ML23194A013
| ML23194A013 | |
| Person / Time | |
|---|---|
| Issue date: | 08/31/2023 |
| From: | Ball E, Alan Kuritzky NRC/RES/DRA/PRAB |
| To: | |
| References | |
| Download: ML23194A013 (1) | |
Text
NUREG-XXXX U.S. NRC Level 3 Probabilistic Risk Assessment Project Volume 4d: Reactor, At-Power, Level 2 PRA for Internal Fires, Seismic Events, and High Winds Office of Nuclear Regulatory Research This report, though formatted as a NUREG report, is currently being released as a draft (non-NUREG) technical report.
U.S. NRC Level 3 Probabilistic Risk Assessment Project Volume 4d: Reactor, At-Power, Level 2 PRA for Internal Fires, Seismic Events, and High Winds Office of Nuclear Regulatory Research Manuscript Completed: August 2023 Date Published: Month 20xx Prepared by:
E. Ball U.S. Nuclear Regulatory Commission A. Kuritzky, NRC Level 3 PRA Project Program Manager
iii ABSTRACT The U.S. Nuclear Regulatory Commission performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The scope of the L3PRA project encompasses all major radiological sources on the site (i.e., reactors, spent fuel pools, and dry cask storage), all internal and external hazards, and all modes of plant operation. A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources. This report, one of a series of reports documenting the models and analyses supporting the L3PRA project, specifically addresses the reactor, at-power, Level 2 PRA model for internal fires, seismic events, and wind events, for a single unit. The analyses documented herein are based information for the reference plant as it was designed and operated as of 2012 and do not reflect the plant as it is currently designed, licensed, operated, or maintained.1 CAUTION:
While the L3PRA project is intended to be a state-of-practice study, due to limitations in time, resources, and plant information, some technical aspects of the study were subjected to simplifications or were not fully addressed. As such, inclusion of approaches in the L3PRA project documentation should not be viewed as an endorsement of these approaches for regulatory purposes.
1 An overview report, which covers all three PRA levels, has been created for each major element of the L3PRA project scope (e.g., for the combined internal event and internal flood PRAs for a single reactor unit operating at full power). These overview reports include a reevaluation of plant risk based on a set of updated plant equipment and PRA model assumptions (e.g., incorporation of the current reactor coolant pump shutdown seal design at the reference plant and the potential impact of the U.S. nuclear power industrys proposed safety strategy, called Diverse and Flexible Coping Strategies [FLEX], both of which reduce the risk to the public).
v FOREWORD The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The staff undertook this project in response to Commission direction in the staff requirements memorandum dated September 21, 2011 (Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) resulting from SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment Activities, dated July 7, 2011 (ML11090A039).
Licensee information used in performing the Level 3 PRA project was voluntarily provided based on a licensed, operating nuclear power plant. The information provided reflects the plant as it was designed and operated as of 2012 and does not reflect the plant as it is currently designed, licensed, operated, or maintained. In addition, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models used in its regulatory decision-making. As such, the L3PRA project reports will not be the sole basis for any regulatory decisions specific to the reference plant.
Each set of L3PRA project reports covering the Level 1, 2, and 3 PRAs for a specific site radiological source, plant operating state, and hazard group is accompanied by an overview report. The overview reports summarize the results and insights from all three PRA levels.
To provide results and insights better aligned with the current design and operation of the reference plant, the overview reports also provide the results of a parametric sensitivity analysis based on a set of new plant equipment and PRA model assumptions for all three PRA levels.
The sensitivity analysis reflects the current reactor coolant pump shutdown seal design at the reference plant, as well as the potential impact of FLEX strategies,1 both of which reduce the risk to the public.
A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources (i.e., spent fuel in pools and dry storage casks).
These insights may be used to further enhance the regulatory framework and decision-making and to help focus limited agency resources on issues most directly related to the agencys mission to protect public health and safety. More specifically, potential future uses of the L3PRA project can be categorized as follows (a more detailed list is provided in SECY-12-0123, Update on Staff Plans to Apply the Full-Scope Site Level 3 PRA Project Results to the NRCs Regulatory Framework, dated September 13, 2012 [ML12202B170]):
1 FLEX refers to the U.S. nuclear power industrys proposed safety strategy, called Diverse and Flexible Coping Strategies. FLEX is intended to maintain long-term core and spent fuel cooling and containment integrity with installed plant equipment that is protected from natural hazards, as well as backup portable onsite equipment. If necessary, similar equipment can be brought from off site.
vi enhancing the technical basis for the use of risk information (e.g., obtaining updated and enhanced understanding of plant risk as compared to the Commissions safety goals) improving the PRA state of practice (e.g., demonstrating new methods for site risk assessments, which may be particularly advantageous in addressing the risk from advanced reactor designs, a multi-unit accident, or an accident involving spent fuel; and using PRA information to inform emergency planning) identifying safety and regulatory improvements (e.g., identifying potential safety improvements that may lead to either regulatory improvements or voluntary implementation by licensees) supporting knowledge management (e.g., developing or enhancing in-house PRA technical capabilities)
In addition, the overall L3PRA project model can be exercised to provide insights regarding other issues not explicitly included in the current project scope (e.g., security-related events or the use of accident tolerant fuel). Furthermore, some future advanced light-water reactor (ALWR) and advanced non-light-water reactor (NLWR) applicants may rely heavily on the results of analyses similar to those used in the L3PRA project to establish their licensing basis and design basis by using the Licensing Modernization Project (LMP) (NEI 18-04, Rev. 1) which was endorsed via Regulatory Guide 1.233 in June 2020. Licensees who use the LMP framework are required to perform Level 3 PRA analyses. Therefore, another potential use of the methodology and insights generated from this study is to inform regulatory, policy, and technical issues pertaining to ALWRs and NLWRs.
The results and perspectives from this report, as well as all other reports prepared in support of the L3PRA project, will be incorporated into a summary report to be published after all technical work for the L3PRA project has been completed.
vii TABLE OF CONTENTS ABSTRACT............................................................................................................................... iii FOREWORD.............................................................................................................................. v LIST OF FIGURES.................................................................................................................... ix LIST OF TABLES...................................................................................................................... xi EXECUTIVE
SUMMARY
......................................................................................................... xiii ACKNOWLEDGMENTS......................................................................................................... xvii ABBREVIATIONS AND ACRONYMS..................................................................................... xix 1
INTRODUCTION................................................................................................................1-1 1.1 Level 2 PRA Model Limitations...............................................................................1-3 1.2 Use of Computer Codes.........................................................................................1-5 2
TECHNICAL ELEMENTS..................................................................................................2-1 2.1 Scope.....................................................................................................................2-1 2.2 Level 1/2 PRA Interface - Accident Sequence Grouping........................................2-2 2.2.1 Step 1 - Development of the Bridge Event Tree.......................................2-4 2.2.2 Step 2 - Development of Plant Damage State Binning........................... 2-11 2.2.3 Step 3 - Review the Resulting Plant Damage States............................. 2-20 2.2.4 Step 4 - Iteration on the Level 1 PRA Modeling as Necessary............... 2-27 2.2.5 Step 5 - Criteria for, and Selection of, Representative Sequences........ 2-27 2.3 Containment Capacity Analysis............................................................................ 2-28 2.4 Severe Accident Progression Analysis.................................................................. 2-28 2.5 Probabilistic Treatment of Accident Progression................................................... 2-28 2.5.1 Step 1 - Response of SSCs Not Considered in the Level 1 PRA........... 2-29 2.5.2 Step 2 - Construction of the Containment Event Tree............................ 2-35 2.5.3 Step 3 - Development of Support Trees................................................ 2-42 2.5.4 Step 4 - Human Reliability Model Development.................................... 2-42 2.5.5 Step 5 - Human Reliability Analysis....................................................... 2-44 2.5.6 Step 6 - Level 2 Model Quantification.................................................... 2-47 2.5.7 Step 7 - Uncertainty Calculations.......................................................... 2-54 2.6 Radiological Source Term Analysis...................................................................... 2-64 2.6.1 Step 1 - Definition of the Release Category Binning Logic..................... 2-64 2.6.2 Step 2 - Development of Source Terms for the Various Release Categories.............................................................................................. 2-67 2.6.3 Step 3 - Consideration of Uncertainties in the Source Term Development.......................................................................................... 2-71 2.7 Evaluation and Presentation of Results................................................................ 2-72 2.7.1 Consolidation of Results......................................................................... 2-72 2.7.2 Cross-Hazard Comparisons................................................................... 2-79 2.7.3 Comparison to Past Studies................................................................... 2-81
viii 2.7.4 Outcomes............................................................................................... 2-83 2.7.5 Recommendations................................................................................. 2-84 2.8 Level 2/3 PRA Interface........................................................................................ 2-86 3
REFERENCES...................................................................................................................3-1 APPENDIX A FIRE, SEISMIC, AND WIND IMPACTS ON LEVEL 2 MODEL................... A-1 APPENDIX B DETAILED UNCERTAINTY CALCULATIONS........................................... B-1
ix LIST OF FIGURES Figure 2-1 Bridge Event Tree.............................................................................................2-5 Figure 2-2 The Plant Damage State Event Tree (1-PDS-EXT)......................................... 2-16 Figure 2-3 Comparison of PDS Frequencies as Percentage of Hazard CDF -
Graphical........................................................................................................ 2-25 Figure 2-4 Comparison of PDS Frequencies (per rcy) by Hazard, Logarithmic Scale
- Graphical..................................................................................................... 2-26 Figure 2-5 Containment Event Tree (1 of 4)..................................................................... 2-38 Figure 2-6 Containment Event Tree (2 of 4)..................................................................... 2-39 Figure 2-7 Containment Event Tree (3 of 4)..................................................................... 2-40 Figure 2-8 Containment Event Tree (4 of 4)..................................................................... 2-41 Figure 2-9 Release Category Contributions for Fire Events - Graphical.......................... 2-53 Figure 2-10 Release Category Contributions for Seismic Events - Graphical.................... 2-53 Figure 2-11 Release Category Contributions for High Wind Events - Graphical................ 2-53 Figure 2-12 Fire, Seismic, and Wind Release Category Frequency Uncertainties.............. 2-56 Figure 2-13 Fire, Seismic, and Wind RCF Uncertainties, Logarithmic Scale...................... 2-57 Figure 2-14 Fire Initiator Fractional Contributions to each Release Category, by Building........................................................................................................... 2-75 Figure 2-15 Seismic Bin Fractional Contributions to Each Release Category..................... 2-76 Figure 2-16 Wind Initiator Fractional Contributions to Each Release Category.................. 2-77 Figure 2-17 Release Category ContributionsComparison Across Hazards..................... 2-80 Figure 2-18 Release Category FrequenciesComparison Across Hazards...................... 2-81 Figure A-1 Example Fault Tree for a Level 2 Operator Action............................................ A-2
xi LIST OF TABLES Table 1-1 Key Limitations That Could Impact Potential Applications.................................1-4 Table 2-1 Level 1 Core Damage Frequency (CDF) Contribution Results..........................2-3 Table 2-2 Fire Mapping for Containment Systems............................................................2-6 Table 2-3 Seismic Failure Probabilities for Containment Systems....................................2-9 Table 2-4 Summary of Bridge Tree HEP Manipulations.................................................. 2-10 Table 2-5 Additional Seismic Bridge Tree-Related Model Customization........................ 2-10 Table 2-6 Accident Types (ACCTYPE) in the 1-PDS-EXT Event Tree............................ 2-12 Table 2-7 Contribution of Direct Core Damage Seismic Sequences............................... 2-13 Table 2-8 Direct to Core Damage Sequence Damage State Characterization................ 2-14 Table 2-9 Seismic Failure Probabilities for SSCs in Direct to Core Damage Sequences...................................................................................................... 2-14 Table 2-10 Cross-Walk of Physical and Accident Sequence Characteristics from HLR L1-A........................................................................................................ 2-17 Table 2-11 PDS Frequency Comparison Across Hazards - Tabular (PDS Contributions Less Than 0.5 % of Hazard CDF are Suppressed).................... 2-22 Table 2-12 Hazard Contributions to PDS Frequency - Tabular (PDS Contributions Less Than 0.5 % of Hazard CDF are Suppressed)......................................... 2-23 Table 2-13 Hazard Impacts on Systems Explicitly and Implicitly Credited in the Level 2 PRA............................................................................................................. 2-31 Table 2-14 Review of Internal Events Post-Core-Damage HFEs...................................... 2-46 Table 2-15 Release Category Contributions for Fire Events - Tabular.............................. 2-49 Table 2-16 Release Category Contributions for Seismic Events - Tabular....................... 2-50 Table 2-17 Release Category Contributions for High Wind Events - Tabular................... 2-52 Table 2-18 LERF Parameter Uncertainty Results Summary............................................. 2-56 Table 2-19 A Partial List of Hazard-Unique Model Uncertainties....................................... 2-58 Table 2-20 Mapping of Release Categories to Accident Characteristics........................... 2-65 Table 2-21 Description of Release Categories.................................................................. 2-66 Table 2-22 Preliminary EAL Classifications....................................................................... 2-69 Table 2-23 Comparison of Preliminary GE Time to Release Timings................................ 2-70 Table 2-24 Mapping of Source Terms to Release Categories without Truncation............. 2-71 Table 2-25 Risk Surrogates Presented for Different Accident Termination Times............. 2-74 Table 2-26 Identification of Significant Release Categories.............................................. 2-74 Table 2-27 Initial Inventories............................................................................................. 2-86 Table 2-28 Release Category Summary Table for the Level 3 PRA Analysis.................... 2-88
xii Table 2-29 Release Category Summary Table for Seismic Bins 6-8................................. 2-90 Table 2-30 Release Path Characterization........................................................................ 2-91 Table A-1 Equipment Required for Level 2 Operator Actions........................................... A-1 Table A-2 SSC Fire Impacts............................................................................................. A-4 Table A-3 Level 1-Developed Building and Structure Fragilities Relevant to the Level 2 PRA................................................................................................... A-11 Table A-4 Level 1-Developed System and Component Fragilities Relevant to the Level 2 PRA................................................................................................... A-12 Table A-5 Controlling Fragilities for Systems Unique to the Level 2 PRA....................... A-13 Table A-6 Seismic Failure Probabilities of Level 2 Systems........................................... A-14 Table A-7 Wind Fragility Availability for Level 2 PRA SSCs........................................... A-20 Table A-8 Wind Failure Probability Data For B5b Pump Warehouse............................. A-20 Table A-9 Wind Failure Basic Event Probabilities for B5b Pump................................... A-21 Table B-1 Basic Events Used in the Level 2 Fire PRA Model that Lacked Uncertainty Distributions.................................................................................. B-1 Table B-2 Assignment of Uncertainty to Basic Events Used in the Level 2 Seismic PRA Model....................................................................................................... B-2 Table B-3 Assignment of Uncertainty to Basic Events Used in the Level 2 High Wind PRA Model.............................................................................................. B-4 Table B-4 Tabular Results of Release Category Uncertainty Analysis: Internal Fires....... B-6 Table B-5 Tabular Results of Release Category Uncertainty Analysis: Seismic Events.............................................................................................................. B-7 Table B-6 Tabular Results of Release Category Uncertainty Analysis: Wind Events........ B-8 Table B-7 Increased HEPs for Level 2 Operator Actions.................................................. B-9 Table B-8 Fire Release Category Frequencies with Increased Level 2 PRA HEPs........ B-10 Table B-9 Seismic Release Category Frequencies with Increased Level 2 PRA HEPs............................................................................................................. B-10 Table B-10 Seismic Release Category Frequencies with SCUBE.................................... B-11
xiii EXECUTIVE
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The staff undertook this project in response to Commission direction in the staff requirements memorandum dated September 21, 2011 (Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) resulting from SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment Activities, dated July 7, 2011 (ML11090A039).
As described in SECY-11-0089, the objectives of the L3PRA project are the following:
Develop a Level 3 PRA, generally based on current state-of-practice methods, tools, and data, that (1) reflects technical advances since the last NRC-sponsored Level 3 PRAs (ML040140729), which were completed over 30 years ago, and (2) addresses scope considerations that were not previously considered (e.g., low power and shutdown risk, multi-unit risk, other radiological sources).
Extract new insights to enhance regulatory decision making and to help focus limited NRC resources on issues most directly related to the agencys mission to protect public health and safety.
Enhance PRA staff capability and expertise and improve documentation practices to make PRA information more accessible, retrievable, and understandable.
Demonstrate technical feasibility and evaluate the realistic cost of developing new Level 3 PRAs.
This report documents the single-unit, reactor at-power, Level 2 PRA for internal fires, seismic events, and wind events to support that supports the L3PRA project. Licensee information used in performing the L3PRA project was voluntarily provided based on a licensed, operating nuclear power plant. The information provided reflects the plant as it was designed and operated as of 2012 and does not reflect the plant as it is currently designed, licensed, operated, or maintained. (For example, the L3PRA does not reflect the current reactor coolant pump shutdown seal design or the potential impact of FLEX strategies.1) In addition, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models. As such, this report will not be the sole basis for any regulatory decisions specific to the reference plant.
As a part of the L3PRA study, the NRC already constructed a Level 2, at-power, PRA model for internal events and floods using the Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) software. This Level 2 internal event PRA model is used as the starting point for the fire, seismic, and wind (FSW) model documented in this report. It 1 FLEX refers to the U.S. nuclear power industrys proposed safety strategy, called Diverse and Flexible Coping Strategies. FLEX is intended to maintain long-term core and spent fuel cooling and containment integrity with installed plant equipment that is protected from natural hazards, as well as backup portable onsite equipment. If necessary, similar equipment can be brought from off site.
xiv further incorporates Level 1 PRA modeling previously developed for additional system failures that are specific to fire, seismic, and wind initiators. Building on the Level 1 FSW PRA models, it goes on to identify impacts that were not important to core damage frequency (CDF) but could affect containment performance and post-core damage accident progression.
The following is a synopsis of the major outcomes stemming from the work described in this report:
A Level 2 PRA model for postulated at-power accidents caused by fire, seismic, or wind initiating events has been developed which covers a broad spectrum of severe accident scenarios, and which considers a variety of different systems, phenomena, and operator actions. This model is directly integrated with the corresponding Level 1 PRA, including the ability to inspect cutsets, importance measures, and sensitivities/uncertainties in an integrated fashion, though the process for doing so is more complex than the internal events/floods model.
The probabilistic model has a strong basis in underlying deterministic analysis, most notably using the Methods for Estimation of Leakages and Consequences of Releases (MELCOR) computer code, but also using other analytical tools where appropriate. It also benefits from a post-core-damage human reliability analysis method developed specifically for this project, but the quantitative extension of this method to fire, seismic, and wind initiators is beyond the state-of-practice. Sources of uncertainty have been examined and quantified where possible.
The vast majority (approximately 98-99 percent) of potential accidents were found to not contribute to the potential for early fatalities, while the large majority (approximately 90 percent for seismic and 99 percent for fire and wind) were found to not contribute to the potential for large early release (based on the potential for early injuries). The larger estimates of large early release frequency (LERF) in the seismic case are largely due to seismic-related failure of containment isolation.
Combustion-induced failure of containment hours (or tens of hours) after vessel breach, following sustained molten core-concrete interaction, was found to have an important contribution to the results, generally consistent with its importance in the Level 2 PRA for internal events and floods.
When accident sequences are carried out to longer timeframes (e.g., 7 days), without credit for successful mitigative actions beyond the initial core damage and vessel breach response, the majority of accidents ultimately lead to containment failure (resulting in relatively high large release frequency [LRF]2 and conditional containment failure probability [CCFP] estimates). Though radiological releases are generally lower in these cases than for the bypass, early containment impairment, and combustion-induced failure cases, they are still significant.
2 Note, LRF is not a risk metric used for operating U.S. reactors, and so comparison to LRF values or objectives for advanced light water reactors is not necessarily appropriate. Nevertheless, it has been tabulated in this study to provide additional context because (like CDF) it is a risk surrogate for long-term offsite consequences.
xv Due to the generally similar trends between the fire/seismic/wind results and the internal event/flood results, the observations about the impacts of accident termination time made in the Level 2 PRA for internal events and floods can be extended here:
o Consideration of longer-term recovery would not affect LERF.
o The greatest reduction in LRF would occur from recoveries related to controlling containment pressure, with additional benefit seen if this were combined with preventing combustion.
o The greatest reduction in CCFP would occur from combined recoveries to control containment pressure and prevent basemat melt-through (either one by itself would not be sufficient), with additional benefit seen if this is combined with controlling combustion.
xvii ACKNOWLEDGMENTS The authors of this report would like to thank the members of the Level 3 PRA project technical advisory group, who provided many constructive comments on this part of the Level 3 PRA project. The authors would also like to thank the following individuals for their contributions in the areas indicated:
Shawn Campbell, US NRC General support Keith Compton, US NRC Level 2/3 interface Anders Gilbertson, US NRC General support Felix Gonzalez, US NRC (formerly)
Fire modeling Donald Helton, US NRC (formerly)
Numerous aspects Stacey Hendrickson, Sandia National Laboratories (formerly) Human reliability analysis Christopher Hunter, US NRC Level 1/2 interface Roy Karimi, Energy Research, Inc.
Level 1/2 interface Mohsen Khatib-Rahbar, Energy Research, Inc.
Numerous aspects James Knudsen, Idaho National Laboratory Numerous aspects Alan Kuritzky, US NRC Numerous aspects Nick Melly, US NRC Fire modeling Jose Pires, US NRC Seismic modeling Selim Sancaktar, US NRC Level 1/2 interface and technical review Frederick Sock, US NRC Seismic modeling Steven Wessels, US NRC (formerly)
Plant damage state binning John Wreathall, John Wreathall & Company Human reliability analysis Michael Zavisca, Energy Research Inc.
General support
xix ABBREVIATIONS AND ACRONYMS AC Alternating current AFW Auxiliary feedwater ARV Atmospheric relief valves ASC Alternate shutdown capability BDD Binary decision diagram BMT Basemat melt-through CCDP Conditional core damage probability CCFP Conditional containment failure probability CCI Core-concrete interaction CCU Containment cooling unit CD Core damage CDF Core damage frequency CET Containment event tree CHR Containment heat removal CIF Contaiment isolation failure CLOOP Consequential LOOP C-SBO Consequential SBO CSLOCA Consequential small LOCA CST Condensate storage tank DCH Direct containment heating DET Decomposition event tree DSB Damage state bin EAL Emergency action level ECCS Emergency Core Cooling System ECCSAV ECCS Availability EDG Emergency diesel generator EDMG Extensive damage mitigation guideline EMG Emergency Management Guideline EOF Emergency Operations Facility EQK earthquake EVSE Ex-vessel steam explosions F&B feed and bleed
xx HEP Human error probability HFE Human failure event HRA Human reliability analysis HVAC Heating, ventilation, and air conditioning INL Idaho National Laboratory IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events ISGTR Induced steam generator tube rupture ISLOCA Interfacing systems LOCA IVSE In-vessel steam explosions LCF Late containment failure LERF Large early release frequency LLOCA Large LOCA LOCA Loss of coolant accident LOOP Loss of offsite power LOOPPC LOOP, Plant centered LRF Large release frequency MAAP Modular Accident Analysis Program MACCS MELCOR Accident Consequence Code System MCCI Molten core-concrete interaction MCR Main control room MCUB Minimal cutset upper bound MELCOR Methods for Estimation of Leakages and Consequences of Releases (This software is developed by Sandia National Laboratories for the U.S.
Nuclear Regulatory Commission [NRC] to model the progression of severe accidents in nuclear power plants.)
NRC U.S. Nuclear Regulatory Commission OBE Operating basis earthquake OSC Operations Support Center OTRANS Other transients PDS Plant damage state PERMS Process and effluent radiation monitoring system PGA Peak ground acceleration PPAFES Piping penetration area filter and exhaust system PRA Probability risk assessment
xxi Q&A Question and answer RASCAL Radiological Assessment System for Consequence AnaLysis RC (Fission product) Release category RCP Reactor coolant pump RCF (Fission product) Release category frequency RCS Reactor coolant system RHR Residual heat removal RWST Refueling water storage tank RWSTAV RWST Availaibility SAMG Severe accident management guidelines SAPHIRE Systems Analysis Programs for Hands-on Integrated Reliability Evaluations.
(This probabilistic risk and reliability assessment software is developed for the NRC by the Idaho National Laboratory.)
SBO Station blackout SCALE Standardized Computer Analyses for Licensing Evaluation SCUBE SAPHIRE Cut Set Upper Bound Estimator SG Steam generator SGTR Steam generator tube rupture SLOCA Small LOCA SOARCA State-of-the-Art Reactor Consequence Analysis SPRA Seismic PRA SRV Safety relief valve SSC Structure, system, or component SVN Refers to the subversion control software being used to maintain the PRA model configuration control TDAFW Turbine-driven auxiliary feedwater TSC Technical Support Center VB Vessel breach
1-1 1
INTRODUCTION The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The staff undertook this project in response to Commission direction in the staff requirements memorandum dated September 21, 2011 (Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) resulting from SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment Activities, dated July 7, 2011 (ML11090A039).
As described in SECY-11-0089, the objectives of the L3PRA project are the following:
Develop a Level 3 PRA, generally based on current state-of-practice methods, tools, and data,1 that (1) reflects technical advances since the last NRC-sponsored Level 3 PRAs (NRC, 1990), which were completed over 30 years ago, and (2) addresses scope considerations that were not previously considered (e.g., low-power and shutdown risk, multi-unit risk, other radiological sources).
Extract new insights to enhance regulatory decision-making and to help focus limited NRC resources on issues most directly related to the agencys mission to protect public health and safety.
Enhance PRA staff capability and expertise and improve documentation practices to make PRA information more accessible, retrievable, and understandable.
Demonstrate technical feasibility and evaluate the realistic cost of developing new Level 3 PRAs.
This report documents the reactor Level 2 PRA model for the reference PWR for internal fires, seismic events, and wind events, which supports the L3PRA project. The results provided in this report are for a single unita subsequent report in this series addresses multi-unit risk.
Licensee information used in the L3PRA project was voluntarily provided based on a licensed, operating nuclear power plant. The information provided reflects the plant as it was designed and operated as of 2012 and does not reflect the plant as it is currently designed, licensed, operated, or maintained. (For example, the L3PRA does not reflect the current versions of the severe accident management guidelines, which could influence the Level 2 PRA modeling.) In addition, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models. As such, the L3PRA project reports will not be the sole basis for any regulatory decisions specific to the reference plant.
Since the L3PRA project involves multiple PRA models, each of these models should be considered a living PRA until the entire project is complete. It is anticipated that the models 1 State-of-practice methods, tools, and data refer to those that are routinely used by the NRC and industry or have acceptance in the PRA technical community. While the L3PRA project is intended to be a state-of-practice study, note that there are several technical areas within the project scope that necessitated advancements in the state-of-practice (e.g., modeling of multi-unit site risk, modeling of spent fuel in pools or casks, and of human reliability analysis for other than internal events and internal fires).
1-2 and results of the L3PRA project are likely to evolve over time, as other parts of the project are developed, or as other technical issues are identified. As such, the final models and results of the project (which will be documented in a summary report to be published after all technical work for the L3PRA project has been completed) may differ in some ways from the models and results provided in the current report.
The series of reports for the L3PRA project are organized as follows:
Volume 1: Summary (to be published last)
Volume 2: Background, site and plant description, and technical approach Volume 3: Reactor, at-power, internal event and flood PRA (overview report)
Volume 3a: Level 1 PRA for internal events Volume 3b: Level 1 PRA for internal floods Volume 3c: Level 2 PRA for internal events and floods Volume 3d: Level 3 PRA for internal events and floods Volume 4: Reactor, at-power, internal fire and external event PRA (overview report)
Volume 4a: Level 1 PRA for internal fires Volume 4b: Level 1 PRA for seismic events Volume 4c: Level 1 PRA for high wind events and other hazards evaluation Volume 4d: Level 2 PRA for internal fires and seismic and wind-related events Volume 4e: Level 3 PRA for internal fires and seismic and wind-related events Volume 5: Reactor, low-power and shutdown, internal event PRA (overview report)
Volume 5a: Level 1 PRA for internal events Volume 5b: Level 2 PRA for internal events Volume 5c: Level 3 PRA for internal events Volume 6: Spent fuel pool all hazards PRA (overview report)
Volume 6a: Level 1 and Level 2 PRA Volume 6b: Level 3 PRA Volume 7: Dry cask storage, all hazards, Level 1, Level 2, and Level 3 PRA Volume 8: Integrated site risk, all hazards, Level 1, Level 2, and Level 3 PRA The starting point of the Level 2 PRA for internal fires, seismic events, and high winds is the corresponding Level 1 PRAs, documented in the following reports:
Level 1 internal fire PRA (NRC, 2023a)
Level 1 seismic event PRA (NRC, 2023b)
Level 1 high wind PRA (NRC, 2023c)
Since the Level 2 PRA is developed subsequent to the Level 1 PRA (though partially in parallel),
and is incorporated directly into the living PRA model, the Level 2 PRA is based on the current
1-3 fire, seismic, and wind PRAs as of the time that the Level 2 PRA final quantification is performed. To the extent this differs from the documented versions of the Level 1 PRAs, intervening changes are documented herein. Subsequent sections in this report discuss configuration control.
Note on terminology: Collectively, the hazards addressed here (fire, seismic, and wind, or F/S/W) are often referred to as external hazards even though the fires in question are actually an internal hazard.
The Level 1 probabilistic logic model is extended (in an integrated, single-model fashion) to carry event tree sequences beyond core damage, to their ultimate end-state in terms of radiological release to the environment. To do this, the Level 2 PRA developed by NRC for internal events and floods (NRC, 2022a) is heavily leveraged. Rather than creating a highly repetitive document, the current report serves as a delta document to explain how the external hazards Level 2 PRA differs from the internal event and flood PRA, and thus presumes that the reader has a working knowledge of the internal event and flood PRA. The remainder of this report is structured to parallel the format of the Level 2 PRA report for internal events and floods so as to facilitate its use as a delta document. Section 1.1 identifies several limitations of the Level 2 PRA model for fire, seismic, and wind. Section 1.2 discusses the use of computer codes for the Level 2 PRA. Section 2 provides the description of the technical elements of the Level 2 PRA and Section 3 provides a list of references. Appendix A describes the fire, seismic, and wind impacts on the Level 2 PRA model and Appendix B provides details of the parametric uncertainty calculations.
CAUTION:
While the L3PRA project is intended to be a state-of-practice study, due to limitations in time, resources, and plant information, some technical aspects of the study were subjected to simplifications or were not fully addressed. As such, inclusion of approaches in the L3PRA project documentation should not be viewed as an endorsement of these approaches for regulatory purposes.
1.1 Level 2 PRA Model Limitations Table 1-1 identifies several limitations that could impact potential applications of the Level 2 PRA for internal fires, seismic events, and high winds (some of which are carried over from the Level 2 PRA for internal events and floods).
1-4 Table 1-1 Key Limitations That Could Impact Potential Applications Item Description Scope At-power Low-power and shutdown operating modes are not currently modeled.2 These may or may not prove to be of significance for the subject site. Use of this model alone has the potential to under-estimate radiological release frequency from this stand-point.
Single-unit The other operating unit, and the two operating spent fuel pools, are not currently modeled.3 These are potentially important for the subject site due to coupling of accident management resources, and to a lesser degree, potential spatial interactions.
Use of this model alone will potentially significantly under-estimate the actual site-wide radiological release frequency from this stand-point.
Airborne pathway The focus of this model is airborne radiological releases only, and modeling decisions (e.g., release category selection) are made as such. When relevant, surface aqueous releases are noted, but only airborne releases are passed to the offsite consequence analysis.
Level-of-detail Surrounding structures Modeling of the surrounding structures is aimed at providing coarse perspectives on their effect on accident progression and fission product scrubbing. The estimated conditions in these structures (e.g., temperatures, combustible gas concentrations) should be used with caution, owing to the resolution (e.g., nodalization, modeling of internal structures) of their description within the MELCOR model.
Power level All accidents are assumed to initiate from 100 percent full-power operation during middle-of-cycle. Accidents starting from other power levels (i.e., during power ascension, power descension, or reduced-power operations) or significantly different portions of the cycle (i.e., near the beginning or end of the operating cycle), will have an effect on the results. The degree of change will be roughly proportional to the degree to which the starting conditions deviate. Note that long-lived nuclides (e.g., Cs-137) are most affected by the duration of time at full-power operation, while short-lived nuclides (e.g., I-131) are most affected by the power level during the period immediately prior to the accident. Thus, using middle-of-cycle assumptions gives a middle-of-the-spectrum estimate of the long-lived nuclides, and using full-power operation results in a high estimate of short-lived nuclides (relative to assuming reduced-power operation). Decay heat is a combination of these two sources; the middle-of-cycle decay heat is reasonably close to the end-of-cycle decay heat.
Data Data (unreliability due to random failures) modeling is not performed for some systems, as discussed further in Section 2.5.1. This limits the use of the PRA in assessing the impact of maintenance activities.
Limitations in fire mapping No new walkdowns or cable routing were performed for the Level 2 fire mapping, so the modeling here relies on the NRC Level 1 and underlying reference plant PRAs and inherits the simplifications and assumptions therein.
Limitations in fragilities No new walkdowns or cable routing were performed for the Level 2 seismic and wind fragilities, so the modeling here relies on the NRC Level 1 and underlying reference plant PRAs and inherits the simplifications and assumptions therein.
Survivability Survivability of equipment is handled qualitatively, as discussed in Section 2.3.6 of (NRC, 2022a). As such, the model may be limited in its usefulness in assessing the merit of activities related to hardening equipment.
2 Shutdown operating modes will be modeled as part of the L3PRA project (for internal events only) and will be addressed in a separate report.
3 The other operating unit, the two operating spent fuel pools, and dry cask storage will be modeled as part of the L3PRA project and will be addressed in separate reports.
1-5 Table 1-1 Key Limitations That Could Impact Potential Applications Item Description Modeling assumptions Numerous modeling assumptions These are addressed in the form of model uncertainties, which are discussed in Sections 2.5.7 and 2.6.3.
Model quantification SAPHIRE solve time and code robustness The model takes a very long time to solve and is prone to code crashes. It contains far more sequences, and generates far more cutsets, than SAPHIRE was initially designed to handle. When crashes do occur, the calculations are re-run in smaller batches, so results from crashed calculations are never used. Although this technique slows down the process and requires greater manual effort, it does not have any effect on results or insights. (Although still an issue, this problem has become less severe when using SAPHIRE 8.2) 1.2 Use of Computer Codes Relative to the internal events/floods PRA in (NRC, 2022a), no new deterministic calculations have been performed using LS-DYNA, ORIGEN, MELCOR, or RASCAL, thus no new configuration control information applies in this regard.
The two computer codes used most prominently in this report are MELCOR and SAPHIRE.
MELCORs use is discussed predominantly in Sections 2.3.2 through 2.3.5 of (NRC, 2022a), but there are a few key concepts worth introducing here. Since the time that the Source Term Code Package was used for the NUREG-1150 analysis, significant development has been undertaken to consolidate and advance the severe accident modeling modules into a single code capable of performing integrated severe accident analysis (i.e., MELCOR). The MELCOR code itself contains the necessary empirical and analytical formulations to capture major reactor thermal-hydraulic and severe accident physics. The MELCOR input models specify the geometry of major structures/systems/components (SSCs), the nominal operating conditions, and the response of major automatic control and protection systems. Initial and boundary conditions are specified for each calculation to define the particular plant configuration (including equipment and operator successes and failures) that are relevant to the PRA sequence or cutset being analyzed.
SAPHIRE is a fault tree and event tree PRA code designed to support event and condition assessment, and is used here to construct and solve the bridge event tree (Section 2.2.1), plant damage state (PDS) tree (Section 2.2.2), containment event tree (Section 2.5.2), and decomposition event trees (Section 2.5.3). This is all done in the same SAPHIRE project as the Level 1 PRA, resulting in a linked Level 1 and Level 2 PRA. As discussed later, the PDS tree is strictly a sorting tool to group similar sequences, whereas the bridge and containment trees are akin to Level 1 event trees (i.e., they apportion frequency based on successes and failures).
Decomposition event trees also apportion frequency based on successes and failures, but in a different way; each decomposition event tree sequence is assigned to one of a few end-states, each of which in turn maps to one of the branch points for the top event that called the decomposition event tree. Ultimately, a decomposition event tree is a more compact and traceable way of capturing Boolean logic that would otherwise require numerous fault trees.
Linkage rules are used to define how branch assignments are made (e.g., forced up-branch, forced down-branch, assignment of a split fraction, assignment of a fault tree) in all these event
1-6 tree types. Lastly, process flags are used to define what assumptions SAPHIRE makes when quantifying fault trees.
