NUREG-2254, Summary of the Uncertainty Analyses for the State-of-the-Art Reactor Consequence Analyses Project

NUREG-2254, Summary of the Uncertainty Analyses for the State-of-the-Art Reactor Consequence Analyses Project

ML22193A244
Person / Time
Issue date:	10/31/2022
From:	Bixler N, Brooks D, Dennis M, Hossein Esmaili, Faucett C, Gauntt R, Ghosh S, Salman Haq, Haskin T, Hathaway A, Mattie P, Osborn D, Ross K, Katie Wagner Office of Nuclear Regulatory Research, Sandia
To:
Dickey K
References
NUREG-2254
Download: ML22193A244 (121)

Text

NUREG-2254 Summary of the Uncertainty Analyses for the State-of-the-Art Reactor Consequence Analyses Project Office of Nuclear Regulatory Research

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material As of November 1999, you may electronically access NUREG-series publications and other NRC records at the NRCs Library at www.nrc.gov/reading-rm.html. Publicly released records include, to name a few, NUREG-series publications; Federal Register notices; applicant, licensee, and vendor documents and correspondence; NRC correspondence and internal memoranda; bulletins and information notices; inspection and investigative reports; licensee event reports; and Commission papers and their attachments.

NRC publications in the NUREG series, NRC regulations, and Title 10, Energy, in the Code of Federal Regulations may also be purchased from one of these two sources:



1. The Superintendent of Documents U.S. Government Publishing Office Washington, DC 20402-0001 Internet: www.bookstore.gpo.gov Telephone: (202) 512-1800 Fax: (202) 512-2104

2. The National Technical Information Service 5301 Shawnee Road Alexandria, VA 22312-0002 Internet: www.ntis.gov 1-800-553-6847 or, locally, (703) 605-6000

Office of Administration Digital Communications and Administrative Services Branch Washington, DC 20555-0001 E-mail: distribution.resource@nrc.gov Facsimile: (301) 415-2289 Some publications in the NUREG series that are posted at the NRCs Web site address www.nrc.gov/reading-rm/

doc-collections/nuregs are updated periodically and may differ from the last printed version. Although references to material found on a Web site bear the date the material was accessed, the material available on the date cited may subsequently be removed from the site.

Non-NRC Reference Material Documents available from public and special technical libraries include all open literature items, such as books, journal articles, transactions, Federal Register notices, Federal and State legislation, and congressional reports.

Such documents as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings may be purchased from their sponsoring organization.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at The NRC Technical Library Two White Flint North 11545 Rockville Pike Rockville, MD 20852-2738 These standards are available in the library for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from American National Standards Institute 11 West 42nd Street New York, NY 10036-8002 Internet: www.ansi.org (212) 642-4900 Legally binding regulatory requirements are stated only in laws; NRC regulations; licenses, including technical specifications; or orders, not in NUREG-series publications.

The views expressed in contractor prepared publications in this series are not necessarily those of the NRC.

The NUREG series comprises (1) technical and administrative reports and books prepared by the staff (NUREG-XXXX) or agency contractors (NUREG/CR-XXXX),

(2) proceedings of conferences (NUREG/CP-XXXX),

(3) reports resulting from international agreements (NUREG/IA-XXXX),(4) brochures (NUREG/BR-XXXX), and (5) compilations of legal decisions and orders of the Commission and the Atomic and Safety Licensing Boards and of Directors decisions under Section 2.206 of the NRCs regulations (NUREG-0750).

DISCLAIMER: This report was prepared as an account of work sponsored by an agency of the U.S. Government.

Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for any third partys use, or the results of such use, of any information, apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

NUREG-2254 Summary of the Uncertainty Analyses for the State-of-the-Art Reactor Consequence Analyses Project Office of Nuclear Regulatory Research Manuscript Completed: March 2022 Date Published: October 2022 Prepared by:

S.T. Ghosh*, N.E. Bixler**, D. Brooks**, M.L. Dennis**,

H. Esmaili*, C. Faucett**, R.O. Gauntt**, S. Haq*, T. Haskin**,

A.G. Hathaway*, P.D. Mattie**, D. Osborn**, K.W. Ross**,

K.C. Wagner**

U.S. Nuclear Regulatory Commission Sandia National Laboratories S.Tina Ghosh, NRC Project Manager P.O. Box 5800 Albuquerque, NM 87185

iii ABSTRACT The U.S. Nuclear Regulatory Commission, with the assistance of Sandia National Laboratories, conducted three uncertainty analyses (UAs) from 2010 through 2019 as part of the State-of-the-Art Reactor Consequence Analyses (SOARCA) studies. The SOARCA project was initiated to leverage decades worth of research into severe accidents and apply modern analytical tools and techniques to develop a body of knowledge about the realistic consequences of severe nuclear reactor accidents. The original study focused on providing a best estimate evaluation for select scenarios. The SOARCA UAs extended this work to include an integrated evaluation and propagation of uncertainty through detailed accident progression, radiological release, and offsite health consequence modeling using the MELCOR and MACCS codes. As such, the first of the three UAs was a first-of-a-kind analysis. This report presents important results and insights as well as the methodology and scope of the three SOARCA UAs, including the UA results often of most interest in severe accident consequence and risk studies (i.e., cesium and iodine releases and offsite latent cancer fatality risk). This report also presents key insights into input variables and associated phenomena that most influenced variations in source term and offsite health consequences, as well as other observations on UA methodology.

v TABLE OF CONTENTS ABSTRACT............................................................................................................................... iii LIST OF FIGURES................................................................................................................... vii LIST OF TABLES...................................................................................................................... xi ABBREVIATIONS AND ACRONYMS..................................................................................... xiii 1 INTRODUCTION.................................................................................................................1-1 2 METHODOLOGY AND SCOPE..........................................................................................2-1 2.1 Computer Codes..........................................................................................................2-1 2.2 Scope...........................................................................................................................2-1 2.3 Monte Carlo Process....................................................................................................2-3 2.4 Notable Assumptions....................................................................................................2-5 3 UNCERTAIN PARAMETER SELECTION...........................................................................3-1 4

SUMMARY

OF RESULTS..................................................................................................4-1 4.1 Source TermRadionuclide Release to the Environment............................................4-1 4.2 Offsite Health Consequences.......................................................................................4-5 5 ACCIDENT PROGRESSION AND SOURCE TERM INSIGHTS.........................................5-1 5.1 Time in the Fuel Cycle..................................................................................................5-1 5.1.1 Pressurized-Water Reactor Uncertainty Analyses..........................................5-1 5.1.2 Implications for Other Plants...........................................................................5-8 5.2 Safety Valve Failures....................................................................................................5-9 5.2.1 Safety Valve Failure-to-Close Modeling Insights........................................... 5-10 5.2.2 Peach Bottom Boiling-Water Reactor Analysis Insights................................ 5-12 5.2.3 Surry and Sequoyah Pressurized-Water Reactor Analysis Insights.............. 5-14 5.2.4 Applicability to Other Plants.......................................................................... 5-21 5.3 Consequential Steam Generator Tube Rupture.......................................................... 5-23 5.3.1 Modeling....................................................................................................... 5-23 5.3.2 Surry Uncertainty Analysis Consequential Steam Generator Tube Rupture Results........................................................................................... 5-25 5.3.3 Implications for Other Plants......................................................................... 5-34 5.4 Containment Failure Insights...................................................................................... 5-37 5.4.1 Boiling-Water Reactor Containment Failure Timing Insights......................... 5-37 5.4.2 Surry Uncertainty Analysis Insights............................................................... 5-40 5.4.3 Sequoyah Uncertainty Analysis Insights....................................................... 5-45 5.4.4 Implications for Other Plants......................................................................... 5-46 5.5 Other Source Term Insights........................................................................................ 5-48 5.5.1 Peach Bottom Uncertainty Analysis.............................................................. 5-48 5.5.2 Pressurized-Water Reactor Uncertainty Analyses........................................ 5-49 5.5.3 Implications for Other Plants......................................................................... 5-51 6 OFFSITE CONSEQUENCE INSIGHTS...............................................................................6-1

vi 6.1 Common Themes.........................................................................................................6-1 6.2 Latent Cancer Fatality Risk Insights.............................................................................6-1 6.2.1 Insights from Regression Analyses.................................................................6-2 6.2.2 Habitability Criteria and Alternate Dose-Response Models.............................6-3 6.2.3 Alternate Protective Action and Shielding Assumptions for Seismic Initiator...........................................................................................................6-5 6.2.4 Contribution of Different Chemical Groups to Latent Cancer Fatality Risk......6-6 6.3 Early Fatality Risk Insights............................................................................................6-7 6.4 Implications for Other Sites...........................................................................................6-9 7 UNCERTAINTY ANALYSIS METHODOLOGY INSIGHTS.................................................7-1 7.1 Choice of Monte Carlo Simulation and Parameter Sampling........................................7-1 7.2 Stability Analysis..........................................................................................................7-2 7.3 Regression Techniques and Presentation of Results....................................................7-4 8 CONCLUSIONS..................................................................................................................8-1 9 REFERENCES....................................................................................................................9-1

vii LIST OF FIGURES Figure 2-1 Diagram and Pictorial Representation of Code Information Flow for UA...........2-4 Figure 3-1 Parameter Storyboard Used to Capture Key Information for Each Parameter Investigated.....................................................................................3-1 Figure 4-1 Cesium (Left) and Iodine (Right) Release Fraction to Environment Horsetail Plots Based on the Sequoyah Unmitigated STSBO UA Realizations......................................................................................................4-1 Figure 4-2 Cesium Release Fraction to Environment Horsetail Plots Based on the Peach Bottom Unmitigated STSBO UA Realizations........................................4-2 Figure 4-3 Iodine Release Fraction to Environment Horsetail Plots Based on the Peach Bottom Unmitigated STSBO UA Realizations........................................4-3 Figure 4-4 C-SGTR (SGTR in the Legend) and Non-C-SGTR (Non-SGTR in the Legend) Cesium Release Masses to the Environment with the Corresponding Reference Case Realizations from the Surry Unmitigated STSBO UA........................................................................................................4-4 Figure 4-5 C-SGTR (SGTR in the Legend) and Non-C-SGTR (Non-SGTR in the Legend) Iodine Release Masses to the Environment with the Corresponding Reference Case Realizations from the Surry Unmitigated STSBO UA........................................................................................................4-5 Figure 4-6 Complementary Cumulative Distribution Functions for the Sequoyah UA of Conditional Individual LCF Risk within Five Intervals (Annuli) Centered on Sequoyah.....................................................................................................4-6 Figure 4-7 CCDF of Mean, Population-Weighted LCF Risk (Based on Linear No Threshold (LNT) Dose Response) Conditional on an STSBO Occurring for Five Annular Areas Centered on the Surry Site............................................4-7 Figure 5-1 Activity Levels for Iodine (I)-131 and Cs-137 with Respect to Time in the Cycle in the SOARCA Surry UA........................................................................5-2 Figure 5-2 The 4-Hour Integrated Decay Heat for ORIGEN Calculations Used in the Surry UA...........................................................................................................5-3 Figure 5-3 The Reactor Vessel Lower Head Timing as a Function of the Time in the Cycle in the Surry UA........................................................................................5-4 Figure 5-4 The Sequoyah UA Specifics for the Time in the Cycle Uncertainty Sampling...........................................................................................................5-5 Figure 5-5 Variations in the Sequoyah Decay Heat Power as a Function of the Time in the Cycle.......................................................................................................5-5 Figure 5-6 Sequoyah UA Containment Pressure Response Colored by the Time in the Cycle...........................................................................................................5-6 Figure 5-7 Scatterplot of Iodine Fraction Released Versus the Time in the Cycle in the Sequoyah UA..............................................................................................5-8

viii Figure 5-8 Cesium Environmental Release Fraction as a Function of Valve Failure Mode for the Peach Bottom UA....................................................................... 5-13 Figure 5-9 Steam Generator Pressure as a Function of MSIV Leakage Size in the Surry UA......................................................................................................... 5-17 Figure 5-10 Aggregate Pressurizer SV Cycles and End-State Open Fraction.................... 5-18 Figure 5-11 Time of PRT Boiling Dry Versus Pressurizer SV FTC Open Fraction in Surry UA......................................................................................................... 5-19 Figure 5-12 Example of Cesium Revaporization Following PRT Dryout in Surry UA.......... 5-20 Figure 5-13 CFD Simulation of Hot Natural Circulation Flows from the Vessel to the Steam Generator............................................................................................ 5-24 Figure 5-14 Containment and C-SGTR Leakage Rate (C-SGTR Reference Case)............ 5-28 Figure 5-15 SG Tube Creep Damage Accumulation (C-SGTR Reference Case)............... 5-29 Figure 5-16 Integral Aerosol Decontamination in the SG Secondary Following the C-SGTR (C-SGTR Reference Case)............................................................... 5-30 Figure 5-17 Comparison of the Short-Term Xenon, Iodine Gas, Total Iodine, and Total Cesium Integral Decontamination Factor in the SG (C-SGTR Reference Case).............................................................................................................. 5-31 Figure 5-18 Percentage of Xenon, Iodine Gas, Total Iodine, and Total Cesium Environmental Release as a Function of Time (C-SGTR Reference Case)..... 5-32 Figure 5-19 Iodine Environmental Release Fraction Versus Number of Tubes Failed........ 5-33 Figure 5-20 Cesium Environmental Release Fraction Versus Number of Tubes Failed...... 5-34 Figure 5-21 Cumulative Distribution Function for the Flow Area Resulting from Drywell Liner Failure with an Indication of a Water Pulse from the Wetwell to the Drywell............................................................................................................ 5-39 Figure 5-22 Containment Functional Failure Leakage........................................................ 5-41 Figure 5-23 Containment pressure by C-SGTR (SGTR in the legend)/Non-C-SGTR (Non-SGTR in the legend)1............................................................................. 5-42 Figure 5-24 MCCI Debris Surface and Ablation Depth....................................................... 5-43 Figure 5-25 Containment Pressure Response................................................................... 5-44 Figure 5-26 Scatterplot of Cesium Release Fraction Versus Containment Leakage Input Values.................................................................................................... 5-45 Figure 5-27 French Measured Fission Gas Release to the Fuel-Cladding Gap.................. 5-49 Figure 5-28 Impact of the Iodine Gas in the Fuel-Cladding Gap on the Total Iodine Release to the Environment in the Surry UA................................................... 5-50 Figure 6-1 Habitability Criterion Comparison of Conditional, Mean, Individual LCF Risk (per Event) for Specified Circular Areas for the LNT Dose-Response Model................................................................................................................6-4 1

Note that due to a plotting error, the low horsetails were mischaracterized as C-SGTR cases. None of the low horsetails had a C-SGTR. These were the 0.5 day time in the cycle realizations. Not all realizations are shown in the figure to improve the definition on the individual pressure curves.

ix Figure 6-2 Conditional Mean (over Weather Variability) Individual LNT LCF Risk within the 0- to 10-Mile Interval Assuming Degrees of Degraded Structures during an Extended Shelter in Place for Realization 554 in the SOARCA Sequoyah UA....................................................................................6-6 Figure 6-3 Conditional, Mean, Individual LCF Risk (per Event) for MELCOR Single Realizations for the 20-Mile Circular Area in the SOARCA Peach Bottom UA....................................................................................................................6-7 Figure 7-1 Cesium Middle-Of-Cycle Stability Analysis in Sequoyah STSBO UA................7-3

xi LIST OF TABLES Table 3-1 Uncertain MELCOR Parameters Chosen for the SOARCA Unmitigated SBO UAs........................................................................................................................3-3 Table 3-2 Uncertain MACCS Parameter Groups Used in the SOARCA Unmitigated SBO UAs................................................................................................................3-5 Table 4-1 Conditional, Mean, Individual LCF Risk Statistics for the Peach Bottom UA for Five Circular Areas Centered on Peach Bottom......................................................4-6 Table 5-1 MSS SV FTC Statistics in Surry UA...................................................................... 5-15 Table 5-2 Pressurizer SV FTC Statistics in Surry UA............................................................ 5-18 Table 5-3 Comparison of PRT Dryout and Containment Liner Failure Statistics in Surry UA............................................................................................................... 5-21 Table 5-4 Key Event Timing in the Reference STSBO Calculation with a C-SGTR............... 5-27 Table 5-5 Containment Failure Timing.................................................................................. 5-40 Table 6-1 Habitability Criterion Comparison of Conditional, Mean, Individual LCF Risk (per Event) for USBGR Dose-Response Model, Including Percent Reduction/Increase (-/+) Compared to Base Case, Rounded to One Significant Figure, from the SOARCA Peach Bottom UA........................................6-5 Table 6-2 Conditional,a Mean (Averaged over Weather Variability), Individual Early Fatality Risk (per Event) Statistics for the Peach Bottom SOARCA UA for Circular Areas with Specified Radii, Centered on the Plant, Rounded to One Significant Figure....................................................................................................6-8 Table 7-1 Results from Regression on the Realization Success Indicator in the Sequoyah UA.........................................................................................................7-4

xiii ABBREVIATIONS AND ACRONYMS AC alternating current ACRS Advisory Committee on Reactor Safeguards AFW auxiliary feedwater BOC beginning of cycle B&W Babcock and Wilcox BWR boiling-water reactor C-SGTR consequential steam generator tube rupture CDF core damage frequency CCDF complementary cumulative distribution function CCI core-concrete interaction CE Combustion Engineering CEA Commission for Atomic Energy and Alternative Energies CFD computational fluid dynamics CFR Code of Federal Regulations Cs cesium DC direct current EOC end of cycle EPRI Electric Power Research Institute EPZ emergency planning zone FLEX diverse and flexible coping strategies FTC failure to close FTO failure to open gpm gallons per minute hr hour I

iodine in.

inch ISI inservice inspection LCF latent cancer fatality LER licensee event report

xiv LHF lower head failure LHS Latin hypercube sampling LNT linear no threshold LTSBO long-term station blackout MACCS MELCOR Accident Consequence Code System MARS multivariate adaptive regression splines MCCI molten core-concrete interaction MELCOR not an acronym MOC middle of cycle MSIV main steam isolation valve MSL main steam line MSS main steam system NSSS nuclear steam supply system POD probability of detection PRT pressurizer relief tank psig pounds per square inch gauge PWR pressurized-water reactor RCIC reactor core isolation cooling RCS reactor coolant system RIL research information letter Rlz realization (only used in tables and figures)

RPV reactor pressure vessel SAMG severe accident mitigation guideline SBO station blackout scfh standard cubic feet per hour scfm standard cubic feet per minute SG steam generator SGTR steam generator tube rupture SNL Sandia National Laboratories SOARCA State-of-the-Art Reactor Consequence Analyses SRS simple random sampling SRV safety relief valve STSBO short-term station blackout SV safety valve TAF top of active fuel

xv UA uncertainty analysis USBGR U.S. background dose threshold

1-1 1 INTRODUCTION The U.S. Nuclear Regulatory Commission (NRC), with the assistance of Sandia National Laboratories (SNL), conducted three uncertainty analyses (UAs) from 2010 to 2019, as part of the State-of-the-Art Reactor Consequence Analyses (SOARCA) studies. The SOARCA project was initiated to leverage decades worth of research into severe accidents and apply modern analytical tools and techniques to develop a body of knowledge about the realistic consequences of severe nuclear reactor accidents [NRC, 2012; NRC, 2020]. The original study

[NRC, 2012] focused on providing a best estimate evaluation for select important scenarios at two plants, the Peach Bottom Atomic Power Station (Peach Bottom) and the Surry Power Station (Surry). The SOARCA UAs [NRC, 2016; NRC, 2019; NRC, 2022] extended this work to include an integrated evaluation and propagation of uncertainty through the detailed accident progression, radiological release, and offsite health consequence modeling using the MELCOR and MACCS codes. As such, the first of the UAs, for the Peach Bottom plant, was a first-of-a-kind analysis. The other two UAs, for the Sequoyah Nuclear Plant (Sequoyah) and Surry, built upon the Peach Bottom UA. The purpose of this NUREG report is to summarize concisely some of the important results and insights from the three SOARCA UAs.

The collection of three UAs cover two different types of light-water reactors, three different containment designs, and three different locations within the United States. Each UA comprises plant-specific, site-specific, and scenario-specific analyses. The UA for Peach Bottom, a boiling-water reactor (BWR) with a Mark I containment, located in Pennsylvania, analyzed the unmitigated long-term station blackout (LTSBO) SOARCA scenario (NUREG/CR-7155, State of-the-Art Reactor Consequence Analyses (SOARCA) Project: Uncertainty Analysis of the Unmitigated Long-Term Station Blackout of the Peach Bottom Atomic Power Station, issued May 2016 [NRC, 2016]). The UA for Sequoyah, a 4-loop Westinghouse pressurized-water reactor (PWR), located in Tennessee, analyzed the unmitigated short-term station blackout (STSBO) SOARCA scenario, with a focus on issues unique to the ice condenser containment and the potential for early containment failure due to hydrogen deflagration. Unlike the other two UAs, this UA was conducted simultaneously with other SOARCA analyses for the Sequoyah plant and is documented in NUREG/CR-7245, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Sequoyah Integrated Deterministic and Uncertainty Analyses, issued October 2019 [NRC, 2019]. The UA for Surry, a three-loop Westinghouse PWR with subatmospheric large dry containment, located in Virginia, analyzed the unmitigated STSBO SOARCA scenario, including the potential for induced steam generator tube rupture (SGTR) (NUREG/CR-7262, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Uncertainty Analysis of the Unmitigated Short-Term Station Blackout of the Surry Power Station, forthcoming in 2022 [NRC, 2022].) The three SOARCA UAs are a rich source of information, as documented in the cited NUREG/CR reports.

The SOARCA program produced two other recent summary documentsthe public information brochure, NUREG/BR-0359, Modeling Potential Reactor Accident Consequences, Revision 3, issued October 2020 [NRC, 2020], and the NRC Research Information Letter (RIL)-2020-03, Benefits and Uses of the State-of-the-Art Reactor Consequence Analyses (SOARCA) Project, issued March 2020 [NRC, 2020a]. The purposes of these two documents differ from that of this NUREG report. NUREG/BR-0359 is a plain-language summary of SOARCAs methods, results, and conclusions. RIL-2020-03 summarizes the numerous uses of the SOARCA project as of 2019; for example, the projects results, insights, computer code models, and modeling best practices have supported NRC rulemaking, licensing, and oversight efforts and facilitated international cooperation and knowledge management efforts. The purpose for this NUREG is to

1-2 summarize insights from, and serve as a quick reference for, specifically, the SOARCA UAs body of work.

In addition to this introductory section, Section 2 describes the methodology and scope of the UAs, including notable assumptions. Section 3 describes the process used to select model parameters that would be varied and presents the final sets of uncertain parameters included in each of the UAs. Section 4 provides the UA results often of most interest in severe accident consequence and risk studies: (1) source term results in terms of cesium and iodine releases to the environment and (2) offsite health consequences in terms of latent cancer fatality risk.

Section 5 presents details on key accident progression and source term insights, including input variables and associated phenomena that had the most influence on variations in different output metrics. Section 6 contains key insights on offsite health consequences, and Section 7 presents insights on UA methodology from the three SOARCA UAs. Section 8 presents overall conclusions.

2-1 2 METHODOLOGY AND SCOPE 2.1 Computer Codes The SOARCA analyses were performed primarily with two computer codes, MELCOR for severe accident progression and MACCS and its suite of codes for offsite radiological consequences. During the analyses, code modeling improvements were made to reflect the current state-of-the-art severe accident modeling practices. Hence, the three SOARCA UAs conducted in different timeframes used different versions of the MELCOR and MACCS codes and slightly different best modeling practices.

MELCOR models the following:

thermal-hydraulic response in the reactor coolant system (RCS), reactor cavity (below the reactor vessel), containment, and confinement buildings (e.g., shield building) core heatup, degradation (including fuel cladding oxidation, hydrogen production, and fuel melting), and relocation core-concrete interaction (CCI) in the cavity after lower reactor vessel head failure hydrogen production, transport, combustion, and mitigation fission product transport and release to the environment MACCS models the following:

atmospheric transport and deposition of radionuclides released to the environment emergency response and long-term protective actions exposure pathways acute and long-term doses to a set of tissues and organs early and latent health effects for the affected population resulting from the doses2 2.2 Scope The SOARCA UAs used the existing SOARCA software and models (with some updates) for the three nuclear power plants. In other words, the uncertainty stemming from the choice of conceptual models and model implementation was not explicitly explored, nor was completeness uncertainty (e.g., see NRCs Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, issued January 2017 [NRC, 2017], or NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, issued March 2017 [NRC, 2017a], for discussion on different types of uncertainty). In addition, the analyses did not include all possible uncertain input parameters. Rather, NRC and SNL severe 2

MACCS can also model economic and societal consequences, such as the population subject to protective actions; however, the SOARCA projects did not use these.

2-2 accident experts carefully chose a set of key parameters to capture important influences on the potential release of radioactive material to the environment and on offsite health consequences.

The focus of the UAs was epistemic, or state-of-knowledge, uncertainty in the model parameters. Some parameters may have both aleatory and epistemic attributes (for example, how long the station battery may last during an LTSBO) but are treated as epistemic for analytic convenience. In addition to epistemic parameter uncertainty, one aleatory uncertainty considered explicitly is the uncertainty stemming from the weather conditions at the time of a hypothetical accident at a future unknown time.

