ML22067A210

Level 3 PRA Project, Volume 3x: Overview of Reactor, At-Power, Level 1, 2, and 3 PRAs for Internal Events and Internal Floods (Draft)

ML22067A210
Person / Time
Issue date:	04/05/2022
From:	Alan Kuritzky NRC/RES/DRA/PRAB
To:
Kuritzky, Alan - 301 415 1552
Shared Package
ML22067A194	List: ML22067A210 ML22067A211 ML22067A212 ML22067A213 ML22067A214 ML22067A215
References
Download: ML22067A210 (66)

Text

U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project

Volume 3x: Overview of Reactor, At-Power, Level 1, 2, and 3 PRAs for Internal Events and Internal Floods

Draft Report for Comment

Manuscript Completed: March 2022 Date Published: April 2022

Prepared by:

S. Sancaktar1 J. Wood1 A. Kuritzky1 M. Gonzalez1 S. Dennis1 D. Hudson2 A. Hathaway1 K. Compton1

1U.S. Nuclear Regulatory Commission

2Formerly with the U.S. Nuclear Regulatory Commission

A. Kuritzky, NRC Level 3 PRA Project Program Manager Office of Nuclear Regulatory Research

ABSTRACT

The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk analysis (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant, responding to Commission direction in the staff requirements memorandum (SRM) (Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) resulting from SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment (PRA) Activities (ADAMS Accession No. ML11090A039).

As described in SECY-11-0089, the objectives of the L3PRA project are to:

• Develop a Level 3 PRA, generally based on current state-of-practice methods, tools, and data,0F1 that (1) reflects technical advances since the last NRC-sponsored Level 3 PRAs (NUREG-11501F2), which were completed over 30 years ago, and (2) addresses scope considerations that were not previously considered (e.g., low power and shutdown [LPSD]

risk, multi-unit risk, other radiological sources)

• Extract new insights to enhance regulatory decision-making and to help focus limited NRC resources on issues most directly related to the agencys mission to protect public health and safety

• Enhance PRA staff capability and expertise and improve documentation practices to make PRA information more accessible, retrievable, and understandable

• Demonstrate technical feasibility and evaluate the realistic cost of developing new Level 3 PRAs

The scope of the L3PRA project encompasses all major radiological sources on the site (i.e.,

reactors, spent fuel pools, and dry cask storage), all internal and external hazards, and all modes of plant operation. Fresh nuclear fuel, radiological waste, and minor radiological sources (e.g., calibration devices) are not included as part of the scope. In addition, deliberate malevolent acts (e.g., terrorism and sabotage) are excluded from the scope of this study.

This report, one of a series of reports documenting the models and analyses supporting the L3PRA project, provides an overview of the reactor, at-power, Level 1, 2, and 3 PRA models for internal events and internal floods. Licensee information used for the L3PRA project was voluntarily provided based on a licensed, operating nuclear power plant. In some instances, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models used in its regulatory decision-making.

1 State -of-practice methods, tools, and data refer to those that are routinely used by the NRC and industry or have acceptance in the PRA technical community. While the L3PRA project is intended to be a state-of -practice study, note that there are several technical areas within the project scope that necessitated advancements in the state-of -

practice (e.g., modeling of multi -unit site risk, modeling of spent fuel in pools or casks, and of human reliability analysis for other than internal events and inter nal fires).

2 NUREG -1150, Severe Accident Risk: An Assessment for Five U.S. Nuclear Power Plants, December 1990.

iii The information provided by the licensee reflects the reference plant as it was designed and operated as of 2012. In order to provide results and insights better aligned with the current design and operation of the reference plant, this report also provides a reevaluation of the plant risk based on a set of new plant equipment and PRA model assumptions for all three PRA levels. This reevaluation reflects the current reactor coolant pump (RCP) shutdown seal design at the reference plant, as well as the potential impact of FLEX strategies,2F3 both of which reduce the risk to the public.

The results of the original L3PRA project analyses and the reevaluation both show that, when considering internal events and floods, the combination of this plant design and site location has substantial margin to the quantitative health objectives related to the NRCs safety goal policy.3F4 Even though these margins can vary for other plants due to variations in their design and siting, the estimates derived for the reference plant, when adjusted for siting and design variations, would provide useful qualitative risk insights for other U.S. operating plants.

A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources. Furthermore, some future advanced light water reactor (ALWR) and advanced non-light water reactor (NLWR) applicants may rely heavily on results of analyses similar to those used in the L3PRA project to establish their licensing basis and design basis by using the Licensing Modernization Project (LMP) (NEI 18-04, Rev. 1) which was recently endorsed via RG 1.233. Licensees who use the LMP framework are required to perform Level 3 PRA analyses. Therefore, another potential use of the methodology and insights generated from this study is to inform regulatory, policy, and technical issues pertaining to ALWRs and NLWRs.

CAUTION: While the L3PRA project is intended to be a state-of-practice study, due to limitations in time, resources, and plant information, some technical aspects of the study were subjected to simplifications or were not fully addressed. As such, inclusion of approaches in the L3PRA project documentation should not be viewed as an endorsement of these approaches for regulatory purposes.

3 FLEX refers to the U.S. nuclear power industry's proposed safety strategy, called Diverse and Flexible Mitigation Capability. FLEX is intended to maintain long-term core and spent fuel cooling and containment integrity with installed plant equipment that is protected from natural hazards, as well as backup portable onsite equipment. If necessary, similar equipment can be brought from offs ite.

4 U.S. NRC, Safety Goals for the Operations of Nuclear Power Plants, Policy Statement, Republication (51 FR 30028), Federal Register, 1986.

iv FOREWORD

The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk analysis (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant, responding to Commission direction in the staff requirements memorandum (SRM) (Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) resulting from SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment (PRA) Activities (ADAMS Accession No. ML11090A039).

Licensee information used in performing the Level 3 PRA project was voluntarily provided based on a licensed, operating nuclear power plant. The information provided reflects the plant as it was designed and operated as of 2012 and does not reflect the plant as it is currently designed, licensed, operated, or maintained. In addition, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models used in its regulatory decisionmaking. As such, use of L3PRA project reports to assess the risk from the reference plant is not appropriate and these reports will not be the basis for any regulatory decision associated with the reference plant.

Each set of L3PRA project reports covering the Level 1, 2, and 3 PRAs for a specific site radiological source, plant operating state, and hazard group is accompanied by an overview report. The overview reports summarize the results and insights from all three PRA levels. This current document is the overview report for the reactor, at-power, Level 1, 2, and 3 PRAs for internal events and internal floods.

In order to provide results and insights better aligned with the current design and operation of the reference plant, the overview reports also provide a reevaluation of the plant risk based on a set of new plant equipment and PRA model assumptions and compare the results of the reevaluation to the original study results. This reevaluation reflects the current reactor coolant pump (RCP) shutdown seal design at the reference plant, as well as the potential impact of FLEX strategies,4F5 both of which reduce the risk to the public.

A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources (i.e., spent fuel in pools and dry storage casks).

These insights may be used to further enhance the regulatory framework and decisionmaking and to help focus limited agency resources on issues most directly related to the agencys mission to protect public health and safety. More specifically, potential future uses of the Level 3 PRA project can be categorized as follows (a more detailed list is provided in SECY 0123, Update on Staff Plans to Apply the Full-Scope Site Level 3 PRA Project Results to the NRCs Regulatory Framework, dated September 13, 2012):

• enhancing the technical basis for the use of risk information (e.g., obtaining updated and enhanced understanding of plant risk as compared to the Commissions safety goals)

5 FLEX refers to the U.S. nuclear power industry's proposed safety strategy, called Diverse and Flexible Mi tigation Capability. FLEX is intended to maintain long-term core and spent fuel cooling and containment integrity with installed plant equipment that is protected from natural hazards, as well as backup portable onsite equipment. If necessary, similar eq uipment can be brought from offsite.

v

• improving the PRA state of practice (e.g., demonstrating new methods for site risk assessments, which may be particularly advantageous in addressing the risk from advanced reactor designs, a multi-unit accident, or an accident involving spent fuel; and using PRA information to inform emergency planning)

• identifying safety and regulatory improvements (e.g., identifying potential safety improvements that may lead to either regulatory improvements or voluntary implementation by licensees)

• supporting knowledge management (e.g., developing or enhancing in-house PRA technical capabilities)

In addition, the overall Level 3 PRA project model can be exercised to provide insights with regard to other issues not explicitly included in the current project scope (e.g., security-related events or the use of accident tolerant fuel). Furthermore, s ome future advanced light water reactor (ALWR) and advanced non-light water reactor (NLWR) applicants may rely heavily on the results of analyses similar to those used in the L3PRA project to establish their licensing basis and design basis by using the Licensing Modernization Project (LMP) (NEI 18-04, Rev. 1) which was recently endorsed via RG 1.233. Licensees who use the LMP framework are required to perform Level 3 PRA analyses. Therefore, another potential use of the methodology and insights generated from this study is to inform regulatory, policy, and technical issues pertaining to ALWRs and NLWRs.

The results and perspectives from this report, as well as all other reports prepared in support of the Level 3 PRA project, will be incorporated into a summary report to be published after all technical work for the Level 3 PRA project has been completed.

vi TABLE OF CONTENTS

ABSTRACT................................................................................................................................ iii FOREWORD.............................................................................................................................. v LIST OF FIGURES.................................................................................................................... ix LIST OF TABLES....................................................................................................................... xi ABBREVIATIONS AND ACRONYMS...................................................................................... xiii 1 INTRODUCTION............................................................................................................. 1-1 2 KEY MESSAGES............................................................................................................. 2-1 3

SUMMARY

OF RESULTS AND INSIGHTS..................................................................... 3-1 3.1 Level 1 PRA.............................................................................................................. 3-1 3.1.1 Results of Circa-2012 and 2020 -FLEX Cases............................................... 3-1 3.1.2 Results of Alternative Analyses.......................................................................... 3-2 3.1.3 Initial Insights..................................................................................................... 3-3 3.2 Level 2 PRA............................................................................................................ 3-12 3.2.1 Results of Circa-2012 and 2020 -FLEX Cases............................................. 3-12 3.2.2 Results of Alternative Analyses........................................................................ 3-13 3.2.3 Initial Insights................................................................................................... 3-17 3.3 Level 3 PRA............................................................................................................ 3-30 3.3.1 Results of Circa-2012 and 2020 -FLEX Cases............................................. 3-30 3.3.2 Results of Alternative Analyses........................................................................ 3-32 3.3.3 Initial Insights................................................................................................... 3-33 4 KEY ASSUMPTIONS, CONSIDERATIONS, AND UNCERTAINTIES FOR THE 2020 -FLEX CASE...................................................................................................................................... 4-1 4.1 Level 1 PRA.............................................................................................................. 4-1 4.1.1 Key Assumptions............................................................................................... 4-1 4.1.2 Key Uncertainties............................................................................................... 4-2 4.2 Level 2 PRA.............................................................................................................. 4-3 4.2.1 Key Assumptions............................................................................................... 4-3 4.2.2 Additional Considerations.................................................................................. 4-4 4.2.3 Key Uncertainties............................................................................................... 4-5 4.3 Level 3 PRA.............................................................................................................. 4-7 5 REFERENCES................................................................................................................ 5-1

vii

LIST OF FIGURES

Figure 3.1-1 CDF Percentages by Initiating Event Groups for Circa-2012 Case................. 3-7 Figure 3.1-2 CDF Percentages by Initiating Event Groups for 2020- FLEX Case................ 3-8 Figure 3.1-3 Parametric Uncertainty Results for 2020-FLEX Case..................................... 3-9 Figure 3.2-1 Comparison of Release Category Frequencies for 2020-FLEX and Circa-2012 Cases........................................................................................................... 3-22 Figure 3.2-2 Comparison of Percent Contribution to Total Release Frequency for 2020-FLEX and Circa-2012 Cases.................................................................................. 3-22 Figure 3.3-1 Release Category Contribution to the 0- 1.8-mile Population-Weighted Early Fatality Risk Using Mean Release Category Frequencies (Circa-2012)........ 3-36 Figure 3.3-2 Release Category Contribution to the 0 -1.8-mile Population-Weighted Early Fatality Risk Using Mean Release Category Frequencies (2020-FLEX)....... 3-36 Figure 3.3-3 Release Category Contribution to the 10- mile Population-Weighted Latent Cancer Fatality Risk Using Mean Release Category Frequencies (Circa 2012)................................................................................................. 3-37 Figure 3.3-4 Release Category Contribution to the 10- mile Population-Weighted Latent Cancer Fatality Risk Using Mean Release Category Frequencies (2020 FLEX)................................................................................................. 3-37 Figure 3.3-5 Individual Early Fatality Risk (0- 1.8 miles).................................................... 3-38 Figure 3.3-6 Individual Latent Cancer Fatality Risk (0- 10 miles)....................................... 3-38

ix

LIST OF TABLES

Table 3.1-1 CDF by Initiating Event................................................................................. 3-10 Table 3.1-2 Additional Cases and Comparisons.............................................................. 3-11 Table 3.2-1 Description of Release Categories............................................................... 3-23 Table 3.2-2 Release Category Frequency Results.......................................................... 3-24 Table 3.2-3 Level 2 PRA Surrogate Risk Metric Results.................................................. 3-24 Table 3.2-4 2020- FLEX Parameter Uncertainty Propagation Results by Release Category and Surrogate Risk Metric............................................................................ 3-25 Table 3.2-5 Level 2 PRA Representative Accident Scenario Timelines........................... 3-26 Table 3.2-6 Level 2 PRA Surrogate Risk Metric Results - 2020- FLEX Case................... 3-28 Table 3.2-7 2020- FLEX Level 2 PRA Surrogate Risk Metric Results for Alternative Accident Recovery Assumptions................................................................................. 3-29 Table 3.3-1 Population-Weighted Early Fatality Risk, by Release Category, for the 0 to 1.8 mile Interval for the Circa-2012 and 2020- FLEX Cases................................ 3-39 Table 3.3-2 Population-Weighted Latent Cancer Fatality Risk, by Release Category, for the 0 to 10- mile Interval for the Circa-2012 and 2020-FLEX Cases.................... 3-39

xi

ABBREVIATIONS AND ACRONYMS

AC Alternating current ACCW Auxiliary component cooling water AFW Auxiliary feedwater AOP Abnormal occurrence procedure ARV Atmospheric relief valve BDBEE Beyond-design-basis external event BE Basic event CCDP Conditional core damage probability CCF Common-cause failure CCFP Conditional containment failure probability CDF Core damage frequency CST Condensate storage tank DC Direct current DG Diesel generator ECCS Emergency core cooling system ELAP Extended loss of all AC power EOP Emergency operating procedure EPA Environmental Protection Agency ET Event tree FIP Final integrated plan FLEX Diverse and flexible coping (strategy)

FSG FLEX strategy guideline FT Fault tree FV Fussell-Vesely (importance measure)

GE General emergency HPS Health Physics Society HRA Human reliability analysis IE Initiating event ISLOCA Interfacing systems LOCA L3PRA project Level 3 PRA project LERF Large early release frequency LNT Linear no-threshold LOCA Loss-of-coolant accident LOOP Loss of offsite power LRF Large release frequency MCR Main control room MSIV Main steam isolation valve MSRV Main steam relief valve NRC U.S. Nuclear Regulatory Commission NSCW Nuclear service cooling water PAG Protective action guideline

xiii PORV Power-operated relief valve PRA Probabilistic risk assessment QHO Quantitative health objective RAT Reserve auxiliary transformer RCP Reactor coolant pump RCS Reactor coolant system RHR Residual heat removal RMWST Refueling makeup water storage tank rcy Reactor-critical-year SAMG Severe accident management guideline SBO Station blackout SDS Shutdown seal SG Steam generator SGTR SG tube rupture SIG Strategy implementation guide SOARCA State-of-the-art consequence analyses SPAR Standardized Plant Analysis Risk (model)

SRV Safety relief valve TB Turbine building TDAFW Turbine-driven AFW

xiv 1 INTRODUCTION

The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk analysis (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. Licensee information used in performing the L3 PRA project was voluntarily provided based on a licensed, operating nuclear power plant. The information provided reflects the plant as it was designed and operated as of 2012 and does not reflect the plant as it is currently designed, licensed, operated, or maintained. In addition, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models used in its regulatory decisionmaking. As such, use of this report to assess the risk from the reference plant is not appropriate and this report will not be the basis for any regulatory decision associated with the reference plant.