2-1 2
TECHNICAL ELEMENTS 2.1 Scope Some global assumptions, limitations, and other notes are covered in the following list, which largely re-states information provided in Section 1.1:
This report covers internal fire, seismic, and high wind initiating events during at-power operation4 for the reactor Level 2 PRA for Unit 1. Other modes, hazards, and radiological sources, and the integration of all of these, are the subject of other L3PRA project reports.
Other reactor designs (the reference plant is a 4-loop Westinghouse pressurized water reactor with a reinforced concrete large dry containment) are not within the scope of this study.
The current approach assumes that the two reactor units are identical (an assumption that will be re-visited during the site PRA task).
The current PRA does not include consideration of inadvertent criticality during core reflood, which is only of relevance for situations where the core is reflooded with unborated water following significant heatup of the fuel (to the point of melting poison material) but prior to core relocation.5 At this time, no PRA sequences credit recovery of the core in-vessel after core damage has initiated using unborated sources. Based on the results of the HRA/PRA, the only situation where in-vessel recovery is currently credited are a subset of the cases where operator action to depressurize an otherwise medium or high-pressure scenario leads to cold-leg accumulator injection (borated water) and subsequent secondary-side decay heat removal (Top Event 1-L2-IVREC). Even there, the failure probability is currently very high owing to phenomenological considerations related to coolability.
A key aspect to the buildout of the Level 2 PRA for internal fires, seismic events, and high winds is managing the PRA scope. As discussed in (NRC, 2022a), the internal events/floods Level 2 PRA was extremely cumbersome to quantify.6 Meanwhile, the Level 1 fire PRA has many more (approximately 24 times as many) sequences than did the internal events/floods PRA, and the seismic PRA has large failure probability challenges discussed later in this report, further exacerbating this quantification challenge. As such, the tactical approach taken in the Level 2 PRA development focuses on quantifying the higher-contributing CDF sequences for fire (by pruning the Level 1 model prior to release categorization). All seismic and wind sequences are quantified, and only fire sequences making up about 0.1 percent of fire CDF are left out. The use of pruning for some hazards and not others has minimal impact on risk insights because the pruning captures all sequences that contribute significantly to CDF.
4 Though notionally intended to cover all of Technical Specification Mode 1 (reactor power > 5%), this report practically is focused on accidents that occur at full-power operation, consistent with the associated Level 1 PRA.
5 The current accident management approach is to inject water regardless of re-criticality potential, though this potential might affect the flow rate used. Re-criticality is a possibility for ATWS and non-ATWS accidents. Plant-specific Severe Accident Management Guideline SAG-3 (Rev. 5, 2011) lists borated (e.g., spent fuel pool) and un-borated (e.g., firewater) RWST makeup sources.
6 The large number of sequences and long computation time are a result of the integrated Level 2 PRA approach, and a built-in software solution (in SAPHIRE or other PRA tools) is a potential enabling technology for future detailed PRAs that use similar methods.
2-2 To facilitate this model solution that focuses on higher-contributing sequences, a novel approach was developed. This process involves using a Python script to identify the CDF sequences generating the majority of the CDF, and then modifying the linkage rules to ignore all other sequences. More specifically, the linkage rules in the event tree used to control whether the quantification solves for CDF, PDS frequency, or release category frequency (1-CD-XFER-EXT) are re-written such that only certain sequences (those identified by the Python script) will proceed through the release category branch. All other sequences are sent to a dummy branch, and at the same time identified for sequence skipping in the initiator-specific event tree linkage rules, such that they are ultimately ignored in the quantification.7 This process is largely transparent to the user, since the model has already been pruned. However, the pruning would need to be re-applied if the Level 1 model changed, since the contributors to CDF would change. There may be ways to make this process more efficient (e.g., making the pruning process semi-permanent by adjusting the script to: (i) not over-write any changes made to the Level 1 linkage rules and (ii) making the script deal with the situation where a prior set of pruning rules is present).
This technique does have an unavoidable limitation that is expected to lead to some artificial frequency inflation between the pruned results and the results that would be obtained if the entire model could be solved. To understand this effect, it is first necessary to understand a little more about the SAPHIRE Explore Origin feature used to distill the results. This feature takes the set of cutsets resulting from the Solve and Gather8 of the model, and then re-associates each of these cutsets to a specific sequence in the model. In effect, this re-creates the linkage between a sequence and a (non-minimal) cutset that was broken during the Gather process.
Since a particular cutset can come from multiple sequences (with the duplicate cutsets having been minimized during the Gather process), SAPHIRE selects the most relevant sequence to re-assign a given cutset. Now, take the case where cutset X is generated from sequence 1 and sequence 2. When solving the full model (which has sequence 1 and sequence 2), cutset X might be re-associated with sequence 2. When solving a pruned model that only has sequence 1, cutset X would necessarily be re-associated with sequence 1. Therefore, pruning the model has resulted in an increase in sequence 1s frequency. This type of inflation may affect the PDS and release results, but is difficult to quantify because the un-pruned version of the model cannot be solved in order to make a comparison. However, it cannot exceed the decrease in frequency caused by the original pruning, since cutset frequencies are not affected and no additional cutsets are created. Due to the very low frequency contribution of the sequences pruned from the fire model, the effects are believed to be modest, and not a concern in light of other much larger sources of frequency inflation.
2.2 Level 1/2 PRA Interface - Accident Sequence Grouping The Level 1/2 PRA Interface consists of five interrelated steps:
- 1. Development of the bridge event tree
- 2. Development of plant damage state binning
- 3. Review of the resulting plant damage states 7 This process has to be enacted carefully, because otherwise the linking process takes a prohibitive amount of time.
More specifically, the initiator linkage rules that prune sequences can only be applied after the sequences have been initially linked (and thus it is necessary to only allow those sequences that will ultimately survive pruning to link through the large number of Level 2 sequences).
8 The term Solve refers to results that include within-sequence minimization, but not cross-sequence minimization.
Conversely, Gather refers to results that include both within-sequence and cross-sequence minimization.
2-3
- 4. Iteration on the Level 1 PRA modeling as necessary
- 5. Criteria for, and selection of, representative sequences The objective of the first step is to add additional containment systems to the end of the Level 1 PRA sequences. The objective of the second step is to develop the plant damage states that will be used to identify a manageable number of sequences for deterministic investigation. The objective of the third step is to review the resulting plant damage states to ensure adequate transfer of information across the Level 1 / Level 2 interface, such that information important to the Level 2 analysis (e.g., initiator and support system dependencies, operator action dependencies) is transferred and that credit is not being given for equipment or operator actions that are not appropriate for that plant damage state (or vice versa). The objective of the fourth step is to re-visit and refine any Level 1 modeling assumptions which adversely affected the plant damage state binning. The objective of the fifth step is to establish the criteria that will be used for the selection of representative sequences and to select those sequences for each plant damage state.
Table 2-1 shows the rank-ordered results of the fire, seismic, and wind Level 1 PRAs, by initiator. The Level 1 PRA probabilistic logic models that generated these results are the starting point for the Level 2 PRA.
Note that the Level 1 to Level 2 interface infrastructure used for the fire, seismic, and wind model parallels that used in the internal events and floods model. That is to say, all Level 1 event trees transfer to the tree 1-CD-XFER-EXT. That tree then transfers to one of several different end-states or trees, depending on what quantification is desired. A clone of the internal events and floods Level 2 PRA was used as the starting point for the Level 2 fire, seismic, and wind development, to allow development of new modeling while limiting the risk of unintended harm to the internal events and floods model.
Table 2-1 Level 1 Core Damage Frequency (CDF) Contribution Results Initiator CDF (/rcy)
Contrib.
Cutset count Internal Fires Description 1-FRI-A105-JY_AX:Total MCR Panel - AMSAC 11626Q5AMS Fire 2.68E-06 4.4 1264 1-FRI-1098-JD_B1:Total Train B Shutdown Panel 1-1605-P5-SDB Fire - No Spread 2.12E-06 3.4 3933 1-FRI-A105-JY_P2:Total MCB Panel QMCB A1 Fire - NSCW 2.08E-06 3.4 39 1-FRI-1091-J8_B100:Total 4160 VAC Swgr 1AA02 CUB 00 Fire 1.77E-06 2.9 1865 1-FRI-1092-J9_C104:Total 4160 VAC Swgr 1BA03 Cub 04 Fire 1.67E-06 2.7 2138 1-FRI-1092-J9_C204:Total 4160 VAC Swgr 1BA03 Cub 04 Damage - No Target Damage 1.55E-06 2.5 1846 1-FRI-1091-J8_B104:Total 4160 VAC Swgr 1AA02 CUB 04 Fire 1.55E-06 2.5 2235 1-FRI-1103-J8_B1:Total Train A Shutdown Panel 1-1605-P5-SDA Fire - No Spread 1.48E-06 2.4 3596 1-FRI-1146-VF_TR01_RR Bounding Transient 1.46E-06 2.4 1865 1-FRI-1078A-IL_G_RR:Tot 125 VDC Panel 1AD11 Fire 1.44E-06 2.4 3776 1-FRI-1094-KQ_B1:Total U1 Isolating Auxiliary Relay Cabinet 1ACPAR6 Fire 1.21E-06 2.0 1728 1-FRI-1091-J8_B200:Total 4160 VAC Swgr 1AA02 CUB 00 Fire
- No Target Damage 1.20E-06 2.0 1776
2-4 Table 2-1 Level 1 Core Damage Frequency (CDF) Contribution Results Initiator CDF (/rcy)
Contrib.
Cutset count 1-FRI-2080-M9_H1:Total 480 VAC MCC 2NBR Fire 1.15E-06 1.9 5920 1-FRI-1075-I8_C01:Total 480 VAC Swgr 1AB05 Fire 9.51E-07 1.6 2274 1-FRI-1140B-S1_B:Total FIRE - Elevation 171 - North 9.30E-07 1.5 1882 1-FRI-1121-KG_E1:Total U1 Isolating Auxiliary Relay Cabinet 1BCPAR7 Fire 9.22E-07 1.5 1819
< 1.3 Total (from SAPHIRE) 6.14E-05 232,784 Seismic Events Peak Ground Acceleration (g) 1-EQK-BIN-1: Total 0.173 1.30E-06 12.0 5168 1-EQK-BIN-2: Total 0.387 1.22E-06 11.3 4175 1-EQK-BIN-3: Total 0.592 1.62E-06 15.0 3889 1-EQK-BIN-4: Total 0.794 2.43E-06 22.5 4706 1-EQK-BIN-5: Total 0.995 2.24E-06 20.8 5667 1-EQK-BIN-6: Total 1.290 1.75E-06 16.2 9765 1-EQK-BIN-7: Total 1.940 2.34E-07 2.2 16 1-EQK-BIN-8: Total
>2.5 2.32E-09
< 0.1 1
Total (from SAPHIRE) 1.08E-05 100 33,387 High Winds Wind Speed (mph) 1-HWD-BIN-1: Total 96-110 3.31E-06 24.0 23332 1-HWD-BIN-2: Total 111-129 4.63E-06 33.6 15151 1-HWD-BIN-3: Total 130-156 2.15E-06 15.6 10910 1-HWD-BIN-4: Total
>156 2.42E-07 1.8 3653 1-TOR-BIN1-WM: Total 86-110 1.68E-07 1.2 3489 1-TOR-BIN1-WP: Total 86-110 7.37E-08 0.5 2161 1-TOR-BIN2-WM: Total 111-135 7.19E-07 5.2 4251 1-TOR-BIN2-WP: Total 111-135 3.95E-07 2.9 3029 1-TOR-BIN3-WM: Total 136-165 7.06E-07 5.1 4444 1-TOR-BIN3-WP: Total 136-165 4.29E-07 3.1 3269 1-TOR-BIN4-WM: Total
>165 6.98E-07 5.1 4635 1-TOR-BIN4-WP: Total
>165 2.79E-07 2.0 2640 Total (from SAPHIRE) 1.38E-05 100 80964 The Level 2 to Level 3 interface (Section 2.8) takes the form of source terms and frequencies for each of the 16 release categories. These are reported separately for each hazard, so that consequences for seismic, fire, and wind initiators can be calculated individually.
2.2.1 Step 1 - Development of the Bridge Event Tree Consistent with what is done in the internal events/floods Level 2 PRA (NRC, 2022a), a bridge tree is used to add the most critical containment systems into the Level 1 event trees. This tree is shown in Figure 2-1 and is identical to the internal events/floods model at the event tree level (other than adjustment of the nomenclature) but is different in terms of what underlies these top events. The three systems considered here are:
(1) Containment Isolation System (2) Containment Spray System (3) Containment Cooling Unit (CCU) System (a.k.a, Containment Fan Coolers)
2-5 Figure 2-1 Bridge Event Tree The basic approach for this modeling involves leveraging the internal events/floods system models but expanding these to factor in failure probabilities associated with the fire, seismic, and wind initiators. Changes made in this regard are captured in the following sub-sections.
Internal Fires The fire mapping of containment systems relies on work done in support of the Level 1 fire PRA (NRC, 2023a), which was incorporated into the SAPHIRE model as part of that work (the development and translation of information from the utility was broader than only the systems needed for the NRC Level 1 PRA). That activity led to the fire mapping captured in Table 2-2 for the three containment systems of interest. Note that the Level 2 PRA inherently relies on the Level 1 PRA fire sequence development for treatment of spurious operation, which considers these containment systems by virtue of their inclusion in the underlying reference plant large early release frequency (LERF) model (recall that containment spray and containment isolation are within scope of the utilitys LERF PRA even though they are not in scope for the NRCs Level 1 PRA); containment cooling is within-scope for both.
Cable routing information is largely unavailable for the containment spray system, so it is assumed to fail in most fire scenarios (the few exceptions are listed in Table 2-2). Because containment spray tends to decrease steam concentration and so increase the severity of combustion, there was some concern that this assumption might distort risk profiles. A sensitivity analysis was performed to evaluate what effects it might have on release category frequencies. The frequency of combustion failures is mostly unaffected because the containment cooling units are generally still available to decrease steam concentration if the sprays are assumed to fail due to fire. Disabling sprays for most fire scenarios does prevent scrubbing of releases that would otherwise occur in about 40 percent of combustion failures (i.e., moves some frequency from 1-REL-ICF-BURN-SC to 1-REL-ICF-BURN), which makes it a conservative assumption.
2-6 Table 2-2 Fire Mapping for Containment Systems System Fire Scenarios Containing Any Fire-Related Failure Fire Scenarios with Guaranteed System Failure Other Remarks Containment isolation system Multiple spurious 3/4 to 1 openings:
1017-AW_TR02_RR 1042B-I1_TR03 1044-D2_B1 1048-DC_TR01 1073-I7_TR03RR 1075-I8_E1 1075-I8_F01 1093-JA_TR03 1094-KQ_TR03 1095-JC_D5 1095-JC_E7 1095-JC_F4 1095-JC_G5 1095-JC_G7 1095-JC_J3 1097-JJ_TR04 1120-KH_J4_R 1120-KH_K3_R 1120-KH_L5 1120-KH_M4 1120-KH_M5 1121-KG_B1 1121-KG_E1 1121-KG_TR01 1133B-KK_D2 1133B-KK_H0 1140A-S1_E 1140B-S1_E 1151-IQ_TR03_RR 1176-K1_TR05 1176-K1_TR06 1176-K1_TR07 A105-JY_ABN4 A105-JY_AT0 A105-JY_L 1011B-A1_TR01 1023-B6_TR01 1075-I8_C01 1093-JA_TR04 1094-KQ_B1 1095-JC_B8 1097-JJ_TR01 1097-JJ_TR03 1120-KH_C6 1120-KH_E5 1120-KH_J5 1120-KH_K4 1120-KH_TR09 1151-IQ_TR03_RR A105-JY_AW0 Failures in the 2 to 4 modeling:
A105-JY_R0 (contains CIS-AOV-OO-HV-8028)
A105-JY_ABN4 YARD_TR01 A105-JY_L Failure is enforced using flag files, which are called in the linkage rules for each fire event tree Containment spray system ALL 210 fire zones EXCEPT:
1078A-IL_E 1079A-I9_I 2080-M9_H1 2091-N4-B100A105-JY-P2 A105-JY-Q1 A105-JY-Q6 A105-JY-S2 A105-JY-S3 A105-JY-S5 A105-AHVSWYD_B A105-HVSWYD_C A105-AHVSWYD_E Same as to the left - The modeling derives from the reference plants exclusionary analysis that only considers some fire zones Failure is enforced using flag files, which are called in the linkage rules for each fire event tree Containment cooling unit system Both trains:
YARD-TR01, A105-JY-ABN4 Train containing coolers 1, 2, 5, & 6:
1073-I7-TR03RR 1075-I8-C01 1075-I8-E1 1075-I8-F01 1078A-IL-C1 1078A-IL-G-_RR 1078A-IL-TR01 1085-JF-TR01 1091-J8-B100 1091-J8-B104 1091-J8-B3 1091-J8-C0 1091-J8-E2 1094-KQ-TR03 A105-JY_ABN4 A105-JY_P2 A105-JY_U3A YARD_TR01 Failure is enforced using flag files, which are called in the linkage rules for each fire event tree
2-7 Table 2-2 Fire Mapping for Containment Systems System Fire Scenarios Containing Any Fire-Related Failure Fire Scenarios with Guaranteed System Failure Other Remarks 1095-JC-B8 1103-J8-B1 1103-J8-TR01 1140A-S1-E 1151-IQ-TR3-RR A105-JY-AW0 A105-JY-AW3 Train containing coolers 3, 4, 7 & 8:
1062-JM-TR09 1071-IF-G1_RR 1079A-I9-B1 1079A-I9_TR01 1092-J9-C100 1092-J9-C113 1092-J9-C3 1093-J4-TR02 1093-JA-TR04 1097-JJ-TR01 1097-JJ-TR03 1097-JJ-TR04 1098-JD-B1 1098-JD-TR01 1120-KH-C6 1120-KH-TR09 1133B-KK-D2 1152-IN-TR02 1176-K1-TR04 1176-K1-TR06 A105-JY-AT0 A105-JY-AT3 Individual coolers:
1066-IA-TR02 (7,8) 1140B-S1-E (7, 8)
In addition to the above, it is necessary to fail operator actions in main control room (MCR) abandonment scenarios (consistent with the Level 1 PRAs modeling assumptions). This only requires the failing of two bridge tree actions (1-OA-CS-RECIRC and 1-OA-OP-PHASE-AH) for a single fire event tree (FRI-A105-JY_ABN4).
It is also necessary to consider the fire context on the operator actions unique to the bridge tree.
These fire analyses (performed by the utility) resulted in equal or lower HEPs for containment isolation and containment sprays than the internal event analyses, so for consistency, the internal event HEPs were retained for the fire scenarios.
Seismic Events Failure probabilities were developed for each of the eight seismic bins, as described in Appendix A.2, and these are implemented in the relevant system models as captured in Table 2-3. These bridge tree events use failure model J - user-defined mean seismic g-level -
and SAPHIRE calculates the nominal failure probability based on the uncertainty parameters entered.
Regarding the containment shell, this fragility approach does not directly model the possibility of a seismic event weakening the structure in a way that contributes to a later failure. Accounting quantitatively for possible weakening of the containment structure due to seismic events is beyond the state of practice at this time. The capacity of the containment shell is based on tangential shear stress, and "failure" due to a seismic event theoretically includes any effect that makes the structure unable to perform its function as designed, including changes to the pressure capacity (there can, however, be some plastic deformation without exceeding the
2-8 fragility). Therefore, the existing assumptions are likely conservative. Note also that failure of the containment penetrations is not addressed separately from the shell; seismic analysis of the penetrations is a candidate for future work.
In addition, it is necessary to consider the seismic context on the operator actions unique to the bridge tree. This analysis was performed using damage state bins as described in (NRC, 2023b), and led to some HEP increases summarized in Table 2-4.
The changes specifically due to seismic events are generally accommodated within the existing model quantification infrastructure (reliance on min-cut upper bound approximation to address large failure probabilities, etc.), but there were some situations that warranted further customization of the model. These are covered in Table 2-5.
2-9 Table 2-3 Seismic Failure Probabilities for Containment Systems System Seismic Bin Failure probability1 Basic event name Containment structural damage leading to an isolation failure Controlling SSC: containment shell Fault Tree: 1-CIS-SYS-EQ Am = 2.90g r = 0.23 u = 0.25 Bin 1 (0.1 - 0.3g)
Bin 2 (0.3 - 0.5g)
Bin 3 (0.5 - 0.7g)
Bin 4 (0.7 - 0.9g)
Bin 5 (0.9 - 1.1g)
Bin 6 (1.1 - 1.5g)
Bin 7 (1.5 - 2.5g)
Bin 8 (> 2.5g) 5.255x10-17 1.526x10-9 1.452x10-6 6.858x10-5 8.192x10-4 8.548x10-3 1.183x10-1 1 (assumed) 1-RPS-SYS-EQ1-CONT 1-RPS-SYS-EQ2-CONT 1-RPS-SYS-EQ3-CONT 1-RPS-SYS-EQ4-CONT 1-RPS-SYS-EQ5-CONT 1-RPS-SYS-EQ6-CONT 1-RPS-SYS-EQ7-CONT n/a3 Containment isolation system Controlling SSC: Vital ac inverter panels Fault Tree: 1-CIS-SYS-EQ Am = 1.85g r = 0.25 u = 0.32 Bin 1 (0.1 - 0.3g)
Bin 2 (0.3 - 0.5g)
Bin 3 (0.5 - 0.7g)
Bin 4 (0.7 - 0.9g)
Bin 5 (0.9 - 1.1g)
Bin 6 (1.1 - 1.5g)
Bin 7 (1.5 - 2.5g)
Bin 8 (> 2.5g) 2.682x10-9 5.840x10-5 2.508x10-3 1.863x10-2 6.335x10-2 1.873x10-1 5.466x10-1 1 (assumed) 1-CIS-SYS-EQ1-ISO 1-CIS-SYS-EQ2-ISO 1-CIS-SYS-EQ3-ISO 1-CIS-SYS-EQ4-ISO 1-CIS-SYS-EQ5-ISO 1-CIS-SYS-EQ6-ISO 1-CIS-SYS-EQ7-ISO n/a3 Containment spray system Controlling SSC: MOVs Fault Tree: 1-CSR-SYS-EQ Am = 1.89g r = 0.32 u = 0.32 Bin 1 (0.1 - 0.3g)
Bin 2 (0.3 - 0.5g)
Bin 3 (0.5 - 0.7g)
Bin 4 (0.7 - 0.9g)
Bin 5 (0.9 - 1.1g)
Bin 6 (1.1 - 1.5g)
Bin 7 (1.5 - 2.5g)
Bin 8 (> 2.5g) 6.337x10-8 2.288x10-4 5.158x10-3 2.766x10-2 7.814x10-2 1.993x10-1 5.230x10-1 1 (assumed) 1-CSR-SYS-EQ1-CS 1-CSR-SYS-EQ2-CS 1-CSR-SYS-EQ3-CS 1-CSR-SYS-EQ4-CS 1-CSR-SYS-EQ5-CS 1-CSR-SYS-EQ6-CS 1-CSR-SYS-EQ7-CS n/a3 Containment cooling unit system Controlling SSC: correlated failure of 5 fans2 Fault Tree: 1-CCU-SYS-EQ Am = 1.47g r = 0.32 u = 0.32 Bin 1 (0.1 - 0.3g)
Bin 2 (0.3 - 0.5g)
Bin 3 (0.5 - 0.7g)
Bin 4 (0.7 - 0.9g)
Bin 5 (0.9 - 1.1g)
Bin 6 (1.1 - 1.5g)
Bin 7 (1.5 - 2.5g)
Bin 8 (> 2.5g) 1.133x10-6 1.594x10-3 2.223x10-2 8.675x10-2 1.942x10-1 3.864x10-1 7.301x10-1 1 (assumed) 1-CCU-SYS-EQ1-CUNIT 1-CCU-SYS-EQ2-CUNIT 1-CCU-SYS-EQ3-CUNIT 1-CCU-SYS-EQ4-CUNIT 1-CCU-SYS-EQ5-CUNIT 1-CCU-SYS-EQ6-CUNIT 1-CCU-SYS-EQ7-CUNIT n/a3 1 These failure probabilities are calculated internally in SAPHIRE based on the Am and parameters and the mean PGA for the appropriate seismic bin. They differ slightly from the manually calculated failure probabilities used in previous versions of the model.
2 The system fragility is taken from the Level 1 PRA, which uses a 5-of-8 failure criteria. It is applied here as a simplifying assumption, even though the Level 2 PRA has an 8-of-8 failure criteria, on the assumption that seismic correlation would make the two estimates reasonably similar.
3 Failure for these seismic bins is enforced in the bridge tree linkage rules.
2-10 Table 2-4 Summary of Bridge Tree HEP Manipulations EQK Bin DSB Multiplier 1-OA-OP-PHASE-AH - Operator Fails to Manually Initiate Phase A Isolation 1-OA-CS-RECIRC -
Operators Fail to Align CS Recirculation New HEP Means of implementation New HEP Means of implementation 1
1-2 1
3E-3 Post-processing rule that invokes 1-OA-OP-PHASE-AH-EQ12 1.01 Flag File 1-EQ-HEP-TRUE sets this value to true 2
1-2 1
3E-3 1.01 3
2-3 3
9E-3 Post-processing rule that invokes 1-OA-OP-PHASE-AH-EQ3 1.0 4
2-3 5
1.5E-2 Post-processing rule that invokes 1-OA-OP-PHASE-AH-EQ456 1.0 5
3 5
1.5E-2 1.0 6
3 5
1.5E-2 1.0 7
4 Assume Failure 1.0 Post-processing rule that invokes 1-OA-OP-PHASE-AH-EQ7 1.0 8
4 Failure N/A - Containment systems are assumed failed 1 In the HEP dependency evaluation, a value of 0.5 was set. In implementing this adjustment, problems arose.
The underlying issue is that the internal events model handles HEP dependency for 1-OA-CS-RECIRC using a work-around within the fault tree (rather than post-processing rules) due to frequency inflation issues.
Meanwhile, the seismic Level 1 PRA sets a number of events to TRUE in a flag file as a conservative means of not needing to evaluate seismic impacts on low-contributing HEPs (RIR = ~1). This treatment on the part of the seismic Level 1 PRA results in certain operator actions (e.g., LLOCA recirc, F&B recirc) which appear in the spray fault tree work-around mentioned above to be set to TRUE, and causes containment spray to be failed.
This makes it difficult to provide credit for this particular HEP in Bins 1 and 2, without being invasive to the internal events modeling or the seismic Level 1 PRA. As a work-around prompted by these complications, and based on side testing that indicates the actual impact is less than 1x10-7/rcy in terms of the dis-allowed containment spray credit (and keeping in mind that this issue is only relevant to EQK Bins 1 & 2), the HEP is simply set to TRUE in all seismic bins.
Table 2-5 Additional Seismic Bridge Tree-Related Model Customization Symptom Solution Significant inflation is caused by high seismic failure probabilities in the bridge tree for bins 6 and 7 (and to some extent bins 4 and 5), which are not addressed by the general Level 1 PRAs approach to dealing with high failure probabilities and are not addressable solely with the use of process flags since the events in question are not at the top event (developed basic event) level.
In addition to W process flags, post-processing rules were added to insert success terms for seismic bins 4-7, whenever the containment system node takes the up-branch. Similar adjustments were not needed for lower seismic bins (less impact due to smaller failure probabilities), or for seismic bin 8 (because it is handled in linkage rules).
High Winds During a walkdown of the plant for highwinds performed on behalf of the NRC by Applied Research Associates (ARA), no wind missile or wind pressure vulnerabilities related to the containment isolation system, containment spray system, or containment cooling units were
2-11 identified. Therefore, the only change considered for the bridge tree was a possible increase to the HEPs, along the lines described for the seismic model in Table 2-4.
The multipliers used for seismic HEPs are chosen based on the Damage State Bin (DSB),
which is mapped to seismic bins in Table 5-8 of (NRC, 2023b). DSB 1 is defined as No damage to the SSCs credited in the internal events PRA, DSB2 as No damage to the SSCs credited in the internal events PRA, except for the switchyard, and DSB 3 as Widespread damage to non-safety related SSCs. Some damage expected to safety-related SSCs (NRC, 2023b). Given those definitions, essentially all wind scenarios fall into DSB 1 or DSB 2, since safety-related equipment is not generally vulnerable to wind damage.
For containment isolation (1-OA-OP-PHASE-AH) the seismic model uses the internal events HEP for DSB 1 and 2, with an increased HEP in DSB 3 or higher. Using the same approach, then, no HEP increase for wind is warranted. For containment spray recirculation, the HEP is drastically increased after seismic events based on the short time available, 9 minutes. This treatment could potentially be applicable to the wind model as well, but given the substantial conservatism involved and the limitation noted in Table 2-4, it was decided to use the internal events/fire HEP instead.
2.2.2 Step 2 - Development of Plant Damage State Binning This step includes the development of a plant damage state (PDS) binning event tree to determine the availability of certain Level 1 systems which describe the reactor and containment status at the time of core damage. By defining the PDS bins, an interface between the plant systems analysis done as part of Level 1 and the containment response analysis in Level 2 is established. In the logic model, Level 1 cutsets are carried forward to Level 2, and the PDS binning does not affect this, per se. Rather, the PDS quantification (and resulting bins) are used to establish a pinch-point (i.e., a large reduction in the number of failure combinations explicitly considered) to achieve tractability in the portions of the work that support the logic modeling.
The Level 2 PRA for internal fires, seismic events, and high winds heavily leverages the Level 1 PRA for internal events and floods, since the fire, seismic, and wind initiators are mapped into the Level 1 PRA event trees for internal events and floods.
As a reminder, the top events in the PDS event tree are:
Accident type (possible branches are listed in Table 2-6)
Steam generator (SG) cooling availability/success RWST availability/success Emergency core cooling system (ECCS) availability/success Along with the bridge event tree top events:
Containment isolation status Containment spray status Containment cooling unit status
2-12 Table 2-6 Accident Types (ACCTYPE) in the 1-PDS-EXT Event Tree Branch Number in 1-ACCTYPE Top Event Name Resulting Branches in PDS Tree 0 (success branch)
SLOCA 1-8 1
MLOCA 9-16 2
LLOCA 17-20 3
EXLOCA 21-24 4
TRANSIENT 25-32 5
SBO 33-36 6
SGTR-UNIS 37-44 7
SGTR-ISOL 45-52 8
S-ISLOCA 53-60 9
L-ISLOCA 61-64 For fire, seismic, and wind, PDS macros are created within the SAPHIRE linkage rules to facilitate leveraging the internal events PDS logic. First, a macro is used to gather all fire initiators (as there are 210 Level 1 fire trees that all have the same basic structure prior to transferring to internal events trees). Next, macros are defined to collect the fire/seismic/wind sequences that transfer to particular internal events initiators. For example, all fire and wind event trees and four seismic event trees have a single sequence that transfers to the Other Transients internal event tree (OTRANS). By then replacing the Other Transients initiator in the PDS logic with the Other Transients macro, the fire/seismic/wind sequences will be appropriately mapped to the intended PDS bins. This process is then repeated for other internal event initiators used by the external hazards Level 1 models (LOOPWR, SLOCA, LLOCA, ISINJ, LOSINJ, MLOCA, SSBI, and LOOPPC). This approach takes care of the PDS binning for the vast majority of the fire, seismic, and wind models, with two notable classes of exceptions discussed below.
The first exception to the above is that some fire sequences transfer to the consequential small LOCA internal events tree, which is a transfer tree (as opposed to an initiating event tree) in the Level 1 internal events PRA model. Due to this, additional logic must be added to bin these sequences. So, for instance, an additional criterion is added to the SLOCA accident type assignments to pick up the relevant fire-induced consequential SLOCA sequences. Similar logic is added into the SBO (station blackout) accident type rules, as well as to the rules for whether SG cooling is available, for an SLOCA sequence dominated by an SBO that results from a consequential LOOP (RWST availability and ECCS availability are unaffected because their logic relies only on the accident type top event).
The second exception to the above is that a few seismic sequences go directly to core damage, rather than mapping to internal events initiators. That is, they bypass all the logic from the Level 1 internal events model, so that most systems failures are not queried, and transfer to the 1-CD-XFER-EXT tree. This happens for seismic bins 1-7 as a result of major structural failures (in fault trees 1-STRC-CD-EQX) and automatically for seismic bin 8 (major structural failure is assumed to occur with probability 1). See Figure 4-4 in the Level 1 Seismic PRA report (NRC, 2023b) for more on major structural failures. In these cases, assumptions have to be made about the resulting plant damage state, because the Level 1 PRA sequence is under-specified from a Level 2 PRA perspective.
2-13 To provide context for the relative contribution of these sequences, Table 2-7 provides a breakdown that shows that these sequences are small contributors to seismic bins 1 and 2, a modest contributor to bins 3 through 6, and a large contributor to bins 7 and 8.
Table 2-7 Contribution of Direct Core Damage Seismic Sequences Seismic Bin CDF from direct-to-CD sequences (/rcy)
% Contrib. of Direct-to-CD Seq. to Total Bin CDF Bin 1 7.75E-13 0.0%
Bin 2 4.92E-09 0.3%
Bin 3 8.53E-08 3.7%
Bin 4 2.86E-07 7.7%
Bin 5 4.30E-07 9.7%
Bin 6 7.17E-07 9.9%
Bin 7 2.32E-07 47.4%
Bin 8 2.31E-09 99.6%
Total 1.76E-06 8.2%
Based on a review of the underlying seismic fragility and accident sequence information, it is assumed that for seismic sequences that go straight to core damage due to structural failure:
The accident type is best described as SBO with the exception of seismic bin 8.
No steam generator cooling is available.
The RWST is unavailable.
ECCS is unavailable.
In the internal events Level 2 PRA, station blackout is considered a more consequential damage state relative to a LOCA. Because station blackout disables most safety and control systems and prevents most operator actions, it is more likely to lead to containment failure (defined as any condition other than intact containment, including bypass, overpressure failure, basemat melt-through, etc.) and to large releases compared with a LOCA. The highest-contributing seismic station blackout PDSs (35-4, 36-3, and 36-4) have a conditional containment failure probability (CCFP) of 0.82-0.96, and the probability of ending up in the induced steam generator tube rupture (ISGTR) release category (which contributes to LERF9) is approximately 0.02. By contrast, the highest-contributing LOCA PDSs (03-4, 02-4, 07-3) have a CCFP of 0.48-0.57, with no significant contribution to ISGTR or other LERF release categories.
Table 2-8 depicts the CDF breakdown of direct to cre damage sequences for a variety of damage states.
Meanwhile, regardless of the ACCTYPE selection, containment isolation will still be queried in the bridge tree (so this aspect of containment failure is explicitly covered). As such, station blackout is the clear choice for these sequences. The presence of an un-recovered SBO determines unavailability of SG cooling (for all Level 2 PRA sequences except those crediting blind feeding with TD-AFW) and ECCS (no ac power). RWST unavailability is assumed, on the inclusive assumption that it has been damaged by the seismic event, which in reality would only 9 In this report, two definitions of LERF are provided, one based on early injuries and one based on early fatalities (as discussed in Section 2.7.1). Where numerical results for LERF are reported without specifying early injuries or early fatalities, then the phrase is generally assumed to apply to LERF (early injuries).
2-14 be the case for a portion of the sequence frequency (but is also largely moot with ECCS being failed).
Table 2-8 Direct to Core Damage Sequence Damage State Characterization Damage State Sequence Frequency
(/rcy)
Percentage of Direct to Core Damage Sequence Frequency SBO 1.58x10-6 89.9%
SBO coincident w/ LLOCA 8.34x10-8 4.7%
SBO coincident w/ containment failure 8.08x10-8 4.6%
SBO coincident w/ LLOCA and containment failure 1.34x10-8 0.8%
Total 1.76x10-6 100%
For additional context, Table 2-9 shows the seismic failure probabilities for those SSCs that are considered in evaluating the top event (fault tree) that sends sequences directly to core damage.
