ML12208A429

Attachment 1, Firstenergy Statement of Material Facts on Which There Is No Genuine Issue to Be Heard (July 26, 2012)

ML12208A429
Person / Time
Site:	Davis Besse
Issue date:	07/26/2012
From:	Jenkins D, Matthews T, O'Neill M, Sutton K First Energy Services, Morgan, Morgan, Lewis & Bockius, LLP
To:	Atomic Safety and Licensing Board Panel
SECY RAS
References
RAS 23041, 50-346-LR, ASLBP 11-907-01-LR-BD01
Download: ML12208A429 (703)

Text

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 1 FirstEnergys Statement of Material Facts on Which There is No Genuine Issue to be Heard (July 26, 2012)

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD

)

In the Matter of )

) Docket No. 50-346-LR FIRSTENERGY NUCLEAR OPERATING COMPANY )

)

(Davis-Besse Nuclear Power Station, Unit 1) ) July 26, 2012

)

FIRSTENERGYS STATEMENT OF MATERIAL FACTS ON WHICH THERE IS NO GENUINE DISPUTE TO BE HEARD FirstEnergy Nuclear Operating Company (FirstEnergy) submits this statement of undisputed material facts in support of its Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms) (July 26, 2012).

I. REGULATORY AND TECHNICAL BACKGROUND A. Submittal of the Original and Revised Davis-Besse SAMA Analyses

1. On August 27, 2010, FirstEnergy submitted a license renewal application (LRA),

requesting that the NRC renew the operating license for Davis-Besse Nuclear Power Station, Unit 1 (Davis-Besse) for 20 years (i.e., through April 22, 2037). Letter from Barry S. Allen, FirstEnergy, to NRC Document Control Desk, License Renewal Application and Ohio Coastal Zone Management Program Consistency Certification (ADAMS Accession No. ML102450572 (package)).

2. As required by 10 C.F.R. § 51.53(c)(3)(ii)(L), FirstEnergy prepared an analysis of severe accident mitigation alternatives (SAMAs) as part of its LRA. The Davis-Besse SAMA analysis is documented in Section 4.20 and Attachment E of the Environmental Report (ER).

ER § 4.20 (Severe Accident Mitigation Alternatives) & Attach. E (Severe Accident Mitigation Alternatives Analysis).

3. On July 16, 2012, FirstEnergy submitted to the NRC certain revisions to the SAMA analysis documented in ER Section 4.20 and ER Attachment E. Among other things, the revised

SAMA analysis accounts for FirstEnergys use of updated Modular Accident Analysis Program (MAAP) code runs that, consistent with MAAP Users Group recommendations, are based on core inventory radionuclide masses instead of radionuclide activities. Letter from John C.

Dominy, Director, Site Maintenance, FirstEnergy, to NRC Document Control Desk, Correction of Errors in the Davis-Besse Nuclear Power Station, Unit No. 1, License Renewal Application (TAC No. ME4613) Environmental Report Severe Accident Mitigation Alternatives Analysis, and License Renewal Application Amendment No. 29 (July 16, 2012) (Revised SAMA Analysis Submittal) (Attach. 5).

B. SAMA Analysis Requirements and Guidance

4. SAMAs, by definition, pertain to severe accidents; i.e., accidents in which substantial damage is done to the reactor core, whether or not there are serious offsite consequences. Policy Statement on Severe Reactor Accidents Regarding Future Design and Existing Plants, 50 Fed. Reg. 32,138 (Aug. 8, 1985) (Attach. 11); Joint Declaration of Kevin OKula and Grant Teagarden in Support of FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms) at ¶ 15 (July 26, 2012) (Joint Decl.) (Attach. 2).

5. NUREG-1437, Generic Environmental Impact Statement for License Renewal of Nuclear Plants, Vol. 1, at 5-1 to 5-20 (May 1996) (GEIS) (Attach. 12), provides an evaluation of severe accident impacts that applies to all U.S. nuclear power plants. Based on the GEIS evaluation of severe accident impacts, 10 C.F.R. Part 51 concludes that the [t]he probability weighted consequences of atmospheric releases, fallout onto open bodies of water, releases to ground water, and societal and economic impacts from severe accidents are small for all plants.

10 C.F.R. Part 51, Subpart A, App. B, Table B-1 (Postulated Accidents; Severe accidents); Joint Decl. ¶ 15.

6. 10 C.F.R. Part 51 states that if the Staff has not previously considered SAMAs for a license renewal applicants plant in an EIS or in an environmental assessment, then the applicant must complete an evaluation of alternatives to mitigate severe accidents. 10 C.F.R.

§ 51.53(c)(3)(ii)(L); see also 10 C.F.R. Part 51, Subpart A, App. B, Table B-1; Joint Decl. ¶ 16.

7. SAMA analysis is a site-specific, probability-weighted assessment of the benefits and costs of mitigation alternatives that might be used to reduce the risks (frequencies or consequences or both) of potential nuclear power plant severe accidents. It estimates annual 2

average impacts for the entire 50-mile radius region surrounding a nuclear power plant. Joint Decl. ¶ 17.

8. The Nuclear Energy Institute (NEI) has issued a guidance document, NEI 05-01, Revision A, to assist NRC license renewal applicants in preparing SAMA analyses. NEI 05-01, Rev. A, Severe Accident Mitigation Alternatives (SAMA) Analysis, Guidance Document, at i (Nov. 2005) (NEI 05-01) (Attach. 14); Joint Decl. ¶ 18.

9. The Staff has approved and recommended the use of NEI 05-01 by license renewal applicants. Final License Renewal Interim Staff Guidance LR-ISG-2006-03: Staff Guidance for Preparing Severe Accident Mitigation Alternatives Analyses (Aug. 2007) (Attach. 15); Joint Decl. ¶ 18.

10. NEI 05-01 states: The purpose of the analysis is to identify SAMA candidates that have the potential to reduce severe accident risk and to determine if implementation of each SAMA candidate is cost-beneficial. NEI 05-01 at 1 (Attach. 15); Joint Decl. ¶ 18.

11. A SAMA analysis identifies potential changes to a nuclear power plant, or its operations, that could reduce the already low risk (frequency and/or the consequence) of a severe accident for which the benefit of implementing the change may outweigh the cost of implementation. Changes to the plant that could reduce the risk of a severe accident include plant modifications or operational changes (e.g., improved procedures, augmented training of control room and plant personnel). NEI 05-01 at 1, 23 (Attach. 15); Joint Decl. ¶ 18.

12. A SAMA analysis, broadly speaking, involves four major sequential steps: (1) using probabilistic risk assessments (PRAs) and other risk studies to characterize the overall plant-specific severe accident risk by identifying and characterizing the leading contributors to core damage frequency (CDF) and offsite risk based on a plant-specific risk study; (2) identifying potential plant improvements (i.e., SAMA candidates) that could reduce the risk of a severe accident; (3) quantifying the risk-reduction potential and the implementation cost for each SAMA candidate; and (4) determining whether implementation of the SAMA candidates may be cost-effective. NEI 05-01 at 2 (Attach. 15); Joint Decl. ¶ 19.

13. The SAMA evaluation of a plant is based on the numerical evaluation of severe accident risk impacts in four categories: (1) offsite exposure cost, (2) offsite economic cost, (3) 3

onsite exposure cost, and (4) onsite economic cost. This methodology for the overall SAMA analysis approach is based on methods found in NRC guidance. NEI 05-01 at 28 (Attach. 15);

NUREG/BR-0184, Regulatory Analysis Technical Evaluation Handbook, Rev. 4 (Jan. 1997)

(Attach. 16); NUREG/BR-0058, Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Commission, Revision 4 (August 2004) (Attach 17); Joint Decl. ¶ 19.

C. Use of Plant-Specific Probabilistic Risk Assessment (PRA) in SAMA Analyses

14. The basis for a SAMA analysis conducted for a U.S. nuclear power plant is a sequential, three-level probabilistic risk assessment or PRA. All three PRA levels are required to perform a SAMA analysis. Joint Decl. ¶ 21.

15. The Level 1 PRA establishes the plant damage states and frequency of reactor core damage frequency or CDF. Joint Decl. ¶¶ 47-48.

16. The Level 2 PRA determines different accident progressions and a set of radioactive release conditions from the containment that are assigned to similar representative groups (release categories). The Level 2 PRA defines the sequence of events resulting in a radioactive release to the environment. The source term analysis then follows and quantifies the amount of radioactivity released for a given sequence and the frequency of occurrence (i.e.,

release categories and their respective frequencies). Joint Decl. ¶¶ 47-48.

17. The Level PRA 3 combines the Level 2 PRA results with site-specific parameters (e.g., population distribution, meteorological data, land use data, and economic data) for the Level 3 PRA to calculate offsite public dose and offsite economic consequences of those releases to the environment. Joint Decl. ¶¶ 47-48.

D. Use of the MAAP Code to Develop Source Term Inputs to the MACCS2 Code

18. Various computer codes are used in support of a SAMA analysis. These codes include, among others, the MELCOR Accident Consequence Code System Version 2 (MACCS2) and the Modular Accident Analysis Progression (MAAP) codes. Joint Decl. ¶ 20.

19. As part of the Level 3 PRA, MACCS2 calculates the radiological doses, health effects, and economic consequences that result from postulated releases of radioactive materials to the atmosphere. MACCS2 performs these calculations based on plant- and site-specific, regional, and standardized regulatory inputs. NEI 05-01 at 13 (Attach. 15); Joint Decl. ¶ 20.

4

20. MACCS2 executes three modules (ATMOS, EARLY, and CHRONC) in sequence to calculate consequence values necessary for a SAMA analysis, and models atmospheric transport and dispersion and subsequent deposition in a radial-polar grid (i.e., 16 compass sectors over a 50-mile radius). NUREG/CR-6613, Code Manual for MACCS2: Users Guide, Vol. 1 at 2-1 to 2-3 (May 1998) (Attach. 19); Joint Decl. ¶ 23.

21. ATMOS, in particular, performs calculations pertaining to atmospheric transport, dispersion, and deposition of radioactive material, and to radioactive decay of that material both before and after its release into the atmosphere. NUREG/CR-6613 at 2-2 (Attach. 19); Joint Decl.

¶ 23.

22. The ATMOS input parameters include, among other things, plant-specific source term information, including the core inventory (i.e., the amount of each radionuclide present in the reactor core at the time of accident initiation), and the physical, chemical, and radiological composition of an atmospheric release. NUREG/CR-6613 at 5-23 to 5-28 (Attach. 19); Joint Decl.

¶ 24.

23. The source term is the amount and isotopic composition of material released (or postulated to be released) from the core of a nuclear power reactor during an accident. NUREG-1150, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, Vol. 1, 2-3 tbl. 2.1 (Dec. 1990) (Attach. 10); Joint Decl. ¶ 24.

24. The source term may refer to radionuclide groups in the reactor core inventory at the start of an accident that are released to the containment (i.e., the containment source term) or that are released to the environment (i.e., the environmental source term). Joint Decl. ¶ 25.

25. An environmental source term describes the physical, chemical, and radiological composition of an atmospheric release. The environmental source term description includes: (1) the quantity of each important radionuclide released into the atmosphere, (2) the initial time of the release relative to the start of the accident, (3) the duration of the release, (4) the elevation of the release, (5) the sensible heat released, and (6) the particle size of the released material. Joint Decl.

¶¶ 24-25.

26. The release fraction, i.e., the fraction of the total activity of the fission products released to the environment during the accident, is one component of the source term. It defines 5

the portion of the radionuclide inventory, by radionuclide group, in the reactor core at the start of an accident that is ultimately released to the environment. Joint Decl. ¶ 26.

27. Source terms depend on how rapidly the accident progresses, the path by which the radionuclides escape from the reactor into containment, the path through containment (or possibly bypassing containment altogether), and the effectiveness of both passive and active safety features that are intended to mitigate releases. Joint Decl. ¶ 27.

28. The evaluation of source terms for a SAMA analysis requires use of a detailed analytical model that includes a multitude of physical process sub-models that account for, among other things, the timing and performance of both passive and active plant safety features, and human (i.e., operator) actions affecting accident progression and containment conditions. Joint Decl. ¶ 27.

29. Source terms commonly are estimated in the U.S. using one of two computer codes: the MAAP code and the Methods for Estimation of Leakages and Consequences of Releases (MELCOR) code. Joint Decl. ¶ 28.

30. FirstEnergy used MAAP4 (Version 4.0.6) in support of the Davis-Besse SAMA analysis. Joint Decl. ¶ 28.

31. MAAP simulates the dominant thermal-hydraulic and fission product phenomena in both the primary and containment systems of pressurized water reactors (PWRs) and boiling water reactors (BWRs). MAAP thus evaluates a broad spectrum of phenomena, including steam formation; core heat-up; cladding oxidation and hydrogen evolution; vessel failure; corium-concrete interactions; ignition of combustible gases; fluid entrainment by high-velocity gases; and fission-product release, transport, and deposition. MAAP4 also addresses important engineered safety systems and allows a user to model operator interventions. EPRI Report 1020236, MAAP4 Applications Guidance: Desktop Reference for Using MAAP4 Software, Revision 2 at 2-2 to 2-6 (2010) (MAAP4 Applications Guidance) (Attach. 20); Fauske & Associates, LLC, MAAP (Modular Accident Analysis Program) (Attach. 21); Joint Decl. ¶ 29.

E. Use of Plant-Specific PRAs and MAAP4 Code in the Davis-Besse SAMA Analysis

32. The progression from the failure of individual plant components to the determination of accident frequencies, accident progressions, and offsite consequences involves 6

plant- and site-specific phenomena and can be separated into the three PRA levels. For its SAMA analysis, FirstEnergy used the results from updated Davis-Besse Level 1 and Level 2 PRA models as input to a Level 3 PRA model developed specifically to support the consequence quantification needed for the Davis-Besse SAMA analysis. Joint Decl. ¶¶ 47-48.

33. The Level 1 PRA included initiating event and core damage sequence analyses and yielded a set of plant damage states and associated frequencies. Joint Decl. ¶ 48.

34. The Level 2 PRA used containment event tree (CET) and deterministic source term modeling to provide a set of 34 release categories, each of which has a characteristic frequency and unique timing and fission product magnitude characteristics, depicting the release to the environment. The release categories are defined in terms of similar properties, each with a frequency-weighted mean source term. Joint Decl. ¶ 48.

35. The Level 2 PRA-defined release categories were characterized using the MAAP4 code. The MAAP4 calculations provided a deterministic analysis of the plant under postulated severe accident conditions for a variety of initiating events, and included the influence of operator actions and safety system actuation on accident sequence progression. The MAAP4 calculations predicted the integrated response of the reactor core, primary system, steam generators, and primary containment building. Results included the time of core damage and reactor vessel failure to support Level 1 PRA success criteria, as well as containment response and fission product source term characterization to support the Level 2 and Level 3 assessments. Joint Decl. ¶ 51.

36. Six MACCS2 input parameters came from the output of the Davis-Besse MAAP4 runs: (1) the time after accident initiation that the offsite alarm is initiated (OALARM), (2) the heat content of release segment (PLHEAT), (3) the height of the plume segment at release (PLHITE), (4) the duration of release (PLUDUR), (5) the time of release for each plume (PDELAY), and (6) the release fraction for each radioisotopic group (RELFRC). Joint Decl. ¶ 52.

37. The core inventory for the Davis-Besse Level 3 PRA was obtained from plant-specific calculations performed using the ORIGEN-2 code. For conservatism, the Davis-Besse core inventory was evaluated at the 24-month end-of-cycle for all 177 fuel assemblies. This assumption is conservative because at the end-of-cycle, the radionuclide quantities in the core would be at their peak levels for the 24-month cycle. In total, 58 radionuclides were evaluated in 7

the MACCS2 reactor core inventory for Davis-Besse and are represented in nine fission product groups. Joint Decl. ¶ 52.

38. The release category frequencies and characterizations developed using Level 2 PRA information and MAAP4 were used as inputs to the Level 3 PRA. The Level 2 PRA results were then combined with Davis-Besse site-specific parameters (e.g., population distribution, meteorological data, land use data, and economic data) for the Level 3 PRA to estimate the Davis-Besse Plant offsite population dose risk (in units of person-rem/year) and offsite economic cost risk (in units of dollars/year), the key risk metrics in a SAMA analysis. Joint Decl.

¶¶ 47-48.

II. ISSUES RAISED IN INTERVENORS CONTENTION 4

39. Contention 4 alleges that FirstEnergys SAMA analysis underestimates the true cost of a severe accident at Davis-Besse. Beyond Nuclear, Citizens Environment Alliance of Southwestern Ontario, Dont Waste Michigan, and the Green Party of Ohio Request for Public Hearing and Petition for Leave to Intervene at 100, 104, 108 (Dec. 27, 2010) (Petition) (Errata filed Jan. 5, 2011); FirstEnergy Nuclear Operating Co. (Davis-Besse Nuclear Power Station, Unit 1), LBP-11-13, slip op. at 50-54, 64 (Apr. 26, 2011), affd in part and revd in part, FirstEnergy Nuclear Operating Co. (Davis-Besse Nuclear Power Station, Unit 1), CLI-12-08, (Mar. 27, 2012).

40. Contention 4 further alleges that FirstEnergy has minimized the potential amount of radioactive material released in a severe accident by using MAAP-derived source terms that are smaller for key radionuclides than the release fractions specified in NRC guidance. Petition at 108. Intervenors make three principal claims in support of their contention (which, for clarity and ease of reference, FirstEnergy refers to as Bases 1, 2 and 3):

1. The MAAP code has not been validated by the NRC. Id. (Basis 1)

2. The radionuclide release fractions generated by MAAP are consistently smaller for key radionuclides than the release fractions specified in NUREG-1465 and result in anomalously low accident consequences. Id. at 108, 112, 114 (Basis 2)

3. It previously has been observed that MAAP generates lower release fractions than those derived and used by NRC in other severe accident studies. Id. at 113. (Basis 3) 8

III. UNDISPUTED FACTS SHOWING LACK OF GENUINE MATERIAL DISPUTE A. Validation of the MAAP Code (Basis 1 of Contention 4)

41. MAAP was originally developed for the Industry Degraded Core Rulemaking (IDCOR) program in the early 1980s by Fauske & Associates, LLC (formerly Fauske &

Associates, Inc.). At the completion of IDCOR, ownership of MAAP was transferred to the Electric Power Research Institute (EPRI), which was charged with maintaining and improving the code. Fauske & Associates, LLC is the current maintenance contractor for the MAAP code.

MAAP4 Applications Guidance at 2-2 (Attach. 20); Joint Decl. ¶¶ 31, 33;

42. Starting in the late 1980s, the MAAP3B version became widely used, first in the United States and then worldwide, to support success criteria determination, human action timing evaluations, and Level 2 analyses for Individual Plant Examinations (IPEs). MAAP4 Applications Guidance at 2-2 (Attach. 20); Joint Decl. ¶ 31.

43. MAAP3B updated to MAAP4 in the mid-1990s to expand its modeling capabilities. MAAP4 incorporates updated physical models for core melt, reactor vessel lower head response, and containment response that provide improved mechanistic modeling of severe accident phenomena. MAAP4 Applications Guidance at 2-2 (Attach. 20); Joint Decl. ¶ 31.

44. Several organizations, including EPRI and the DOE, sponsored the development of MAAP4. As part of the development process, a committee of independent experts reviewed MAAP4 to ensure that it is state-of-the-art and applicable for accident management evaluations.

Further, the new software was subjected to review by a Design Review Committee, comprised of senior members of the nuclear safety community. MAAP4 Applications Guidance at 2-2 (Attach.

20); Joint Decl. ¶ 31.

45. MAAP and its successor versions, including MAAP4, were developed in accordance 10 C.F.R. Part 50, Appendix B and International Organization for Standardization (ISO) 9001 quality assurance requirements. MAAP4 Applications Guidance at 2-2 (Attach. 20);

Joint Decl. ¶ 33.

46. EPRI has identified the MAAP code (versions 4.0.5 and later) as a consensus model suitable for use in evaluation of PRA success criteria. EPRI Report 1013492, 9

Probabilistic Risk Assessment Compendium of Candidate Consensus Models at 2-3 (2006)

(Attach. 23); Joint Decl. ¶ 33.

47. MAAP4 has been benchmarked against numerous severe accident studies and the Three Mile Island Unit-2 (TMI-2) core melt accident. The benchmarking of MAAP is documented in Section 7 (MAAP Benchmarks) and Appendix F (Summaries of MAAP Benchmarks) of EPRIs MAAP4 Applications Guidance and also in the Nuclear Energy Agencys Committee on the Safety of Nuclear Installations report Recent Developments in Level 2 PSA and Severe Accident Management. Committee on the Safety of Nuclear Installations, Nuclear Energy Agency, Organization for Economic Co-operation and Development, NEA/CSNI/R(2007)16, at 36 (Nov. 2007) (Attach. 24); Joint Decl. ¶ 34.

48. EPRI licenses MAAP4 to a wide array of entities, such as utilities, vendors, and research organizations, including universities. The majority of MAAP4 users are members of the MAAP Users Group (MUG). The MUG provides direction and funding for code maintenance, enhancements, and benchmarking; facilitates information transfer through biannual meetings and the issuance of various communications on code problems and best practices; and supports industry and regulatory acceptance. MAAP4 Applications Guidance at 2-2 (Attach. 20); Joint Decl. ¶ 32.

49. In general, a computer code in itself is not validated by the NRC, but its use for specific applications may be found acceptable for estimating certain phenomena within certain defined regimes. For example, a computer code may be used to predict the coupled thermal-hydraulic fission product transport response of reactor systems to severe accident events. If inputs and assumptions are appropriate for the computer model, and sources of uncertainty are understood, then the results of that code may be accepted by a reviewer or regulator for purposes of the application. Joint Decl. ¶ 30; Letter from Gary M. Holahan, Director, Division of Systems Safety and Analysis, Office of Nuclear Reactor Regulation, U.S. N.R.C., to Theodore U. Marston, Vice-President & Chief Nuclear Officer, EPRI at 1 (Dec. 4, 2001) (Attach. 22).

50. The MAAP code has been used by nuclear plant licensees and other entities to predict the responses of nuclear power plants during postulated severe accidents and is the most commonly used code in the U.S. for such purposes. Joint Decl. ¶ 35; Kenneth D. Kok, Ed.,

Nuclear Engineering Handbook at 539 (2009) (Attach. 25).

10

51. The use of MAAP and its successor versions in IPEs and subsequent PRA applications, including those related to advanced reactor standard design certification applications, has been accepted by the NRC Staff. See, e.g., NUREG-1503, Final Safety Evaluation Report Related to Certification of the ABWR Reactor Design, Vol. 1 at 19-53 to 19-55 (July 1994)

(Attach. 47); NUREG-1793, Final Safety Evaluation Report Related to Certification of the AP1000 Standard Design, Vol. 1 at 19-61 (Sept. 2004) (Attach. 48); Joint Decl. ¶ 35.

52. Numerous NRC license renewal applicants have used the MAAP code to support NRC-approved SAMA analyses, including very recent recipients of renewed operating licenses.

See, e.g., NUREG-1437, Supp. 47, Generic Environmental Impact Statement for License Renewal of Nuclear Plants: Columbia Generating Station - Final Report, Vol. 2, App. F at F-2, F-6 to F-7, F-27 (Apr. 2012) (Attach. 26); NUREG-1437, Supp. 45, Generic Environmental Impact Statement for License Renewal of Nuclear Plants: Regarding Hope Creek Generating Station and Salem Nuclear Generating Station, Units 1 and 2, Vol. 2, App. G at G-4, G-6, G-15 to G-16 (Mar.

2011) (Attach. 27); Joint Decl. ¶ 36.

B. Differences in MAAP4-Generated and NUREG-1465 Source Terms (Basis 2)

53. The reactor accident source term generally serves two purposes in the U.S. nuclear regulatory process. The first purpose is for licensing, safety analysis, and regulatory compliance, particularly in meeting 10 C.F.R. Part 100 siting requirements. For this purpose, a source term representing the release of radioactive materials into the reactor containment is used to assess the adequacy of reactor containments and engineered safety systems, as well as the environmental qualification of equipment inside the containment that must function following a design-basis accident. This source term also is used to show that dose criteria at the exclusion area boundary are met by assuming the maximum allowable design leak rate from the containment. NUREG-1465 source terms are applicable for the first purpose described above. 10 C.F.R.

§ 50.34(a)(1)(ii)(D) & 10 C.F.R. § 100.11; Joint Decl. ¶ 38.

54. The second purpose for which a reactor accident source term is developed is to simulate a release of radioactive material to the environment (i.e., outside containment) following a hypothetical reactor accident. This second source term may be used as input to radionuclide dispersal and accident consequence models (e.g., MACCS2) that are used for Level 3 PRA and SAMA evaluations. Joint Decl. ¶ 39.

11

55. NUREG-1465 states that it was developed to define a revised accident source term for regulatory application for future LWRs and to provide a postulated fission product source term released into containment that is based on current understanding of LWR accidents and fission product behavior. NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants, at vii, 3 (Feb. 1995) (Attach. 8); Joint Decl. ¶ 41.

56. NUREG-1465 provides generic, default source terms, whereas PRA and SAMA analyses are intended to be best-estimate engineering evaluations that seek to maximize the use of plant-specific data. Joint Decl. ¶ 45.

57. NUREG-1465 assumes a release resulting from substantial meltdown of the core into the containment . . . [and assumes] that the containment remains intact but leaks at its maximum allowable leak rate. NUREG-1465 at vii, 1, 3 (Attach. 8); Joint Decl. ¶ 42.

58. NUREG-1465 discusses in-containment fission product removal mechanisms, such as engineered safety features (ESFs), but does not provide numerical estimates of source terms that account for the effects of such mechanisms (e.g., containment sprays, aerosol deposition).

NUREG-1465 directs the reader to use appropriate methodologies in crediting fission product removal or reduction within containment. NUREG-1465 at 17-21 (Attach. 8); Joint Decl. ¶ 44.

59. The NUREG-1465 source term solely represents radionuclides released into the containment. It does not specify the source term released from containment into the environment following a severe accident, and it does not take into account the reductions of the source term that would occur in those circumstances. Joint Decl. ¶¶ 42-43.

60. The MAAP code produces results that are different from, and generally smaller than, the release fractions specified in NUREG-1465, because MAAP models the release of radionuclides from the containment into the environment following a postulated severe accident.

MAAP models and credits fission product removal mechanisms such as containment ESFs (e.g.,

containment air coolers, containment spray) and natural depletion processes (e.g., aerosol deposition and containment holdup). Joint Decl. ¶¶ 43-44.

12

C. Differences in MAAP4-Generated Source Terms and Source Terms Discussed in Other Historical Studies Cited by Intervenors (Basis 3)

61. Contention 4 cites two documents containing historical comparisons between release fractions developed using earlier versions of the MAAP code and release fractions developed using other codes. The first document is a 1987 draft of the NUREG-1150 severe accident risk study that, in examining accident risk at Zion Nuclear Station, stated that the MAAP estimates for environmental release fractions were significantly smaller than those obtained with the Source Term Code Package1 (STCP) computer code (the primary code used in the NUREG-1150 study). Petition at 114 (citing Office of Nuclear Regulatory Research, Draft for Comment, Reactor Risk Reference Document, NUREG-1150, Vol. 1, at 5-14 (Feb. 1987) (Attach. 9)). This statement does not appear in the final December 1990 version of NUREG-1150 (Attach. 10).

Joint Decl. ¶¶ 58, 59.

62. The second is a 2002 Brookhaven National Laboratory (BNL) report reviewing combustible gas control availability at ice condenser and Mark III containment plants. The BNL study compared the Level 2 portion of the PRA results for the Catawba plant (obtained using the MAAP code) with a typical NUREG-1150 release for the Sequoyah plant (obtained using the STCP and MELCOR codes). John R. Lehner et al., Brookhaven National Laboratory, Benefit Cost Analysis of Enhancing Combustible Gas Control Availability at Ice Condenser and Mark III Containment Plants, Final Letter Report at 17 (Dec. 2002) (BNL report) (Attach. 34); Joint Decl. ¶ 58.

63. The BNL report states that the NUREG-1150 release fractions for the important radionuclides are about a factor of 4 higher than the ones in the Catawba PRA, and that the differences in the release fractions . . . are primarily attributable to the use of the different codes in the two analyses. BNL report at 17 (Attach. 34); Joint Decl. ¶ 58.

64. Severe accident source term estimates depend on many plant-specific design features, operational practices, and the technical accuracy provided by computer code models used for source term quantification Joint Decl. ¶ 59.

1 As noted on the Sandia MELCOR website (http://melcor.sandia.gov/), the STCP is the predecessor to MELCOR:

MELCOR is a fully integrated, engineering-level computer code that models the progression of severe accidents in light-water reactor nuclear power plants. MELCOR is being developed at Sandia National Laboratories for the U.S. Nuclear Regulatory Commission as a second-generation plant risk assessment tool and the successor to the Source Term Code package.

13

65. The NUREG-1150 study (issued as a final report in 1990) was completed over 20 years ago and involved an assessment of the risks from severe accidents at five commercial nuclear power plants in the United States. Davis-Besse was not one of those five plants. Joint Decl. ¶ 59; NUREG-1150 (Attach. 10).

66. The IDCOR (MAAP) to NUREG-1150 (STCP) comparison of Zion results cited by Intervenors was only one of four sets of plant results compared in the February 1987 draft of NUREG-1150. In addition, after extensive peer review of, and public comment on, the February 1987 draft, NUREG-1150, Volume 1, was issued as a second draft in 1989, before being published as a final report in December 1990. The report and its underlying technical analyses were substantially modified in two rounds of review before the reports final publication in December 1990. One of the changes included deleting the specific discussion comparing the MAAP and STCP results for Zion, such that the comparison cited by Intervenors in Contention 4 was not incorporated into the final December 1990 version of NUREG-1150. Joint Decl. ¶ 59; Draft NUREG-1150, Vol. 1 at 5-14 (Attach. 9); NUREG-1150, Vol. 1 (Attach. 10).

67. The final NUREG-1150 report states that the thermal-hydraulic model in the STCP uses simplified models and assumptions for the treatment of some of the very complex steps in the core degradation process, such as fuel slumping into the lower plenum of a reactor vessel.

NUREG-1150, Vol. 3, App. D at D-17 (Attach. 10); Joint Decl. ¶ 60. More realistic models such as MELCOR and MAAP were used to adjust the thermal-hydraulic estimates affecting core degradation, ultimately leading to differences in the estimated source term. NUREG-1150, Vol. 3, App. D at D-17 (Attach. 10); Joint Decl. ¶ 60.

68. The BNL reports comparison between the Catawba Level 2 PRA release fractions and the NUREG-1150 Sequoyah release fractions represents a difference of more than ten years in terms of severe accident modeling (~2002 versus ~1990). The comparison of MAAP-based source terms with those estimated over ten years earlier with STCP (a simpler code) and an earlier version of MELCORand for different plantsis expected to show differences. Joint Decl. ¶ 63.

69. Also, the BNL report comparison uses a release category that represents an early containment failure in which the Catawba source term is based on an early containment failure without ex-vessel release assumption that may not have been applied in the Sequoyah source term. See Memorandum from Asimios Malliakos, Probabilistic Risk Analysis Branch, Division of 14

Risk Analysis and Applications, Office of Nuclear Regulatory Research, to Marc A. Cunningham, Chief, Probabilistic Risk Analysis Branch, Division of Risk Analysis and Applications, Office of Nuclear Regulatory Research, Telecommunication with Duke Energy Corporation in Support of Generic Safety Issue (GSI) 189, Susceptibility of Ice Condenser and BWR Mark III Containments to Early Failure from Hydrogen Combustion During a Severe Accident, Attach. 1, 3 (Oct. 8, 2002) (Attach. 38); Joint Decl. ¶ 63.

70. Since the issuance of NUREG-1150, better understanding of heat transfer and removal from the reactor pressure vessel during severe accident sequences, improved insights on iodine, cesium, and other fission product groups chemistry from contemporary research, and modeling improvements suggest that the early containment failure releases would be smaller than previously estimated. Joint Decl. ¶ 64.

71. In its 2002 Supplemental Environmental Impact Statement for Catawba license renewal, the NRC Staff compared similar sequences between the two studiesNUREG-1150 and Revision 2b of the Catawba PRA,2 which included the plants IPE modelsand concluded there was reasonable agreement for the closest corresponding release scenarios. NUREG-1437, Supp.

9, Generic Environmental Impact Statement for License Renewal of Nuclear Plants: Regarding Catawba Nuclear Station, Units 1 and 2 - Final Report at 5-9 to 5-10 (Dec. 2002) (Attach. 37);

Joint Decl. ¶ 62.

72. The state of the art for source term analysis has significantly improved since the NUREG-1150 study was performed in the 1980s. For example, in 2006, the NRC initiated the State-of-the-Art Reactor Consequence Analyses (SOARCA) project to develop revised best estimates of the offsite radiological health effect consequences of severe reactor accidents. The projects principal objective was to develop updated and more realistic severe accident analyses by including significant plant changes and reactor safety research updates not reflected in earlier NRC assessments such as WASH-1400, the 1982 Siting Study, and NUREG-1150. SOARCA included consideration of plant system improvements, improvements in training and emergency procedures, offsite emergency response, and security-related improvements, as well as plant changes such as power uprates and lengthened operating times. Joint Decl. ¶ 65; NUREG-1935, 2

Letter from Gary R. Peterson, Vice President, Duke Energy Corporation, to Document Control Desk, U.S.

N.R.C., Attach. 1, Catawba PRA Revision 2b Summary Results (Apr. 18, 2001).

15

State-of-the-Art Reactor Consequence Analyses (SOARCA) Report, Draft Report for Comment (Jan. 2012) (Draft NUREG-1935) (Attach. 39).

73. The SOARCA analyzed two plants that are typical of the two U.S. commercial reactor types, i.e., a BWR plant, the Peach Bottom Atomic Power Station in Pennsylvania, and a PWR plant, Surry Power Station in Virginia. These two plants also took part in earlier accident analyses performed by the NRC, including the seminal WASH-1400 PRA study (1975), the Sandia Siting Study (1982), and the NUREG-1150 (1990) study. The Staff analyzed one plant unit at each site. Joint Decl. ¶ 66; Draft NUREG-1935 (Attach. 39).

74. The SOARCA project used computer-modeling techniques to understand how a reactor might behave under severe accident conditions and how a release of radioactive material from the plant might affect the public. Specifically, it used MELCOR to model the severe accident scenarios within the plant, and MACCS2 to model the offsite health effect consequences of any atmospheric releases of radioactive material. Joint Decl. ¶ 68; Draft NUREG-1935 (Attach.

39).

75. In January 2012, the NRC published the results of its SOARCA assessment, including plant-specific reports for Peach Bottom and Surry. Among the findings, the NRC found that, in addition to delayed radiological releases, the magnitude of the radionuclide release, especially with respect to the key radioisotopic (iodine and cesium) groups, is much smaller than estimated in prior studies. Joint Decl. ¶ 69; Draft NUREG-1935 (Attach. 39); NUREG/CR-7110, State-of-the-Art Reactor Consequence Analyses Project: Volume 1: Peach Bottom Integrated Analysis (Jan. 2012) (Attach. 40); NUREG/CR-7110, State-of-the-Art Reactor Consequence Analyses Project: Volume 2: Surry Integrated Analysis (Jan. 2012) (Attach. 42); NUREG/BR-0359, Modeling Potential Reactor Accident Consequences (Jan. 2012) (Attach. 43).

76. Both MAAP and MELCOR were used soon after of the March 2011 Fukushima Dai-ichi nuclear power plant accident in Japan. Tokyo Electric Power Company, the operating utility for the six-unit station, has used MAAP to inform its understanding of the accident progression in Units 1-3 during the earthquake and subsequent tsunami event in March 2011.

International Atomic Energy Agency, IAEA International Fact Finding Expert Mission of the Fukushima Dai-ichi NPP Accident Following the Great East Japan Earthquake and Tsunami at 16

33-35 (June 2011) (Attach. 45). Sandia applied MELCOR in modeling the Station Blackout sequence for the NRC in support of the Japanese Government. Joint Decl. ¶ 72.

Executed in Accord with 10 C.F.R. § 2.304(d)

Signed (electronically) by Martin J. ONeill David W. Jenkins Kathryn M. Sutton Senior Corporate Counsel Timothy P. Matthews FirstEnergy Service Company MORGAN, LEWIS & BOCKIUS LLP Mailstop: A-GO-15 1111 Pennsylvania Avenue, N.W.

76 South Main Street Washington, DC 20004 Akron, OH 44308 Phone: 202-739-3000 Phone: 330-384-5037 Fax: 202-739-3001 E-mail: djenkins@firstenergycorp.com E-mail: ksutton@morganlewis.com E-mail: tmatthews@morganlewis.com Martin J. ONeill, Esq.

MORGAN, LEWIS & BOCKIUS LLP 1000 Louisiana Street, Suite 4000 Houston, TX 77002 Phone: 713-890-5710 Fax: 713-890-5001 E-mail: martin.oneill@morganlewis.com COUNSEL FOR FIRSTENERGY Dated in Washington, DC this 26th day of July 2012 17

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 2 Joint Declaration of Kevin OKula and Grant Teagarden in Support of FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms) (July 26, 2012)

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD

)

In the Matter of )

) Docket No. 50-346-LR FIRSTENERGY NUCLEAR OPERATING COMPANY )

)

(Davis-Besse Nuclear Power Station, Unit 1) )

) July 26, 2012 JOINT DECLARATION OF KEVIN OKULA AND GRANT TEAGARDEN IN SUPPORT OF FIRSTENERGYS MOTION FOR

SUMMARY

DISPOSITION OF CONTENTION 4 (SAMA ANALYSIS SOURCE TERMS)

TABLE OF CONTENTS Page I. PROFESSIONAL QUALIFICATIONS ................................................................................. 1 A. Dr. Kevin R. OKula (KRO) ................................................................................... 1 B. Mr. Grant A. Teagarden (GAT) .............................................................................. 4 II. ISSUES RAISED IN CONTENTION 4 ................................................................................. 5 III.

SUMMARY

OF KEY POINTS AND CONCLUSIONS ....................................................... 6 IV. REGULATORY AND TECHNICAL BACKGROUND ....................................................... 8 A. NRC-Required SAMA Analysis ................................................................................. 8 B. Use of the MAAP Code in NRC SAMA Analyses................................................... 13 V. RESPONSE TO ISSUES RAISED IN CONTENTION 4 ................................................... 16 A. Validation of the MAAP Code (Basis 1) .................................................................. 16 B. Differences in MAAP-Generated and NUREG-1465 Source Terms (Basis

2) ............................................................................................................................... 21

1. The NUREG-1465 Source Term Represents Only Radionuclides Released into the Containment Atmosphere as a Result of a Core-Melt Accident................................................................................................ 21

2. The NUREG-1465 Source Term Does Not Describe the Release of Radionuclides to the Environment as Postulated in a SAMA Analysis......................................................................................................... 23

3. As a Best-Estimate Engineering Evaluation that Seeks to Quantify Risk, the Davis-Besse SAMA Analysis Uses PRA Methods and Requires Plant-Specific Source Term Information ....................................... 25

4. Plant-Specific, MAAP-Generated Source Terms Are Integral to the Davis-Besse SAMA Analysis ....................................................................... 28

5. Use of Generic Source Terms from NUREG-1465 is Not Justified and Would Inappropriately Distort the SAMA Analysis Results ................. 29 C. Inapplicability of Historical Release Fraction Comparisons Cited by Intervenors (Basis 3) ................................................................................................. 32 VI. CONCLUSION ..................................................................................................................... 41 Attachment A - Definitions of Key Severe Accident and PRA Terms

-i-

TABLE OF CONTENTS (continued)

Page LIST OF FIGURES Figure 1. Three-Level Probabilistic Risk Assessment for Reactor Operation.12 Figure 2. MAAP4 Primary System Modeling..16 Figure 3. Sequential Analyses Performed as Part of a Three-Level PRA27 Figure 4. Percentages of Iodine and Cesium Released to the EnvironmentDuring the First 48 Hours of the Accident for SOARCA Unmitigated Scenarios, 1982 Siting Study (SST1), and Historical Accidents39

-ii-

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD

)

In the Matter of )

) Docket No. 50-346-LR FIRSTENERGY NUCLEAR OPERATING COMPANY )

)

(Davis-Besse Nuclear Power Station, Unit 1) ) July 26, 2012

)

JOINT DECLARATION OF KEVIN OKULA AND GRANT TEAGARDEN IN SUPPORT OF FIRSTENERGYS MOTION FOR

SUMMARY

DISPOSITION OF INTERVENORS CONTENTION 4 (SAMA ANALYSIS SOURCE TERMS)

Kevin R. OKula and Grant A. Teagarden state as follows under penalties of perjury:

I. PROFESSIONAL QUALIFICATIONS A. Dr. Kevin R. OKula (KRO)

1. (KRO) My name is Kevin R. OKula. I am an Advisory Engineer with URS Safety Management Solutions (URS) LLC, in Aiken, South Carolina. I am a consultant to FirstEnergy Nuclear Operating Company (FirstEnergy) on source term and severe accident mitigation alternatives (SAMA) analysis issues.

2. (KRO) My professional qualifications are provided in Attachment 3. In brief, I have over 29 years of experience as a technical professional and manager in the areas of safety analysis methods and guidance development, computer code validation and verification, probabilistic risk assessment (PRA), deterministic and probabilistic accident and consequence analysis applications for reactor and non-reactor nuclear facilities, source term evaluation, risk management, software quality assurance (SQA), and shielding. I obtained my B.S. in Applied

and Engineering Physics from Cornell University in 1975, and my M.S. and Ph.D. in Nuclear Engineering from the University of Wisconsin in 1977 and 1984, respectively.

3. (KRO) In addition, I have over 20 years of experience using and applying the MELCOR Accident Consequence Code System 2 (MACCS2) computer code and its predecessor, MACCS. I co-chaired a U.S. Department of Energy (DOE) Accident Phenomenology and Consequence evaluation program in the 1990s that evaluated applicable computer models for radiological dispersion and consequence analysis. More recently, I was a technical peer reviewer of the Sandia National Laboratories (Sandia) and NRC State-of-the-Art Reactor Consequence Analyses (SOARCA) Project that reviewed updated and more realistic evaluations of severe accident progression in U.S. nuclear power plants. By virtue of my training and experience, I also am familiar with the Modular Accident Analysis Program (MAAP) and similar codes and the manner in which they are typically used to support severe accident analyses, PRAs, and SAMA analyses.

4. (KRO) I have taught MACCS2 training courses for DOE and its contractors at Lawrence Livermore National Laboratory, Los Alamos National Laboratory, Idaho National Laboratory, Oak Ridge, the Waste Isolation Pilot Plant, and the DOE Safety Basis Academy. In addition, I was the lead author of a DOE guidance document on the use of MACCS and MACCS2 for DOE safety analysis applications, and managed overall completion of equivalent reports for DOE on MELCOR (similar in function to MAAP) and GENII (similar in function to MACCS2).

As part of the SOARCA Project Peer Review Committee, I provided critical review and comment to Sandia and the NRC on the use of integrated modeling of accident progression and offsite consequences from postulated severe accidents using both improved computational analysis tools and more accurate inputs and assumptions reflecting current-day plant operations and accident management/response planning.

2

5. (KRO) I am providing this Joint Declaration in support of the Applicants Motion for Summary Disposition of the Petitioners Contention 4 (SAMA Analysis Source Terms) in the above-captioned proceeding. I understand that, in August 2010, FirstEnergy submitted a license renewal application (LRA) to the U.S. Nuclear Regulatory Commission (NRC) seeking to renew its operating license for the Davis-Besse Nuclear Power Station, Unit No. 1 (Davis-Besse) for another 20 years.1 The SAMA analysis is described in Section 4.20 and Attachment E of the Environmental Report (ER) (Appendix E to the LRA).2

6. (KRO) I have thoroughly reviewed the various inputs and assumptions used in FirstEnergys SAMA analysis, as submitted in August 2010 and revised in July 2012,3 to calculate offsite consequences associated with a postulated severe accident at Davis-Besse, including relevant supporting technical documentation for the SAMA analysis prepared by FirstEnergy vendors. I also have reviewed the SAMA analysis revisions and clarifications that FirstEnergy provided in response to NRC Staff requests for additional information (RAIs) in June and September 2011.4 I thus have personal knowledge of the modeling methods, inputs, and assumptions used in the Davis-Besse SAMA analysis, as described in the Davis-Besse ER and other related documentation.

1 See generally Letter from Barry S. Allen, Vice President-Nuclear, FirstEnergy, to Document Control Desk, U.S.

N.R.C., License Renewal Application and Ohio Coastal Management Program Consistency Certification (Aug.

27, 2010) (ADAMS Accession No. ML102450565).

2 See ER § 4.20 (Severe Accident Mitigation Alternatives) & Attach. E (Severe Accident Mitigation Alternatives Analysis).

3 Letter from John C. Dominy, Director, Site Maintenance, FirstEnergy, to Document Control Desk, U.S. N.R.C.,

Correction of Errors in the Davis-Besse Nuclear Power Station, Unit No. 1, License Renewal Application (TAC No.

ME4613) Environmental Report Severe Accident Mitigation Alternatives Analysis, and License Renewal Application Amendment No. 29 (July 16, 2012) (Revised SAMA Analysis Submittal) (Attach. 5).

4 See Letter from Kendall W. Byrd, Director, Site Performance Improvement, FirstEnergy, to Document Control Desk, U.S. N.R.C., Reply to Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No. 1, License Renewal Application (TAC No. ME4613), Environmental Report Severe Accident Mitigation Alternatives Analysis, and License Renewal Application Amendment No. 10 (June 24, 2011)

(Attach. 6); Letter from Barry S. Allen, FirstEnergy, to Document Control Desk, U.S. N.R.C., Reply to Supplemental Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No. 1, License Renewal Application (TAC No. ME4613) Environmental Report Severe Accident Mitigation Alternatives Analysis (Sept. 1, 2011) (Attach. 7).

3

7. (KRO) In preparing this Joint Declaration, I also reviewed relevant pleadings of the parties and Orders issued by the Atomic Safety and Licensing Board (Board) and the Commission, applicable NRC regulations and guidance documents, and relevant technical reports and studies.

B. Mr. Grant A. Teagarden (GAT)

8. (GAT) My name is Grant A. Teagarden. I am Manager for Consequence Analysis for ERIN Engineering and Research, Inc., in Campbell, California. I am acting as a consultant to FirstEnergy on source term and SAMA analysis issues.

9. (GAT) My professional qualifications are provided in Attachment 4. Briefly summarized, I have 14 years of experience in the nuclear field, including 10 years as a manager and technical professional in the areas of PRA, source term analysis, consequence analysis, and nuclear power plant security risk assessment. I obtained a B.S. degree in Mechanical Engineering from University of Miami in 1990 and completed the Bettis Reactor Engineering School at the Bettis Atomic Power Laboratory as part of my training in the U.S. Navy nuclear program. I am a member of the American Nuclear Society (ANS) and serve as the Vice Chair for the writing committee for ANSI/ANS-58.25, Standard for Radiological Accident Offsite Consequence Analysis (Level 3 PRA) to Support Nuclear Installation Applications.

10. (GAT) I am experienced with Level 2 PRA (e.g., severe accident analysis) and the use of the thermal-hydraulic and fission product MAAP code to model severe accident phenomenology. My experience includes using MAAP to develop Level 2 PRA models for commercial nuclear power plants in the United States. I also have substantial experience using MACCS2 and preparing Level 3 PRA models for commercial nuclear power plants in the United States. I have performed, or overseen the performance of, MACCS2 modeling in support of SAMA analyses for ten nuclear power plant sites. I also have developed similar analyses for three 4

proposed new reactor sites and supported reactor vendor development of MACCS2 models for new plant designs.

11. (GAT) I am providing this Joint Declaration in support of the Applicants Motion for Summary Disposition of the Petitioners Contention 4 (SAMA Analysis Source Terms). Like Dr. OKula, I have thoroughly reviewed the various inputs and assumptions used in FirstEnergys original and revised SAMA analyses to calculate offsite consequences associated with a postulated severe accident at Davis-Besse, including relevant supporting documentation discussed herein. As a result, I have personal knowledge of the modeling methods, inputs, and assumptions used in the Davis-Besse SAMA analysis, as recently amended.

12. (GAT) In preparing this Joint Declaration, I also reviewed relevant pleadings of the parties and Orders issued by the Board and the Commission; relevant regulations and guidance documents; those portions of FirstEnergys ER, as amended, describing the Davis-Besse SAMA analysis; FirstEnergy responses to NRC Staff RAIs; supporting technical documentation for the SAMA analysis prepared by FirstEnergy vendors; and various technical reports and studies.

II. ISSUES RAISED IN CONTENTION 4

13. We understand that, as admitted by the Board and narrowed in scope by the Commission, Contention 4 challenges FirstEnergys use of the MAAP computer code to determine source terms (including release fractions) used in the Davis-Besse SAMA analysis.5 FirstEnergy Nuclear Operating Co. (Davis-Besse Nuclear Power Station, Unit 1), LBP-11-13, slip op. at 50-54, 64 (Apr. 26, 2011), affd in part and revd in part, CLI-12-08 (Mar. 27, 2012).

Specifically, Contention 4 alleges that the use of MAAP-generated source terms appears to lead to anomalously low consequences because: (1) the MAAP code has not been validated by the NRC; (2) the radionuclide release fractions generated by MAAP are consistently smaller for key 5

Source term, release fraction, and other PRA-related terms used in this Joint Declaration are defined in the table in Attachment A to this Joint Declaration and discussed further throughout this document.

5

radionuclides than the release fractions specified in NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants (Feb. 1995) (Attach. 8); and (3) other severe accident studies have observed that MAAP generates lower release fractions than those derived and used by the NRC Staff. See Beyond Nuclear, Citizens Environment Alliance of Southwestern Ontario, Dont Waste Michigan, and the Green Party of Ohio Request for Public Hearing and Petition for Leave to Intervene at 108-114 (Dec. 27, 2010) (Pet.) (Errata filed Jan. 5, 2011). We address each of these three bases for the Intervenors contention below.

III.

SUMMARY

OF KEY POINTS AND CONCLUSIONS

14. In this Joint Declaration, we summarize the purpose of, and methodologies required for, a PRA-based, site-specific SAMA analysis, and explain why the MAAP46 code used by FirstEnergy is reasonable and appropriate for that type of analysis. We also explain why Intervenors criticisms of the MAAP code as applied in the Davis-Besse SAMA analysis are not credible. Intervenors make three principal claims in support of their contention, which, for clarity and ease of reference, we refer to as Bases 1, 2 and 3. In summary, Intervenors contention and three supporting bases lack merit for the following principal reasons:

Basis 1: The MAAP code has been developed and maintained in accordance with NRC quality assurance standards, extensively benchmarked, applied to different reactor designs throughout the world, identified as a consensus computer code suitable for use in PRA applications, and long been accepted by the NRC for use in both safety and environmental applications, including numerous NRC-approved SAMA analyses.

Basis 2: MAAP expectedly produces source terms and release fractions that are different from, and consistently smaller than, those specified in NUREG-1465. MAAP-generated source terms serve a fundamentally different regulatory purpose and reflect modeling of different, plant-6 Although FirstEnergy used MAAP Version 4.0.6 (MAAP4) in support of the Davis-Besse SAMA analysis, we generally use the term MAAP below for brevity and convenience.

6

specific accident phenomena than those considered in NUREG-1465. NUREG-1465 was developed to define revised, generic accident source terms for regulatory application for future light-water reactors (LWRs). It postulates a release of fission products from the core of an LWR into the containment atmosphere for the purpose of calculating offsite doses in accordance with reactor siting criteria contained in 10 C.F.R. Part 100. Further, NUREG-1465 does not specify plant-specific source terms for releases from containment into the environment following a severe accident and does not take into account the source term reductions that would occur as a result of engineered and natural fission product removal mechanisms. In contrast, MAAP models the release of radionuclides from the containment into the environment following a postulated severe accident using plant-specific information and accounts for fission product removal mechanisms.

NUREG-1465 presents only one set of generic pressurized water reactor (PWR) release fraction data for an in-containment accident source term. Applying those data to all 34 release categories examined in the Davis-Besse SAMA analysis, as apparently suggested by Intervenors, essentially treats all releases into the containment as releases into the environment; i.e., it treats a wide spectrum of containment failure and containment bypass events equivalently. The assumption of not crediting the containments presence, and neglecting associated passive and active engineered safety features for mitigating and delaying releases would lead to a worst-case source term scenario. It does not account for the plant-specific and probabilistic nature of a SAMA analysis, including the initiating events, accident progression and its associated likelihood, reactor core radionuclide inventory, and release fractions that are specific to each accident sequence in the plant of interest.

Basis 3: Severe accident source term estimates depend on many plant-specific design features and operational practices, and the level of technical accuracy provided by computer code 7

models used for source term quantification. Comparisons of MAAP to earlier studies and the source term/release fractions provided by older codes are flawed because earlier source term and release fraction estimates were based on the state of research available at the time, and the earlier severe accident codes were not as accurate as todays versions. As an example, the Intervenors cite a severe accident and risk analysis for the Zion PWR plant in a draft of the NUREG-1150 study. Pet. at 114 (citing NRC Office of Nuclear Regulatory Research, Draft for Comment, Reactor Risk Reference Document, NUREG-1150, Vol. 1, at 5-14 (Feb. 1987) (Attach. 9)).7 The draft NUREG-1150 study cited by Intervenors was published over 25 years ago and involved an assessment of severe accident risks at five commercial nuclear power plants in the U.S. Davis-Besse was not one of those five plants. In addition, the state of the art for source term analysis has improved significantly since the NUREG-1150 study was performed in the mid-to-late 1980s.

Intervenors cited comparisons of MAAP-generated source terms or release fractions with those estimated over ten years earlier by different analysts for different plantsusing simpler versions of other codes and different assumptionsare expected to show differences.

IV. REGULATORY AND TECHNICAL BACKGROUND A. NRC-Required SAMA Analysis

15. Severe nuclear accidents are those in which substantial damage is done to the reactor core whether or not there are serious offsite consequences. Policy Statement on Severe Reactor Accidents Regarding Future Design and Existing Plants, 50 Fed. Reg. 32,138 (Aug. 8, 1985) (Attach. 11). In the context of a nuclear power plant PRA, a severe accident is described as a beyond design-basis accident involving multiple failures of equipment or functions. Although severe accidents generally have lower likelihoods than design-basis accidents, they may have 7

The NRC published NUREG-1150 in final form in December 1990. NUREG-1150, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, Vol. 1, Tbl. 2.1 at 2-3 (Dec. 1990) (NUREG-1150) (excerpts attached as Attach. 10).

8

greater consequences. NUREG-1437, Generic Environmental Impact Statement for License Renewal of Nuclear Plants, Vol. 1, at 5-1 (May 1996) (GEIS) (Attach. 12). The NRCs GEIS provides an evaluation of severe accident impacts that applies to all U.S. nuclear power plants.

See id. at 5-1 to 5-20. Based on the GEIS evaluation of severe accidents, 10 C.F.R. Part 51 concludes that [t]he probability weighted consequences of atmospheric releases, fallout onto open bodies of water, releases to ground water, and societal and economic impacts from severe accidents are small for all plants. 10 C.F.R. Pt. 51, Subpt. A, App. B, Tbl. B-1 (Postulated Accidents; Severe accidents). Thus, by definition, a SAMA analysis considers postulated events whose probability of occurrence is so low that they are excluded from the spectrum of design-basis accidents postulated by NRC regulations.

16. SAMA analysis is not part of the NRC safety review for license renewal under the Atomic Energy Act (AEA). Rather, it is a mitigation alternatives analysis conducted pursuant to the National Environmental Policy Act (NEPA). The NRCs NEPA-implementing regulations in 10 C.F.R. Part 51 state that, if the NRC Staff has not previously considered SAMAs for a license renewal applicants plant in a final environmental impact statement or in an environmental assessment, then the applicant must complete an evaluation of alternatives that may mitigate severe accidents. 10 C.F.R. § 51.53(c)(3)(ii)(L); see also Part 51, Subpart A, App. B, Table B-1.

At the time of its 1996 Part 51 rulemaking, the Commission was unable to reach a generic conclusion regarding mitigation alternatives for purposes of license renewal, because not all licensees had completed the agencys Part 50-based ongoing regulatory program related to severe accident mitigation. Final Rule: Environmental Review for Renewal of Nuclear Power Plant Operating Licenses, 61 Fed. Reg. 28,467, 28,480-481 (June 5, 1996), amended by 61 Fed. Reg.

66,537 (Dec. 18, 1996) (Attach. 13).

9

17. SAMA analysis is a site-specific, frequency-weighted assessment of the benefits and costs of mitigation alternatives that might be used to reduce the risks (frequencies or consequences or both) of potential nuclear power plant severe accidents. SAMA analysis focuses on mean annual consequences and, therefore, is not intended to model a single radiological release event under specific meteorological conditions at a single moment in time. Instead, it models a set of postulated plant-specific, severe accident releases that could, based on probabilistic analysis, occur at any time under varying weather conditions during a one-year period. The objective is to estimate mean annual impacts for the entire 50-mile radius region surrounding a nuclear power plant.

18. NRC-endorsed industry guidance on SAMA analyses states: The purpose of the analysis is to identify SAMA candidates that have the potential to reduce severe accident risk and to determine if implementation of each SAMA candidate is cost-beneficial. NEI 05-01, Rev. A, Severe Accident Mitigation Alternatives (SAMA) Analysis Guidance Document at 1 (Nov.

2005) (NEI 05-01) (Attach. 14); Final License Renewal Interim Staff Guidance LR-ISG-2006-03: Staff Guidance for Preparing Severe Accident Mitigation Alternatives Analyses (Aug. 2007)

(Attach. 15) (endorsing NEI 05-01, Rev. A). A SAMA analysis thus identifies potential changes to a nuclear power plant, or its operations, that could reduce the already-low risk (frequency and/or the consequences) of a severe accident for which the benefit of implementing the change may outweigh the cost of implementation. NEI 05-01 at 1. Changes to the plant that could reduce the risk of a severe accident include plant modifications or operational changes (e.g., improved procedures and augmented training of control room and plant personnel). Id. at 23. These potential changes are referred to as SAMAs or SAMA candidates. Id. at 23-26.

19. The methodology for the overall SAMA analysis approach is based on NRC guidance in NUREG/BR-0184, Regulatory Analysis Technical Evaluation Handbook, Final 10

Report (January 1997) (Attach. 16) and NUREG/BR-0058, Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Commission, Revision 4 (August 2004) (Attach 17). Broadly speaking, a SAMA analysis involves four major sequential steps:

• Use PRAs and other risk studies to characterize the overall plant-specific severe accident risk by identifying and characterizing the leading contributors to core damage frequency (CDF) and offsite risk based on a plant-specific risk study;

• Identify potential plant improvements (i.e., SAMA candidates) that could reduce the risk of a severe accident;

• Quantify the risk-reduction potential and the implementation cost for each SAMA candidate; and

• Determine whether implementation of the SAMA candidates may be cost-effective.

NEI 05-01 at 2 (Attach. 14). The SAMA evaluation of a plant is based on the numerical evaluation of severe accident risk impacts in four categories: (1) offsite exposure cost, (2) offsite economic cost, (3) onsite exposure cost, and (4) onsite economic cost. Id. at 28.

20. Various computer codesincluding the MAAP code at issue in Contention 4are used in support of a SAMA analysis. These include codes used to develop a Level 1 PRA (analysis of initiating events and ensuing accident sequences leading to core damage) and a Level 2 PRA (analysis of accident progression leading to containment failure and bypass, and release of radionuclides to the environment). The output of the Level 1 PRA is used in the Level 2 PRA.

The output of the Level 2 PRA, in turn, is used in the Level 3 PRA offsite consequences portion of the analysis. As identified in NEI 05-01, the Level 3 PRA uses the MACCS2 code to estimate the offsite dose and offsite economic impacts resulting from postulated releases of radioactive materials to the atmosphere. NEI 05-01 at 13. MACCS2 performs these calculations based on plant- and site-specific, regional, industry, and standardized regulatory inputs.

21. The basis for a SAMA analysis conducted for a U.S. nuclear power plant is a sequential, three-level PRA, i.e., a comprehensive assessment of postulated accident sequences resulting in damage to the core and containment, radiological release, and their associated 11

frequencies. NEI 05-01 at 4 (Attach. 14). As shown in Figure 1, and as discussed above, the PRA for a commercial power reactor is divided into three levelsLevel 1, Level 2, and Level 3all of which are required to perform a SAMA analysis.

SAMA-related Consequences Figure 1. Three-Level Probabilistic Risk Assessment for Reactor Operation (adapted from U.S. Nuclear Regulatory Commission, Probabilistic Risk Assessment (PRA).

http://www.nrc.gov/about-nrc/regulatory/risk-informed/pra.html) (Attach. 18).

22. A PRA assesses the risk from operating nuclear power plants by answering three basic questions: (1) What can go wrong? (2) How likely is it? and (3) What are the consequences?

The Level 3 PRA consequence analysis, performed in part with the MACCS2 code, uses the source terms and frequencies from the Level 2 PRA to estimate the 50-mile radius region offsite population dose and economic consequences, and their likelihoods. Thus, PRAs using plant-12

specific information are key components of a SAMA analysis. As described further below, FirstEnergy performed a three-level PRA for Davis-Besse to support the SAMA analysis.

B. Use of the MAAP Code in NRC SAMA Analyses

23. As discussed further below, the plant-specific PRA provides, among other information, the source term information developed using the MAAP code and required as input to the MACCS2 code. MACCS2 executes three modules (ATMOS, EARLY, and CHRONC) in sequence to calculate consequence values necessary for a SAMA analysis, and models atmospheric transport and dispersion and subsequent deposition in a radial-polar grid (16 compass sectors over a 50-mile radius). NUREG/CR-6613, Code Manual for MACCS2: Volume 1, Users Guide, at 2-1 to 2-3 (May 1998) (Attach. 19). ATMOS performs calculations pertaining to atmospheric transport, dispersion, and deposition of radioactive material, and to radioactive decay of that material both before and after its release into the atmosphere. EARLY uses the calculated air and ground concentrations, plume size, and timing information for all plume segments calculated by ATMOS and other inputs (e.g., population distribution) to calculate consequences due to radiation exposure in the emergency phase (e.g., the first seven days from the time of release). Id. at 2-2. CHRONC uses atmospheric transport, dispersion, and deposition information calculated by ATMOS and other inputs (e.g., population distribution and economic data) to calculate (1) the long-term phase consequences due to exposure after the emergency phase (i.e.,

the duration of the long-term exposure period is set to 30 years in most SAMA analyses); and (2) the economic impacts from each release category and the economic costs of the short-term and long-term protective actions. Id. at 2-2 & 2-10.

24. ATMOS requires plant-specific source term information, including the core inventory (i.e., the amount of each radionuclide present in the reactor core at the time of accident initiation), and characteristics of the postulated release, including the amount of each radionuclide 13

released, release height, release duration, the sensible energy released, and other physical-chemical characteristics. The source term refers to the amount and isotopic composition of material released (or postulated to be released) from the reactor core during an accident. NUREG-1150, Vol. 1, 2-3 tbl. 2.1 (Attach. 10).

25. The source term may refer to radionuclide groups in the reactor core inventory at the start of an accident that are released to the containment (i.e., the containment source term) or that are released to the environment (i.e., the environmental source term). (This is an important distinction that we discuss further below in addressing the claims made in Contention 4.) An environmental source term describes the physical, chemical, and radiological composition of an atmospheric release. The environmental source term is used in the ATMOS atmospheric transport and dispersion module of MACCS2 to quantify the population dose and economic cost consequences that are estimated in a SAMA analysis.

26. One component of the source term is the release fraction, which is the fraction of the total activity of the fission products released during the postulated accident. It defines the portion of the radionuclide inventory, by radionuclide group, in the reactor core or other location, that is ultimately released. NUREG-1150, Vol. 1 at 10-4 (Attach. 10).

27. Evaluation of source terms for a SAMA analysis requires a detailed analytical model that includes a multitude of physical process sub-models that account for, among other things, the timing and performance of both passive and active plant safety features and human (i.e., operator) actions affecting accident progression and containment conditions. Any radionuclide releases outside of containment are sequentially modeled from their release from the reactor core through any release path from the containment (through partial containment failure or bypass conditions), and into the environment. Source terms depend on how rapidly the accident progresses, the path by which the radionuclides escape from the reactor into containment, the path 14

through containment (or possibly bypassing containment altogether), and the effectiveness of both passive and active safety features, especially pools and sprays, that are intended to mitigate releases. An example of mitigation provided by sprays and pools would be the scrubbing or removal of radionuclides and cooling of the internal environment to which radionuclides have been released (which reduces the containment internal pressure driving the release).

28. In the U.S., source terms usually are estimated using one of two computer codes:

the Methods for Estimation of Leakages and Consequences of Releases (MELCOR) code or the MAAP code. As noted above, FirstEnergy used MAAP 4.0.6 in support of its SAMA analysis.

For purposes of a Level 3 PRA/SAMA analysis, there are six parameters in the Release Description Data group of MACCS2 that need to be extracted from the MAAP code output. See NUREG/CR-6613, Vol. 1 at 5-23 to 5-29 (Attach. 19). Those parameters are identified in paragraph 52, infra.

29. MAAP simulates the dominant thermal-hydraulic and fission product phenomena in both the primary (Figure 2) and containment systems of PWRs. MAAP models have also been applied to boiling water reactors (BWR) and other types of reactors. MAAP evaluates a broad spectrum of phenomena, including steam formation; core heat-up; cladding oxidation and hydrogen evolution; vessel failure; corium-concrete interactions; ignition of combustible gases; fluid entrainment by high-velocity gases; and fission-product release, transport, and deposition. It also addresses important engineered safety systems and allows a user to model operator interventions. Electric Power Research Institute (EPRI) Report 1020236, MAAP4 Applications Guidance: Desktop Reference for Using MAAP4 Software, Revision 2 at 2-2 to 2-3 (2010) (MAAP4 Applications Guidance) (Attach. 20); Fauske & Associates, LLC, MAAP (Modular Accident Analysis Program), http://www.fauske.com/pdf/MAAP.pdf (Attach. 21).

15

Figure 2. MAAP4 Primary System Modeling (from Fauske & Associates, LLC, MAAP (Modular Accident Analysis Program) (Attach. 21).

V. RESPONSE TO ISSUES RAISED IN CONTENTION 4 A. Validation of the MAAP Code (Basis 1)

30. Intervenors claim that the MAAP code has not been validated by the NRC (Pet.

at 108, 112, 114) is inaccurate because, as discussed later in this section, the NRC has accepted source terms calculated by numerous licensees with MAAP for use in their respective license renewal SAMA analyses. In general, a computer code in itself is not validated by the NRC, but its use for specific applications may be found acceptable for estimating certain phenomena within certain defined regimes. For example, a computer code may be used to predict the coupled thermal-hydraulic fission product transport response of reactor systems to severe accident events.

If inputs and assumptions are appropriate for the computer model, and sources of uncertainty are 16

understood, then the results of that code may be accepted by a reviewer or regulator for purposes of the application. The NRC previously has described its approach to reviewing licensee submittals that rely on MAAP as follows:

For each plant-specific submittal that relies on MAAP for a design-basis application, we will review those portions of the code relevant to the application, as we would any other licensing basis code. The review will generally be limited to identifying the critical MAAP models, assumptions, and code input used in the application, verifying the validity of the models by benchmarking the code with experiments and other codes, and assessing the integration of the MAAP results (e.g.,

containment pressure and temperature history) into the analysis package.

We may supplement this review by performing audit calculations (using staff codes) to confirm the results. The approval of the analysis will be limited to that specific licensing action (i.e., the approval will not be an approval of MAAP.) This approach will also be used for plant-specific submittals that rely on MAAP for severe accident applications, when we consider a technical review appropriate.

Letter from Gary M. Holahan, Director, Division of Systems Safety and Analysis, Office of Nuclear Reactor Regulation, U.S. N.R.C., to Theodore U. Marston, Vice-President & Chief Nuclear Officer, EPRI at 1 (Dec. 4, 2001) (Attach. 22) (emphasis added). As explained below, the use of MAAP code results have been found acceptable by the NRC Staff in Level 1 and 2 PRAs, and PRA-based SAMA analyses. In these analyses, the NRC has accepted the use of the MAAP code as a tool for modeling specific severe accident phenomenology in specific reactor systems, such as a PWRs thermal-hydraulic response and fission product release characteristics under postulated accident conditions.

31. MAAP was originally developed for the Industry Degraded Core Rulemaking (IDCOR) program in the early 1980s by Fauske & Associates, LLC (formerly Fauske &

Associates, Inc.).8 At the completion of IDCOR, ownership of MAAP was transferred to EPRI, 8

The nuclear power industry created the IDCOR program in response to the 1979 accident at Three Mile Island Unit 2 (TMI-2) to independently evaluate technical issues related to potential severe accidents at LWR nuclear power plants. IDCORs original mission was to gather and critically review existing technical work related to the severe accident issues and to perform the additional technical work required to develop a comprehensive 17

which was charged with maintaining and improving the code. Starting in the late 1980s, the MAAP3B version became widely used, first in the United States and then worldwide, to support success criteria determination, human action timing evaluations, and Level 2 analyses for Individual Plant Examinations (IPEs) required by the NRC. MAAP3B was updated to MAAP4 in the mid-1990s to expand its modeling capabilities. MAAP4 incorporates updated physical models for core melt, reactor vessel lower head response, and containment response that provide improved mechanistic modeling of severe accident phenomena. Several organizations, including EPRI and the DOE, sponsored the development of MAAP4. As part of the development process, a committee of independent experts reviewed MAAP4 to ensure that it is state-of-the-art and applicable for accident management evaluations. Further, a Design Review Committee comprising senior members of the nuclear safety community reviewed the new software. MAAP4 Applications Guidance at 2-2 (Attach. 20).

32. EPRI licenses MAAP to a wide array of entities, such as utilities, vendors, and research organizations, including universities. The majority of MAAP users are members of the MAAP Users Group (MUG). The MUG provides direction and funding for code maintenance, enhancements, and benchmarking; facilitates information transfer through biannual meetings and the issuance of various communications on code problems and best practices; and supports industry and regulatory acceptance. MAAP4 Applications Guidance at 2-2 (Attach. 20).

33. Fauske & Associates is the current maintenance contractor for the code. MAAP and its successor versions, including MAAP4, were developed in accordance with 10 C.F.R. Part 50, Appendix B and International Organization for Standardization (ISO) 9001 quality assurance requirements. MAAP4 Applications Guidance at 2-2 (Attach. 20). EPRI has identified the MAAP code (versions 4.0.5 and later) as a consensus model suitable for use in evaluation of understanding of these issues. The IDCOR program also served as the industry interface with the NRC on these matters.

18

PRA success criteria. EPRI Report 1013492, Probabilistic Risk Assessment Compendium of Candidate Consensus Models at 2-3 (2006) (Attach. 23).

34. MAAP and MELCOR have been sponsored by the industry and the NRC, respectively, in part to predict the phenomenology of severe accident progression and have been benchmarked, to the extent possible, with applicable severe accident experimental research results.

For example, MAAP has been successfully benchmarked against numerous severe accident studies and the Three Mile Island Unit-2 (TMI-2) core melt accident. The extensive benchmarking of MAAP is documented in the Section 7 (MAAP Benchmarks) and Appendix F (Summaries of MAAP Benchmarks) of EPRIs MAAP4 Applications Guidance, and also in a 2007 report issued by the Nuclear Energy Agency (NEA). The 2007 NEA report summarizes key MAAP benchmarking activities as follows:

Many comparisons between the MAAP code and separate effects tests, integral experiments, actual plant transients, and accidents have been performed to illustrate the performance of individual models and to provide confidence in the MAAP integral results. The assessment matrix listed shows the experimental benchmarking status of the MAAP computer code. It is seen that the various code versions have been compared to several separate effects and integral experiments. These include: CORA and PHEBUS (core damage);

LOFT FP-2 (integral severe accident test); ABCOVE (aerosol behaviour); CSE (containment spray); COPO (molten pool heat transfer); FARO (debris quenching); Surtsey IET (DCH); SWISS, SURC-4, ACE, KfK BETA (core-concrete interaction); NUPEC mixing tests; Marviken, FAI, and GE vessel blowdown tests; and HDR containment experiment, among many others. The current version of the code, MAAP4, has also been benchmarked against the TMI-2 accident. This comparison study shows that MAAP4 provides a reasonable simulation of the TMI-2 accident in terms of the system response prior to core uncovery, during core degradation, following core reflood, and the lower head behaviour after 224 minutes. These are all severe accident processes that are essential for application of computer codes for decisions related to design, operations, emergency operating procedures, and accident management.

NEA Committee on the Safety of Nuclear Installations, NEA/CSNI/R(2007)16, Recent Developments in Level 2 PSA and Severe Accident Management at 36 (Nov. 2007) (Attach.

24).

19

35. Furthermore, the MAAP code has long been used by nuclear power plant licensees and other entities to predict the responses of nuclear power plants during postulated severe accidents. To our knowledge, MAAP is the most commonly used code in the U.S. for such purposes.9 The use of MAAP and its successor versions in IPEs and subsequent PRA applications has been accepted by the NRC Staff for many years, including the codes use in design and licensing basis applications.10 Moreover, the MAAP code has been used throughout the world and produces results comparable to MELCOR, a similar code developed by Sandia for the NRC for use in modeling severe accidents and performing PRAs.

36. Although SAMA analysis is a NEPA-related requirement (as opposed to a safety-based analysis subject to 10 C.F.R. Part 50 requirements), numerous license renewal applicants have used the MAAP code to support NRC-approved SAMA analyses, including several very recent recipients of renewed operating licenses. See, e.g., NUREG-1437, Supp. 47, Generic Environmental Impact Statement for License Renewal of Nuclear Plants: Columbia Generating Station - Final Report, Vol. 2, App. F at F-2, F-6 to F-7, F-27 (Apr. 2012) (Attach. 27); NUREG-1437, Supp. 45, Generic Environmental Impact Statement for License Renewal of Nuclear Plants: Regarding Hope Creek Generating Station and Salem Nuclear Generating Station, Units 1 and 2, Vol. 2, App. G at G-4, G-6, G-15 to G-16 (Mar. 2011) (Attach. 28).

37. In view of the above, it is clear that the MAAP code has been subject to extensive benchmarking and technical review by the nuclear safety community. In addition, the NRC has 9

See also Kenneth D. Kok, Ed., Nuclear Engineering Handbook at 539 (2009) (Attach. 25) (The most commonly used Level-II PRA tools include CAFTA for fault tree analysis and the modular accident analysis program (MAAP) for severe accident simulation.).

10 For example, the Staff accepted the use of MAAP in its 1994 design certification approval for the Advanced Boiling Water Reactor (ABWR) design in NUREG-1503, Final Safety Evaluation Report Related to Certification of the ABWR Reactor Design, Vol. 1 at 19-53 to 19-55 (July 1994) (Attach. 47), and has done so for other subsequent design certification approvals. See, e.g., NUREG-1793, Final Safety Evaluation Report Related to Certification of the AP1000 Standard Design, Vol. 1 at 19-61 (Sept. 2004) (Attach. 48) (finding the applicants use of both the MAAP4 and MACCS2 codes to be consistent with the present state of knowledge regarding severe accident modeling and acceptable).

20

reviewed applicants use of MAAP in various licensing contexts and found it to be acceptable for severe accident modeling and probabilistic risk assessment. The codes use as a basis for fission product release from the core, transport into the containment, and subsequent environmental source term prediction is reasonable and appropriate under NEPA and 10 C.F.R. Part 51. In our view, Intervenors have offered no credible information to support a different conclusion. In fact, Intervenors position runs counter to the international nuclear communitys recognition of MAAP as a state-of-the art code and to the NRCs acceptance of the code for use by its licensees in both safety and environmental applications, including many SAMA analyses.

B. Differences in MAAP-Generated and NUREG-1465 Source Terms (Basis 2)

1. The NUREG-1465 Source Term Represents Only Radionuclides Released into the Containment Atmosphere as a Result of a Core-Melt Accident

38. Intervenors claim that NUREG-1465 source terms are more appropriate for use in a SAMA analysis than plant-specific, MAAP-generated source terms is not valid. Pet. at 112. As an initial matter, one must recognize that the reactor accident source term generally serves two purposes in the U.S. nuclear regulatory process. F. Eltawila, NRC, NRC Source Term Research

- Outstanding Issues and Future Directions, European Review Meeting on Severe Accident Research, Karlsruhe, Germany, June 12-14, 2007, Slide 2 (Eltawila) (Attach. 28). The first purpose is for licensing, safety analysis, and regulatory compliance, particularly in meeting 10 C.F.R. Part 100 reactor siting requirements. Id. For this purpose, a source term representing the release of radioactive materials into the reactor containment is used to assess the adequacy of reactor containments and engineered safety systems, as well as the environmental qualification of equipment inside the containment that must function following a design-basis accident. This source term also is used to show that dose criteria at the exclusion area boundary are met by assuming the maximum allowable design leak rate from the containment. See 10 C.F.R.

§ 50.34(a)(1)(ii)(D) and § 100.11. NUREG-1465 source terms are applicable for this purpose.

21

39. The second purpose for which a reactor accident source term is developed is to simulate a release of radioactive material to the environment (i.e., outside containment) following a hypothetical reactor accident. See Eltawila, Slide 2 (Attach. 28). This second source term is input to models of radionuclide environmental transport and dispersion and accident consequences that, among other purposes, are used for Level 3 PRAs and SAMA cost-benefit analyses, which are best-estimate analyses. The use of the MAAP-based source term associated with releases to the environment for the Davis-Besse PRA and its SAMA analysis supports this latter purpose; i.e.,

it is a crucial element of Level 3 PRA and SAMA cost-benefit analyses.

40. The inapplicability of NUREG-1465 to SAMA analysis is evident from the origin and stated purpose of that report. In 1962, the Atomic Energy Commission published TID-14844, Calculation of Distance Factors for Power and Test Reactors (Mar. 1962) (Attach. 29), which specified a release of fission products from the core to the reactor containment in the event of a postulated accident involving a substantial meltdown of the core. This source term, the basis for NRC Regulatory Guides 1.3 and 1.4, has been used to determine compliance with the NRCs Part 100 reactor siting criteria, and to evaluate other important plant performance requirements.

41. In the period between TID-14844 and the issuance of NUREG-1465, the knowledge base for severe LWR accidents and the associated behavior of released fission products was substantially updated and augmented. The NRC developed and issued NUREG-1465 in 1995 to provide a postulated fission product source term released into containment that is based on current understanding of LWR accidents and fission product behavior. NUREG-1465 at vii (Attach. 8) (emphasis added). NUREG-1465 states that its primary objective is to define a revised accident source term for regulatory application for future LWRs. Id. at 3 (emphasis added).

22

42. A SAMA analysis uses the plant-specific Level 2 PRA analyses to postulate and model the release of radionuclides into the environment during a severe accident. In contrast, the NUREG-1465 generic source term solely represents radionuclides released into the containment (as contrasted to the environment); i.e., it assumes a release resulting from substantial meltdown of the core into the containment . . . [and assumes] that the containment remains intact but leaks at its maximum allowable leak rate.11 NUREG-1465 at 1 (Attach. 8) . Indeed, NUREG-1465 states: In this document, a release of fission products from the core of a light-water reactor (LWR) into the containment atmosphere (source term) was postulated for the purpose of calculating off-site doses in accordance with 10 CFR Part 100, Reactor Site Criteria. Id. at vii (emphasis added). Notably, a November 2002 report cited by the Intervenors in their Petition (Pet. at 114) further confirms that NUREG-1465 postulates a release of fission products from the core of an LWR into the containment atmosphere, not to the environment.12

2. The NUREG-1465 Source Term Does Not Describe the Release of Radionuclides to the Environment as Postulated in a SAMA Analysis

43. It should be expected that MAAP produces release fractions that are different from, and generally smaller than, the release fractions specified in NUREG-1465. As discussed above, MAAP models the release of radionuclides from the containment into the environment following a postulated severe accident. In contrast, the NUREG-1465 source term describes the amounts and types of radioactive material that would enter the containment. The NUREG-1465 source term 11 Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors (Jan. 2000) (Attach. 30), provides environmental source terms to be applied for design basis accident consideration of the NUREG-1465 source term, and prescribes the performance of engineered safety features and the containment leak rate. It also acknowledges that NUREG-1465 presents a representative accident source term for a boiling-water reactor (BWR) and for a pressurized-water reactor (PWR). These source terms are characterized by the composition and magnitude of the radioactive material, the chemical and physical properties of the material, and the timing of the release to the containment. (emphasis added).

12 See Energy Research, Inc., ERI/NRC 02-202, Accident Source Terms for Light-Water Nuclear Power Plants:

High Burnup and Mixed Oxide Fuels at 5 (Nov. 2002) (Attach. 46). The report states that the representative PWR and BWR source terms in NUREG-1465 are characterized by the composition and magnitude of fission product release into containment, the timing of the release into containment, and the physical and chemical forms in containment. Id. (emphasis added).

23

does not specify the source term released from containment into the environment following a severe accident. Nor does it take into account the reductions of the source term that would occur due to fission product removal mechanisms.

44. In short, the amount of radioactive material that enters the containment atmosphere is different from (i.e., larger than) the amount of radioactive material that enters the environment as a result of a severe accident. Although NUREG-1465 recognizes the importance of fission product removal mechanisms, including engineered safety features (ESFs) and natural processes (e.g., aerosol deposition and the sorption of vapors on equipment and structural surfaces), it does not consider the effects of such mechanisms (e.g., containment sprays, aerosol deposition) in the numerical estimates of source terms. NUREG-1465 at 17-21 (Attach. 8). That is, NUREG-1465 does not provide numerical estimates of the containment source terms that account for the effects of in-containment fission product removal mechanisms (e.g., containment sprays, aerosol deposition). Rather, it directs the reader to use appropriate methodologies in crediting fission product removal or reduction within containment. NUREG-1465 at 4-5, 17-18. In contrast, MAAP does model and credit these ESFs as fission product removal mechanisms. See ¶ 31 & Fig.

2, supra. The developer of MAAP has noted this fact:

Due to the strong dependence of fission product retention of plant specific features and accident sequence progression, however, NUREG-1465 source terms do not already credit retention. This is left up to the individual licensees.

The advantage of using [MAAP] is that, in a single integrated analysis, it will provide time dependent fission product release from the core, transport to the containment, leakage to the reactor or auxiliary buildings, credit for all major engineered safeguard features, and modeling of all active and passive fission product retention mechanisms.

Fauske & Associates, Inc., Technical Bulletin No. 1295-1, BWR MSIV Leakage Assessment:

NUREG-1465 vs. MAAP 4.0.2, at 1 (Attach. 31). Thus, we would expect to see obvious 24

differences between a source term into the containment and a source term from the containment into the environment.

3. As a Best-Estimate Engineering Evaluation that Seeks to Quantify Risk, the Davis-Besse SAMA Analysis Uses PRA Methods and Requires Plant-Specific Source Term Information

45. NUREG-1465 provides generic, default source terms. However, PRA and SAMA analyses are best-estimate engineering evaluations that seek to maximize the use of plant-specific data. Use of a thermal-hydraulic code, like MAAP, to develop plant-specific release fractions for a SAMA analysis is strongly preferred and technically superior to using generic inputs from other sources, such as the NUREG-1465 or NUREG-1150 reports cited by Intervenors. Use of the plant-specific inputs in the SAMA analysis allows for better resolution of data and more accurate portrayal of plant-specific response to postulated severe accident phenomenology, and better serves the purpose of evaluating the benefits of potential plant improvements.

46. Intervenors suggestion that FirstEnergy use NUREG-1465 generic source term values, which do not account plant-specific differences, is directly contrary to established NRC studies and guidance documents that have informed countless PRAs and SAMA analyses. See, e.g., Final Rule, Environmental Review for Renewal of Nuclear Power Plant Operating Licenses, 61 Fed. Reg. 28,467, 28,480 (June 5, 1996) (Attach. 13) (referring to SAMA analysis as site-specific and stating that the Commission expects that significant efficiency can be gained by using site-specific individual plant examination (IPE) and individual plant examinations of external events (IPEEE) results in the consideration of severe accident mitigation alternatives);

NUREG-1150, Vol. 1, at 1-3 (One of the clear perspectives from this study of severe accident risks and other such studies is that characteristics of design and operation specific to individual plants can have a substantial impact on the estimated risks.); Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific 25

Changes to the Licensing Basis, Rev. 2 at 7 (May 2011) (Attach. 32) (stating that the scope, level of detail, and technical acceptability of these risk-informed analyses are to be based on the as-built and as-operated and maintained plant and reflect operating experience at the plant.); NEI 05-01 at 2 (Attach. 14) (suggesting use of plant-specific PRA models in SAMA analyses).

47. Plant-specific source terms developed for SAMA analysis must consider a spectrum of probabilistically-significant accident scenarios to have any meaning from a risk quantification perspective. As discussed earlier, the progression from the failure of individual plant components to the determination of accident frequencies, accident progressions, and offsite consequences involves plant- and site-specific phenomena and can be separated into the three PRA levels. The Level 1 PRA establishes the plant damage states and frequency of reactor core damage frequency or CDF. The Level 2 PRA determines different accident progressions and a set of radioactive release conditions from the containment that are assigned to similar representative groups (release categories). The Level 2 PRA defines the sequence of events resulting in a radioactive release to the environment. The source term analysis then follows and quantifies the amount of radioactivity released for a given sequence and the frequency of occurrence (i.e.,

release categories and their respective frequencies). The Level PRA 3 combines the Level 2 PRA results with site-specific parameters (e.g., population distribution, meteorological data, land use data, and economic data) for the Level 3 PRA to estimate offsite public dose and offsite economic consequences of those releases to the environment.

48. This is precisely the approach that FirstEnergy used in performing the Davis-Besse SAMA analysis. As discussed in ER Sections E.3.1, E.3.2, and E.3.3, FirstEnergy used the Davis-Besse Level 1 PRA and Level 2 PRA models to estimate the CDF and release category frequencies, as well as the source terms, for use in the SAMA analysis. Fault tree and containment event tree (CET) logic models, plant data, and mechanistic models of severe 26

accident phenomena (e.g., MAAP) were used as part of this process. The Level 1 PRA included initiating event (IE) and core damage (CD) sequence analyses and yielded a set of plant damage states (PDS) and associated frequencies.13 The Level 2 PRA used CET and deterministic source term models to provide a set of 34 release categories, each of which has a characteristic frequency and unique timing and fission product magnitude characteristics that represent the release to the environment. The 34 release categories determined from the Level 2 Davis-Besse PRA, based in part on the MAAP analysis, were applied in the MACCS2 SAMA analysis, along with other site-specific inputs, to calculate the Davis-Besse offsite population dose risk (in units of person-rem/year) and offsite economic cost risk (in units of dollars/year), the key risk metrics in a SAMA analysis. Figure 3 illustrates the sequential analyses that are performed as part of a three-level PRA and include the use of the MAAP and MACCS2 codes.

MACCS2 MAAP Figure 3. Sequential Analyses Performed as Part of a Three-Level PRA (based on D.

Harrison, NRC, Chief, PRA Licensing Branch, Perspectives on PSA Technology and Applications, Slide 5, Fire PRA China PSA Workshop, January 10, 2010 (Attach. 33).

13 Initiating events may include, for example, a plant trip, loss-of-coolant accident, loss of offsite power, or steam generator tube rupture.

27

4. Plant-Specific, MAAP-Generated Source Terms Are Integral to the Davis-Besse SAMA Analysis

49. The specifics of the source terms required for a SAMA analysis are highly dependent upon the specifics of the accident progressions themselves. For that reason, PRA analysis uses detailed design-, plant type-, and site-specific information to identify initiating events and their likelihood of potentially leading to core damage, and to establish the CDF, subsequent reactor containment release, and environmental release conditions. The methodology used to develop source terms for a SAMA analysis must account for plant-unique conditions, plant design, support system dependencies, plant maintenance and operating procedures, operator training, and the interdependencies among these factors that can influence the CDF estimate for a specific plant.

50. MAAP meets this important requirement. It is an integral code that treats the full spectrum of important phenomena that could occur during an accident, simultaneously modeling those that relate to the thermal-hydraulics and to the fission product transport and deposition. It also simultaneously models the primary system and the containment (including the influence of mitigative systems and the effects of operator actions).

51. The MAAP 4.0.6 calculations provide a deterministic analysis of Davis-Besse under postulated severe accident conditions for a variety of initiating events and include the influence of operator actions and safety system actuation on accident sequence progression. The MAAP 4.0.6 calculations predict the integrated response of the reactor core, primary system, steam generators, and primary containment building. Results include the time of core damage and reactor vessel failure to support Level 1 PRA success criteria, as well as containment response and fission product source term characterization to support the Level 2 and Level 3 assessments. For each of the 34 release categories examined in the Davis-Besse SAMA analysis, a representative MAAP case was used to estimate (1) the timing of the radioactive release into the environment 28

and (2) the magnitude of the radioactive release into the environment. The source term defined for each release category from the Level 2 PRA was processed in the MACCS2 code.

52. Among other inputs to MACCS2, the input parameters require output information extracted from MAAP, and the development of the core inventory. Specifically, there are six input variables required by MACCS2 that come from the output of MAAP: (1) the time after accident initiation that the offsite alarm is initiated (OALARM), (2) the heat content of release segment (PLHEAT), (3) the height of the plume segment at release (PLHITE), (4) the duration of release (PLUDUR), (5) the time of release for each plume (PDELAY), and (6) the release fraction for each radionuclide group (RELFRC). The core inventory for the Davis-Besse Level 3 PRA was obtained from plant-specific calculations performed using the ORIGEN-2 code. For conservatism, the Davis-Besse core inventory was evaluated at the 24-month end-of-cycle for all 177 fuel assemblies. This assumption is generally conservative because at the end-of-cycle, the radionuclide quantities in the core would be at their peak levels for the 24-month cycle. In total, the activity levels of 58 radionuclides (represented in nine fission product groups) were evaluated as part of the Davis-Besse reactor core inventory for subsequent analysis in the MACCS2 code.

5. Use of Generic Source Terms from NUREG-1465 is Not Justified and Would Inappropriately Distort the SAMA Analysis Results

53. NUREG-1465 presents only one set of PWR release fraction data and one set of BWR release fraction data. NUREG-1465 at 13 tbl. 3.13 (PWR Releases Into Containment) and tbl. 3.12 (BWR Releases Into Containment) (Attach. 8). Use of the NUREG-1465 source term as a surrogate for the release into the environment instead of the Davis-Besse, plant-specific Level 2 PRA, which develops accident-specific release categories for input to the consequence analysis for the SAMA analysis, leads to an overly conservative estimate and lacks technical merit. It essentially treats all types of postulated core melt accident releases into the containment as releases into the environment; i.e., it treats containment failure sequences and containment by-pass 29

events equivalently. The assumption of not crediting the containments presence, and neglecting associated passive and active engineered safety features for mitigating and delaying releases, leads to one worst-case source term scenario. This magnitude of release is only PWR or BWR-specific, and does not quantify the effects of plant-specific features for which a SAMA analysis provides a reasonable, NEPA-compliant, cost-benefit analysis evaluation. Thus, using the NUREG-1465 source term instead of plant-specific information from the Level 1 and Level 2 PRA for a given plant would oversimplify the SAMA cost-benefit process and likely lead to technically unfounded conclusions about a particular plants offsite risks.