The series of reports for the L3PRA project are organized as follows:

Volume 1: Summary (to be published last)

Volume 2: Background, site and plant description, and technical approach

Volume 3: Reactor, at-power, internal event and flood PRA Volume 3x: Overview Volume 3a: Level 1 PRA for internal events (Part 1 - Main Report; Part 2 - Appendices)

Volume 3b: Level 1 PRA for internal floods Volume 3c: Level 2 PRA for internal events and floods Volume 3d: Level 3 PRA for internal events and floods

Volume 4: Reactor, at-power, internal fire and external event PRA Volume 4x: Overview Volume 4a: Level 1 PRA for internal fires Volume 4b: Level 1 PRA for seismic events Volume 4c: Level 1 PRA for high wind events and other hazards evaluation Volume 4d: Level 2 PRA for internal fires and seismic and wind-related events Volume 4e: Level 3 PRA for internal fires and seismic and wind-related events

Volume 5: Reactor, low power and shutdown, internal event PRA Volume 5x: Overview Volume 5a: Level 1 PRA for internal events Volume 5b: Level 2 PRA for internal events Volume 5c: Level 3 PRA for internal events

Volume 6: Spent fuel pool all hazards PRA Volume 6x: Overview Volume 6a: Level 1 and Level 2 PRA Volume 6b: Level 3 PRA

Volume 7: Dry cask storage, all hazards, Level 1, Level 2, and Level 3 PRA

Volume 8: Integrated site risk, all hazards, Level 1, Level 2, and Level 3 PRA

1-1 The original L3PRA project models are referred to as the Circa-2012 case and a description of the plant as modeled is given in Volume 2 (NRC, 2020a). Volumes 3a (NRC, 2020b) and 3b (NRC, 2020c) were created to document the L3PRA project Level 1 PRA models and analyses for internal events and internal flooding during power operation for the Circa-2012 case.

Additionally, Volumes 3c (NRC, 2020d) and 3d (NRC, 2020e) were created to document the corresponding Level 2 and Level 3 PRA models and analyses. As indicated in the list above, other volumes address the risk contributions from other hazards, other plant operating states, and other site radiological sources (i.e., spent fuel pools and dry storage casks).

In response to NRC Order EA-12-0049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, licensees submitted a Final Integrated Plan (FIP) that provides strategies to maintain or restore core cooling, containment, and spent fuel pool cooling capabilities. Although FIP documents focus on beyond-design-basis external events, the associated FLEX strategies and equipment are applicable for internal events and internal floods, per emergency operating proc edures and abnormal occurrence procedures.

This document includes a ree valuation of the plant risk based on a set of new plant equipment and PRA model assumptions for all three PRA levels. This reevaluation is referred to as the 2020- FLEX case (see Section 4.1.1 for a brief s ummary of the major modeling changes). The scope of the reevaluation in this document is limited to internal events and internal flooding during power operation for a single unit.

Section 2 provides key messages from the reactor, at-power, Level 1, 2, and 3 PRAs for internal events and internal floods, while Section 3 provides a summary of the results and insights from these analyses, including comparisons between the Circa-2012 and 2020-FLEX cases. Section 4 documents key modeling assumptions, considerations, and uncertainties associated with the 2020- FLEX case.

Note, it is anticipated that the models and results of the L3PRA project are likely to evolve over time, as other parts of the project are developed, or as other technical issues are identified. As such, the final models and results of the project ( which will be documented in the Volume 1 summary report after all technical work for the Level 3 PRA project has been completed) may differ in some ways from the models and results provided in the current report.

CAUTION: While the L3PRA project is intended to be a state-of-practice study, due to limitations in time, resources, and plant information, some technical aspects of the study were subjected to simplifications or were not fully addressed. As such, inclusion of approaches in the L3PRA project documentation should not be viewed as an endorsement of these approaches for regulatory purposes.

1-2 2 KEY MESSAGES

This section provides some of the key messages resulting from the reac tor, at-power, Level 1, 2, and 3 PRAs for internal events and internal floods for a single unit. Table 2-1 summarizes some of the key risk metrics and surrogate risk metrics that were quantified as part of the analyses. In this table, results are provided for both the Circa-2012 case and the 2020- FLEX case for the surrogate risk metrics of core damage frequency (CDF), large early release frequency (LERF), and large release frequency (LRF), as well as for the two quantitative health objectives (QHOs) associated with the NRCs safety goal policy (NRC, 1986). Overall, the results show that the combination of this plant design and site location has substantial margin to the QHOs when considering internal events and floods.

Table 2-1 Summary of Risk Metric Results

Risk Metric Circa-2012 2020-FLEX Risk Metric (per reactor-critical-year) Case Case Reduction Core damage frequency 6.5E-05 2.7E-05 59%

Large early release frequency 9.3E-07 5.7E-07 39%

Large release frequency 4.4E-05 1.7E-05 60%

Individual early fatality risk5F6 ~0 ~0 Individual latent cancer fatality risk 2.6E-08 9.6E-09 63%

Level 1 PRA for internal events and internal floods:

• The CDF from internal events and internal floods is 6.5x10-5 per reactor-critical-year (rcy ).

• Internal floods are a very minor contributor (approximately 1 percent of internal event CDF).

• The core damage profile is dominated by loss of offsite power (LOOP), due primarily to assumptions regarding recovery of alternating current (AC) power.

• The next largest contributor to CDF is loss of nuclear service cooling water ( NSCW).

• For the 2020-FLEX case, CDF for internal events and internal floods is reduced by approximately 60% to 2.7x10-5/rcy. This significant reduction occurs because the CDF for the reference plant is dominated by LOOP and NSCW sequences, both of which benefit significantly from the types of measures incorporated into the 2020-FLEX case.

Level 2 PRA for internal events and internal floods:

• A very small fraction of CDF leads to large early release (approximately 1 percent).

• A relatively large fraction of CDF results in later containment failure (approximately 64 percent).

o Late, large release does not result in any prompt fatalities, but can result in latent cancer fatalities and economic consequences.

6 The actual calculated individual early fatality risk for the Circa-2012 case is 3.4x10 -13/rcy. For the 2020-FLEX case, the actual calculated individual early fatality risk is 3.2x10-13/rcy (a reduction of 6 percent).

2-1

• The frequency of late, large releases is highly dependent on the severe accident progression modeling time.

o The L3PRA base case models severe accident progression for 7 days after accident initiation (with no credit for longer-term recovery actions, such as venting, steam-inerting, or implementing FLEX to restore electrical power).

o Reducing modeling time to approximately 2 days after accident initiation reduces late containment failure to less than 20 percent of CDF. This demonstrates that significant reductions in risk can occur if credible mitigative actions can be successfully implemented in this timeframe.

Level 3 PRA for internal events and internal floods:

• Early fatality risks to individuals (when considering just internal events and internal floods for the reactor, at-power) are far below the QHO associated with the safety goals (due primarily to sufficient warning times for effective evacuation).

o The frequency of exceeding one early fatality within 50 miles of the plant is calculated to be less than once every 100 billion years (with large uncertainty).

o For the 2020-FLEX case, there is only minimal change in the population-weighted early fatality risk within 1 mile of the site boundary, since this metric is dominated by interfacing system loss -of-coolant accidents (ISLOCAs), which do not generally benefit from the types of measures incorporated into the 2020-FLEX case.

• Latent fatality risks to individuals (when considering just internal events and internal floods for the reactor, at-power) are well below the QHO associated with the safety goals (due to longer-term relocation of affected populations).

o The frequency of exceeding one latent fatality within 100 miles of the plant site is approximately once every 16,000 years.

o Latent cancer fatalities occur from long-term reoccupation of land and use of the linear no-threshold (LNT) model.

o Radiogenic cancers are still not expected to be statistically detectable above norms.

o Economic impacts arise largely from these longer-term protective measures.

o For the 2020-FLEX case, individual latent cancer fatality risk within 10 miles of the plant is reduced by approximately 63 percent from 2.6x10-8/rcy to 9.7x10 -9/rcy.

o Use of an alternate dose truncation model in place of the LNT model (as described in Section 3.3.2) reduces latent cancer fatality risk by over two orders of magnitude.

2-2 3

SUMMARY

OF RESULTS AND INSIGHTS

This section provides a summary of the results and insights from the reactor, at-power, Level 1, 2, and 3 PRAs for internal events and internal floods for a single unit. In order to provide results and insights that are more reflective of the current design and operation of the reference plant, throughout this section, results of the Circa-2012 case are compared with the results of the 2020- FLEX case.6F7 These comparisons demonstrate how the plant risk profile associated with at-power, internal events and i nternal floods has been influenced by several key plant changes implemented at the reference plant since 2012. The Level 1, Level 2, and Level 3 PRAs are discussed in Sections 3.1, 3.2, and 3.3, respectively.

3.1 Level 1 PRA

This section provides a summary of the results and insights from the reactor, at -power, Level 1 PRA for internal events and internal floods for a single unit. Section 3.1.1 provides the high-level results for both the Circa-2012 and 2020- FLEX cases. Section 3.1.2 discusses several alternative analyses that were performed to better assess the effect of introducing FLEX into the Level 1 PRA model. Section 3.1.3 discusses insights from the reactor, at-power, Level 1 PRA for internal events and internal floods, including a discussion of the dominant contributors to CDF for both the Circa-2012 and 2020 -FLEX cases.

3.1.1 Results of Circa -2012 and 2020 -FLEX Cases

Detailed descriptions of the Circa-2012 Level 1 PRA models and results for internal events and internal flooding during power operation are provided in (NRC, 2020b) and (NRC, 20 20c),

respectively. The total CDF from internal events is reported as 6.4x1 0-5/rcy and the total CDF from internal flooding is reported as 7.9x1 0-7/rcy, for a combined total CDF of 6.5x1 0-5/rcy. A breakdown of this CDF by initiating event groups is provided in Figure 3.1-1.

The 2020- FLEX case updates the Circa-2012 models to include the new RCP seals (shutdown seals) and FLEX strategies and equipment for responding to an extended loss of AC power (ELAP). In addition, if FLEX is not successful, the 2020- FLEX case credits the potential for continued turbine-driven auxiliary feedwater (TDAFW) pump operation given a complete loss of all installed AC and direct current ( DC) power.7F8 Continued TDAFW pump operation given a complete loss of all installed AC and DC power was not credited in the Cir ca-2012 Level 1 PRA models because, as discussed in Section 8.1.2 of (NRC, 2022b), there is a low likelihood of

7 To provide a more straightforward comparison, the results presented in this report for both the Circa-2012 and FLEX-2020 cases are based on the same L3PRA project SAPHIRE -based model version (i.e., SVN -402 for the Level 1 PRA and SVN-404 for the Level 2 and 3 PRAs). As such, the Circa-2012 results presented here may not exactly match those presented in other L3PRA project documentation, which are based on earlier versions of the model. However, the differences are very minima l.

8 In pre-FLEX PRA models, this was often referred to as blind feeding. For a post-FLEX PRA model, the current terminology is used, since for some FLEX failure modes ( e.g., failure of the FLEX steam generator feed pump),

FLEX may still be able to provide control power for continued TDAFW pump operation. However, it is acknowledged that, in most instances, continued operation of TDAFW requires recovery of some form of installed AC power earlier than the time required to bring in offsite resources. The human error probabilities assigned to the basic events representing failure to successfully implement FLEX or continued TDAFW pump operation include the possibility of not recovering installed AC power in a timely manner.

3-1 success for this action and, even if successful, the plant would not be in a stable condition (without the FLEX equipment and strategies).

The installation of the shutdown seals affects (positively) all sequences where RCP seal leakage occurs. The FLEX strategies, as well as continued TDAFW pump operation given a complete loss of all installed AC and DC power, are only credited in the modeling of station blackout (SBO) accident sequences. General modeling assumptions and considerations associated with the 2020 -FLEX case are addressed in Section 4.

The total CDF for the 2020- FLEX case for internal events and internal flooding during power operation is estimated to be 2.7x1 0-5/rcy. A breakdown of this CDF by initiating event groups is provided in Figure 3.1-2.

The CDF from internal events and internal flooding is reduced by 59 percent when the FLEX-related changes (including the RCP shutdown seals and continued operation of TDAFW pumps) are included in the L3PRA model. The impact on individual initiating events can be seen in Table 3.1-1, which compares the results for the two models (Circa-2012 and 2020- FLEX) for the most risk-significant individual initiating events from the Circa-2012 model.8F9

A parametric uncertainty analysis for the 2020-FLEX case was performed, which addresses the uncertainties associated with all basic events in the model. A summary of the results is given in Figure 3.1-3. The range of the output distribution (95th/5th) is 8.4. This is considered to be a tight distribution. The relatively large number of basic events and cutsets used in the parametric uncertainty analysis is deemed to dilute (mask) the effect of those few basic events with higher uncertainties. To test this hypothesis, a parametric uncertainty analysis was performed using only the CDF cutsets from the LOOPWR (weather-related LOOP) initiating event. For this case, the range almost doubled to a value of 16.

The results of parametric uncertainty only provide limited insights due to the reason stated above. However, greater insights can be obtained by focusing on modeling uncertainty; in particular, as related to the values of the three basic events introduced in 2020- FLEX case.

Such modeling uncertainty analyses were performed and are documented in the following section, where CDFs of various cases were quantified and compared.

3.1.2 Results of Alternative Analyses

Several alternative analyses were performed to better assess the effect on plant CDF of introducing FLEX into the model. The results of these analyses are reported in Table 3.1-2.

Case 1 is the Circa -2012 case (no RCP shutdown seals or FLEX strategies).

Case 2 introduces the RCP shutdown seals into the model, but no FLEX strategies.

Cases 3, 4, 5, and 6 examine the effect of the FLEX failure probability on the model after RCP shutdown seals are introduced. The purpose of the additional cases is to acknowledge the

9 The L3PRA model is continuously being revised (improved) as the project progresses. CDF values for the Circa-2012 case were obtained from the latest available version of the L3PRA CDF model as of the writing of this report (SVN-402). Also, for the results presented in this report, a truncation limit of 10 -12/rcy was used, while a truncation limit of 10 -11/rcy was used for the results presented in references (NRC, 2020b-e). As such, there may be minor differences in the values presented for the Circa-2012 case in this report and those given in the references.

3-2 large uncertainty associated with the basic events introduced to model the FLEX-2020 case and to examine the robustness of the results in light of this uncertainty. The results of these alternative cases demonstrate that the selected failure probabilities for FLEX and continued operation of TDAFW (Case 4) are reasonable and do not unduly influence the total CDF for internal events and internal floods. For all these cases, the failure probability of the shutdown seals is kept constant, but the failure probabilities for FLEX and TDAFW operation are varied.

The results are summarized in Table 3.1-2. The table also shows the values of the parameter "p" defined as the joint failure probability assigned to FLEX implementation and continued operation of the TDAFW pump (if FLEX is not successful). This joint failure probability is 0.09 in the 2020-FLEX case.

The failure probabilities used for FLEX and manual TDAFW pump operations are parametric values chosen by expert judgement, based on PRA experience, and specific experience with construction of NRCs 70 Standardized Plant Analysis Risk (SPAR) models. The cases studied with different parametric values are used to support the assertion that the selected base case values are reasonable and they do not shift the results unduly in either direction; that is, there is no p value that could have shifted the CDF an order of magnitude either way. This assertion is supported by the results provided in Table 3.1-2, which shows a narrow spread of 2.7 (6.47/2.37) between total failure and total success of the three basic events modeled.