Table 2-9 Seismic Failure Probabilities for SSCs in Direct to Core Damage Sequences SSC BIN-1 BIN-2 BIN-3 BIN-4 BIN-5 BIN-6 BIN-7 BIN-8 Aux. Building 3.49E-12 2.57E-06 4.06E-04 6.06E-03 3.12E-02 1.29E-01 5.16E-01 7.79E-01 Control Building 1.84E-10 4.53E-06 2.55E-04 2.50E-03 1.09E-02 4.33E-02 2.18E-01 4.21E-01 Containment 5.75E-17 1.60E-09 1.47E-06 6.92E-05 8.27E-04 8.31E-03 1.17E-01 3.31E-01 Seismic Failure of Reactor Vessel 6.75E-17 1.43E-10 6.71E-08 2.60E-06 3.10E-05 3.60E-04 8.63E-03 3.94E-02 Nuclear Service Cooling Water Tower 5.90E-12 1.18E-06 1.40E-04 1.99E-03 1.07E-02 5.00E-02 2.77E-01 5.25E-01 Note, core damage due to an event in seismic bin 8 is not treated as a station blackout; instead, PDS linkage rules bin it as a large ISLOCA, so that the containment event tree (CET) can direct it to the 1-REL-V-F release category (ISLOCA with failed auxiliary building). ISLOCA is considered the most conservative end state with respect to early fatalities, based on results from the Level 3 PRA. Given the extreme accelerations associated with bin 8, it is appropriate to conservatively assume failure of all relevant components, including some that are normally evaluated as seismically robust (e.g., check valves). Therefore, the team decided that seismic bin 8 should be directed to whichever end state (release category) has the most severe consequences.
There are several possible risk metrics by which release category severity could be judged. Based on the Level 3 PRA:
SGTR-O has the highest cumulative cesium and iodine release fractions V-F has the highest conditional consequences for early fatalities and for population exceeding early-phase dose thresholds ECF and SGTR-O tend to have the highest conditional consequences for collective dose
2-15 ECF, ISGTR, CIF, ICF-BURN, and SGTR-O have the highest conditional consequences for latent fatalities SGTR-O and ECF tend to have the highest conditional consequences for land contamination, relocated population, and total economic costs ISLOCA with the auxiliary building failed (1-REL-V-F) is considered the most conservative end state with respect to early fatalities. However, when it comes to latent fatalities and other long-term consequences, SGTR-O or ECF would be more conservative.
Because the overall consequences in terms of early fatalities are otherwise small, an increase to ISLOCA is more likely to have a quantitative impact than a small increase to SGTR-O or ECF (which already have much higher release category frequencies). For this reason, seismic bin 8 is directed to the 1-REL-V-F release category.
When quantifying the model for PDS frequencies, the 1-PDS-Q-EXT event tree is used, which explicitly merges the 1-PDS-EXT event tree and the bridge event tree, and has end-states associated with the plant damage state bins. When quantifying the model for release frequency, core damage sequences are routed to the bridge event tree, from there to the 1-PDS-EXT event tree, and from there to the containment event tree. The 1-PDS-EXT event tree is shown in Figure 2-2. A transfer event tree (1-CD-XFER-EXT) is used within the current model to readily switch between core damage quantification, PDS quantification, PDS event tree linkage rule debugging, and release frequency quantification. Level 1 event tree linkage rules take care of routing the fire-, seismic-, and wind-originated sequences to 1-CD-XFER-EXT, since they would otherwise be routed to 1-CD-XFER (by virtue of transiting the internal event Level 1 PRA event trees).
Note that PDS binning, while represented as an event tree, does not have probabilities associated with the pathways (i.e., it sorts sequences into bins rather than adding additional conditional probabilities). To ensure that the PDS binning assignments are accurately handled via the aforementioned PDS binning rules, the model was linked, and the automatically-generated PDS bins were compared to the manually-generated PDS bins for fire and seismic.
2-16 Figure 2-2 The Plant Damage State Event Tree (1-PDS-EXT)
ZV-TRUE TRUE house event for accident matrix 1-ACCTYPE Accident Type 1-SGCOOL Steam Generator Cooling 1-RWSTAV Refueling Water Storage Tank 1-ECCSAV Emergency Core Cooling System End State (Phase - CD)
E-BRIDGE-N-EXT SLOCA 1
1-CET-EXT 2
1-CET-EXT 3
1-CET-EXT 4
1-CET-EXT 5
1-CET-EXT 6
1-CET-EXT 7
1-CET-EXT 8
1-CET-EXT MLOCA 9
1-CET-EXT 10 1-CET-EXT 11 1-CET-EXT 12 1-CET-EXT 13 1-CET-EXT 14 1-CET-EXT 15 1-CET-EXT 16 1-CET-EXT LLOCA 17 1-CET-EXT 18 1-CET-EXT 19 1-CET-EXT 20 1-CET-EXT EXLOCA 21 1-CET-EXT 22 1-CET-EXT 23 1-CET-EXT 24 1-CET-EXT Transient 25 1-CET-EXT 26 1-CET-EXT 27 1-CET-EXT 28 1-CET-EXT 29 1-CET-EXT 30 1-CET-EXT 31 1-CET-EXT 32 1-CET-EXT SBO 33 1-CET-EXT 34 1-CET-EXT 35 1-CET-EXT 36 1-CET-EXT SGTR-UNIS 37 1-CET-EXT 38 1-CET-EXT 39 1-CET-EXT 40 1-CET-EXT 41 1-CET-EXT 42 1-CET-EXT 43 1-CET-EXT 44 1-CET-EXT SGTR-ISOL 45 1-CET-EXT 46 1-CET-EXT 47 1-CET-EXT 48 1-CET-EXT 49 1-CET-EXT 50 1-CET-EXT 51 1-CET-EXT 52 1-CET-EXT S-ISLOCA 53 1-CET-EXT 54 1-CET-EXT 55 1-CET-EXT 56 1-CET-EXT 57 1-CET-EXT 58 1-CET-EXT 59 1-CET-EXT 60 1-CET-EXT L-ISLOCA 61 1-CET-EXT 62 1-CET-EXT 63 1-CET-EXT 64 1-CET-EXT
2-17 As a structural test of the model, and to comply with the Level 2 PRA Standard (ASME, 2014),
Table 2-10 provides a cross-walk of the modeling aspects covered by Supporting Requirements L1-A1 through L1-A3a of the Standard.
Table 2-10 Cross-Walk of Physical and Accident Sequence Characteristics from HLR L1-A Physical Characteristics Identified at the Time of Core Damage (L1-A1)
Accident Sequence Characteristics That Determine the Physical Characteristics (L1-A2)
Where the Physical Characteristics are Treated in the Model (L1-A3a)
Reactor coolant system (RCS) pressure Type of initiating event and subsequent accident sequence characteristics (i.e., accident type, operator depressurization, and availability of steam generator cooling).
The type of initiating event and subsequent accident sequence characteristics that affect the RCS pressure are queried by the PDS tree linkage rules for 1-ACCTYPE and 1-SGCOOL top events. This information is also used in 1-L2-DET-PRESVE.
RCS configuration Not applicable. This PRA only addresses at-power operations.
Not applicable.
ECCS status Type of initiating event and subsequent accident sequence characteristics, including ECCS and support system availabilities.
The type of initiating event and other accident sequence characteristics that affect the availability of the ECCS are queried by the PDS tree linkage rules for the 1-ECCSAV top event.
Containment isolation status System dependencies on supporting systems System availability External hazard initiator impacts The containment isolation system dependencies and status (i.e.,
system component failures) are modeled in the supporting fault tree logic for the 1-CISOL-H top event in the bridge tree, including impacts from the external hazards initiators.
Containment heat removal status System dependencies on supporting systems System availability External hazard initiator impacts The containment cooling unit system dependencies and status (i.e., system component failures) are modeled in the supporting fault tree logic for the 1-CONTCOOL-H top event in the bridge tree, including impacts from the external hazards initiators.
Containment integrity Type of initiating event (i.e., whether the containment is bypassed, seismic effects). Open containment situations are not within scope of the at-power model. Induced containment failure is within the scope of the CET.
Containment isolation is covered above, and direct impacts to containment function from seismic events are included therein.
Containment impairment prior to core damage is treated by the containment isolation event in the bridge tree, while impairment of containment after core damage is carried through by the sequence logic (and release category assignments) in the CET.
2-18 Table 2-10 Cross-Walk of Physical and Accident Sequence Characteristics from HLR L1-A Physical Characteristics Identified at the Time of Core Damage (L1-A1)
Accident Sequence Characteristics That Determine the Physical Characteristics (L1-A2)
Where the Physical Characteristics are Treated in the Model (L1-A3a)
Steam generator pressure Type of initiating event and subsequent accident sequence characteristics The type of initiating event and other accident sequence characteristics that affect the steam generator pressure are queried by the PDS tree linkage rules for the 1-SGCOOL top event.
Steam generator water level Type of initiating event and subsequent accident sequence characteristics The type of initiating event and other accident sequence characteristics that affect steam generator water level are queried by the PDS tree linkage rules for the 1-SGCOOL top event.
Steam generator tube integrity Type of initiating event, as well as other sequence logic for pressure-induced SGTRs The type of initiating event, and relevant sequence logic, is queried by the PDS tree linkage rules for the 1-ACCTYPE top event. Severe accident-induced SGTR is treated within the CET.
Containment pressure Initiating event information that would affect containment pressure (namely bypass) is passed in the 1-ACCTYPE PDS top. Other aspects are determined within the bridge tree and CET.
Containment isolation status, availability of sprays, and availability of heat removal all affect containment pressure.
These are all handled in the bridge tree. Other influencing characteristics, such as energetic events and core-concrete interaction are handled within the CET/DETs.
Availability/accessibility of mitigating equipment Type of initiating event and subsequent accident sequence characteristics No information on extensive damage mitigation guideline (EDMG) equipment (except for success or failure in blind feeding SGs in relevant station blackout [SBO]
situations) is passed from the Level 1 PRA since EDMGs are not generally addressed in the Level 1 PRA.
Information regarding the availability of mitigating equipment is queried by the PDS tree linkage rules. For example, the information passed through for steam generator pressure is also used to determine the availability of auxiliary feedwater (AFW) and the information passed through for ECCS status is used to determine the availability of ECCS. Accessibility is handled as part of the HRA, and indirectly uses Level 1 information. For example, certain actions in the auxiliary building might not be considered for ISLOCAs where the auxiliary building is likely to be flooded.
2-19 Table 2-10 Cross-Walk of Physical and Accident Sequence Characteristics from HLR L1-A Physical Characteristics Identified at the Time of Core Damage (L1-A1)
Accident Sequence Characteristics That Determine the Physical Characteristics (L1-A2)
Where the Physical Characteristics are Treated in the Model (L1-A3a)
Status of support systems Type of initiating event and subsequent accident sequence characteristics The PDS tree linkage rules query the Level 1 accident sequence logic for information on the status of support systems. The CET indirectly receives this information by virtue of the fact that the CET linkage rules query the PDS tree sequence logic. Detailed information about the support system availability is passed on to the Level 2 via the Level 1 cutsets, however, this information is not used as part of the accident progression modeling. Rather, support system information is manually addressed in the Level 2 HRA.
Time of core damage No information is passed from the Level 1 PRA.
The role of core damage timing in the Level 2 PRA model is handled via the CETs use of the Level 2-specific deterministic accident progression modeling, which includes the pre-core damage phase of the accident.
Status of other non-safety systems No information is passed from the Level 1 PRA.
Information about the status of non-safety systems is manually addressed in the Level 2 HRA.
Environmental or physical conditions caused by the hazards The initiator provides some basic indication of the type of environmental conditions that may be caused (e.g., the seismic acceleration or wind speed bin, the fire zone).
However, explicit information is not otherwise available/transferred.
Environmental hazards caused by the initiating event are considered within the Level 2 HRA and are based on subjective use of Level 1 PRA information. Note that environmental hazards caused by the severe accident itself are considered manually in the Level 2 HRA.
Design and configuration of surrounding structures Dependencies The only dependency currently modeled in this regard is the auxiliary building ventilation systems dependency on ac power (meant here to represent both the auxiliary building ventilation system and piping penetration area filtration and exhaust system).
2-20 Table 2-10 Cross-Walk of Physical and Accident Sequence Characteristics from HLR L1-A Physical Characteristics Identified at the Time of Core Damage (L1-A1)
Accident Sequence Characteristics That Determine the Physical Characteristics (L1-A2)
Where the Physical Characteristics are Treated in the Model (L1-A3a)
Physical effects of flooding Type of initiating event and subsequent accident sequence characteristics; note that external flooding was screened out of the external hazards PRA.
No information is passed from the Level 1 PRA regarding flooding in the auxiliary building during an ISLOCA as this information is handled manually.
Containment flooding and resultant instrument failure are not explicitly modeled.
Information about the physical effects of flooding is queried by the PDS tree linkage rules for the 1-ACCTYPE, 1-SGCOOL, 1-RWSTAV, and 1-ECCSAV top events, in that sequence logic (successes and failures) for flooding sequences are queried in the PDS tree in the same manner as is done for internal events.
2.2.3 Step 3 - Review the Resulting Plant Damage States Using the model described in the previous section, the PDS bin frequency was then quantified, and the resulting PDS bins were reviewed in order to gain confidence that critical information was being appropriately considered in the binning process. In addition, Appendix D of the Level 2 PRA for internal events and floods (NRC, 2022a) contains an entry entitled, SAPHIRE Level 1/2 PRA Interface, providing a simple tutorial about how SAPHIRE linkage rules are used to enact the logic. The results of the PDS quantification for internal events are described in Section 2.1.3 of (NRC, 2022a). In the current logic model, 384 unique PDS bins are possible.
This section provides the final calculated PDS frequencies for internal fires, seismic events, and high winds. For internal fires, pruning was performed to eliminate sequences contributing to the last 0.1 percent of CDF.
The results of the PDS binning are presented in tabular and graphical form, presenting slightly different subsets of the results to facilitate easy digestion. Table 2-11 presents the fire, seismic, and wind contributions to each PDS frequency alongside the internal event and flood contributions, and the percentage contribution of each PDS to the total CDF for each individual hazard. Table 2-12 shows the same frequencies and the percentage contribution of each hazard to the total frequency of each individual PDS. PDS bins contributing less than 0.5 percent of CDF for a particular hazard are left out for easier comparison of the significant contributors (which results in some rounding error). Figure 2-3 presents the percentage contributions of each PDS to each hazard from Table 2-11 in a graphical format. Figure 2-4 compares the PDS frequencies across all hazards, on a logarithmic scale, making it possible to see the contributions of the unisolated SGTR and ISLOCA PDSs that make up much of LERF.
As can be seen, some of the large contributors overlap, while there are also external hazard contributors that were not important to the internal event and flood PDS profile.
Given this comparison, it is clear that the fire, seismic, and wind PDS profiles are not grossly different than the internal event and flood PDS profiles. Although there are clear differences in
2-21 PDS profiles when comparing fire, seismic, and wind to internal events, there are also some commonalities (see Figure 2-3). In particular, all four of these models have PDS 35-4 as the most important, contributing between 24 percent (fire) and 92 percent (wind) of the release frequency, compared with 59 percent for internal events. Among the smaller contributing PDS, most do not closely match the internal event frequency distribution but do appear in the internal event results. This provides some confidence that the internal event and flood model is a reasonable launching-off point, while also suggesting that the addition of deterministic analysis (most notably MELCOR simulations and human reliability analysis) for additional PDS would be a worthwhile consideration for future work.
The biggest caveat for the PDS quantification results is that the current model continues to use the hard-wired consequential-SBO (C-SBO) binning logic from the internal event and flood PDS binning. This is by far the best way to keep the internal and external hazard models in sync with one another, but it is known to influence the binning of the results (i.e., introduce cases where sequences are improperly binned). This occurs because the types of sequences that were partial to C-SBO for internal events and floods (most notably transients with failure of AFW and F&B) are not as heavily influenced by C-SBO from the fire, seismic, and wind models. The inverse is true for other sequences. This simply reflects a shift from a model where random failures and human failures are of most importance, to one where probabilistic seismic and fire-related failures are most important.
There are a number of nuanced considerations that influence the motivation to alter or retain the internal event C-SBO treatment. Within the current modeling construct, sequences must be treated entirely as SBO or entirely as a different accident type (e.g., transient or small LOCA).
While being treated as an SBO is notionally more punitive (e.g., there is no credit for post-core damage actions for SBO sequences), this is not inherently so (other accident types can also contribute to bypass or containment failure release categories). As with most things Level 2 PRA-related, to classify a modeling decision as conservative necessitates very specific decisions about what specific output is of most interest (between release frequency, release timing, and release magnitude for various chemical classes). So practically speaking, one is left trying to ensure that the sequence treatment is the most relevant to its contribution (e.g., if more than 50 percent of the sequence contribution is not from SBO cutsets, then treat the entire sequence as non-SBO). For fire, detailed sequence analysis shows that this issue affects several percent of the overall fire CDF. Note that this is the theoretical maximum benefit from potential linkage rule changes (within the current modeling construct) because changing a given sequence rule generically (across all fire initiators) has the potential to break the contribution assumption for initiators where it is currently appropriate. The current treatment also tends to assign more sequences to the SBO damage states, which is expected to be broadly conservative.
2-22 Table 2-11 PDS Frequency Comparison Across Hazards - Tabular (PDS Contributions Less Than 0.5 % of Hazard CDF are Suppressed)
PDS Number1 Internal Events &
Floods Seismic Internal Fires (Pruned @ 99.9%)
Wind PDS Description Freq.
% of Hazard Freq.
% of Hazard Freq.
% of Hazard Freq.
% of Hazard PDS-02-3 2.90E-06 4.1%
SLOCA, no ECCS, no spray PDS-02-4 1.17E-05 17.7%
2.90E-07 2.1%
7.53E-06 10.6%
SLOCA, no ECCS, no spray, no coolers PDS-03-3 1.45E-07 1.0%
7.17E-06 10.1%
SLOCA, no RWST, no spray PDS-03-4 3.35E-07 2.4%
3.79E-07 0.5%
SLOCA, no RWST, no spray, no coolers PDS-03-6 1.10E-07 0.8%
SLOCA, no RWST, no isolation, no spray, no coolers PDS-05-4 1.44E-06 2.2%
1.74E-06 2.4%
7.25E-08 0.5%
SLOCA, no SG cooling, no spray, no coolers PDS-07-3 2.04E-07 1.5%
7.73E-07 1.1%
SLOCA, no SG cooling, no RWST, no spray PDS-11-3 1.18E-06 1.8%
MLOCA, no RWST, no spray PDS-12-1 4.92E-07 0.7%
MLOCA, no RWST, no ECCS PDS-12-2 3.07E-07 0.5%
MLOCA, no RWST, no ECCS, no coolers PDS-12-3 9.27E-07 1.3%
MLOCA, no RWST, no ECCS, no spray PDS-25-3 8.65E-08 0.6%
1.66E-06 2.3%
Transient, no spray PDS-25-4 8.36E-07 1.3%
5.31E-07 3.8%
1.94E-06 2.7%
Transient, no spray, no coolers PDS-25-6 7.88E-08 0.6%
Transient, no isolation, no spray, no coolers PDS-29-1 2.12E-06 3.2%
4.04E-06 5.7%
5.95E-07 4.3%
Transient, no SG cooling PDS-29-3 6.37E-07 4.5%
1.08E-05 15.1%
Transient, no SG cooling, no spray PDS-29-4 6.99E-06 10.6%
3.60E-07 2.6%
3.26E-06 4.6%
3.54E-07 2.5%
Transient, no SG cooling, no spray, no coolers PDS-29-6 1.35E-07 1.0%
Transient, no SG cooling, no isolation, no spray, no coolers PDS-35-3 8.59E-06 12.1%
SBO, no SG cooling, no spray PDS-35-4 3.89E-05 58.8%
7.82E-06 55.8%
1.72E-05 24.2%
1.28E-05 91.9%
SBO, no SG cooling, no spray, no coolers PDS-35-6 5.25E-07 3.8%
2.77E-07 0.4%
SBO, no SG cooling, no isolation, no spray, no coolers PDS-36-3 6.90E-07 4.9%
SBO, no SG cooling, no RWST, no spray PDS-36-4 1.28E-06 9.1%
SBO, no SG cooling, no RWST, no spray, no coolers PDS-36-6 3.63E-07 2.6%
SBO, no SG cooling, no RWST, no isolation, no spray, no coolers
2-23 Table 2-11 PDS Frequency Comparison Across Hazards - Tabular (PDS Contributions Less Than 0.5 % of Hazard CDF are Suppressed)
PDS Number1 Internal Events &
Floods Seismic Internal Fires (Pruned @ 99.9%)
Wind PDS Description PDS-43-3 1.38E-07 1.0%
Unisolated SGTR, no RWST, no spray PDS-43-4 7.24E-08 0.5%
Unisolated SGTR, no RWST, no spray, no coolers PDS-63-1 3.08E-07 0.5%
Large ISLOCA, no RWST 1 The PDS numbering has two portions. The first number is its branch number in the 1-PDS-EXT tree, which depends on the accident type (small LOCA, large LOCA, SBO, etc.) and the success or failure of the RWST, ECCS, and SG cooling. The second number is its branch in the bridge tree, which indicates success or failure of containment isolation, sprays, and cooling units.
Table 2-12 Hazard Contributions to PDS Frequency - Tabular (PDS Contributions Less Than 0.5 % of Hazard CDF are Suppressed)
PDS Number Internal Events &
Floods Seismic Internal Fires (Pruned @ 99.9%)
Wind PDS Description Freq.
% of PDS Freq.
% of PDS Freq.
% of PDS Freq.
% of PDS PDS-02-3 2.90E-06 100%
SLOCA, no ECCS, no spray PDS-02-4 1.17E-05 60%
7.53E-06 39%
2.90E-07 1%
SLOCA, no ECCS, no spray, no coolers PDS-03-3 7.17E-06 98%
1.45E-07 2%
SLOCA, no RWST, no spray PDS-03-4 3.79E-07 53%
3.35E-07 47%
SLOCA, no RWST, no spray, no coolers PDS-03-6 1.10E-07 100%
SLOCA, no RWST, no isolation, no spray, no coolers PDS-05-4 1.44E-06 44%
1.74E-06 53%
7.25E-08 2%
SLOCA, no SG cooling, no spray, no coolers PDS-07-3 7.73E-07 79%
2.04E-07 21%
SLOCA, no SG cooling, no RWST, no spray PDS-11-3 1.18E-06 100%
MLOCA, no RWST, no spray PDS-12-1 4.92E-07 100%
MLOCA, no RWST, no ECCS PDS-12-2 3.07E-07 100%
MLOCA, no RWST, no ECCS, no coolers PDS-12-3 9.27E-07 100%
MLOCA, no RWST, no ECCS, no spray PDS-25-3 1.66E-06 95%
8.65E-08 5%
Transient, no spray
2-24 Table 2-12 Hazard Contributions to PDS Frequency - Tabular (PDS Contributions Less Than 0.5 % of Hazard CDF are Suppressed)
PDS Number Internal Events &
Floods Seismic Internal Fires (Pruned @ 99.9%)
Wind PDS Description Freq.
% of PDS Freq.
% of PDS Freq.
% of PDS Freq.
% of PDS PDS-25-4 8.36E-07 25%
1.94E-06 59%
5.31E-07 16%
Transient, no spray, no coolers PDS-25-6 7.88E-08 100%
Transient, no isolation, no spray, no coolers PDS-29-1 2.12E-06 31%
4.04E-06 60%
3.02E-07 9%
Transient, no SG cooling PDS-29-3 1.08E-05 94%
6.37E-07 6%
Transient, no SG cooling, no spray PDS-29-4 6.99E-06 64%
3.26E-06 30%
3.60E-07 3%
2.12E-07 3%
Transient, no SG cooling, no spray, no coolers PDS-29-6 1.35E-07 100%
Transient, no SG cooling, no isolation, no spray, no coolers PDS-35-3 8.59E-06 100%
SBO, no SG cooling, no spray PDS-35-4 3.89E-05 51%
1.72E-05 22%
7.82E-06 10%
6.79E-06 17%
SBO, no SG cooling, no spray, no coolers PDS-35-6 2.77E-07 35%
5.25E-07 65%
SBO, no SG cooling, no isolation, no spray, no coolers PDS-36-3 6.90E-07 100%
SBO, no SG cooling, no RWST, no spray PDS-36-4 1.28E-06 100%
SBO, no SG cooling, no RWST, no spray, no coolers PDS-36-6 3.63E-07 100%
SBO, no SG cooling, no RWST, no isolation, no spray, no coolers PDS-43-3 1.38E-07 100%
Unisolated SGTR, no RWST, no spray PDS-43-4 7.24E-08 100%
Unisolated SGTR, no RWST, no spray, no coolers PDS-63-1 3.08E-07 100%
2-25 Note:
PDS Bins are suppressed when the sum of the internal and external event PDS frequency is less than ~5x10-7/rcy.
Figure 2-3 Comparison of PDS Frequencies as Percentage of Hazard CDF - Graphical
2-26 Figure 2-4 Comparison of PDS Frequencies (per rcy) by Hazard, Logarithmic Scale -
Graphical Finally, a few additional modeling limitations and considerations already documented in the internal events and floods PDS quantification are repeated here (as they apply here as well):
Since the Level 1 PRA treats offsite power recovery at the event tree level, rather than the fault tree level, it is not captured by the containment systems evaluations in the bridge event tree. So in some cases, containment systems are treated as unavailable, whereas they could be potentially available following timely restoration of offsite power, if they are not affected by the operator failure to restore systems that dominates the relevant cutsets (e.g., see PDS-29-4 and PDS-05-4). This effect is sometimes further minimized by fire and seismic impacts overwhelming the random failure of these systems.
In some cases, there is insufficient information in the Level 1 PRA sequence logic to judge the availability of feedwater or ECCS, and numerous assumptions are encoded in the PDS binning logic. Exceptions to these rules manifest in the PDS binning of particular cutsets (e.g., see PDS-25-4). The need for these assumptions is not a universal problem for Level 2 PRA, but rather results from the choices to embed certain failures in fault trees rather than to create top events for them. Successes/failures that appear in fault trees are invisible at the sequence level and therefore cannot be used in the PDS sequence assignment rules.
2-27 Again, recall that PDS binning is performed as a convenient pinch-point for making modeling assumptions and guiding deterministic analysis, but all Level 1 sequences and cutsets are carried forward to the CET.
2.2.4 Step 4 - Iteration on the Level 1 PRA Modeling as Necessary No new work has been done in this subject area, and if interested in iteration performed in the internal events modeling (which is leveraged here), the reader is referred to Section 2.1.4 of (NRC, 2022a).
2.2.5 Step 5 - Criteria for, and Selection of, Representative Sequences As discussed in Section 2.1.5 of (NRC, 2022a), PDSs were selected for deterministic evaluation (i.e., were translated to representative sequences or sensitivities) if they:
Comprise an important portion of PDS frequency, or Are of potentially high conditional consequence based on projection of release magnitude or timing, or Illustrate or yield data or phenomenological insight (e.g., combustible gas accumulation, reactor coolant system [RCS] piping creep rupture behavior) into particular items of interest to the CET modeling.
As shown in the PDS binning results, there are a few significant contributors to fire and seismic PDSs (e.g., contribute at least 5 percent to a fire PDS or seismic PDS) that were not significant to the internal events and floods PRA (i.e., did not motivate a representative sequence in the internal events and floods modeling). PDSs that fall into this category include PDS-03-3, PDS-29-3, PDS-35-3, and PDS-36-4.10 PDS 36-4, which is a significant contributor to seismic, is identical to PDS 35-4 except that the RWST is unavailablea difference that is unlikely to matter given the lack of AC power and steam generator cooling.
In terms of higher-than-usual conditional consequences, the lack of a credible failure mode resulting in gross seismic-related containment failure makes this less of a concern (in terms of the similarity to the internal events and floods situation). Meanwhile, it is recognized that the fire/seismic/wind situation will create some unique situations with respect to equipment survivability and human reliability, but not necessarily in a way that new representative MELCOR analysis would be useful in exploring.
The existing analyses for internal events represent very similar containment failure modes to those expected in fire/wind/seismic scenarios. On the whole, it was judged that the benefit that would be gained from defining additional representative sequences (over those already identified and analyzed in the internal events model) would not be justified in light of the resource and scheduling issues that would be introduced.
10 A key reason for this is the higher predominance of -3 PDS bins in the fire results, stemming from the assumed failure of containment sprays for the vast majority of fire initiators caused by a lack of cable tracing for this system.
2-28 2.3 Containment Capacity Analysis The response of containment due to severe accident phenomena is assumed to be identical to what is developed in (NRC, 2022a). Other aspects of containment response, and more broadly structural response, are embedded within the sections of this report that deal with their manifestation in the PRA modeling, specifically:
Section 2.2.1 for seismic response of containment systems; Section 2.5.1 and Appendix A for seismic response of SSCs and effects of fire and wind initiators on the post-core-damage accident progression.
The seismic aspect of this work relies on the prior reference plant and NRC work for the Level 1 PRA and extends this work to develop fragility information for the SSCs that are relevant to the Level 2 PRA but that were not relevant to the Level 1 PRA. The outputs of that work are reproduced in the previously mentioned sections of this report that deal with the seismic response of containment systems and those systems of relevance to the post-core-damage Level 2 PRA.
2.4 Severe Accident Progression Analysis The severe accident progression is assumed to be analogous to that developed in (NRC, 2022a). Modeling seismic, fire, and wind effects on severe accident phenomena is beyond the state-of-practice and believed to play a minor role. A few theoretical examples of such effects are cited here:
Seismic-weakening of cladding that decreases the claddings integrity under high-temperature conditions, Seismic weakening of SG tubes that increases their susceptibility to creep-induced SGTR, and Fire-suppression material affecting the amount of fission product retention in the auxiliary building.
Note that fire, seismic, and wind effects directly on SSC availability and operator actions are addressed elsewhere in this report. Also note that the existing severe accident phenomena are applied to the specific accident sequences arising from the Level 1 fire, seismic, and wind PRAs.
2.5 Probabilistic Treatment of Accident Progression This subtask consists of seven interrelated steps:
- 2. Construction of the containment event tree
- 3. Development of support trees
- 4. Human reliability model development
- 5. Human reliability analysis
- 6. Level 2 model quantification
- 7. Uncertainty characterization
2-29 The objective of the first step is to consider the response of SSCs not considered in the Level 1 PRA. The objective of the second step is to develop the set of accident progression event tree (a.k.a., CET) top events, and the trees logic structure. The objective of the third step is to develop the severe accident phenomena and system response logic modeling (i.e.,
decomposition event trees [DETs]) needed to support the CET top events. The objective of the fourth step is to develop the human reliability analysis model to be used in considering post-core-damage actions. The objective of the fifth step is to exercise the human reliability analysis for the representative sequences. The objective of the sixth step is quantification of the Level 2 PRA, to arrive at release category frequencies (since the release categories are the end-states of the CET). The objective of the seventh step is to identify sources of parameter and model uncertainty, characterize these sources, and use uncertainty propagation and sensitivity analyses to assess the effects of key sources of uncertainty.
2.5.1 Step 1 - Response of SSCs Not Considered in the Level 1 PRA The response of containment systems to perform their engineered, design-basis accident functions has already been captured by the inclusion of containment sprays, containment fan coolers, and containment isolation in the bridge event tree. The underlying fault tree models in the bridge event tree capture these systems response, using a mix of information adopted from the licensees PRA model and information developed by NRC, following the lead of the Level 1 PRAs treatment of data issues, common-cause failure, etc. (NRC, 2022b). These system models are then augmented, as described in Section 2.2.1, to capture the external hazard impacts. Their failure is explicitly captured in the sequences (and cutsets) leading into the containment event tree.
This leaves systems that are modeled (or otherwise considered) within the containment event tree (and more precisely within the supporting decomposition event trees). These systems are those that either actuate automatically based on their design or are manually operated as part of the post-core-damage accident management (severe accident management guidelines
[SAMGs], EDMGs, or accident termination efforts). Reliability models were not developed in the internal events model, for a combination of reasons (e.g., high human reliability failure probabilities, no readily applicable data) covered in (NRC, 2022a). Detailed reliability evaluations for these systems would likely not have a first-order effect on their overall probability of being successfully employed and would thereby have less value.
Fire, seismic, and wind events complicate this situation, in that they can create a high likelihood of failure dependent on the initiating event. Thus, it is necessary to re-visit these systems in light of these hazards, to avoid inappropriate explicit or implicit credit for systems that are likely to be failed. To this end, the fragility and fire impacts work performed by the reference plant and the L3PRA Level 1 PRA were extended to consider these additional Level 2-relevant SSCs.
The fire and wind impacts analyses were impeded by lack of underlying information (cable tracing, relevant fire zone walkdowns, and fragilities for many systems), as the walkdowns were primarily focused on equipment relevant to Level 1. Nevertheless, this work led to a set of assumptions/assignments regarding the fire/seismic/wind impacts for the set of SSCs that are considered explicitly (i.e., appear in the model) and implicitly (i.e., do not appear in the model but that would need to provide some underlying functionality to support SSCs that do appear in the model). This information is distilled in Table 2-13. The translation of the seismic and wind fragilities into the bin-by-bin failure probabilities is provided in Appendix A, along with other modeling details.
2-30 Of the equipment for which no wind fragilities have been provided, much of it can generally be considered not vulnerable to high winds because it is inside buildings. One exception is the security diesel, which might become inaccessible since its exact location is not known (to the L3PRA staff). Minor additional insights for the Level 2 PRA RCF model might be gained from future work evaluating high wind fragilities for Level 2 actions that require access to buildings from outdoors (RWST refill by fire department; security diesel; etc.).
In cases where the MCR is unavailable due to fire, credit is not given for any Level 2 operator actions. Seismic failure of the main control room is not considered in the model because of the high seismic capacity of the control building; other equipment necessary for the relevant actions has lower capacity and therefore those actions are already very likely to fail in any situation where the control building is threatened. Relevant components within the MCR (main control board and 125V DC power panels) are considered, including the anchorage of those components to the control panel and the anchorage of the control panel within the control room.
Seismic failure of the MCR/TSC ventilation and filtering system is modeled, given its somewhat lower seismic capacity, but only for sequences where there is a presumed radiation hazard to personnel in the control building it is assumed that if containment remains isolated and not bypassed, the MCR and TSC can be used without the ventilation system. This assumption may be optimistic in cases of extreme heat or other conditions that inhibit natural ventilation through the opening of doors.
The Operations Support Center (OSC), on the other hand, has a fairly low seismic capacity. Its failure is likely (p > 0.5) in seismic bin 4 and higher. However, OSC failure is not included in the model. For some operator actions (SCG1-1, SCG1-4) OSC failure is irrelevant because they require the use of the EDMG pump, which has similar seismic capacity to the OSC, and so are unlikely to succeed if the OSC has failed. The rest of the operator actions, however, rely only on more robust components (auxiliary building, ARVs, motor control centers) that are likely to be operable after seismic events in bins 4, 5, and 6. Because the OSC has no unique features, its functions (mainly, as a gathering point) can more readily be duplicated in alternate (intact) locations. Therefore, the model assumes that failure of the OSC has no impact discernible within the resolution of the modeling on the human error probabilities for those actions.
2-31 Table 2-13 Hazard Impacts on Systems Explicitly and Implicitly Credited in the Level 2 PRA SSC(s)
General background Fire Impacts Seismic impacts Wind impacts Explicitly considered TD-AFW blind feeding This line item refers to blind feeding of SGs similar to the use of TD-AFW in more traditional contexts - blind feeding adds the additional complexity of manually operating the pump, manually opening SG ARVs, manually monitoring SG level, and performing CST refill, thus leading to locally and manually accessing equipment in numerous locations.
Equipment is failed in 28 fire zones, as catalogued in Table A-2.
The median fragility of this item is determined to be 0.75g (see Table A-5).
Failure probabilities are provided for wind missile damage, but the highest one (at 289 mph) is just 6.0x10-3, so wind failure is not modeled.
RWST refill via County Fire Department (as part of SAG-3)
This action requires access to the RWST and its surrounding area.
Equipment is failed in 22 fire zones, as catalogued in Table A-2.
The median fragility of this item is determined to be 0.75g (see Table A-5).
No wind fragility information is available; access may be impeded by high winds.
Containment spray using the B5b pump This action requires access to the production warehouse, fire water storage tank, or demineralized water storage tank, and particular areas of the yard and either the auxiliary building or the fuel handling building.
No information could be found that would support specifically crediting or dis-crediting this equipment. It is anticipated to be un-impacted in virtually all fire scenarios, and as a simplifying assumption it is credited for all.
The median fragility of this item is determined to be 0.75g (see Table A-5).
Failures of the production warehouse roof due to wind pressure are the limiting fragilities.
Condensate system (to feed SGs as part of SAMG action)
This is similar to the use of this same equipment for the equivalent function in the Level 1 PRA.
Equipment is failed in 4 fire zones, as catalogued in Table A-2.
The median fragility of this item is determined to be 2.5g (see Table A-5).
Modeling of wind fragility is retained from Level 1.