54. As proposed by Intervenors, NUREG-1465 PWR source term data in the Davis-Besse SAMA analysis would be applied to all 34 release categories; i.e., from containment bypass-steam generator tube rupture (RC 1) source terms through no-failure, containment maintained intact with design leakage (RC 9) source terms. However, for Davis-Besse, approximately 90% of the core damage sequences involve accidents in which the containment retains its structural integrity (i.e., radiological release is limited to containment leakage, as modeled in RC 9.1 and 9.2), and the remaining 10% would be the result of early containment failure and other events (e.g., containment bypass events, specifically steam generator tube rupture and interfacing system loss of coolant accidents). Additionally, early containment failure and containment bypass are different event types, with significant differences in sequence progression, timing, release pathways, and fission product deposition and removal mechanisms. These different event types logically would result in different source terms and release fractions. Use of NUREG-1465 release fractions for all release categories would essentially treat all releases into the containment as releases into the environment and greatly distort the results of the SAMA analysis. Indeed, not crediting the containments presence and neglecting associated passive and 30

active engineered safety features for mitigating and delaying releases would lead to a worst-case source term scenario without any technically supported weighting by likelihood of occurrence.

55. It also bears mention that an integrated computer code such as MAAP may serve multiple functions in a Level 2 PRA. FirstEnergy used the MAAP code to support the entire Davis-Besse PRA that serves as a major input to the SAMA analysis. For example, FirstEnergy used MAAP to support the development of plant equipment success criteria (e.g., amount of flow required to meet core cooling needs at specific times) and to develop timelines for operator actions to determine human error probabilities included in the PRA. Use of alternate data for release fractions as inputs to the Level 3 analysis does not obviate the dependence of the Davis-Besse SAMA analysis on the MAAP code.

56. In summary, the distinct phenomenological bases and regulatory purposes of the NUREG-1465 and MAAP source terms explain the relative numerical differences in the amount of radionuclides and the timing for the release. Due to containment ESFs (e.g., containment air coolers, containment spray) and natural depletion processes (e.g., aerosol deposition and containment holdup), the source term released from the reactor coolant system into containment expectedly is different from that of the containment into the environment. Thus, the NUREG-1465 and MAAP source terms should differ, with the MAAP source term being the smaller of the two.

57. Use of an overstated source term from NUREG-1465 would have numerous (and unjustified) effects. Such effects include exaggerated early and long-term health effects, incorrect determination of the size of the area that might become contaminated, inflated offsite economic losses, and incorrect estimates of the dollar value of SAMA candidates. The net effect would be to distort the SAMA process, and likely misrepresent the risk reduction effectiveness of plant-31

specific SAMA candidates. Such SAMA candidates would be technically unmerited because they arise from applying a generic source term basis.

C. Inapplicability of Historical Release Fraction Comparisons Cited by Intervenors (Basis 3)

58. In Contention 4, the Intervenors also cite historical comparisons between release fractions developed using earlier versions of the MAAP code and release fractions developed using other codes. The first is a 1987 draft of the NUREG-1150 severe accident risk study that, in examining accident risk at Zion Nuclear Station, found that the MAAP estimates for environmental release fractions were significantly smaller than those obtained with the Source Term Code Package14 (STCP) computer code (the primary code used in the NUREG-1150 study). Draft NUREG-1150, Vol. 1 at 5-14 (Attach. 9). The second is a 2002 Brookhaven National Laboratory (BNL) report reviewing combustible gas control availability at ice condenser and Mark III containment plants. The BNL report compared the Level 2 portion of the PRA results for the Catawba plant (obtained using the MAAP code) with a typical NUREG-1150 release for the Sequoyah plant (obtained using the STCP and MELCOR codes). John R. Lehner et al., Brookhaven National Laboratory, Benefit Cost Analysis of Enhancing Combustible Gas Control Availability at Ice Condenser and Mark III Containment Plants, Final Letter Report at 17 (Dec. 2002) (BNL report) (Attach. 34). The BNL report states that the NUREG-1150 release fractions for the important radionuclides are about a factor of 4 higher than the ones in the Catawba PRA, and that the differences in the release fractions . . . are primarily attributable to the use of the different codes in the two analyses. Id.

14 As noted on the Sandia MELCOR website (http://melcor.sandia.gov/), the STCP is the predecessor to MELCOR:

MELCOR is a fully integrated, engineering-level computer code that models the progression of severe accidents in light-water reactor nuclear power plants. MELCOR is being developed at Sandia National Laboratories for the U.S. Nuclear Regulatory Commission as a second-generation plant risk assessment tool and the successor to the Source Term Code package.

32

59. Neither of the Intervenors comparisons is germane to FirstEnergys use of MAAP-generated source terms or release fractions in the Davis-Besse SAMA analysis. Although its remains a seminal document, the final NUREG-1150 study was completed over 20 years ago and involved an assessment of the risks from severe accidents at five commercial nuclear power plants in the United States. Davis-Besse was not one of those five plants. Furthermore, the IDCOR (MAAP) to NUREG-1150 (STCP) comparison of Zion results cited by Intervenors was only one of four sets of plant results compared in the February 1987 draft of NUREG-1150 (with several other comparisons in the draft report showing reasonable agreement). In addition, after extensive peer review of, and public comment on, the February 1987 draft, NUREG-1150, Volume 1, was issued as a second draft in 1989, before being published as a final report in December 1990. In summary, the report and its underlying technical analyses were substantially modified in two rounds of review before the reports final publication in December 1990. Notably, one of the changes included deleting the specific discussion comparing the MAAP and STCP results for Zion, such that the comparison cited by Intervenors in Contention 4 was not incorporated into the final December 1990 version of NUREG-1150.

As discussed previously, severe accident source term estimates from computer codes depend on user assumptions and expertise, the extent to which plant-specific passive and active design features are modeled, the degree of benchmarking,15 and the technical accuracy provided by computer code models and their underlying algorithms. While the final 1990 NUREG-1150 report still is relevant to the nuclear safety communitys understanding of severe accident progression, additional severe accident research performed in the U.S. and abroad in the 25 years since the 1987 draft of NUREG-1150 was issued has significantly improved that understanding.

15 In this context, benchmarking refers to comparison of code predictions with experiments, other qualified codes that model the same phenomena and, in some situations, hand or spreadsheet calculations.

33

One of these research efforts, a recent NRC-sponsored project, is discussed later in this Joint Declaration (Paragraphs 65 to 69).

60. In using STCP in the NUREG-1150 study to predict complex phenomena, the studys authors noted that they used both expert elicitation and additional computer codes to augment the results of simplified STCP models. For example, with respect to the core degradation process, the NUREG-1150 authors stated the thermal-hydraulic model in the STCP uses simplified models and assumptions for the treatment of some of the very complex steps in the core degradation process, such as fuel slumping into the lower plenum of a reactor vessel. NUREG-1150, Vol. 3, App. D at D-17 (Attach. 10). More realistic models such as MELCOR and MAAP were used to adjust the thermal-hydraulic estimates affecting core degradation, ultimately leading to differences in the source term. Id.

61. In accounting for the effect of more realistic models evaluating the same sequences and for the same basis plant (Zion), Henry and Rahn (2004) showed reduced environmental source terms comparing PWR sequences from WASH-1400 (1975)16 to updated analyses in NUREG-1150 (1990) and in an updated analysis performed using MAAP. Frank J. Rahn and Robert E.

Henry, Release and Dispersion of Radioactivity from Reactor Fuel Research and Analytical Results Leading to Reductions in Radiological Source Terms, American Nuclear Society Position Statement No. 65 on Realism in the Assessment of Nuclear Technologies, Appendix 1A (June 2004) (Attach. 36). To illustrate the time available for corrective action and the mitigation of fission product releases, Henry and Rahn evaluated large dry type accident sequences (Station Blackout or SBO) SBO sequences (i.e., AC power recovery at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and one without power recovery). The Henry and Rahn results showed that there are substantial processes (e.g., heat transfer and fission product chemistry) within the reactor coolant system and the containment that 16 WASH-1400 (NUREG-75/014), Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants (1975) (excerpt attached as Attach. 35).

34

extend the interval before releases to the environment occur and also substantially limit the magnitude of releases to the environment for severe core damage accidents. In summary, the comparison showed lower release fractions from the containment to the environment for NUREG-1150 and MAAP large dry source terms than comparable (PWR 3 and 7) WASH-1400 source terms and that the MAAP-based release fractions to the environment were about the same or slightly higher when compared to similar, corresponding sequences from NUREG-1150.

62. Regarding the 2002 BNL reports comparison of the Catawba and Sequoyah plants release fractions, it should be noted that both of these plants have ice condenser containments, while Davis-Besse has a dry, ambient pressure containment type. In any case, in its Supplemental Environmental Impact Statement for Catawba license renewal, the NRC Staff compared similar sequences between the two studiesNUREG-1150 and Revision 2b of the Catawba PRA,17 which included the plants IPE modelsand concluded there was reasonable agreement for the closest corresponding release scenarios. NUREG-1437, Supp. 9, at 5-9 to 5-10 (Attach. 37). Specifically, the Staff provided the following summary:

The Staff reviewed the process used by Duke to extend the containment performance (Level 2) portion of the IPE to the offsite consequence (Level 3) assessment. This included consideration of the source terms used to characterize fission product releases for each containment release category and the major input assumptions used in the offsite consequence analyses. This information is provided in Section 6.3 of Dukes IPE submittal. Duke used the Modular Accident Analysis Program (MAAP) code to analyze postulated accidents and develop radiological source terms for each of 29 containment release categories used to represent the containment end-states. These source terms were incorporated as input to the MACCS2 analysis. The staff reviewed Dukes source term estimates for the major release categories and found these predictions to be in reasonable agreement with estimates of NUREG-1150 (NRC 1990) for the closest corresponding release scenarios. The staff concludes that the assignment of source terms is acceptable. Id. at 5-10.

17 Letter from Gary R. Peterson, Vice President, Duke Energy Corporation, to Document Control Desk, U.S.

N.R.C., Attach. 1, Catawba PRA Revision 2b Summary Results (Apr. 18, 2001).

35

63. The state of the art for source term analysis has improved considerably since the NUREG-1150 study was performed in the 1980s. This is a well-known fact that Intervenors faulty comparisons fail to consider. For example, the comparison between the Catawba Level 2 PRA release fractions and the NUREG-1150 Sequoyah release fractions represents a difference of more than ten years in terms of severe accident modeling (~2002 versus ~1990). Also, the comparison uses a release category that represents an early containment failure in which the Catawba source term is based on an early containment failure without ex-vessel release assumption that may not have been applied in the Sequoyah source term. See Memorandum from Asimios Malliakos, Probabilistic Risk Analysis Branch, Division of Risk Analysis and Applications, Office of Nuclear Regulatory Research, to Marc A. Cunningham, Chief, Probabilistic Risk Analysis Branch, Division of Risk Analysis and Applications, Office of Nuclear Regulatory Research, Telecommunication with Duke Energy Corporation in Support of Generic Safety Issue (GSI) 189, Susceptibility of Ice Condenser and BWR Mark III Containments to Early Failure from Hydrogen Combustion During a Severe Accident, Attach. 1, 3 (Oct. 8, 2002)

(Attach. 38). Early containment failure, in this case, seems to be associated with high pressure in the Reactor Coolant System at reactor vessel failure, with the resulting blowdown dispersing the corium into the lower containment area. With the debris bed spread over a large area, the debris bed will be coolable, preventing the ex-vessel release of fission products, such as that due to molten core-concrete interactions, and subsequently leading to a smaller source term to the environment. This assumption apparently was not applied in the earlier NUREG-1150 analysis for Sequoyah. Although Davis-Besse also is a PWR, it has a dry, ambient air containment type, whereas both Catawba and Sequoyah are typical of ice condenser containment PWR plants.

64. Since the issuance of NUREG-1150, better understanding of heat transfer and removal from the reactor pressure vessel (RPV) during severe accident sequences; improved 36

insights into iodine, cesium, and other fission product group chemistry from contemporary research; and modeling improvements suggest that the early containment failure releases potentially could be smaller than previously concluded. See ¶ 61, supra. Thus, the BNL reports comparison of MAAP-based source terms with those estimated over ten years earlier with the simpler STCP code and an earlier version of MELCORand for different plantsis expected to show differences. A more logical and meaningful approach is to compare contemporary, severe accident computer code models and compare their predictions to experimental data or to postulated reactor conditions for the same scenario. In other words, the best comparison is of the predictions of computer models at the same point in time with the same inputs and available data available to the code analysts.

65. The NRC, the nuclear power industry, and the international nuclear energy research community have extensively researched and studied accident phenomena and offsite consequences of severe reactor accidents over the last 25 years. As part of an initiative to assess plant response to security-related events following the terrorist attacks of 2001, the NRC completed updated analyses of severe accident progression and offsite consequences. Those analyses incorporate a wealth of accumulated research data as well as more detailed, integrated, and realistic modeling methods than previous analyses. One insight gained from these security assessments was that updated analyses of severe reactor accidents were needed to reflect realistic estimates of the more likely accident outcomes given the current state of plant design and operation and advances in our understanding of severe accident behavior. NUREG-1935, State-of-the-Art Reactor Consequence Analyses (SOARCA) Report, Draft Report for Public Comment at xv (Jan. 2012)

(Draft NUREG-1935) (Attach. 39).

66. Consequently, the NRC initiated the State-of-the-Art Reactor Consequence Analyses (SOARCA) project in 2006 to develop revised best estimates of the offsite 37

radiological health effect consequences of severe reactor accidents. The projects principal objective was to develop updated and more realistic severe accident analyses by including significant plant changes and reactor safety research updates not reflected in earlier NRC assessments. SOARCA included consideration of plant system improvements, improvements in training and emergency procedures, offsite emergency response, and security-related improvements, as well as plant changes such as power uprates and lengthened operating times.

67. The SOARCA analyzed two plants that are typical of the two U.S. commercial reactor types, i.e., a BWR plant, the Peach Bottom Atomic Power Station in Pennsylvania, and a PWR plant, Surry Power Station in Virginia. These two plants also took part in earlier accident analyses performed by the NRC, including the seminal WASH-1400 PRA study (1975), the Sandia Siting Study (1982),18 and the NUREG-1150 (1990) study. The SOARCA analysis considered one plant unit at each site.

68. The SOARCA project used computer-modeling techniques to understand how a reactor might behave under severe accident conditions, and how a release of radioactive material from the plant might affect the public. Specifically, it used MELCOR to model the severe accident scenarios within the plant and MACCS2 to model the offsite health effect consequences of any atmospheric releases of radioactive material.

69. In January 2012, the NRC published the results of its assessment and plant-specific reports for Peach Bottom and Surry. See Draft NUREG-1935; NUREG/CR-7110, State-of-the-Art Reactor Consequence Analyses Project Volume 1: Peach Bottom Integrated Analysis (Jan.

2012) (Attach. 41); NUREG/CR-7110, State-of-the-Art Reactor Consequence Analyses Project Volume 2: Surry Integrated Analysis (Jan. 2012) (Attach. 42). Among the findings, the NRC found that, in addition to delayed radiological releases, the magnitude of the radionuclide release, 18 NUREG/CR-2239, Technical Guidance for Siting Criteria Development (1982) (excerpt attached as Attach.

40).

38

especially with respect to the key radionuclide (iodine and cesium) groups, is much smaller than estimated in prior studies, such as the 1982 Sandia Siting Study. This is shown in Figure 4 below.

Figure 4. Percentages of Iodine and Cesium Released to the Environment During the First 48 Hours of the Accident for SOARCA Unmitigated Scenarios, 1982 Siting Study (SST1), and Historical Accidents (from NUREG/BR-0359, Modeling Potential Reactor Accident Consequences, 24 fig. 4.1 (Jan. 2012) (Attach. 43).

70. Another more meaningful comparison is between the MAAP and MELCOR codes.

Sandia developed MELCOR for the NRC, and it is the current software tool in a line of evolutionary, severe accident progression computer models used by the NRC. As noted above, 39

Sandia and the NRC used MELCOR in support of the SOARCA project. Both MAAP and MELCOR are now used throughout the world and are much more advanced than predecessor versions or simpler models, such as the STCP, that were applied more than 20 years ago in the NUREG-1150 study. They are both integrated codes that allow the calculation of accident sequences from the initiating event while taking into account important inter-related phenomena (e.g., reactor coolant system, containment thermal-hydraulics, in-vessel core degradation, molten core concrete interaction, fission product release and transport into the environment).

71. A 2004 comparison using MELCOR and MAAP for a PWR accident sequence demonstrates that the two codes provide similar calculated results for thermal-hydraulic and core degradation response of the plant, with minor differences in various timings of phenomena. The authors indicated that these minor differences in results were within the uncertainties of the code numerical computations and the physics models. K. Vierow, Y. Liao, J. Johnson, M. Kenton, and R. Gauntt, Severe accident analysis of a PWR station blackout with the MELCOR, MAAP4, and SCDAP/RELAP5 Codes, Nuclear Engineering and Design 234, 129-145 (2004) (Attach. 44).

Although this documented comparison did not specifically address the calculation of release fractions to the environment, this comparison does support the use of either code for purposes supporting PRAs. In our judgment, the results of this comparison show that use of MAAP is reasonable for the purposes of developing a SAMA analysis for the purposes of NEPA.

72. Notably, both MAAP and MELCOR were used soon after the March 2011 Fukushima Dai-ichi nuclear power plant accident in Japan. Tokyo Electric Power Company, the operating utility for the six-unit station, has used MAAP to inform its understanding of the accident progression in Units 1-3 during the earthquake and subsequent tsunami event in March 2011. International Atomic Energy Agency, IAEA International Fact Finding Expert Mission of the Fukushima Dai-ichi NPP Accident Following the Great East Japan Earthquake and Tsunami, 40

at 33-35 (June 2011) (Attach. 45). Sandia applied MELCOR in modeling the Station Blackout sequence for the NRC in support of the Japanese Government.

73. The contemporary applications and comparisons of MAAP discussed above demonstrate the current-day use and value of MAAP (and MELCOR) with respect to state-of-the-art modeling and simulation of severe reactor accident conditions. In our professional opinions, they are better indicators of the MAAP codes fitness for simulating severe accident conditions and estimating environmental source terms than the references cited by Intervenors, which are outdated and impertinent and which fail to show any flaw in the MAAP code or related inputs used by FirstEnergy in its SAMA analysis VI. CONCLUSION

74. We have thoroughly evaluated the claims in Contention 4 against information in the recently amended Davis-Besse ER and its supporting technical documentation, the applicable accepted standards for performing PRAs and SAMA analyses, and the studies and reports discussed above. Based on our evaluation, we conclude that all of the Intervenors claims lack a technical foundation and provide no reason to conclude that the source terms used in the Davis-Besse SAMA analysis are invalid or unreasonable. Specifically we conclude the following:

• The MAAP code has a strong technical basis for use in PRA and severe accident analysis and has been accepted for use in numerous NRC-approved analyses. Use of the MAAP code is reasonable for a SAMA analysis performed under NEPA.

• The use of plant-specific source terms (e.g., based on MAAP) is preferred over the use of generic source terms (e.g., based on NUREG-1465) for a SAMA analysis where plant specific design and operational changes are evaluated.

• The primary purpose of NUREG-1465 source terms is for defining releases into containment, not to the environment. A SAMA analysis requires a plant-specific evaluation of releases to the environment.

• NUREG-1465 provides data only for a single PWR release. A SAMA analysis requires an evaluation of the spectrum of plant-specific releases. Use of NUREG-1465 data for the entire spectrum would result in grossly-distorted SAMA results.

41

In accordance with 28 U.S.C. § 1746, we declare under penalty of perjury that the foregoing is true and correct.

Executed in accord with 10 C.F.R. § 2.304(d) Executed in accord with 10 C.F.R. § 2.304(d)

Kevin R. OKula Grant A. Teagarden Advisory Engineer Manager, Consequence Analysis URS Safety Management Solutions LLC ERIN Engineering and Research, Inc.

2131 South Centennial Avenue 2105 S. Bascom Avenue, Suite 350 Aiken, SC 29803-7680 Campbell, CA 95008 Phone: (803) 502-9620 Phone: (408) 559-4514 E-mail: kevin.okula@wsms.com E-mail: gateagarden@erineng.com July 26, 2012 42

Attachment A Definitions of Key Severe Accident and PRA Terms Term Definition Accident A group of postulated accidents that has similar characteristics with respect to the Progression timing of containment building failure and other factors that determine the amount of Bin radioactive material released. Accident progression bins are sometimes referred to as containment failure modes in older PRAs.

Core Damage The frequency of combinations of initiating events, hardware failures, and human Frequency errors leading to core uncovery with reflooding of the core not imminently expected.

Core Inventory The amount (in units of activity) of each radionuclide present in the reactor core at the time accident initiation.

External Events occurring away from the reactor site that result in initiating events in the plant.

Initiating In keeping with PRA tradition, some events occurring within the plant during normal Events power plant operation, e.g., fires and floods initiated within the plant, are included in this category.

Initiating Event A challenge to plant operation from which there can be numerous accident sequences.

The various accident sequences result regardless of whether plant systems operate properly or fail and what actions operators take. Some accident sequences will result in a safe recovery and some will result in reactor core damage. PRA normally consider internal and external initiating events.

Internal Initiating events involving components internal to the plant (e.g., transient events Initiating requiring reactor shutdown, pipe breaks) occurring during the normal power Events generation of a nuclear power plant. In keeping with PRA standard practice, loss of offsite power is considered an internal initiating event.

Plant Damage A group of accident sequences that has similar characteristics with respect to accident State progression and containment engineered safety feature operability.

Release The fraction defining the portion of the radionuclide inventory by radionuclide group Fraction in the reactor at the start of an accident that is released through a containment barrier(s), such as the reactor coolant system, to the primary containment, or from the primary containment to the environment.

Severe Severe nuclear accidents are those in which substantial damage is done to the reactor Accident core whether or not there are serious offsite consequences. A severe accident is often described as a beyond design-basis accident involving multiple failures of equipment or function. Although severe accidents generally have lower likelihoods than design-basis accidents, they may have greater consequences.

Source Term The fractions of the core inventory released to the atmosphere, and the timing and other release information needed to calculate the offsite consequences. Specifically, the information includes the fractions of the radionuclide groups in the inventory in the reactor at the start of an accident that are released to the containment (i.e., the containment source term), or to the environment (i.e., the environmental source term).

The source term to the environment also includes the initial elevation, heat or energy content of the plume, and timing of the release (time after accident initiation or shutdown, and duration of release).

43

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 3 Curriculum Vitae of Dr. Kevin R. OKula

KEVIN R. OKULA Advisory Engineer URS Safety Management Solutions LLC 2131 South Centennial Avenue Aiken, South Carolina 29803-7680 Telephone: 803.502.9620 - Email: kevin.okula@wsms.com KEY AREAS:

• Computer Model Verification and Validation

• Severe Accident and Quantitative Risk Analysis

• Accident and Consequence Analysis for Design Basis

• Level 2/3 Probabilistic Risk Assessment Accident Support

• Tritium Dispersion and Consequence Analysis

• Regulatory Standard & Guidance Development

• MACCS2 Code Applications

• New Reactor Design Accident Analysis and PRA Support

• Level 3 PRA Standard Development PROFESSIONAL

SUMMARY

Dr. OKula has over 29 years of experience as a manager and technical professional in the areas of accident and consequence analysis, source term evaluation, commercial and production reactor probabilistic risk assessment (PRA) and severe accident analysis, safety software quality assurance (SQA), safety analysis standard and guidance development, computer code evaluation and verification, risk management, hydrogen safety, reactor materials dosimetry, shielding, and tritium safety applications.

Kevin is currently the lead for the PRA technical area in the Risk Assessment and Analysis Group. He is a member of the American Nuclear Society (ANS) Standard working group ANS 58.25 on Level 3 Probabilistic Safety Assessment, and recently concluded activities as a member of the Peer Review Committee for the Nuclear Regulatory Commissions (NRCs) State-of-the-Art Reactor Consequence Analysis (SOARCA) Program. Dr. OKula was part of the Department of Energy (DOE) team writing DOE G 414.1-4, Safety Software Guide. He coordinated technical support for the DOE Office of Environment, Safety, and Health (EH) in addressing Defense Nuclear Facilities Safety Board (DNFSB)

Recommendation 2002-1 on Software Quality Assurance (SQA), and was a consultant to DOE/EH-31 Office of Quality Assurance for disposition of SQA issues.

Dr. OKula is supporting, or has supported, Atomic Safety Licensing Board (ASLB) relicensing issue resolution for several commercial nuclear power plants, including Indian Point Units 2 and 3, Davis-Besse Nuclear Power Station, Prairie Island Units 1 and 2, and Pilgrim Nuclear Power Station, on severe accident mitigation alternatives (SAMA) analysis issues. He also was part of the accident analysis and PRA/severe accident teams supporting the Design Certification Document for the U.S. Advanced Pressure Water Reactor (US-APWR) a joint effort with URS Washington Division and Mitsubishi Heavy Industries (MHI). He has provided similar support for an alternative reactor technology, the Pebble Bed Modular Reactor (PBMR).

Kevin was a member of the Partner, Assess, Innovate, and Sustain (PAIS) Safety Case team for the Sellafield Sites in the United Kingdom in the early 2009 period. The PAIS team identified and began implementation of improvement opportunities in nuclear safety and related areas for Sellafield.

Recommendations were documented in comprehensive reports to the Sites Nuclear Management Partners consortium in March 2009.

URS SAFETY MANAGEMENT SOLUTIONS LLC K. R. OKULA Dr. OKula is coordinating URS SMS support to the Quantitative Risk Analysis (QRA) for evaluation of hydrogen events to risk-inform the Waste Immobilization and Treatment Plant (WTP) design at Hanford, including fault tree analysis and reliability data, and human factors areas. He is also a contributor to the DOE response on the use of risk assessment methodologies as part of the DNFSB Recommendation 2009-1 implementation action for Risk Assessment. He led work in reviewing EIS food pathway consequence analysis performed on assumed accident conditions from the Mixed Oxide Fuel Fabrication Facility (MFFF), sited at the Savannah River Site. This project compared and evaluated the impacts calculated from three computer models, including MACCS2, GENII, and UFOTRI.

Kevin is past chair of the ANS Nuclear Installations Safety Division (NISD), and the Energy Facility Contractors Group (EFCOG) Accident Analysis Subgroup, and is the current NISD Program Committee Chair. He is a member of the Nuclear Hydrogen Production Technical Group under the ANSs Environmental Sciences Division, and is chair for the EFOCG Hydrogen Safety Interest Group. He was the Technical Program Chair for two ANS embedded topical meetings on Operating Nuclear Facility Safety (Washington, D.C., 2004) and the Safety and Technology of Nuclear Hydrogen Production, Control and Management (Boston, MA, 2007). He is the Assistant Technical Program Committee Chair for the Probabilistic Safety Assessment (PSA) Meeting in Columbia, SC, scheduled for September 22-26, 2013.

Dr. OKula was PRA group manager for K Reactor at the time of restart in the early 1990s. He led a successful effort demonstrating Savannah River Site (SRS) K-Reactor siting compliance to 10 CFR Part 100, and tritium facility compliance with SEN-35-91.

Kevin was the project leader for independent Verification and Validation (V&V) of urban dispersion software for the Defense Threat Reduction Agency (DTRA) and is the current V&V project manager for the evaluation of several chemical/biological software tools for the U.S. Army Test and Evaluation Command (ATEC) and Chemical-Biological Program (Dugway Proving Ground (Utah) and Edgewood Chemical/Biological Center in Maryland.

EDUCATION:

Ph.D., Nuclear Engineering, University of Wisconsin, 1984 M.S., Nuclear Engineering, University of Wisconsin, 1977 B.S., Applied and Engineering Physics, Cornell University, 1975 TRAINING:

Conduct of Operations (CONOPS), 1994 Harvard School of Public Health, Atmospheric Science and Radioactivity Releases, 1995 Consequence Assessment, (Savannah River Site, 1995)

U.S. DOE Risk Assessment Workshop (Augusta, GA, 1996)

MELCOR Accident Computer Code System (MACCS) 2 Computer Code, 1997, 2005, 2011 MCNPX Training Class (ANS Meeting, 1999)

CLEARANCE:

Active DOE L 2

URS SAFETY MANAGEMENT SOLUTIONS LLC K. R. OKULA PROFESSIONAL EXPERIENCE:

URS Safety Management Solutions LLC 1997 to Present Advisory Engineer and Senior Fellow Advisor Dr. OKula recently concluded activities as a member of the NRC-Sandia National Laboratories State-of-the-Art Reactor Consequence Analysis (SOARCA) Project Peer Review Committee. The SOARCA team provided recommendations on applying MACCS2 for modeling accident phenomena and subsequent off-site consequences from postulated severe reactor accidents. This activity supports the efforts of Sandia National Laboratories (SNL) and the Nuclear Regulatory Commission (NRC) to provide more realistic assessment of severe accidents.

Kevin also part of the Level 3 PRA Standard working group charged with developing an ANSI/ANS standard for Level 3 PRA analysis. He participated in a team that conducted an SQA gap analysis on the bioassay code [Integrated Modules for Bioassay Analysis (IMBA)] based on DOE G 414.1-4 requirements. He identified safety analysis codes that were designated as DOE toolbox codes, and oversaw production of the first documents (QA criteria and application plan, code guidance reports, and gap analysis) for six accident analysis codes designated for the DOE Safety Software Toolbox. He provided support to DOE/EH-31 (now DOE/HSS) for addressing SQA issues for safety analysis software.

He was a contributor to DOE G 414.1-4, Safety Software Guide on SQA practices, procedures, and programs.

Kevin has provided technical input for work packages on several recent commercial projects. In the first, he teamed with Entergy on MACCS2 code applications issues in the Severe Accident Mitigation Alternatives (SAMA) analysis area for the Pilgrim Nuclear Power Station. In the second, he was part of tritium environmental release analysis team that supported evaluation of tritium control and management areas for the Braidwood plant. A third effort developed an initial SAMDA document for the Mitsubishi Heavy Industries (MHI) US-APWR (1610 MWe evolutionary PWR), as well as complete a control room habitability study for postulated toxic chemical gas releases.

He was part of a Washington Group team that developed a Design Control Document (DCD) for the MHI US-APWR using input information from MHI. He was Chapter lead on Chapter 15 (Transient and Accident Analysis), and later transitioned to severe accident evaluation and documentation support to Chapter 19 (PRA and Severe Accidents). He was the Chapter 19 lead for PRA and Severe Accident for COLA development for the Pebble Bed Modular Reactor (PBMR).

Dr. OKula developed the outline, coordinated contributors, and assembled the first draft of the DOE Accident Analysis Guidebook, a reference guide for hazard, accident, and risk analysis of nuclear and chemical facilities operated in the DOE Complex. He is also the primary author and coordinator for the Accident Analysis Application Guide for the Oak Ridge contractor. Dr. OKula also developed a one-day course and exam for the guide, which he later presented to the Oak Ridge, Paducah, and Portsmouth staff.

Kevin also led an independent V&V review for the DTRA of the U.K.-developed Urban Dispersion Model (UDM) software for predicting chemical and biological plume dispersion in city environments, and is leading projects to verify and validate chemical/biological simulation suite software applications for the Dugway Proving Ground (Utah), and the Edgewood Chemical Biological Center (ECBC) in Maryland.

Managing Member, Consequence Analysis Dr. OKula was responsible for the consequence analysis associated with accident analysis sections of Documented Safety Analysis (DSA) reports and other safety basis documents for SRS, Oak Ridge, and other DOE nuclear facilities. He also developed the methodology and identified appropriate computer models for this purpose. Additionally, Dr. OKula developed training to enhance consistency and 3

URS SAFETY MANAGEMENT SOLUTIONS LLC K. R. OKULA standardize analyses in the consequence analysis area. He was project manager for environmental assessment support to SRS on a transportation safety analysis using the RADTRAN code.

Kevin coordinated development of a DOE Accident Analysis Guidebook involving over 10 sites and organizations. He also led the effort to produce Computer Model Recommendations for source term (fire, spill, and explosion), in-facility transport, and dispersion/consequence (radiological and chemical) areas.

Westinghouse Savannah River Company 1989 to 1997 Group Manager Dr. OKula managed consequence analyses associated with accident analysis sections of DSA reports and other safety basis documents. He also developed the associated methodologies and identified appropriate computer models. He was a member of the management team supporting Criticality Safety Evaluation preparation assisting Safe Sites of Colorado and the dispositioning of final criticality safety issues for the decommissioning and decontamination of nuclear facilities at the Rocky Flats Environmental Technology Site.

In a teaming arrangement with Science Applications International Corporation, Kevin initiated discussions that led to development of an emergency management enhancement tool to risk inform likely source terms. He applied this approach to a Savannah River nuclear facility (K Reactor), and was part of the team to provide this methodology for use on the British Advanced Gas-Cooled Reactors (AGRs) (for the United Kingdoms Nuclear Installation Inspectorate). The model was knowledge-based and required the development of an Accident Progression Event Tree (APET) for the facility in question.

Dr. OKula managed the completion of the SRS K Reactor PRA program. He was the lead for development of the K Reactor Source Term Predictor Model and assisted with the core technology lay-up program to preserve competencies in reactor safety. He coordinated a 25-person group responsible for K Reactor probabilistic and deterministic dose analyses, and led the examination of reduced power cases at project termination. He developed risk and dose management applications to cost-effectively prioritize facility modifications.

Kevin interfaced with DOE Independent and Senior Review teams to finalize study acceptance, and transitioned the risk assessment team to risk management functions for nuclear and waste processing facilities. In addition, he successfully prepared a 10 CFR 100 Siting white paper to resolve issues raised by the DNFSB, and teamed with DOE/HQ legal support to document resolutions. He led the development of a position paper demonstrating SRS Replacement Tritium Facility compliance with DOE Safety Policy (SEN-35-91).

Staff Engineer Dr. OKula led an analytical team quantifying the tritium source term during a Loss of River Water design basis accident. He evaluated airborne tritium levels with multi-cell CONTAIN model, interfaced with a multidisciplinary team to resolve Operational Readiness Review concerns, developed an SRS-specific methodology for applying MACCS as a tool for Level 3 PRA Applications, and applied CONTAIN code for K Reactor source term analysis.

E.I. du Pont de Nemours & Company 1982 to 1989 Principal Engineer, Research Engineer Dr. OKula performed risk analysis duties for the Savannah River Laboratory (SRL) Risk Analysis Group, after earlier conducting research activities for the Reactor Materials and Reactor Physics Groups.

He performed initial planning for offsite irradiation of test specimens to evaluate remaining reactor lifetime for Savannah River reactor components.

4

URS SAFETY MANAGEMENT SOLUTIONS LLC K. R. OKULA Westinghouse Electric Corporation 1975 Summer Student, Reactor Licensing Monroeville, PA American Electric Power Corporation 1973 to 1974 Co-op Student, Reactor Physics and Reactor Licensing New York, NY Long Island Lighting Company 1972 Summer Intern Riverhead, NY PARTIAL LIST OF PUBLICATIONS (2000-2011):

M. G. Wentink, K. R. OKula (Primary and Presenting Author), H. A. Ford, C.R. Lux, and H. C.

Benhardt, Operational Frequency Analysis Model Supporting the QRA for Risk-Informing the Design of a Waste Processing Facility, American Nuclear Society Winter Meeting, October 30 - November 3, 2011 (Washington, D.C.).

K. R. OKula, D. C. Thoman, J. Lowrie, and A. Keller, Perspectives on DOE Consequence Inputs for Accident Analysis Applications, American Nuclear Society 2008 Winter Meeting and Nuclear Technology Expo, November 9-13, 2008 (Reno, NV).

K. R. OKula, F. J. Mogolesko, K-J Hong, and P. A. Gaukler, Severe Accident Mitigation Alternative Analysis Insights Using the MACCS2 Code, American Nuclear Society 2008 Probabilistic Safety Assessment (PSA) Topical Meeting, September 7-11, 2008 (Knoxville, TN).

K. R. OKula and D. C. Thoman, Modeling Atmospheric Releases of Tritium from Nuclear Installations, American Nuclear Society Embedded Topical Meeting on the Safety and Technology of Nuclear Hydrogen Production, Control and Management, June 24-28, 2007 (Boston, MA).

K. R. OKula and D. C. Thoman, Analytical Evaluation of Surface Roughness Length at a Large DOE Site (U), American Nuclear Society Winter Meeting, November 12-16, 2006 (Albuquerque, NM).

K. R. OKula and D. Sparkman, Safety Software Guide Perspectives for the Design of New Nuclear Facilities (U), Winter Meeting of the American Nuclear Society, November 13 - 17, 2005 (Washington, D.C.).

K. R. OKula and R. Lagdon, Progress in Addressing DNFSB Recommendation 2002-1 Issues: Improving Accident Analysis Software Applications, Fifteenth Annual Energy Facility Contractors Group Safety Analysis Workshop, April 30 - May 5, 2005, Los Alamos, NM (2005).

K. R. OKula and Tony Eng, A Toolbox Equivalent Process for Safety Analysis Software, Fourteenth Annual Energy Facility Contractors Group Safety Analysis Workshop, May 1-6, 2004, Pleasanton, CA (2004).

K. R. OKula, D. C. Thoman, J. A. Spear, R. L. Geddes, Assessing Consequences Due to Hypothetical Accident Releases from New Plutonium Facilities (U), American Nuclear Society Embedded Topical Meeting on Operating Nuclear Facility Safety, November 14 - 18, 2004 (Washington, D.C.).

K. OKula and J. Hansen, Implementation of Methodology for Final Hazard Categorization of a DOE Nuclear Facility (U), Annual Meeting of the American Nuclear Society, June 13-17, 2004, 5

URS SAFETY MANAGEMENT SOLUTIONS LLC K. R. OKULA (Pittsburgh, PA).

K. R. OKula and Tony Eng, A Toolbox Equivalent Process for Safety Analysis Software, Fourteenth Annual Energy Facility Contractors Group Safety Analysis Workshop, May 1-6, 2004, Pleasanton, CA (2004).

K. R. OKula, et al., Evaluation of Current Computer Models Applied in the DOE Complex for SAR Analysis of Radiological Dispersion & Consequences, WSRC-TR-96-0126, Westinghouse Savannah River Company (2003).

K. R. OKula, et al., Evaluation of Current Computer Models Applied in the DOE Complex for SAR Analysis of Radiological Dispersion & Consequences, WSRC-TR-96-0126, Rev. 3, Westinghouse Savannah River Company (2002).

K. R. OKula, A DOE Computer Code Toolbox: Issues and Opportunities, Eleventh Annual EFCOG Workshop, also 2001 Annual Meeting of the American Nuclear Society, Milwaukee, WI (2001).

PUBLICATIONS (1988-1999):

Dr. OKula authored or co-authored more than 20 publications between 1988 and 1999. Details are available upon request.

PROFESSIONAL SOCIETIES AND STANDARDS COMMITTEES

• American Nuclear Society

• Health Physics Society

• ANS Level 3 PRA Standard Committee 58.25 6

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 4 Curriculum Vitae of Mr. Grant A. Teagarden

GRANT TEAGARDEN WORK EXPERIENCE

SUMMARY

Mr. Teagarden has over fourteen years of experience in the Manager nuclear field, including four years as a Naval Reactors Consequence Analysis Engineer in the U.S. Navy. He is experienced in Level 3 PRA consequence analysis, Fire PRA, plant security risk assessment, PRA updates, data and common cause failure analysis, integrated leak rate test extension evaluations, and internal flood updates.

AREAS OF EXPERTISE WORK EXPERIENCE x Level 3 PRA (MACCS) Mr. Teagarden holds a Bachelor of Science degree in Mechanical Engineering from the University of Miami, Florida. He is ERIN x Security Risk Assessment Engineerings lead for Level 3 PRA consequence analysis (e.g.

radiological dispersion analysis). The following are some of his x Level 2 PRA (MAAP) recent consequence analysis activities:

x Developed Level 3 PRA models (MACCS2) for Limerick (2011),

x Fire PRA Callaway (2011), Diablo Canyon (2009), Salem (2008), Hope Creek (2008), Progress Energy Levy County Site (2008), Harris x Internal Flooding Advanced Reactor Site (2007), General Electrics ABWR (2007) and ESBWR (2006, 2005), TMI (2006), Prairie Island (2006),

x Data Analysis Oyster Creek (2004), Exelon Early Site Permit (2004), Palisades (2004), and Monticello (2004) x Supported Level 3 PRA SAMA contention resolution for Davis Besse (2011), Indian Point (2009-2011) and Prairie Island EDUCATION (2008) x Developed quasi-site specific Level 3 PRA models (MACCS2) for B.S., Mechanical every operating U.S. commercial nuclear power plant site in Engineering, University of support of industry security assessments (2005)

Miami, Florida x Vice Chair of ANS Level 3 PRA Standard Writing Committee (ANS-58.25)

Bettis Nuclear Reactor Engineering School, Bettis Mr. Teagarden has been an integral part of ERIN Engineerings Atomic Power Laboratory, security assessment team, developing and implementing risk based assessment methodologies for the commercial nuclear power plant Pennsylvania industry in the U.S. and clients abroad. The following are some of his recent activities:

x Supported Aircraft Impact Analysis per NEI 07-13 guidance for GE ABWR (2009-2010), KOPEC APR-1400 (2010), MHI US-SECURITY CLEARANCE APWR (2007-2010), and MHI EU-APWR (2009) x Co-authored development of Risk Analysis and Management for Secret Critical Asset Protection (RAMCAP) methodology for nuclear power plants in support of EPRI, ASME, and the U.S.

Safeguards Department of Homeland Security (DHS) and supported its implementation for NEI at all U.S. nuclear power plants (2005-U.S. Citizen 2007). Implementation included leading an NEI sponsored industry workshop on the methodology, coordinating and facilitating site assessments, and developing industry level insights from the assessment results.

x Developed RAMCAP methodology for spent nuclear fuel dry storage and transportation in support of EPRI, ASME, and DHS, and supported its implementation for NEI (2005-2007) 01/01/12

x GRANT TEAGARDEN Provided RAMCAP training for personnel at Idaho National Laboratory Page 2 x Co-authored report for EPRI for identifying potential mitigation strategies for beyond design basis conditions (2005) x Participated in the development of NEI industry guidance to PROFESSIONAL resolve security related open issues related to large fires and ORGANIZATIONS explosions (i.e., B.5.b) at all U.S. nuclear power plants (2005-2006)

American Nuclear Society x Authored Vulnerability Assessment Methodology for EPRI and NEI use for security threat analysis (2003) x Co-authored report for EPRI for identification of mitigation strategies for scenarios involving loss of intake structure and offsite power (2004) x Co-authored reports for EPRI and NEI use for operational response to beyond design basis security threats (2003) x Authored Explosive Threat Guidelines for EPRI and NEI use in response to NRC Interim Compensatory Measures (2002)

Mr. Teagarden is experienced with Level 2 PRA (e.g., severe accident analysis) and the use of the thermal hydraulic MAAP code to model severe accident phenomenology. Some of his recent Level 2 PRA activities include:

x Managed updates of Hatch Level 2 PRA (2009-2010) x Performed Level 2 MAAP runs for Columbia Generating Station (2010) in support of SAMA life extension x Supported Level 2 PRA updates and MAAP analysis for Grand Gulf (2010) and Limerick (2010) x Served as analyst for Integrated Leak Rate Test (ILRT) extension evaluations for Hatch (2010), Clinton (2006),

Columbia (2004), Dresden (2003) and Quad Cities (2002) x Performed independent review for ILRT extension evaluation for NMP1 and NMP2 (2008, 2009)

Mr. Teagarden has been involved with the commercial nuclear industrys development of Fire PRAs using the guidance of NUREG/CR-6850 in the following ways:

x Exelon Fire PRA Model Owner for Clinton Power Station (2011) x Technical lead for Fire PRA project for KKM (2011) x Supported Fire PRA updates to NUREG/CR-6850 for Hope Creek (2010), LaSalle (2008-2009), Clinton (2007-2008) and Hatch (2007)

Mr. Teagarden has also been involved in other technical aspects of PRA analyses such as:

x Served as analyst for Hope Creek and Quad Cities PRA Updates performing the common cause failure analysis and revisions to all the System Notebooks (2002) x Served as analyst for NASA Space Shuttle PRA performing common cause failure analysis (2002) 01/01/12

x GRANT TEAGARDEN Performed pipe rupture and flooding analysis for Internal Flood updates for South Texas Project Units 3&4 (2010), Clinton Page 3 (2009), Hope Creek (2003), Dresden (2001), and Oyster Creek (2001) x Performed system analysis and pipe rupture evaluation for Limerick ISLOCA analysis (2001)

Prior to working for ERIN Engineering, Mr. Teagarden worked four years as a Naval Reactors Engineer in the U.S. Navy for the Department of Energy. He was principally involved in refueling operations, providing technical support and oversight for the nuclear refueling of the eight reactors on the USS Enterprise Aircraft Carrier.

Mr. Teagardens responsibilities included oversight of reactor disassembly, spent fuel removal and shipout, and reactor reassembly.

01/01/12

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 5 Letter from B. Allen, FirstEnergy, to NRC Document Control Desk, Correction of Errors in the Davis-Besse Nuclear Power Station, Unit No. 1, License Renewal Application (TAC No. ME4613) Environmental Report Severe Accident Mitigation Alternatives Analysis, and License Renewal Application Amendment No. 29 (July 16, 2012)

FENOC.... Davis-Besse Nuclear Power Station 5501 N. Stale Route 2 FirstEnergy Nuclear Operating Company Oak Harbor; Ohio 43449 July 16,2012 L-12-244 10 CFR 54 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Davis-Besse Nuclear Power Station, Unit No.1 Docket No. 50-346, License Number NPF-3 Correction of Errors in the Davis-Besse Nuclear Power Station. Unit No.1, License Renewal Application (TAC No. ME4613) Environmental Report Severe Accident Mitigation Alternatives Analysis, and License Renewal Application Amendment No. 29 By letter dated August 27, 2010, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML102450565), FirstEnergy Nuclear Operating Company (FENOC) submitted an application pursuant to Title 10 of the Code of Federal Regulations, Part 54 for renewal of Operating License NPF-3 for the Davis-Besse Nuclear Power Station, Unit No.1 (Davis-Besse). In January 2012, during review of the License Renewal Application (LRA), Environmental Report, Attachment E, Severe Accident Mitigation Alternatives (SAMA) Analysis, four errors were identified that affected the SAMA Analysis. In March 2012, during review of the draft corrected SAMA Analysis and an extent-of-condition review for the four errors, an additional error was identified in the analysis. On January 12 and March 28, 2012, FENOC contacted Ms. Paula Cooper, Nuclear Regulatory Commission (NRC) Environmental Project Manager, to inform NRC of the SAMA Analysis errors and discuss the impacts to the SAMA Analysis review schedule. Following correction of the five errors, the revised (corrected) SAMA Analysis conclusions did not change; specifically, the revised SAMA Analysis did not result in the discovery of any additional cost beneficial SAMAs beyond the one (SAMA AC/DC-03, which adds a portable diesel-driven battery charger to the DC system) identified in the FENOC letter dated June 24, 2011 (ML11180A233).

Attachment 1 provides a description of the five SAMA Analysis errors.

Attachment 2 provides, based on the revised SAMA Analysis, the results of a review for impacts to the responses to NRC requests for additional information (RAls) for the SAMA Analysis submitted by FENOC letter dated June 24, 2011 (ML11180A233).

Attachment 3 provides, based on the revised SAMA Analysis, the results of a review for impacts to the supplemental responses to NRC supplemental RAls for the SAMA Analysis submitted by FENOC letter dated September 1, 2011 (ML11250A068).

The Enclosure provides Amendment No. 29 to the Davis-Besse LRA.

Davis-Besse Nuclear Power Station, Unit No.1 L-12-244 Page 2 There are no regulatory commitments contained in this letter. If there are any questions or if additional information is required, please contact Mr. Clifford I. Custer, Fleet License Renewal Project Manager, at 724-682-7139.

I declare under penalty of perjury that the foregoing is true and correct. Executed on JulyA,2012.

Sincerely, J  !-C. Oom;",

D~t~r, Site Maintenan Attachments:

1. Description of Errors Identified in the Davis-Besse Nuclear Power Station, Unit No.1 (Davis-Besse), License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis

2. Review for Impacts to Responses to Requests for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No.1 (Davis-Besse),

License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis Submitted by FENOC Letter Dated June 24, 2011 (ML11180A233)

3. Review for Impacts to Responses to Requests for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No.1 (Davis-Besse),

License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis Submitted by FENOC Letter Dated September 1, 2011 (ML11250A068)

Enclosure:

Amendment No. 29 to the Davis-Besse License Renewal Application cc: NRC DLR Project Manager NRC DLR Environmental Project Manager NRC Region III Administrator

Davis-Besse Nuclear Power Station, Unit No. 1 L-12-244 Page 3 cc: w/o Attachments or Enclosure NRC DLR Director NRR DORL Project Manager NRC Resident Inspector Utility Radiological Safety Board

Attachment 1 L-12-244 Description of Errors Identified in the Davis-Besse Nuclear Power Station, Unit No. 1 (Davis-Besse), License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis Page 1 of 1 During reviews of the Severe Accident Mitigation Alternatives (SAMA) Analysis, the following five errors were identified:

1. An inaccurate land area conversion factor for acres to hectares was used.

2. Dollar values for Ohio farmland and non-farmland used as inputs to the MELCOR Accident Consequence Code System (MACCS2) software used in support of the SAMA Analysis were not appropriate. The land values were selected from Ohio Department of Taxation tax assessment values instead of appraised values. The Ohio tax assessment value is 35 percent of the appraised value.

3. The escalation of decontamination costs used in the SAMA Analysis was not performed per the guidance of Nuclear Energy Institute (NEI) 05-01 Severe Accident Mitigation Alternatives (SAMA) Analysis Guidance Document, November 2005, using the consumer price index.

4. Use of core inventory isotopic activity instead of isotopic mass in the Modular Accident Analysis Program (MAAP) software code runs did not reflect updated industry guidance. MAAP Users Group News Bulletin, MAAP-FLASH #68 (August 5, 2008), recommended that users of MAAP versions 4.0.5 through 4.0.7 (FENOC is currently using MAAP software version 4.0.6) include plant-specific values for the mass of the relevant fission product elements instead of the isotopic activity of those elements.

5. The wind direction from the Davis-Besse Meteorological Tower was not converted from the blowing from direction to the blowing toward direction for use in the SAMA Analysis calculations. The data from the Davis-Besse Meteorological Tower is received in the blowing from direction. However, the MACCS2 software requires wind direction data inputs to be provided in the blowing toward direction.

The data conversion was not performed properly.

Following correction of the five errors identified above, the revised (corrected) SAMA Analysis conclusions did not change; specifically, the revised SAMA Analysis did not result in the discovery of any additional cost-beneficial SAMAs beyond the one (SAMA AC/DC-03, which adds a portable diesel-driven battery charger to the DC system) identified in the FENOC letter dated June 24, 2011 (ML11180A233). LRA Appendix E, Applicants Environmental Report Operating License Renewal Stage, Attachment E, Severe Accident Mitigation Alternatives Analysis, is revised to incorporate the corrected information in the affected Sections and Tables.

See the Enclosure to this letter for the revision to the Davis-Besse LRA.

Attachment 2 L-12-244 Review for Impacts to Responses to Requests for Additional Information for the Review of the Davis Besse Nuclear Power Station, Unit No. 1 (Davis-Besse),

License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis Submitted by FENOC Letter Dated June 24, 2011 (ML11180A233)

Page 1 of 63 FirstEnergy Nuclear Operating Company (FENOC) performed a review, based on the revised SAMA Analysis, for impacts to the responses to Nuclear Regulatory Commission (NRC) requests for additional information (RAIs) for the Severe Accident Mitigation Alternatives (SAMA) Analysis submitted by FENOC letter dated June 24, 2011 (ML11180A233). Based on the changes to the SAMA Analysis, no revision to the FENOC responses provided by the June 24, 2011, letter is necessary for the following SAMA RAIs:

SAMA RAI Responses -

No Revision 1.a 3.b 6.b 1.b 4.a 6.c 1.c 4.b 6.d 1.d 4.c 6.e 1.e 5.a 6.f 1.f 5.b 6.g 2.a 5.d.i 6.h 2.b 5.e 6.i.i 2.c 5.f 7.b 2.d 5.h 7.c 2.e 5.i 3.a 6.a FENOC responses are revised for the remaining SAMA RAIs from the June 24, 2011, letter as provided in the following discussion. The NRC request is shown in bold text followed by the original FENOC response provided by the June 24, 2011, letter. A statement is provided for each SAMA RAI response to identify whether the response is replaced in its entirety or edited. For edited responses, the sentence affected is printed in italics with deleted text lined-out and added text underlined.

L-12-244 Page 2 of 63 Item 3 Provide the following information with regard to the treatment and inclusion of external events in the SAMA analysis:

Question RAI 3.c ER Section E.3.1.2.4 presents the basis for an external events multiplier of 3 based on a conservatively estimated fire CDF of 2.5E-05/yr developed using the FIVE methodology and the assumption that a realistic fire CDF is a factor of 3 less than this FIVE-produced fire CDF. The NRC staff disagrees that a fire CDF produced using the FIVE screening methodology is necessarily conservative in light of more recent research and guidance on hot short probabilities (i.e.,

NUREG/CR-6850). The NRC staff particularly notes that the minimal or non-treatment of hot shorts in the IPEEE FIVE analysis may more than offset other conservatisms in the FIVE analysis. Based on this, and the previous RAI, the NRC staff believes the best estimate of the fire CDF for Davis-Besse is 2.9E-05/yr.

In addition, the USGS issued updated seismic hazard curves for much of the U.S.

in 2008. Using this data, the NRC staff estimated a weakest link model seismic CDF for Davis-Besse of 6.7E-06/yr (see NRC Information Notice 2010-18 regarding Generic Issue 199). Based on a fire CDF of 2.9E-05/yr, a seismic CDF of 6.7E-06/yr, and an internal events CDF of 9.8E-06/yr, the NRC staff estimates the external events multiplier to be 3.6. In light of this, provide a revised SAMA evaluation using an external events multiplier of 3.6 or alternatively provide justification for an evaluation of a different multiplier based on this updated USGS information.

RESPONSE RAI 3.c

[The response to RAI 3.c is edited as shown in 2nd paragraph.]

Based on the information provided in the RAI, an updated external events multiplier was calculated for Davis-Besse. The updated external events multiplier includes risk contribution from fire, seismic, and other hazard groups. The risk contribution for the fire and seismic hazard groups was determined by a ratio between the hazard group CDF and the internal events CDF as shown in the equations below. The risk contribution from the other hazard group was conservatively assumed to be equivalent to the internal events contribution. Therefore, the other hazard group multiplier is 1.0.

L-12-244 Page 3 of 63 Fire Hazard Multiplier:

Fire CDF 2.9x10 5 /yr 2.90 Internal Events CDF 1.0x10 5 /yr Seismic Hazard Multiplier:

Seismic CDF 6.7x10 6 /yr 0.67 Internal Events CDF 1.0x10 5 /yr To determine the multiplier to account for fire, seismic, and other hazard groups, the three individual multipliers were summed, resulting in a multiplier of 4.6. The cost-benefit evaluation was updated using an external event multiplier of 4.6. The updated maximum benefit for Davis-Besse is $1,955,223 $2,053,481. Based on the updated maximum benefit, one SAMA candidate, AC/DC-03 (add a portable diesel-driven battery charger to the direct current (DC) system) was determined to be cost-beneficial.

ER Section E.3.1.2.4, External Event Severe Accident Risk, is deleted based on the response to this RAI. ER Section E.4.5, Total Cost of Severe Accident Risk, is revised to explain the updated external events multiplier. ER Tables E.4-1, E.7-2, E.7-3, E.7-5, and E.8-1 are revised to reflect the revised cost-benefit results.

See the Enclosure to this letter for the revision to the Davis-Besse LRA.

L-12-244 Page 4 of 63 Item 4 Provide the following information concerning the Level 3 analysis:

Question RAI 4.d ER Section E.3.4.6.2 does not identify the population base/year reference for the emergency planning zone (EPZ) evacuation speed. Describe how/whether the EPZ evacuation time was corrected for the year 2040 population (and address the population discrepancy noted in RAI 4.b).

RESPONSE RAI 4.d

[The response to RAI 4.d is edited as shown in the 2nd paragraph and Table 4.d-1.]

Reference [4] (in Attachment E of the Environmental Report) does not identify a collection date for the data that were used to estimate the evacuation speed in Section E.3.4.6.2. The evacuation information provided in Reference [4] was assumed to be current as of the 2000 census. However, no correction factor was applied to account for the increased population in 2040 in the original analysis.

Assuming that an increase in population is proportional to a decrease in evacuation speed, the evacuation speed was adjusted from 0.58 meters/second to 0.52 meters/second. This adjustment represents a 9.6 percent decrease in the evacuation speed, which was used to offset a 9.6 percent [(1.047)2 = 1.096] increase in population at the end of the two-decade license renewal period. This decrease in evacuation speed was evaluated as a new sensitivity case (Sensitivity Case E3). The results are provided in Table 4.d-1, below, and show no very little change from the base case, indicating that the results are not sensitive to slow evacuation speeds. The base case results shown in Table 4.d-1 include the updated population (as needed to respond to RAI 4.b); similarly, sensitivity case E3 includes the updated population, to permit an equitable comparison to the base case. ER Section E.3.5.2.4 is revised and new ER Table E.3-33, Comparison of Base Case and Case E3, is added to incorporate sensitivity case E3.

See the Enclosure to this letter for the revision to the Davis-Besse LRA.

L-12-244 Page 5 of 63 Table 4.d-1: Comparison of Base Case and Case E3 Internal Events Base E3  % diff.

2.30E+00 2.31E+00 0.4%

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.12E+00 0.0%

1.80E+03 1.80E+03 Economic Impact (50) ($/yr) 0.0%

3.59E+03 3.59E+03 Question RAI 4.e In ER Section E.3.5.2.3, for Case A1, identify the heat release energy (e.g. thermal, 1 MW) assumed for both the base and sensitivity cases.

RESPONSE RAI 4.e

[Table 4.e-1 is replaced in its entirety.]

The energy of release for the base case and sensitivity Case A1 are provided for each release category in Table 4.e-1, below.

L-12-244 Page 6 of 63 Table 4.e-1 Energy of Release: Base Case and Sensitivity Case A1 PLHEAT/Energy of Release (watts)

Release Category Base Case Sensitivity Case A1 1.1 3.87E+07 1.49E+08 1.2 1.45E+07 9.21E+07 1.3 3.87E+07 1.49E+08 1.4 1.45E+07 9.21E+07 2.1 8.91E+06 6.04E+08 2.2 6.68E+06 6.16E+08 3.1 2.22E+06 2.92E+07 3.2 2.61E+06 1.82E+07 3.3 2.22E+06 1.78E+07 3.4 2.61E+06 1.82E+07 4.1 9.17E+05 1.66E+07 4.2 2.24E+05 1.66E+07 4.3 6.77E+05 1.66E+07 4.4 2.10E+05 1.66E+07 5.1 3.17E+06 2.48E+07 5.2 1.09E+07 6.31E+07 5.3 2.83E+06 2.01E+07 5.4 9.59E+06 5.80E+07 6.1 7.35E+07 3.36E+08 6.2 1.14E+08 4.64E+08 6.3 6.10E+07 3.87E+08 6.4 1.16E+08 4.90E+08 7.1 3.02E+07 1.79E+08 7.2 2.79E+07 1.67E+08 7.3 2.82E+07 1.68E+08 7.4 2.80E+07 1.66E+08 7.5 2.01E+07 1.34E+08 7.6 2.36E+07 1.22E+08 7.7 1.93E+07 1.32E+08 7.8 2.45E+07 1.29E+08 8.1 8.71E+06 1.61E+08 8.2 9.78E+07 4.11E+08 9.1 2.63E+02 2.08E+03 9.2 3.30E+02 2.14E+03 L-12-244 Page 7 of 63 Item 5 Provide the following with regard to the SAMA identification and screening process:

Question RAI 5.c None of the SAMA candidates identified in Table E.5-4 appear to be plant-specific SAMAs identified from plant-specific risk insights based on the current PRA model. Clarify how the importance lists were used to develop plant-specific SAMA candidates and justify the apparent absence of any plant-specific SAMA candidates. Also, the basic events identified in importance analysis Tables E.5-2 and E.5-3 are not linked to SAMA candidates. Sections E.5.4 and E.5.5 only discuss the SAMA candidates identified to address basic events with high risk reduction worth (RRW) values. Identify, for each basic event having a RRW benefit value (averted cost risk) greater than the minimum cost of a procedure change at Davis-Besse, the specific SAMA(s) that address each event and describe how the SAMA(s) address the basic event. Identify and evaluate SAMAs for basic events not addressed by an existing SAMA (e.g., flooding related basic events and initiators, including WHAF3ISE, SHAF2ISE, F3AM, and F7L). For any basic event for which no SAMA is identified, provide justification for not identifying a SAMA(s).

RESPONSE RAI 5.c

[The response to RAI 5.c is edited as shown on pages 9 and 10 of 63, and Table 5.c-2 on page 22 of 63. Tables 5.c-1 and 5.c-2 are also revised (multiple locations) to change the steam generator replacement schedule from 2013 to 2014 to align with current FENOC plans and with the discussions in the ER.]

The final list of SAMA candidates was developed from a combination of generic data, industry SAMA analyses and Davis-Besse-specific insights. The following SAMA candidates were added to the generic list based on Davis-Besse PRA-identified insights:

x SAMA candidate AC/DC-25 (dedicated DC power for AFW) and AC/DC-26 (alternator/generator for turbine-driven auxiliary feedwater (TDAFW) pump) were designed to extend the life of the TDAFW pumps in a station blackout (SBO) event and improve the likelihood of successful restoration of alternating current (AC) power.

L-12-244 Page 8 of 63 x SAMA candidate AC/DC-27 (increased size of SBO fuel oil tank) was also designed to help mitigate an SBO event.

x SAMA candidate CB-21 (pressure sensors between the two in-series Decay Heat Removal (DHR) System suction valves) was designed to help reduce the likelihood of ISLOCA events.

x SAMA candidate CC-19 (automatic switchover of high pressure injection (HPI) and low pressure injection (LPI) suction from the BWST to the containment sump) was designed to increase the reliability of the switchover during a loss of coolant accident (LOCA) event.

x SAMA candidate CC-20 (modify hardware and procedures to allow using make-up pumps for high pressure recirculation from the containment sump) was designed improve the reliability of high pressure recirculation following the loss of HPI.

x SAMA candidate CC-21 (reduce the BSWT level at which switchover to containment recirculation is initiated) was designed to extend the time available to accomplish BWST refill.

x SAMA candidate CP-19 (install a redundant containment fan system) was designed to increase containment heat removal ability. This SAMA candidate was added as a variation to CP-18 to provide a redundant containment cooling function, in the form of containment fan coolers.

x SAMA candidates CW-24 (adding a diversified CCW pump) and CW-25 (providing the capability to cool makeup pumps with fire water on loss of CCW) were designed to mitigate the total loss of CCW cooling.

x SAMA candidate FW-16 (surveillance of manual AFW suction valves) was designed to improve the reliability of alternate sources of AFW water supply.

x SAMA candidate HV-06 (procedure guidance for alternate means of switchgear cooling) was designed to prevent the loss of one train of service water in the event of loss of one HVAC fan for the service water pump room. This SAMA candidate was developed from Davis-Besse IPE insights.

L-12-244 Page 9 of 63 Evaluating Basic Events with Potential Benefit Greater Than the Cost of a Procedure Change The internal events and LERF basic events with an RRW value estimated to be equal to or greater than the cost of a procedure change were evaluated. These basic events were dispositioned by either identifying resulting SAMAs or presenting the reason for no new SAMA candidate. One new SAMA candidate (OT-9R) resulted from this evaluation.

An estimate of the cost-benefit versus RRW was developed for the internal events basic events calculated for the base PRA model. The minimum cost of a procedure change was assumed to be $10,000. In addition, the minimum cost of a hardware modification was estimated to be $100,000. The cost-benefit versus RRW assumed that cost-benefit was directly proportional to the reduction in core damage frequency (CDF). Cost is not perfectly correlated with CDF, due to the fact that different scenarios, even with the same CDF, will result in different distributions of release categories. It is judged, however, that this correlation provides a reasonable estimate of potential benefit along with what is judged to be a low cost for a procedure change, and provides strong confidence that cost-effective SAMA candidates will be captured.

For the total benefit for the hazard group (Bt), the cost-benefit versus RRW used the maximum derived benefit of $349,147 $366,693.

The following formula is used for deriving the estimated benefit by hazard group based on RRW:

§ 1

• EB(BE) Bt ¨1  ¸

© RRW ¹

where, EB(BE) = the estimated benefit based on a basic event Bt = the total benefit for the hazard group (internal events, fire, or seismic)

RRW = the RRW for the basic event from the PSA, by hazard, assuming the basic event failure probability is reduced to zero.

The RRW for the Level 2 PRA basic events may be calculated based on LERF rather than CDF. Additional conservatism is added by treating Level 2 PRA basic event RRW values based on LERF as if they were based on CDF (i.e., the use of Bt significantly overstates their benefit), and the degree of conservatism could be large.

L-12-244 Page 10 of 63 Based on these estimates, an RRW value of 1.03 was calculated to have a maximum cost benefit of $10,000 and an RRW of 1.40 1.37 was estimated to have a maximum cost benefit of $100,000. The maximum cost benefit is based on the RRW of the basic event being reduced to 1.0 (basic event modeled as perfect). For all basic events having an RRW value estimated to be at, or above, the value of a procedure change, a disposition was provided either identifying the SAMA candidate(s) addressing that basic event or a description as to why the basic event was not addressed in a SAMA candidate. No basic events had an RRW value equal to, or greater than the estimated cost of a hardware modification. Table 5.c-1, below, lists the basic events with the highest RRW for CDF.

Table 5.c-2, below, tabulates the basic events with the highest RRW for LERF. The estimated benefit for each basic event was derived by taking the RRW for LERF and applying the maximum total benefit used for the CDF basic events. This is very conservative, since the total maximum benefit does not apply only to LERF. For all basic events having an RRW value estimated to be at, or above, the value of a procedure change, a disposition was provided either identifying the SAMA candidate(s) addressing that basic event or a description as to why the basic event was not addressed in a SAMA candidate. No basic events had an RRW value equal to, or greater than the estimated cost of a hardware modification.

Basic events WHAF3ISE, SHAF2ISE, F3AM, and F7L did not have RRW values with potential benefit equal to, or greater than, the minimum cost of a procedure change.

Basic event F7L, a large circulating water flood in the Turbine Building, did, however, result in an RRW value greater than the minimum cost of a procedure change for the 95 percent uncertainty CDF model. SAMA candidate FL-01 (improve inspection of rubber expansion joints on main condenser) was initially identified to address basic event F7L, and was designed to reduce the frequency of a large circulating water system flooding event due to failure of the circulating water system expansion joints.

Based on the F7L RRW value from the 95 percent uncertainty CDF model and its original screening of Very Low Benefit, SAMA candidate FL-01 was reevaluated and screened as Already Implemented, as discussed in the response to RAI 6.k.

The ER is revised (numerous locations) to identify that there are now 168 SAMA candidates that were evaluated instead of the original 167. Also, ER Table E.5-4 is revised to include changes identified in Tables 5.c-1 and 5.c-2, below.

See the Enclosure to this letter for the revision to the Davis-Besse LRA.

L-12-244 Page 11 of 63 Table 5.c Basic Event Level 1 PRA Importance Event Name F-V RRW Description Disposition A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Failure to initiate makeup/HPI cooling after UHAMUHPE 2.59E-01 1.349 training. SAMA candidate OT-09R was loss of all feedwater added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

SAMA candidate FW-17R evaluates implementing an automatic start of the QHAMDFPE 2.45E-01 1.324 Failure to start MDFP after loss of feedwater motor-driven feed pump (MDFP) on loss of main feedwater (MFW).

SAMA candidate CW-26R evaluates implementing an automatic RCP trip on high Operators fail to trip RCPs after a total loss of QHARCPCE 2.32E-01 1.302 bearing cooling temperature or loss of CCW seal cooling flow to the RCP thermal barrier cooler and loss of seal injection flow.

Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator T3 1.96E-01 1.243 LOOP (initiating event)

AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size SAMA candidate AC/DC-28R evaluates the Operators fail to align power from SBO diesel automatic start of the SBO diesel and EHASBDGE 1.64E-01 1.196 generator to supply MDFP loading to Bus D2 upon loss of power to Bus D2.

L-12-244 Page 12 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to start SBO diesel generator EHASBD1E 1.58E-01 1.187 training. SAMA candidate OT-09R was and align to bus D1 added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to align power from EDG 1-1 or EHAD2DGE 1.53E-01 1.181 training. SAMA candidate OT-09R was EDG 1-2 to supply MDFP given LOOP added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

L-12-244 Page 13 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition This is based on a somewhat conservative T1 value of 1.02/yr. Davis-Besse trip occurrence frequency is considered representative of industry values.

SAMA candidates have been evaluated that address various Davis-Besse important scenarios following a reactor/turbine trip.

CC-01, evaluates the installation of an T1 1.35E-01 1.156 Reactor/turbine trip (initiating event) independent active or passive HPI system.

CW-26R, evaluates an automatic RCP trip on high motor bearing temperature or loss of CCW flow to the RCP thermal barrier cooler and loss of seal injection flow.

FW-17R, evaluates an automatic start of the motor driven feedwater pump.

HV-01, evaluates a redundant train for ventilation.

HV-03, evaluates the staging of backup fans in the switchgear room.

SAMA candidate AC/DC-25 provides a dedicated DC system to TDAFW pumps and SAMA candidate AC/DC-26 provides an alternator/generator driven by TDAFW Operators fail to take local manual control of QHAOVF2E 1.22E-01 1.139 pumps.

TDAFW pump 1-2 speed.

These SAMA candidates would eliminate the need for local manual control of the TDAFW pumps.

L-12-244 Page 14 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition SAMA candidate CW-26R evaluates implementing an automatic RCP trip on high Operators fail to trip RCPs following loss of ZHARCPCE 1.10E-01 1.124 bearing cooling temperature or loss of CCW seal cooling flow to the RCP thermal barrier cooler and loss of seal injection flow.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Failure to recover CCW using spare CCW WHASPREE 1.07E-01 1.12 training. SAMA candidate OT-09R was train (prior to damage) added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

This estimated benefit of this basic event is below the minimum estimated cost of a hardware modification.

The following SAMA candidates address improvements to the reliability of AFW in QMBAFP11 7.61E-02 1.082 AFW Train 1 in maintenance loss of off-site power scenarios:

AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps XHOS- This is a plant configuration probability in 7.54E-02 1.082 CCW Pump 1 running, Pump 2 in standby CCW1RUN2STBY the model. It does not contribute to risk.

SAMA candidate AC/DC-14 evaluates EDG0012F 7.12E-02 1.077 EDG 1-2 fails to run adding a gas turbine generator as an additional source of on-site power.

L-12-244 Page 15 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator ZOP007BR 7.09E-02 1.076 Failure to restore off-site power AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size SAMA candidate CW-24 evaluates the All CCW pumps fail to run due to CCF TMPP43XF-CC_ALL 6.79E-02 1.073 standby CCW pump with a pump diverse (initiating event) from the other two CCW pumps.

XHOS- This is a plant configuration probability in 6.57E-02 1.07 CCW Pump 2 running, Pump 1 in standby CCW2RUN1STBY the model. It does not contribute to risk.

Davis-Besse is scheduled to install new steam generators in 2013 2014. This modification, with resulting reduction in R 6.37E-02 1.068 SGTR (initiating event) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator EHAD1ACE 5.90E-02 1.063 Failure to lineup alternate source to D1 training. SAMA candidate OT-09R was added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

L-12-244 Page 16 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition The estimated benefit for this basic event is below the cost of a hardware modification.

T2 5.86E-02 1.062 Plant trip due to loss of MFW (initiating event)

No SAMA candidate considered.

Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity Offsite power recovery not possible after a AC/DC-14, install gas turbine generator NORCVRT3 5.57E-02 1.059 tornado. AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size Reactor vessel rupture is a low probability event that that is assumed to result in AV 5.12E-02 1.054 Reactor vessel rupture guaranteed core damage. No applicable SAMA candidates were considered possible to prevent core damage.

The estimated benefit for this basic event is CCF of two components: QTP0001A & below the cost of a hardware modification.

QTP000XA-CC_1_2 5.13E-02 1.054 QTP0002A (TDAFW)

No SAMA candidate considered.

The estimated benefit for this basic event is below the cost of a hardware modification.

QTP0001A 4.90E-02 1.051 AFP/T-1 fails to start No SAMA candidate considered.

L-12-244 Page 17 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition The estimated benefit for this basic event is below the cost of a hardware modification.

The following SAMA candidates address improvements to the reliability of AFW in QMBAFP12 4.67E-02 1.049 AFW Train 2 in maintenance LOOP scenarios:

AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator ZOP006FR 4.58E-02 1.048 Failure to restore off-site power AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size SAMA candidate CC-01 evaluates the installation of an independent active or passive HPI system.

S 4.35E-02 1.045 Small LOCA (initiating event)

SAMA candidate CC-19 evaluates the implementation of automatic switchover of HPI and LPI suction from the BWST to the to containment sump for LOCAs.

L-12-244 Page 18 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition The estimated benefit for this basic event is Loss of CCW Train 1 initiating event Pump 1 below the cost of a hardware modification.

T13A-1-3-IEF 4.18E-02 1.044 running No SAMA candidate considered.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to compensate for loss of room MHARMVTE 4.17E-02 1.043 training. SAMA candidate OT-09R was cooling for makeup pumps.

added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to attempt cooldown via XHAMUCDE 4.10E-02 1.043 training. SAMA candidate OT-09R was makeup/HPI cooling.

added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

The estimated benefit for this basic event is Loss of CCW Train 2 initiating event Pump 2 below the cost of a hardware modification.

T13A-2-3-IEF 3.93E-02 1.041 running No SAMA candidate considered.

SAMA candidate AC/DC-14 evaluates EMBEDG12 3.85E-02 1.04 EDG Train 2 in maintenance adding a gas turbine generator as an additional source of on-site power.

L-12-244 Page 19 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator training. SAMA candidate OT-09R.

Also, Davis-Besse is scheduled to install CHASGDPE 3.63E-02 1.038 Operators fail to cooldown during a SGTR new steam generators in 2013 2014. This modification, with resulting reduction in SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

The estimated benefit for this basic event is below the cost of a hardware modification.

FMFWTRIP 3.71E-02 1.038 MFW/ICS faults following trip No SAMA candidate considered.

SAMA candidate CB-22R evaluates the use FMM00003 3.52E-02 1.037 Any MSSVs on SG1 fail to reseat of a gagging device to close a stuck open MSSV.

SAMA candidate AC/DC-14 evaluates EDG0012A 3.46E-02 1.036 EDG 1-2 fails to start adding a gas turbine generator as an additional source of on-site power.

Davis-Besse is scheduled to install new steam generators in 2013 2014. This modification, with resulting reduction in AASGTR11 3.42E-02 1.035 SGTR occurs on OTSG 1-1 (split fraction) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

L-12-244 Page 20 of 63 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition Davis-Besse is scheduled to install new steam generators in 2013 2014. This modification, with resulting reduction in Failure to close MSIV and isolate steam LHAMSIVE 3.34E-02 1.035 SGTR frequency, is not reflected in the generator containing ruptured tube current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

SAMA candidate FW-17R evaluates implementing an automatic start of the motor-driven feed pump (MDFP) on loss of Failure to start MDFP prior to depletion of main feedwater (MFW).

QHAMDF3E 3.34E-02 1.035 BWST during makeup SAMA candidate CC-22R evaluates implementing an automatic refilling of the BWST.

The estimated benefit for this basic event is below the cost of a hardware modification.

QTP0002A 3.25E-02 1.034 AFP/T-2 fails to start No SAMA candidate considered.

SAMA candidate AC/DC-14 evaluates EDG0011F 3.13E-02 1.032 EDG 1-1 fails to run adding a gas turbine generator as an additional source of on-site power.

This is a PRA model flag. It is not a candidate for a SAMA.

FCIRCTMP 3.00E-02 1.031 Circ water temperature not acceptable No SAMA candidate considered.

RRW of 1.03 is estimated to have a cost of approximately $10,000. This is assumed to be the minimum cost of a procedure change.

L-12-244 Page 21 of 63 Table 5.c Basic Event LERF Importance Event Name F-V RRW Description Disposition Davis-Besse is scheduled to install new steam generators in 2013 2014. This modification, with resulting reduction in R 9.00E-01 10.048 SGTR (initiating event) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to attempt cooldown via XHAMUCDE 6.10E-01 2.563 training. SAMA candidate OT-09R was makeup/HPI cooling added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator CHASGDPE 5.40E-01 2.175 Operators fail to cooldown during a SGTR training. SAMA candidate OT-09R was added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Failure to close MSIV and isolate steam LHAMSIVE 4.97E-01 1.989 training. SAMA candidate OT-09R was generator containing ruptured tube added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

L-12-244 Page 22 of 63 Table 5.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition Davis-Besse is scheduled to install new steam generators in 2013 2014. This modification, with resulting reduction in AASGTR11 4.81E-01 1.926 SGTR occurs on OTSG 1-1 (split fraction) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

Davis-Besse is scheduled to install new steam generators in 2013 2014. This modification, with resulting reduction in AASGTR12 3.93E-01 1.646 SGTR occurs on OTSG 1-2 (split fraction) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

RRW of 1.40 1.37 is estimated to have a cost of approximately $100,000.

This is assumed to be the minimum cost of a hardware modification.

SAMA candidate CB-22R evaluates the use FMM00003 7.90E-02 1.086 Any MSSVs on SG1 fail to reseat of a gagging device to close a stuck open MSSV.

SAMA candidate CB-21 evaluates placing pressure measurements between the two ISLOCA due to internal rupture of DHR VD-IEF 7.54E-02 1.082 DHR suction valves in the RCS hot leg suction valves allowing early detection of inboard isolation valve leakage.

The estimated benefit for this basic event is Logic card fails during operation - MSIV 101 below the cost of a hardware modification.

FLCO101F 7.31E-02 1.079 fails to close No SAMA candidate considered.

L-12-244 Page 23 of 63 Table 5.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition The estimated benefit for this basic event is ISLOCA occurs in non-isolable portion of DHR below the cost of a hardware modification.

LPPNISOZ 7.18E-02 1.077 system No SAMA candidate considered.

SAMA candidate CB-22R evaluates the use FMM00004 6.80E-02 1.073 Any MSSVs on SG2 fail to reseat of a gagging device to close a stuck open MSSV.

The estimated benefit for this basic event is Logic card fails during operation - MSIV 100 below the cost of a hardware modification.

FLC0100F 6.13E-02 1.065 fails to close No SAMA candidate considered.

SAMA candidate FW-17R evaluates implementing an automatic start of the Failure to start MDFP as backup to turbine-motor-driven feed pump (MDFP) on loss of QHAMDFPE 5.96E-02 1.063 driven feedwater pumps for transient, Small main feedwater (MFW).

LOCA or SGTR events The estimated benefit for this basic event is CCF of two components: EC1Z089N & below the cost of a hardware modification.

EC1ZXXXN-CC_1_2 5.19E-02 1.055 EC1Z100N No SAMA candidate considered.

The estimated benefit for this basic event is Press switch PSH RC2B4 fails high - fails below the cost of a hardware modification.

LPSRC2BH 4.93E-02 1.052 DHR No SAMA candidate considered.

The estimated benefit for this basic event is below the cost of a hardware modification.

LPSZ416H 4.93E-02 1.052 Press switch PSH 7531A fails high - fails DHR No SAMA candidate considered.

L-12-244 Page 24 of 63 Table 5.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition SAMA candidate CB-21 evaluates placing pressure measurements between the two LMVF012R 4.53E-02 1.047 Internal rupture of DH 12 (annual frequency) DHR suction valves in the RCS hot leg allowing early detection of inboard isolation valve leakage.

The estimated benefit for this basic event is below the cost of a hardware modification.

LMBCWRT1 4.12E-02 1.043 CWR Train 1 unavailable due to maintenance No SAMA candidate considered.

SAMA candidate AC/DC-14 evaluates EDG0012F 3.47E-02 1.036 EDG 1-2 fails to run adding a gas turbine generator as an additional source of on-site power.

This is a PRA model flag. It is not a candidate for a SAMA.

FCIRCTMP 3.00E-02 1.031 Circ water temperature not acceptable No SAMA candidate considered.

The estimated benefit for this basic event is below the cost of a hardware modification.

FVV011BT 3.04E-02 1.031 AVV ICS11B fails to reseat after steam No SAMA candidate considered.

SAMA candidate CB-21 evaluates placing pressure measurements between the two LMVF011R 3.01E-02 1.03 Internal rupture of DH 11 (annual frequency) DHR suction valves in the RCS hot leg allowing early detection of inboard isolation valve leakage.

L-12-244 Page 25 of 63 Table 5.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator ELOOPRT 2.93E-02 1.03 LOOP given reactor trip AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size RRW of 1.03 is estimated to have a cost of approximately $10,000. This value is assumed to be the minimum cost of a procedure change.

L-12-244 Page 26 of 63 Question RAI 5.d ER Section E.5.3, E.5.4, and E.5.5 discuss significant contributors to core damage frequency (CDF) and large early release frequency (LERF). These sections and the associated tables show that there are a number of operator errors and non-recovery actions that occur in these listings, but report that no weaknesses in training or procedures were identified. Given: 1) the significant number of operator errors in these lists, 2) that human errors are among the most dominant failure modes presented in the importance Tables E.5-2 (i.e., the first 9 basic events listed by RRW are human error events) and E.5-3, and 3) that operator errors often have relatively high failure probabilities, provide the following:

i. Explain the process used to make the determination that there were no opportunities to improve procedures and training.

ii. Discuss whether any of the risk significant operator action failures could be addressed by a SAMA to automate the function (i.e., automating tripping of the RCPs after a loss of seal cooling -see RAI 7.a).

RESPONSE RAI 5.d

[The response to RAI 5.d.ii is edited as shown in the middle of the 1st paragraph.

Also, Tables 5.d-1, 5.d-2 and 5.d-3 are replaced in their entirety.]

[NOTE:

• One sensitivity case no longer applies and has been deleted; see the revised response to RAI 6.i.ii]

5.d.ii In addition to the new SAMAs addressed in RAI 7, two additional SAMA candidates were evaluated to address automating risk significant operation actions: SAMA candidate AC/DC-28R (automatically start and load the SBODG on Bus D2 upon loss of power to the bus), and SAMA candidate OT-08R (automatically start and load the SBODG on Bus D2 upon loss of power to the bus in combination with automatically starting the MDFP). Table 5.d-1 and Table 5.d-2, below, provide the internal event and total benefit results for SAMA candidates AC/DC-28R and OT-08R, respectively. Table 5.d-3, below, provides the final results for the ten nine [*] sensitivity cases for SAMA candidate AC/DC-28R and OT-08R. The implementation cost for SAMA candidate AC/DC-28R was estimated as $1,600,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse. The implementation cost for SAMA candidate OT-08R was estimated as $4,400,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

L-12-244 Page 27 of 63 Table 5.d-1: Internal Events Benefit Results for SAMA Candidates AC/DC-28R and OT-08R AC/DC-28R OT-08R Case (Auto (Auto SBODG SBODG) & MDFP)

Off-site Annual Dose (rem) 2.03E+00 1.92E+00 Off-site Annual Property Loss ($) 3.45E+03 3.26E+03 Comparison CDF 1.0E-05 1.0E-05 Comparison Dose (rem) 2.12E+00 2.12E+00 Comparison Cost ($) 3.59E+03 3.59E+03 Enhanced CDF 8.3E-06 5.7E-06 Reduction in CDF 17.00% 43.00%

Reduction in Off-site Dose 4.25% 9.43%

Immediate Dose Savings (On-site) $138 $348 Long Term Dose Savings (On-site) $600 $1,518 Total Accident Related Occupational

$738 $1,866 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$22,502 $56,916 site)

Replacement Power Savings (On-site) $22,766 $57,584 Averted Costs of On-site Property

$45,267 $114,500 Damage (AOSC)

Total On-site Benefit $46,005 $116,366 Averted Public Exposure (APE) $2,209 $4,908 Averted Off-site Damage Savings (AOC) $1,718 $4,049 Total Off-site Benefit $3,926 $8,957 Total Benefit (On-site + Off-site) $49,932 $125,323 Table 5.d-2: Total Benefit Result for SAMA Candidates AC/DC-28R and OT-08R AC/DC-28R OT-08R (Auto_SBODG) (Auto_SBODG &

MDFP)

Internal Events $49,932 $125,323 Fires, Seismic, Other $229,685 $576,486 Total Benefit $279,617 $701,809 L-12-244 Page 28 of 63 Table 5.d-3: Final Results of the Sensitivity Cases for SAMA Candidates AC/DC-28R and OT-08R Low High On-site Repair On-site SAMA ID Discount Discount Clean-up Case Dose Case Rate Case Rate Case Case AC/DC-28R $177,626 $422,629 $193,345 $283,796 $321,619 OT-08R $443,832 $1,060,578 $484,871 $712,381 $808,052 Replacement Multiplier Evacuation 95th CDF SAMA ID Power Case Case Speed Case AC/DC-28R $365,190 $399,452 $279,617 $405,444 OT-08R $918,258 $1,002,584 $701,809 $1,017,623 Question RAI 5.g Several SAMA candidates identified in Table E.6-1 are subsumed in another SAMA candidate (e.g., AC/DC-06, AC/DC-09, AC/DC-20). For each subsumed SAMA candidate, provide an assessment of its implementation cost relative to that of the SAMA into which it was subsumed. If the implementation cost of the subsumed SAMA is less, provide a revised basis for the Phase I screening and Phase II cost-benefit evaluation if it meets Criterion F.

RESPONSE RAI 5.g

[The response to RAI 5.g is edited as shown in Table 5.g-1.]

SAMA candidate CB-08 was subsumed in SAMA candidate CB-07 in Table E.6-1.

SAMA candidate CB-07 was screened as already implemented at Davis-Besse. The nature of the operation action/training is similar in both SAMA candidates. Therefore, SAMA candidate CB-08 was re-screened as Criterion B (Already Implemented).

Accordingly, there was no need to determine the cost of implementation and assess the cost-benefit of SAMA candidate CB-08. ER Table E.6-1 is revised to identify the re-screening of SAMA candidate CB-08.

L-12-244 Page 29 of 63 The SAMA candidates subsumed in Phase I (AC/DC-06, AC/DC-09, AC/DC-20, and CC-08) have an equivalent or higher cost of implementation than the SAMA candidates evaluated in Phase II. Nonetheless, an analysis was performed to assess the cost-benefit of the subsumed SAMA candidates. The total benefit was derived from the SAMA candidates into which they were subsumed and compared to the cost of implementation. Table 5.g-1 provides the results of the cost-benefit evaluation. None of the subsumed SAMA candidates are cost-beneficial to implement at Davis-Besse.

See the Enclosure to this letter for the revision to the Davis-Besse LRA.

Table 5.g-1: Final Results of the Cost-Benefit Evaluation for Subsumed SAMA Candidates SAMA ID Modification Estimated Cost Estimate Conclusion Benefit Provide additional DC

$94,363 AC/DC-06 power to the 120/240V $1,750,000 Not Cost Effective

$100,547 vital AC system.

Provide an additional $94,363 AC/DC-09 $2,800,000 Not Cost Effective diesel generator. $237,436 Add a new backup source

$33,745 AC/DC-20 of diesel generator $700,000 Not Cost Effective

$39,242 cooling.

Add the ability to automatically align ECCS CC-08 $15,155 $1,500,000 Not Cost Effective to recirculation mode upon BWST depletion.

L-12-244 Page 30 of 63 Item 6 Provide the following with regard to the Phase II cost-benefit evaluations:

Question RAI 6.i ER Section E.8.6 discusses six sensitivity cases. Relative to these sensitivity cases, provide the following:

ii. The description of the sixth sensitivity case states that off-site economic cost was increased by 25 percent. Table E.8-1 indicates that the total benefit for each of the SAMA candidates was increased by the same amount of $19,632, the offsite economic cost (AOC) value. Clarify how the increase of 25 percent in off-site economic cost correlates to the increase in total benefits of $19,632 for each SAMA.

RESPONSE RAI 6.i

[The response to RAI 6.i.ii is replaced in its entirety.]

6.i.ii The sensitivity case for which the off-site economic cost was increased by 25 percent has been removed as a sensitivity case as it is no longer germane, since the MACCS2 economic input values that formed the basis for the sensitivity case were increased to reflect 2009 dollars, the reference economic year for the SAMA analysis.

Question RAI 6.j ER Section 8.3 discusses a sensitivity case using a higher evacuation speed.

Provide the evacuation speed used for this analysis. Also, Table E.3-31 shows that the population dose decreased compared to the base case yet Table E.8-1 shows the total net benefit increased by $1,963 for each SAMA. Explain this anomalous result and describe the methodology for developing the $1,963 used for each SAMA.

L-12-244 Page 31 of 63 RESPONSE RAI 6.j

[The response to RAI 6.j is edited as shown.]

The evacuation speed used in the sensitivity case discussed in ER Section E.8.3 was 1.0 meter/second. The population dose risk used in the Section E.8.3 sensitivity case was the result of the Level 3 PRA sensitivity case E1.

As noted in the RAI, with a decrease in population dose risk, the net benefit for each SAMA candidate would be expected to decrease. The anomalous result (e.g., a net benefit increase) was due to the number of significant figures used in the Level 3 PRA and the cost-benefit evaluation. The population dose risk values differed in the third significant digit, which when rounded caused the unexpected results. As a result of the response to RAI 4.b, above, the population dose risk values have been revised for the Level 3 PRA sensitivity case E1. The ER revisions due to population dose risk were identified in the response to RAI 4.b.

With the revised results from RAI 4.b and consistent use of significant figures between the Level 3 PRA and cost-benefit analysis, the value $1,963 is no longer germane to the sensitivity case in Section E.8.3.

As noted in the staffs RAI, a decrease in population dose risk was the result of sensitivity case E1 (where the evacuation speed was increased). Since NEI 05-01 suggested an evacuation speed sensitivity case to assess the impact on the results due to the uncertainty in the evacuation speed, it is logical to test (via a sensitivity case) the impact of a lower evacuation speed (which may cause a previously screened SAMA candidate to become cost-beneficial). Accordingly, the cost-benefit sensitivity case (Evacuation Speed from Table E.8-1) has been revised to use the results from Level 3 PRA sensitivity case E3 (see response to RAI 4.d), in which the evacuation speed is decreased by 9.6 percent, which causes a slight results in no increase in population dose risk. ER Section E.3.5.2.4 is revised and new ER Table E.3-33 is added to incorporate sensitivity case E3.

The total benefit for each SAMA candidate has been increased by $1374 did not increase, which is consistent with the no increase in population dose risk. For the sensitivity case in Section E.8.3, the population doses risk values are taken from the Level 3 PRA sensitivity case E3 and replace the base case values in the determination of the averted public exposure (APE). Since there is a constant difference in the population dose values, for the Section E.8.3 sensitivity case, the total benefit for each SAMA is changed by the same dollar amount. (See Table E.8-1 for results of evacuation speed sensitivity case in response to RAI 4.b.)

See the Enclosure to this letter for the revision to the Davis-Besse LRA.