The results of the case studies indicate that even with a perfect FLEX the CDF from internal events and internal floods is limited to a 63 percent reduction. The results also indicate that even if the failure probabilities for FLEX implementation and continued operation of the TDAFW pump (if FLEX is not successful) are each raised from 0.3 to 0.5, the percentage of CDF reduction would only drop from 59 percent to 51 percent.

Based on the results of these case studies, the 2020- FLEX case (Case 4) appears to be a reasonable choice to be further studied as part of the Level 2 and Level 3 PRA analyses.

Case 4 is equivalent to assigning FLEX (including continued operation of TDAFW) an overall success probability of 91 percent, applicable to those ELAP sequences where FLEX can be utilized.9F10

It should also be noted that the results of the case studies indicate that for the purposes of the L3PRA project, there would be very little value in performing a more rigorous and detailed assessment of the FLEX failure probability.

3.1.3 Initial Insights

As discussed in the previous section, the 2020-FLEX case is equivalent to assigning FLEX (including continued operation of TDAFW) an overall success probability of 0.91, applicable to those ELAP sequences where FLEX can be utilized. Even with a lower success probability of 0.75, Table 3.1-2 shows that imple mentation of FLEX and continued operation of TDAFW, coupled with the installed RCP shutdown seals, results in a factor of 2 reduction of the CDF from internal events and internal flooding during power operation.

10 It is acknowledged that the probability of FLEX failure may be higher for weather -related LOOP events; however, the higher failure probability would not significantly increase total CDF for the 2020-F LEX case and much of the weather-related LOOP contribution is separately accounted for in the L3PRA project high wind PRA.

3-3 The CDF in the Circa-2012 case is dominated by LOOP events (primarily, SBO and SBO -like sequences10F11), which collectively contribute over 60 percent to total internal event and internal flooding CDF. In the 2020- FLEX case, total LOOP CDF (combining all four modeled causes of LOOP) is reduced from 3.95x1 0-5/rcy to 1.24x1 0-5/rcy, since the new RCP shutdown seals, back-up power capabilities of FLEX, and the continued operation of TDAFW all help to mitigate SBO sequences. However, LOOP events are still the dominant contributor to CDF in the 2020 -

FLEX case, though they now contribute slightly under half (47 percent) of total CDF from internal events and internal flooding. Most of the LOOP CDF in the 2020 -FLEX case arises from operator failure to restore systems after AC power is recovered following an SBO or from failure to successfully implement FLEX strategies (including continued operation of TDAFW under extended SBO conditions11F12).

The second largest contributor to CDF in the Circa-2012 case is loss of NSCW, contributing 13.5 percent to total internal event and internal flooding CDF. In the 2020-FLEX case, CDF for loss of NSCW is reduced by 83 percent ( from 8.76x10-6/rcy to 1.47 x10-6/rcy). Since most loss of NSCW sequences involve an RCP seal los s-of-coolant accident (LOCA), the new RCP shutdown seals are the primary reason for this significant reduction. Accordingly, loss of NSCW goes from contributing 13.5 percent to CDF in the Circa-2012 case to 5.5 percent in the 2020-FLEX case and is now superseded by several other initiating event categories in terms of contribution to total CDF, as shown in Figure 3.1-2.

The second largest contributor to CDF in the 2020- FLEX case is medium LOCA. The medium LOCA CDF is 2.34x10-6/rcy, contributing 8.7 percent to total internal event and internal flooding CDF. The medium LOCA CDF is the same in both the Circa-2012 and 2020- FLEX cases, since, as discussed in Section 4.1, FLEX strategies are only incorporated into the model if an ELAP is declared (i.e., FLEX stra tegies and equipment cannot be used to satisfy PRA success criteria for LOCA events).

The third largest individual initiating event contributor to CDF for the 2020 -FLEX case is loss of 4.16kv AC safety-related bus A. When combined with the loss of 4.16kv A C safety-related bus B as an initiating event, the CDF from these two initiators is 2.24x1 0-6/rcy, contributing 8.4 percent to total internal event and internal flooding CDF. Similar to the medium LOCA, the CDF for loss of a 4.16kv AC safety-related bus is essentially the same in both the Circa -2012 and 2020- FLEX cases, but its relative importance to total CDF i s increased due to the reduction in total CDF for the 2020-FLEX case. It should be noted that examination of the top contributing cutsets for loss of either 4.16kv AC safety-related bus A or B shows that they would all be recoverable through implementation of the FLEX strategies. As discussed in Section 4.1, credit for FLEX for accident sequences that do not propagate through the SBO event tree was applied manually (using post-processing rules) and this process was not extended to the level of detail needed to address these particular cutsets, since the additional recovery credit would not significantly influence the insights from the study.

11 SBO sequences refer to sequences that involve the complete loss of AC electric power to both safety -related and nonsafety-related switchgear buses (i.e., loss of both offsite and onsite AC power). SBO -like sequences refer to sequences where AC power is lost to all safety -rel ated switchgear buses, though offsite AC power may remain available to nonsafety -related switchgear buses. In terms of plant response to a modeled PRA initiating event, SBO-like sequences progress very similarly to SBO sequences.

12 In this context, extended SBO conditions is equivalent to (and short -hand for) loss of all installed AC and DC power, since an extended SBO will eventually result in loss of all DC power due to the loss of battery charging capability.

3-4 To gain insight into the relative risk significance of individual basic events for the 2020-FLEX case, they were ranked by Fussell-Vesely importance. From this ranking, the most risk-significant basic event is operator failure to restore systems after AC power is recovered following an SBO, which contributes over 25 percent to total CDF from internal events and internal flooding. The human error probability for this action (5.7x10-2), which was taken directly from the licensees PRA, is dominated by execution failure (rather than cognition failure) due to the large number of steps that must be accomplished. Also, in cases where offsite AC power is recovered following an SBO, no ELAP is declared, so no credit is given for FLEX.

The next most risk-significant basic events (excluding initiating events) are independent failure of emergency DGs 1A and 1B to run for the 24-hour mission time, contributing approximately 18 percent and 16 percent, respectively, to total CDF from internal events and internal flooding.

These basic events generally appear in cutsets that also contain the operator failure described in the previous paragraph. The risk significance of these DG failures (as well as other failures of the onsite emergency AC power system) is consistent with the risk significance of LOOP, both as an initiator and as a consequential event (see below).

The fourth most risk-significant basic event (again, excluding initiating events) is a consequential LOOP following a transient, which contributes over 13 percent to total CDF from internal events and internal flooding. As discussed in Section 8.2.2 of (NRC, 2020b), following a reactor trip, the offsite electrical grid is taxed not only by the loss of voltage support from the reactor, but also due to the transfer of plant non-safety loads from the unit auxiliary transformer to the reserve auxiliary transformers (RATs), which are supplied from the offsite grid. Since, as discussed previously, FLEX credit has been manually applied to many cutsets that involve consequential LOOP following a transient, the majority of the remaining contribution comes from cutsets that either (1) involve failures that are not recoverable using FLEX or (2) were not addressed through the manual application of FLEX credit through post-processing rules.

The only other basic events (besides initiating events) that contribute at least 10 percent to total CDF from internal events and internal flooding are the basic events that represent (1) failure to declare ELAP or successfully implement FLEX or (2) failure to continue TDAFW under extended SBO conditions. Each of these basic events, which always occur in cutsets together, contributes approximately 11 percent to CDF.

There are also two basic events that represent failure to trip the RCPs following a reactor trip and coincident or subsequent loss of all RCP seal injection and cooling. Separate human error probabilities are included for this event for loss of NSCW and for all other initiating events due to the significant difference in time available to complete this action for these two cases.

Collectively, these two events contribute approximately 11 percent to total CDF from internal events and internal flooding.

Finally, it is interesting to note that the next two most risk-significant basic events are common-cause failure (CCF) of the two RAT breakers to open following a LOOP and CCF of the DG load sequencers to operate following a LOOP. These are the two most risk-significant basic events in the Circa-2012 model, collectively contributing nearly one-third of total internal event CDF.

However, because the cutsets involving either of these failures are typically recoverable using FLEX, their respective contribution to CDF has been significantly reduced in the 2020- FLEX model.

In summary, incorporating the new RCP shutdown seals, credit for FLEX strategies and equipment, and continued TDAFW operation under extended SBO conditions into the Level 1

3-5 PRA model has reduced total CDF from internal events and internal flooding by nearly 60 percent. This CDF reduction is relatively insensitive to the specific failure probabilities assigned to FLEX and continued TDAFW operation. LOOP events are still the major risk contributor to CDF, though there have been significant changes in the relative importance of different basic events to the LOOP CDF. In addition, the risk significance of loss of NSCW has been greatly diminished due primarily to the installation of the new RCP shutdown seals.

3-6 CDF % CIRCA-2012 CASE (6.5E-5/rcy)

INTERNAL FLOODING, 1.2% SG TUBE RUPTURE, 0.2%

STEAMLINE BREAKS, 2.6%

LOSS OF NSCW,a 13.5%

LOSS OF 4.16KV BUS, 3.6%

LOCAS, 4.2% LOSS OF OFFSITE OTHER INTERNAL POWER, 61.2%

EVENTS,c 4.8%

TRANSIENTS,b 8.6%

a NSCW - nuclear service cooling water

b The initiating event group Transients includes the following initiating events: reactor trip, turbine trip, loss of main feedwater, loss of condenser h eat sink, and other transients.

c The initiating event group Other Internal Events includes the following initiating events: loss of seal injection, loss of two out of four 120V AC panels, loss of one of two 125V DC safety buses, loss of auxiliary component cooling water, loss of instrument air, inadvertent safety injection, interfacing systems LOCA.

Figure 3.1-1 CDF Percentages by Initiating Event Groups for Circa-2012 Case

3-7 CDF % 2020- FLEX CASE (2.7E-05/rcy)

INTERNAL STEAMLINE FLOODING, 2.4% SG TUBE BREAKS, 4.5% RUPTURE, 0.5%

LOSS OF NSCW,a 5.5%

LOSS OF 4.16KV BUS, 8.4%

LOSS OF OFFSITE POWER, 46.6%

LOCAS, 10.1%

OTHER INTERNAL EVENTS,c 10.6%

TRANSIENTS,b 11.3%

a NSCW - nuclear service cooling water

b The initiating event group Transients includes the following initiating events: reactor trip, turbine trip, loss of main feedwater, loss of condenser heat sink, and other transients.

c The initiating event group O ther Internal Events includes the following initiating events: loss of seal injection, loss of two out of four 120V AC panels, loss of one of two 125V DC safety buses, loss of auxiliary component cooling water, loss of instrument air, inadvertent safety i njection, interfacing systems LOCA.

Figure 3.1-2 CDF Percentages by Initiating Event Groups for 2020- FLEX Case

3-8 Figure 3.1-3 Parametric Uncertainty Results for 2020-FLEX Case

3-9 Table 3.1-1 CDF by Initiating Event*

Initiating Event Description Circa-2012 2020- FLEX CDF CDF (/rcy) CDF (/rcy) Reduction

Loss of Offsite Power (Grid-Related) 1.83E-05 5.60E-06 69.4%

Loss of Offsite Power (Switchyard-Centered) 1.03E-05 3.93E-06 62.0%

Loss of Offsite Power (Weather-Related) 9.01E-06 2.19E-06 75.7%

Loss of Nuclear Service Cooling Water 8.76E-06 1.47E-06 83.2%

Other Transient 2.53E-06 1.34E-06 47.1%

Medium LOCA 2.34E-06 2.34E-06 0.00%

Loss of Offsite Power (Plant-Centered) 1.91E-06 7.25E-07 62.0%

Secondary-Side Break Outside o f MSIVs 1.59E-06 1.12E-06 29.1%

Loss of 4.16kv Bus A 1.43E-06 1.40E-06 2.1%

Turbine Trip 1.07E-06 5.60E-07 47.6%

Loss of Seal Injection 1.04E-06 9.94E-07 4.5%

Reactor Trip 9.77E-07 5.12E-07 47.6%

Loss of 4.16kv Bus B 8.77E-07 8.40E-07 4.2%

Loss of DC Bus 1BD1 8.60E-07 8.59E-07 0.1%

Total (f or all initiating events) 6.47E-05 2.67E-05 58.7%

• This table includes all initiating events that contribute at least 1 percent to total CDF for the Circa-2012 case.

3-10 Table 3.1-2 Additional Cases and Comparisons Case # 1 2 3 4 5 6

No-FLEX Circa-2012 (shutdown FLEX-1 2020- FLEX-2 Perfect-seals only) FLEX FLEX (Note 1)

F FLEX failure N/A 1.0 0.5 0.3 0.1 0.0 probability RCP shutdown S seal failure N/A 0.01 0.01 0.01 0.01 0.01 probability TDAFW failure T probability N/A 1.0 0.5 0.3 0.3 0.0 (Note 2)

p = F

• T (Note 3) 1 0.25 0.09 0.03 0

CDF (/rcy) 6.47E-05 5.68E-05 3.20E-05 2.67E-05 2.47E-05 2.37E-05 CDF Reduction N/A 12% 51% 59% 62% 63%

Notes

1. As used in the column headings for this table, FLEX refers to both FLEX strategies and continued TDAFW pump operation given a complete loss of all installed AC and DC power.

2. TDAFW failure probability refers to the f ailure probability for continued TDAFW pump operation given a complete loss of all installed AC and DC power.

3. The joint failure probability (p) that neither the FLEX strategies nor the continued operation of TDAFW (if FLEX is not successful) is capable of preventing core damage for station blackout sequences.

3-11 3.2 Level 2 PRA

This section provides a summary of the results and insights from the reactor, at -power, Level 2 PRA for internal events and internal floods for a single unit. Section 3.2.1 provides the release frequency results for both the Circa-2012 and 2020- FLEX cases. Section 3.2.2 discusses alternative analyses to assess the effects of modeling assumptions on the Level 2 PRA results for the 2020- FLEX case. Section 3.2.3 discusses insights from the Level 2 PRA portion of the 2020- FLEX case, including a discussion of the dominant contributors to release category frequencies.

3.2.1 Results of Circa -2012 and 2020-FLEX Cases

The 2020- FLEX case updates the Circa-2012 models to include the new RCP shutdown seals and FLEX strategies and equipment for responding to an extended loss of AC power. The FLEX strategies are intended to provide coping capability to prevent core damage. Therefore, the primary effect of FLEX strategies on the PRA model is a reduction of the CDF in the Level 1 PRA model (as discussed in Section 3.1.1). The Level 1 2020- FLEX case model changes result in reduced CDF contributions from the sequences involving SBO events or RCP seal failures.

The main impact on the Level 2 model for FLEX strategies is carrying forward the modified Level 1 sequences, which results in reduced frequencies for the applicable release categories.

This section provides a comparison of the 2020- FLEX case results to the Circa-2012 case. The description of the Circa-2012 Level 2 PRA model and results for internal events and internal flooding during power operation are provided in (NRC, 2020d). The Circa-2012 case is based on the reference plant as it was designed and operated as of 2012 and does not reflect the FLEX strategies. However, the Circa-2012 case does include severe accident mitigating strategies that can delay or arrest core damage and subsequent releases. The Level 2 PRA for the Circa-2012 case considers extended manual operation of TDAFW pump for some SBO sequences. For the 2020-FLEX case, the Level 2 model is revised to avoid applying conflicting credit for the same extended TDAFW operation that is represented in the Level 1 2020- FLEX case. The net effect on the model results is that the combined effects of the FLEX strategies and continued TDAFW pump operation in the 2020- FLEX case lead to significantly reduced frequency contribution from SBO sequences compared to the Circa-2012 case that included limited credit for extended TDAFW pump operation with a high probability of failure.12F13

The Level 2 PRA accident sequences are binned into release categories, as described in (NRC, 2020d). A description of each release category is provided in Table 3.2-1. The release category frequency results for the 2020- FLEX case and the Circa-2012 case are provided in Table 3.2-2.