Motor-driven AFW (to feed SGs as part of SAMG action)
This is similar to the use of this same equipment for the equivalent function in the Level 1 PRA.
Equipment is failed in 25 fire zones, as catalogued in Table A-2.
The median fragility of this item is determined to be 1.91g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
2-32 Table 2-13 Hazard Impacts on Systems Explicitly and Implicitly Credited in the Level 2 PRA SSC(s)
General background Fire Impacts Seismic impacts Wind impacts RHR (as part of SAMG action)
This is similar to the use of this same equipment for the equivalent function in the Level 1 PRA. That said, the equipment is not ultimately used in the modeling because of the high estimated HEP for the relevant SAMG action.
No information could be found that would support specifically crediting or dis-crediting this equipment.
The median fragility of this item is determined to be 1.91g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
Condenser steam dump system (as part of SAMG action)
This is similar to the use of this same equipment for the equivalent function in the Level 1 PRA.
No information could be found that would support specifically crediting or dis-crediting this equipment. In the absence of specific information, and with the expectation that the majority of fire zones would not affect the equipment, it is presumed available.
The median fragility of this item is determined to be 1.91g (see Table A-5).
Modeling of wind fragility is retained from Level 1.
Manual operation of ARVs as part of SAMG action This requires accessing and operating equipment in specific locations in the auxiliary building and the north and south main steam valve rooms.
Equipment is failed in 11 fire zones, as catalogued in Table A-2.
Multiple fragilities govern the overall fragilities, as captured in Table A-6.
Modeling of the fragility of the ARVs is retained from Level 1. No information is available for the 480V MCCs, but they are likely not vulnerable to wind.
Implicitly considered Post-accident monitoring instrumentation This line item refers to a very extensive amount of instrumentation that relates to a very wide range of plant SSCs and locations.
SAMGs acknowledge that some instrumentation may be unavailable or unreliable.
Numerous zones are identified that may impact this equipment, as catalogued in Table A-2.
The median fragility of this item is determined to be 2.5g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
2-33 Table 2-13 Hazard Impacts on Systems Explicitly and Implicitly Credited in the Level 2 PRA SSC(s)
General background Fire Impacts Seismic impacts Wind impacts Security diesel Specifics of its locations are not known (to the L3PRA staff), though it is expected that the majority of the equipment will be within, and adjacent to, the control building.
No information could be found that would support specifically crediting or dis-crediting this equipment.
The median fragility of this item is determined to be 0.99g (see Table A-5).
No wind fragility information is available. Access to some of this equipment may be vulnerable.
Main control room and Technical Support Center (TSC) ventilation and filtering systems These systems are housed within the control building in the vicinity of the main control room and the TSC (which are both on Level 1).
Equipment is subject to fire impacts in 20 fire zones, as catalogued in Table A-2.
Multiple fragilities govern the overall fragilities, as captured in Table A-6.
No wind fragility information is available (likely not vulnerable to wind).
Auxiliary, control, turbine, and TD-AFW pump-house buildings for taking local actions This refers to general access to these structures for taking a myriad of actions and making observations in specific locations.
Equipment is subject to fire impacts in all but 18 fire zones, as catalogued in Table A-2.
The median fragilities of these items are determined to be 1.91g, 2.73g, 2.5g, and 7.05g, respectively.
(Table A-5).
Fragility information is provided only for the turbine building.
Access to some of these buildings may be vulnerable.
Operations Support Center (OSC) and Emergency Operations Facility (EOF) availability The OSC is located on the 2nd floor of the Maintenance Building. The EOF is located off-site (Birmingham).
No information could be found that would support specifically crediting or dis-crediting this equipment.
The median fragility of this item is determined to be 0.75g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
Effluent radiation monitors (e.g., main plant stack monitor)
This refers to radiation monitors in the process and effluent radiation monitoring system (PERMS), most notably RE-12442A/B/C, which is located in the plant stack ductwork.
No information could be found that would support specifically crediting or dis-crediting this equipment.
The median fragility of this item is determined to be 2.5g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
Piping penetration area filter and exhaust system (PPAFES) and auxiliary building ventilation system These systems are housed within the auxiliary building (meant here to denote both the auxiliary building and the area adjacent to containment sometimes referred to as the equipment building).
Equipment is subject to fire impacts in 2 fire zones, as catalogued in Table A-2.
The median fragility of this item is determined to be 2.5g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
2-34 Table 2-13 Hazard Impacts on Systems Explicitly and Implicitly Credited in the Level 2 PRA SSC(s)
General background Fire Impacts Seismic impacts Wind impacts Containment hydrogen sampling This refers to grab sampling capabilities retained after the post-accident sampling system was removed. The sampling lines are known to be on the A and grade (operating floor; Level 1) levels of containment, respectively. The ex-containment access point is in the area between the containment and the fuel handling building.
No information could be found that would support specifically crediting or dis-crediting this equipment.
The median fragility of this item is determined to be 2.5g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
Valves used in accident management (e.g., to isolate cold leg accumulators)
This is a catch-all for a range of equipment.
No information could be found that would support specifically crediting or dis-crediting this equipment.
The median fragility of this item is determined to be 2.5g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
Fire detection and suppression systems This is a catch-all for fire detection and suppression systems.
No information could be found that would support specifically crediting or dis-crediting this equipment.
The median fragility of this item is determined to be 0.99g (see Table A-5).
No wind fragility information is available (likely not vulnerable to wind).
2-35 2.5.2 Step 2 - Construction of the Containment Event Tree The accident progression sequences (i.e., the containment event tree and the underlying decomposition event trees) used for the fire, seismic, and winds PRAs is identical to that used for the internal event and flood PRA. Some of the descriptive information is repeated below from (NRC, 2022a) to provide a basic understanding of the modeling. The internal event and flood Level 2 PRA (NRC, 2022a) provides additional detail.
One containment event tree (CET) is used for managing all Level 2 PRA sequences.11 Top events in the CET are organized approximately in a chronological or causal order. The CET covers the following four time periods:
In-Vessel Time Frame: This period starts from the beginning of core damage and lasts up until (but not including) the time of vessel breach. Potentially important phenomena include hydrogen combustion; in-vessel steam explosions (IVSEs); and temperature-induced creep rupture of the hot leg nozzle, pressurizer surge line, or SG tubes.
Vessel Failure Time Frame: This period includes the time of vessel breach as well as the time associated with the containment transient just after vessel breach (typically a duration of less than 30 minutes). Potentially important phenomena accompanying vessel breach include direct containment heating (DCH), hydrogen combustion, vessel rocketing, and ex-vessel steam explosions (EVSEs).
Initial Ex-Vessel Time Frame: This period begins at the end of vessel blowdown (i.e., the end of the vessel failure time frame), and lasts for approximately 8-12 hours thereafter.
The duration of this time frame is chosen such that it includes the majority of the ex-vessel core debris oxidation and fission product release. Potentially important phenomena in this time frame include EVSEs and combustion of hydrogen and/or carbon monoxide generated during molten core-concrete interaction (MCCI).
Very Late Time Frame: This period extends from the end of the initial ex-vessel time frame until the end of the Level 2 PRA sequence. The potentially important phenomena in this time frame include quasi-static pressurization of the containment due to MCCI and decay heat, revaporization of radionuclides from surfaces (only relevant to source term analysis), and potential basemat melt-through (BMT) during MCCI.
The CET contains the following top events:
- 1. Special treatment for extremely slowly-developing scenarios (1-L2-REC) - This top event is used as a means of giving special treatment to extremely slowly-developing scenarios.
Currently, it only applies to indefinite blind feeding of SGs past battery depletion, which dramatically delays the time of core damage for SBO scenarios without elevated RCP seal leakage. Successful blind feeding at this top event is routed straight to a no containment failure end state, whereas the full accident progression treatment is performed otherwise.
11 In the SAPHIRE model for internal events and floods, the containment event tree is named CET. In the SAPHIRE model for external events, the containment event tree is named CET-EXT. Some of the containment event tree nodes in CET-EXT have the -EXT suffix. The corresponding versions of these decomposition event trees or fault trees reflect modeling changes to account for the impacts of the different external events. Otherwise, the CET and CET-EXT containment event trees are identical.
2-36
- 2. Containment status at the time of core damage (1-L2-SUM-CONTINT) - This event summarizes the status of the containment or containment bypass as of the time of core damage, using information from the bridge and PDS event trees (i.e., containment isolation status from the former and accident type from the latter). It is necessary in order for the downstream logic structure to properly account for differences in the behavior of issues such as bypass versus non-bypass sequences.
- 3. RCS pressure before vessel breach (1-L2-DET-PRESVE) - This event questions the RCS primary-side pressure during the time frame between the start of core damage and before vessel breach. It has three potential branches (Low, Medium, and High pressure) and is evaluated via a DET.
- 4. In-vessel recovery after the start of core damage (1-L2-IVREC) - This event evaluates the potential to arrest core damage by means of post-core-damage action in time to prevent core relocation and vessel breach. Its success is evaluated based on the RCS pressure, hardware availabilities, and the amount of time available for accident management. For ISLOCA sequences, no in-vessel recovery is considered since RCS inventory cannot be maintained indefinitely. Recovery for SGTRs is not explicitly treated, but the same effect is essentially covered by the scrubbing top events associated with these sequences.
- 5. Containment status during in-vessel phase (1-L2-DET-CONTVE) - This event evaluates whether containment failure occurs during the time frame after the start of core damage and before vessel breach. It has three branches corresponding to containment intact; containment failed due to overpressure or energetic event (e.g., hydrogen combustion);
and containment bypassed due to a pressure-induced or temperature-induced SGTR. It is evaluated via a DET.
- 6. Scrubbing of radionuclide release during in-vessel and vessel failure phase (1-L2-DET-SCRUBE) - This event questions whether the phase of the radiological release occurring during the time frame at or before vessel breach is mitigated by either a pool of water overlying the break location (in the case of containment bypass) or by containment systems (in the absence of containment bypass). It is evaluated via a DET.
- 7. Containment status at vessel breach (1-L2-DET-CONTE) - This event evaluates the potential for containment failure at or around the time of vessel breach due to phenomena such as IVSE or EVSE, vessel rocketing, DCH, or hydrogen combustion. It is evaluated via a DET.
- 8. Molten core-concrete interaction (1-L2-MCCI) - This event questions whether or not sustained basemat attack occurs in the reactor cavity by core-concrete interactions following vessel breach. It is evaluated using logic rules based upon the presence of water in the cavity. In addition, energetic events at vessel breach such as steam explosions could disperse the debris, rendering it coolable and prevent concentrated basemat attack.
- 9. Scrubbing of radioactive release after vessel failure (1-L2-DET-SCRUBL) - This event evaluates whether or not mitigation of the release by sprays or water pools occurs in the time frame following vessel breach. It is otherwise similar to event SCRUBE (above),
with the additional factor that water in the reactor cavity may be present to scrub the ex-vessel release. It is evaluated via a DET.
2-37
- 10. Containment status well after vessel failure (1-L2-DET-CONTL) - This event evaluates whether containment failure occurs in the late time frame following vessel breach, via overpressure or energetic event (e.g., hydrogen combustion), or by BMT. It is evaluated via a DET.
- 11. Atmosphere relief valve status (1-L2-ARV) - This event determines whether SG relief/safety valves are predominantly closed or cycling during release, or whether they remain open due to deliberate action or failure. This is important only for SGTR sequences in order to assign them to a proper release category.
- 12. Auxiliary building status (1-L2-DET-AB) - This event evaluates whether the auxiliary building fails due to overpressure during the post-core-damage accident progression (e.g., due to hydrogen combustion). It is important in assigning the proper release category for ISLOCA sequences, and it is evaluated via DET.
These top events combine the functionality of accident sequence characterization with that of a release categorization tree. As such, the end-states of the CET are the release categories (as opposed to a transfer to a release categorization tree). There are 148 sequences mapping to 16 release categories. The CET is shown in Figure 2-5 through Figure 2-8. It may be necessary to zoom in on the CET figures in order to read the text.
2-38 Figure 2-5 Containment Event Tree (1 of 4)
2-39 Figure 2-6 Containment Event Tree (2 of 4)
2-40 Figure 2-7 Containment Event Tree (3 of 4)
2-41 Figure 2-8 Containment Event Tree (4 of 4)
2-42 2.5.3 Step 3 - Development of Support Trees The support trees used, which again are identical to the internal events and floods PRA as discussed in the introduction to the preceding sub-section, take the following forms:
fault trees to support the top events in the bridge event tree - these are discussed in Section 2.2.1 linkage rule logic to support the plant damage state tree - these are discussed conceptually in Sections 2.2.2 and 2.2.3 fault trees and/or linkage rules to support some CET top events - these are briefly mentioned in Section 2.5.2 DETs to support the remaining CET top events - these are discussed briefly in this section The seven CET top events represented by DETs are repeated here:
- 1. RCS pressure before vessel breach (1-L2-DET-PRESVE)
- 2. Containment status during in-vessel phase (1-L2-DET-CONTVE)
- 3. Scrubbing of radionuclide release during in-vessel and vessel failure phase (1-L2-DET-SCRUBE)
- 4. Containment status at vessel breach (1-L2-DET-CONTE)
- 5. Scrubbing of radioactive release after vessel failure (1-L2-DET-SCRUBL)
- 6. Containment status well after vessel breach (1-L2-DET-CONTL)
- 7. Auxiliary building status (1-L2-DET-ABF)
A decomposition event tree functionally expands a single top event in a main event tree into a secondary event tree with its own top events, logic structure, and logic rules. DETs are employed as part of the Level 2 PRA model for the reference plant because they enable the main CET to be simplified into only 12 top events directly determinative of release category, with details of individual phenomena handled by the DETs. This representation also simplifies the presentation of the model by reducing the number of branches in the CET. Logically, SAPHIRE treats each DET as if it were inserted into the main event tree in place of the main trees top event that represents the DET.
2.5.4 Step 4 - Human Reliability Model Development The approach taken in the internal events and floods Level 2 PRA for developing human failure events and estimating human error probabilities is documented in Section 2.4.4 of (NRC, 2022a). For the fire, seismic, and wind initiators, a fundamental assumption is made that the approach taken for the internal events and floods PRA for post-core-damage operator actions generally applies. The notional justification for this viewpoint is that:
2-43 Core damage typically occurs many hours after the initiating event, such that the plant staffs situation following core damage is somewhat de-coupled from the fire, seismic, or high winds event that caused the accident (see Section 2.5.5 for more details)
The SAMGs are initiator-neutral, meaning that they are structured to deal with post-core-damage plant response without consideration for what hazards or events precipitated the accident Obviously, this assertion is a generalization, and there are aspects related to fire, seismic, and high winds that could undermine this assumption. The following general areas of concern were identified:
Main control room (MCR) abandonment due to fire - As a simplifying assumption, the Level 1 PRA does not give credit for operator actions occurring after MCR abandonment. This simplified treatment is the result of resource constraints, state-of-practice limitations, and shortcomings in the availability of plant-specific information related to design and operational expectations. Whether credit is appropriate following core damage depends on the specifics of the reason for abandonment (e.g., habitability, physical damage), and the status of the MCR (and TSC) during the post-core-damage phase of the accident. The Level 1 PRA does not generally develop sufficient accident sequence and human reliability information necessary to carry these factors into the post-core-damage analysis.
Fast breakers - While most accident sequences involve significant time between the initiating event and the onset of core damage (routinely more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />), this is not always the case. In particular, sequences in the at-power Level 2 PRAs that involve core damage prior to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> include SBO sequences with immediate loss of EDGs and TD-AFW, as well as large interfacing-system LOCAs.
Large seismic - Large seismic events have the potential to result in wide-spread site damage and significant destabilizing effects on human performance.
Persistent high winds - While tornadoes and thunderstorms pass quickly, hurricanes may result in high winds and related effects that persist for several hours, potentially long enough to be relevant to operator actions after core damage has occurred. Like seismic events, they can also have effects on personnel.
Persistent fires - Although fire suppression probabilities in NUREG-2169 are very high, fires that cause core damage probably persist much longer than typical fires. For instance, the Browns Ferry fire took over 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to extinguish.
In light of the above considerations, the following modeling assumptions were made:
MCR abandonment due to fire - No credit is given in the CET or DETs for operator actions occurring after MCR abandonment (i.e., HEPs were assigned a screening value of 1.0). Fire initiators that cause MCR abandonment (1-IE-FRI-A105-JY_ABN4) are responsible for 3.6% of unscrubbed pressure-induced SGTRs, 0.3% of temperature-induced SGTRs, and 34.6% of unscrubbed containment isolation failures. MCR abandonment therefore accounts for approximately 14% of fire LERF. However, the significance of isolation failure releases for offsite consequences is relatively small compared to other LERF release categories (no early fatalities, and latent fatalities similar to 1-REL-ICF-BURN, which has much higher frequency). As such, no additional analysis was performed to look at the role of a compromised MCR in terms of the SAMG
2-44 diagnosis and execution (e.g., which of the six Level 2 HRA decision tree top events are affected for a given modeled action).
Fast breakers (core damage < 8 hrs after initiating event) - While there is admittedly some effect from this issue, it is beyond our ability to quantify this effect. Seismic-related aspects (e.g., difficulty in reaching the site quickly) are rolled into the item below.
Meanwhile, fire-related aspects are believed to be relatively minor. The reason for this is that the probability of fire non-suppression is very low even for the faster breaking accident scenarios. For instance, NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, Table 5-2 and Figure 5-2, provide a probability of non-suppression for the all fires bin of 0.001 at 100 minutes. Thus, even for the faster breaking scenarios, by the time of core damage (which is not earlier than 170 minutes for any of the simulated accidents), there is a high likelihood that the fire event itself will have been stabilized.
Large seismic - For larger seismic bins (taken here to be bins 3-8), the underlying internal events HRA was reviewed to look for any aspects that would likely be unjustifiable following a large seismic event. The seismic multiplier approach used elsewhere in this project (which assigns HEP multipliers based on seismic damage states) was considered as a possible solution. Note that these multipliers were developed specifically for use in a Level 1 HRA context (EOPs, etc.), and their use here would be quite speculative. Therefore, no modification to HEPs was used for most operator actions following seismic events, with the exception of blind feed to the steam generators (manual extension of TDAFW) which already included a high HEP (0.65) and was increased to 1.0 for seismic bins 3 and higher.
High winds - The PRA distinguishes between tornado and non-tornado winds, but does not distinguish hurricane from thunderstorm winds. The model does not currently consider the possibility that the reactor will shut down due to a hurricane warning (NRC, 2023c); nonetheless, the majority of the non-tornado wind initiator frequency is from non-hurricane events. The estimated likelihood of the reactor being at power in a hurricane is just 0.1 (NRC, 2023c). Therefore, changes to HEPs that might be appropriate for some hurricanes (similar to the multipliers used for seismic events) are not included.
Persistent fires - Even if a fire has not been fully suppressed by the time of core damage, it is very likely to have been contained to hard-to-reach spaces (as happened at Browns Ferry), rather than causing habitability/accessibility issues for large portions of the plant. Given the lack of information available, no modifications were made to the HEPs for fire scenarios other than MCR abandonment.
2.5.5 Step 5 - Human Reliability Analysis The preceding section described the process for updating the Level 2 HRA for aspects unique to seismic, fire, and wind initiators. The application of that approach, and its implementation in the model, are described here. More information about the Level 2 HRA approach for the underlying internal events and internal floods HEPs is provided in Section 2.4.4 of (NRC, 2022a).
The first set of modifications to Level 2 HEPs is associated with MCR abandonment scenarios.
In the Level 1 PRA, all such scenarios have been bundled in the FRI-A105-JY_ABN4 fire event tree. Thus, in all situations where a CET or DET top event represents the success/failure of a post-core-damage operator action, the down-branch is forced for accident sequences
2-45 originating with the FRI-A105-JY_ABN4 initiating event. This is accomplished through the event tree linkage rules.
The other set of modifications to Level 2 HEPs is associated with sustained disruptions related to large seismic events. This relates to the impacts of the seismic event on human performance, not the impact on the specific equipment the actions intend to use (which is addressed elsewhere in the seismic fragility analysis for this equipment). To this end, a member of the original internal events HRA team reviewed the internal events HRA in search of instances where assumptions are made that would not be justifiable following a large seismic event. In addition, the seismic multiplier approach used elsewhere in the project was reviewed, with the intent of extending its use here. A synopsis of this effort follows.
The actions for which HEP modifications are considered are described in Table 2-15 of (NRC, 2022a). Table 2-14 below identifies the representative scenarios and HFEs in Table 2-15 of (NRC, 2022a), along with information concerning the timescales in relation to the initiating seismic (or wind) event and the time available for action after the cue conditions are met.
Generally, there are two types of actions for which HFEs are identified. These are actions before vessel breach (VB) and actions to reduce the fission products in the containment after VB. Obviously the times from the initiating event to the actions prior to VB are shorter than after VB, but are still relatively long; the shortest is 11.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (S3) and the longest is 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> (S8).
Given these lengths of time for actions after the initiating event, in conjunction with the human performance disruptions already created by core damage and considered in the internal events Level 2 HRA, it was concluded that no increases should be made to the internal event HEPs for any kind of base case analysis. Put differently, the types of long-term disruptions caused by a seismic event are similar enough in nature to those disruptions already considered, that further shaping human performance estimates in this regard would be too speculative.
However, it is recognized that there are considerable uncertainties associated with human performance in the period after a major seismic event; these are primarily aleatory in nature.
The following are examples:
The potential exists that staff may be injured, either by structural damage caused by the seismic event or due to the direct effects on people (such as falling down stairs), or the contortions required to accomplish actions (such as connecting equipment to use the firewater systems discussed during the plant walk-down visit) that could result in staffing shortages Concerns with the survivability/operability of communications systems needed to allow coordination of actions between the centers of control and field operations (command and control issue)
Problems of accessibility to equipment (such as the Godwin pump) in storage areas after the initiating event, which is insufficient to render the SSC failed, but sufficient to make its use problematic (e.g., the plant walk-down observed containers of chemicals stored in the vicinity of the trailer-mounted pump)
Supervisor concerns about sending staff into potentially hazardous areas The potential effects of aftershocks that would create repeated disturbances to the operators after the initiating event (there were 3 large aftershocks at the Fukushima Daiichi nuclear power plant within roughly 30 minutes of the main shock)
2-46 Additional examples from operating experience (including at the Fukushima Daiichi nuclear power plant) are provided in the report, An Approach to Human Reliability Analysis for External Events with a Focus on Seismic (EPRI, 2016), Sections 2.4 and 2.5.
Table 2-14 Review of Internal Events Post-Core-Damage HFEs Representative Scenario HFE Time after Seismic Event*
(Hours)
Time Available (Hours)
Internal Events HEP S2 SAG-2: Open SG ARVs 12 6
0.03 S2 SCG-1: Firewater via CS 22 "long" 0.6 S3 SAG-1: Open ARVs on 2 SGs & feed SGs with condensate prior to VB 11.5 2.5 0.4 S3 SCG-1: Firewater via CS following VB 22 "long" 0.6 S3 SAG-1: Open ARVs on 2 SGs & feed SGs with condensate following VB 54 40 0.4 S4 SAG-2: Open all SG ARVs prior to VB 20 5
0.1 S4 SCG-1: Firewater via CS following VB 33 8
0.6 S6 SAG-3: Start RHR and align alt inventory Not analyzed in detail S6 SCG-1: Start containment sprays and align alt inventory Not analyzed in detail S8 SCG-1: Feed & Bleed SG prior to VB 50 7
0.1 S8 SCG-1: Feed & Bleed SG following VB
> 58 (could be days)
"long" 0.5
- Time after seismic event is calculated as the time from the initiating seismic event to the latest time at which the action must be started, based on the detailed description of the HEP quantification Generally, uncertainties like those described above (and Table 2-14) apply to persistent or large-scale high winds as well as to large seismic events, though with lower severity. Note that unlike the seismic model, the high wind model does not alter any of the bridge tree HEPs or the HEP for blind-feeding the SGs.
Because of these uncertainties, a sensitivity analysis was performed for the fire, seismic, and wind models in which Level 2 operator action failure probabilities were increased by a factor of 3 (unless that would put them above 1.0, in which case they were set to 1.0). This analysis showed that increasing the HEPs causes a modest increase in CCFP and a major reduction in scrubbing for certain releases (especially pressure-induced SGTRs).
Note that the above discussion applies to the post core damage HFEs. However, there are a few HFEs in the Level 2 PRA that occur prior to core damage. All but one of these were previously addressed in the bridge tree, as discussed previously in Section 2.2.1. The sole remaining HFE is 1-L2-BE-MANUALTDAFW-GEN (extended blind feeding of the SGs), which appears in the CET as a matter of modeling convenience, as it is actually a pre-core damage action. This HFE receives the same seismic treatment as the bridge tree events, which leads to a base value of 0.65 for seismic bins 1 and 2, and a value of unity for all other seismic bins.
For the fire model, there are two contexts in which the application of Level 2 operator actions may be inappropriate. The first case is fire scenarios involving catastrophic loss of the turbine
2-47 generator set, which would cause widespread damage to the turbine building and might damage adjacent structures. The level of damage involved might render certain recovery actions implausible even given a long time window. The second category is the ability to recover fire-damaged equipment, such as cables. Because fire damage is likely to involve a larger number of components and more severe damage than internal events failures, repair or replacement may be significantly more difficult. The current model does not handle these two situations by modifying the HEPs; instead, they are dealt with via the Level 2 system fault trees (Appendix A),
in which the specific equipment needed for each post-core damage operator action is queried.
The impact of each fire initiator on the equipment needed for those actions is incorporated via the fire flag sets (Appendix A.1).
In summary, the pre-existing internal event HEPs are used in the base fire, seismic, and wind model for all conditions except internal fires resulting in MCR abandonment.
2.5.6 Step 6 - Level 2 Model Quantification Quantification Background Information Section 2.4.6 of (NRC, 2022a) provides some background on quantification-related challenges associated with Level 2 PRA modeling in SAPHIRE (e.g., the effect of post-processing rules).
One substantial quantification issue is frequency inflation (an apparent increase in total sequence frequency) between Level 1 and Level 2. Ideally, the sum of release category frequencies should exactly equal the core damage frequency. Frequency inflation in the SAPHIRE output can have multiple causes.
One cause is that SAPHIRE minimizes cut set results for individual end states during the gather stage of quantification but does not minimize cut sets across end states. As such, non-minimal cut sets that exist across multiple Level 1 sequences are minimized in the CDF gather results, whereas the same non-minimal cut sets may be binned into different PDS (or release category) end states and would thus not be minimized in the PDS or release category gather results. This results in higher total frequency when cut set elements that do not affect the CDF determination do affect the release categorization. The degree of inflation due to non-minimal cut sets is typically small enough to be an acceptable source of error.
However, large failure probabilities can also cause inflation, especially in the seismic model.
Without intervention, significant inflation will occur between CDF and release category frequency (or between CDF and PDS frequency), particularly for seismic bins 5-7. Inflation is far less prominent in bins 1-4 due to the lower seismic failure probabilities, as well as in bin 8 because of the simplified model (assumed failures). Such inflation would not occur if every core damage instance corresponded to one plant damage state and one release category, but this is not the case. One significant source of this frequency inflation is the deletion of success terms in SAPHIREs default quantification. By default, SAPHIRE assumes that successes occur with frequency approximately 1.0, which is often not the case following a severe seismic event. That problem can be partially resolved by using the I or W process flag to add success events to the cutset results, thereby reducing the calculated probability of cutsets that include successes.
However, a reduction in cutset probability does not always sufficiently reduce the corresponding end state probability, due to the minimal cutset upper bound (MCUB) approximation SAPHIRE uses to calculate the combined probability of the cutsets. As an example, take four cutsets in two end states (assuming an initiating event frequency of 1.0):
2-48
- 1.
A*/C -> ES1
- 2.
B*/C -> ES1
- 3.
A*C -> ES2
- 4.
B*C -> ES2 Assume each of the basic events A, B, and C has a probability of 0.5. The total CCDP, combining all end states, should be 1-(1-A)(1-B) = 0.75, and the end state probabilities should be PES1 = /C*(1-(1-A)(1-B)) = 0.375 PES2 = C*(1-(1-A)(1-B)) = 0.375 In SAPHIREs calculation, each cutset will be assigned probability 0.5 0.5 = 0.25, and when gathered each end state will have probability 1 - (1 - 0.25) (1 - 0.25) = 0.4375, which is 17 percent higher than the correct value. The binary decision diagram (BDD) solver (included in SAPHIRE) does not have this problem but remains difficult to use on large numbers of cutsets (typically some low-frequency cutsets must still be quantified with MCUB) and cannot provide basic event importances. Appendix B.3 has further discussion of BDD and SCUBE including a sensitivity analysis.
Instead, various methods have been used to mitigate inflation in the seismic model. They include rearrangement of certain Level 1 fault trees (see NRC, 2023b), use of process flags to carry success events where necessary (Table 2-5), and post-processing rules to substitute basic events for fault tree successes (see Appendix B.2).
Another model quantification challenge involves the treatment of dependencies between HFEs.
Since the dependencies were applied using post-processing rules after the base model was quantified using the nominal HEP values, some cutsets containing dependent HFEs were undoubtedly truncated before the post-processing rules were applied. This has the potential to underestimate the RCFs.
This same issue exists for the Level 2 internal events and floods model. For the internal events and floods model, an exercise was performed to gauge the impact on all the individual RCFs from truncating cutsets before applying the HEP dependency adjustments. The results of this exercise showed that this treatment has a minimal effect on the RCFs for internal events and floods, even for those with very low absolute frequencies. It is assumed here that the same conclusion applies for the fire, seismic, and wind RCFs.
Quantification Results The seismic, wind, and pruned fire Level 1 and Level 2 PRA models discussed previously were linked and solved using SAPHIRE and a cutoff frequency of 10-12/rcy. Relative to the pruning approach discussed in Section 2.1, the fire results retain sequences that contribute 99.9 percent of fire CDF. The seismic and wind results include 100 percent of sequences that contribute to core damage.
Table 2-15, Table 2-16, and Table 2-17 provide the release category bin contributions separately for the fire, seismic, and wind initiators, respectively (the release category scheme itself is discussed in Section 2.6.1 and adopted from [NRC, 2022a]). The tables show the contributions for all three accident termination times considered in this study. The SAPHIRE
2-49 model only generates the base case results, which assume accident termination 7 days after the initiator. The other two sets of results are generated manually by observing that late containment failure (1-REL-LCF) occurs between 36 and 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after SAMG entry, while scrubbed late containment failure (1-REL-LCF-SC) and basemat melt-through (1-REL-BMT) occur between 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after SAMG entry and 7 days after the initiator. Figure 2-9, Figure 2-10, and Figure 2-11 show the same information in graphical form.
The results are qualitatively similar to the comparable results from the internal events and floods Level 2 PRA (NRC, 2022a). The large majority of release frequency is attributable to intact containment and late containment failure states. Contribution moves from the former to the latter as the accident termination time is extended. Meanwhile, combustion-induced containment failure in the timeframe well after vessel breach but prior to late containment failure accounts for approximately 28 percent, 19 percent, and 14 percent of the release frequency for internal fires, seismic events, and high winds, respectively, compared with approximately 16 percent for internal events and floods. The remaining modes of containment failure or bypass are small contributors to release frequency, though higher for fire than for internal events/floods, and higher for seismic than for fire (wind has about 1 percent SGTR and isolation failure, similar to internal events). This aspect of the results is further considered in Section 2.7.
Table 2-15 Release Category Contributions for Fire Events - Tabular RC Bin Shorthand Description Individual Contribution 36 Hours after SAMG Entry 60 Hours after SAMG Entry 7 Days after Initiator V-F ISLOCA, auxiliary building failed 0.0%
0.0%
0.0%
V-F-SC ISLOCA, auxiliary building failed, break submerged 0.0%
0.0%
0.0%
V ISLOCA, auxiliary building intact 0.0%
0.0%
0.0%
Total ISLOCA (All ISLOCAs) 0.0%
0.0%
0.0%
SGTR-O SGTR, direct relief path 0.06%
0.06%
0.06%
SGTR-O-SC SGTR, direct relief path, break submerged 0.3%
0.3%
0.3%
SGTR-C SGTR, no direct relief path 0.0%
0.0%
0.0%
ISGTR Severe accident-induced SGTR 0.8%
0.8%
0.8%
1.1%
1.1%
CIF Containment isolation failure 0.6%
0.6%
0.6%
CIF-SC Containment isolation failure, scrubbed 0.1%
0.1%
0.1%
Total CIF (All containment isolation failures) 0.7%
0.7%
0.7%
ECF Early containment failure 0.01%
0.01%
0.01%
Total ECF (All early containment failure) 0.01%
0.01%
0.01%
ICF-BURN Intermediate containment failure - combustion 23.8%
23.8%
23.8%
ICF-BURN-SC Intermediate containment failure - combustion - scrubbed 3.9%
3.9%
3.9%
Total ICF (All intermediate containment failure) 27.7%
27.7%
27.7%
LCF Late containment failure 0.0%
31.0%
31.0%
2-50 Table 2-15 Release Category Contributions for Fire Events - Tabular RC Bin Shorthand Description Individual Contribution 36 Hours after SAMG Entry 60 Hours after SAMG Entry 7 Days after Initiator LCF-SC Late containment failure, scrubbed 0.0%
0.0%
3.1%
Total LCF (All late containment failure) 0.0%
31.0%
34.1%
BMT Basemat melt-through 0.0%
0.0%
5.4%
NOCF Containment intact 70.4%
39.4%
31.0%
Total BMT/NOCF (All BMT / intact containment) 70.4%
39.4%
36.3%
Total 100.0%
100.0%
100.0%
Table 2-16 Release Category Contributions for Seismic Events - Tabular RC Bin Shorthand description Individual Contribution 36 Hours after SAMG Entry 36 Hours after SAMG Entry 36 Hours after SAMG Entry V-F ISLOCA, auxiliary building failed 0.02%
0.02%
0.02%
V-F-SC ISLOCA, auxiliary building failed, break submerged 0.00%
0.00%
0.00%
V ISLOCA, auxiliary building intact 0.00%
0.00%
0.00%
Total ISLOCA (All ISLOCAs) 0.02%
0.02%
0.02%
SGTR-O SGTR, direct relief path 0.4%
0.4%
0.4%
SGTR-O-SC SGTR, direct relief path, break submerged 1.2%
1.2%
1.2%
SGTR-C SGTR, no direct relief path 0.0%
0.0%
0.0%
ISGTR Severe accident-induced SGTR 1.5%
1.5%
1.5%
3.1%
3.1%
CIF Containment isolation failure 7.8%
7.8%
7.8%
CIF-SC Containment isolation failure, scrubbed 0.2%
0.2%
0.2%
Total CIF (All containment isolation failures) 8.0%
8.0%
8.0%
ECF Early containment failure 0.01%
0.01%
0.01%
Total ECF (All early containment failure) 0.01%
0.01%
0.01%
ICF-BURN Intermediate containment failure - combustion 18.3%
18.3%
18.3%
ICF-BURN-SC Inter. containment failure -
combustion - scrubbed 0.2%
0.2%
0.2%
Total ICF (All intermediate containment failure) 18.5%
18.5%
18.5%
LCF Late containment failure 0.0%
50.4%
50.4%
LCF-SC Late containment failure, scrubbed 0.0%
0.0%
0.5%
2-51 Table 2-16 Release Category Contributions for Seismic Events - Tabular RC Bin Shorthand description Individual Contribution 36 Hours after SAMG Entry 36 Hours after SAMG Entry 36 Hours after SAMG Entry Total LCF (All late containment failure) 0.0%
50.4%
50.9%
BMT Basemat melt-through 0.0%
0.0%
0.9%
NOCF Containment intact 70.3%
20.0%
18.6%
Total BMT/NOCF (All BMT / intact containment) 70.3%
20.0%
19.4%
Total 100.0%
100.0%
100.0%
2-52 Table 2-17 Release Category Contributions for High Wind Events - Tabular RC Bin Shorthand description Individual Contribution 36 Hours after SAMG Entry 36 Hours after SAMG Entry 36 Hours after SAMG Entry V-F ISLOCA, auxiliary building failed 0.0%
0.0%
0.0%
V-F-SC ISLOCA, auxiliary building failed, break submerged 0.0%
0.0%
0.0%
V ISLOCA, auxiliary building intact 0.0%
0.0%
0.0%
Total ISLOCA (All ISLOCAs) 0.0%
0.0%
0.0%
SGTR-O SGTR, direct relief path 0.0%
0.0%
0.0%
SGTR-O-SC SGTR, direct relief path, break submerged 0.0%
0.0%
0.0%
SGTR-C SGTR, no direct relief path 0.0%
0.0%
0.0%
ISGTR Severe accident-induced SGTR 1.0%
1.0%
1.0%
1.0%
1.0%
CIF Containment isolation failure 0.1%
0.1%
0.1%
CIF-SC Containment isolation failure, scrubbed 0.0%
0.0%
0.0%
Total CIF (All containment isolation failures) 0.1%
0.1%
0.1%
ECF Early containment failure 0.0%
0.0%
0.0%
Total ECF (All early containment failure) 0.0%
0.0%
0.0%
ICF-BURN Intermediate containment failure - combustion 11.8%
11.8%
11.8%
ICF-BURN-SC Inter. containment failure -
combustion - scrubbed 1.7%
1.7%
1.7%
Total ICF (All intermediate containment failure) 13.5%
13.5%
13.5%
LCF Late containment failure 0.0%
46.5%
46.5%
LCF-SC Late containment failure, scrubbed 0.0%
0.0%
0.4%
Total LCF (All late containment failure) 0.0%
46.5%
47.0%
BMT Basemat melt-through 0.0%
0.0%
0.5%
NOCF Containment intact 85.4%
38.9%
38.0%
Total BMT/NOCF (All BMT / intact containment) 85.4%
38.9%
38.5%
Total 100.0%
100.0%
100.0%
2-53 Figure 2-9 Release Category Contributions for Fire Events - Graphical Figure 2-10 Release Category Contributions for Seismic Events - Graphical Figure 2-11 Release Category Contributions for High Wind Events - Graphical
2-54 Some review and digestion of results for the baseline model (including the tabulation of Level 2 risk surrogates) is covered in the overall presentation and evaluation of results in Section 2.7 of this report.