A systematic evaluation of conceptual model uncertainty was not within the scope of the SOARCA UAs. Although such a systematic evaluation could reveal additional important uncertainties that were not captured within the scope of the UAs, each of the SOARCA UAs contained separate sensitivity analyses to understand the variation in results arising from some alternative modeling approaches. These sensitivity analyses increase confidence in the robustness of the overall UA conclusions.

Scenarios Selected A detailed UA was performed for a single accident scenario at each of the SOARCA plants rather than for all of the SOARCA scenarios documented in NUREG-1935, State-of-the-Art Reactor Consequence Analysis (SOARCA) Report, issued November 2012 (for Peach Bottom and Surry [NRC, 2012]), and in NUREG/CR-7245 (for Sequoyah [NRC, 2019]). While a single scenario cannot provide a complete exploration for all possible effects of uncertainties in analyses for the SOARCA plants, it can be used to provide insights into the overall sensitivity of SOARCA results and conclusions to uncertainty in inputs and begin to provide insights on phenomena that are influential to accident progression and offsite consequences.

The SOARCA BWR unmitigated LTSBO scenario was analyzed for Peach Bottom [NRC, 2016].

Station blackouts (SBOs) are an important class of events for nuclear power plants, especially BWRs, which pointed to both Peach Bottom LTSBO and STSBO scenarios as good candidates.

Although the UA was already under way by March 2011, the events at the Fukushima Dai-ichi plant reconfirmed the interest in SBOs for BWRs. The SOARCA 2012 Peach Bottom STSBO had an earlier radiological release compared to LTSBO. Although it was an earlier release (i.e., 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (hr) versus 20 hr), the STSBO release was delayed beyond the time needed for successful evacuation [NRC, 2013]. In addition, the Peach Bottom STSBO frequency was assessed to be approximately an order of magnitude lower than the LTSBO (i.e., approximately 3x10-7 per reactor-year (STSBO) versus approximately 3x10-6 per reactor-year (LTSBO)3,4).

The original SOARCA analysis published in 2012 indicated the absolute risk is smaller for the STSBO than for the LTSBO. Another factor that influenced the choice of the LTSBO was the ability to explore the impact of parameters that are not evaluated in the STSBO. For example, only the LTSBO could assess the importance of battery life.

The SOARCA unmitigated STSBO [NRC, 2013a] was selected for Surry, in part because of the importance of SBO scenarios to environmental impacts, and because accident progression occurs relatively quickly under the postulated conditions. The relatively quick accident 3

These estimated core damage frequency (CDF) contributions do not consider recent diverse and flexible coping strategies (FLEX) upgrades that can potentially avert core damage in the given scenario.

4 These numbers are based on information and expert judgment at the time each analysis was conducted.

This study involved no new work to quantify the contribution to CDF. This discussion is included to provide context for the likelihood of the scenarios studied in this consequence analysis.

2-3 progression provides an opportunity to assess the offsite response parameters while the release is potentially underway. Of the scenarios selected for the original SOARCA project published in 2012, the Surry unmitigated STSBO with induced SGTR was also one of the two scenarios with the highest conditional individual latent cancer fatality (LCF) risk [NRC, 2012]. This scenario, as detailed in the Surry SOARCA study [NRC, 2013a], is postulated to initiate by an earthquake (0.5-1.0 g peak ground acceleration) and has an estimated frequency of 1x10-6 to 2x10-6 per reactor-year.5,6 System failures were specified (i.e., assumed) in the Surry SOARCA calculation based on the type of event.

The SOARCA unmitigated STSBO was selected for Sequoyah [NRC, 2019] because of its particular focus on the potential for early containment failure. A seismically initiated STSBO has an estimated contribution to the CDF of approximately one in 500,000 years of reactor operation (2x10-6 per reactor year4,5). For Sequoyah, STSBO scenarios include unavailability of the auxiliary feedwater (AFW) system due to a loss of direct current (DC) power, failure of a turbine-driven AFW system component, or loss of the water supply due to the seismic initiating event.

Although mitigative actions would be recommended and attempted throughout the course of an accident, the unmitigated UA scenarios in the three SOARCA UAs assume mitigative actions are not successful. For the same reason, uncertainty in human actions is outside the scope of the three SOARCA UAs. In addition, the SOARCA UAs did not include an analysis of scenario frequency.

2.3 Monte Carlo Process The UAs used a two-step Monte Carlo simulation to propagate parameter uncertainty. From the complete set of MELCOR realizations, a family of radiological source term results were produced. The MACCS sample size (number of realizations) was chosen to match the number of source terms in each UA. The MACCS results are presented as individual LCF risk and individual early fatality risk, averaged over the aleatory uncertainty stemming from weather (accomplished in the Monte Carlo simulation through a second, inner loop sampling of weather conditions in MACCS, for each parameter sample in the outer loop). Figure 2-1 shows a diagram and pictorial representation of the overall code information flow for the UAs.

Latin hypercube sampling (LHS), which employs a stratified sampling approach, is often preferred over simple random sampling (SRS) in Monte Carlo calculations. LHS has the potential to produce results that are more representative of the underlying distribution (particularly for the tail quantiles) using fewer samples. However, SRS was chosen for MELCOR calculations, from the first SOARCA UA, as some of the MELCOR calculation runs do not converge. If LHS were employed, distributions of analysis outcomes with nonconvergence issues would need to account for an input sample set with stratification that was incomplete (i.e., some sample value ranges would definitively have been excluded from the analysis). SRS does not have this challenge, since it does not stratify the distributions before sampling. In the first SOARCA UA (for Peach Bottom), LHS was employed initially for the MACCS calculations, since the MACCS runs did not experience the same convergence challenges. However, subsequent SOARCA UAs also used SRS for the MACCS calculations, given the advantage for 5

These estimated CDF contributions do not consider recent FLEX upgrades that can potentially avert core damage in the given scenario.

6 These numbers are based on information and expert judgment at the time each analysis was conducted.

This study involved no new work to quantify the contribution to CDF. This discussion is included to provide context for the likelihood of the scenarios studied in this consequence analysis.

2-4 convergence testing, as discussed in Ghosh et al. [2019]. Also, the sample sizes used in the SOARCA UAs were large enough that LHS had little advantage over SRS [NRC, 2016].

Figure 2-1 Diagram and Pictorial Representation of Code Information Flow for UA Source: NRC, 2020

2-5 For all three UAs, the sample size for MACCS was chosen to match the number of successful MELCOR realizations. The sample sizes for Peach Bottom, Sequoyah, and Surry were 865, 567, and 1,147, respectively.

The UAs used multiple regression techniques to estimate the importance of selected uncertain input parameters, both individually and in interaction with other parameters, with respect to the uncertainty in source terms and consequences. The regression techniques used were linear rank regression, quadratic regression, recursive partitioning, and multivariate adaptive regression splines (MARS), the latter three of which can measure interaction effects.

Regression analysis helps do the following:

Identify which uncertain parameters and phenomena are driving the variability in model results.

Verify and validate the SOARCA model through exploration of the distributions of results and any unexpected outcomes.

Assess linear and nonlinear regression techniques and the overall UA approach.

Provide a technical basis for future work.

Furthermore, the use of select single-realization analyses (analyzing the MELCOR and MACCS results of one Monte Carlo sample) in all three UAs was helpful in validating the results of the statistical regression analyses and in providing phenomenological explanations. Single realizations were selected to help explain the reasons for the range in different results (e.g., a low-, average-, and high-release realization) and outliers (e.g., an unusual case where a nonzero early fatality risk was calculated to a radius beyond 10 miles from the plant). Scatter plots were particularly valuable in gaining and communicating important insights.

2.4 Notable Assumptions As noted above, the SOARCA UAs used the existing SOARCA MELCOR and MACCS models for each of the three plants and sites and the versions of the MELCOR and MACCS codes available at the time of each UA. Furthermore, the scope was limited to conditional accident progression, source term, and offsite consequence analyses (i.e., predicated on predefined accident scenario initiators). As a result, the following additional assumptions were made, and these should be kept in mind when considering the results and insights from the SOARCA UAs:

While safety valve (SV) behavior was important in all three SOARCA UAs (for different reasons), there are sparse data and a lack of established expert consensus on how best to model the valve failure rates under severe accident conditions (discussed further in Section 5.2.1).

The flaw distribution is a key component for predicting a consequential SGTR (C-SGTR).

The Surry UA flaw distribution was developed from a combination of generic data from steam generators (SGs) with Alloy 600 tubes and plant-specific data, and the corresponding flaw frequency and severity damage may be atypical of other plants (discussed further in Section 5.3).

Each of the UAs assumed that the accident scenario proceeded without mitigation (e.g., FLEX, Title 10 of the Code of Federal Regulations (10 CFR) 50.54(hh), severe

2-6 accident mitigation guidelines (SAMGs), and extensive damage mitigation guidelines are not credited).

The Peach Bottom UA calculations assume that, for even the unmitigated accident modeled, releases can be terminated by 48 hr (original discussion of this assumption can be found in Appendix A to NUREG-1935 [NRC, 2012]). The Sequoyah and Surry UA calculations assume the same by 72 hr.

The SOARCA models assume that appropriate planned protective actions (e.g., evacuation, relocation, interdiction, and decontamination of land) will be undertaken and successfully keep doses to the public below habitability criteria in the long term.

The SOARCA models assume that 99.5 percent of the population residing in the 10-mile emergency planning zone (EPZ) will evacuate as ordered.

Shadow evacuationsthe voluntary evacuation of members of the public who have not been ordered to evacuateare also modeled for 10 to 15-mile or 10 to 20-mile radius annular rings around the plants.

The Sequoyah analysis explicitly considered the potential impact of the seismic initiating event on emergency response and also included sensitivity calculations for extended sheltering in place with and without degraded shielding due to structural damage, in case evacuation is delayed [NRC, 2019].

3-1 3 UNCERTAIN PARAMETER SELECTION Through expert judgment and iteration after interim reviews by the independent technical reviewers (see Appendix B to NUREG-1935 [NRC, 2012]) and members of the NRCs Advisory Committee on Reactor Safeguards (ACRS) (see Appendix E to NUREG/CR-7155 [NRC, 2016]),

key MELCOR parameters and key MACCS parameter groups were identified for inclusion in each of the UAs, and distributions were defined for each uncertain parameter. The MACCS parameter groups comprised more than 300 individual parameters, many of which were fully correlated to form a parameter group. For example, there were many individual organ-specific and radionuclide-specific dose conversion factors, which were considered one group of parameters.

The MELCOR uncertain parameters were selected to capture the following:

accident sequence issues accident progression issues within the reactor vessel accident progression issues outside the reactor vessel containment behavior issues fission product release, transport, and deposition upon plant structures These broad areas span the severe accident progression over time, ranging from sequence variations as affected by safety relief valve (SRV) behavior and battery duration, to uncertainties in the core damage and melt progression. Other parameters more specific to fission product transport include deposition and settling processes, and chemical speciation of cesium and iodine, which affects both release and transport within plant structures.

The team learned from each UA and used a new process for the Surry UA parameters. To ensure sufficient detail was captured for parameter justification and rationale, the team used a storyboard process for the Surry project. Figure 3-1 illustrates the form that was created to identify the parameter, responsible owner, technical justification for uncertainty, type of distribution, and rationale for the distribution type and bounds. The intent was to capture, in a concise format, the justification and rationale for each parameter from which the detailed technical bases could ultimately be developed. The storyboards were reviewed internally in small groups where analysts explained and defended each parameter.

Parameter Name:

Type of Distribution:

Responsible Technical Expert:

Technical justification for the uncertainties:

Rationale for type of distribution:

Were similar or related parameters considered and rejected?

Graphic: (plot of the distribution)

Figure 3-1 Parameter Storyboard Used to Capture Key Information for Each Parameter Investigated Source: Jones et al., 2014

3-2 The purpose of the reviews was to obtain information and insights from a team of experts on severe accident and MELCOR analysis that could be used to further define and defend the parameters and distributions. The team challenged the technical leads to explain the basis and defend the appropriateness of supporting data. This approach often required the analyst to revise or revisit the technical basis and obtain additional supporting detail for the rationale. The project team was ultimately required to make some decisions based on the ability to obtain sufficient information to address specific parameters. The state of knowledge continues to be developed for some of the parameters investigated, which is evident in the MELCOR Code Manual [NRC, 2005]. The code manual identifies many parameters as order-of-magnitude parameters. In other words, a lot of uncertainty remains, and the state of knowledge does not support estimating the parameter values more precisely than an order of magnitude [Jones et al., 2014].

The parameters selected from the MACCS consequence model were those that affect (either directly or indirectly) individual LCF risk and individual early fatality risk due to the following:

cloudshine during radiological plume passage (CSFACT)1 groundshine from deposited radionuclides (GSHFAC) inhalation during plume passage and following plume passage from resuspension of deposited radionuclides (PROTIN)

Parameters related to emergency response were also varied. Although there is confidence in planned emergency response actions, an emergency is a dynamic event with uncertainties in elements of the response. The following three emergency planning parameter sets were selected:

hotspot and normal relocation criteria (TIMHOT, DOSHOT, TIMNRM, DOSNRM) evacuation delay (DLTEVA) evacuation speed (ESPEED)

Table 3-1 shows the set of MELCOR parameters that were varied in the three SOARCA UAs.

Table 3-2 shows the set of MACCS parameters that were varied in the three SOARCA UAs; those parameters that were varied in only a subset of the UAs are footnoted.

1 This is included in the Peach Bottom UA only.

3-3 Table 3-1 Uncertain MELCOR Parameters Chosen for the SOARCA Unmitigated SBO UAs Peach BottomBWR with Mark I Containment SequoyahPWR with Ice Condenser Containment SurryPWR with Large, Dry Subatmospheric Containment Sequence-Related Parameters SRV stochastic failure to reclose Battery duration Primary SV stochastic number of cycles until failure to close Primary SV open area fraction after failure Secondary SV stochastic number of cycles until failure to close Secondary SV open area fraction after failure Primary SV stochastic number of cycles until failure to close Primary SV open area fraction after failure Secondary SV stochastic number of cycles until failure to close Secondary SV open area fraction after failure Reactor coolant pump seal leakage Normalized temperature of hottest SG tube SG nondimensional flaw depth Main steam isolation valve leakage In-Vessel Accident Progression Zircaloy melt breakout temperature Molten clad drainage rate SRV thermal seizure criterion SRV open area fraction upon thermal seizure Main steam line creep rupture area fraction Fuel failure criterion Radial debris relocation time constants Melting temperature of the eutectic formed from fuel and zirconium oxides Oxidation kinetics model Zircaloy melt breakout temperature Molten clad drainage rate Melting temperature of the eutectic formed from fuel and zirconium oxides Oxidation kinetics model

3-4 Peach BottomBWR with Mark I Containment SequoyahPWR with Ice Condenser Containment SurryPWR with Large, Dry Subatmospheric Containment Ex-Vessel Accident Progression and Containment Behavior Debris lateral relocation cavity spillover and spreading rate Hydrogen ignition criteria Railroad door open fraction Drywell head flange leakage Drywell liner failure flow area Chemical form of iodine Chemical form of cesium Aerosol density Lower flammability limit hydrogen ignition criterion for an ignition source in lower containment Containment rupture pressure Barrier seal open area Barrier seal failure pressure Ice chest door open fraction Aerosol dynamic shape factor Hydrogen ignition criteria Containment design leakage rate Containment fragility curve Containment convection heat transfer coefficient Chemical form of iodine Chemical form of cesium Aerosol dynamic shape factor Secondary-side decontamination factor Time within the Fuel Cycle Not varied Time in cycle sampled at three points in the refueling cyclenear beginning of cycle (BOC), middle of cycle (MOC), and end of cycle (EOC)

Time in cycle sampled discretely at 14 times from 0.5 days to 550 days Source: Ghosh et al., 2021 Table 3-1 Uncertain MELCOR Parameters Chosen for the SOARCA Unmitigated SBO UAs (cont.)

3-5 Table 3-2 Uncertain MACCS Parameter Groups Used in the SOARCA Unmitigated SBO UAs Epistemic Uncertainty Dispersion Crosswind Dispersion Linear Coefficient Vertical Dispersion Linear Coefficient Time-Based Crosswind Dispersion Coefficienta Deposition Wet Deposition Coefficient Dry Deposition Velocities Emergency Response Evacuation Delay Evacuation Speed Hotspot Relocation Time Normal Relocation Time Hotspot Relocation Dose Normal Relocation Dose Keyhole Weather Forecastb Shielding Factors Cloudshine Shielding Factorsc Groundshine Shielding Factors Inhalation Protection Factors Early Health Effects Early Health Effects LD50 Parameter Early Health Effects Exponential Parameter Early Health Effects Threshold Dose Latent Health Effects Dose and Dose Rate Effectiveness Factor Lifetime Cancer Fatality Risk Factors Long-Term Inhalation Dose Coefficients Aleatory Uncertainty Weather aThis is included in the Sequoyah and Surry UAs only.

bThis is included in the Sequoyah and Surry UAs only.

cThis is included in the Peach Bottom UA only.

Source: Ghosh et al., 2021 As noted in the detailed reports for each UA, SOARCA subject matter experts identified those input parameters that may be correlated (i.e., which inputs should not be sampled completely independently). For those inputs, correlations were imposed on the sampling of those MELCOR input parameters with each other, and some of the MACCS input parameters with each other, in the Monte Carlo simulations [NRC, 2016; NRC, 2019; NRC, 2022]. For example, the MACCS dry deposition velocities are assumed to be perfectly rank-order correlated across the aerosol sizes. This prevents small aerosols from depositing faster than large aerosols, which would contradict the understanding of aerosol physics. The SOARCA UAs did not impose any

3-6 sampling correlations between any MELCOR and MACCS uncertain input parameters, as such dependencies are not thought to exist for the modeled scenarios.

4-1 4

SUMMARY

OF RESULTS The results presented in Sections 4.1 and 4.2 are based on the 865, 567, and 1,147 successful Monte Carlo realizations in the Peach Bottom, Sequoyah, and Surry UAs, respectively.

4.1 Source TermRadionuclide Release to the Environment Within each of the three SOARCA UAs, radionuclide releases to the environment span multiple orders of magnitude. All three individual SOARCA UA reports present the cesium and iodine releases. While MELCOR and MACCS model a full set of radionuclides, of particular interest are cesium, since it tends to dominate the long-term health effects in the scenarios studied, and iodine, since it can be an important contributor to potential early fatality risk. Figure 4-1 shows the horsetail plots (called Horsetails in Figure 2-1) of fractions of cesium and iodine released to the environment (on a log scale), produced through the Monte Carlo simulation for the Sequoyah UA [NRC, 2019]. Each thin grey curve represents one Monte Carlo realization.

Summary percentile measures, and the reference realization (Realization 266), are shown in thicker colored lines (the 5th percentile is outside the range of the chart, in the realm of BOC realizations, where containment did not fail within the 72-hr simulation time). The four grey curves with the earliest releases represent the early containment failure cases; these cases also have some of the highest total release magnitudes. Figures 4-2 and 4-3 show the cesium and iodine releases to the environment (on a linear scale) in the Peach Bottom UA [NRC, 2016].

Figures 4-4 and 4-5 show the cesium and iodine releases to the environment (on a log scale) in the Surry UA [NRC, 2022]. The Surry UA reported the mass releases rather than release fractions, since it sampled 14 different times in the cycle, as discussed further in Section 5.1.

The curves in Figures 4-4 and 4-5 are also color-coded to indicate which realizations resulted in a C-SGTR, and a reference C-SGTR realization (Rlz 37) and reference non-SGTR realization (Rlz 454) are highlighted.

Figure 4-1 Cesium (Left) and Iodine (Right) Release Fraction to Environment Horsetail Plots Based on the Sequoyah Unmitigated STSBO UA Realizations Source: NRC, 2019

4-2 Figure 4-2 Cesium Release Fraction to Environment Horsetail Plots Based on the Peach Bottom Unmitigated STSBO UA Realizations Source: NRC, 2016

4-3 Figure 4-3 Iodine Release Fraction to Environment Horsetail Plots Based on the Peach Bottom Unmitigated STSBO UA Realizations Source: NRC, 2016

4-4 Figure 4-4 C-SGTR (SGTR in the Legend) and Non-C-SGTR (Non-SGTR in the Legend)

Cesium Release Masses to the Environment with the Corresponding Reference Case Realizations from the Surry Unmitigated STSBO UA Source: NRC, 2022

4-5 Figure 4-5 C-SGTR (SGTR in the Legend) and Non-C-SGTR (Non-SGTR in the Legend)

Iodine Release Masses to the Environment with the Corresponding Reference Case Realizations from the Surry Unmitigated STSBO UA Source: NRC, 2022 4.2 Offsite Health Consequences Within each of the three SOARCA UAs, similar to the source term results, the offsite health consequence metrics also span multiple orders of magnitude. Table 4-1 shows the LCF risk results for the Peach Bottom UA [NRC, 2016]. Figure 4-6 shows the LCF risk results for the Sequoyah UA [NRC, 2019], and Figure 4-7 shows the LCF risk results for the Surry UA [NRC, 2022]. Note that Table 4-1 shows results for circular areasin other words, the results for the 0 to 20-mile radius result column also include 0 to 10-mile radius results, the 0-30 miles also include the 0-20 miles, and so on, whereas the annular ring result curves in Figures 4-6 and 4-7 are mutually exclusive. Section 6.3 further discusses the early fatality risks, which were negligible in all three UAs.

4-6 Table 4-1 Conditional, Mean, Individual LCF Risk Statistics for the Peach Bottom UA for Five Circular Areas Centered on Peach Bottom 0-10 miles 0-20 miles 0-30 miles 0-40 miles 0-50 miles Mean 1.7x10-4 2.8x10-4 2.0x10-4 1.3x10-4 1.0x10-4 Median 1.3x10-4 1.9x10-4 1.3x10-4 8.7x10-5 7.1x10-5 5th percentile 3.1x10-5 4.9x10-5 3.4x10-5 2.2x10-5 1.9x10-5 95th percentile 4.2x10-4 7.7x10-4 5.3x10-4 3.4x10-4 2.7x10-4 Source: NRC, 2016 Figure 4-6 Complementary Cumulative Distribution Functions for the Sequoyah UA of Conditional Individual LCF Risk within Five Intervals (Annuli) Centered on Sequoyah Source: NRC, 2019

4-7 Figure 4-7 CCDF of Mean, Population-Weighted LCF Risk (Based on Linear No Threshold (LNT) Dose Response) Conditional on an STSBO Occurring for Five Annular Areas Centered on the Surry Site Source: NRC, 2022

5-1 5 ACCIDENT PROGRESSION AND SOURCE TERM INSIGHTS As described in Section 2.3, the MELCOR Monte Carlo results were postprocessed with regression analyses to establish statistically significant influential uncertain input parameters and single realization analyses to construct phenomenological explanations of variations among realizations. Each of the three SOARCA UAs included supplementary sensitivity analyses, separate from the Monte Carlo simulations, to provide additional insights for the MELCOR analyses [NRC, 2016; NRC, 2019; NRC, 2022]. For example, the Peach Bottom UA included a separate sensitivity analysis for the timing of manual control of an SRV and a separate analysis of sensitivity of fission product release to reactor lower head penetration failures. The Sequoyah UA included a host of separate analyses, including (1) a matrix of MELCOR calculations for LTSBO sequence variations, (2) hydrogen igniter benefits, (3) reactor coolant pump leakage, and (4) a mini supplementary UA focused on the behavior of pressurizer SVs.

This section summarizes some of the important accident progression and source term insights emerging from the SOARCA UAs. Each of the topics below also includes potential applicability of the insights to other plants, beyond the specific plants analyzed in the three SOARCA UAs.

Wagner et al. [2020] discusses additional topics (e.g., hydrogen behavior and primary system pump leakage).

5.1 Time in the Fuel Cycle 5.1.1 Pressurized-Water Reactor Uncertainty Analyses The parameter for time in the fuel cycle was included to understand the extent to which the fuel burnup influenced simulation results. This was accomplished by varying the point during the fuel burnup cycle (between refueling outages) at which the accident occurs. The time-in-cycle parameter directly affects the MELCOR accident progression through the magnitude of the decay heat power. It also affects the MELCOR source term and MACCS consequence analyses through the mass and makeup of the fission product inventory. Although the inventories of shorter lived isotopes increase with burnup only until secular equilibrium is established, the inventories of longer lived isotopes grow throughout the cycle. For example, cesium (Cs)-137 grows monotonically and can nearly double from the beginning to the end of the fuel burnup cycle (see Figure 5-1, which shows the activity levels for Surry). Because the longer lived isotopes have an effect on LCF risk, especially in the long-term phase, the time in the fuel cycle can have high importance for consequence calculations.

5-2 Figure 5-1 Activity Levels for Iodine (I)-131 and Cs-137 with Respect to Time in the Cycle in the SOARCA Surry UA Source: Wagner et al., 2020 The Peach Bottom UA does not address the time in the fuel cycle. However, the Surry and Sequoyah UAs included the time in the cycle as an uncertain parameter that impacted the overall decay heat power and the radionuclide inventory. The Sequoyah UA used three representative times in the fuel cycle [NRC, 2019; NRC, 2022]. However, there is significantly lower decay heat at the beginning of the cycle (i.e., the BOC sample was specified close to the start of the fuel cycle) due to short recent irradiation time, which results in a lower inventory of the shorter lived nuclides that dominate decay heat for a few hours after shutdown. Similarly, the radionuclide inventory at the EOC sample was near the maximum activity of the long-lived isotopes during the cycle, which will dominate the decay power for longer decay times. The inability to characterize the continuous variation from the start to the EOC with only three points identified a weakness in the Sequoyah UA. Consequently, the final Surry UA included 14 evenly spaced samples [NRC, 2022].