Figure 3.2-1 shows the comparison of release category frequency results for the 2020-FLEX and Circa-2012 cases. Figure 3.2 -2 shows the percent contribution of each release category to the total release frequency for the 2020- FLEX and Circa-2012 cases. The contributions of individual release category frequencies are discussed further in Section 3.2.3.

The surrogate risk metric Level 2 PRA results for the 2020- FLEX case and the Circa-2012 case are provided in Table 3.2-3. The project -specific risk metric definitions that are used for this study are described in Appendix D of the Level 2 reactor at-power internal event and flood PRA report (NRC, 2020d). The surrogate risk metrics shown in Table 3.2-3 are:

13 The Circa-2012 case Level 2 PRA uses a h uman error failure probability of 0.65 for extended TDAFW pump operation during certain slow -developing SBO sequences.

3-12

• Total release frequency: the total combined release frequency from all release categories including releases where the containment is not bypassed or failed and radiological release to the environment occurs via design-basis containment leakage only

• Large early release frequency (LERF) based on early fatalities: release categories are defined to contribute to this LERF definition if their representative source term has a warning time (based on i odine release exceeding 1 percent) less than 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> simultaneous with the cumulative i odine release fraction being greater than 4 percent (this definition is based on the potential for releases causing early fatalities)

• Large release frequency (LRF): the summation of the frequency of all release categories that include containment bypass or containment failure, excluding those where fission product scrubbing (or other mechanisms) result in a source term comparable to, or smaller than, the remainder of the (intact containment) source terms

• Conditional containment failure probability (CCFP): the ratio of the combined frequencies of all release categories involving a failed or bypassed containment to the overall release frequency

The individual release categories that contribute to each surrogate risk metric are identified in Table 3.2-3. As can be seen from Table 3.2-3, the total release frequency from internal events and internal flooding is reduced by 64 percent when the FLEX-related changes are included in the Level 2 PRA model. The LERF and LRF metrics are reduced by 39 percent and 60 percent, respectively. The reduction in LERF is less than the overall reduction in total release frequency since LERF has a significant contribution from ISLOCAs, which is not reduced by the FLEX model changes. On the other hand, the reduction in LRF is more substantial because SBO sequences are a large contributor to LRF and the new RCP shutdown seals, back -up power capabilities of FLEX, and the continued operation of TDAFW all help to mitigate SBO sequences.

Note, CCFP is larger for the 2020-FLEX case. The increase of CCFP is due to the smaller contribution of the intact containment release category in the 2020- FLEX case. The intact containment release category accounts for 34 percent of the total release frequency in the Circa-2012 case, but only 22 percent of the total release for the 2020-FLEX case. The most relevant fact, however, is that the frequency of a severe accident that leads to containment failure goes down substantially in the 2020-FLEX case.

A parametric uncertainty analysis for the 2020-FLEX case was performed. A summary of the results for the release category frequencies and surrogate risk metrics is given in Table 3.2-4.

3.2.2 Results of Alternative Analyses

Alternative analyses were performed to assess the impacts of two of the key modeling assumptions and sources of uncertainty on the 2020- FLEX case results. Specifically, alternate analyses were performed to assess the impact on the 2020- FLEX case results from (1) alternate assumptions regarding the termination of radiological releases and (2) crediting additional post-core damage recovery actions that could mitigate or terminate releases.

3-13 Accident Termination Time

The L3PRA project does not expli citly model the role of long-term onsite, or offsite, resources in terminating accidents after core damage has occurred. The issue of the timing of accident termination and termination of radiological release is treated as a global model ing uncertainty.

The issue is described in Appendix D of the Level 2 reactor at -power internal event and flood PRA report (NRC, 2020d). The timing of the accident and release termination may be influenced by the Phase 3 FLEX strategies to obtain additional off site resources,13F14 which could allow for earlier accident termination compared to the nominal termination assumption of 7 days after event initiation.14F15

Given the uncertainty in accident termination time, alternate termination times of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after severe accident management guideline (SAMG) entry and 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after SAMG entry were considered to assess the impact of earlier release termination. Assumptions regarding these alternative release termination times are provided in Appendix D of (NRC, 2020d).

Table 3.2-5 provides details of the key parameter timeline for each of the release category representative accident scenarios. This information assists in interpreting the alternate termination results. The key parameters are defined below.

• GE declaration - The timing of declaring a g eneral emergency (GE) is based on plant-specific Emergency Action Level determination guidance and the specific conditions of the accident scenario. There are several different criteria and plant indications that can prompt the GE declaration. The assessments of each modeled accident scenario and the estimated times of GE declaration are discussed in Section 2.5.2 and Table 2-20 of (NRC, 2020d).

• SAMG entry - This marks the transition from the plant operators using the e mergency operating procedures to using the SAMGs to manage the accident response. The accident management staff will refer to the SAMGs when core damage is imminent or has occurred. The MELCOR simulated time to reach average temperature of coolant at core exit of 1,200 F is used as a surrogate for the timing of imminent core damage.

Navigation of the SAMGs is discussed further in Appendix D of (NRC, 2020d).

• Cumulative I > 1% - This refers to the time when the cumulative environmental release of the iodine chemical class exceeds 1 percent of its initial core inventory mass. This threshold is used as an indication of a release with potential to cause health effects. The timing is an input into the calculation of warning time for the LERF definition.

• Warning time - The warning time is defined as the time when the cumulative environmental iodine release fraction exceeds 1 percent minus the time that GE declaration occurs. Warning time is an input used in the LERF definition. The warning time gives an indication of the time available for evacuating populations, which can significantly influence the occurrence of early radiological health effects. Warning time is discussed further in the risk metric surrogate definitions in Appendix D of (NRC, 2020d).

14 See Section 4.1.2 for a definition of the FLEX phases.

15 In order to obtain a more complete understanding of long-term accident behavior and radiological release considerations, the severe accident progression analyses were modeled until a stable state was reached, with a backstop of 7 days.

3-14

• Time to LERF threshold - The LERF definition includes criteria on the warning time and the cumulative environmental i odine release fraction exceeding 4 percent. In assessing the timing of reaching the threshold, the second criterion is the determining factor. The release categories that do not meet the LERF warning time criteria indicate N/A in this column.

• Time to LRF threshold - The LRF is the summation of the frequency of all release categories that include containment bypass or containment failure, excluding those where fission product scrubbing (or other mechanisms) result in a source term comparable to, or smaller than, the remainder of the intact containment source term s.

For the purposes of assessing timing of LRF, a threshold value is designated to determine when a release is significantly greater than the reference intact containment source term. The time when the cesium environmental release fraction exceeds 2.9x10-4 is used as the criterion for a large release that is not comparable to the intact containment source term. The LRF definition is discussed further in the risk metric surrogate definitions section in Appendix D of (NRC, 2020d).

• Time of containment failure - This refers to the timing of failure of the containment structure or timing of opening a containment bypass release pathway. A time of 0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> indicates a containment bypass is open throughout the entire duration of the scenario.

Table 3.2-5 shows the times to reach the LERF, LRF, and containment failure criteria. If an earlier accident termination time is assumed, then some of the scenarios may not reach the thresholds for LERF, LRF, or containment failure. Table 3.2-6 includes results showing the impacts of alternate assumptions regarding the termination of radiological releases. As seen in Table 3.2-6, the LERF result is insensitive to the accident termination time assumptions.

However, the LRF and CCFP results can be significantly reduced by the earlier accident termination alternatives (for both alternative termination times, LRF is reduced by around 70 percent). It should also be noted that besides reducing the LRF surrogate risk metric, earlier accident termination times also reduce the magnitude of the radiological releases.

This sensitivity analysis shows that selection of a shorter scenario modeling time results in reductions of LRF and CCFP. As discussed at the beginning of this section, if there are credible reasons to model an accident scenario termination time at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after SAMG entry, then both LRF and CCFP would be reduced by approximately a factor of three. This is a significant reduction.

Additional Post-Core-Damage Recovery Actions

Another set of alternative analyses was performed to assess the impacts of potential post-core damage recovery actions that could mitigate or terminate releases. The Level 2 human reliability analysis (HRA) approach, as described in (NRC, 2020d), excluded credit for operator actions following core damage during station blackout and for actions in the long -term (meaning roughly six hours or more after vessel breach during all scenarios). It is expected that operators would continue to take actions under station blackout conditions and during the longer timeframes, including possibly making use of offsite resources. Nevertheless, modeling the reliability of such actions is beyond the scope of the Level 2 HRA approach for the L3PRA project, and generally beyond the state of practice in Level 2 PRA.

The alternative analyses show how varying the reliability of possible longer-term recovery actions (during station blackout and otherwise) would affect the surrogate risk metrics LERF,

3-15 LRF, and CCFP. A similar set of alternative analyses was performed for the Circa-2012 case results and is described in Appendix C of (NRC, 2020d), which addresses the treatment of uncertainty for the Level 2 PRA.

These alternative analyses are performed by applying a set of recovery factors to represent failure of possible recovery actions. Three categories of recovery actions are considered:

actions that prevent significant combustion events, actions that successfully control containment pressure, and actions to flood containment to prevent basemat failure. The analyses assume that recovery actions will have an overall positive effect (i.e., the potential for actions to exacerbate the accident is not considered). A failure probability of 0.1 is assumed for each of the recovery factors. The recovery factors are applied to the release category frequencies, resulting in a reduced frequency contribution for the applicable release categories. Successful recovery actions are accounted for by applying the success terms (i.e., 1.0 - 0.1 = 0.9) resulting in an increased frequency for the release categories impacted by the successful actions. The rational for which release categories would be impacted by the recovery factors is outlined below. The potential recovery actions fall into one of the following three categories:

• Actions that prevent significant combustion events in the intermediate and long term (named RFcombust here); for example, by igniting at lower flammability levels - this drives frequency from the 1-REL-ICF-BURN release category to the 1-REL-LCF release category. Similarly, for the scrubbed releases the recovery factor drives frequency from the 1-REL-ICF-BURN-SC release category to the 1-REL-LCF-SC release category.

• Actions that successfully control containment pressure through restoration of containment heat removal or containment venting (named RFpressure here) - this drives frequency from both the LCF release categories to the BMT release category

• Actions that flood the cavity with timing and flow rates that are sufficient to arrest basemat ablation prior to basemat failure (named RF BMT here) - this drives frequency from the BMT release category to the NOCF release category

The risk surrogate results with the alternative recovery action assumptions are shown in Table 3.2-7. The alternatives show the possible impacts that combinations of recovery actions could have on the results (assuming a human error probability of 0.1 for each of the actions).

The alternative analyses in Table 3.2-7 consider each recovery action individually and the combined effects of multiple recovery actions. However, it should be noted that this analysis does not consider the dependencies between actions; for example, actions to control containment pressure could adversely impact the likelihood of combustion in the containment.

As seen in the table, the LERF result is unaffected by any of the recovery actions (due to the timeframes involved). However, the LRF and CCFP results can be significantly reduced if recovery actions can be implemented within the necessary timeframe. Actions that successfully control containment pressure through restoration of containment heat removal or containment venting, RF pressure, appear to be very effective in reducing LRF. These actions can provide a reduction in LRF of approximately a factor of three. Thus, among the three recovery actions considered in this subsection, controlling containment pressure through restoration of containment heat removal or containment venting appears to be the strategy or plant improvement with the greatest potential risk benefit.

Note, the recovery action that can prevent combustion events appears to have minimal impact on the results when not combined with other recovery actions. The analysis assumes that the

3-16 decrease in frequency from the combustion event release categories shifts to the late containment overpressure failure release categories. Both these types of release categories contribute to the LRF results, so no impact is seen. However, the radiological consequences would be reduced because the combustion event release categories have higher magnitude releases than the late containment overpressure failure release categories.

3.2.3 Initial Insights

As discussed previously in Section 3.2.1, the analysis of the Level 2 PRA 2020- FLEX case shows a significant reduction in release frequencies when the impacts of the FLEX strategies are included in the model (total release frequency is reduced by 64 percent). The alternative analyses described in Section 3.2.2 show that the Level 2 risk surrogate metrics (and radiological release magnitudes) can be further reduced if earlier accident termination or recovery actions are successful.

As expected, some of the largest FLEX impacts are seen for the release categories that are dominated by station blackout sequences: 1-REL-CIF, 1-REL-ICF-BURN, and 1-REL-LCF. Also as expected, release categories that are dominated by RCP seal failures are significantly reduced: 1-REL-ECF, 1-REL-LCF-SC, and 1 -REL-NOCF. The release category 1-REL-ISGTR includes a mix of different accident sequences including LOOP with power recovery and SBO.

The combined effects of FLEX mitigation and improved RCP seals lead to a significantly reduced frequency for this release category. There is little or no impact on the frequency of release categories that involve containment bypass scenarios: 1-REL-SGTR-C, 1-REL-SGTR-O, 1-REL-SGTR-O-SC, 1-REL-V, 1-REL-V-F, and 1-REL-V-F-SC.

The dominant release categories for the 2020-FLEX case in terms of frequency contributions are 1-REL-LCF, 1-REL-NOCF, 1-REL-ICF-BURN, and 1-REL-ICF-BURN-SC. The frequency results do not reflect the differences in the release magnitudes of the release categories and their overall contributions to risk. For example, the 1 -REL-LCF and 1-REL-ICF-BURN release categories both contribute to LRF, while 1 -REL-NOCF and 1-REL-ICF-BURN-SC do not contribute to LRF. The release category 1-REL-ISGTR has a small contribution to the overall release frequency, but it has the highest contribution to the LERF risk metric. The release category contributions to the surrogate risk metrics for the 2020 -FLEX case are provided in Table 3.2-6. The contribution of individual release categories to risk (accounting for both frequency and consequences) is discussed in Section 3.3.1.

A set of significant release categories is defined to identify the contributions that are important to the surrogate risk metrics LERF and LRF. The selection of significant release categories is based on the definition of significant radionuclide release category from the ASME/ANS Level 2 PRA Trial Use and Pilot Application standard (ASME, 2014). A significant radionuclide release category is defined as:

One of the set of radionuclide release categories [RCs] contributing to LRF/LERF or to the overall radionuclide release frequency that, when rank-ordered by decreasing frequency, sum to 95% of the LRF/LERF or overall release frequency (excluding design-basis leakage RCs) or individually contribute more than 1% of LRF/LERF or 5% of the overall release frequency.

Note that in assessing the significant release categories, the definition of LERF considers both potential for early injuries and early fatalities consistent with the two LERF definitions described

3-17 in Section 2.6.1 of (NRC, 2020d).15F16 This assessment yields the following set of significant release categories16F17:

• 1-REL-BMT

• 1-REL-CIF

• 1-REL-ICF-BURN

• 1-REL-ICF-BURN-SC

• 1-REL-ISGTR

• 1-REL-LCF

• 1-REL-LCF-SC

• 1-REL-SGTR-O

• 1-REL-SGTR-O-SC

• 1-REL-V-F

• 1-REL-V-F-SC

Again, it should be noted that significance in this context pertains to release category frequency, not consequences. However, by including only those release categories that contribute to LERF and LRF, the definition of the significant release category is intended to include release categories that are both high frequency contributors and have significant release magnitudes.

The highest frequency accident sequence for each of the s ignificant release categories is described here.

1-REL-BMT

A medium LOCA occurs. Operators fail to establish high pressure recirculation resulting in core damage. Core degradation continues and vessel breach occurs. Molten core -concrete interaction contributes to combustible gas generation, but detonation does not occur.

Containment is breached due to gradual concrete erosion in the reactor cavity. The release is not scrubbed by sprays or water pools.

1-REL-CIF

A grid-related LOOP occurs. Various equipment failures contribute to a loss of onsite emergency AC power. Offsite power is recovered, but operators fail to restore systems after power recovery resulting in core damage. Containment isolation fails due to a preexisting tear or maintenance errors. The release is not scrubbed by sprays or water pools.

1-REL-ICF-BURN

A medium LOCA occurs. Operators fail to establish high pressure recirculation resulting in core damage. During the period of molten core -concrete interaction, a combustible gas detonation event occurs. The detonation results in containment failure. The release is not

16 All other LERF results in this report use only the definition of LERF with potential early fatal ities, which is provided in Section 3.2.1.