L-12-244 Page 32 of 63 Question RAI 6.k The ER provides no assessment of the uncertainty distribution for CDF. Relative to the uncertainty distribution, address the following:

x Provide the uncertainty distribution (5th, mean, and 95th percentiles) for the Davis-Besse PRA model CDF and describe how the distribution was developed.

x Provide an assessment of whether an uncertainty analysis using the 95th percentile CDF and the external events multiplier of 3.6 developed in RAI 3.c is bounded by the Multiplier Case sensitivity analysis. If not bounded, provide an uncertainty analysis using the 95th percentile CDF. In this analysis, provide an assessment of each Phase 1 SAMA eliminated using Screening Criterion D and E to determine whether any Phase 1 SAMAs originally screened should have a Phase 2 cost-benefit evaluation performed. Provide a Phase 2 cost-benefit evaluation for any SAMA not screened.

x If the Multiplier Case is bounding, provide an assessment of each Phase 1 SAMA eliminated using Screening Criteria D and E to determine whether any Phase 1 SAMAs originally screened should have a Phase 2 cost-benefit evaluation performed. Provide a Phase 2 cost-benefit evaluation for any SAMA not screened.

RESPONSE RAI 6.k

[The response to RAI 6.k is edited as shown in Tables 6.k-1 and 6.k-2. Table 6.k-3 is also revised (page 39 of 63) to change the steam generator replacement schedule from 2013 to 2014 to align with current FENOC plans and with the discussions in the ER.]

The following table provides the uncertainty distribution for the Davis-Besse SAMA PRA model CDF. The 5th, mean, and 95th percentile values are in bold font:

5% 95%

Mean Conf. Conf.

Point Estimate 9.70E-06 Mean 1.06E-05 1.07E-05 1.09E-05 th 5 percentile 7.18E-06 7.20E-06 7.22E-06 Median 9.51E-06 9.53E-06 9.55E-06 th 95 percentile 1.53E-05 1.55E-05 1.56E-05 StdDev 1.48E-05 L-12-244 Page 33 of 63 Skewness 5.75E+01 Kurtosis 4.55E+03 The SAMA analysis model database was modified to support performance of an uncertainty analysis using the UNCERT software package. Failure rate distributions were entered into the database and modifications were made to make the database compatible with the UNCERT software. The SAMA analysis level 1 model was re-quantified to provide a cutset file compatible with the UNCERT software, and the uncertainty analysis was performed using the revised cutset file and database.

An assessment of the impact of the 95th percentile CDF uncertainty for internal events was performed for Davis-Besse. The uncertainty factor was derived from a ratio of the 95th percentile CDF uncertainty (1.55E-05/yr) to the point estimate CDF (1.07E-05/yr) for internal events. The uncertainty factor used in this analysis was 1.45. The analysis also used an external events multiplier of 4.6 (see the response to RAI 3.c for additional information on the development of the external events multiplier). Table 6.k-1, below, provides the cost-benefit results for the 95th percentile CDF uncertainty factor case. Also, the Multiplier Case was updated using an external events multiplier of seven (7). Table 6.k-2, below, provides the Multiplier Case cost-benefit results. The results of the 95th percentile CDF uncertainty and Multiplier Case sensitivity analyses identified one SAMA candidate (AC/DC-03) to be cost effective.

Since the external event multiplier used in the base case and the sensitivity case have changed, the issue of bounding is no longer relevant. Nonetheless, the SAMA candidates designated as Criterion D (Very Low Benefit) were re-evaluated (see Table 6.k-3, below) based on the results of the 95th percentile CDF uncertainty. For SAMA candidates where the 95th percentile CDF uncertainty basic event data were available, these basic events RRW data were used as a basis for the final determination. For some SAMA candidates, either basic event data were not available, or basic event data were not applicable to the determination; for those cases, the determination basis is also provided.

SAMA candidate FL-01 (improve inspection of rubber expansion joints on main condenser) was initially identified for cost-benefit analysis based on the 95th percentile CDF uncertainty results. However, upon further investigation, the disposition of SAMA candidate FL-01 is changed to Criterion B (Already Implemented). The basis for the revised disposition is that the circulating water joints are currently inspected during outages and periodically replaced. ER Table E.6-1 is revised to include this change.

Further, based on additional information, SAMA candidate OT-05 (increase training and operating experience feedback to improve operator response) is changed from Criterion D (Very Low Benefit) to Criterion B (Already Implemented). The basis for the revised disposition is that Davis-Besse provides PRA information, such as risk L-12-244 Page 34 of 63 significant initiating events, high worth operator actions and high worth equipment, to operators and other departments. Attachment 2 of FENOC procedure NOPM-CC-6000, Probabilistic Risk Assessment Program, identifies items supported by the PRA Program; one item is PRA training support in areas such as new licensed operator training and operator re-qualification training cycles. ER Table E.6-1 is revised to include this change.

SAMA candidates screened with Criterion E (Subsumed) were addressed in the response to RAI 5.g, above.

See the Enclosure to this letter for the revision to the Davis-Besse LRA.

Table 6.k-1: 95th Percentile Uncertainty Factor Cost-Benefit Results 95th Percentile SAMA ID Uncertainty Factor Estimated Cost Conclusion Estimated Benefit AC/DC-01 $145,794 $1,750,000 Not Cost Effective AC/DC-03 $575,095 $330,000 Cost Effective AC/DC-14 $344,283 $2,000,000 Not Cost Effective AC/DC-19 $56,901 $700,000 Not Cost Effective AC/DC-21 $68,912 $100,000 Not Cost Effective AC/DC-25 $354,521 $2,000,000 Not Cost Effective AC/DC-26 $354,521 $2,000,000 Not Cost Effective AC/DC-27 $0 $550,000 Not Cost Effective CB-21 $42,842 $550,000 Not Cost Effective CC-01 $4,982 $6,500,000 Not Cost Effective CC-04 $0 $5,500,000 Not Cost Effective CC-05 $0 $6,500,000 Not Cost Effective CC-19 $21,974 $1,500,000 Not Cost Effective HV-01 $1,993 $50,000 Not Cost Effective HV-03 $1,993 $400,000 Not Cost Effective AC/DC-28R $405,444 $1,600,000 Not Cost Effective CB-22R $162,566 $4,600,000 Not Cost Effective CC-22R $0 $2,200,000 Not Cost Effective CW-26R $529,319 $1,500,000 Not Cost Effective FW-17R $592,197 $2,800,000 Not Cost Effective OT-08R $1,017,623 $4,400,000 Not Cost Effective L-12-244 Page 35 of 63 Table 6.k-2: Multiplier Case Cost-Benefit Results SAMA ID Multiplier Case Estimated Cost Conclusion AC/DC-01 $143,639 $1,750,000 Not Cost Effective AC/DC-03 $566,596 $330,000 Cost Effective AC/DC-14 $339,195 $2,000,000 Not Cost Effective AC/DC-19 $56,060 $700,000 Not Cost Effective AC/DC-21 $67,893 $100,000 Not Cost Effective AC/DC-25 $349,282 $2,000,000 Not Cost Effective AC/DC-26 $349,282 $2,000,000 Not Cost Effective AC/DC-27 $0 $550,000 Not Cost Effective CB-21 $42,209 $550,000 Not Cost Effective CC-01 $4,908 $6,500,000 Not Cost Effective CC-04 $0 $5,500,000 Not Cost Effective CC-05 $0 $6,500,000 Not Cost Effective CC-19 $21,649 $1,500,000 Not Cost Effective HV-01 $1,963 $50,000 Not Cost Effective HV-03 $1,963 $400,000 Not Cost Effective AC/DC-28R $399,452 $1,600,000 Not Cost Effective CB-22R $160,164 $4,600,000 Not Cost Effective CC-22R $0 $2,200,000 Not Cost Effective CW-26R $521,496 $1,500,000 Not Cost Effective FW-17R $583,446 $2,800,000 Not Cost Effective OT-08R $1,002,584 $4,400,000 Not Cost Effective L-12-244 Page 36 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Enhancements Related to AC and DC Power Abnormal Procedure DB-OP-2532 addresses the loss of both AC and DC power to both the Non-Nuclear Instrumentation Increase training on response (NNI) and the ICS that are powered from uninterruptible AC AC/DC- to loss of 120V AC buses that Criterion D instrumentation distribution panels YAU and YBU. It is 08 cause inadvertent actuation judged that operator awareness to the required actions is well Very Low Benefit signals. established.

This SAMA should remain Criterion D.

Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to uninterruptible AC/DC- Improve uninterruptible power Criterion D power supplies has an RRW value above the minimum cost 16 supplies. of a hardware modification.

Very Low Benefit This SAMA should remain Criterion D.

Enhancements Related to ATWS Events Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to emergency Add an independent boron Criterion D boration has an RRW value above the minimum cost of a AT-01 hardware modification.

injection system. Very Low Benefit This SAMA should remain Criterion D.

L-12-244 Page 37 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Based on the basic event RRW results from the 95% CDF Add a system of relief valves to uncertainty case, no basic event related to ATWS pressure prevent equipment damage Criterion D relief has an RRW value above the minimum cost of a AT-02 hardware modification.

from pressure spikes during an Very Low Benefit ATWS.

This SAMA should remain Criterion D.

Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to reactor trip has an RRW value above the minimum cost of a hardware modification Install motor generator set trip Criterion D AT-07 Also, if the reactor power is not decreasing, procedures breakers in control room. Very Low Benefit instruct the operators to first de-energize substations E2 and F2, and, if necessary, locally open reactor trip breakers in the Low Voltage Switchgear room.

This SAMA should remain Criterion D.

Enhancements Related to Containment Bypass Failure of containment isolation typically leads to a LERF if core damage has occurred. LERF results are dominated by containment bypass events such as SGTR and ISLOCA Add redundant and diverse Criterion D events. Containment isolation is not shown to be a significant CB-02 limit switches to each CIV. Very Low Benefit contributor to LERF in the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 38 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

HPI and LPI injection check valves are leak tested per Appendix J. DHR suction lines are not tested, but rather than a leakage test, it is judged that continuously monitoring these valves at power would be preferable to leakage test. A SAMA Increase leak testing of valves Criterion D candidate to continuously monitor the DHR suction valves is CB-03 in ISLOCA paths. Very Low Benefit provided in SAMA candidate CB-21. This conclusion remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

Important CIVs receive a close signal from the safety actuation system. Many are air-operated and fail in the closed position. It is judged that self-actuating valves would not provide any significant increase in the reliability of isolation.

Criterion D CB-04 Install self-actuating CIVs.

Very Low Benefit Containment isolation is not shown to be a significant contributor to CDF or LERF in the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 39 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

This SAMA candidate would have very little benefit. It is likely that the break would be well above floor drain level.

Ensure ISLOCA releases are Therefore, a significant height of water would be required scrubbed. One method is to before any scrubbing took place. At these levels, the water Criterion D level would likely have undesirable effects, such as CB-06 plug drains in potential break areas so that break point will Very Low Benefit threatening mitigating equipment due to flooding. This be covered with water. conclusion remains valid for the 95% CDF uncertainty results.

This SAMA should remain Criterion D.

Davis-Besse is scheduled to replace the steam generators in Institute a maintenance 2013 2014, which would result in inspecting new steam practice to perform a 100% generator tubes. Therefore, this SAMA candidate is Criterion D considered very low benefit for Davis-Besse. This conclusion CB-09 inspection of steam generator tubes during each refueling Very Low Benefit remains valid for the 95% CDF uncertainty case.

outage.

This SAMA should remain Criterion D.

Flooding the SG prior to core damage could impact efforts to mitigate the SGTR. For example, flooding may present a risk Direct steam generator Criterion D to the operation of the TDAFW pumps by risking steam CB-18 flooding after a SGTR, prior to Very Low Benefit generator overfill.

core damage.

Disposition of this SAMA candidate is addressed in the response to RAI 5.i.

L-12-244 Page 40 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

This SAMA candidate would result in plant decay heat being deposited into primary containment, resulting in a harsh environment. The possible advantages for SGTR will be offset by the negative impacts for other events where Criterion D secondary steam is deposited into containment with intact CB-19 Vent MSSVs in containment.

Very Low Benefit steam generators. This conclusion remains valid for the 95%

CDF uncertainty case.

This SAMA should remain Criterion D.

Based on the top 100 cutsets and component basic event importance, ISLOCA in the CCW is not significant risk contributor at Davis-Besse. An ISLOCA occurring in the Install relief valves in the CCW Criterion D CCW system is not a risk contributor in the 95% CDF CB-20 system. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

Enhancements Related to Core Cooling Systems Davis-Besse operators are prohibited from throttling LPI pumps earlier in medium or large break LOCAs to maintain BWST inventory. If BWST flow was throttled down to reduce Modify procedures to throttle flowrate, the additional time gained is approximately 20 LPI pumps earlier in medium or Criterion D minutes, which, from a PRA perspective, is of low benefit for CC-11 large break LOCAs to maintain Very Low Benefit a LOCA condition. This conclusion remains valid for the 95%

BWST inventory. CDF uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 41 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The make-up system can be used to provide make-up to the RCS in the event of a small LOCA. Because of the separate HPI and make-up systems, the plant has essentially four Upgrade the chemical and separate systems capable of injecting from the BWST into the Criterion D RCS at high pressure. This was identified as a unique safety CC-13 volume control system to mitigate small break LOCAs. Very Low Benefit feature in the IPE. This conclusion remains valid for the 95%

CDF uncertainty case.

This SAMA should remain Criterion D.

Reducing the level at which switchover occurs (nine feet) would not significantly extend the time to switchover, and would increase the probability of pump failure due to loss of Reduce the BWST level at suction head. Davis-Besse has installed more accurate which switchover to Criterion D BWST level instrumentation that allows reaching a lower level CC-21 containment recirculation is Very Low Benefit prior to switchover to recirculation. This conclusion remains initiated. valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

Enhancements Related to Containment Phenomena Davis-Besse has a very large dry containment. Containment Use the fire water system as a over-pressurization is not a significant risk contributor. This Criterion D conclusion remains valid for the 95% LERF uncertainty case.

CP-03 backup source for the containment spray system. Very Low Benefit This SAMA should remain Criterion D.

L-12-244 Page 42 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

This SAMA candidate addresses the scrubbing of radioactive releases into certain areas by actuating the fire protection system. Although some scrubbing benefits might be realized, this SAMA candidate presents the risk of impacting required equipment by spray or flooding. This could only be performed Enhance fire protection system Criterion D with fire protection systems that could be remotely actuated.

CP-06 If the temperature in certain areas became high enough, hardware and procedures. Very Low Benefit some existing fire protection systems may automatically actuate. This conclusion remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

The delay time that could be realized if containment spray was delayed would be less than 10 minutes. This SAMA Delay containment spray Criterion D candidate is considered to be of very low benefit. This CP-16 actuation after a large break conclusion remains valid for the 95% CDF uncertainty case.

LOCA. Very Low Benefit This SAMA should remain Criterion D.

The capability already exists at Davis-Besse to throttle containment spray after the switchover to the sump. The delay time that could be realized if containment spray was Install automatic containment Criterion D throttled would be less than 10 minutes. This SAMA CP-17 spray pump header throttle candidate is considered to be of very low benefit. This valves. Very Low Benefit conclusion remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 43 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Based on component basic event importance, containment fan coolers are not significant risk contributors at Davis-Besse. This SAMA candidate is considered to be very Install a redundant Criterion D low benefit. This conclusion remains valid for the 95% CDF CP-19 containment fan system. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

Install or use an independent Davis-Besse has a very large dry containment. Hydrogen power supply to the hydrogen burn does not present a significant risk in terms of LERF.

control system using either This SAMA candidate is considered to be very low benefit.

new batteries, a non-safety This conclusion remains valid for the 95% CDF uncertainty grade portable generator, Criterion D case.

CP-20 existing station batteries, or Very Low Benefit existing AC/DC independent power supplies, such as the This SAMA should remain Criterion D.

security system diesel generator.

This SAMA would mitigate large early releases resulting from a hydrogen burn. LERF is dominated by containment bypass events such as SGTR and ISLOCA. Failure of containment is Install a passive hydrogen Criterion D not a significant contributor to LERF. This SAMA candidate is CP-21 considered to be very low benefit. This conclusion remains control system. Very Low Benefit valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 44 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Enhancements Related to Cooling Water Failure of DC power would impact much more than service water and improving the reliability of DC power to only service water would have very limited value. Based on the basic event RRW results from the 95% CDF uncertainty case, no Add redundant DC control Criterion D basic event related to service water performance has an CW-01 power for service water pumps. Very Low Benefit RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Davis-Besse has three service water pumps. In addition, the normally running cooling tower makeup pump is the preferred supply of service water following loss of service water. Based on the basic event RRW results from the 95% CDF Add a redundant service water Criterion D uncertainty case, no basic event related to service water CW-04 pump. Very Low Benefit performance has an RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

L-12-244 Page 45 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The Davis-Besse water supply from Lake Erie travels through a long canal before reaching the intake structure. There is a screen at the intake from Lake Erie. The long distance traveled through the canal results in a significant fraction of material passing through the initial screen settling out prior to Enhance the screen wash Criterion D reaching the intake structure. Based on the basic event RRW CW-05 system. Very Low Benefit results from the 95% CDF uncertainty case, no basic event related to service water performance has an RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Loss of CCW through drain and vent lines is not considered to be a significant contributor to loss of CCW. These lines are Cap downstream piping of Criterion D small, and any leakage would likely be low. This conclusion CW-06 normally closed CCW drain remains valid for the 95% CDF uncertainty case.

and vent valves. Very Low Benefit This SAMA should remain Criterion D.

Seal LOCA is not a concern at Davis-Besse if the RCPs are tripped. On loss of CCW, the makeup pumps can continue Enhance loss of CCW operation for at least one hour. Therefore, if operators trip the procedure to underscore the Criterion D RCPs within one hour of loss of CCW, an RCP seal LOCA is CW-08 not a risk concern. This conclusion remains valid for the 95%

desirability of cooling down the Very Low Benefit RCS prior to seal LOCA. CDF uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 46 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Seal LOCA is not a concern at Davis-Besse if the RCPs are tripped. On loss of CCW, the makeup pumps can continue operation for at least one hour. Therefore, if operators trip the Additional training on loss of Criterion D RCPs within one hour of loss of CCW, an RCP seal LOCA is CW-09 not a risk concern. This conclusion remains valid for the 95%

CCW. Very Low Benefit CDF uncertainty case.

This SAMA should remain Criterion D.

Davis-Besse makeup pumps can operate for at least one hour on loss of CCW. Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to Increase charging pump lube Criterion D charging (make-up) pump performance has an RRW value CW-12 oil capacity. Very Low Benefit above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Seal LOCA is not a concern at Davis-Besse if the RCPs are tripped. On loss of CCW, the makeup pumps can continue operation for at least one hour. Therefore, if operators trip the Use existing hydro test pump Criterion D RCPs within one hour of loss of CCW, an RCP seal LOCA is CW-15 for RCP seal injection. Very Low Benefit not a risk concern.

This SAMA should remain Criterion D.

L-12-244 Page 47 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The make-up system is continuously operating. Malfunctions of relief valves would be immediately detected during operation and corrected. Based on the basic event RRW Prevent make-up pump flow Criterion D results from the 95% CDF uncertainty case, no basic event CW-18 diversion through the relief related make-up flow diversion has an RRW value above the valves. Very Low Benefit minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Enhancements Related to Internal Flooding Revised to read: A large circulating water flood in the turbine building has Improve inspection of rubber associated basic event FL7 that is above the minimum cost of Criterion F FL-01 expansion joints on main a procedure change (although less that a hardware condenser. Considered for Further modification). This SAMA candidate will be considered for Evaluation further evaluation.

Enhancements Related to Fire Risk Inadvertent actuation of fire protection water is not considered risk significant and currently not modeled in the PRA. Any fire protection system water should be handled by existing drains Replace mercury switches in Criterion D and is not considered a significant flooding threat. This FR-01 fire protection system. Very Low Benefit conclusion remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 48 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The Davis-Besse IPEEE did not identify any weakness in the fire barrier performance. This conclusion remains valid for Upgrade fire compartment Criterion D the 95% CDF uncertainty case.

FR-02 barriers. Very Low Benefit This SAMA should remain Criterion D.

Currently, isolation switches exist for a control evacuation.

Some manual actions beyond operation of isolation switches are required (e.g., plugging connectors, removing/inserting Install additional transfer and Criterion D fuse blocks). Adding additional transfer/isolation switches is FR-03 not considered to be of significant benefit. This conclusion isolation switches. Very Low Benefit remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

The Davis-Besse IPEEE did not identify any weakness in fire brigade performance. This conclusion remains valid for the Enhance fire brigade Criterion D 95% CDF uncertainty case.

FR-04 awareness. Very Low Benefit This SAMA should remain Criterion D.

The Davis-Besse IPEEE did not identify any weakness in the Enhance control of combustible control program. This conclusion remains valid Criterion D for the 95% CDF uncertainty case.

FR-05 combustibles and ignition sources. Very Low Benefit This SAMA should remain Criterion D.

L-12-244 Page 49 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Enhancements Related to Feedwater and Condensate Davis-Besse has the capability of replenishing the CST using fire protection water. This can be done even on loss of AC power. Adding diesel for condensate makeup pumps would Install an independent diesel Criterion D add little benefit. This conclusion remains valid for the 95%

FW-03 for the CST make-up pumps. Very Low Benefit CDF uncertainty case.

This SAMA should remain Criterion D.

The purpose of the SAMA candidate was to reduce dual turbine-driven pump maintenance unavailability. Although manual isolation valves do not exist, Davis-Besse has valves Install manual isolation valves Criterion D within the steam lines that allow isolation of one TDAFW FW-05 around the TDAFW pump Very Low Benefit pump for maintenance while leaving the second TDAFW steam admission valves. pump available. This conclusion remains valid for the 95%

CDF uncertainty case.

This SAMA should remain Criterion D.

Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to CST performance Install a new condensate has an RRW value above the minimum cost of a hardware Criterion D FW-07 storage tank (AFW storage modification.

Very Low Benefit tank).

This SAMA should remain Criterion D.

L-12-244 Page 50 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

On loss of air or electric power, several components required Change failure position of for secondary heat removal would be lost; therefore the state condenser make-up valve if the Criterion D of the condenser make-up valve is not relevant. This FW-12 conclusion remains valid for the 95% CDF uncertainty case.

condenser make-up valve fails Very Low Benefit open on loss of air or power.

This SAMA should remain Criterion D.

Failure of the PORV to open only shows up in the Level 1 PRA importance measures with a RRW of 1.006 (cutoff 1.005). It does not show up in the top cutsets or the LERF Replace existing pilot-operated importance list. Therefore, it is judged to be very low benefit.

relief valves with larger ones, Criterion D Based on the basic event RRW results from the 95% CDF FW-15 uncertainty case, no basic event related to PORV opening or such that only one is required Very Low Benefit for successful feed and bleed. capacity has an RRW value above the minimum cost of a hardware modification This SAMA should remain Criterion D.

Enhancements Related to Heating, Ventilation and Air Conditioning (HVAC)

The high voltage switchgear rooms do not require forced ventilation. Low voltage switchgear rooms require forced ventilation. Operators monitor the temperature of the low voltage switchgear rooms during their plant tours. Based on Add a switchgear room high Criterion D the basic event RRW results from the 95% CDF uncertainty HV-04 case, no basic event related to switchgear ventilation has an temperature alarm. Very Low Benefit RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

L-12-244 Page 51 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Loss of ventilation to AFW is not a risk significant contributor Create ability to switch at Davis-Besse. This conclusion remains valid for the 95%

emergency feedwater room fan Criterion D CDF uncertainty case.

HV-05 power supply to station Very Low Benefit batteries in an SBO.

This SAMA should remain Criterion D.

Service water ventilation includes four 50% fans. Loss of service water ventilation is not a significant risk contributor at Provide procedural guidance Davis-Besse. Based on the basic event RRW results from for establishing an alternate Criterion D the 95% CDF uncertainty case, no basic event related to HV-06 service water room ventilation has an RRW value above the means of room ventilation to Very Low Benefit the service water pump room. minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Enhancements Related to Instrument Air and Nitrogen Supply Service Air and Instrument Air are not significant risk contributors based on top cutsets and risk importance measures. Based on the basic event RRW results from the Modify procedure to provide Criterion D 95% CDF uncertainty case, no basic event related to air IA-02 ability to align diesel power to compressors has an RRW value above the minimum cost of a more air compressors. Very Low Benefit hardware modification.

This SAMA should remain Criterion D.

L-12-244 Page 52 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Service Air and Instrument Air are not significant risk contributors based on top cutsets and risk importance Replace service and measures. Based on the basic event RRW results from the instrument air compressors Criterion D 95% CDF uncertainty case, no basic event related to service IA-03 with more reliable compressors or instrument air compressors has an RRW value above the that have self-contained air Very Low Benefit minimum cost of a hardware modification cooling by shaft-driven fans.

This SAMA should remain Criterion D.

Enhancements Related to Seismic Risk The Seismic Qualifications Utility Group (SQUG) previously identified the need for additional seismic restraints in the Increase seismic ruggedness Criterion D plant. These restraints have already been added. This SR-01 conclusion remains valid for the 95% CDF uncertainty case.

of plant components. Very Low Benefit This SAMA should remain Criterion D.

The CO2 tanks are located outdoors. These tanks supply only the turbine generator. No other components are protected with CO2. A seismic failure of the CO2 tanks has Provide additional restraints for Criterion D minimal risk. This conclusion remains valid for the 95% CDF SR-02 CO2 tanks. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

L-12-244 Page 53 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Other Enhancements Large break LOCA is not a significant risk contributor (0.2%

CDF). Davis-Besse has a Containment Leakage Detection System (FLUS) to identify leaks from vessel penetrations and Install digital large break LOCA Criterion D nozzles. This conclusion remains valid for the 95% CDF OT-01 protection system. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

Davis-Besse has a qualified Maintenance Rule program in place. No deficiencies in maintenance practices have been Improve maintenance Criterion D identified. This conclusion remains valid for the 95% CDF OT-04 uncertainty case.

procedures. Very Low Benefit This SAMA should remain Criterion D.

FENOC provides PRA information, such as risk-significant Increase training and operating Revised to read: initiating events, high worth operator actions and high worth OT-05 experience feedback to Criterion B equipment, to various departments, including Operations improve operator response. Already Implemented Training, and presents this information on posters throughout the plant.

L-12-244 Page 54 of 63 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as Very Low Benefit (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Steam line breaks are not a significant contributor to CDF or LERF based on top cutsets or basic event importance. The derived benefit would not justify the implementation cost required. Based on the basic event RRW results from the Install secondary side guard Criterion D 95% CDF uncertainty case, no basic event related to main OT-07 pipes up to the MSIVs. Very Low Benefit steam breaks has an RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

L-12-244 Page 55 of 63 Item 7 For certain SAMAs considered in the ER, there may be lower-cost alternatives that could achieve much of the risk reduction at a lower cost. In this regard, discuss whether any lower-cost alternatives to those Phase II SAMAs considered in the ER would be viable and potentially cost-beneficial. Evaluate the following SAMAs (previously found to be potentially cost-beneficial at other Babcock and Wilcox plants), or indicate if the particular SAMA has already been considered. If the latter, indicate whether the SAMA has been implemented or has been determined to not be cost-beneficial at Davis-Besse Nuclear Power Station.

Question RAI 7.a Automate reactor coolant pump trip on high motor bearing cooling temperature.

RESPONSE RAI 7.a

[The response to RAI 7.a is edited as shown in the text and Tables 7.a-1, 7.a-2 and 7.a-3.]

[NOTE:

• One sensitivity case no longer applies and has been deleted; see the revised response to RAI 6.i.ii]

A SAMA candidate (CW-26R) to provide an automatic reactor coolant pump trip on loss of cooling to the RCP seal thermal barrier cooler and loss of seal injection flow was evaluated for Davis-Besse. Table 7.a-1 and Table 7.a-2, below, provide the internal event and total benefit results for SAMA candidate CW-26R, respectively. Table 7.a-3, below, provides the final results for the ten nine [*] sensitivity cases for SAMA candidate CW-26R. The implementation cost for this SAMA candidate was estimated as

$1,500,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

L-12-244 Page 56 of 63 Table 7.a-1: Internal Events Benefit Results for SAMA Candidate CW-26R CW-26R Case (Auto_RCP)

Off-site Annual Dose (rem) 2.05E+00 Off-site Annual Property Loss ($) 3.49E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.12E+00 Comparison Cost ($) 3.59E+03 Enhanced CDF 7.7E-06 Reduction in CDF 23.00%

Reduction in Off-site Dose 3.30%

Immediate Dose Savings (On-site) $186 Long Term Dose Savings (On-site) $812 Total Accident Related Occupational

$998 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$30,443 site)

Replacement Power Savings (On-site) $30,801 Averted Costs of On-site Property

$61,244 Damage (AOSC)

Total On-site Benefit $62,242 Averted Public Exposure (APE) $1,718 Averted Off-site Damage Savings (AOC) $1,227 Total Off-site Benefit $2,945 Total Benefit (On-site + Off-site) $65,187 Table 7.a-2: Total Benefit Result for SAMA Candidate CW-26R CW-26R (Auto_RCP)

Internal Events $65,187 Fires, Seismic, Other $299,860 Total Benefit $365,047 L-12-244 Page 57 of 63 Table 7.a-3: Final Results of the Sensitivity Cases for SAMA Candidate CW-26R Low High On-site SAMA Repair On-site Discount Discount Clean-up ID Case Dose Case Rate Case Rate Case Case CW-26R $227,059 $551,324 $251,436 $370,702 $421,875 SAMA Replacement Multiplier Evacuation 95th CDF ID Power Case Case Speed Case CW-26R $480,823 $521,496 $365,047 $529,319 Question RAI 7.d Automate refill of the borated water storage tank (BWST).

RESPONSE RAI 7.d

[The response to RAI 7.d is edited as shown in the text and Tables 7.d-1 and 7.d-3.]

[NOTE:

• One sensitivity case no longer applies and has been deleted; see the revised response to RAI 6.i.ii]

A SAMA candidate (CC-22R) to provide an automatic refill of the borated water storage tank was evaluated for Davis-Besse. Table 7.d-1 and Table 7.d-2, below, provide the internal event and total benefit results for SAMA candidate CC-22R, respectively. Table 7.d-3, below, provides the final results for the ten nine [*] sensitivity cases for SAMA candidate CC-22R. The implementation cost for this SAMA candidate was estimated as

$2,200,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

L-12-244 Page 58 of 63 Table 7.d-1: Internal Events Benefit Results for SAMA Candidate CC-22R CC-22R Case (Auto_BWST)

Off-site Annual Dose (rem) 2.12E+00 Off-site Annual Property Loss ($) 3.59E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.12E+00 Comparison Cost ($) 3.59E+03 Enhanced CDF 1.0E-05 Reduction in CDF 0.00%

Reduction in Off-site Dose 0.00%

Immediate Dose Savings (On-site) $0 Long Term Dose Savings (On-site) $0 Total Accident Related Occupational

$0 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$0 site)

Replacement Power Savings (On-site) $0 Averted Costs of On-site Property

$0 Damage (AOSC)

Total On-site Benefit $0 Averted Public Exposure (APE) $0 Averted Off-site Damage Savings (AOC) $0 Total Off-site Benefit $0 Total Benefit (On-site + Off-site) $0 Table 7.d-2: Total Benefit Result for SAMA Candidate CC-22R CC-22R (Auto_BWST)

Internal Events $0 Fires, Seismic, Other $0 Total Benefit $0 L-12-244 Page 59 of 63 Table 7.d-3: Final Results of the Sensitivity Cases for SAMA Candidate CC-22R Low High On-site SAMA Repair On-site Discount Discount Clean-up ID Case Dose Case Rate Case Rate Case Case CC-22R $0 $0 $0 $0 $0 SAMA Replacement Multiplier Evacuation 95th CDF ID Power Case Case Speed Case CC-22R $0 $0 $0 $0 Question RAI 7.e Automate start of auxiliary feedwater (AFW) pump in the event the automated emergency feedwater (EFW) system is unavailable.

RESPONSE RAI 7.e

[The response to RAI 7.e is edited as shown in the text and Tables 7.e-1, 7.e-2 and 7.e-3. ]

[NOTE:

• One sensitivity case no longer applies and has been deleted; see the revised response to RAI 6.i.ii]

A SAMA candidate (FW-17R) to automatically start the auxiliary feedwater pump when the emergency feedwater system is unavailable was evaluated for Davis-Besse. Based on the Davis-Besse design, this SAMA was interpreted as automatically starting the motor driven feedwater pump in the event both turbine-driven auxiliary feedwater pumps were not available. Table 7.e-1 and Table 7.e-2, below, provide the internal event and total benefit results for SAMA candidate FW-17R, respectively. Table 7.e-3, below, provides the final results for the ten nine [*] sensitivity cases for SAMA candidate FW-17R. The implementation cost for this SAMA candidate was estimated as

$2,800,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

L-12-244 Page 60 of 63 Table 7.e-1: Internal Events Benefit Results for SAMA Candidate FW-17R FW-17R Case (Auto_MDFP)

Off-site Annual Dose (rem) 2.00E+00 Off-site Annual Property Loss ($) 3.40E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.12E+00 Comparison Cost ($) 3.59E+03 Enhanced CDF 7.5E-06 Reduction in CDF 25.00%

Reduction in Off-site Dose 5.66%

Immediate Dose Savings (On-site) $202 Long Term Dose Savings (On-site) $882 Total Accident Related Occupational

$1,085 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$33,091 site)

Replacement Power Savings (On-site) $33,479 Averted Costs of On-site Property

$66,570 Damage (AOSC)

Total On-site Benefit $67,655 Averted Public Exposure (APE) $2,945 Averted Off-site Damage Savings (AOC) $2,331 Total Off-site Benefit $5,276 Total Benefit (On-site + Off-site) $72,931 Table 7.e-2: Total Benefit Result for SAMA Candidate FW-17R FW-17R (Auto_MDFP)

Internal Events $72,931 Fires, Seismic, Other $335,481 Total Benefit $408,412 L-12-244 Page 61 of 63 Table 7.e-3: Final Results of the Sensitivity Cases for SAMA Candidate FW-17R Low High On-site SAMA Repair On-site Discount Discount Clean-up ID Case Dose Case Rate Case Rate Case Case FW-17R $258,425 $617,207 $282,195 $414,559 $470,181 SAMA Replacement Multiplier Evacuation 95th CDF ID Power Case Case Speed Case FW-17R $534,255 $583,446 $408,412 $592,197 Question RAI 7.f Purchase or manufacture of a gagging device that could be used to close a stuck-open steam generator safety valve for a SGTR event prior to core damage.

RESPONSE RAI 7.f

[The response to RAI 7.f is edited as shown in the text and Tables 7.f-1, 7.f-2 and 7.f-3.]

[NOTE:

• One sensitivity case no longer applies and has been deleted; see the revised response to RAI 6.i.ii]

A SAMA candidate (CB-22R) to use a gagging device that could be used to close a stuck-open steam generator safety valve for a SGTR was evaluated for Davis-Besse.

Table 7.f-1 and Table 7.f-2, below, provide the internal event and total benefit results for SAMA candidate CB-22R, respectively. Table 7.f-3, below, provides the final results for the ten nine [*] sensitivity cases for SAMA candidate CB-22R. The implementation cost for this SAMA candidate was estimated as $4,600,000. The high implementation cost of this SAMA candidate is based on replacement of the safety valves with a new design that includes a gagging feature. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

L-12-244 Page 62 of 63 Table 7.f-1: Internal Events Benefit Results for SAMA Candidate CB-22R CB-22R Case (Gagging_Device)

Off-site Annual Dose (rem) 1.86E+00 Off-site Annual Property Loss ($) 3.14E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.12E+00 Comparison Cost ($) 3.59E+03 Enhanced CDF 9.7E-06 Reduction in CDF 3.00%

Reduction in Off-site Dose 12.26%

Immediate Dose Savings (On-site) $24 Long Term Dose Savings (On-site) $106 Total Accident Related Occupational

$130 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$3,971 site)

Replacement Power Savings (On-site) $4,018 Averted Costs of On-site Property

$7,988 Damage (AOSC)

Total On-site Benefit $8,119 Averted Public Exposure (APE) $6,380 Averted Off-site Damage Savings (AOC) $5,522 Total Off-site Benefit $11,902 Total Benefit (On-site + Off-site) $20,020 Table 7.f-2: Total Benefit Result for SAMA Candidate CB-22R CB-22R (Gagging_Device)

Internal Events $20,020 Fires, Seismic, Other $92,094 Total Benefit $112,115 L-12-244 Page 63 of 63 Table 7.f-3: Final Results of the Sensitivity Cases for SAMA Candidate CB-22R Low High On-site SAMA Repair On-site Discount Discount Clean-up ID Case Dose Case Rate Case Rate Case Case CB-22R $94,116 $171,489 $82,166 $112,852 $119,527 SAMA Replacement Multiplier Evacuation 95th CDF ID Power Case Case Speed Case CB-22R $127,216 $160,164 $112,115 $162,566

Attachment 3 L-12-244 Review for Impacts to Responses to Requests for Additional Information for the Review of the Davis Besse Nuclear Power Station, Unit No. 1 (Davis-Besse),

License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis Submitted by FENOC Letter Dated September 1, 2011 (ML11250A068)

Page 1 of 1 FirstEnergy Nuclear Operating Company (FENOC) performed a review, based on the revised SAMA Analysis, for impacts to the supplemental responses to Nuclear Regulatory Commission (NRC) supplemental requests for additional information (RAIs) for the Severe Accident Mitigation Alternatives (SAMA) Analysis submitted by FENOC letter dated September 1, 2011 (ML11250A068). Based on the changes to the SAMA Analysis, no revision to the FENOC supplemental responses provided in the September 1, 2011, letter is necessary. The list of supplemental RAI s contained in the letter is as follows:

SAMA RAI Supplemental Responses - No Revision 1.d 7.b 4.b 7.c 5.b 7.d 5.d 7.e 6.j 7.f 7.a

Enclosure Davis-Besse Nuclear Power Station, Unit No. 1 (Davis-Besse)

Letter L-12-244 Amendment No. 29 to the Davis-Besse License Renewal Application Page 1 of 49 License Renewal Application Environmental Report (ER) Sections Affected Environmental Report Section E.8.6 Table E.3-27 Section 4.20 Section E.9 Table E.3-28 Table E.3-29 ER Attachment E Section E.10 Table E.3-30 Executive Summary Table E.3-6 Table E.3-31 Section E.3.1.2.4 Table E.3-11 Table E.3-32 Section E.3.4.1 Table E.3-13 Table E.3-33 Section E.3.4.8 Table E.3-18 Table E.4-1 Section E.3.5.2.2 Table E.3-19 Table E.5-4 Section E.3.5.2.3 Table E.3-20 Table E.6-1 Section E.3.5.2.4 Table E.3-21 Table E.7-2 Section E.4.1 Table E.3-22 Table E.7-3 Section E.4.2 Table E.3-23 Table E.7-5 Section E.4.5 Table E.3-24 Table E.8-1 Section E.5.6 Table E.3-25 Section E.7.1.2 Table E.3-26 Section E.11 The amendment to the License Renewal Application (LRA) ER Sections and Tables included in this Enclosure are a result of the revision to the Severe Accident Mitigation Alternatives (SAMA) Analysis based on correction of the five SAMA Analysis errors, unless otherwise indicated. The Enclosure identifies the change to the LRA by Affected LRA Section, LRA Page No., and Affected Paragraph and Sentence. The count for the affected paragraph, sentence, bullet, etc., starts at the beginning of the affected Section or at the top of the affected page, as appropriate. The sentence affected is printed in italics with deleted text lined-out and added text underlined.

Enclosure L-12-244 Page 2 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section 4.20 4.20-3 & 4.20-4 Final paragraph Based on the responses to RAIs 4.b (see FENOC Letter dated June 24, 2011 (ML11180A233) and 5.c, and the revised SAMA Analysis, Environmental Report (ER) Section 4.20, Severe Accident Mitigation Alternatives, the last bulleted item and final paragraph, are replaced in their entirety to read as follows:

x Sensitivity Analysis - Sensitivity cases were performed to investigate the sensitivity of the results to certain modeling assumptions in the Davis Besse SAMA analysis. Nine sensitivity cases were investigated. These cases examined the impacts of assuming damaged plant equipment is repaired and refurbished following an accident, a lower discount rate, a higher discount rate, higher on-site dose estimates, higher total on-site cleanup costs, higher costs for replacement power, a higher external event hazard groups multiplier, a reduced evacuation speed, and use of a 95th percentile core damage frequency uncertainty factor for internal events. Details on the sensitivity cases are discussed in Attachment E, Section E.8.

The results of the evaluation of 168 SAMA candidates identified one cost-beneficial enhancement at Davis Besse. Assuming a lower discount rate, higher dose rates, higher onsite clean-up costs, increased replacement power costs, increased external event multiplier, reduced evacuation speed, and use of a 95th percentile core damage frequency uncertainty factor for internal events identified the same SAMA candidate to be cost-beneficial. The SAMA candidate identified in the base case and sensitivity cases is not related to plant aging.

Therefore, the identified cost-beneficial SAMA candidate is not a required modification for the license renewal period. Nevertheless, this SAMA candidate will be considered through the normal FENOC processes for evaluating possible modifications to the plant.

Enclosure L-12-244 Page 3 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Attachment E - E-9 4th and 5th paragraphs Executive Summary Based on the responses to RAIs 4.b (see FENOC Letter dated June 24, 2011 (ML11180A233) and 5.c, and the revised SAMA Analysis, the Executive Summary of ER Attachment E, Severe Accident Mitigation Alternatives Analysis, paragraphs four and five, are revised to read as follows:

The cost-benefit evaluation of SAMA candidates performed for Davis-Besse provides significant insight into the continued operation of Davis-Besse. The results of the evaluation of 167 168 SAMA candidates indicate no enhancements one enhancement to be cost-beneficial for implementation at Davis-Besse. The cost-beneficial SAMA candidate is AC/DC-03, which adds a portable diesel-driven battery charger to the DC system.

However, the The sensitivity cases performed for this analysis found one the same SAMA candidate (AC/DC-03) to be cost-beneficial for implementation at Davis-Besse under the assumptions of three of the sensitivity cases (lower discount rate, replacement power, and multiplier). SAMA candidate AC/DC-03 considered the addition of a portable diesel-driven battery charger for the DC system. a lower discount rate, higher dose rates, higher onsite clean-up costs, increased replacement power costs, increased external event multiplier, reduced evacuation speed, and use of a 95th percentile core damage frequency uncertainty factor for internal events. While the identified SAMA candidate is not related to plant aging and therefore not required to be resolved as part of the relicensing effort, FENOC will, nonetheless, consider implementation of this candidate through normal processes for evaluating possible changes to the plant.

Enclosure L-12-244 Page 4 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.1.2.4 E-28 Entire Section In response to RAI 3.c, ER Section E.3.1.2.4, External Event Severe Accident Risk, is deleted in its entirety, as follows:

E.3.1.2.4 External Event Severe Accident Risk This section describes the method used to address external events risk.

As discussed in Section E.3.1.2.2, Davis Besse used the SMA to evaluate the risk from seismic events. While this methodology does not provide a quantitative result, the resolution of outliers ensures that the seismic risk is low and further cost-beneficial seismic improvements are not expected. Also, as discussed in Section E.3.1.2.3, no other external events were found to exceed the screening criteria. Therefore, the FIVE results were used as a measure of total external events risk.

As discussed in Section E.3.1.2.1, using the EPRI FIVE methodology, Davis Besse conservatively estimated the Fire CDF to be 2.5E-05/yr. Since the FIVE methodology contains numerous conservatisms, a more realistic assessment could result in a substantially lower fire CDF. As noted in NEI 05-01 (Reference 2), the NRC staff has accepted that a more realistic fire CDF may be a factor of three less than the screening value obtained from a FIVE analysis.

Based on the Davis Besse FIVE CDF of 2.5E-05/yr, a factor of three reduction would result in a fire CDF of approximately 8.3E-06/yr. This value is the same order of magnitude as the internal events CDF of 9.2E-06/yr. Therefore, this justifies use of an external events multiplier of three to the averted cost estimates (for internal events) to represent the additional SAMA benefits in external events.

Enclosure L-12-244 Page 5 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.4.1 E-33 & E-34 Last paragraph and bulleted list ER Section E.3.4.1, Introduction, last paragraph and bulleted list, are revised to read as follows:

The Level 3 PRA analysis considered a base case and eleven ten sensitivity cases to account for variation in data and assumptions. The following list describes the sensitivity cases, which are discussed in Section E.8 E.3.5.2:

x Case S1 - Use estimated 2060 site population data (with an escalation rate of 4.7%/decade); the same escalation rate for the base case population to 2040 x Case S2 - Use a less conservative escalation rate of 1.5% to estimate the 50-mile population around Davis Besse in 2040 x Case S3 - Set all watershed indices to 1 x Case M1 - Use 2007 meteorological data x Case M2 - Use meteorological data from circa late-1990s x Case A1 - Use an alternative method to estimate PLHEAT x Case A2 - Use more extreme meteorological boundary conditions x Case A3 - Use a longer OALARM value to better reflect operators ability to react x Case E1 - Use a more realistic (higher faster) evacuation speed of evaluation (ESPEED) x Case E2 - Set sheltering shielding factors based on brick house (versus wood housing used in the base case) x Case E3 - Use a slower evacuation speed (ESPEED)

Enclosure L-12-244 Page 6 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.4.8 E-41 RELCST (Relocation Cost),

2nd and 4th paragraphs ER Section E.3.4.8, Economic Data, RELCST subsection, 2nd and 4th paragraphs, are revised to read as follows:

RELCST was estimated using the evacuation costs plus the average property cost per person. The average property cost per person was calculated from the total property value in the state, which can be found on the individual states Department of Revenue websites:

x $256,088,369,000 for Ohio (Reference 25, Table PD-30);

Ohio property values obtained were tax assessment values, which are 35% of total property value, so the Ohio property value needs to be corrected by dividing by 0.35 to obtain total property value x $340,545,761,049 for Michigan (Reference 26, Exhibit 22)

The total property cost was divided by the total population (11,353,140 for Ohio and 9,938,444 for Michigan) (Reference 27).

For Ohio State, RELCST is $266.34/person-day $381.11/person-day; for Michigan State, RELCST is $310.61/person-day. The average of the Ohio and Michigan RELCST values was used as input in the CHRONC file.

Enclosure L-12-244 Page 7 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.5.2.2 E-43 & E-44 Case M2 subsection - entire subsection ER Section E.3.5.2.2, Meteorological, Case M2 subsection, is deleted in its entirety, as follows:

Case M2 - An additional sensitivity case was performed to further demonstrate the typical nature of any particular years worth of meteorological data. These data are circa late-1990s, but no specific year could be identified, and therefore are only to be used as a second sensitivity case.

The results in Table E.3-27 are similar to sensitivity case M1, with some minor variability in the consequence, demonstrating the representativeness of any years worth of meteorological data.

Enclosure L-12-244 Page 8 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.5.2.3 E-44 Case A2 subsection, 3rd and 4th sentences ER Section E.3.5.2.3, ATMOS, Case A2 subsection, 3rd and 4th sentences, are revised to read as follows:

Case M2 - A sensitivity case was run with more extreme values of the meteorological boundary parameters, i.e., mixing height (BNDMXH), stability class (IBDSTB), rain rate (BNDRAN), wind speed (BNDWND). In general, the sensitivity case considered all of these boundary parameters collectively (i.e., all considered in one case). The rain rate boundary condition was set at 0.0 mm/hour for the base case; there is no value more conservative than that 30.73 mm/hour (the maximum rainfall in any hour) as a sensitivity case against the base case value of 0.0 mm/hr. The conservative more extreme boundary parameters had no impact on the results as shown in Table E.3-29.

Enclosure L-12-244 Page 9 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.5.2.4 E-45 New subsection Based on the response to RAI 4.d, and the revised SAMA Analysis, ER Section E.3.5.2.4, Early, previously revised by FENOC letter dated June 24, 2011 (ML11180A233), to include a new paragraph for sensitivity case E3 at the end of the section, is revised to read as follows:

Case E3 - The base case was performed with an evacuation speed of 0.58 meters/second, based on Davis-Besse-specific evaluation information, without any correction factor to account for the escalated population. In response to an NRC request for additional information, this sensitivity case was performed to gauge the sensitivity of reducing the evacuation speed. As the population was increased 4.7 percent per decade for the 20 years of license renewal (total increase of 9.6 percent), it was assumed for this sensitivity case that the increase in population was directly proportional to the decrease in evacuation speed. The evacuation speed for this sensitivity is a 9.6 percent decrease from the base case, i.e., 0.52 meters/second. This change resulted in a minor no increase in the consequence values population dose risk, as shown in Table E.3-33, and only a minor increase in the other consequence values. This is These results are expected as slower evacuation should remove the population from the radiological damage less quickly.

Enclosure L-12-244 Page 10 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.1 E-47 1st paragraph on page ER Section E.4.1, Off-site Exposure Cost, the first paragraph on page E-47, previously revised by FENOC Letter dated June 24, 2011 (ML11180A233), is revised to read as follows:

Table E.3-21 provides the off-site dose for each release category obtained for the base case of the Davis Besse Level 3 PRA weighted by the release category frequency. The total off-site dose for internal events (Dt) was estimated to be 2.30 2.12 person-rem/year. The APE cost was determined using Equation E.4-2 (Reference 1, Section 5.7.1).

Enclosure L-12-244 Page 11 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.1 E-48 Equations E.4-6 and E.4-7 ER Section E.4.1, Off-site Exposure Cost, equations E.4-6 and E.4-7, previously revised by FENOC Letter dated June 24, 2011 (ML11180A233), are replaced in their entirety to read as follows:

§ $ *§ person  rem

• Z pha ¨ 2,000 ¸¨ 2.12 ¸ $4240/yr (E.4-6)

© person  rem ¹© yr ¹ where, R = $2,000/person-rem Dt = 2.12 person-rem/year The values for the best estimate case are:

C = 12.27 yr Zpha = $4,240/yr

§ $4240

• APE 12.27yr ¨ ¸ $52,025 (E.4-7)

© yr ¹

Enclosure L-12-244 Page 12 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.2 E-49 1st paragraph, 4th sentence, and equations E.4-8 and E.4-9 ER Section E.4.2, Off-site Economic Cost, the first paragraph, fourth sentence and equations E.4-8 and E.4-9, previously revised by FENOC Letter dated June 24, 2011 (ML11180A233), are revised to read as follows:

The term used for off-site economic cost is designated as averted off-site property damage costs (AOCs). The off-site economic loss for a 50-mile radius of the site was determined using the MACCS2 model developed for the Davis Besse Level 3 PRA in Section E.3.4. Table E.3-21 provides the economic loss for each release category obtained for the base case of the Level 3 PRA weighted by the release category frequency. The total economic loss from internal events (It) was estimated to be $1,800 $3,590 ($3.59E+03) per year.

The averted cost was determined using Equation E.4-8 from Reference (1),

Section 5.7.5.

AOC C It (E.4-8) where, AOC = off-site economic costs associated with a severe accident ($)

C = present value factor (yr)

It = monetary value of economic loss per year from internal events before discounting ($/yr)

The values for the base case are:

C = 12.27 yr It = $1,800/yr $3,590/yr

§ $*

AOC 12.27yr ¨ 3,590 ¸ $44,049 (E.4-9)

© yr ¹

Enclosure L-12-244 Page 13 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.5 E-55 Entire section, including equations Based on the responses to RAIs 3.c and 4.b (see FENOC letter dated June 24, 2011 (ML11180A233), and the revised SAMA Analysis, ER Section E.4.5, Total Cost of Severe Accident Risk, is revised to read:

The total cost of severe accident impact for internal events was calculated by summing the public exposure cost, off-site property damage cost, occupational exposure cost, and on-site economic cost. The cost of the impact of a severe accident for internal events was $339,331 $366,693 as shown in Table E.4-1.

Davis Besse does not have external events (i.e., fire, seismic and other external events) PRA from which risk contributors could be combined with the internal events risk. This analysis assumed that the benefit from each hazard groups (i.e., fire, seismic, and other external events) contribution is equivalent to that of internal events. This approach is conservative, based on the discussion in Section E.3.1.2. Therefore, the cost of SAMA candidate implementation was compared with a benefit value of four times (i.e., 1x for internal events plus 3x for external events) that calculated for internal events to include the contribution from internal events, fire, seismic, and other hazard groups. Based on the NRC staffs best estimate, the fire CDF for Davis-Besse is 2.9x10-5/yr [39]. To account for the risk contribution from the fire hazard, a ratio between the fire CDF and internal events CDF was used to determine a fire multiplier of 2.90 (see equation E.4-24).

5 Fire CDF 2.9x10 /yr

5 2.90 (E.4-24)

Internal Events CDF 1.0x10 /yr Based on updated probabilistic seismic hazard estimates due to Generic Issue 199, the NRC staff estimated a weakest link model seismic CDF for Davis-Besse of 6.7x10-6/yr [40]. To account for the risk contribution from the seismic hazard, a ratio between the seismic CDF and internal events CDF was used to determine a seismic multiplier of 0.67 (see equation E.4-25).

6 Seismic CDF 6.7x10 /yr

5 0.67 (E.4-25)

Internal Events CDF 1.0x10 /yr

Enclosure L-12-244 Page 14 of 49 This analysis conservatively assumed that the benefit from other hazard groups contribution is equivalent to that of internal events. Therefore, the other hazard groups multiplier is 1.0.

To determine the multiplier to account for fire, seismic, and other hazard groups, the individual multipliers are summed; the resulting multiplier is 4.6.

This approach provided a comparison of the cost to the risk reduction estimated for internal and external events for each SAMA candidate. The maximum benefit for Davis Besse was $1,357,324 $2,053.481 as shown in Table E.4-1.

Enclosure L-12-244 Page 15 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.5.6 E-63 1st sentence In response to RAIs 4.b (see FENOC letter dated June 24, 2011 (ML11180A233) and 5.c, ER Section E.5.6, Initial SAMA Candidate List, the first sentence in the section is 2nd revised to read:

Based on the review of the aforementioned sources, an initial list of 167 168 SAMA candidates was assembled.

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.7.1.2 E-68 2nd paragraph, 6th & 7th sentence ER Section E.7.1.2, Best-Estimate Benefit Calculation, 2nd paragraph, 6th and 7th sentences are revised to read:

For each case, the benefit from internal events and external events (fire, seismic, and other hazard groups) were summed in a worksheet to determine estimate the total benefit of implementing the SAMA candidate. As discussed in Section E.4.5, the fire, seismic, and other hazard group risk contribution was conservatively estimated to be equivalent to three 4.6 times the internal events risk contribution.

Enclosure L-12-244 Page 16 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.8.6 E-73 Last two bullets and last paragraph ER Section E.8.6, Other Sensitivity Cases, the last two bullets and last paragraph, are revised to read as follows:

x The fifth sensitivity case investigated the sensitivity of each analysis to the non-internal external events hazard groups multiplier by assuming a multiplier of five seven.

x The sixth sensitivity case investigated the sensitivity of each analysis to the off-site economic cost. This sensitivity case assumed the off-site ecomonic cost was increased by twenty-five percent. The sixth sensitivity case assessed the impact of using an uncertainty factor for internal events based on the 95th percentile CDF for internal events. The uncertainty factor used in this sensitivity case was 1.45.

The results of the sensitivity cases (Repair, On-site Dose, On-site Cleanup, Replacement Power, Multiplier, and Off-site Economic Cost 95th percentile CDF) are summarized in Table E.8 1.

Enclosure L-12-244 Page 17 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.9 E-74 1st and 2nd paragraphs Based on the responses to RAIs 4.b (see FENOC letter dated June 24, 2011 (ML11180A233) and 5.c, and the revised SAMA Analysis, the first and second paragraphs of ER Section E.9, Conclusions, are revised to read:

The cost-benefit evaluation of SAMA candidates performed for the Davis-Besse license renewal process provided significant insight into the continued operation of Davis-Besse. The results of the evaluation of 167 168 SAMA candidates indicated no enhancements to be potentially one enhancement to be cost-beneficial for implementation at Davis-Besse. The cost-beneficial SAMA candidate is AC/DC-03, which adds a portable diesel-driven battery charger to the DC system.

However, the The sensitivity cases performed for this analysis also found one the same SAMA candidate (AC/DC-03) to be potentially cost-beneficial for implementation at Davis-Besse under the assumptions of the lower discount rate, higher dose rates, higher on-site clean-up costs, increased replacement power costs, increased external event multiplier, reduced evacuation speed, and 95th percentile CDF sensitivity cases. three of the sensitivity cases (low discount rate, replacement power, and multiplier). SAMA candidate AC/DC-03 considered the addition of a portable diesel-driven battery charger for the DC system. While the identified SAMA candidate is not related to plant aging and therefore not a required modification for the license renewal period, FENOC will, nonetheless, consider implementation of this candidate through the normal processes for evaluating possible plant modifications.

Enclosure L-12-244 Page 18 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-6 E-83 Entire Table ER Table E.3-6, Release Severity Source Term Release Fraction, is replaced in its entirety, and reads as follows:

Table E.3-1: Release Severity Source Term Release Fraction Release Category Cesium Iodine % Release 2.1 34.40%

3.4 31.10%

3.2 30.30%

2.2 28.90%

5.2 11.60%

5.4 11.10%

7.2 9.93%

6.2 7.16%

1.2 7.05%

1.4 5.95%

8.2 4.84%

1.3 4.42%

1.1 4.04%

6.1 3.12%

7.1 2.34%

7.6 2.16%

4.2 1.96%

6.4 1.91%

7.8 1.76%

5.1 0.83%

5.3 0.73%

3.1 0.63%

4.4 0.62%

3.3 0.46%

7.5 0.21%

6.3 0.20%

7.4 0.03%

7.3 0.02%

4.1 0.01%

4.3 0.01%

9.2 0.00%

7.7 0.00%

8.1 0.00%

9.1 0.00%

Enclosure L-12-244 Page 19 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-11 E-86 New row ER Table E.3-11, Total (Permanent and Transient) Escalated Population (50-Mile Radius - Davis Besse) for the Year 2040, previously revised by FENOC letter dated June 24, 2011 (ML11180A233), is revised to add a Total Population row at the bottom of the table, and now reads:

Table E.3-11: Total (Permanent and Transient) Escalated Population (50-Mile Radius - Davis-Besse) for the Year 2040 1 2 3 4 5 10 20 30 40 50 Sector mile miles miles miles miles miles miles miles miles miles N 0 0 0 0 0 0 0 0 151518 448232 NNE 6 0 0 0 0 0 0 0 154651 193313 NE 0 0 0 0 0 0 0 0 38663 96657 ENE 0 0 0 0 0 0 828 0 0 0 E 0 0 0 0 0 0 2229 219 0 13561 ESE 0 0 320 0 0 0 11198 50152 20763 104445 SE 662 661 0 0 6786 27558 7443 9301 35612 11828 SSE 661 729 60 71 109 1593 2075 23880 6229 20419 S 4 12 55 328 651 1680 34083 7301 34694 7138 SSW 17 5 82 79 482 5743 4141 6025 26881 12565 SW 37 20 20 469 197 1728 9970 9130 7669 64607 WSW 0 50 0 35 84 1050 8246 12404 47735 14163 W 0 53 72 66 87 847 19318 259606 102087 25871 WNW 683 723 156 0 7274 4821 7009 207932 58896 13460 NW 0 165 595 0 0 1763 0 53092 20356 25771 NNW 20 138 0 0 0 0 0 20080 77289 233548 Total Population 2,909,792

Enclosure L-12-244 Page 20 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-13 E-87 thru E-93 Entire Table ER Table E.3-13, MAAP Output for MACCS2, is replaced in its entirety, to read as follows:

Table E.3-13: MAAP Output for MACCS2 Davis-Besse ST11_RIYVXIN ST12_RIYVXINN ST13_RIYVXINN ST14_RIYVXINN ST21_ISLOCA MAAP Case ID N_52Y-0021a _52Y-0021a _52Y-0021a _52Y-0021a Release Category 1.1 1.2 1.3 1.4 2.1 Core Uncovery OALARM (uncovery) (hrs) 1.67 1.67 1.67 1.67 8.35E-02 (IEVNT(49))

Core Uncovery OALARM (uncovery) (s) 6012 6012 6012 6012 301 (IEVNT(49))

PLHEAT (watts) 3.87E+07 1.45E+07 3.87E+07 1.45E+07 8.91E+06 PLHITE (meters) TDPLHITE 18.44 18.44 18.44 18.44 2.13 RELFRC FREL(1) 1.00E+00 3.70E-01 1.00E+00 3.70E-01 1.00E+00 FREL(2) 4.04E-02 7.05E-02 4.42E-02 5.95E-02 3.44E-01 FREL(3) 1.06E-02 3.05E-02 1.52E-02 2.88E-02 3.18E-01 FREL(4) 2.16E-04 3.93E-05 2.46E-04 8.30E-05 2.64E-02 FREL(5) 3.94E-03 3.36E-03 3.94E-03 3.41E-03 1.03E-02 FREL(6) 1.51E-02 2.90E-02 2.39E-02 2.40E-02 3.20E-01 FREL(7) 1.11E-03 4.81E-04 1.12E-03 5.14E-04 2.27E-02 FREL(8) 6.05E-06 2.43E-06 1.17E-05 1.40E-05 3.53E-03 FREL(9) 4.11E-05 1.10E-05 1.40E-04 1.65E-04 3.85E-02 FREL(10) 3.58E-01 1.16E-02 4.19E-01 8.85E-03 2.56E-01 FREL(11) 7.85E-11 4.97E-06 1.92E-06 2.26E-05 2.96E-03 FREL(12) 3.60E-15 1.14E-08 1.35E-06 1.50E-06 3.25E-04 PDELAY (hrs) 73.80 2.25 73.80 2.25 0.5 PDELAY(s) 265680 8100 265680 8100 1800 PLUDUR (hrs) 74.18 51.39 74.17 29.95 36.07 PLUDUR (s) 267048 185004 267012 107820 129852 End of Release (hrs) 147.98 53.64 147.97 32.20 36.57

Enclosure L-12-244 Page 21 of 49 Table E.3-13: MAAP Output for MACCS2 (continued)

Davis-Besse ST22_ISLOCA ST31_AXI1A_4 ST32_AXI1A_4 ST33_AXI1A_4 ST34_AXI1A_4 MAAP Case ID Release Category 2.2 3.1 3.2 3.3 3.4 Core Uncovery OALARM (uncovery) (hrs) 8.37E-02 8.34E-02 8.39E-02 8.34E-02 8.39E-02 (IEVNT(49))

Core Uncovery OALARM (uncovery) (s) 301 300 302 300 302 (IEVNT(49))

PLHEAT (watts) 6.68E+06 2.22E+06 2.61E+06 2.22E+06 2.61E+06 PLHITE (meters) TDPLHITE 2.13 45.42 45.42 45.42 45.42 RELFRC FREL(1) 9.40E-01 1.00E+00 9.66E-01 9.90E-01 9.92E-01 FREL(2) 2.89E-01 6.34E-03 3.03E-01 4.55E-03 3.11E-01 FREL(3) 2.65E-01 3.61E-03 2.52E-01 3.42E-03 2.73E-01 FREL(4) 4.51E-03 1.17E-04 3.58E-03 1.17E-04 1.56E-02 FREL(5) 1.25E-02 2.10E-04 1.23E-02 2.09E-04 1.31E-02 FREL(6) 2.75E-01 5.94E-03 2.56E-01 4.36E-03 2.81E-01 FREL(7) 1.01E-02 2.40E-04 9.08E-03 2.39E-04 1.48E-02 FREL(8) 1.64E-04 2.55E-06 1.36E-04 2.70E-06 2.82E-03 FREL(9) 6.61E-04 1.20E-05 6.05E-04 1.35E-05 3.24E-02 FREL(10) 1.55E-01 8.62E-03 2.02E-01 4.85E-03 2.62E-01 FREL(11) 2.12E-05 1.99E-07 0.00E+00 1.97E-07 2.28E-03 FREL(12) 1.48E-07 3.34E-10 7.26E-08 1.76E-08 2.80E-04 PDELAY (hrs) 0.58 0.42 0.42 0.42 0.42 PDELAY(s) 2088 1512 1512 1512 1512 PLUDUR (hrs) 14.62 49.52 29.58 9.08 43.38 PLUDUR (s) 52632 178272 106488 32688 156168 End of Release (hrs) 15.20 49.94 30 9.5 43.8

Enclosure L-12-244 Page 22 of 49 Table E.3-13: MAAP Output for MACCS2 (continued)

Davis-Besse ST51_SIYYFYYN ST41_AXI1A_4 ST42_AXI1A_4 ST43_AXI1A_4 ST44_AXI1A_4 MAAP Case ID _36Y-002 Release Category 4.1 4.2 4.3 4.4 5.1 Core Uncovery OALARM (uncovery) (hrs) 8.38E-02 8.38E-02 8.38E-02 8.38E-02 6.68E-01 (IEVNT(49))

Core Uncovery OALARM (uncovery) (s) 302 302 302 302 2405 (IEVNT(49))

PLHEAT (watts) 9.17E+05 2.24E+05 6.77E+05 2.10E+05 3.17E+06 PLHITE (meters) TDPLHITE 2.13 2.13 2.13 2.13 45.42 RELFRC FREL(1) 5.31E-01 5.60E-01 4.69E-01 5.49E-01 9.99E-01 FREL(2) 9.90E-05 1.96E-02 7.73E-05 6.16E-03 8.28E-03 FREL(3) 2.94E-06 1.08E-02 2.64E-06 3.35E-03 1.26E-03 FREL(4) 2.95E-14 7.14E-05 4.92E-09 2.08E-03 3.27E-07 FREL(5) 2.89E-13 1.98E-04 7.90E-09 1.02E-04 7.66E-07 FREL(6) 6.33E-05 1.30E-02 7.46E-05 4.06E-03 1.50E-03 FREL(7) 7.53E-14 1.81E-04 3.43E-08 9.72E-04 1.03E-06 FREL(8) 3.75E-16 2.71E-06 6.18E-10 3.69E-04 1.03E-08 FREL(9) 9.19E-16 1.05E-05 7.73E-09 4.38E-03 2.25E-08 FREL(10) 7.54E-04 7.62E-03 6.81E-04 1.44E-02 8.29E-04 FREL(11) 0.00E+00 0.00E+00 1.40E-04 7.60E-04 5.33E-08 FREL(12) 0.00E+00 0.00E+00 6.44E-09 3.25E-05 1.57E-11 PDELAY (hrs) 12.5 0.58 14 0.58 4.1 PDELAY(s) 45000 2088 50400 2088 14760 PLUDUR (hrs) 37.21 49.14 35.71 49.16 22.50 PLUDUR (s) 133956 176904 128556 176976 81000 End of Release (hrs) 49.71 49.72 49.71 49.74 26.6

Enclosure L-12-244 Page 23 of 49 Table E.3-13: MAAP Output for MACCS2 (continued)

Davis-Besse ST52_TINYNI ST53_SIYYFYYN ST54_TINYNINN ST61_TINYNINN ST62_TINYNINN MAAP Case ID NN_53Y _36Y-002 _53Y _53Y _53Y Release Category 5.2 5.3 5.4 6.1 6.2 Core Uncovery OALARM (uncovery) (hrs) 9.17E-01 6.68E-01 9.17E-01 9.17E-01 9.17E-01 (IEVNT(49))

Core Uncovery OALARM (uncovery) (s) 3301 2405 3301 3301 3301 (IEVNT(49))

PLHEAT (watts) 1.09E+07 2.83E+06 9.59E+06 7.35E+07 1.14E+08 PLHITE (meters) TDPLHITE 45.42 45.42 45.42 2.13 2.13 RELFRC FREL(1) 9.65E-01 9.85E-01 9.95E-01 9.93E-01 9.91E-01 FREL(2) 1.16E-01 7.31E-03 1.11E-01 3.12E-02 7.16E-02 FREL(3) 1.72E-01 1.03E-03 1.71E-01 1.55E-02 3.15E-02 FREL(4) 1.71E-04 1.02E-06 2.50E-02 3.09E-05 3.22E-05 FREL(5) 1.09E-03 7.15E-07 9.33E-04 1.88E-04 1.13E-04 FREL(6) 9.05E-02 1.33E-03 9.12E-02 1.62E-02 2.50E-02 FREL(7) 1.19E-03 1.24E-06 1.21E-02 1.58E-04 2.55E-04 FREL(8) 1.71E-05 2.26E-07 4.10E-03 1.84E-06 3.14E-06 FREL(9) 9.08E-05 2.79E-06 6.37E-02 1.50E-05 1.53E-05 FREL(10) 2.48E-02 7.82E-04 1.91E-01 5.90E-03 1.48E-02 FREL(11) 0.00E+00 1.97E-07 6.29E-03 1.92E-08 4.41E-07 FREL(12) 0.00E+00 2.68E-08 3.68E-04 0.00E+00 0.00E+00 PDELAY (hrs) 2.08 4.1 2.08 2.34 2.42 PDELAY(s) 7488 14760 7488 8424 8712 PLUDUR (hrs) 12.92 5.90 48.02 1.46 37.58 PLUDUR (s) 46512 21240 172872 5256 135288 End of Release (hrs) 15 10 50.1 3.8 40

Enclosure L-12-244 Page 24 of 49 Table E.3-13: MAAP Output for MACCS2 (continued)

Davis-Besse ST63_TINYNIN ST64_TINYNINN ST73_TINYNINN ST71_AXI1A_4 ST72_AXI1A_4 MAAP Case ID N_53Y _53Y _53Y Release Category 6.3 6.4 7.1 7.2 7.3 Core Uncovery OALARM (uncovery) (hrs) 9.17E-01 9.17E-01 8.35E-02 8.35E-02 3.51 (IEVNT(49))

Core Uncovery OALARM (uncovery) (s) 3301 3301 301 301 12636 (IEVNT(49))

PLHEAT (watts) 6.10E+07 1.16E+08 3.02E+07 2.79E+07 2.82E+07 PLHITE (meters) TDPLHITE 2.13 2.13 45.42 45.42 45.42 RELFRC FREL(1) 9.99E-01 9.95E-01 1.00E+00 1.00E+00 9.99E-01 FREL(2) 2.03E-03 1.81E-02 2.34E-02 9.93E-02 2.35E-04 FREL(3) 1.82E-04 1.93E-03 3.96E-03 9.82E-03 1.55E-05 FREL(4) 1.12E-09 2.30E-04 1.14E-08 1.80E-08 4.68E-10 FREL(5) 2.72E-09 1.73E-06 1.98E-08 6.96E-08 6.48E-10 FREL(6) 9.44E-04 2.82E-03 2.31E-02 4.08E-02 4.91E-05 FREL(7) 8.60E-09 1.07E-04 2.90E-08 5.37E-08 2.23E-09 FREL(8) 2.99E-10 4.29E-05 3.40E-10 4.35E-10 2.34E-11 FREL(9) 8.30E-10 8.20E-04 1.29E-09 1.59E-09 2.07E-10 FREL(10) 3.91E-04 2.92E-02 1.50E-02 1.55E-02 1.07E-05 FREL(11) 2.36E-07 1.57E-04 0.00E+00 0.00E+00 0.00E+00 FREL(12) 8.30E-11 6.50E-06 0.00E+00 0.00E+00 0.00E+00 PDELAY (hrs) 11.9 11 29.0 33.3 35.6 PDELAY(s) 42840 39600 104400 119880 128160 PLUDUR (hrs) 48.07 48.04 47.95 47.98 48.00 PLUDUR (s) 173052 172944 172620 172728 172800 End of Release (hrs) 59.97 59.04 76.95 81.28 83.6

Enclosure L-12-244 Page 25 of 49 Table E.3-13: MAAP Output for MACCS2 (continued)

Davis-Besse MAAP Case ST74_TINYNIN ST77_TINYNINN ST78_TINYNINN ST75_AXI1A_4 ST76_AXI1A_4 ID N_53Y _53Y _53Y Release Category 7.4 7.5 7.6 7.7 7.8 Core Uncovery OALARM (uncovery) (hrs) 3.51 8.35E-02 8.36E-02 3.51 3.51 (IEVNT(49))

Core Uncovery OALARM (uncovery) (s) 12636 301 301 12636 12636 (IEVNT(49))

PLHEAT (watts) 2.80E+07 2.01E+07 2.36E+07 1.93E+07 2.45E+07 PLHITE (meters) TDPLHITE 45.42 45.42 45.42 45.42 45.42 RELFRC FREL(1) 1.00E+00 9.97E-01 9.93E-01 9.99E-01 9.89E-01 FREL(2) 3.36E-04 2.06E-03 2.16E-02 1.07E-05 1.76E-02 FREL(3) 3.72E-05 1.80E-05 3.78E-03 5.97E-07 1.69E-03 FREL(4) 4.69E-10 1.16E-08 6.37E-06 5.66E-10 1.10E-05 FREL(5) 6.48E-10 2.07E-08 1.05E-06 6.96E-10 2.95E-07 FREL(6) 2.01E-05 8.58E-04 7.49E-03 1.41E-06 1.37E-03 FREL(7) 2.23E-09 2.95E-08 4.95E-06 2.35E-09 5.78E-06 FREL(8) 2.34E-11 3.44E-10 8.77E-07 4.32E-11 1.86E-06 FREL(9) 2.07E-10 1.33E-09 1.15E-05 4.86E-10 3.64E-05 FREL(10) 1.24E-06 5.66E-03 2.08E-02 2.05E-06 1.90E-02 FREL(11) 0.00E+00 8.59E-08 1.96E-03 2.74E-08 1.03E-03 FREL(12) 0.00E+00 7.84E-12 2.22E-07 7.57E-12 2.96E-07 PDELAY (hrs) 40.8 42 37.2 50.9 42.5 PDELAY(s) 146880 151200 133920 183240 153000 PLUDUR (hrs) 11.90 48.01 48.08 48.01 48.04 PLUDUR (s) 42840 172836 173088 172836 172944 End of Release (hrs) 52.7 90.01 85.28 98.91 90.54

Enclosure L-12-244 Page 26 of 49 Table E.3-13: MAAP Output for MACCS2 (continued)

Davis-Besse ST81_AXI1a_4 ST82_AXI1a_4 ST91_AXI1A_4 ST92_AXI1A_4 MAAP Case ID Release Category 8.1 8.2 9.1 9.2 Core Uncovery OALARM (uncovery) (hrs) 8.36E-02 8.36E-02 8.36E-02 8.34E-02 (IEVNT(49))

Core Uncovery OALARM (uncovery) (s) 301 301 301 300 (IEVNT(49))

PLHEAT (watts) 8.71E+06 9.78E+07 2.63E+02 3.30E+02 PLHITE (meters) TDPLHITE 0.00 0.00 45.42 45.42 RELFRC FREL(1) 9.32E-01 9.93E-01 1.47E-03 1.51E-03 FREL(2) 5.57E-06 4.84E-02 5.66E-07 4.51E-05 FREL(3) 5.03E-07 9.35E-03 4.64E-07 3.38E-05 FREL(4) 2.14E-08 7.64E-05 2.09E-08 6.01E-07 FREL(5) 1.85E-07 7.72E-06 2.00E-07 1.78E-06 FREL(6) 3.17E-06 2.85E-02 5.26E-07 3.49E-05 FREL(7) 5.58E-08 4.63E-05 5.74E-08 1.36E-06 FREL(8) 5.32E-10 1.14E-05 5.11E-10 1.99E-08 FREL(9) 1.60E-09 1.53E-04 1.60E-09 9.08E-08 FREL(10) 2.50E-05 1.92E-02 5.22E-07 3.09E-05 FREL(11) 9.20E-09 1.86E-03 0.00E+00 3.29E-09 FREL(12) 3.00E-12 2.22E-06 0.00E+00 8.69E-12 PDELAY (hrs) 33.2 15.4 0.33 0.5 PDELAY(s) 119520 55440 1188 1800 PLUDUR (hrs) 47.90 47.95 15.27 49.42 PLUDUR (s) 172440 172620 54972 177912 End of Release (hrs) 81.1 63.35 15.6 49.92

Enclosure L-12-244 Page 27 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-18 E-96 Farm & Nonfarm (last 2) columns ER Table E.3-18, Economic Data, the Farmland Property Value for the Region and Nonfarm Property Value for the Region columns, are replaced in their entirety, to read as follows:

Table E.3-18: Economic Data Fraction of Total Annual Farmland Fraction of Nonfarm Farm Sales Farm Sales Property Region Name, Land Devoted Property Value Resulting for the Value for the State to Farming in for the Region from Dairy in Region Region Region ($/person)

Region ($/hectare) ($/hectare)

Crawford, OH 0.854 0.044 1301 7,907 34,979 Erie, OH 0.522 0.025 1186 9,869 82,281 Fulton, OH 0.709 0.086 1802 8,859 59,090 Hancock, OH 0.729 0.032 1007 8,033 56,893 Huron, OH 0.697 0.055 1507 8,540 42,523 Lorain, OH 0.395 0.106 2612 11,120 71,245 Lucas, OH 0.289 0.000 1881 10,751 68,848 Ottawa, OH 0.706 0.019 990 7,144 117,709 Sandusky, OH 0.694 0.024 1081 7,630 54,067 Seneca, OH 0.764 0.021 985 7,719 37,526 Wood, OH 0.698 0.044 1125 8,300 70,940 Lenawee, MI 0.727 0.244 1142 7,902 23,140 Monroe, MI 0.591 0.011 1547 9,454 34,958 Wayne, MI 0.045 0.000 4074 19,128 28,338

Enclosure L-12-244 Page 28 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-19 E-96 Entire table ER Table E.3-19, MACCS2 Economic Parameters Used in CHRONC, is replaced in its entirety, to read as follows:

Table E.3-19: MACCS2 Economic Parameters Used in CHRONC Value Variable Description (in Davis-Besse model)

DPRATE Property depreciation rate (/year) 0.20 DSRATE Investment rate of return (/year) 0.12 POPCST Population relocation cost ($/person) $9,750/person Cost of farm decontamination for various levels of $1,096.90/hectare, CDFRM0 decontamination ($/hectare) $2,437.50/hectare Cost of non-farm decontamination per person for various $5,850/person, CDNFRM levels of decontamination ($/person) $15,600/person DLBCST Average cost of decontamination labor ($/person-year) $68,250/person-year Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-20 E-97 Release Category rows 2.1 and 2.2 ER Table E.3-20, Frequency Vector, Release Category rows 2.1 and 2.2, Frequency (/year) column data are reversed, and the rows are revised to read as follows:

Release Category Frequency (/year) Percent 2.1 5.4E-08 6.0E-09 0.06%

2.2 6.0E-09 5.4E-08 0.53%

Enclosure L-12-244 Page 29 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-21 E-98 Entire table ER Table E.3-21, Base Case Results for Internal Events at 50 Miles, previously revised by FENOC letter dated June 24, 2011 (ML11180A233), is replaced in its entirety, and now reads:

Table E.3-21: Base Case Results for Internal Events at 50 Miles Release Whole Body Dose Economic Impact Category (50, rem)/yr (50, $)/yr 1.1 4.29E-02 5.70E+01 1.2 2.41E-02 5.15E+01 1.3 1.28E+00 2.23E+03 1.4 2.12E-03 4.20E+00 2.1 4.89E-02 6.78E+01 2.2 3.05E-01 5.10E+02 3.1 2.43E-03 1.44E+00 3.2 1.52E-04 2.62E-01 3.3 1.90E-05 9.05E-03 3.4 1.27E-02 1.84E+01 4.1 2.47E-05 5.25E-03 4.2 4.69E-02 5.92E+01 4.3 3.03E-07 6.00E-05 4.4 1.05E-02 1.54E+01 5.1 9.69E-03 4.26E+00 5.2 1.15E-02 2.46E+01 5.3 7.67E-04 3.78E-01 5.4 6.51E-03 7.70E+00 6.1 5.68E-04 8.62E-01 6.2 5.68E-05 1.13E-01 6.3 9.45E-04 3.09E-01 6.4 2.44E-02 1.36E+01 7.1 2.17E-05 4.55E-02 7.2 1.05E-03 2.65E+00 7.3 3.83E-08 5.32E-06 7.4 2.24E-05 3.98E-03 7.5 5.72E-06 2.05E-03 7.6 2.11E-02 1.55E+01 7.7 4.25E-08 8.86E-07 7.8 3.68E-02 1.60E+01 8.1 1.32E-04 2.33E-03

Enclosure L-12-244 Page 30 of 49 Release Whole Body Dose Economic Impact Category (50, rem)/yr (50, $)/yr 8.2 2.08E-01 4.88E+02 9.1 1.92E-03 2.03E-06 9.2 1.75E-02 2.25E+00 Total 2.12E+00 3.59E+03

Enclosure L-12-244 Page 31 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-22 E-99 Entire table ER Table E.3-22, Base Case Consequence Input to SAMA Analysis, previously revised by FENOC letter dated June 24, 2011 (ML11180A233), is replaced in its entirety, and now reads:

Table E.3-22: Base Case Consequence Input to SAMA Analysis Release Whole Body Dose Economic Impact Category (50, rem) (50, $)

1.1 1.95E+06 2.59E+09 1.2 1.85E+06 3.96E+09 1.3 2.17E+06 3.78E+09 1.4 1.77E+06 3.50E+09 2.1 8.15E+06 1.13E+10 2.2 5.64E+06 9.45E+09 3.1 9.73E+05 5.77E+08 3.2 5.44E+06 9.36E+09 3.3 7.58E+05 3.62E+08 3.4 7.48E+06 1.08E+10 4.1 2.47E+04 5.25E+06 4.2 1.38E+06 1.74E+09 4.3 2.75E+04 5.45E+06 4.4 1.36E+06 2.00E+09 5.1 3.34E+05 1.47E+08 5.2 3.02E+06 6.47E+09 5.3 2.74E+05 1.35E+08 5.4 7.31E+06 8.65E+09 6.1 1.29E+06 1.96E+09 6.2 1.72E+06 3.41E+09 6.3 2.10E+05 6.87E+07 6.4 7.86E+05 4.39E+08 7.1 1.55E+06 3.25E+09 7.2 1.85E+06 4.65E+09 7.3 1.74E+04 2.42E+06 7.4 9.32E+03 1.66E+06 7.5 2.12E+05 7.60E+07 7.6 1.11E+06 8.17E+08 7.7 1.18E+03 2.46E+04 7.8 3.76E+05 1.63E+08 8.1 2.10E+03 3.70E+04

Enclosure L-12-244 Page 32 of 49 Release Whole Body Dose Economic Impact Category (50, rem) (50, $)

8.2 1.60E+06 3.75E+09 9.1 2.53E+02 2.67E-01 9.2 1.25E+04 1.61E+06 Total 6.07E+07 9.34E+10

Enclosure L-12-244 Page 33 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Tables E.3-23 E-100 & E-101 Entire Tables (10 tables) through E.3-32 ER Tables E.3-23 through E.3-32, Comparison of Base Case and Case [XX],

previously revised by FENOC letter dated June 24, 2011 (ML11180A233), are replaced in their entirety, with the exception of Table E.3-27, Comparison of Base Case and Case M2, which is no longer used and is deleted, and the tables read as follows:

Table E.3-23: Comparison of Base Case and Case S1 Internal Events Base S1  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.32E+00 9.4%

Economic Impact (50) ($/yr) 3.59E+03 3.92E+03 9.2%

Table E.3-24: Comparison of Base Case and Case S2 Internal Events Base S2  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 1.88E+00 -11.3%

Economic Impact (50) ($/yr) 3.59E+03 3.20E+03 -10.9%

Table E.3-25: Comparison of Base Case and Case S3 Internal Events Base S3  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.18E+00 2.8%

Economic Impact (50) ($/yr) 3.59E+03 3.59E+03 0.0%

Table E.3-26: Comparison of Base Case and Case M1 Internal Events Base M1  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.11E+00 -0.5%

Economic Impact (50) ($/yr) 3.59E+03 3.63E+03 1.1%

Enclosure L-12-244 Page 34 of 49 Table E.3-27: Comparison of Base Case and Case M2

[Table E.3-27 is not used, and is deleted.]

Table E.3-28: Comparison of Base Case and Case A1 Internal Events Base A1  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.05E+00 -3.3%

Economic Impact (50) ($/yr) 3.59E+03 3.40E+03 -5.3%

Table E.3-29: Comparison of Base Case and Case A2 Internal Events Base A2  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.12E+00 0.0%

Economic Impact (50) ($/yr) 3.59E+03 3.59E+03 0.0%

Table E.3-30: Comparison of Base Case and Case A3 Internal Events Base A3  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.12E+00 0.0%

Economic Impact (50) ($/yr) 3.59E+03 3.59E+03 0.0%

Table E.3-31: Comparison of Base Case and Case E1 Internal Events Base E1  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.11E+00 -0.5%

Economic Impact (50) ($/yr) 3.59E+03 3.59E+03 0.0%

Table E.3-32: Comparison of Base Case and Case E2 Internal Events Base E2  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 1.62E+00 -23.6%

Economic Impact (50) ($/yr) 3.59E+03 2.16E+03 -39.8%

Enclosure L-12-244 Page 35 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-33 E-101 Entire table Based on the revised response to RAI 4.d, ER Table E.3-33, Comparison of Base Case and Case E3, previously added in response to RAI 6.j (see revised response to RAI 6.j in this letter) by FENOC letter dated June 24, 2011 (ML11180A233), reads as follows:

Table E.3-33: Comparison of Base Case and Case E3 Internal Events Base S1  % diff.

Whole Body Dose (50) (person-rem/yr) 2.12E+00 2.12E+00 0.0%

Economic Impact (50) ($/yr) 3.59E+03 3.59E+03 0.0%

Enclosure L-12-244 Page 36 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.4-1 E-101 Entire table Based on the responses to RAIs 3.c and 4.b (see FENOC letter dated June 24, 2011 (ML11180A233), and the revised SAMA Analysis, ER Table E.4-1, Total Cost of Severe Accident Impact, is revised to read as follows:

Table E.4-1: Total Cost of Severe Accident Impact APE $52,025 AOC $44,049 AOE $4,340 AOSC $266,279 Severe Accident Impact

$366,693 (Internal Events)

Fire, Seismic, Other $1,686,788 Maximum Benefit

$2,053,481 (Internal Events, Fire, Seismic, Other)

Enclosure L-12-244 Page 37 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.5-4 E-144 thru 154 6 rows revised; 1 new row In response to RAIs 5.c and 5.f (see FENOC letter dated June 24, 2011 (ML11180A233), ER Table E.5-4, List of Initial SAMA Candidates, is revised as follows:

Table E.5-4: List of Initial SAMA Candidates SAMA Candidate SAMA Candidate Description Derived Benefit Source Identifier This SAMA candidate would provide [2, Table 14]

Install pressure measurements indication of failure of inboard isolation [Table E.5-2]

CB-21 between the two DHR suction valves valves allowing time to initiate in the line from the RCS hot leg.

mitigating actions to prevent ISLOCA.

This SAMA candidate will increase the [Table E.5-1]

Provide automatic switchover of HPI reliability of switchover of suction from CC-19 and LPI suction from the BWST to the BWST to the containment sump by containment sump for LOCAs. providing both manual and automatic switchover.

This SAMA candidate would increase Davis-Besse containment heat removal ability. containment SAMA candidate CP-19 was added cooling design Install a redundant containment fan CP-19 as a variation to CP-18 to provide a system.

redundant containment cooling function, in the form of containment fan coolers.

This SAMA candidate would improve [Table E.5-1]

Replace the standby CCW pump CCW reliability by reducing the [Table E.5-2]

CW-24 with a pump diverse from the other likelihood of a CCF of all three CCW two CCW pumps.

pumps.

Provide the ability to cool make-up This SAMA candidate would allow [Table E.5-1]

CW-25 pumps using fire water in the event continued injection of RCP seal water in [Table E.5-2]

of loss of CCW. the event of loss of CCW.

This SAMA candidate would improve [2, Table 14]

Perform surveillances on manual the success probability for providing an [Table E.5-1]

FW-16 valves used for backup AFW pump alternate water supply to the AFW [Table E.5-2]

suction.

pumps.

PRA results show that operator actions Table E.5-2 Provide operator training with are significant contributors to overall PRA-identified high risk important plant risk. By highlighting those OT-09R human actions to be emphasized in operator actions shown to have the training. highest risk importance, the reliability of those actions will be improved.

Enclosure L-12-244 Page 38 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.6-1 E-155 thru 180 8 rows revised, and 1 new row In response to RAIs 5.c, 5.g, 5.h, 6.b (for RAIs 5.h and 6.b, see FENOC letter dated June 24, 2011 (ML11180A233), and 6.k, and to align with current FENOC plans and with the discussions in the ER regarding the steam generator replacement schedule, Table E.6-1, Qualitative Screening of SAMA Candidates, is revised as follows:

Table E.6-1: Qualitative Screening of SAMA Candidates Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

This SAMA would reduce the risk of ISLOCA events by improving the likelihood of timely identification and diagnosis of ISLOCA events Criterion E and thereby increasing the likelihood of successful mitigating actions. This SAMA will be subsumed in CB-07.

Improve operator training on Subsumed CB-08 Davis-Besse has several procedures in place to address small and ISLOCA coping. Criterion B interfacing system LOCAs. Operators receive training on LOCAs, Already Implemented and there are a number of indications to support the likelihood and timely identification and diagnosis of ISLOCA events (including tank level indications, lifting relief valves, and running sump pumps).

Institute a maintenance practice to Davis-Besse is scheduled to replace the steam generators in 2013 perform a 100% inspection of Criterion D 2014, which would result in inspecting new steam generator tubes.

CB-09 steam generator tubes during Very Low Benefit Therefore, this SAMA candidate is considered very low benefit for each refueling outage. Davis-Besse.

Criterion B Davis-Besse is scheduled to replace the steam generators in 2013 Replace steam generators with a CB-10 2014. Therefore, the intent of the SAMA candidate has already new design. Already Implemented been implemented at Davis-Besse.

Enclosure L-12-244 Page 39 of 49 Table E.6-1: Qualitative Screening of SAMA Candidates (continued)

Modification SAMA ID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Davis-Besse currently has the ability to initiate automatic switchover Add the ability to automatically Criterion E from the BWST to the containment sump on low BWST level, but CC-08 align ECCS to recirculation mode this feature has been deactivated. The cost would by minor to upon BWST depletion. Subsumed reactivate this feature. This SAMA candidate will be subsumed in SAMA candidate CC-19.

Davis-Besse currently has the ability to initiate automatic switchover Provide automatic switchover of Criterion F from the BWST to the containment sump on low BWST level, but HPI and LPI suction from the CC-19 this feature has been deactivated. The cost would by minor to BWST to containment sump for Considered for Further Evaluation reactivate this feature. Therefore, this SAMA candidate is LOCAs.

considered for further evaluation.

Based on the top 100 cutsets and component basic event importance, circulating water breaks are not a significant risk Criterion D contributor at Davis-Besse.

Improve inspection of rubber Very Low Benefit FL-01 expansion joints on main The circulating water joints are currently inspected during outages, condenser. Criterion B and include both interior and exterior inspections. Exterior Already Implemented inspections of the visible portion of the expansion joint are performed during Engineering system walkdowns and Operator tours.

Additionally, the expansion joints are periodically replaced.

Criterion D No deficiencies in operator training or feedback are identified.

Increase training and operating Very Low Benefit FENOC provides PRA information, such as risk-significant initiating OT-05 experience feedback to improve events, high worth operator actions and high worth equipment, to operator response. Criterion B various departments, including Operations Training, and presents Already Implemented this information on posters throughout the plant.

Criterion D Steam line breaks are not a significant contributor to CDF or LERF.

Install secondary side guard pipes OT-07 The derived benefit would not justify the implementation cost up to the MSIVs. Very Low Benefit required.