The decay heat power samples from ORIGEN time-of-the-cycle calculations supporting the Surry UA were integrated through 4 hr (see Figure 5-2). The integrated power during the first 4 hr (i.e., the core-degradation phase of the STSBO accident) rapidly changes at the start of the cycle but subsequently stabilizes. The delineation between the startup phase of the cycle and when the integrated decay heat is relatively constant is approximately 100 days. Consequently, the Surry UA provides more information on the transition from the start of the cycle to the more stable long-term decay heat power.

5-3 Figure 5-2 The 4-Hour Integrated Decay Heat for ORIGEN Calculations Used in the Surry UA Source: Wagner et al., 2020 The Surry and Sequoyah UAs show that the time in the cycle influenced the timing of the events in the accident sequence. Regressions were performed in the Surry UA on the timing to a hot leg creep rupture failure and the reactor vessel lower head failure (LHF), which occurred in all completed realizations.1 Both regressions identified the time in the fuel cycle (i.e., the ORIGENDay uncertainty parameter) as the most important parameter. Figure 5-3 shows the LHF timings as a function of the 14 sampled times in the cycle. There is a very large impact on the event timings for the first time in the cycle sample versus the other times in the cycle (i.e., the events occur much later due to the very low decay heat power). Similar to the trend for the integrated decay heat power (Figure 5-2), the subsequent times in the cycle show a smaller impact on the timings, which occurred more quickly as the cycle continued. In both the hot leg failure and LHF regressions, the time in the cycle was the most important parameter affecting the timing (e.g., contributing over 30 percent to the variation in the timing to these two events and 17 percent of the conjoint influence2) [NRC, 2022].

1 The Surry UA report [NRC, 2022] discusses the one outlying realization that did not have a hot leg failure.

2 The conjoint influence concerns two or more input parameters acting together. The conjoint influence may have synergistic effects that would not be uncovered by studying the influence of each parameter individually.

5-4 Figure 5-3 The Reactor Vessel Lower Head Timing as a Function of the Time in the Cycle in the Surry UA Source: Wagner et al., 2020 The Sequoyah UA only sampled three times in the cycle (i.e., BOC, MOC, and EOC). Figure 5-4 shows the selected time in the cycle parameter. Three points in the cycle are taken as representative times to constrain the problem. Using only three times in the cycle was criticized as too coarse in the Sequoyah UA, which led to the finer discretization in the Surry UA.

Figure 5-5 shows the Sequoyah decay heat curves as a function of decay time for variable operating time (in days) into the last day in cycle. The BOC sample (6.25 days) has significantly less decay versus the MOC sample at 200 days. As with the Surry UA, the decay heat power does not change significantly from the MOC to the EOC value at 529 days.

5-5 Figure 5-4 The Sequoyah UA Specifics for the Time in the Cycle Uncertainty Sampling Source: NRC, 2019 Figure 5-5 Variations in the Sequoyah Decay Heat Power as a Function of the Time in the Cycle Source: NRC, 2019 The Sequoyah BOC sample time (i.e., 6.25 days) occurred between the first two samples in the Surry UA (i.e., 0.5 and 25 days). The Surry UA showed no significant pressurization at 0.5 days but a containment pressurization to high containment pressure by 72 hr for a time in the cycle of BOC 69 Realizations MOC 300 Realizations EOC 231 Realizations Time (hr)

Decay power (MW) 0 10 20 30 40 50 60 70 80 5

10 15 20 25 30 550 d 529 d 400 d 300 d 200 d 100 d 60 d 30 d 10 d 6 d

5-6 25 days and greater (i.e., Figure 5-6 only shows the 0.5-day decay heat cases not pressurizing the containment). The Sequoyah BOC samples showed an observable containment pressurization but significantly less than the MOC and EOC results (see Figure 5-6).

Consequently, the Surry 0.5-day and the Sequoyah BOC results suggest the containment pressure responses are transitioning from almost no pressurization at 0.5 days to an observable pressurization at 6.25 days. By 25 days into the cycle, the Surry UA is showing a pressurization to containment failure before 72 hr. Many plant-specific factors affect the two containment responses, but these results provide qualitative insights into the duration of the early-burnup phase.

Figure 5-6 Sequoyah UA Containment Pressure Response Colored by the Time in the Cycle Source: NRC, 2019 The lower containment pressurization rate for BOC prevented long-term containment rupture before 72 hr.3 The BOC realizations would have eventually ruptured the containment if the simulations were extended well beyond 72 hr. Some MOC and EOC realizations also did not reach containment failure within 72 hr, which was primarily due to high sampled rupture pressures. Of the 567 realizations completed to 72 hr, the end-states of the containment included the following:

3 Sequoyah has a free-standing steel containment, consisting of a cylinder topped by a hemispherical dome.

The containment failure studies indicate that the containment would rupture due to an overpressurization near the large access penetration. Unlike the concrete-reinforced Surry containment, the tear would quickly depressurize the containment. A concrete-reinforced containment yields with increased leakage through the cracks in the concrete and tears in the internal steel liner.

5-7 4 realizations with early containment failures following the sudden pressurization of the first hydrogen burn 492 realizations that failed the containment between 36 hr and 72 hr after a gradual monotonic progression in pressure to rupture 71 realizations, including all of the BOC realizations, that did not fail containment by 72 hr4 The time in the cycle was identified as the most important parameter for in-vessel hydrogen production in the Surry UA. There is a trend for decreased hydrogen production as a function of the time in the cycle. The hydrogen production at 0.5 day time is significantly higher. The low decay heat power led to a slower progression of the accident and a protracted hydrogen-generation phase before significant core degradation. In contrast, the higher decay heat at later times in the cycle promoted a faster heatup through the fuel collapse with less complete oxidation. The impact is observable for a time in the cycle greater than 25 days but smaller than the significant variation from 0.5 day to 25 days. The highest in-vessel hydrogen production was 777 kilograms (kg), which occurred at 0.5 day into the fuel cycle and was over twice as large as the 310 kg median and 318 kg mean values.

The Surry and Sequoyah UAs also identified the time in the cycle as an important parameter for source term to the environment. In the Surry UA, the time in the cycle was the second most important parameter in the realizations without a C-SGTR, behind the fraction of elemental iodine gas in the gap for the total iodine release to the environment and behind containment design leakage rate for cesium release. Although the iodine reached secular equilibrium after approximately 50 days at cycle, the higher decay heat impacted the iodine release by accelerating the containment failure and increasing revaporization.

The time in the cycle was also the second most important regression parameter for the cesium release to the environment, behind the magnitude of the design leakage, in the Surry UA.

Somewhat surprising, the time in the cycle importance for cesium was lower than for iodine. The inventory of cesium nearly doubled from the start to the end of the cycle, which is not evident in the trend of released mass versus time in the cycle. The difference in the iodine and cesium response is largely attributed to transport physics. The cesium release is less susceptible to revaporization due to the low vapor pressure of its dominant chemical form (i.e., cesium molybdate [Cs2MoO4]).5 The cesium aerosols settle after their release to the containment, which largely occurs before the containment failure. Consequently, the cesium release to the environment is highly sensitive to the preexisting design leakage rate (i.e., the most important sampled variable). In contrast, the important iodine uncertain parameters include the amount of iodine gas and revaporized iodine gas that is less sensitive to the amount of the design leakage (i.e., the iodine gases will continue to be released well after the cesium aerosols have settled).

4 An early containment failure at BOC is judged possible but not encountered in the UA of 69 BOC realizations.

5 The less dominant form of cesium (i.e., cesium hydroxide) can chemisorb onto stainless steel and be retained in-vessel. The only significant example of the chemisorption behavior occurred in the Peach Bottom UA calculations with a delayed main steam line (MSL) failure [NRC, 2016]. Unlike a PWR, the hot gases with radionuclides exiting the core in a BWR flow directly into the stainless steel steam separators and dryers. The high surface areas of these stainless steel internals and the high temperature and pressure conditions in the Peach Bottom MSL failure accident progression contributed to higher levels of cesium chemisorption.

5-8 The time in the cycle is the most important parameter for the iodine release and the second most important parameter for the cesium release to the environment in the Sequoyah UA. The discretization of the Sequoyah UA results is more limited and biased due to only three time in the cycle samples and no containment failure with BOC sample, respectively. However, the Sequoyah UA MOC and EOC realizations showed the same trends observed in the Surry UA.

Figure 5-7 shows an example of the results, in this case the iodine fraction released versus the time in the cycle for the Sequoyah UA6 [NRC, 2019].

Figure 5-7 Scatterplot of Iodine Fraction Released Versus the Time in the Cycle in the Sequoyah UA 5.1.2 Implications for Other Plants The Surry and Sequoyah UAs included variability of the accident time during the fuel cycle, which was not explored in the Peach Bottom UA. The uncertainty revealed large variations in the radionuclide inventories and decay heats from BOC to EOC. Relative to the timing of the accident progression, the earliest sampled times in cycle had significantly different behavior until the increase in inventories of shorter lived isotopes reached a secular equilibrium. An interpretation using the Surry and Sequoyah results suggests this occurs after 25 days. The accident progression near the full-power startup after refueling (i.e., the Surry UA sampled at 0.5 day) showed particularly slow developing behavior that did not progress to a containment overpressure failure. This behavior is expected to be generally consistent for other PWRs and BWRs.

The integrated decay heat power rises rapidly through 100 days at cycle but slowly thereafter.

The regressions of the key accident event timings show a correlation of the time in the cycle to 6

The Sequoyah UA reported the iodine and cesium released to the environment as a fraction of the initial inventory and therefore does not include the variation of the mass over the cycle.

5-9 accelerating the accident progression, including hot leg failure, reactor vessel lower head failure, and containment failure. The correlation of these items to a BWR would be the timing to a thermal failure of the SRV, reactor LHF, and containment failure.7 The insights on the accident progression timing as a function of the time in the cycle are qualitatively applicable to all plants.

The Surry UA identified the time in the cycle as the most important parameter for in-vessel hydrogen production. The in-vessel hydrogen production is very important for early challenges to containment integrity. The higher quantity of hydrogen at earlier times in the cycle with lower decay heat is expected to be applicable to all plants. As the cycle progresses, the increasing decay heat power with more time in the cycle accelerates the accident progression through the fuel collapse, which limits the in-vessel hydrogen production. The same trend will be applicable to other plants. For example, the time in cycle was the second most important parameter for the amount of hydrogen vented to the containment before hot leg failure, as shown in the Sequoyah UA-focused SRV study (see Section 5.2.2 and Appendix I to NUREG-7245 [NRC, 2019]). The amount of hydrogen vented to the containment is directly related to the higher amount of in-vessel hydrogen production. Although the Peach Bottom UA did not vary the time in the cycle, the trends observed in the PWR UAs are also expected to show a high importance in BWRs (i.e., the quantities of the in-vessel hydrogen production and fuel collapse timing versus decay heat levels have similarities).

The time in the cycle also had an important impact on the source term. The variations of the iodine and cesium radionuclides shown in Figure 5-1 illustrate important differences of the inventories where short-lived isotopes (e.g., I-131) reach a secular equilibrium while longer lived isotopes grow throughout the cycle. However, somewhat surprisingly, the time in the cycle was more important to the iodine release to the environment in both the Surry and Sequoyah UAs than for the cesium release to the environment. The differences were attributed to an increased mobility (i.e., revaporization) and release of the iodine as a function of the decay heat. The qualitative implications for other plants are expected to be the same but quantitatively affected by plant-specific containment leakage and failure attributes.

5.2 Safety Valve Failures Following the loss of power in an SBO scenario without DC power, passive spring-operated SVs open to prevent overpressurization.8 This includes PWR pressurizer SVs, the PWR secondary system SVs, and BWR SRVs. Valve failures have occurred during operations that are recorded in the utilitys licensee event reports (LERs) to the NRC and in NUREG/CR-7037, Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007, issued March 2011 [NRC, 2011]. All three UAs found the failure modeling of the SVs to be very important in the accident progression. In the Peach Bottom UA, the effect was notable on determining whether an MSL creep rupture occurs, which bypasses the benefits of wetwell scrubbing. In the Sequoyah UA, the effect was notable on the in-vessel hydrogen release to the containment and its potential for causing an early containment failure. In the Surry UA, the effect was notable on whether a C-SGTR containment bypass event occurs.

7 The mode of containment failure in the Peach Bottom UA was a liner melt-through, which followed the reactor lower head failure. Consequently, the containment failure timing is related to the decay heat power that leads to the vessel lower head failure, whereas the ex-vessel debris spreading and liner failure include other physics in addition to the decay heat power (e.g., quenching, heat transfer, and chemical reactions).

8 The UAs did not credit the operation of the power-operated relief valves.

5-10 5.2.1 Safety Valve Failure-to-Close Modeling Insights The following discussion describes the insights and approach to modeling PWR SV failures.

While SV behavior was important in all three SOARCA UAs, there are sparse data and a lack of established expert consensus on how best to model the valve failure rates under severe accident conditions. Some operational data exist on SV failure to close (FTC) during nonsevere accident conditions (i.e., main steam SVs following scram events). However, the data are not under the exact conditions that the SVs would experience in the SBO scenarios. SV performance is clearly important in an SBO, yet the basis for a more confident modeling of the uncertainties in SV behavior is currently lacking. The SOARCA UA analyses attempt to address the lack of applicable data (with respect to both failure rates and failure mechanisms) on SV FTC in a reasonable way that has been positively reviewed by experts outside the team [Ghosh et al., 2017].

Insights on pressurized-water reactor safety valve failure The stochastic valve failure area was updated following an ACRS review after completion of the draft Sequoyah UA. The draft version of the Sequoyah UA used different assumptions for primary SV failure attributes [NRC, 2016b]. The ACRS questioned the modeling of an equal likelihood of failure from 1 percent to 100 percent open and recommended discussions with valve experts. SNL contacted nuclear valve testing personnel and examined LERs with reported SV failures. The following conclusions and changes were made to the PWR SV modeling (i.e., applied to the final Surry and Sequoyah UAs):

An SV FTC is most likely on the initial demand.

If an SV functioned according to design on the initial demand, it would most likely function on all subsequent demands.

SVs that fail to close are most likely to fail in either a weeping (i.e., mostly closed) or a mostly open position.

The probability per demand of a valve experiencing an FTO is sufficiently small compared to the FTC that FTO may be neglected.

A valve is more likely to fail if cold water rather than saturated water flows through the valve.

Applying MSL SV operational data to pressurizer SVs is acceptable due to the lack of pressurizer SV operational data.9 Based on these insights, the SV FTC was modified to emphasize mostly closed and mostly open failure area distributions. There was no further consideration of FTO and failure due to flowing water.10 9

NUREG/CR-7037 noted that, although main steam system (MSS) and RCS SVs are similar, the SV testers found that the pressurizer and main steam SVs had characteristic physical and maintenance differences.

10 The SV failure following water flow was essentially eliminated after the Electric Power Research Institute (EPRI) analyzed the events and issued recommendations to prevent standing, cold water upstream of the SVs.

5-11 Technical rationale for the pressurized-water reactor safety valve failure-to-close distribution NUREG/CR-7037 [NRC, 2011] informed the uncertainty characterization of stochastic SV failure. NUREG/CR-7037 (Table 20) reports on SV operation subsequent to actual scram events. It includes information for both the MSS SVs on the secondary side of the SGs and the RCS SVs on the pressurizer. The UAs assumed that the MSS data were most representative of valve failure during severe accident scenarios. NUREG/CR-7037 notes that the MSS and the pressurizer SVs are similar. Inquiries to SV testers revealed that these valves are similar but not identical in that there are some physical and maintenance differences. While the MSS and pressurizer SVs differ, they are similar enough that, in weighing the difference between the valves against the lack of operational data on the pressurizer SVs, it was judged a more defensible basis to rely on the MSS operational data for the pressurizer SVs as well.

Only valve responses to actual scram events were considered. The data from valve testing reported in NUREG/CR-7037 were not considered. NUREG/CR-7037 (Table 22) reports on failure rates in SV testing, but the rates differ markedly from the rates evidenced by actual plant events, suggesting that aspects of the testing were inconsistent with actual conditions experienced by an installed valve. To better understand the differences, the SNL project team made inquiries on valve testing and testing requirements. The testing is only required to demonstrate whether the valves will unseat at design pressures to relieve pressure during an overpressure event. The testing does not fully stroke an SV at pressure like an actual demand would. In fact, no testing facility in the United States has the flow capacity to fully stroke an SV.

This UA report did not consider the testing data applicable.

The data from actual scram events typically include a single SV cycle, so there may be some limitation in extrapolating to repeated valve cycles during a severe accident. Although the number of occurrences were limited, the actual plant events were judged as the best data source. The data have sufficient resolution to separate them into two groups. The first group consists of all of the initial demands and the number of valve failures on initial demand. No valves failed after the initial demand, so the second group consists of the number of cases in which a subsequent demand occurred. This separation of the data suggests two separate failure probability distributions: one for the probability of failure on the initial demand and another for the probability of failure on subsequent demands.

Description of the pressurized-water reactor safety valve failure-to-close distribution A beta-binomial distribution was used to model cycles until an FTC event. The sampling from this model was extended to include uncertainty in cycles to failure. For the FTC on the initial demand, the model consists of a beta distribution on the probability of an FTC event on initial demand and a binomial distribution on the cycles to failure. Similarly, for FTC on subsequent demand, the model consists of a beta distribution on the probability of an FTC event on subsequent demand and a negative binomial distribution on the subsequent cycles to failure.

Hence, both for failure on the initial demand and failure on the subsequent demand, the beta-binomial model facilitates two-stage sampling that incorporates both uncertainty in the probability of valve FTC-on-demand, and in the cycles to failure experienced by a valve given that probability of failure. The beta distributions used the data from NUREG/CR-7037 to refine a Jeffreys uninformed beta distribution, which is commonly used as a prior distribution in Bayesian analysis with limited data [Zhu and Lu, 2004].

5-12 Description of the boiling-water reactor safety valve failure-to-close distribution The BWR SRV construction is different from PWR SVs and monitored separately from the PWR SVs in NUREG/CR-7037 [NRC, 2011]. The operating mode of interest during an SBO is the pressure mode, where the SRVs are actuated using a pilot sensing port that is internal to the valve (not the air actuator). However, the failure rate reflected in NUREG/CR-7037 is conceptually different from the situation modeled in an LTSBO. The historical failure events occurred after only a few valve cycles, although the precise number is difficult to determine from the available information in the LER (i.e., not reported). The failure rate after numerous cycles is nonexistent because events involving numerous valve cycles are not observed. The conclusion was that other unknown failure mechanisms would likely overwhelm those that lay behind the nominal failure rate. The FTC beta distribution for the Peach Bottom UA was ultimately developed from consideration of these uncertainties. The beta distribution from the utilitys individual plant examination covers the range of values that are needed to define the parametric relationship between the probability that the SRV will fail to close and the modeled severe accident [NRC, 2013].

Summary of failure-to-close findings In summary, the historical PWR SV FTC data suggested a lower likelihood of a valve failure after the first cycle, which was incorporated into the PWR UAs. The PWR FTC area is biased to weeping (i.e., mainly closed) and mainly open failure areas, which is also judged applicable to BWR SRVs. However, the Peach Bottom UA data did not include the complication of first and subsequent FTC distributions or the biases on failure areas. The Peach Bottom UA did incorporate uncertainty from other unknown mechanisms involving numerous, continuous valve cycling.

Consequently, the SV or SRV FTC frequency conceptually consists of separate failure rates for the first valve demand, a short-term number of cycles, and long-term cycling. However, the historical data are very sparse to accurately quantify these parameters. Furthermore, the test data were judged inappropriate due to the lack of a prototypical full valve cycle and discrepancy with the historical rate of occurrences. Consequently, the valve FTC remains as having significant uncertainty and high importance (see Sections 5.2.2 and 5.2.3), which warrants its inclusion in characterizing the range of possible severe accident progressions.

The BWR SRVs also experience high thermal stresses during core degradation. The Peach Bottom UA included the thermal failure of a BWR SRV, which is further discussed in Section 5.2.2.

5.2.2 Peach Bottom Boiling-Water Reactor Analysis Insights In the Peach Bottom UA, the valve response strongly affected the magnitude and timing of fission product releases to the environment. Whether an SRV sticks open before or after the start of core damage had a significant impact on the magnitude of the source term (i.e., the magnitude of cesium and iodine releases to the environment) and whether an MSL creep rupture occurs.

Every Peach Bottom UA calculation experienced a failed SRV, which could be divided into three outcomes representing a distinct mode of venting the reactor pressure vessel (RPV) during much of the core degradation. The three groups are (1) an SRV stochastic failure for approximately 50 percent of the realizations, (2) an SRV thermal failure without MSL creep

5-13 rupture representing about 33 percent of the realizations, and (3) an SRV thermal failure with MSL creep rupture for the remaining 17 percent of the realizations. These parameters are significant because their values strongly influence the releases of iodine and cesium to the environment.

One of the most important parameters, both for the amount of radionuclide release and hydrogen production, is the uncertainty in the frequency of the SRV stochastic FTC. It has a strong negative monotonic influence (indicating that fewer cycles before failure lead to higher releases). A longer period of SRV valve cycling will cause a thermal seizure of the SRV and potential MSL creep rupture, which ultimately leads to a larger source term release to the environment. Other regression techniques indicate that it also has nonmonotonic and conjoint influence. The conjoint influence is partly shared with the SRV open area fraction after thermal seizure. If the SRV thermal failure area is small, the failed valve relieves steam more slowly with higher protracted pressures. The higher pressures result in elevated stresses in the MSL piping, which combine with elevated temperatures to accumulate creep damage over time that can lead to an MSL rupture. Combined, these parameters control the type of failure (SRV stochastic, SRV thermal seizure, or SRV thermal seizure with MSL creep rupture). The importance of failure mode is visible in Figure 5-8, which shows cesium release curves color coded by the type of failure experienced in each realization.

Figure 5-8 Cesium Environmental Release Fraction as a Function of Valve Failure Mode for the Peach Bottom UA Source: NRC, 2016 A sensitivity study was carried out to determine the effect of manual operation of the SRV. The study varied the manual opening time of a single SRV. To depressurize the reactor vessel in a

5-14 controlled manner, operators can manually open an SRV. The station emergency procedures describe the emergency depressurization action to prevent excessive cycling of the SRVs

[NRC, 2016]. The UA calculations include this operation action at 1.0 hr after the initiating event following discussions with plant staff. Four sensitivity variations on SRV operation considered opening at 0.5 hr, 2.0 hr, and 3.0 hr and not opening.

There was very little impact in the timings of key events between the 1.0 hr, 2.0 hr, 3.0 hr, and no operator actions. This showed the timing of the operator action or the lack of an operator action did not significantly impact the timing of the severe accident progression. The 0.5 hr differed from the other cases because the operator did not maintain adequate steam pressure for the reactor core isolation cooling (RCIC) system. The impact on any other SRV manual opening strategy would be similar if it inadvertently disabled RCIC.

Although the timings were not impacted, the probability of an SRV FTC rises with increasing delays to implement manual control of the SRV to stop valve cycling. Each of the sensitivity calculations used the same failure cycle specifications (i.e., 270 cycles to FTC) and therefore experienced earlier stochastic failures of the SRV due to a fast accumulation of SRV cycles as the manual operator action is delayed. The calculation with no operator actions predicted 4.6 hr to a stochastic failure of the SRV, whereas the 1, 2, and 3-hr cases were 8.2, 7.9, and 7.5 hr, respectively.

Similarly, the various manual SRV actions or lack of an action had a relatively small impact on the source term to the environment. All cases showed a similar cesium release to the environment. However, the case without any operator actions had a higher iodine release attributed to higher in-vessel revaporization. The timing of the reactor depressurization due to an SRV FTC relative to the loss injection impacted the magnitude of the in-vessel iodine deposition available as a late-phase revaporization source. The small iodine source term differences were judged not significant within the variability of the other in-vessel accident progression uncertainties that could be considered for this comparison.

5.2.3 Surry and Sequoyah Pressurized-Water Reactor Analysis Insights The Surry and Sequoyah UAs included stochastic SV FTC on the MSS and pressurizer SVs.

The two studies used the same FTC distributions and associated failure areas. Each valve had randomly selected failure cycles and failure areas. The two UAs illustrated different insights and have different ramifications based on the containment design. Unlike the BWRs, neither PWR UA showed any significant potential for a thermal failure of SVs. Consequently, the valve failures were limited to stochastic failures.

The Surry UA showed some key impacts from SV failures: (1) increased mechanic stress for a C-SGTR, (2) reduced stress for a hot leg failure, and (3) an increased radionuclide inventory discharged to the pressurizer relief tank (PRT), which may subsequently revaporize. However, the most likely outcome was normally operating MSS and pressurizer SVs. The MSS and pressurizer FTC parameters have the greatest impact on the potential for C-SGTRs if an MSS SV FTC occurs before core damage, and the associated heatup of the SG tube and a pressurizer SV FTC does not occur (i.e., maximum differential pressure across the tubes).