17 The L3PRA Level 2 PRA for internal events and floods documented in (NRC, 2020d) also identifies a set of significant release categories. The frequency contributions have changed for the 2020-FLEX case compared to the Circa-2012 case. Consequently, the release categories that meet the LERF, LRF, and overall release frequency criteria are somewhat different.

3-18 scrubbed by sprays or water pools. This is the highest frequency sequence for all the significant release categories.

1-REL-ICF-BURN-SC

A medium LOCA occurs. Various equipment and electrical system failures contribute to failure to establish emergency core cooling system ( ECCS) injection and core damage occurs. Operators successfully implement guidelines to mitigate fission product releases by establishing containment spray. During the period of molten core-concrete interaction, a combustible gas detonation event occurs. The detonation results in containment failure.

Containment spray provides scrubbing of the release.

1-REL-ISGTR

A grid-related LOOP occurs. Various equipment failures contribute to a loss of onsite emergency AC power. Actions to implement FLEX strategies or extend the TDAFW pump operation fail resulting in core damage. Reactor coolant system ( RCS) conditions result in thermally induced rupture of one or more steam generator (SG) tubes creating a containment bypass release pathway.

1-REL-LCF

A grid-related LOOP occurs. Various equipment failures contribute to a loss of onsite emergency AC power. Actions to implement FLEX strategies or extend the TDAFW pump operation fail resulting in core damage. Without containment heat removal systems available, g radual pressure increase results in containment overpressure failure.

1-REL-LCF-SC

A grid-related LOOP occurs. Various equipment failures contribute to a loss of onsite emergency AC power. Offsite power is recovered, but operators fail to restore systems after power recovery resulting in core damage. Operators successfully implement SAMG -directed actions to establish containment spray using the firewater system. Gradual pressure increase results in containment overpressure failure; however, c ontainment spray provides scrubbing of the release.

1-REL-SGTR-O

A steam generator tube rupture (SGTR) initiating event occurs. A consequential LOOP occurs. Various emergency power failures impact the capability to isolate the impacted steam generator. Operators fail to implement feed and bleed cooling resulting in core damage. Operators fail to implement SAMG-directed actions to mitigate releases from the impacted steam generator.

1-REL-SGTR-O-SC

An SGTR initiating event occurs. A consequential LOOP occurs. Various emergency power failures impact the capability to isolate the impacted steam generator. Operators fail to implement feed and bleed cooling resulting in core damage. Operators successfully implement SAMG-directed actions to feed the impacted steam generator and provide scrubbing of the containment bypass release.

3-19 1-REL-V-F

An ISLOCA initiating event occurs in a residual heat removal (RHR) system hot leg suction line resulting in core damage. The ISLOCA results in a containment bypass pathway to the auxiliary building. Blow down from the break l eads to pressurization of the building and failure of the exhaust and filtration system resulting in an unfiltered flow path to the environment. The ISLOCA release location is not submerged or sufficiently scrubbed to attenuate the release to the environment.

1-REL-V-F-SC

An ISLOCA initiating event occurs in an RHR system hot leg suction line resulting in core damage. The ISLOCA results in a containment bypass pathway to the auxiliary building.

Blow down from the break leads to pressurization of the building and failure of the exhaust and filtration system resulting in an unfiltered flow path to the environment. The ISLOCA release location is submerged or sufficiently scrubbed to attenuate the release to the environment.

There are many similarities in the contributions to both t he 2020-FLEX case and the Circa-2012 case. For instance, both cases have significant contributions from station blackout and medium LOCA scenarios. However, for the 2020-FLEX case, while the station blackout contribution is still significant (in a relative sense), the absolute frequency of the contribution is much less than for the Circa-2012 case.

To gain insight into the relative risk significance of individual basic events for the combined set of significant release categories for the 2020- FLEX case, they were ranked by Fussell-Vesely importance. From this ranking, the following types of events were identified as among the highest contributors:

• Events representing the likelihood of the presence of an ignition source during different phases of the accident prog ression for conditions with and without AC power available.

These events contribute to the overall likelihood of energetic combustion events that can result in containment failure.

• Human failure events from the Level 1 and Level 2 portions of the model, which are the highest contributing failure events. The highest contributing Level 2 operator action is failure to implement SAMG-directed actions to establish containment spray using the firewater system. The highest contributing Level 1 operator action is failure to restore systems after AC power is recovered in station blackout conditions (since, if AC power is recovered, there is no ELAP and, therefore, no FLEX implementation).

• Several Level 1 initiating events, of which the highest contributor is a grid-related LOOP.

• Events representing the likelihood of combustion in containment under different conditions and during different phases of the accident progression.

• The event representing failure of in-vessel recovery, which results in vessel breach.

• The event representing the probability of a consequential LOOP during a reactor transient event.

3-20

• The event representing the probability of containment failure due to overpressure without containment heat removal.

• Level 1 failures of emergency DGs to run for the duration of the mission time.

• Failures to implement FLEX strategies and failure to extend the TDAFW pump operation during station blackout.

• Operator failure to implement SAMG -directed actions to open atmospheric relief valves (ARVs) and feed steam generators using condensate pumps.

• Level 1 CCF events for failures of reserve auxiliary transformer supply breakers to open and failures of undervoltage sequencers to operate.

3-21 Comparison of Release Category Frequencies

1.00E-04 1.00E-05 1.00E-06 1.00E-07 1.00E-08 1.00E-09 1.00E-10 1.00E-11

Circa-2012 2020-FLEX

Figure 3.2-1 Comparison of Release Category Frequencies for 2020-FLEX and Circa-2012 Cases

Comparison of Release Category Contributions

45%

40%

35%

30%

25%

20%

15%

10%

5%

0%

Circa-2012 2020-FLEX

Figure 3.2-2 Comparison of Percent Contribution to Total Release Frequency for 2020-FLEX and Circa-2012 Cases

3-22 Table 3.2-1 Description of Release Categories

Name Description 1-REL-NOCF Containment is not bypassed or failed, and radiological release to the environment occurs via design-basis containment leakage only. This release may or may not benefit from any aerosol scrubbing.

1-REL-ECF The containment fails before or around the time of vessel breach due to an energetic event. This release may or may not benefit from any aerosol scrubbing.

1-REL-ICF-BURN The containment fails hours after vessel breach due to a global deflagration or detonation. Releases to the environment are not mitigated significantly by sprays or water pools.

1-REL-ICF-BURN-SC The containment fails hours after vessel breach due to a global deflagration or detonation. Releases to the environment benefit from scrubbing.

1-REL-LCF The containment fails tens of hours after the time of vessel breach due to long-term quasi-static overpressure. Releases to the environment a re not mitigated significantly by sprays or water pools.

1-REL-LCF-SC The containment fails tens of hours after the time of vessel breach due to long-term quasi-static overpressure. Releases to the environment a re mitigated by sprays and/or water pools.

1-REL-BMT The containment eventually fails due to basemat ablation due to sustained core-concrete interaction. Only the airborne component of release to the environment (which stems from normal containment leakage while the containment is pressurized) is modeled.

1-REL-CIF Release from the containment to the environment occurs via a containment penetration that fails to be isolated by the containment isolation system, or a preexisting leakage path. The release is unmitigated.

1-REL-CIF-SC Release from the containment to the environment occurs via a containment penetration that fails to be isolated by the containment isolation system, or a preexisting leakage path. The release is mitigated.

1-REL-SGTR-C Release from the RCS to the environment occurs via ruptured steam generator (SG) tube( s), where the rupture occurs prior to core damage. ARVs and main steam relief valves (MSRVs) remain predominantly closed.

1-REL-SGTR-O Release from the RCS to the environment occurs via one or more ruptured SG tubes, where the rupture occurs prior to core damage. The release is not mitigated by water above the break point on the secondary side of the affected SG. One or more secondary -side relief valves ar e kept open during release as a deliberate action or fail in the open position.

1-REL-SGTR-O-SC Release from the RCS to the environment occurs via one or more ruptured SG tubes, where the rupture occurs prior to core damage. The release is mitigated by water above the break point on the secondary side of the affected SG. One or more secondary-side relief valves a re kept open during release as a deliberate action or fail in the open position.

1-REL-ISGTR Release to the environment occurs via a thermally induced rupture of one or more steam generator tubes after the time of core damage.

1-REL-V Release occurs from the RCS to the auxiliary building via interfacing systems LOCA. The break point may or may be not submerged. The auxiliary building remains intact.

1-REL-V-F Release occurs from the RCS to the auxiliary building via interfacing systems LOCA. The break point was not submerged. The auxiliary building fails.

1-REL-V-F-SC Release occurs from the RCS to the auxiliary building via interfacing systems LOCA. The break point was submerged. The auxiliary building fails.

3-23 Table 3.2-2 Release Category Frequency Results Circa-2012 Circa-2020-FLEX 2020-Release Category Release 2012 % Release FLEX % of FLEX Name Category of Total Category Total Impact Frequency Release Frequency Release (a-b)/a %

(/rcy) (a) (/rcy) (b)

Total 7.20E-05 2.63E-05 63.5%

1-REL-BMT 8.06E-07 1.1% 7.86E-07 3.0% 2.5%

1-REL-CIF 7.53E-08 0.1% 2.36E-08 0.1% 68.6%

1-REL-CIF-SC 1.11E-11 0.0% 1.11E-11 0.0% 0.0%

1-REL-ECF 9.46E-09 0.0% 3.14E-09 0.0% 66.8%

1-REL-ICF-BURN 9.20E-06 12.8% 4.14E-06 15.8% 55.0%

1-REL-ICF-BURN-2.86E-06 4.0% 2.33E-06 8.9% 18.5%

SC 1-REL-ISGTR 6.00E-07 0.8% 2.39E-07 0.9% 60.2%

1-REL-LCF 2.97E-05 41.3% 1.04E-05 39.6% 65.0%

1-REL-LCF-SC 3.34E-06 4.6% 2.05E-06 7.8% 38.4%

1-REL-NOCF 2.48E-05 34.4% 5.64E-06 21.5% 77.2%

1-REL-SGTR-C 4.17E-08 0.1% 4.17E-08 0.2% 0.0%

1-REL-SGTR-O 2.42E-08 0.0% 2.42E-08 0.1% 0.0%

1-REL-SGTR-O-SC 2.32E-07 0.3% 2.31E-07 0.9% 0.1%

1-REL-V 1.27E-08 0.0% 1.27E-08 0.0% 0.0%

1-REL-V-F 1.01E-07 0.1% 1.01E-07 0.4% 0.0%

1-REL-V-F-SC 2.30E-07 0.3% 2.30E-07 0.9% 0.0%

Table 3.2-3 Level 2 PRA Surrogate Risk Metric Results Level 2 PRA Surrogate Risk Circa-2012 2020-FLEX Risk Metric Metric Case Case Reduction Total Release Frequency (/rcy) 7.2E-05 2.6E-05 63.5%

LERF1 (/rcy) 9.3E-07 5.7E-07 38.8%

LRF2 (/rcy) 4.4E-05 1.7E-05 59.9%

CCFP3 0.656 0.785

1. The release categories contributing to LERF with potential for early fatalities are: 1-REL -ISGTR, 1-REL -V-F, and 1-REL -V-F-SC.

2. The release categories contributing to LRF are: 1-REL -CIF, 1 -REL -CIF -SC, 1 -REL -ECF, 1-REL -ICF -BURN, 1 -REL -ISGTR, 1 -REL -LCF, 1 -REL -LCF -SC, 1 -REL -SGTR -C, 1 -REL -SGTR -O, 1-REL -SGTR -O -SC, 1 -REL -V, 1 -REL -V-F, and 1-REL -V-F -SC.

3. The release categories contributing to CCFP include all release categories resulting in containment failure or bypass: 1-REL -BMT, 1 -REL -CIF, 1 -REL -CIF -SC, 1 -REL-ECF, 1 -REL -ICF -BURN, 1-REL -ICF -BURN-SC, 1 -REL -ISGTR, 1-REL -LCF, 1 -REL -LC F-SC, 1 -REL -SGTR -C, 1-REL -SGTR -O, 1 -REL -SGTR -O -SC, 1 -REL -V, 1 -REL -V-F, and 1-REL -V-F-SC.

3-24 Table 3.2-4 2020- FLEX Parameter Uncertainty Propagation Results by Release Category and Surrogate Risk Metric

Release Circa-Category or Point Mean 5th Median 95th 95th/5th 2012 Surrogate Estimate Percentile Percentile Ratio 95th/5th Risk Metric 1-REL-BMT 7.86E-07 7.47E-07 4.52E-09 5.46E-08 3.70E-06 818 772 1-REL-CIF 2.36E-08 2.13E-08 8.25E-10 7.38E-09 9.01E-08 109 79 1-REL-CIF-SC 1.11E-11 1.14E-11 3.84E-16 7.42E-13 4.67E-11 1.22E+5 1.80E+5 1-REL-ECF 3.14E-09 2.45E-09 7.31E-11 8.18E-10 9.79E-09 134 131 1-REL-ICF-BURN 4.14E-06 4.04E-06 3.55E-07 2.53E-06 1.26E-05 35 45 1-REL-ICF-BURN-SC 2.33E-06 2.23E-06 4.74E-09 1.41E-06 7.42E-06 1564 2302 1-REL-ISGTR 2.39E-07 2.31E-07 1.37E-08 1.05E-07 8.25E-07 60 56 1-REL-LCF 1.04E-05 1.04E-05 2.03E-06 7.50E-06 2.72E-05 13 14 1-REL-LCF-SC 2.05E-06 2.24E-06 4.18E-08 1.18E-06 7.77E-06 186 274 1-REL-NOCF 5.64E-06 5.85E-06 1.14E-06 4.24E-06 1.52E-05 13 14 1-REL-SGTR-C 4.17E-08 4.08E-08 1.97E-09 1.79E-08 1.64E-07 83 71 1-REL-SGTR-O 2.42E-08 2.30E-08 1.35E-09 1.01E-08 8.32E-08 62 57 1-REL-SGTR-O-SC 2.31E-07 2.23E-07 4.26E-08 1.51E-07 6.08E-07 14 15 1-REL-V 1.27E-08 1.29E-08 5.91E-10 5.58E-09 4.58E-08 78 74 1-REL-V-F 1.01E-07 1.21E-07 9.21E-09 6.60E-08 3.93E-07 43 43 1-REL-V-F-SC 2.30E-07 2.97E-07 2.64E-08 1.74E-07 9.58E-07 36 37

LERF (/rc y) 5.70E-07 6.74E-07 1.05E-07 4.67E-07 1.92E-06 18 18 LRF (/rc y) 1.75E-05 1.73E-05 4.48E-06 1.28E-05 4.43E-05 10 11

3-25 Table 3.2-5 Level 2 PRA Representative Accident Scenario Timelines

MELCOR Time of Warning Time to Time to 36 hr 60 hr End of Release Rep. GE1 SAMG Cumul. Time3 LERF LRF Time of C ont. after after Calc.