Provide operator training with Davis-Besse provides PRA information such as risk significant PRA-identified high risk important Criterion B initiating events, high worth operator actions and high worth OT-09R human actions to be emphasized Already Implemented equipment. This information is provided to various departments and in training. is presented on posters throughout the plant.

Enclosure L-12-244 Page 40 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.7-2 E-183 - 185 Entire table ER Table E.7-3 E-186 Entire table ER Table E.7-5 E-188 Entire table ER Table E.8-1 E-189 - 190 Entire table Based on the responses to RAIs 3.c and 4.b (see FENOC letter dated June 24, 2011 (ML11180A233), and the revised SAMA Analysis, ER Tables E.7-2, E.7-3, E.7-5 and E.8-1 are replaced in their entirety, to read as shown on the following pages:

Enclosure L-12-244 Page 41 of 49 Table E.7-2: Internal Events Benefit Results for Analysis Case Case Maximum Benefit AC/DC-01 AC/DC-03 AC/DC-14 (DCBattery) (Battery Charger) (GasTurbineGen)

Off-site Annual Dose (rem) 2.12E+00 2.08E+00 1.87E+00 1.78E+00 Off-site Annual Property Loss ($) 3.59E+03 3.53E+03 3.17E+03 3.02E+03 Comparison CDF ---- 1.0E-05 1.0E-05 1.0E-05 Comparison Dose (rem) ---- 2.12E+00 2.12E+00 2.12E+00 Comparison Cost ($) ---- 3.59E+03 3.59E+03 3.59E+03 Enhanced CDF ---- 9.4E-06 7.8E-06 9.0E-06 Reduction in CDF ---- 6.00% 22.00% 10.00%

Reduction in Off-site Dose ---- 1.89% 11.79% 16.04%

Immediate Dose Savings (On-site) $810 $49 $178 $81 Long Term Dose Savings (On-site) $3,530 $212 $777 $353 Total Accident Related Occupational

$4,340 $260 $955 $434 Exposure (AOE)

Cleanup/Decontamination Savings (On-site) $132,362 $7,942 $29,120 $13,236 Replacement Power Savings (On-site) $133,917 $8,035 $29,462 $13,392 Averted Costs of On-site Property Damage

$266,279 $15,977 $58,581 $26,628 (AOSC)

Total On-site Benefit $270,619 $16,237 $59,536 $27,062 Averted Public Exposure (APE) $52,025 $982 $6,135 $8,344 Averted Off-site Damage Savings (AOC) $44,049 $736 $5,153 $6,994 Total Off-site Benefit $96,074 $1,718 $11,288 $15,338 Total Benefit (On-site + Off-site) $366,693 $17,955 $70,824 $42,399

Enclosure L-12-244 Page 42 of 49 Table E.7-2: Internal Events Benefit Results for Analysis Case (continued)

Case AC/DC-19 AC/DC-21 AC/DC-25 AC/DC-26 (FireWaterBackup) (RepairBreakers) (DedDCPower) (Generator TDAFW)

Off-site Annual Dose (rem) 2.08E+00 2.11E+00 2.05E+00 2.05E+00 Off-site Annual Property Loss ($) 3.54E+03 3.58E+03 3.48E+03 3.48E+03 Comparison CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Comparison Dose (rem) 2.12E+00 2.12E+00 2.12E+00 2.12E+00 Comparison Cost ($) 3.59E+03 3.59E+03 3.59E+03 3.59E+03 Enhanced CDF 9.8E-06 9.7E-06 8.5E-06 8.5E-06 Reduction in CDF 2.00% 3.00% 15.00% 15.00%

Reduction in Off-site Dose 1.89% 0.47% 3.30% 3.30%

Immediate Dose Savings (On-site) $16 $24 $121 $121 Long Term Dose Savings (On-site) $71 $106 $529 $529 Total Accident Related Occupational Exposure

$87 $130 $651 $651 (AOE)

Cleanup/Decontamination Savings (On-site) $2,647 $3,971 $19,854 $19,854 Replacement Power Savings (On-site) $2,678 $4,018 $20,088 $20,088 Averted Costs of On-site Property Damage

$5,326 $7,988 $39,942 $39,942 (AOSC)

Total On-site Benefit $5,412 $8,119 $40,593 $40,593 Averted Public Exposure (APE) $982 $245 $1,718 $1,718 Averted Off-site Damage Savings (AOC) $614 $123 $1,350 $1,350 Total Off-site Benefit $1,595 $368 $3,068 $3,068 Total Benefit (On-site + Off-site) $7,007 $8,487 $43,660 $43,660

Enclosure L-12-244 Page 43 of 49 Table E.7-2: Internal Events Benefit Results for Analysis Case (continued)

Case AC/DC-27 CB-21 CC-01 CC-04 (SBO_DieselTank) (DHR_valves) (HPI_System) (LPI_pump)

Off-site Annual Dose (rem) 2.12E+00 2.00E+00 2.10E+00 2.12E+00 Off-site Annual Property Loss ($) 3.59E+03 3.40E+03 3.58E+03 3.59E+03 Comparison CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Comparison Dose (rem) 2.12E+00 2.12E+00 2.12E+00 2.12E+00 Comparison Cost ($) 3.59E+03 3.59E+03 3.59E+03 3.59E+03 Enhanced CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Reduction in CDF 0.00% 0.00% 0.00% 0.00%

Reduction in Off-site Dose 0.00% 5.66% 0.94% 0.00%

Immediate Dose Savings (On-site) $0 $0 $0 $0 Long Term Dose Savings (On-site) $0 $0 $0 $0 Total Accident Related Occupational

$0 $0 $0 $0 Exposure (AOE)

Cleanup/Decontamination Savings (On-site) $0 $0 $0 $0 Replacement Power Savings (On-site) $0 $0 $0 $0 Averted Costs of On-site Property Damage

$0 $0 $0 $0 (AOSC)

Total On-site Benefit $0 $0 $0 $0 Averted Public Exposure (APE) $0 $2,945 $491 $0 Averted Off-site Damage Savings (AOC) $0 $2,331 $123 $0 Total Off-site Benefit $0 $5,276 $614 $0 Total Benefit (On-site + Off-site) $0 $5,276 $614 $0

Enclosure L-12-244 Page 44 of 49 Table E.7-2: Internal Events Benefit Results for Analysis Case (continued)

Case CC-05 CC-19 HV-01 HV-03 (LPI_Diesel_pump) (BWST_to_Sump) (Redundant_HVAC) (Backup_fans)

Off-site Annual Dose (rem) 2.12E+00 2.12E+00 2.11E+00 2.11E+00 Off-site Annual Property Loss ($) 3.59E+03 3.59E+03 3.59E+03 3.59E+03 Comparison CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Comparison Dose (rem) 2.12E+00 2.12E+00 2.12E+00 2.12E+00 Comparison Cost ($) 3.59E+03 3.59E+03 3.59E+03 3.59E+03 Enhanced CDF 1.0E-05 9.9E-06 1.0E-05 1.0E-05 Reduction in CDF 0.00% 1.00% 0.00% 0.00%

Reduction in Off-site Dose 0.00% 0.00% 0.47% 0.47%

Immediate Dose Savings (On-site) $0 $8 $0 $0 Long Term Dose Savings (On-site) $0 $35 $0 $0 Total Accident Related Occupational

$0 $43 $0 $0 Exposure (AOE)

Cleanup/Decontamination Savings (On-site) $0 $1,324 $0 $0 Replacement Power Savings (On-site) $0 $1,339 $0 $0 Averted Costs of On-site Property Damage

$0 $2,663 $0 $0 (AOSC)

Total On-site Benefit $0 $2,706 $0 $0 Averted Public Exposure (APE) $0 $0 $245 $245 Averted Off-site Damage Savings (AOC) $0 $0 $0 $0 Total Off-site Benefit $0 $0 $245 $245 Total Benefit (On-site + Off-site) $0 $2,706 $245 $245

Enclosure L-12-244 Page 45 of 49 Table E.7-3: Total Benefit Results for Analysis Case Maximum Benefit AC/DC-01 AC/DC-03 AC/DC-14 AC/DC-19 AC/DC-21 (DCBattery) (Battery Charger) (GasTurbineGen) (FireWaterBackup) (RepairBreakers)

Internal Events $366,693 $17,955 $70,824 $42,399 $7,007 $8,487 Fires, Seismic, Other $1,686,788 $82,593 $325,792 $195,037 $32,234 $39,039 Total Benefit $2,053,481 $100,547 $396,617 $237,436 $39,242 $47,525 AC/DC-25 AC/DC-26 AC/DC-27 CB-21 CC-01 (DedDCPower) (Generator_TDAFW) (SBO_DieselTank) (DHR_valves) (HPI_System)

Internal Events $43,660 $43,660 $0 $5,276 $614 Fires, Seismic, Other $200,837 $200,837 $0 $24,270 $2,822 Total Benefit $244,497 $244,497 $0 $29,546 $3,436 CC-04 CC-05 CC-19 HV-01 HV-03 (LPI_pump) (LPI_Dieselpump) (BWST_to_Sump) (Redundant_HVAC) (Backup_fans)

Internal Events $0 $0 $2,706 $245 $245 Fires, Seismic, Other $0 $0 $12,448 $1,129 $1,129 Total Benefit $0 $0 $15,155 $1,374 $1,374

Enclosure L-12-244 Page 46 of 49 Table E.7-5: Final Results of Cost Benefit Evaluation SAMA 2009 Estimated Candidate Modification Estimate Conclusion Benefit ID Cost Provide additional DC battery AC/DC-01 $100,547 $1,750,000 Not Cost Effective capacity.

Add a portable, diesel-driven AC/DC-03 battery charger to existing DC $396,617 $330,000 Cost Effective system.

AC/DC-14 Install a gas turbine generator. $237,436 $2,000,000 Not Cost Effective Use fire water system as a AC/DC-19 $39,242 $700,000 Not Cost Effective backup source for diesel cooling.

Develop procedures to repair or AC/DC-21 $47,525 $100,000 Not Cost Effective replace failed 4kV breakers.

Provide a dedicated DC power system (battery/battery charger)

AC/DC-25 for the TDAFW control valve and $244,497 $2,000,000 Not Cost Effective NNI-X for steam generator level indication.

Provide an alternator/generator AC/DC-26 that would be driven by each $244,497 $2,000,000 Not Cost Effective TDAFW pump.

Increase the size of the SBO fuel AC/DC-27 $0 $550,000 Not Cost Effective oil tank.

Install pressure measurements between the two DHR suction CB-21 $29,546 $550,000 Not Cost Effective valves in the line from the RCS hot leg.

Install an independent active or CC-01 $3,436 $6,500,000 Not Cost Effective passive HPI system.

CC-04 Add a diverse LPI system. $0 $5,500,000 Not Cost Effective Provide capability for alternate CC-05 $0 $6,500,000 Not Cost Effective LPI via diesel-driven fire pump.

Provide automatic switchover of HPI and LPI suction from the CC-19 $15,155 $1,500,000 Not Cost Effective BWST to containment sump for LOCAs.

Provide a redundant train or HV-01 $1,374 $50,000 Not Cost Effective means of ventilation.

Stage backup fans in switchgear HV-03 $1,374 $400,000 Not Cost Effective rooms.

Enclosure L-12-244 Page 47 of 49 Table E.8-1: Final Results of the Sensitivity Cases SAMA Low High On-site On-site 2009 Repair Candidate Discount Discount Dose Cleanup Estimated Conclusion Case ID Rate Case Rate Case Case Case Cost AC/DC-01 $64,551 $152,033 $69,662 $102,023 $115,372 $1,750,000 Not Cost Effective AC/DC-03 $264,628 $600,596 $276,817 $402,026 $450,974 $330,000 Cost Effective AC/DC-14 $177,442 $361,238 $169,575 $239,895 $262,144 $2,000,000 Not Cost Effective AC/DC-19 $27,243 $59,518 $27,604 $39,734 $44,183 $700,000 Not Cost Effective AC/DC-21 $29,527 $71,774 $32,727 $48,263 $54,938 $100,000 Not Cost Effective AC/DC-25 $154,505 $369,476 $168,897 $248,186 $281,559 $2,000,000 Not Cost Effective AC/DC-26 $154,505 $369,476 $168,897 $248,186 $281,559 $2,000,000 Not Cost Effective AC/DC-27 $0 $0 $0 $0 $0 $550,000 Not Cost Effective CB-21 $29,546 $45,615 $22,616 $29,546 $29,546 $550,000 Not Cost Effective CC-01 $3,436 $5,304 $2,630 $3,436 $3,436 $6,500,000 Not Cost Effective CC-04 $0 $0 $0 $0 $0 $5,500,000 Not Cost Effective CC-05 $0 $0 $0 $0 $0 $6,500,000 Not Cost Effective CC-19 $9,155 $22,864 $10,383 $15,401 $17,625 $1,500,000 Not Cost Effective HV-01 $1,374 $2,122 $1,052 $1,374 $1,374 $50,000 Not Cost Effective HV-03 $1,374 $2,122 $1,052 $1,374 $1,374 $400,000 Not Cost Effective

Enclosure L-12-244 Page 48 of 49 Table E.8-1: Final Results of the Sensitivity Cases (continued)

SAMA 2009 Replacement Multiplier Evacuation 95th Percentile Candidate Estimated Conclusion Power Case Case Speed CDF ID Cost AC/DC-01 $130,750 $143,639 $100,547 $145,794 $1,750,000 Not Cost Effective AC/DC-03 $507,358 $566,596 $396,617 $575,095 $330,000 Cost Effective AC/DC-14 $287,773 $339,195 $237,436 $344,283 $2,000,000 Not Cost Effective AC/DC-19 $49,309 $56,060 $39,242 $56,901 $700,000 Not Cost Effective AC/DC-21 $62,626 $67,893 $47,525 $68,912 $100,000 Not Cost Effective AC/DC-25 $320,003 $349,282 $244,497 $354,521 $2,000,000 Not Cost Effective AC/DC-26 $320,003 $349,282 $244,497 $354,521 $2,000,000 Not Cost Effective AC/DC-27 $0 $0 $0 $0 $550,000 Not Cost Effective CB-21 $29,546 $42,209 $29,546 $42,842 $550,000 Not Cost Effective CC-01 $3,436 $4,908 $3,436 $4,982 $6,500,000 Not Cost Effective CC-04 $0 $0 $0 $0 $5,500,000 Not Cost Effective CC-05 $0 $0 $0 $0 $6,500,000 Not Cost Effective CC-19 $20,188 $21,649 $15,155 $21,974 $1,500,000 Not Cost Effective HV-01 $1,374 $1,963 $1,374 $1,993 $50,000 Not Cost Effective HV-03 $1,374 $1,963 $1,374 $1,993 $400,000 Not Cost Effective

Enclosure L-12-244 Page 49 of 49 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.11 E-194 New references In response to RAI 3.c, ER Section E.11, References, is revised to include two new references cited in revised ER Section E.4.5, as follows:

39. Nuclear Regulatory Commission, Requests for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit 1, License Renewal Application, Accession Number ML110910566, April 20, 2011.

40. Nuclear Regulatory Commission, Results of Safety/Risk Assessment of Generic Issue 199, Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants, Accession Number ML100270582, September 7, 2010.

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 6 Letter from K. Byrd, FirstEnergy, to NRC Document Control Desk, Reply to Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No. 1, License Renewal Application (TAC No. ME4613), Environmental Report Severe Accident Mitigation Alternatives Analysis, and License Renewal Application Amendment No. 10 (June 24, 2011)

FENOC ~

Davis-Besse Nuclear Power Station 5501 N. State Route 2 FirstEnergy Nuclear Operating Company Oak Harbor. Ohio 43449 June 24, 2011 L-11-154 10 CFR 54 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Davis-Besse Nuclear Power Station, Unit No.1 Docket No. 50-346, License Number NPF-3 Reply to Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station. Unit No.1. License Renewal Application (TAC No. ME4613)

Environmental Report Severe Accident Mitigation Alternatives Analysis. and License Renewal Application Amendment No.1 0 By letter dated August 27,2010, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML102450565), FirstEnergy Nuclear Operating Company (FENOC) submitted an application pursuant to Title 10 of the Code of Federal Regulations, Part 54 for renewal of Operating License NPF-3 for the Davis-Besse Nuclear Power Station, Unit No.1 (DBNPS). By letter dated April 20,2011 (ADAMS Accession No. ML110910566), the Nuclear Regulatory Commission (NRC) requested additional information to complete its review of the License Renewal Application (LRA).

The Attachment provides the FENOC reply to the NRC request for additional information.

The NRC request is shown in bold text followed by the FENOC response. The Enclosure provides Amendment No.1 0 to the DBNPS LRA. The due date for this reply was changed from June 20 to June 24, 2011, as mutually agreed to by Ms. Paula Cooper, NRC Environmental Project Manager, on June 17, 2011.

There are no regulatory commitments contained in this letter. If there are any questions or if additional information is required, please contact Mr. Clifford I. Custer, Fleet License Renewal Project Manager, at 724-682-7139.

Davis-Besse Nuclear Power Station, Unit No.1 L-11-154 Page 2 I declare under penalty of perjury that the foregoing is true and correct. Executed on June .1.!L, 2011.

Sincerely, Kendall W. By Director, Site erformance Improvement

Attachment:

Reply to Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No.1, License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis

Enclosure:

Amendment No.1 0 to the DBNPS License Renewal Application cc: NRC DLR Project Manager NRC DLR Environmental Project Manager NRC Region III Administrator cc: wlo Attachment or Enclosure NRC DLR Director NRR DORL Project Manager NRC Resident Inspector Utility Radiological Safety Board

Attachment L-11-154 Reply to Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No.1, License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives Analysis Page 1 of 92 Item 1 Provide the following information regarding the Level 1 Probabilistic Risk Assessment (PRA) used for the Severe Accident Mitigation Alternatives (SAMA) analysis:

Question RAI 1.a Environmental Report (ER) Section E.3.1.1.2 explains that the SAMA evaluation is based on an updated version of the Davis-Besse Revision 4 PRA model that takes advantage of a 2008 "gap self assessment." This model, referred to as the "SAMA Analysis Model" represents a "freeze date" of July 9, 2009 for plant configuration, August 1, 2006 for component failure data and initiating event data, April 30, 2007 for equipment availability, and January 1, 2006 for non-Maintenance Rule unavailability. Identify any changes to the plant (physical and procedural modifications) since July 9,2009 that could have a significant impact on the results of the PRA and/or SAMA analyses. Provide an assessment of their impact on the PRA and on the results of the SAMA evaluation.

RESPONSE RAI 1.a As discussed in the response to RAI 1.c, below, plant changes are tracked for subsequent PRA updates. While there have been some plant changes since the SAMA model, no changes have been identified that have a significant impact on the PRA results or SAMA evaluation. Based on FirstEnergy Nuclear Operating Company (FENOC) Nuclear Operating Business Practice NOBP-CC-6001, "PRA Model Management," plant changes are evaluated to determine if they would cause a change of greater than 10 percent core damage frequency (CDF), or greater than 20 percent large early release frequency (LERF); there have been no changes that meet this criteria since the SAMA model.

Attachment L-11-154 Page 2 of 92 Question RAI 1.b ER Section E.3.1.1.2 describes the PRA model history from 1993, when the IPE was issued, to July 2009 when the SAMA Analysis Model became effective. This section specifically discusses the model updates to Revision 2, 3, 4, and the SAMA Analysis Model. This section does not discuss the model revision from the IPE to the Revision 0, when the largest decrease in internal events CDF occurred (i.e., a decrease from 6.6E-OS/yr to 1.4E-OS/yr), or the update to Revision 1. Also, the reason for the drop in internal events CDF between the Revision 3 and 4 PRA models of approximately a factor of three is not apparent from the model update discussion. Provide a discussion of the PRA model changes that most impacted the change in total internal events CDF for the Revision 0,1, and 4 PRA models.

Also provide the effective dates of the Revision 0, 1, and 2 PRA models.

RESPONSE RA11.b The second underlined section in Environmental Report (ER) Section E.3.1.1.2 is titled "Davis-Besse PRA, Revision 0 - CDF = 1.4E-05/yr to Revision 2 CDF = 1 .7E-05/yr and

=

LERF 7.3E-OB/yr"; this section discusses changes made in the PRA Revision 0, PRA Revision 1 and PRA Revision 2 models, collectively. The largest decrease in risk, from the Individual Plant Examination (IPE) CDF of 6.5E-05/yr, to the PRA Revision 0 CDF of 1.4E-05/yr, is primarily due to a reduction in transient frequencies for the reactor/turbine trip (T1) and the loss of main feedwater (T2 ) transients. The slight increase in risk from the PRA Revision 0 CDF of 1 .4E-05/yr, to the PRA Revision 1 CDF of 1.6E-05/yr is primarily associated with a data update.

Subsequent PRA revisions are also discussed in ER Section E.3.1.1.2. The decrease in risk from the PRA Revision 3 CDF of 1 .3E-05/yr, to the PRA Revision 4 CDF of 4.7E-06/yr is primarily associated with increasing the time operators have to trip the reactor coolant pumps (RCPs) following a loss of seal cooling (supplied by the Component Cooling Water (CCW) System), and a data update.

The IPE was completed in February 1993; the PRA Quantification Notebook was signed off in March 1999 for PRA Revision 0, August 1999 for PRA Revision 1, October 1999 for PRA Revision 2, and September 2007 for PRA Revision 4. These are the effective dates for each PRA revision.

Attachment L-11-154 Page 3 of 92 Question RAI 1.c Provide a brief description of the quality control process used for controlling changes to the PRA, including the process of monitoring potential plant changes, tracking items that may lead to model changes, making model changes (including frequency for model updates), documenting changes, software quality control, independent reviews, and qualification of PRA staff.

RESPONSE RA11.c PRA quality control is covered under: 1) FENOC Nuclear Operating Program Manual NOPM-CC-6000, "Probabilistic Risk Assessment Program;" and 2) FENOC Nuclear Operating Business Practice NOBP-CC-6001, "Probabilistic Risk Assessment Model Management." Both procedures identify requirements for maintaining and updating the PRA models and applications and both were developed in accordance with Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, to assure the PRA is technically acceptable and supports risk-informed applications in accordance with NRC regulatory guidelines. Specific elements of NOPM-CC-6000 include:

• Requirement 4.2.1, that the PRA be maintained and updated to represent the as-designed, as-built, as-operated plant.

• Requirement 4.2.4, that the PRA be conducted by qualified personnel with industry recognized levels of capabilities and skills in PRA, commensurate with EPRI TR-1 011981, "Development of PRA Qualification and Curriculum," dated September 2005. In addition, Section 5 of NOPM-CC-6000 addresses Qualifications and Training. This section requires that PRA team members meet the PRA Analyst qualification requirements of Job Performance Requirement (JPR) 2.4; this JPR addresses the requirements for a Davis-Besse Analyst, requring completion of the EPRI PRA Fundamentals course (or equivalent),

required reading, as well as mentor discussions and proficiency demonstrations.

One pre-requisite for JPR 2.4 is completion of the Davis-Besse Engineering Support Personnel orientation training, and the Davis-Besse systems training.

• Section 6.2 on Self-Assessments; they are to be performed on as as-needed basis, and at an interval not to exceed 3 years. The results of Self-Assessments and issues identified are evaluated and changes incorporated into the PRA Program as appropriate as required by the FENOC Self-Assessment/Benchmarking procedure.

• Section 7.3 on PRA Software and Computer Control. All PRA software and computers shall be under configuration control as specified in the PRA Software and Computer Control Plan in accordance with NOP-SS-1 001, FENOC Administrative Program for Computer Related Activities; this provides

Attachment L-11-154 Page 4 of 92 requirements for verification of all approved versions of PRA specific software and computers.

• Section 8.4 on PRA Software QA Requirements. All PRA software shall comply with NOP-SS-1 001, FENOC Administrative Program for Computer Related Activities.

• Section 9.1 on PRA Program Records that identifies specific PRA documentation that should be maintained.

Specific elements of NOBP-CC-6001 include:

• Section 5.1.1 on Tracking and Disposition of Plant Changes. Each site is required to have a system for identifying, tracking and dispositioning plant changes that may affect the PRA model; at Davis-Besse, this is done in accordance with NOP-CC-2004, "Design Interface (DIE) Reviews and Evaluations," in which proposed plant changes are routed to the PRA group to identify if the change will impact the PRA. The DIE forms are contained in the Configuration Management Interface System (CMIS). Similarly, NOP-SS-3001, "Procedure Review and Approval," requires a cross-disciplinary review of proposed procedure changes.

• Section 5.1 .2 on Reference Model Updates. This section identifies those items that should be reviewed for possible PRA updates, including plant changes, data, and industry experience.

• Section 5.3 on PRA Revisions; PRA models are expected to be revised every other refueling cycle.

• Section 5.4 on Models and Documentation.

Question RAI 1.d ER Section E.3.1.1.2 identifies a Babcock and Wilcox (B&W) owner's group peer review of the internal events Level 1 and LERF PRA models performed on November 8,1999 and states that no Level A and 18 Level B supporting requirements findings were identified. The ER further explains that following the review a Revision 3 PRA was issued to "close gaps to the draft industry standards." It is not clear from this statement whether all Level B findings were resolved by the Revision 3 PRA model. Section E.3.3 of the ER also discusses a B&W owner's group peer review that was finished in March 2000 which states that there were no Level A findings, and presents 5 Level B findings, three of which are closed and two that are still open. It is not clear whether this is the same B&W

Attachment L-11-154 Page 5 of 92 owner's group peer review comments described in Section 3.1.1.2, and if it is, why there are discrepancies in the two descriptions. The ER also states that in 2008 a "gap self assessment" was performed using a team of industry peers and internal staff that identified four Level A findings and 23 Level B findings associated with not meeting Capability Category 2 requirements of the 2005 ASME PRA standard. It is not clear from the description what the scope of this "gap self assessment" included. The ER does not identify any other peer reviews, technical reviews, or self assessments of the PRA. In light of these issues, provide the following:

i. Clarify whether there were one or two B&W owner's group peer reviews performed in late 1999 and early 2000 and the differences (e.g., scope) between these reviews if there were two. Clarify whether any Level A or B findings remain unresolved from this peer review (or these peer reviews) and if so, provide an assessment of their impact on the SAMA evaluation.

ii. Clarify the scope of the 2008 "gap self assessment" including whether it covered Level 1 and 2 internal events, internal flooding, and the high winds hazard. Also, identify the open Level A and B findings from this self assessment and provide an assessment of their impact on the SAM A evaluation.

iii. Provide a summary of the scope of any other PRA model internal and external reviews, a discussion of each unresolved finding, and an assessment of the impact of all unresolved findings on the SAMA evaluation.

RESPONSE RAI 1.d 1.d.i There was one B&W peer review performed; it was performed in late 1999, and the report was issued in early 2000. There were no Level A findings, and of the 18 Level B level findings, 13 were closed prior to implementation of the Mitigating Systems Performance Index (MSPI) Basis Document; 4 were closed in the SAMA model; and the 1 remaining finding recommended additional sensitivity studies be performed.

As noted in ER Section E.3.3, FENOC plans to include sensitivity studies in Revision 5 of the PRA. The sensitivity studies recommended in EPRI Report 1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, address Human Error Probabilities (HEP) and Common Cause Factors (CCF). Since the basic event importance results for the Level 1 PRA and LERF (discussed in ER Sections E.5.4 and E.5.5, as well as E.3.1.1.1 and E.3.2.1) include Human Failure Events (HFEs), components, and initiating events, and these items were reviewed and

Attachment L-11-154 Page 6 of 92 considered in identifying SAMAs, no new or additional insights are expected that would have a significant impact on the SAMA evaluation.

1.d.ii The scope of the 2008 gap self-assessment included the following PRA technical areas:

initiating events; accident sequences evaluation; success criteria; systems analysis; human reliability analysis; data analysis; quantification; and, maintenance and update.

As discussed in ER Section E.3.1.1.2, the 2008 gap self-assessment was targeted at identifying 'gaps' to meet Capability Category II (of the PRA standard ASME RA-Sb-2005). Also, as discussed in ER E.3.1.1.2, the Davis-Besse SAMA model has all level A and B findings addressed.

1.d.iii Other than those reviews described in paragraphs i and ii above, the PRA team is not aware of any other peer reviews of the PRA model.

Question RAI 1.e ER Section E.3.1.1.1 states that the Davis-Besse Level 1 PRA internal events CDF is estimated to be 9.2E-6/yr, but further explains that if high winds and internal flooding is included that the CDF is estimated to be 9.8E-6/yr. Regarding the internal events CDF, provide the following:

i. The ER provides a caveat about the "tornado high winds" analysis in Section E.3.1.2.3 saying that the model does not include tornado-generated missiles. Based on the top 100 cutsets presented in Table E.S-1, the contribution to the total CDF from tornadoes does not appear to be significant (i.e. Cutset #1 = 3.0E-8/yr, #30 = 2.8E-8/r, #69 =1.2E-8/yr, and

1. 87 = 1.2E-8/yr). The NRC staff notes that the contribution to the internal events CDF from internal flooding is typically included in the internal events CDF whereas the contribution from high winds is generally not included. In light of this and given the high winds analysis is not complete, provide the internal events CDF including flooding but excluding high winds.

ii. ER Table E.3-1 presents dominant internal event sequences by initiating event and their percentage contribution to CDF that includes a contribution

Attachment L-11-154 Page 7 of 92 from internal flooding (i.e., F3AM and F7L). The calculated contribution percentages in Table E.3-1 appear to be based on a CDF of 9.2E-06/yr. This is consistent with the CDF reported in Section E.3.1.1.1 for the internal events CDF that does not include internal flooding and external wind, rather than the CDF of 9.2E-06/yr that does includes internal flooding and external winds. Clarify this apparent discrepancy. Also, clarify which model the Level 2 PRA was based on (i.e., with or without inclusion of internal flooding and external wind).

RESPONSE RAI 1.e 1.e.i ER Section E.3.1.1.1 , second paragraph is revised to read:

The Davis-Besse Level 1 PRA internal event CDF (including internal flooding) is 9.2E-6/yr, and, when also including high winds, the CDF is 9.8E-6/yr.

1.e.ii As discussed above, the Davis-Besse Level 1 PRA internal event CDF, including internal flooding, is 9.2E-6/yr. The Davis-Besse Level 2 PRA is based on the Level 1 internal event PRA, including internal flooding and tornados/high winds, with a CDF of 9.8E-6/yr.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Question RA11.f In ER Table E.3-1, initiating event T2B-1 listed as "SP6A fails to throttle" and T2A-1 listed as "SP6B fails to throttle" appear to have mismatching nomenclature and descriptions. Also it is not clear which valves are being referred to or what their function is in the plant. Initiating event T2A-2 listed as "FICICS35B fails high" and T2B-2 listed as "FICICS35A fails high" also appear to have mismatching nomenclature and descriptions. It is also unclear for these initiating events which components are being referred to or what their function is in the plant. Clarify these apparent discrepancies and provide layman descriptions for these four initiators.

Attachment L-11-154 Page 8 of 92 RESPONSE RAI 1.f The nomenclature is based on plant numbering guidelines. Davis-Besse typically assigns train 1 valves "B" suffixes, and train 2 valves "A" suffixes. Valves SP6A and SP6B are the main feedwater flow control valves: FICICS35A and FICICS35B are the associated flow controllers for the valves. Events T2A-1 and T2A-2 represent main feedwater overfeeds on steam generator 1: T2A-1 is associated with valve SP6B and T2A-2 is associated with its flow controller FICICS35B. Events T2B-1 and T2B-2 represent main feedwater overfeeds on steam generator 2: T2B-1 is associated with valve SP6A and T2B-2 is associated with its flow controller FICICS35A.

Attachment L-11-154 Page 9 of 92 Item 2 Provide the following information relative to the Level 2 analysis:

Question RAI 2.a ER Section E.3.1.1.1 states that the Level 1 PRA quantification was performed using a "truncation cutoff" of 5E-13/yr, but no reference is made to the Level 2 truncation cutoff. Provide the Level 2 PRA truncation cutoff.

RESPONSE RAI 2.a The Level 2 PRA was also performed at a truncation of 5E-13/yr. ER Section E.3.2.1 is revised to include this truncation value.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Question RA12.b ER section E.3.2.1 states that "The CET provides the framework for evaluating containment failure modes and conditions that would affect the magnitude of the release." The ER also explains that "The probabilities of the CET end states were quantified for each POS." However, the Containment Event Tree (CET) is not presented in the ER nor is a description of its structure and composition provided. Provide the CET or a description of the CET used in the Level 2 analysis. Include in the response a discussion of how the CET top events were selected and how branch points probabilities were determined, including how phenomenological versus system failure mode branch point probabilities were determined.

RESPONSE RAI 2.b The Containment Event Tree (CET) provides the framework for evaluating containment failure modes and conditions that would affect the magnitude of a release. The Davis-Besse CET was developed from a Babcock & Wilcox Owners Group (B&WOG) generic CET and refined to address phenomena that could have a significant impact on RCS integrity, containment response and eventual release from containment. Table 2.b-1, below, identifies the top events and branches in the CET.

Attachment L-11-154 Page 10 of 92 Table 2.b-1: Containment Event Tree Events and Branches eET Events Branches A: Arrest of Core Success - core cooling restored in time to prevent vessel failure or Damage In-Vessel steam generator tube creep rupture Failure - cooling not restored R: Submerged-Vessel Success - reactor cavity flooding prevents vessel failure Cooling of Core Failure - vessel breach Debris V: Ctmt Bypass No Bypass Bypassed - ISLOCA or SGTR (Le., direct radionuclide release)

B1: Ctmt Isolated Containment Isolated Isolation failure B2: Isolation Failure Small - containment did not depressurize appreciably Large - containment depressurizes E: Early Ctmt Failure No Early Failure Prevented Early Failure - no potential for fission product scrubbing C: Ex-Vessel Cooling Debris Cooled - prevents core-concrete interaction Debris Uncooled - basemat or sidewall failure D: Ctmt Sidewall No Sidewall Failure Sidewall Failure L: Late Ctmt Failure No Late Failure Late Failure F: Late Revaporization No Revaporization Release Revaporization S: Fission Product Scrubbed Scrubbing Unscrubbed Branch probabilities in the CET were determined based on a consideration of phenomena and elements of the associated core damage bin and plant damage state.

Phenomena probabilities were estimated based on references (e.g., NUREG-1150),

sensitivity studies, and judgment. House events were used to determine applicable CET branches based on the core damage bin and plant damage state.

Attachment L-11-154 Page 11 of 92 Question RAI 2.c ER Section 3.1.1.2 states that an explicit LERF model was added to the PRA. ER Section 3.2.1 states that 14 additional PDSs were added to better define the status of certain containment systems. Clarify how the Level 2 model used in the SAM A evaluation differs from the IPE analysis.

RESPONSE RAI 2.c ER Section E.3.2.2 discusses the Level 2 PRA model changes since the IPE. One of the most significant changes is the level of detail reflected in the plant-damage states (PDS), and the manner in which their frequencies were calculated. Nearly 500 PDS were defined to accommodate the core-damage bins and the various combinations of system states that could affect subsequent Containment response. In the SAMA Level 2 PRA, 14 additional PDS were added to better define the status of Containment systems to support CET quantification. Since the IPE, a framework was also established to allow all of the PDS frequencies to be calculated in a manner that could be readily repeated for sensitivity studies and applications.

Another change involved developing a probability distribution for Containment failure as a function of internal pressure. The analysis investigated various mechanisms for Containment failure to identify those that might limit its capacity. The expected yield strength was calculated and a distribution was developed based on variability in the materials used, and uncertainties. A second distribution was developed to apply to scenarios in which pressurization would occur over a long period of time, such that the heating of the Containment might reduce the strength of the Containment shell.

Reviews were also made of new analytical studies completed since the IPE. One review identified a change in the treatment of the potential for a rupture of a steam generator tube to be induced due to the transport of hot gases to the steam generators during meltdown of the core (e.g., PDS TIN_18Y).

Other changes include enhancements in quantification capabilities, and changes in the Level 1 PRA, including: updates based on plant changes, procedure changes, and maintenance changes; system enhancements to support applications such as the Maintenance Rule; updates to the SGTR analysis based on emergency operating procedure (EOP) changes; updates in initiating event frequencies and component failure rates based on plant experience; and improvements in technical methods such as the Human Reliability Analysis.

The LERF quantification process has also been simplified; the process allows LERF cutsets to be generated without the lengthy quantification process required to a complete the Level 2 analysis.

Attachment L-11-154 Page 12 of 92 Question RAI 2.d Identify the version of MAAP used in the SAMA analysis.

RESPONSE RAI 2.d MAAP 4.0.6 was used in the SAMA analysis.

Question RAI 2.e Identify the release categories that compose the large early release frequency (LERF) from those presented in Table E.3-4 (Release Categories 1.1 through 9.2).

Confirm that the identified release categories are those reviewed in Table E.5-3 (Basic Event LERF Importance).

RESPONSE RAI 2.e ER Table E.3-4 identifies the Release Categories and descriptions; LERF was calculated using the following Release Categories: 1.2 and 1.4 (steam generator tube rupture (SGTR)), 2.1 and 2.2 (interfacing system loss of coolant accident (ISLOCA)),

3.2 and 3.4 (Large Isolation containment failure), 5.2 and 5.4 (Early containment failure), and 6.1 and 6.2 (Sidewall containment failure).

A re-review of LERF importance and ER Table E.5-3, "Basic Event LERF Importance" (pg E-136), based on these Release Categories, identified a few discrepancies: the omission of two events (UHAMUHPE and FMFWTRIP); and the inclusion of two extra events (ZHABWMUE and NORCVRT3, which are just below the risk reduction worth (RRW) cutoff). There are also some slight discrepancies in the rankings, Fussell-Vesely (F-V) importance measures, and RRW importance measures (e.g., in the ER, QHAMDFPE has a F-V of 5.96E-02 and a RRW of 1.063, but should have a F-V of 6.80E-02 and RRW of 1.073, and should be immediately preceding FLC0100F and not immediately following FLC0100F). In addition, FW011AT should be defined as lAW fails to reseat after steam release' (and not fails to reseat after SGTR).

ER Table E.5-3 is revised to correct the identified discrepancies.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Attachment L-11-154 Page 13 of 92 Item 3 Provide the following information with regard to the treatment and inclusion of external events in the SAMA analysis:

Question RAI 3.a For each of the four dominant fire areas identified in ER Section E.3.1.2.1, provide the following:

i. Explain what measures have already been taken to reduce risk. Include in the response specific consideration of improvements to detection systems, enhancements to suppression capabilities, changes that would improve cable separation and drain separation, and monitoring and controlling the quantity of combustible materials in critical process areas.

ii. Review to identify potential SAM A candidates to reduce fire risk. Provide a Phase I and II assessment, as applicable, of each SAMA candidate. If no SAMA candidates are identified, explain why the fire CDF cannot be further reduced in a cost effective manner through implementation of SAMAs specific to fire events.

RESPONSE RAI 3.a 3.a.i A large portion of fire risk is associated with control of combustibles, both transient and permanent; this is primarily accomplished through proper management of maintenance of fire detection and suppression systems, and configuration control of the fire design features, such as fire barriers. Following the issuance of the Individual Plant Examination for External Events (IPEEE), Davis-Besse began utilizing a software tool, the Fire Risk Management Program, that tracks inoperable or degraded fire protection features as well as manages transient combustible loads and travel paths. This software is maintained by the site Fire Marshall and controlled by operations procedures:

DB-FP-0007, "Control of Transient Combustibles", DB-FP-0018, "Control of Ignition Sources", and DB-FP-0009,"Fire Protection Impairment and Fire Watch".

The Fire Risk Management Program is a software tool designed to capture fire protection requirements along with expert knowledge to provide real time fire risk assessment and management. This tool allows users at all levels to understand fire risks and ensure the application of appropriate risk management techniques, and includes establishing fire watches, limiting hot work and prohibiting transient combustibles.

Attachment L-11-154 Page 14 of 92 3.a.ii The four dominant areas identified in ER Section E.3.1.2.1 are Q.01, S.01, X.01, and FF.01. The dominant contributors to risk in three of these areas are the motor-driven feedwater pump (MDFP), the Auxiliary Feedwater (AFW) System, and the pilot-operated relief valve (PORV). The fourth area, the Control Room, area FF.01, is further divided into "control room not evacuated" and "control room evacuated". In both cases, the dominant contributor is a loss of feedwater, and AFW, MDFP, and the PORV are again the main contributors to risk. When the control room is evacuated, the ability to feed and bleed is greatly hindered, so the importance of the PORV is diminished for control room evacuation scenarios.

A review of SAMAs was performed with the intent of identifying modifications that could improve fire-related risk. As described above, the fire risk is generally driven by loss of all feedwater and inability to perform feed and bleed; the fire initiator feeds into the transient event tree and core damage sequences are governed by a loss of feedwater or inability to perform feed and bleed cooling. The following SAMAs apply and the alternatives and evaluations are bounded by the existing analysis; these SAMAs were evaluated as 'Already Implemented' in ER Table E.6-1:

• CC-16

• FW-02

• FW-08

• FW-09

• FW-10

• FW-11 No additional SAMAs were identified unique to fire risk.

Question RAI 3.b ER Section E.3.1.2.1 presents the four fire areas identified in the IPEEE that had an estimated CDF above the screening criteria of 1E-06/yr. It also presents the summation of those fire area CDFs to be 2.5E-05/yr which is then used as the basis to develop an external events multiplier. The IPEEE SER (Enclosure 3, Section 2.1.7) explains that the total frequency of the fire area CDFs which had been screened out after detailed analysis (some of which had revised CDFs greater than 1E-06/yr) is 3.8E-06/yr, which results in a total fire CDF of 2.9E-05/yr.

Identify the fire compartments that were screened after detailed analysis and the

Attachment L-11-154 Page 15 of 92 corresponding CDFs and provide a review of these fire compartments for potential SAMAs.

RESPONSE RAI 3.b The fire compartments that were screened are delineated in Table 4.2.3.2 of the IPEEE.

There are fifteen compartments that start with A.07 and end with Y.02. One column in this table describes the fire effects. The effects are identical to those described in response to RAI 3.a.ii, above; they are associated with secondary side actions including a loss of feedwater and actions pertaining to the AFW System. The SAMAs associated with these actions have been evaluated in response to RAI 3.a.ii; no new SAMAs were identified unique to these compartments or fire risk.

Question RAI 3.c ER Section E.3.1.2.4 presents the basis for an external events multiplier of 3 based on a "conservatively" estimated fire CDF of 2.5E-05/yr developed using the FIVE methodology and the assumption that a "realistic" fire CDF is a factor of 3 less than this FIVE-produced fire CDF. The NRC staff disagrees that a fire CDF produced using the FIVE screening methodology is necessarily conservative in light of more recent research and guidance on hot short probabilities (i.e.,

NUREG/CR-6850). The NRC staff particularly notes that the minimal or non-treatment of hot shorts in the IPEEE FIVE analysis may more than offset other conservatisms in the FIVE analysis. Based on this, and the previous RAI, the NRC staff believes the best estimate of the fire CDF for Davis-Besse is 2.9E-05/yr.

In addition, the USGS issued updated seismic hazard curves for much of the U.S.

in 2008. Using this data, the NRC staff estimated a "weakest link model" seismic CDF for Davis-Besse of 6.7E-06/yr (see NRC Information Notice 2010-18 regarding Generic Issue 199). Based on a fire CDF of 2.9E-05/yr, a seismic CDF of 6.7E-06/yr, and an internal events CDF of 9.8E-06/yr, the NRC staff estimates the external events multiplier to be 3.6. In light of this, provide a revised SAMA evaluation using an external events multiplier of 3.6 or alternatively provide justification for an evaluation of a different multiplier based on this updated USGS information.

RESPONSE RAI 3.c Based on the information provided in the RAI, an updated external events multiplier was calculated for Davis-Besse. The updated external events multiplier includes risk contribution from fire, seismic, and other hazard groups. The risk contribution for the fire and seismic hazard groups was determined by a ratio between the hazard group

Attachment L-11-154 Page 16 of 92 CDF and the internal events CDF as shown in the equations below. The risk contribution from the other hazard group was conservatively assumed to be equivalent to the internal events contribution. Therefore, the other hazard group multiplier is 1.0.

Fire Hazard Multiplier:

5 Fire CDF = 2.9x1 0- /yr = 2.90 Internal Events CDF 1.0x1 0-5 /yr Seismic Hazard Multiplier:

Seismic CDF = 6.7x10-6 /yr = 0.67 Internal Events CDF 1.0x10-5 /yr To determine the multiplier to account for fire, seismic, and other hazard groups, the three individual multipliers were summed, resulting in a multiplier of 4.6. The cost-benefit evaluation was updated using an external event multiplier of 4.6. The updated maximum benefit for Davis-Besse is $1,955,223. Based on the updated maximum benefit, one SAMA candidate, AC/DC-03 (add a portable diesel-driven battery charger to the direct current (DC) system) was determined to be cost-beneficial.

ER Section E.3.1.2.4, "External Event Severe Accident Risk," is deleted based on the response to this RAI. ER Section E.4.5, "Total Cost of Severe Accident Risk," is revised to explain the updated external events multiplier. ER Tables E.4-1, E.7-2, E.7-3, E.7-5, and E.8-1 are revised to reflect the revised cost-benefit results.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Attachment L-11-154 Page 17 of 92 Item 4 Provide the following information concerning the Level 3 analysis:

Question RAI 4.a Regarding ER Section E.3.4.7, clarify that the core inventory is based on the rated thermal power of 2,817 MWt and, if not, provide justification for the thermal power used.

RESPONSE RAI 4.a The core inventory source term analysis used to generate Environmental Report Table E.3-17, "Davis-Besse Core Inventory (Full Core at EOC; 177FAs)," incorporates a two percent uncertainty in core power, or:

P=1.02 x 2772 megawatts thermal (Mwt) = 2827.44 Mwt Question RA14.b Table 2.6-1 identifies that the year 2000 population living within the 50-mile site boundary is 2,375,624. Table E.3-11 identifies that the escalated population to year 2040 is only 2,227,192. The year 2040 population was stated to be a 4.7%

escalation per decade from year 2000. Clarify this discrepancy. Also, in ER Section E.3.4.2, the statement that actual population within the 50-mile radius decreases appears to be incorrect. This statement appears to apply only to the US population groups within a 20-mile radius. Clarify that this understanding is correct.

RESPONSE RAI 4.b The discrepancy in the 2000 population within a 50-mile radius of Davis-Besse as reported in Table 2.6-1 (of the Environmental Report) and the escalated population in 2040 used as input to the Level 3 Probabilistic Risk Assessment (PRA) is because SECPOP2000 only includes population in the United States. SECPOP2000 calculates estimated population and economic data about any point (specified by longitude and latitude) that lies within the continental United States. The population data in SECPOP2000 are based on 2000 U.S. Census Bureau data. The year 2000 population in a 50-mile radius of Davis-Besse (used as the basis of the escalation) was taken from SECPOP2000. Since SECPOP2000 does not include Canadian population, the 2000

Attachment L-11-154 Page 18 of 92 population used in Level 3 PRA underestimated the total population in a 50-mile radius around Davis-Besse. The population data in Table 2.6-1 included the Canadian population. The Level 3 PRA has been revised to include the Canadian population in sectors 30-40 miles/N, 30-40 miles/NNE, 30-40 miles/NE, 40-50 miles/N, 40-50 miles/NNE, and 40-50 miles/NE. The total escalated population for the year 2040 is 2,903,784. The Canadian population is based on the difference of the population reported in Table 2.6-1 and the SECPOP2000 data originally developed.

Section E.3A.2 of Attachment E of the Environment Report is revised to explain the addition of Canadian population data. Sections EA.1, EA.2, EA.5, and E.9 are revised to reflect the adjusted cost-benefit results. In Section E.10, Table E.3-11 is revised to reflect the Canadian population data. Tables E.3-21 through E.3-32 are revised to reflect the adjusted results of the base case and the sensitivity cases. Tables EA-1, E.7-2, Table E.7-3, Table E.7-5, and Table E.8-1 are revised to reflect the adjusted cost-benefit results.

In Section E.3A.2, the statement concerning the declining population related specifically to population estimated from Reference 19 of Attachment E of the Environmental Report; when the population data by year are summed over the counties surrounding Davis-Besse, it shows increasing population until about 2004, and then slightly decreasing population after that until 2008. The population data from Reference 19 are not explicitly provided in Attachment E of the Environmental Report since these data are publicly accessible through the US Census. This observation underscored the conservative assumption of using a constant population escalation factor for each decade through 2040.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Question RAI 4.c Three SECPOP2000 code errors have been publicized, specifically: 1) incorrect column formatting of the output file, 2) incorrect 1997 economic database file end character resulting in the selection of data from wrong counties, and 3) gaps in the 1997 economic database numbering scheme resulting in the selection of data from wrong counties. Address whether these errors were corrected in the Oavis-Besse analysis. If they were not corrected, then provide a revised cost-benefit evaluation of each SAMA with the errors corrected.

RESPONSE RAI 4.c First Energy Nuclear Operating Company (FENOC) is aware of the code errors reported for SECPOP2000. These code errors, as noted in the request for additional information

Attachment L-11-154 Page 19 of 92 (RAI), are unrelated to the population data. For the Davis-Besse Level 3 PRA, only the population data were extracted from SECPOP2000. All other SITE file input parameters were independently developed. Accordingly, there is no need to correct these code errors, nor is there a need to provide a revised cost-benefit evaluation of each SAMA candidate.

Question RAI 4.d ER Section E.3.4.6.2 does not identify the population base/year reference for the emergency planning zone (EPZ) evacuation speed. Describe how/whether the EPZ evacuation time was corrected for the year 2040 population (and address the population discrepancy noted in RAI4.b).

RESPONSE RAI 4.d Reference [4] (in Attachment E of the Environmental Report) does not identify a collection date for the data that were used to estimate the evacuation speed in Section E.3.4.6.2. The evacuation information provided in Reference [4] was assumed to be current as of the 2000 census. However, no correction factor was applied to account for the increased population in 2040 in the original analysis.

Assuming that an increase in population is proportional to a decrease in evacuation speed, the evacuation speed was adjusted from 0.58 meters/second to 0.52 meters/second. This adjustment represents a 9.6 percent decrease in the evacuation speed, which was used to offset a 9.6 percent [(1.047)2 = 1.096] increase in population at the end of the two-decade license renewal period. This decrease in evacuation speed was evaluated as a new sensitivity case (Sensitivity Case E3). The results are provided in Table 4.d-1, below, and show very little change from the base case, indicating that the results are not sensitive to slow evacuation speeds. The base case results shown in Table 4.d-1 includes the updated population (as needed to respond to RAI 4.b); similarly, sensitivity case E3 includes the updated population, to permit an equitable comparison to the base case.

Table 4.d-1: Comparison of Base Case and Case E3 Internal Events Base E3 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.31E+00 0.4%

Economic Impact (50) ($/yr) 1.80E+03 1.80E+03 0.0%

Attachment L-11-154 Page 20 of 92 Question RAI 4.e In ER Section E.3.S.2.3, for Case A1, identify the heat release energy (e.g. thermal, 1 MW) assumed for both the base and sensitivity cases.

RESPONSE RA14.e The energy of release for the base case and sensitivity Case A 1 are provided for each release category in Table 4.e-1, below.

Table 4.e-1 Energy of Release: Base Case and Sensitivity Case A1 PLHEAT/Energy of Release (watts)

Release Category Base Case Sensitivity Case A 1 1.1 6.94E+07 2.16E+09 1.2 6.94E+07 2.16E+09 1.3 6.94E+07 2.16E+09 1.4 6.94E+07 2.16E+09 2.1 6.92E+06 6.19E+OB 2.2 9.44E+06 6.02E+OB 3.1 2.22E+06 2.67E+07 3.2 2.63E+06 1.B2E+07 3.3 2.22E+06 2.50E+07 3.4 2.63E+06 1.B2E+07 4.1 9.2BE+05 1.66E+07 4.2 2.31E+05 1.66E+07 4.3 7.41E+05 1.66E+07 4.4 2.21 E+05 1.66E+07 5.1 3.25E+06 2.10E+07 5.2 1.07E+07 6.4BE+07 5.3 3.07E+06 1.B5E+07 5.4 9.10E+06 5.5BE+07 6.1 6.44E+07 2.9BE+OB 6.2 9.70E+07 4.30E+OB 6.3 6.19E+07 3.9BE+OB 6.4 9.17E+07 4.27E+OB 7.1 2.BOE+07 1.6BE+OB 7.2 2.7BE+07 1.67E+OB 7.3 2.B9E+07 1.72E+OB 7.4 2.B4E+07 1.6BE+OB 7.5 2.24E+07 1.42E+OB 7.6 2.56E+07 1.31 E+OB 7.7 1.96E+07 1.34E+OB 7.B 2.53E+07 1.34E+OB B.1 1.15E+07 1.52E+OB B.2 9.07E+07 5.21E+OB 9.1 2.65E+02 2.0BE+03 9.2 3.29E+02 2.14E+03

Attachment L-11-154 Page 21 of 92 Item 5 Provide the following with regard to the SAMA identification and screening process:

Question RAI 5.a ER Section E.5.2 describes major contributors to plant CDF, suggested improvements from the IPE study, and specific SAMA candidates identified to address the major contributors and suggested improvements. In addition to the suggested improvements identified in the ER, the IPE (in Section 3, Other Potential Plant Improvements) identifies four potential plant improvements related to the "back-end analysis": 1) BWST level at switchover to sump recirculation, 2) operator actions for inadequate core cooling, 3) emergency plan evacuation criteria, and 4) monitoring of carbon monoxide levels in containment.

Describe the status of the implementation of each of these suggested improvements and identify and assess SAMAs to address each unimplemented improvement.

RESPONSE RAI 5.a In the IPE, Part 6, Section 3, Other Potential Plant Improvements, one insight discussed is borated water storage tank (BWST) refill options. The discussion notes that for some sequences involving steam generator tube ruptures, the BWST inventory could be depleted by injection before the Reactor Coolant System (RCS) was depressurized sufficiently to terminate flow through the broken tube. The discussion also notes that while means are available to provide water to refill the BWST, there is no explicit procedural guidance to taking that step. Since the issuance of the IPE, the EOP has been revised; in EOP Section 8, Steam Generator Tube Rupture, Section 8.54 directs the operators to lineup and transfer the contents of the Clean Waste Receiver Tank (CWRT) to the BWST (if BWST inventory is required). It also directs the operators to procedure DB-OP-06101, "Clean Liquid Radwaste System," which includes specific steps to lineup the CWRT to refill the BWST.

In the IPE, another insight discussed is Operator actions for inadequate core cooling.

The discussion notes that different timing of operator inadequate core cooling actions, and particularly those related to ReS depressurization and restarting the Reps, would have delayed the onset of serious core damage. The discussion also notes that there are concerns regarding the effect of Rep restarts on creep rupture of the SG tubes or RCS for high pressure accidents. Since the IPE, FENOe has prepared Severe Accident Management Guidelines (SAMGs). Davis-Besse SAMG candidate high level actions for all plant damage conditions include the injection of water into the RCS and/or Containment. The likelihood of pressurizer surge line creep rupture, hot leg creep

Attachment L-11-154 Page 22 of 92 rupture, and SGTR due to bumping or restarting of the RCPs is addressed for plant conditions which have the primary system pressurized.

In the IPE, another insight discussed is emergency plan evaluation criteria. The discussion notes that a re-examination of evaluation criteria should be accomplished to ensure consistency with the more realistic accident source terms available for severe accidents. On September 30,2009, Davis-Besse implemented revised Emergency Action Levels (EALs) based on Nuclear Energy Institute (NEI) 99-01, "Methodology for Development of Emergency Action Levels", Revision 5. The NRC approved the revised EALs in a safety evaluation report (DBNPS, Unit 1, Safety Evaluation for Emergency Action Levels (ADAMS Accession number ML083450120)). NEI 99-01 Revision 5 EALs use two isotopic mixes to determine EALs associated with fuel melt and failure. The Davis-Besse station dose assessment program has the ability to perform dose assessment using either mix.

In the IPE, another insight discussed is monitoring of carbon monoxide levels in containment. The discussion notes that if core-concrete interactions occur in a severe accident, significant amounts of flammable carbon monoxide would be generated and consideration of carbon monoxide as well as hydrogen may be appropriate in emergency plan evacuation or severe accident management guidelines. The Davis-Besse SAMGs address hydrogen burn likelihood and resultant containment pressures for various hydrogen concentrations (hydrogen production is assumed to be 50 percent or 75 percent of clad oxidation). Containment pressure change due to core concrete interaction gas evolution is also estimated. The Davis-Besse SAMG Technical Basis Document (TBD) discusses Core Concrete Interactions (CCI), the release of carbon dioxide (C0 2 ), and the potential for combustible concentrations of carbon monoxide (CO) and hydrogen (H2) in Containment.

Because the improvements discussed above have been implemented at Davis-Besse, there is no need to identify and assess additional SAMAs.

Question RAI S.b ER Section E.S.2 indicates that no plant-specific vulnerabilities that would affect the PRA CDF were identified in the IPEEE. NRC staff notes that the IPEEE safety evaluation report (Section 3.0, of the seismic attachment) states that "The aggregate of the material provided in the submittal and the licensees response to the RAls is not quite sufficient to meet NUREG 1407" but that "The license did provide an incomplete list of HCLPF values for the plant, with the lowest HCLPF value being 0.26g" and so concluded that the submittal "did come close to meeting the objectives of a focused scope analysis." A FirstEnergy response to an NRC staff RAI on the IPEEE dated May 2S, 2000 identifies a number of plant

Attachment L-11-154 Page 23 of 92 components with high-confidence low probability of failure (HCLPF) values less than 0.3g:

• Borated Water Storage Tank roof from sloshing (0.28g)

• Masonry Wall No. 2367 associated with 480 V Essential MCC (0.26g)

• Masonry Wall No. 3407 associated with Component cooling water room (0.27g)

• Masonry Wall No. 4786 associated with Essential Distribution Panel "D2N" (0.27g)

• Masonry Wall No. 6107 associated with Control Room Emergency Vent Fan Temperature Switch (0.29g)

Discuss whether plant improvements to meet 0.3g for these components has been implemented at the plant and, if not, identify and evaluate SAMAs to improve the seismic capacities of each of these components.

RESPONSE RAI 5.b SAMA SR-01 considers increasing the seismic ruggedness of plant components. As identified in ER Table E.6-1, the Seismic Qualification Utility Group (SQUG) previously identified the need for additional seismic restraints in the plant, and these restraints have been added.

No modifications have been made to the borated water storage tank roof that would increase the seismic capability of the tank roof.

Plant improvements and updated analyses have also been performed on the masonry wall plant components listed that may impact their HCLPF. During the masonry wall project in 2007, changes were made to Masonry wall 3407; the pipe support load was removed from the wall thereby eliminating a major load on the wall. Similarly, changes were made to Masonry wall 6107; the steel beam supporting the wall loads was reinforced. In addition, in the 2006-2007 time frame, the masonry wall analysis was updated for a majority of masonry walls, including Masonry walls 2367 and 4768. The analyses were updated to ensure they met allowable stresses and Design Basis requirements. Although improvements in seismic capacity of the masonry walls have been made, no specific analysis has been performed to determine whether the walls meet the HCLPF value of 0.3g.

In addition, several other SAMAs also meet the intent of improving the seismic capacity of plant components (e.g., AC/DC-01, CC-10, and CW-09).

Attachment L-11-154 Page 24 of 92 Question RAI S.c None of the SAMA candidates identified in Table E.S-4 appear to be plant-specific SAMAs identified from plant-specific risk insights based on the current PRA model. Clarify how the importance lists were used to develop plant-specific SAM A candidates and justify the apparent absence of any plant-specific SAMA candidates. Also, the basic events identified in importance analysis Tables E.S-2 and E.S-3 are not linked to SAMA candidates. Sections E.S.4 and E.S.S only discuss the SAMA candidates identified to address basic events with high risk reduction worth (RRW) values. Identify, for each basic event having a RRW benefit value (averted cost risk) greater than the minimum cost of a procedure change at Davis-Besse, the specific SAMA(s) that address each event and describe how the SAMA(s) address the basic event. Identify and evaluate SAMAs for basic events not addressed by an existing SAMA (e.g., flooding related basic events and initiators, including WHAF3ISE, SHAF2ISE, F3AM, and F7L). For any basic event for which no SAMA is identified, provide justification for not identifying a SAMA(s).

RESPONSE RAI 5.c The final list of SAMA candidates was developed from a combination of generic data, industry SAMA analyses and Davis-Besse-specific insights. The following SAMA candidates were added to the generiC list based on Davis-Besse PRA-identified insights:

• SAMA candidate AC/DC-25 (dedicated DC power for AFW) and AC/DC-26 (alternator/generator for turbine-driven auxiliary feedwater (TDAFW) pump) were designed to extend the life of the TDAFW pumps in a station blackout (SBO) event and improve the likelihood of successful restoration of alternating current (AC) power.

• SAMA candidate AC/DC-27 (increased size of SBO fuel oil tank) was also designed to help mitigate an SBO event.

• SAMA candidate CB-21 (pressure sensors between the two in-series Decay Heat Removal (DHR) System suction valves) was designed to help reduce the likelihood of ISLOCA events.

• SAMA candidate CC-19 (automatic switchover of high pressure injection (HPI) and low pressure injection (LPI) suction from the BWST to the containment sump) was designed to increase the reliability of the switchover during a loss of coolant accident (LOCA) event.

• SAMA candidate CC-20 (modify hardware and procedures to allow using make-up pumps for high pressure recirculation from the containment sump) was

Attachment L-11-154 Page 25 of 92 designed improve the reliability of high pressure recirculation following the loss of HPI.

• SAMA candidate CC-21 (reduce the BSWT level at which switchover to containment recirculation is initiated) was designed to extend the time available to accomplish BWST refill ..

• SAMA candidate CP-19 (install a redundant containment fan system) was designed to increase containment heat removal ability. This SAMA candidate was added as a variation to CP-18 to provide a redundant containment cooling function, in the form of containment fan coolers.

• SAMA candidates CW-24 (adding a diversified CCW pump) and CW-25 (providing the capability to cool makeup pumps with fire water on loss of CCW) were designed to mitigate the total loss of CCW cooling.

• SAMA candidate FW-16 (surveillance of manual AFW suction valves) was designed to improve the reliability of alternate sources of AFW water supply.

• SAMA candidate HV-06 (procedure guidance for alternate means of switchgear cooling) was designed to prevent the loss of one train of service water in the event of loss of one HVAC fan for the service water pump room. This SAMA candidate was developed from Davis-Besse IPE insights.

Evaluating Basic Events with Potential Benefit Greater Than the Cost of a Procedure Change The internal events and LERF basic events with an RRW value estimated to be equal to or greater than the cost of a procedure change were evaluated. These basic events were dispositioned by either identifying resulting SAMAs or presenting the reason for no new SAMA candidate. One new SAMA candidate (OT-9R) resulted from this evaluation.

An estimate of the cost-benefit versus RRW was developed for the internal events basic events calculated for the base PRA model. The minimum cost of a procedure change was assumed to be $10,000. In addition, the minimum cost of a hardware modification was estimated to be $100,000. The cost-benefit versus RRW assumed that cost-benefit was direCtly proportional to the reduction in core damage frequency (CDF). Cost is not perfectly correlated with CDF, due to the fact that different scenarios, even with the same CDF, will result in different distributions of release categories. It is judged, however, that this correlation provides a reasonable estimate of potential benefit along with what is judged to be a low cost for a procedure change, and provides strong confidence that cost-effective SAMA candidates will be captured.

Attachment L-11-154 Page 26 of 92 For the total benefit for the hazard group (Bt), the cost-benefit versus RRW used the maximum derived benefit of $349,147.

The following formula is used for deriving the estimated benefit by hazard group based on RRW:

where, EB(BE) = the estimated benefit based on a basic event Bt = the total benefit for the hazard group (internal events, fire, or seismic)

RRW = the RRW for the basic event from the PSA, by hazard, assuming the basic event failure probability is reduced to zero.

The RRW for the Level 2 PRA basic events may be calculated based on LERF rather than CDF. Additional conservatism is added by treating Level 2 PRA basic event RRW values based on LERF as if they were based on CDF (i.e., the use of Bt significantly overstates their benefit), and the degree of conservatism could be large.

Based on these estimates, an RRW value of 1.03 was calculated to have a maximum cost benefit of $10,000 and an RRW of 1.40 was estimated to have a maximum cost benefit of $100,000. The maximum cost benefit is based on the RRW of the basic event being reduced to 1.0 (basic event modeled as perfect). For all basic events having an RRW value estimated to be at, or above, the value of a procedure change, a disposition was provided either identifying the SAMA candidate(s) addressing that basic event or a description as to why the basic event was not addressed in a SAMA candidate. No basic events had an RRW value equal to, or greater than the estimated cost of a hardware modification. Table 5.c-1, below, lists the basic events with the highest RRWforCDF.

Table 5.c-2, below, tabulates the basic events with the highest RRW for LERF. The estimated benefit for each basic event was derived by taking the RRW for LERF and applying the maximum total benefit used for the CDF basic events. This is very conservative, since the total maximum benefit does not apply only to LERF. For all basic events having an RRW value estimated to be at, or above, the value of a procedure change, a disposition was provided either identifying the SAMA candidate(s) addressing that basic event or a description as to why the basic event was not addressed in a SAMA candidate. No basic events had an RRW value equal to, or greater than the estimated cost of a hardware modification.

Attachment L-11-154 Page 27 of 92 Basic events WHAF3ISE, SHAF2ISE, F3AM, and F7L did not have RRW values with potential benefit equal to, or greater than, the minimum cost of a procedure change.

Basic event F7L, a large circulating water flood in the Turbine Building, did, however, result in an RRW value greater than the minimum cost of a procedure change for the 95 percent uncertainty CDF model. SAMA candidate FL-01 (improve inspection of rubber expansion joints on main condenser) was initially identified to address basic event F7L, and was designed to reduce the frequency of a large circulating water system flooding event due to failure of the circulating water system expansion joints. Based on the F7L RRW value from the 95 percent uncertainty CDF model and its original screening of "Very Low Benefit," SAMA candidate FL-01 was reevaluated and screened as "Already Implemented," as discussed in the response to RAI 6.k.

The ER is revised (numerous locations) to identify that there are now 168 SAMA candidates that were evaluated instead of the original 167. Also, ER Table E.5-4 is revised to include changes identified in Tables 5.c-1 and 5.c-2, below.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Attachment L-11-154 Page 28 of 92 Table 5.c Basic Event Level 1 PRA Importance Event Name F-V RRW Description Disposition A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Failure to initiate makeup/HPI cooling after UHAMUHPE 2.S9E-01 1.349 training. SAMA candidate OT-09R was loss of all feedwater added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

SAMA candidate FW-17R evaluates implementing an automatic start of the QHAMDFPE 2.4SE-01 1.324 Failure to start MDFP after loss of feedwater motor-driven feed pump (MDFP) on loss of main feedwater (MFW).

SAMA candidate CW-26R evaluates implementing an automatic RCP trip on high Operators fail to trip RCPs after a total loss of QHARCPCE 2.32E-01 1.302 bearing cooling temperature or loss of CCW seal cooling flow to the RCP thermal barrier cooler and loss of seal injection flow.

Numerous SAMA candidates that address LOOP were evaluated: I AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator T3 1.96E-01 1.243 LOOP (initiating event)

AC/DC-2S, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size SAMA candidate AC/DC-2BR evaluates the Operators fail to align power from SBO diesel automatic start of the SBO diesel and EHASBDGE 1.64E-01 1.196 generator to supply MDFP loading to Bus D2 upon loss of power to Bus D2.

Attachment L-11-154 Page 29 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to start SBO diesel generator EHASBD1E 1.58E-01 1.187 training. SAMA candidate OT-09R was and align to bus 01 added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

A SAM A candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to align power from EDG 1-1 or EHA02DGE 1.53E-01 1.181 training. SAMA candidate OT-09R was EDG 1-2 to supply MDFP given LOOP added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

Attachment L-11-154 Page 30 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition This is based on a somewhat conservative T1 value of 1.02/yr. Davis-Besse trip occurrence frequency is considered representative of industry values.

SAMA candidates have been evaluated that address various Davis-Besse important scenarios following a reactor/turbine trip.

CC-01, evaluates the installation of an T1 1.35E-01 1.156 Reactor/turbine trip (initiating event) independent active or passive HPI system.

CW-26R, evaluates an automatic RCP trip on high motor bearing temperature or loss of CCW flow to the RCP thermal barrier cooler and loss of seal injection flow.

FW-17R, evaluates an automatic start of the motor driven feedwater pump.

HV-01, evaluates a redundant train for ventilation.

HV-03, evaluates the staging of backup fans in the switchgear room.

SAMA candidate AC/DC-25 provides a dedicated DC system to TDAFW pumps and SAMA candidate AC/DC-26 provides an alternator/generator driven by TDAFW Operators fail to take local manual control of QHAOVF2E 1.22E-01 1.139 pumps.

TDAFW pump 1-2 speed.

These SAMA candidates would eliminate the need for local manual control of the TDAFW pumps.

SAMA candidate CW-26R evaluates implementing an automatic RCP trip on high Operators fail to trip RCPs following loss of I

ZHARCPCE 1.10E-01 1.124 bearing cooling temperature or loss of CCW seal cooling I

flow to the RCP thermal barrier cooler and loss of seal inlection flow.

Attachment L-11-154 Page 31 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Failure to recover CCW using spare CCW WHASPREE 1.07E-01 1.12 training. SAM A candidate OT-09R was train (prior to damage) added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

This estimated benefit of this basic event is below the minimum estimated cost of a hardware modification.

The following SAMA candidates address improvements to the reliability of AFW in QMBAFP11 7.61 E-02 1.082 AFW Train 1 in maintenance loss of off-site power scenarios:

AC/DC-2S, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps XHOS- This is a plant configuration probability in 7.S4E-02 1.082 CCW Pump 1 running, Pump 2 in standby CCW1 RUN2STBY the model. It does not contribute to risk.

SAMA candidate AC/DC-14 evaluates EDG0012F 7.12E-02 1.077 EDG 1-2 fails to run adding a gas turbine generator as an additional source of on-site power.

Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator ZOP007BR 7.09E-02 1.076 Failure to restore off-site power AC/DC-2S, provide dedicated DC system to TDAFW pumps ACIDC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size

Attachment L-11-154 Page 32 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition SAMA candidate CW-24 evaluates the All CCW pumps fail to run due to CCF TMPP43XF-CC_ALL 6.79E-02 1.073 standby CCW pump with a pump diverse (initiating event) from the other two CCW pumps.

XHOS- This is a plant configuration probability in 6.57E-02 1.07 CCW Pump 2 running, Pump 1 in standby CCW2RUN1STBY the model. It does not contribute to risk.

Davis-Besse is scheduled to install new steam generators in 2013. This modification, with resulting reduction in R 6.37E-02 1.068 SGTR (initiating event) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator EHAD1ACE 5.90E-02 1.063 Failure to lineup alternate source to D1 training. SAMA candidate OT-09R was added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

The estimated benefit for this basic event is below the cost of a hardware modification.

T2 5.86E-02 1.062 Plant trip due to loss of MFW (initiating event)

No SAMA candidate considered.

Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity Offsite power recovery not possible after a AC/DC-14, install gas turbine generator NORCVRT3 5.57E-02 1.059 tornado. AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size

Attachment L-11-154 Page 33 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition Reactor vessel rupture is a low probability event that that is assumed to result in AV 5.12E-02 1.054 Reactor vessel rupture guaranteed core damage. No applicable SAMA candidates were considered possible to prevent core damage.

The estimated benefit for this basic event is CCF of two components: QTP0001A & below the cost of a hardware modification.

QTPOOOXA-CC_1_2 5.13E-02 1.054 QTP0002A (TDAFW)

No SAMA candidate considered.

The estimated benefit for this basic event is below the cost of a hardware modification.

QTPOO01A 4.90E-02 1.051 AFPIT -1 fails to start No SAMA candidate considered.

The estimated benefit for this basic event is below the cost of a hardware modification.

The following SAMA candidates address improvements to the reliability of AFW in QMBAFP12 4.67E-02 1.049 AFW Train 2 in maintenance LOOP scenarios:

AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps Numerous SAMA candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator ZOPOO6FR 4.58E-02 1.048 Failure to restore off-site power AC/DC-25, provide dedicated DC system to TDAFW pumps AC/DC-26, provide alternator/generator driven by TDAFW pumps AC/DC-27, increase SBO fuel oil tanks size

Attachment L-11-154 Page 34 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition SAMA candidate CC-01 evaluates the installation of an independent active or passive HPI system.

S 4.35E-02 1.045 Small LOCA (initiating event)

SAMA candidate CC-19 evaluates the implementation of automatic switchover of HPI and LPI suction from the BWST to the to containment sump for LOCAs.

The estimated benefit for this basic event is Loss of CCW Train 1 initiating event Pump 1 below the cost of a hardware modification.

T13A-1-3-IEF 4.18E-02 1.044 running No SAMA candidate considered.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to compensate for loss of room MHARMVTE 4.17E-02 1.043 training. SAMA candidate OT-09R was cooling for makeup pumps.

added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to attempt cooldown via XHAMUCDE 4.10E-02 1.043 training. SAMA candidate OT-09R was makeup/HPI cooling.

added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

The estimated benefit for this basic event is Loss of CCW Train 2 initiating event Pump 2 below the cost of a hardware modification.

T13A-2-3-IEF 3.93E-02 1.041 running No SAM A candidate considered.

SAMA candidate AC/DC-14 evaluates EMBEDG12 3.85E-02 1.04 EDG Train 2 in maintenance adding a gas turbine generator as an additional source of on-site power.

Attachment L-11-154 Page 35 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator training. SAMA candidate OT-09R.

Also, Davis-Besse is scheduled to install CHASGDPE 3.63E-02 1.038 Operators fail to cooldown during a SGTR new steam generators in 2013. This modification, with resulting reduction in SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

The estimated benefit for this basic event is below the cost of a hardware modification.

FMFWTRIP 3.71 E-02 1.038 MFW/ICS faults following trip No SAMA candidate considered.

SAMA candidate CB-22R evaluates the use FMMOOO03 3.52E-02 1.037 Any MSSVs on SG1 fail to reseat of a "gagging device" to close a stuck open MSSV.

SAMA candidate AC/DC-14 evaluates EDG0012A 3.46E-02 1.036 EDG 1-2 fails to start adding a gas turbine generator as an additional source of on-site power.

Davis-Besse is scheduled to install new steam generators in 2013. This modification, with resulting reduction in AASGTR11 3.42E-02 1.035 SGTR occurs on OTSG 1-1 (split fraction) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

Attachment L-11-154 Page 36 of 92 Table 5.c Basic Event Level 1 PRA Importance (continued)

Event Name F-V RRW Description Disposition Davis-Besse is scheduled to install new steam generators in 2013. This I Failure to close MSIV and isolate steam I modification, with resulting reduction in LHAMSIVE I 3.34E-02 I 1.035 generator containing ruptured tube SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk im~ortance of SGTR events.

SAMA candidate FW-17R evaluates implementing an automatic start of the motor-driven feed pump (MDFP) on loss of QHAMDF3E I 3.34E-02 I 1.035 I Failure to start MDFP prior to depletion of I main feedwater (MFW).

BWST during makeup SAMA candidate CC-22R evaluates implementing an automatic refilling of the BWST.

The estimated benefit for this basic event is QTPOO02A 3.25E-02 1.034 I AFPfT-2 fails to start I below the cost of a hardware modification.

No SAMA candidate considered.

SAMA candidate ACIDC-14 evaluates EDG0011F I 3.13E-02 I 1.032 I EDG 1-1 fails to run I adding a gas turbine generator as an additional source of on-site This is a PRA model flag. It is not a I candidate for a SAMA.

FCIRCTMP I 3.00E-02 I 1.031 I Circ water temperature not acceptable

Attachment L-11-154 Page 37 of 92 Table S.c Basic Event LERF Importance Event Name F-V RRW Description Disposition Davis-Besse is scheduled to install new steam generators in 2013. This modification, with resulting reduction in R 9.00E-01 10.048 SGTR (initiating event) SGTR frequency, is not reflected in the current PRA model. This plant improvement is assumed to result in a reduction risk importance of SGTR events.

A SAM A candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Operators fail to attempt cooldown via XHAMUCDE 6.10E-01 2.563 training. SAMA candidate OT-09R was makeup/HPI cooling added to the initial list of SAM A candidates, but subsequently found to be already implemented at Davis-Sesse.

A SAMA candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator CHASGDPE 5.40E-01 2.175 Operators fail to cooldown during a SGTR training. SAM A candidate OT-09R was added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

A SAM A candidate was developed that presents the highest worth PRA human actions to the Davis-Besse operator Failure to close MSIV and isolate steam LHAMSIVE 4.97E-01 1.989 training. SAM A candidate OT-09R was generator containing ruptured tube added to the initial list of SAMA candidates, but subsequently found to be already implemented at Davis-Besse.

Attachment L-11-154 Page 38 of 92 Table S.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition Davis-Besse is scheduled to install new steam generators in 2013. This modification, with resulting reduction in SGTR frequency, AASGTR11 4.81 E-01 1.926 SGTR occurs on OTSG 1-1 (split fraction) is not reflected in the current PRA model.

This plant improvement is assumed to result in a reduction risk importance of SGTR events.

Davis-Besse is scheduled to install new steam generators in 2013. This modification, with resulting reduction in SGTR frequency, AASGTR12 3.93E-01 1.646 SGTR occurs on OTSG 1-2 (split fraction) is not reflected in the current PRA model.

This plant improvement is assumed to result in a reduction risk importance of SGTR events.

SAMA candidate CB-22R evaluates the use FMMOOO03 I 7.90E-02 I 1.086 I Any MSSVs on SG1 fail to reseat I of a "gagging device" to close a stuck open MSSV.

SAMA candidate CB-21 evaluates placing pressure measurements between the two VD-IEF I 7.S4E-02 I 1.082 I ISLOCA due to internal rupture of DHR suction valves I DHR suction valves in the RCS hot leg allowing early detection of inboard isolation valve leakage.

The estimated benefit for this basic event is FLC0101F I 7.31 E-02 I 1.079 I Logic card fails during operation - MSIV 101 I below the cost of a hardware modification.

fails to close No SAM A candidate considered.

Attachment L-11-154 Page 39 of 92 Table 5.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition The estimated benefit for this basic event is ISLOCA occurs in non-isolable portion of DHR below the cost of a hardware modification.

LPPNISOZ 7.18E-02 1.077 system No SAMA candidate considered.

SAMA candidate CB-22R evaluates the use FMMOOO04 6.80E-02 1.073 Any MSSVs on SG2 fail to reseat of a "gagging device" to close a stuck open MSSV.

The estimated benefit for this basic event is Logic card fails during operation - MSIV 100 below the cost of a hardware modification.

FLC0100F 6.13E-02 1.065 fails to close No SAMA candidate considered.

SAMA candidate FW-17R evaluates implementing an automatic start of the Failure to start MDFP as backup to turbine-motor-driven feed pump (MDFP) on loss of QHAMDFPE 5.96E-02 1.063 driven feedwater pumps for transient, Small main feedwater (MFW).

LOCA or SGTR events The estimated benefit for this basic event is CCF of two components: EC1 Z089N & below the cost of a hardware modification.

EC1ZXXXN-CC_1_2 5.19E-02 1.055 EC1Z100N No SAMA candidate considered.

The estimated benefit for this basic event is Press switch PSH RC2B4 fails high - fails below the cost of a hardware modification.

LPSRC2BH 4.93E-02 1.052 DHR No SAM A candidate considered.

The estimated benefit for this basic event is below the cost of a hardware modification.

LPSZ416H 4.93E-02 1.052 Press switch PSH 7531A fails high - fails DHR No SAMA candidate considered.

Attachment L~11 ~154 Page 40 of 92 Table 5.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition SAMA candidate CB-21 evaluates placing I pressure measurements between the two  !

Internal rupture of DH 12 (annual frequency) DHR suction valves in the RCS hot leg I

LMVF012R 4.53E-02 1.047 allowing early detection of inboard isolation valve leakage.

The estimated benefit for this basic event is below the cost of a hardware modification.

LMBCWRT1 4.12E-02 1.043 CWR Train 1 unavailable due to maintenance No SAM A candidate considered.

SAMA candidate AC/DC-14 evaluates EDG0012F 3.47E-02 1.036 EDG 1-2 fails to run adding a gas turbine generator as an I additional source of on-site power.

This is a PRA model flag. It is not a candidate for a SAMA.

FCIRCTMP 3.00E-02 1.031 Circ water temperature not acceptable No SAMA candidate considered.

The estimated benefit for this basic event is below the cost of a hardware modification.

FW011BT 3.04E-02 1.031 AVV ICS11 B fails to reseat after steam No SAMA candidate considered.

SAMA candidate CB-21 evaluates placing pressure measurements between the two LMVF011R 3.01 E-02 1.03 Internal rupture of DH 11 (annual frequency) DHR suction valves in the RCS hot leg allowing early detection of inboard isolation valve leakage.

Attachment L-11-154 Page 41 of 92 Table 5.c Basic Event LERF Importance (continued)

Event Name F-V RRW Description Disposition Numerous SAM A candidates that address LOOP were evaluated:

AC/DC-01, additional battery capacity AC/DC-14, install gas turbine generator ELOOPRT 2.93E-02 1.03 LOOP given reactor trip AC/DC-25, provide dedicated DC system to TDAFW pumps ACIDC-26, provide alternator/generator driven by TDAFW pumps I I I I AC/DC-27, increase SSO fuel oil tanks size

. .. . ~~. . . ,\>J *.~_~l;:.*('~f :.,~....:::... _.-,:: ~*i~..;;:'?,.;L.;~,~:.:';"::'..,h;:~.~L:~!i.~i,-:':-.\,.;~~~..!* -" *Lt.~, .* '" -,,~; .". . -. ~ .. ~,;,.;.-~.

Attachment L-11-154 Page 42 of 92 Question RAI S.d ER Section E.S.3, E.S.4, and E.S.S discuss significant contributors to core damage frequency (CDF) and large early release frequency (LERF). These sections and the associated tables show that there are a number of operator errors and non-recovery actions that occur in these listings, but report that no weaknesses in training or procedures were identified. Given: 1) the significant number of operator errors in these lists, 2) that human errors are among the most dominant failure modes presented in the importance Tables E.S-2 (i.e., the first 9 basic events listed by RRW are human error events) and E.S-3, and 3) that operator errors often have relatively high failure probabilities, provide the following:

i. Explain the process used to make the determination that there were no opportunities to improve procedures and training.

ii. Discuss whether any of the risk significant operator action failures could be addressed by a SAMA to automate the function (i.e., automating tripping of the RCPs after a loss of seal cooling -see RAI 7.a).

RESPONSE RAI 5.d 5.d.i The Human Failure Events (HFEs) included in the dominant cutsets, and identified in the Level 1 and LERF importance tables (as discussed in ER Sections E.5.3, E.5.4 and E.5.5) were reviewed. In the Davis-Besse PRA, the EPRI software supporting the Computer-Aided Fault Tree Analysis (CAFTA) Software, the Human Reliability Analysis (HRA) Calculator, was utilized to quantify and document the HRA analysis. The documentation for each HFE includes a discussion of the action, associated cues, relevant procedures, training, assumptions, staffing, performance shaping factors, and timing. The review concluded that adequate procedures and training were in place; no specific weaknesses were identified in the review of the HFEs.

By their nature, and the way in which they support system fault trees and functional event trees, operator actions are recognized as a key source of model uncertainty and important contributors to core damage. Accordingly, operator actions are discussed in ER Sections E.5.3, E.5.4, and E.5.5. Over the last fifteen years, there has been a significant industry effort in improving procedure content, procedure use, human error reduction techniques, and training.

Attachment L-11-154 Page 43 of 92 5.d.ii In addition to the new SAMAs addressed in RAI 7, two additional SAMA candidates were evaluated to address automating risk significant operation actions: SAMA candidate AC/DC-2BR (automatically start and load the SBODG on Bus 02 upon loss of power to the bus), and SAMA candidate OT-OBR (automatically start and load the SBODG on Bus 02 upon loss of power to the bus in combination with automatically starting the MDFP). Table 5.d-1 and Table 5.d-2, below, provide the internal event and total benefit results for SAMA candidates AC/DC-2BR and OT-OBR, respectively. Table 5.d-3, below, provides the final results for the ten sensitivity cases for SAMA candidate AC/DC-2BR and OT-OBR. The implementation cost for SAMA candidate AC/DC-2BR was estimated as $1,600,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse. The implementation cost for SAMA candidate OT-OBR was estimated as

$4,400,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

Attachment L-11-154 Page 44 of 92 Table 5.d-1: Internal Events Benefit Results for SAMA Candidates AC/DC-2SR and OT-OSR AC/DC-2SR OT-OSR Case (Auto (Auto SBODG SBODG) & MDFP)

Off-site Annual Dose (rem) 2.23E+00 2.10E+00 Off-site Annual Property Loss ($) 1.74E+03 1.63E+03 Comparison CDF 1.0E-05 1.0E-05 Comparison Dose (rem) 2.30E+00 2.30E+00 Comparison Cost ($) 1.80E+03 1.80E+03 Enhanced CDF B.3E-06 5.7E-06 Reduction in CDF 17.00% 43.00%

Reduction in Off-site Dose 3.04% S.70%

Immediate Dose Savings (On-site) $138 $348 Long Term Dose Savings (On-site) $600 $1,518 Total Accident Related Occupational

$738 $1,866 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$22,502 $56,916 site)

Replacement Power Savings (On-site) $22,766 $57,584 Averted Costs of On-site Property

$45,267 $114,500 Damage (AOSC)

Total On-site Benefit $46,005 $116,366 Averted Public Exposure (APE) $1,718 $4,908 Averted Off-site Damage Savings (AOC) $736 $2,086 Total Off-site Benefit $2,454 $6,994 Total Benefit (On-site + Off-site) $4S,459 $123,360 Table 5.d-2: Total Benefit Result for SAM A Candidates AC/DC-2SR and OT-OSR AC/DC-2SR OT-OSR (Auto_SBODG) (Auto_SBODG &

MDFP)

Internal Events $48,459 $123,360 Fires, Seismic, Other $222,912 $567,455 Total Benefit $271,371 $690,815

Attachment L-11-154 Page 45 of 92 Table S.d-3: Final Results of the Sensitivity Cases for SAMA Candidates ACIDC-2SR and OT -OSR Low High On-site Repair On-site SAMAID Discount Discount Clean-up Case Dose Case Rate Case Rate Case Case AC/DC-28R $169,380 $409,899 $187,033 $275,551 $313,374 OT-08R $432,838 $1,043,605 $476,456 $701,388 $797,058 Off-site th Replacement Multiplier Evacuation 95 CDF SAMAID Economic Power Case Case Speed Case Cost ACIDC-28R $356,944 $387,673 $302,292 $272,745 $393,488 OT-08R $907,264 $986,879 $721,735 $692,189 $1,001,682 Question RAI S.e Table E.S-2 identifies events QMBAFP11 and QMBAFP12 representing unavailability of Auxiliary Feedwater (AFW) Trains 1 and 2, respectively, due to maintenance. Provide an evaluation of a SAMA to improve the availability of the AFW pumps by making improvements to maintenance practices or by making hardware modifications.

RESPONSE RAI 5.e The events QMBAFP11 and QMBAFP12 represent unavailability of AFW trains 1 and 2.

The AFW maintenance unavailability data in the PRA is based on the Maintenance Rule data. The SAMA PRA model includes the following: AFW train 1 in maintenance 285 hours0.0033 days <br />0.0792 hours <br />4.712302e-4 weeks <br />1.084425e-4 months <br /> and AFW train 2 in maintenance 311 hours0.0036 days <br />0.0864 hours <br />5.142196e-4 weeks <br />1.183355e-4 months <br />, over 24,209 hours0.00242 days <br />0.0581 hours <br />3.455688e-4 weeks <br />7.95245e-5 months <br /> (3 years). These values equate to a maintenance unavailability of 1.18E-2/yr and 1.29E-2/yr for AFW trains 1 and 2, respectively. This data is consistent with the generic Industry unavailability data in NUREG/CR-6928 for a turbine-driven AFW pump of 5.44E-3/yr.

Improvements to maintenance practices are proposed and evaluated as a normal course of business to maintain AFW train unavailability at its lowest achievable value.

Safety-related hardware modifications are costly, and, based on the industry unavailability data, a SAMA to improve the availability of the AFW pumps is not expected to be cost-beneficial.

Attachment L-11-154 Page 46 of 92 Question RAI 5.f Table E.5-4 does not provide the source for identifying SAMAs CC-19, CW-24, and CW-25. ER Section E.5.2 implies that CW-24 and CW-25 were identified to address IPE risk insights. Clarify the basis for identifying these SAMA candidates.

RESPONSE RAI 5.f The basis for identifying SAMA candidates CC-19, CP-19, CW-24 and CW-25 were inadvertently omitted from Table E.5-4. The following provides a discussion of the basis for each of these SAMA candidates.

CC-19: Davis-Besse currently has the automatic switchover of HPI and LPI suction from the BWST to the containment sump removed. SAMA candidate CC-19 examined re-installing the automatic switchover of HPI and LPI suction from the BWST to the containment sump. The first MLOCA cutset (cutset #12) included basic event ZHALPRME (operators fail to initiate low pressure recirculation) as a single-element cutset.

CP-19: This SAMA candidate evaluates the installation of a redundant containment fan system. SAMA candidate CP-18 was taken from the generic list of SAMA candidates, and evaluates the implementation of a redundant containment spray system. SAMA candidate CP-19 was added as a variation to CP-18 to provide a redundant containment cooling function, in the form of containment fan coolers.

CW-24: This SAMA candidate to add a diversified CCW pump was developed based on the high importance of CCW, as indicated in cutsets and RRW importance values.

CW-25: This SAMA candidate to provide the ability to cool makeup pumps using fire water in the event of loss of CCW was developed based on the high importance of CCW, as indicated in cutsets and RRW importance values.

ER Table E.5-4, "List of Initial SAMA Candidates," rows CC-19, CP-19, CW-24 and CW-25, are revised to include a reference source.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Attachment L-11-154 Page 47 of 92 Question RAI 5.g Several SAM A candidates identified in Table E.6-1 are subsumed in another SAMA candidate (e.g., AC/DC-06, AC/DC-09, AC/DC-20). For each subsumed SAMA candidate, provide an assessment of its implementation cost relative to that of the SAMA into which it was subsumed. If the implementation cost of the subsumed SAMA is less, provide a revised basis for the Phase I screening and Phase II cost-benefit evaluation if it meets Criterion F.

RESPONSE RAI 5.g SAMA candidate CB-OB was subsumed in SAMA candidate CB-07 in Table E.6-1.

SAMA candidate CB-07 was screened as already been implemented at Davis-Besse.

The nature of the operation action/training is similar in both SAMA candidates.

Therefore, SAMA candidate CB-OB was re-screened as Criterion B (Already Implemented). Accordingly, there was no need to determine the cost of implementation and assess the cost-benefit of SAMA candidate CB-OB. ER Table E.6-1 is revised to identify the re-screening of SAMA candidate CB-OB.

The SAMA candidates subsumed in Phase I (AC/DC-06, AC/DC-09, AC/DC-20, and CC-OB) have an equivalent or higher cost of implementation than the SAMA candidates evaluated in Phase II. Nonetheless, an analysis was performed to assess the cost-benefit of the subsumed SAMA candidates. The total benefit was derived from the SAMA candidates into which they were subsumed and compared to the cost of implementation. Table 5.g-1 provides the results of the cost-benefit evaluation. None of the subsumed SAMA candidates are cost-beneficial to implement at Davis-Besse.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Table 5.g-1: Final Results of the Cost-Benefit Evaluation for Subsumed SAMA Candidates SAM A 10 Modification Estimated Cost Estimate Conclusion Benefit Provide additional DC AC/DC-06 power to the 120/240V $94,363 $1,750,000 Not Cost Effective vital AC system.