5-15 Main steam system valve failure influence on consequential steam generator tube ruptures The MSS SVs only cycled until the water inventory in the SGs was vented away. The SGs subsequently depressurized due to MSL leakage, which stopped further cycling. The maximum number of MSS SV cycles was less than 130 cycles. Consequently, only sampled FTC failures within this range could possibly fail. Table 5-1 shows the MSS SV FTC results for the Surry UA.

For the 1,147 realizations included in the UA statistics, an MSS SV FTC occurred about 10 percent of the time on each SG. The regressions showed decreased strain of the SG tubes as a function of the number of MSS SV cycles. However, due to MSL leakage that also depressurized the SG, the MSS FTC cycle parameter only accounted for less than 1 percent of the strain evaluation (i.e., the creep rupture index). For example, the sampled parameter for the MSL sampled leakage accounted for more than 12 percent of the unflawed SG tube strain evaluation.11 Table 5-1 MSS SV FTC Statistics in Surry UA MSL A MSL B MSL C FTC occurrences 116 127 130 Mean cycles to FTC 26 26 23 Median cycles to FTC 24.5 19 15 Min cycles to FTC 1

1 1

Max cycles to FTC 102 93 92 Mean FTC open fraction 0.325 0.380 0.398 Median FTC open fraction 0.087 0.181 0.176 Mean time of FTC (hr) 0.617 0.644 0.490 Median time of FTC (hr) 0.563 0.537 0.309 Earliest FTC time (hr) 0.042 0.043 0.040 Latest FTC time (hr) 1.827 4.350 1.507 Source: Wagner et al., 2020 Impact of the leakage from the main steam isolation valve While not a valve failure, the leakage past the PWR main steam isolation valves (MSIVs) or other isolating systems on the MSS can increase the mechanical stress across the SG tubes and contribute to a C-SGTR. PWRs do not have regulatory requirements to maintain MSIV leakage below a technical specification. However, the BWRs do have technical specifications and are often challenged to meet their technical specification limits. MSIV leakage and an MSS FTC are two mechanisms that can depressurize the SG. The resulting larger pressure difference between the primary and the secondary system increases the stress across the SG tubes and increases the likelihood of their failure. Furthermore, a C-SGTR, along with the MSIV leakage, provides a release path for radionuclides to bypass containment and reach the environment.

To inform the uncertainty range for MSIV leakage, it was desirable to have the technical specification for a PWR. An in-depth search included checking the final safety analysis report 11 The best regressions for the MSS and RCS FTC parameters assessed the strain on an unflawed tube. The regressions for tubes with flaws were overwhelmed by the flaw depth. The unflawed regression was only performed for the hottest region of the thermal plume entering the SG, which was overwhelmed by an uncertainty parameter on the plume temperature. The MSL leakage, the MSS and RCS FTC parameters, and the pump seal leakage are the next most important influencing parameters.

5-16 and plant data book for Surry, a search of licensee testing reports, and a discussion with a former PWR operator who is now with the NRC. Although the PWR MSIV performance is controlled by technical specifications for closure timing, there is no requirement for leak-tightness. No direct information was obtained for measured leakage of PWR MSIVs.

Several sources provided guidance for the PWR leakage, including technical specifications for BWR MSIV leakage, BWR LERs concerning MSIVs, and PWR LERs concerning MSIVs [NRC, 2022]. Parametric MELCOR calculations were also performed to examine the secondary depressurization rate for a range of leak sizes. The hot leg failure of the RCS occurs at about 4 hr in the Surry STSBO without any SV FTC. Consequently, the secondary pressure at 4 hr has the most significance in the competition between a hot leg failure and an SG tube failure.

After the hot leg failure, the primary system depressurizes, and there is no more threat of a tube rupture. Figure 5-9 shows that leakages less than 0.025 in.2 do not show any significant depressurization within 4 hr, whereas a leak of 0.2 in.2 or greater depressurizes the secondary below 1 megapascal by 4 hr. To put the BWR technical specification into perspective, 0.1 in.2 and 0.5 in.2 leakages correspond to approximately 4,600 and 23,000 standard cubic feet per hour (scfh), respectively, which is very large compared to the original BWR12 technical specification of 11.5 scfh. However, the value required by BWR technical specifications is offset by the lack of required testing for PWRs and the large number of PWR LERs with MSIV issues.13 The Surry UA sampled variable MSIV leakage from 0.01 in.2 to 1 in.2 using a uniform distribution.

In summary, a key insight is that MSIV leakage can be as effective as MSS SV FTC. In the regressions on the creep magnitude for an ideal tube in the peak temperature region, the MSIV leakage was the second most important parameter behind the peak temperature of the plume entering the SG. Although not evaluated, the most important parameter affecting the magnitude of the creep accumulation in hot, upflow, and cold regions of the SG is expected to be the magnitude of the MSIV leakage (i.e., the peak hot plume temperature parameter is not used in these bulk regions).

12 Modern-day allowed BWR MSIV leakages are larger by an order of magnitude or more [NRC, 2021].

13 The size, design, and function of the PWR MSIV are judged to be similar to the BWR MSIV.

5-17 Figure 5-9 Steam Generator Pressure as a Function of MSIV Leakage Size in the Surry UA Source: Wagner et al., 2020 Pressurizer valve failure influence on consequential steam generator tube ruptures Similarly, the pressurizer SVs only cycled until a hot leg failure, which occurred after the primary system was vented away. The maximum number of pressurizer SV cycles was generally bounded due to the consequences of the inventory loss out of the vessel (i.e., typically less than 70 cycles14). Consequently, only sampled FTCs within this range could fail. Table 5-2 shows the Surry UA pressurizer SV FTC results. For the 1,147 realizations included in the UA statistics, a pressurizer SV FTC occurred 120 times or about 10 percent. In 10 realizations, 2 SVs failed to close. The regressions showed increased strain of the SG tubes as a function of the number of pressurizer SV cycles. However, the pressurizer SV FTC cycle did not appear as a significant contributor to the strain evaluation for the creep rupture index.11 Figure 5-10 shows that most of the tube ruptures occurred when there were 50 or more pressurizer SV cycles. Furthermore, the failed SV leakage area was always less than about 10 percent of the SV flow area. These two 14 The maximum number of SV cycles was dependent on the time in cycle and the magnitude of the pump seal leakage. It was typically less than 70 cycles. The SVs open to release steam, and then later hydrogen, out of the primary system. At approximately 70 cycles, the core has transitioned to a high-temperature, degrading state. The high-temperature gases exiting the core caused a hot leg failure under these conditions, which depressurized the primary system and prevented any further SV cycling. The cycle count was slightly higher for the earliest BOC realizations due to the very low decay heat power and slower core degradation (e.g., the Sequoyah BOC realizations).

3 sq. in 1 sq. in 0.3 sq. in 0.2 sq. in 0.1 sq. in 0.075 sq. in 0.025 sq. in 0.01 sq. in 3 sq. in 1 sq. in 0.3 sq. in 0.2 sq. in 0.1 sq. in 0.075 sq. in 0.05 sq in.

0.025 sq. in 0.01 sq. in 0

1 2

3 4

5 6

7 8

0 1

2 3

4 5

6 7

8 SGA Pressure (MPa)

Time (h)

5-18 factors contributed to keeping the primary system pressure high to increase stress across the SG tubes.

Table 5-2 Pressurizer SV FTC Statistics in Surry UA SV-1 SV-2 SV-3 FTC occurrences 120 10 0

Mean cycles to FTC 17.667 5.800 Median cycles to FTC 11 5.5 Min cycles to FTC 1

1 Max cycles to FTC 63 15 Mean FTC open fraction 0.384 0.661 Median FTC open fraction 0.092 0.773 Mean time of FTC (hr) 2.468 2.512 Median time of FTC (hr) 2.204 2.295 Earliest FTC time (hr) 1.876 2.042 Latest FTC time (hr) 4.122 3.728 Source: Wagner et al., 2020 Figure 5-10 Aggregate Pressurizer SV Cycles and End-State Open Fraction Source: Wagner et al., 2020 Large pressurizer valve failure areas delaying or preventing a reactor coolant system hot leg failure There was only one realization without a creep rupture failure of the hot leg during core degradation. The realization had an FTC that occurred at an optimum time with a large failure area. The optimum time occurred near the start of the core degradation that led to accumulator water injection while the system depressurized. The core degradation transitioned into a

5-19 collapse onto the lower head and its subsequent failure. An earlier SV FTC did not promote a protracted accumulator injection during the critical core-damage phase. All other combinations of SV FTC and valve failure area resulted in sufficient thermal-mechanical stress to fail the hot leg.

Small pressurizer valve failure areas accelerating hot leg failure The earliest rupture of a hot leg nozzle in the UA occurred with a pressurizer FTC of the lowest set point pressurizer SV on the first cycle but with the valve leaving a small 0.096 fraction open.

While these aspects served to reduce RCS pressure and hence the stress on the hot leg nozzles, they more importantly leaked RCS coolant relatively rapidly. The rapid loss of coolant resulted in a relatively early overheating of the fuel rods, and the open SV kept a continuous flow of hot gas moving through the loop C hot leg nozzle. The creep damage accumulation in the nozzle started early and proceeded steadily until the nozzle ruptured earlier than in any other calculation in the UA.

Valve failures leading to a cesium vapor source from the pressurizer relief tank The PRT was a location of substantial deposition and retention of fission products in both the PWR UA calculations. The degree of fission product retention in the tank was strongly influenced by whether the tank boiled dry. In all but 2 of the 56 realizations in the Surry UA that experienced an FTC of a pressurizer SV in a substantially open position (greater than 0.36 open area fraction), the PRT boiled dry (see Figure 5-11Figure ). The zero values in this figure indicate no valve failure (i.e., the pressurizer SVs operated per design). The decay heat in the retained fission products boiled the PRT dry. In the case of a stuck-open SV, more fission products were vented to the PRT.

Figure 5-11 Time of PRT Boiling Dry Versus Pressurizer SV FTC Open Fraction in Surry UA Source: Wagner et al., 2020 0

10 20 30 40 50 60 70 0

0.2 0.4 0.6 0.8 1

1.2 Boiled dry time (hr)

SV open fraction after FTC PRT boil dry time vs SV frac (all Rlzs)

5-20 There is dramatic heating inside the tank following the water boiloff. Figure 5-12 shows the corresponding history of the three chemical forms of cesium resident in the tank. Note the large steep decreases of the quantities of cesium hydroxide (CsOH) and cesium iodide (CsI) that occur when the tank heats and vaporizes the previously settled retained cesium compounds.

The venting reduces the fission product decay power in the tank, which subsequently drops in temperature and ends the vaporization. All the cesium molybdate is retained in the tank due to its lower volatility. Although cesium hydroxide is the most volatile cesium compound in the PRT, the remaining amount chemisorbed from cesium hydroxide into the steel of the tank. A key modeling enhancement for the Surry UA included multiple heat structures on the PRT that separated regions for radionuclide settling after the pool evaporates versus the sides and the top of the tank.

Figure 5-12 Example of Cesium Revaporization Following PRT Dryout in Surry UA Source: Wagner et al., 2020 The behavior of revaporized cesium from the PRT can be important to the environmental source term. It is a source of hot radionuclide vapors that will condense to form small, airborne aerosols in the containment atmosphere. The small aerosols are susceptible to release to the environment due to design leakage and through the containment failure. However, the timing of the large cesium source following the PRT dryout occurs in the well before containment liner failure (see Table 5-3), which allows significant time for aerosol settling. Consequently, the PRT vapor source is most important if the prefailure (design) leakage is high.

5-21 Table 5-3 Comparison of PRT Dryout and Containment Liner Failure Statistics in Surry UA Statistical Measure PRT Dryout Time (Hr)

Containment Liner Failure Time (Hr)

Mean 12.712 50.785 Median 10.116 50.058 Min 7.373 34.489 Max 66.212 71.915 Source: Wagner et al., 2020 5.2.4 Applicability to Other Plants The MSS and pressurizer SV failures had significant impacts on all three UAs. The UA analyses identified SV FTC as the key or one of the key uncertain parameters increasing the source term.

An SV FTC changes the course of the accident. As noted in Section 5.2.1, there are sparse data and a lack of established expert consensus on how best to model the failure rates under severe accident conditions. Nevertheless, the stochastic occurrence of a valve FTC is noted in plant LERs. Furthermore, the high-temperature conditions at BWR SRVs during a severe accident also strongly indicate thermal failure modes for BWRs. Although there is significant uncertainty in the FTC distributions and their associated failure flow areas, the possibility of these scenario-altering failures is a significant finding from the UAs.

Boiling-water reactor accident progression insights All BWRs in the United States are designed by General Electric, although their size, safety system configuration, and containment design can vary significantly. In particular, there are several types of BWR SVs. NUREG/CR-7037 [NRC, 2011] found that BWRs use code SVs, direct-acting SRVs, and pilot-actuated SRVs. The SRVs include a pressure mode where they function as a code SV. Furthermore, the pilot-actuated SRVs have three configurations.

Peach Bottom uses three-stage Target Rock SRVs. However, the assessment for their stochastic FTC relied on generic data for all BWR SRVs. Consequently, the FTC distributions are judged to be applicable within the previously mentioned caveats on sparse data in accident conditions.

The thermal SRV FTC criteria and the corresponding failure area also have uncertainties, which the Peach Bottom UA explored within the current understanding of their failure characteristics.

The location of the SRVs in all BWRs is similar and would flow very hot gases during a severe accident core degradation as simulated in the UA. However, the response of the valve components to flowing high-temperature gas depends on the valve design and operation. For example, different thermal failure criteria were developed for the Grand Gulf Nuclear Station (Grand Gulf) (a similar BWR in the U.S. fleet) and Peach Bottom MELCOR models because the plants have different types of SRVs [NRC, 2013].

The three-stage Target Rock SRVs are pilot operated, and they fully open when the pressure exceeds the setpoint and fully close when the pressure decreases below the closing set pressure. The movement of the valve disc is controlled by a pilot valve, which realigns the internal gas pressure in the valve, allowing the RPV pressure to the valve to be closed up to the opening pressure and open until the closing pressure. The Dikkers SRVs in the Grand Gulf plant are spring-loaded valves that pop open at the relief pressure and gradually close as the pressure decreases. Consequently, the modeling and insights on the thermal SRV failures are

5-22 expected to vary. The thermal SRV failure challenge is expected for all BWRs, but the resulting leakage area and failure criteria will have differences.

Overall, the Peach Bottom SRV failure insights are expected to have qualitative applicability to all BWRs. The stochastic and thermal failure characteristics are expected to be similar. The associated thermal challenges to the MSL are also expected to be applicable.

The impact of the source term from the various SRV and MSL failures is not expected to be generally applicable. All the Peach Bottom UA calculations include a liner melt-through shortly after the vessel failure. The timing and mode of containment failure for the Peach Bottom Mark I containment are different than expected for the BWR Mark III containment and the various designs of the BWR Mark II containments.15 Consequently, the holdup and eventual release of radionuclides will be substantially different and not follow the characteristic cesium release insights observed in Figure 5-8. However, the responses of the other Mark I containments are expected to be similar with some variations in the timing of the liner melt-through due to the sump size and drywell wall and floor characteristics [Wagner et al., 2020].

Boiling-water reactor Mark III overpressure insights Similar to the PWR ice condenser containment, the BWR Mark III containment is relatively small and not inerted. It is qualitatively expected to also be challenged by hydrogen burns following a collection of hydrogen in the containment from an SRV FTC. The steam-reducing effects of the wetwell pool will increase combustibility and the flame speed in a manner similar to the ice condenser chests. However, the containment ignition sources for a BWR Mark III containment will differ from those for a PWR (e.g., no hot gases exiting a PRT and no hot leg failure). Similar to the ice condenser design, the ex-vessel debris is expected to be an important ignition source in an unmitigated BWR Mark III loss-of-power sequence [Wagner et al., 2020].

Pressurized-water reactor general consequential steam generator tube rupture and accident progression insights All PWRs include pressurizer and MSS SVs. In scenarios with a loss of power like the SBOs in the Surry and Sequoyah UAs, the MSS and pressurizer SVs will cycle to release steam and prevent an overpressurization of the secondary system. With respect to the uncertainty of their failure characteristics, the SV FTC characteristics used in the PWR UAs are judged representative of other PWRs in the United States. The quantitative insights are dependent on many plant-specific factors that limit their direct applicability. However, the following qualitative insights are applicable:

An MSS SV FTC weakly increases C-SGTR occurrences.

A pressurizer SV FTC with a large failure area can prevent a C-SGTR, whereas no FTC or an FTC with a small failure area promotes a C-SGTR.

A pressurizer SV FTC with a large failure area can delay or prevent hot leg failure.

15 The Mark II containments had four different architectural engineering firms and have significant differences in the reactor pedestal and drywell floor design [NRC, 1990].

5-23 A pressurizer SV FTC can concentrate radionuclides in the PRT that may promote their late revaporization.

Reactors with a Babcock and Wilcox (B&W) design for nuclear steam supply systems (NSSSs) use once-through SGs that are less susceptible to hot natural circulation flows from the core flowing through the SG. Although the insights above increase mechanical stress (i.e., higher differential pressure) across the SG tubes, the B&W NSSSs do not experience the same thermal stresses as Westinghouse and Combustion Engineering (CE) NSSS designs.

Consequently, the B&W plants are less susceptible to a C-SGTR. However, the higher radionuclide loading to the PRT following a pressurizer FTC is common across all PWR designs

[Wagner et al., 2020].

Pressurized-water reactor ice condenser overpressure insights The Sequoyah UA results show a dependence on a pressurizer SV FTC promoting a large deflagration that could fail the containment. However, a key insight from the Sequoyah UA is that an early containment failure was very unlikely within the constraints of the study (e.g., uncertain parameters and ranges, ignition assumptions, and containment design). The 10 ice condenser plants operating in the United States are similar but not identical. All 10 ice condenser NSSSs are large four-loop Westinghouse designs of similar power ratings and containment sizes. Eight of the 10 reactors have free-standing steel containments like Sequoyah. However, the two ice condenser units at the Donald C. Cook Nuclear Plant (D.C. Cook) in Michigan have steel-reinforced concrete containments (i.e., similar to Surry). The qualitative insights that large hydrogen deflagrations challenge the containment overpressure limits following a pressurizer FTC will be applicable to other ice condenser plant designs, with the possible exception of the D.C. Cook plant. The quantitative evaluation of that challenge includes the uncertainty in the hydrogen pressurization as well as the specific geometry and pressure ratings of the containment. However, the impact of the design variations of the eight ice condensers with a free-standing steel containment is expected to be smaller than the severe accident uncertainties, which should make the low likelihood of an overpressure challenge applicable [Wagner et al., 2020].

5.3 Consequential Steam Generator Tube Rupture Only the Surry UA evaluated STSBO-induced C-SGTRs. The consequential response is due to hot thermal plumes generated during the core degradation circulating to the SG and failing the tubes. While C-SGTRs would also be expected in the Sequoyah plant, the Sequoyah UA did not include the uncertainty parameter additions and additional modeling needed to predict C-SGTRs. BWRs do not have SGs, so the issue is only applicable to PWRs.

5.3.1 Modeling The Surry UA includes additional modeling to predict when an SGTR may be induced by evolving conditions in the unmitigated STSBO scenario. Similar to the Sequoyah PWR model, the Surry model includes in-vessel, hot leg, and SG natural circulation modeling. Natural circulation flows can occur in all three regions that transfer heat from the hottest regions of the core to a hot leg and the SGs (see Figure 5-13). As a special modeling addition for the Surry UA, a separate effects SG inlet model was imbedded in the model to predict the response from the peak temperature of the gas entering the SG. The separate effects model uses boundary conditions from the full plant model to specify the peak plume temperature entering the SG. The magnitude of the natural circulation flows and peak hot plume temperature modeling is guided

5-24 by detailed computational fluid dynamics (CFD) work [NRC, 2010]. Furthermore, the peak plume temperature is an uncertain parameter derived from the variability observed in the CFD analyses. Finally, the Surry model includes a sampled flaw distribution in the cold, hot, and peak plume temperature regions of the three SGs. Creep rupture evaluations were performed to evaluate the potential for the failure of flawed and unflawed tubes in the three regions [Wagner et al., 2020].

Figure 5-13 CFD Simulation of Hot Natural Circulation Flows from the Vessel to the Steam Generator Source: NRC, 2010 Evaluation of steam generator tube flaws The flaw size and frequency are guided by NRC research on consequential tube ruptures (i.e., NUREG-2195, Consequential SGTR Analysis for Westinghouse and Combustion Engineering Plants with Thermally Treated Alloy 600 and 690 Steam Generator Tubes, issued May 2018 [NRC, 2018]), and historical Surry inservice inspection (ISI) reports (e.g., NUREG-1771, U.S. Operating Experience with Thermally Treated Alloy 600 Steam Generator Tubes, issued April 2003 [NRC 2003], and NUREG-2195 [NRC 2018]). Surry adopted industry guidelines to maintain SG tube integrity for the operating interval between tube inspections. The technical specifications define what constitutes tube integrity through the establishment of performance criteria. However, the maintenance requirements are supplemented with some prescriptive requirements that include 100-percent inspection of the tubes every two refueling outages.

The ISI reports include a table summarizing the wear observed at the antivibration bars at the top of the tube bundle, a location known for tube wear that is carefully monitored. The wear at these locations generally increases at a predictable rate and can be managed effectively in the

5-25 ISI program. The second most common reason for plugging thermally treated Inconel 600 tubes is due to damage by loose parts. The Surry ISI reports include detailed information on every tube plugging not due to antivibration bar wear, which includes loose parts damage and inadvertent maintenance damage from sludge cleanup tools. The Surry ISI reports show 76 incidences of tube plugging due to flaws during the SGs lifetimes.16 Sixty-one percent of the identified flaws that led to tube plugging were located between the tube sheet and the second grid support, or close to the hot side of the SG inlet. The higher occurrence of flaws near the inlet of the hot side of the SG is significant because this location is susceptible to the highest temperatures during a severe accident [NRC, 2010]. These insights were incorporated into the hot and upflow region flaw sizes.

The NUREG-2195 statistical analysis and the Surry ISI reports are based on flaws that are detected. The number of flawed tubes from the two approaches does not account for the hidden flaws that are not detected during the SG ISIs. The larger and deeper the flaw, the higher the probability of detection (POD). NUREG-2195 cites NUREG/CR-6791, Eddy Current Reliability Results from the Steam Generator Mock-up Analysis Round-Robin, Revision 1, issued October 2009 [NRC, 2009], as providing techniques for evaluating the POD and judges the impact to be relatively small for deep flaws. The flaw estimation and judgment on the POD is important since the Surry UA results did not predict any failures in unflawed tubes.

5.3.2 Surry Uncertainty Analysis Consequential Steam Generator Tube Rupture Results The occurrence of a C-SGTR required a substantial tube flaw depth and other contributing accident progression parameter characteristics. A C-SGTR occurred in 144 of the Surry realizations, or 12.5 percent of the completed calculations. In every realization with a C-SGTR, a hot leg nozzle rupture also occurred (i.e., the attributes that lead to a C-SGTR also promote a hot leg rupture). The hot leg failure terminated the high leakage flow rate through the C-SGTR.

The high-level insights for a C-SGTR occurrence include the following:

The threat of a C-SGTR was not limited to the peak plume region in the SG tube bundle.

The likelihood of a C-SGTR for the cold and hot upflow regions significantly increased if the nondimensional flaw depths were greater than 0.8 and 0.68, respectively.

The likelihood of a C-SGTR in the peak temperature region significantly increased if either the nondimensional flaw depth was greater than 0.42 or if the flaw depth was greater than 0.31 with a peak nondimensional hot plume temperature greater than 0.48.

The consequences of the C-SGTR are significant because these realizations predict the largest and earliest cesium and iodine releases. Figures 4-4 and 4-5 show a time-dependent release of cesium and iodine mass to the environment, respectively. There is a clear bifurcation in the results, with the higher release masses representing C-SGTR realizations and the remainder of the realizations having much lower releases. The realizations with a C-SGTR have an early pathway to the environment through the failed tube and then either a failed open MSS SV (see Section 5.2.2) or MSL leakage. On the semilog scales of Figures 4-4 and 4-5, the non-C-SGTR results show significant increases after 36 hr with the start of containment failures. However, most of the postcontainment releases are relatively small in absolute magnitude as compared to 16 The Surry SGs were replaced in 1980 and 1981.

5-26 the earlier C-SGTR releases. Only design leakage17 occurred before the containment failure, which accounts for the early but small releases to the environment. The late releases result from lingering airborne radioactive aerosols and gases in the containment and late revaporization releases (e.g., see the PRT discussion in Section 5.2.2).

Detailed insights from the consequential steam generator tube rupture reference case The reference C-SGTR realization was selected to give the median response for four specific attributes of interest. The attributes selected to identify the reference calculations were (1) the cesium release to the environment, (2) the iodine release to the environment, (3) the timing of the containment liner yielding (or the C-SGTR, if calculated), and (4) the containment pressure at the end of the calculation. The first three parameters characterize the magnitude and the timing of the source term, which is the focus of the SOARCA project. This evaluation included the containment pressure to reflect the median hydraulic condition for long-term releases from the containment.

Some of the key attributes that apply to both reference calculations include the following:18 No overcycling FTC SV occurred on any of the SGs.

No overcycling FTC occurred on the pressurizer SV.