Category Case (hr) Entry2 I > 1% (hr) Thresh. Thresh. Failure (hr) SAMG SAMG (hr)

(hr) 6 7 Entry (hr) Entry (hr) 1-REL-BMT 6 13 14.7 Never >155 N/A Never 129 50.7 74.7 168 1-REL-CIF 7 3 15.6 18 15 4 ~30 ~17 0 51.6 75.6 168 (cont. bypass) 1-REL-CIF-7A 3 15.6 18 15 4 Never ~17 0 51.6 75.6 168 SC (cont. bypass) 1-REL-ECF 2A 8 13.5 22 14 4 ~23 ~22 21.6 49.5 73.5 140 8 1-REL-ICF-1A2 3 15.5 33 30 N/A ~28 28 51.5 75.5 140 8 BURN 1-REL-ICF-1A2 3 15.5 33 30 N/A Never 28 51.5 75.5 28.0 9 BURN-SC 1-REL-10.1 - SGTR ISGTR 3A2 8 10.1 11 3 5 ~12 10.1 87.8 - OP 46.1 70.1 168 failure 1-REL-LCF 1B 3 3.5 146 143 N/A ~68 47.9 39.5 63.5 168 1-REL-LCF-2R2 8 13.5 Never > 160 N/A ~140 120 49.5 73.5 168 SC 1-REL-NOCF 2R1 8 13.5 Never > 160 N/A Never Never 49.5 73.5 168 1-REL-8 47 49.1 52 5 4 Never ~50 0 85.1 109.1 168 SGTR-C (cont. bypass) 1-REL-8B 47 49.1 51 4 4 ~50 ~50 0 85.1 109.1 168 SGTR-O (cont. bypass) 1-REL-8BR1 47 49.1 Never > 160 N/A ~50 0 85.1 109.1 58.8 10 SGTR-O-SC (cont. bypass) 1-REL-V 5 7.5 9.5 Never > 64 N/A ~11 0 45.5 69.5 72 (cont. bypass)

3-26 Table 3.2-5 Level 2 PRA Representative Accident Scenario Timelines (cont.)

MELCOR Time of Warning Time to Time to 36 hr 60 hr End of Release Rep. GE1 SAMG Cumul. Time3 LERF LRF Time of C ont. after after Calc.

Category Case (hr) Entry2 I > 1% (hr) Thresh.6 Thresh.7 Failure (hr) SAMG SAMG (hr)

(hr) Entry (hr) Entry (hr) 1-REL-V-F 5D 1.25 2.9 3.2 1.95 5 ~4 ~3 0 38.9 62.9 72 (cont. bypass) 1-REL-V-F-5B 1.25 2.9 3.2 1.95 5 ~4 ~3 0 38.9 62.9 72 SC (cont. bypass)

1 GE is declared according to plant -specific Emergency Action Level determination guidance. The GE declaration times are estimated for the representative accident scenarios in Section 3.6.2 and Table 29 of (NRC, 2018a).

2 SAMG entry is indicated by average temperature of coolant at core exit exceeding 1,200 F.

3 Warning time is defined as the time at which cumulative environmental iodine release fraction exceeds 1% minus the time that GE conditions are met.

4 The warning time meets the criteria for LERF resulting in early injuries, i.e., warning time < 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.

5 The warning time meets the criteria for LERF resulting in early fatalities, i.e., warning time < 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

6 The LERF criteria are met when the warning time is less than the designated time (3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> for early fatalities and 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for early injuries) and the cumulative environmental i odine release fraction exceeds 4%.

7 The time when cumulative environmental release fraction of cesium exceeds 2.9x10 -4 is used to indicate a large release, which is significantly larger than releases from an intact containment.

8 The calculation was ended at 140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br /> because releases have stabilized at this time.

9 The source term for case 1A2 truncated at the time of containment failure is used as a surrogate for this release category.

10 The calculation termi nated during in-vessel recovery due to numerical problems; no significant changes in the results after this time are expected.

3-27 Table 3.2-6 Level 2 PRA Surrogate Risk Metric Results - 2020- FLEX Case Release Time at which airborne radiological releases are terminated Release Category Category SAMG entry + 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SAMG entry + 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> 7 days after event initiation Name Frequency

(/rcy) LERF LRF CCFP LERF LRF CCFP LERF LRF CCFP 1-REL-BMT 7.86E-07 (Note 1) 3.0%

1-REL-CIF 2.36E-08 2.36E-08 0.1% 2.36E-08 0.1% 2.36E-08 0.1%

1-REL-CIF-SC 1.11E-11 1.11E-11 0.0% 1.11E-11 0.0% 1.11E-11 0.0%

1-REL-ECF 3.14E-09 3.14E-09 0.0% 3.14E-09 0.0% 3.14E-09 0.0%

1-REL-ICF-BURN 4.14E-06 4.14E-06 15.8% 4.14E-06 15.8% 4.14E-06 15.8%

1-REL-ICF-BURN-SC 2.33E-06 8.9% 8.9% 8.9%

1-REL-ISGTR 2.39E-07 2.39E-07 2.39E-07 0.9% 2.39E-07 2.39E-07 0.9% 2.39E-07 2.39E-07 0.9%

1-REL-LCF 1.04E-05 39.6% 1.04E-05 39.6%

1-REL-LCF-SC 2.05E-06 2.05E-06 7.8%

1-REL-NOCF 5.64E-06 1-REL-SGTR-C 4.17E-08 4.17E-08 0.2% 4.17E-08 0.2% 4.17E-08 0.2%

1-REL-SGTR-O 2.42E-08 2.42E-08 0.1% 2.42E-08 0.1% 2.42E-08 0.1%

1-REL-SGTR-O-SC 2.31E-07 2.31E-07 0.9% 2.31E-07 0.9% 2.31E-07 0.9%

1-REL-V 1.27E-08 1.27E-08 0.0% 1.27E-08 0.0% 1.27E-08 0.0%

1-REL-V-F 1.01E-07 1.01E-07 1.01E-07 0.4% 1.01E-07 1.01E-07 0.4% 1.01E-07 1.01E-07 0.4%

1-REL-V-F-SC 2.30E-07 2.30E-07 2.30E-07 0.9% 2.30E-07 2.30E-07 0.9% 2.30E-07 2.30E-07 0.9%

Total 2.63E-05 5.70E-07 5.04E-06 28.1% 5.70E-07 5.04E-06 67.7% 5.70E-07 1.75E-05 78.5%

Notes

1. A similar set of results is shown in Table 2-23 of (NRC, 2020d) for the Circa -2012 case. However, Table 2-23 of (NRC, 2020d) includes an error. The CCFP contribution for the 1-REL-BMT release category was incorrectly included for the SAMG entry + 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> alternate termination time. The basemat melt-through scenario sees gradual erosion of the reactor vessel cavity. Containment is considered failed when radial erosion exceeds the thickness of the cavity wall. This occurs at 129 hours0.00149 days <br />0.0358 hours <br />2.132936e-4 weeks <br />4.90845e-5 months <br /> after the initiating event. The SAMG entry + 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> accident termination occurs at approximately 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> after the initiating event.

3-28 Table 3.2-7 2020- FLEX Level 2 PRA Surrogate Risk Metric Results for Alternative Accident Recovery Assumptions

Postulated Recovery Factors Resulting Risk Surrogates RFcombust RFpressure RFBMT LERF (/rcy) LRF (/rcy) CCFP 1 1 1 5.7E-07 1.7E-05 0.785 1 1 0.1 5.7E-07 1.7E-05 0.758 1 0.1 1 5.7E-07 6.3E-06 0.785 0.1 1 1 5.7E-07 1.7E-05 0.785 1 0.1 0.1 5.7E-07 6.3E-06 0.374 0.1 1 0.1 5.7E-07 1.7E-05 0.758 0.1 0.1 1 5.7E-07 3.1E-06 0.785 0.1 0.1 0.1 5.7E-07 3.1E-06 0.194

3-29 3.3 Level 3 PRA

This section provides a summary of the results and insights from the reactor, at -power, Level 3 PRA for internal events and internal floods for a single unit. Results are provided for the following two risk metrics:

• Population-weighted early fatality risk (0- 1.8 miles) measures the average annual risk to individuals within 1 mile of the site boundary of incurring a fatality within 1 year from acute exposures to radiation due to modeled accidental releases of radiological materials from the reference nuclear power plant site. Results for this metric can be compared to the average individual early fatality risk quantitative health objective (QHO) to obtain insights related to the NRCs safety goal policy (NRC, 1986).

• Population-weighted latent cancer fatality risk (0-10 miles) measures the average annual risk to individuals within 10 miles of the site of incurring a fatality from cancers caused by doses arising from modeled accidental releases of radiological materials from the reference nuclear power plant site. This result, by weighting health effects cases across the entire 10-mile population, reflects the occurrence of exposures relative to the distribution of population around the site. Results for this metric can be compared to the average individual latent cancer fatality risk QHO to obtain insights related to the NRCs safety goal policy (NRC, 1986).

Section 3.3.1 provides the results for these two risk metrics for the 2020- FLEX case and a comparison to the results for the Circa-2012 case. Section 3.3.2 discusses alternative analyses to assess the effects of modeling assumptions on the Level 3 PRA results. Section 3.3.3 discusses insights from the Level 3 PRA portion of the 2020-FLEX case, including a discussion of the significant risk contributors.

3.3.1 Results of Circa -2012 and 2020 -FLEX Cases

The 2020- FLEX case updates the Circa -2012 models to include the new RCP shutdown seals, FLEX strategies and equipment for responding to an extended loss of AC power, and continued TDAFW pump operation given a complete loss of all installed AC and DC power. The FLEX strategies are intended to provide coping capability to prevent core damage. Therefore, the primary effect of FLEX strategies on the PRA model is a reduction of the CDF in the Level 1 PRA model (as discussed in Section 3.1.1). The Level 1 2020- FLEX case model changes result in reduced CDF contributions from the sequences involving SBO events or RCP seal failures.

The main impact on the Level 2 model for FLEX strategies is carrying forward the modified Level 1 sequences, which results in reduced frequencies for the applicable release categories.

The 2020- FLEX case does not consider the impact of FLEX strategies on severe accident timing; therefore, the conditional consequences do not change and the only impact on the Level 3 model derives from the change in release category frequencies.

This report provides a comparison of the 2020- FLEX case results to the Circa-2012 case. The description of the Circa-2012 Level 3 PRA model and results for internal events and internal flooding during power operation are provided in (NRC, 2020e). Table 3.3-1 compares mean annual population-weighted early fatality risk within 1 mile of the site boundary for the Circa-

3-30 2012 and 2020-FLEX cases.17F18 Only the four release categories that appreciably contribute to early fatality risk are included in the table. This information is displayed graphically in Figures 3.3-1 and 3.3-2.18F19

The four release categories that contribute virtually all of the mean annual population-weighted individual early fatality risk within 1 mile of the site boundary include: (1) a release category in which a release occurs from the RCS to the auxiliary building via an ISLOCA with the break point not submerged and auxiliary building failure (1-REL-V-F); (2) a release category in which a release occurs from the RCS to the auxiliary building via an ISLOCA with the break point submerged and auxiliary building failure (1-REL-V-F-SC); (3) a release category in which a release to the environment occurs via a thermally induced rupture of one or more steam generator tubes subsequent to the time of core damage ( 1-REL-ISGTR); and (4) a release category in which a release from the RCS to the environment occurs via one or more ruptured SG tubes, where the rupture occurred prior to core damage, the release is not mitigated by water above the break point on the secondary side of the affected SG, and one or more secondary-side relief valves are either kept open during the release as a deliberate action or fail in the open position (1-REL-SGTR-O). As can be seen from Table 4-2 in (NRC, 2020e), these are the four release categories that have large radiological release fractions (e.g., cumulative iodine and cumulative cesium release fractions of approximately 0.1 or higher) combined with short warning times (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or less).

As can be seen from Table 3.3-1, the changes in the 2020- FLEX case only reduce population-weighted early fatality risk within 1 mile of the site boundary by 6 percent. The only release category that shows a significant reduction is 1-REL-ISGTR (thermally induced SGTRs after the time of core damage). This limited impact on early fatality risk derives from the fact that ISLOCAs do not generally benefit from the types of measures incorporated into the 2020-FLEX case. Nonetheless, as seen in Figure 3.3-5, the margins to the QHO are already substantial when considering just internal events and floods for the reactor, at-power.

Table 3.3-2 compares mean population-weighted individual latent cancer fatality risk within 10 miles of the site for the Circa-2012 and 2020 -FLEX cases.19F20 Only those release categories that contribute at least 1 percent to latent cancer fatality risk are included in the table. This information is displayed graphically in Figures 3.3-3 and 3.3-4.

As can be seen from Table 3.3-2, mean annual population-weighted individual latent cancer fatality risk within 10 miles is dominated by two radiological release categories: (1) a late containment failure release category in which the containment fails tens of hours after the time of vessel breach, due to long-term quasi-static overpressure, and releases to the environment are not mitigated significantly by sprays or water pools (1-REL-LCF); and (2) an intermediate containment failure release category in which the containment fails hours after vessel breach, due to a global deflagration or detonation, and releases to the environment are not mitigated significantly by sprays or water pools (1-REL-ICF-BURN). These two radiological release categories collectively contribute well over 90 percent to the mean annual population-weighted individual latent cancer fatality risk within 10 miles. As can be seen from Table 4-3 in (NRC,

18 These values were obtained by weighting the mean (over all weather trials) consequence values for individual release categories by the point estimate of the individual release category frequencies.

19 Figures 3.3-1 to 3.3-6 label the risk metric results in terms of per reactor year (/ry ). In actuality, these risk metric results are in terms of per reactor-critical -year (/rcy).

20 These values were obtained by weighting the mean (over all weather trials) consequence values for individual release categories by the point estimate of the individual release category frequencies.

3-31 2020e), these release categories combine relatively high frequencies of occurrence with relatively high radiological release fractions.

As can also be seen from Table 3.3-2, the changes in the 2020-FLEX case reduce population-weighted latent cancer fatality risk within 10 miles of the site by 63 percent. As can be seen from Figure 3.3-6, the margins to the latent cancer fatality QHO are approximately a factor of 80 and 200 for the Circa-2012 and 2020- FLEX cases, respectively (when considering just internal events and internal floods for the reactor, at-power). This relatively large impact derives from the fact that the frequency of the two release categories identified above is driven primarily by SBO sequences (and, to a lesser extent, losses of NSCW leading to RCP seal LOCAs), which significantly benefit from the types of measures incorporated into the 2020-FLEX case.

3.3.2 Results of Alternative Analyses

Several alternative analyses were performed to assess the impacts of modeling assumptions and sources of uncertainty on the Level 3 PRA results. The two alternative analyses discussed here involve the accident termination time (as previously discussed in Section 3.2.2 for the Level 2 PRA) and the dose truncation model for evaluating radiological health effects.

As discussed in Section 3.2.2, the L3PRA project does not explicitly model the role of long-term onsite, or offsite, resources in terminating accidents after core damage has occurred. The issue of the timing of accident termination and termination of radiological release is treated as a global modeling uncertainty, as described in Appendix D of the Level 2 reactor at-power internal event and flood PRA report (NRC, 2020d). In both the Circa-2012 and 2020- FLEX cases, the accident and release termination time for many accident sequences is 7 days after event initiation. To gain insight into the range of consequence/risk results from different accident termination times, consequence calculations were performed terminating radiological releases from all the representative accident sequences 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after SAMG entry.

For releases that can lead to early fatalities, most of the release occurs within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after SAMG entry; therefore, this alternative termination time has no appreciable impact on early fatality risk. However, as seen in Figure 3.3-6, the alternative termination time does have a significant impact on latent cancer risk (the result displayed in the figure is for the 2020- FLEX case). For the 1 -REL-LCF release category, the release is prolonged and occurs over a period of several days, with a steady increase in released material. Terminating the releases 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after SAMG entry therefore significantly reduces the total amount of radiological material released for the 1-REL-LCF release category. The same is true, albeit to a to a lesser extent, for the 1-REL-ICF-BURN release category. Because these two release categories are dominant contributors to the latent cancer fatality risk, terminating the analysis at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after SAMG entry reduces the latent cancer fatality risk for the 2020- FLEX case by over 70 percent.

As discussed in (NRC, 2022e), it is unclear what health consequences, if any, are attributable to very low radiation exposure. The NRC currently relies on the hypothesis that a linear no-threshold (LNT) dose-response relationship is the appropriate approach to use in making its regulatory decisions. The LNT approach is based on scientific evidence supported by many in the technical community. However, there is also the belief by many in the technical community that estimating latent cancer fatalities based on very small doses to large populations is inappropriate, though there is no consensus on what dose threshold is appropriate.