Provide an additional AC/DC-09 $94,363 $2,800,000 Not Cost Effective diesel generator.

Add a new backup source ACIDC-20 of diesel generator $33,745 $700,000 Not Cost Effective cooling.

Add the ability to automatically align ECCS CC-08 $15,155 $1,500,000 Not Cost Effective to recirculation mode upon BWST de~etion.

Attachment L~11-154 Page 48 of 92 Question RAI S.h A few SAMA candidates identified in Table E.6-1 are screened for Very Low Benefit based on low contribution to LERF (e.g., CB-02, CP-21 , OT-07). The ER does not provide sufficient information to assess the contribution of LERF to population dose-risk and offsite economic cost-risk relative to the total contribution from all release categories. Considering that the benefit of a SAMA is potentially based on the contribution from multiple release categories, provide additional justification for screening these SAMAs on Very Low Benefit.

RESPONSE RAI 5.h SAMA candidate CB-02 addresses the reliability of containment isolation, and was included in the generic SAMA list within the CB (containment bypass) category.

Isolation failure leads to a LERF event. Therefore, this SAMA candidate has no impact on CDF. At Davis-Besse, isolation failure is not a significant contributor to LERF, based on LERF basic event RRW values. Improving containment isolation reliability will not have any significant improvement in other release categories; therefore this SAMA candidate was not considered further.

SAMA candidate CP-21 addresses installing a passive hydrogen control system. A hydrogen burn or detonation typically leads to an early large release. A hydrogen burn or detonation is not risk-significant for LERF at Davis-Besse; therefore this SAMA candidate was not considered further.

SAMA candidate OT-07 is designed to reduce the likelihood of a main steam line break upstream of the main steam isolation valves (MSIVs). This SAMA candidate should not have been eliminated based on LERF. Rather, main steam line breaks are not a significant contributor to either CDF or LERF since they are not found in the top 100 cutsets or the list of either Level 1 or Level 2 risk-significant basic events. The disposition of this SAMA in ER Table E.6-1 , "Qualitative Screening of SAMA Candidates," is revised to include a reference to CDF.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Attachment L-11-154 Page 49 of 92 Question RAI 5.i SAMA CB-18, "direct steam generator flooding after a steam generator tube rupture (SGTR), prior to core damage," was screened in Table E.6-1 because it could impact efforts to mitigate the SGTR. This SAMA was determined to be potentially cost-beneficial in previous SAMA analyses (e.g., Diablo Canyon, TMI-1). Provide a cost-benefit evaluation of this SAMA.

RESPONSE RAI 5.i In the Davis-Besse PRA model, steam generator tube rupture sequences resulting in core damage are placed in one of the following core damage bins: RRY, RRN, RIY, or RIN. Core damage bins RRN and RIN represent sequences in which feedwater is unavailable to the steam generators. In these sequences, it would be impossible to flood the steam generators because no feedwater is available to do so. For core damage bins RRY and RIY, feedwater is available, and it was judged that scrubbing would occur in the steam generator. The auxiliary feedwater nozzles spray high into the tubes and would be expected to provide scrubbing even if the break location was not flooded. Therefore, flooding the steam generators as suggested in CB-18 provides no additional scrubbing benefit, and as such, a cost-benefit evaluation of those SAMAs is not warranted.

Attachment L-11-154 Page 50 of 92 Item 6 Provide the following with regard to the Phase II cost-benefit evaluations:

Question RAI 6.a ER Section E. 7.2 states that an expert panel developed the implementation cost estimates for each of the SAMAs. Briefly, describe the level of detail used to develop the cost estimates (i.e., the general cost categories considered). Also, clarify whether the cost estimates accounted for inflation, contingency costs associated with unforeseen implementation obstacles, replacement power during extended outages required to implement the modifications, and maintenance and surveillance costs during plant operation.

RESPONSE RAI 6.a The Expert Panel process was a collegial review process that relied upon the expertise and judgment of long-term site staff drawn from engineering, operations, procurement, and project management, and assisted by select support personnel (License Renewal, SAMA & probabilistic risk assessment (PRA>>. The Panel reviewed each SAMA candidate and, based on their professional expertise and judgment, approximated the costs associated with implementation processes and equipment.

Main cost categories considered included:

• eqUipment, including the specific mechanical or electrical components identified in the SAMA (e.g., gas turbine-powered generator), and associated piping and piping components, and electrical cables, switchgear, connectors and conduit;

• fuel (natural gas or petroleum-based fuels), if appropriate;

• space requirements, and whether existing space was available or new spaces need to be constructed to house and protect the equipment or for storage of associated fuel and supporting equipment; and,

• extent of modifications, considering whether modifications were safety-related (higher costs) or nonsafety-related, the seismic requirements (higher costs),

calculation requirements (higher costs), whether piping or electrical runs would be required between structures or through walls (higher costs), or whether the Control Room envelope was potentially impacted (higher costs).

Attachment L-11-154 Page 51 of 92 Some implementation costs were assigned a standard value based upon plant experience or estimated man-hours required:

• minimal procedure changes will be between $10,000 and $50,000;

• procedure changes with Engineering support will be between $50,000 and $200,000;

• procedure changes with Engineering support and testing or training required will be between $200,000 and $300,000; and,

• minimal physical plant changes (modifications) start at $100,000.

Least cost "out-of-the-box" options were included wherever possible (e.g., securing retail store small generator(s)). Detailed design concepts were not developed by the Expert Panel, but every effort was made to identify and reasonably price all activities that need to be performed in support of each SAMA candidate (Le., "conceptually estimated," as described by NEI 05-01, "Severe Accident Mitigation Alternatives (SAMA) Analysis Guidance Document," (Nov. 2005), Section 7.2, "Cost of SAMA Implementation"). These support activities included costs associated with procurement, installation, long-term maintenance, surveillance, calibration, and initial and ongoing training. Inflation, contingency costs associated with unforeseen implementation obstacles, and replacement power costs during extended outages required to implement modifications were not specifically identified or included in the cost estimates.

Question RAI 6.b SAMA CC-19, "provide automatic switch over of HPI and LPI suction from the BWST to containment sump for LOCAs," has an estimated implementation cost of $1.SM. Table E.6-1 states that Davis-Besse already has this capability but that the feature has been deactivated, and that the cost would be minor to reactivate this feature. The estimated cost of $1.SM seems very high based on this description. Furthermore, other SAMA analyses have estimated the cost of this SAMA to range from $26SK (Robinson) to $1 M (Catawba). Provide a more detailed description of this modification and justification for the estimated cost.

Attachment L-11-154 Page 52 of 92 RESPONSE RAI 6.b The SAMA Expert Panel made the following assumptions regarding SAMA candidate CC-19 to provide automatic switchover of HPI and LPI suction from the BWST to the containment sump:

• the hardware for automatic switchover is already in-place, but not connected, so reconnection and reactivation of the equipment is necessary;

• the associated valves were de-powered in support of Appendix R criteria;

• Appendix R analyses would need to be re-performed (approximately $500K);

• the change would require a safety-related modification due to the safety-significance of the affected equipment, and calculation support would be necessary (approximately $500K);

• procedure changes with Engineering support and initial testing or training required (approximately $300K); and,

• ongoing testing, surveillances, maintenance and training (approximately $200K).

Estimated cost to implement would be approximately $1.5M or greater.

Based on the review by the SAMA Expert Panel, the costs to implement the modification are not 'minor'; therefore, the ER is revised to delete the statements that the costs to reactivate the automatic switchover feature would be minor.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Question RAI 6.c SAM A AC/DC-25, "provide a dedicated DC power system (battery/battery charger) for the TDAFW control valve and NNI-X for steam generator level indication," has an estimated implementation cost of $2M. This cost seems quite high for a system dedicated to just the TDAFW control valves and in light of the estimated costs for AC/DC-01 and AC/DC-03. Provide a more detailed description of this modification and justification for the estimated cost. Also, consider whether a portable system can provide the same benefit at a lower cost.

Attachment L-11-154 Page 53 of 92 RESPONSE RAI 6.c The Expert Panel made the following assumptions regarding SAMA candidate AC/DC-25 to provide a dedicated DC power system (battery/battery charger) for the TDAFW control valve and NNI-X for steam generator level indication:

• the DC power system will consist of a dedicated set of batteries and a battery charger;

• the intent of this SAMA would be to extend TDAFW pump operating time in the event of an SSO event, or loss of DC power to a TDAFW pump. Therefore, the dedicated DC system must have a longer battery lifetime than the existing safety-related DC system, or be able to supply power following loss of the current safety-related DC system;

• automatic steam generator level control will be needed (pump control, valves, indications, and speed changer motor, which means more DC power is required) to make the probabilistic risk assessment (PRA) case that the TDAFW pumps and level control are reliable;

• safety-related space for the batteries will be required (approximately $400K);

• major safety-related modification with seismic evaluation and calculation support required (approximately $500K);

• procedure changes with Engineering support and testing or training required (approximately $300K);

• batteries and other components and equipment, cable and conduit, disconnects to transfer DC power, including installation (approximately $700K); and

• both batteries / trains affected (additional costs).

Estimated cost to implement would be approximately $2M or greater.

A portable system, such as a diesel-driven battery charger or generator was evaluated in AC/DC-03, and was determined to cost approximately $330K or greater, and is considered cost-beneficial. For SAMA candidate AC/DC-25, due to the additional loads described above, an assumed portable system for this SAMA may require a larger generator unit to carry the loads. A portable system was not considered for this SAMA, however, because of the wording of the SAMA (Le., a dedicated DC power system (battery/battery charger}).

Attachment L-11-154 Page 54 of 92 Question RAI 6.d SAMA CW-24 , "replace the standby CCW pump with a pump diverse from the other two CCW pumps," has an estimated implementation cost of $7.SM. This cost seems quite high for a pump replacement. Provide a more detailed description of this modification and justification for the estimated cost.

RESPONSE RAI 6.d The Expert Panel made the following assumptions regarding SAMA candidate CW-24 to replace the standby CCW pump with a pump diverse from the other two CCW pumps:

• merely changing the standby pump with a different style pump would not meet the intent of the SAMA;

• additional safety-related space is needed that is separate from the existing component cooling water pumps due to the lack of space in the CCW pump room and to eliminate the potential for a common failure (Le., flood) of all CCW pumps (approximately $2M);

• a new design pump, piping, valves and fittings will be required; cable and conduit required; components and equipment, including installation (approximately $4M);

• major safety-related modification with seismic evaluation and calculation support required (approximately $1 M);

• procedure changes with Engineering support and testing or training required (approximately $500K);

Estimated cost to implement would be approximately $7.5M or greater.

Question RAI 6.e As reported in Table E.7-2, the population dose risk reduction is either 10.00%

(for 3 SAMAs) or 0.00% (for all other SAMAs). Explain how population dose risk was calculated and justify the result for each SAMA individually.

RESPONSE RAI 6.e The results presented in Table E.7-2 appeared to be binary (either 0.00 percent or 10.00 percent). These population dose risk reduction values are correct, however, due to rounding in the Excel spreadsheet, the distinction between values for each SAMA candidate was not evident.

Attachment L-11-154 Page 55 of 92 The population dose risk for each SAMA candidate is determined as follows:

1. The population dose is determined by execution of MACCS2 for each release category.

2. A PRA run for each SAMA candidate generates a new "vector" of release category frequencies.

3. The population dose risk (for each SAMA candidate) equals the sum (over all release categories) of the population dose for release category i times the frequency for release category i.

The percent change is determined by comparison of the population dose risk for each SAMA candidate compared with the base case (comparison dose). As the input from MACCS2 has changed (see response to RAI 4.b, above), the results presented in Table E.7-2 are revised; see the Enclosure to this letter for the revision to Table E. 7-2. Note that the number of significant digits for the population dose (Off-site Annual Dose) provided in Table E.7-2 has increased to permit a discernable distinction between the population dose risk values for each SAMA candidate.

Question RA16.f The model approach for SAMA AC/DC-01, "provide additional DC battery capacity," assumes a seven hour battery life. Provide the battery life assumed in the base PRA model, the basis for assuming a seven hour battery life in the SAMA analysis, and justification for the estimated implementation cost of $1.7SM.

RESPONSE RAI 6.f Davis-Besse has 4 Essential Batteries (1 P, 1N, 2P & 2N). The four 125V DC, 1500 ampere-hour, lead-calcium batteries are provided and arranged to form two independent 125/250V DC Motor Control Centers (MCC). The batteries are sized to supply the anticipated DC and Instrument AC supply for a period of one hour after the loss of the battery charger supply. As discussed in FENOC procedure DB-OP-02521, "Loss of AC Bus Power Sources," non-essential loads can be shed to prolong battery life during a station blackout. The PRA assumes a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> battery life. And, as discussed in USAR Chapter 15.2.9, decay heat removal after coastdown of the reactor coolant pumps is provided by natural circulation due to the raised loop design of Davis-Besse; the turbine-driven auxiliary feedwater pumps provide feedwater to the steam generators by taking suction from the condensate storage tanks. Feedwater level control can be provided by DC power, or manually. FENOC procedure DB-OP-02600, "Operational Contingency Response Action Plan," Attachment 1, "Emergency Control of Auxiliary Feedwater," identifies AFW System manual control actions, and Attachment 2, "Providing RPS/NNI Emergency Power Source," identifies actions to line up a portable

Attachment L-11-154 Page 56 of 92 gasoline-powered AC generator (located in the Fire Brigade Equipment Room) to support manual operation of the AFW System following a loss of all AC and DC power.

A 6 - 8 hr battery was considered a reasonable extension for additional DC battery capacity based on the likelihood of recovering off-site power in this timeframe; SAMA AC/DC-01 considered 7 hrs.

The SAMA Expert Panel made the following assumptions regarding SAMA candidate AC/DC-01 to provide additional DC battery capacity:

• consider moving nonsafety-related loads to a new nonsafety-related battery;

• additional safety-related space for the batteries will be required; no space exists for additional batteries in the current battery room (approximately $500K);

• major modification required (approximately $200K);

• procedure changes with Engineering support and testing or training required (approximately $300K);

• batteries and other components and equipment, cable and conduit, including installation (approximately $600K); and,

• both batteries I trains affected - additional costs.

Estimated cost to implement would be approximately $1.75M or greater.

Question RAI 6.g The model approach for SAMA AC/DC-14, "install a gas turbine generator,"

assumes failure of the station blackout (580) diesel generator is eliminated. This assumption does not provide credit for the gas turbine generator in the situation where all the emergency diesel generators (EDGs) are unavailable. Provide an assessment of the impact of this omission.

RESPONSE RAI 6.g The Davis-Besse SBODG is manually started and loaded to supply power to Bus D2 in the event of an SBO. The SBODG is also available to power either shutdown Bus C1 or D1 at the onset of an SBO. In the Davis-Besse PRA, the SBODG is modeled as a backup to either EDG 1 or 2; it is considered in cases where both or either EDG 1 or 2 are unavailable. By eliminating failure of the SBODG (Le., assuming it is perfectly reliable and available), this SAMA already accounts for crediting a gas turbine generator by ensuring one train of emergency power.

Attachment L-11-154 Page 57 of 92 Question RAI 6.h The model approach for SAMA CB-21, "install pressure measurements between the two DHR suction valves in the line from the RCS hot leg," assumes latent failures of the upstream valve are eliminated. It is unclear what is meant by "latent failures." Provide a more detailed description of the PRA model changes made to evaluate this SAMA.

RESPONSE RA16.h The DHR ISLOCA model considers combinations of failures of the two motor-operated suction isolation valves in the DHR drop line. The valves are in series, so both must fail to result in an ISLOCA. Since both valves must fail, one valve could have failed at some point in the past without being detected as long as the other is not failed; this is what is meant by "latent failures." The failure of the other valve would then be the initiating event for the ISLOCA.

SAMA C8-21 proposed installing pressure indication in the piping between the two valves, which is not normally at RCS pressure. The pressure indication could detect if the inboard isolation valve (DH12) connected to the RCS had failed since startup, either by having failed to close while indicating closed, or by an internal rupture after startup.

The analysis for SAMA C8-21 eliminated these failures of DH12, assuming that the failure would be detected and the unit shut down before the outboard isolation valve (DH11) fails. The pRA model also considers the case where DH12 fails, and the sudden increase in pressure on DH11 causes it to fail immediately. These failures were not removed from the cutsets because pressure indication would not serve to prevent the ISLOCA in that case.

Question RAI 6.i

i. ER Section E.8.6 discusses six sensitivity cases. Relative to these sensitivity cases, provide the following:

i. Insufficient information is provided to understand the specific changes made to the baseline analysis assumptions for the first and fourth sensitivity cases. Provide a more detailed description of the analysis assumptions and methodology for these two cases.

ii. The description of the sixth sensitivity case states that off-site economic cost was increased by 25 percent. Table E.8-1 indicates that the total benefit for each of the SAMA candidates was increased by the same amount of $19,632, the offsite economic cost (AOC) value. Clarify how the

Attachment L-11-154 Page 58 of 92 increase of 25 percent in off-site economic cost correlates to the increase in total benefits of $19,632 for each SAMA.

RESPONSE RAI 6.i 6.i.i The first sensitivity case in Section E.8.6 investigated the impact of assuming damaged plant equipment is repaired and refurbished following an accident scenario, as opposed to automatically decommissioning the facility following the event. For the purpose of this sensitivity case, the cost of repair and refurbishment over the lifetime of the plant is equivalent to 20 percent of the replacement power cost in accordance with NUREG/BR-0184. To calculate the benefit for the first sensitivity case, 20 percent of the replacement power cost from the baseline analysis for each SAMA candidate is used to estimate the repair and refurbishment costs.

The fourth sensitivity case in Section E.8.6 investigated the sensitivity of each analysis to the cost of replacement power. To determine the replacement power cost in 2009 dollars, the variable string power cost calculated in Section EAA.2 was modified for energy price inflation. The inflation rate was determined by assessing the electricity costs in 1993 and in 2009. The retail electricity cost for the state of Ohio in 1993 was 6.22 cents/kW-h and in 2009 was 8.96 cents/kW-h. The inflation rate was calculated using the method shown below:

2009cost 8.96cents/kW - h Z= = =1.44 1993cost 6.22cents/kW - h (1 + xi2009-1993) = 1.44 x = 0.0231 ~ 2.31 %

y = year x = inflation rate The next step calculated the 2009 value for the string of replacement power costs based on the calculated inflation rate. The inflation of the string of replacement power costs (B) scaled for Davis-Besse was calculated using the equation shown below. The 2009 value for the string of the replacement power costs (B2009) was used to determine the present value of replacement power costs (PVRP) in 2009 dollars with a seven percent discount rate.

Attachment L-11-154 Page 59 of 92 B - B (1 00231)(2009-1993) 2009 - 1993 + .

( X B2009 = 1.20E + 08 1+ 0.0231 )(16)

B2009 = $1.73E +08 6.i.ii The sixth sensitivity case investigated the sensitivity of the analysis to the off-site economic cost. For each SAMA candidate, a delta between the maximum benefit value and the specific SAMA candidate value is used to estimate the benefit for each SAMA candidate. This sensitivity case increased the maximum benefit off-site economic cost (AOC) value by 25 percent. When performing the delta calculation between the 25 percent increase to the maximum benefit AOC and AOC best-estimate value for each SAMA candidate, the total benefit increases by a constant value.

For example, for SAMA candidate AC/DC-01, the increased AOC value is $1,800

• 1.25

= $2,250. From this value, the AC/DC-01-specific off-site annual economic loss (property loss) value of $1 ,790 is subtracted, yielding a delta of $460. This value is compared to the base case delta calculation ($1,800 - $1,790 =$10). The total benefit increase when comparing the base case to the sensitivity case (for internal events) is

$450 ($460 - $10 = $450); the total increase considering fire, seismic and other external events (multiplier of 4.6) is $450 + ($450

• 4.6) = $2,520. This value is then multiplied by the present worth factor of 12.27 to yield an increase of $30,920, as shown in Table E.8-1. Since the specific SAMA candidate off-site economic cost is included in both the base case calculation and the sensitivity case calculation, when subtracted, it yields a constant increase in the benefit for each SAMA candidate.

Since the cost-benefit analysis was revised with the results from the Level 3 PRA (see response to RAI 4.b), the constant value differs from the $19,632 stated in the RAI.

The revised results are provided in the LRA mark-up of Table E.8-1 in the response to RAI4.b.

Attachment L-11-154 Page 60 of 92 Question RAI 6.j ER Section 8.3 discusses a sensitivity case using a higher evacuation speed.

Provide the evacuation speed used for this analysis. Also, Table E.3-31 shows that the population dose decreased compared to the base case yet Table E.8-1 shows the total net benefit increased by $1,963 for each SAMA. Explain this anomalous result and describe the methodology for developing the $1,963 used for each SAMA.

RESPONSE RAI 6.j The evacuation speed used in the sensitivity case discussed in ER Section E.8.3 was 1.0 meter/second. The population dose used in the Section E.8.3 sensitivity case was the result of the Level 3 PRA sensitivity case E1.

As noted in the RAI, with a decrease in population dose, the net benefit for each SAMA candidate would be expected to decrease. The anomalous result (e.g., a net benefit increase) was due to the number of significant figures used in the Level 3 PRA and the cost-benefit evaluation. The population dose values differed in the third significant digit, which when rounded caused the unexpected results. As a result of the response to RAI 4.b, above, the population dose values have been revised for the Level 3 PRA sensitivity case E1. The ER revisions due to population dose were identified in the response to RAI 4.b.

With the revised results from RAI 4.b and consistent use of significant figures between the Level 3 PRA and cost-benefit analysis, the value $1963 is no longer germane to the sensitivity case in Section E.8.3.

As noted in the staff's RAI, a decrease in population dose was the result of sensitivity case E1 (where the evacuation speed was increased). Since NEI 05-01 suggested an evacuation speed sensitivity case to assess the impact on the results due to the uncertainty in the evacuation speed, it is logical to test (via a sensitivity case) the impact of a lower evacuation speed (which may cause a previously screened SAMA candidate to become cost-beneficial). Accordingly, the cost-benefit sensitivity case (Evacuation Speed from Table E.8-1) has been revised to use the results from Level 3 PRA sensitivity case E3, in which the evacuation speed is decreased by 9.6 percent, which causes a slight increase in population dose. ER Section E.3.5.2.4 is revised and new ER Table E.3-33 is added to incorporate sensitivity case E3.

The total benefit for each SAMA candidate has been increased by $1374, which is consistent with the increase in population dose. For the sensitivity case in Section E.8.3, the population doses values are taken from the Level 3 PRA sensitivity case E3 and replace the base case values in the determination of the averted public exposure (APE). Since there is a constant difference in the population dose values, for the Section E.8.3 sensitivity case, the total benefit for each SAMA is changed by the same

Attachment L-11-154 Page 61 of 92 dollar amount. (See Table E.8-1 for results of evacuation speed sensitivity case in response to RAI 4.b.)

See the Enclosure to this letter for the revision to the DBNPS LRA.

Question RAI 6.k The ER provides no assessment of the uncertainty distribution for CDF. Relative to the uncertainty distribution, address the following:

• Provide the uncertainty distribution (5th , mean, and 95th percentiles) for the Davis-Besse PRA model CDF and describe how the distribution was developed.

• Provide an assessment of whether an uncertainty analysis using the 95th percentile CDF and the external events multiplier of 3.6 developed in RAI 3.c is bounded by the Multiplier Case sensitivity analYSis. If not bounded, provide an uncertainty analysis using the 95th percentile CDF. In this analysis, provide an assessment of each Phase 1 SAMA eliminated using Screening Criterion D and E to determine whether any Phase 1 SAMAs originally screened should have a Phase 2 cost-benefit evaluation performed. Provide a Phase 2 cost-benefit evaluation for any SAMA not screened.

• If the Multiplier Case is bounding, provide an assessment of each Phase 1 SAM A eliminated using Screening Criteria D and E to determine whether any Phase 1 SAMAs originally screened should have a Phase 2 cost-benefit evaluation performed. Provide a Phase 2 cost-benefit evaluation for any SAMA not screened.

Attachment L-11-154 Page 62 of 92 RESPONSE RAI 6.k The following table ~rovides the uncertainty distribution for the Davis-Besse SAMA PRA model CDF. The 5t , mean, and 95th percentile values are in bold font:

5% 95%

Mean Conf. Conf.

Point Estimate 9.70E-06 Mean 1.06E-05 1.07E-05 1.09E-05 th 5 percentile 7. 1BE-06 7.20E-06 7.22E-06 Median 9.51 E-06 9.53E-06 9.55E-06 th 95 percentile 1.53E-05 1.55E-05 1.56E-05 StdDev 1.4BE-05 Skewness 5.75E+01 Kurtosis 4.55E+03 The SAMA analysis model database was modified to support performance of an uncertainty analysis using the UNCERT software package. Failure rate distributions were entered into the database and modifications were made to make the database compatible with the UNCERT software. The SAMA analysis level 1 model was re-quantified to provide a cutset file compatible with the UNCERT software, and the uncertainty analysis was performed using the revised cutset file and database.

An assessment of the impact of the 95 th percentile CDF uncertainty for internal events was performed for Davis-Besse. The uncertainty factor was derived from a ratio of the 95 th percentile CDF uncertainty (1.55E-05/yr) to the point estimate CDF (1.07E-05/yr) for internal events. The uncertainty factor used in this analysis was 1.45. The analysis also used an external events multiplier of 4.6 (see the response to RAI 3.c for additional information on the development of the external events multiplier). Table 6.k-1, below, provides the cost-benefit results for the 95 th percentile CDF uncertainty factor case. Also, the Multiplier Case was updated using an external events multiplier of seven (7). Table 6.k-2, below, provides the Multiplier Case cost-benefit results. The results of the 95th percentile CDF uncertainty and Multiplier Case sensitivity analyses identified one SAMA candidate (AC/DC-03) to be cost effective.

Since the external event multiplier used in the base case and the sensitivity case have changed, the issue of bounding is no longer relevant. Nonetheless, the SAMA candidates designated as Criterion D (Very Low Benefit) were re-evaluated (see Table 6.k-3, below) based on the results of the 95 th percentile CDF uncertainty. For SAMA candidates where the 95 th percentile CDF uncertainty basic event data were available, these basic events' RRW data were used as a basis for the final determination. For some SAMA candidates, either basic event data were not available, or basic event data were not applicable to the determination; for those cases, the determination basis is also provided.

Attachment L-11-154 Page 63 of 92 SAMA candidate FL-01 (improve inspection of rubber expansion joints on main condenser) was initially identified for cost-benefit analysis based on the 95 th percentile CDF uncertainty results. However, upon further investigation, the disposition of SAMA candidate FL-01 is changed to Criterion B (Already Implemented). The basis for the revised disposition is that the circulating water joints are currently inspected during outages and periodically replaced. ER Table E.6-1 is revised to include this change.

Further, based on additional information, SAMA candidate OT-05 (increase training and operating experience feedback to improve operator response) is changed from Criterion D (Very Low Benefit) to Criterion B (Already Implemented). The basis for the revised disposition is that Davis-Besse provides PRA information, such as risk significant initiating events, high worth operator actions and high worth equipment, to operators and other departments. Attachment 2 of FENOC procedure NOPM-CC-6000, "Probabilistic Risk Assessment Program," identifies items supported by the PRA Program; one item is PRA training support in areas such as new licensed operator training and operator re-qualification training cycles. ER Table E.6-1 is revised to include this change.

SAMA candidates screened with Criterion E (Subsumed) were addressed in the response to RAI 5.g, above.

See the Enclosure to this letter for the revision to the DBNPS LRA.

Attachment L-11-154 Page 64 of 92 Table 6.k-1: 95th Percentile Uncertainty Factor Cost-Benefit Results tn 95 Percentile SAMAID Uncertainty Factor Estimated Cost Conclusion Estimated Benefit ACIDC-01 $136,827 $1,750,000 Not Cost Effective AC/OC-03 $548,194 $330,000 Cost Effective AC/OC-14 $284,503 $2,000,000 Not Cost Effective AC/OC-19 $48,930 $700,000 Not Cost Effective ACIDC-21 $68,912 $100,000 Not Cost Effective AC/OC-25 $341,569 $2,000,000 Not Cost Effective AC/OC-26 $341,569 $2,000,000 Not Cost Effective ACIDC-27 $0 $550,000 Not Cost Effective CB-21 $46,827 $550,000 Not Cost Effective CC-01 $2,989 $6,500,000 Not Cost Effective CC-04 $0 $5,500,000 Not Cost Effective CC-05 $0 $6,500,000 Not Cost Effective CC-19 $21,974 $1,500,000 Not Cost Effective HV-01 $0 $50,000 Not Cost Effective HV-03 $0 $400,000 Not Cost Effective AC/OC-28R $393,488 $1,600,000 Not Cost Effective CB-22R $141,643 $4,600,000 Not Cost Effective CC-22R $0 $2,200,000 Not Cost Effective CW-26R $512,381 $1,500,000 Not Cost Effective FW-17R $584,227 $2,800,000 Not Cost Effective OT-08R $1,001,682 $4,400,000 Not Cost Effective

Attachment L-11-154 Page 65 of 92 Table 6.k-2: Multiplier Case Cost-Benefit Results SAMAID Multiplier Case Estimated Cost Conclusion AC/OC-01 $134,805 $1,750,000 Not Cost Effective AC/OC-03 $540,092 $330,000 Cost Effective AC/OC-14 $280,299 $2,000,000 Not Cost Effective AC/OC-19 $48,207 $700,000 Not Cost Effective AC/DC-21 $67,893 $100,000 Not Cost Effective AC/OC-2S $336,521 $2,000,000 Not Cost Effective AC/OC-26 $336,521 $2,000,000 Not Cost Effective AC/OC-27 $0 $550,000 Not Cost Effective CB-21 $46,135 $550,000 Not Cost Effective CC-01 $2,945 $6,500,000 Not Cost Effective CC-04 $0 $5,500,000 Not Cost Effective CC-05 $0 $6,500,000 Not Cost Effective CC-19 $21,649 $1,500,000 Not Cost Effective HV-01 $0 $50,000 Not Cost Effective HV-03 $0 $400,000 Not Cost Effective AC/OC-28R $387,673 $1,600,000 Not Cost Effective CB-22R $139,550 $4,600,000 Not Cost Effective CC-22R $0 $2,200,000 Not Cost Effective CW-26R $504,809 $1,500,000 Not Cost Effective FW-17R $575,593 $2,800,000 Not Cost Effective OT-08R $986,879 $4,400,000 Not Cost Effective

Attachment L-11-154 Page 66 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" Modification SAMAID Screening Criteria Basis for ScreeninglModification Enhancements (Potential Enhancement)

Enhancements Related to AC and DC Power Abnormal Procedure DB-OP-2532 addresses the loss of both AC and DC power to both the Non-Nuclear Instrumentation Increase training on response (NNI) and the ICS that are powered from uninterruptible AC ACIDC- to loss of 120V AC buses that Criterion D instrumentation distribution panels YAU and YBU. It is 08 cause inadvertent actuation judged that operator awareness to the required actions is well Very Low Benefit signals. established.

This SAMA should remain Criterion D.

Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to uninterruptible AC/DC- Improve uninterruptible power Criterion D power supplies has an RRW value above the minimum cost 16 supplies. of a hardware modification.

Very Low Benefit This SAMA should remain Criterion D.

Enhancements Related to ATWS Events Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to emergency Add an independent boron Criterion D boration has an RRW value above the minimum cost of a AT-01 hardware modification.

injection system. Very Low Benefit This SAMA should remain Criterion D.

Based on the basic event RRW results from the 95% CDF Add a system of relief valves to uncertainty case, no basic event related to ATWS pressure prevent equipment damage Criterion D relief has an RRW value above the minimum cost of a AT-02 hardware modification.

from pressure spikes during an Very Low Benefit ATWS.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 67 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued) I Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement) I Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to reactor trip has an I RRW value above the minimum cost of a hardware modification Install motor generator set trip Criterion D AT-O? Also, if the reactor power is not decreasing, procedures breakers in control room. Very Low Benefit instruct the operators to first de-energize substations E2 and I F2, and, if necessary, locally open reactor trip breakers in the I Low Voltage Switchgear room.

This SAMA should remain Criterion D. I Enhancements Related to Containment Bypass I Failure of containment isolation typically leads to a LERF if core damage has occurred. LERF results are dominated by containment bypass events such as SGTR and ISLOCA Add redundant and diverse Criterion D events. Containment isolation is not shown to be a significant CB-02 limit switches to each CIV. Very Low Benefit contributor to LERF in the 95% CDF uncertainty case.

This SAMA should remain Criterion D.  !

HPI and LPI injection check valves are leak tested per Appendix J. DHR suction lines are not tested, but rather than a leakage test, it is judged that continuously monitoring these I valves at power would be preferable to leakage test. A SAMA Increase leak testing of valves Criterion D candidate to continuously monitor the DHR suction valves is CB-03 in ISLOCA paths. Very Low Benefit provided in SAMA candidate CB-21. This conclusion remains valid for the 95% CDF uncertainty case. I This SAMA should remain Criterion D. I

Attachment L-11-154 Page 68 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for ScreeninglModification Enhancements (Potential Enhancement)

Important CIVs receive a close signal from the safety actuation system. Many are air-operated and fail in the closed position. It is judged that self-actuating valves would not provide any significant increase in the reliability of isolation.

Criterion D CB-04 Install self-actuating CIVs.

Very Low Benefit Containment isolation is not shown to be a significant contributor to CDF or LERF in the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

This SAMA candidate would have very little benefit. It is likely that the break would be well above floor drain level.

Ensure ISLOCA releases are Therefore, a significant height of water would be required scrubbed. One method is to before any scrubbing took place. At these levels, the water Criterion D level would likely have undesirable effects, such as CB-06 plug drains in potential break areas so that break point will Very Low Benefit threatening mitigating equipment due to flooding. This be covered with water. conclusion remains valid for the 95% CDF uncertainty results.

This SAMA should remain Criterion D.

Davis-Besse is scheduled to replace the steam generators in Institute a maintenance 2013, which would result in inspecting new steam generator practice to perform a 100% tubes. Therefore, this SAMA candidate is considered very Criterion D low benefit for Davis-Besse. This conclusion remains valid CB-09 inspection of steam generator tubes during each refueling Very Low Benefit for the 95% CDF uncertainty case.

outage.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 69 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for ScreeninglModification Enhancements (Potential Enhancement)

Flooding the SG prior to core damage could impact efforts to mitigate the SGTR. For example, flooding may present a risk Direct steam generator Criterion D to the operation of the TDAFW pumps by risking steam CB-18 flooding after a SGTR, prior to Very Low Benefit generator overfill.

core damage.

Disposition of this SAMA candidate is addressed in the response to RAI 5.i.

This SAMA candidate would result in plant decay heat being I

deposited into primary containment, resulting in a harsh environment. The possible advantages for SGTR will be offset by the negative impacts for other events where Criterion D secondary steam is deposited into containment with intact I CB-19 Vent MSSVs in containment.

Very Low Benefit steam generators. This conclusion remains valid for the 95%

CDF uncertainty case.

This SAMA should remain Criterion D.

Based on the top 100 cutsets and component basic event importance, ISLOCA in the CCW is not significant risk contributor at Davis-Besse. An ISLOCA occurring in the Install relief valves in the CCW Criterion D CCW system is not a risk contributor in the 95% CDF CB-20 system. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 70 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement) I Enhancements Related to Core Cooling Systems Davis-Besse operators are prohibited from throttling LPI pumps earlier in medium or large break LOCAs to maintain BWST inventory. If BWST flow was throttled down to reduce I

Modify procedures to throttle flowrate, the additional time gained is approximately 20 LPI pumps earlier in medium or Criterion D minutes, which, from a PRA perspective, is of low benefit for CC-11 I large break LOCAs to maintain Very Low Benefit a LOCA condition. This conclusion remains valid for the 95%

BWST inventory. CDF uncertainty case.

This SAMA should remain Criterion D.

The make-up system can be used to provide make-up to the RCS in the event of a small LOCA. Because of the separate HPI and make-up systems, the plant has essentially four Upgrade the chemical and separate systems capable of injecting from the BWST into the Criterion D RCS at high pressure. This was identified as a unique safety CC-13 volume control system to mitigate small break LOCAs. Very Low Benefit feature in the IPE. This conclusion remains valid for the 95%

CDF uncertainty case.

This SAMA should remain Criterion D.

Reducing the level at which switchover occurs (nine feet) would not significantly extend the time to switchover, and I would increase the probability of pump failure due to loss of Reduce the BWST level at suction head. Davis-Besse has installed more accurate which switch over to Criterion D BWST level instrumentation that allows reaching a lower level CC-21 I containment recirculation is Very Low Benefit prior to switch over to recirculation. This conclusion remains initiated. valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D. I

Attachment L-11-154 Page 71 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Enhancements Related to Containment Phenomena Davis-Besse has a very large dry containment. Containment Use the fire water system as a over-pressurization is not a significant risk contributor. This Criterion D conclusion remains valid for the 95% LERF uncertainty case.

CP-03 backup source for the containment spray system. Very Low Benefit This SAMA should remain Criterion D.

This SAMA candidate addresses the scrubbing of radioactive releases into certain areas by actuating the fire protection system. Although some scrubbing benefits might be realized, this SAMA candidate presents the risk of impacting required equipment by spray or flooding. This could only be performed Enhance fire protection system Criterion D with fire protection systems that could be remotely actuated.

CP-06 If the temperature in certain areas became high enough, hardware and procedures. Very Low Benefit some existing fire protection systems may automatically actuate. This conclusion remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

The delay time that could be realized if containment spray was delayed would be less than 10 minutes. This SAMA Delay containment spray Criterion D candidate is considered to be of very low benefit. This CP-16 actuation after a large break conclusion remains valid for the 95% CDF uncertainty case.

LOCA. Very Low Benefit This SAMA should remain Criterion D.

Attachment L-11-154 Page 72 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The capability already exists at Davis-Besse to throttle containment spray after the switchover to the sump. The delay time that could be realized if containment spray was Install automatic containment Criterion D throttled would be less than 10 minutes. This SAM A CP-17 spray pump header throttle candidate is considered to be of very low benefit. This valves. Very Low Benefit conclusion remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

Based on component basic event importance, containment fan coolers are not significant risk contributors at Davis-Besse. This SAMA candidate is considered to be very Install a redundant Criterion D low benefit. This conclusion remains valid for the 95% CDF CP-19 containment fan system. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

Install or use an independent Davis-Besse has a very large dry containment. Hydrogen power supply to the hydrogen burn does not present a significant risk in terms of LERF.

control system using either This SAMA candidate is considered to be very low benefit.

new batteries, a non-safety This conclusion remains valid for the 95% CDF uncertainty grade portable generator, Criterion D case.

CP-20 existing station batteries, or Very Low Benefit existing AC/DC independent power supplies, such as the This SAMA should remain Criterion D.

security system diesel generator.

Attachment L-11-154 Page 73 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

This SAMA would mitigate large early releases resulting from a hydrogen burn. LERF is dominated by containment bypass events such as SGTR and ISLOCA. Failure of containment is Install a passive hydrogen Criterion D not a significant contributor to LERF. This SAM A candidate is CP-21 considered to be very low benefit. This conclusion remains control system. Very Low Benefit valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

Enhancements Related to Cooling Water Failure of DC power would impact much more than service water and improving the reliability of DC power to only service water would have very limited value. Based on the basic event RRW results from the 95% CDF uncertainty case, no Add redundant DC control Criterion D basic event related to service water performance has an CW-01 power for service water pumps. Very Low Benefit RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Davis-Besse has three service water pumps. In addition, the normally running cooling tower makeup pump is the preferred supply of service water following loss of service water. Based on the basic event RRW results from the 95% CDF Add a redundant service water Criterion D uncertainty case, no basic event related to service water CW-04 pump. Very Low Benefit performance has an RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 74 of 92 Table 6.k-3: Re-evaluation of SAM A Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The Davis-Besse water supply from Lake Erie travels through a long canal before reaching the intake structure. There is a screen at the intake from Lake Erie. The long distance traveled through the canal results in a significant fraction of material passing through the initial screen settling out prior to Enhance the screen wash Criterion D reaching the intake structure. Based on the basic event RRW CW-05 system. Very Low Benefit results from the 95% CDF uncertainty case, no basic event related to service water performance has an RRW value above the minimum cost of a hardware modification.

I This SAMA should remain Criterion D. I Loss of CCW through drain and vent lines is not considered ,

to be a significant contributor to loss of CCW. These lines are Cap downstream piping of Criterion D small, and any leakage would likely be low. This conclusion CW-06 normally closed CCW drain remains valid for the 95% CDF uncertainty case.

and vent valves. Very Low Benefit I This SAMA should remain Criterion D.

Seal LOCA is not a concern at Davis-Besse if the RCPs are tripped. On loss of CCW, the makeup pumps can continue Enhance loss of CCW operation for at least one hour. Therefore, if operators trip the procedure to underscore the Criterion D RCPs within one hour of loss of CCW, an RCP seal LOCA is CW-08 not a risk concern. This conclusion remains valid for the 95%

desirability of cooling down the Very Low Benefit RCS prior to seal LOCA. CDF uncertainty case.  !

This SAMA should remain Criterion D.

Attachment L-11-154 Page 75 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for ScreeninglModification Enhancements (Potential Enhancement) I Seal LOCA is not a concern at Davis-Besse if the RCPs are tripped. On loss of CCW, the makeup pumps can continue operation for at least one hour. Therefore, if operators trip the I Additional training on loss of Criterion D RCPs within one hour of loss of CCW, an RCP seal LOCA is CW-09 not a risk concern. This conclusion remains valid for the 95%

CCW. Very Low Benefit CDF uncertainty case.

This SAMA should remain Criterion D.

Davis-Besse makeup pumps can operate for at least one hour on loss of CCW. Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to Increase charging pump lube Criterion D charging (make-up) pump performance has an RRW value CW-12 oil capacity. Very Low Benefit above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Seal LOCA is not a concern at Davis-Besse if the RCPs are tripped. On loss of CCW, the makeup pumps can continue operation for at least one hour. Therefore, if operators trip the Use existing hydro test pump Criterion D RCPs within one hour of loss of CCW, an RCP seal LOCA is CW-15 for RCP seal injection. Very Low Benefit not a risk concern.

I This SAMA should remain Criterion D.

Attachment L-11-154 Page 76 of 92 Table 6.k-3: Re-evaluation of SAM A Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The make-up system is continuously operating. Malfunctions of relief valves would be immediately detected during operation and corrected. Based on the basic event RRW Prevent make-up pump flow Criterion D results from the 95% CDF uncertainty case, no basic event CW-18 diversion through the relief related make-up flow diversion has an RRW value above the valves. Very Low Benefit minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Enhancements Related to Internal Flooding Revised to read: A large circulating water flood in the turbine building has Improve inspection of rubber associated basic event FL7 that is above the minimum cost of Criterion F FL-01 expansion jOints on main a procedure change (although less that a hardware condenser. Considered for Further modification). This SAMA candidate will be considered for Evaluation further evaluation.

Enhancements Related to Fire Risk Inadvertent actuation of fire protection water is not considered risk significant and currently not modeled in the PRA. Any fire protection system water should be handled by existing drains Replace mercury switches in Criterion D and is not considered a significant flooding threat. This FR-01 fire protection system. Very Low Benefit conclusion remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

The Davis-Besse IPEEE did not identify any weakness in the fire barrier performance. This conclusion remains valid for Upgrade fire compartment Criterion D the 95% CDF uncertainty case.

FR-02 barriers. Very Low Benefit This SAMA should remain Criterion D.

Attachment L-11-154 Page 77 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)  !

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Currently, isolation switches exist for a control evacuation.

Some manual actions beyond operation of isolation switches are required (e.g., plugging connectors, removing/inserting Install additional transfer and Criterion D fuse blocks). Adding additional transferlisolation switches is FR-03 not considered to be of significant benefit. This conclusion isolation switches. Very Low Benefit remains valid for the 95% CDF uncertainty case.

This SAMA should remain Criterion D.

The Davis-Besse IPEEE did not identify any weakness in fire brigade performance. This conclusion remains valid for the Enhance fire brigade Criterion D 95% CDF uncertainty case.

FR-04 awareness. Very Low Benefit This SAMA should remain Criterion D.

The Davis-Besse IPEEE did not identify any weakness in the Enhance control of combustible control program. This conclusion remains valid Criterion D for the 95% CDF uncertainty case.

FR-05 combustibles and ignition sources. Very Low Benefit This SAMA should remain Criterion D.

Enhancements Related to Feedwater and Condensate Davis-Besse has the capability of replenishing the CST using fire protection water. This can be done even on loss of AC power. Adding diesel for condensate makeup pumps would Install an independent diesel Criterion D add little benefit. This conclusion remains valid for the 95%

FW-03 for the CST make-up pumps. Very Low Benefit CDF uncertainty case.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 78 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

The purpose of the SAMA candidate was to reduce dual turbine-driven pump maintenance unavailability. Although manual isolation valves do not exist, Davis-Besse has valves Install manual isolation valves Criterion D within the steam lines that allow isolation of one TDAFW FW-05 around the TDAFW pump Very Low Benefit pump for maintenance while leaving the second TDAFW steam admission valves. pump available. This conclusion remains valid for the 95%

CDF uncertainty case.

This SAMA should remain Criterion D.

Based on the basic event RRW results from the 95% CDF uncertainty case, no basic event related to CST performance Install a new condensate has an RRW value above the minimum cost of a hardware Criterion D FW-07 storage tank (AFW storage modification.

Very Low Benefit tank).

This SAMA should remain Criterion D.

On loss of air or electric power, several components required Change failure position of for secondary heat removal would be lost; therefore the state condenser make-up valve if the Criterion D of the condenser make-up valve is not relevant. This FW-12 conclusion remains valid for the 95% CDF uncertainty case.

condenser make-up valve fails Very Low Benefit open on loss of air or power.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 79 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification 5AMAID Screening Criteria Basis for ScreeninglModification Enhancements (Potential Enhancement)

Failure of the PORV to open only shows up in the Level 1 PRA importance measures with a RRW of 1.006 (cutoff 1.005). It does not show up in the top cutsets or the LERF Replace existing pilot-operated importance list. Therefore, it is judged to be very low benefit.

relief valves with larger ones, Criterion D Based on the basic event RRW results from the 95% CDF FW-15 uncertainty case, no basic event related to PORV opening or such that only one is required Very Low Benefit for successful feed and bleed. capacity has an RRW value above the minimum cost of a hardware modification This SAMA should remain Criterion D.

Enhancements Related to Heating, Ventilation and Air Conditioning (HVAC)

The high voltage switchgear rooms do not require forced ventilation. Low voltage switchgear rooms require forced ventilation. Operators monitor the temperature of the low voltage switchgear rooms during their plant tours. Based on Add a switchgear room high Criterion D the basic event RRW results from the 95% CDF uncertainty HV-04 case, no basic event related to switchgear ventilation has an temperature alarm. Very Low Benefit RRW value above the minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Loss of ventilation to AFW is not a risk significant contributor Create ability to switch at Davis-Besse. This conclusion remains valid for the 95%

emergency feedwater room fan Criterion D CDF uncertainty case.

HV-05 power supply to station Very Low Benefit batteries in an SBO.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 80 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Service water ventilation includes four 50% fans. Loss of service water ventilation is not a significant risk contributor at Provide procedural guidance Davis-Besse. Based on the basic event RRW results from for establishing an alternate Criterion D the 95% CDF uncertainty case, no basic event related to HV-06 service water room ventilation has an RRW value above the means of room ventilation to Very Low Benefit the service water pump room. minimum cost of a hardware modification.

This SAMA should remain Criterion D.

Enhancements Related to Instrument Air and Nitrogen Supply Service Air and Instrument Air are not significant risk contributors based on top cutsets and risk importance measures. Based on the basic event RRW results from the Modify procedure to provide Criterion D 95% CDF uncertainty case, no basic event related to air IA-02 ability to align diesel power to compressors has an RRW value above the minimum cost of a more air compressors. Very Low Benefit hardware modification.

This SAMA should remain Criterion D.

Service Air and Instrument Air are not significant risk contributors based on top cutsets and risk importance Replace service and measures. Based on the basic event RRW results from the instrument air compressors Criterion D 95% CDF uncertainty case, no basic event related to service IA-03 with more reliable compressors or instrument air compressors has an RRW value above the that have self-contained air Very Low Benefit minimum cost of a hardware modification cooling by shaft-driven fans.

This SAMA should remain Criterion D.

Attachment L-11-154 Page 81 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Enhancements Related to Seismic Risk The Seismic Qualifications Utility Group (SQUG) previously identified the need for additional seismic restraints in the Increase seismic ruggedness Criterion D plant. These restraints have already been added. This SR-01 conclusion remains valid for the 95% CDF uncertainty case.

of plant components. Very Low Benefit This SAMA should remain Criterion D.

The CO 2 tanks are located outdoors. These tanks supply only the turbine generator. No other components are protected with CO 2 . A seismic failure of the CO 2 tanks has Provide additional restraints for Criterion D minimal risk. This conclusion remains valid for the 95% CDF SR-02 CO 2 tanks. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

Other Enhancements Large break LOCA is not a significant risk contributor (0.2%

CDF). Davis-Besse has a Containment Leakage Detection System (FLUS) to identify leaks from vessel penetrations and Install digital large break LOCA Criterion D nozzles. This conclusion remains valid for the 95% CDF OT-01 protection system. Very Low Benefit uncertainty case.

This SAMA should remain Criterion D.

Davis-Besse has a qualified Maintenance Rule program in place. No deficiencies in maintenance practices have been Improve maintenance Criterion D identified. This conclusion remains valid for the 95% CDF OT-04 uncertainty case.

procedures. Very Low Benefit This SAMA should remain Criterion D.

Attachment L-11-154 Page 82 of 92 Table 6.k-3: Re-evaluation of SAMA Candidates Screened as "Very Low Benefit" (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement) I FENOC provides PRA information, such as risk-significant Increase training and operating Revised to read: initiating events, high worth operator actions and high worth OT-05 experience feedback to Criterion B equipment, to various departments, including Operations I improve operator response. Already Implemented Training, and presents this information on posters throughout the plant.

I Steam line breaks are not a significant contributor to CDF or I LERF based on top cutsets or basic event importance. The derived benefit would not justify the implementation cost required. Based on the basic event RRW results from the Install secondary side guard Criterion D 95% CDF uncertainty case, no basic event related to main OT-O?

pipes up to the MSIVs. Very Low Benefit steam breaks has an RRW value above the minimum cost of a hardware modification.

L- _ _ _ _ _

This SAMA should remain Criterion D.

Attachment L-11-154 Page 83 of 92 Item 7 For certain SAMAs considered in the ER, there may be lower-cost alternatives that could achieve much of the risk reduction at a lower cost. In this regard, discuss whether any lower-cost alternatives to those Phase II SAMAs considered in the ER would be viable and potentially cost-beneficial. Evaluate the following SAMAs (previously found to be potentially cost-beneficial at other Babcock and Wilcox plants), or indicate if the particular SAMA has already been considered. If the latter, indicate whether the SAMA has been implemented or has been determined to not be cost-beneficial at Davis-Besse Nuclear Power Station.

Question RAI 7.a Automate reactor coolant pump trip on high motor bearing cooling temperature.

RESPONSE RAI 7.a A SAMA candidate (CW-26R) to provide an automatic reactor coolant pump trip on loss of cooling to the RCP seal thermal barrier cooler and loss of seal injection flow was evaluated for Davis-Besse. Table 7.a-1 and Table 7.a-2, below, provide the internal event and total benefit results for SAMA candidate CW-26R, respectively. Table 7.a-3, below, provides the final results for the ten sensitivity cases for SAMA candidate CW-26R. The implementation cost for this SAMA candidate was estimated as

$1,500,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

Attachment L-11-154 Page 84 of 92 Table 7.a-1: Internal Events Benefit Results for SAM A Candidate CW-26R CW-26R Case (Auto_RCP)

Off-site Annual Dose (rem) 2.27E+00 Off-site Annual Property Loss ($) 1.79E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.30E+00 Comparison Cost ($) 1.80E+03 Enhanced CDF 7.7E-06 Reduction in CDF 23.00%

Reduction in Off-site Dose 1.30%

Immediate Dose Savings (On-site) $186 Long Term Dose Savings (On-site) $812 Total Accident Related Occupational

$998 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$30,443 site)

Replacement Power Savings (On-site) $30,801 Averted Costs of On-site Property

$61,244 Damage (AOSC)

Total On-site Benefit $62,242 Averted Public Exposure (APE) $736 Averted Off-site Damage Savings (AOC) $123 Total Off-site Benefit $859 Total Benefit (On-site + Off-site) $63,101 Table 7.a-2: Total Benefit Result for sAMA Candidate CW-26R CW-26R (Auto_RCP)

Internal Events $63,101 Fires, Seismic, Other $290,265 Total Benefit $353,366

Attachment L-11-154 Page 85 of 92 Table 7.a-3: Final Results of the Sensitivity Cases for SAMA Candidate CW-26R Low High On-site SAMA Repair On-site Discount Discount Clean-up 10 Case Dose Case Rate Case Rate Case Case CW-26R $215,378 $533,291 $242,495 $359,021 $410,194 Off-site SAMA Replacement Multiplier Evacuation 95th CDF Economic 10 Power Case Case Speed Case Cost CW-26R $469,142 $504,809 $354,741 $384,287 $512,381 Question RAI 7.b Use the decay heat removal (OHR) system as an alternate suction source for high pressure injection (HPI).

RESPONSE RAI 7.b The Davis-Besse design and PRA already include use of the DHR system as a suction source for HPI. For cases in which RCS pressure is too high for adequate flow, the HPI pumps can be aligned to take suction from the discharge of the DHR pumps; this is possible with the BWST as the suction source or with the containment sump as the suction source.

Question RAI 7.c Automate HPI injection on low pressurizer level (in loss of secondary side heat removal cases where the reactor coolant system (RCS) pressure remains high while the RCS level drops) -Three Mile Island SAM A 16.

RESPONSE RAI 7.c This SAMA candidate considers automating HPI injection on low pressurizer level following a loss of secondary side heat removal where RCS pressure remains high while level drops. This SAMA was a viable consideration for Three Mile Island (TMI)

Attachment L-11-154 Page 86 of 92 based on plant design and system configuration. At TMI, the HPI system is also the makeup system - there is a single Makeup and Purification system that provides normal makeup as well as standby Engineered Safety Actuation Signal (ESAS)-selected pumps which automatically inject high-pressure water into the RCS from the BWST in mitigation of LOCA scenarios. In addition, as discussed in Volume 3 of the B&W Emergency Operating Procedure Technical Basis Document (EOP TBD), (Chapter III.C, Lack of Adequate Primary to Secondary Heat Transfer), for all plants except Davis-Besse, HPI cooling must not be intentionally delayed if feedwater is not available.

HPI COOling must be established in a timely manner to assure adequate core cooling; it must be started early enough to slow RCS inventory depletion so that HPI cooling will match decay heat before the core is uncovered.

At Davis-Besse, however, the plant design and systems are different from those at TMI.

Davis-Besse has a separate HPI safety system in addition to the normally operating makeup system. The Davis-Besse HPI system is not capable of injecting water into the RCS until pressure reaches -1600psig. In addition, because Davis-Besse has two makeup pumps, makeup/HPI cooling can be delayed until the core outlet temperature reaches 600°F provided the RCS PT limit is not exceeded. Although the Davis-Besse PRA considers makeup/HPI cooling in response to a loss of feedwater, and the associated operator actions, automating this function was not considered because of the complexity associated with the number of options and systems involved (e.g.,

pumps, valves and alignment options, injection line options, bleed options).

Consequently, this SAMA candidate was not considered for Davis-Besse.

Question RAI 7.d Automate refill of the borated water storage tank (BWST).

RESPONSE RA17.d A SAMA candidate (CC-22R) to provide an automatic refill of the borated water storage tank was evaluated for Davis-Besse. Table 7.d-1 and Table 7.d-2, below, provide the internal event and total benefit results for SAMA candidate CC-22R, respectively. Table 7.d-3, below, provides the final results for the ten sensitivity cases for SAMA candidate CC-22R. The implementation cost for this SAMA candidate was estimated as

$2,200,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

Attachment L-11-154 Page 87 of 92 Table 7.d-1: Internal Events Benefit Results for SAM A Candidate CC-22R CC-22R Case*

(Auto_BWST)

Off-site Annual Dose (rem) 2.30E+00 Off-site Annual Property Loss ($) 1.80E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.30E+00 Comparison Cost ($) 1.80E+03 Enhanced CDF 1.0E-05 Reduction in CDF 0.00%

Reduction in Off-site Dose 0.00%

Immediate Dose Savings (On-site) $0 Long Term Dose Savings (On-site) $0 Total Accident Related Occupational

$0 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$0 site)

Replacement Power Savings (On-site) $0 Averted Costs of On-site Property

$0 Damage (AOSC)

Total On-site Benefit $0 Averted Public Exposure (APE) $0 Averted Off-site Damage Savings (AOC) $0 Total Off-site Benefit $0 Total Benefit (On-site + Off-site) $0 Table 7.d-2: Total Benefit Result for SAMA Candidate CC-22R CC-22R (Auto_BWST)

Internal Events $0 Fires, Seismic, Other $0 Total Benefit $0

Attachment L-11-154 Page 88 of 92 Table 7.d-3: Final Results of the Sensitivity Cases for SAMA Candidate CC-22R Low High On-site SAMA Repair On-site Discount Discount Clean-up ID Case Dose Case Rate Case Rate Case Case CC-22R $0 $0 $0 $0 $0 Off-site th SAMA Replacement Multiplier Evacuation 95 CDF Economic ID Power Case Case Speed Case Cost CC-22R $0 $0 $1,374 $30,920 $0 Question RAI 7.e Automate start of auxiliary feedwater (AFW) pump in the event the automated emergency feedwater (EFW) system is unavailable.

RESPONSE RAI 7.e A SAMA candidate (FW-17R) to automatically start the auxiliary feedwater pump when the emergency feedwater system is unavailable was evaluated for Davis-Besse. Based on the Davis-Besse design, this SAMA was interpreted as automatically starting the motor driven feedwater pump in the event both turbine-driven auxiliary feedwater pumps were not available. Table 7.e-1 and Table 7.e-2, below, provide the internal event and total benefit results for SAMA candidate FW-17R, respectively. Table 7.e-3, below, provides the final results for the ten sensitivity cases for SAMA candidate FW-17R. The implementation cost for this SAMA candidate was estimated as $2,800,000. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

Attachment L-11-154 Page 89 of 92 Table 7.e-1: Internal Events Benefit Results for SAM A Candidate FW-17R FW-17R Case (Auto_MDFP)

Off-site Annual Dose (rem) 2.18E+00 Off-site Annual Property Loss ($) 1.69E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.30E+00 Comparison Cost ($) 1.80E+03 Enhanced CDF 7.5E-06 Reduction in CDF 25.00%

Reduction in Off-site Dose 5.22%

Immediate Dose Savings (On-site) $202 Long Term Dose Savings (On-site) $882 Total Accident Related Occupational

$1,085 Exposure (AOE)

CleanuplDecontamination Savings (On-

$33,091 site)

Replacement Power Savings (On-site) $33,479 Averted Costs of On-site Property

$66,570 Damage (AOSC)

Total On-site Benefit $67,655 Averted Public Exposure (APE) $2,945 Averted Off-site Damage Savings (AOC) $1,350 Total Off-site Benefit $4,294 Total Benefit (On-site + Off-site) $71,949 Table 7.e-2: Total Benefit Result for SAMA Candidate FW-17R FW-17R (Auto_MDFP)

Internal Events $71,949 Fires, Seismic, Other $330,966 Total Benefit $402,915

Attachment L~11-154 Page 90 of 92 Table 7.e-3: Final Results of the Sensitivity Cases for SAMA Candidate FW-17R Low High On-site SAMA Repair On-site Discount Discount Clean-up 10 Case Dose Case Rate Case Rate Case Case FW-17R $252,928 $608,721 $277,988 $409,062 $464,684 Off-site th SAMA Replacement Multiplier Evacuation 95 CDF Economic 10 Power Case Case Speed Case Cost FW-17R $528,758 $575,593 $404,289 $433,835 $584,227 Question RAI 7.f Purchase or manufacture of a "gagging device" that could be used to close a stuck-open steam generator safety valve for a SGTR event prior to core damage.

RESPONSE RAI 7.f A SAMA candidate (CB-22R) to use a "gagging" device that could be used to close a stuck-open steam generator safety valve for a SGTR was evaluated for Davis-Besse.

Table 7.f-1 and Table 7.f-2, below, provide the internal event and total benefit results for SAMA candidate CB-22R, respectively. Table 7.f-3, below, provides the final results for the ten sensitivity cases for SAMA candidate CB-22R. The implementation cost for this SAMA candidate was estimated as $4,600,000. The high implementation cost of this SAMA candidate is based on replacement of the safety valves with a new design that includes a gagging feature. Therefore, this SAMA candidate is not cost-beneficial at Davis-Besse.

Attachment L-11-154 Page 91 of 92 Table 7.f-1: Internal Events Benefit Results for SAMA Candidate CB-22R CB-22R Case (Gagging_Device)

Off-site Annual Dose (rem) 2.04E+OO Off-site Annual Property Loss ($) 1.56E+03 Comparison CDF 1.0E-05 Comparison Dose (rem) 2.30E+OO Comparison Cost ($) 1.80E+03 Enhanced CDF 9.7E-06 Reduction in CDF 3.00%

Reduction in Off-site Dose 11.30%

Immediate Dose Savings (On-site) $24 Long Term Dose Savings (On-site) $106 Total Accident Related Occupational

$130 Exposure (AOE)

Cleanup/Decontamination Savings (On-

$3,971 site)

Replacement Power Savings (On-site) $4,018 Averted Costs of On-site Property

$7,988 Damage (AOSC)

Total On-site Benefit $8,119 Averted Public Exposure (APE) $6,380 Averted Off-site Damage Savings (AOC) $2,945 Total Off-site Benefit $9,325 Total Benefit (On-site + Off-site) $17,444 Table 7.f-2: Total Benefit Result for SAMA Candidate CB-22R CB-22R (Gagging_Device)

Internal Events $17,444 Fires, Seismic, Other $80,241 Total Benefit $97,685

Attachment L-11-154 Page 92 of 92 Table 7.f-3: Final Results of the Sensitivity Cases for SAMA Candidate CB-22R Low High On-site SAMA Repair On-site Discount Discount Clean-up ID Case Dose Case Rate Case Rate Case Case CB-22R $79,687 $149,212 $71,121 $98,423 $105,097 Off-site th SAMA Replacement Multiplier Evacuation 95 CDF Economic ID Power Case Case Speed Case Cost CB-22R $112,786 $139,550 $99,059 $128,605 $141,643

Enclosure Davis-Besse Nuclear Power Station, Unit No.1 (DBNPS)

Letter L-11-154 Amendment No. 10 to the DBNPS License Renewal Application Page 1 of 35 License Renewal Application Environmental Report (ER) Sections Affected Environmental Report Section EA.2 Table E.3-29 Section 4.20 Section EA.S Table E.3-30 Table 6.1-1 Section E.S.6 Table E.3-31 Section E.9 Table E.3-32 ER Attachment D Table E.3-33 Section D.2.1 Section E.10 Table EA-1 Table E.3-11 Table E.S-3 ER Attachment E Table E.3-21 Table E.S-4 Executive Summary Table E.3-22 Table E.6-1 Section E.3.1 .1.1 Table E.3-23 Table E.7-2 Section E.3.1.2A Table E.3-24 Table E.7-3 Section E.3.2.1 Table E.3-2S Table E.7-S Section E.3A.2 Table E.3-26 Table E.8-1 Section E.3.S.2.4 Table E.3-27 Section EA.1 Table E.3-28 Section E.11 The Enclosure identifies the change to the License Renewal Application (LRA) by Affected LRA Section, LRA Page No., and Affected Paragraph and Sentence. The count for the affected paragraph, sentence, bullet, etc. starts at the beginning of the affected Section or at the top of the affected page, as appropriate. Below each section the reason for the change is identified, and the sentence affected is printed in italics with deleted text lined Ol:Jt and added text underlined.

Enclosure L-11-154 Page 2 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section 4.20 4.20-3 & 4.20-4 Final paragraph In response to RAls 4.b and 5.c, Environmental Report (ER) Section 4.20, "Severe Accident Mitigation Alternatives," final paragraph, is replaced in its entirety, and now reads:

The results of the evaluation of 168 SAMA candidates identified one cost-beneficial enhancement at Davis Besse. Assuming a lower discount rate.

higher dose rates. higher on site clean-up cost. increased replacement power costs. increased external event multiplier. increased off-site economic impact.

and reduced evacuation speed identified the same SAMA candidate to be cost-beneficial. The SAMA candidate identified in the base case and sensitivity cases is not related to plant aging. Therefore. the identified cost-beneficial SAMA candidate is not a required modification for the license renewal period.

Nevertheless. this SAMA candidate will be considered through the normal FENOC processes for evaluating possible modifications to the plant.

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table 6.1-1 6.1-5 Row 76, Environmental Impact column In response to RAI 4.b, ER Table 6.1-1, "Environmental Impacts Related to License Renewal at Davis-Besse," Row 76, Environmental Impact column, is revised to read:

No. Category 2 Issue I Environmental Impact Postulated Accidents 76 Severe accident mitigation alternatives SMALL. No impact from continued operation.

10 CFR 51.53(c)(3)(ii)(L) FENOe fi.ig Rot igBRtify aRY identified one cost-beneficial enhancements, elJt gig ifi6Rtifr ORB potBRtial Gost SBRBfiGiaJ a/liMA GaRgigato, which FENOe will consider through normal processes for evaluating possible changes to the plant.

Enclosure L-11-154 Page 3 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section 0.2.1 0-10 4th bullet on page In response to RAI 4.b, ER Section 0.2.1, "Environmental Impacts - Background Information," last bullet in the Section, is revised to read:

o Severe accidents - The NRC determined that the license renewal impacts from severe accidents would be small, but that applicants should perform site-specific analyses of ways to further mitigate impacts. Results from the FENOC severe accident mitigation alternatives (SAMA) analysis have not identified aRY one cost-beneficial enhancemento-te that may further mitigate risk to public health and the economy in the area of the plant, including the coastal zone, due to potential severe accidents at Davis Besse.

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Attachment E - E-9 4th and 5th paragraphs Executive Summary In response to RAls 4.b and 5.c, the Executive Summary of ER Attachment E, "Severe Accident Mitigation Alternatives Analysis," paragraphs four and five, are revised to read:

The cost-benefit evaluation of SAMA candidates performed for Davis-Besse provides significant insight into the continued operation of Davis-Besse. The results of the evaluation of 4-e+ 168 SAMA candidates indicate no enhanseFRenffi one enhancement to be cost-beneficial for implementation at Davis-Besse. The cost-beneficial SAMA candidate is AC/DG-03, which adds a portable diesel-driven battery charger to the DG system.

HOVl-ever, the The sensitivity cases performed for this analysis found en-e the same SAMA candidate (AG/DC-03) to be cost-beneficial for implementation at Davis-Besse under the assumptions of three of the sensitivity sases (!o'l.'fJr dissount rate, replaseFRent pO'l.'fJr, and FRu#ipJier). SAMA sandidafe ACIDC OJ sons/dered the addition of a portable diesel dri'lf3R battery sharger for the DC

Enclosure L-11-154 Page 4 of 35 system. lower discount rate. higher dose rates. higher on site clean-up cost.

increased replacement power costs. increased external event multiplier.

increased off-site economic impact. and reduced evacuation speed sensitivity cases. While the identified SAMA candidate is not related to plant aging and therefore not required to be resolved as part of the relicensing effort, FENOC will, nonetheless, consider implementation of this candidate through normal processes for evaluating possible changes to the plant.

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.1.1.1 E*19 Second paragraph, first sentence In response to RAI 1.e, ER Section E.3.1.1.1, "Description of Level 1 Internal Events PRA Model," second paragraph, first sentence, is replaced in its entirety, and now reads:

The Davis Besse Level 1 PRA internal events CDF. including internal flooding.

is estimated to be 9.2E-06/vr. and when also including high winds. the CDF is estimated to be 9.BE-06/vr.

Enclosure L-11-154 Page 5 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.1.2.4 E-28 Entire section In response to RAI 3.c, ER Section E.3.1.2.4, "External Event Severe Accident Risk," is deleted in its entirety, as follows:

£.3.1.2.4 External Event SO'lOre Accidont Risk This sOGtion desGrihos tho mothod usod to address extornal o\'lf)nts risk.

As disGussod in SOGtion £.3.1.2.2, Da'iis Bosso usod tho SMA to ovaluate tho risk from soismiG ovents. ",/Rile this mothodology doos not pro'Jido a quantitatiYo resuJt, the rosoli:Jtion of oEJtJiers onSf.HUS that the seisfRiG risk is loVi and fEJrlhor Gost bonofiGia! soismiG improvemonts are not oxpoGtod. Also, as disGEJssod in SOGtion £.3.1.2.3, no othor oxternal ovents vlero foEJnd to OXGood tho sGffJoning criteria. Thorefore, tho FIVE resEJJts were EJsod as a moaSEJre of total oxternal ovents risk.

As disGEJssod in Soction £.3.1.2.1, EJsing tho £PRJ RVE mothodoJogy, DaYis Bosso Gonsorvative!y ostimated tho Firo CDF to bo 2.5E 05/yr. Sinco tho F!VE mothodoJogy Gontains nEJmoroEJS GOnSoPlatisms, a mora reaUstiG assossmont COEJId resuJt in a sEJbstantiaNy /ovler fire CDF. As notod in NEJ 05 01 (Roferonco 2), tho NRC staff has aGGopted that a more reaJistiG fire CDF may bo a factor of threo less than tho sGFOoning vali:Jo obtainod from a RVE analysis.

Basod on tho Davis Bosso FIVE CDF of 2. 5E 05/yr, a faGtor of threo rodEJGtion VlOEJId roSEJJt in a fire CDF of approxifRately 8.3E 06/yr. This valEJo is #70 samo order of magnitudo as tho internal ovents CDF of 9. 2E 06/yr. Therofore, this jEJstifios EJSO of an oxternal ovents mEJJtipJior of throo to tho a'lOrtod Gost ostimates (for internal ovents) to reprosont tho additional SAMA bonofits in oxternal oyonts.

Enclosure L-11-154 Page 6 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.2.1 E-30 Last paragraph In response to RAI 2.a, ER Section E.3.2.1, "Description of the Level 2 PRA Model," the last paragraph of the Section on page E-30, is revised to read:

The SAMA analysis model calculated a LERF of 6.6E-07/year. Table E.3-8 ranks the top 30 components for Level 2 PRA based on Fussell-Vesely importance measure. Table E.3-9 provides the top ten operator actions for Level 2 PRA ranked by Fussell-Vesely importance measure. LERF was quantified using a truncation cutoff frequency of 5.0E-13/vr.

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.4.2 E-34 1st paragraph In response to RAI 4.b, ER Section E.3.4.2, "Population Data," first paragraph, is revised to read:

The population data were extracted using SECPOP2000 (Reference 18) with 2000 census data for Davis Besse sited at latitude of 41 degrees, 35 minutes, 50 seconds, and longitude of 83 degrees, 5 minutes, 11 seconds. To the SECPOP2000 population. Canadian population data in sectors 30-40 miles/N.

30-40 miles/NNE. 30-40 miles/NE. 40-50 miles/N. 40-50 miles/NNE. and 40-50 mileS/NE were added. The Canadian population was estimated by subtracting the SECPOP2000 population data from the total population in the 50-mile radius of Davis-Besse. as reported in Environmental Report Table 2.6-1. Population was assigned to each of the affected six sectors normalized by the land fraction in each of the sectors. The population data were adjusted to account for the transient population within 10 miles of Davis Besse. The transient population segment, includes seasonal residents, transient population, and boating population. The population escalation factor was developed considering different sets of population data, e.g., state-wide versus within a 50-mile radius of the plant.

Enclosure L-11-154 Page 7 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.3.5.2.4 E-45 New paragraph In response to RAI 4.b, ER Section E.3.5.2.4, "Early," a new paragraph for sensitivity case E3 is added to the end of the section, which reads:

Case E3 - The base case was performed with an evacuation speed of 0.58 meters/second, based on Davis-Besse-specific evaluation information, without any correction factor to account for the escalated population. In response to an NRC request for additional information, this sensitivity case was performed to gauge the sensitivity of reducing the evacuation speed. As the population was increased 4. 7 percent per decade for the 20 years of license renewal (total increase of 9.6 percent), it was assumed for this sensitivity case that the increase in population was directly proportional to the decrease in evacuation speed. The evacuation speed for this sensitivity is a 9.6 percent decrease from the base case, i.e., 0.52 meters/second. This change resulted in a minor increase in the consequence values, as shown in Table E.3-33. This is expected as slower evacuation should remove the population from the radiological damage less quickly.

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.1 E-47 1st paragraph on page In response to RAI 4.b, ER Section E.4.1, "Off-site Exposure Cost," the first paragraph on page E-47, is revised to read:

Table E.3-21 provides the off-site dose for each release category obtained for the base case of the Davis Besse Level 3 PRA weighted by the release category frequency. The total off-site dose for internal events (Dt) was estimated to be ~

2.30 person-rem/year. The APE cost was determined using Equation E.4-2 (Reference 1, Section 5.7.1).

Enclosure L-11-154 Page 8 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.1 E-48 Equations E.4-6 and E.4-7 In response to RAI 4.b, ER Section EA.1, "Off-site Exposure Cost," equations E.4-6 and EA-7, are replaced in their entirety, and now read:

Zpha (

= 2,000 $)(

person - rem 2.30 person - rem) yr

= $4600/yr (E.4-6) where.

R = $2.000/person-rem Ot = 2.30 person-rem/year The values for the base case are:

c = 12.27 vr Zpha = $4.600/vr O

APE = (12.27yr { $4;rO ) = $56,442 (E.4-7)

Enclosure L-11-154 Page 9 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.2 E-49 1st paragraph and equations E.4-8 and E.4-9 In response to RAI 4.b, ER Section EA.2, "Off-site Economic Cost," the first paragraph and equations EA-8 and E.4-9, are revised to read:

The term used for off-site economic cost is designated as averted off-site property damage costs (AOCs). The off-site economic loss for a 50-mile radius of the site was determined using the MACCS2 model developed for the Davis Besse Level 3 PRA in Section E.3A. Table E.3-21 provides the economic loss for each release category obtained for the base case of the Level 3 PRA weighted by the release category frequency. The total economic loss from internal events (It) was estimated to be $1,600 $1.800 per year. The averted cost was determined using Equation EA-8 from Reference (1), Section 5.7.5.

(E.4-8) where, AOC = off-site economic costs associated with a severe accident ($)

C = present value factor (yr)

It = monetary value of economic loss per year from internal events before discounting ($/yr)

The values for the base case are:

C = 12.27 yr It = $1,600/yr $1.800Ivr Ace =(12.27yr l( 1800 ; ) =$22,086 (EA-9)

Enclosure L-11-154 Page 10 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.4.5 E-55 Entire section, including equations In response to RAls 3.c and 4.b, ER Section E.4.5, "Total Cost of Severe Accident Risk," is revised to read:

The total cost of severe accident impact for internal events was calculated by summing the public exposure cost, off-site property damage cost, occupational exposure cost, and on-site economic cost. The cost of the impact of a severe accident for internal events was $339,331 $349,147 as shown in Table E.4-1.

Davis Besse does not have external events (fire, seismic, other external events)

PRA from which risk contributors could be combined with the internal events risk.

This analysis assl:JFF/ed that the benefit froFF/ each ha~rd grol:.lp'S (f.e., fire, seisFF/ic, and other externaf eYfJnto) contribl:Jtion is eql:Jivaient to that of internal e'lfJnts. This approach is conservati'ie, based on the discl:Jssion in Section

£'3.1.2. Therefore, the cost of SAMA candidate iFF/pfeFF/entation was cOFnpared

'tilth a benefit yaiI:Je of fol:Jr tiFF/es (f.e., 1x for internaf e'tff)nts pll:Js 3x for externaJ e'lfJnto) that caJeI:JJated for internal e'lfJnts to incfl:Jde the contribl:Jtion froFF/ internal e'lfJnts, fire, seiSFFIic, and other ha~rd grol:Jps. Based on the NRC staff's best estimate, the fire CDF for Davis-Besse is 2.9x10-5/vr [397. To account for the risk contribution from the fire hazard, a ratio between the fire CDF and internal events CDF was used to determine a fire multiplier of 2.90 (see equation E.4-24).

FireCDF 2.9x10- 5 /yr

---

= =2.90 (E.4-24)

Internal Events CDF 1.0x10-5 /yr Based on updated probabilistic seismic hazard estimates due to Generic Issue 199, the NRC staff estimated a "weakest link model" seismic CDF for Davis-Besse of 6. 7x10-6/vr [407. To account for the risk contribution from the seismic hazard, a ratio between the seismic CDF and internal events CDF was used to determine a seismic multiplier of 0.67 (see equation E.4-25).

6 Seismic CDF 6.7x10- /yr 06

---

- 7 (E.4-25)

InternaIEventsCDF-1.0x10-5 /yr - .

This analysis conservatively assumed that the benefit from other hazard groups contribution is equivalent to that of internal events. Therefore, the other hazard groups multiplier is 1. O.

Enclosure L-11-154 Page 11 of 35 To determine the multiplier to account for fire. seismic. and other hazard groups.

the individual multipliers are summed; the resulting multiplier is 4.6.

This approach provided a comparison of the cost to the risk reduction estimated for internal and external events for each SAMA candidate. The maximum benefit for Davis Besse was $1,357,324 $1.955.223 as shown in Table E.4-1.

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.S.6 E-63 1st sentence In response to RAls 4.b and 5.c, ER Section E.5.6, "Initial SAMA Candidate List,"

the first sentence in the section is revised to read:

Based on the review of the aforementioned sources, an initial list of.:J.e+ 168 SAMA candidates was assembled.

Enclosure L-11-154 Page 12 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.9 E-74 1st and 2nd paragraphs In response to RAls 4.b and 5.c, the first and second paragraphs of ER Section E.g, "Conclusions," are revised to read:

The cost-benefit evaluation of SAMA candidates performed for the Davis-Sesse license renewal process provided significant insight into the continued operation of Davis-Sesse. The results of the evaluation of.:t-6+ 168 SAMA candidates indicated no enhanGements to be potentially one enhancement to be cost-beneficial for implementation at Davis-Besse. The cost-beneficial SAMA candidate is AG/DG-03, which adds a portable diesel-driven battery charger to the DG system.

However, the The sensitivity cases performed for this analysis found eRe the same SAMA candidate (AG/DC-03) to be potenUaUy cost-beneficial for implementation at Davis-Besse under the assumptions of the second Oower discount rate), fourth (higher discount rate). fifth (higher on-site clean-up cost).

sixth (increased replacement power costs). seventh (increased external event multiplier), eighth (increased off-site economic impact). and ninth (reduced evacuation speed) sensitivity cases. three of the sensitivity Gases (low C#sGount rate, replaGement po~v6r, and muJtipJter). SAMA GanC#date ACIDC 03 Gonsidored the adC#tion of a portabkJ C#ese! dri'lOn battery Gharger for the DC system. While the identified SAMA candidate is not related to plant aging and therefore not a required modification for the license renewal period, FENOC will, nonetheless, consider implementation of this candidate through the normal processes for evaluating possible plant modifications.

Enclosure L-11-154 Page 13 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Section E.11 E-194 New references In response to RAI 3.c, ER Section E.11, "References," is revised to include two new references cited in revised ER Section E.4.5, as follows:

39. Nuclear Regulatory Commission. "Requests for Additional Information for the Review of the Davis-Besse Nuclear Power Station. Unit 1. License Renewal Application." Accession Number ML110910566. April 20. 2011.

40. Nuclear Regulatorv Commission. Results of SafetY/Risk Assessment of Generic Issue 199. "Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants. "

Accession Number ML100270582. September 7. 2010.

Enclosure L-11-154 Page 14 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-11 E-86 3 rows In response to RAI 4.b, three rows (Le., N, NNE, and NE) in ER Table E.3-11, "Total (Permanent and Transient) Escalated Population (50-Mile Radius - Davis Besse) for the Year 2040," are revised to include the Canadian population within the Davis-Besse 50-mile Emergency Planning Zone, and now reads:

Table E.3-11: Total (Permanent and Transient) Escalated Population (50-Mile Radius - Davis-Besse) for the Year 2040 1 2 3 4 5 10 20 30 40 50 Sector mile miles miles miles miles miles miles miles miles miles N 0 0 0 0 0 0 0 0 151518 448232 NNE 6 0 0 0 0 0 0 0 154651 193313 NE 0 0 0 0 0 0 0 0 38663 96657 ENE 0 0 0 0 0 0 828 0 0 0 E 0 0 0 0 0 0 2229 219 0 13561 ESE 0 0 320 0 0 0 11198 50152 20763 104445 SE 662 661 0 0 6786 27558 7443 9301 35612 11828 SSE 661 729 60 71 109 1593 2075 23880 6229 20419 S 4 12 55 328 651 1680 34083 7301 34694 7138 SSW 17 5 82 79 482 5743 4141 6025 26881 12565 SW 37 20 20 469 197 1728 9970 9130 7669 64607 WSW 0 50 0 35 84 1050 8246 12404 47735 14163 W 0 53 72 66 87 847 19318 259606 102087 25871 WNW 683 723 156 0 7274 4821 7009 207932 58896 13460 NW 0 165 595 0 0 1763 0 53092 20356 25771 NNW 20 138 0 0 0 0 0 20080 77289 233548

Enclosure L-11-154 Page 15 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-21 E-98 Entire table In response to RAI 4.b, ER Table E.3-21, "Base Case Results for Internal Events at 50 Miles," is replaced in its entirety, and now reads:

Table E.3-21: Base Case Results for Internal Events at 50 Miles Release Whole Body Dose Economic Impact Category (50, rem)Jyr (50, $)Jyr 1.1 4.91 E-02 4.77E+01 1.2 3.07E-02 2.93E+01 1.3 1.37E+00 1.33E+03 1.4 3.66E-03 2.B6E+00 2.1 3.25E-02 2.42E+01 2.2 5.56E-01 2.64E+02 3.1 2.20E-03 1.09E+00 3.2 1.35E-04 1.11 E-01 3.3 2.16E-OS 1.07E-02 3.4 1.23E-02 7.B5E+00 4.1 3.73E-05 B.67E-03 4.2 3.57E-02 1.B6E+01 4.3 7.01 E-07 1.19E-04 4.4 1.0BE-02 B.09E+00 5.1 9.77E-03 2.B5E+00 5.2 1.32E-02 1.12E+01 5.3 9.41 E-04 2.66E-01 5.4 7.36E-03 3.B4E+00 6.1 5.50E-04 4.44E-01 6.2 6.07E-05 5.21 E-02 6.3 4.01 E-05 5.B1 E-03 6.4 1.90E-02 7.3BE+00 7.1 5.63E-07 3.05E-05 7.2 7.35E-05 2.63E-02 7.3 5.37E-09 3.45E-07 7.4 B.09E-06 7.13E-04 7.5 3.7SE-OB O.OOE+OO 7.6 6.57E-03 1.64E+00 7.7 2.90E-OB 2.32E-07 7.B 1.92E-02 7.4BE+00 B.1 1.20E-04 7.25E-04 B.2 1.01 E-01 2.B9E+01 9.1 2.03E-03 1.10E-04 9.2 2.09E-02 1.30E+00 Total 2.30E+00 1.80E+03

Enclosure L-11-154 Page 16 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-22 E-99 Entire table In response to RAI 4.b, ER Table E.3-22, "Base Case Consequence Input to SAMA Analysis," is replaced in its entirety, and now reads:

Table E.3-22: Base Case Consequence Input to SAMA Analysis Release Whole Body Dose Economic Impact Category (50, rem) j50, $)

1.1 2.23E+06 2.17E+09 1.2 2.36E+06 2.2SE+09 1.3 2.32E+06 2.26E+09 1.4 3.0SE+06 2.38E+09 2.1 S.41 E+06 4.04E+09 2.2 1.03E+07 4.89E+09 3.1 B.B1E+OS 4.34E+OB 3.2 4.B3E+06 3.97E+09 3.3 B.63E+05 4.27E+OB 3.4 7.22E+06 4.62E+09 4.1 3.73E+04 B.67E+06 4.2 1.0SE+06 S.46E+OB 4.3 6.37E+04 1.0BE+07 4.4 1.40E+06 1.05E+09 S.1 3.37E+OS 9.84E+07 S.2 3.47E+06 2.96E+09 5.3 3.36E+05 9.S0E+07 5.4 B.27E+06 4.32E+09 6.1 1.2SE+06 1.01 E+09 6.2 1.84E+06 1.SBE+09 6.3 B.91 E+03 1.29E+06 6.4 6.12E+05 2.3BE+08 7.1 4.02E+04 2.1BE+06 7.2 1.29E+OS 4.62E+07 7.3 2.44E+03 1.S7E+OS 7.4 3.37E+03 2.97E+05 7.5 1.39E+03 O.OOE+OO 7.6 3.46E+OS 8.64E+07 7.7 8.05E+02 6.45E+03 7.8 1.96E+05 7.63E+07 B.1 1.90E+03 1.1SE+04 8.2 7.79E+OS 2.22E+08 9.1 2.67E+02 1.45E+01 9.2 1.49E+04 9.27E+OS Total 5.97E+07 3.98E+10

Enclosure L~11~154 Page 17 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Tables E.3-23 E-100 & E-101 Entire tables (10 tables) through E.3-32 In response to RAI 4.b, ER Tables E.3~23 through E.3-32 are replaced in their entirety, and now read:

Table E.3-23: Comparison of Base Case and Case 51 Internal Events Base 51 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.52E+00 9.6%

Economic Impact (50) ($/yr) 1.80E+03 1.96E+03 8.9%

Table E.3-24: Comparison of Base Case and Case 52 Internal Events Base 52 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.05E+00 -10.9%

Economic Impact (50) ($/yr) 1.80E+03 1.61 E+03 -10.6%

Table E.3-25: Comparison of Base Case and Case 53 Internal Events Base 53 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.37E+00 3.0%

Economic Impact (50) ($/yr) 1.80E+03 1.80E+03 0.0%

Table E.3-26: Comparison of Base Case and Case M1 Internal Events Base M1 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.36E+00 2.6%

Economic Impact (50) ($/yr) 1.80E+03 1.81 E+03 -0.6%

Enclosure L-11-154 Page 18 of 35 Table E.3-27: Comparison of Base Case and Case M2 Internal Events Base M2 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.20E+00 -4.3%

Economic Impact (50) ($/yr) 1.80E+03 1.78E+03 -1.1%

Table E.3-28: Comparison of Base Case and Case A1 Internal Events Base A1 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 1.75E+00 -23.9%

Economic Impact (50) ($/yr) 1.80E+03 1.42E+03 -21.1%

Table E.3-29: Comparison of Base Case and Case A2 Internal Events Base A2 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 0.30E+00 0.0%

Economic Impact (50) ($/yr) 1.80E+03 1.80E+03 0.0%

Table E.3-30: Comparison of Base Case and Case A3 Internal Events Base A3 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.31E+00 0.4%

Economic Impact (50) ($/yr) 1.80E+03 1.80E+03 0.0%

Table E.3-31: Comparison of Base Case and Case E1 Internal Events Base E1 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 2.28E+00 -0.9%

Economic Impact (50) ($/yr) 1.80E+03 1.80E+03 0.0%

Table E.3-32: Comparison of Base Case and Case E2 Internal Events Base E2 %diff.

Whole Body Dose (50) (person-rem/yr) 2.30E+00 1.86E+00 -19.1%

Economic Impact (50) ($/yr) 1.80E+03 1.38E+03 -23.3%

Enclosure L-11-154 Page 19 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.3-33 E-101 New table In response to RAI 6.j, new ER Table E.3-33, "Comparison of Base Case and Case E3," is added to the ER, which reads:

Table E.3-33: Comparison of Base Case and Case S1 Internal Events

- Base 51  % diff.

Whole Bod'{. Dose (501 (e.erson-rem/'l!l 2.30E+00 2.31E+00 0.4%

Economic Im12.act (501 {$/'l!l 1. BOE+03 1. BOE+03 0.0%

Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.4-1 E-101 Entire table In response to RAls 3.c and 4.b, ER Table E.4-1, "Total Cost of Severe Accident Impact," is replaced in its entirety, and now reads:

Table E.4-1: Total Cost of Severe Accident Impact APE $56,442 AOe $22,086 AOE $4,340 AOSe $266,279 Severe Accident Impact

$349,147 (Internal Events)

Fire, Seismic, Other $1,606,076 Maximum Benefit

$1,955,223 (Internal Events, Fire, Seismic, Other)

Enclosure L-11-154 Page 20 of 35 Affected LRA Section LRA Page Nos. Affected Paragraph and Sentence ER Table E.5-3 E-136 -139 Entire table In response to RAI 2.e, ER Table E.5-3, "Basic Event LERF Importance," is replaced in its entirety, and now reads:

Table E.5-3: Basic Event LERF Importance Event Name F-V RRW Description Steam generator tube rupture <initiating R 9.00E-01 10.031 event>

Operators fail to attempt cooldown via XHAMUCDE 6.04E-01 2.526 makeup/HPI cooling.