No reactor coolant pump seal failures occurred, which is the most likely outcome from the uncertainty distribution.

The hot leg nozzle rupture occurred on Loop C where the pressurizer surge line connects. Loop C heated faster due to the cycling pressurizer SV, which led to the preferential failure on this loop.

Hydrogen deflagrations occurred in containment after the hot leg failure, but they did not pose a significant overpressure challenge to the containment boundary.

The containment design pressure and the pressure associated with liner yield were both exceeded. However, the containment pressure was below the rebar failure pressure at 72 hr, which is the most likely outcome at 72 hr.19 Although the containment pressure associated with rebar yield was not reached by 72 hr, the pressure was expected to exceed this value shortly thereafter.

The largest contributor to containment pressurization was the continuous heating of RCS coolant recast as steam in the containment (rather than the addition of noncondensable gases to the atmosphere from CCI).

The C-SGTR significantly increased the release to the environment. The reference realization without a C-SGTR released 0.028 percent and 0.003 percent of the iodine 17 The design leakage is a sampled uncertain variable. The uncertainty sampling ranges from 10 percent to 1,000 percent of the technical specifications for containment leakage (i.e., 0.1 percent air volume per day at the containment design pressure.

18 A reference case was also identified for a realization without a C-SGTR but is not discussed further here.

19 There were 1,091 liner failures and 16 rebar failures within 72 hr. There were 56 calculations with a 0.5 day time in the cycle where no containment failure occurred within 72 hr.

5-27 and cesium inventory, respectively. However, the C-SGTR reference realization released 1.42 percent and 0.92 percent of the iodine and cesium inventory, respectively.

The concrete ablation from CCI had not slowed by the end of the MELCOR calculation at 72 hr. The concrete erosion rate and noncondensable gas generation was relatively constant after the start of the CCI.

Table 5-4 shows the timing of key events for the reference C-SGTR realization. The C-SGTR occurs after the start of core damage, which is identified by the first fission product release.

There are 16 minutes between the C-SGTR and the subsequent hot leg failure, which terminates the high-flow leakage. As noted above, the reference C-SGTR calculation approximated the median C-SGTR cesium and iodine release to the environment. In contrast, the realization with the largest release to the environment was a rare calculation that experienced two C-SGTRs. The multiple C-SGTRs led to a depressurization of the primary system that delayed the hot leg failure until 1 hr 27 minutes after the first C-SGTR, which was at the 86th percentile for the high-flow C-SGTR duration.

Table 5-4 Key Event Timing in the Reference STSBO Calculation with a C-SGTR Event Time (hh:mm)

STSBOloss of all AC and DC electrical power, AFW unavailable 00:00 Reactor trips MSIVs close Reactor coolant pump seal leakage initiates at 21 gpm/pump 00:00 SG dryout 01:32 PRT rupture disk breaks 02:16 RPV water level reduces to TAF 02:16 First fission product gap release 03:43 C-SGTR in SG A in the cold region 04:01 Release of elemental iodine to the environment exceeds 1%

04:06 Loop C hot leg nozzle rupture 04:17 Accumulators begin discharging 04:18 Accumulators empty 04:19 Release of noble gases to the environment exceeds 1%

05:37 Core debris mass exceeds 5%

05:46 First hydrogen burn 06:09 Initial core plate failure 06:36 RPV lower head breach 09:13 End of containment hydrogen burns 10:12 Containment pressure reaches design (45 psig) 32:15 Containment liner yields 57:55 End of calculation 72:00 Source: NRC, 2022

5-28 Figure 5-14 shows the rate of gas leakage from the C-SGTR and the containment. The C-SGTR occurs at 4 hr 1 minute and begins leaking at 4,700 standard cubic feet per minute (scfm) from the primary system to the secondary side of the SG and then past the MSIV. After the hot leg failure, the C-SGTR leakage decreases by two orders of magnitude and follows the containment pressure response. The fission products that are released after the hot leg creep failure primarily flow to the containment through the large hot leg failure rather than out the C-SGTR.

After vessel lower head failure at 9 hr 13 minutes and the core debris discharge into the containment, there is a natural circulation flow from the containment through the vessel and out the failed hot leg, with some small leakage out the C-SGTR pathway. Consequently, the radionuclide release through the C-SGTR after the hot leg failure is slowed due to the large reduction in flow rate and the dilution from entering the containment through the hot leg failure and mixing with the containment air. The containment liner yield occurs at 57 hr 55 minutes and increases to 175 scfm at 72 hr, which becomes the secondary source of leakage (i.e., the primary leakage location in non-C-SGTR outcomes).

Figure 5-14 Containment and C-SGTR Leakage Rate (C-SGTR Reference Case)

Source: NRC, 2022 Figure 5-15 illustrates the creep damage accumulation in the three various tube locations of the three SGs. The accumulated creep is a function of the tube temperature, the differential pressure across the tube, and the flaw depth. The C-SGTR reference realization had a severe flaw depth in the cold tube region of SG A. The creep accumulation increased much faster in this tube than the other monitored locations until its failure at 4 hr 1 minute. No other tube is close to failure before the hot leg nozzle rupture 16 minutes later, emphasizing the importance and requirement of a severe flaw for a C-SGTR.

0 500 1000 1500 2000 2500 3000 3500 4000 4500 5000 0

12 24 36 48 60 72 Flow rate (scfm)

Time (hr)

Containment and SGTR leakage rate Containment leakage SGTR leakage SGTR Containment liner fails by yeilding

5-29 Figure 5-15 SG Tube Creep Damage Accumulation (C-SGTR Reference Case)

Source: NRC, 2022 The SGs are cluttered with thousands of SG tubes, seven levels of grid spacers, steam separators, and steam dryers. The complex deposition of aerosols released to the SG was prescribed using insights and results from the ARTIST (AeRosol Trapping In a Steam generaTor) experiments [NRC, 2022]. The uncertainty in the aerosol retention in the secondary side of the SG was varied by sampling the location and number of SG tube grid supports between the C-SGTR and the exit of the SG boiler section. The grids are a dominant retention location and especially effective at capturing larger aerosols.

Figure 5-16 shows the calculated time-dependent aerosol sectional decontamination factors in SG A following the C-SGTR. The MELCOR model discretizes the aerosols into size ranges called sections. The ten sections are uniformly spaced logarithmic intervals from a minimum of 0.1 microns to a maximum of 50 microns. The larger aerosols in Sections 5 through 10 have very large decontamination factors and are effectively retained in the SG. Large aerosols are more likely to deposit on the surrounding tubes and be captured in the tube grid spacers.

However, the smaller aerosols in Sections 1 through 4 more closely follow the gas streamlines through the tube region and out the MSIV leakage pathway.

0.0001 0.001 0.01 0.1 1

0 1

2 3

4 5

LM-CREEP Time (hr)

SG Tube Creep Index SG A cold SG A hot SG A hottest SG B cold SG B hot SG B hottest SG C cold SG C hot SG C hottest Tube failure = 1

5-30 Figure 5-16 Integral Aerosol Decontamination in the SG Secondary Following the C-SGTR (C-SGTR Reference Case)20 Source: NRC, 2022 Figure 5-17 shows the integral SG decontamination factors of key chemical groups exiting through the C-SGTR. The retention of the noble gases (i.e., characterized by the xenon radionuclide class) and the elemental iodine gas are contrasted with the predominantly aerosol release of the cesium iodide and the other cesium compounds.21 There is no retention of the noble and iodine gases passing through the SG tube bundle and exiting out the MSIV leak path.

In contrast, the total iodine (i.e. the sum of the gaseous and aerosol components) and the cesium decontamination factors trend towards 1.5 and 1.9 at 5 hr, respectively.

20 After the hot leg failure at 4.25 hr, the secondary side of the SG temporarily leaks inward to the primary system and outward through the MSIV leak path until fully depressurized. Since the integral decontamination factor is the

, the takes an abrupt decrease, which lowers the decontamination factor.

21 The total cesium decontamination factor includes all forms of cesium, including cesium hydroxide, cesium molybdate, and cesium iodide. The total iodine decontamination factor includes the two forms of iodine, which are elemental iodine (i.e., gas) and cesium iodide.

1.E+00 1.E+01 1.E+02 1.E+03 1.E+04 1.E+05 1.E+06 1.E+07 3.0 3.5 4.0 4.5 5.0 Decontamination Factor (-)

Time (hr)

Aerosol Decontamination Factor versus Section Size Section 10 Section 9 Section 8 Section 7 Section 6 Section 5 Section 4 Section 3 Section 2 Section 1 SGTR Hot leg nzl creep failure

5-31 Figure 5-17 Comparison of the Short-Term Xenon, Iodine Gas, Total Iodine, and Total Cesium Integral Decontamination Factor in the SG (C-SGTR Reference Case)

Source: NRC, 2022 Of the total cesium and iodine released to the environment, 99.9 percent and 99.8 percent come through the C-SGTR pathway versus containment leakage. However, the C-SGTR leakage during the high flow-rate phase before the hot leg failure and primary system depressurization is not the dominant release phase to the environment. For example, only 2.7 percent and 5.0 percent of the total cesium and iodine are released through the C-SGTR to the environment by 5 hr (see Figure 5-18). The bulk of the release to the environment (i.e., 97.3 percent and 95 percent of the cesium and iodine released to the environment) occurs after 5 hr. This was primarily due to more significant releases from the fuel occurring during the second fuel heatup after the hot leg failure and accumulator discharge at 4.3 hr. The dominant C-SGTR releases of 69 percent and 62 percent of the total cesium and iodine to the environment, respectively, occur by vessel failure at 9.2 hr. Nevertheless, the C-SGTR persists as an important pathway after vessel failure (i.e., accounting for more than 30 percent of the total iodine and cesium release),

which is somewhat disguised on a semilog scale (e.g., see Figures 4-4 and 4-5).

1.E+00 1.E+01 1.E+02 1.E+03 3.0 3.5 4.0 4.5 5.0 Decontamination Factor (-)

Time (hr)

Radionuclide Decontamination Factor versus Release Class Xe Total I2 Gas I Total Cs Total SGTR Hot leg nzl creep failure Gases trending to no decontamination 1.9 1.5

5-32 Figure 5-18 Percentage of Xenon, Iodine Gas, Total Iodine, and Total Cesium Environmental Release as a Function of Time (C-SGTR Reference Case)

Source: NRC, 2022 The Surry UA modeled 100 percent of the elemental iodine in the gap between the fuel and the cladding. The iodine gas is released in a puff following the cladding failures in the various rings.

Due to the rapid and complete release of the elemental iodine, 57 percent of the total environmental release occurs by 5 hr. In contrast, most of the xenon gas is tied up in the fuel matrix, which releases over time as the fuel heats and degrades. The percentage of the xenon gas released to the environment is only 29 percent at vessel failure. The subsequent release occurs very slowly as xenon flows back into the RCS from the containment and out the C-SGTR leakage pathway. The long-term shape of the xenon release through the C-SGTR is driven by the steady containment pressurization.

Impact of multiple steam generator tube ruptures The draft Surry UA [NRC, 2015] included a sensitivity analysis to understand the effects of the multiple SG tube failures.22 A reduced set of parameters judged to be most important to variations in C-SGTR behavior was selected and varied (i.e., the number of tubes, C-SGTR location, secondary SV open fraction, and primary SV open fraction). The distribution sampled the failure of one to five tubes, and 97 realizations finished to completion. The sensitivity study included other specified boundary conditions that ensured a C-SGTR (i.e., severely flawed tube[s] are located in the hot plume region of the SG). It also included some assumptions not used in the final Surry UA, which specified a pressurizer and MSS SV FTC after 45 cycles. The MSS SV FTC would promote a high radionuclide release by venting the radionuclides more 22 The final Surry UA substantially changed the C-SGTR modeling, which included plant-specific data for tube flaws, monitoring of multiple locations, and an improved characterization of the highest temperature location in the SG. The draft Surry UA was constrained to one tube failure per SG, which prompted this multiple SG tube sensitivity study.

0%

25%

50%

75%

100%

0 12 24 36 48 60 72 Percentage (%)

Time (hr)

Percentage of Total SGTR Environmental Release for Key RN Classes Xe Total I2 Gas I Total Cs Total SGTR Hot leg nzl creep failure Lower head failure

5-33 quickly to the environment. The pressurizer SV FTC after 45 cycles helped delay a hot leg failure and promote a longer release.

Figures 5-19 and 5-20 show the fractional releases of iodine and cesium to the environment.

The horsetails were color coded to identify the number of failed tubes. Additional tube failures led to higher releases. With a couple of overlapping exceptions, the releases for two tubes are higher than one tube, and the releases for three tubes are higher than two tubes. However, the releases for three to five tubes show no clear differences and seem to randomly overlap. While the leakage rate of radionuclides through the C-SGTR was limited by the tube flow rate with fewer than three failed tubes, there was adequate flow above three failed tubes to pressurize the SG. The leakage rate is controlled by the MSL leakage rate rather than the C-SGTR flow rate.

The single tube C-SGTR realizations have an initial puff release that is followed by a gradual increase over the next 10 hr. This trend is seen to a lesser extent with two tubes. In contrast, there is a large initial release at the time of three or more C-SGTRs, which ends within 6 hr. At the time of the C-SGTR, the radionuclide releases from the fuel were rapidly increasing but the fuel and cladding had not yet collapsed (i.e., intact geometry). A larger number of failed tubes overwhelms any hot leg natural circulation patterns and redirects radionuclide-filled gases towards the failed C-SGTRs.

The multiple tube C-SGTR sensitivity study conducted a limited regression analysis. The number of tubes dominated results, with none of the other three sampled parameters having a significant additional impact. A large factor in the magnitude of the environmental release is the timing of hot leg creep relative to the C-SGTR. The variability in the timing is impacted by the primary system depressurization rate, based on the number of tubes failing and exacerbated by the primary SV open fraction. One realization, with five tubes failing, had no hot leg creep and led to the highest release fractions.

Figure 5-19 Iodine Environmental Release Fraction Versus Number of Tubes Failed Source: NRC, 2015

5-34 Figure 5-20 Cesium Environmental Release Fraction Versus Number of Tubes Failed Source: NRC, 2015 5.3.3 Implications for Other Plants The prediction of a C-SGTR includes modeling natural circulation flows to the SG and thermal-mechanical stress calculations. The natural circulation flows are unique to the plant design. The geometry of the B&W NSSS plant, with its once-through SGs, is not supportive of a natural circulation flow. These plants include Arkansas Nuclear One, Unit 1, in Arkansas; Davis-Besse Nuclear Power Station, in Ohio; and Oconee Nuclear Station, Units 1, 2, and 3, in South Carolina. The remaining PWR nuclear power plants use a U-tube SG design. CE and Westinghouse designed these plants. A C-SGTR is not applicable to BWRs, which do not have SG tubes.

Natural circulation for Westinghouse plants The technical basis for the Surry natural circulation flows was developed from experiments and CFD modeling. The NRC and the industry performed 1/7th-scale experimental tests to characterize the natural circulation flows between the vessel and the SG. The tests were studied using CFD techniques. The CFD benchmark to the 1/7th scale showed very close agreement to measured values and provided confidence in the code and modeling approach.

The CFD techniques were subsequently scaled to full scale from the 1/7th scale using the geometry and severe accident conditions. The CFD modeling scale-up to a full-scale SG with the geometry of the 1/7th-scale facility shows similar mixing and entrainment in the inlet plenum as the experiment [Wagner, 2020].

However, a full-scale model of the 1/7th-scale was not prototypical of a Westinghouse SG. The 1/7th-scale facility has a hot leg oriented in a vertical plane normal to the divider plate that separates the inlet and outlet plenums. This orientation of the hot leg makes the SG symmetric.

The hot leg nozzle of the Westinghouse Model 44 SG is oriented approximately 30 degrees from a vertical plane normal to the divider plate. Consequently, a second set of predictions was performed for a prototypic Westinghouse Model 44 SG [NRC, 2004], which also has a shallower

5-35 inlet plenum than the 1/7th-scale model. The Westinghouse Model 44 SG calculations were specified in a similar manner to the scale-up, which provided a direct indication of the effect of the geometric differences on the inlet plenum mixing parameters. The Model 44 predictions indicated significant variations in the plume intensity and location versus the scale-up geometry.

The NRC presents the final CFD recommendations that guided the Surry natural circulation modeling in NUREG-1922, Computational Fluid Dynamics Analysis of Natural Circulation Flows in a Pressurized-Water Reactor Loop under Severe Accident Conditions, issued March 2010

[NRC, 2010]. The NUREG-1922 results extend earlier predictions of SG inlet plenum mixing with the inclusion of the entire natural circulation loop between the reactor vessel upper plenum and the SG. The Model 51 H geometry is used as the basis for the new CFD calculations. The CFD predictions are used as a numerical experiment to improve the basis for simplified models used in the MELCOR Surry model. NUREG-1922 provided specific recommendations for (1) the hot leg discharge coefficient, (2) the SG mixing fraction, (3) the ratio of the hot leg flow to the SG recirculation flow, (4) the percentage of tubes involved in upflow versus the circulatory return flow ratio, (5) the bounding normalized temperature of the hottest tube, and (6) the hot and cold stream flow split into the surge line. The insights from the CFD work were also used to select the variability in the peak plume temperature as an uncertain parameter for the Surry UA.

Applicability to Westinghouse plants The insights from the NUREG-1922 natural circulation work and its implications for C-SGTR were uniquely developed for a Westinghouse design with Model 51 SGs. Surry uses Model 51 H SGs, which are consistent with this geometry. However, NUREG-1788, CFD Analysis of Full-Scale Steam Generator Inlet Plenum Mixing During a PWR Severe Accident, issued May 2004 [NRC, 2004], noted that the primary-side dimensions of a Model 44 SG are very similar to the dimensions of the Westinghouse Model 51 designs. Consequently, the guidance in NUREG-1922 is judged to be applicable to all Westinghouse plants using these SG designs. Westinghouse has other SG designs that were not assessed. A comparison of the other Westinghouse model geometries would be needed to assess the direct applicability of NUREG-1922 recommendations. The CFD work identified the similarity of the hot leg and inlet plenum dimensions as most important.

New AP1000 nuclear reactors are being built at the Vogtle Electric Generating Plant site in Georgia. The AP1000 SGs are significantly different than the other operating Westinghouse plants. The AP1000 plant is rated at 3,626 megawatts (MW) and uses only two large SGs (i.e., 1,813 MW/SG). In contrast, the Surry plant is rated at 2,587 MW and uses three SGs (862 MW/SG). The large two-loop AP1000 is expected to be more similar to the CE SG design.

The flaw distribution is the key second component for predicting a C-SGTR. The Surry UA flaw distribution was developed from a combination of generic data from SGs with Alloy 600 tubes and plant-specific ISI data. Surry has a very long ISI history (circa 1980). However, the recorded occurrences of tubes with severe flaws was impacted by loose parts damage and inadvertent damage by a lancing machine while removing sludge at the bottom of the SG. The corresponding flaw frequency and severity damage may be atypical of other plants.

The generic data used in the Surry UA flaw distribution was for Alloy 600 tubes from NUREG-2195 [NRC, 2018]. However, guidance is provided for both Alloy 600 and Alloy 690 tubes. The correlation for the flaw distribution used in the Surry UA is based on the effective full-power years of operation, which was defined uniquely for the Surry plant. Consequently, this

5-36 would generate conservative results for almost all other plants (i.e., Surry had the first SG replacements of the older plants with Alloy 600 tubes).23 The Surry UA and other NRC research for Westinghouse plants show that a flaw is required for a C-SGTR. Although the research is not exhaustive for all SG designs and every accident sequence, the research is very comprehensive (e.g., see analyses in NRC [2018], NRC [2010a],

NRC [2022]). Therefore, the flaw distribution is very important. The assumptions in the Surry UA include the long effective full-power years of operation. The analysis in the Surry UA also shows that the historical frequency of deep flaws is consistent with the larger generic data of all Alloy 600 tubes [NRC, 2018]). In summary, the Surry UA C-SGTR insights are applicable to Westinghouse plants with SGs similar to the Model 51 SG, which includes the Model 44 SG.

Applicability to Combustion Engineering plants The NRC has also done research on C-SGTRs in CE plants. CE plant designs only have two SGs, which are larger than the Westinghouse Model 51 SGs and have a different inlet plenum geometry. The two CE hot legs are also much larger to accommodate the large two-SG design.

For example, a Westinghouse Model 51 SG plant has a 29-in. hot leg and 3,388 tubes. A CE SG has a 42-in. hot leg and 8,471 tubes [NRC, 2016a]. The larger dimensions allow less mixing in the hot leg as the hot plume enters the SG plenum. The CE SG plenum is wider and shallower, which results in less mixing and a hotter plume that enters the SG tubes. The CFD results show that a small portion of the flow from the vessel enters the SG tube bundle with very little mixing. The smaller amount of mixing in the SG inlet plenum is attributed the large hot leg positioned relatively close to the tube bundle entrance. Whereas the peak normalized hot plume temperature24 in the Westinghouse plants is 0.43, the value in the CE plants is between 0.95 and 1.0 [NRC, 2016a]. =1.0 means the hottest portion of the plume enters the SG tubes without mixing or cooling, which places higher thermal stresses on the tubes.

In NUREG-2195, the NRC performed MELCOR analyses using the CFD CE-specific guidance from NRC [2016a]. Similar to the Westinghouse plants, the analyses did not predict a C-SGTR in an unflawed tube before the hot leg failure. The study also noted that any radionuclide releases from a C-SGTR without a failure of an MSS SV are expected to be small, as indicated by the MELCOR runs.

In NUREG-2195, the NRC developed probabilistic risk assessment tools for predicting the occurrence of a C-SGTR. The study found that the conditional probability of a C-SGTR in core damage scenarios with a high primary pressure and a low secondary pressure without secondary water is about a factor of 10 larger for plants with a shallow inlet SG plenum (e.g., the selected CE plant) than the plants with a deep inlet SG plenum (e.g., the example Westinghouse plant). The observations on the flaw depth for a C-SGTR from the Surry UA would suggest less severe flaws will fail tubes in a CE plant. Consequently, the Surry UA quantitative insights on flaw depth would not be conservative for a CE plant or other SG designs with large, shallow SG inlet plenums.

23 Westinghouse subsequently shifted to Alloy 690 tubes, which have superior performance to Alloy 600 tubes.

Of the 577,070 thermally treated Alloy 690 SG tubes placed in service, only 333 tubes (0.06 percent) have been plugged after approximately 173 calendar years of operation.

24 The normalized hot plume temperature is defined as, = ()

()

, where is the normalized hot plume temperature, is the cold return tube temperature, and is the hot plume temperature leaving the vessel.

5-37 NUREG-2195 also evaluated other locations along the natural circulation pathway for thermally induced failures (e.g., the SG primary manway, the resistance temperature detector, the power-operated relief valve). The detailed thermal analyses indicated that the upper half of the hot leg will fail much earlier than the other RCS regions.

5.4 Containment Failure Insights A key figure of merit in the UAs was the source term to the environment. As the last barrier to radionuclide release to the environment, the integrity of the containment was a first-order parameter affecting the iodine and cesium release to the environment. In particular, the UAs investigated uncertain parameters judged to impact the timing of the containment failure. Each UA had unique insights described in Sections 5.4.1 through 5.4.3 of this report. Section 5.4.4 discusses the implications for other plants. A C-SGTR, while not a containment failure, is a containment bypass and equally important. Section 5.3 discusses the insights on C-SGTR separately.

5.4.1 Boiling-Water Reactor Containment Failure Timing Insights There were two key modes of containment failure in the Peach Bottom UA: (1) drywell head leakage and (2) drywell liner melt-through. The drywell head leakage occurred as the bolts retaining the drywell head stretched to form a gap when the containment reached high pressure.

The exact criteria for the bolt stretching were sampled using uncertain parameters. The drywell liner melt-through also included uncertain parameters for debris movement criteria from the reactor pedestal to the drywell. The radionuclides that escape the containment have some limited retention in the reactor building. Two other uncertain variables explored the hydrogen ignition criteria and the overpressure opening criteria for the large railroad doors.

Every realization in the Peach Bottom UA experienced a drywell liner melt-through. To better understand what affects the timing of radionuclide releases from the containment, a regression was performed on the timing when the fraction of iodine released to the environment reaches 0.001 (i.e., 0.1 percent of the iodine inventory).25 This metric served as an indication of when fission product releases to the environment were increasing above design leakage values and directly related to the timing of the containment failure.

The regression analyses indicate that the battery duration is the most influential parameter that would be expected. The battery duration has an obvious influence on release timing, in that RCIC functions keep the reactor cool as long as DC power is available. It is not until DC power is lost that the operators lose control of RCIC and its water delivery increases, overfilling the vessel and flooding the steam lines. The drive turbine on the RCIC pump is assumed to fail when the steam lines flood.

The number of cycles to SRV failure and the open fraction of an SRV after thermal seizure were also important to release timing because they are important to whether an MSL rupture occurs.

When an MSL rupture occurs, containment overpressurizes and leaks past the drywell head flange, which results in an early release. Section 5.2.1 more thoroughly discusses the role of the valve and MSL failure.

25 The 0.1 percent iodine regression is used as a surrogate for containment failure timing insights to assess whether the various uncertain parameters on the mode of containment failure or reactor building failure were important.

5-38 After the DC battery duration and the valve cycle parameters, no other parameters had a significant impact on the timing of the containment failure. In particular, the uncertain parameters for the drywell head leakage, the ex-vessel debris movement to the drywell liner, and reactor building leakage or failure were not important factors to the timing of the iodine release.