3-32 Consistent with the State -of-the-Art Reactor Consequence Analyses (SOARCA) (NRC, 2012) and current NRC policy for regulatory applications, the LNT model is used as the base-case dose-response model for both the Circa-2012 and 2020- FLEX cases for evaluating radiological health effects. However, an alternative dose truncation model was also considered to allow examination of the cancer risks arising only from moderate (>10 rem) or high (>100 rem) lifetime doses, where the level of uncertainty in cancer risk estimation is less than in the low and very low dose range. The alternate dose truncation model is based on the model documented in a Health Physics Society (HPS) position paper on radiation risk (HPS, 2010), which estimates cancer risk based only on annual individual doses greater than 0.05 Sv (5 rem), or lifetime individual doses greater than 0.1 Sv (10 rem).20F21

The impact of the alternative dose truncation model on the 2020- FLEX case (while retaining the 7-day accident and release termination time) is shown in Figure 3.3-6. As can be seen from the figure, use of the alternative dose truncation model reduces latent cancer fatality risk by over two orders of magnitude. This is to be expected since the latent cancer fatality risk estimat ed in this study primarily results from long-term, low-dose exposure to individuals after they are allowed to return to their homes following decontamination. 21F22

3.3.3 Initial Insights

This section provides initial insights from the Level 3 PRA portion of both the Circa-2012 and 2020- FLEX cases. The focus is on significant risk contributors, but some other insights are provided at the end of the section.

Significant risk contributors

To gain insight into the relative risk significance of individual basic events to selected offsite public risk metrics, composite Fussell-Vesely (FV) importance measures were calculated for each event. The composite FV importance measure for a particular basic event is used to approximate the relative contribution to the total mean annual risk for each selected offsite public risk metric from accident scenarios that include that basic event. In practice, this composite FV importance measure is calculated as a weighted sum of the standard FV importance measure for the basic event with respect to each radiological release category frequency, weighted by the relative contribution of each radiological release category to the mean annual risk for each selected offsite public risk metric. For more information on the composite FV importance measure, see Section 5.2.5.1 of (NRC, 2020e).

For both the Circa-2012 and 2020- FLEX cases, composite FV importances were calculated for (1) mean annual population-weighted individual early fatality risk within 1 mile of the site

21 It is noted that the HPS position statement on radiation risk was updated in February 2019 to state simply that The Health Physics Society advises against estimating health risks to people from exposures to ionizing radiation that are near or less than natural background levels because statistical uncertainties at these low level s are great (HPS, 2019). However, the numerical values corresponding to the 2010 position statement were used in this analysis for consistency with recent NRC analyses using the MACCS dose truncation model.

22 The dose criterion for the required decontamination after a severe accident is uncertain. The current state of practice is to model decontamination to the level of meeting the habitability criteria as defined by the Environmental Protection Agency (EPA) intermediate-phase protective action guidelines (PAGs ). The use of the EPA intermediate-phase PAGs (2 rem in the year of the accident and 500 mrem in subsequent years) is assumed as a surrogate for decisions on cleanup and reoccupation.

3-33 boundary and (2) mean annual population-weighted individual latent cancer fatality risk within 10 miles.

The most significant contributors to early fatalit y risk for the Circa-2012 case involve various failures leading to an ISLOCA. This is consistent with the results provided in Table 3.3-1, which show that ISLOCAs contribute nearly 90 percent to this risk metric for the Circa-2012 case. The vast majority of the ISLOCAs are associated with failures of RHR system components, with the largest individual contributor being an ISLOCA in one of the two RHR system hot leg suction lines, contributing 58 percent to this risk metric. The next largest contributor is the basic event representing the probability that a large ISLOCA break is not submerged or scrubbed, which results in a much larger source term. This event contributes 55 percent to this risk metric (note, the sum of these two contributions exceeds 100 percent reflecting the fact that they are not mutually exclusive events).

The most significant contributors to early fatality risk for the 2020- FLEX case are very similar to those for the Circa-2012 case. This is expected since, as pointed out in Section 3.3.1, ISLOCAs do not generally benefit from the types of measures incorporated into the 2020- FLEX case.

Again, as pointed out in Section 3.3.1, the biggest difference in early fatality risk between the Circa-2012 and FLEX-2020 cases is the decrease in contribution from thermally induced SGTRs in the FLEX-2020 case. Since many of these SGTRs result from SBO sequences, which do significantly benefit from the types of measures incorporated into the 2020- FLEX case, there is a corresponding decrease in the relative importance of SBO -related basic events (e.g., the various categories of LOOP initiat ing events).

The most significant contributors to latent cancer fatality risk for the Circa-2012 case include failure of manual extension of TDAFW during an SBO scenario (contributing approximately 46 percent); many events related to combustion (detonations or deflagrations) within containment; and various failures leading to the occurrence of an SBO. Note, some combustion events result in direct failure of the containment, while others occur early in the accident progression before there is sufficient combustible gas to result in containment failure. In these latter cases, the early combustible events can reduce the amount of combustible gas in containment, thereby significantly reducing the likelihood of a larger combustible event later in the accident progression.

The composite FV importance ranking for latent cancer fatality risk for the Circa-2012 case also reveals that SBO sequences contribute approximately 80 percent to latent cancer fatality risk.

Loss of NSCW sequences (leading to RCP seal LOCAs) and medium LOCAs contribute approximately another 7 percent and 3 percent, respectively, to this risk metric. Approximately half of the SBO contribution comes from CCF of either both RAT input breakers to open or both safeguards load sequencers to operate. Both of these CCFs result in a non-recoverable loss of all safety-related 4160V AC power, rendering all safety-related equipment unavailable.

For latent cancer fatality risk, both the 2020- FLEX and Circa-2012 cases include many of the same significant risk contributors, though there are differences in their relative contributions.

Further, due to the significantly lower latent cancer fatality risk in the 2020- FLEX case, these differences are more pronounced in terms of absolute risk contribution. For example, the failure of manual extension of T DAFW during an SBO scenario ( 1-L2-BE-MANUALTDAFW-GEN in the Circa-2012 case and 1 -AFW-SBO-NO-FLEX-FA in the 2020- FLEX case) is an important contributor for both cases, contributing approximately 46 percent and 18 percent for the Circa-2012 and 2020-FLEX cases, respectively. However, in terms of absolute risk, this basic event contributes to an individual latent cancer fatality risk of 1.2x10-8/rcy for the Circa -2012 case, but

3-34 only 1.7x1 0-9/rcy for the 2020- FLEX case. This reduction in absolute risk contribution is due to the fact that in the 2020- FLEX case, the human error probability for this action is lower22F23 and is always combined with the basic event representing failure to declare ELAP or FLEX failure (1-FLEX-FAILS).

One other notable difference between the Circa-2012 and 2020-FLEX lists of significant contributors to latent fatality risk involves loss of NSCW sequences and medium LOCAs. As mentioned earlier, these two initiators contribute 7 percent and 3 percent, res pectively, to this risk metric for the Circa-2012 case. For the 2020-FLEX case, the contributions for these two initiators is flipped to 3 percent and 9 percent, respectively. The reduced contribution from loss of NSCW sequences is due to the fact that the 2020- FLEX case accounts for the new RCP shutdown seals, greatly reducing the likelihood of an RCP seal LOCA, which i s the major cause of core damage given a loss of NSCW. In contrast, while the absolute contribution of medium LOCAs is not increased in the 2020- FLEX case, the overall latent cancer fatality risk in the 2020- FLEX case was reduced by approximately 63%, resulting in a substantial increase in the relative contribution of medium LOCAs, since plant response to them does not benefit from any of the updated modeling changes.

Additional insights

As discussed in Section 3.3.1, the changes in the 2020- FLEX case only reduce population-weighted early fatality risk within 1 mile of the site boundary by 6 percent, since this metric is dominated by ISLOCAs, which do not generally benefit from the types of measures incorporated into the 2020- FLEX case. Nonetheless, as seen in Figure 3.3-5, when considering only internal events and floods, the margins to the QHO are already substantial ( approximately six orders of magnitude).

As shown in Figure 3.3-6, for mean annual population-weighted individual latent cancer fatality risk within 10 miles, the Circa-2012 case has a margin of approximately a factor of 80 to the respective QHO associated with the Commissions safety goals. When accounting for the modeling changes associated with the 2020-FLEX case, this margin increases to approximately a factor of 200. Further, terminating the ac cident and radiological release analysis at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after SAMG entry, as opposed to 7 days after event initiation (as discussed in Section 3.3.2),

further increases the margin to the QHO to approximately a factor of 800. Lastly, using the alternative dose truncation model described in Section 3.3.2 (as opposed to the LNT model) suggests that there may be even more margin to the QHO. Note, in all these cases, the results only consider internal events and floods for the reactor, at-power. Later parts of this study will account for the risk from additional hazards.

23 Note, as discussed in Section 3.1.2, this human error probability is an assumed parametric value chosen by expert judgement and is not the result of a formal human reliability analysis.

3-35 Figure 3.3-1 Release Category Contribution to the 0-1.8-mile Population-Weighted Early Fatality Risk Using Mean Release Category Frequencies (Circa -2012)

Figure 3.3-2 Release Category Contribution to the 0-1.8-mile Population-Weighted Early Fatality Risk Using Mean Release Category Frequencies (2020-FLEX)

3-36 Figure 3.3-3 Release Category Contribution to the 10-mile Population-Weighted Latent Cancer Fatality Risk Using Mean Release Category Frequencies (Circa 2012)

Figure 3.3-4 Release Category Contribution to the 10-mile Population-Weighted Latent Cancer Fatality Risk Using Mean Release Category Frequencies (2020 FLEX)

3-37 Figure 3.3-5 Individual Early Fatality Risk (0-1.8 miles)

Figure 3.3-6 Individual Latent Cancer Fatality Risk (0-10 miles)

3-38 Table 3.3-1 Population-Weighted Early Fatality Risk, by Release Category, for the 0 to 1.8 mile Interval for the Circa-2012 and 2020- FLEX Cases

Circa-2012 Case 2020- FLEX Case FLEX Impact Release Category Early Fatality % of Early Fatality % of (a-b)/a %

Name Risk (/rcy) (a) Total Risk (/rcy) (b) Total Total 3.4E-13 100% 3.2E-13 100% 6%

1-REL-V-F 2.1E-13 62% 2.1E-13 65%

1-REL-V-F-SC 9.1E-14 27% 9.1E-14 28%

1-REL-ISGTR 3.4E-14 10% 1.4E-14 4% 59%

1-REL-SGTR-O 6.0E-15 2% 6.0E-15 2%

Table 3.3-2 Population-Weighted Latent Cancer Fatality Risk, by Release Category, for the 0 to 10- mile Interval for the Circa-2012 and 2020- FLEX Cases

Circa-2012 Case 2020- FLEX Case FLEX Impact Release Category Latent Cancer % of Latent Cancer % of Name Fatality Risk Total Fatality Risk Total (a-b)/a %

(/rcy) (a) (/rcy) (b)

Total 2.6E-08 100% 9.6E-09 100% 63%

1-REL-LCF 1.8E-08 69% 6.1E-09 63% 66%

1-REL-ICF-BURN 6.1E-09 23% 2.7E-09 28% 56%

1-REL-ISGTR 5.0E-10 2% 2.0E-10 2% 60%

1-REL-LCF-SC 4.8E-10 2% 3.0E-10 3% 38%

1-REL-NOCF 3.6E-10 1% 8.0E-11 <1% 78%

3-39 4 KEY ASSUMPTIONS, CONSIDERATIONS, AND UNCERTAINTIES FOR THE 2020- FLEX CASE

This section documents key modeling assumptions, additional considerations (if any), and uncertainties associated with the 2020- FLEX case. This information is provided separately for the Level 1 PRA, Level 2 PRA, and Level 3 PRA in Sections 4.1, 4.2, and 4.3, respectively.

4.1 Level 1 PRA

This section contains a summary of 2020- FLEX case model. FLEX Support Guidelines (FSGs) are intended to provide preplanned FLEX strategies for performing specific tasks in support of emergency operating procedure (EOP) and abnormal occurrence procedure (AOP) functions to improve the capability to cope with beyond-design-basis external events (BDBEEs). Section 4.1.1 describes the key modeling assumptions and Section 4.1.2 summarizes the key uncertainties and their impact on the results.

4.1.1 Key Assumptions

Major assumptions for the Level 1 PRA portion of the 2020-FLEX case model are summarized below. This list includes the desired characteristics of a FLEX model as already used in the NRCs SPAR models. It should be noted, however, that not all these modeling points are necessarily used explicitly in the parametric sensitivity analysis documented in this report.

Some of these points are only included here to elaborate on the context and scope of the FLEX model basic events used in this sensitivity analysis.

• FLEX is considered for accident sequences modeled in the SBO event tree (ET). The SBO ET is entered when the Total Loss of All AC Power procedure is implemented.

The Circa-2012 case model was revised to account for FLEX if ELAP is declared, since FSGs are only activated after ELAP is declared in Section B of the procedure.

• Although FLEX strategies and equipment were stated in the reference plant FIP to be in response to BDBEEs, there is no explicit limitation in the plant FLEX documents and procedures to prevent taking credit for FLEX for internal events and internal flooding if SBO conditions exist and ELAP is declared, as long as no concurrent LOCA exists.

• ELAP may be declared as early as within the first hour following a reactor trip, and as late as within the fourth hour following a reactor trip.

• FSGs are called from ECA-0.0 (Loss of All AC Power). Accident sequences while ECA-0.0 is invoked are modeled in the SBO ET. If ELAP is not invoked, or before ELAP is invoked, Section A of ECA-0.0 is followed.

• When ELAP is invoked, Section B of ECA-0.0 is used. The accident sequences in this case are modeled in the SBO ET.

• FLEX strategies and equipment are assumed to be unable to satisfy PRA success criteria for LOCA events.

4-1

• ELAP declaration can apply to all h azard categories modeled as long as the SBO ET is entered in the sequence. Different hazard categories can lead to additional failure modes that can negatively impact the ability of the FLEX strategies to successfully accomplish the core cooling and RCS makeup functions.

• The mission time is assumed to be 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

• It is assumed that if the TDAFW pump is available, operators will use it as long as possible to cope with the sequence, until AC power is restored. That is, operator s will not voluntarily switch to low pressure SG injection via FSG 3, if the TDAFW pump is still operational and can remove decay heat.

• Success of FLEX or TDAFW operation includes eventual installed plant AC power recovery to reach a safe and stable end state. Indefinite FLEX operation (e.g., beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) is not considered a success. However, this does not impact the 2020- FLEX model quantification since a simplified modeling approach is used.

• In this model, a value of 0.01 is assigned as the combined failure probability of the shutdown seals to close and remain closed.

• The current state of knowledge limits NRCs ability to assign highly accurate human error probabilities to individual FLEX actions. Therefore, f or this sensitivity analysis no attempt is made to separately model equipment and human failure events. Instead, t he failure probabilities assigned to FLEX and continued TDAFW operation are meant to include equipment and operator failures as well as failure to recover AC power within 72 hrs. This simplified approach is deemed appropriate due to the uncertainties in modeling deployment actions and valid when the new nodes are independent from the other ET nodes.

• The failure probabilities used for FLEX and manual TDAFW pump operations are parametric values chosen by expert judgement, based on PRA experience, and experience with 70 SPAR models. The cases studied with different values of the parameter values are used to support the assertion that the selected base case values are reasonable and do not overly shift the results in either direction. This assertion is supported by the case results provided in Section 3.1.2 and Table 3.1-2. Table 3.1-2 shows a narrow spread of 2.7 (6.47/2.37) between total failure and total success of the three basic events modeled.

• For the purposes of propagating parametric uncertainty, the failure of the passive shutdown seals, FLEX strategies, and manual TDAFW pump operations are all represented by broad distributions. However, as mentioned previously, the relatively large number of basic events and cutsets used in the parametric uncertainty analysis appears to dilute (mask) the effect of basic events with higher uncertainties.

4.1.2 Key Uncertainties

The most important modeling uncertainties introduced in the 2020-FLEX case are associated with the probabilities assigned to the three new ET nodes characterizing the new shutdown seals and the two FLEX-related failures, as discussed below.