2.5.7 Step 7 - Uncertainty Calculations Since the Level 2 PRA model for internal fires, seismic events, and high winds makes substantial use of the Level 2 PRA model for internal events and floods, many of the uncertainties covered in the internal event and flood Treatment of Uncertainty appendix (NRC, 2022a) are relevant here. However, these new hazards do introduce some new and unique uncertainties, and the propagation of parameter uncertainty was also updated. Some highlights are discussed here.
2.5.7.1 Parameter Uncertainty Parameter uncertainty analyses for internal fires, seismic events, and high winds, were each performed separately. These were performed by assigning a distribution to each basic event used in solving for the release category frequency (RCF) for internal fires, seismic events, and high winds. Most of the basic events used in the model already had distributions assigned to them for Level 1 model parameter analyses, or for the Level 2 internal events model parameter analysis. The remaining events (introduced for Level 2 fire, seismic, and wind modeling) have been assigned new distributions appropriate to the source of the parameter estimate. High wind failure probabilities use lognormal distributions derived from the 5th and 95th percentile failure probabilities, or beta distributions for those cases where the lognormal distribution would leave too much probability mass above 1.0. Seismic failure probabilities use lognormal distributions, with error factors chosen in the same way as described for HEPs in Section 19.4.1 of (NRC, 2023a). The few HEPs that are specific to the fire model also use these lognormal distributions.
The parameters in the model are assigned distributions and the software is instructed to generate plant RCF distributions. The uncertainty distributions were calculated in SAPHIRE using a minimum of 1,000 Monte Carlo samples (5,000 samples where possible) on the RCF cutsets for each release category (from a solution with cutset truncation at 10-12/rcy).
In generating the fire release category frequency uncertainty distributions described above, SAPHIRE uses a separate Monte Carlo sample over the parameter uncertainties for each release category. Therefore, the release category frequencies may be inconsistent with each other, since logical correlations between sample values are not enforced. With large enough sample sets to almost fully cover the range of uncertainty for every parameter, the use of separate random samples for each release category should have little effect. That hypothesis was tested by repeating the fire release category frequency uncertainty calculations but using a common set of 10,000 random samples across all RCs in the group. A comparison of those results to the original indicates that using common sample values across release categories is not critical to the resulting distributions as long as the number of samples is large enough.
Parameter Uncertainty Results:
For all hazards, the largest uncertainties are found in the release categories with the lowest frequency. The most frequent release categories (LCF, NOCF, ICF-BURN) are subject to relatively little variation, while smaller release categories have 90 percent confidence intervals that cover multiple orders of magnitude; since these include the LERF release categories, the
2-55 total LERF confidence interval for each hazard covers at least one order of magnitude. Thus, while the Level 2 PRA model provides some indication of the upper and lower bounds on the plant risk, the results must also be considered as an illustration of the complexity and associated uncertainty of nuclear power plant external hazard PRA. Table 2-18 summarizes the LERF parameter uncertainty distributions tabulated in Appendix B. The high wind model results show considerably higher parameter uncertainty than the fire and seismic models, with confidence intervals covering more than an order of magnitude even in the largest release categories, and this high uncertainty appears to be partially carried over from the Level 1 PRA model (CDF uncertainty) which is somewhat higher than for the other hazards.
2-56 Table 2-18 LERF Parameter Uncertainty Results Summary LERF 5th %
Mean 95th %
95th/5th Ratio 95th/5th for CDF All RCs Mean LERF as % of RCF Internal Fires 3.37E-07 1.25E-06 3.10E-06 9.2 3.7 6.78E-05 1.8%
Seismic Events 1.54E-07 1.41E-06 4.62E-06 30 9.5 1.39E-05 10.1%
Wind Events 7.42E-09 1.68E-07 6.04E-07 81 13 1.48E-05 1.1%
Sum =
2.83E-06 9.65E-05 2.9%
Figure 2-12 and Figure 2-13 summarize the uncertainty ranges for the release category frequencies for fire, seismic, and wind. For each data point, the horizontal black line marks the median, the colored bar goes from the median to the mean, the whiskers extend to the 5th and 95th percentiles, and the purple dot marks the point estimate. Figure 2-12 uses a linear scale to clearly show the uncertainties in the high-frequency release categories (ICF-BURN, LCF, NOCF), while Figure 2-13 uses a logarithmic scale to show more detail in the lower-frequency release categories (including those that contribute to LERF).
Figure 2-12 Fire, Seismic, and Wind Release Category Frequency Uncertainties
2-57 Figure 2-13 Fire, Seismic, and Wind RCF Uncertainties, Logarithmic Scale One notable result not visible from this summary figure is that release category frequencies can be bimodally distributedthis occurs in the case of ICF-BURN for the fire model. The bimodal distribution results from certain Level 2 phenomenological basic events, related to combustion in containment, where aleatory uncertainty has been included in the basic event uncertainty distributions.
2.5.7.2 Modeling Uncertainty Modeling uncertainty arises from choices about how to design the PRA model, what variables to include, and how to relate them to each otherin other words, it covers all modeling choices other than the actual values assigned to basic events with non-zero, non-unity probabilities.
Many of the modeling uncertainties relevant here also apply to the internal events PRA, but the discussion below is focused on model uncertainties specific to external hazards. For a subset of these, sensitivity analyses have been performed; they are summarized later in this section. In a few cases, such as application of SAPHIRE failure model J to Level 2 seismic failures, sensitivity analyses were recommended as candidates for future work.
As discussed in the internal event uncertainty appendix (NRC, 2022a), another critical aspect of uncertainty is the user effect (i.e., a strong impact of user choices on the outcome of a particular
2-58 simulation) which is difficult to evaluate without comparison to a second completely independent analysis. Table 2-19 provides a partial list of hazard-unique model uncertainties.
Table 2-19 A Partial List of Hazard-Unique Model Uncertainties Item Description Other Comments Specific PDS binning assumptions External hazards PDS rules maintain many of the binning assumptions from the internal events PRA, specifically consequential LOOP. Since the binning rules for CLOOP-induced SBO sequences were designed to capture specific internal events sequences, they do not apply perfectly to external hazards.
This issue is further discussed in Section 2.2.2. A sensitivity analysis on this topic is a possible candidate for future work.
Lack of information about vulnerability of L2 equipment to external hazards Seismic and wind fragility data, and mapping of fire initiators to potentially affected systems, are available for certain L2 equipment, but where no information is available, no failure probabilities have been assigned.
These cases must in general be handled by assuming either success or failure, based largely on engineering judgment. Although this may be non-conservative in some instances, overall the effect is expected to be conservative. For fire impacts on containment spray cable routing in particular, fires in most locations are assumed to cause failure.
Seismic equipment failure probabilities Seismic equipment failure probabilities for each bin have been calculated from a median fragility (Am) and a corresponding random uncertainty (r) and epistemic uncertainty (u). Currently, the random and epistemic uncertainties are combined into a total uncertainty (c). Ideally, the epistemic portion would be included in the parameter uncertainty instead, and point estimates would be calculated based on r and the point estimate of seismic capacity.
Separation of the epistemic uncertainty would be expected to decrease seismic failure probability point estimates that are already low (in the lower seismic bins) but potentially increase the higher failure probabilities, skewing the distribution of risk more toward the higher seismic bins.
A sensitivity analysis could assign SAPHIREs failure model J to some of the Level 2 seismic failure basic events, as was done with some Level 1 basic events. This sensitivity analysis was identified as a candidate for future work.
2-59 Table 2-19 A Partial List of Hazard-Unique Model Uncertainties Item Description Other Comments Modeling of operator actions during severe accidents The effects of external hazards initiating events on HEPs are largely not included, based on the assumption that the seismic, fire, or high wind conditions that caused core damage are over by the time core damage occurs. However, fire and seismic events that make the main control room unavailable are assumed to prevent all operator actions performed in the MCR.
One exception is manual extension of TDAFW, for which an increased HEP is applied after seismic events. No similar exception has been applied for high winds, though the validity of this assumption could not be confirmed since the wind fragility analysis performed by ARA did not address this action.
A related sensitivity analysis tripled all the HEPs for post-core-damage actions and found a modest increase in CCFP (about 7% for fire, 2% for seismic, and 1% for wind) and a major reduction in scrubbing for certain releases.
Modeling assumptions associated with habitability, including MCR habitability The seismic model incorporates the fragility of the main control room ventilation/filtration system but assumes that the MCR only has to be abandoned if the ventilation system fails when there is also a bypass or isolation failure accident.
The treatment specific to external hazards is addressed in Appendix A.
2-60 Table 2-19 A Partial List of Hazard-Unique Model Uncertainties Item Description Other Comments Consequential ISLOCA modeling The only treatment of ISLOCA in the external hazards model is for seismic bin 8, which is assigned directly to the V-F release category as a worst-case assumption (see Section 2.2.2).
The potential for consequential ISLOCA is not otherwise modeled.
The internal events phenomenological companion examines the possibility of temperature-induced ISLOCA and finds the probability negligible, but fire and seismic potentially provide additional mechanisms for induced ISLOCA. High wind events do not create any plausible mechanism for consequential ISLOCA.
Seismic ISLOCA would likely have to involve mechanical failure of multiple valves (such as RHR valves--see for instance the discussion of seismic ISLOCA for H.B. Robinson in NUREG-1437, Supplement 13, page G-23). Since valves are in general considered seismically rugged (see Appendix A.2), multiple failures are unlikely. Nonetheless, seismically-induced ISLOCA is a candidate for further seismic analysis.
Fire-induced ISLOCA could occur due to spurious operation of multiple valves (NRC, 2023a). The reference plant Level 1 fire PRA included this possibility along with several operator actions to recover; however, CDF was estimated to be of order 1E-11/rcy. This is insignificant compared to both the internal events ISLOCA CDF
(~1E-7/rcy) and compared to other LERF release categories in the fire model (~1E-6/rcy).
The effect of MCR and TSC HVAC failures on post-core-damage operator actions The model presently assumes that MCR and TSC HVAC are required for containment isolation failure and bypass events where radiological habitability in these areas would be of greater concern. Otherwise, it is assumed that the areas remain habitable even without HVAC, or that operator actions are unaffected by a loss of habitability (e.g., a backup TSC location is established efficiently enough so as not to overly affect the human reliability analysis).
This is unrelated to fire-induced MCR abandonment, where all operator actions are dis-credited.
Beyond the question of radiological habitability, issues of smoke and temperature are too stochastic to address in the current modeling.
2-61 Table 2-19 A Partial List of Hazard-Unique Model Uncertainties Item Description Other Comments Frequency of fires causing MCR abandonment Compared with the initiating event frequency used in this model for frequency of MCR abandonment due to fire (1.4E-7/rcy), higher values (e.g.
3E-5/rcy) have sometimes been used in IPEEE and other NRC documentation. Credit for the Alternate Shutdown Capability may balance this out, but an increase of one order of magnitude could make it easily the largest contributor to LERF.
This treatment could be re-visited by looking at the role of a compromised MCR in terms of the SAMG diagnosis and execution (e.g., which of the six Level 2 HRA decision tree top events are affected for a given modeled action).
Fire initiators that cause MCR abandonment (1-IE-FRI-A105-JY_ABN4) are responsible for 3.6% of unscrubbed pressure-induced SGTRs, 0.3% of temperature-induced SGTRs, and 34.6% of unscrubbed containment isolation failures. MCR abandonment therefore accounts for approximately 14% of fire LERF. However, the significance of isolation failure releases for offsite consequences is relatively small compared to other LERF release categories (no early fatalities, and latent fatalities similar to 1-REL-ICF-BURN, which has much higher frequency).
Section 19.4.3.2 of (NRC, 2023a) documents a sensitivity study allowing credit for remote shutdown panels. This reduces CDF due to MCR abandonment fires by a factor of 3.8.
Stochastic external hazard impacts on human reliability Section 2.5.5 presents some stochastic uncertainties related to seismic/wind impacts that are beyond the state-of-practice in HRA to accommodate (e.g., hazard-related accessibility or survivability issues, effect of after-shocks).
Seismic-Induced Large SGTR The possibility of a very large SGTR caused by seismic damage to the SG tubes has not been considered. If this kind of large bypass accident is possible, it could have a high impact on early fatalities.
Direct seismic damage to the steam generators is not included in the model because the SGs have higher capacity than the containment structure. Seismic failure of a steam generator is assigned capacity 3.59g in the L1 PRA (Table 5-6 of
[NRC, 2022-4b]). However, this refers to catastrophic failures such as of the steam generator supports; the steam generator tubes do not have a fragility assigned and are simply assumed to be robust (>2.5g capacity).
A level 1 sensitivity analysis (Section 7.5.3 of [NRC, 2022-4b])
showed that accounting for seismically-induced SGTR at a capacity of 2.5g would increase CDF by approximately 1E-8/rcy, which is much smaller than the current seismic SGTR release category frequencies (total 2.4E-7/rcy).
It treats the SGTR as a small LOCA and does not consider the possibility of a large SGTR.
This value is also much smaller than the internal events unscrubbed ISLOCA frequency (~1E-7/rcy), and it is not clear whether the immediate offsite consequences of a very large SGTR would exceed ISLOCA.
2-62 Table 2-19 A Partial List of Hazard-Unique Model Uncertainties Item Description Other Comments MCUB approximation The min-cut upper bound quantification method used by default in SAPHIRE tends to become inaccurate when there are large numbers of cutsets that share high-probability basic events.
This issue is discussed in detail in Section 2.5.6, along with methods for mitigating the effect.
Correlation of parameter uncertainties SAPHIREs parameter uncertainty analysis uses an assumption of independence between parameter uncertainties, except in specific cases where the relationship between events has been defined. If aspects of the plants status cause a weak correlation among a large number of failure probabilities, the increase in risk would not be captured here.
Risk could plausibly be dominated by inaccuracies that affect many parameters at once, such as systematic underestimation of HEPs due to external hazard initiating events (see Appendix B.3 for a sensitivity analysis with increased HEPs) or implicit availability of support systems that are not modeled.
Cutset truncation limit In the fire/seismic/wind models, the same cutset truncation limit is used for Level 1 and Level 2 solutions, but each Level 1 cutset corresponds to at least one (often many) Level 2 cutsets that contain all the same Level 1 events plus additional Level 2 events.
Thus, the cutset probability is necessarily smaller, and some cutsets included in Level 1 are dropped from Level 2.
Lack of convergence of cutset truncation limit The wind results do not meet the convergence criteria set out in (ASME, 2014). The magnitude of the effect is unknown, though similarity with past results (from SVN-364) that used a lower truncation limit are encouraging.
Sensitivity Analyses Sensitivity analyses performed on the fire, seismic, and wind models are summarized below. A few of these are documented in greater detail in Appendix B.3.
Increased Level 2 HEPs: The potential for lingering effects of a fire/seismic/wind initiating event to affect post-core-damage actions is explored by tripling the HEPs for all Level 2 operator actions. The results are shown in Appendix B.3.
BDD solver: Limitations of the default (MCUB) quantification method in SAPHIRE are examined by quantifying the Level 2 results for seismic bin 7 using the more accurate Binary Decision Diagram solver and comparing inflation across release categories.
2-63 SCUBE: The SAPHIRE Cut Set Upper Bound Estimator provides a system for applying the BDD solver to the highest-frequency cut sets (and therefore to most of the release frequency) while using MCUB for the remaining large number of small cutsets. SCUBE is applied to the seismic RCF results to examine the impact of inflation. The results are shown in Appendix B.3.
Containment spray availability in fire scenarios: Due to lack of information about containment spray cable routing, most fire initiators are assumed to disable sprays. This sensitivity examines the effects on RCFs of allowing sprays for several high-CDF fire initiators. It shows that disabling containment sprays is generally conservative.
Bridge tree uncertainty distributions: Because the containment systems fault trees in the bridge tree have high failure probabilities during some seismic events, their success probabilities are carried using customized basic events as described in Appendix A.2, but those basic events do not have parameter uncertainty distributions assigned. This sensitivity assigns uncertainty distributions to a subset of those events to estimate the effect on RCF uncertainty.
Seismic structure failures: The seismic capacity of the turbine building is unclear, so this sensitivity study evaluates the effect on seismic RCF of disallowing all operator actions that require it.
Leak size for containment isolation failure: A sensitivity analysis from internal events (NRC, 2022a) demonstrates how increasing the size of the containment leak path increases the source term. This analysis is especially relevant to seismic. It shows that increasing leak area by a factor of 4 roughly doubles the release of radioactive material.
Correction to fire tree linkage rule: In the base case model for this report, there is a minor error in linkage rules for a fire initiator event tree. This sensitivity analysis evaluates the change in RCFs if the error is corrected.
Frequency of fire initiators causing MCR abandonment: This sensitivity analysis examines the impact of crediting purge mode for the MCR HVAC system to preclude the need for abandonment. The change was later incorporated into the base model. Containment isolation failures are reduced from 1.7 percent of the total to 0.7 percent, with no other significant changes.
Some key insights from the sensitivity analyses include:
If continued exposure to a fire, seismic, or wind initiating event increases the HEPs for Level 2 operator actions, it will cause only a small increase in CCFP, but could cause a major reduction in the likelihood of scrubbing releases.
Application of SCUBE to the Level 2 seismic results shows that frequency inflation is fairly evenly spread across every release category. The smallest RCF reduction from using SCUBE is 13 percent (for LCF) and the largest is 44 percent (for SGTR-O), with an overall reduction of 17 percent. Use of SCUBE reduced frequency inflation to 5 percent relative to seismic CDF.
Assuming failure of containment sprays for most fire scenarios was believed to be potentially non-conservative, because with sprays disabled, buildup of steam can mitigate the risk of containment failure due to combustion. However, sensitivity analysis suggests that in most cases where sprays could be used, containment heat removal is
2-64 also available by other means (i.e., containment cooling units). Therefore, the main effect of disabling sprays is to prevent scrubbing of releases.
Seismic releases are potentially sensitive to assumptions about the seismic capacity of the turbine building, which the base case treats as seismically robust. In particular, failure of the turbine building prevents scrubbing actions and could greatly increase the frequency of unscrubbed PI-SGTR releases (1-REL-SGTR-O).
The leak size modeled for containment isolation failure is a key parameter. Sensitivity analysis shows that a doubling of the leak path diameter leads to roughly a doubling of the source term. Isolation failure induced by a seismic event is treated the same as pre-existing isolation failure, but whether that failure size is realistic remains unclear. The value of additional information about possible seismic isolation failure modes (and their probabilities) would be quite high, since the CIF release category makes up most of seismic LERF. If the source term associated with 1-REL-CIF were substantially larger it might become a major contributor to offsite consequences.
2.6 Radiological Source Term Analysis The Radiological Source Term Analysis consists of three interrelated steps:
- 1. Definition of the release category binning logic
- 2. Development of source terms for the various release categories
- 3. Consideration of uncertainties in the source term development The objective of the first step is to develop the logic that will be used for assigning the CET end-states to release categories for use in the Level 3 PRA. The objective of the second step is to take the MELCOR source terms that are a natural outcome of the PDS representative sequence analyses and specify which source terms will be designated as the representative source term for each release category. The objective of the third step is to re-visit the issue of uncertainty in the context of source term uncertainties.
2.6.1 Step 1 - Definition of the Release Category Binning Logic The release category development from (NRC, 2022a) applies here in its entirety. No reason was found to modify the release category scheme to account for special features related to seismic, wind, or fire. The release categorization from (NRC, 2022a) is reproduced in Table 2-20 and Table 2-21 for convenience.
Note, an intact containment is defined as the containment not being bypassed or failed, and the associated radiological release to the environment occurs via design-basis containment leakage only. This release may or may not benefit from any aerosol scrubbing (see Table 2-21 NOCF release category). Also, as noted in Table 1-1, the focus of this model is airborne radiological releases only, and modeling decisions (e.g., release category selection) are made as such.
When relevant, surface aqueous releases are noted, but only airborne releases are passed to the offsite consequence analysis.
2-65 Table 2-20 Mapping of Release Categories to Accident Characteristics Unscrubbed Scrubbed Containment intact NOCF1 Containment bypass - ISLOCA V1 V-F V-F-SC Containment bypass - SGTR SGTR-C1, ISGTR1 SGTR-O SGTR-O-SC Containment not isolated CIF CIF-SC Containment fails at or before vessel breach ECF1 Containment fails hours after vessel breach due to a global deflagration or detonation ICF-BURN ICF-BURN-SC Containment fails late due to over-pressure LCF LCF-SC Containment fails late due to BMT BMT1 1 These release categories do not differentiate with respect to scrubbing because either (a) the associated source terms are already very small without scrubbing or (b) the underlying phenomena occur so quickly that there is insufficient time for natural scrubbing phenomena or operator actions to have a large impact.
2-66 Table 2-21 Description of Release Categories Name Description 1-REL-NOCF Containment is not bypassed or failed, and radiological release to the environment occurs via design-basis containment leakage only. This release may or may not benefit from any aerosol scrubbing.
1-REL-ECF The containment fails before or around the time of vessel breach due to an energetic event. This release may or may not benefit from any aerosol scrubbing.
1-REL-ICF-BURN The containment fails hours after vessel breach due to a global deflagration or detonation. Releases to the environment are not mitigated significantly by sprays or water pools.
1-REL-ICF-BURN-SC The containment fails hours after vessel breach due to a global deflagration or detonation. Releases to the environment benefit from scrubbing.
1-REL-LCF The containment fails tens of hours after the time of vessel breach due to long-term quasi-static overpressure. Releases to the environment are not mitigated significantly by sprays or water pools.
1-REL-LCF-SC The containment fails tens of hours after the time of vessel breach due to long-term quasi-static overpressure. Releases to the environment are mitigated by sprays and/or water pools.
1-REL-BMT The containment eventually fails due to basemat ablation due to sustained core-concrete interaction. Only the airborne component of release to the environment (which stems from normal containment leakage while the containment is pressurized) is modeled.
1-REL-CIF Release from the containment to the environment occurs via a containment penetration that fails to be isolated by the containment isolation system, or a pre-existing leakage path. The release is unmitigated.
1-REL-CIF-SC Release from the containment to the environment occurs via a containment penetration that fails to be isolated by the containment isolation system, or a pre-existing leakage path. The release is mitigated.
1-REL-SGTR-C Release from the RCS to the environment occurs via one or more ruptured SG tubes, where the rupture occurs prior to core damage. Atmospheric relief valves (ARVs) and main steam relief valves remain predominantly closed.
1-REL-SGTR-O Release from the RCS to the environment occurs via one or more ruptured SG tubes, where the rupture occurs prior to core damage. The release is not mitigated by water above the break point on the secondary side of the affected SG. One or more secondary-side relief valves are kept open during release as a deliberate action or fail in the open position.
1-REL-SGTR-O-SC Release from the RCS to the environment occurs via one or more ruptured SG tubes, where the rupture occurs prior to core damage. The release is mitigated by water above the break point on the secondary side of the affected SG. One or more secondary-side relief valves are kept open during release as a deliberate action or fail in the open position.
1-REL-ISGTR12 Release to the environment occurs via a thermally induced rupture of one or more steam generator tubes subsequent to the time of core damage.
1-REL-V Release occurs from the RCS to the auxiliary building via interfacing systems LOCA. The break point may or may be not submerged. The auxiliary building remains intact.
1-REL-V-F Release occurs from the RCS to the auxiliary building via interfacing systems LOCA. The break point is not submerged. The auxiliary building fails.
12 In this report and elsewhere, the acronyms ISGTR and TI-SGTR are used interchangeably. Meanwhile, the term C-SGTR is used to more broadly capture both TI-SGTRs and the PI-SGTRs considered in the Level 1 PRA.
2-67 Table 2-21 Description of Release Categories Name Description 1-REL-V-F-SC Release occurs from the RCS to the auxiliary building via interfacing systems LOCA. The break point is submerged. The auxiliary building fails.
2.6.2 Step 2 - Development of Source Terms for the Various Release Categories As discussed previously in Section 2.2.5 and Section 2.4, the representative sequences and MELCOR accident progression analysis were adopted from the internal events and floods at-power Level 2 PRA (NRC, 2022a). The same is true for the source terms (which stem from the same set of MELCOR calculations). The only notable deviation between the situation in (NRC, 2022a) and the situation here, from a source term perspective, is the timing of emergency action level (EAL) declarations (discussed below).
EAL Declarations The EAL work previously completed for the internal events and floods Level 2 PRA (NRC, 2022a), which included an assumption of timely monitoring and declaration of EALs, is directly applicable here with a few very notable exceptions. On one hand, a seismic, wind or fire event has the potential to disrupt the conduct of operations sufficiently to increase the unreliability of making a timely EAL declaration, or to disable equipment needed to communicate that declaration to stakeholders. In general, the more severe the event, the more potentially impactful it is to this function.
Conversely, a fire, wind, or seismic event also has the potential to result in earlier EAL declarations. There are specific hazard-related declarations of relevance here, as follows:
ALERT o HA1:
Seismic monitoring system confirms seismic event greater than OBE Earthquake acceleration of 0.12g, OR Tornado OR high winds greater than 100 mph within the protected area boundary AND resulting in visible damage to any of the following plant structures/equipment (separate table cited) OR the Control Room has indication of degraded performance of any listed systems, OR Sustained hurricane winds onsite resulting in visible damage to plant structures within the protected area boundary containing equipment necessary for safe shutdown.
o HA2: Fire OR explosion in a plant vital area AND affected system parameter indications show degraded performance OR plant personnel report visible
2-68 damage to permanent structures OR safety related equipment in any of a set of listed structures.
o HA5: Entry into procedure for control room evacuation (Operation from the Remote Shutdown Panels).
SITE AREA EMERGENCY o HS2: Control room evacuation has been initiated AND control of the plant cannot be established within 15 minutes per the procedure.
GENERAL EMERGENCY o No new criteria unique to this situation.
With the above as background, the preliminary EAL timings from (NRC, 2022a) are reproduced in Table 2-22, with a note that these may be subject to additional uncertainty for the reasons discussed above (for consideration by the Level 3 PRA team in modeling emergency response).
The basis is removed for brevity, but is available in (NRC, 2022a). As before, recovery cases will have the same EAL timings because the recovery occurs after the EAL declarations.
Table 2-23 reproduces the internal events and floods comparison of preliminary GE declarations to the timing of release, while Table 2-24 reproduces the source term selection for the release categorization. Where multiple source terms are available for a given release category, the justification for choosing the representative source term remains unchanged from that documented in (NRC, 2022a).
The remainder of the source term characterization (i.e., the means of assigning aerosol size distributions and release pathways) also remains unchanged from (NRC, 2022a).
2-69 Table 2-22 Preliminary EAL Classifications Rep.
Seq.
Alert Decl.*
(hr)
SAE Decl.*
(hr)
GE Decl.*
(hr)
Basis 1
~0 0.25 3
See (NRC, 2022a) 1A
~0 0.25 3
Same as Case 1 1A1
~0 0.25 3
Same as Case 1 1A2
~0 0.25 3
Same as Case 1 1B
~0 0.25 3
See (NRC, 2022a) 1B1 0
0.25 2.5 See (NRC, 2022a) 1B2 0
0.25 3
Same as Case 1B 2
1 7
8 See (NRC, 2022a) 2A 1
7 8
Same as Case 2 3
0.25 5
8 See (NRC, 2022a) 3A1 0.25 5
8 Same as Case 3 3A2 0.25 5
8 Same as Case 3 3A3 0.25 5
8 Same as Case 3 3A4 0.25 5
8 Same as Case 3 4
2.25 8
17 See (NRC, 2022a) 5 0.25 0.25 7.5 See (NRC, 2022a) 5A 0.25 0.25 7.5 Same as Case 5 5B 0.25 0.25 1.25 See (NRC, 2022a) 5C 0.25 0.25 7.5 Same as Case 5 5D 0.25 0.25 1.25 Same as Case 5B 6
2.5 13 13 See (NRC, 2022a) 6A 2.5 13 13 Same as Case 6 6B 2.5 13 13 Same as Case 6 6C 2.5 13 13 Same as Case 6 6D 2.5 13 13 Same as Case 6 7
~0 0.25 3
See (NRC, 2022a) 7A
~0 0.25 3
Same as Case 7 8
0.25 38 47 See (NRC, 2022a) 8A 0.25 70 90 Rough estimates (given the dramatically protracted timeline),
but based on the same triggers as for Case 8 8B 0.25 38 47 Same as Case 8
- Timings are relative to the time of occurrence of the initiating event.
Note: This table contains preliminary classificationsfinal classifications will be determined by the Level 3 PRA team. Depending on the initiating event, these classifications may be subject to additional uncertainty as discussed in the text.
2-70 Table 2-23 Comparison of Preliminary GE Time to Release Timings Time (Hours)
Representative Sequence No.
Time of Reactor Trip Prelim. GE Declaration PCT
> 1204 C Xe Release
> 10%
I Release
> 1%
1 0
3 139 Never Never 1A 0
3 16 75 Never 1A1 0
3 16 76 Never 1A2 0
3 16 28 33 1B 0
3 3.9 55 158 1B1 0
2.5 3.0 56 146 1B2 0
3 3.3 64 Never 2
0.1 8
15 99 Never 2R1 0.1 8
15 Never Never 2R2 0.1 8
15 128 Never 2A 0.1 8
15 22 22 3
0 8
11 62 140 3A1 0
8 11 58 151 3A2 0
8 11 11 11 3A3 0
8 11 11 11 3A4 0
8 11 71 156 4
2 17 15 99 Never 5
~0 7.5 9.5 10 Never 5A
~0 7.5 9.5 10 Never 5B
~0 1.25 2.8 3.5 3.2 5C
~0 7.5 9.5 10 Never 5D
~0 1.25 2.8 3.5 3.2 6
0 13 15 Never Never 6R1 0
13 15 Never Never 6A 0
13 15 Never Never 6B 0
13 15 Never Never 6C 0
13 15 40 Never 6D 0
13 15 74 Never 7
0 3
16 21 18 7A 0
3 16 21 18 8
0.25 47 50 52 52 8R1 0.25 47 50 Never Never 8R2 0.25 47 50 52 52 8A 0.25 90 96 97 Never 8B 0.25 47 50 51 51 8BR1 0.25 47 50 51 Never
2-71 Table 2-24 Mapping of Source Terms to Release Categories without Truncation Release Category Candidate Source Terms Chosen Source Term 1-REL-V-F 5D 5D 1-REL-V-F-SC 5B, 5C 5B 1-REL-V 5, 5A 5
1-REL-SGTR-O 8B 8B 1-REL-SGTR-O-SC 8BR1 8BR1 1-REL-SGTR-C 8, 8A, 8R1, 8R2 8
1-REL-ISGTR (a.k.a., C-SGTR) 3A2ii, 3A3 ii 3A2 1-REL-CIF 7
7 1-REL-CIF-SC 7A 7A 1-REL-ECF 2A, 6C, 6D 2A 1-REL-LCF 1A, 1A1iii, 1B, 1B1, 1B2, 2, 3, 3A1, 3A4, 4 1B 1-REL-LCF-SC 2R2 2R2 1-REL-ICF-BURN 1A2i 1A2i 1-REL-ICF-BURN-SC None - 1A2 truncated at the time of containment failure can be used as a surrogate 1A2 truncated at the time of containment failure (~28 hrs) 1-REL-BMT 6, 6A, 6Biii 6
1-REL-NOCF 1, 2R1, 6R1; BMT source terms could be used as surrogates 2R1
- i.
This case involves containment failure seven hours after vessel breach due to a large deflagration ii.
Loss of AFW at time zero (rather than three hours) would be a lower-likelihood sequence that would result in an earlier release as well as earlier declaration of a General Emergency iii.
The source terms from these calculations should be viewed with caution because the cases non-mechanistically suppress combustion in order to generate information for the probabilistic treatment of hydrogen.
2.6.3 Step 3 - Consideration of Uncertainties in the Source Term Development No source term uncertainty analysis specific to fire/seismic/wind events has been performed. In general, the source terms are expected to be similar to those for internal events, since the hazards are generally not present by the time core damage occurs (see Section 2.5.5).
However, the source term uncertainties described in the internal events Treatment of Uncertainty Companion Document (Section 6 of [NRC, 2022a]) do include some aspects relevant to external hazards. In particular, the size of the leak in a seismically-induced containment isolation failure could plausibly differ from the leak size from other causes. This issue is explored in an internal event sensitivity analysis showing that a doubling of the containment isolation leak size from 2 inches to 4 inches would roughly double the iodine and cesium release fractions.
The other points in Section 6 of (NRC, 2022a) about uncertainty in the MELCOR calculations are, in general, equally applicable to the same release categories for fire, seismic, and wind.
It has been questioned whether full-power source terms are always applicable to external hazards. In general, the release pathways are not affected by the external hazard directly, with the exception of seismic events that cause containment isolation failure (as discussed above).
Fire and wind events have no plausible mechanism for creating a new pathway through the containment boundary (as opposed to opening an existing pathway). What may differ between
2-72 internal events and external hazards is the accident progression. This issue is discussed in Sections 2.2.3 and 2.2.5. Despite commonalities in the PDS distribution across hazards, there are some new PDSs important to external hazards (especially seismic) that do not appear in internal events. However, these are generally quite similar to PDSs that are important in internal events, and there is no reason to expect major differences in the resulting source terms.
Therefore, additional MELCOR analyses corresponding to those PDSs have not been performed.
2.7 Evaluation and Presentation of Results 2.7.1 Consolidation of Results Section 2.5.6 provides release category frequencies obtained from the probabilistic model. As discussed at length in the internal events and floods Level 2 PRA (NRC, 2022a), the presentation of the combination of these results requires a decision regarding when each accident sequence will be successfully terminated, and what metrics will be used to condense these results. In this analysis, the base case uses a termination time 7 days after the initiating event. Other possible termination times are considered as a sensitivity analysis (Table 2-25).
The following project-specific surrogate risk metric definitions are used, both here and in the Level 2 PRA for internal events and floods (for more information on how these were chosen, see Section D.13 of [NRC, 2022a]):
LERF: release categories are defined to contribute to LERF if their representative source term has a warning time (based on iodine release exceeding 1 percent) less than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> simultaneous with the cumulative iodine release fraction being greater than 4 percent; in some documents this risk metric may also be referred to as LERF (early injuries).
o The LERF release categories are 1-REL-CIF, 1-REL-ECF, 1-REL-ISGTR, 1-REL-SGTR-O, 1-REL-V-F, and 1-REL-V-F-SC.
Early-fatalities LERF: release categories are defined to contribute to this subset of LERF if their representative source term has a warning time (based on iodine release exceeding 1 percent) less than 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> simultaneous with the cumulative iodine release fraction being greater than 4 percent; in some documents this risk metric may be referred to as LERF (early fatalities).
o Early-fatalities LERF includes 1-REL-ISGTR, 1-REL-V-F, and 1-REL-V-F-SC.
LRF: large release frequency is the summation of the frequency of all release categories that include containment bypass or containment failure, excluding those where fission product scrubbing (or other mechanisms) result in a source term comparable to, or smaller than, the remainder of the (intact containment) source terms.
o LRF includes 1-REL-CIF, 1-REL-CIF-SC, 1-REL-ECF, 1-REL-ICF-BURN, 1-REL-LCF and 1-REL-LCF-SC, and all types of SGTRs and ISLOCAs.