The regressions on the magnitude of the iodine and cesium release, rather than the timing of the radionuclide release, provide a few more insights on the influences of the uncertain parameters related to the containment and reactor building failure. The magnitude of the iodine release shows some small influence of the drywell liner failure area and the railroad door opening pressure. Both parameters appear as small contributors to the magnitude of the cesium release to the environment. Consequently, the containment and reactor building uncertainty parameters have no strong impact on either the timing or the magnitude of the releases to the environment.

The independent regression analyses for each of the failure modes (SRV stochastic, SRV thermal seizure, or SRV thermal seizure with MLS creep rupture) in the Peach Bottom UA identified additional important parameters and phenomena (see Section 5.2.1). For realizations with only a stochastic SRV failure, the releases of iodine and cesium are also sensitive to the drywell liner failure flow area. There is a correlation between the uncertainty in the drywell liner breach size and whether a surge of water from the wetwell occurs (see Figure 5-21). Larger breach sizes cause stronger containment depressurizations. The surged water from the wetwell spreads across the core debris on the drywell floor and evaporates. The evaporating water creates steam that increases the leakage rate from the containment that promotes the release of the airborne radionuclides. Any radionuclides in the water that surges into the drywell will be released into the drywell atmosphere where they can leak to the environment. Due to the larger releases with a thermal seizure of the SRV, with or without an MSL creep rupture, the influence of the drywell liner area was not important for these failure modes.

5-39 Figure 5-21 Cumulative Distribution Function for the Flow Area Resulting from Drywell Liner Failure with an Indication of a Water Pulse from the Wetwell to the Drywell Source: NRC, 2016 Impact of an earlier reactor pressure vessel penetration failure The investigation into failing RPV lower head penetrations yielded outcomes where core debris made its way to the containment floor generally earlier than in the UA calculations, which were constrained to only failing the RPV lower head in a gross manner. Sensitivity calculations addressed the uncertainties in the number of penetrations that might fail and the temperature that might be associated with failure. They did not address the specific vulnerabilities of the drain line/valve at the low point of the lower head to failure. The earlier relocation of core debris to the containment floor in the failed-penetration calculations led to an earlier onset of fission product releases from containment and hence larger iodine and cesium releases to the environment by 48 hr.

Insights from the updated Peach Bottom model using MELCOR 2.2 The two PWR UAs followed completion of the Peach Bottom UA using the MELCOR 1.8.6 code, The two PWR UAs incrementally updated the approach and methodology, including using MELCOR Version 2.2. A small number of Peach Bottom reference calculations were performed using the updated model and MELCOR 2.2 to assess the changes since the Peach Bottom UA

[Wagner et al., 2020a]. The updated Peach Bottom input model includes input corrections and enhancements. It also includes changes to the uncertainty parameters and the distributions.

5-40 The new model was compared to three reference calculations from the Peach Bottom UA.

Some differences are expected due to changes in the code versions and in the input. In addition, the severe accident models have inherent variabilities due to complex numerical and physical interactions. Consequently, some variations are expected as subtle interactions accumulate and change model responses. The results from the updated Peach Bottom calculations are presented in Wagner et al. [2020a] and summarized in Section 3.5.1 in Wagner et al. [2020].

5.4.2 Surry Uncertainty Analysis Insights A primary goal of the Surry UA was to investigate parameters leading to an early containment failure from a C-SGTR. A C-SGTR, though not a containment failure, is a containment bypass and is equally important. Accordingly, Surry UA sequence end states had the following outcomes:

late overpressurization from steam and noncondensable gases generated from CCI (95.1 percent) liner failure only (81.2 percent) liner failure and C-SGTR (12.6 percent) liner and rebar failure (1.4 percent) no containment failure before the end of the 72 hr simulation time (4.9 percent)

Table 5-5 presents the mean, median, minimum, and maximum (within the 72 hr simulation time) of the containment failure time. All the failures resulted from gradual monotonic pressurizations of containment (i.e., there were no containment ruptures immediately following a hydrogen deflagration). Most (92.8 percent) of the realizations reached the liner yield criteria, which was sampled between 1.09 times the design pressure (Pdesign) and 2.03 times Pdesign using a Beta distribution informed with insights from SNLs scale containment testing program, assessments of containment performance in severe accidents, and assessments of degraded containment conditions [Wagner et al., 2020; NRC, 2022].

Table 5-5 Containment Failure Timing Liner failure time (hr)

Mean 50.8 Median 50.1 Min 34.5 Max 71.9 Figure 5-22 shows the Surry containment pressure versus leakage curve. The value for the lowest point (i.e., the liner plate yield) is sampled as an uncertain variable. Figure 5-22 shows the median value for the liner plate yield pressure. When the liner plate yields, the leakage increases to 1 percent volume/day. The leakage rate due to the liner yield slowly increases to 10 percent volume/day until the rebar yield pressure. If the pressure reaches 2.25 times the design pressure, then the rebar is expected to yield, which starts an increased leakage rate.

5-41 The rebar yield pressure was only exceeded in 1.4 percent of the realizations within 72 hr and was not sampled as an uncertain variable in the Surry UA. The trend shown in Figure 5-23 suggests other cases would exceed the rebar yield pressure after 72 hr.

Figure 5-22 Containment Functional Failure Leakage Source: NRC, 2022

5-42 Figure 5-23 Containment Pressure by C-SGTR (SGTR in the Legend)/Non-C-SGTR (Non-SGTR in the Legend)26 Source: NRC, 2022 The realizations with a containment failure beyond 72 hr are attributed to the 0.5 day time in the cycle calculations. The 0.5 day cases are very early in core life (i.e., shortly after refueling). The decay heat power at 0.5 day was too low to generate a significant containment pressurization.

As discussed in Section 3.2.4 of Wagner et al. [2020], the hydrogen deflagrations were common in the calculations but were not threatening for a containment overpressure failure. A C-SGTR decreased the rate of containment pressurization, as evidenced in the horsetails in Figure 5-23.

Section 5.3.2 discusses the lower pressurization rate, which is attributable to the additional containment leakage pathway afforded by a tube rupture.

Impact of the reactor cavity concrete composition on containment failure timing The original Surry SOARCA MELCOR analyses specified a limestone-based aggregate for the containment concrete. However, subsequent information confirmed Surry has a basaltic aggregate concrete in the reactor cavity. Two sensitivity MELCOR calculations varied the concrete type. The basaltic concrete shows more ablation of the concrete than with limestone concrete. However, the limestone concrete has approximately 30 percent greater release of noncondensable gases. These results are in line with previous EPRI analyses that show an inverse relationship between the downward heat transfer coefficient and the effective decomposition enthalpy. Although there is a higher ablation rate for basaltic concrete 26 Note that due to a plotting error, the low horsetails were mischaracterized as C-SGTR cases. None of the low horsetails had a C-SGTR. These were the 0.5 day time in the cycle realizations. Not all realizations are shown in the figure to improve the definition on the individual pressure curves.

0.5 day time in the cycle realizations (no C-SGTRs)

5-43 (Figure 5-24), the noncondensable generation rate is lower due to the increased cooling effect of the higher ablation rate on the corium.

Most of the pressure in containment is attributable to the partial pressure of steam (Figure 5-25).

The partial pressures of noncondensable gases generated by molten core concrete interaction (MCCI) do not contribute much to the overall pressure, so differences in the amounts of gas generated do not either. Instead, the containment pressure increase over the long term is due to continued heating of the containment atmosphere by decay heat generated in the core debris residue on the containment floor.

A sensitivity study was also performed to assess the impact of the rebar mass in the concrete

[NRC, 2022]. The rebar mass was changed from to zero and 30 percent (i.e., the base value was 17 percent). The total containment pressure for the no rebar and 30 percent rebar cases is 1 percent greater and 2 percent less, respectively, when compared to the base case.

Additionally, the containment temperature differences response among the three cases is small.

However, the amount of rebar does have a secondary effect for hydrogen response after hot leg failure. A high rebar content increases hydrogen and carbon monoxide production from MCCI (i.e., iron within the rebar reacts with water and carbon dioxide to generate iron oxide and hydrogen and carbon monoxide, respectively). The impact is a slightly larger hydrogen burn.

However, no hydrogen deflagration challenged the containment structural integrity.

Figure 5-24 MCCI Debris Surface and Ablation Depth Source: NRC, 2022

5-44 Figure 5-25 Containment Pressure Response Source: NRC, 2022 Impact of containment design leakage on the source term The Surry UA sampled the amount of design leakage from containment. Before increased leakage due to a containment liner yield, the design leakage is the only release path for radionuclides to the environment, excluding bypass events like a C-SGTR. Each regression technique identified the design leakage as the largest contributor to the uncertainty in the cesium release to the environment and the third most important contributor to the iodine release to the environment. It was less important for iodine due to late revaporization physics that also allowed iodine leakage after the containment failure. The regression was biased by the early time in the cycle results that have late or no containment liner yield, leaving this leakage as the only release pathway. The scatterplot (Figure 5-26) shows a clear trend of an increasing cesium release with an increasing design leakage rate. Another interesting result is the clearly increasing lower bound with higher leakage. A higher design leakage allows more release of airborne aerosols before there is time for deposition in containment.

5-45 Figure 5-26 Scatterplot of Cesium Release Fraction Versus Containment Leakage Input Values Source: NRC, 2022 5.4.3 Sequoyah Uncertainty Analysis Insights A primary goal of the Sequoyah UA [NRC, 2019] was to investigate parameters leading to an early containment failure from hydrogen deflagrations. Accordingly, containment end states had three general outcomes:

early containment failure from the first hydrogen combustion (i.e., four realizations or 0.7 percent) late overpressurization from steam and noncondensable gases generated from CCIs (i.e., 86.8 percent) no containment failure before the end of the 72 hr simulation time (i.e., 12.5 percent)

The most common outcome was late containment failure. None of the BOC cases reached containment failure within 72 hr, and only a very small percentage of realizations with a MOC decay heat profile (i.e., 1 percent of the total) did not fail the containment within 72 hr.

Unlike early containment failures, the late containment failures were caused by a slow overpressurization and not pressure spikes from deflagrations. If a containment survived the first burn, the subsequent deflagrations were never energetic enough to rupture the containment. The burns after the first ignition were generally from hydrogen produced by CCI igniting in the cavity region. The late burns (after 12 hr) were less energetic due to frequent burning of smaller quantities of combustible gases near the lower flammability limit (i.e., ignited by aerosols and hot gases from ex-vessel CCI). As the burns consume oxygen and the

5-46 containment pressurizes, the oxygen concentration in containment eventually decreases to the point where it is insufficient to support further burning. Although the deflagrations cease, the containment continues to pressurize and heat up from the ex-vessel CCI noncondensable gas generation and the resulting vaporization of water from the melted ice. The pressurization is monotonic and most often causes the containment to rupture before 72 hr (end of simulation time). However, none of the BOC (i.e., 6.25 days at cycle) realizations overpressurized containment by 72 hr (see Section 5.1).

Focused pressurizer failure-to-close study The Sequoyah SOARCA pressurizer SV study explored the conditions that were more favorable for early containment failure (see Appendix I to NUREG/CR-7245 [NRC, 2019]). The focused pressurizer SV study found the following:

The containment failure pressure was the most important sampled parameter with respect to containment failure time.

The number of pressurizer cycles to failure, the time in cycle, and the oxidation model were the most important sampled parameters with respect to the mass of hydrogen vented to containment.

The number of pressurizer SV cycles to failure, eutectic melting temperature, and oxidation model were the most important sampled parameters with respect to the mass of hydrogen transported to the containment dome, a crucial aspect that helped determine whether there could be a large enough initial deflagration to fail containment early.

5.4.4 Implications for Other Plants The insights on the various containment failure modes from the Peach Bottom UA and updated MELCOR 2.2 results are applicable to other BWR Mark I plants. All BWR Mark I containments include a drywell head that is susceptible to leakage at high pressure. All the Peach Bottom UA calculations included a drywell liner melt-through. The Peach Bottom UA calculations did not include any mitigation or ex-vessel water addition. Consequently, the ex-vessel debris is expected to heat and attack the concrete. The updated calculations showed the debris movement to the liner can be delayed by the pump seal water on the drywell floor. However, the water evaporates and allows the continued movement to the drywell shell. The ex-vessel debris behavior in other Mark I designs will be affected by the size of the in-pedestal sump, the doorway opening to the drywell floor, and the exposure of the steel shell near the drywell floor.

The insights being formed from the Fukushima Dai-chi accidents, which were complicated by emergency water addition and debris interaction with the structures below the vessel lower head, illustrate additional complications not included or considered in the Peach Bottom UA.

Consequently, the drywell failure by spreading likely has larger uncertainties than illustrated in the Peach Bottom UA. However, a key insight from the new MELCOR 2.2 calculations showed that drywell head seal leakage replaces the drywell liner leakage as a comparable radionuclide leakage pathway. Consequently, the limitations in current abilities to model ex-vessel debris behavior had an unexpectedly low impact on the magnitude of the source term.

Each Mark II design is different, with significantly different reactor pedestal designs (e.g., see NUREG/CR-5528, An Assessment of BWR Mark-II Containment Challenges, Failure Modes,

5-47 and Potential Improvements in Performance, issued July 1990 [NRC, 1990]). The drywell liner is not directly vulnerable in the Mark II containments in the same manner as in the Mark I containments. The three basic variations include (1) a flat floor cavity with no in-pedestal downcomers (Susquehanna Steam Electric Station and Limerick Generating Station), (2) a deep cavity below the drywell floor (Columbia Generating Station and La Salle County Station),

and (3) cavities with in-pedestal downcomers (Nine Mile Point Nuclear Station, Unit 2). Any ex-vessel debris may not reach the drywell liner due to the location of the pedestal relative to the drywell floor (i.e., design 2) or the presence of downcomers in the pedestal and drywell regions (i.e., design 1) or downcomers in the drywell (i.e., design 1).

The Mark II drywell head is similar to the Mark I design and expected to leak at high pressure.

However, the pressure response of the Mark II will be different due to its large size and variations and uncertainties on debris movement into the wetwell. Consequently, it is difficult to extrapolate the Peach Bottom UA containment failure dynamics directly to the Mark II design.

Some of the other insights from the Peach Bottom UA are expected to be applicable to all BWRs. Operation of the RCIC system will delay the timing of the containment failure. All BWRs include RPV penetrations (e.g., a drain line at the bottom of the lower head) that could be susceptible to an earlier failure than predicted in the Peach Bottom UA. The impact would be an earlier and more protracted release of debris to the containment. Due to the limited sensitivity investigations, any extrapolation to containment failure conditions for other designs would be limited and qualitative (i.e., likely less important to Mark II and Mark III designs). Finally, the reactor building is not expected to provide significant retention of released radionuclides for any BWR. The hydrogen burns in the reactor building will cause failures and increased leakage that limit their retention in unmitigated severe accidents.

The PWR UAs provided somewhat consistent insights on the containment performance. The most likely outcome is a slow, monotonic pressurization to an overpressure condition. In a free-standing steel ice condenser containment, the failure mode is expected to be a rupture.

The insights on the timing and mode of the containment failure will be qualitatively similar for 8 of the 10 ice condenser plants. Section 5.2.2 discusses the susceptibility of the ice condenser plant to an early failure from a hydrogen burn and the role of the pressurizer SVs in a large early burn.

Most of the PWRs have steel-reinforced concrete containments. The slow pressurization to an overpressure failure identified in the Surry UA is qualitatively applicable to all PWRs with similar containments. The Surry containment is a small, subatmospheric design. The insight of a low challenge of an early containment overpressurization from a hydrogen burn is expected to be representative of most plants. The mode of a gradual overpressure failure from the liner yield to rebar yield is also expected to be characteristic of most PWRs with steel-reinforced concrete containments.

The insights on design leakage impacting the timing and early magnitude of the release is expected to be applicable to all BWR and PWR plants. Nuclear power plant control of containment leak tightness is governed by 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, Appendix J, Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors. Since the NRC implemented an initiative to allow performance-based requirements to replace the prescriptive requirements of Appendix J, EPRI reports that the industry response to the risk-informed testing approach has been very successful. The program reports 75 successful integrated leakage rate tests from the adoption of performance-based testing and no failures (i.e., leakage is below the design limits) [EPRI,

5-48 2011]. Nevertheless, severe accidents without power may present challenges to isolate all penetrations to the containment. Consequently, the trends observed in the Surry UA, from lower aerosol (cesium) source term with low leakage to a higher aerosol source term for high leakage above the design limits, are expected to be applicable to all reactor types.

Finally, an inadvertent mistake in the concrete specification for the Surry containment illustrated the impact of the concrete type on the containment pressurization rate from the CCI [NRC, 2015]. CCI with basaltic concrete shows more ablation of the concrete than with limestone concrete. However, the limestone concrete has approximately 30 percent greater release of noncondensable gases. The most important factor contributing to the higher releases in the original SOARCA calculation is the faster pressurization rate due to the limestone concrete and the earlier transition to a rebar yield failure at 25.5 hr. In contrast, most liner failures occurred after 48 hr in the Surry UA simulations (e.g., primarily due to the smaller gas generation from the basaltic concrete) [NRC, 2022]. The qualitative insights on the concrete type are expected to be applicable to CCI in all plants (i.e., higher change due to erosion with basaltic concrete and higher pressurization with limestone concrete).

A sensitivity study in the draft Surry UA assessed the impact of the rebar mass in the concrete.

There was very little difference in the containment pressurization during CCI or the temperature response (i.e., a 3-percent impact on pressure over a 30-percent rebar variation). A high rebar content increases hydrogen and carbon monoxide production from MCCI (i.e., iron within the rebar reacts with water and carbon dioxide to generate iron oxide and hydrogen and carbon monoxide, respectively). The impact is a slightly larger hydrogen burn. The qualitative insight on rebar variations (or uncertainty) is expected to be applicable to all nuclear designs.

5.5 Other Source Term Insights 5.5.1 Peach Bottom Uncertainty Analysis Chemical form of cesium The Peach Bottom UA also identified the chemical form of iodine and cesium as an influential parameter for iodine and cesium release fractions for all three failure modes. The impacts relate to (1) the amount of iodine as a gas and (2) the cesium permanently deposited in the RPV through chemisorption of cesium from cesium hydroxide onto the stainless steel of reactor internals. A high ratio of cesium hydroxide to cesium molybdate in the released cesium contributed to smaller cesium releases to the environment in simulations that promoted in-vessel chemisorption (e.g., the Peach Bottom realizations with delayed MSL failures).

Although cesium hydroxide has a significantly higher vapor pressure and can be more mobile as vapor than cesium molybdate, the cesium in the cesium hydroxide chemisorbed at a higher rate to the RPV stainless steel structures (e.g., the dryers, separators, and vessel liner). In calculations where core degradation occurred before or without failure of the lowest setpoint SRV (i.e., the vessel remained at high pressure during the core-degradation phase), the potential for chemisorption was higher due to higher structural temperatures in the RPV. For simulations with cesium predominantly as cesium hydroxide, more than half of the initial cesium inventory was permanently chemisorbed and retained in the RPV. This influence is only pertinent for the realizations that have all or some of the reactor core cesium inventory present as cesium hydroxide (i.e., 62.5 percent of the realizations formed all excess cesium as cesium molybdate after first forming cesium iodide).

5-49 5.5.2 Pressurized-Water Reactor Uncertainty Analyses Insights on the iodine gas fraction from the Surry uncertainty analysis The Surry UA varied the fraction of gaseous iodine versus the time in cycle. The fraction of gaseous iodine versus an aerosol form of iodine is based on data from the French Commission for Atomic Energy and Alternative Energies (CEA) detailing the fraction of fission gas released to the fuel-cladding gap as a function of burnup (see Figure 5-27Figure ). The uncertainty in the measured gap gas mass (i.e., represented as a fraction of the total iodine inventory) at a particular burnup is the sampling distribution for the gaseous iodine mass. For each of the specified times selected during the Surry fuel cycle, the range of burnup values is identified. The relevant CEA data are fit to a log-normal distribution, and the gaseous iodine fraction is sampled from that distribution.

Figure 5-27 French Measured Fission Gas Release to the Fuel-Cladding Gap Source: NRC, 2022 The I2 gas gap fraction is identified by each regression technique as explaining much of the overall variance for iodine release masses. Notably, the rank regression model ranks the time in the cycle as the most important parameter (see Section 5.1) and the gas gap fraction as the second most important parameter. The gas gap fraction is also identified as having a high conjoint contribution (i.e., contributing with other parameters to have an influence). The iodine release masses for non-C-SGTR realizations increase with an increasing I2 gas gap fraction, as shown in Figure 5-28. A clustering of release masses exists around the gas gap fractions empirical mean, and the release masses show a strong decade-for-decade relationship with the gas gap fraction in this cluster. Due to the higher mobility of gaseous iodine relative to cesium iodide, the iodine release to the environment is correlated with the specified gaseous mass.

5-50 Figure 5-28 Impact of the Iodine Gas in the Fuel-Cladding Gap on the Total Iodine Release to the Environment in the Surry UA Source: NRC, 2022 Insights on higher ex-vessel molybdenum releases The steel in the ex-vessel debris reacts with oxygen released from the ablation of the concrete to form oxides. The steel component of chromium (Cr) is oxidized first and followed by iron (Fe) and nickel (Ni). When the steel components in the melt (Ni, Cr, and Fe) are exhausted, the Gibbs free energy chemistry model in MELCOR predicts that molybdenum becomes the preferred metal in the debris for oxidation by the ablation gases. The molybdenum oxide (1,555 degrees Celsius (C)) had a much lower boiling point than the molybdenum metal (4,639 degrees C), which dramatically increases the release from the melt and to the environment. The debris change from the depletion of the steel also leads to an increase in the carbon dioxide release rate and a decrease in the carbon monoxide release rate. The timing of the transition is dependent on the concrete type (i.e., limestone or basaltic) and amount of steel in the debris and in the concrete rebar. Appendix A to the draft Surry UA [NRC, 2015] shows the sensitivity of the steel oxidation and ex-vessel molybdenum release versus concrete type. It also shows the sensitivity of the ex-vessel heat balance on the timing of the failure.

The UAs did not include the molybdenum release as a figure of merit. However, the Sequoyah UA shows higher molybdenum releases in the reference calculation (i.e., Realization 266) in Table B-4 of NUREG/CR-7245 [NRC, 2019] (i.e., Realizations 266 for MACCS plumes 109 and 110). The Sequoyah calculations progressed for 72 hr after the SBO, which allowed time for the

5-51 complete oxidation of the steel in the debris.27 Appendix A to the draft Surry UA [NRC, 2015]

described the result in detail. However, the timing of complete steel oxidation is highly dependent on the duration of the ex-vessel CCI, the amount of rebar in the concrete, the dimensions of the ex-vessel cavity, and the CCI heat balance and concrete ablation rate.

Nevertheless, high molybdenum releases are possible late in time.

5.5.3 Implications for Other Plants The other source term insights from the BWR and PWR UAs are expected to have some generic applicability. The chemical form of the cesium is uncertain and likely variable (i.e., the chemistry forming the various forms of cesium and iodine likely changes based on the accident progression for the same plant). However, the chemisorption of cesium to internal stainless structures has a higher applicability to BWRs due to the proximity and very large surface areas of the steam separators and dryers above the core. The same phenomena occur in PWRs but are less effective due to less stainless steel surface area in the reactor upper plenum.

In contrast, the amount of gaseous iodine will directly impact the source term in all reactors. The gaseous iodine is highly mobile, and its subsequent evolution in the containment is complex and uncertain. The formation of iodine gas in the fuel-cladding gap used in the Surry UA shows an increasing inventory as a function of burnup, which was the second most important uncertain parameter affecting the iodine release to the environment (i.e., more important late in the cycle, as discussed in Section 5.5.2). The release behavior of the gas in the fuel-cladding gap and the iodine from the fuel matrix has complex uncertainties not explored in the UA. Nevertheless, the early release of iodine gas from the gap is expected to affect the source term in all reactor types (see Figure 5-27).

27 The timing of complete steel oxidation is highly dependent on the duration of the ex-vessel CCI, the amount of rebar in the concrete, the dimensions of the ex-vessel cavity, and the CCI heat balance and concrete ablation rate.

6-1 6 OFFSITE CONSEQUENCE INSIGHTS 6.1 Common Themes The offsite consequence analyses had some common themes across the three SOARCA UAs.

All three projected essentially zero individual early fatality risk and a low individual LCF risk for the affected populations. Even for accident sequence variations leading to early containment failure in which the release to the environment begins before the completion of the 10-mile radius EPZ evacuation, there is negligible individual early fatality risk and the individual LCF risk is low. A handful of realizations out of the hundreds in each UA had a nonzero early risk calculated, and even those are small. In the Peach Bottom UA, where there was a nonzero early fatality risk calculated, of the 865 realizations, the highest absolute scenario-specific early fatality risk calculated was 1x10-10 per reactor year1 with a mean of about 1x10-12 within 1.3 miles (recall the Peach Bottom LTSBO CDF is about 3x10-6 per reactor year2) [NRC, 2016].