Operators fail to cooldown during a steam CHASGDPE 5.35E-01 2.151 generator tube rupture Failure to close MSIV and isolate steam LHAMSIVE 4.92E-01 1.970 generator containing ruptured tube AASGTR11 4.80E-01 1.925 SGTR occurs on OTSG 1-1 <split fraction>

AASGTR12 3.93E-01 1.647 SGTR occurs on OTSG 1-2 <split fraction>

FMMOOO03 7.88E-02 1.086 Any MSSVs on SG 1 fail to reseat ISLOCA due to internal rupture of DHR VD-IEF 7.47E-02 1.081 suction valves Logic Card Fails during operation - MSIV FLC0101F 7.24E-02 1.078 101 fails to close ISLOCA occurs in non-isolable portion of LPPNISOZ 7.11 E-02 1.077 DHR system FMMOOO04 6.80E-02 1.073 Any MSSVs on SG2 fail to reseat Failure to start MDFP as backup to turbine-driven feedwaer pumps for transient, Small QHAMDFPE 6.80E-02 1.073 LOCA or SGTR events Logic Card Fails during operation - MSIV FLC0100F 6.07E-02 1.065 100 fails to close CCF of two components: EC1Z089N &

EC1ZXXXN-CC 1 2 5.18E-02 1.055 EC1Z100N Press switch PSH RC2B4 fails high - fails LPSRC2BH 4.88E-02 1.051 DHR Press switch PSH 7531A fails high - fails LPSZ416H 4.88E-02 1.051 DHR LMVF012R 4.49E-02 1.047 Internal rupture of DH 12 (annual frequency)

CWR Train 1 unavailable due to LMBCWRT1 4.09E-02 1.043 maintenance EDG0012F 3.44E-02 1.036 EDG 1-2 fails to run

Enclosure L-11-154 Page 21 of 35 Table E.S-3: Basic Event LERF Importance (continued)

Event Name F-V RRW Description FCIRCTMP 3.27E-02 1.034 Circ water temperature not acceptable AVV ICS 11 B fails to reseat after steam FW011BT 3.02E-02 1.031 release LMVF011R 2.98E-02 1.031 Internal rupture of DH 11 (annual frequency)

ELOOPRT 2.91 E-02 1.030 LOOP given reactor trip Operators fail to align power from EDG 1-1 EHAD2DGE 2.73E-02 1.028 or EDG 1-2 to supply MDFP given LOOP Operators fail to align power from station blackout diesel generator to supply MDFP EHASBDGE 2.76E-02 1.028 given LOOP AVV ICS11A fails to reseat after steam FW011AT 2.60E-02 1.027 release Internal rupture of DH 11 since cold LMVU011R 2.39E-02 1.024 shutdown Internal rupture of DH 12 since cold LMVU012R 2.39E-02 1.024 shutdown CWR Train 2 unavailable due to LMBCWRT2 2.14E-02 1.022 maintenance ICS logic card fails ICS11 B (AVV SG1) fails FLC011BF 1.95E-02 1.020 to open ICS logic card fails ICS11A (AW SG2) fails FLC011AF 1.83E-02 1.019 to open Breaker HX11 B fails to open - fails power EC1Z100N 1.79E-02 1.018 from SU1 and SU2 to Bus B Breaker HX02B fails to close - fails power EC1Z153C 1.79E-02 1.018 from SU1 to Bus B XHOS-CCW1 RUN2STBY 1.67E-02 1.017 CCW Pump 1 running, Pump 2 in standby XHOS-CCW2RUN1 STBY 1.65E-02 1.017 CCW Pump 2 running, Pump 1 in standby Operators fail to start SBODG and align to EHASBD1E 1.61 E-02 1.016 bus D1 ET4DF12F 1.53E-02 1.016 Transformer DF 1-2 local faults LAV1761N 1.55E-02 1.016 Air-operated valve WC 1761 fails to open EHAD1ACE 1.45E-02 1.015 Failure to lineup alternate source to bus D1 Motor-operated valve DH 11 fails to hold on LMV0011H 1.50E-02 1.015 high exposure EB200D1 F 1.30E-02 1.013 Bus D1 local faults not including fire EDGOSBOF 1.31 E-02 1.013 SBO diesel generator fails to run Manual valve WC 125 fails to close -

LXV0125C 1.11 E-02 1.011 makeup to BWST for SGTR Manual valve WC 169 fails to close -

LXV0169N 1.11 E-02 1.011 makeup to BWST for SGTR

Enclosure L-11-154 Page 22 of 35 Table E.5-3: Basic Event LERF Importance (continued)

Event Name F-V RRW Description Manual valve WC 171 fails to close -

LXV0171C 1.11 E-02 1.011 makeup to BWST for SGTR Manual valve WC 172 fails to close -

LXV0172C 1.11 E-02 1.011 makeup to BWST for SGTR Manual valve BW 1S fails to close - makeup LXVBW1SC 1.11 E-02 1.011 to BWST for SGTR Manual valve BW 16 fails to close - makeup LXVBW16N 1.11 E-02 1.011 to BWST for SGTR Manual valve SF 79 fails to open - makeup LXVSF79N 1.11 E-02 1.011 to BWST for SGTR Manual valve SF BO fails to open - makeup LXVSFBOC 1.11 E-02 1.011 to BWST for SGTR Manual valve SF B7 fails to open - makeup LXVSFB7N 1.11 E-02 1.011 to BWST for SGTR Manual valve SF 92 fails to close - makeup LXVSF92C 1.11 E-02 1.011 to BWST for SGTR Manual valve WC 44 fails to open - makeup LXVWC44N 1.11 E-02 1.011 to BWST for SGTR EDGOSBOA 1.00E-02 1.010 SBO diesel generator fails to start FIV0101C 1.02E-02 1.010 MS 101 (MSIV SG1) fails to close Operators fail to attempt to close DH1A to VHAISOLR 1.02E-02 1.010 isolate ISLOCA Failure to find and isolate ISLOCA resulting ZHAISOLR 1.02E-02 1.010 from reverse flow through LPI injection line FIV0100C B.43E-03 1.009 MS100 (MSIV SG2) fails to close Failure to initiate makeup/HPI cooling after loss of all feed water coincident with reactor UHAMUHPE B.B9E-03 1.009 trip Failure to recover offsite power within one ZOP007BR 9.1SE-03 1.009 hour to prevent loss of DC EMBEDG12 7.76E-03 1.00B EDG Train 2 in maintenance QMBAFP12 7.S6E-03 1.00B AFW train 2 in maintenance Operators fail to initiate makeup to the XHABWMUE 7.B6E-03 1.00B BWST during a SGTR.

EB300F1F 6.47E-03 1.007 Bus F1 local faults EDG0012A 6.SSE-03 1.007 EDG 1-2 fails to start EMBSBODG 7.22E-03 1.007 SBO diesel generator in maintenance LMV0011N 7.02E-03 1.007 Motor-operated valve DH 11 fails to open LMV0012N 7.02E-03 1.007 Motor-operated valve DH 12 fails to open QMBAFP11 6.B7E-03 1.007 AFW train 1 in maintenance XHOS-AMB->40F 7.16E-03 1.007 Ambient temperature is > 40 EC1BET9N 6.03E-03 1.006 CCF for failure of 13.B kV breakers to open EC1CC09N 6.03E-03 1.006 Breaker HX11A OR HX11 B fails to open EC2Z012R S.S2E-03 1.006 Breaker AD1 DF12 fails to remain closed

Enclosure L-11-154 Page 23 of 35 Table E.5-3: Basic Event LERF Importance (continued)

Event Name F-V RRW Description Motor-operated valve DH 11 fails to close LMV0011X 5.96E-03 1.006 while indicating closed Motor-operated valve DH 12 fails to close LMV0012X 5.96E-03 1.006 while indicating closed ISLOCA via Train 1 injection line reverse VL 10-IEF 6.39E-03 1.006 flow (initiating event)

ISLOCA via Train 2 injection line reverse VL20-IEF 6.41 E-03 1.006 flow (initiating event)

EDG0011F 5.35E-03 1.005 EDG 1-1 fails to start FMFWTRIP 4.70E-03 1.005 MFW/ICS faults following trip Internal leak develops in check valve CF 30 LCVF030R 5.37E-03 1.005 (per year)

Internal leak develops in check valve CF 31 LCVF031R 5.35E-03 1.005 (per year)

Enclosure L-11-154 Page 24 of 35 Affected LRA Section LRA Page Nos. Affected Paragraph and Sentence ER Table E.5-4 E-144 - 154 6 rows revised; 1 new row In response to RAls 5.c and 5.f, ER Table E.5-4, "List of Initial SAMA Candidates," is revised as follows:

Table E.5-4: List of Initial SAMA Candidates SAM A Candidate SAMA Candidate Description Derived Benefit Source Identifier This SAMA candidate would provide [2, Table 14]

Install pressure measurements indication of failure of inboard isolation !Table E.5-2l CB-21 between the two DHR suction valves valves allowing time to initiate in the line from the RCS hot leg.

mitigating actions to prevent ISLOCA.

This SAMA candidate will increase the !Table E.5-1l Provide automatic switch over of HPI reliability of switch over of suction from CC-19 and LPI suction from the BWST to the BWST to the containment sump by containment sump for LOCAs. providing both manual and automatic switchover.

This SAMA candidate would increase Davis-Besse containment heat removal ability. containment SAMA candidate CP-19 was added cooling design Install a redundant containment fan CP-19 as a variation to CP-1B to erovide a system.

redundant containment cooling function, in the form of containment fan coolers.

This SAMA candidate would improve !Table E.5-1[

Replace the standby CCW pump CCW reliability by reducing the !Table E.5-2l CW-24 with a pump diverse from the other likelihood of a CCF of all three CCW two CCW pumps.

pumps.

Provide the ability to cool make-up This SAMA candidate would allow !Table E.5-1l CW-25 pumps using fire water in the event continued injection of RCP seal water in !Table E.5-2l of loss of CCW. the event of loss of CCW.

This SAMA candidate would improve {2, Tagle 14}

Perform surveillances on manual the success probability for providing an !Table E.5-1l FW-16 valves used for backup AFW pump alternate water supply to the AFW !Table E.5-2l suction.

pumps.

PRA results show that oeerator actions Table E.5-2 Provide oeerator training with are significant contributors to overall PRA-identified high risk imeortant elant risk. Bl!: highlighting those OT-09R human actions to be emehasized in oeerator actions shown to have the training. highest risk imeortance, the reliabilitl!: of those actions will be imeroved.

Enclosure L-11-154 Page 25 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.6-1 E-155 - E-180 6 rows revised; 1 new row In response to RAls 5.c, 5.g, 5.h, 6.b, and 6.k, ER Table E.6-1, "Qualitative Screening of SAMA Candidates," is revised as follows:

Table E.6-1: Qualitative Screening of SAMA Candidates Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

"Uiis S Il A44 walJle "BelJse I~e ~islf e~ IS&GG Il el<er:!1s B~" ifRl3"Bl<ir:!1 t~e N~eliheee e~ lime,~' ieer:!#fiea#eR aRe e ia1r:!es is e~ IS&GG Il el ter:!1s GFileFier:! E ami #Re"Ba)' ir:!s"Basir:!1I~e lilfeli~eee ef.slJssessflJl mili1a1ir:!1 astier:!s. "f1:jis SIlM4 "@Be slJsslJmee ir:! GS (J7.

Improve operator training on SlJaslJmee CB-08 Davis-Besse has several Q.rocedures in Q.lace to address small and ISLOCA coping. Criterion B interfacing s'i.stem LOCAs. OQ.erators receive training on LOCAs Alread'i. ImQ.lemented and there are a number of indications to sUQ.Q.orl the likelihood and timel'i. identification and diagnosis of ISLOCA events (jncluding tank level indications lifting relief valves and running sumQ. Q.umQ.s!.

Davis-Besse currently has the ability to initiate automatic switchover Add the ability to automatically Criterion E from the BWST to the containment sump on low BWST level, but CC-08 align ECCS to recirculation mode this feature has been deactivated. "Uie easl \fJIJ'd B)' mir:!e r Ie upon BWST depletion. Subsumed reastivale #Ris featme. This SAMA candidate will be subsumed in SAMA candidate CC-19.

Davis-Besse currently has the ability to initiate automatic switchover Provide automatic switchover of Criterion F from the BWST to the containment sump on low BWST level, but HPI and LPI suction from the CC-19 this feature has been deactivated. The eest VJ9IJ!fJ B)' miRer Ie BWST to containment sump for Considered for Further Evaluation <eas#vale #Ris feature. Therefore, this SAMA candidate is LOCAs.

considered for further evaluation.

Enclosure L-11-154 Page 26 of 35 Table E.6-1: Qualitative Screening of SAMA Candidates (continued)

Modification SAMAID Screening Criteria Basis for Screening/Modification Enhancements (Potential Enhancement)

Basefi eA IRe tap 1()() sfJlsels aRfi sempeReRI easis e~'eRI impeFlaRse, GicSfJ'a#Rg waler acealfs ace Ret a s:gR;fiGaAt c:s.1f Q:ilerieR D seAt#l3fJter at Dauis Besse.

Improve inspection of rubber Herr 1:..131'/ BeAefil FL-01 expansion joints on main The circulating water ioints are current/'/. inse.ected during outages condenser. Criterion B and include both interior and exterior inse.ections. Exterior A/read'/. /me./emented inse.ections of the visible e.ortion of the exe.ansion ioint are e.erformed during Engineering s'/.stem wa/kdowns and Oe.erator tours.

Additional/'/. the exe.ansion iOints are e.eriodical/'/. ree./aced.

Q:;lerieA D Ne fi.efis;eAs;es iR epeFaler IraiR;Ag e feefieas4 aFa ifi.eRI;fiefi.

r I

Increase training and operating Herr I:..e BeRefit w

FENOC e.rovides PRA information, such as risk-significant initiating OT-05 experience feedback to improve events high worth oe.erator actions and high worth equie.ment to operator response. Criterion B various dee.artments including Oe.erations Training, and e.resents Alread'/./me.lemented this information on e.osters throughout the e.lant.

Criterion D Steam line breaks are not a significant contributor to CDF or LERF.

Install secondary side guard pipes OT-07 The derived benefit would not justify the implementation cost up to the MSIVs. Very Low Benefit required.

Provide oe.erator training with Davis-Besse e.rovides PRA information such as risk significant PRA-identified high risk ime.ortant Criterion B initiating events, high worth oe.erator actions and high worth OT-09R human actions to be eme.hasized A/read'/. /me./emented equie.ment. This information is e.rovided to various dee.artments and in training. is e.resented on e.osters throughout the e./ant.

Enclosure L-11-154 Page 27 of 35 Affected LRA Section LRA Page No. Affected Paragraph and Sentence ER Table E.7-2 E-183 - 185 Entire table ER Table E.7-3 E-186 Entire table ER Table E.7-5 E-188 Entire table ER Table E.8-1 E-189 - 190 Entire table In response to RAls 3.c and 4.b, ER Tables E.7-2, E.7-3, E.7-5 and E.8-1 are replaced in their entirety, and now read as shown on the following pages:

Enclosure L-11-154 Page 28 of 35 Table E. 7-2: Internal Events Benefit Results for Analysis Case AC/DC-01 AC/DC-03 AC/DC-14 Case Maximum Benefit (DC Battery) (Battery Charger) (GasTurbineGen)

Off-site Annual Dose (rem) 2.30E+00 2.28E+00 2.07E+00 2.05E+00 Off-site Annual Property Loss ($) $1,800 $1,790 $1,610 $1,650 Comparison CDF 4

---

1.0E-05 1.0E-05 1.0E-05 I Comparison Dose (rem) ---- 2.30E+00 2.30E+00 2.30E+00 I

Comparison Cost ($) ---- $1,800 $1,800 $1,800 Enhanced CDF ---- 9.4E-06 7.8E-06 9.0E-06 I Reduction in CDF ---- 6.00% 22.00% 10.00%

Reduction in Off-site Dose ---- 0.87% 10.00% 10.87%

Immediate Dose Savings (On-site) $810 $49 $178 $81 Long Term Dose Savings (On-site) $3,530 $212 $777 $353 Total Accident Related Occupational

$4,340 $260 $955 $434 Exposure (AOE)

Cleanup/Decontamination Savings (On-site) $132,362 $7,942 $29,120 $13,236 Replacement Power Savings (On-site) $133,917 $8,035 $29,462 $13,392 Averted Costs of On-site Property Damage

$266,279 $15,977 $58,581 $26,628 (AOSC)

Total On-site Benefit $270,619 $16,237 $59,536 $27,062 Averted Public Exposure (APE) $56,442 $491 $5,644 $6,135 Averted Off-site Damage Savings (AOe) $22,086 $123 $2,331 $1,841 Total Off-site Benefit $78,528 $614 $7,976 $7,976 I Total Benefit (On-site + Off-site) $349,147 $16,851 $67,512 $35,037 4 The sum of the Containment Systems State frequencies calculated by the Level 2 PRA model is slightly different than the CDF calculated by the Level 1 PRA due to the delete term approximation and the additional systems included in the Level 2 models.

Enclosure L-11-154 Page 29 of 35 Table E.7-2: Internal Events Benefit Results for Analysis Case (continued)

AC/DC-19 AC/DC-21 AC/DC-25 AC/DC-26 Case (FireWaterBackup) (RepairBreakers) (DedDCPower) (GeneratocTDAFW)

Off-site Annual Dose (rem) 2.28E+00 2.29E+00 2.25E+00 2.25E+00 Off-site Annual Property Loss ($) $1,790 $1,790 $1,780 $1,780 4

Comparison CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Comparison Dose (rem) 2.30E+00 2.30E+00 2.30E+OO 2.30E+00 Comparison Cost ($) $1,800 $1,800 $1,800 $1,800 Enhanced CDF 9.8E-06 9.7E-06 8.5E-06 8.5E-06 Reduction in CDF 2.00% 3.00% 15.00% 15.00%

Reduction in Off-site Dose 0.87% 0.43% 2.17% 2.17%

Immediate Dose Savings (On-site) $16 $24 $121 $121 Long Term Dose Savings (On-site) $71 $106 $529 $529 Total Accident Related Occupational

$87 $130 $651 $651 Exposure (AOE)

Cleanup/Decontamination Savings (On-site) $2,647 $3,971 $19,854 $19,854 Replacement Power Savings (On-site) $2,678 $4,018 $20,088 $20,088 Averted Costs of On-site Property Damage

$5,326 $7,988 $39,942 $39,942 (AOSC)

Total On-site Benefit $5,412 $8,119 $40,593 $40,593 Averted Public Exposure (APE) $491 $245 $1,227 $1,227 Averted Off-site Damage Savings (AOC) $123 $123 $245 $245 Total Off-site Benefit $614 $368 $1,472 $1,472 Total Benefit (On-site + Off-site) $6,026 $8,487 $42,065 $42,065 4 The sum of the Containment Systems State frequencies calculated by the Level 2 PRA model is slightly different than the CDF calculated by the Level 1 PRA due to the delete term approximation and the additional systems included in the Level 2 models.

Enclosure L-11-154 Page 30 of 35 Table E.7-2: Internal Events Benefit Results for Analysis Case (continued)

AC/DC-27 CB-21 CC-01 CC-04 Case (SBO_DieseITank) (DHR_valves) (HP,-System) (LP,-pump)

Off-site Annual Dose (rem) 2.30E+00 2.11E+00 2.29E+00 2.30E+00 Off-site Annual Property Loss ($) $1,800 $1,710 $1,790 $1,800 4

Comparison CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Comparison Dose (rem) 2.30E+00 2.30E+00 2.30E+00 2.30E+00 Comparison Cost ($) $1,800 $1,800 $1,800 $1,800 Enhanced CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Reduction in CDF 0.00% 0.00% 0.00% 0.00%

Reduction in Off-site Dose 0.00% 8.26% 0.43% 0.00%

Immediate Dose Savings (On-site) $0 $0 $0 $0 Long Term Dose Savings (On-site) $0 $0 $0 $0 Total Accident Related Occupational

$0 $0 $0 $0 Exposure (AOE)

Cleanup/Decontamination Savings (On-site) $0 $0 $0 $0 Replacement Power Savings (On-site) $0 $0 $0 $0 Averted Costs of On-site Property Damage

$0 $0 $0 $0 (AOSC)

Total On-site Benefit $0 $0 $0 $0 Averted Public Exposure (APE) $0 $4,663 $245 $0 Averted Off-site Damage Savings (AOC) $0 $1,104 $123 $0 Total Off-site Benefit $0 $5,767 $368 $0 Total Benefit (On-site + Off-site) $0 $5,767 $368 $0 4 The sum of the Containment Systems State frequencies calculated by the Level 2 PRA model is slightly different than the CDF calculated by the Level 1 PRA due to the delete term approximation and the additional systems included in the Level 2 models.

Enclosure L-11-154 Page 31 of 35 Table E.7-2: Internal Events Benefit Results for Analysis Case (continued)

CC-05 CC-19 HV-01 HV-03 Case (LP'_Diese'_pump) (BWST_to_Sump) (RedundanCHVAC) (Backup_fans)

Off-site Annual Dose (rem) 2.30E+00 2.30E+00 2.30E+00 2.30E+00 Off-site Annual Property Loss ($) $1,800 $1,800 $1,800 $1,800 4

Comparison CDF 1.0E-05 1.0E-05 1.0E-05 1.0E-05 Comparison Dose (rem) 2.30E+00 2.30E+00 2.30E+00 2.30E+00 Comparison Cost ($) $1,800 $1,800 $1,800 $1,800 Enhanced CDF 1.0E-05 9.9E-06 1.0E-05 1.0E-05 Reduction in CDF 0.00% 1.00% 0.00% 0.00%

Reduction in Off-site Dose 0.00% 0.00% 0.00% 0.00%

Immediate Dose Savings (On-site) $0 $8 $0 $0 Long Term Dose Savings (On-site) $0 $35 $0 $0 Total Accident Related Occupational

$0 $43 $0 $0 Exposure (AOE)

CleanuplDecontamination Savings (On-site) $0 $1,324 $0 $0 Replacement Power Savings (On-site) $0 $1,339 $0 $0 Averted Costs of On-site Property Damage

$0 $2,663 $0 $0 (AOSC)

Total On-site Benefit $0 $2,706 $0 $0 Averted Public Exposure (APE) $0 $0 $0 $0 Averted Off-site Damage Savings (AOC) $0 $0 $0 $0 Total Off-site Benefit $0 $0 $0 $0 Total Benefit (On-site + Off-site) $0 $2,706 $0 $0 4 The sum of the Containment Systems State frequencies calculated by the Level 2 PRA model is slightly different than the CDF calculated by the Level 1 PRA due to the delete term approximation and the additional systems included in the Level 2 models.

Enclosure L-11-154 Page 32 of 35 Table E.7-3: Total Benefit Results for Analysis Cases Maximum AC/DC-01 AC/DC-03 AC/DC-14 AC/DC-19 AC/DC-21 AC/DC-25 Benefit (DC Battery) (Battery Charger) (GasTurbineGen) (FireWaterBackup) (RepairBreakers) (DedDCPower) I Internal Events $349,147 $16,851 $67,512 $35,037 $6,026 $8,487 $42,065 Fires, Seismic,

$1,606,076 $77,513 $310,553 $161,172 $27,719 $39,039 $193,500 Other Total Benefit $1,955,223 $94,363 $378,065 $196,209 $33,745 $47,525 $235,565 J AC/DC-26 AC/DC-27 CB-21 CC-01 CC-04 CC-05 CC-19 (Generator TDAFW) (5BO DieselTank) (DHR valves) (HPI_System) (LPI pump) (LPI Dieselpump) (BWST_to_Sump)

Internal Events $42,065 $0 $5,767 $368 $0 $0 $2,706 Fires, Seismic,

$193,500 $0 $26,528 $1,693 $0 $0 $12,448 Other Total Benefit $235,565 $0 $32,295 $2,061 $0 $0 $15,155 I HV-01 HV-03 (Redundant_HVAC) (Backup_fans)

Internal Events $0 $0 Fires, Seismic,

$0 $0 Other Total Benefit $0 $0

Enclosure L-11-154 Page 33 of 35 Table E.7-5: Final Results of Cost Benefit Evaluation SAMA 2009 Estimated Candidate Modification Estimate Conclusion Benefit 10 Cost Provide additional DC battery AC/DC-01 $94,363 $1,750,000 Not Cost Effective capacity.

Add a portable, diesel-driven AC/DC-03 battery charger to existing DC $378,065 $330,000 Cost Effective system.

AC/DC-14 Install a gas turbine generator. $196,209 $2,000,000 Not Cost Effective Use fire water system as a ACIDC-19 $33,745 $700,000 Not Cost Effective backup source for diesel cooling.

Develop procedures to repair or AC/DC-21 $47,525 $100,000 Not Cost Effective replace failed 4kV breakers.

Provide a dedicated DC power system (battery/battery charger)

AC/DC-25 for the TDAFW control valve and $235,565 $2,000,000 Not Cost Effective NNI-X for steam generator level indication.

Provide an alternator/generator ACIDC-26 that would be driven by each $235,565 $2,000,000 Not Cost Effective TDAFW pump.

Increase the size of the SBO fuel AC/DC-27 $0 $550,000 Not Cost Effective oil tank.

Install pressure measurements between the two DHR suction CB-21 $32,295 $550,000 Not Cost Effective valves in the line from the RCS hot leg.

Install an independent active or CC-01 $2,061 $6,500,000 Not Cost Effective passive HPI system.

CC-04 Add a diverse LPI system. $0 $5,500,000 Not Cost Effective Provide capability for alternate CC-05 $0 $6,500,000 Not Cost Effective LPI via diesel-driven fire pump.

Provide automatic switchover of HPI and LPI suction from the CC-19 $15,155 $1,500,000 Not Cost Effective BWST to containment sump for LOCAs.

Provide a redundant train or HV-01 $0 $50,000 Not Cost Effective means of ventilation.

Stage backup fans in switchgear HV-03 $0 $400,000 Not Cost Effective rooms.

Enclosure L-11-154 Page 34 of 35 Table E.8-1: Final Results of the Sensitivity Cases SAMA Low High On-site On-site 2009 Repair Replacement Candidate Discount Discount Dose Cleanup Estimated Conclusion Case Power Case ID Rate Case Rate Case Case Case Cost AC/DC-01 $58,367 $142,486 $64,929 $95,839 $109,188 $124,566 $1,750,000 Not Cost Effective AC/DC-03 $246,076 $571,954 $262,617 $383,474 $432,421 $488,806 $330,000 Cost Effective AC/DC-14 $136,214 $297,589 $138,018 $198,668 $220,917 $246,546 $2,000,000 Not Cost Effective AC/DC-19 $21,746 $51,031 $23,396 $34,237 $38,686 $43,812 $700,000 Not Cost Effective AC/DC-21 $29,527 $71,774 $32,727 $48,263 $54,938 $62,626 $100,000 Not Cost Effective ACIDC-25 $145,573 $355,685 $162,059 $239,253 $272,626 $311,071 $2,000,000 Not Cost Effective AC/DC-26 $145,573 $355,685 $162,059 $239,253 $272,626 $311,071 $2,000,000 Not Cost Effective AC/DC-27 $0 $0 $0 $0 $0 $0 $550,000 Not Cost Effective C8-21 $32,295 $49,858 $24,719 $32,295 $32,295 $32,295 $550,000 Not Cost Effective CC-01 $2,061 $3,182 $1,578 $2,061 $2,061 $2,061 $6,500,000 Not Cost Effective CC-04 $0 $0 $0 $0 $0 $0 $5,500,000 Not Cost Effective CC-05 $0 $0 $0 $0 $0 $0 $6,500,000 Not Cost Effective CC-19 $9,155 $22,864 $10,383 $15,401 $17,625 $20,188 $1,500,000 Not Cost Effective HV-01 $0 $0 $0 $0 $0 $0 $50,000 Not Cost Effective HV-03 $0 $0 $0 $0 $0 $0 $400,000 Not Cost Effective

Enclosure L-11-154 Page 35 of 35 Table E.8-1: Final Results of the Sensitivity Cases (continued)

SAMA 2009 Multiplier Evacuation Off-site Candidate Estimated Conclusion Case Speed Economic Cost 10 Cost AC/DC-01 $134,805 $125,284 $95,738 $1,750,000 Not Cost Effective AC/DC-03 $540,092 $408,985 $379,439 $330,000 Cost Effective AC/DC-14 $280,299 $227,130 $197,583 $2,000,000 Not Cost Effective AC/DC-19 $48,207 $64,665 $35,119 $700,000 Not Cost Effective AC/DC-21 $67,893 $78,446 $48,899 $100,000 Not Cost Effective AC/DC-25 $336,521 $266,485 $236,939 $2,000,000 Not Cost Effective AC/DC-26 $336,521 $266,485 $236,939 $2,000,000 Not Cost Effective AC/DC-27 $0 $30,920 $1,374 $550,000 Not Cost Effective C8-21 $46,135 $63,215 $33,669 $550,000 Not Cost Effective CC-01 $2,945 $32,982 $3,436 $6,500,000 Not Cost Effective CC-04 $0 $30,920 $1,374 $5,500,000 Not Cost Effective CC-05 $0 $30,920 $1,374 $6,500,000 Not Cost Effective CC-19 $21,649 $46,075 $16,529 $1,500,000 Not Cost Effective HV-01 $0 $30,920 $1,374 $50,000 Not Cost Effective HV-03 $0 $30,920 $1,374 $400,000 Not Cost Effective

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 7 Letter from B. Allen, FirstEnergy, to NRC Document Control Desk, Reply to Supplemental Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No. 1, License Renewal Application (TAC No. ME4613) Environmental Report Severe Accident Mitigation Alternatives Analysis (Sept. 1, 2011)

FENOC... 5501 North State Roule 2 FirstEnergy Nuclear Operating Company Oak Harbor. Ohio 43449 8aII)' S. Ailen 419*321-7676 Vice President - Nuclear Fax: 419*321-7582 September 1, 2011 L-11-251 10 CFR54 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Davis-Besse Nuclear Power Station, Unit No.1 Docket No. 50-346, License Number NPF-3 Reply to Supplemental Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station. Unit No.1. License Renewal Application, (TAC No. ME4613) Environmental Report Severe Accident Mitigation Alternatives Analysis By letter dated August 27, 2010 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML102450565), FirstEnergy Nuclear Operating Company (FENOC) submitted an application pursuant to Title 10 of the Code of Federal Regulations, Part 54 for renewal of Operating License NPF-3 for the Davis-Besse Nuclear Power Station, Unit No.1 (DBNPS). During a telephone conference call on July 29, 2011, with Ms. Paula Cooper, Nuclear Regulatory Commission (NRC)

Environmental Project Manager, the NRC discussed supplemental requests for additional information (RAls) to clarify FENOC responses to the severe accident mitigation alternatives (SAMA) analysis RAls submitted by FENOC letter dated June 24, 2011 (ADAMS Accession No. ML11180A233). FENOC agreed to submit responses to the NRC supplemental SAMA analysis RAls discussed during the call.

The Attachment provides the FENOC response to the NRC supplemental RAls. The NRC request is shown in bold text followed by the FENOC response.

Davis-Besse Nuclear Power Station, Unit No.1 L-11-251 Page 2 There are no regulatory commitments contained in this letter. If there are any questions or if additional information is required, please contact Mr. Clifford I. Custer, Fleet License Renewal Project Manager, at 724-682-7139.

I declare under penalty of perjury that the foregoing is true and correct. Executed on September _1_, 2011.

Sincerely, B~72,,:~

Attachment:

Reply to Supplemental Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No.1 (DBNPS), License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives (SAMA) Analysis cc: NRC DLR Project Manager NRC DLR Environmental Project Manager NRC Region III Administrator cc: wlo Attachment or Enclosure NRC DLR Director NRR DORL Project Manager NRC Resident Inspector Utility Radiological Safety Board

Attachment L-11-251 Reply to Supplemental Request for Additional Information for the Review of the Davis-Besse Nuclear Power Station, Unit No. 1 (DBNPS),

License Renewal Application, Environmental Report, Attachment E, Severe Accident Mitigation Alternatives (SAMA) Analysis Page 1 of 6 Supplemental Question RAI 1.[d]

Clarify whether the scope of the 2008 gap self assessment included Level 2 as well as Level 1 internal events, and whether a review of internal flooding and the high winds hazard was performed.

SUPPLEMENTAL RESPONSE RAI 1.d The 2008 gap self assessment x included Level 2 as well as Level 1 internal events; x did not include internal flooding; and, x did not include high winds.

Supplemental Question RAI 4.b Was the escalation factor for the updated analysis the same one as used originally, and if not what was it? Was transient population considered in the updated analysis?

SUPPLEMENTAL RESPONSE RAI 4.b The population escalation factor used for the updated analysis (accounting for the Canadian population) is the same as was used for the original analysis.

Transient population (between 0-30 miles) was considered in the original analysis. The same transient population was considered in the updated analysis.

Attachment L-11-251 Page 2 of 6 Supplemental Question RAI 5.b Clarify which and how applicable SAMAs meet the intent of improving seismic capacity for the BWST. Address in your response the cited SAMAs (i.e., AC/DC-01, CC-10, and CW-09) and SAMA CC-19.

SUPPLEMENTAL RESPONSE RAI 5.b SAMA candidate CC-10 considers providing an in-containment reactor water storage tank; this SAMA candidate would meet the intent of improving seismic capacity for the borated water storage tank (BWST) by providing a suction source to the injection pumps independent of the BWST.

SAMA candidates AC/DC-01 (provide additional DC battery capacity) and CW-09 (additional training on loss of component cooling water) are not related to the BWST.

SAMA candidate CC-19 addresses switchover from the BWST to the containment sump, which does not meet the intent of improving seismic capacity.

Supplemental Question RAI 5.d

1. Clarify whether the automatic actions that were identified and evaluated in the response to RAI 5.d.ii are the only candidates or meant to be representative of other possibilities. Clarify that further unevaluated potentially cost beneficial automating options do not remain.

2. Describe the PRA modeling assumptions used to calculate the SAMA benefits for AC/DC-[28R] and OT-08R similar to that shown in Table E.7-1 of the ER.

SUPPLEMENTAL RESPONSE RAI 5.d

1. The following SAMA candidates evaluate automating operator actions. Only those SAMA candidates that were evaluated in detail are listed here; SAMA candidates that were screened (or subsumed, or already implemented) are not listed even if they considered automating operator actions.

x AC/DC-14 (Table E.7-1) - makes the station blackout diesel generator and corresponding human failure event perfectly reliable.

x AC/DC-25 (Table E.7-1) - provides dedicated DC power for auxiliary feedwater pump control and eliminates the need for local manual control.

Attachment L-11-251 Page 3 of 6 x AC/DC-26 (Table E.7-1) - provides an alternator/generator driven by the auxiliary feedwater pumps to provide DC power for the auxiliary feedwater pumps and eliminates the need for local manual control.

x AC/DC-27 (Table E.7-1) - makes the human failure event to refuel the station blackout diesel generator fuel tank perfectly reliable.

x AC/DC-28R (RAI 5.d) - automatically starts and loads the station blackout diesel generator on Bus D2 upon loss of power to the bus.

x CC-19 (Table E.7-1) - makes the human failure events for switchover of high pressure injection and low pressure injection suction from the BWST to the containment sump for loss of coolant accidents perfectly reliable.

x CC-22R (RAI 7.d) - automates refill of the BWST.

x CW-26R (RAI 7.a) - automates reactor coolant pump trip on high motor bearing cooling temperature.

x FW-17R (RAI 7.e) - automates start of the motor-driven feedwater pump in the event the automated emergency feedwater system is unavailable.

x OT-08R (RAI 5.d) - automatically starts and loads the station blackout diesel generator on Bus D2 upon loss of power to the bus in combination with automatically starting the motor-driven feedwater pump.

As described in the FENOC response (ML11180A233) to RAI 5.c, internal events and large early release frequency (LERF) basic events (including human failure events) with a risk reduction worth (RRW) equal to or greater than the cost of a procedure change were identified and evaluated. Hardware modifications were also considered based on RRW values. This method was judged to identify all potentially cost-beneficial automating options.

2. The probabilistic risk assessment (PRA) modeling assumptions used to calculate the SAMA benefits for SAMA candidates AC/DC-28R and OT-08R are as follows:

x SAMA candidate AC/DC-28R evaluates automatically starting and loading the Davis-Besse station blackout diesel generator on Bus D2 upon loss of power to the bus.

A bounding assessment of the potential benefit of automatically starting the station blackout diesel generator and loading it on bus D2 upon loss of power to the bus was performed by removing the human action to start the station blackout diesel generator from the cutsets.

Core damage frequency (CDF) = 8.17E-06/yr.

Attachment L-11-251 Page 4 of 6 x SAMA candidate OT-08R evaluates automatically starting and loading the station blackout diesel generator on Bus D2 upon loss of power to the bus in combination with automatically starting the motor-driven feedwater pump.

A bounding assessment of the potential benefit of automatically starting the station blackout diesel generator and loading it on bus D2 upon loss of power to the bus with automatically starting the motor-driven feedwater pump was performed by removing the human actions to start the station blackout diesel generator and motor-driven feedwater pump from the cutsets.

CDF = 5.43E-06/yr.

Supplemental Question RAI 6.j Provide the increased evacuation speed used in the Case E1 sensitivity analysis.

SUPPLEMENTAL RESPONSE RAI 6.j The increased evacuation speed used in sensitivity case E1 (use a more realistic (higher) speed of evaluation (ESPEED)) is 1.0 meters/second.

Supplemental Question RAI 7.a - 7.f Describe the PRA modeling assumptions used to calculate the SAMA benefit similar to that shown in Table E.7-1 of the ER.

SUPPLEMENTAL RESPONSE RAI 7.a - 7.f 7.a A SAMA candidate (CW-26R) to provide an automatic reactor coolant pump trip on loss of cooling to the reactor coolant pump seal thermal barrier cooler and loss of seal injection flow was evaluated for Davis-Besse.

A bounding assessment of the potential benefit of automating a reactor coolant pump trip on high motor bearing cooling temperature or on a loss of cooling to the reactor coolant pump seal thermal barrier cooler and a loss of seal injection flow was performed

Attachment L-11-251 Page 5 of 6 by making the operator action to trip the reactor coolant pumps on loss of seal cooling and injection perfectly reliable.

CDF = 7.50E-06/yr.

7.b As described in the FENOC response (ML11180A233) to RAI 7.b, the Davis-Besse design and PRA already includes use of the Decay Heat Removal System as a suction source for high pressure injection. For cases in which reactor coolant system pressure is too high for adequate flow, the high pressure injection pumps can be aligned to take suction from the discharge of the decay heat removal pumps; this is possible with the BWST as the suction source or with the containment sump as the suction source.

7.c As described in the FENOC response (ML11180A233) to RAI 7.c, this SAMA candidate considers automating high pressure injection on low pressurizer level following a loss of secondary side heat removal where Reactor Coolant System pressure remains high while level drops. This SAMA was a viable consideration for Three Mile Island (TMI) based on plant design and system configuration. At TMI, the High Pressure Injection System is also the makeup system - there is a single Makeup and Purification System that provides normal makeup as well as standby Engineered Safety Actuation Signal (ESAS)-selected pumps which automatically inject high-pressure water into the Reactor Coolant System from the BWST in mitigation of loss of coolant accident scenarios. In addition, as discussed in Volume 3 of the Babcock and Wilcox Emergency Operating Procedure Technical Basis Document (EOP TBD), (Chapter III.C, Lack of Adequate Primary to Secondary Heat Transfer), for all plants except Davis-Besse, high pressure injection cooling must not be intentionally delayed if feedwater is not available. High pressure injection cooling must be established in a timely manner to assure adequate core cooling; it must be started early enough to slow Reactor Coolant System inventory depletion so that high pressure injection cooling will match decay heat before the core is uncovered.

At Davis-Besse, however, the plant design and systems are different from those at TMI.

Davis-Besse has a separate safety High Pressure Injection System in addition to the normally-operating makeup system. The Davis-Besse High Pressure Injection System is not capable of injecting water into the RCS until pressure reaches ~1600 psig. In addition, because Davis-Besse has two makeup pumps, makeup/high pressure injection cooling can be delayed until the core outlet temperature reaches 600°F provided the Reactor Coolant System pressure-temperature limit is not exceeded. Although the Davis-Besse PRA considers makeup/ high pressure injection cooling in response to a loss of feedwater, including the associated operator actions, automating this function was not considered because of the complexity associated with the number of options and systems involved (e.g., pumps, valves, and alignment options, injection line options, and bleed options). Consequently, this SAMA candidate was not considered for Davis-Besse.

Attachment L-11-251 Page 6 of 6 7.d A SAMA candidate (CC-22R) to provide an automatic refill of the BWST was evaluated for Davis-Besse.

A bounding assessment of the potential benefit of automating refill of the BWST was performed by making the operator action to refill the BWST perfectly reliable.

CDF = 9.76E-06/yr.

7.e A SAMA candidate (FW-17R) to automatically start the auxiliary feedwater pump when the emergency feedwater system is unavailable was evaluated for Davis-Besse. Based on the Davis-Besse design, this SAMA was interpreted as automatically starting the motor-driven feedwater pump in the event both turbine-driven auxiliary feedwater pumps were not available.

A bounding assessment of the potential benefit of automating start of the motor-driven feedwater pump was performed by removing cutsets containing operator actions to start the motor-driven feedwater pump, thereby making the operator actions to start the motor-driven feedwater pump perfectly reliable.

CDF = 7.03E-06/yr.

7.f A SAMA candidate (CB-22R) to use a gagging device that could be used to close a stuck-open steam generator safety valve for a steam generator tube rupture was evaluated for Davis-Besse.

A bounding assessment of the potential benefit of utilizing a gagging device on a stuck open main steam safety valve was performed by removing main steam safety valve failures to close from the cutsets.

CDF = 9.24E-06/yr.

FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 8 NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants (Feb. 1995)

NUREG-1465 Accident Source Terms for Light-Water Nuclear Power Plants Final Report U.S. Nuclear Regulatory Commission Offlce of Nuclear Regulatory Research L Soffer, S. B. Burson, C. M. Ferrell, R. Y. Lee, J. N. Ridgely

@* .'/

.. I *0

NUREG-1465 Accident Source Terms for Accident Source Terms for Light-Water Nuclear Power Plants Final Report Manuscript Completed: February 1995 Date Published: February 1995 L Soffer, S. B. Burson, C. M. Ferrell, R. Y. Lee, J. N. Ridgely Division of Systems Technology Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 9 A I8,4

Abstract In 1962 The U.S. Atomic Energy Commission published information on fission product releases has been TLD-14844, "Calculation of Distance Factors for Power developed based on significant severe accident and Test Reactors" which specified a release of fission research. This document utilizes this research by products from the core to the reactor containment in providing more realistic estimates of the "source term" the event of a postulated accident involving a release into containment, in terms of timing, nuclide "substantial meltdown of the core." This "source term," types, quantities, and chemical form, given a severe the basis for the NRC's Regulatory guides 1.3 and 1.4, core-melt accident. This revised "source term" is to be has been used to determine compliance with the NRC's applied to the design of future Light Water Reactors reactor site criteria, 10 CFR Part 100, and to evaluate (LWRs). Current LWR licensees may voluntarily other important plant performance requirements. propose applications based upon it. These will be During the past 30 years substantial additional reviewed by the NRC staff.

iii NUREG-1465

CONTENTS Page Abstract .............................................................................. iii Preface......................................................................................... vii 1 Introduction And Background ...................................... . I 1.1 Regulatory Use of Source Terms ..I........................................................ 1 1.2 Research Insights Since TID-14844 ....................................................... 2 2 Objectives And Scope ...................................... . 3 2.1 General .............................................................................. 3 2.2 Accidents Considered . ........................................................... 3 2.3 Limitations ............................................................................ 4 3 Accident Source Terms ...................................... .5 3.1 Accident Sequences Reviewed ........................................................... 5 3.2 Onset of Fission Product Release ......................................................... 5 3.3 Duration of Release Phases ........................................................... 7 3.4 Fission Product Composition and Magnitude ..........................

. 9 3.5 Chemical Form ........................................................................ 10 3.6 Proposed Accident Source Terms ...................... 12 3.7 Nonradioactive Aerosols ...................... 14 4 Margins And Uncertainties ...................... 15 4.1 Accident Severity and Type ......... .. 15 4.2 Onset of Fission Product Release ......... . . 15 4.3 Release Phase Durations ......... .. 15 4.4 Composition and Magnitude of Releases .................................................. 16 4.5 Iodine Chemical Form .......................................................... 17 5 In-Containment Removal Mechanisms .......................................................... 17 5.1 Containment Sprays .......................................................... 18 5.2 BWR Suppression Pools .......................................................... 18 5.3 Filtration Systems ............................ .............................. 19 5.4 Water Overlying Core Debris ........................................................... 20 5.5 Aerosol Deposition ............................ .............................. 20 6 References ........................................................... 21 TABLES 1.1 Release Phases of a Severe Accident ............... ....................................... 2 3.1 BWR Source Term Contributing Sequences ........................ 5.......................

3.2 PWR Source Tberm Contributing Sequences . ............................................... 6 3.3 Contribution of LOCAs to Core Damage Frequency (CDF)-Internal Events ....... .......... 7 3.4 In-Vessel Release Duration for PWR Sequences ................. .......................... 8 3.5 In-Vessel Release Duration for BWR Sequences .................. ......................... 9 3.6 Release Phase Durations for PWRs and BWRs ................... ......................... 9 3.7 STCP Radionuclide Groups ............ ............................................ 10 3.8 Revised Radionuclide Groups ........................... 10 3.9 Fraction of mean core damage frequency with high, intermediate, and low pressure sequences (internal events only unless otherwise noted) ....................... 11 v NUREG-1465

CONTENTS (Cont'd)

Page 3.10 Mean Values of Radionuclides Into Containment for BWRs, Low RCS Pressure, High Zirconium Oxidation ............ ................................. 11 3.11 Mean Values of Radionuclide Releases Into Containment for PWRs, Low RCS Pressure, High Zirconium Oxidation ....................... ............................. 11 3.12 BWR Releases Into Containment .................................................... 13 3.13 PWR Releases Into Containment .................................................... 13 4.1 Measures of Low Volatile In-Vessel Release Fractions ............... ....................... 16 APPENDICES A Uncertainty Distributions ...................................................... 24 B STCP Bounding Value Releases .......................... ............................ 28 NUREG-1465 vi

Preface In 1962, the Atomic Energy Commission issued provide a postulated fission product source term Technical Information Document (IMD) 14844, released into containment that is based on current "Calculation of Distance Factors for Power and Test understanding of LWR accidents and fission product Reactors." In this document, a release of fission behavior. The information contained in this document products from the core of a light-water reactor (LWR) is applicable to LWR designs and is intended to form into the containment atmosphere ("source term") was the basis for the development of regulatory guidance, postulated for the purpose of calculating off-site doses primarily for future LWRs. This report will serve as a in accordance with 10 CFR Part 100, "Reactor Site basis for possible changes to regulatory requirements.

Criteria." The source term postulated an accident that However, acceptance of any proposed changes will be resulted in substantial meltdown of the core, and the on a case-by-case basis.

fission products assumed released into the containment were based on an understanding at that time of fission Source terms for future reactors may differ from those product behavior. In addition to site suitability, the presented in this report which are based upon insights regulatory applications of this source term (in derived from current generation light-water reactors.

conjunction with the dose calculation methodology) An applicant may propose changes in source term affect the design of a wide range of plant systems. parameters (timing, release magnitude, and chemical form) from those contained in this report, based upon and justified by design specific features.

In the past 30 years, substantial information has been developed updating our knowledge about severe LWR accidents and the resulting behavior of the released fission products. The purpose of this document is to NUREG-1465

1 INTRODUCTION AND BACKGROUND 1.1 Regulatory Use of Source Terms (91%) in elemental (02)form, with 5% assumed to be particulate iodine and 4% assumed to be in organic The use of postulated accidental releases of radioactive form. These assumptions have significantly affected the materials is deeply embedded in the regulatory policy design of engineered safety features. Containment and practices of the U.S. Nuclear Regulatory isolation valve closure times have also been affected by Commission (NRC). For over 30 years, the NRC's these assumptions.

reactor site criteria in 10 CFR Part 100 (Ref. 1) have required, for licensing purposes, that an accidental Use of the TID-14844 release has not been confined to fission product release resulting from "substantial an evaluation of site suitability and plant mitigation meltdown" of the core into the containment be features such as sprays and filtration systems. The postulated to occur and that its potential radiological regulatory applications of this release are wide, consequences be evaluated assuming that the contain- including the basis for (1) the post-accident radiation ment remains intact but leaks at its maximum allowable environment for which safety-related equipment should leak rate. Radioactive material escaping from the be qualified, (2) post-accident habitability requirements containment is often referred to as the "radiological for the control room, and (3) post-accident sampling release to the environment." The radiological release systems and accessibility.

is obtained from the containment leak rate and a knowledge of the airborne radioactive inventory in the containment atmosphere. The radioactive inventory In contrast to the TID-14844 sourge term and within containment is referred to as the containment leakage release used for design basis "in-containment accident source term." accidents, severe accident releases to the environment first arose in probabilistic risk assessments (e.g.,

The expression "in-containment accident source term," Reactor Safety Study, WASH-1400 (Ref. 5)) in as used in this document, denotes the radioactive examining accident sequences that involved core melt material composition and magnitude, as well as the and containments that could fail. Severe accident chemical and physical properties of the material within releases represent mechanistically determined best the containment that are available for leakage from the estimate releases to the environment, including reactor to the environment. The "in-containment estimates of failures of containment integrity. This is accident source term" will normally be a function of very different from the combination of the non-time and will involve consideration of fission products mechanistic release to containment postulated by being released from the core into the containment as TID-14844 coupled with the assumption of very limited well as removal of fission products by plant features containment leakage used for Part 100 siting calcula-intended to do so (e.g., spray systems) or by natural tions for design basis accidents. The worst severe removal processes. accident releases resulting from containment failure or containment bypass can lead to consequences that are For currently licensed plants, the characteristics of the much greater than those associated with a TID-14844 fission product release from the core into the source term released into containment where the containment are set forth in Regulatory Guides 1.3 and containment is assumed to be leaking at its maximum 1.4 (Refs. 2,3) and have been derived from the 1962 leak rate for its design conditions. Indeed, some of the report, TID-14844 (Ref. 4). This release consists of most severe releases arise from some containment 100% of the core inventory of noble gases and 50% of bypass events, such as rupture of multiple steam the iodines (half of which are assumed to deposit on generator tubes.

interior surfaces very rapidly). These values were based largely on experiments performed in the late 1950s Although severe accident source terms have not been involving heated irradiated U0 2 pellets. TID-14844 used in individual plant licensing safety evaluations, also included 1% of the remaining solid fission they have had significant regulatory applications.

products, but these were dropped from consi- Source terms from severe accidents (beyond-design-deration in Regulatory Guides 1.3 and 1.4. The 1% of basis accidents) came into regulatory consideration and the solid fission products are considered in certain usage shortly after the issuance of WASH-1400 in 1975, areas such as equipment qualification. and their application was accelerated after the Three Mile Island accident in March 1979. Current Regulatory Guides 1.3 and 1.4 (Refs. 2 and 3) specify applications rely to a large extent on the results of that the source term within containment is assumed to WASH-1400 and include (1) part of the basis for the be instantaneously available for release and that the sizes of emergency planning zones for all plants, (2) the iodine chemical form is assumed to be predominantly basis for staff assessments of severe accident risk in I NUREG-1465

plant environmental impact statements, and (3) part of Improved modeling of severe accident phenomena, the basis for staff prioritization and resolution of including fission product transport, has been provided generic safety issues, unresolved safety issues, and by the recently developed MELCOR (Ref. 14) code. At other regulatory analyses. Source term assessments this time, however, an insufficient body of calculations based on WASH-1400 methodology appear in many is available to provide detailed insights from this model.

probabilistic risk assessment studies performed to date.

Using analyses based on the STCP and MELCOR codes and NUREG-1150, the NRC has sponsored 1.2 Research Insights Since studies (Refs. 15-17) that analyzed the timing, TID-14844 magnitude, and duration of fission product releases. In addition, an examination and assessment of the Source term estimates under severe accident conditions chemical form of iodine likely to be found within became of great interest shortly after the Three-Mile containment as a result of a severe accident has also Island (rMI) accident when it was observed that only been carried out (Ref. 18).

relatively small amounts of iodine were released to the environment compared with the amount predicted to In contrast to the instantaneous releases that were be released in licensing calculations. This led a number postulated in Regulatory Guides 1.3 and 1.4, analyses of of observers to claim that severe accident releases were severe accident sequences have shown that, despite much lower than previously estimated. differences in plant design and accident sequence, such releases can be generally categorized in terms of The NRC began a major research effort about 1981 to phenomenological phases associated with the degree of obtain a better understanding of fission-product fuel melting and relocation, reactor pressure vessel transport and release mechanisms in LWRs under integrity, and, as applicable, attack upon concrete below severe accident conditions. This research effort has the reactor cavity by molten core materials. The included extensive NRC staff and contractor efforts general phases, or progression, of a severe LWR involving a number of national laboratories as well as accident are shown in Table 1.1.

nuclear industry groups. These cooperative research Table 1.1 Release Phases of a Severe Accident activities resulted in the development and application of a group of computer codes known as the Source Term Code Package (STCP) (Ref. 6) to examine Release Phases core-melt progression and fission product release and transport in LWRs. The NRC staff has also sponsored Coolant Activity Release significant review efforts by peer reviewers, foreign Gap Activity Release partners in NRC research programs, industry groups, Early In-Vessel Release and the general public. The STCP methodology for Ex-Vessel Release severe accident source terms has also been reflected in Late In-Vessel Release NUREG-1150 (Ref. 7), which provides an updated risk assessment for five U.S. nuclear power plants.

Initially there is a release of coolant activity associated with a break or leak in the reactor coolant system.

As a result of the NRC's research effort to obtain a Assuming that the coolant loss cannot be accommo-better understanding of fission product transport and dated by the reactor coolant makeup systems or the release mechanisms in LWRs under severe accident emergency core cooling systems, fuel cladding failure conditions, the STCP emerged as an integral tool for would occur with a release of the activity located in the analysis of fission product transport in the reactor gap between the fuel pellet and the fuel cladding.

coolant system (RCS) and containment. The STCP models release from the fuel with CORSOR (Ref. 8) As the accident progresses, fuel degradation begins, and fission product retention and transport in the RCS resulting in a loss of fuel geometry accompanied by with TRAPMELT (Ref. 9). Releases from core-concrete gradual melting and slumping of core materials to the interactions are modeled using the VANESA and bottom of the reactor pressure vessel. During this CORCON (Ref. 10) codes. Depending upon the period, the early in-vessel release phase, virtually all containment type, SPARC or ICEDF (Refs. 11,12) are the noble gases and significant fractions of the volatile used in conjunction with NAUA (Ref.13) to model the nuclides such as iodine and cesium are released into transport and retention of fission product releases from containment. The amounts of volatile nuclides released the RCS and from core-concrete interactions into the into containment during the early in-vessel phase are containment, with subsequent release of fission strongly influenced by the residence time of the products to the environment consistent with the state radioactive material within the RCS during core of the containment. degradation. High pressure sequences result in long NUREG-1465 2

residence times and significant retention and plateout airborne activity already within containment. Large of volatile nuclides within the RCS, while low pressure scale steam explosions, on the other hand, could result sequences result in relatively short residence times and in significant increases in airborne activity, but are little retention within the RCS and consequently higher much less likely to occur. In any event, releases of releases into containment. particulates or vapors during steam explosions will also be accompanied by large amounts of water droplets, If failure of the bottom head of the reactor pressure which would tend to quickly sweep released material vessel occurs, two additional release phases may occur. from the atmosphere.

Molten core debris released from the reactor pressure vessel into the containment will interact with the 2 OBJECTIVES AND SCOPE concrete structural materials of the cavity below the reactor (ex-vessel release phase). As a result of these 2.1 General interactions, quantities of the less volatile nuclides may be released into containment. Ex-vessel releases are The primary objective of this report is to define a influenced somewhat by the type of concrete in the revised accident source term for regulatory application reactor cavity. Limestone concrete decomposes to for future LWRs. The intent is to capture the major produce greater quantities of CO and CO 2 gases than relevant insights available from recent severe accident basaltic concrete. These gases may, in turn, sparge research on the phenomenology of fission product some of the less volatile nuclides, such as barium and release and transport behavior. The revised source strontium, and small fractions of the lanthanides into term is expressed in terms of times and rates of the containment atmosphere. Large quantities of appearance of radioactive fission products into the non-radioactive aerosols may also be released as a containment, the types and quantities of the species result of core-concrete interactions. The presence of released, and other important attributes such as the water in the reactor cavity overlying any core debris can chemical forms of iodine. This mechanistic approach significantly reduce the ex-vessel releases (both will therefore present, for regulatory purposes, a more radioactive and non-radioactive) into the containment, realistic portrayal of the amount of fission products either by cooling the core debris, or at least by present in the containment from a postulated severe scrubbing the releases and retaining a large fraction in accident.

the water. The degree of scrubbing will depend, of course, upon the depth and temperature of any water 2.2 Accidents Considered overlying the core debris. Simultaneously, and generally with a longer duration, late in-vessel releases In order to determine accident source terms for of some of the volatile nuclides, which had deposited in regulatory purposes, a range of severe accidents that the reactor coolant system during the in-vessel phase, have been analyzed for LWR plants was examined.

will also occur and be released into containment. Evaluation of a range of severe accident sequences was based upon work done in support of NUREG-1150 (Ref. 7). This work is documented in NUREG/CR-5747 Two other phenomena that affect the release of fission (Ref. 17) and employed the integrated Source Term products into containment could also occur, as Code Package (STCP) computer codes, together with discussed in Reference 7. The first of these is referred insights from the MELCOR code, which were used to to as "high pressure melt ejection" (HPME). If the analyze specific accident sequences of interest to RCS is at high pressure at the time of failure of the provide the accident chronology as well as detailed bottom head of the reactor pressure vessel, quantities estimates of fission product behavior within the reactor of molten core materials could be injected into the coolant system and the other pertinent parts of the containment at high velocities. In addition to a plant. The sequences studied progressed to a complete potentially rapid rise in containment temperature, a core melt, involving failure of the reactor pressure significant amount of radioactive material could also be vessel and including core-concrete interactions, as well.

added to the containment atmosphere, primarily in the form of aerosols. The occurrence of HPME is A key decision to be made in defining an accident precluded at low RCS pressures. A second source term is the severity of the accident or group of phenomenon that could affect the release of fission accidents to be considered. Footnote 1 to 10 CFR Part products into containment is a possible steam explosion 100 (Ref. 1). in referring to the postulated fission as a result of interactions between molten core debris product release to be used for evaluating sites, notes and water. This could lead to fine fragmentation of that "Such accidents have generally been assumed to some portion of the molten core debris with an increase result in substantial meltdown of the core with in the amount of airborne fission products. While small subsequent release of appreciable quantities of fission scale steam explosions are considered quite likely to products." Possible choices range from (1) slight fuel occur, they will not result in significant increases in the damage accidents involving releases into containment 3 NUREG-1465

of a small fraction of the volatile nuclides such as the 2.3 Limitations noble gases, (2) severe core damage accidents involving major fuel damage but without reactor vessel failure or The accident source terms defined in this report have core-concrete interactions (similar in severity to the been derived from examination of a set of severe TMI accident), or (3) complete core-melt events with accident sequences for LWRs of current design.

core-concrete interactions. These outcomes are not Because of general similarities in plant and core design equally probable. Since many reactor systems must fail parameters, these results are also considered to be for core degradation with reactor vessel failure to occur applicable to evolutionary LWR designs such as and core-concrete interactions to occur, one or more General Electric's Advanced Boiling Water Reactor systems may be returned to an operable status before (ABWR) and Combustion Engineering's (CE) System core melt commences. Hence, past operational and 80+.

accident experience together with information on modern plant designs, together with a vigorous program Currently, the NRC staff is reviewing reactor designs aimed at developing accident management procedures, for several smaller LWRs employing some passive indicate that complete core-melt events resulting in features for core cooling and containment heat reactor pressure vessel failure are considerably less removal. While the "passive" plants are generally likely to occur than those involving major fuel damage similar to present LWRs, they are expected to have without reactor pressure vessel failure, and that these, somewhat lower core power densities than those of in turn, are less likely to occur than those involving current LWRs. Hence, an accident for the passive slight fuel damage. plants similar to those used in this study would likely extend over a longer time span. For this reason, the timing and duration values provided in the release For completeness, this report displays the mean or tables given in Section 3.3 are probably shorter than average release fractions for all the release phases those applicable to the passive plants. The release associated with a complete core melt. However, it is fractions shown may also be overestimated somewhat concluded that any source term selected for a particular for high pressure sequences associated with the passive regulatory application should appropriately reflect the plants, since longer times for accident progression likelihood associated with its occurrence. would also allow for enhanced retention of fission products in the primary coolant system during core heatup and degradation. Despite the lack of specific It is important to emphasize that the release fractions accident sequence information for these designs, the for the source terms presented in this report are in-containment accident source terms provided below intended to be representative or typical, rather than may be considered generally applicable to the "passive" conservative or bounding values, of those associated designs.

with a low pressure core-melt accident, except for the initial appearance of fission products from failed fuel, The accident source terms provided in this report are which was chosen conservatively. The release fractions not considered applicable to reactor designs that are are not intended to envelope all potential severe very different from LWRs, such as high-temperature accident sequences, nor to represent any single gas-cooled reactors or liquid-metal reactors.

sequence, since accident sequences yielding both higher as well as lower release fractions were examined and Recent information has indicated that high burnup fuel, factored into the final report presented here. that is, fuel irradiated at levels in excess of about 40 GWD/MTU, may be more prone to failure during Source terms for future reactors may differ from those design basis reactivity insertion accidents (RIA) than presented in this report which are based upon insights previously thought. Preliminary indications are that derived from current generation light-water reactors. high burnup fuel also may be in a highly fragmented or An applicant may propose changes in source term powdered form, so that failure of the cladding could parameters (timing, release magnitude, and chemical result in a significant fraction of the fuel itself being form) from those contained in this report, based upon released. In contrast, the source term contained in this and justified by design specific features. report is based upon fuel behavior results obtained at lower burnup levels where the fuel pellet remains intact upon cladding failure, resulting in a release only The NRC staff also intends to allow credit for removal of those fission product gases residing in the gap or reduction of fission products within containment via between the fuel pellet and the cladding. Because of engineered features provided for fission product this recent information regarding high burnup fuels, the reduction such as sprays or filters, as well as by natural NRC staff cautions that, until further information processes such as aerosol deposition. These are indicates otherwise, the source term in this report discussed in Section 5. (particularly gap activity) may not be applicable for fuel NUREG-1465 4

irradiated to high burnup levels (in excess of about 40 considered to significantly impact the source term are GWDIMTU). summarized in Thble 3.1 for BWRs and Table 3.2 for PWRs.

3 ACCIDENT SOURCE TERMS 3.2 Onset of Fission Product Release The expression "in-containment source terms," as used This section discusses the assumptions used in selecting in this report, denotes the fission product inventory the scenario appropriate for defining the early phases present in the containment at any given time during an of the source term (coolant activity and gap release accident. lb evaluate the in-containment source term phases). It was considered appropriate to base these during the course of an accident, the time-history of the early release phases on the design basis initiation that fission product release from the core into the could lead to earliest fuel failures.

containment must be known, as well as the effect of fission product removal mechanisms, both natural and A review of current plant final safety analysis reports engineered, to remove radioactive materials from the (FSARs) was made to identify all design basis accidents containment atmosphere. This section discusses the in which the licensee had identified fuel failure. For all time-history of the fission product releases into the accidents with the potential for release of radioactivity containment. Removal mechanisms are discussed in into the environment, the class of accident that had the Section 5. shortest time until the first fuel rod failed was the design basis LOCA. As might be expected, the time 3.1 Accident Sequences Reviewed until cladding failure is very sensitive to the design of the reactor, the type of accident assumed, and the fuel All the accident sequences identified in NUREG-1150 rod design. In particular, the maximum linear heat were reviewed and some additional Source lbrm Code generation rate, the internal fuel rod pressure, and the Package (STCP) and MELCOR calculations were stored energy in the fuel rod are significant p&formed. The dominant sequences which are considerations.

Table 3.1 BWR Source Term Contributing Sequences Plant Sequence Description Peach Bottom TC1 ATWS with reactor depressurized TC2 ATWS with reactor pressurized TC3 TC2 with wetwell venting TB1 SBO with battery depletion TB2 TB1 with containment failure at vessel failure S2E1 LOCA (2"), no ECCS and no ADS S2E2 S2E1 with basaltic concrete V RHR pipe failure outside containment TBUX SBO with loss of all DC power LaSalle TB SBO with late containment failure Grand Gulf TC ATWS early containment failure fails ECCS TBI SBO with battery depletion TB2 TB1 with H2 burn fails containment TBS SBO, no ECCS but reactor depressurized TBR TBS with AC recovery after vessel failure SBO Station Blackout LOCA Loss of Coolant Accident RCP Reactor Coolant Pump RHR Residual Heat Removal ADS Automatic Depressurization System ATWS Anticipated Transient Without Scram 5 NUREG-1465

Table 3.2 PIVR Source Term Contributing Sequences Plant Sequence Description Surry AG LOCA (hot leg), no containment heat removal systems TMLB' LOOP, no PCS and no AFWS V Interfacing system LOCA M3B SBO with RCP seal LOCA S2D-8 SBLOCA, no ECCS and H2 combustion S2D-p SBLOCA with 6" hole in containment Zion S2DCR LOCA (2"), no ECCS no CSRS S2DCF1 LOCA RCP seal, no ECCS, no containment sprays, no coolers-H 2 burn or DCH fails containment S2DCF2 S2DCF1 except late H2 or overpressure failure of containment TMLU Transient, no PCS, no ECCS, no AFWS-DCH fails containment Oconee 3 TMLB' SBO, no active ESF systems S1DCF LOCA (3"), no ESF systems Sequoyah S3HF1 LOCA RCP, no ECCS, no CSRS with reactor cavity flooded S3HF2 S3HF1 with hot leg induced LOCA 3HF3 S3HF1 with dry reactor cavity M3B LOCA (3") with SBO TBA SBO induces hot leg LOCA-hydrogen burn fails containment ACD LOCA (hot leg), no ECCS no CS M3B1 SBO delayed 4 RCP seal failures, only steam driven AFW operates S3HF LOCA (RCP seal), no ECCS, no CSRS S3H LOCA (RCP seal) no ECC recirculation SBO Station Blackout LOCA Loss of Coolant Accident RCP Reactor Coolant Pump DCH Direct Containment Heating PCS Power Conversion System ESF Engineered Safety Feature CS Containment Spray CSRS CS Recirculation System ATWS Anticipated Transient Without Scram LOOP Loss of Offsite Power The details of the specific accident sequences are documented in NUREG/CR-5747, Estimate of Radionuclide Release Characteristics into Containment Under Severe Accident Conditions (Ref. 17).

To determine whether a design basis LOCA was a LOCA is considered a reasonable initiator to assume reasonable scenario upon which to base the timing of for modeling the earliest appearance of the gap activity initial fission product release into the containment, if the plant has not been approved for leak before various PRAs were reviewed to determine the break (LBB) operation. For plants that have received contribution to core damage frequency (CDF) resulting LBB approval, a small LOCA (6" line break) would from LOCAs. This information is shown in Table 3.3. more appropriately model the timing. For BWRs, large As can be seen from this table, LOCAs are a small LOCAs may not be an appropriate scenario for gap contributor to CDF for BWRs, but can be a substantial activity timing. However, since the time to initial fuel contributor for PWRs. Therefore, for PWRs a large rod failure is long for BWRs, even for large LOCAs, NUREG-1465 6

use of the large LOCA scenario should not unduly performed to identify the size of the LOCA that penalize BWRs and will maintain consistency with the resulted in the shortest fuel rod failure time (Ref. 15).

assumptions for the PWR. As with the PWR, for an In both cases, the accident was a double-ended LBB approved plant, the timing associated with a small guillotine rupture of the cold leg pipe. The minimum LOCA (6" line break) would be more appropriate. time from the time of accident initiation until first fuel In order to provide a realistic estimate of the shortest rod failure was calculated to be 13 and 24.6 seconds for time for fuel rod failure for the LOCA, calculations the B&W and _ plants, respectively. A sensitivity were performed using the FRAPCON2, study was performed to determine the effect of tripping SCDAP/RELAP5 MOD 3.0, and FRAPT6 computer or not tripping the reactor coolant pumps. The results codes for two plants. The two plants were a Babcock indicated that tripping of the reactor coolant pumps and Wilcox (B&W) plant with a 15 by 15 fuel rod array had no appreciable impact on timing. For a 6-inch line and a Westinghouse 4-loop (M!) plant with a 17 by 17 break, the time until first fuel rod failure is expected to fuel rod array. For each plant, a sensitivity study was be greater than 6.5 and 10 minutes, respectively.

Table 33 Contribution of LOCAs to Core Damage Frequency (CDF)-Internal Events Percent or CDF Percent of CDF caused by large LOCAs Boiling Water Reactors caused by LOCAs (>6" line break)

Peach Bottom (NUREG-1150) 3.5 1.0 Grand Gulf (NUREG-1150) 0.1 0.03 Millstone 1 (Utility) 23 13 Pressurized W'ater Reactors Surry (NUREG-1150) 15 4.3 Sequoyah (NUREG-1150) 63 4.6 Zion (NUREG-1150) 87 1.4 Calvert Cliffs (IREP) 21 <1 Oconee-3 (EPRI/NSAC) 43 3.0 A comparison calculation was done using the TRAC- Source terms for future reactors may differ from those PF1 MOD I code, version 14.3U5Q.LG on the W presented in this report which are based upon insights plant. This analysis indicated that the first fuel rod derived from current generation light-water reactors.

failure would occur 34.9 seconds after pipe rupture, in An applicant may propose changes in source term contrast to the value of 24.6 seconds calculated using parameters (timing, release magnitude, and chemical SCDAPIRELAP. The reasons for the difference form) from those contained in this report, based upon between the SCDAP/RELAPS MOD 3.0 and and justified by design specific features.

TRAC-PF1 MOD 1 are discussed in Reference 15.

3.3 Duration of Release Phases The review of the FSARs for BWRs indicates that fuel failures may occur significantly later, on the order of Section 1.2 provided a qualitative discussion of the release phases of an accident. This section provides several minutes or more. No calculations have been estimated durations for these release phases.

performed using the aforementioned suite of codes.

The coolant activity phase begins with a postulated pipe For determining the time of appearance of gap activity rupture and ends when the first fuel rod has been in the containment (i.e., initial fuel failure), which estimated to fail. During this phase, the activity corresponds to the duration of the coolant activity released to the containment atmosphere is that phase and the beginning of the gap activity phase, it associated with very small amounts of radioactivity would be appropriate to perform a plant specific dissolved in the coolant itself. As discussed in Section calculation using the codes described above. However, 3.2 above, this phase is estimated to last about 25 if no plant specific calculations are performed, the seconds for Westinghouse PWRs, and about 13 seconds minimum times discussed above may be used to provide for B&W PWRs, assuming a large break LOCA. For a an estimate of the earliest time to fuel rod failure. smaller LOCA (e.g., a 6-inch line break), such as would 7 NUREG-1465

be considered for a plant that has received LBB than about 30 minutes and 60 minutes for PWRs and approval, the coolant activity phase duration would be BWRs, respectively, after the onset of the accident.

expected to be at least 10 minutes. Although not However, more recent calculations (Ref. 19) for the specifically evaluated at this time, Combustion Peach Bottom plant using the MELCOR code Engineering (CE) PWRs would be expected to have indicated that the durations of the gap release for three coolant activity durations similar to Westinghouse BWR accident sequences were about 30 minutes, as plants. For BWRs, the coolant activity phase would be well. On this basis, the duration of the gap activity expected to last longer; however, unless plant specific release phase has been selected to be 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, for calculations are made, the durations discussed above both PWRs and BWRs.

are considered applicable.

During the early in-vessel release phase, the fuel as The gap activity release phase begins when fuel well as other structural materials in the core reach cladding failure commences. This phase involves the sufficiently high temperatures that the reactor core release of that radioactivity that has collected in the geometry is no longer maintained and fuel and other' gap between the fuel pellet and cladding. This process materials melt and relocate to the bottom of the releases to containment a few percent of the total reactor pressure vessel. During this phase, significant inventory of the more volatile radionuclides, quantities of the volatile nuclides in the core inventory particularly noble gases, iodine, and cesium. During this as well as small fractions of the less volatile nuclides phase, the bulk of the fission products continue to be are estimated to be released into containment. This retained in the fuel itself. The gap activity phase ends release phase ends when the bottom head of the when the fuel pellet bulk temperature has been raised reactor pressure vessel fails, allowing molten core sufficiently that significant amounts of fission products debris to fall onto the concrete below the reactor can no longer be retained in the fuel. As noted in pressure vessel. Release durations for this phase vary Reference 16, a review of STCP calculated results for depending on both the reactor type and the accident six reference plants, PWRs as well as BWRs, indicated sequence. Tables 3.4 and 3.5, based on results from that significant fission product releases from the bulk of Reference 16, show the estimated duration times for the fuel itself were estimated to commence no earlier PWRs and BWRs, respectively.

Table 3.4 In-Vessel Release Duration for PWR Sequences Release Duration Plant Accident Sequence (Min)

Surry TMLB' (H) 41 Surry S3B (H) 36 Surry AG (L) 215 Surry V (L) 104 Zion TMLU (H) 41 Zion S2DCR/S2DCF (H) 39 Sequoyah S3HF/S3B (H) 46 Sequoyah S3B1 (H) 75 Sequoyah TMLB' (H) 37 Sequoyah TBA (L) 195 Sequoyah ACD (L) 73 Oconee TMLB' (H) 35 Oconee SPDCF (L) 84

• (H or L) Denotes whether the accident occurs at high or low pressure.

Based on the information in these tables, the staff release phase have been selected to be 1.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and concludes that the in-vessel release phase is somewhat 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, for PWR and BWR plants respectively, as longer for BWR plants than for PWR plants. This is recommended by Reference 17.

largely due to the lower core power density in BWR plants that extends the time for complete core melt. The ex-vessel release phase begins when molten core Representative times for the duration of the in-vessel debris exits the reactor pressure vessel and ends when NUREG-1465 &

Table 3.5 In-Vessel Release Duration for BWR Sequences Release Duration Plant Accident Sequence* (Min)

Peach Bottom TC2 (H) 66 Peach Bottom TC3 68 Peach Bottom TC1 (L) 97 Peach Bottom TB1ITB2 (H) 91 Peach Bottom V (L) 69 Peach Bottom S2E (H) 81 Peach Bottom TBUX (H) 67 LaSalle TB (H) 81 Grand Gulf TB (H) 122 Grand Gulf TC1 (L) 130 Grand Gulf TBS/TBR (L) 96

• (H or L) denotes whether the accident occurs at high or low pressure.

the debris has cooled sufficiently that significant release phase to have a duration of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. This value quantities of fission products are no longer being has been selected for this report.

released. During this phase, significant quantities of the volatile radionuclides not already released during the A summary of the release phases and the selected early in-vessel phase as well as lesser quantities of duration times for PWRs and BWRs is shown for non-volatile radionuclides are released into reference purposes in Table 3.6.

containment. Although releases from core-concrete interactions are predicted to take place over a number Table 3.6 of hours after vessel breach, Reference 16 indicates Release Phase Durations for PWRs and BWRs that the bulk of the fission products (about 90%), with the exception of tellurium and ruthenium, are expected Duration, Duration, to be released over a 2-hour period for PWRs and a PWRs BWRs 3-hour period for BWRs. For tellurium and ruthenium, Release Phase (Hours) (Hours) ex-vessel releases extend over 5 and 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, respectively, for PWRs and BWRs. The difference in Coolant Activity 10 to 30 seconds 30 seconds' duration of the ex-vessel phase between PWRs and Gap Activity 0.5 0.5 BWRs is largely attributable to the larger amount of zirconium in BWRs, which provides additional chemical Early In-Vessel 1.3 1.5 energy of oxidation. Based on Reference 17, the Ex-Vessel 2 3 ex-vessel release phase duration is taken to be 2 and 3 Late In-Vessel 10 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, respectively, for PWRs and BWRs.

Without approval for leak-before-break. Coolant activity phase duration is assumed to be 10 minutes The late in-vessel release phase commences at vessel with leak-before-break approval.

breach and proceeds simultaneously with the occurrence of the ex-vessel phase. However, the 3.4 Fission Product Composition and duration is not the same for both phases. During this Magnitude release phase, some of the volatile nuclides deposited within the reactor coolant system earlier during core In considering severe accidents in which the contain-degradation and melting may re-volatilize and be ment might fail, WASH-1400 (Ref. 5) examined the released into containment. Reference 17, after a review spectrum of fission products and grouped 54 radionu-of the source term uncertainty methodology used in clides into 7 major groups on the basis of similarity in NUREG-1150 (Ref. 7), estimates the late in-vessel chemical behavior. The effort associated with the STCP 9 NUREG-1465

further analyzed these groupings and expanded the 7 Similarly, low pressure sequences cause aerosols fission product groups into 9 groups. These are shown generated within the RCS to be swept out rapidly in Table 3.7. without significant retention within the RCS, thereby resulting in higher release fractions from the core into containment.

Table 3.7 STCP Radionuclide Groups Group Elements Table 3.8 Revised Radionuclide Groups 1 Xe, Kr Group Title Elements in Group 2 I, Br 3 Cs, Rb 1 Noble gases Xe, Kr 4 Te, Sb, Se 2 Halogens I, Br 5 Sr 3 Alkali Metals Cs, Rb 6 Ru, Rh, Pd, Mo, 'T 4 Tellurium group 'T, Sb, Se 5 Barium, strontium Ba, Sr 7 La, Zr, Nd, Eu, Nb, Pm, Pr, Sm, Y 8 Ce, Pu, Np 6 Noble Metals Ru, Rh, Pd, Mo, Tc, Co 7 Lanthanides La, Zr, Nd, Eu, Nb, Pm, 9 Ba Pr, Sm, Y, Cm, Am 8 Cerium group Ce, Pu, Np Both the results of the STCP analyses and the uncertainty analysis (using the results of the NUREG-1150 source term expert panel elicitation) The relative frequency of occurrence of high vs. low reported in NUREG/CR-5747 (Ref. 17) indicate only pressure sequences were examined for both BWRs and minor differences between Ba and Sr releases. Hence, PWRs. The results of this survey are shown in a revised grouping of radionuclides has been developed Thble 3.9, and they indicate that a significant fraction of that groups Ba and Sr together. The relative the sequences examined, in terms of frequency, importance to offsite health and economic occurred at low pressure. In addition, advanced PWR consequences of the radioactive elements in a nuclear designs are increasingly incorporating safety-grade reactor core has been examined and documented in depressurization systems, primarily to minimize the NUREG/CR-4467 (Ref. 20). In addition to the likelihood of high pressure melt ejection (HPME) with elements already included in Thble 3.7, Reference 20 its associated high containment atmosphere heat loads found that other elements such as Curium could be and large amounts of atmospheric aerosols.

important for radiological consequences if released in sufficiently large quantities. For this reason, group 7 has been revised to include Curium (Cm) and For these reasons, the composition and magnitude of Americium (Am), while group 6 has been revised to the source term has been chosen to be representative include Cobalt (Co). The revised radionuclide groups of conditions associated with low pressure in the RCS used in this report including revised titles and the at the time of reactor core degradation and pressure elements comprising each group are shown in Table 3.8. vessel failure. Reference 17 provides estimates of the mean core fractions released into containment, as estimated by NUREG-1150 (Ref. 7), for accident Source term releases into the containment were sequences occurring under low RCS pressure and high evaluated by reactor type, i.e., BWR or PWR, from the zirconium oxidation conditions. These are shown in sequences in NUREG-1150 and the supplemental Tables 3.10 and 3.11.

STCP calculations discussed in Section 3.1.

Releases into containment during the early in-vessel 3.5 Chemical Form phase, prior to reactor pressure vessel failure, are markedly affected by retention in the RCS, which is a The chemical form of iodine and its subsequent function of the residence time in the RCS during core behavior after entering containment from the reactor degradation. High pressure in the RCS during core coolant system have been documented in degradation allows for longer residence time of NUREG/CR-5732, Iodine Chemical Forms in LWR aerosols released from the core. This, in turn, permits Severe Accidents (Ref. 18) and in ORNLITM-12202, increased retention of aerosols within the RCS and "Models of Iodine Behavior in Reactor Containments,"

lower releases from the core into the containment. (Ref. 21).

NUREG-1465 10

Table 3.9 Fraction of mean core damage frequency with high, intermediate, and low pressure sequences (internal events only unless otherwise noted)

Low Pressure at High Pressure at Intermed. press. Vessel Breach Boiling Water Reactors Vessel Breach at vessel breach (<200 psi) No vessel breach LaSalle-external events only 0.27 N/A 0.67 0.06 LaSalle-internal events only 0.19 N/A 0.62 0.19 Grand Gulf 0.28 N/A 0.51 0.21 Peach Bottom 0.51 N/A 0.41 0.08 Pressurized Water Reactors Surry 0.06 0.07 0.37 0.50 Sequoyah 0.14 0.21 0.24 0.41 Zion 0.03 0.15 0.72 0.10 Table 3.10 Mean Values or Radionuclides Into Containment for BW'Rs, Low RCS Pressure, High Zirconium Oxidation Nuclide Early In-Vessel Ex-Vessel Late In-vessel N.G. 1.0 0 0 I 0.27 0.37 0.07 Cs 0.2 0.45 0.03 le 0.11 0.38 0.01 Sr 0.03 0.24 0 Ba 0.03 0.21 0 Ru 0.007 0.004 0 La 0.002 0.01 0 Ce 0.009 0.01 0 Table 3.11 Mean Values of Radionuclide Releases Into Containment for PWRs, Low RCS Pressure, High Zirconium Oxidation Nuclide Early In-Vessel Ex-Vessel Late In-vessel N.G. 1.0 0 0 I 0.4 0.29 0.07 Cs 0.3 0.39 0.06

,lb 0.15 0.29 0.025 Sr 0.03 0.12 0 Ba 0.04 0.1 0 Ru 0.008 0.004 0 La 0.002 0.015 0 Ce 0.01 0.02 0 11 NUREG-1465

The results from Ref. 18 indicate that iodine entering values of 7 or greater within the containment, the containment is at least 95% CsI with the remaining elemental iodine can be taken as comprising no more 5% as I plus HI, with not less than 1% of each as I and than 5 percent of the total iodine released, and iodine HI. Once the iodine enters containment, however, in organic form may be taken as comprising no greater additional reactions are likely to occur. In an aqueous than 0.15 percent (3 percent of 5 percent) of the total environment, as expected for LWRs, iodine is expected iodine released.

to dissolve in water pools or plate out on wet surfaces in ionic form as I-. Subsequently, iodine behavior Organic iodide formation in BWRs versus PWRs is not within containment depends on the time and pH of the notably different. Reference 18 examined not only water solutions. Because of the presence of other iodine entering containment as CsI; but also considered dissolved fission products, radiolysis is expected to other reactions that might lead to volatile forms of occur and lower the pH of the water pools. Without any iodine within containment, such as reactions of CsOH pH control, the results indicate that large fractions of with surfaces and revaporization of CsI from RCS the dissolved iodine will be converted to elemental surfaces. Reference 18 indicates (Thble 2.4) that for the iodine and be released to the containment atmosphere. Peach Bottom TC2 sequence, the estimated percentage However, if the pH is controlled and maintained at a of iodine as HI was 3.2 percent, not notably less than value of 7 or greater, very little (less than 1%) of the the PWR sequences examined. While organic iodide is dissolved iodine will be converted to elemental iodine. formed largely from reactions of elemental iodine, Ref.

Some considerations in achieving pH control are 22 clearly notes that reactions with HI may be discussed in NUREG/CR-5950, "Iodine Evolution and important.

pH Control," (Ref. 22).

Although organic iodine is not readily removed by containment sprays or filter systems, it is unduly Organic compounds of iodine, such as methyl iodide, CH 3 1, can also be produced over time largely as a conservative to assume that organic iodine is not removed at all from the containment atmosphere, once result of elemental iodine reactions with organic generated, since such an assumption can result in an materials. Organic iodide formation as a result of overestimate of long-term doses to the thyroid.

reactor accidents has been surveyed in WASH-1233, References 23 and 24 discuss the radiolytic destruction "Review of Organic Iodide Formation Under Accident of organic iodide, and Standard Review Plan Section Conditions in Water-Cooled Reactors," (Ref. 23), and (S.R.P.) 6.5.2 notes the above reference and indicates more recently in NUREG/CR-4327, "Organic Iodide that removal of organic iodide may be considered on a Formation Following Nuclear Reactor Accidents," case-by-case basis. A rational model for organic iodine (Ref.24). From an analysis of a number of containment behavior within containment would consider both its experiments, WASH-1233 concluded that, considering formation as well as destruction in a time-dependent both non-radiolytic as well as radiolytic means, no more than 3.2 percent of the airborne iodine would be fashion. Development of such a model, however, is beyond the scope of the present report.

converted to organic iodides during the first two hours following a fission product release. The value of 3.2 Clearly, where the pH is not controlled to values of 7 percent was noted as a conservative upper limit and was or greater, significantly larger fractions of elemental judged to be considerably less, since it did not account, iodine, as well as organic iodine may be expected within among other things, for decreased radiolytic formation containment.

of organic iodide due to iodine removal mechanisms within containment. Reference 24 also included results All other fission products, except for the noble gases involving irradiated fuel elements, and concluded that and iodine, discussed above, are expected to be in the organic iodide concentration within containment particulate form.

would be about 1 percent of the iodine release concentration over a wide range of iodine concentrations. 3.6 Proposed Accident Source Terms The proposed accident source terms, including their A conversion of 4 percent of the elemental iodine to timing as well as duration, are listed in Thbles 3.12 for organic has been implicitly assumed by the NRC staff in BWRs and 3.13 for PWRs. The information for these Regulatory Guides 1.3 and 1.4, based upon an upper tables was derived from the simplification of the bound evaluation of the results in WASH-1233. NUREG-1150 (Ref. 7) source terms documented in However, in view of the results of Ref. 23 that a NUREG/CR-5747 (Ref. 17). It should also be noted conversion of 3.2 percent is unduly conservative, a that the rate of release of fission products into the value of 3 percent is considered more realistic and will containment is assumed to be constant during the be used in this report. Where the pH is controlled at duration time shown.

NUREG-1465 12

Table 3.12 BWR Releases Into Containment*

Gap Release*** Early In-Vessel Ex-Vessel Late In-Vessel Duration (Hours) 0.5 1.5 3.0 10.0 Noble Gases* 0.05 0.95 0 0 Halogens 0.05 0.25 0.30 0.01 Alkali Metals 0.05 0.20 0.35 0.01 Tellurium group 0 0.05 0.25 0.005 Barium, Strontium 0 0.02 0.1 0 Noble Metals 0 0.0025 0.0025 0 Cerium group 0 0.0005 0.005 0 Lanthanides 0 0.0002 0.005 0

• Values shown are fractions of core inventory.

• See Table 3.8 for a listing of the elements in each group

• • • Gap release is 3 percent if long-term fuel cooling is maintained.

Table 3.13 PWR Releases Into Containment Gap Release*** Early In-Vessel Ex-Vessel Late In-Vessel Duration (Hours) 0.5 1.3 2.0 10.0 Noble Gases* 0.05 0.95 0 0 Halogens 0.05 0.35 0.25 0.1 Alkali Metals 0.05 0.25 0.35 0.1 Tellurium group 0 0.05 0.25 0.005 Barium, Strontium 0 0.02 0.1 0 Noble Metals 0 0.0025 0.0025 0 Cerium group 0 0.0005 0.005 0 Lanthanides 0 0.0002 0.005 0 Values shown are fractions of core inventory.

See Table 3.8 for a listing of the elements in each group

• Gap release is 3 percent if long-term fuel cooling is maintained.

It is emphasized that the release fractions for the PWRs, respectively. The changes and the reasons for source terms presented in this report are intended to these was as follows:

be representative or typical, rather than conservative or bounding values, of those associated with a low 1. BWR in-vessel release fractions for the volatile pressure core-melt accident, except for the initial nuclides (I and Cs) increased slightly while appearance of fission products from failed fuel, which ex-vessel release fractions for the same nuclides was chosen conservatively. The release fractions are not was reduced as a result of comments received and intended to envelope all potential severe accident additional MELCOR calculations available after sequences, nor to represent any single sequence. issuance of the draft report. The total I and Cs released into containment over all phases of the accident remained the same.

Tibles 3.12 and 3.13 in this, the final report, were 2. Release fractions for Te, Ba and Sr were reduced modified from the tables in the draft report which were somewhat, both for in-vessel as well as ex-vessel taken from Table 3.9 and Table 3.10, for BWRs and releases, in response to comments.

13 NUREG-1465

3. Release fractions for the non-volatile nuclides, additional release of 2 percent over the duration particularly during the early in-vessel phase were of the gap release phase.

reduced significantly based on additional research results (Ref. 25) since issuance of NUREG-1150 3. Accidents where fuel failure results from reactivity which indicate that releases of low volatile insertion accidents (RIA), such as the postulated nuclides, both in-vessel as well as ex-vessel, have rod ejection (PWR) or rod drop (BWR) accidents.

been overestimated. A re-examination in response The accidents examined in this report do not to comments received showed that the supposed contain information on reactivity induced "means" of the uncertainty distribution were in accidents to permit a quantitative discussion of excess of other measures of the distribution, such fission product releases from them. Hence, the as the 75th percentile. In this case, the 75th gap release magnitude presented in Tables 3.12 percentile was selected as an appropriate measure and 3.13 may not be applicable to fission product of the release fraction. For additional discussion releases resulting from reactivity insertion on this topic, see Section 4.4. accidents.

4. Gap activity release fractions were reduced from 5 Recent information has indicated that high burnup fuel, percent to 3 percent for accidents not involving that is, fuel irradiated at levels in excess of about 40 degraded or molten core conditions, and where GWD/MTU, may be more prone to failure during long-term fuel cooling is maintained. See design basis reactivity insertion accidents than additional discussion below. previously thought. Preliminary indications are that high bumup fuel also may be in a highly fragmented or powdered form, so that failure of the cladding could Based on WASH-1400 (Ref. 5), the inventory of fission result in a significant fraction of the fuel itself being products residing in the gap between the fuel and the released. In contrast, the source term contained in this cladding is no greater than 3 percent except for cesium, report is based upon fuel behavior results obtained at which was estimated to be about 5 percent. lower burnup levels where the fuel pellet remains NUREG/CR-4881 (Ref.16) reported a comparison of intact upon cladding failure, resulting in a release only more recently available estimations and observations of those fission product gases residing in the gap indicating that releases of the dominant fission product between the fuel pellet and the cladding. Because of groups were generally below the values reported in this recent information regarding high burnup fuels, the Reference 5. However, the magnitude of fission NRC staff cautions that, until further information products released during the gap release phase can indicates otherwise, the source term in Tables 3.12 and vary, depending upon the type of accident. Accidents 3.13 (particularly gap activity) may not be applicable for where fuel failures occur may be grouped as follows: fuel irradiated to high burnup levels (in excess of about 40 GWD/MTU).

1. Accidents where long-term fuel cooling is maintained despite fuel failure. Examples include With regard to the ex-vessel releases associated with the design basis LOCA where ECCS functions, core-concrete interactions, according to Reference 17, and a postulated spent fuel handling accident. For there were only slight differences in the fission this category, fuel failure is taken to result in an products released into containment between limestone immediate release, based upon References 5 and vs. basaltic concrete. Hence, the table shows the 16, of 3 percent of the volatile fission products releases only for a limestone concrete. Further, the (noble gases, iodine, and cesium) which are in the releases shown for the ex-vessel phase are assumed to gap between the fuel pellet and the cladding. No be for a dry reactor cavity having no water overlying any subsequent appreciable release from the fuel core debris. Where water covers the core debris, pellet occurs, since the fuel does not experience aerosol scrubbing will take place and reduce the prolonged high temperatures. quantity of aerosols entering the containment atmosphere. See Section 5.4 for further information.