Intact Containment: a situation wherein the containment successfully isolates, is not bypassed, and does not experience an increase in the effective leakage area (i.e., an induced failure) to the airborne pathway. In the present model only the release category 1-REL-NOCF is considered to have an intact containment.
2-73 CCFP: the ratio of the release categories involving a failed containment to the overall release category frequency. Containment failure is defined as any condition other than intact containment, including bypass, overpressure failure, basemat melt-through, etc.
o All release categories except for 1-REL-NOCF contribute to CCFP.
The contributing release categories to these surrogates are the same for the internal events/floods, fire, seismic, and wind PRA models, because the models rely on the same set of underlying source terms and EAL declarations.
The definition of LERF was chosen to roughly delineate releases with potential to cause early health effects (prodromal vomiting). Some studies instead define LERF based on early fatalities, so it may be more appropriate to compare their results against the Early-fatalities LERF risk metric defined above.
Note that the word large does not have the same meaning in the definitions of LERF and LRF; LRF is based on the cesium release fraction instead of iodine. LRF is not a risk metric used for operating US reactors (such as the reference plant), and so comparison to LRF values or objectives for advanced light water reactors is not necessarily appropriate. Nevertheless, it has been tabulated in this study to provide additional context.
Table 2-25 provides the breakdown of these risk surrogates, as a fraction of summed RC frequency, for different accident termination times (36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> or 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after SAMG entry in addition to the 7-day base case). Note that the sum of the release category frequencies (the denominator in calculating these fractions) is typically greater than CDF, due to frequency inflation (see Section 2.5.6). For termination times earlier than 7 days, the risk metrics are adjusted as follows:
LRF does not include 1-REL-LCF and 1-REL-LCF-SC, because the source terms for these release categories do not reach the large release threshold until more than 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after SAMG entry.
CCFP at 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after SAMG entry does not include 1-REL-LCF-SC or 1-REL-BMT, because those containment failure modes occur later. At 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after SAMG entry, it also does not yet include LCF.
These definitions are consistent with the termination-time-adjusted frequencies of individual release categories listed in Table 2-15, Table 2-16, and Table 2-17.
As would be expected, Table 2-25 shows that LERF is insensitive to the selected truncation time, while LRF and CCFP are very sensitive to this choice.
2-74 Table 2-25 Risk Surrogates Presented for Different Accident Termination Times Assumed Accident Termination Time 36 Hrs after SAMG Entry 60 Hrs after SAMG Entry 7 Days after Initiator Fire Seismic Wind Fire Seismic Wind Fire Seismic Wind CCFP Early-fatalities LERF 0.01 0.02 0.01 0.01 0.02 0.01 0.01 0.02 0.01 Total LERF 0.01 0.10 0.01 0.01 0.10 0.01 0.01 0.10 0.01 LRF (including LERF) 0.26 0.29 0.13 0.26 0.29 0.13 0.60 0.80 0.60 Total CCFP1 0.30 0.30 0.15 0.61 0.80 0.61 0.69 0.81 0.62 Intact containment 0.70 0.70 0.85 0.39 0.20 0.39 0.31 0.19 0.38 Total 1.0 1.0 1.0 1.0 1.0 1.0 1.0 1.0 1.0 1CCFP includes LRF plus other release categories; see previous text.
A set of significant release categories was established as part of each model convergence study (and based on the Level 2 PRA Standards definition of this term [ASME, 2014]). This significance relates to their elevated contribution to LRF or LERF, along with the nature of their respective containment status. Since release category significance identification (unlike the aforementioned surrogate identification) is affected by the release category frequency results, it varies by hazard. The significant release categories are identified in Table 2-26.
Table 2-26 Identification of Significant Release Categories Fire Seismic Wind 1-REL-BMT 1-REL-CIF 1-REL-ICF-BURN 1-REL-ICF-BURN-SC 1-REL-ISGTR 1-REL-LCF 1-REL-LCF-SC 1-REL-SGTR-O 1-REL-CIF 1-REL-ICF-BURN 1-REL-ISGTR 1-REL-LCF 1-REL-SGTR-O 1-REL-SGTR-O-SC 1-REL-CIF 1-REL-ICF-BURN 1-REL-ISGTR 1-REL-LCF Figure 2-14, Figure 2-15, and Figure 2-16 break down the release category contributions by initiator for fire, seismic, and wind, respectively.
2-75 Fire The fire initiators are aggregated by building/area, since there are too many to distinguish otherwise. The MCR (along with a few adjacent areas on the same floor) is plotted separately from the rest of the control building, in gray.
Every release category is strongly dominated by fires in the control building. Containment isolation failure end states are dominated specifically by MCR fires, especially 1-IE-FRI-A105-JY_ABN4 (fire leading to MCR abandonment) and 1-IE-FRI-A105-JY_L (fire in MCR panel QPCP). Scrubbed combustion failures are also dominated by MCR fires, whereas unscrubbed combustion failures are primarily caused by control building fires outside the MCR; the reason for this distinction is unclear.
Pressure-induced SGTRs have large contributions from fires outside the control building, particularly the river intake area and the turbine plant cooling water pumps. They also have a large contribution from fires that cause MCR abandonment. MCR abandonment fires mostly result in unscrubbed SGTR while the others are mostly scrubbed. This is because scrubbing of containment isolation failure requires in-vessel recovery to be successful.
Figure 2-14 Fire Initiator Fractional Contributions to each Release Category, by Building
2-76 Seismic Figure 2-15 shows that most release categories (including combustion failures, overpressure failures, and thermally induced SGTR) are distributed across seismic bins roughly in proportion to their CDF, indicating that they are not strongly dependent on the initiator. Intact containment and basemat melt-through result disproportionately from seismic bins 1-2, as would be expected.
Seismic bin 8 results exclusively in ISLOCA releases (category V-F); this choice is described in Section 2.2.2).
Containment isolation failure and unscrubbed PI-SGTR are unlikely in low seismic bins and are dominated by seismic bin 6, which makes bin 6 the largest contributor to LERF. Seismic bin 7 is also a large contributor to the CIF release category but does not contribute to pressure-induced SGTRs due to specifics of its Level 1 modeling.
Figure 2-15 Seismic Bin Fractional Contributions to Each Release Category
2-77 Wind Figure 2-16 shows that non-tornado high winds in bins 1 and 2 are the dominant contributors to every release category. Tornado missiles in bins 3 and 4 contribute significantly to BMT and ICF-BURN-SC; otherwise, wind events in bins 3 and 4 are mostly insignificant due to their low initiating event frequencies.
The wind results show zero frequency for scrubbed containment isolation failure; in previous versions of the model there was a small frequency in that category, but it was eliminated because of the current cut set truncation limit of 10-12/rcy.
Figure 2-16 Wind Initiator Fractional Contributions to Each Release Category Based on an analysis of release category frequencies for each PDS (not reproduced here),
some key conclusions are:
PDS 35-4 (the highest-frequency PDS for fire, seismic, and wind, as well as internal events) is an SBO with immediate or delayed loss of TD-AFW and no power recovery. It contributes to combustion-related containment failure, I-SGTR, late containment failure, and no containment failure. The latter is the result of sequences where sustained CCI does not occur. The lack of contribution to BMT is explained by the lack of containment heat removal and feedwater, thus ensuring over-pressure failure when CCI does occur.
2-78 PDS 36-3 and 36-4 (important to seismic) contribute to the same release categories as PDS 35-4, since they are essentially the same scenario but with the RWST unavailable.
(PDS 36-3 also has containment cooling, but this is irrelevant due to lack of power.)
PDS 29-3 (important to fire and seismic), which is an SBO with ac power recovery (but operators fail to restore systems to prevent core damage) and with containment heat removal available, contributes primarily to combustion-related containment failure (unscrubbed due to lack of sprays), I-SGTR (no elevated leakage and unavailable SG cooling permits high RCS pressure), and intact containment.
PDS 25-4 (important to seismic), which is similar to PDS 29-3 but with SG cooling and not containment cooling, contributes mainly to LCF (unscrubbed) and intact containment.
PDS 02-4 (important to fire), which is an SLOCA with no ECCS, sprays, or containment cooling, contributes mainly to LCF (scrubbed and unscrubbed) and to intact containment. Combustion is relatively unlikely because of the lack of containment heat removal.
PDS 03-3 (important to fire) is an SLOCA with ECCS available (but RWST unavailable),
containment cooling available, and sprays unavailable. It contributes mainly to combustion failure (unscrubbed) and to intact containment, since CHR prevents late overpressure.
PDS 35-3 (important to fire) is similar to PDS 35-4 but has containment cooling available; since no power is available for containment cooling, it also contributes mainly to LCF.
PDS 29-1 (important to wind) is the same as PDS 29-3 except that containment sprays are available. As a result, it contributes largely to ICF-BURN-SC instead of ICF-BURN; it also makes a significant contribution to intact containment.
SGTR PDSs (PDSs 37 through 52) contribute solely to SGTR release categories (SGTR-O and SGTR-O-SC).
Another analysis looked at release category frequencies by which branches of the CET contribute the most. Some conclusions are:
CET branch 68 is the biggest contributor for fire, seismic, and wind, contributing over 40 percent of seismic release frequency, 25 percent of fire release frequency, and almost 40 percent of wind release frequency. This CET sequence includes cut sets where containment is initially intact and RCS pressure during core damage is high.
Extension of TD-AFW and in-vessel recovery both fail (when applicable). Containment remains intact during in-vessel melt progression, with no scrubbing at that time.
Containment stays intact at vessel breach, followed by sustained MCCI. There is no scrubbing during the ex-vessel phase, and eventual containment over-pressure failure occurs due to the sustained MCCI. As such, it is binned in the 1-REL-LCF release category. It makes up about 80 percent of LCF frequency for each hazard.
Branch 67 is also an important contributor to all hazards. It is similar to branch 68 except that containment failure is caused by a large combustion well after vessel breach. Thus,
2-79 it is binned in the 1-REL-ICF-BURN category. It makes up the majority of ICF-BURN frequency for seismic and wind, and just under half for fire.
Other top contributors to wind include branches 44 and 43, which are similar to 68 and 67 but with intermediate RCS pressure.
Top contributors to fire include branches 20 and 21, which are similar to 67 and 68 but with low RCS pressure.
Seismic also has branch 98 contributing about 6 percent of seismic release frequency, which includes containment isolation failure prior to core damage. Branch 88, which is similar, contributes about 2 percent of seismic release frequency. Together these make up nearly all the CIF release category. These two branches also appear with much lower frequency in the fire and wind results.
Branch 72 is responsible for 100 percent of the ISGTR frequency for wind events, 99 percent for internal fires, and 91 percent for seismic events. It includes high RCS pressure during core damage, failure of in-vessel recovery when applicable, and occurrence of a creep-induced SGTR.
2.7.2 Cross-Hazard Comparisons Figure 2-17 shows how the fractional distribution among release categories compares across hazards, including internal events and floods, for the 7-day hazard termination time. LCF is the largest category for every hazard, but less dominant for fire because fire has an especially large contribution from combustion failures.
Seismic release frequency has large contributions to SGTR and even more so to containment isolation failure, leading to its higher LERF percentage (about 10 percent). The greater contribution of CIF for seismic events arises from the elevated probability of direct seismic failure of the containment isolation system for the higher seismicity bins (i.e., bins 5-7). Seismic also has a correspondingly higher CCFP than the other hazards. Seismic LERF is quite sensitive to the seismic fragility of containment isolation, which is assigned a mean capacity of 1.85g (Appendix A.2). This is much lower than the containment structural capacity (2.9g) and could represent a significant conservatism in the Level 2 PRA.
Wind has a slightly higher percentage of intact containment compared with internal events or internal fires, and a slightly lower percentage of combustion failures. It also has a low LERF percentage, mostly ISGTR.
Figure 2-18 compares actual release frequencies (rather than fractions) for internal events, fire, seismic, and wind, again for the 7-day termination. It also includes the total of all LERF release categories. Because fire has a much higher CDF than either seismic or wind (comparable to internal events), it correspondingly has a much higher frequency for most release categories.
However, as can be seen in the figure, seismic LERF is slightly higher than fire or internal event LERF, despite the lower seismic CDF. This is primarily due to the relatively large seismic contribution to containment isolation failure, as mentioned above. Note that this comparison of absolute frequencies is distorted slightly by the different magnitudes of frequency inflation for different hazards (see Section 2.5.6).
2-80 Figure 2-17 Release Category ContributionsComparison Across Hazards
2-81 Figure 2-18 Release Category FrequenciesComparison Across Hazards 2.7.3 Comparison to Past Studies As discussed previously, there are two fundamental outputs to a Level 2 PRA: the release category source terms and the release category frequencies. In Appendix D of the internal event and flood Level 2 PRA (NRC, 2022a), there exists an extensive comparison of the MELCOR analyses used to generate the release category source terms to other relevant information sources (see the entry entitled, Comparison of MELCOR Results to Other Relevant Analyses),
and these comparisons remain valid for the fire, seismic, and wind PRAs use of these same accident analyses. For convenience, the principal findings from these comparisons, as documented in (NRC, 2022a), are repeated here:
The current results are similar to the reference plants IPE source term results, with major differences stemming from: (i) the longer accident termination time used here, leading to larger source terms for some accident sequences; (ii) the inclusion here of hydrogen-induced containment failure leading to a larger range of source terms for station blackout; (iii) generally higher non-volatile releases owing to volatilization of Molybdenum during sustained MCCI; and (iv) lower ISLOCA source terms here owing to treatment of additional fission product retention mechanisms.
2-82 The current results are comparable to the Surry SOARCA results in NUREG-1935, with major differences stemming from a combination of: (i) differences in plant design, (ii) differences in phenomenological and system modeling assumptions, and (iii) fundamental differences in the scope of the studies and the assessment technologies employed (PRA versus consequence analysis).
The MELCOR analyses are similar to comparable MAAP analyses for the studied cases.
With regard to the frequency output, as of the studied-plant (circa 2012), the reference plant had a fire PRA and was beginning to develop a seismic PRA. For the circa 2012 reference plant, the results show that cross-unit fire impacts are important, and that LERF is estimated to be approximately 4 percent for Unit 1 and 5 percent for Unit 2. This estimate is notably higher than the 1 percent estimated for the early fatalities subset of LERF in the present analysis, and higher even than the 1.5 percent estimated for total LERF in the fire results. In the utilitys results, the top LERF cutsets all consist of main control room abandonment scenarios with alternate shutdown capability (ASC) assumed failed. These cutsets were not significant contributors to the utilitys CDF, thus the simplified treatment of ASC. For this reason, it is believed that the difference in LERF results primarily stems from differences in the Level 1 PRA modeling. In particular, as discussed in Section 18.4.5.5 of (NRC, 2023a), the utility inadvertently failed to credit an operator action for some MCR abandonment scenarios leading to a significant overestimate of the CDF for these scenarios. Crediting this action in the L3PRA fire PRA reduced the total CDF for all MCR abandonment scenarios to 1.4x10-7/ry, as opposed to 7.5x10-7/ry in the reference plant fire PRA.
The reference plant also provided preliminary seismic PRA information in 2014. Though a completed seismic PRA has been developed in the intervening time, it includes intervening plant modifications (most notably the introduction of new RCP seal packages) that have a potentially important impact on the internal and external events CDF profile, and thus make comparison to the NRCs results herein less informative. For the reference plants circa 2014 draft seismic PRA, LERF was approximately 8.5 percent. The most significant contribution to LERF stems from seismic failure of the steam generators (assumed to lead directly to core damage and simultaneous containment isolation failure), followed by seismic failure of the control building (assumed loss of all I&C), followed by seismic failure of the auxiliary building (assumed core damage and containment isolation failure). The overall LERF result is much larger than the 2 percent estimate herein associated with the frequency for early fatalities, but quite similar to the 10 percent estimate herein associated with LERF (for early injuries). As for the contributors to LERF in the NRC results, the majority of LERF in the seismic model comes from seismic failure of the containment isolation system, followed by thermally induced SGTR in high/dry/low sequences.
The reference plant did not perform a high wind PRA, so no direct comparison is possible.
However, given the similarity of the Level 2 modeling to the internal events model, it is worth noting that the release category percentages for high wind are very similar to the internal event results with ISLOCA initiators removed. LERF, in both cases, includes approximately 1 percent from SGTR and approximately 0.1 percent from containment isolation failure. Intermediate containment failures are 14 percent for high winds versus 16 percent for internal events. Late containment failures are 47 percent for both high winds and internal events, while intact containment is 38 percent for high winds and 35 percent for internal events.
2-83 2.7.4 Outcomes The following is a synopsis of the major outcomes stemming from the work described in this report:
O1. A Level 2 PRA model for postulated at-power accidents caused by fire, seismic, or wind initiating events has been developed which covers a broad spectrum of severe accident scenarios, and which considers a variety of different systems, phenomena, and operator actions. This model is directly integrated with the corresponding Level 1 PRA, including the ability to inspect cutsets, importance measures, and sensitivities/uncertainties in an integrated fashion, though the process for doing so is more complex than the internal events/floods model (as discussed previously).
O2. The probabilistic model has a strong basis in underlying deterministic analysis, most notably using MELCOR, but also using other analytical tools where appropriate. It also benefits from post-core-damage HRA methods development performed specifically for this project, but the quantitative extension of this method to fire, seismic, and wind initiators is beyond the state-of-practice. Sources of uncertainty have been examined and quantified where possible.
O3. The vast majority (~98-99 percent) of potential accidents were found to not contribute to the potential for early fatalities, while the large majority (~90 percent for seismic and 99 percent for fire and wind) were found to not contribute to the potential for large early release (based on the potential for early injuries). The larger estimates of LERF in the seismic case are largely due to seismic-related failure of containment isolation.
O4. Combustion-induced failure of containment hours (or tens of hours) after vessel breach, following sustained MCCI, was found to have an important contribution to the results, generally consistent with its importance in the internal events and floods PRA.
O5. When accident sequences are carried out to longer timeframes (e.g., 7 days), without credit for successful mitigative actions beyond the initial core damage and vessel breach response, the majority of accidents ultimately lead to containment failure (resulting in relatively high LRF13 and CCFP estimates). Though radiological releases are generally lower in these cases than for the bypass, early containment impairment, and combustion-induced failure cases, they are still significant.
O6. Due to the generally similar trends between the fire/seismic/wind results and the internal events/floods results, the observations about termination time impacts made in (NRC, 2022a) can be extended here:
- a. Consideration of longer-term recovery would not affect LERF 13 Recall that LRF is not a risk metric used for operating US reactors (such as the reference plant), and so comparison to LRF values or objectives for advanced light water reactors is not necessarily appropriate.
Nevertheless, it has been tabulated in this study to provide additional context because (like CDF) it is a risk surrogate for long-term offsite consequences.
2-84
- b. The greatest reduction in LRF would occur from recoveries related to controlling containment pressure, with additional benefit seen if this were combined with preventing combustion
- c. The greatest reduction in CCFP would occur from combined recoveries to control containment pressure and prevent basemat melt-through (either one by itself would not be sufficient), with additional benefit seen if this is combined with controlling combustion 2.7.5 Recommendations There are various parts of the modeling that are recognized as areas that would benefit from enhancement, and so this section also includes recommendations so as to: (i) facilitate discussions about potential follow-on work and (ii) encapsulate some of the more important limitations in using the results of the PRA. These enhancements, along with feedback received during the review phase of the present documentation and model, will influence future development efforts. The list of recommendations is limited to those that are felt to be the most important, and does not reiterate recommendations in (NRC, 2022a) that are wholly associated with the underlying internal events Level 2 PRA modeling.
Level 1/2 PRA Interface:
R1. Although the degree of pruning has been reduced so that it is unlikely to affect risk insights, additional effort with regard to both the model and SAPHIRE might allow for eliminating this extra step from the fire model.
R2. Some assumptions are necessary when translating straight to core damage Level 1 seismic sequences, and additional exploration might improve the fidelity of this modeling.
R3. There are some contributors to fire, seismic, and wind PDS results that were not important for internal event and flood PDSs. Thus, an expansion of the representative sequence set to include these PDSs would provide additional basis for the Level 2 PRA modeling.
R4. As in the internal events model, consequential SBO is manually handled in the PDS binning, and some lower-contributing sequences are susceptible to having cutsets where a consequential SBO has occurred, but AC power is presumed present in the Level 2 PRA handling - this translates to credit for operator actions using installed systems in instances where they may be unavailable, and where station blackout conditions might otherwise preclude Level 2 HRA credit.
R5. Similar to the above, while uncommon, there can be cases where widespread DC power dependencies may affect the viability of Level 2 HRA actions - this dependency is lost in the Level 1 to Level 2 interface, since the Level 2 HRA (manually) uses sequence-level rather than cutset-level information.
Containment Capacity Analysis No new recommendations identified.
2-85 Severe Accident Progression Analysis No new recommendations identified.
Probabilistic Treatment of Accident Progression R6. There are many assumptions made in the fire mapping and seismic and wind impacts assessments for the SSCs unique to the Level 2 PRA modeling. These would benefit from additional plant walkdowns and discussion with plant staff.
R7. The human reliability analysis identifies limitations in terms of incorporating longer-term seismic and wind impacts into the HEP quantification.
R8. The probabilistic model requires significant work-arounds to facilitate timely and accurate quantification. First, the fire model must be pruned in order to significantly reduce the number of sequences solved, and this aspect is largely unavoidable in the current modeling construct, given the size of the Level 1 and Level 2 PRA models.
Second, limitations in the min cutset upper bound approximation are only partially addressed, as described in Section 2.5.6. The BDD and/or SCUBE quantification methods allow some characterization of the significant frequency inflation observed in the seismic model, but do not permit it to be removed. Monte Carlo uncertainty using the BDD method is not implemented in SAPHIRE, so in order to get parameter uncertainty results consistent with BDD quantification, this feature would need to be added as well.
R9. Certain model limitations or errors, if investigated and addressed, would improve the legibility of the model results. These include:
- a. Fire cutsets are often difficult to decipher, because many of the crucial failures are set by the flag file and so do not appear in the cutset. In most cases it is possible to use the sequence logic to partially understand the scenario.
- b. Some cutsets appear to be non-minimal, when they contain only the initiating event: for instance, the first fire cutset in 1-REL-CIF contains only 1-IE-FRI-A105-JY_ABN4 (fire causing MCR abandonment) and a system-generated <TRUE>
event. The next two cutsets contain 1-IE-FRI-A105-JY_ABN4 plus additional failure and success events. SAPHIRE does not treat these as non-minimal because they do not contain <TRUE>. However, although they appear in the cutset list, they do not contribute to the gathered end state frequency and so do not affect the overall numerical results.
- c. Many of the top fire cutsets go into station blackout PDS bins (1-ACCTYPE[5])
because they are transients with failure of AFW and F&B. This consequential SBO binning rule is carried over from the internal events model and does not always apply to fire sequences. In cases where this binning is incorrect, it may lead to under-estimating the probability of containment failure by combustion, since containment heat removal is often available if there is AC power.
2-86 Radiological Source Term Analysis R10. Uncertainties with respect to the EAL declarations for fire and seismic were previously discussed in Section 2.6.2. These uncertainties could be reduced via additional discussion with plant staff.
R11. Additional characterization of the possible seismic containment failure modes, particularly regarding the size of the leak path involved in seismic isolation failure, could have a large impact on predicted offsite consequences due to the prominence of isolation failure in the seismic release frequency results.
Level 2/3 PRA Interface No new recommendations identified.
2.8 Level 2/3 PRA Interface The Level 2/3 PRA Interface consolidates the release category information in a format conducive for use by the Level 3 PRA analysts. The objective of this subtask is to catalogue the characteristics of each release category (release frequency, time-dependent chemical class-specific release fractions, sequence information sufficient for establishing declaration of emergency action levels, release energy and elevation, and aerosol size distributions).
The initial inventories of each radionuclide group at the time of the accident are provided in Table 2-27, and are identical to those reported in (NRC, 2022a). As mentioned previously, middle-of-cycle characteristics are used in the Level 2 PRA analysis. The Level 3 PRA team uses the radioisotope-specific activities in the actual SCALE datasets.
Table 2-27 Initial Inventories MELCOR RN Class Initial Inventory (Kilograms)
Beginning-of-Cycle Middle-of-Cycle End-of-Cycle XE 219.1 386.4 546.1 CS 5.676 9.952 13.86 BA 92.48 164.2 225.5 I2 0
0 0
TE 20.21 35.69 50.67 RU 137.5 247.9 371.9 MO 120.0 209.8 295.8 CE 650.8 1127 1475 LA 291.2 514.5 733.7 UO2 79,870 78,580 77,440 CD 2.938 5.607 9.402 AG 4.236 7.694 11.90 CSI 16.61 29.58 42.16 CSM 146.8 257.3 358.4 Table 2-28 provides a synopsis of the fire/seismic/wind release category results for use by the Level 3 PRA team. Most aspects of this table are the same as the analogous table in (NRC, 2022a), with the release category frequencies being the major exception. The
2-87 recommended representative source term for each release category is bolded. A more complete set of information relative to releases is provided in the MELCOR output files. The MELCOR output files include fission product release fractions as a function of time, by chemical class and aerosol size bin, and per flow path. Energy content is also included.
Table 2-29 summarizes the release category frequencies for just seismic bins 6-8, in order to allow separate assumptions about evacuation timing in case of extreme seismic events.
Release path characterizations are unchanged from those described in (NRC, 2022a), and are reproduced in Table 2-30.
The following are some items for the Level 3 PRA team to be aware of in using the provided results:
- 1. Time zero in MELCOR simulations corresponds to the initial upset condition, which may or may not correspond to the time of reactor trip (depending on whether the upset condition causes immediate trip). This should be considered in setting the initial radionuclide activities in MACCS, such that MACCS decay of the source term starts at the correct time (see Table 2-23).
- 2. MELCOR simulations have deliberately suppressed containment rupture at the time BMT is predicted, since there is no mechanistic model in MELCOR for this situation.
- 3. Some special handling instructions are provided in Table 2-30. Specifically, two flow paths may require adjustment of the release height, while several flow paths are internal paths defined only for diagnostic purposes and should not be propagated to the offsite consequence analysis because they do not represent releases to the environment.
- 4. The provided EALs are subject to the considerations discussed in Section 2.6.2.
2-88 Table 2-28 Release Category Summary Table for the Level 3 PRA Analysis Release Category Seismic Frequency
(/rcy)
Fire Frequency
(/rcy)
Winds Frequency
(/rcy)
MELCOR Modeling Case Core Damage1 (hr)
GE (hr)
Major Release2 (hr)
Cumul.
Iodine Release Cumul.
Cesium Release 1-REL-V-F 2.32E-09 0
0 5D 2.8 1.25 3.2 1.4E-1 1.3E-1 1-REL-V-F-SC 0
0 0
5B 2.8 1.25 3.2 1.2E-1 9.2E-2 5C 9.5 7.5 10 1.5E-3 7.8E-4 1-REL-V 0
0 0
5 9.5 7.5 10 1.1E-3 6.4E-4 5A 9.5 7.5 10 6.8E-4 6.3E-4 1-REL-SGTR-O 6.38E-08 3.87E-08 4.17E-11 8B 50 47 51 3.4E-1 2.5E-1 1-REL-SGTR-O-SC 1.72E-07 1.83E-07 3.71E-10 8BR1 50 47 51 9.1E-3 1.0E-2 1-REL-SGTR-C 0
0 0
8 50 47 52 1.2E-2 1.1E-2 8A 96 90 97 9.4E-3 8.3E-3 8R1 50 47 Never 5.9E-4 6.4E-4 8R2 50 47 52 1.1E-2 1.1E-2 1-REL-ISGTR (a.k.a.,
C-SGTR) 2.27E-07 5.51E-07 1.64E-07 3A2 11 8
11 2.3E-1 9.2E-2 3A3 11 8
11 7.6E-2 3.8E-2 1-REL-CIF 1.15E-06 4.05E-07 1.46E-08 7
16 3
18 4.2E-2 3.4E-2 1-REL-CIF-SC 3.10E-08 7.65E-08 0
7A 16 3
18 3.3E-2 2.5E-2 1-REL-ECF 2.21E-09 7.54E-09 9.58E-10 2A 15 8
22 1.5E-1 1.6E-1 6C 15 13 40 6.1E-3 3.2E-3 6D 15 13 74 7.7E-4 2.2E-3 1-REL-LCF 7.46E-06 2.13E-05 7.78E-06 1A 16 3
75 3.7E-3 4.2E-3 1A1 16 3
76 2.7E-3 3.8E-3 1B 3.9 3
55 1.2E-2 9.9E-3 1B1 3.0 2.5 56 1.6E-2 1.0E-2 1B2 3.3 3
64 8.2E-3 4.3E-2 2
15 8
99 2.0E-3 4.2E-3 3
11 8
62 2.4E-2 1.5E-2 3A1 11 8
58 1.2E-2 6.9E-3 3A4 11 8
71 1.5E-2 9.9E-3 4
15 17 99 2.2E-3 5.2E-3 1-REL-LCF-SC 7.52E-08 2.13E-06 6.96E-08 2R2 15 8
128 6.0E-4 1.7E-3 1-REL-ICF-BURN 2.71E-06 1.64E-05 1.97E-06 1A2 16 3
28 4.3E-2 3.2E-2
2-89 Release Category Seismic Frequency
(/rcy)
Fire Frequency
(/rcy)
Winds Frequency
(/rcy)
MELCOR Modeling Case Core Damage1 (hr)
GE (hr)
Major Release2 (hr)
Cumul.
Iodine Release Cumul.
Cesium Release 1-REL-ICF-BURN-SC 2.71E-08 2.71E-06 2.88E-07 1A2 (truncate d at ~28 hrs) 16 3
28 6.9E-5 5.9E-5 1-REL-BMT 1.31E-07 3.70E-06 8.44E-08 6
15 13 Never 6.4E-5 5.4E-5 6A 15 13 Never 4.4E-6 3.0E-6 6B 15 13 Never 8.2E-5 7.9E-5 1-REL-NOCF 2.75E-06 2.13E-05 6.34E-06 1
139 3
Never 1.1E-4 7.4E-5 2R1 15 8
Never 8.5E-5 7.4E-5 6R1 15 13 Never 1.4E-5 1.2E-5
2-90 Table 2-29 Release Category Summary Table for Seismic Bins 6-8 Release Category Seismic Frequency (/rcy) 1-REL-V-F 2.320E-09 1-REL-V-F-SC 0
1-REL-V 0
1-REL-SGTR-O 4.127E-08 1-REL-SGTR-O-SC 4.856E-08 1-REL-SGTR-C 0
1-REL-ISGTR (a.k.a., C-SGTR) 8.653E-08 1-REL-CIF 8.890E-07 1-REL-CIF-SC 2.185E-08 1-REL-ECF 7.344E-10 1-REL-LCF 1.678E-06 1-REL-LCF-SC 2.174E-08 1-REL-ICF-BURN 7.756E-07 1-REL-ICF-BURN-SC 7.705E-09 1-REL-BMT 2.384E-08 1-REL-NOCF 5.327E-07
2-91 Table 2-30 Release Path Characterization Note: Flowpaths in blue type require manipulation of the release height prior to use in the Level 3 analysis; those in red type are not environmental release flowpaths and thus should not be used in the Level 3 analysis.
MACCS MELCOR FL Name MELCOR Elevation (m)e Plant Elevation (ft)e Special instructions Description Location Containment (Width: 147.5 ft, Length: 147.5 ft, Height: 402 ft)a 819 (820d)
FL_CONT_LEAK1 61.11 359 None Normal containment leakage This leakage is assumed to be distributed throughout the containment shell above grade 823 (821d)
FL_CONT_LEAK2 43.23 301 None Normal containment leakage 824 FL_CONT_LEAK3 34.54 272 None Normal containment leakage 820 (841d)
FL_CONT_FAIL1 4.19 173 This release path is not used in any scenarios Containment overpressure failure path 821 (842d)
FL_CONT_FAIL2 4.19 173 This release path is not used in any scenarios Auxiliary Building (Width: 220 ft, Length: 125 ft, Height: 288 ft)a 027 FL_027 29.87 257 The elevation of this release path should be 402' (i.e. top of the containment).
Auxiliary building air ventilation exhaust flow path (through the plant stack)
On auxiliary building ventilation duct, exhaust side 995 FL_AUX_995 29.87 257 None Auxiliary building overpressure failure release pathway The assumed failure elevation (i.e. roof of the Auxiliary Building) is reasonable but subject to considerable uncertainty 997 FL_AUX_997 18 218 None Normal auxiliary building leakage above grade This leakage is assumed to be distributed throughout the Auxiliary Building walls and roof 998 FL_AUX_998 25 241 None
2-92 Table 2-30 Release Path Characterization Note: Flowpaths in blue type require manipulation of the release height prior to use in the Level 3 analysis; those in red type are not environmental release flowpaths and thus should not be used in the Level 3 analysis.
MACCS MELCOR FL Name MELCOR Elevation (m)e Plant Elevation (ft)e Special instructions Description Location Tendon gallery access shafts (Height: 220ft)b 840 (810d)
CONT_FAIL_BE The release to the environment from containment through the tendon gallery is now accounted for by FL_844. This should not be transferred to MACCS.
Containment failure to tendon gallery Basemat junction /
tendon gallery 844 FL_844 18.6 220 The specified elevation is for the lower of the two associated release points. One tendon gallery access shaft releases at grade, while the other releases at the top of the control building roof. (The third access shaft connects to the auxiliary building.)
Tendon gallery access shafts (2 of
- 3)
Top of one of the tendon gallery access shafts connects to the environment near the containment structure at grade; another terminates at the control building roof Main Steam Valve Room (Height: 262 ft)b 372 FL_372 28.74c 253c None SG 1 SRV tailpipe On top of the south main steam valve room, right up against containment 373 FL_373 28.74c 253c None SG 1 SRV tailpipe 374 FL_374 28.74c 253c None SG 1 SRV tailpipe 375 FL_375 28.74c 253c None SG 1 SRV tailpipe 376 FL_376 28.74c 253c None SG 1 lowest setpoint SRV tailpipe 377 FL_377 28.74c 253c None SG 1 ARV tailpipe 379 FL_379 28.74c 253c None SG 1 secondary-side leakage Nominally from top of the south main steam valve room, right up against containment 472 FL_472 28.74c 253c None SG 2 SRV tailpipe On top of the north main steam valve 473 FL_473 28.74c 253c None SG 2 SRV tailpipe 474 FL_474 28.74c 253c None SG 2 SRV tailpipe
2-93 Table 2-30 Release Path Characterization Note: Flowpaths in blue type require manipulation of the release height prior to use in the Level 3 analysis; those in red type are not environmental release flowpaths and thus should not be used in the Level 3 analysis.
MACCS MELCOR FL Name MELCOR Elevation (m)e Plant Elevation (ft)e Special instructions Description Location 475 FL_475 28.74c 253c None SG 2 SRV tailpipe room, right up against containment 476 FL_476 28.74c 253c None SG 2 lowest setpoint SRV tailpipe 477 FL_477 28.74c 253c None SG 2 ARV tailpipe 479 FL_479 28.74c 253c None SG 2 secondary-side leakage Nominally from top of the north main steam valve room, right up against containment 572 FL_572 28.74c 253c None SG 3 SRV tailpipe See FL_472 573 FL_573 28.74c 253c None SG 3 SRV tailpipe See FL_472 574 FL_574 28.74c 253c None SG 3 SRV tailpipe See FL_472 575 FL_575 28.74c 253c None SG 3 SRV tailpipe See FL_472 576 FL_576 28.74c 253c None SG 3 lowest setpoint SRV tailpipe See FL_472 577 FL_577 28.74c 253c None SG 3 ARV tailpipe See FL_472 579 FL_579 28.74c 253c None SG 3 secondary-side leakage See FL_479 672 FL_672 28.74c 253c None SG 4 SRV tailpipe See FL_372 673 FL_673 28.74c 253c None SG 4 SRV tailpipe See FL_372 674 FL_674 28.74c 253c None SG 4 SRV tailpipe See FL_372 675 FL_675 28.74c 253c None SG 4 SRV tailpipe See FL_372 676 FL_676 28.74c 253c None SG 4 lowest setpoint SRV tailpipe See FL_372 677 FL_677 28.74c 253c None SG 4 ARV tailpipe See FL_372 679 FL_679 28.74c 253c None SG 4 secondary-side leakage See FL_379 Other 991 FL_FHB_991 39.37 288 This release path is not used in any scenarios Fuel handling building exhaust
2-94 Table 2-30 Release Path Characterization Note: Flowpaths in blue type require manipulation of the release height prior to use in the Level 3 analysis; those in red type are not environmental release flowpaths and thus should not be used in the Level 3 analysis.