Individual LCF risk calculations are generally dominated by long-term exposure to small annual doses (assuming the LNT dose response model). These annual doses are typically3 below 2 rem in the first year after the accident and below 500 mrem per year in subsequent years, corresponding to the habitability criteria for populations exposed to residual contamination over a long period of time. All three SOARCA UAs also corroborated the conclusion from the original SOARCA project [NRC, 2012], that public health consequences from severe nuclear accident scenarios modeled are smaller than those projected in NUREG/CR-2239, Technical Guidance for Siting Criteria Development, issued December 1982 [NRC, 1982].4 The regression analyses from the integrated UAs also showed that input uncertainty in the MELCOR models (contributing to source term uncertainty) made dominant contributions to uncertainty in the LCF risk. Health effect5 risks do not vary as much as the source terms (environmental releases) because the long-term phase dominates the health risk, and people are assumed to not return until doses are below the habitability criterion (according to the protective action plans and modeling).

6.2 Latent Cancer Fatality Risk Insights Figure 4-6 in Section 4.2 shows the conditional individual LCF risk results from the Sequoyah STSBO UA. Using the LNT dose response model, the conditional individual LCF risks for the UA are distributed bimodally and generally decrease with increasing distance from the Sequoyah plant. The bimodal nature of the CCDF curves derives from the fact that the containment does not fail by 72 hr (the end of the simulation) in 13 percent of the realizations and does fail before 72 hr in the remaining 87 percent of the realizations. The cases with no containment failure account for the upper left (very low risk) portion of the CCDF curves; the cases with containment failure account for the right (relatively higher risk) portion of the CCDF 1

Estimated risks below 1x10-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the analyses and the inherent uncertainty in very small calculated numbers.

2 This CDF estimate is based on information and expert judgment at the time the original Peach Bottom SOARCA UA was conducted. This study included no new work to quantify the contribution to CDF.

3 The habitability criteria can be more restrictive in certain States, such as in Pennsylvania, where Peach Bottom is located.

4 One of the purposes of the original SOARCA study, as laid out in SECY-05-0233, Plan for Developing State of the Art Reactor Consequence Analyses [NRC, 2005a], and approved in the staff requirements memorandum for SECY-05-0233, dated April 14, 2006 [NRC, 2005b], was to develop state-of-the-art reactor consequence assessments of severe accidents and update such analyses as NUREG/CR-2239.

5 Unless the potential uncertainty in low-dose and low-dose-rate modeling is taken into account; see, for example, the difference in results when using alternate dose-threshold models in Section 6.2.2.

6-2 curves. These risks are conditional on the occurrence of an STSBO. Contributions from the long-term phase risks dominate the emergency-phase risks for the large majority of the realizations.

Figure 4-7 in Section 4.2 shows the conditional individual LCF risk results from the Surry STSBO UA. Similar to the Sequoyah UA results, the LCF risk distributions show a bimodal nature. In this case, the 12.5 percent of realizations where a C-SGTR occurred account for the hump of higher LCF risks in the lower right of the graph. These LCF risk results are consistent with the source term results (discussed in Section 5.3.2), which showed that the C-SGTR realizations had the largest and earliest cesium and iodine releases.

6.2.1 Insights from Regression Analyses In the Peach Bottom UA, all regression methods at each of the circular areas (within 50 miles of the reactor) consistently ranked the following as the most important input parameters for individual LCF risks:

MACCS dry deposition velocity (VDEPOS) (which had the widest distribution in the Peach Bottom UA of the three SOARCA UAs6), which involves a variety of mechanisms that cause aerosols to deposit, including gravitational settling; impaction onto terrain irregularities, including buildings and other manmade structures; and Brownian diffusion the MELCOR SRV stochastic failure probability, an important MELCOR parameter for source term determination (as noted in Section 5.2.2) the MACCS residual cancer risk factor (CFRISK),7 which is used for estimating cancers not related to the seven organ-specific cancers that were examined in the SOARCA project The following additional parameters consistently showed some level of importance at all circular areas:

the MELCOR fuel failure criterion, which is the time endurance of the upright, cylindrical configuration of fuel rod bundles the MELCOR drywell liner melt-through open area flowpath the MACCS residual7 dose and dose-rate effectiveness factor (DDREFA), which was based on BEIR V8 risk factors for estimating health effects to account for observed differences between low and high dose rates In the Sequoyah UA, regression analyses indicated that the time in cycle (CYCLE) when the accident occurs (a variable that was not made uncertain in the Peach Bottom UA) had the 6

The distribution was revised after peer review comments on the Peach Bottom UA and reevaluation by the SOARCA team subject matter experts. The resulting distribution of dry deposition velocity had more narrow bounds in the Sequoyah and Surry UAs, where this variable did not show the same level of importance.

7 The MACCS versions used in the SOARCA analyses were limited to eight cancer sites (organs). In the SOARCA analyses, seven are specific (lung, red bone marrow, bone, breast, thyroid, liver, and colon). The last (residual) cancer site represents the cancers not explicitly modeled and is based on the dose for the pancreas, which is used as a surrogate for other soft tissues.

8 National Research Council, Committee on the Biological Effects of Ionizing Radiation, Health Effects of Exposure to Low Levels of Ionizing Radiation: BEIR V (1990).

6-3 largest influence on consequences of all the uncertain inputs considered in the Sequoyah STSBO UA; this parameter affects both fission product inventory and the associated decay heat. Within the 10-mile EPZ, three MACCS parameters and two additional MELCOR parameters were also assessed as important. The MACCS parameters were the cancer risk factors (CFRISK) for residual and colon cancers and the long-term groundshine shielding factor (LGSHFAC). The cancer fatality risk factor for the residual organ9 represents all the cancer types not specifically treated in MACCS. The MELCOR parameters were the aggregate primary (pressurizer) SV cycles to failure and containment rupture pressure. Two additional MACCS parameters, the cancer risk factor for lung cancer and the normal relocation time (TIMNRM),

were important at farther distances presented in the regression analyses.

In the Surry UA [NRC, 2022], when the full set of realizations was evaluated, the most important input variables identified were consistently the MELCOR parameters specifying the flaw depths in the SG tubes (the possibility of an induced SGTR was modeled in the Surry STSBO UA) and the containment design leakage area. Also, the MACCS parameters for the long-term groundshine shielding factor (LGSHFAC) and the time at which the accident occurs during the operating cycle (CYCLE), which directly affects both MELCOR and MACCS inputs, were important. The flaw depths significantly influence the likelihood that an SGTR occurs. The containment design leakage area is proportional to the containment leakage rate, which is an important release path when an SGTR does not occur. Long-term groundshine exposures are responsible for most of the long-term doses and are proportional to the groundshine shielding factor (GSHFAC), and as a result, this factor was the most important of the uncertain MACCS input parameters. The time when the accident occurs during the operating cycle directly influences core degradation through decay heat in MELCOR and doses to individuals through the isotopic inventories in the core in MACCS, and this parameter contributed significantly to LCF risk.

Each of the three SOARCA UAs included supplementary separate sensitivity analyses to provide additional insights into the MACCS analyses [NRC, 2016; NRC, 2019; NRC, 2022]. For example, the Peach Bottom UA included important sensitivity analyses on the effect of protective action and habitability criteria, alternate dose response models (e.g., linear-with-threshold models with different threshold levels) [Bixler et al., 2013], the effect of weather sampling technique [Bixler et al., 2013a], the contribution of different types of uncertainty (e.g., source term uncertainty, weather uncertainty, offsite consequence modeling epistemic uncertainty) to consequence results [Bixler et al., 2014], and others [NRC, 2016].

Given the assumption of a strong seismic event initiator in the Sequoyah STSBO UA, a matrix of sensitivity analyses was performed for alternate protective actions (in case evacuation was delayed), such as extended shelter in place, and different shielding factors (in case of structural damage to shelters caused by the seismic event) [NRC, 2016]. For the updated Surry STSBO UA, MACCS sensitivity evaluations investigated the importance of the different released chemical groups and isotopes to health risk.

6.2.2 Habitability Criteria and Alternate Dose-Response Models In the SOARCA Peach Bottom UA, a series of sensitivity analyses using five different habitability criteria (i.e., dose limits used to determine when the public is allowed to return 9

The MACCS versions used in the SOARCA analyses were limited to eight cancer sites (organs). In the SOARCA analyses, seven are specific (lung, red bone marrow, bone, breast, thyroid, liver, and colon). The last (residual) cancer site represents the cancers not explicitly modeled and is based on the dose for the pancreas, which is used as a surrogate for other soft tissues.

6-4 following the emergency phase) was conducted for the LNT dose-response model. All the sensitivity simulations use the SOARCA UA base case source term (described in Appendix C to NUREG/CR-7155 [NRC, 2016]). As an additional comparison, the Peach Bottom unmitigated LTSBO scenario also presented the conditional, mean, individual LCF risk (per event) results from the original SOARCA study [NRC, 2012]. All MACCS variables remained fixed other than the habitability parameters (e.g., TMPACT, DSCRLT, CRTOCR). The applicable habitability guideline in the State of Pennsylvania (where Peach Bottom is sited) at the time was 0.5 rem/year beginning in the first year. The applicable Federal recommendation (from the U.S. Environmental Protection Agency) at the time was implemented as a cumulative 4 rem over the first 5 years of exposure (2 rem in the first year + 4 years x 0.5 rem/year). Figure 6-1 shows a relatively straightforward relationship between the habitability criterion and the LCF risk at all radial intervals considered; LCF risk increases with higher habitability limits.

Figure 6-1 Habitability Criterion Comparison of Conditional, Mean, Individual LCF Risk (per Event) for Specified Circular Areas for the LNT Dose-Response Model Source: NRC, 2016 The habitability criterion can have an even greater effect on the alternate dose response models that employ linear-with-threshold models. For example, Table 6-1 shows the effect of the habitability criterion on LCF risk for the U.S. background dose threshold (USBGR) model, where risk is computed only after the doses are above 0.62 rem/yr (the average background-plus-medical dose to individuals in the United States at the time). Table 6-1 shows that, within the EPZ (10 miles), when the dose rate for the habitability criterion is below the dose threshold level (0.62 rem/yr), LCF risks are two orders of magnitude lower than when the dose rate for the habitability criterion is above the dose threshold level. Table 6-1 also shows the percent difference between each of the habitability criteria as compared with the SOARCA UA

6-5 base case, which uses a 0.5 rem/yr habitability criterion. The percent differences are similar to those shown in Figure 6-1 for the LNT dose-response model for distances beyond the EPZ.

Table 6-1 Habitability Criterion Comparison of Conditional, Mean, Individual LCF Risk (per Event) for USBGR Dose-Response Model, Including Percent Reduction/Increase (-/+) Compared to Base Case, Rounded to One Significant Figure, from the SOARCA Peach Bottom UA Radius (mi)

SOARCA UA Base Case Source Term 0.5 rem/yr (base case) 0.1 rem/yr 2 rem/yr 4 rem/

5yrs 5 rem/ 7yrs 10 9x10-7 8x10-7 3x10-5 3x10-5 4x10-5

-10%

3,000%

4,000%

4,000%

20 3x10-5 2x10-5 4x10-5 4x10-5 4x10-5

-20%

50%

60%

70%

30 2x10-5 1x10-5 2x10-5 3x10-5 3x10-5

-30%

50%

60%

60%

40 8x10-6 5x10-6 1x10-5 1x10-5 1x10-5

-40%

60%

70%

70%

50 5x10-6 3x10-6 8x10-6 9x10-6 1x10-5

-40%

70%

80%

90%

Source: NRC, 2016 6.2.3 Alternate Protective Action and Shielding Assumptions for Seismic Initiator The SOARCA Sequoyah UA included sensitivity analyses to study the impact of alternate protective action strategies, such as extended sheltering in place (assuming that the EPZ public may not be able to evacuate, or may be ordered not to evacuate, immediately), and seismically impacted shielding (e.g., reduced shielding due to seismic damage to structures). Figure 6-2 shows the results of some of these analyses; in this case, for one of the realizations that resulted in early containment failure with a relatively large source term. Columns shaded blue present results with nominal sheltering shielding parameters, columns shaded purple represent the 50 percent of nominal shielding factors, and columns shaded green represent evacuation-equivalent shielding (i.e., minimal shielding). The solid portion of the bars present the long-term phase contribution to LCF risk while the hatched regions reflect the emergency-or early-phase contribution to LCF risk. Assuming a portion of the shielding structures is degraded to a point that a fraction of the population is unable to shelter indoors, or shelters in degraded structures, the 12-and 48-hr shelter-in-place order increases the emergency-phase LCF risk, compared to nominal evacuation and sheltering, by factors of about 5 and about 8, respectively.

Finally, if the entire population does not have effective sheltering structures for the entire

6-6 duration of the delay to evacuation, the emergency-phase LCF risk increases by factors of about 8 and about 13 for the 12-and 48-hr delay to evacuation duration [NRC, 2019].

Figure 6-2 Conditional Mean (over Weather Variability) Individual LNT LCF Risk within the 0- to 10-Mile Interval Assuming Degrees of Degraded Structures during an Extended Shelter in Place for Realization 554 in the SOARCA Sequoyah UA Source: NRC, 2019 6.2.4 Contribution of Different Chemical Groups to Latent Cancer Fatality Risk In the Peach Bottom UA [NRC, 2016], rather than considering the fraction of cesium released to the environment alone for all MELCOR single realizations analyzed, when the cesium and cerium release fractions are both considered, a better relationship to LCF risk appears. Cesium is generally regarded as the most important contributor to long-term health risk, due to its half-life (on the order of decades) and dose hazard from external exposure. Cerium is an inhalation hazard and can be an important contributor to LCF risk, particularly during the early phase when populations may not have evacuated or relocated (if outside the EPZ and projected to exceed the relocation criteria) ahead of the release plumes. Figure 6-3 shows the conditional, mean, individual LCF risk (per event) for the selected realizations from the MELCOR single realization analyses10 within the 20-mile circular area for the emergency-phase risk contribution 10 As discussed at the end of Section 2.3, single realizations were selected to help explain the phenomenological reasons for the range in different results and outliers.

6-7 (red) and the long-term phase risk contribution (blue). The red dots on Figure 6-3 are the fraction of cesium in the core released into the environment, and the orange dots are the fraction of cerium in the core released to the environment. The 20-mile circular area includes the 10-20 mile annular area where (other than the assumed shadow evacuees) the population is not automatically under evacuation procedures. Realizations 52 and 134 had both the highest emergency-phase LCF risk contributions and the highest cerium release fractions.

The updated Surry STSBO UA also includes MACCS sensitivity evaluations to investigate the importance of the different released chemical groups and isotopes to health risk in the 0 to 50-mile radial circle in the reference non-SGTR and SGTR realizations [NRC, 2022]. As expected, the cesium group firmly dominates the risk to the 0 to 50-mile population, where the risk is consistently dominated by the long-term phase. Within the cesium group, Cs-137 is more important than Cs-134.

Figure 6-3 Conditional, Mean, Individual LCF Risk (per Event) for MELCOR Single Realizations for the 20-Mile Circular Area in the SOARCA Peach Bottom UA Source: NRC, 2016 6.3 Early Fatality Risk Insights In the SOARCA Peach Bottom UA, the early fatality risks were zero for 87 percent of the 865 realizations, within all specified circular areas. This is because the releases are too low to produce doses large enough to exceed the dose thresholds for early fatalities, even for the 0.5 percent of the population that is modeled as refusing to evacuate. Of the 865 MACCS realizations investigated, 11 percent resulted in a nonzero early fatality risk per event for the

6-8 population within 1.3 miles. At 2 miles, but not at 1.3 miles, 1.3 percent of the realizations result in an early fatality risk. A select few realizations (3 of the 865) resulted in a nonzero early fatality risk per event out to 10 miles; in other words, combining a large-enough source term with specific weather trials and uncertain input parameter values resulted in early fatality risks out to the boundary of the EPZ.

Table 6-2 shows statistical results for conditional, mean (over weather variability), individual early fatality risk (per event) from the MACCS UA within the specified circular areas. At 2.5 miles and beyond in Table 6-2, the mean result is greater than the 95th percentile. This is due to the few number of nonzero early fatality risks (i.e., less than 5 percent of the realizations) at these distances. This table shows that early fatality risks are negligible even for the population that resides very close to the plant boundary. The early fatality risks are even lower for Sequoyah and Surry than they are for Peach Bottom.

Table 6-2 Conditional,a Mean (Averaged over Weather Variability), Individual Early Fatality Risk (per Event) Statistics for the Peach Bottom SOARCA UA for Circular Areas with Specified Radii, Centered on the Plant, Rounded to One Significant Figure 0-1.3 miles 0-2 miles 0-2.5 miles 0-3 miles 0-3.5 miles Mean 5 x10-7 2 x10-7 9 x10-8 6 x10-8 4 x10-8 Median 0.0 0.0 0.0 0.0 0.0 75th percentile 0.0 0.0 0.0 0.0 0.0 95th percentile 2 x10-6 7 x10-7 4 x10-8 5 x10-10 0.0 aThe assessed frequency for this scenario is about 3 x10-6 per reactor-year.

Source: NRC, 2016 The regression results obtained for conditional, mean, individual early fatality risk (per event) for the Peach Bottom SOARCA UA for the circular areas less than 2 miles ranked the MACCS wet deposition model; the MELCOR SRV stochastic failure probability; the MELCOR SRV open area fraction; the MACCS early health effects threshold (EFFTHR) and beta (shape) factor (EFFACB) for red bone marrow; and the MACCS linear, crosswind dispersion coefficient (CYSIGA) as the most important input variables. Additional variables also consistently show some level of importance for circular areas less than 2 miles: the MACCS variable for the amount of shielding between an individual and the source of groundshine (GSHFAC) during normal activities for the nonevacuated residents, the MACCS variable for the evacuation delay (DLTEVA) for Cohort 5 (the tail evacuees), and the MELCOR variable DC station battery duration.

The SOARCA Peach Bottom UA found that 3 of 865 realizations have a nonzero calculated conditional, mean, individual early fatality risk (per event) out to the 10-mile circular area. Since this was not expected, a further investigation into these realizations was conducted to confirm that they were valid model results and to understand the phenomenological explanation. For all three single realizations, the accident progression included an MSL creep rupture, which generally led to higher source terms (as discussed in Section 5.2.2). One of the realizations (i.e., only 1 of the 865 total realizations) showed a nonzero early fatality risk beyond the 10-mile circular area. Also, 50 percent or greater of the weather trials resulted in a nonzero early fatality risk out to the 30-mile circular area in this realization. While the early fatality risk results for this

6-9 realization are extreme, further investigation into the parameters that affected these results does not indicate the source term as the predominant or only cause. Instead, the MELCOR source term and the MACCS sampled parameters, which have a higher early fatality risk contribution for the red bone marrow, contribute to the early fatality risk beyond 10 miles. Specifically, the following variables are at the upper or lower end (i.e., the worst end for consequence in each input variable) of their respective distributions and hence indicate an extremely unlikely outcome:

(1)

The early health effects threshold for red bone marrow (EFFTHR-Red Marrow) is near the 1st percentile of the distribution.

(2)

The beta (shape) factor for red bone marrow (EFFACB-Red Marrow) is near the 10th percentile of the distribution.

(3)

The crosswind dispersion coefficient (CYSIGA) is near the 5th percentile of the distribution.

(4)

The vertical dispersion coefficient (CZSIGA) is near the 5th percentile of the distribution.

(5)

The MELCOR source term is near the 95th percentile of the distribution.

The first two items relate to the most sensitive organ for the early health effects, red marrow.

The third and fourth parameters enable higher concentrations to reach individuals further from the plant due to a tighter plume.

6.4 Implications for Other Sites When considering the applicability of the offsite consequence insights from the SOARCA UAs, it is important to consider both the source term aspects and the site aspects. Each subsection in Section 5 concludes with a discussion of the implications of the accident progression and source term insights for other plants. In addition to these considerations, site-to-site variability must be taken into account when considering the applicability of insights from the SOARCA UAs for LCF and early fatality risks for similar accident scenarios at sites other than the three studied in the SOARCA program.

Section 2.4 of this report lists some notable assumptions of the SOARCA UAs. The successful evacuation of the EPZ (other than the 0.5 percent assumed not to evacuate unless they subsequently meet hot-spot or normal relocation criteria) is an important assumption for both early fatality and LCF risk. Most of the LCF risk comes from the chronic or long-term phase, from the accrual of small doses below habitability criteria over a lifetime. While the emergency-phase doses can dominate under certain conditions, these tend to be firmly in the minority of cases. In considering whether this insight could be extended to other sites for similar accidents, it would be important to note whether their site-specific evacuation time estimates confirm that evacuation of the affected population could indeed be accomplished in advance of any significant releases from the severe accident.

In addition to the consideration of site-specific evacuation time estimates in conjunction with release times to determine potential overlaps, the total population affected can also vary from site to site. The absolute number of people living in different annular rings and radial circles from the plant can vary. Risks can be expected to scale with the absolute population. In addition, the superposition of the site-specific wind rose with the distribution of the population around the

6-10 plant is important to both early health risks and long-term dose accruals, but the wind rose is just one aspect of site-specific meteorology (e.g., average wind speed, frequency of rain) that can cumulatively affect site-specific results.

7-1 7 UNCERTAINTY ANALYSIS METHODOLOGY INSIGHTS The UAs used a two-step Monte Carlo simulation process. Simple random sampling was chosen for the MELCOR calculations, which resulted in source terms. Either simple random sampling or LHS was used for the MACCS parameters, with a sample size to match the number of source terms. This section discusses the pros and cons of the two sampling approaches, for example, with respect to representation of the output distributions and stability analyses.

As noted in Section 2, four regression techniques were used for postprocessing Monte Carlo results to estimate the relative importance of the input parameter uncertainties with respect to the uncertainty in source terms and consequences: linear rank regression, quadratic regression, recursive partitioning, and MARS. This analysis measures the effects of the selected uncertain parameters both individually and in interaction with other parameters. This section discusses some of the challenges that were encountered in employing the regression techniques (e.g., in presenting results from multiple regression techniques), and the teams approach to overcoming these challenges.

The SOARCA UAs represent a first-of-a-kind analysis in its integrated look at uncertainties in MELCOR accident progression and MACCS offsite consequence analyses. As such, an additional objective of the work was to demonstrate UA methodology that could be used in future combined Level 2/3 probabilistic risk assessment and probabilistic consequence analysis studies. This section also discusses insights and lessons learned with regard to the potential application of the SOARCA UA methodologies and approaches in such future studies.

7.1 Choice of Monte Carlo Simulation and Parameter Sampling Monte Carlo methods were developed in the late 1940s as an answer to a specific problem:

how can a function of a large number of inputs be estimated numerically? The problem of dimensionality quickly led to an impractical number of function evaluations. The Monte Carlo technique consists of covering the input space by randomly sampling a vector of values in that input space. A dense coverage ensures that the approximation of the function is close enough to reality so that the appropriate conclusion can be reached. Demonstrations showed that the Monte Carlo approach converges with the true solution as the sample size increases. Thus, the method essentially reduces a multidimensional integral (one dimension per variable) into a monodimensional one. The Monte Carlo method is the core of many sampling-based approaches, notably when the input space represents uncertainty with respect to the system.

The original Monte Carlo method is characterized by sampling randomly in each direction using any of a variety of sampling techniques (e.g., SRS, LHS, importance sampling). Given the complex model simulations involved, the hundreds of uncertain input variables, and the availability of powerful parallel computing capability, the Monte Carlo approach was a natural choice for the SOARCA UAs [Ghosh et al., 2019].

LHS, which employs a stratified sampling approach, is usually preferred over SRS because of its potential to produce results that are more representative of the underlying distribution (particularly for the more extreme quantiles) using fewer samples. However, SRS was chosen for MELCOR calculations, from the first SOARCA UA, as some of the MELCOR calculation runs do not converge. If LHS were employed, distributions of analysis outcomes with nonconvergence issues would need to account for an input sample set with stratification that was incomplete. In the first SOARCA UA, the MACCS calculations initially employed LHS, since the MACCS runs did not experience the same convergence challenges. However, subsequent

7-2 SOARCA UAs also used SRS for the MACCS calculations, given the advantage for convergence testing, as discussed in the next section. Also, the sample sizes used in the SOARCA UAs were large enough that LHS had little advantage over SRS [NRC, 2016; Ghosh et al., 2019].

7.2 Stability Analysis As with any numerical method, Monte Carlo techniques will lead to different levels of accuracy, depending notably on the sample size. The purpose of statistical stability analysis is to assess the level of convergence and determine whether the sample size is big enough or whether more realizations may be required. The notion of stability is hard to capture quantitatively, as it is inherently qualitative and often includes subjective judgments. While it can be expressed with a formal approach (e.g., it is not desirable for the confidence interval to be larger than a certain fraction of the standard deviation or a standard error), the ultimate criterion is whether there is enough confidence that the conclusion will not be affected by the accuracy of the Monte Carlo technique used. To address this, a decision was made to represent stability as a confidence interval around the statistics of interest that quantifies the uncertainty in these statistics due to sample size limitations. Whether the magnitude of uncertainty is acceptable within the context of this analysis is a determination left to experts rather than defined by an arbitrary cutoff.

The method selected to estimate these confidence intervals in the SOARCA UAs was a classical percentile bootstrap. This method requires the generation of a new sample of the same size (with replacement) from the original output sample. The operation is then repeated a large number of times (1,000 iterations were used in the SOARCA Sequoyah UA, for example) to generate a set of possible output distributions. This leads to a distribution for each statistic (mean and quantiles in the SOARCA UAs). A 95-percent confidence interval using a percentile bootstrap is obtained by calculating the 2.5 percentile for the lower bound and 97.5 percentile for the upper bound for each of the statistics. One advantage of the SRS technique is that it is easy to increase the sample size, as any new realization can be added to the existing set.