2. Accidents where long-term fuel cooling or core geometry are not maintained. Examples include 3.7 Nonradioactive Aerosols degraded core or core-melt accidents, including the postulated limiting design basis fission product In addition to the fission product releases into release into containment used to show compliance containment shown in Tables 3.12 and 3.13, quantities with 10 CFR Part 100. For this category, the gap of nonradioactive or relatively low activity aerosols will release phase may overlap to some degree with also be released into containment. These aerosols arise the early in-vessel release phase. The release from core structural and control rod materials released magnitude has been taken as an initial release of 3 during the in-vessel phase and from concrete decompo-percent of the volatiles (as for category 1), plus an sition products during the ex-vessel phase. A detailed NUREG-1465 14

analysis of the quantity of nonfission product aerosols 4.1 Accident Severity and lype released into containment was not undertaken. Precise estimates of the masses of non-radioactive aerosols As noted earlier in Section 2.2, this report discusses released into containment are difficult to determine. mean or average release fractions for all the release phases associated with a complete core-melt accident, including reactor pressure vessel failure. The accident Reference 26 evaluated one PWR sequence (Sequoyah) selected is one in which core melt occurs at low and one BWR (Peach Bottom) sequence and calculated pressure conditions. A low pressure core melt scenario in-vessel non-radioactive aerosol masses of 350 and 780 results in a relatively low level of fission product kilograms, respectively, for the PWR and BWR retention within the reactor coolant system, and a sequences. The same reference calculated that consequently high level of release of fission products ex-vessel aerosol masses (assuming a dry cavity) would from the core into containment during the early be higher, 3800 and 5600 kilograms, respectively, for in-vessel release phase. Since the bulk of the fission the PWR and BWR sequences investigated. However, products entering containment do so during the early these values, particularly for the ex-vessel release in-vessel release phase, selection of a low pressure core phase, may be excessive. NUREG/CR-4624 (Ref. 27) melt scenario provides a high estimate of the total examined several sequences for both PWRs and BWRs quantity of fission products released into containment, and calculated ex-vessel releases to containment of as well as that during the early in-vessel release phase.

about 1000 and 4000 kilograms, respectively, for PWRs and BWRs. NUREG/CR-5942 (Ref.19), making use of 4.2 Onset of Fission Product Release the MELCOR code, calculated significantly lower The onset, or earliest time of appearance of fission releases during the ex-vessel phase of about 1000 products within containment, has been selected on the kilograms for the Peach Bottom plant. basis of the earliest time to failure of a fuel rod, given a design basis LOCA. This is estimated to be from about 13 to 25 seconds for plants that do not have leak-In view of the wide diversity of calculated results, the before-break approval for their reactor coolant system NRC staff concludes that precise estimates of the piping, and it is expected to vary depending on the release of non-radioactive aerosols are not available at reactor as well as the fuel rod design. This value, while this time. Because nonradioactive aerosol masses could representing some relaxation from the assumption of have an effect upon the operation of certain plant instantaneous appearance, is nevertheless conservative.

equipment, such as filter loadings or sump perfor- As noted in Reference 15, these estimates are valid for mance, during and following an accident, however, the a double-ended rupture of the largest pipe, assume that NRC staff concludes that the release of non-radioactive the fuel rod is being operated at the maximum peaking aerosols should be considered by the designer using factor permitted by the plant Technical Specifications methods considered applicable for his design, and the and at the highest burnup levels anticipated, and potential impact upon the plant evaluated. assume that the emergency core cooling system (ECCS) is not operating. Use of more realistic assumptions for any of these parameters would increase estimated times to fuel rod failure by factors of two or more. Neverthe-4 MARGINS AND UNCERTAINTIES less, the use of conservative assumptions in estimating fuel rod failure times is considered appropriate since This section discusses some of the more significant such failure times are likely to be used primarily in conservatisms and margins in the proposed accident consideration of the necessary closure time for certain source term given in Section 3. Briefly, the proposed containment isolation valves. Since it is important that release fractions have been developed from a complete closure of such valves be ensured before the release of core-melt accident, that is, assuming core melt with significant radioactivity to the environment, a conserva-reactor pressure vessel failure and with the assumption tive estimate of fuel failure time and consequent onset of core-concrete interactions. The timing aspects were of fission product appearance is deemed appropriate.

selected to be typical of a low pressure core-melt For plants with leak-before-break approval for their scenario, except that the onset of the release of gap reactor coolant system piping, a longer duration before activity was based upon the earliest calculated time of fuel clad failure is expected. However, other constraints fuel rod failure under accident conditions. The may become the limiting factor on containment magnitude of the fission products released into isolation valve closure time.

containment was intended to be representative and, except for the low volatile nuclides, as discussed in 4.3 Release Phase Durations section 4.4, was estimated from the mean values for a The durations of the various release phases have been typical low-pressure core-melt scenario. selected primarily by examination of the values 15 NUREG-1465

available for the group of severe accident scenarios examination of the Three Mile Island (TMI) accident, considered in Section 3. The durations of the early and the SASCHA out-of-pile tests. Ex-vessel insights in-vessel and ex-vessel release phases differs for BWRs derive primarily from large scale tests performed as versus PWRs and reflect the differing core heatup rates part of the internationally sponsored ACE Program.

as well as the differing amounts of zirconium available Reference 25 notes that, based on the SFD experiments to supply chemical energy after core-melt. While the as well as the TMI accident, in-vessel release fractions selected durations of the release phases are realistic, for cerium, for example, were about 104, compared to some conservatisms should be noted. The duration of the value of 10-2 cited in the draft report. Based on the early in-vessel release phase for BWRs and PWRs these results, the NRC staff concludes that the low is short and does not represent a probabilistically volatile release fractions cited in draft NUREG-1465 weighted average or mean value for the accident are too high.

sequences considered. This will introduce a given quantity of fission products into containment in a The uncertainty distributions were also examined to shorter time than might be expected for a typical obtain additional insight. As can be seen from the sequence. uncertainty distributions in Appendix A, the range of release estimates for the volatile nuclides, such as the Similarly, the duration of the ex-vessel release phase, noble gases, iodine, cesium, and to some extent while considered realistic for the bulk of the fission tellurium, spans about one order of magnitude. For this products being released, is short for releases of group of nuclides, use of the mean value is a tellurium and ruthenium since, as noted in Section 3.3, reasonable estimate of the release fraction. In contrast, release of these nuclides occurs over a longer time. the range for the low volatile nuclides, such as barium, strontium, cerium and lanthanum, spans about 4 to 6 The selected release duration times have been chosen orders of magnitude. For the latter group of nuclides, primarily on the basis of simplicity, since an accurate the mean value can be misleading, since it may be well determination of the duration of the release phases in excess of other measures of the distribution. This is depends not only on the reactor type but also on the illustrated in TIable 4.1 which tabulates the mean, applicable accident sequence, which varies for each median, and 75th percentile values for several low reactor design. volatile nuclides released during the early in-vessel phase.

4.4 Composition and Magnitude of Table 4.1 Measures of Low Volatile In-Vessel Release Releases Fractions The composition of the fission products was initially Nuclide Mean Median 75th percentile based on the grouping developed with the STCP, but has been modified as discussed in Section 3.4. Sr 0.03 0.001 0.006 Ba 0.04 0.003 0.009 The magnitudes of the fission products released into La 0.002 0.00003 0.0003 containment for the accident source term were selected Ce 0.01 0.00006 0.0006 in the draft version of this report to be the mean values, using NUREG-1150 methodology, for BWR and PWR low-pressure scenarios involving high As can be seen from Thble 4.1, the mean value for this estimates of zirconium oxidation. The uncertainty group of nuclides is one to two orders of magnitude distributions for the in-vessel release and total release greater than the median value, and is about 5 times into containment are displayed graphically in Appen- greater than the 75th percentile of the distribution. For dix A. Bounding estimates for the releases into this group of nuclides, the mean is controlled by the containment taken from Reference 17, using the STCP upper tail of the distribution, and the details of the methodology, are shown in Appendix B. whole distribution may be more indicative of the uncertainty than the "bottom line" results, such as a The release magnitudes for the low volatile fission mean value. Because of this, the final version of this products were reduced significantly in the final report. report has chosen not to use the mean value in This reduction was based upon recent experimental estimating releases for the non-volatile nuclides. While research results (Ref. 25) since completion of the median value might be selected as an alternate, it NUREG-1150, as well as a re-examination of the fails to provide an appreciation of the range of values uncertainty distribution, in response to comments on lying above it. Since this report is intended for the draft report. Research on in-vessel phenomena regulatory applications, the intent is to avoid includes the in-pile Severe Fuel Damage (SFD) under-estimation of potential releases or offsite doses, experiments in the Power Burst Facility (PBF), further without undue conservatism. Hence, for the final NUREG-1465 16

report, the 75th percentile value has been selected for Mean value estimates selected for the in-containment the low volatile nuclides on the basis that it bounds accident source term provide reasonable estimates for most of the range of values, without undue influence by the important nuclides consisting of iodine, cesium, and the upper tail of the distribution. tellurium. These estimates show a relatively low degree of uncertainty and are unlikely to be exceeded by more Uncertainties, particularly in understanding and than 50%. Uncertainty increases in estimating releases modeling core melt progression phenomena, can affect for the remaining nuclides.

the duration of the early in-vessel release phase, including the timing of reactor pressure vessel failure. 4.5 Iodine Chemical Form An increase in duration of the early in-vessel phase can lead to increased releases of volatile fission products The chemical form of iodine entering containment was during the early in-vessel phase and a concomitant investigated in Reference 18. On the basis of this work, reduction during the ex-vessel phase. An increase in the NRC staff concludes that iodine entering duration of the early in-vessel phase, however, also containment from the reactor coolant system is provides additional time for fission product removal composed of at least 95% cesium iodide (CsI), with no within containment by natural processes or fission more than 5% 1 plus HI. Once within containment, product cleanup systems. highly soluble cesium iodide will readily dissolve in water pools and plate out on wet surfaces in ionic form.

Radiation-induced conversion of the ionic form to Upper bound estimates, tabulated in Appendix B, elemental iodine will potentially be an important indicate that virtually all the iodine and cesium could mechanism. If the pH is controlled to a level of 7 or enter the containment. Similarly, for tellurium, upper greater, such conversion to elemental iodine will be bound estimates indicate that as much as about minimal. If the pH is not controlled, however, a two-thirds of the core inventory of tellurium could be relatively large fraction (greater for PWRs than BWRs) released into containment. Hence, for this important of the iodine dissolved in containment pools in ionic group of radionuclides (iodine, cesium, and tellurium), form will be converted to elemental iodine.

the upper bound estimates of total release into containment are approximately 1.5 times the mean value estimates. 5 IN-CONTAINMENT REMOVAL MECHANISMS For the lower volatility radionuclides such as barium and strontium, upper bound estimates range from Since radioactive fission products within containment about 50 to 70% of the core inventory released into are in the form of gases and finely divided airborne containment. Almost all of this is estimated to be particulates (aerosols), the principal mechanism by released as a result of core-concrete interactions. In which fission products find their way from the reactor contrast, mean value estimates range from 15 to 25%. to the environment with an intact containment is via Hence, in this case, the upper bound estimates are leakage from the containment atmosphere. The specific about two to three times the mean values. fission product inventory present in the containment atmosphere at any time depends on two factors: (1) the source, i.e., the rate at which fission products are being Finally, for the refractory nuclides such as lanthanum introduced into the containment atmosphere, and and cerium, the upper bound estimates indicate that (2) the sink, the rate at which they are being removed.

about 5% of the inventory of these nuclides could Aspects of the release and transport of fission products appear within containment, whereas the mean value from the core into the containment atmosphere were estimate indicates only about 1% released. presented in Section 3.

PRAs have indicated that, considering the magnitudes Mechanisms that remove fission products from the of the radioactive species estimated to be released to atmosphere with consequent mitigation of the the environment for severe reactor accidents, the in-containment source term fall into two classes:

radionuclides having the greatest impact on risk are (1) engineered safety features (ESFs) and (2) natural typically the volatile nuclides such as iodine and processes. ESFs to remove or reduce fission products cesium, with tellurium to a somewhat lesser degree. within the containment are presently required The uncertainty distributions for this group of (Criterion 41 in Appendix A of 10 CFR Part 50) and radionuclides is also the smallest, as shown in the include such systems as containment atmosphere graphical tabulations of Appendix A. Hence, our ability sprays, BWR suppression pools, and filtration systems to predict the behavior and releases for this group of utilizing both particulate filters and charcoal adsorption nuclides is significantly better than for other fission beds for the removal of iodine, particularly in elemen-product groupings. tal form. Natural removal includes such processes as 17 NUREG-1465

aerosol deposition and the sorption of vapors on containment spray systems be initiated automatically, equipment and structural surfaces. because of the instantaneous appearance of the source term within containment, and that the spray duration The draft version of this report contained a discussion not be less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In contrast, the revised source of some of the more important fission product removal term information given in Section 3 suggests that spray mechanisms, including some quantitative results. These system actuation might be somewhat delayed for numerical results were intended to be illustrative of the radiological purposes, but that the spray system phenomena involved and were not intended to be duration should be for a longer period of about 10 or applied rigorously, however. It was recognized that the more hours. Because sprays are effective in rapidly data and illustrations used in the draft might not be removing particulates from the containment applicable to all situations. atmosphere, intermittent operation over a prolonged period may also provide satisfactory mitigation.

In recognition of this, the NRC staff undertook to examine, with contractor assistance, improved The spray removal coefficient for particulates appears understanding of fission product removal mechanisms. particularly important in view of the information At this time, this effort is still underway. Rather than presented in Section 3, which indicates that most fission provide numerical values that may be inapplicable, this products are expected to be in particulate form. The report will provide references, where available, so that spray removal coefficient (X) is derived from the the reader may utilize improved methodologies to following equation from Standard Review Plan obtain results that apply to the situation at hand. Section 6.5.2 x =3hFE 5.1 Containment Sprays 2VD Containment sprays, covered in Standard Review Plan h = Fall height of spray drops V = Containment building volume (SRP) Section 6.5.2 (Ref. 28), are used in many PWR F = Spray flow designs to provide post-accident containment cooling as E/D = the ratio of a dimensionless collection well as to remove released radioactive aerosols. Sprays efficiency E to the average spray drop Diameter D.

are effective in reducing the airborne concentration of EJD is conservatively assumed to be equal to elemental and particulate iodines as well as other 10/meter for spray drops 1 mm in diameter changing particulates, such as cesium, but are not effective in to 1/meter when the aerosol mass has been removing noble gases or organic forms of iodine. The depleted by a factor of 50.

reduction in airborne radioactivity within containment by a spray system as a function of time is expressed as Using values typical for PWRs, the formulation given in an exponential reduction process, where the spray SRP 6.5.2 estimates particulate removal rates to be on removal coefficient, lambda, is taken to be constant the order of 5 per hour. Nourbakhsh (Ref. 29) exa-over a large part of the regime. Typical PWR mined the effectiveness of containment sprays, as containment spray systems are capable of rapidly evaluated in NUREG-1150 (Ref. 7), in decontamin-reducing the concentration of airborne activity (by ating both in-vessel and ex-vessel releases. Powers and about 2 orders of magnitude within about 30 minutes, Burson (Ref. 30) have developed a more realistic, yet where both spray trains are operable). Once the bulk of simplified, model with regard to evaluating the the activity has been removed, however, the spray effectiveness of aerosol removal by containment sprays becomes significantly less effective in reducing the remaining fission products. This is usually accounted for by either employing a spray cut-off, wherein the 5.2 BWR Suppression Pools spray removal becomes zero after some reduction has BWRs use pressure suppression pools to condense been achieved, or changing to a much smaller value of steam resulting from a loss-of-coolant accident. Prior to lambda to reflect the decreased removal effectiveness the release to the reactor building, these pools also of the spray when airborne concentrations are low. scrub radioactive fission products that accompany the steam. Regulatory Guide 13 (Ref. 2) suggests not SRP Section 6.5.2 (Ref. 28) provides expressions for allowing credit for fission product scrubbing by BWR calculating spray lambdas, depending on plant suppression pools, but SRP Section 6.5.5 (Ref. 31) was parameters as well as the type of species removed. In revised to suggest allowing such credit. The pool water addition, SRP 6.5.2 currently suggests that the will retain soluble, gaseous, and solid fission products containment sump solution be maintained at values at such as iodines and cesium but provide no attenuation or above pH levels of 7, commencing with spray of the noble gases released from the core. The Reactor recirculation, to minimize revolatilization of iodine in Safety Study (WASH-1400, Ref. 5) assumed a the sump water. Current guidance states that decontamination factor (DF) of 100 for subcooled NUREG-1465 18

suppression pools and 1.0 for steam saturated pools. radioactive aerosols and iodine released during Since 1975 when WASH-1400 was published, several postulated accident conditions.

detailed models have been developed for the removal of radioactive aerosols during steam flow through A typical ESF filtration system consists of redundant suppression pools. trains that each have demisters to remove steam and water droplets from the air entering the filter bank, Calculations for a BWR with a Mark I containment heaters to reduce the relative humidity of the air, high (Ref. 27) used in NUREG-1150 (Ref. 7) indicate that efficiency particulate air (HEPA) filters to remove DFs ranged from 1.2 to about 4000 with a median value particulates, charcoal adsorbers to remove iodine in of about 80. The suppression pool has been shown to be elemental and organic form, followed finally by effective in scrubbing some of the most important additional HEPA filters to remove any charcoal fines radionuclides such as iodine, cesium, and tellurium, as released.

these are released in the early in-vessel phase. The NRC staff is also presently reviewing fission product Charcoal adsorber beds can be designed, as indicated in scrubbing by suppression pools to develop simplified Regulatory Guide 1.52, to remove from 90 to 99% of models. the elemental iodine and from 30 to 99% of the organic If not bypassed, the suppression pool will also be iodide, depending upon the specific filter train design.

effective in scrubbing ex-vessel releases. Suppression Revised insights on accident source terms, given in pool bypass is an important aspect that places an upper limit on the overall performance of the suppression Section 3, may have several implications for ESF pool in scrubbing fission products. For example, if as filtration systems. Present ESF filtration systems are little as 1% of the fission products bypass the not sized to handle the mass loadings of non-suppression pool, the effective DF, taking bypass into radioactive aerosols that might be released as a result of the ex-vessel release phase, which could produce account, will be less than 100, regardless of the pool's releases of significant quantities of nonradioactive as ability to scrub fission products. well as radioactive aerosols. However, if ESF filtration Although decontamination factors for the suppression systems are employed in conjunction with BWR pool are significant, the potential for iodine suppression pools or if significant quantities of water re-evolution can be important. Re-evolution of iodine are overlaying molten core debris (see Section 5.4),

was judged to be important in accident sequences large quantities of nonradioactive (as well as where the containment had failed and the suppression radioactive) aerosols will be scrubbed and retained by pool was boiling. There is presently no requirement for these water sources, thereby reducing the aerosol mass pH control in BWR suppression pools. Hence, it is loads upon the filter system.

possible that suppression pools would scrub substantial amounts of iodine in the early phases of an accident, A second implication of revised source term insights for only to re-evolve it later as elemental iodine. It may ESF filtration systems is the impact of revised well be that additional materials likely to be in the understanding of the chemical form of iodine within suppression pool as a result of a severe accident, such containment. Present ESF filtration systems presume as cesium borate or cesium hydroxide and core-concrete that the chemical form of iodine is primarily elemental decomposition products, would counteract any iodine, and these systems include charcoal adsorber reduction in pH from radiolysis and would ensure that beds to trap and retain elemental iodine. Assuming that the pH level was sufficiently high to preclude pH control is maintained within the containment, a key re-evolution of elemental iodine. Therefore, if credit is question is whether charcoal beds are necessary. Two to be given for long-term retention of iodine in the questions appear to have a bearing on this issue and suppression pool, maintenance of the pH at or above a must be addressed, even assuming pH control. These level of 7 must be demonstrated. It is important to are (1) to what degree will Csl retained on particulate note, however, that this is not a matter of concern for filters decompose to evolve elemental iodine? and (2) present plants since all BWRs employ safety-related what effect would hydrogen bums have on the chemical filtration systems (see Section 5.3) designed to cope form of the iodine within containment? Based on with large quantities of elemental iodine. Hence, even preliminary information, Csl retained on particulate if the suppression pool were to re-evolve significant filters as an aerosol appears to be chemically stable amounts of elemental iodine, it would be retained by provided that it is not exposed to moisture. Exposure to the existing downstream filtration system. moisture, however, would lead to CsI decomposition and production of iodine in ionic form (1), which in turn would lead to re-evolution of elemental iodine.

5.3 Filtration Systems Although ESF filtration systems are equipped with ESF filtration systems are discussed in Regulatory demisters and heaters to remove significant moisture Guide 1.52 (Ref. 32) and are used to reduce the before it reaches the charcoal adsorber bed, an 19 NUREG-1465

additional concern is that the demisters themselves may There are four natural processes that remove aerosols trap some CsI aerosol. from the containment atmosphere over a period of time: (1) gravitational settling, (2) diffusiophoresis, In conclusion, present ESF filtration systems, while (3) thermophoresis, and (4) particle diffusion. (Particle optimized to remove iodine, particularly in elemental diffusion is less important than the first three processes form, have HEPA filters that are effective in the - and will not be discussed further.) All particles fall removal of particulates as well. Although such filtration naturally under the force of gravity and collect on any systems are not designed to handle the large mass available surface that terminates the fall, e.g., the floor loadings expected as a result of ex-vessel releases, when or upper surfaces of equipment. Both diffusiophoresis they are used in conjunction with large water sources and thermophoresis cause the deposition of aerosol such as BWR suppression pools or significant water particles on all surfaces regardless of their orientation, depths overlaying core debris, the water sources will i.e., walls and ceiling as well as the floor.

reduce the aerosol mass loading on the filter system Diffusiophoresis is the process by which water vapor in significantly, making such filter systems effective in the atmosphere 'drags' aerosol particles with it as it mitigation of a large spectrum of accident sequences. migrates (diffuses) toward a relatively cold surface on which condensation is taking place. Thermophoresis also causes aerosol particles to move toward and 5.4 Water Overlying Core Debris deposit on colder surfaces but not as a result of mass Experimental measurements (Ref. 33) have shown that motion. Rather, the decreasing average velocity of the significant depths of water overlying any molten core surrounding gas molecules tends to drive the particle debris after reactor pressure vessel failure will scrub down the temperature gradient until it traverses the and retain particulate fission products. The question of interface layer and comes into contact with the surface coolability of the molten debris as a result of water where it sticks.

overlying it is still under investigation. A major factor Aerosol agglomeration is another natural phenomenon that may affect the degree of scrubbing is whether the that has an influence on the rates at which the removal water layer in contact with the molten debris is boiling processes described above will proceed. Agglomeration or not. results from the random inelastic collisions of particles with each other. The process brings about a gradual Results from Ref. 33 indicate that both subcooled as increase in average particle size resulting in more rapid well as boiling water layers having a depth of about gravitational settling. Three phenomena contribute to 3 meters had measured DFs of about 10. A recent study particle growth by agglomeration: (1) Brownian motion, (Ref. 34) performed for the NRC has provided a (2) gravitational fall, and (3) turbulence. Brownian simplified model to determine the degree of aerosol agglomeration is caused by particle collisions resulting scrubbing by a water pool overlying core debris from random 'buffeting' by high-energy gas molecules.

interacting with concrete.

Gravitational agglomeration results from the fact that some particles fall faster than others and therefore 5.5 Aerosol Deposition tend to collide with and stick to other slower falling particles on their way down. Finally, rapid variations in Since the principal pathway for transport of fission gas velocity and flow direction in the atmosphere, Le.,

products is via airborne particulates, i.e., aerosols, this turbulence, tend to increase the rate at which particle subject is discussed in some detail. Aerosols are usually collisions occur and thus increase the average particle thought of as solid particulates, but in general, the term size. It is to be expected that, as agglomeration also includes finely divided liquid droplets such as advances, the size of the particle will increase, and its water, i.e., fog. The two major sources of aerosols are shape can be expected to change as well. These latter condensation and entrainment. Condensation aerosols factors have a strong influence on the removal form when a vapor originating from some high- processes.

temperature source moves into a cooler region where the vapor falls below its saturation temperature and The agglomeration and aerosol removal processes all nucleation begins. Entrainment aerosols form when gas depend critically upon the thermodynamic state and bubbles break through a liquid surface and drag thermal-hydraulic conditions of the containment droplets of the liquid phase into the wake of the bubble atmosphere. For example, the condensation onto and as it leaves the surface. In general, condensation evaporation of water from the aerosol particles particles are smaller in size (submicron to a few themselves have strong effects on all of the microns), while entrainment particles are usually larger agglomeration and removal processes. Water condensed (1.0-100 microns). Once airborne, both types of on aerosol particles increases their mass and makes aerosols behave in a similar manner with respect to them more spherical; both of these effects tend to both natural and engineered removal processes. increase the rate of gravitational settling. Some NUREG-1465 20

aerosols, such as CsI and CsOH, are hygroscopic and Accident for Boiling Water Reactors," Regulatory absorb water vapor even when the containment Guide 1.3, Revision 2, June 1974.

atmosphere is below saturation. As with condensation, hygroscopicity also increases the rate of deposition. 3. U.S. Nuclear Regulatory Commission; "Assumptions Used for Evaluating the Potential Because of its importance to fields such as weather and Radiological Consequences of a Loss of Coolant atmosphere pollution, the behavior of aerosols has Accident for Pressurized Water Reactors,"

been under study for many decades. A number of Regulatory Guide 1.4, Revision 2, June 1974.

computer codes have been developed to specifically consider aerosol behavior as it relates to nuclear 4. JJ. DiNunno et al., "Calculation of Distance accident conditions. The most complete mechanistic Factors for Power and Test Reactor Sites,"

treatment of aerosol behavior in the reactor Technical Information Document (11D}-14844, containment is found in CONTAIN, a computer code U.S. Atomic Energy Commission, 1962.

developed at Sandia National Laboratories under NRC sponsorship for the analysis of containment behavior 5. U.S. Nuclear Regulatory Commission; "Reactor under severe accident conditions. The aerosol models Safety Study An Assessment of Accident Risks in in the NAUA code are very similar to those used in U.S. Commercial Nuclear Power Plants,"

CONTAIN; NAUA was developed at the WASH-1400 (NUREG-75/014), December 1975.

Kernforschungszentrum, Karlsrhue, F.R.G., and was used for aerosol treatment in the NRC STCP. There 6. J. A. Gieseke et al., "Source Term Code Package:

are a number of other well-known aerosol behavior A User's Guide," NUREG/CR-4587 (BMI-2138),

computer codes, but these two are the most widely used prepared for NRC by Battelle Memorial Institute, and accepted throughout the international nuclear July 1986.

safety community.

7. U.S. Nuclear Regulatory Commission; "Severe The rate at which gravitational settling occurs depends Accident Risks: An Assessment for Five U.S.

upon the degree of agglomeration at any particular Nuclear Power Plants," NUREG-1150, December time (i.e., the average particle size) as well as the total 1990.

particle density m (mass per unit volume). Thus, as in most cases where the decrement of a variable is 8. M.R. Kuhlman, DJ. Lehmicke, and R.O. Meyer, proportional to the variable itself, one can expect an "CORSOR User's Manual," NUREG/CR-4173 exponential behavior. The gravitational settling process (BMI-2122), prepared for NRC by Battelle is quite complex and depends upon a large number of Memorial Laboratory, March 1985.

physical quantities, e.g., collision shape factor, particle settling shape factor, gas viscosity, effective settling 9. H. Jordan, and M.R. Kuhlman, "TRAP-MELT2 height, density correction factor, normalized Brownian User's Manual," NUREG/CR-4205 (BMI-2124),

collision coefficient, gravitational acceleration, and prepared for NRC by Battelle Memorial particle material density. The only variable in this list Laboratory, May 1985.

that is independent of the plant, the accident scenario, and the atmospheric thermal-hydraulic conditions is the 10. D.A. Powers, J.E. Brockmann, and A.W. Shiver, constant of gravitation. It follows that no single DF can "VANESNA A Mechanistic Model of Radionuclide be ascribed to cover the entire range of plant designs, Release and Aerosol Generation During Core accident scenarios, and source materials. An effort is Debris Interactions with Concrete,"

under way to establish a set of simplified algorithms NUREG/CR-4308 (SAND 85-1370), prepared for that can be used to provide a set of specific ranges of NRC by Sandia National Laboratories, July 1986.

atmosphere conditions. This effort is still underway at this time. 11. P.C. Owczarski, A.K. Postma, and R.I. Schreck,

'Technical Bases and User's Manual for the Prototype of SPARC-A Suppression Pool Aerosol

6. REFERENCES Removal Code," NUREG/CR-3317 (PNL-4742),

prepared for NRC by Battelle Pacific Northwest

1. U.S. Nuclear Regulatory Commission; "Reactor Laboratories, May 1985.

Site Criteria," Title 10, Code of Federal Regulations (CFR), Part 100. 12. W.K. Winegardner, A.K. Postma, and M.W.

Jankowski, "Studies of Fission Product Scrubbing

2. U.S. Nuclear Regulatory Commission; within Ice Compartments," NUREG/CR-3248 "Assumptions Used for Evaluating the Potential (PNL-4691), prepared for NRC by Battelle Pacific Radiological Consequences of a Loss of Coolant Northwest Laboratories, May 1983.

21 NUREG-1465

13. H. Bunz, M. Kayro, and W. Schock, "NAUA-Mod for NRC by Oak Ridge National Laboratory, 4: A Code for Calculating Aerosol Behavior in December 1992.

LWR Core Melt Accidents," KfK-3554, Kernforschungszentrum Karlsruhe Germany, 23. A.K. Postma, and R.W. Zavadowski, "Review of 1983. Organic Iodide Formation Under Accident

. Conditions in Water-Cooled Reactors,"

14. R.M. Summers, et al., "MELCOR 1.8.0: A WASH-1233, U.S. Atomic Energy Commission, Computer Code for Nuclear Reactor Severe October 1972.

Accident Source Term and Risk Assessment Analysis," NUREG/CR-5531 (SAND 90-0364), 24. E.C. Beahm, W.E. Shockley, and O.L. Culberson, prepared for NRC by Sandia National "Organic Iodide Formation Following Nuclear Laboratories, January 1991. Reactor Accidents," NUREG/CR-4327, (ORNLITM-9627), prepared for NRC by Oak

15. K.R. Jones, et al, '"Tming Analysis of PWR Fuel Ridge National Laboratory, December 1985.

Pin Failures," NUREG/CR-5787 (EGG-2657),

prepared for NRC by Idaho National Engineering 25. D. J. Osetek, "Low Volatile Fission Product Laboratory, September 1992. Releases During Severe Reactor Accidents,"

DOE/ID-13177-2, prepared for U.S. Department

16. H.P. Nourbakhsh, M. Khatib-Rahbar, and R.E. of Energy by Los Alamos Technical Associates, Davis, "Fission Product Release Characteristics October 1992.

into Containment Under Design Basis and Severe Accident Conditions," NUREG/CR-4881 26. M. Silberberg et al., "Reassessment of the (BNL-NUREG-52059), prepared for NRC by Technical Bases for Estimating Source Terms,"

Brookhaven National Laboratory, March 1988. NUREG-0956, July 1986.

17. H.P. Nourbakhsh,: "Estimates of Radionuclide 27. R.S. Denning, et al., "Radionuclide Release Release Characteristics into Containment Under Calculations for Selected Severe Accident Severe Accidents," NUREG/CR-5747 Scenarios: BWR Mark I Design,"

(BNL-NUREG-52289), prepared for NRC by NUREG/CR-4624, Vol. 1, prepared for NRC by Brookhaven National Laboratory, November 1993. Battelle Memorial Institute, July 1986.

18. E.C. Beahm, C.F. Weber, and T.S. Kress, "Iodine 28. U.S. Nuclear Regulatory Commission:

Chemical Forms in LWR Severe Accidents", "Containment Spray as a Fission Product Cleanup NUREG/CR-5732 (ORNLTM-11861), prepared System," Standard Review Plan, Section 6.5.2, for NRC by Oak Ridge National Laboratory, April Revision 2, NUREG-0800, December 1988.

1992.

29. H.P. Nourbakhsh,: "In-Containment Removal

19. JJ. Carbajo, "Severe Accident Source Term Mechanisms," Presentation to NRC staff January Characteristics for Selected Peach Bottom 3, 1992, Brookhaven National Laboratory, January Sequences Predicted by the MELCOR Code," 1992.

NUREG/CR-5942 (ORNLnTM-12229), prepared for NRC by Oak Ridge National Laboratory, 30. D.A. Powers and S.B. Burson, "A Simplified September 1993. Model of Aerosol Removal by Containment Sprays," NUREG/CR-5966, (SAND92-2689),

20. DJ. Alpert, D.I. Chanin, and LT. Ritchie, prepared for NRC by Sandia National "Relative Importance of Individual Elements to Laboratories, June 1993.

Reactor Accident Consequences Assuming Equal Release Fractions."NUREG/CR-4467, prepared 31. U.S. Nuclear Regulatory Commission: "Pressure for NRC by Sandia National Laboratories, 1986. Suppression Pool as a Fission Product Cleanup System," Standard Review Plan, Section 6.5.5,

21. C.F. Weber, E.C. Beahm and T.S. Kress, "Models NUREG-0800, December 1988.

of Iodine Behavior in Reactor Containments,"

ORNrITM-12202, Oak Ridge National 32. U.S. Nuclear Regulatory Commission: "Design, Laboratory, October 1992. Testing, and Maintenance Criteria for Postaccident Engineered-Safety-Feature Atmosphere Cleanup

22. E.C. Beahm, R.A. Lorenz, and C.F. Weber, System Air Filtration and Adsorption Units of "Iodine Evolution and pH Control," Light-Water-Cooled Nuclear Power Plants,"

NUREG/CR-5950, (ORNLErM-12242), prepared Regulatory Guide 1.52, Revision 2, March 1978.

NUREG-1465 22

33. J. Hakii et al., "Experimental Study on Aerosol 34. D.A. Powers and J.L Sprung, "A Simplified Model Removal Efficiency for Pool Scrubbing Under of Aerosol Scrubbing by a Water Pool Overlying High Temperature Steam Atmosphere," Core Debris Interacting With Concrete,"

Proceedings of the 21st DOE/NRC Nuclear Air NUREG/CR-5901, (SAND92-1422), prepared for Cleaning Conference, August 1990. NRC by Sandia National Laboratories, November 1993.

23 NUREG-1465

APPENDIX A UNCERTAINTY DISTRIBUTIONS NUREG-1465 24

a) a)

co r.

U) to 0

a)

V) co

.2 P.0

- r1 i:

U

=

(b) Low Zirconium Oxidation (High Zr Content in the Melt)

Uncertainty Distributions for Total Rdeases Into Containment PWR,.Low RCS Pressure, Lime-stone Concrete, Dry Cavity, Two Openings After VB, FPART = 1.

25 NUREG-1465

en 0)

-Z 0

0)

C.)

-j lk:

to (b) Low Zirconium Oxidation (High Zr Content in the Melt)

Uncertainty DistributIons for Total Releases Into Containment PWR. Low ICS Pressure, Basaltic Concrete, Dr Cavity, Two Openings After YB, FPART = 1.

NUREG-1465 26

i0 inU 10-3 Clo -51 f 10

.2 sth 10~

107 l-B 10 (a) High Zirconium Oxidation (Low Zr Content in the Melt) 10-10- -Lc .. r{s 1 Th I 10

-Jh (b) Low Zirconium Oxidation (High Zr Content in the Melt)

Uncertainty Distributions fbor Total Releass late Contalatnent BWER, Low Pressure Fast Statlon Blackout, LUmestone Concrete, Dry Pedestal, bou DrywvH Temperature, FPART = 1.

_0-27 NUREG-1465

APPENDIX B STCP BOUNDING VALUE RELEASES NUREG-1465 28

- Updated Bounding Value of Radionuclide Releases Into the Containment Under Severe Accident Conditions for PWRs n NVU ST e STr (b)

STEV Hiah RCS Low RCS PIeh RCS urme stone I3asaltic Hlah RCS Low RCS Pressure Pressure Pressurn Cont creto e oncrete Pressure Pressure NG 1.0 1.0 0. a 0. 0. 0.

1 0.30 0.75 0.10 0. 15 0.15 0.05 0.02 Cs 0.30 0.75 .0.10 0. 15 0.15 0.02 0.02 To 0.20 0.50 0.05 0. 40 0.30 0.02 0.01 Sr-Ba 0.003 0.01 0.01 0. 40 0.15 Ru 0.003 0.01 0.05 o.C005 0.005 La-Co 5 x105 1.5 x 10'4 0.01 0. 05 0.05 Release 40 minutes 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />ste' 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> -

Duration

(' All entries are fractions of Initial core Inventory.

(b) Assuming 100% of the core participate In CCI.

(') Except for To and Ru where the duration Is extended to five hours.

C m

0d I.-

z I-Updated Bounding Value of Radionuclide Releases Into the Containment Under Severe Accident Conditions for BWRs eTv (a aTMXV!2 Hbh PCS Low RCS Hith RCS Llmestone Basaltic High RCS Low RCS Pressure Pressure") Pressure Concrete Concrete Pressure Pressure (b MG 1. 1. 0. 0. 0. 0. 0.

0.50 0.75 0.10 015 0.15 0.10 0.02 Cs 0.50 0.75 0.10 0.15 0.15 0.05 0.01 To 0.10 0.15 0.05 0.50 0.30 0.02 0.02 I r8- 0.003 0.01 0.01 0.70 0.30 Ru 0.003 0.01 0.05 0.005 0.005 La-Ca 5x10' 1.5x104 *0.01 0.10 0.10 Release 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />(d) 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> Duration

"' All entries are fractions of Initial core Inventory.

I' High pressure ATWS wre also considered In this category.

"' Assuming 100% of the core participate In CCI.

I' Except for To and Ru where the duration Is extended to six hours.

NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION . REPORT NUMBER 12 a9i (Al,~.d by NAC. Add Vo.I.$.g. Rjw.

32C013202. BIBLIOGRAPHIC DATA SHEET 'a umkfe I (SM inS fCtomS on the t.rain

2. TITLE AND SUBTITLE NUREG- 1465 Accident Source Terms for Lischt-Water Nuclear Power Plants

3. OATE REPORT PUBLISHED MONTH Y YEAR February 1995

4. FIN OR GRANT NUMBER S. AUTHOR(S) 6. TYPE OF REPORT L. Soffer, S. B. Burson, C. M. Ferrell, R. Y. Lee, J. N. Ridgelv 7.PERIOD COVEREO rneNjr"i U.r s~Antlt r%,ul-Tnm,

, N%  %/fl inARFCCi'&fl 1%f no nif.Y_ At~h as'hf ax~ I, 'VM. .W U E. U'MPAl'. . MU ( qo yL m O. mbfg ,ujt nrw p v

-E d maia 4ad&oj Division of Systems Technology Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington. DC 20555 -0001

9. SPONSORING ORGANIZATION -NAME AND ADDR ESS (If NRC. rp -Sw'v u *t egonrcMt, eofdoe NRC Ories on. Oftivo potion,. U.S. SIKOCMAeotjrorr Commni'o.,

an -wlnodk Same as above

10. SUPPLEMENTARY NOTES

11. ABSTRACT (Ie_ or ir In 1962 the U.S. Atomic Energy Commission published TID-14844, "Calculation of Distance Factors for Power and Test Reactors" which specified a release of fission products from the core to the reactor containment for a postulated accident involving "substantial meltdown of the core". This "source term", the basis for the NRC's Regulatory Guides 1.3 and 1.4, has been used to determine compliance with the NRC's reactor site criteria, 10 CFR Part 100, and to evaluate other important plant performance requirements.

During the past 30 years substantial additional information on fission product releases has been developed based on significant severe accident research. This document utilizes this research by providing more realistic estimates of the "source term" release into containment, in terms of timing, nuclide types, quantities and chemical form, given a severe core-melt accident. This revised "source term" is to be applied to the design of future light water reactors (LWRs). Current LWR licensees may voluntarily propose applications based upon it.

12. KEY WORbSIOES/MPTORS (fL fet uIil.w AM"" 13. AVAILAE)ITY STATEMENT Unlimited

14. SECURIITY CLASSIFICATION ITM, PWj Severe Accident Source Term Unclassified Core Meltdown 1ThrARpen Design Basis Accident Unclassified TID-14844 Replacement 15. NUMBER OF PAGES Core Fission Product Releases IS. PRICE NPC FORM 33 m(2"

Federal Recycling Program FirstEnergys Motion for Summary Disposition of Contention 4 (SAMA Analysis Source Terms)

ATTACHMENT 9 Excerpt from NRC Office of Nuclear Regulatory Research, Draft for Comment, Reactor Risk Reference Document, NUREG-1150, Vol. 1 (Feb. 1987)

NUREG-1160 Vol. 1 0 .. ",_ _ Y"!._

iI'

.~. _ ..... ...-.

-I iii g I db '1 I

' . +/-

Reactor Risk Reference Document Main Report Draft for Comment Manuscript Completed: January 1987 Date Published: February 1987 Office of Nuclear Regulatory R**earch U.S. Nuclear flegulato.-y Commission Washington. DC 20666

~

0, .-<,~~ !,=+"~- -"--="-_.~-"_ ..::,._

TABLE OF CONTENTS (Continued)

Page 4.3 Results for Zion Nucle.r Power Plant Unit 1 *...........*... 4-15 4.3.1 Characteristics of Containment Event Tree ..........* 4-15 4.3.2 Containment Failure Bins at Zion ..*................. 4-17 4.3.3 Quantification of Containment Event Tree .........*.. 4-18 4.3.4 Comparison With Other Studies ....................... 4-18 4.3.5 Pllnt*Specffic Perspectives ......................... 4-20 4.4 Results for Sequoyah Nuclear Power Station Unit 1 .......... 4-20 4.4.1 Characteristics of Containment Event Tree ........... 4-20 4.4.2 Containment Failure Bfns at Sequoyah ..*............. 4-24 4.4.3 Quantification of Containment Event Tree ....... ....* 4~27 4.4.4 Comparison With Other Studies .. ..................... 4-29 4.4.5 Plant-Specific Perspectives **.*..................... 4-32 4.5 Results for Peach Bottom Atomic Power Station Unit 2 ....... 4-33 4.5.1 Characteristics of Containment Event Tree ........... 4-33 4.5.2 Containment Failure Bins at Peach Bottom ............ 4-35 4.5.3 Quantification of Containment Event Tree ............ 4-35 4.5.4 Comparison With Other Studies ............... ........ 4-37 4.5.5 Plant-Specific Perspectfves ......................... 4-38 4.6 Results for Grand Gulf Nuclear Station Unit 1 .............. 4-39 4.6.1 Characteristics of Containment Event Tree ........... 4-39 4.6.2 Containment Failure Bins at Grand Gulf .............. 4-42 4.6.3 Quantification of Containment Event Tree ............ 4-43 4.6.4 Comparison With Other Studies....................... 4-45 4.6.5 Plant-Specific Perspectives ............ ............. 4-45 4.7 Perspectives ..... tllt.,I ** ~ .............. !t.Ii ..... "-+ . . . . . . . . . . . . . . . . , . 4-46 References for Chapter 4 ........................................ 4-48

5. SOURCE TERM ANALYSIS ............................................ 5"1 5.1 Introduction ................................ " ... ".................. 5"1 5.2 Results for Surry Power Station Unit 1 ............ ......... 5-2 5.2.1 Ranges of Source Term Results ......... ..*........... 5-2 5.2.2 Comparison With Other Studies ....................... 5-8 5.2.3 Plant-Specific Perspectives ..*......... ............. 5-11 5.3 Results for Zion Nuclear Power Plant Unit 1 ................ 5-11 5.3.1 Ranges of Source lerm Results ....................... 5-11 5.3.2 Comparison With Other Studies ....................... 5-12 5.3.3 Plant-Specific Perspectives ......................... 5-14 v

TABLE OF CONTENTS (Continued)

Page 5.4 Results for Sequoyah Nuclaar Pawer Station Unit 1 .......... 5-14 5.4.1 Rlnges of Source leMB Results ..*...*................ 5-14 5.4.2 Comparison With Other Studies *.**....*.............. 5-16 5.4.3 Plant-Specific Perspectives......................... 5-18 5.S Results for Peach Bottom Atomic Power Station Unit 2 ....... 5-20 5.5.1 Ranges of Source Term Results ..........*............ 5-20 5.5.2 Co~ar1son With Other Studies ........ ............... 5-20 5.5.3 Plant-Specific Perspectives ......................... 5-22 5.6 Results for Grand Gulf Nuclear Station Unit 1 .............. 5-24 5.6.1 Ranges of Source Term Results ....................... 5-24 5.6.2 Comparison With Other Studies ....................... 5-26 5.6.3 Plant-Specific Perspectives ......................... 5-28 5.1 Perspectives. I

• tI ............... " ** IJ- ........................... ~ III ...... II .. * * *

• 5- 28 References for Chapter 5 ........................................ 5- 31

6. OFFSlTE CONSEQUENCE ANALySIS.................................... 6*1 6.1 Introduction 11 ...... I ,. .... ,. ...... ~ ................................................... ..,.. * .. 6-1 6.2 Consequence Results for Surry Plant ........................ 6-4 6.2.1 Results" ..... ,. ... "........... 11 ......... ,. ......... It..................................... 6-4 6.2.2 Comparison With Other Studies ................ ....... 6-7 6.3 Consequence Results for Zion Plant ......................... 6-9 6.3 . . 1 Resul ts .... 'II 4' ,.. ........ '" .. .0; .. iii.

• I " ................. ill .......... It ............ + * .. .. ..

• 6-9 6.3.2 Comparison With Other Studies ............... ,....... 6-12 6.4 Consequence Results for Sequoyah Plant ..................... 6-13 6.4.1 Results ... ,. .................. flO .. "- .. 'I ... " ............... ",., .. I .... It............. 6-13 6.4.2 Comparison With Other Studies ..................*.... 6~13 6.5 Consequence Results for Peach Bottom Plant ................. 6-13 6.5.1 Results ... ,. ......... iI ., ....... " ............ " iI ........... ,. . . . . . . . . ,. .. " .... It to .. II .. 6-13 6.S.2 Cnmpar;son With Other Studies ....................... 6-18 6.6 Consequence Results for Grand Gulf Plant ....*.............. 6-18 6.6 . . 1 Resul ts III -to .- .Ii III ........... '" .... " " * , ~ .. " ** ,. ** " * .- ** ~ ..... 111 It " ..

• 6-18 6.6.2 Comparison With Other Studies ....................... 6-21 vi

LIST OF FIGURES (Continued)

FiGure 3.8 neOle-and-whisker" display of uncertainties top core damage frequency at Peach Botto. **.*.............** > ************ 3-41 3.9 Principal contributors to core damage frequency at Grand Gul f iii" '" iii iI .. 10 6-

• Ii ** ,.

• I .... "

• Ir 11 .- ... t I II. ... ., ................ _ It .. 11 It " , , , II' 3-47 3.10 "80M"end-wh1sker" display of uncertainties for core damage at Grand Gulf ....... ".. i! ...... " 11- ..... I- t ....... ,. . . . . . . . , of. III "' ... ,. .. I .. ,.. ........ 3-51 4.1 Scheaa'tic of containment design for Surry plant ........... . 4-4 4.2 Conditional probabl1 ity of early containment fai 1ure ...... . 4-12 4.3 Schematic of containment design for Zion plant .....*..*.... 4"16 4.4 Schematic of containment design for Sequoyah plant ........ . 4-21 4.5 Schematic of containment design for Peach Bottom plant .... . 4-34 4.6 Schematic of containment design for Grand Gulf plant ...... . 4-40 5.1 Rlnges 01 release fractions for selected bins at Surry .... . 5-5 5.2 Comparison of results for station blackout scenarios at Surry . '" . . . . . . . . . . . . . . . . . . . . . . . . .... '" . . . . It ,. .. .. II .. .. ... * ... .. * .II II; .Ii .. .. .. .. ... 5-7 5.3 Comparison of results for 1nteriacing*system LOCA at Surry . 5-10 5.4 Ranges of release fractions for selEcted bins at Zion ...... . 5-13 5.5 Comparison of results for station blackout scenarios at Z1on . Ii

• oil I It ..... '" .... Ii- ....... Ii ..... t! ... 11 ..... '" , ...... '" ...... to ... + ~ ........ .Ii .... 5-15 5.6 Ranges of release fractions for selected bins at Sequoyah ... 5-17 5.7 Comparison of results for failure to isolate containment at Sequoyah III. IF

• 11 II !II " II> ....... i It ... .- I ... I IF ............... II' ..... + ........ Ii Ii. * -iI ,. .. .. 5-19 5.8 Ranges of release fractio~s for selected bins at Peach Bottom ""' .... II 41 . . . . . . . . .i. .. Ii Iii Ii Iii. .. l ...... It II + ,.. ............... i ..... I It .... ., .. , .................. . 5-21 5.9 COMParison of results for station blackout scenarios at

- Peach Bottom ............ + ********************************* 5-23

-5.10 Ranges of release fractions for selected bins at Grand Gulf. 5-25

.5~n Comparison of results for anticipated transient without scram scenario at Grand Gul f ............................. . 5-27 xiii

5. SOURCE TERM 4NAlYSIS

Definition or Pllnl

o.m.o. Stlttll i .. '..........

" ~ ".,..... '-, ." .......... .

, Conl.tlnmlnt An,IVlI.

(ChlDttr 04)

I j

1'e't ,"Ur,.*'_ .... ' .... " .. _> * * * !u . . . . _~" .... ,'

-"~

i o.nnltton of

! Conlallvn.nt hlkr.DInI I

,,......,,, I1 PIIft1 . . . .

I s.rer TIMD AMI,...

(CMpt. 5)

I

...... t I,

-~~.~ '~~:The' amoit~r and t.iming ~Qf tile release of~ radioactive material to the envi ronment

':' .:.:. -~:ifr an~ acclden~.1sl"~eferred to as a SOUrce term. Source terms are the input to

,~~.~-: :-ex""jrlant*consequericeanalysls codes such as CRAC2 (Ref. 5.1) or MAces (Ref. 5.2-).-

~~:-:*::Beca:u.5e.

- ...,-.- ~ ,,-..,,~ ~ ---= -

many

-Ocr tHe end states ~ of the containment event tree would have very

~-. -

si.ilar source terms, they are grouped into containment failure bins. A set of radionuclide release fractions must therefore be determined for each bin, as illustrated in the above 'igute. The characteristics of the containment failure bins are determined in the contain~ent event tree task and the release fractions are then determined in the source term taik. In practice, the process is iterative.

Source terms are typically characterized by the fractions of the core inventory 01 radionuclides that are released to the environment, as well as the time dependence of the release, the size distribution of the aerosols released. the elevation of the release, the time of containment failure, the warning timet and the energy released with the radioactive material, all of which are required for input to the consequence codes.

Shortly after the accident at Three Mile Island. the NRC initiated a program to review the adequacy of the methods available for predicting the magnitude of source terms for severe reactor accidents. After considerable effort and exten-sive peer review, the NRC published a report entitled "Reassessment of the Technical Bases for Estimating Source Terms,1I NUREG-0956 (Ref. 5.3), which describes a consistent and integrated approach to estimating source terms. The report recommends that a set of coupled computer codes. the Source Term Code Package (Ref. 5.4), be used as the state-of-the-art methodology for source term analysis at this time. These are the methods that have been used as the princi-pal basis for source term estimates for this study of accident risk. Since a separate source term result is required for each different combination of the variables in the statistical sampling analysis and containment failure bin t it is not practical to perform a Source Term Code Package calculation for each combination of the variables of interest. For this reason, simplified methods of analysis with adjustable parameters that were determined from Source Term Code Package results were developed. In addition, the simplified source term methods include a parametric representation of a number of source term issues that are not treated mechanistically in the Source Term Code Package but are varied in the statistical sdmpling analysis. Thus, the simplified source term methods not only were used to extend results obtained with the Source Term Code Package to different plant conditions, but they also played a key role in the performance of uncertainty analyses (Ref. 5.5).

S.2 Results for SurryP.o~er Station Unit 1 5.2.1 Ranges of Source Term Results Twelve source term issues were considered in the statistical sampling analysis for the_Surry plant. The uncertainty assessments that had been made in the Quantitative-Uncertainty Estimate of the Source Term (QUEST) program (Ref. 5.6)

• • _*w~re frequently used to assist in determining alternative issue levels.

.-111~Vessel ~ Re 1ease- f-rom Ft,rel

--~-.- *:~_--*jheuncertaintiet;in tf'ierelease from fuel in-vessel are not only the result of

___o~.~- - uhcert.airitiesassociatedwJth the migration of radioactive materials within the

~~~- ~~-~~J:rU!J and-their release from the surface of the fuel but also with the details

':.~~ __ -*~-~-(jf~melt-progressJoll. Four levels of re-lease were Gonsldered: low. base (which

'"~ -~--"~=*~~was-Dased -oflcSoiJrte Term Code Packageresults)~ high, and very high. Each

~-~, 0:-- ~~~ ~_,

5-2

lev'l was represented by a set of release tractions for each of the seven elemental groups of rldionucl1des.

AMount of CesiUM lod1de Decomposition Although chealical equilibrium analyses (Ref. 5.7) indicate that cesium iodide (CsI) would be the predominant fOnl of iodine in simple systems of cesium.

iodine. steam, and hydrogen under in-vessel core melt cond1tfons t a number of processes could decompose CsI to form more volatile species. These species would be more likely to escape the reactor coolant system. The range of decom-position of Csl assumed was from 0 to 100 percent; and the weights were fairly uniform indicatina a high degree of uncertainty among the review-group members.

Retention in Reactor Coolant System Four levels of retention were considered: high, base (based on the Source Term Code Package)t low, and very low. For each set, different retention factors were defined for iodine/cesium, tellurium. and the less volatile radfonuclides.

Separate sets were developed for high-pressure and for low-pressure sequences.

Decontamination Factor for V Sequence

. For those scenarios in which the pOint of release is submerged. it is necessary to estimate the pool decontamination factor. Since the depth of submergence, failure size. and orientation of leak are not well defined, the range of possible decontamina.tion factors, from 2 to 100, is quite broad.

Magnitude of Core-Concrete Interaction Releas~

In the Source Term Code Package, the magnitude of the ex-vessel release is cal-culated by the CORCON/VANESA modules. Typically. these modules predict higher releases of radionucl1des than the methods used by industry. As a result, the area has been the subject of considerab1e technical dispute. The mode of vessel failtire; degree of dispersal of _fuel debris. and time-dependence of release of fuel to the cavit,y are-uncertain parameters that also influence the size of the Y'elea$:e~. : Four levels Of release were considered in the analysis with release c *t8nIS~t_hat varied by -as much as lOD~

~'~--. -fMcorit8llination Factors for Corttainment Ssrays

• The- .ffecUvenit$lO~'fsprays. in the~removal of aerosols is very sensitive to the

";s;ze ~(liStrtbut ion5g1. the-- aerosol s and the spray drop 1ets. Three cases were

- cconsi:deredi -elr etfect on relea5efrom the reactor coolant system in high-

.~pre"lIti$~uences' .lnwh1~h. -contalnment failure follows vessel meltthrough,

• • --~l.lf.ect(m reT ease tromreac't()r coo 1ant* system in other. sequences t and

~;'""e~;:~;;flJ,,:e.tfect Qn __ CQie--coric*rete 1oteractfon release. The range of decontamination

. _~-_fitt:O~$~fO)! r.elease_ from the reactor coolant-system is from 5 to 100 and for C_;.CC_ > >

=the :Core-COfmrf!te release--from to 1.000.

--<_ -.-;-_--~, * .:-~-_r ___ ~ _ _ ~ -;-_. _ - r **_'0 __

~ -

=--':-i-*-~,T,_,-,,-,-. __ <~ _~;'::.-_< _':':._ *. _~_,,"_

1~;o_~:,=~;Xi!"'~sO[As9riiD!irit.itJn.Ufieeitai nM ts

~'":+/-: ":~;~-~]~~ouglt:aer(Jstilc.~r~nsp(fY't i agg) qmera ~ ion i-and dttp_OS it ion prOces se s are we 11

~o;':;F~.:-:.~~~lj~!:ttall~'c.h~ac~eti~~c!. anc:i . . experimentally dQfI)onstrated~~ som~ aspects of

--- ~-> - -.-.,..::...."'-:-..;., oC -'-_ ---,-- -e-

• __

- '.~ ."'=- .. ---=-. ---;-.,~ :';.~,....;.--: ~ "--' ---~---:'--"'~-

---

.:'--..-'-~ -=h .:-_~. "'""_'_- _'-;" -fl'--o,::,,:";~.-~~.,,; __' "'_*. _:-. -"" *

---r-- =-_.' -- _.. --'--~~ --,=*=-. __'-. ..;"

_;:~~::-~~--=:~'-=--i. 0--"-:' --=~ ~ __ ~-~_ "--= '_ ~-__ -~ _

_~.o~.£j::"~. ~."~:'-~~'<~-'---:~---;>-~'-'"-:-:o... _~.--:_

5-3**

~, '- --. -. --

the aerosols mu~t be specified that are difficult to predict such as aerosol shape factors. The range of aerosol characteristics used in the analyses were primarily bas.ed on $tudies undertaken in tt\C, QUEST uncertainty analysis program (Ref. 5.6),

La~ Iodine Release from Containment After containment failure t iodine that has been dissolved in water on the containment floor will evolve from the pool, and volatile organic iodides may be formed on containment surfaces leading to an extended period of release from the containment. The range of release considered in the statistical analysis was from zero to 10 percent of the inventory of iodine in the containment.

late_~vol~l~zation from Reactor Coolant System Volatile radionuclides deposited on reactor coolant system surfaces early in an accident may be revolatilized later as the surfaces are heated. The Source lerm Code Package models the process of revolatilization to the time of vessel meltthrough. After meltthrough. however, the uncertainties in the processes controlling r&volatil1zation increase. The amount of revolatilization is influenced by complex natural convection flow patterns in the reactor coolant 5ystem~ the extent of degradation of the reactor coolant system insulation, and the chemistry of the interaction of the radionuclides with the surface and other contaminants on the ~urface. The range of release considered included u~ to 70 percent of the amount of iodine and the cesium deposited on the surfaces.

Releases Associated With High-Pressure Ejection and Direct Containment Heating When the reactor coolant system is at elevated pressure at the time of vessel meltthrough, significant aerosol formation is expected with the expulsion of molten core material, even if the dispersed core debris does not undergo oxida-tion resulting in significant pressurization of the containment. Under such conditions, radioactive releases can be enhanced. In this study, this release is divided into a high-pressure ejection and a direct containment heating release. four levels of release were developed for both mechanisms. The enhanced release was assumed to occur for the fraction of the core ejected in the case of the high*pressure ejection component. The additiona1 release asso-ciated with the direct heating component was assumed to only affect the fraction of this material that participated in direct containment heating .

. As aescribed in Section 4.2.2, 19 containment failure bins were defined for the Surry plant to represent the prinCipal end states of the containment event b'ee.

In the statistical sampling analysis that was performed to develop the uncer-tainty.range for the plant risk, there is potehtial1y a separate source term analysis required for each combi nation of containment fail ure bi n ahd stati st-

. ital sample member. since f ;n each member. variations are made in assumptions that affect the course of the accident and the mechanisms that affect the

. release of. radionuclides. Figure 5.1 shows the range of results obtai ned for

- some s-e lected bi ns. These ranges are compared wi th resul ts obta i ned wi th the

.. suite of codes 1n the Source rerm Code Package (the Surry resul ts were obtai ned

.. prior- to tne Gompleti on of the code package) (Ref. 5.8). The Source Term Code

-Packagetesults are not to be considered best estimates because they do not account fora number of important source term issues. which can lead to either "hJglfer or lower source terms. A s i ng1 e va 1ue. rather than a range. i 5 presented

fi <["'],, I , :,i l I ,1,\ li. }'. 1, j' 1 'I I, 1 1

.' ~:;1;5.', ' :No ~" FaIk.re en 16. &rIy OverpressLl'e FaIl.re.

H(t1 Pri'nary Presstl'e. DH. No Sprays "1,'

~,

,LbM."LfT~*'*~"'-:::---*-'-**------" .-~.---

, "  : \ ' I .

'~I' I* I.

, \ < ': 1\

I .,

I '1,

,I ,Ii III , : ; " 1 ,I I R.ulhlftll( I Jde Group 1 atnon ** r,plon 1 tucth,.

J (l'SI . .

I*

, ~ ,

• t te*l1urh.

S bilrh_ *. UronU ..

6 ruthenh.

I '"In...,. Ides **e tin fd4!'$

. . '--~.,__~_. I. _ J_____.

t

• a

~Grcq:t

.. * * ~

.1.__

• _ _

.a. __ "

a

.. ~ "

ern 12. cartai'ment Bypass en 11. Contannent9tp8SS Wllthout Water Pool With Water Pool U'I

.0.

U'I

-J

• 'IP

• 1IH1 e-s e-e,

... ~

~

1

_ _ _ _.J. ___ . _

• t

• . __ ..... 1 4

Figure 5.1 Ranges of release fractions for selected bins at Surry

fOT' the nobla ga;es because_ io sequences in which the containillent fails t essen p Ually all the noble gases win be released to the environment.

For the volatile radionuclides (the iodine. cesium, and tellurium groups), the range of uncertainty varies. from one to two orders of magnitude. For the non-volatIle radionuclides (the barium, ruthenium, and lanthanum groups), the range of uncertainty varies by two to three orders of magnitude. Bin 15, in which the containment leaks at the design value but does not fail in the accident, has the lowest source terms of the containment failure bins. These results are essentially the same as thofoe for Bin 14 in which there is meltthrough of the basemat but no aboveground failure of the containment. The iodine group (Elemental Group 2) has somewhat higher releases than the cesium group (Elemental Group 3) because of the formation of volatile chemical forms of iod'ine over an extended period of time. Indeed for all the bins, the iodine release band is higher than the cesium band because of mechanisms that can lead to the formation of volatile forms. of iodine and the ret.!',Ilution of iodine from pools of water.

Bin 1& in~olves early failure by direct heating pressurization of the contain-ment. If one assumes that direct heating occurs sufficient to threaten contain-ment integrity and accounts for the frequencies of the plant damage states, Bin 16 is the most likely early failure mode of the containment. The release frac-tions are typically four orders of magnitude higher than for the no-failure case. The comparable bin without direct heating is Bin 1. which ;s illustrated in Figure 5.2. The ranges of release fractions for the more volatile groups of radioactive materials are the same for the two bins. The range of release frac-tions for the barium/strontium group (Elemental Group 5) is shifted upward by approximately a factor of two for the direct heating case. For both the ruthenium and the lanthanum group~ (Elemental Groups u and 7), the range of rplease fractions is shifted upward b:, a f~.ctor of three. A single Source Term Cod' ~ ~ckage run was performed to reprasent both the Bin 1 and Bin 16 release terms. This calculation is actual1j more representative of Bin 1 than Bin 16, s'ince t.le Source Term Code Package does not model the enhanced release of radionuclides associated with direct heating.

located in Bins 11 and 12 are the containment bypass source terms in which the release point in the safeguards building is either submerged beneath a pool of water or is above water. The effect of the decontamination in the water pool is not only to shift the band toward smaller releases but also to increase the spread of uncertainty since the effectiveness of scrubbing could vary over a broad range. Although pool decontamination is clearly beneficial in reducing the source term for this type of accident scenario t the uncertainty bands for the source terms are so wide that the overall perspective of the source term is not dramatically changed. For example, even with scrubbing by a water pool in the safeguards building! the iodine release fraction could still exceed 20

_percent of the core inventory within the uncertainties associated with phenome-no19yical issues.

,i I I ,~ !. I I 'I

,\ I"

\ i:

Comparison of Results Station Blackout. Early FaBure Scenario

,.1 l,l:1  ! ,i

',:' ':1 Il\ I I Release 0,

o "1

'+

j teo..:, , +

o +

x o

0

+ ,l(

+ x o

tTl I,

"'-I

)( Reactor Safety Study R.dlonucltde Group

+

1E-4 1 _enon. 'rypton 0 'I iodine MARCH/CORRAL J ce~hJIII 4 telluriUIII

+ Source Term Code Package ~ b.r1u.. strontiu.

1E-5 () ruthentUII I NUREG-1150 (Bin 1 ) 1 lanthanide'S. ae tlntde'S 1E-6 '---~:------~-----.1..-.------L-- ___-L-_ _ _ _ _L-_--J 2 3 4 5 6 7 Radionuclide Group Figure 5.2 Comparison of results for station blackout scenarios at Surry

5.2.2' Comparison With Other Studies Although probabilistic risk assessments (PRAs) use stmilar terminology to describe accident sequences. scenarfos with the same identifier in two different stulJie~ frequently Involve 5ubstahtially different definitions. and assumptions.

What appear to be minor differences in assumptions can have a major impact on the calculated source tenl. For eMample t a few psi difference in assumed fai-lure pressure could be the difference between early containment failure and late cont~inment failure in an accident scenario 1n the Surry plant. with ord~.~ of magnitude variation5 tn source terms. Furthermore J differences in the predicted behavior in one part 01 the analysis can propagate through the remainder of the analysis. 1n addition. the large uncertainties in the source term methods must be recognized when comparing potnt*est1mate results. For example, a difference o*f a factor of two between source terms is certainly minor when interpreted wlthinthe context of two orders of magnitude uncertainty.

lhe treatment of source terms in PRAs has passed through three major phases as the capability to model severe accident processes has improved. The first phase was based on Reactor Safety Study (Ref. 5.9) source term results. The Reactor Safety Study analyzed two plants) Surry and Peach Bottom. The available data base was very ~parse and the methods of analysiS were crude. The next phase of source term analysis followed the writing of the MARCH code (Ref. 5.10).

The combination of the thermal-hydraulic analysis capabil ity of MARCH and the ---

containment transport analysis capability of CORRAL (Ref. 5.11) permitted acci-dfnt. sequences to be analyzed from beginning ~o end. The radionuclide modeling assumptions were essentially identical to th" ' . i"'4: -1 in the Reactor Safety Study.

The core meltdown modeling assumptions wen '1 1 :; I..e simple. relying heavily on conservatiun laws and intuition about the expected behavior of core meltdown progression. The MARCH/CORRAL methodology was used in the Reactor Safety Study Mtithodology Applications Program in the analysis of the Oconee, Calvert Cliffs, Sequoyah~ and Grand Gulf plants (Refs. 5.12 and 5.13), A number of sequences w~r~ also reanalyzed for the Surry and Peach Bottom plants using these methods (Ref. 5.14).

Subsequent to the Three Mile Island accident t the NRC undertook a compr~hensive research progra. to develop and validate methods for the analysis of severe accident phenomena (Ref, 5. 15). 1 his program has been augmented by cont r I bu-lions from the Electric Power Research Institute and rOCOR programs in the United States and coop~rative programs with a number of foreign coun~ries. One of the products of this research program has been the Source Term C~de Package used in this study. The technical basis for the Source Term Code Package ;s described in HUREG-0956 (Ref. &.3).

At the same time as the NRC has been daveloping a complement of computer codes for analyziqgsevere accidents; the nuclear industry h~s also been developing analysis capabilities. The analog to the ~ource Term Code Package is the IDCOR Modular Accident Analysis Program (MAAP) (Ref. 5.16). Although there are a numbe~ of differences in modeling assumptions in the two code packages, both packages were developed with similar objectives. Each attempts to perform a consfstent~ realistic analySiS of severe accident processes. However, to date Ute MAAp program has not yet been subjected to the same level of external peer review as the Source Term Code Package.

5-8

figure 5.2 ..:ompare1J source terms that have been obtained in different studies tor the ~tatlon blackout 5equenee in the Surry plant, The mode of containment faOure ~\ by steam ::.pike and/or hydrogen detlagrat ion. Results are compared for the Reactor Safety St.udy. the R.artor Safety Study Methodology Applications Program using the HARCH and CORRAL codes. the Soure£, Term Code Package, and the raflge of "ouree terms from the uncertainty analysh 1n this study. The Surry plant was not one of the reference designs studied in the IDCOR program with the MAP code. For the volatne radionuclfdei (the iodine t cesium. and tellu-rium groups). the principal differenee between the Souree Term Code Package and the earl tet results h in the credit taken for retention within the reactor coolant system, In the uncertaint.y analysls. some of the credit taken in the Source Term Code Pac kage forlhis retent i on is 10& t because 0 f the potent 1a 1 tor revaporhation from reactor coolant system surfaces and the conversion of le" volatile forms of iodine to more yolltile forms during transport within the reactor coolant system. For the less volatile radionuclides , the uncer*

tainty can either be in the direction of higher Dr lower releases than pre-dicted by the Source Term Code Package 1 depending on the most important source of uncertainty.

Figure 5.3 shows a similar comparison fqr the interfacing-system LOeA sequence without water scrubbing in the safeguards building. For this sequence J an analysis was not actually perform@d in the Reactor Safety Study. The sequence was binned wi th the PWR2 bin. whkh is used to rep lot the Reactor Safety I'

Study in the comparison. In the MARCH/CORRAL analysis. the only credit for retention of the volatile radionuclides was retention in the already failed safeguards building. It is not surprising that the MARCH/CORRAL release fractions for the volatile radionuclides are very high. The Source Term Code Package not only accounts for retention during transport in the reactor coolant system but also performs a more mechanistic analysi& of aerosol retention pro-cesses in the safeguards building and in the containment after meltthrough of the reactor vessel. The principal sources of uncertainty in the analysis can lead to somewhat higher source terms for the volat 11& radionuc 1i des t but the uncertainties are primarily in the direction of smaller source terms for the less volatile radion~clides.

The comparison of source terms from earlier studies with those of NUREG~1150 indicate that, at least for the sequences compared and considering uncertain-ties, the values in the Reactor Safety Study were not as conservative as has often been claimed. The presentation of source terms as a band of uncertainty provides much more insight into the state of knowledge than previous presenta*

tions of point estimates. It is not possible to make meaningful comparisons between source terms or to understand the significance of a source term in an absolute sense without doing so within the context of the associated uncer-tainties. If Figure 5.3 were considered without the NUREG-1150 results (with only the pOint-estimate values for the Reactor Safety Study. MARCH/CORRAL t and the Source Term Code Package). these points indicate a trend of a factor ot two-to-ten reduction in source terms with the improvement in methods. When the uncertainty in the source term results is graphically displayed~ however, it can be seen that the apparent decrease in source terms is within the uncertainty spread associated with outstanding phenomenological issues.

5-9

Comparison of Results for Interfacing I .

Systems lOCA (Without Scrubbing) o

... 0 x +

o x

+

o +

x U"I I

1-1 o RMtOfW(' ift Group x Reactor Safety Study 1 ** no.. krypton 0 Iv1ARD-VCORAAL 1 lodl ...

1 (f':>i . .

+ Sou'ce T em Code Package , teIIIlT ....

S b.lrh... It.",., It.-

1E-5 I N...REG:-1i50 6 rut_nil..

' hnt"."tdll'S. ICU"'ftS 1E-6 2 3 4 5 6 7 Radionuclide Group Figure 5.3 Compar'j son of results for interfacing-system LOtA at Surry

5.2.3 Plant-Specific Perspect;ve$

Sub$equent to the Three Mile Island accident, there has been corsiderable research undertaken to study the phenomena associated wi th Uie release and transport of radioactive material In severe accidents. A number of phenomena are treated in current models that have the potential to lead to greater reten-tion of rad1unuclides within the plant in comparison with the Reactor Safety StuQy analyses. In particu1ar. current models indicate that a significant frac-tion of the radionuclides released from fuel will deposit as aerosols, condense as vapors, or react as vapors with surfaces in the reactor coolant system.

Similarly, the mechanistic treatment Of aerosols in containment volumes in the Source Term Code Package predicts more retentic.o of radioactive aerosols than the semlempir1cal model. CORRAL. used in the Reactor Safety Study and Reactor Safety Study Methodology Applications Program.

In comparing point estimates of radionuclide release result~ over the past decade there is an apparent trend with time toward smaller I~leases. When uncertainties are included in the comparison, however, the significance of the trend becomes less clear. The uncertainty bands associated with source terms are quite wide. For the Reactor Safety Study sequences, the Surry results fall within the band of uncertainty in NUREG-1150. This is because some of the phenomena identified in recent years have the potential to increase source terms rather than to decrease them. For example, the uncertainty associated with the revaporizat1on of volatile radionuclides deposited on surfaces in the reactor coolant system tends to negate the erE' lit taken for retention inside the reactor coolant system.

5.3 Results for Zion Nuclear Power Plant Unit 1 5.3.1 Ranges of Source Term Results The same source term issues. levels; and weightings '.".,., nsidpred in the uncertainty study for the Zion plant as in the stat' . ampling study per-formed for the Surry plant (Ref. 5.17). Since it ~~5 , ded that the break location in an interfacing-system LOCA sequence would r J@ w~ter covered, it was not necessary to consider the decontamination factor associated with water scrubbing.

As discussed in Section 4.3.2 t the containment failure bins for the Zion plant were defined in almost an identical manner to those used for the Suny plant.

The reactor coolant systems for the two plants are different; the Surry plant has three loops while the Zion plant has four loops. However, for a given plant damage state, the release of rad10nuclides from the fuel and transport within the reactor coolant system would be quite similar. There are also differences in the containment features between the two plants. Since for a given contain-ment failure bin the mode and timing of failure are specified, the differences in containment-features have a greater influence on the probability of a bin than on the release characteristics of a bin. It is not surprising, therefore, that the ranges of release fractions obtained for the Zion containment fai1ure bins are ve~ similar to those for Surry.

5-11

In the Surry analysIs. the luit.e of codes that were later combined to form the Source Term Code Package were uI.d in their stand-alone form (Ref. 5.18). for the Source Tertii Code Package, SOlIe improvements were made in the codes, includ-ing the treatment of releale coefficients for the in-vessel analysis of release of radtonuclides frOM fUll as a function of temperature. The most significant difference obtained was for the ruthenium group of radionuclides. As a result, for many of the bins the Zion values of ruthenium release are substantially lower than the Surry values. The only exceptions are the direct heating bins in which the magnitude of the ruthenium release is determined by the release during direct heating rather than by the in-vessel release period. The Source Term Code Package results also have two additional radionuclide groups. In order to better represent the chemical difference!! between elements~ the barium/

strontium group has been divided into two groups an~ the lanthanum group has been divided into two groups. For consistency with the Surry results, only seven groups are displayed. Results for the barium and cerium groups are quite similar to those obtained for the strontium and lanthanum groups. respectively.

Ranges of release fractions are il1ustr~ted in Figure 5.4 for four containment failure bins. Source Term Code Package results are shown on the figures for comparison. 8in 15. which involves no containment failure, has very small release fractions. The high release for the noble gases is somewhat misleading.

Although it can be argue~ that the noble gases are not reactive and that they will all eventually be released, in actuality they would be largely decayed when released. Radioactive decay is accounted for in the consequence analysis codes. In the late failure case, Bin 8. in which containment sprays operate.

the predicted release of iodine and cesium in the Source Term Code Package analysis is very small. In comparison, the NUREG-llSO uncertainty bands extend to release fractions of approximately 0.1. The important sources of uncertainty are the revolatilization of radionuclides from reactor coolant system surfaces and the late release of iodine. The high release assumptions used in the statistical sampling analysis for these two issues involve substantial fractions of the radionuclide inventories. Although the weights assigned to these levels were smal" they were found to control the upper end of the iodine and cesium re lease tel'ms.

5.3.2 Comparison With Other Studies The Zion Probabilistic Safety Study (Ref. 5.19) used the Reactor Safety Study CORRAL code to estimate source terms for severe accident sequences. As a result. many of the mechanisms that are now recognized to be important in source term analySis were not considered.

The Zion plant was one of the reference plants in the lOCOR study (Ref. 5.20).

Four scenarios were analy%ed using the MAAP code. For the interfacing-system LOCA sequences t V. the predicted release fractions for the volatile radionu-elides (iodine, cesium. and tellurium) were quite small (8 x 10- 6 fraction of initial core inventory). The small release is primarily the result of exten-sive condensation of steam predicted in the auxiliary building in the MAAP analyses. A specific Source Term Code Package analysis was not performed for this case. The Brookhaven ranges of release fractions for the V plant damage state are substantially above this level of release. however, varying from 5-12

Bin 15 No Containment Failure

£l,,"UL G"quR 1 .enon. krypton 2 fodin' 3 Ctlfum 4 t.llilrf LIllI S stront,iUIII 6 rutfleniUIII 1 lanthanum I:

'" e * '1 Bin 8 Late Failure, Sprays Operate I NUREG~1150

• Source Term I Code Package

+

+

~~~1-------.~----~3------~",------~e~----~------*~~~

Figure 5.4 Ranges of release fractions for selected bins at Zion

10 ~rcent to 80 percent for fodin ** 5 percent to 70 percent for cesium. and 0.8 Ptreent to 60 pere'lftt for tallur1 unt.

Three variations of ~tat1on blackout we,' also analyzed by IOCOR. The release fract ions obtained for t.wo of the cases wi th late ,ontai nment fail ure were Idlnt ieal. Figure L & comp.re. the IDCOR values wi th the NUREG-1l50 range for 81 n 10,

• l.'te ovtrpr... ure bin with leakage rather than rupture. Also shown in the figure are Source Term Code Package results. For each elemental group, the IDCOR results t.l1 below or near the bottom of the NUREG-llSO uncertainty band.

A station blackout scenario was also analyzed by IOCOR in which there was Issumed to be a prlex1$ting breach in containment at the start of the accident.

These results If' compared with the range obtained for the corresponding Bin 1 in HUREG-llSO and with a Source Term Code Package run for a sce"~r10 within the hin. Again, the MAAP results are conSistently below the NUREG*1150 range~

indicative of technical disagreements in the source term models.

5.3.3 Plant-Specific Perspectives The source term results for the Zion plant are quite similar to those obtained for the Surry plant and the plant-specific perspective~ are the same. The uncertainties in the eitimaled source terms are quite large. The principal contributors to the uncertainties are basically the same as for the Surry plant. Comparisons made between the Source Term Code Package results and MAAP results indicated that the MAAP estimates for environmental release fractions were significantly smaller. It is very difficult to determine the precise source of the differences observed. however, without performing controlled comparisons for identical boundary conditions and input data.

5.4 Results f0t-Sequoyah Nuclear Power Station Unit 1 5.4.1 Ranges of Sour~e Term Result~

The source term issues included in the stati~tical sampling analysis are very similar to those considered for the other PWR plants (Ref. 5.21). A few issues were added because of the unique aspects of the ice condenser design.

Decontamination Factor for lee Condenser

.,.--.

• W . . -

Retention of radionuclides in the ice condenser region is a very important aspect limiting the release of radionuclides to the environment in this plant design.

The effectiveness of the ice condenser ;s affected by the operability of the air*return fans. On the one hand, prior to containment failure the air-return fans can recycle the containment air through the ice condenser a number of times providing an opportunity for additional retention at each pass. By returning noncondensible gases to the lower compartment region, however. the air-return fans tend to reduce the effectiveness of the ice in retaining radionuclides for any single pass t since the decontamination factor is very sensitive to the f~act1on of steam in the flowing gas. Three boundary conditions were considered:

(l) containment failure at vessel breach with the air-return fans operating, (2) containment failure prior to vessel breach with the air-return fans operating t and (3) containment failure at or before vessel breach with the air-return fans off.

5-14

Station Blackout with Early Failure r

.I .I +

• Elemental Groue

• 1 xenon 'I krypton 2 10dfne 3 ce5ium 4 tellurium 5 strontium 1

• :I 4 I ., 6 ruthenium 7 lanthanum Elementat Q-04)

Station Blackout with Late Failure, I+ NUREG-1150 Source rem Leakage Faill.l'e Code Package 0 [DeOR teo -r - -.

r-UK

...u'Cr

... '~

~

~

I .I

• dHr'"

~ * *

• te-3l

~

"'r:: +

"'r

.... _I t 2 3 4

• e* 7 Elemental GtClt.fl Figure 5.5 Comparison of results for station blackout scenarios at Zion 5-15

Scrubbing of 'eleasss from Core-Concrete Interactions As discussed previously. the potential eXl~ts in the Sequoyah design for a wide range of flooding conditions ranging from a dry cavity to a depth of 20 feet for complete injection of the refueling water storage tank and to higher values depending on the amount of ice melted. This issue is of most significance when the ice bed is depleted or bypassed at the time of core-concrete release.

Twenty-five containment failure bins were defined for the Sequoyah plant. The SIYYY (small break with failure of emergency core cooling in the recirculation mode) and SNNNY (failure of component cooling water system resulting in failure of the emergency core cooling, containment heat removal, and containment spray systems) stand out as the highest frequency plant damage states. For the SIYYY state. the most likely bins are Bin 23 in which there is no containment failure and Bin 21 in which the containment failure is late~ the sprays operate. and the core concrete release is scrubbed by a deep pool of water. The range of release fractions for Bins 21 and 23 are illustrated in Figure ~.6. As expected, the release fractions for the no~containment-failu.'e case (Bin 23) are quite small, even accounting for uncertainties. Most of the release fractions for Bin 21 are also small, except for the upper end of the uncertainty range for iodine release. which is driven by late iodine release uncertainties.

The SNNNY failure slate would ue expected to have more severe containment failure bins because fewer of the important containment safety systems are operational. However, because ac power is available and the igniters operate, the expected failure time is several hours after vessel Dreach. Thp principal bin for this ~lant damage state is Bin 19. The range of release fractions is shown in Figure 5.6.

Another important plant damage state is ~NNNN, station blackout with failure of reactor coolant pump seals. The principal containment failure bins are Bin 1, in which th~re is early containment failure and the sprays and air-return fans are inoperable; Bin 21, which involves late containment failure as the result ot hydrogen burning at the time ac power is restored; and Bin 19. A major difference between Bins 19 and 21 is that the containment spray system operates in 8in 21 after ac power is restored. removing aerosols from the containment atmosphere and providing water to the reactor cavity suppressing the core-concrete release.

5.4.2 Comparison With Other Studies Sequoyah was analyzed previously in the Reactor Safety Study Methodology Applications Program (Ref. 5.13) using the MARCH/CORRAL codes and, as one of the IOCOR reference plants, using MAAP. In the MARCH/CORRAL analyses the decontami-nation factor for the ice beds was input to the code. The base case value was a decontamination factor of 100. Some variations were performed using a value of 10. Mechani st it analyses us lng the ICEDF code (Ref. 5.22) in the Source Term Code Package indicate that a value as large as 100 is quite unlikely under the conditions anticipated. Figure 5.6 compares RSSMAP values with a decontamina-tion factor of 10 with the NUREG-1150 range and with the results of the Source Term Code Package for Bin 1. The MARCH/CORRAL results tend to be near the upper end of the NUREG-1150 range. In contrast t the results obtained in the MARCH/

CORRAL calculation with late containment failure and sprays operating, which 5-16

BI1 21. Late Foue SIn 23, No Conlannenl Falue Sp.Y' .." FlAIl 0Pw.tKnl1

- I ~r II *

.1

... -- I f

I

• *I 1-.

I I u I * * *

....... Q . . EIImnIII GrOIO 8i'1 1 Early Faue. No AC Power Bin 19. Late Fai/u"e.

Ice Av..... 8' v..... ereach Spraye IIrd Fane /'oCt Operalknll

... I **1 ...

• *.1* -., I II

• 1 * ..I * *

-- --r *

...... QQII

• * - I.

~

e.n.tt.. QGI.P an J Early Faikle. No AC Power Ice B)pas!Kid Elemental Groue I NUREG~ 1150 1 xenon, krypton o IDCOR 2 iOdine +- Source Term

-r 3 cesium COde Package 4 tell ur1 um X RSSMAP

- 5 strontium 6 ruthenium 7 lanthanum

..*L-~--~.~---+.----7.-----~----*!.----+-~

Figure S, Ranges of release fractions for selected bins at Sequoyah 5-17

can be compared with 8in 21 results, are not shown in Figure 5.6 because the r,l,aie was len than 10. 6 for each elemental group of rad1onuclides.

In the JDtOR Inllyses~ as discussed in Chapter 4. very few early containment failure Clles were evaluated. One cIse that was analyzed 1s a small LOCA with fal1ure of both t.he emergency core cooling system and the spray system in the recirculation mode with an impaired containment. figure 5,7 provides a compar-ison of the IDCOR results with the Btn 15 range for the case of a large isola-tion failure. In this comparison; the IDCOR results fall wfthin the NUREG-1150 uncertainty ranges. The JDCOR results tor the iodine group fall at the bottom of the band because of the contribution of late release of iodine to the uncer-tainty in iodine release. The IDCOR results also fall near the bottom of the strontium band as the result of modeling differences related to core-concrete interaction release. A less favorable comparison is shown in Figure 5.6 for 8in 19. This is a late containment failure case involving station blackout conditions. The large rlifference in the results is more representative of differences in the morl~ling of containment behavior rather than differences in modeling source term oehavior. In the IDCOR analyses, because of the smaller estimate of hydrogen production. the containment is predicted to remain intact for a day after vessel meltthrough. In the Sandia analyses, the failure time is only delayed a few hours. The nonvolatile groups have small release values in the IOCOR analysis (less than the 1 x 10 & IOCOR cutoff). The NUREG-1150 bin 8

involves quenching of the core debris in the reactor cavity and a very delayed period of core-concrele interaction after the water in the cavity has been boil ed away.

S.4.~ Plant-Specific Perspectives A number of features of the ice condenser design can play an important role in the mitigation of radionuclide release to the environment in a severe accident.

The availability of the ice bed is the most imp~rtant feature. As long as the ice bed is available at the time radionuclides are released, it is capable of reducing the release by an order of magnitude or more. A possible exception could be in the event of direct heating in which hot gases are transported too rapidly through the ice bed to allow effective decontamination.

Another important feature is the large depth of water that can develop in the reactor cavity. Thi s water may pt'event core-concrete interaction by formi ng a coolable debris bed, can decontaminate the core-concrete release if the debris is not coolable. may decrease the lik~lihood or effectiveness of direct heating after vessel failure, and can decontaminate the revolatilization release of volatile radionuclides from reactor coolant system surfaces.

The spray system provides another means for reducing the environmental release.

If the containment remains intact for an extended period of time, the spray system can be particularly effective in the removal of suspended aerosols. In this regard. the operability of the hydrogen igniter system has an indirect but important impact on source terms because of its importance to the timing of containment failure.

For a number of bins the upper end of the band of uncertainty for the release of iodine is quite high. Uncertainties related to the long-term evolution of iodine from pools, organic iodine formation; and the revolatilization of iodine 5-18

Bin 15, Failure to Isolate tian 1E-1 o o o

Elemental Groue o

• 1 lCenon. krypton 2 iodine 1 cesillll 4 tellurium 5 strontium 6 ruthenflilll' I NUREG-1150 o IOCOR 7 lanthanum 1E-6 1 2 3 -4 6 7 Elemental GrOl4l Figure 5.7 Comparison of results for failure to isolate containment at Sequoyah

fro. reactor coolant iYlt,. furfac.s are the key contributors to the top of the band. Ongofng research is investigating these issues; the final version of thil report wltl reflect the$e new data.

5.5 Results for Peach Bottom Atomic Power Station Unit 2 5,5.1 Ranges of Source Term Results The source term issues sele't~1 for the statistical sampling analyses for the two boiling water reactor plant~ were quite similar. For the Peach Bottom plant, nine issues were included in the analysis (Ref. 5.23):

1. Magnitude of in-vessel release from the fuel;

2. Amount of cesium iodide decomposition in the reactor pressure vessel;

3. The amount of radionuclide retention in the reactor coolant system;

4. Suppression pool decontamination factors for aerosols;

5. Suppression pool decontamination factors for volatile iodine;

6. Revolatilization of iodine and cesium from the reactor pressure vessel following vessel breach~

7. The magnitude of radionuclide r'elease from the melt during core-concrete interact 1ons ;

8. Reactor building and refueling bay decontamination factors; and

9. Late release of iodine from the pressure-suppression pool.

Figure S.8 shows release fractions for two important Peach Bottom bins, desig-nated Bin 7 and Bin 13 in Appendix E. Both are associated with station blackout scenar10s leading to early core meltdown and early failure of the containment.

In Bin 1 there is no direct heating. A moderate value of decontamination factor is applfed to the reactor building. The strontium and lanthanum releases for the Source Term Code Package run are high relative to the NUREG-1150 uncertainty ranges because the amount of retention predicted for the reactor building was quite small. The predicted release of the ruthenium group was less than 10- 6 of the core inventory and thus does not appear on the figure. In Bin 13 there is direct heating, and the rea~tor building decontamination factor is quite small. The results for the SO'lrce Term Code Package are shown for compari son.

The code package values do not. include the enhanced release associated with direct heating. In both COl'rlparisons , the NUREG-1l50 uncertainty bands are higher for the iodine an ... ceslum groups than the Source Term Code Package results because of the treatment of the late iodine and vessel revolatiliza-tion issues.

S.S.2 Comparison With Other Studies The release fractions for some of the Reactor Safety Study scenarios were quite large. For example, the release fraction of iodine for the Reactor Safety Study 9WR2 bin was 90 percent. The potential for reactor building retention 5-20

Bin 7, Early Failure, Direct Heating, IvhnaI Reactor Building Retention

-,..1r I~

I"

-. _~J I -,

.... r I"

I"

~

• -I

• I -I tHr'" ~

~

""'r ~

"'r'" to tH

• t e I

" EJemantaJ" c:t'~

15 7 Bin 2f Early Failure.

tvtoderate Reactor Building Retention f!'", .&

.r

-~l-I

+

-I I

.... r

.3r

~

~

~

EleNntal Groue 1 .enOftt krypton 2 todin, I

... r 3 4

tUfUil tf!l1urtum r

5 s tron tf utII I HUREG-l1S0 6 ruthenium + Source Tem

"'r 1 lanthanum Code Package

.... i-t Z 3

e

.1 e 1 Elemental (Seq)

Figure 5.8 Ranges of release fractions for selected bins at Peach Bottom 5-21

was liMited to depos.ition in the annulus between the steel containment shell and the re inforced concr'ete wall behind H. Although the station blackout s.eou~nce was not specifically analyzed in the Reactor Safety StudYt a comparable se4uence was analyzed with the MARCH/CORRAL code set a5 part of the rebaselining effort in the Reactor Safety Study Methodology Applications Program. In this acc;dent. ccnta;nment failure is predicted to follow vessel breach by approxi-mately 45 minutes. Figure 5.9 provides a comparison of a variety of station blackout $cenar1os with delayed containment failure. In the Source Term Code Package analysis, the containment fafls apprOXimately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after vessel breach. In this case, a suustantlal amount of the strontium and lanthanum release from fuel during core-concrete attack occurs after containment failure.

In comparison, for the NURfG-ll&O range ~f releases shown for a late contain-ment failure bin, the period of core~concrete release precedes containment failure. This is why 't.he release fractions for the strontium and lanthanum groups are so much lower than the Source Term Code Package results.

HAAP results from the IDCOR program are also shown for comparison in Figure 5.9.

In the IDCOR analYSis, containment failure followed vessel breach by 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The Source Term Code Package and MAJ\P results are in ret"lsonable agreement for the iodine, cesium, and tellurium groups. The MAAP releases of iodine and cesium are somewhat higher despite the longer time to containment failure because of the treatment of revolatilization from reactor coolant system sur-faces in the analysis. The release of strontium in the Source Term Code Pack-age analysis is orders of magnitude higher than the MAAP results because of the large release predicted by the Source Term Code Package during core-concrete interactions. The Source Term Code Package also predicts a large release of the lanthanum group. which the MAAP code did not model at the time of the reported analysis. The mo&t severe scenarios analyzed in the IDCOR program were the transient with failure of longNterm heat removal and an anticipated transient without scram, in both of which containment fai lm'e precedes core melting. In these ca~es, the predicted release of iodine to the environment was 20 percent and 10 percent, respectively.

5.5.3 Plant-Specific Perspectives The source term~ for the Peach Bottom plant are largely influenced by the mode and timing of containment failure. However, a number of other issues can also have a major influence. Since the likelihood of transient-~lIitiated accidents is much greater than pipe break accidents leading to core melt, the release of radionuclides from th@' fuel that OCCUf5 in*vessel will initially be largely deposited on pressure vessel surfaces or captured by the suppression pool. As a result. the amount of the volatile radionuclides (iodine, cesium, and tellurium) that escape to the environmant will be detprmined by subsequent phenomena such as the revolatilization from pressure vessel surfaces, late release of iodine from the suppression pool, and the amount of these elements still retained in the fuel at the time of vessel breach. Unfortunately. these issues all have large associated uncertainties.