MACCS MELCOR FL Name MELCOR Elevation (m)e Plant Elevation (ft)e Special instructions Description Location 741 FL_741 Appears in the S8 series cases. For MELCOR analysis purposes and should not be transferred to MACCS.
Creep rupture in SGT-1 SG1 742 FL_742 Appears in the S8 series cases. For MELCOR analysis purposes and should not be transferred to MACCS.
Creep rupture in SGT-1 SG1 751 FL-751 Appears in S3A2. For MELCOR analysis purposes and should not be transferred to MACCS.
Creep rupture in SGT-2 SG2 752 FL_752 Appears in S3A2. For MELCOR analysis purposes and should not be transferred to MACCS.
Creep rupture in SGT-2 SG2 753 FL_753 Appears in S3A2. For MELCOR analysis purposes and should not be transferred to MACCS.
Creep rupture in SGT-2 SG2
- a.
These are the structure dimensions used in the L3PRA Other Hazards analysis (NRC, 2023c). They are provided as a starting place for the Level 3 team in assessing release heights and wake effects. Note that heights are relative to mean sea level and plant grade is 220.
- b.
These are the release points assumed in the development of the MELCOR model (see the associated special instructions). They are provided as a starting place for the Level 3 team in assessing release heights and wake effects.
- c.
The release point is at elevation 262 ft (top of north main steam valve room at 260 ft plus approximately 2 ft of pipe). The value in MELCOR is more indicative of the top of the valve itself and does not include the relief valve tailpipe.
- d.
These flow paths were inconsistently identified in the MELCOR model (Revision 7), between the time that they were defined as FLs versus the time that they were specified as MACCS flow paths. The first number cited here is the FL number used in defining the flow path. The parenthetical number is the (mistaken) number used in the MACCS card specification. This has no effect on the MELCOR calculations, but care needs to be taken in the Level 2 to Level 3 interface.
- e.
MELCOR elevations are referenced to the inside-bottom of the reactor pressure vessel; plant elevations are referenced to mean sea level.
3-1 3
REFERENCES ASME, 2014 ASME/ANS RAS1.22014, Severe Accident Progression and Radiological Release (Level 2) PRA Standard for Nuclear Power Plant Applications for Light Water Reactors (LWRs), American Society of Mechanical Engineers, New York, NY, Trial Use and Pilot Application, January 5, 2015.
EPRI, 2016 Electric Power Research Institute, An Approach to Human Reliability Analysis for External Events with a Focus on Seismic, EPRI Report No.
3002008093, Palo Alto, CA, 2016.
FEMA, 2015 Earthquake Model - HAZUSMH MR4 Technical Manual, Multi-hazard Loss Estimation Methodology, developed by FEMA (Department of Homeland Security) under contract with National Institute of Building Sciences (https://www.fema.gov/media-library/assets/documents/24609)
NRC, 1990 U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessmente for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990 (Agencywide Documents Access and Management System [ADAMS] Accession No. ML040140729).
NRC, 2022a U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment Project, Volume 3c: Reactor, At-Power, Level 2 PRA for Internal Events and Floods, April 2022 [Draft] (ADAMS Accession No. ML22067A214).
NRC, 2022b U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment Project, Volume 3a: Reactor, At-Power, Level 1 PRA for Internal Events, Part 1 - Main Report, April 2022 [Draft] (ADAMS Accession No. ML22067A211).
NRC, 2023a U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment Project, Volume 4a: Reactor, At-Power, Level 1 PRA for Internal Fires, August 2023 [Draft] (ADAMS Accession No. ML23166A036).
NRC, 2023b U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment Project, Volume 4b: Reactor, At-Power, Level 1 PRA for Seismic Events, August 2023 [Draft] (ADAMS Accession No. ML23166A038).
NRC, 2023c U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment Project, Volume 4c: Reactor, At-Power, Level 1 PRA for High Winds and Other Hazards, August 2023 [Draft] (ADAMS Accession No. ML23166A041).
A-1 APPENDIX A FIRE, SEISMIC, AND WIND IMPACTS ON LEVEL 2 MODEL Impacts of the fire, seismic, or wind initiating event on the post-core damage accident progression acts primarily through either containment systems (handled in the bridge tree, Section 2.2.1) or by affecting the availability of equipment for accident mitigation actions. The specific SSCs needed for each operator action in the Level 2 model are listed in Table A-1. For internal events, each of these is modeled as a single basic event (an HEP). For the seismic and wind models, each of the actions is expanded into a fault tree in which failure can occur due to either the human failure or failure of one of the necessary SSCs due to a seismic or wind event (failures due to fire are handled by flag sets, as described in Section A.1). Figure A-1 shows the fault tree for the SAG-1 action as an example. Fault trees for seismic and wind failures of the supporting equipment were developed or adapted from Level 1 as needed.
In addition to the equipment listed in Table A-1, all of these actions are assumed to fail if the ventilation and filtering system for the main control room and TSC fails in combination with a bypass accident or isolation failure (since this would require abandonment of the main control room). In sequences with bypass or containment isolation failure, the linkage rules will select an alternative fault tree that also includes failure of the MCR/TSC ventilation system.
Table A-1 Equipment Required for Level 2 Operator Actions Operator Action Description Equipment Required 1-L2-BE-MAN UALTDAFW-GEN Manual extension of TD-AFW in SBO TD-AFW 1-L2-OP-SAG1 Open ARVs on at least 2 SGs & start AFW injection, before VB SG ARVs At least one 480V MCC Condensate pumps Turbine bldg., Auxiliary bldg.
1-L2-OP-SAG2-1 Open all ARVs to depressurize the RCS, before VB (with FW available)
SG ARVs Both 480V MCCs Turbine bldg., Auxiliary bldg.
1-L2-OP-SCG1-1 Spray containment with fire water, after VB B5B pump Firewater storage tank Auxiliary bldg.
1-L2-OP-SCG1-2 Feed and bleed damaged SG, before VB MD-AFW Condenser steam dumps Turbine bldg., Auxiliary bldg.
1-L2-OP-SCG1-3 Feed and bleed damaged SG, after VB MD-AFW Condenser steam dumps Turbine bldg., Auxiliary bldg.
1-L2-OP-SCG1-4 Operate containment spray system, after VB Containment sprays
A-2 Figure A-1 Example Fault Tree for a Level 2 Operator Action Although action SAG1 requires access to the turbine building, it is not included in the fault tree because it is substantially more seismically robust than the auxiliary building (so failure of the turbine building but not the auxiliary building is implausible).
A.1 Fire Impacts Here we summarize fire impacts for those SSCs/strategies that are germane to the Level 2 PRA but were not germane to the Level 1 PRA, and identify the location of equipment relevant to those SSCs/strategies.
The Level 1 model contains a flag set for each fire initiator, activated by the initiating event trees linkage rules. These flag sets modify certain basic events to have failure probability 1.0, according to their location and susceptibility to damage by each fire initiator. To follow the same approach in Level 2, it was necessary to modify those flag sets to include Level 2 basic events as well.
Based on practical constraints, a new effort was not undertaken to systematically develop this new information. Rather, existing information was utilized to make judgments about the performance of previously un-analyzed equipment. Further, it should be understood that the Level 2 PRA inherits the fire scenario development from the Level 1 PRA, so the fire scenarios of interest to the Level 2 PRA are the 210 collapsed NRC fire scenarios developed from the larger set of reference plant scenarios.
Several simplifying assumptions are made, including:
A-3 In the vast majority of situations, the fire will have been identified and suppressed by the time of core damage, so it is the lasting unavailability of the equipment that is of most relevance to the Level 2 PRA usage.
Credit for operator actions cannot be given in main control room abandonment scenarios.
Cable tracing was not performed for the containment spray system, though an exclusion analysis was performed to justify credit for this system within some fire scenarios.
Where no specific information was available to support crediting or discrediting a system, the model is not modified to change the way the system is credited for internal events.
Table A-2 gives the mapping between Level 2 SSCs and fire scenarios that are assumed to disable those SSCs. The effects of these fire initiators on the Level 2 model are captured entirely through the use of flag sets, consistent with the Level 1 fire methodology. Many of the systems listed correspond to basic events or fault trees in the Level 2 model, while others are modeled implicitly. From this information, a list of Level 2 equipment failures was generated for each fire initiator, and those equipment failures were added to the initiators existing flag set using MARD.
Additionally, all Level 2 operator actions are set to fail for initiator 1-FRI-A105-JY_ABN4, which represents all fires that result in main control room abandonment.
Fires that affect the TDAFW system disable the action to manually extend TDAFW. Fires that affect the RWST disable action SCG1-4 to operate containment sprays. Those that affect the condensate system disable action SAG-1 to inject auxiliary feedwater. Those that affect the MDAFW system disable actions SCG1-2 and SCG1-3 to feed and bleed a damaged steam generator.
A-4 Table A-2 SSC Fire Impacts SSC Fire Scenarios Resulting in Equipment Failure L2 Basic Events Failed Explicitly considered:
1 Containment None 2
Containment spray system ALL 210 fire scenarios EXCEPT:
IE-FRI-1506_JB1 IE-FRI-A105-JY_AX IE-FRI-A105-JY_Q1 IE-FRI-A105-JY_Q6 IE1-FRI-A105-JY_R0 IE-FRI-A105-JY_S2 IE-FRI-A105-JY_S3 IE-FRI-A105-JY_S5 IE-FRI-2080-M9_H1 IE-FRI-2091-N4_B100 IE-FRI-AHVSWYD_B IE-FRI-AHVSWYD_C IE-FRI-AHVSWYD_E Note that this fire mapping will be enforced through the bridge trees use of the Level 1 flag files None (affects the bridge tree) 3 Containment cooling units IE-FRI-A105-JY_ABN4 IE-FRI-A105-JY_P2 IE-FRI-A105-JY_U3A IE-FRI-YARD_TR01 Note that this fire mapping will be enforced through the bridge trees use of the Level 1 flag files None (affects the bridge tree) 4 Containment isolation system IE-FRI-A105-JY_ABN4 IE-FRI-YARD_TR01 IE-FRI-A105-JY_L Note that this fire mapping will be enforced through the bridge trees use of the Level 1 flag files None (affects the bridge tree) 5 TD-AFW blind feeding AUX pump house tunnel IE-FRI-1509_Q_RR Aux Rooms IE-FRI-2050-D4_A_RR IE-FRI-1603-KD_E_RR IE-FRI-2136-LP_A_RR IE-FRI-2098-N9_JB1_RR IE-FRI-1016-AV_A_RR IE-FRI-1026A-C7_A_RR IE-FRI-1095-JC_F1_RR IE-FRI-1155-V1_TR01_RR IE-FRI-1092-J9_D1_RR IE-FRI-1113-JZ_TR03_RR IE-FRI-1031-C6_A_RR IE-FRI-1073-I7_TR03RR IE-FRI-1071-IF_G1_RR IE-FRI-2085-NB_TR04_RR IE-FRI-1030-C7_A_RR IE-FRI-1800_A_RR IE-FRI-1044-D2_B1 IE-FRI-1044-D2_B0 1-L2-BE-MANUALTDAFW-GEN
A-5 SSC Fire Scenarios Resulting in Equipment Failure L2 Basic Events Failed IE-FRI-1043-D1_B0 Control Building Rooms IE-FRI-1078A-IL_G_RR IE-FRI-2136-LP_A_RR IE-FRI-1800_A_RR IE-FRI-1030-C7_A_RR IE-FRI-1016-AV_A_RR Aux Building IE-FRI-2136-LP_A_RR IE-FRI-2133A-KK_A_RR CST Refill IE-FRI-1509_Q_RR 6
RWST refill via County Fire Department (as part of SAG-3)
IE-FRI-1095-JC_E3 IE-FRI-1095-JC_E7 IE-FRI-1095-JC_G5 IE-FRI-1095-JC_G7 IE-FRI-1120-KH_C6 IE-FRI-1120-KH_E4 IE-FRI-1120-KH_H2 IE-FRI-1120-KH_M4 IE-FRI-1120-KH_M5 IE-FRI-1133B-KK_D2 IE-FRI-1151-IQ_TR03_RR IE-FRI-1151-IN_TR02 IE-FRI-YARD_TR01 IE-FRI-1095 JC F1 IE-FRI-1017-AW_TR02_RR IE-FRI-1146-VF_TR01_RR IE-FRI-1056A-IM_TR01RR IE-FRI-1086-KB_A_RR IE-FRI-1120-KH_J4_R IE-FRI-1174-JG_TR04_RR IE-FRI-1113-JZ_TR03_RR IE-FRI-1077A-IJ_TR01RR 1-L2-OP-SCG1-4 7
Containment spray using the B5b pump No information could be found that would support specifically crediting or dis-crediting this equipment. It is anticipated to be un-impacted in virtually all fire scenarios, and as a simplifying assumption it will be credited for all.
None 8
Condensate system (to feed SGs as part of SAMG action)
IE-FRI-1014D-B9_A_RR IE-FRI-1509_Q_RR IE-FRI-2133A-KK_A_RR IE-FRI-1016-AV_A_RR 1-L2-OP-SAG1 9
Motor-driven AFW (to feed SGs as part of SAMG action)
IE-FRI-1095-JC_E3 IE-FRI-1095-JC_G5 IE-FRI-1095-JC_G7 IE-FRI-1120-KH_C6 IE-FRI-1120-KH_E4 IE-FRI-1120-KH_H2 1-L2-OP-SCG1-2 1-L2-OP-SCG1-3
A-6 SSC Fire Scenarios Resulting in Equipment Failure L2 Basic Events Failed IE-FRI-1133B-KK_D2 IE-FRI-YARD_TR01 IE-FRI-1095-JC_J3 IE-FRI-1095-JC_K1 IE-FRI-1120-KH_L5 IE-FRI-1120-KH_M4 IE-FRI-1120-KH_M5 IE-FRI-1151-IQ_TR03_RR IE-FRI-1151-IN_TR02 IE-FRI-1017-AW_TR02_RR IE-FRI-1071-IF_G1_RR IE-FRI-1073-I7_TR03RR IE-FRI-1078A-IL_G_RR IE-FRI-1086-KB_A_RR IE-FRI-1095-JC_N3_RR IE-FRI-1099-J5_A_RR IE-FRI-1120-KH_J4_R IE-FRI-1120-KH_K3_R IE-FRI-1121-KG_D1_RR 10 RHR (as part of SAMG action)
No information could be found that would support specifically crediting or dis-crediting this equipment.
None 11 Condenser steam dump system (as part of SAMG action)
No information could be found that would support specifically crediting or dis-crediting this equipment.
None 12 Manual operation of ARVs as part of SAMG action IE-FRI-1043-D1_B0 IE-FRI-1044-D2_B1 IE-FRI-1044-D2_B0 IE-FRI-2050-D4_A_RR IE-FRI-1603-KD_E_RR IE-FRI-2136-LP_A_RR IE-FRI-2098-N9_JB1_RR IE-FRI-2050-D4_A_RR IE-FRI-1603-KD_E_RR IE-FRI-1016-AV_A_RR IE-FRI-1160A-V8_C_RR 1-L2-OP-SAG1 1-L2-OP-SAG2-1 Implicitly considered:
13 Post-accident monitoring instrumentation Cable Spreading Room IE-FRI-1092-J9_D1_RR IE-FRI-1095-JC_B5 IE-FRI-1095-JC_B8 IE-FRI-1095-JC_D5 IE-FRI-1095-JC_E3 IE-FRI-1095-JC_E7 IE-FRI-1095-JC_F1_RR IE-FRI-1095-JC_F4 IE-FRI-1095-JC_G1 IE-FRI-1095-JC_G3 IE-FRI-1095-JC_G5 IE-FRI-1095-JC_G7 IE-FRI-1095-JC_J3 IE-FRI-1095-JC_K1 None
A-7 SSC Fire Scenarios Resulting in Equipment Failure L2 Basic Events Failed IE-FRI-1095-JC_N3_RR IE-FRI-1113-JZ_TR03_RR IE-FRI-1120-KH_C3 IE-FRI-1120-KH_C4 IE-FRI-1120-KH_C6 IE-FRI-1120-KH_E4 IE-FRI-1120-KH_E5 IE-FRI-1120-KH_F3 IE-FRI-1120-KH_G1 IE-FRI-1120-KH_G4 IE-FRI-1120-KH_H1 IE-FRI-1120-KH_H2 IE-FRI-1120-KH_J4 IE-FRI-1120-KH_J5 IE-FRI-1120-KH_K3 IE-FRI-1120-KH_K4 IE-FRI-1120-KH_L5 IE-FRI-1120-KH_M4 IE-FRI-1120-KH_M5 IE-FRI-1120-KH_TR04 IE-FRI-1120-KH_TR09 IE-FRI-1144-T6_JB3_RR IE-FRI-1152-IN_TR01_RR IE-FRI-1155-V1_TR01_RR IE-FRI-1179-KV_B1_RR IE-FRI-1300A-X1_A_RR IE-FRI-2085-NB_TR04_RR IE-FRI-2091-N4_B100 IE-FRI-2095-N8_JB1 IE-FRI-2098-N9_JB1_RR IE-FRI-2133A-KK_A_RR IE-FRI-2136-LP_A_RR Control Room IE-FRI-1016-AV_A_RR IE-FRI-1025-BT_A_RR IE-FRI-1026A-C7_A_RR IE-FRI-1030-C7_A_RR IE-FRI-1056B-IH_TR01RR IE-FRI-1071-IF_G1_RR IE-FRI-1078A-IL_G_RR IE-FRI-1086-KB_A_RR IE-FRI-1099-J5_A_RR IE-FRI-1144-T6_JB3_RR IE-FRI-1149-DO_TR02_RR IE-FRI-1152-IN_TR01_RR IE-FRI-1155-V1_TR01_RR IE-FRI-1174-JG_TR04_RR IE-FRI-1509_Q_RR IE-FRI-1603-KD_E_RR IE-FRI-2098-N9_JB1_RR IE-FRI-2133A-KK_A_RR IE-FRI-A105-JY_ABN4 IE-FRI-A105-JY_AI
A-8 SSC Fire Scenarios Resulting in Equipment Failure L2 Basic Events Failed IE-FRI-A105-JY_AR IE-FRI-A105-JY_AT0 IE-FRI-A105-JY_AT1 IE-FRI-A105-JY_AT2 IE-FRI-A105-JY_AT3 IE-FRI-A105-JY_AV IE-FRI-A105-JY_AW0 IE-FRI-A105-JY_AW1 IE-FRI-A105-JY_AW2 IE-FRI-A105-JY_AW3 IE-FRI-A105-JY_AX IE-FRI-A105-JY_L IE-FRI-A105-JY_M IE-FRI-A105-JY_P2 IE-FRI-A105-JY_Q1 IE-FRI-A105-JY_Q6 IE-FRI-A105-JY_R0 IE-FRI-A105-JY_S2 IE-FRI-A105-JY_S3 IE-FRI-A105-JY_S5 IE-FRI-A105-JY_U3A IE-FRI-A105-JY_U5A IE-FRI-A105-JY_U7A Shutdown Panel IE-FRI-1056A-IM_TR01RR IE-FRI-1093-JA_TR02 IE-FRI-1093-JA_TR03 IE-FRI-1093-JA_TR04 IE-FRI-1103-J8_B1 IE-FRI-1103-J8_TR01 IE-FRI-1113-JZ_TR03_RR IE-FRI-1152-IN_TR01_RR IE-FRI-1509_Q_RR IE-FRI-2098-N9_JB1_RR 14 Security diesel No information could be found that would support specifically crediting or dis-crediting this equipment.
None 15 Main control room and TSC ventilation and filtering systems MCR - HVAC IE-FRI-1026A-C7_A_RR IE-FRI-1078A-IL_G_RR IE-FRI-1030-C7_A_RR IE-FRI-1509_Q_RR IE-FRI-1174-JG_TR04_RR IE-FRI-1603-KD_E_RR IE-FRI-1099-J5_A_RR IE-FRI-2133A-KK_A_RR IE-FRI-1016-AV_A_RR IE-FRI-1086-KB_A_RR IE-FRI-1056B-IH_TR01RR IE-FRI-1071-IF_G1_RR IE-FRI-1155-V1_TR01_RR IE-FRI-1152-IN_TR01_RR 1-L2-MCR-VENT-FRI (not an operator action but is used in Level 2 fault trees)
A-9 SSC Fire Scenarios Resulting in Equipment Failure L2 Basic Events Failed IE-FRI-1025-BT_A_RR IE-FRI-1144-T6_JB3_RR IE-FRI-2098-N9_JB1_RR IE-FRI-1149-DO_TR02_RR TSC - HVAC IE-FRI-2133A-KK_A_RR IE-FRI-1016-AV_A_RR 16 Auxiliary, control, turbine, and TD-AFW pump-house buildings for taking local actions ALL 210 fire scenarios EXCEPT:
IE-FRI-YARD_TR01 IE-FRI-TB1_A IE-FRI-1011B-A1_TR01 IE-FRI-1140A-S1_E IE-FRI-YARD_TR10 IE-FRI-ALVSWYD_TR01 IE-FRI-1140B-S1_E IE-FRI-1140B-S1_H IE-FRI-AHVSWYD_E IE-FRI-AHVSWYD_B IE-FRI-AHVSWYD_C IE-FRI-AHVSWYD_TR01 IE-FRI-1140B-S1_B IE-FRI-1140C-S1_L2 IE-FRI-1161-T1_B IE-FRI-1162-T2_B IE-FRI-YARD_TR05 IE-FRI-1140C-S1_C_RR None 17 OSC and EOF availability No information could be found that would support specifically crediting or dis-crediting this equipment.
None 18 Effluent radiation monitors (e.g.,
main plant stack monitor)
No information could be found that would support specifically crediting or dis-crediting this equipment.
None 19 Piping penetration area filter and exhaust system (PPAFES) and auxiliary building ventilation system IE-FRI-1603-KD_E_RR IE-FRI-1800_A_RR None 20 Containment hydrogen sampling No information could be found that would support specifically crediting or dis-crediting this equipment.
None 21 Valves used in accident management (e.g., to isolate cold leg accumulators)
No information could be found that would support specifically crediting or dis-crediting this equipment.
None
A-10 SSC Fire Scenarios Resulting in Equipment Failure L2 Basic Events Failed 22 Fire detection and suppression systems No information could be found that would support specifically crediting or dis-crediting this equipment.
None
A-11 A.2 Seismic Impacts This appendix gives seismic fragilities for systems relevant to the Level 2 PRA and uses them to develop seismic failure probabilities. The bases for selected newly developed fragilities are also discussed.
Table A-3, Table A-4, and Table A-5 provide the seismic response characterization (akin to a simplified seismic equipment list (SEL)), specific to the Level 2 PRA, for the reference plant. It is developed from the seismic modeling done for the Level 1 PRA (NRC, 2023b), for which a seismic walkdown was performed. The fragilities of SSCs modeled in the Level 1 PRA are listed in Table 5-3 of (NRC, 2023b). Seismic fragilities are given in the form of median capacity Am, random uncertainty r, and epistemic uncertainty u. The combined uncertainty C = (r2 + u2)1/2 is also shown in Tables A-4 and A-5.
Table A-3 Level 1-Developed Building and Structure Fragilities Relevant to the Level 2 PRA Structure Median Capacity (PGA)
Am (g)
Random r
Epistemic u
Remarks Containment Shell 2.90 0.23 0.25 Tangential shear failure governs Containment Internal Structures &
Equipment Wall: 3.59 Pressurizer: 2.88 0.21 0.37 Diagonal Shear Failure of the Pressurizer wall governs the wall failure; failure capacity of pressurizer governs the equipment Auxiliary Building 1.91 0.23 0.29 Mixture of Diagonal Shear and Flexure; Diagonal shear failure of a 1st story wall governs Control Building 2.73 0.35 0.32 Mixture of Diagonal Shear and Flexure; Diagonal shear failure of a 1st story wall governs Auxiliary Feedwater Pump House 7.05 0.21 0.20 Mixture of Diagonal Shear and Flexure; Diagonal shear failure governs Condensate Water Storage Tank 4.16 0.19 0.38 Tangential shear failure governs Refueling Water Storage Tank 4.16 0.19 0.38 Tangential shear failure governs
A-12 Table A-4 Level 1-Developed System and Component Fragilities Relevant to the Level 2 PRA Index Description Median Am (g)
Random r
Epistemic u
Total c
Comments 12 SG ARVs 1.92 0.32 0.32 0.45 35 RHR HEAT EXCHANGER 2.98 0.26 0.21 0.33 RHR 71 CONTAINMENT FAN COOLER UNITS 1.47 0.32 0.32 0.45 CCU-Failure of 5 of 8 fans 75 AFW TDP TURB CONT PNL (PAFT) 2.03 0.25 0.33 0.41 AFW 76 AFW TDP ELECT PNL (PAFP) 2.83 0.28 0.14 0.31 AFW 77 AFW TDP 3.11 0.24 0.17 0.29 AFW TDP fails 78 BOTH AFW MDP 4.14 0.25 0.17 0.30 Both AFW pumps fail
A-13 Table A-5 Controlling Fragilities for Systems Unique to the Level 2 PRA System Median Am (g)
Random r
Epistemic u
Total c
Limiting component TDAFW blind feed 0.75 0.45 0.45 0.64 Structure housing the trailer-mounted diesel pumps RWST refill via fire dept 0.75 0.45 0.45 0.64 Containment spray via B5B pump 0.75 0.45 0.45 0.64 Condensate to feed SGs 2.5 0.32 0.32 0.45 Turbine building MDAFW 1.91 0.23 0.29 0.37 Auxiliary building RHR 1.91 0.23 0.29 0.37 Auxiliary building Condenser steam dump 1.91 0.23 0.29 0.37 Auxiliary building ARV manual operation 1.87/2.64 1.91 1.92 0.32 0.19 0.32 0.32 0.29 0.32 0.45 0.35 0.45 480V motor control center(s)
Aux building access ARVs Post-accident monitoring 2.5 0.32 0.32 0.45 (all rugged)
Security diesel 0.99 0.32 0.32 0.45 Battery racks MCR/TSC ventilation 1.66 1.82 0.23 0.32 0.16 0.32 0.28 0.45 Chilled water pumps Motor-operated valves Auxiliary building 1.91 0.23 0.29 0.37 Control building 2.73 0.35 0.32 0.47 Turbine building 2.5 0.32 0.32 0.45 (rugged)
AFW pump housing building 7.05 0.21 0.20 0.29 Operations Support Center 0.75 0.40 0.40 0.57 Maintenance building Emergency Operations Facility (no seismic threat)
Effluent radiation monitors 2.5 0.32 0.32 0.45 (rugged)
PPAFES aux building ventilation 2.5 0.32 0.32 0.45 (rugged)
Containment hydrogen sampling 2.5 0.32 0.32 0.45 (rugged)
Valves for accident mitigation 2.5 0.32 0.32 0.45 (rugged)
Fire detection and Suppression 0.99 0.25 0.25 0.35 Fire Water Storage Tanks To convert these seismic fragilities to failure probabilities for each seismic bin, we assume a lognormal distribution of the fragility with standard deviation C and a fixed value of peak acceleration amax for each seismic bin:
Bin 1: 0.173 g Bin 2: 0.387 g Bin 3: 0.592 g Bin 4: 0.794 g Bin 5: 0.995 g Bin 6: 1.285 g Bin 7: 1.936 g Bin 8: 2.500 g Using Excels NORMSDIST function to get the exceedance probability, the failure probability for a system in a given seismic bin is:
Pfailure = NORMSDIST( (ln(amax) - ln(Am)) / C)
A-14 or equivalently Pfailure = NORMSDIST( ln(amax / Am) / C)
Here we assume the seismic capacity to have a log-normal distribution, and the uncertainty C is taken to be the logarithmic standard deviation.
The results of this calculation for each system and seismic bin are shown in Table A-6. In most cases, the failure probabilities shown are for the least rugged component of the system. For some systems, the fragilities of multiple sub-systems are relevant because no single component dominates by having a lower fragility than the rest. These sub-systems are shown underneath the main SSC in italics.
Table A-6 Seismic Failure Probabilities of Level 2 Systems SSC Description Bin 1 Bin 2 Bin 3 Bin 4 Bin 5 Bin 6 Bin 7 Bin 8 Containment structural failure 5.41E-17 1.55E-09 1.44E-06 6.83E-05 8.19E-04 8.26E-03 1.17E-01 3.31E-01 Pressurizer compartment wall 5.19E-13 8.30E-08 1.13E-05 1.95E-04 1.28E-03 7.85E-03 7.34E-02 1.98E-01 Containment isolation system 2.73E-09 5.89E-05 2.50E-03 1.86E-02 6.33E-02 1.85E-01 5.45E-01 7.71E-01 Containment spray system 6.43E-08 2.30E-04 5.14E-03 2.76E-02 7.81E-02 1.97E-01 5.21E-01 7.32E-01 Containment fan coolers 1.15E-06 1.60E-03 2.22E-02 8.66E-02 1.94E-01 3.83E-01 7.29E-01 8.80E-01 Turbine-Driven AFW blind feed 1.06E-02 1.50E-01 3.55E-01 5.35E-01 6.72E-01 8.01E-01 9.32E-01 9.71E-01 RWST refill via fire department 1.06E-02 1.50E-01 3.55E-01 5.35E-01 6.72E-01 8.01E-01 9.32E-01 9.71E-01 Containment spray using B5b pump 1.06E-02 1.50E-01 3.55E-01 5.35E-01 6.72E-01 8.01E-01 9.32E-01 9.71E-01 Condensate to feed SGs 1.83E-09 1.89E-05 7.25E-04 5.62E-03 2.09E-02 7.06E-02 2.86E-01 5.00E-01 MDAFW 4.43E-11 8.12E-06 7.72E-04 8.84E-03 3.90E-02 1.42E-01 5.15E-01 7.66E-01 RHR 4.43E-11 8.12E-06 7.72E-04 8.84E-03 3.90E-02 1.42E-01 5.15E-01 7.66E-01 Condenser steam dump 4.43E-11 8.12E-06 7.72E-04 8.84E-03 3.90E-02 1.42E-01 5.15E-01 7.66E-01 Manual operation of ARVs 480 V motor control center 7.31E-08 2.51E-04 5.49E-03 2.91E-02 8.16E-02 2.03E-01 5.31E-01 7.39E-01
A-15 SSC Description Bin 1 Bin 2 Bin 3 Bin 4 Bin 5 Bin 6 Bin 7 Bin 8 Both 480 V motor control centers 8.75E-10 1.11E-05 4.75E-04 3.96E-03 1.55E-02 5.57E-02 2.47E-01 4.52E-01 Aux bldg access points 4.43E-11 8.12E-06 7.72E-04 8.84E-03 3.90E-02 1.42E-01 5.15E-01 7.66E-01 ARVs 5.31E-08 2.02E-04 4.64E-03 2.55E-02 7.32E-02 1.87E-01 5.08E-01 7.20E-01 PAM systems 3.17E-09 2.49E-05 8.58E-04 6.28E-03 2.25E-02 7.37E-02 2.89E-01 5.00E-01 Security Diesel 5.86E-05 1.90E-02 1.28E-01 3.13E-01 5.04E-01 7.18E-01 9.31E-01 9.80E-01 MCR/TSC ventilation and filtering Chilled water pumps 3.61E-16 1.03E-07 1.16E-04 4.23E-03 3.39E-02 1.80E-01 7.09E-01 9.28E-01 Ctrl room HVAC filter exhaust MOV 1.01E-07 3.14E-04 6.51E-03 3.33E-02 9.10E-02 2.21E-01 5.55E-01 7.58E-01 Ctrl room HVAC filter return &
supply air fans inlet MOV 1.01E-07 3.14E-04 6.51E-03 3.33E-02 9.10E-02 2.21E-01 5.55E-01 7.58E-01 Ctrl room HVAC filter supply air fan inlet MOV 1.01E-07 3.14E-04 6.51E-03 3.33E-02 9.10E-02 2.21E-01 5.55E-01 7.58E-01 Aux bldg 4.43E-11 8.12E-06 7.72E-04 8.84E-03 3.90E-02 1.42E-01 5.15E-01 7.66E-01 Control bldg 3.04E-09 1.91E-05 6.31E-04 4.60E-03 1.67E-02 5.59E-02 2.34E-01 4.26E-01 Turbine bldg 1.83E-09 1.89E-05 7.25E-04 5.62E-03 2.09E-02 7.06E-02 2.86E-01 5.00E-01 AFW pump housing bldg 1.06E-37 7.21E-24 6.45E-18 2.51E-14 7.30E-12 2.16E-09 4.18E-06 1.75E-04 Operations Support Center 4.79E-03 1.21E-01 3.37E-01 5.40E-01 6.91E-01 8.29E-01 9.53E-01 9.83E-01 Emergency Operations Facility Not applicable Effluent Radiation Monitors 1.83E-09 1.89E-05 7.25E-04 5.62E-03 2.09E-02 7.06E-02 2.86E-01 5.00E-01 PPAFES aux bldg ventilation 1.83E-09 1.89E-05 7.25E-04 5.62E-03 2.09E-02 7.06E-02 2.86E-01 5.00E-01
A-16 SSC Description Bin 1 Bin 2 Bin 3 Bin 4 Bin 5 Bin 6 Bin 7 Bin 8 Containment hydrogen sampling Assumed to be zero Valves to isolate CL accumulators Assumed to be zero Fire Detection and Suppression system 4.10E-07 3.97E-03 7.27E-02 2.66E-01 5.06E-01 7.69E-01 9.71E-01 9.96E-01 The process employed to develop quantitative fragilities for Level 2 PRA systems uses the fragility for the weakest component in the system, with exceptions, described below, for systems that depend strongly on multiple weak components. Reference plant-provided material, the FSAR, and the NRC Westinghouse systems training manuals were used to understand the components in each of the relevant systems. The reference plant seismic PRA was reviewed, and fragilities were compared to other relevant data sources.
The fragility screening capacity of 2.5g was adopted from the Level 1 PRA, and in turn selected based on a target value for the core damage frequency (CDF). Structures, systems and components (SSCs) that were screened from the logic model for having very high or rugged capacities, or components (such as valves) that were classified as rugged, could be assumed to have median capacities equal to or greater than the fragility screening capacity of 2.5g. It must be stressed that prior to screening a component of the logic model, an evaluation had to be made by experts to show that screening the component out from the logic model based on high seismic capacity made sense. For the Level 2 PRA, systems screened from the Level 1 PRA based on having high seismic capacity are treated as having a median seismic fragility of 2.5g.
Containment Building The concrete internal structures of the containment building include the primary shield wall, the secondary shield and the pressurizer compartment walls. Together with the refueling canal walls and primary shield walls, the secondary shield enclose the steam generators. All these walls are cantilevered off the common foundation with the containment shell (i.e., there is no direct connection between the walls and the containment shell except at their foundations)
The fragility of the containment shell is the controlling component for the containment building with a median capacity, Am = 2.90 g (random uncertainty, r = 0.23 and epistemic uncertainty, u = 0.25) based on tangential shear failure of the shell.
Along with failure of the shell itself, the staff also looked at the implications of failure of large structures internal to containment. The utility previously looked at these containment internals and concluded that a particular pressurizer wall would be the controlling structure, with seismic capacity on par with the tangential shear failure of the containment shell (the limiting pressurizer wall has a higher median capacity but broader uncertainty causing it to have a higher seismic failure probability in the lower seismic bins). The staff discounted the possibility that failure of the controlling pressurizer wall would lead to containment liner failure, on the basis that the structure is located well away from the containment wall, and shares only a common foundation.
A-17 The same conclusion was reached for other internal walls, including those of the of the steam generator compartments. Even though failure of the steam generator snubbers could cause disruption of the main steam and feedwater lines, the staff concluded that median capacity of the steam generator walls was significantly larger than that of the controlling pressurizer wall (based on the ratio of the elastic strength factor of the pressurizer wall to that of the steam generator wall), and the SG compartment walls will not fail at the level governing the controlling pressurizer wall. The staff also determined that movement of the steam generator, as a result of the failure of the snubbers, will be minimal and will have no impact on containment integrity, especially at the locations where the large-bore piping (main steam and main feed) penetrate containment. This leaves the tangential shear failure of the shell as the controlling seismic capacity.
Containment Spray System Several of the main sub-systems of the CS system (such as the refueling water storage tank, containment spray pumps, motor-operated valves, relays and the emergency sump screens) were looked at to determine the component(s) with the controlling seismic fragility capacities. It was determined that the valves controlling the containment spray pumps to the spray header (1HV9001A and 1HV9001B) were the components with the smallest fragility capacity with a median capacity, Am = 1.89 g (random uncertainty, r = 0.32 and epistemic uncertainty, u = 0.32).