The FLEX-related revisions to the CDF model consist of adding three new ET nodes to the existing SBO ET to expand the number of possible success paths. These nodes address (1)

4-2 whether the RCP shutdown seal s operate successfully, (2) whether ELAP is declared and FLEX strategies are successfully implemented, and (3) if FLEX is unsuccessful, whether extended TDAFW pump operation is successful under extended SBO conditions.23F24

As discussed in Section 3.1.2, sensitivity analyses (referred to as alternative cases) were performed to assure that the failure probabilities assumed for these ET nodes are reasonable; namely, they do not significantly sway the results and insights in either a conservative or nonconservative direction.

Section 3.1.2 also highlighted a potentially significant uncertainty associated with the treatment of failures of the high-side input breakers for the reserve auxiliary transformers.

There are other modeling uncertainties inherited from the Circa -2012 model, upon which the FLEX scenarios are superimposed. These modeling uncertainties are already discussed in references (NRC, 2020b) and (NRC, 2020c) for the Circa-2012 model.

4.2 Level 2 PRA

This section contains a summary of the key model assumptions, additional considerations, and sources of uncertainty for the Level 2 PRA portion of the 2020- FLEX case. The Level 2 PRA model is influenced by the Level 1 PRA FLEX-related modeling changes that result in a reduction of the CDF. Section 4.2.1 describes the key modeling assumptions. Section 4.2.2 discusses other modeling considerations. Section 4.2.3 summarizes the key uncertainties and their impact on the results.

4.2.1 Key Assumptions

The key assumptions for the Level 2 PRA for the 2020- FLEX case model are summarized below.

• The Level 2 PRA for the Circa-2012 case considers extended manual operation of the TDAFW pump during certain slow-developing station blackout sequences. For the 2020-FLEX case, the credit for extended TDAFW pump operation is removed because it duplicates model changes that are made to the Level 1 portion of the model. The continued TDAFW pump operation is addressed in the Level 1 PRA portion of the 2020-FLEX case.

• The 2020- FLEX case release categories use the same representative source terms as the Circa-2012 case. The primary impact on the model with the inclusion of FLEX strategies and passive RCP shutdown seals is the reduction of release category frequencies, but the model changes also influence the accident progression sequences and related modeling assumptions. Each release category includes a mix of different accident sequences that have similar attributes but are not identical. The representative source term scenarios cannot exactly represent all the contributing elements. The representative source term should consider the balance of timing and magnitude to select a source term that conservatively bounds the range of outcomes for that release category. The considerations related to within release category variability are discussed

24 To simplify the ET structure, the extended TDAFW node is assumed to inherently include failures associated with the safe/ stable node from the original (Circa -2012 case) SBO ET model (note, the alternate charging node from the original SBO ET does not apply to the FLEX case).

4-3 in Section 2.5 of (NRC, 2020d). Those considerations generally apply to the 2020- FLEX case release category results. Although the FLEX changes have significantly reduced the frequency results, the contributing sequences remain consistent with the representative source term selections.

• The reference plants containment design does not require cooling or venting during the Phase 1 or P hase 2 FLEX implementation. Therefore, the inclusion of FLEX has no impact on the ability to control containment pressure or containment heat removal. The Level 2 PRA does consider longer -term actions directed by SAMGs for containment pressure control and containment heat removal. These actions are considered to be unaffected by the FLEX model changes.

• The modeled SAMG-directed actions are developed based on versions of the guidelines provided by the reference plant circa 2012. Updated versions of the SAMGs for the reference plant were later obtained, but these were not provided in time to be incorporated into the current analysis. In the updated SAMGs, FLEX equipment is listed as an option along with other installed plant equipment as possible ways to implement the strategies. Since the SAMGs are not prescriptive, but focus on accomplishing a function (e.g., control containment pressure) and provide options to accomplish it, the Level 2 modeling of SAMGs is primarily driven by HRA and plant conditions due to earlier failures, not by availability of equipment. Availability of FLEX equipment provides another layer of defense-in-depth but is not expected to have significant impact on the post-core damage modeling.

4.2.2 Additional Considerations

The inclusion of FLEX strategies significantly reduces the release frequen cies, but the representative release source terms are not changed. As discussed in the key assumptions above, the modeled release categories each include a range of accident sequences, which are collectively represented by a single representative source term. A significant contribution to the variation within release categories is the timing of equipment failures that can delay core damage and containment failure, which can reduce the resulting source terms. A range of accident scenario simulations and sensitivity studies have been performed to account for this variation. The boundary conditions of the cases that were simulated to generate potential source terms are described in Appendix B of (NRC, 2020d).

One aspect of the accident simulation cases that significantly influences the timing of core damage and containment failure is the continued operation of auxiliary feedwater ( AFW) during the accident sequence. The following variations were evaluated and are described in Appendix B of (NRC, 2020d).

• Case 1 - A station blackout scenario with the TDAFW pump available throughout the accident progression. This situation results in significant delay of core damage relative to the other simulated scenarios, and gradual containment overpressure failure does not occur within the accident simulation time of 7 days.

• Case 1A and its variations - A station blackout scenario with the TDAFW pump available for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the time of the initiating event. The scenario results in much earlier loss of heat removal from the SGs and onset of core damage compared to Case 1. In this scenario, the gradual overpressure of containment results in containment failure at

4-4 approximately 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br /> after the initiating event. Other variations of this case consider different modeling assumptions that can influence the occurrence of combustion events in containment.

• Case 1B and its variations - A station blackout scenario with TDAFW unavailable from the start of the accident. Like Case 1A, the accident progresses more rapidly without feedwater to the steam generators. Containment overpressure failure is predicted at approximately 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after the initiating event.

• Another sensitivity analysis (case MU -1.2) was performed as part of the uncertainty analysis in Appendix C of (NRC, 2020d). This case is a variation of Case 1A and extends the AFW availability from 4 to 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. The extended availability of AFW delays accident progression and eventual containment failure. Containment overpressure failure is predicted at approximately 86 hours9.953704e-4 days <br />0.0239 hours <br />1.421958e-4 weeks <br />3.2723e-5 months <br /> after the initiating event. The delayed containment failure and delayed environmental release results in a smaller total cumulative radiological release compared with Cases 1A and 1B.

In addition, other variations on the availability of AFW are addressed in Cases 3, 6, 7, and their variations. The different times of AFW availability give insights in to the impacts of delaying the accident progression. As discussed in the MU -1.2 sensitivity analysis, the timing of AFW availability has a somewhat linear impact on the timing of containment failure and environmental release.

With the implementation of FLEX strategies, it may be more likely that core cooling can be successfully extended. The reference plants FLEX implementation plan states that critical DC power can be extended to a minimum of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> by shedding unnecessary loads. These conditions would be more aligned with the MU-1.2 sensitivity case than with Cases 1A and 1B.

The sensitivity case results show that by delaying core damage, the eventual environmental releases are lessened. However, the representative source terms for the 2020- FLEX case are based on the Case 1A and 1B variations. The reasoning for using those representative cases is that the Level 1 PRA station blackout sequences that are passed to the Level 2 PRA include failures to implement FLEX and extend TDAFW operation. If those actions fail, then steam generator cooling is assumed to be lost early in the event progress ion, similar to the assumptions in Cases 1A and 1B. If those actions are successful, then core damage is avoided, and the sequences would not be addressed in the Level 2 PRA. Realistically, there could be a range of intermediate outcomes with different combinations of human and equipment failures that influence the timing of event progression, which w ould tend to reduce the environmental releases.

4.2.3 Key Uncertainties

There are several important modeling uncertainties that can affect the Level 2 PRA results. The model uncertainties for the Circa -2012 case are discussed in detail in Appendix C of (NRC, 2020d). In general, the same model uncertainties apply to the 2020-FLEX case.

As described in Section 3.2.2, alternative assumptions regarding accident termination and post-core damage recovery actions can significantly reduce the surrogate risk metric results for LERF, LRF, and CCFP. The alternative analyses show the impact of successful actions to terminate or recover the accident. However, modeling the reliability of such actions is beyond

4-5 the scope of the Level 2 HRA approach and generally beyond the state of practice in Level 2 PRA.

The model uncertainties that impact release magnitudes are not affected by the FLEX model changes. The same trends on the releases as discussed in Appendix C of (NRC, 2020d) also apply to the 2020- FLEX case results. Some of the key model uncertainties that can significantly impact the releases are discussed here.

• The impacts of assumptions regarding the timing of Level 1 PRA failures and system availabilities (e.g., extended battery life during station blackout) are discussed in Section 4.2.2, above.

• The timing of primary-side relief valve failure and realistic modeling of pressurizer relief tank (PRT) behavior can be very important in terms of cumulative iodine release, if it is proximate to the time of containment failure. The PRT drying out and increasing temperature causes the iodine and tellurium classes (in particular) to re-volatilize and increases the environmental release. Refer to sensitivity cases MU -4.2, MU-5.1A, and MU-5.1B in Appendix C of (NRC, 2020d) for additional discussion.

• Modeling assumptions related to accumulator injection can significantly affect the in-vessel melt progression. Increased accumulator injection flow rate delays aspects of the accident progression and aids in limiting the release. Refer to sensitivity case MU-4.1 in Appendix C of (NRC, 2020d) for additional discussion.

• The susceptibility of the containment fan coolers to combustion-induced failure would tend to shift the release category frequency from the 1-REL-BMT release category to the 1-REL-LCF release category. Refer to sensitivity case MU -2.1 in Appendix C of (NRC, 2020d) for additional discussion.

• The assumptions about location and size of containment failure can have a significant impact on environmental release. The long-term containment overpressure failure pathway is modeled through the tendon gallery. From there, two pathways are open, one to the environment with two-thirds of the flow area and the other to the auxiliary building with the remaining one-third flow area. If the release pathway is assumed only to open to the auxiliary building rather than directly to the environment, then significant auxili ary building fission product retention is seen. Refer to sensitivity case MU-8.1 in Appendix C of (NRC, 2020d) for additional discussion.

• Alternative treatments are explored for the uncertainty of the timing of SG tube and hot leg nozzle creep rupture for severe accident -induced SGTR, as well as uncertainty related to secondary-side retention (e.g., in the dryers and separators) of fission products in all SGTRs. The alternative treatments tend to reduce release to the environment. Refer to sensitivity cases MU-11.1 and MU-11.2 in Appendix C of (NRC, 2020d) for additional discussion.

• Uncertainties in ISLOCA modeling can impact the release. This includes modeling choices regarding the initial break size, whether the break is covered, turbulent deposition in the piping, and downstream effects on auxiliary building status. Refer to Section 4.10 of Appendix C of (NRC, 2020d) for additional discussion.

4-6

• Uncertainty in the containment isolation failure can significantly influence the release.

The modeling approach considers many potential isolation failure pathways (see Section 2.2 of Appendix D of [ NRC, 2020d] ). A representative failure of a 2-inch equivalent diameter failure area leading to the environment is used for t he containment isolation failure release category. If a larger equivalent diameter failure area is assumed, then the magnitude of the environmental release increases significantly. Refer to sensitivity case MU-12.1 in Appendix C of (NRC, 2020d) for additional discussion.

• The likelihood of containment failure is influenced by the uncertainty in the approach for modeling energetic burning of combustible gases; in particular, whether the combustion is most appropriately mode led as a deterministic process or a stochastic process. For this study a stochastic process was used. Refer to sensitivity case MU -7.1 in Appendix C of (NRC, 2020d) for discussion of the approach and related sensitivity analyses. The analyzed sensitivity cases demonstrate that a combustion event large enough to over-pressurize and fail containment is unlikely in the early phases of accident progression.

However, during the phase after vessel breach, combustion is much more likely, and without prior burn events early in the progression, the pressure caused by the combustion event could challenge the containment. The likelihood of the prior burn events is a key uncertainty in the combustion-induced containment failure modeling. The uncertainty in these and other modeling parameters may not be fully represented in a deterministic approach. However, t he deterministic analysis could suggest a lower likelihood for combustion events challenging containment integrity. This would tend to shift severe accident sequences from the 1-REL-ICF-BURN release category to the 1-REL-LCF release category.

4.3 Level 3 PRA

As discussed previously, FLEX strategies are intended to provide coping capability to prevent core damage. Therefore, the primary effect of FLEX strategies on the PRA model is a reduction of the CDF from sequences involving SBO events or RCP seal failures. The main impact on the Level 2 and Level 3 models for FLEX strategies is carrying forward the modified Level 1 sequences, which results in reduced frequencies for the applicable release categories.

As discussed in Section 4.2, the implementation of FLEX strategies may affect accident progression modeling impacting the timing and magnitude of releases. However, while the release category frequency results have changed in the 2020-FLEX case, the representative source terms are still consistent with the Level 2 logic model assumptions that were used in defining the release categories. Therefore, the 2020- FLEX case uses the same representative source terms as the circa -2012 case.

To the extent that the implementation of FLEX strategies alters accident progression timelines, the warning time (i.e., the time between the declaration of a general emergency and the onset of a major release) could either increase or decrease. An increase in the warning time would not have a significant effect on the results because the warning time is already sufficiently long for most release categories to significantly reduce early phase exposures. In principle, a decrease in the warning time could result in increased early phase exposures; the significance of this hypothetical situation would need to be balanced against the long warning times in the base case model, the reduction of core damage frequency associated with the 2020- FLEX case, and likelihood of lower release magnitudes associated with the more delayed accident progression.

4-7 The potential influences of the FLEX modeling changes on the scenario assumptions and timing are discussed in more detail in Section 4.2, but ultimately no changes were made to the representative accident scenarios or source terms. It is also not expected that there would be changes to other aspects of the Level 3 modeling (e.g., meteorology, atmospheric transport and diffusion, emergency response, economic factors, dosimetry, or health effects).

As indicated above, the 2020- FLEX case does not include any changes specific to the consequence analysis portion of the analysis; therefore, no specific assumptions, considerations, or uncertainties are identified here. However, it should be noted that the key assumptions, considerations, and uncertainties from the Circa-2012 case, as discussed in (NRC, 2020e), also apply to the 2020- FLEX case.

4-8 5 REFERENCES

HPS, 2010 Health Physics Society (HPS), Radiation Risk in Perspective: P osition Statement of t he H ealth Physics Society (PS010- 2), adopted January 19 96, revised July 2010, M cLean, V a.

HPS, 2019 Health Physics Society ( HPS), Radiation Risk in Perspective: Position Statement of t he H ealth Physics Society (PS010- 4), adopted January 19 96, revised February 2019, McLean, V a.

NRC, 1986 U.S. Nuclear Regulatory C ommission (USNRC), Safety G oals f or the Operations o f Nuclear P ower P lants, Policy Statement, Republication (51 FR 30028), Federal R egister, 1986.

NRC, 2012 USNRC, State-of-the-Art Reactor C onsequence Analyses ( SOARCA)

Report, NUREG-1935, November 2012 (Agencywide Documents A ccess and Management S ystem (ADAMS) Accession No. M L 12332A057).

NRC, 2022a USNRC, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 2: Background, Site and Plant Des cription, and Approach, April 2022 (ADAMS Accession No. ML22067A232).

NRC, 2022b USNRC, U.S. NRC Level 3 P robabilistic Risk A ssessment (PRA) P roject, Volume 3a, Part 1: Reactor, At-P ower, Level 1 PRA for Internal Events, Part 1 - Main Report, April 2022 (A DAMS Accession No. ML22067A211).

USNRC, U.S. NRC Level 3 Probabilistic Risk As sessment (PRA) Project, NRC, 2022c Volume 3b: Reactor, At-P ower, Level 1 PRA for Internal Flooding, April 2022 (ADAMS Accession No. ML22067A213).

USNRC, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, NRC, 2022d Volume 3c : Reactor, At-P ower, Level 2 PRA for Internal Events and Floods, April 2022 (ADAMS Accession No. ML22067A214).

USNRC, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, NRC, 2022e Volume 3d: Reactor, At-P ower, Level 3 PRA for Internal Events and Floods, April 2022 (ADAMS Accession No. ML22067A215).

5-1