Furthermore, a subset of the sample is a valid sample of the original distribution, which is one of the required assumptions for using the bootstrap technique.

This property of SRS can also be used to determine an optimal sample size that will lead to an appropriately stable estimate of one output of interest (within the context of the analysis).

Furthermore, if the desired accuracy is not met using the initial sample size, such a technique can be used to extrapolate a potential sample size that should meet the corresponding criterion.

The draft SOARCA Surry UA stability analysis was used to determine the recommended sample size for the SOARCA Sequoyah UA. Figure 7-1 shows an example of the stability analysis results, in this case for cesium release to the environment in the SOARCA Sequoyah UA, for the set of realizations where an MOC time was assumed for the reactor core at the time of the accident. At each point in time through the modeled accident progression, the confidence interval (blue and red) characterizes the expected location of the given statistic. For the MOC cesium median estimate, the width of the confidence bounds is fairly small relative to the mean estimate. For the 95th percentile, however, the width of the bounds is larger relative to the mean estimate. This is consistent with the application of SRS; the number of samples required for a stable estimate of distribution tails is much larger than the number of samples required for a stable estimate of central tendency.

7-3 Figure 7-1 Cesium Middle-Of-Cycle Stability Analysis in Sequoyah STSBO UA Source: NRC, 2019 Further discussion appears in Sallaberry et al. [2014] and Appendix E to NUREG/CR-7155

[NRC, 2016].

Regression analysis of incomplete MELCOR realizations A certain number of MELCOR calculations failed to converge for various reasons in each of the SOARCA UAs. An analysis was thus completed for each UA to determine whether there is a correlation between failed runs and having the realization set in a particular area of the input space. Such a situation would indicate that a particular value for one input (or combination of values for several inputs) would lead to failure. If this value (or set of values) defines a valid physical condition for the reactor, the failed realizations could potentially bias the conclusions that could be drawn by only analyzing the successful runs.

To detect a potential relation between input uncertainty and failure to complete, a regression analysis (using the four regressions techniques used in the SOARCA UAs) was performed, using an indicator function set to 0.0 when the realization failed to run to completion and 1.0 when it ran to completion for the output of interest. The regression results were compared to a similar analysis performed on a uniform discrete random variable (with values 0.0 and 1.0). The regression on a random variable was used as a baseline to indicate the ability of the regression techniques to find a relationship between regions of the input space and an unrelated random variable. Similar results between the random variable analysis and the success indicator

7-4 function analysis would therefore suggest that failed realizations are randomly distributed within the input space.

In most cases, the regression comparisons did not indicate a significant relationship between incomplete realizations and any region of the sample space. In the case of the Sequoyah UA, the regression comparison showed that slightly better relationship models were fit to the realization success indicator than to the random output. However, none of the realization success indicator regressions resulted in models that suggest a relationship strong enough that it could not be due to random chance; while the regressions generated models, those models were fairly weak, and a conclusion could not be established without further investigation.

Table 7-1 shows the results of these regressions for the Sequoyah UA. The only parameter indicated as important was priSVfrac (the aggregate open area fraction upon the FTC of primary SVs) with a high conjoint influence. Further study was focused on the priSVfrac parameter and its relationship to priSVcycles (the aggregate number of cycles experienced by the primary SVs before the primary system depressurizes through a valve failing to close or hot leg failure) because of the conjoint influence also indicated for priSVcycles and the related impact of the two parameters on accident progression. A potential relationship between low cycles to failure and high open area fractions and realization completion was uncovered. Thus, the regression analysis of incomplete realizations was valuable in identifying a gap in the UA that would be beneficial to explore further. A smaller subsequent UA addressed this gap by studying this restricted region of the sample space (documented in Appendix I to NUREG/CR-7245 [NRC, 2019]). The percentage of early containment failure cases (a key result of interest in the Sequoyah UA) in this subsequent focused study compared well to the overall UA and improved confidence in the results.

Table 7-1 Results from Regression on the Realization Success Indicator in the Sequoyah UA Final R 2

Input R

2 contr.

SRRC Si Ti Si Ti Si Ti priSVfrac 0.08

-0.19 0.03 0.44 0.38 0.66 0.42 0.81 0.105 0.136 burn_dir 0.01 0.04 0.06 0.13 0.00 0.21 0.10 0.11 0.015 0.047 priSVcyc 0.08 0.28 0.02 0.14 0.03 0.16 0.014 0.060 secSVfrac 0.01 0.19 0.02 0.08 0.00 0.03 0.005 0.036 Ox_model 0.02 0.15 0.01 0.00 0.003 0.016 Seal_Open_A 0.02 0.05 0.01 0.40 0.003 0.040 shape_fact 0.01 0.09 0.01 0.02 0.002 0.017 EU_melt_T 0.01 0.19 0.00 0.01 0.002 0.033 rupture 0.00 0.05 0.01 0.05 0.00 0.00 0.002 0.014

• highlighted if main contribution larger than 0.02 or conjoint contribution larger than 0.1 Conjoint Contribution 0.09 0.36 0.55 0.28 Rank Regression Quadratic Recursive Partitioning MARS Main Contribution Source: NRC, 2019 7.3 Regression Techniques and Presentation of Results The SOARCA analyses use two complex code suites to estimate the consequences of a severe nuclear accident: MELCOR and MACCS. Both of these code suites involve complex physics

7-5 phenomena and interactions. Past analyses (e.g., NUREG-1150, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, issued December 1990 [NRC, 1990a]) relied mostly on linear and rank regressions, which suppose that the models are mostly additive (i.e., the variance in the results is driven by single effects from individual uncertain inputs) and the influences are linear or monotonic. These suppositions do not hold true for much severe accident modeling for nuclear power reactors.

One of the major problems when trying to capture complex interactions is that so many different types of interactions are possible that a single parametric regression is often not effective in providing an adequate representation for model results. Some techniques, such as rank regression, can be too restrictive, while others may be too broad and capture nonphysical interactions. This may happen with quadratic regression that incorporates all second-order interactions (influence of the type XiXj), as well as with recursive partitioning or MARS. These limitations are more pronounced when the sample size is relatively small compared to the number of input variables under consideration. As an example, the analyses for early fatalities considered approximately 100 input variables, which leads to approximately 10,000 possible regression terms analyzed with quadratic regression. LCF analyses considered about 300 input parameters leading to about 90,000 possible regression terms. In such conditions, it is likely that the regression technique may indicate some important relationships that are, in fact, due to spurious correlation rather than actual importance.

For this reason, the SOARCA UAs used four regression techniques. (Appendix A to NUREG/CR-7155 [NRC, 2016] or Section IV.A. in Ghosh et al., [2019] contain more detailed discussion of the four regression techniques.) Each technique has strengths and weaknesses.

Some effects are captured only by one or two of these techniques, but the same techniques can ignore other kinds of interactions. The analysis of the resulting arrays is, consequently, not as straightforward. The confidence one has on the influence of a parameter is conditional on the number of techniques and the type of techniques capturing this influence. This analysis can only be done in conjunction with a careful physical interpretation and checking of the results. In this sense, the addition of sensitivity cases and the study of selected deterministic cases provided information that was crucial in interpreting the results, as was the subject matter experts knowledge: any strange interaction (or noninteraction if one was expected) was double-checked to understand and explain it (or correct it, if spurious).

The increased complexity of interpretation (compared to the simple rank regression technique) derives from the complexity of the regression models and is necessary to increase the understanding with some confidence that the improvement in R2 is not spurious (or nonphysical) due to the large number of variables considered compared to the sample size.

A consequence of the use of multiple regression techniques is that the ranking of the inputs among themselves is not obvious when the different regression techniques disagree. A qualitative approach had been used in the first SOARCA UA [NRC, 2016] based on the physics considered in the problem and expert knowledge, but such an approach introduces some subjectivity and is hard to document. The Sequoyah and Surry UAs [NRC, 2019; NRC, 2022]

subsequently developed and implemented a more quantitative approach. The team also held a strong belief that such a quantitative ranking is only an indicator and should be supported by expert opinion based on the physics of the problem (and more detailed phenomenological explanations from single-realization analyses).

The present study estimates two effects of the uncertainty, in the input and on the output of consideration. The main effect represents the influence of the uncertain input by itself and is

7-6 estimated with 2

in the stepwise regression and for the other three regression techniques.

Then the effect of the uncertain input from its interaction with other variables, which is ignored by the stepwise regression as it is an additive regression, is estimated with for the other three regressions.

The first effect of the uncertainty in the input was considered the most important, and a decision was made to rank the variables according to this main effect. Stepwise regression provides an estimate of the main effect for each variable directly. For the other regression techniques, the real effect has to be adjusted by the goodness of fit of the model (i.e., the 2 value from the regression model). To accomplish this, each value is multiplied by the 2 value of the regression model. Finally, if a given regression does not include a variable, it is supposed that its main effect is null and the corresponding value is set to zero. The four resulting estimates are combined to create a weighted average, represented by:

Main influence =

2

+

2, 3

=1 4

where 2

is from rank regression, j is the index of the three nonlinear regression techniques, and 2 is the final R2 for each nonlinear technique.

The variables are then sorted according to this weighted average approach in decreasing order, such that the most important variable is listed at the top of the array.

The conjoint influence is captured by estimating for each of the last three regressions and adjusted using the 2 value as a weight. The weighted average is taken again, represented by:

Conjoint influence =

2(,,)

3

=1 3

If the average value is greater than 0.1, is emphasized to draw attention to a potentially important conjoint influence. As the first order indices (i.e., ) and total order indices (i.e., )

are estimated numerically and separately using a Sobol decomposition, they are approximations. If no conjoint influence is present, it may happen that is estimated slightly lower than. In such situations, the value of () was set to zero. These two metrics are added to the summary tables for the four regression results, as an indicator of the importance of the input uncertainty onto the output uncertainty. This represents a best estimate of the ranking of input uncertainty influence toward the uncertainty of the output considered.

To make reading the tables easier, highlighting is applied in the main contribution and conjoint contribution columns to identify the most important parameters with respect to individual and conjoint influence, based on the overall analysis. The cutoff for main contribution effect was set at 0.02, and the cutoff for conjoint effect was set at 0.10. The reason for a difference in the contribution effects is that conjoint contribution influence looks at a larger range of possible interactions (e.g., with 20 input variables, the main contribution looks at 20 potential relations, while conjoint influence for pairs of inputs looks at 190 potential relations) and is more likely to identify spurious correlations. Therefore, an approach that concentrates on a larger contribution was considered appropriate. The SOARCA UA team selected the threshold values of 0.02 and 0.10 based on the knowledge acquired during the Peach Bottom UA [NRC, 2016] and the regressions tables for the subsequent SOARCA UAs, such that important parameters would be acknowledged and negligible influence would not be highlighted. Table 7-1 shows an example

7-7 of a regression analysis table; in this case, for the MELCOR realization success indicator [NRC, 2019].

Sections 5 and 6 of this report include examples of other useful visualizations of results. For example, the use of scatterplots is a qualitative yet powerful technique that complements the suite of regression techniques applied in the SOARCA UAs. Color coding of the outputs of interest from the Monte Carlo simulation, such as radionuclide release horsetails grouped by accident progression characteristics, can also be a useful visualization tool.

8-1 8 CONCLUSIONS The three SOARCA UAs completed a first-of-a-kind analysis in their integrated characterization and propagation of uncertainty in both MELCOR and MACCS model parameters. This was accomplished through a two-step Monte Carlo simulation that first exercised the MELCOR models to compute a set of source terms and then coupled the set of source terms with samples of MACCS uncertain variables to generate offsite consequence metrics. The results were shown as distributions of source terms in terms of cesium and iodine release to the environment and distributions of LCF risk and early fatality risk. Regression analyses were run for various outputs of interest to uncover important uncertain input parameters. The regression analyses for the MACCS outputs identified important parameters in both the MELCOR and MACCS portions of the overall severe accident modeling. Single realization analyses by subject matter experts were also crucial in constructing phenomenological explanations for variations in accident progression, source term, and LCF and early fatality risk.

Some novel insights were uncovered. For example, cesium existing as cesium hydroxide versus cesium molybdate can actually be beneficial (in terms of smaller releases) in high-temperature BWR accident scenarios because of chemisorption, as shown in the Peach Bottom UA. Other insights were suspected or known and were confirmed with more quantitative and specific analyses. For example, the time in the operating cycle when an accident occurs can make a meaningful difference in accident progression, source terms, and offsite consequences, as shown in the Surry UA. The SOARCA UAs also added details and granularity to the existing knowledge base. For example, early containment failure was thought to be a low-probability outcome for ice condenser plants, but the Sequoyah UA identified more specifically under what set of low-probability conditions an early containment failure becomes possible.

The SOARCA UAs served as a model validation exercise in some cases. For example, although early fatality risk is essentially zero or negligible in the accident scenarios studied, it is possible to compute a nonzero early fatality risk in the very low probability cases when the uncertain variables influential for early fatality risk are each sampled at extreme values that promote early fatality riskas was shown through the single realization analyses of outlier cases in the Peach Bottom UA.

9-1 9 REFERENCES Bixler, N.E., D.M. Osborn, J.A. Jones, C.J. Sallaberry, P.D. Mattie, and S.T. Ghosh, SOARCA Peach Bottom Atomic Power Station Long-Term Station Blackout Uncertainty Analysis:

MACCS2 Dose Truncation Sensitivity, Proceedings of American Nuclear Society International Topical Meeting on Probabilistic Safety Assessment and Analysis 2013, Columbia, SC, American Nuclear Society, 2013.

Bixler, N.E., D.M. Osborn, P.D. Mattie, and S.T. Ghosh, SOARCA Peach Bottom Atomic Power Station Long-Term Station Blackout Uncertainty Analysis: MACCS2 Aleatory Weather Effects, Proceedings of American Nuclear Society International Topical Meeting on Probabilistic Safety Assessment and Analysis 2013, Columbia, SC, American Nuclear Society, 2013a.

Bixler, N.E., D.M. Osborn, J.A. Jones, C.J. Sallaberry, P.D. Mattie, and S.T. Ghosh, SOARCA Peach Bottom Atomic Power Station Long-Term Station Blackout Uncertainty Analysis:

Contributions to Overall Uncertainty, Proceedings of the Probabilistic Safety Assessment and Management (PSAM 12) Conference, Honolulu, HI, International Association for Probabilistic Safety Assessment and Management, 2014.

Electric Power Research Institute (EPRI), Type C Containment Isolation Valve Performance, EPRI Report Number 1022599, EPRI, Palo Alto, CA, 2011. Agencywide Documents Access and Management System (ADAMS) Accession No. ML110970450.

Ghosh, S.T., H.E. Esmaili, A.G. Hathaway, D.O. Osborn, K.W. Ross, and K.C. Wagner, Estimating Safety Valve Stochastic Failure-to-Close Probabilities for the Purpose of Nuclear Reactor Severe Accident Analysis, Proceedings of the Thirteenth NRC/ASME Symposium on Valves, Pumps, and Inservice Testing, NUREG/CP-0152, Volume 10, U.S. Nuclear Regulatory Commission, Washington, DC, 2017.

Ghosh, S.T., H.E. Esmaili, A.G. Hathaway, N. Bixler, D. Brooks, D. Osborn, K. Ross, and K. Wagner, State-of-the-Art Reactor Consequence Analyses Project Uncertainty Analyses: Insights on Methodologies, Proceedings of the Probabilistic Safety Assessment Conference, American Nuclear Society, 2019. ADAMS Accession No. ML19064B355.

Ghosh, S.T., H.E. Esmaili, A.G. Hathaway, N. Bixler, D. Brooks, M. Dennis, D. Osborn, K. Ross, and K. Wagner, State-of-the-Art Reactor Consequence Analyses Project: Uncertainty Analyses for Station Blackout Scenarios, Nuclear Technology, 207(3), pp. 441-451, 2021.

Jones, J., D.M. Osborn, K.W. Ross, J.N. Cardoni, and S.T. Ghosh, SOARCA Surry Power Station Uncertainty Analysis: Parameter Methodology and Insights, Proceedings of the Probabilistic Safety Assessment and Management (PSAM 12) Conference, Honolulu, HI, International Association for Probabilistic Safety Assessment and Management, 2014.

NRC, Technical Guidance for Siting Criteria Development, NUREG/CR-2239, U.S. Nuclear Regulatory Commission, Washington, DC, 1982.

9-2 NRC, An Assessment of BWR Mark-II Containment Challenges, Failure Modes, and Potential Improvements in Performance, NUREG/CR-5528, U.S. Nuclear Regulatory Commission, Washington, DC, 1990.

NRC, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants NUREG-1150, U.S. Nuclear Regulatory Commission, Washington, DC, 1990a.

NRC, U.S. Operating Experience with Thermally Treated Alloy 600 Steam Generator Tubes, NUREG-1771, U.S. Nuclear Regulatory Commission, Washington, DC, 2003. ADAMS Accession No. ML031140094.

NRC, CFD Analysis of Full-Scale Steam Generator Inlet Plenum Mixing During a PWR Severe Accident, NUREG-1788, U.S. Nuclear Regulatory Commission, Washington, DC, 2004.

ADAMS Accession No. ML041380224.

NRC, MELCOR Computer Code Manuals, Vol. 2: Reference Manuals, Version 1.8.6, NUREG/CR-6119, Vol. 2, Rev. 3, U.S. Nuclear Regulatory Commission, Washington, DC, 2005.

NRC, Plan for Developing State-of-the Art Reactor Consequence Analyses, SECY-05-0233, U.S. Nuclear Regulatory Commission, Washington, DC, 2005a. ADAMS Accession No. ML11228A232.

NRC, Staff RequirementsSECY-05-0233Plan for Developing State-of-the Art Reactor Consequence Analyses, SRM-SECY-05-0233, U.S. Nuclear Regulatory Commission, Washington, DC, 2005b.

NRC, Eddy Current Reliability Results from the Steam Generator Mock-up Analysis Round-Robin, NUREG/CR-6791, Revision 1, U.S. Nuclear Regulatory Commission, Washington, DC, 2009. ADAMS Accession No. ML092870775.

NRC, Computational Fluid Dynamics Analysis of Natural Circulation Flows in a Pressurized-Water Reactor Loop under Severe Accident Conditions, NUREG-1922, U.S. Nuclear Regulatory Commission, Washington, DC, 2010. ADAMS Accession No. ML110110152.

NRC, SCDAP/RELAP5 Thermal-Hydraulic Evaluations of the Potential for Containment Bypass During Extended Station Blackout Severe Accident Sequences in a Westinghouse Four-Loop PWR, NUREG/CR-6995, U.S. Nuclear Regulatory Commission, Washington, DC, 2010a. ADAMS Accession No. ML101130544.

NRC, Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007, NUREG/CR-7037, U.S. Nuclear Regulatory Commission, Washington, DC, 2011.

ADAMS Accession No. ML110980205.

NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Report, NUREG-1935, U.S. Nuclear Regulatory Commission, Washington, DC, 2012. ADAMS Accession No. ML12332A057.

9-3 NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project Volume 1: Peach Bottom Integrated Analysis, NUREG/CR-7110, Volume 1, Revision 1, U.S. Nuclear Regulatory Commission, Washington, DC, 2013. ADAMS Accession No. ML13150A053.

NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project Volume 2: Surry Integrated Analysis, NUREG/CR-7110, Volume 2, Revision 1, U.S. Nuclear Regulatory Commission, Washington, DC, 2013a. ADAMS Accession No. ML13240A242.

NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Surry Uncertainty Analysis, Draft Report, U.S. Nuclear Regulatory Commission, Washington, DC, 2015.

ADAMS Accession No. ML15224A001.

NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Uncertainty Analysis of the Unmitigated Long-Term Station Blackout of the Peach Bottom Atomic Power Station, NUREG/CR-7155, U.S. Nuclear Regulatory Commission, Washington, DC, 2016. ADAMS Accession No. ML16133A461.

NRC, CFD Predictions of Severe Accident Natural Circulation Flows in a Combustion Engineering PWR, Boyd, C., U.S. Nuclear Regulatory Commission, Washington, DC, 2016a. ADAMS Accession No. ML16068A170.

NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Sequoyah Integrated Deterministic and Uncertainty Analyses, Draft Technical Report, U.S. Nuclear Regulatory Commission, Washington, DC, 2016b. ADAMS Accession No. ML16096A374.

NRC, An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 3, U.S. Nuclear Regulatory Commission, Washington, DC, 2017. ADAMS Accession No. ML17317A256.

NRC, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, NUREG-1855, Revision 1, U.S. Nuclear Regulatory Commission, Washington, DC, 2017a. ADAMS Accession No. ML17062A466.

NRC, Consequential SGTR Analysis for Westinghouse and Combustion Engineering Plants with Thermally Treated Alloy 600 and 690 Steam Generator Tubes, NUREG-2195, U.S. Nuclear Regulatory Commission, Washington, DC, 2018. ADAMS Accession No. ML18122A012.

NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Sequoyah Integrated Deterministic and Uncertainty Analyses, NUREG/CR-7245, U.S. Nuclear Regulatory Commission, Washington, DC, 2019. ADAMS Accession No. ML19296B786.

NRC, Modeling Potential Reactor Accident Consequences, State-of-the-Art Reactor Consequence Analyses: Using decades of research and experience to model accident progression, mitigation, emergency response, and health effects, NUREG/BR-0359, Revision 3, Washington, DC, 2020. ADAMS Accession No. ML20304A339.

9-4 NRC, Benefits and Uses of the State-of-the-Art Reactor Consequence Analyses (SOARCA)

Project, Research Information Letter, RIL-2020-03, U.S. Nuclear Regulatory Commission, Washington, DC, 2020a. ADAMS Accession No. ML20100J883.

NRC, Official Transcript of Proceedings: Nuclear Regulatory Commission Advisory Committee on Reactor Safeguards, November 2, 2021, teleconference, U.S. Nuclear Regulatory Commission, Washington, DC, 2021. ADAMS Accession No. ML21321A161.

NRC, State-of-the-Art Reactor Consequence Analyses (SOARCA) Project: Uncertainty Analysis of the Unmitigated Short-Term Station Blackout of the Surry Power Station, NUREG/CR-7262, U.S. Nuclear -Regulatory Commission, Washington, DC, forthcoming 2022.

Sallaberry, C.J., D.M. Osborn, N.E. Bixler, A.C. Eckert-Gallup, P.D. Mattie, and S.T. Ghosh, SOARCA Peach Bottom Atomic Power Station Long-Term Station Blackout Uncertainty Analysis: Convergence of the Uncertainty Results, SAND2014-1346C, Proceedings of the Probabilistic Safety Assessment and Management (PSAM 12) Conference, Honolulu, HI, International Association for Probabilistic Safety Assessment and Management, 2014.

Wagner, Kenneth C., Christopher Faucett, Dusty Brooks, and Aaron Krueger, An Overview of the State-of-the-Art Reactor Consequence Uncertainty Assessment Accident Progression Insights, SAND2020-6295, Sandia National Laboratories, 2020.

Wagner, Kenneth C., Christopher Faucett, Kyle Ross, Brad Beeny, and Dusty Brooks, MELCOR 2.2 Benchmarks of Peach Bottom NUREG/CR-7155 Uncertainty Analysis, SAND2020-6298, Sandia National Laboratories, 2020a.

Zhu, M. and A. Lu, The Counter-intuitive Non-informative Prior for the Bernoulli Family, Journal of Statistics Education, 12(2), 2004.

NUREG-2254 S.T. Ghosh*, N.E. Bixler**, D. Brooks**, M.L. Dennis**, H.E. Esmaili*,

C. Faucett**, R.O. Gauntt**, S. Haq*, T. Haskin**, A.G. Hathaway*,

P.D. Mattie**, D. Osborn**, K.W. Ross**, K.C. Wagner**

• U.S. Nuclear Regulatory Commission **Sandia National Laboratories Division of Systems Analysis Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Same as above The U.S. Nuclear Regulatory Commission, with the assistance of Sandia National Laboratories, conducted three uncertainty analyses (UAs) from 2010 through 2019 as part of the State-of-the-Art Reactor Consequence Analyses (SOARCA) project. The SOARCA project was initiated to leverage decades worth of research into severe accidents and apply modern analytical tools and techniques to develop a body of knowledge about the realistic consequences of severe nuclear reactor accidents. The original study focused on providing a best estimate evaluation for select scenarios. The SOARCA UAs extended this work to include an integrated evaluation and propagation of uncertainty through detailed accident progression, radiological release, and offsite health consequence modeling using the MELCOR and MACCS codes. As such, the first of the three UAs was a first-of-a-kind analysis. This report presents important results and insights as well as the methodology and scope of the three SOARCA UAs, including the UA results often of most interest in severe accident consequence and risk studies (i.e., cesium and iodine releases and offsite latent cancer fatality risk). This report also presents key insights into input variables and associated phenomena that most influenced variations in source term and offsite health consequences, as well as other insights on UA methodology.

Severe accident consequence analysis, uncertainty analysis, MACCS, MELCOR October 2022 Technical Summary of the Uncertainty Analyses for the State-of-the-Art Reactor Consequence Analyses Project

NUREG-2254 Summary of the Uncertainty Analyses for the State-of-the-Art Reactor Consequence Analyses Project October 2022