Containment Cooling System The major components of the nuclear service cooling water system (NSCW), such as the cooling towers, the pumps and fans, were considered in developing a controlling fragility for the system. Also considered were the eight cooling fans. Even though failure of a single fan had a lower fragility capacity, it was determined that the correlated failure of five (5) fans would be the governing fragility capacity of the system, with a median capacity, Am = 1.47 g (random uncertainty, r = 0.32 and epistemic uncertainty, u = 0.32).
Containment Isolation System Each piping system that penetrates the containment is provided with an isolation feature and a list of these penetrations and related isolation valves was available in the FSAR. The electric power sources (such as the 120 VAC vital panels and the vital AC inverter panels) necessary for containment isolation were also reviewed and it was determined that the uncorrelated fragility capacity of either one of the following vital AC inverter panels: 11807Y3IB12 and 11807Y3IA1 governed with a median capacity, Am = 1.85 g (random uncertainty, r = 0.25 and epistemic uncertainty, u = 0.32)
Turbine-Driven Auxiliary Feedwater Blind Feed Several sub-systems were considered to determine the controlling seismic fragility for blind feed, including valves and pumps, structures, water tanks, sensors, and control panels. The lowest capacity is for the production warehouse and/or fire training facility, where the trailer-mounted diesel pumps to be used for CST refill (AB5BPUMP001/002) are housed. Those structures were each found to have median fragility Am = 0.75 g (random uncertainty, r = 0.45 and epistemic uncertainty, u = 0.45), based on methods in the HAZUS technical manual (FEMA, 2015).
A-18 RWST Refill via County Fire Department The major sub-systems required for the fire department to refill the RWST are the water source (firewater storage tank or demineralized water storage tank), transportation system to allow the fire department to travel to the site, and the availability of the adapter needed when using the trailer-mounted B5b pump. Availability of the fire department itself is not considered in this analysis. Assuming the pump adapter is necessary, the controlling fragility is that of the production warehouse and/or fire training facility where it is stored: Am = 0.75 g (random uncertainty, r = 0.45 and epistemic uncertainty, u = 0.45), based on methods in the HAZUS technical manual (FEMA, 2015).
Containment Spray Using B5b Pump As noted above, the B5b pump equipment is stored in the production warehouse and/or fire training facility, Am = 0.75 g (random uncertainty, r = 0.45 and epistemic uncertainty, u = 0.45),
based on methods in the HAZUS technical manual (FEMA, 2015). Other components considered are the water source and containment spray valves.
Condensate System to Feed Steam Generators The condensate system depends on the CST, AC and DC power supplies, condensate pumps, and condenser hotwell water. The only one considered in the Level 1 SPRA is the CST, with Am = 4.16. The pumps and hotwell are assumed to be rugged. The condensate system is housed in the turbine building, and this is considered the controlling fragility, with median capacity Am > 2.5 g, (random uncertainty, r = 0.25 and epistemic uncertainty, u = 0.32). For this analysis the median capacity is taken as 2.5 g. Note that if the actual capacity of the turbine building were found to be higher, the controlling fragility would be that of the control building (median capacity 2.73) and the effect on failure probabilities would be minor.
Motor-Driven Auxiliary Feedwater Motor-driven auxiliary feedwater depends on the two MD-AFW pumps and the CST, both of which are extremely rugged. It also depends on availability of the auxiliary building, which has a lower median capacity (Am = 1.91, r = 0.23, u = 0.29) and so is considered the controlling fragility.
The RHR system components considered include the RHR pumps, the RHR heat exchanger, the RWST, and the containment sump. The median capacities of the pumps and heat exchanger are each 2.98 g, but are located in the auxiliary building, which contributes the controlling fragility (Am = 1.91 g, r = 0.23, u = 0.29).
Condenser Steam Dump System (as part of SAMG action)
The main condenser and its components can be considered rugged, as can most valves such as the steam dump valves and associated piping, based on information provided by the reference plant. However, portions of the steam dump system are located in the auxiliary building, so it contributes the controlling fragility (Am = 1.91 g, r = 0.23, u = 0.29).
A-19 Manual Operation of ARVs Manual operation of the ARVs relies on the ARVs themselves, the 480V motor control centers, and access to the auxiliary building, all of which have similar fragilities. Since failure of any one of these components makes the action impossible, a min-cut upper bound (MCUB) calculation is used to determine the combined failure probability. The fragilities of the relevant components are:
ARVs:
Am = 1.92 g, r = 0.32, u = 0.32 Aux building: Am = 1.91 g, r = 0.23, u = 0.29 480V MCCs: Am = 1.87 g, r = 0.32, u = 0.32 or Am = 2.64 g, r = 0.32, u = 0.32 Note that this value for the motor control centers is for independent failure. For correlated failure of both 480V MCCs (11805S3ABB and 11805S3BBB) the median capacity should change to 2.64g. Steam generators 1 and 4 use ABB, while 2 and 3 use BBB. Therefore, manual operation of the ARVs on a particular steam generator (such as in SCG-1) should use the independent failure capacity for a single 480V MCC, while actions to depressurize the secondary side (such as SAG-1) should use the higher correlated failure capacity.
Main Control Room and TSC Ventilation and Filtering System Relevant MCR/TSC ventilation system components include motor-operated valves for the control room HVAC filter exhaust, HVAC filter return fan inlet, and HVAC supply fan inlet, as well as chilled water pumps. For the MOVs, Am = 1.82 g, r = 0.32 g, u = 0.32 g. For the chilled water pumps, Am = 1.66 g, r = 0.23 g, and u = 0.16 g. Although the median capacity of the pumps is substantially lower, the greater uncertainty about the MOVs gives them a higher failure probability under all but the highest accelerations (>1.45 g)14. Because of their apparent similarity and co-location we consider the MOV failures to be perfectly correlated. However, the failure of the MOVs is treated as independent of the chilled water pumps. An MCUB calculation is used to combine the failure probabilities.
Valves Used in Accident Management Valves considered in this category include safety valves, relief valves, PORVs, check valves, and manual valves. The valves addressed in by the reference plant PRA have been shown to be rugged based on expert judgment during the SPRA walkdown. Check and manual valves are inherently rugged, and other valves have been shown to be of high capacity when the valve is not required to change position (and is thus considered part of the piping). For this analysis, rugged is taken to mean median capacity Am = 2.5 g, r = 0.32, u = 0.32.
14 The value of 1.45g cited here is obtained by calculating the continuous failure probabilities for each of the relevant sets of fragility assignments, and determining where they cross (i.e., where one begins to produce higher values than the other).
A-20 A.3 Wind Impacts A wind walkdown and fragility report performed on behalf of the NRC staff provided failure probabilities for various components at a range of wind speeds. These include tornado and non-tornado wind pressure failures, as well as wind missile failures (which apply to both tornado and non-tornado winds). Table A-7 shows which Level 2 PRA SSCs have wind fragility information and where that information is included in the model. Of those systems that have fragility information, most are already modeled in the Level 1 PRA, and the existing fault trees can be used in modeling the appropriate Level 2 PRA actions for the turbine building, condensate system, condenser steam dump, and atmospheric relief valves.
Table A-7 Wind Fragility Availability for Level 2 PRA SSCs System Fragility Information Fault Tree Containment Isolation No Containment cooling No Containment sprays No TD-AFW Missile only Not modeled b/c highest failure probability is just 6.0E-3 RWST refill No B5B pump For warehouse (see below) 1-L2-FT-B5B-HW (new)
Condensate system Yes 1-MSS-CDS-HW (from L1)
MD-AFW No Steam dump Yes 1-MSS-STMDUMP-HW (from L1)
ARVs Yes 1-MSS-ADVS-HW (from L1) 480V MCCs No Turbine building Yes 1-TURB-BLDG-HW Auxiliary building No Firewater storage tank No MCR/TSC ventilation No Only the B5B pump warehouse requires a new fault tree, with additional basic events not present in the Level 1 PRA. Wind pressure failure probabilities are given for the warehouse roof, walls, and frame; the probabilities for the roof are by far the highest, so we ignore the walls and frame. The mean failure probabilities determined for the warehouse are shown in Table A-8.
Table A-8 Wind Failure Probability Data For B5b Pump Warehouse Wind Speed (mph)
Wind Missile Tornado Wind Pressure (Roof)
Non-Tornado Wind Pressure (Roof) 79 2.52E-04 0
0 91.5 6.48E-04 4.08E-05 2.38E-07 105 1.84E-03 6.77E-03 1.51E-03 119 5.20E-03 5.48E-02 1.38E-02
A-21 133.5 1.60E-02 2.19E-01 6.11E-02 149 3.44E-02 5.19E-01 2.07E-01 167 7.79E-02 8.21E-01 4.36E-01 191.5 1.08E-01 9.80E-01 7.08E-01 233 1.66E-01 1.00E+00 9.52E-01 289 2.03E-01 1.00E+00 1.00E+00 Since the wind speeds given in Table A-8 do not match the wind speed bins used for the high wind and tornado initiators, linear interpolation is used, following the same methods used in Level 1 PRA (NRC, 2023c), to assign failure probabilities to the new basic events. The missile failure probabilities are applied to both tornado and non-tornado winds. The resulting basic event probabilities are listed in Table A-9, for non-tornado (HWD) and tornado (TOR) initiators.
Table A-9 Wind Failure Basic Event Probabilities for B5b Pump Wind Initiator Bin Wind Speed (mph)
Missile Failure Probability Wind Pressure Failure Probability HWD 1 103 1.66E-03 1.29E-03 HWD 2 120 5.94E-03 1.71E-02 HWD 3 143 2.73E-02 1.51E-01 HWD 4 172 8.40E-02 4.92E-01 TOR 1 98 1.22E-03 3.28E-03 TOR 2 120 8.18E-03 6.61E-02 TOR 3 150 3.68E-02 5.36E-01 TOR 4 182 9.63E-02 9.18E-01
B-1 APPENDIX B DETAILED UNCERTAINTY CALCULATIONS B.1 New Basic Event Uncertainty Distributions Events Specific to Fire Most of the basic events used in the Level 2 PRA fire model come from the Level 2 PRA model for internal events and floods, and the basis for the uncertainty distributions of those events is described in Section C.2 of that report (NRC, 2022a). Of the basic events used in the internal fires release category cutsets, Table B-1 lists those which could reasonably be assigned an uncertainty distribution but did not have an uncertainty distribution assigned in the internal event model. Table B-1 does not include basic events with probability 1.0 or 0.0 (not considered random variablesmost fire basic events are in this category), compound basic events (which have uncertainty distributions calculated by SAPHIRE), and basic events that represent a fraction (such as the probability that a break occurred in a particular loopSAPHIRE does not provide a way to make the fractions sum to 1.0 in its Monte Carlo samples).
Table B-10 Basic Events Used in the Level 2 Fire PRA Model that Lacked Uncertainty Distributions Basic Event Name Point Estimate Distribution Assigned Error Factor 1
1-CONSQ-SGTR-SSB 0.5 2
1-NO-UET2-NOPORV-BLK 0.89 3
1-NSCW-CT-NEED-SWAP 0.29 4
1-NSCW-CT-NO-NEED-SWAP 0.71 5
1-NSCW-MOV-F-NON-RECBLE 0.12 6
1-NSCW-MOV-F-RECBLE 0.88 7
1-NSCWCT-SPRAY 0.904 8
1-OA-XFER-NON1EH-LT-FIRE 2.7E-3 lognormal 5
9 1-RPS-XHE-XE-NSGNL-FIRE 0.23 lognormal 5
10 1-UET2-NOPORV-BLK 0.11 Of the 10 events in Table B-1, eight are also used in the Level 2 PRA model for internal events.
To maintain consistency with that model, uncertainty distributions have not been assigned to those basic events. The two events specific to the fire model, both Human Error Probabilities (HEPs), were assigned lognormal distributions with error factors determined by Section 19.4.1 of (NRC, 2023a).
Events Specific to Seismic Seismic failures were assigned lognormal uncertainty distributions in the same manner as other basic events, except for the 1-BE-CISOL-, 1-BE-CONTCOOL-, and 1-BE-CONTSPRAY-events, which do not represent model parameters. Instead, these basic events are placeholders for the containment systems fault trees used in the bridge tree. For the point estimates of RCF,
B-2 the various failure probabilities of these fault trees were calculated in advance, by solving the fault trees for each seismic bin. A basic event was created for each such failure probability and placed into the cutsets using postprocessing rules prior to quantification (substituting for the fault tree success event that appears in the cutset when the W process flag is applied). These basic events and their uncertainty information are provided in Table B-2.
For uncertainty analysis, ideally the fault tree failure probabilities would be calculated separately for each Monte Carlo sample; however, SAPHIRE cannot perform the fault tree quantification after post-processing rules have been applied at the end of the initial solve. No SAPHIRE uncertainty distribution is assigned to these events in the base model.
Table B-11 Assignment of Uncertainty to Basic Events Used in the Level 2 Seismic PRA Model Event Description Failure Probability Uncertainty Distribution Distribution Parameter 1-BE-CISOL-EQ5-1 Failure probability of 1-FT-CISOL-F in EQK bin 5 given success of 1-STRC-CD-EQ5 6.446E-02 None 1-BE-CISOL-EQ5-2 Failure probability of 1-FT-CISOL-F in EQK bin 5 given failure of 1-STRC-CD-EQ5 6.523E-02 None 1-BE-CISOL-EQ6-1 Failure probability of 1-FT-CISOL-F in EQK bin 6 given success of 1-STRC-CD-EQ6 1.883E-01 None 1-BE-CISOL-EQ6-2 Failure probability of 1-FT-CISOL-F in EQK bin 6 given failure of 1-STRC-CD-EQ6 1.952E-01 None 1-BE-CISOL-EQ7-1 Failure probability of 1-FT-CISOL-F in EQK bin 7 given success of 1-STRC-CD-EQ7 5.471E-01 None 1-BE-CISOL-EQ7-2 Failure probability of 1-FT-CISOL-F in EQK bin 7 given failure of 1-STRC-CD-EQ7 6.007E-01 None 1-BE-CONTCOOL-EQ4 Failure probability for 1-FT-CONTCOOL-F in seismic bin 4 given success of CISOL 1.809E-01 None 1-BE-CONTCOOL-EQ5 Failure probability for 1-FT-CONTCOOL-F in seismic bin 5 given success of CISOL 4.006E-01 None 1-BE-CONTCOOL-EQ6 Failure probability for 1-FT-CONTCOOL-F in seismic bin 6 given success of CISOL 7.662E-01 None 1-BE-CONTCOOL-EQ7 Failure probability for 1-FT-CONTCOOL-F in seismic bin 7 given success of CISOL 9.951E-01 None 1-BE-CONTSPRAY-EQ4-1 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 4 given success of CISOL 2.766E-02 None
B-3 Event Description Failure Probability Uncertainty Distribution Distribution Parameter 1-BE-CONTSPRAY-EQ4-2 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 4 given failure of CISOL 1.600E-01 None 1-BE-CONTSPRAY-EQ5-1 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 5 given success of CISOL 7.814E-02 None 1-BE-CONTSPRAY-EQ5-2 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 5 given failure of CISOL 3.145E-01 None 1-BE-CONTSPRAY-EQ6-1 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 6 given success of CISOL 1.993E-01 None 1-BE-CONTSPRAY-EQ6-2 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 6 given failure of CISOL 7.018E-01 None 1-BE-CONTSPRAY-EQ7-1 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 7 given success of CISOL 5.230E-01 None 1-BE-CONTSPRAY-EQ7-2 Failure prob. For 1-FT-CONTSPRAY-F in seismic bin 7 given failure of CISOL 9.918E-01 None 1-CCU-SYS-EQ1-CUNIT CCU System Failure from Seismic Event Bin 1 1.01E-06 Lognormal 1.50 1-CCU-SYS-EQ2-CUNIT CCU System Failure from Seismic Event Bin 2 1.52E-03 Lognormal 3.63 1-CCU-SYS-EQ3-CUNIT CCU System Failure from Seismic Event Bin 3 2.16E-02 Lognormal 5.20 1-CCU-SYS-EQ4-CUNIT CCU System Failure from Seismic Event Bin 4 8.54E-02 Lognormal 4.49 1-CCU-SYS-EQ5-CUNIT CCU System Failure from Seismic Event Bin 5 1.93E-01 Lognormal 3.42 1-CCU-SYS-EQ6-CUNIT CCU System Failure from Seismic Event Bin 6 3.82E-01 Lognormal 2.32 1-CCU-SYS-EQ7-CUNIT CCU System Failure from Seismic Event Bin 7 7.30E-01 Lognormal 1.36 1-CSR-SYS-EQ1 Containment spray failure due to EQ event bin 1 6.43E-08 Lognormal 1.50 1-CSR-SYS-EQ2 Containment spray failure due to EQ event bin 2 2.30E-04 Lognormal 2.04 1-CSR-SYS-EQ3 Containment spray failure due to EQ event bin 3 5.14E-03 Lognormal 4.59 1-CSR-SYS-EQ4 Containment spray failure due to EQ event bin 4 2.76E-02 Lognormal 5.18 1-CSR-SYS-EQ5 Containment spray failure due to EQ event bin 5 7.81E-02 Lognormal 4.60
B-4 Event Description Failure Probability Uncertainty Distribution Distribution Parameter 1-CSR-SYS-EQ6 Containment spray failure due to EQ event bin 6 1.97E-01 Lognormal 3.40 1-CSR-SYS-EQ7 Containment spray failure due to EQ event bin 7 5.21E-01 Lognormal 1.84 1-CIS-SYS-EQ1-ISO Containment isolation failure due to EQ event bin 1 2.73E-09 Lognormal 1.50 1-CIS-SYS-EQ2-ISO Containment isolation failure due to EQ event bin 2 5.89E-05 Lognormal 1.50 1-CIS-SYS-EQ3-ISO Containment isolation failure due to EQ event bin 3 2.50E-03 Lognormal 2.82 1-CIS-SYS-EQ4-ISO Containment isolation failure due to EQ event bin 4 1.86E-02 Lognormal 5.40 1-CIS-SYS-EQ5-ISO Containment isolation failure due to EQ event bin 5 6.33E-02 Lognormal 5.58 1-CIS-SYS-EQ6-ISO Containment isolation failure due to EQ event bin 6 1.85E-01 Lognormal 4.02 1-CIS-SYS-EQ7-ISO Containment isolation failure due to EQ event bin 7 5.45E-01 Lognormal 1.82 1-L2-480VMCC-ABB-EQ4 Seismic failure of 480V motor control center ABB in bin 4 2.91E-02 Lognormal 5.00 1-L2-480VMCC-ABB-EQ5 Seismic failure of 480V motor control center ABB in bin 5 8.16E-02 Lognormal 5.00 1-L2-480VMCC-ABB-EQ6 Seismic failure of 480V motor control center ABB in bin 6 2.03E-01 Lognormal 5.00 1-L2-480VMCC-ABB-EQ7 Seismic failure of 480V motor control center ABB in bin 7 5.31E-01 Lognormal 2.05 Events Specific to Wind Table B-3 lists the basic events added for the Level 2 PRA model for high winds, and their associated uncertainty distributions. They were assigned uncertainty distributions based on the 5th and 95th percentile values estimated in the original wind walkdown. Lognormal approximations were used where possible, and beta distributions were used if a lognormal distribution placed too much probability mass on values greater than 1.0.
Table B-12 Assignment of Uncertainty to Basic Events Used in the Level 2 High Wind PRA Model Basic Event Description Point Estimate 5th 95th Uncertainty Distribution EF or Beta 1-L2-B5B-WP-TOR1 B5B unavailable due to tornado wind pressure bin 1 3.28E-3 0
2.22E-02 Beta 152
B-5 Basic Event Description Point Estimate 5th 95th Uncertainty Distribution EF or Beta 1-L2-B5B-WP-TOR2 B5B unavailable due to tornado wind pressure bin 2 6.61E-2 9.85E-04 3.26E-01 Beta 7.06 1-L2-B5B-WP-TOR3 B5B unavailable due to tornado wind pressure bin 3 5.26E-1 1.68E-01 9.09E-01 Beta 0.45 1-L2-B5B-WP-TOR4 B5B unavailable due to tornado wind pressure bin 4 9.18E-1 7.43E-01 9.97E-01 Beta 0.04 1-L2-B5B-WM-TOR1 B5B unavailable due to tornado wind missile bin 1 7.30E-4 0
1.01E-03 Beta 687 1-L2-B5B-WM-TOR2 B5B unavailable due to tornado wind missile bin 2 2.68E-2 2.87E-05 1.37E-01 Beta 18.1 1-L2-B5B-WM-TOR3 B5B unavailable due to tornado wind missile bin 3 2.20E-1 1.37E-02 5.33E-01 Beta 1.8 1-L2-B5B-WM-TOR4 B5B unavailable due to tornado wind missile bin 4 6.02E-1 3.15E-01 8.68E-01 Beta 0.33 1-L2-B5B-WP-HWD1 B5B unavailable due to non-tornado wind pressure bin 1 1.66E-3 1.52E-04 9.14E-03 Lognormal 7.76 1-L2-B5B-WP-HWD2 B5B unavailable due to non-tornado wind pressure bin 1 5.94E-3 5.45E-04 3.26E-02 Lognormal 7.74 1-L2-B5B-WP-HWD3 B5B unavailable due to non-tornado wind pressure bin 1 1.50E-1 3.82E-03 4.05E-01 Beta 2.82 1-L2-B5B-WP-HWD4 B5B unavailable due to non-tornado wind pressure bin 1 4.91E-1 2.00E-01 7.87E-01 Beta 0.52 1-L2-B5B-WM-HWD1 B5B unavailable due to non-tornado wind missile bin 1 1.66E-3 1.52E-04 9.14E-03 Lognormal 7.76 1-L2-B5B-WM-HWD2 B5B unavailable due to non-tornado wind missile bin 1 1.71E-2 7.17E-06 1.12E-01 Beta 28.8 1-L2-B5B-WM-HWD3 B5B unavailable due to non-tornado wind missile bin 1 2.73E-2 2.51E-03 1.49E-01 Lognormal 7.71 1-L2-B5B-WM-HWD4 B5B unavailable due to non-tornado wind missile bin 1 8.40E-2 7.72E-03 4.61E-01 Lognormal 7.73 B.2 Tabular Parameter Uncertainties The uncertainty results for all releases categories are listed in Table B-4, Table B-5, and Table B-6 for internal fires, seismic events, and high winds, respectively.
B-6 Table B-13 Tabular Results of Release Category Uncertainty Analysis: Internal Fires Category Point Estimate Samples Mean Median 5th 95th Std. Dev.
(%)
95th/5th Fire CDF 6.14E-05 15000 6.13E-05 5.45E-05 2.96E-05 1.10E-04 58 3.7 All RCs 6.88E-05 5000 6.78E-05 5.94E-05 3.19E-05 1.26E-04 62 3.9 BMT 3.70E-06 5000 3.54E-06 2.21E-07 1.56E-08 1.82E-05 217 1167 CIF 4.05E-07 5000 3.91E-07 2.59E-07 4.80E-08 1.14E-06 105 24 CIF-SC 7.65E-08 5000 7.95E-08 3.18E-08 2.63E-09 3.07E-07 203 117 ECF 7.54E-09 5000 6.93E-09 2.39E-09 2.43E-10 2.46E-08 282 101 ICF-BURN 1.64E-05 5000 1.57E-05 1.29E-05 1.54E-06 3.76E-05 93 24 ICF-BURN-SC 2.71E-06 5000 2.49E-06 1.32E-06 6.46E-09 8.60E-06 138 1331 ISGTR 5.51E-07 5000 5.19E-07 2.81E-07 4.75E-08 1.68E-06 155 35 LCF 2.13E-05 5000 2.00E-05 1.70E-05 7.29E-06 4.14E-05 69 5.7 LCF-SC 2.13E-06 5000 2.09E-06 1.46E-07 4.29E-08 6.15E-06 117 143 NOCF 2.13E-05 5000 2.28E-05 1.98E-05 7.93E-06 4.66E-05 66 5.9 SGTR-C 0
0 0
0 0
0 SGTR-O 3.87E-08 5000 4.56E-08 2.23E-08 3.45E-09 1.53E-07 228 44 SGTR-O-SC 1.83E-07 5000 1.87E-07 1.30E-07 3.54E-08 5.17E-07 110 15 V
0 0
0 0
0 0
V-F 0
0 0
0 0
0 V-F-SC 0
0 0
0 0
0
B-7 Table B-14 Tabular Results of Release Category Uncertainty Analysis: Seismic Events Category Point Estimate Samples Mean Median 5th 95th Std. Dev.
(%)
95th/5th Seismic CDF 1.08E-05 15,000 1.07E-05 8.00E-06 2.85E-06 2.71E-05 99 9.5 All RCs 1.49E-05 5000 1.39E-05 1.04E-05 3.67E-06 3.54E-05 93 9.6 BMT 1.57E-07 5000 1.38E-07 8.02E-09 4.11E-10 6.27E-07 412 1526 CIF 1.16E-06 5000 9.47E-07 4.05E-07 5.33E-08 3.34E-06 177 63 CIF-SC 3.1E-08 5000 3.28E-08 5.04E-09 1.30E-10 1.31E-07 448 1010 ECF 2.21E-09 5000 1.92E-09 6.45E-10 5.56E-11 7.26E-09 220 131 ICF-BURN 2.82E-06 5000 2.58E-06 1.66E-06 2.23E-07 7.84E-06 119 35 ICF-BURN-SC 2.92E-08 5000 2.87E-08 1.48E-09 2.13E-14 1.14E-07 524 5E6 ISGTR 2.35E-07 5000 2.21E-07 1.02E-07 1.46E-08 7.80E-07 189 54 LCF 7.49E-06 5000 7.12E-06 5.24E-06 1.67E-06 1.85E-05 87 11 LCF-SC 8.11E-08 5000 7.63E-08 1.81E-08 3.56E-10 2.91E-07 291 819 NOCF 2.61E-06 5000 2.72E-06 1.87E-06 5.02E-07 7.49E-06 115 15 SGTR-C 0
0 0
0 0
0 SGTR-O 6.38E-08 5000 6.84E-04 1.36E-08 7.62E-10 2.53E-07 666 332 SGTR-O-SC 1.72E-07 5000 1.72E-07 4.37E-08 4.06E-09 6.50E-07 402 160 V
0 0
0 0
0 0
V-F 2.32E-09 5000 2.35E-09 1.43E-09 2.93E-10 7.25E-09 155 25 V-F-SC 0
0 0
0 0
0
B-8 Table B-15 Tabular Results of Release Category Uncertainty Analysis: Wind Events Category Point Estimate Samples Mean Median 5th 95th Std. Dev.
(%)
95th/5th Wind CDF 1.38E-05 1.22E-05 8.84E-06 2.55E-06 3.35E-05 13 All RCs 1.67E-05 5000 1.48E-05 9.54E-06 2.00E-06 4.38E-05 22 BMT 8.44E-08 3216 5.83E-08 2.38E-09 6.23E-11 2.83E-07 272 4547 CIF 1.46E-08 3440 1.28E-08 3.54E-09 3.23E-10 4.85E-08 303 150 CIF-SC 0
0 0
0 0
0 ECF 9.58E-10 4425 8.61E-10 1.91E-10 1.40E-11 2.88E-09 392 205 ICF-BURN 1.97E-06 3013 1.81E-06 9.07E-07 5.44E-08 6.29E-06 147 116 ICF-BURN-SC 2.88E-07 3082 2.51E-07 8.32E-08 8.50E-12 9.28E-07 276 109090 ISGTR 1.64E-07 3317 1.54E-07 6.30E-08 7.08E-09 5.52E-07 266 78 LCF 7.78E-06 3085 6.46E-06 4.32E-06 9.95E-07 1.80E-05 93 18 LCF-SC 6.96E-08 5000 6.38E-08 9.84E-09 1.15E-10 2.66E-07 306 2323 NOCF 6.34E-06 2978 6.03E-06 4.15E-06 9.47E-07 1.75E-05 101 18 SGTR-C 0
0 0
0 0
0 SGTR-O 4.17E-11 5000 3.91E-11 1.72E-11 2.19E-12 1.33E-10 248 60 SGTR-O-SC 3.71E-10 5000 3.38E-10 1.67E-10 2.18E-11 1.16E-09 148 53 V
0 0
0 0
0 0
V-F 0
0 0
0 0
0 V-F-SC 0
0 0
0 0
0
B-9 B.3 Selected Sensitivity Analyses Increased Post-Core Damage HEPs With the exception of manual extension of TDAFW (where the HEP has been increased to 1.0 for high seismic bins), HEPs for Level 2 PRA operator actions are assumed to be the same for external hazards as for internal events. This assumption is valid if the hazard that caused the accident is over, and the lingering effects of that hazard on human reliability are smaller than the effects of the severe accident condition itself. Although both of these seem likely, it is possible both that the external hazard might persist (aftershocks, extended hurricane conditions) or that the effects of the hazard could be significant after it ends (particularly for large-scale seismic events).
To investigate the sensitivity of the RC frequencies to post-core damage HEPs, all Level 2 PRA operator action failure probabilities were increased by a factor of 3 (unless that would put them above 1.0, in which case they were set to 1.0). Table B-7 shows the new values for the modified basic events.
Table B-16 Increased HEPs for Level 2 Operator Actions Basic Event Description Original Failure Prob.
New Failure Prob.
1-L2-OP-SAG1 Operator Fails to Carry Out SAG-1 (Open 2 ARVs and Feed SGs) 0.4 1.0 1-L2-OP-SAG2-1 Operator Fails to Carry Out SAG-2 (Open all ARVs
- Not Depress) 0.07 0.21 1-L2-OP-SCG1-1 Operator Fails to Carry Out SCG-1 (Spray Containment w/ Firewater) 0.60 1.0 1-L2-Op-SCG1-2 Operator Fails to Carry Out SCG-1 (F&B SGs) 0.1 0.3 1-L2-Op-SCG1-3 Operator Fails to Carry Out SCG-1 (F&B SGs -
Late) 0.5 1.0 1-L2-Op-SCG1-4 Operator Fails to Carry Out SCG-1 (Spray Containment w/ Cont. Spray System) 0.1 0.3 The edited cutsets were quantified, and the results are shown in Table B-8 and Table B-9 for internal fires and seismic events, respectively. Increasing these HEPs causes a modest increase in CCFP (about 7 percent for fire and 2 percent for seismic) and a major reduction in scrubbing for certain releases. All LCF-SC frequency is eliminated for all hazards (because scrubbing a late overpressure release requires success of SCG1-1). SGTR-O-SC is reduced by 22 percent for all hazards as well, leading to big increases in SGTR-O frequency. Frequency of basemat melt-through increases because most of the top BMT cutsets contain 1-L2-OP-SAG1, since it prevents in-vessel recovery. The wind results are omitted because this sensitivity analysis used an obsolete version of the wind PRA model. However, it is expected that the results for wind would be comparable to those for seismic and fire.
B-10 Table B-17 Fire Release Category Frequencies with Increased Level 2 PRA HEPs Base Case HEPs Increased Change BMT 3.703E-06 4.508E-06 22%
CIF 4.048E-07 4.139E-07 2%
CIF-SC 7.650E-08 6.498E-08
-15%
ECF 7.544E-09 8.338E-09 11%
ICF-BURN 1.637E-05 2.001E-05 22%
ICF-BURN-SC 2.714E-06 2.062E-06
-24%
ISGTR 5.510E-07 7.383E-07 34%
LCF 2.131E-05 2.397E-05 12%
LCF-SC 2.132E-06 0.000E+00
-100%
NOCF 2.130E-05 1.652E-05
-22%
SGTR-C 0.000E+00 0.000E+00 0%
SGTR-O 3.870E-08 7.727E-08 100%
SGTR-O-SC 1.831E-07 1.424E-07
-22%
V-F 0.000E+00 0.000E+00 0%
Total 6.879E-05 6.85E-05 1%
CCFP 69%
76%
7%
Table B-18 Seismic Release Category Frequencies with Increased Level 2 PRA HEPs Base Case HEPs Increased Change BMT 1.310E-07 1.696E-07 29%
CIF 1.150E-06 1.180E-06 3%
CIF-SC 3.104E-08 2.638E-08
-15%
ECF 2.212E-09 2.207E-09 0%
ICF-BURN 2.712E-06 2.948E-06 9%
ICF-BURN-SC 2.713E-08 0.000E+00
-100%
ISGTR 2.271E-07 2.385E-07 5%
LCF 7.456E-06 7.641E-06 2%
LCF-SC 7.524E-08 0.000E+00
-100%
NOCF 2.746E-06 2.552E-06
-7%
SGTR-C 0.000E+00 0.000E+00 0%
SGTR-O 6.378E-08 1.109E-07 74%
SGTR-O-SC 1.722E-07 1.341E-07
-22%
V-F 2.320E-09 2.320E-09 0%
Total 1.48E-05 1.50E-05 1%
CCFP 81%
83%
2%
B-11 SCUBE Seismic Quantification SCUBE (SAPHIRE Cut Set Upper Bound Estimator) is a recent enhancement that makes it possible to combine MCUB and BDD quantification in a compromise solution. It divides the cut sets at a frequency cutoff specified by the user. The high-frequency cut sets are quantified with BDD, and the low-frequency cut sets with MCUB. Then it combines the two to get a total that is normally between the BDD and MCUB values. SCUBE can be used to estimate the impact of inflation on the entire seismic model by setting BDD to quantify the major cutsets representing a large fraction of each release category. Table B-10 shows the combined BDD and MCUB probability from SCUBE for the seismic release category frequencies. For most release categories, the cutsets making up the top 95 percent are quantified with BDD, and the remaining 5 percent with MCUB. For two of the end states with large numbers of cut sets (ICF-BURN and NOCF) 95 percent BDD was not successful, so they were quantified with 90 percent BDD instead. The difference is likely small enough that it does not mask any important insights in comparison with other release categories.
Table B-19 Seismic Release Category Frequencies with SCUBE Base Case SCUBE with 90-95% BDD Change BMT 1.310E-07 1.01E-07
-23%
CIF 1.150E-06 9.12E-07
-21%
CIF-SC 3.104E-08 1.99E-08
-36%
ECF 2.212E-09 1.43E-09
-35%
ICF-BURN 2.712E-06 2.23E-06 (90%)
-18%
ICF-BURN-SC 2.713E-08 1.95E-08
-28%
ISGTR 2.271E-07 1.42E-07
-37%
LCF 7.456E-06 6.51E-06
-13%
LCF-SC 7.524E-08 5.35E-08
-29%
NOCF 2.746E-06 2.21E-06 (90%)
-19%
SGTR-C 0.000E+00 0.000E+00 0%
SGTR-O 6.378E-08 3.6E-08
-44%
SGTR-O-SC 1.722E-07 1.2E-07
-30%
V-F 2.320E-09 2.32E-09 0%
Total 1.48E-05 1.24E-05
-17%
CCFP 81%
82%
The apparent inflation here is spread fairly evenly across release categories. The greatest differences are in LERF categoriesECF, ISGTR, and SGTR-Obut even LCF (the least-affected release category) is reduced by 13 percent when using SCUBE.
Even with this 90/95 percent BDD quantification, the release frequency is still inflated by 15 percent compared with seismic CDF (1.2410-5/rcy versus 1.0810-5/rcy).
NUREG-XXXX Erick Ball Division of Risk Analysis Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Alan Kuritzky, NRC Level 3 PRA Project Program Manager Same as above The U.S. Nuclear Regulatory Commission performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The scope of the L3PRA project encompasses all major radiological sources on the site (i.e., reactors, spent fuel pools, and dry cask storage), all internal and external hazards, and all modes of plant operation. A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources. This report, one of a series of reports documenting the models and analyses supporting the L3PRA project, specifically addresses the reactor, at-power, Level 2 PRA model for internal fires, seismic events, and wind events, for a single unit. The analyses documented herein are based information for the reference plant as it was designed and operated as of 2012 and do not reflect the plant as it is currently designed, licensed, operated, or maintained.
PRA Internal fires Level 2 PRA Seismic events Severe accident analysis High winds Large early release frequency Plant damage states Large release frequency Release categories LERF Source terms Risk Level 3 PRA project L3PRA project Month 20xx Technical U.S. NRC Level 3 Probabilistic Risk Assessment Project Volume 4d: Reactor, At-Power, Level 2 PRA for Internal Fires, Seismic Events, and High Winds
NUREG-XXXX U.S. NRC Level 3 Probabilistic Risk Assessment Project Month20xx