Because the in-vessel release of radionuclides is likely to be substantially attenuated. the magnitude of the ex-vessel release of radionuclides in the Peach Bottom plant becomes that much more important. If early failure of containment occurs in the drywell, as expected in many scenarios in the Sandia study, only drywell sprays or deposition in the reactor building represents si gnificant oppm'tunit ies to decrease the t'elease to the envi ronment of the 5-22

Station B,lackout Scenarios V\/ith Late Containment Failure E1-,,"1 &foul!

r +

r" """I

~

j

---1 Z

xeaon. krypton iodine 3 cesft.

1E-1 I I

I II *s steUurt_

t!l"Ollti.-

X 0 6 rutlwmt . .

I 0 I 0

• I t +

1 1inth.".

~ f X j

+

I + I l

• i I

! X U'I

,t X  ! IX N

I I i I

X I

(.,0..>

iI i

I II 0 0

I RURES-USO I

+ Source Term i I 1E-5 0,

Code Package lOCO_

X RSSMAP II i

t II I

I I

1E-6 1 2 I

3 i

I

.. J _ _ _ _ _ _ *. _ _ _ _ _ _ ....1_.

5 I

l 6

7 t

I Elemental Group Figure 5.9 Comparison of results for station blackout scenarios at Peach Bottom

core*concrelerelease terms. Because of the high limestone composition of the aggregate in the Peach Bottom design t the CORCON!VANESA routines in the Source Term Code Pac~age pred;ct a particularly large release of radionuclides during core-concrete interactions. Whereas the consequences of rn~~t severe accident

~cenarios in pressurized water reactors tend to be control1~d by the quantities of iodine and cesh ..., released, in the Peach Bottom plant the lanthanum, cerium.

barium. and strontium groups can have a greater radiological impact than the more volatile groups.

5.6 Results f~r Grand Gulf Nuclear Station Unit 1 5.6.1 Ranges of Source Term Results Only four soutce term issues were included in the statistical sampling analysis for the Grand Gulf facility (Ref. 5.24). The selection was based on an assess-ment of the importance of different source term issues in the Peach Bottom analysis..

1. Revolatilization of iodine and cesium from the reactor pressure vessel following vp,ssel breach.

2. The magnitude of radionuclide release from the melt during core-concrete

nter8( t ions.

3. Scrubbing of core-concrete interactions by ovel'lying water in the drywell.

4. Late release of iodine from the pressure-suppression pool.

Because of the large number of cOlltainment failure bins, no single bin completely dominates any of the measures of risk. However, a few bins can be identified that are particularly important contributors. The principal contributors to ear'ly failufP probability are Bins 137, 138,144. and 145, which are variations of a sin~le scenal'io. Ea:h inVOlves early failure of the containment, no con-tainment sprays, no core-concrete interaction, and nominal leakage from the dry-well. These conditions are expected in station blackout scenarios with recovery of ac power. In Bins 137 and 144, containment failure precedes core melting and in Bins 138 and 145 containment failure occurs at the end of the in-vessel melt-ing period. Bins 137 ana 138 are complete core meltdown scenarios involving meltthrough of the pressure vessel, whereas in Bins 144 and 145 emergency core cooling ;s recovered and the melting is arrested within the vessel. As indi-cated in Figure 5.10, the release fractions for Bins 137 and 138 are identical as are the release fractions for Bins 144 and 145. The timing of containment failure and the energy release vary as associated with the relative timing of core melting and containment failure. Since there is no ex-vessel release or it is effectively scrubbed for all of these bins, the very limited statistical sampling treatment for Grand Gulf on'!y identified uncertainty ranges for iodine and cesium. As expected, however, the iodine and cesium releases for these scenarios are by far the most important among the different elemental groups.

The most important source of uncertainty is in the late release cf iodine from the suppression pool. In the statistical sampling treatment, up t~ 50 percent 5-24

611 137" 38 Early Fa....s. No Sprays. Bin 144/145 Early Fai/Lfe. No Sprays,

~ DyW1li Leakagllt Norr"~1 Orywe/l Leakage. Recovery

.., I I * *

... ,-----*~~----~i----~;~*---%-----*,~----~-~ ....,'---~--.~.--i'---4~'---:~----:.~--+. . . . .

Bin 132 Late Feilll'e. DarnogE'd Drywall Bin 128 Early Failu*e. Damaged Drywell

.,rw.-. FrllClm

..., I

"'f

... I I -

• I I I

1I-lI I

I .J

... " ~..

I 4

QG.P

• • * .... I~~-----~~-----i----~

Elemental GCJll)

Elemental GroUl! I HUREG-l1S0 1 xenon. krypton + Source Term 2 iodine Code Package 3 cesium 4 tel1uriUlli S st tOnt t till!

6 ruthenium 7 lanthanum Figure 5.10 Ranges of rel(*ase fractions for selected bins at Grand Gulf 5-25

of the iodine captured in the pool could potentially 08 released from contain-ment. Although the probability assigned to this amount of release was not high. the resulting release 15 Quite large, This uncertainty affects nearly all the Grand Gulf release bins leading to an upper bound on the release uncertainty of a~proximately one-third of the core inventory of iodine. As discussed in Chapter 11. this hsue is intended to be the subject of additiona"' study prior to the publication of the final verston of this report.

Another important contrfbutor to risk in Grand Gulf is Bin 128. in which there is early failure of the containment accompanied by damage to the drywell result-ing in significant bypass of the pool. In this scenario t the core-concrete interaction is delayed until water in the reactor cavity has been boiled away.

As indicated in Figure 5.10. the uncertainties in the release of the nonvolatile radionuclides dre quite broad with the potential for large releases of the lanthanum and strontium groups, as well as for the more volatile radionuclides.

The Source Term Code Package results fall slightly below the uncertainty ranges for Bin 128. In the sequence analyzed. core-concrete interactions began before the water in the pedestal region had been boiled away. As a result, the releases for the nonvolatile radionuclide groups were partially scrubbed in the Source Term Code Package analysis. The releases of the volatile radionuclide groups, iodine and cesium, are also lower for the Source Term Code Package calculation because of the late release mechanisms accounted for in the NUREG-1150 uncertainty analysis.

Some late contai nment fa it ure scenarios can also resul tin potentially large releases. Bin 132 involves late containment failure but with a damaged drywell.

As a result, the cesium, which after some period of delay is revolatilized from the pressure vessel surfaces. is able to bypass the suppression pool and escape from the containment. More recent analytical wo~k at Sandia indicates that the potential for revaporization from surfaces is not as great as simple analyses based on the vapor pressures of pure substances predict. These additional data will be reflected in the final version of this report.

5.6.2 Comparison With Other Studies Neither the IDCOR nor the Reactor Safety Study Methodology Applications Program analyzed station blackout scenarios. The methodology of the Reactor Safety Study Methodology Applications Prcgram was quite outdated in comparison with modern analytical tools. The CORRAL code was used to analyze the transport of radionuclides in the containment. No retention of radionuclides within the reactor coolant system was taken into account. A decontamination factor for the suppression pool was input to the code but a value of unity (no retention) was assumed for cases in which the pool was hot. .l\s a result, the predicted release fractions for many of the sequences analyzed were quite high.

Figure 5.11 shows a comparison between IDCOR, Source Term Code Package, and the NUREG-1150 range of release fraction~ for an anticipated transient without scram scenario in which containment failure precedes core meltdown. Except for the ruthenium release group, the IOCOR results fall beneath the lower boundary of the NUREG-1150 uncertainty band. Release estimates for all the IDCOR scenarios analyzed are quite low because it was assumed that there was minimal bypass of the suppression pool and because the potential for significant vaporization of iodine from the pool wa!J not consider'ed possible.

5-26

,r 200 psi, 0.005 0.001 0.001 0.004 0.013 0°08 early CF VB, < 200 psi, 0.082 early CF VB. BMT or late CL 0.079 0.046 j0.013 0.055 0 059 0.292 0 280 Bypass 0.003 0.078 0.007 . L 0.122 0.001 0.310 [5 J0.217 0 346 [7 09f]

435 VB, No CF F73 LI 0.350 li H 0.352 0.46 H 0.189 No VB Key: BMT = Basemat Melt-Through CF Containment Failure CL Containment Leak 5

VB Vessel Breach Figure 2.4 Example display of mean accident progression bin conditional probabilities.

LEO -

95th.

L.E-1 95th, a) 1 .

1.E 2.2

. -4 a) 10 co 50),

N) j 1.E Ff-4 0

0 C) W 0

o 4-1E-i.E 51 M = mean m = median th = percentile z Internal Initiators------------------- Fire Seismic PDS Group . LOSP ATWS Transients LOCAs Bypass All LLNL 0

Core Damage Freq. 2.8E-05 1.4E-06 I.BE-06 6.1E-06 3.4E-06 4.1E-05 LAE-05 l.9E-04 Figure 2.5 Example display of early containment failure probability distribution.

2. Summary of Methods Measures of this distribution provided include: tems, such as sprays, are accounted for in each location.

- Mean; Briefly, the principal steps in this analysis include:

- Median; 0 Development of ParametricModels of Mate-

- 5th percentile value; and rial Transport: Because of the complexity

- 95th percentile value. and cost of radioactive material transport cal-culations performed with detailed codes, the

• The mean conditional probability of each ac- number of accidents that could be investi-cident progression bin for each plant damage gated with these codes was rather limited.

state. Further, no one detailed code available for the analyses contained models of all physical Figure 2.4 displays example results of the processes considered important to the risk mean conditional probability of each acci- analyses. Therefore, source terms for the va-dent progression bin for each plant damage riety of accidents of interest were calculated state. Results are provided both in tabular using simplified algorithms. The source terms and graphical (bar chart) forms. were described as the product of release frac-tions and transmission factors at successive stages in the accident progression for a vari-2.4 Analysis of Radioactive Material ety of release pathways, a variety of accident Transport progressions, and nine classes of radio-nuclides. The release fraction at each stage 2.4. 1 Methods of the accident and for each pathway is de-termined using various information such as The radioactive material transport analysis tracks predictions of detailed mechanistic codes, the transport of the radioactive materials from the experimental data, etc. For the more impor-fuel to the reactor coolant system, then to the tant release parameters, listed in Table 2.4, containment and other buildings, and finally into probability distributions were developed by a the environment. The fractions of the core inven- panel of experts. The set of codes (one for tory released to the atmosphere, and the timing each plant) used to calculate the source and other release information needed to calculate terms is known collectively as the "XSOR" the offsite consequences, together are termed the codes (Ref. 2.34). The XSOR codes are "source term." The removal and retention of ra- parametric in nature; that is, they are de-dioactive material by natural processes, such as signed to use the results of more detailed deposition on surfaces, and by engineered sys- mechanistic codes or analyses as input.

Table 2.4 Source term issues evaluated by expert panel.

• Source Term Expert Panel In-vessel retention and release of radioactive material (PWRs and BWRs)

Revolatization of radioactive material from the reactor vessel and reactor coolant system (early and late) (PWRs and BWRs)

Radioactive releases during high-pressure melt ejection/direct containment heating (PWRs and BWRs)

Radioactive releases during core-concrete interaction (PWRs and BWRs)

Retention and release from containment of core-concrete interaction radioactive releases (PWRs and BWRs)

Ice condenser decontamination factor (Sequoyah)

Reactor building decontamination factor (Grand Gulf)

Late sources of iodine (Grand Gulf)

NUREG-1 150 2-16

2. Summary of Methods Release terms are divided into two time peri- material transport analysis methods summarized ods, an early release and a delayed release. above were used in the risk analyses supporting The timing of release is particularly important this report.

for the prediction of early health effects.

• Detailed Analysis of Radioactive Material 2.4.2 Products of Radioactive Material Transport Analysis Transport for Selected Accident Progression Bins: Once the basic XSOR algorithm was The product of this part of the risk analysis is the defined, it was necessary to insert parameters estimate of the radioactive release magnitude, analogous to the quantification of the acci- with associated energy content, time, elevation, dent progression event tree in the previous and duration of release, for each of the specified part of the analysis. Since a quantitative un- source term groups developed in the "partition-certainty analysis was one of the objectives of ing" process described above.

this study, data on the more important pa-rameters were constructed in the form of The radioactive release estimates generated in this probability distributions. These distributions part of the risk analysis can be displayed in a vari-were developed based on calculations from ety of ways. In this report, radioactive release the Source Term Code Package (STCP) magnitudes are shown in the following ways:

(Ref. 2.30), CONTAIN (Ref. 2.31), MEL-COR (Ref. 2.32), and other calculational and

• Distribution of release magnitudes for each of experimental data. The source term the nine isotopic groups for selected accident parameters determined by an expert panel progression bins.

are shown in Table 2.4. Distributions for pa- The results of the radioactive material transport rameters that were judged of lesser impor- analysis can vary in form depending on the in-tance were evaluated by experts drawn from tended use. For purposes of this report, exam-the analysis staff or from other groups at na- ple results that display the distribution of tional laboratories. (See Section C.1 of Ap- release magnitudes for selected accident pro-pendix C for a listing of such parameters for gression bins were obtained. In Part II of this re-the Surry plant. Similar listings for the other port, the results for two accident progression plants may be found in Refs. 2.11 through bins are displayed for each plant. For these se-2.14.) In rare instances, single-valued esti- lected accident progression bins, the distribu-mates were used. tion of the radioactive release magnitude (for each of the nine radionuclide groups) is charac-

• Grouping of Radioactive Releases: For these terized by the mean, median, 5th percentile, and risk analyses, radioactive releases were 95th percentile. An example distribution is dis-grouped according to their potential to cause played in Figure 2.6. (Distributions of this type early and latent cancer fatalities and warning are constructed with the assumption that all es-time.

• Through this "partitioning" process, timated source terms are equally likely and thus the large number of radioactive releases cal- do not incorporate the frequencies of the indi-culated with the XSOR codes were collected vidual source terms. Recalculation of these into a small set of source term groups (30 to distributions, including consideration of fre-60 in number). This set of groups was then quencies, does not significantly change the used in the offsite consequence calculations results.)

discussed below.

• Frequency distribution of radioactive releases Additional discussion of the methods used to per- of iodine, cesium, strontium, and lanthanum.

form the radioactive material transport analysis Chapter 10 displays the absolute frequency*

may be found in Section A.4 of Appendix A. of source term release magnitudes.These re-Reference 2.8 provides an extensive discussion of sults are presented in the form of comple-the methods used that is suitable for the reader mentary cumulative distribution functions expert in severe accident and risk analysis. (CCDFs) of the magnitude of iodine, cesium, strontium, and lanthanum releases.

• This Section B.4 of Appendix B provides a detailed ex-ample calculation showing how the radioactive *That is, the combined frequency of all plant damage state frequencies and conditional accident progression

'This grouping of source terms by offsite consequence ef- bin probabilities.

fects is analogous to the grouping of accident sequences *'These four groups are used to represent the spectrum of into plant damage states by their potential effect on acci- possible chemical groups, i.e., from chemically volatile dent progression. to nonvolatile species.

2-17 NUREG-1150

2. Summary of Methods i-Release Fraction 1.OE+OO mean 1.OE-O1 median 1.OE-02 1.OE-03 1.OE-04 1.OE-05 NG I Cs Te Sr Ru La Ba Ce Radionuclide Group Figure 2.6 Example display of radioactive release distributions.

display provides information on the frequency There are five principal steps in the offsite conse-of source term magnitudes exceeding a specific quence analysis. Briefly, these are:

value for each of the plants. Figure 2.7 displays an example CCDF for one chemical group.

• Assessment of Pre-accident Inventories of Radioactive Material: An assessment was made of the pre-accident inventories of each 2.5 Offsite Consequence Analysis radioactive species in the reactor fuel, using information on the thermal power and refuel-2.5.1 Methods ing cycles for the plants studied. For the source term and offsite consequence analysis, The severe accident radioactive releases described the radioactive species were collected into in the preceding section are of concern because of groups of similar chemical behavior. For their potential for impacts on the surrounding these risk analyses, nine groups were used to environment and population. The impacts of such represent 60 radionuclides considered to be releases to the atmosphere can manifest them- of most importance to offsite consequences:

selves in a variety of early and delayed health ef- noble gases, iodine, cesium, tellurium, stron-fects, loss of habitability of areas close to the plant tium, ruthenium, cerium, barium, and lan-site, and economic losses. The fourth part of the thanum.

risk analysis process shown in Figure 2.1 repre-sents the estimation of these offsite consequences,

• Analysis of Transport and Dispersion of given the radioactive releases (source term Radioactive Material: The transport and dis-groups) generated in the previous analysis part. persion of radioactive material to offsite NUREG-1 150 2-18

2. Summary of Methods Frequency of R > R* (yr-i) 1.OE-03 Iodine Group -Surry

--- Zion L.OE-04

- ' ~" -~9Sequoyah 2== =- '< ~~~~~~~~~~~~Peach Bottom

_ ~~~~~

~~~ == + C~~~~~~~rand Gulf

-,(bmash slv~~wf--

=~~rr+.

1.05-06 1.05-07 I.E-08 1.0E 1.0E5-05 l.§E-04 I.OE-03 1.OE-02 LOE-01 1.OE+00 Release Fraction Note: As discussed in Reference 2.29, estimated risks at or below E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 2.7 Example display of source term complementary cumulative distribution function.

areas was modeled in two parts: the initial devel- from the plume onto the ground (or water opment of a plume in the wake of plant build- bodies) beneath the plume was based on a ings, using models described in Reference set of experimentally derived deposition rates 2.35; and the subsequent downwind trans- for dry and wet (rain) conditions.

port, which used a straight-line Gaussian plume model, as described in Reference 2.36. The effect of the initial sensible energy Analysis of the Radiation Doses: Using the content of the plume was included in these dispersion and deposition patterns developed models so that under some conditions plume in the previous step and a set of dose conver-

"liftoff" could occur, elevating the contained sion factors (which relate a concentration of radioactive material into the atmosphere. a radioactive species to a dose to a given body organ) (Refs. 2.37, 2.38, and 2.39),

The dispersion models used in this report calculations were made of the doses received also explicitly accounted for the variability of by the exposed populations via direct (cloud-transport and deposition with weather condi- shine, inhalation, groundshine) and indirect tions. (ingestion, resuspension of radioactive mate-rial from the ground into the air) pathways.

Meteorological data for each specific power Site-specific population data were used in plant site were used. For each of a set of ap- these calculations. The doses were calculated proximately 160 representative weather con- on a body organ-by-organ basis and com-ditions, a dispersion pattern of the plume was bined into health effect estimates in a later calculated. Deposition of radioactive material step.

2-19 NUREG-1150

2. Summary of Methods Analysis of Dose Mitigation by Emergency - In lieu of evacuation or sheltering, only Response Actions: Consideration was given to relocation from the EPZ within 12 to 24 the mitigating effects of emergency response hours after plume passage, using reloca-actions taken immediately after the accident tion criteria described above.

and in the longer term. Effects included were evacuation, sheltering, and relocation of peo- In each of these alternatives, the region out-ple, interdiction of milk and crops, and de- side the 10-mile zone was subject to a com-contamination, temporary interdiction, and/ mon assumption that relocation was per-or condemnation of land and buildings. formed based on comparisons of projected doses with EPA guidelines (as discussed above).

The analysis of offsite consequences for this study included a "base case" and several sets

• Calculation of Health Effects: The offsite of alternative emergency response actions. consequence analysis calculated the following For the base case, it was assumed that 99.5 health effect measures:

percent of the population within the 10-mile emergency planning zone (EPZ) participated - The number of early fatalities and early in an evacuation. This set of people was as- injuries expected to occur within 1 year sumed to move away from the plant site at a of the accident and the latent cancer fa-speed estimated from the plant licensee's talities expected to occur over the life-emergency plan, after an initial delay (to time of the exposed individuals; reach the decision to evacuate and permit - The total population dose received by communication of the need to evacuate) also the people living within specific dis-estimated from the licensee's plan. It was tances (e.g., 50 miles) of the plant; and also assumed that the 0.5 percent of the population that did not participate in the in-itial evacuation was relocated within 12 to 24 - Other specified measures of offsite hours after plume passage, based on the health effect consequences (e.g., the measured concentrations of radioactive ma- number of early fatalities in the popula-terial in the surrounding area and the com- tion living within 1 mile of the reactor parison of projected doses with proposed En- site boundary).

vironmental Protection Agency (EPA) The health effects calculated in this analysis guidelines (Ref. 2.40). Similar relocation as-were based on the models of Reference 2.42.

sumptions were made for the population out-This work in turn used the work of the BEIR side the 10-mile planning zone. Longer-term III report (Ref. 2.43) for its models of latent countermeasures (e.g., crop or land interdic-cancer effects.

tion) were based on EPA and Food and Drug Administration guidelines (Ref. 2.41). The schedule for completing the risk analyses of this report did not permit the performance of Several alternative emergency response as- uncertainty analyses for parameters of the offsite sumptions were also analyzed in this study's consequence analysis, although variability due to offsite consequence and risk analyses. These annual variations in meteorological conditions is included: included. Such an analysis is, however, planned to be performed.

- Evacuation of 100 percent of the popu- Section A.5 of Appendix A provides additional lation within the 10-mile emergency discussion of the methods used for performing the planning zone; offsite consequence analysis. The reader seeking extensive discussion of the methods used is di-

- Indoor sheltering of 100 percent of the rected to Reference 2.8 and to Reference 2.36, population within the EPZ (during which discusses the computer code used to per-plume passage) followed by rapid subse- form the offsite consequence analysis (i.e., the quent relocation after plume passage; MELCOR Accident Consequence Code System (MACCS), Version 1.5).

- Evacuation of 100 percent of the popu-lation in the first 5 miles of the planning 2.5.2 Products of Offsite Consequence zone, and sheltering followed by fast re- Analysis location of the population in the second The product of this part of the risk analysis proc-5 miles of the EPZ; and ess is a set of offsite consequence measures for NUREG-1 150 2-20

2. Summary of Methods each source term group. For this report, the spe-

• Definition of Specific Uncertainties: In order cific consequence measures discussed include for uncertainties in accident phenomena to early fatalities, latent cancer fatalities, total popu- be included in the probabilistic risk analyses lation dose (within 50 miles and entire site re- conducted for this study, they had to be ex-gion), and two measures for comparison with pressed in terms of uncertainties in the pa-NRC's safety goals (average individual early fatal- rameters that were used in the study. Each ity probability within 1 mile and average individual section of the risk analysis was conducted at latent cancer fatality probability within 10 miles of a slightly different level of detail. However, the site boundary) (Ref. 2.44). each analysis part (except for offsite conse-quence analysis, which was not included in For display in this report, the results of the offsite the uncertainty analysis) did not calculate the consequence analyses are combined with the fre- characteristics of the accidents in as much quencies generated in the previous analysis steps detail as would a mechanistic and detailed and shown in the form of complementary cumula- computer code. Thus, the uncertain input tive distribution functions (CCDFs). This display parameters used in this study are "high level" shows the frequency of consequences occurring at or summary parameters. The relationships a level greater than a specified amount. Figure 2.8 between fundamental physical parameters provides a display of such a CCDF. This informa- and the summary parameters of the risk tion is also provided in tabular form in Chapter analysis parts are not always clear; this lack

11. of understanding leads to what is referred to in this study as modeling uncertainties. In ad-2.6 Uncertainty Analysis dition, the values of some important physical or chemical parameters are not known and As stated in the introduction to the chapter, an lead to uncertainties in the summary parame-important characteristic of the probabilistic risk ters. These uncertainties were referred to as analyses conducted in support of this report is that data uncertainties. Both types of uncertain-they have explicitly included an estimation of the ties were included in the study, and no con-uncertainties in the calculations of core damage sistent effort was made to differentiate be-frequency and risk that exist because of incom- tween the effects of the two types of plete understanding of reactor systems and severe uncertainties.

accident phenomena.

Parameters were chosen to be included in the There are four steps in the performance of uncer- uncertainty analysis if the associated uncer-tainty analyses. Briefly, these are: tainties were estimated to be large and impor-tant to risk.

• Scope of Uncertainty Analyses: Important sources of uncertainty exist in all four stages

• Development of Probability Distributions:

of the risk analysis shown in Figure 2.1. In Probability distributions for input parameters this study, the total number of parameters were developed by a number of methods. As that could be varied to produce an estimate stated previously, distributions for many key of the uncertainty in risk was large, and it input parameters were determined by panels was somewhat limited by the computer ca- of experts. The experts used a large variety pacity required to execute the uncertainty of techniques to generate probability distribu-analyses. Therefore, only the most important tions, including reliance on detailed code cal-sources of uncertainty were included. Some culations, extrapolation of existing experi-understanding of which uncertainties would mental and accident data to postulated be most important to risk was obtained from conditions during the accident, and complex previous PRAs, discussion with phenomeno- logic networks. Probability distributions were logists, and limited sensitivity analyses. Sub- obtained from the expert panels using for-jective probability distributions for parame- malized procedures designed to minimize ters for which the uncertainties were bias and maximize accuracy and scrutability estimated to be large and important to risk of the experts' results. These procedures are and for which there were no widely accepted described in more detail in Section 2.7.

data or analyses were generated by expert pan- Probability distributions for some parameters els. Those issues for which expert panels gener- believed to be of less importance to risk were ated probability distributions are listed in Ta- generated by analysts on the project staff or bles 2.2 through 2.4. by phenomenologists from several different 2-21 NUREG-1 150

z tA b1, l5th0 .OE-04 I.OE-04.E-0 -.

O 9th o - ~~~~~~~~~~~~~~Mean --------- Ma aX t.oE-06 - o60th L1E-05 - 60th

• f ac itn --- 5th - . , = 4 +- 5t

- .OE

• 1 t.OE-07 0

D CDCt-oE-08 ; \ \t .oE-087 C C C t.OE-O9 " < U. .OE-O08-xO l.OE-09 1.0OE-09 0

l.OE 00 t.OE.O1 1.OE.O2 1.O-03 l.OE-04 I.OE.05 1.OE.OO .oE+O1 1.OE.02 .OE'O3 1OE*04 .OE-06 1.OE.O8 Early Fatalities Latent Cancer Fatalities t O6- 0 6.OE-0=

> .oE-04 I .OE-04 --------------

Id .OE-04 \.OE-04 t.OE-0 I I1.OE-O -

CT

°a .OE-08 -- \ \OE-O9 aXj\ S\

95th Uo x - enMa I -- ID 0 4, 1.OE-08 CD0t1.OE-08 - 61th 0 ~~~~~~~~~~~~~~~~~~~~~~~~~0 O E-0 6th a) - -.- 5th 6

l.OE - l_ -- t.OE-lO --- ___--1h

.OEOO t.OE-02 1.OE-04 .OE.O8 I.OE08 OE0o0 1WE.02 .OE.04 I.OE-O6 l.OE-Q8 Population Dose (person-rem) to -50 Miles Population Dose (person-rem) to -Entire Region Note: As discussed in Reference 2.29, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 2.8 Example display of offsite consequences complementary cumulative distribution function.

2. Summary of Methods national laboratories using techniques like

• Selection of Issues: As stated in Section 2.6, those employed with the expert panels. (Sec- the total number of uncertain parameters tion C. 1 of Appendix C provides a listing of that could be included in the core damage parameters to which probability distributions frequency and risk uncertainty analyses was were assigned for the Surry plant. Similar somewhat limited. The parameters consid-listings for the other plants may be found in ered were restricted to those with the largest Refs. 2.11 through 2.14.) uncertainties, expected to be the most impor-tant to risk, and for which widely accepted Probability distributions for many of the most data were not available. In addition, the important accident sequence frequency vari- number of parameters that could be deter-ables were generated using statistical analyses mined by expert panels was further restricted of plant data or data from other published by time and resource limitations. The pa-sources. rameters that were determined by expert

• Combination of Uncertainties: A specialized panels are, in the vernacular of this project, Monte Carlo method, Latin hypercube sam- referred to as "issues." An initial list of issues pling, was used to sample the probability dis- was chosen from the important uncertain pa-tributions defined for the many input pa- rameters by the plant analyst, based on re-rameters. The sample observations were sults from the first draft NUREG-1 150 analy-propagated through the constituent analyses ses (Ref. 2.46). The list was further modified to produce probability distributions for core by the expert panels. Tables 2.2 through 2.4 damage frequency and risk. Monte Carlo list those issues studied by expert panels.

methods produce results that can be analyzed

• Selection of Experts: Seven panels of experts with a variety of techniques, such as regres- were assembled to consider the principal is-sion analysis. Such methods easily treat dis- sues in the accident frequency analyses (two tributions with wide ranges and can incorpo- panels), accident progression and contain-rate correlations between variables. Latin ment loading analyses (three panels), con-hypercube sampling (Ref. 2.20) provides for tainment structural response analyses (one a more efficient sampling technique than panel), and source term analyses (one straightforward Monte Carlo sampling while panel). The experts were selected on the ba-retaining the benefits of Monte Carlo tech- sis of their recognized expertise in the issue niques. It has been shown to be an effective areas, such as demonstrated by their publica-technique when compared to other, more tions in refereed journals. Representatives costly, methods (Ref. 2.45). Since many of from the nuclear industry, the NRC and its the probability distributions used in the risk contractors, and academia were assigned to analyses are subjective distributions, the panels to ensure a balance of "perspectives."

composite probability distributions for core Diversity of perspectives has been viewed by damage frequency and risk must also be con- some (e.g., Refs. 2.47 and 2.48) as allowing sidered subjective. the problem to be considered from more viewpoints and thus leading to better quality Additional discussion of uncertainty analysis answers. The size of the panels ranged from methods is provided in Section A.6 of Appendix 3 to 10 experts.

• A and in detail in Reference 2.8.

• Training in ElicitationMethods: Both the ex-perts and analysis team members received 2.7 Formal Procedures for Elicitation training from specialists in decision analysis.

of Expert Judgment The team members were trained in elicitation methods so that they would be proficient and The risk analysis of severe reactor accidents in- consistent in their elicitations. The experts' herently involves the consideration of parameters training included an introduction to the elici-for which little or no experiential data exist. Ex- tation and analysis methods, to the psycho-pert judgment was needed to supplement and in- logical aspects of probability estimation (e.g.,

terpret the available data on these issues. The the tendency to be overly confident in the elicitation of experts on key issues was performed estimation of probabilities), and to probabil-using a formal set of procedures, discussed in ity estimation. The purpose of this training greater detail in Reference 2.8. The principal was to better enable the experts to transform steps of this process are shown in Figure 2.9. their knowledge and judgments into the form Briefly, these steps are: of probability distributions and to avoid 2-23 NUREG-1 150

2. Summary of Methods Proesentation Selection Elicitation of Technical of Experts Training Evidence "II Selection of Issues Preparation of ssues

[ Presentation of Issues Experi Prepartlion Discussion Elicitation of Analyses of Analyses of Experts Compoeltion Aggregation and Documentation

=~~~~~~ Review b Exports Figure 2.9 Principal steps in expert elicitation process.

NUREG-1 150 2-24

2. Summary of Methods particular psychological biases such as over- sues, to search for additional sources of in-confidence. Additionally, the experts were formation on the issues, and to conduct given practice in assigning probabilities to calculations. During this period, several pan-sample questions with known answers (alma- els met to exchange information and ideas nac questions). Studies such as those dis- concerning the issues. During some of these cussed in Reference 2.49 have shown that meetings, expert panels were briefed by the feedback on outcomes can reduce some of project staff on the results from other expert the biases affecting judgmental accuracy. panels in order to provide the most current data.

• Presentationand Review of Issues: Presenta-tions were made to each panel on the set of Expert Review and Discussion: After the ex-issues to be considered, the definition of pert panels had prepared their analyses, a fi-each issue, and relevant data on each issue. nal meeting was held in which each expert Other parameters considered by the analysis discussed the methods he/she used to analyze staff to be of somewhat lesser importance the issue. These discussions frequently led to were also described to the experts. The pur- modifications of the preliminary judgments of poses of these presentations were to permit individual experts. However, the experts' ac-the panel to add or drop issues depending on tual judgments were not discussed in the their judgments as to their importance; to meeting because group dynamics can cause provide a specific definition of each issue people to unconsciously alter their judgments chosen and the sets of associated boundary in the desire to conform (Ref. 2.51).

conditions imposed by other issue definitions; and to obtain information from additional

• Elicitation of Experts: Following the panel data sources known to the experts. discussions, each expert's judgments were elicited. These elicitations were performed In addition, written descriptions of the issues privately, typically with an individual expert, were provided to the experts by the analysis an analysis staff member trained in elicitation staff. The descriptions provided the same in- techniques, and an analysis staff member fa-formation as provided in the presentations, in miliar with the technical subject. With few addition to reference lists of relevant techni- exceptions, the elicitations were done with cal material, relevant plant data, detailed de- one expert at a time so that they could be scriptions of the types of accidents of most performed in depth and so that an expert's importance, and the context of the issue judgments would not be adversely influenced within the total analysis. The written descrip- by other experts. Initial documentation of the tions also included suggestions of how the is- expert's judgments and supporting reasoning sues could be decomposed into their parts us- were obtained in these sessions.

ing logic trees. The issues were to be decomposed because the decomposition of

• Composition and Aggregation of Judgments:

problems has been shown to ease the cogni- Following the elicitation, the analysis staff tive burden of considering complex problems composed probability distributions for each and to improve the accuracy of judgments expert's judgments. The individual judgments (Ref. 2.50). were then aggregated to provide a single composite judgment for each issue. Each ex-For the initial meeting, researchers, plant pert was weighted equally in the aggregation representatives, and interested parties were because this simple method has been found invited to present their perspectives on the in many studies (e.g., Ref. 2.52) to perform issues to the experts. Frequently, these pres- the best.

entations took several days.

• Review by Experts: Each expert's probability

• Preparationof Expert Analyses: After the in- distribution and associated documentation itial meeting at which the issues were pre- developed by the analysis staff was reviewed sented, the experts were given time to pre- by that expert. This review ensured that po-pare their analyses of the issues. This time tential misunderstandings were identified and ranged from 1 to 4 months. The experts were corrected and that the issue documentation encouraged to use this time to investigate al- properly reflected the judgments of the ex-ternative methods for decomposing the is- pert.

2-25 NUREG- 1150

2. Summary of Methods 2.8 Risk Integration probability distribution are identified in Fig-ure 2.2 (and throughout this report):

2.8.1 Methods

- Mean; The fifth part of the risk analysis process shown in Figure 2.1 ("Risk Integration") is the integration - Median; of the other analysis products into the overall esti-mate of plant risk. Risk for a given consequence - 5th percentile value; and measure is the sum over all postulated accidents of the product of the frequency and consequence - 95th percentile value.

of the accident. This part of the analysis consisted of both the combination of the results of the con- A second display of risk results is used in stituent analyses and the subsequent assessment of Part III of this report, where results for all the relative contributions of different types of ac- five plants are displayed together. This rec-cidents (as defined by the plant damage states, tangular display (shown on the left side of accident progression bins, or source term groups) Fig. 2.2) provides a summary of these four to the total risk. specific measures in a simple graphical form.

Appendix A provides a more detailed description

• Contributions of plant damage states and ac-of the risk integration process. In order to assist cident progression bins to mean risk.

the reader seeking a detailed understanding of this process, an example calculation is provided in Ap- The risk results generated in this report can pendix B. This example makes use of actual re- be decomposed to determine the fractional sults for the Surry plant. contribution of individual plant damage states and accident progression bins to the mean 2.8.2 Products of Risk Integration risk. An example display of the fractional contribution of plant damage states to mean The risk analyses performed in this study can be early and latent cancer fatality risk is pro-displayed in a variety of ways. The specific prod- vided in Figure 2.10. The estimated values of ucts shown in this summary report are described these relative contributions are somewhat below, with similar products provided for early fa- sensitive to the Monte Carlo sampling vari-tality risk, latent cancer fatality risk, population ation, particularly those contributions that dose risk within 50 miles and within the entire are small. References 2.10 through 2.14 dis-area surrounding the site, and for two measures cuss this sensitivity to sampling variation in related to NRC's safety goals (Ref. 2.44). more detail. These references also include discussion of an alternative method for calcu-

• The total risks from internal and fire events.

• lating the relative contributions to mean risk that provides somewhat different results.

Reflecting the uncertain nature of risk re-sults, such results can be displayed using a

• Contributions to risk uncertainty.

probability density function. For Part II of this report (plant-specific results), a histo- Regression analyses were performed to assess gram is used. This histogram for risk results is the relative contributions of the uncertainty like that shown on the right side of Figure 2.2 in individual parameters (or groups of pa-for the results of the accident frequency rameters) to the uncertainty in risk. Results analysis. In addition, four measures of the of these analyses are discussed in Part III of

'For reasons described in Chapter 1, seismic risk is not this report and in more detail in References displayed or discussed in this report. 2.10 through 2.14.

NUREG-1 150 2-26

2. Summary of Methods SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY MEAN

• 2E-SJRY MEAN

• 6.2E-3S/RY N .  %

5 NZ Plant Damage States

1. 8BO

2. ATWS S. TRANSIENTS

4. LOCA

e. BYPASS SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY MEAN

• 2E-81RY MEAN 6.2E-31RY 2

1 ii1 5 \ 5 Accident Progression ins

1. VS. Early CF. Alpha Mode

2. VS. Early CF, RC8 Pressure 200 pala at VS

3. V, Early CF. RCS Pressure 200 pla at VD

4. VS BSMT and Late Leak

e. bypass S. VD. No CF

7. No VD Figure 2.10 Example display of relative contributions to mean risk.

2-27 NUREG-1 150

2. Summary of Methods REFERENCES FOR CHAPTER 2 2.1 D. M. Ericson, Jr., (Ed.) et al., "Analysis put Parameters," Sandia National Labora-of Core Damage Frequency: Internal tories, NUREG/CR-4551, Vol. 2, Revision Events Methodology," Sandia National 1, SAND86-1309, December 1990.

Laboratories, NUREG/CR-4550, Vol. 1, Revision 1, SAND86-2084, January 1990. 2.10 R. J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia Na-2.2 T. A. Wheeler et al., "Analysis of Core tional Laboratories, NUREG/CR-4551, Damage Frequency from Internal Events: Vol. 3, Revision 1, SAND86-1309, Octo-Expert Judgment Elicitation," Sandia Na- ber 1990.

tional Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April 1989. 2,11 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit 2.3 R. C. Bertucio and J. A. Julius, "Analysis 2," Sandia National Laboratories, NUREG/

of Core Damage Frequency: Surry Unit 1," CR-4551, Vol. 4, Draft Revision 1, Sandia National Laboratories, NUREG/ SAND86-1309, to be published.*

CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990. 2.12 J. J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia 2.4 A. M. Kolaczkowski et al., "Analysis of National Laboratories, NUREG/CR-4551, Core Damage Frequency: Peach Bottom Vol. 5, Revision 1, SAND86-1309, De-Unit 2," Sandia National Laboratories, cember 1990.

NUREG/CR-4550, Vol. 4, Revision 1, SAND86-2084, August 1989. 2.13 T. D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," San-2.5 R. C. Bertucio and S. R. Brown, "Analysis dia National Laboratories, NUREG/

of Core Damage Frequency: Sequoyah Unit CR-4551, Vol. 6, Draft Revision 1, 1," Sandia National Laboratories, NUREG/ SAND86-1309, to be published.*

CR-4550, Vol. 5, Revision 1, SAND86-2084, April 1990. 2,14 C. K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven 2.6 M. T. Drouin et al., "Analysis of Core National Laboratory, NUREG/CR-4551, Damage Frequency: Grand Gulf Unit 1," Vol. 7, Draft Revision 1, BNL-NUREG-Sandia National Laboratories, NUREG/ 52029, to be published.*

CR-4550, Vol. 6, Revision 1, SAND86-2084, September 1989. 2.15 J. W. Hickman, "PRA Procedures Guide.

A Guide to the Performance of Probabilis-2.7 M. B. Sattison and K. W. Hall, "Analysis tic Risk Assessments for Nuclear Power of Core Damage Frequency: Zion Unit 1," Plants," American Nuclear Society and In-Idaho National Engineering Laboratory, stitute of Electrical and Electronic Engi-NUREG/CR-4550, Vol. 7, Revision 1, neers, NUREG/CR-2300 (2 of 2), January EGG-2554, May 1990. 1983.

2.8 E. D. Gorham-Bergeron et al., "Evaluation 2.16 USNRC, "Probabilistic Risk Assessment of Severe Accident Risks: Methodology for Reference Document," NUREG-1050, the Accident Progression, Source Term, September 1984.

Consequence, Risk Integration, and Uncer-tainty Analyses," Sandia National Labora-2.17 A. Mosleh et al., "Procedures for Treating tories, NUREG/CR-4551, Vol. 1, Draft Re-Common Cause Failures in Safety and Reli-vision 1, SAND86-1309, to be published.*

ability Studies. Procedural Framework and Examples," NUREG/CR-4780, Vol. 1, 2.9 F. T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major In- EPRI NP-5613, January 1988.

2.18 A. D. Swain III, "Accident Sequence

'Available in the NRC Public Document Room, 2120 L Evaluation Program-Human Reliability Street NW., Washington, DC. Analysis Procedure," Sandia National NUREG-1150 2-28

2. Summary of Methods Laboratories, NUREG/CR-4772, SAND 2.28 M. P. Bohn et al., "Application of the 86-1996, February 1987. SSMRP Methodology to the Seismic Risk at the Zion Nuclear Power Plant," Lawrence 2.19 W. J. Luckas, Jr., "A Human Reliability Livermore National Laboratory, NUREG/

Analysis for the ATWS Accident Sequence CR-3428, UCRL-53483, January 1984.

with MSIV Closure at the Peach Bottom Atomic Power Station," Brookhaven Na- 2.29 H. J. C. Kouts et al., "Special Committee tional Laboratory, May 1986. Review of the Nuclear Regulatory Commis-sion's Severe Accident Risks Report (NUREG-1150)," NUREG-1420, August 2.20 M. D. McKay, Jr., "A Comparison of 1990.

Three Methods for Selecting Values in In-put Variables in the Analysis of Output 2.30 J. A. Gieseke et al., "Source Term Code from a Computer Code," Technometrics Package: A User's Guide," Battelle Colum-21(2), 1979. bus Division, NUREG/CR-4587, BMI-2138, July 1986.

2.21 Commonwealth Edison Company of Chi-cago, "Zion Probabilistic Safety Study," 2.31 K. D. Bergeron et al., "User's Manual for September 1981. CONTAIN 1.0, A Computer Code for Severe Reactor Accident Containment 2.22 D. L. Berry et al., "Review and Evaluation Analysis," Sandia National Laboratories, of the Zion Probabilistic Safety Study: Plant NUREG/CR-4085, SAND84-1204, July Analysis, " Sandia National Laboratories, 1985.

NUREG/CR-3300, Vol. 1, SAND83-1118, 2.32 R. M. Summers et al., "MELCOR In-Ves-May 1984. sel Modeling," Proceedings of the Fifteenth Water Reactor Safety Information Meeting 2.23 M. P. Bohn and J. A. Lambright, "Pro- (Gaithersburg, MD), NUREG/CP-0091, cedures for the External Event Core February 1988.

Damage Frequency Analyses for NUREG-1150," Sandia National Laboratories, 2.33 S. S. Dosanjh, "MELPROG-PWR/MOD1:

NUREG/CR-4840, SAND88-3102, No- A Two-Dimensional, Mechanistic Code for vember 1990. Analysis of Reactor Core Melt Progression and Vessel Attack Under Severe Accident 2.24 D. L. Bernreuter et al., "Seismic Hazard Conditions," Sandia National Laboratories, Characterization of 69 Nuclear Power Sites NUREG/CR-5193, SAND88-1824, May East of the Rocky Mountains," Lawrence 1989.

Livermore National Laboratory, NUREG/

CR-5250, Vols. 1-8, UCID-21517, Janu- 2.34 H. N. Jow et al., "XSOR Codes User's ary 1989. Manual," Sandia National Laboratories, NUREG/CR-5360, SAND89-0943, to be 2.25 Seismicity Owners Group and Electric published.

• Power Research Institute, "Seismic Hazard 2.35 G. A. Briggs, "Plume Rise Prediction,"

Methodology for the Central and Eastern Proceedings of Workshop: Lectures on Air United States," EPRI NP-4726, July 1986. Pollution and Environmental Analysis, American Meteorological Society, 1975.

2.26 J. E. Richardson, USNRC, letter to R. A.

Thomas, Seismicity Owners Group, "Safety 2.36 D. I. Chanin, H. Jow, J. A. Rollstin et al.,

Evaluation Review of the SOG/EPRI Topi- "MELCOR Accident Consequence Code cal Report Titled 'Seismic Hazard Method- System (MACCS)," Sandia National Labo-ology for the Central and Eastern United ratories, NUREG/CR-4691, Vols. 1-3, States,"' dated September 20, 1988. SAND86-1562, February 1990.

2.27 G. E. Cummings, "Summary Report on the 2.37 D. C. Kocher, "Dose Rate Conversion Seismic Safety Margins Research Pro- Factors for External Exposure to Photons gram," Lawrence Livermore National Laboratory, NUREG/CR-4431, UCID- *Available in the NRC Public Document Room, 2120 L 20549, January 1986. Street NW., Washington, DC.

2-29 NUREG-1150

2. Summary of Methods and Electrons," Oak Ridge National 2.45 R. L. Iman and J. C. Helton, "A Compari-Laboratory, NUREG/CR-1918, ORNL/ son of Uncertainty and Sensitivity Analysis NUREG-79, August 1981. Techniques for Computer Models," Sandia National Laboratories, NUREG/CR-3904, 2.38 International Commission on Radiological SAND84-1461, May 1985.

Protection, "Recommendations of ICRP,"

Publication 26, Annals of ICRP, Vol. 1, 2.46 USNRC, "Reactor Risk Reference Docu-No. 3, 1977. ment," NUREG-1150, Vols. 1-3, Draft for Comment, February 1987.

2.39 International Commission on Radiological Protection, "Limits for Intakes of Radio- 2.47 P. A. Seaver, "Assessments of Group Pref-nuclides by Workers," Publication 30, An- erences and Group Uncertainty for Deci-nals of ICRP, Vol. 2, Nos. 3 and 4, 1978. sion Making," University of Southern Cali-fornia, Social Sciences Research Institute, 2.40 U. S. Environmental Protection Agency, 1976.

"Manual of Protective Action Guides and Protective Actions for Nuclear Incidents," 2.48 J. M. Booker and M. A. Meyer, "Sources Office of Radiation Programs, Draft, 1989. and Effects of Interexpert Correlation: An Empirical Study," IEEE Transactions on 2.41 U.S. Department of Health and Human Systems, Man, and Cybernetics, Vol. 18, Services/Food and Drug Administration, No. 1, pp. 135-142, 1988.

"Accidental Radioactive Contamination of Human Food and Animal Feeds; Recom- 2.49 S. Lictenstein et al., "Calibration of Prob-mendations for State and Local Agencies," abilities: The State of the Art to 1980," in Federal Register, Vol. 47, No. 205, pp. Judgment Under Uncertainty: Heuristics 47073-47083, October 22, 1982. and Biases, Cambridge University Press, 1982.

2.42 J. S. Evans et al., "Health Effects Model for Nuclear Power Plant Accident Conse- 2.50 J. S. Armstrong et al., "Use of the Decom-quence Analysis," Harvard University, position Principle in Making Judgments,"

NUREG/CR-4214, SAND85-7185, August Organizational Behavior and Human Per-1985. formance, 14: 257-263, 1975.

2.43 U.S. National Research Council, National 2.51 I. C. Janis, Victims of Group Think: A Psy-Academy of Sciences, Committee on the chological Study of Foreign Policy Deci-Biological Effects of Ionizing Radiation, sions and Fiascoes, Houghton Mifflin, Bos-

"The Effects on Populations of Exposure to ton, MA.

Low Levels of Ionizing Radiation: 1980,"

National Academy Press, 1980. 2.52 H. F. Martz et al., "Eliciting and Aggregat-ing Subjective Judgments-Some Experi-2.44 USNRC, "Safety Goals for the Operation of mental Results," Proceedings of the 1984 Nuclear Power Plants; Policy Statement," Statistical Symposium on National Energy Federal Register, Vol. 51, p. 30028, Issues (Seattle, WA), NUREG/CP-0063, August 21, 1986. July 1985.

NUREG-1150 2-30

PART I Summary of Plant Results

3. SURRY PLANT RESULTS 3.1 Summary Design Information quences described in that report have been grouped into five summary plant damage states.

The Surry Power Station is a two-unit site. Each These are:

unit, designed by the Westinghouse Corporation, is a three-loop pressurized water reactor (PWR)

• Station blackout, rated at 2441 MWt (788 MWe) and is housed in

• Large and small loss-of-coolant accidents a subatmospheric containment designed by Stone (LOCAs),

and Webster Engineering Corporation. The bal-ance of plant systems were engineered and built

• Anticipated transients without scram by Stone and Webster Engineering Corporation. (ATWS),

Located on the James River near Williamsburg,

• All other transients except station blackout Virginia, Surry 1 started commercial operation in and ATWS, and 1972. Some important system design features of the Surry plant are described in Table 3.1. A gen-

• Interfacing-system LOCA and steam genera-eral plant schematic is provided in Figure 3.1. tor tube rupture.

The relative contributions of these groups to the This chapter provides a summary of the results mean internal-event core damage frequency at obtained in the detailed risk analyses underlying Surry are shown in Figure 3.3. From Figure 3.3, it this report (Refs. 3.1 and 3.2). A discussion of is seen that station blackout sequences are the perspectives with respect to these results is pro- largest contributors to mean core damage fre-vided in Chapters 8 through 12. quency. It should be noted that the plant configu-ration was modeled as of March 1988 and thus 3.2 Core Damage Frequency Estimates does not reflect implementation of the station blackout rule.

3.2.1 Summary of Core Damage Frequency Estimates Within the general class of station blackout acci-dents, the more probable combinations of failures The core damage frequency and risk analyses per- leading to core damage are:

formed for this study considered accidents initi-ated by both internal and external events (Ref.

• Loss of onsite and offsite ac power and fail-3.1). The core damage frequency results obtained ure of the auxiliary feedwater (AFW) system.

from internal events are provided in graphical All core heat removal is unavailable after form, displayed as a histogram, in Figure 3.2 failure of AFW. Station blackout results in (Section 2.2.2 discusses histogram development). the unavailability of the high-pressure injec-The core damage frequency results obtained from tion system, the containment spray system, both internal and external events are provided in and the inside and outside containment spray tabular form in Table 3.2. recirculation systems. For station blackout at Unit 1 alone, it was assessed that one high-The Surry plant was previously analyzed in the pressure injection (HPI) pump at Unit 2 Reactor Safety Study (RSS) (Ref. 3.3). The RSS would not be sufficient to provide feed and calculated a point estimate core damage fre- bleed cooling through the crossconnect while quency from internal events of 4.6E-5 per year. at the same time provide charging flow to The present study calculated a total median core Unit 2. Core damage was estimated to begin damage frequency from internal events of 2.3E-5 in approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> if AFW and HPI per year. For a detailed discussion of, and insights flow had not been restored by that time.

into, the comparison between this study and the RSS, see Chapter 8.

• Loss of onsite and offsite ac power results in the unavailability of the high-pressure injec-3.2.1.1 Internally Initiated Accident tion system, the containment spray system, Sequences the inside and outside containment spray recirculation systems, and the motor-driven A detailed description of accident sequences im- auxiliary feedwater pumps. While the loss of portant at the Surry plant is provided in Reference all ac power does not affect instrumentation 3.1. For this summary report, the accident se- at the start of the station blackout, a long 3-1 NUREG-1 150

3. Surry Plant Results Table 3.1 Summary of design features: Surry Unit 1.

1. Coolant Injection Systems a. High-pressure safety injection and recirculation system with 2 trains and 3 pumps.

b. Low-pressure injection and recirculation system with 2 trains and 2 pumps.

c. Charging system provides normal makeup flow with safety injection crosstie to Unit 2.

2. Steam Generator Heat Removal a. Power conversion system.

Systems

b. Auxiliary feedwater system (AFWS) with 3 trains and 3 pumps (2 MDPs, 1 TDP)

• and crosstie to Unit 2 AFWS.

3. Reactivity Control Systems a. Control rods.

b. Chemical and volume control systems.

4. Key Support Systems a. dc power provided by 2-hour design basis station batteries.

b. Emergency ac power provided by 1 dedicated and 1 swing diesel generator (both self-cooled).

c. Component cooling water provides cooling to RCP thermal barriers.

d. Service water is gravity-fed system that provides heat re-moval from containment following an accident.

5. Containment Structure a. Subatmospheric (10 psia).

b. 1.8 million cubic feet.

c. 45 psig design pressure.

d. Reinforced concrete.

6. Containment Systems a. Spray injection initiated at 25 psia with 2 trains and 2 pumps.

b. Inside spray recirculation initiated (with 2-minute time de-lay) at 25 psia with 2 trains and 2 pumps (both pumps inside containment).

c. Outside spray recirculation initiated (with 5-minute time delay) at 25 psia with 2 trains and 2 pumps (both pumps outside containment).

d. Inside and outside spray recirculation systems are the only sources of containment heat removal after a LOCA.

• MDP - Motor-Driven Pump.

TDP - Turbine-Driven Pump.

NUREG- 15 0 3-2

AF AFl to Typical of each Cold Leg Loop C z

0 Figure 3.1 Surry plant schematic.

En C>

3. Surry Plant Results Core Damage Frequency (per RY) 1.OE-03 96th -

1.OE-04 Mean -

Median - I 1.OE-05 5th -

6th 1..OE-06 Number of LHS samples Figure 3.2 Internal core damage frequency results at Surry.*

Table 3.2 Summary of core damage frequency results: Surry.*

5% Median Mean 95%

Internal Events 6.8E-6 2.3E-5 4.OE-5 1.3E-4 Station Blackout Short Term 1.1E-7 1.7E-6 5.4E-6 2.3E-5 Long Term 6. 1E-7 8.2E-6 2.2E-5 9.5E-5 ATWS 3.2E-8 4.2E-7 1. 6E-6 5.9E-6 Transient 7.2E-8 6.9E-7 2.OE-6 6.OE-6 LOCA 1.2E-6 3.8E-6 6.OE-6 1.6E-5 Interfacing LOCA 3.8E-1 1 4.9E-8 1. 6E-6 5.3E-6 SGTR 1.2E-7 7.4E-7 1.8E-6 6.OE-6 External Events**

Seismic (LLNL) 3.9E-7 1.5E-5 1.2E-4 4.4E-4 Seismic (EPRI) 3. OE-7 6.1E-6 2.5E-5 1.OE-4 Fire 5.4E-7 8.3E-6 1.E-5 3.8E-5

• As discussed in Reference 3.4, core damage frequencies below lB-S per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

`"See "Externally Initiated Accident Sequences" in Section 3.2.1.2 for discussion.

NUREG-1150 3-4

3. Surry Plant Results Station Blackout LOCA XrI-Aws Bypass nt. Sys. LOCAISGTR) Transient&

Total Mean Core Damage Frequency: 4.OE-6 Figure 3.3 Contributors to mean core damage frequency from internal events at Surry.

duration station blackout leads to battery de- Within the general class of LOCAs, the more pletion and subsequent loss of vital instru- probable combinations of failures are:

mentation. Battery depletion was concluded to occur after approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The

• LOCA with an equivalent diameter of greater ability to subsequently provide decay heat re- than 6 inches in the reactor coolant system moval with the turbine-driven AFW pump is (RCS) piping with failure of the low-pressure lost because of the loss of all instrumentation injection or recirculation system. Recovery of and control power. Using information from equipment is unlikely for the system failures Reference 3.5, approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> be- assessed to be most likely and, because the yond the time of battery depletion was al- break size is sufficiently large, the time to lowed for restoration of ac power before core core uncovery is approximately 5 to 10 min-uncovery would occur. utes, leaving virtually no time for recovery actions. All containment heat removal sys-tems are available. The dominant contribu-tors to failure of the low-pressure recirc-Loss of onsite and offsite ac power, followed ulation function are the common-cause by a reactor coolant pump seal LOCA due to failure of the refueling water storage tank loss of all seal cooling. Station blackout also (RWST) isolation valves to close, common-results in the unavailability of the HPI cause failure of the pump suction valves to system, as well as the auxiliary feedwater open, common-cause failure of the discharge motor-driven pumps, the containment spray isolation valves to the hot legs to open, or system, and the inside and outside spray miscalibration of the RWST level sensors.

recirculation systems. Continued coolant loss through the failed seals, with unavailability of

• Intermediate-size LOCAs with an equivalent the HPI system, leads to core uncovery. diameter of between 2 and 6 inches in the 3-5 NUREG-1 150

3. Surry Plant Results RCS piping with failure of the low-pressure coolant system in a timely manner (in about injection or recirculation core cooling system. 45 minutes), there is a high probability that All containment heat removal systems are water will be forced through the safety relief available, but the continued heatup and valves (SRVs) on the steam line from the af-boiloff of primary coolant leads to core un- fected SG. The probability that the SRVs will covery in 20 to 50 minutes. The dominant fail to reclose under these conditions is also contributors to low-pressure injection failure estimated to be very high (near 1.0). Failure are common-cause failure of the low-pressure to close (gag the SRVs) by a local, manual injection (LPI) pumps to start or plugging of action results in a non-isolable path from the the normally open LPI injection valves. RCS to the environment. After the entire contents of the refueling water storage tank

• Small-size LOCAs with an equivalent diame- are pumped through the broken SG tube, the core uncovers. The onset of core degradation ter of between 1/2 and 2 inches in the RCS is thus not expected until about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> af-piping with failure of the HPI system. All ter the start of the accident.

containment heat removal systems are avail-able, but the continued heatup and boiloff of primary coolant leads to core uncovery in 1 3.2.1.2 Externally Initiated Accident to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The dominant contributors to Sequences HPI system failures are hardware failures of the check valves in the common suction and A detailed description of accident sequences initi-discharge line of all three charging pumps or ated by external events important at the Surry common-cause failure of the motor-operated plant is provided in Part 3 of Reference 3.1. The valves in the HPI discharge line. accident sequences described in that reference have been divided into two main types for this study. These are:

Within the general class of containment bypass ac-cidents, the more probable combinations of fail-

• Seismic, and ures are:

• Fire.

• An interfacing-system LOCA resulting from a A scoping study has also been performed to assess failure of any one of the three pairs of check the potential effects of other externally initiated valves in series that are used to isolate the accidents (Ref. 3.1, Part 3). This analysis indi-high-pressure RCS from the LPI system. The cated that the following external-event sources failure modes of interest for Event V are rup- could be excluded based on the low frequency of ture of valve internals on both valves or fail- the initiating event:

ure of one valve to close upon repressuriza-tion (e.g., during a return to power from cold

• Air crashes, shutdown) combined with rupture of the other valve. The resultant flow into the low-

• Hurricanes, pressure system is assumed to result in failure

• Tornados, (rupture) of the low-pressure piping or com-ponents outside the containment boundary.

• Internal flooding, and Although core inventory makeup by the high-

• External flooding.

pressure systems is initially available, inability to switch to recirculation would eventually

1. Seismic Accident Frequency Analysis lead to core damage approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the initial failure. Because of the loca- The relative contribution of classes of seismically tion of the postulated system failure (outside and fire-initiated accidents to the total mean fre-containment), all containment mitigating sys-quency of externally initiated core damage acci-tems are bypassed. dents is provided in Figure 3.4. As may be seen, seismically initiated loss of offsite power plant

• A steam generator tube rupture (SGTR) acci- transients and transients that (through cooling sys-dent initiated by the double-ended guillotine tem failures) lead to reactor coolant pump seal rupture of one steam generator (SG) tube. LOCAs are the most likely causes of externally (Multiple tube ruptures may be possible but caused core damage accidents. For these two ac-were not considered in this analysis.) If the cident initiators, the more probable combinations operators fail to depressurize the reactor of system failures are:

NUREG-1 150 3-6

3. Surry Plant Results TRANSIENTS LOSP (SEISMIC)

LOCA MALL LLOCA RVR STUCK OPEN PORVa (FIRE)

TRANSIENT IND. RCP SEAL LOCA (SEISMIC)

Total Mean Core Damage Frequency: 1.3E-4 Figure 3.4 Contributors to mean core damage frequency from external events (LLNL hazard curve) at Surry.

• Transient-initiated accident sequences result- heat exchanger supports result in loss of the ing from loss of offsite power in conjunction CCW system.

with failures of the auxiliary feedwater system and failure of the feed and bleed mode of As discussed in Chapter 2, the seismic analysis in core cooling. These result from either seismi- this report made use of two sets of hazard curves cally induced diesel generator failures (caus- from Lawrence Livermore National Laboratory ing station blackout and eventual battery de- (LLNL) (Ref. 3.6) and the Electric Power Re-pletion) or from seismically induced failure search Institute (EPRI) (Ref. 3.7). The above ac-of the condensate storage tank in conjunc- cident sequences are dominant for both sets of tion with power-operated relief valve (PORV) hazard curves. In addition, the differences be-failures. tween the seismic risk estimates shown in Ta-ble 3.2 for the LLNL and the EPRI cases are due entirely to the differences between the two sets of hazard curves. That is, the system models, failure

• Loss of offsite power (LOSP) due to seismi- rates, and success logic were identical for both es-cally induced failure of ceramic insulators in timates.

the switchyard, with simultaneous (seismic) failure of both high-pressure injection (HPI) The seismic hazard associated with the curves and component cooling water (CCW) sys- developed by EPRI was significantly less than that tems (the redundant sources of seal cooling). of the LLNL curves. Differences between these Failures of HPI result from seismic failures of curves result primarily from differences between the refueling water storage tank or emer- the methodology and assumptions used to de-gency diesel generator load panels, while velop the hazard curves. In the LLNL program, seismic failures of the diesels or the CCW considerable emphasis was placed on a wide rnge 3-7 NUREG-1 150

3. Surry Plant Results of uncertainty in the ground-motion attenu- 3.2.2 Important Plant Characteristics (Core ation models, while a relatively coarse set of seis- Damage Frequency) mic tectonic provinces was used in characterizing Characteristics of the Surry plant design and op-each site. By contrast, in the EPRI program eration that have been found to be important in considerable emphasis was placed on a fine zona- the analysis of core damage frequency include:

tion for the tectonic provinces, and very little un-certainty in the ground-motion attenuation was 1. Crossties Between Units considered. In any case, it is the difference be-tween the two sets of hazard curves that causes The Surry plant has numerous crossties be-the differences between the numeric estimates in tween similar systems at Units 1 and 2. Some Table 3.2. of these were installed in order to comply with requirements of 10 CFR Part 50, Ap-pendix R (fire protection) (Ref. 3.8) or high-

2. Fire Accident Frequency Analysis energy line-break threats, and some were in-stalled for operational reasons. Crossties exist The fire-initiated accident frequency analyses per- for the auxiliary feedwater system, the charg-formed for this report considered the impact of ing pump system, the charging pump cooling fires beginning in a variety of separate locations system, and the refueling water storage tanks.

within the plant. Those locations found to be most These crossties are subject to technical speci-important were: fications, their potential use is included in the plant operating procedures, and they are re-viewed in operator training. The availability

• Emergency switchgear room, of such crossties was estimated to reduce the

• Control room, internal-event core damage frequency by ap-proximately a factor of 3.

• Auxiliary building, and

• Cable vault and tunnel. 2. Diesel Generators Surry is a two-unit site with three emergency In the emergency switchgear room, a fire is as- diesel generators (DGs), one of which is a sumed to fail either control or power cables for swing diesel (which can be aligned to one both HPI and CCW, leading directly to a reactor unit or the other), while many other PWR coolant pump seal LOCA. No additional random plants have dedicated diesels for each safety-failures were required for this sequence to lead to grade power train (i.e., four DGs for a two-core damage. (Credit was given for operator re- unit site). Each DG is self-cooled and sup-covery by crossconnecting the Unit 2 HPI sys- plied with a dedicated battery (independent tem.) The identical scenario arises as the result of of the batteries providing power to the vital fires postulated in the auxiliary building and the dc buses) for starting. The latter two factors cable vault and tunnel. Thus, fires in these three eliminate potential common-cause failure areas both cause the initiating event (a seal modes found important at other plants in this LOCA) and fail the system required to mitigate study (e.g., Peach Bottom and Grand Gulf).

the scenario (i.e., HPI). The Surry site also has a gas turbine genera-tor. However, administrative procedures and In the control room, a fire in a bench board was design characteristics of support equipment determined to lead to spurious actuation of a (e.g., dc batteries and compressed air) pre-PORV with smoke-induced abandonment of the clude its use during a station blackout acci-control room. A low probability of successful op- dent.

erator recovery actions from the remote shutdown panel (RSP) was assessed since the PORV closure 3. Reactor Coolant Pump Seals status is not displayed at the RSP. In addition, the At Surry, there are two diverse and inde-PORV block valve controls in the RSP are not pendent methods for providing reactor cool-routed independently of the control room bench ant pump seal cooling: the component cool-board and thus may not function.

ing water system and the charging system (which has its own dedicated cooling sys-The frequency of fire-initiated accident scenarios tem). The only common support systems for in other locations contributed less than 10 percent seal cooling are ac and dc power. As such, to the total fire-initiated core damage frequency. reactor coolant pump seal LOCAs have been NUREG-1 150 3-8

3. Surry Plant Results found important only in station blackout se- During loss of offsite power and station blackout, quences. This is in contrast to some other important actions required to be taken by the op-PWR plants that have a dependency between erating crew to prevent core damage include:

charging pumps and the component cooling water system and thus greater potential for Align alternative source of condensate to loss of seal cooling. Without cooling, the condensate storage tank seals were expected to degrade or fail. The probability of seal failure upon loss of seal The primary source of condensate for the cooling was studied in detail by the expert AFW system is a 100,000-gallon tank. This is panel elicitation (Ref. 3.9). Reflecting this, nominally sufficient for the duration of most the Surry analyses have found that station station blackout events. But in the event that blackout accident sequences with significant a steam generator becomes faulted, the in-seal leakage are important contributors to the creased AFW flow would require the provi-total frequency of core damage. sion of additional condensate water. This would involve manual local actions.

4. Battery Capacity

• Isolate condenser water box For the Surry plant, the station Class E bat- Surry has a somewhat unique gravity-fed tery depletion time following station blackout service water system that relies on the head has been estimated to be 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (Ref. 3.5). difference between the intake canal and the The inability to ensure availability for longer discharge canal to provide flow through serv-times contributes significantly to the fre- ice water heat exchangers. The intake canal quency of core damage resulting from station is normally supplied with water by the circu-blackout accident sequences. The batteries lating water pumps. These pumps are not are designed and tested for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. A provided with emergency power and are thus 4-hour battery depletion time is considered unavailable after a loss of offsite power. The realistic because of the margin in the design condenser at each unit is provided with four and possible load shedding. inlet and four outlet isolation valves. These isolation valves are provided with emergency power. Each inlet isolation valve is provided

5. Capability for Feed and Bleed Core with a hand wheel, located in the turbine Cooling building, in order to allow manual condenser isolation during station blackout to avoid In the Surry plant, the high-pressure injec- draining the canal.

tion system and the power-operated relief valves have the capability to provide feed and

• Cool down and depressurize the RCS bleed core cooling in the event of loss of the cooling function of the steam generators. The Emergency Contingency Actions (ECAs)

This capability to provide core cooling call for depressurization of the secondary through feed and bleed is estimated to result side of the steam generators during a station in approximately a factor of 1.4 reduction in blackout to provide cooldown and depressur-core damage frequency. Without the crossties ization of the reactor coolant system. This of auxiliary feedwater to Unit 2, which en- action is done through manual, local valve hances overall reliability of the auxiliary lineups.

feedwater system, the benefit of feed and During steam generator tube rupture, the most im-bleed cooling would be much greater. portant operator action is to cool down and depressurize the RCS within approximately 45 3.2.3 Important Operator Actions minutes after the event in order to prevent lifting the relief valves on the damaged steam generator.

The estimation of accident sequence and total Other possible recovery actions considered in this core damage frequencies depends substantially on accident sequence include: provision of an alter-the credit given to operating crews in performing native source of steam generator feed flow in re-actions before and during an accident. Failure to sponse to a loss of feed flow; crossconnect of HPI perform these actions correctly and reliably will from Unit 2 or opening of alternative injection have a substantial impact on estimated core dam- paths in response to failure of safety injection age frequency. For the Surry plant, actions found flow; and isolation of a damaged, faulted steam to be important are discussed below. generator.

3-9 NUREG-1150

3. Surry Plant Results During small-break and medium-break LOCA ac- estimated core damage frequency if their cident sequences, two human actions are princi- probabilities were set to zero:

pally important in response to loss of core coolant injection or recirculation. These are: - Loss of offsite power initiating event.

The core damage frequency would be

• Cool down and depressurize the RCS reduced by approximately 61 percent.

- Failure of diesel generator number one RCS cooldown and depressurization is the to start. The core damage frequency procedure directed for all small-break would be reduced by approximately 25 LOCAs. This event is important to reduce percent.

the pressure in the RCS and thus reduce the leak rate. Successful cooldown and depres- - Probability of not recovering ac electric surization of the RCS will delay the need to power between 3 and 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> after loss go to recirculation cooling. of offsite power. The core damage fre-quency would be reduced by approxi-

• Crossconnect high-pressure injection (HPI) mately 24 percent.

In the event that HPI pumps or water sources - Failure to recover diesel generators. The are unavailable at Unit 1, HPI flow can be core damage frequency would be provided via a crosstie with the Unit 2 charg- reduced by approximately 18 to 21 per-ing system. This crosstie requires an operator cent.

to locally open and/or close valves in the charging pump area. It was estimated that the

• Uncertainty importance measure (internal crossconnect of HPI would require 15 to 20 events) minutes. This and other timing considera-tions were such that the HPI crossconnect A second importance measure used to evalu-was considered viable only for small and very ate the core damage frequency results is the small LOCAs. uncertainty importance measure. For this measure, the relative contribution of the un-certainty of groups of component failures and 3.2.4 Important Individual Events and basic events to the uncertainty in total core Uncertainties (Core Damage damage frequency is calculated. Using this Frequency) measure, the following event groups were As discussed in Chapter 2, the process of develop- found to be most important:

ing a probabilistic model of a nuclear power plant - Probabilities of diesel generators failing involves the combination of many individual to start when required; events (initiators, hardware failures, operator er-rors, etc.) into accident sequences and eventually - Probabilities of diesel generators failing into an estimate of the total frequency of core to run for 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; damage. After development, such a model can also be used to assess the relative importance and - Frequency of loss of offsite power; and contribution of the individual events. The detailed studies underlying this report have been analyzed - Frequency of interfacing-system LOCA.

using several event importance measures. The re-sults of the analyses using two measures, "risk re- It should be noted that many events each contrib-duction" and "uncertainty" importance, are sum- ute a small amount to the uncertainty in core marized below. damage frequency; no single event dominates the uncertainty.

• Risk (core damage frequency) reduction im-portance measure (internal events) 3.3 Containment Performance Analysis 3.3.1 Results of Containment Performance The risk-reduction importance measure is Analysis used to assess the change in core damage fre-quency as a result of setting the probability of The Surry containment system uses a sub-an individual event to zero. Using this meas- atmospheric concept in which the containment ure, the following individual events were building housing the reactor vessel, reactor cool-found to cause the greatest reduction in the ant system, and secondary system's steam NUREG-1 150 3-10

3. Surry Plant Results generator is maintained at 10 psia. The contain- mechanism is bypass due to interfacing-system ment building is a reinforced concrete structure LOCA; and (3) external initiating events such as with a volume of 1.8 million cubic feet. Its design fire and earthquakes produce higher early and basis pressure is 45 psig, whereas its mean failure late containment failure probabilities.

pressure is estimated to be 126 psig. As previously discussed in Chapter 2, the method used to esti- The accident progression analyses performed for mate accident loads and containment structural this report are particularly noteworthy in that, for response for Surry made extensive use of expert core melt accidents at Surry, there is a high prob-judgment to interpret and supplement the limited ability that the reactor coolant system (RCS) will data available. be at relatively low pressures (less than 200 psi) at the time of molten core penetration of the lower The potential for early Surry containment failure reactor vessel head, thereby reducing the potential is of major interest in this risk analysis. The prin- for direct containment heating (DCH). There are cipal threats identified in the Surry risk analyses several reasons for concluding that the RCS will (Ref. 3.2) as potentially leading to early contain- be at low system pressure such as: stuck-open ment failure are: (1) pressure loads, i.e., hydro- PORVs, operator depressurization, failed reactor gen combustion and direct containment heating coolant pump seals, induced failures of RCS pip-due to ejection of molten core material via the ing due to high temperatures, and the relative rapid expulsion of hot steam and gases from the "mix" of plant damage states (i.e., for the fre-reactor coolant system; and (2) in-vessel steam quency of plant damage states initially at high ver-explosions leading to vessel failure with the vessel sus low RCS pressures). Accordingly, it has been upper head being ejected and impacting the con- concluded that the potential for early containment tainment building dome area (the so-called alpha- failure due to the phenomenon of DCH is less in mode failure). Containment bypass (such as fail- the risk analyses underlying this report relative to ures of reactor coolant system isolation check previous studies (Ref. 3.10) on the basis of a com-valves in the emergency core cooling system or bination of higher probabilities of low RCS pres-steam generator tubes) is another serious threat to sures (discussed above), lower calculated pres-the integrity of the containment system. sures given direct containment heating, and greater estimated strength of the Surry contain-The results of the Surry containment analysis are ment building (Ref. 3.2). (See Section C.5 of summarized in Figures 3.5 and 3.6. Figure 3.5 Appendix C for additional discussion of DCH and displays information in which the conditional why its importance is now less.)

probabilities of seven containment-related acci-dent progression bins; e.g., VB, alpha, early CF, Additional discussions on containment perform-are presented for each of seven plant damage ance (for all studied plants) are-provided in Chap-states; e.g., loss of offsite power. This information ter 9.

indicates that, on a plant damage state frequency-weighted average,' the conditional mean prob- 3.3.2 Important Plant Characteristics ability from internally initiated accidents of: (Containment Performance)

(1) early containment failure is about 0.01, Characteristics of the Surry plant design and op-(2) late containment failure (basemat melt- eration that are unique to the containment build-through or leakage) is about 0.06, (3) direct by- ing during core damage accidents include:

pass of the containment is about 0.12, and (4) no containment failure is 0.81. Figure 3.6 further dis- 1. Subatmospheric Containment Operation plays the conditional probability distribution of early containment failure for each plant damage The Surry containment is maintained at a state to show the estimated range of uncertainties subatmospheric pressure (10 psia) during op-in these containment failure predictions. The im- eration with a continual monitoring of the portant conclusions to be drawn from the infor- containment leakage. As a result, the likeli-mation in Figures 3.5 and 3.6 are: (1) the mean hood of pre-existing leaks of significant size is conditional probability of early containment fail- negligible.

ure from internal events is low; i.e., less than 0.01; (2) the principal containment release 2. Post-Accident Heat Removal System

• Each value in the column in Figure 3.5 labeled "All" is The Surry containment does not have fan obtained by calculating the products of individual accident cooler units that are qualified for post-acci-progression bin conditional probabilities for each plant damage state and the ratio of the frequency of that plant dent heat removal as do some other PWR damage state to the total core damage frequency. plants. Containment (and core) heat removal 3-11 NUREG-1150

z c) 1 T0

SUMMARY

SUMMARY

PDS GROUP (A

(Mean Core Damage Frequency)

ACCIDENT Initiators----------

I--------------Internal Fire Seismic PROGRESSION LOSP ATWS Transients LOCAs Bypass All LLNL BIN GROUP ( 2.8E-05) ( 1.4E-06) ( 18E-a6) ( 6.1E-06) ( 3.4E-06) ( 4.IE-05) ( 1.1E-05) ( 9E-04)

VB, alpha, early CF VB > 200 psi, early CF VB, < 200 psi, early CF VB, BMT or late CL Bypass VB, No CF No VB Key: BMT = Basemat Melt-Through CF = Containment Failure CL = Containment Leak VB = Vessel Breach Figure 3.5 Conditional probability of accident progression bins at Surry.

LEO 95th, I.E-1 95thb. M_4F a)

.tt1.E-2_

CD 7 4) 1- 01E4..

• H <~~~*

r

.t 0:: i.E-SI fl21.

0

.E-5.

2 M= mean m = median th = percentile U, - I z

-nternal Initiators

---

Fire Seismic PDS Group LOSP ATWS Transients LOCAs Blypass All LLNL Cl Core Damage Mleq. 2.BE-05 1.4E-06 1.8E-06 6.1E-06 3.4E-06 4.1E-05 l.lE-05 1.9E-04 c (tI Zi 0

Figure 3.6 Conditional probability distributions for early containment failure at Surry.

3. Surry Plant Results following an accident is provided by the con- tile groups (iodine, cesium, and tellurium) exceed tainment spray recirculation system, whereas, approximately 10 percent (Ref. 3.11). For the by-in some PWR plants, post-accident heat re- pass accident progression bin, the median value moval can also be provided by the residual for the volatile radionuclides is approximately at heat removal system heat exchangers in the the 10 percent level whereas for the early contain-emergency core cooling system. ment failure bin not shown, the releases are lower.

The median values are somewhat smaller than 10

3. Reactor Cavity Design percent, but the ranges extend to approximately The reactor cavity area is not connected di- 30 percent.

rectly with the containment sump area. As a In contrast to the large source term for the bypass result, if the containment spray systems fail bin, Figure 3.8 provides the range of source terms to operate during an accident, the reactor predicted for an accident progression bin involv-cavity will be relatively dry. The amount of ing late failure of the containment. The fractional water in the cavity can have a significant in- release of radionuclides for this bin is several or-fluence on phenomena that can occur after ders of magnitude smaller than for the bypass bin, reactor vessel lower head failure, such as except for iodine, which can be reevolved late in magnitude of containment pressurization the accident. It should be noted that, for many of from direct containment heating and post- the elemental groups, the mean of the distribution vessel failure steam generation, the formation falls above the 95th percentile value. For distribu-of coolable debris beds, and the retention of tions that occur over a range of many orders of radioactive material released during core- magnitude, sampling from the extreme tail of the concrete interactions. distribution (at the high end) can dominate and cause this result.

4. Containment Building Design Additional discussion on source term perspectives The containment volume and high failure is provided in Chapter 10.

pressure provide considerable capacity for accommodation of severe accident pressure 3.4.2 Important Plant Characteristics loads. (Source Term)

Plant design features that affect the mode and 3.4 Source Term Analysis likelihood of containment failure also influence 3.4.1 Results of Source Term Analysis the magnitude of the source term. These features were described in the previous section. Plant fea-In the Surry plant, the absolute frequency of an tures that have a more direct influence on the early failure of the containment* due to the loads source term are described in the following para-produced in a severe accident is small. Although graphs.

the absolute frequency of containment bypass is 1. Containment Spray System also small, for internal accident initiators it is greater than the absolute early failure frequency. The Surry plant has an injection spray system Thus, bypass sequences are the more likely means that uses the refueling water storage tank as a of obtaining a large release of radioactive mate- water source and a recirculation spray system rial. Figure 3.7 illustrates the distribution of that recirculates water from the containment source terms associated with the accident progres- sump. Sprays are an effective means for re-sion bin representing containment bypass. The moving airborne radioactive aerosols. For se-range of release fractions is quite large, primarily quences in which sprays operate throughout as the result of the range of parameters provided the accident, it is most likely that the con-by the experts. The magnitude of the release for tainment will not fail and the leakage to the many of the elemental groups is also large, indica- environment will be minor. If the contain-tive of a potentially serious accident. Typically, ment does fail late in the accident following consequence analysis codes only predict the extended spray operation, analyses indicate occurrence of early fatalities in the surrounding that the release of aerosols will be extremely population when the release fractions of the vola- small. Even in a station blackout case with delayed recovery of sprays, condensation of steam from the air, and a subsequent hydro-

• In this section, the absolute frequencies of early contain- gen explosion that fails containment, Source ment failure aTe discussed (i.e., including the frequencies Term Code Package (STCP) analyses indi-of the plant damage states). This is in contrast to the pre-vious section, which discusses conditional failure prob- cate that spray operation results in substan-abilities (i.e., given that a plant damage state occurs). tially reduced source terms (Ref. 3.12).

NUREG-1 150 3-14

Release Fraction T 1 1.OE+OO Os%

- moan 1.OE-01 modi1In as 1.OE-02 1.OE- 03 1.OE- 04 M M 1.OE - 05 NG I Cs Te Sr Ru La Ba Ce z Radionuclide Group cO an C

Figure 3.7 Source term distributions for containment bypass at Surry.

z Ca Qd Mo Release Fraction 1<

ICjI 1 .OE.00 96%

_- mean 1.OE-01 median 5%

1.OE-02 I

II 1.OE-03 1.OE-04 Q 9~

1.OE-05 NG I Cs Te Sr Ru La Ba Ce Radionuclide Group Figure 3.8 Source term distributions for late containment failure at Surry.

3. Surry Plant Results Sprays are not always effective in reducing ters included exclusion area radius (520 meters),

the source term, however. The risk-dominant meteorological data for 1 full year collected at the containment bypass sequences are largely un- site meteorological tower, the site region popula-affected by operation of the spray systems. tion distribution based on the 1980 census data, Early containment failure scenarios involving topography (fraction of the area that is land-the high-pressure melt ejection have a compo- remaining fraction is assumed to be water), land nent of the release that occurs almost simul- use, agricultural practice and productivity, and taneously with containment failure, for which other economic data for up to 1,000 miles from the sprays would not be effective. the Surry plant.

In addition to removing aerosols from the at- The consequence estimates displayed in these fig-mosphere, containment sprays are an impor- ures have incorporated the benefits of the follow-tant source of water to the reactor cavity at ing protective measures: (1) evacuation of 99.5 Surry, which is otherwise dry. A coolable de- percent of the population within the 10-mile bris bed can be established in the cavity, pre- plume exposure pathway emergency planning venting interactions between the hot core and zone (EPZ), (2) early relocation of the remaining concrete. If a coolable debris bed is not population only from the heavily contaminated ar-formed, a pool of water overlaying the hot eas both within and outside the 10-mile EPZ, and core as it attacks concrete can effectively (3) decontamination, temporary interdiction, or mitigate the release of radioactive material to condemnation of land, property, and foods con-the containment from this interaction. taminated above acceptable levels.

2. Cavity Configuration The population density within the Surry 10-mile EPZ is about 230 persons per square mile. The Water collecting on the floor of the Surry average delay time before evacuation (after a containment cannot flow into the reactor warning prior to radionuclide release) from the cavity. As a result, the cavity will be dry at 10-mile EPZ and average effective evacuation the time of vessel meltthrough unless the speed used in the analyses were derived from in-containment spray system has operated. As formation contained in a utility-sponsored Surry discussed earlier, water in the cavity can have evacuation time estimate study (Ref. 3.13) and a substantial effect on mitigating or eliminat- the NRC requirements for emergency planning.

ing the release of radioactive material from the molten core-concrete interaction. The results displayed in Figures 3.9 and 3.10 are discussed in Chapter 11.

3.5 Offsite Consequence Results 3.6 Public Risk Estimates Figures 3.9 and 3.10 display the frequency distri-butions in the form of graphical plots of comple- 3.6.1 Results of Public Risk Estimates mentary cumulative distribution functions (CCDFs) of four offsite consequence measures- A detailed description of the results of the Surry early fatalities, latent cancer fatalities, and the risk analysis is provided in Reference 3.2. For this 50-mile and entire site region population expo- summary report, results are provided for the fol-sures (in person-rems). The CCDFs in Figures 3.9 lowing measures of public risk:

and 3.10 include contributions from all source terms associated with reactor accidents caused by

• Early fatality risk, the internal initiating events and fire, respectively.

Four CCDFs, namely, the 5th percentile, 50th

• Latent cancer fatality risk, percentile (median), 5th percentile, and the mean CCDFs, are shown for each consequence

• Population dose within 50 miles of the site, measure.

• Population dose within the entire site region, Surry plant-specific and site-specific parameters were used in the consequence analysis for these

• Individual early fatality risk in the population CCDFs. The plant-specific parameters included within 1 mile of the Surry exclusion area source terms and their frequencies, the licensed boundary, and thermal power (2441 MWt) of the reactor, and the approximate physical dimensions of the power

• Individual latent cancer fatality risk in the plant building complex. The site-specific parame- population within 10 miles of the Surry site.

3-17 NUREG-1 150

z tri 0

l.OE-O3 3. -

I 1.OE-04 I IQOE-O5 9

.OE-03 t0 I a .OE-00  ;------- I a

C:

I 0 DI 1.OE-07 I 0

ar :Percentile  %"

T

.OE-07 CD 1.OE-08 . --- 96th E

C  :- Utah U_

S,3 t, i.OE-OQ I- 6011%  %

w: --- ath 11 0 . .. ...... . . . . . .. ...I t 4 s 9 s.,a UJ I.oE-t.oE.OO 1.OE+O1 1.OE.02 tOE.03 t.OE-04 tOE-05  ;*OO 1.OEO1 1OE*02 tOE.03 1.OE-04 1.OE05 .OE.06 Early Fatalities Latent Cancer Fatalities 00 sUt U nrnn _

03 t.oE -04 ------

• 1.OE-08 > .OE-04 0~~~~~~~~~~~~~~~~~~~~~~

a OE-06 <° .OE-OS .,6 C,

CD1.OE-08 crtOE-07 v\

o l.OE-08 10 Mean o .O-9 --- 9thi \

0D 1CE-09 XL)

U 5tth tlOE0 - 50th _ l_ i \

• ~~~~~ .IJZ - I. 0 1.OEo0 1.OE.02 t.OE.04 l.OE-O .OE.OO 1.OE.00 tE.O02 I.oE404 t.OE.O l.OE*08 Population Dose (person-rem) to -50 Mles Population Dose (person-rem) to -Entire Region Note: As discussed in Reference 3.4, consequences at frequencies estimated at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 3.9 Frequency distributions of offsite consequence measures at Surry (internal initiators).

'L- 1.0E-03 - ,D 1.0E-03 0

01O.1.0E-04. L 1.0E-04

- tII B

6.OE-064

(.)

0 1.0E-05 0

Cx i.OE-OC 8 l'OE- 08 a

.0

= 1.0E-07 CT' 0

,> 1.oE-o8 M

o.0E-08 ui

°3 .OE-08 I.0E-07 9D1 I.0E-07 0

0 1.06O-09 Lo "106E 0

§i tGE-10 lOE-OO lOE-01 .E02 t.oE-03 1.0E-04 .oE06 1OE E00 .OE01 toE+02 tOE+03 1.E004 1.0E05 1.0EOt Early Fatalities Latent Cancer Fatalities I&A -

0 ID

>' 1.0E-04 o

il I.OE-04 0

Q .OE-08 2

a 0 1.0E-07 G)X 1.0E-OB S

0

° t.OE-08 Bo5th DC x

W - -

I. uV - s*J 1.OE.00 1.0E-02 1.0.E04 tOE.00 tOE-08 .-00 .OE-02 .OE.04 1.06.08 I.oE008 -t zC Population Dose (person-rem) o -50 Miles Populatlon Dose (person-rem) to -Entire Region QV Note: As discussed in Reference 3.4, consequences at frequencies estimated at .or below 1E-7 per reactor year should be viewed with caution because of r CD the potential impact of events not studied in the risk analyses. C Figure 3.10 Frequency distributions of offsite consequence measures at Surry (fire initiators).

3. Surry Plant Results The first four of the above measures are com- Details of these accident sequences are provided monly used measures in nuclear power plant risk in Section 3.2.1.1. It should be noted from these studies. The last two are those used to compare discussions that for the steam generator tube rup-with the NRC safety goals (Ref. 3.14). ture accident, if corrective or protective actions are taken (e.g., alternative sources of water are made available, emergency response is initiated*)

3.6.1.1 Internally Initiated Accident before the refueling water storage tank water is Sequences totally depleted, i.e., within about a 10-hour pe-riod after start of the accident, risks from this ac-The results of the risk studies using the above cident may be substantially reduced.

measures are provided in Figures 3.11 through 3.13 for internally initiated accidents. The figures 3.6.1.2 Externally Initiated Accident display the variabilities in mean risks estimated Sequences from the meteQrology-averaged conditional mean The Surry plant has been analyzed for two exter-values of the consequence measures. For the first nally initiated accidents: earthquakes and fire (see two measures, the results of the first risk study of Section 3.2.1.2). The fire risk analysis has been Surry, the Reactor Safety Study (Ref. 3.3), are performed, including estimates of consequences also provided. As may be seen, both the early fa- and risk, while the seismic analysis has been con-tality risks and latent cancer fatality risks are ducted up to the containment performance (as lower than those of the Reactor Safety Study. discussed in Chapter 2). Sensitivity analyses of The early fatality risk distribution, however, has a seismic risk at Surry are provided in Reference longer tail at the low end indicating a belief by the 3.2.

experts that there is a finite probability that risks may be orders of magnitude lower than those of Results of fire risk analysis (variabilities in mean the Reactor Safety.Study. The risks of population risks estimated from meteorology-averaged condi-dose within 50 miles of the plant site as well as tional mean values of the consequence measures) within the entire site region are very low. Individ- of Surry are shown in Figures 3.16 through 3.18 ual early fatality and latent cancer fatality risks are for the early fatality, latent cancer fatality, popula-well below the NRC safety goals. tion dose (within 50 miles of the site and within the entire site region), and individual early and For the early and latent cancer fatality risk meas- latent cancer fatality risks. As can be seen, the ures, the Reactor Safety Study values lie in the risks from fire are substantially lower than those upper portions of the present risk range. This is from internally initiated events.

because of the current estimates of better contain- Major contributors to early and latent cancer fa-ment performance and source terms. The esti- tality risks are shown in Figure 3.19. (Note that mated probability of early containment failure in there are no bypass initiating events in the fire this study is significantly lower than the Reactor plant damage state.) The most risk-important se-Safety Study values. The source term ranges of quence is a fire in the emergency switchgear room the Reactor Safety Study are comparable with the that leads to loss of ac power throughout the sta-upper portions of the present study. The median tion. The principal risk-important accident pro-core damage frequencies of the two studies, how- gression bin is early containment failure with the ever, are about the same (2.3E-5 per reactor year reactor coolant system at high pressure (>200 for this study compared to 4.6E-5 per reactor psia) at vessel breach leading to direct contain-year for the Reactor Safety Study). A more de- ment heating.

tailed comparison between results is provided in Chapters 12. Additional discussion of risk perspectives (for all five plants studied) is provided in Chapter 12.

The risk results shown in Figure 3.11 have been 3.6.2 Important Plant Characteristics (Risk) analyzed to determine the relative contributions of plant damage states and containment-related acci- The plant characteristics discussed in Section dent progression bins to mean risk. The results of 3.2.2 that were important in the analysis of core this analysis are provided in Figures 3.14 and damage frequency were primarily related to the 3.15. As may be seen, the mean early and latent station blackout accident sequences and have not cancer fatality risks of the Surry plant are princi- been found to be important in the risk analysis.

pally due to accidents that bypass the containment building (interfacing-system LOCA (Event V) and *See Chapter 11 for sensitivity of offsite consequences to steam generator tube ruptures). alternative modes of emergency response.

NUREG-1150 3-20

3. Surry Plant Results 1f(T 'a A-109 _m 95iLh-. I5tII M4 10

'10

-4 l1rI le >10 I1 10 I Number of LHS Observations Key: M mean m median th - percentile Ii N -

9th 951f

-4 hm

4 M~.I 4

l33 1. - 5th a) 101-

$4 6t" a

10 Number of LHS ObservatIons Note: As discussed in Reference 3.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 3.11 Early and latent cancer fatality risks at Surry (internal initiators).

3-21 NUREG-1 150

3. Surry Plant Results Jid' 9!5fh 3 0

0 0 5tb--.

a) z90id 0 5th 1O 1, Number of LHS Observations Key: M = mean m median th = percentile ad

0) 95h it 0

2a)

-4q

.4 )

0 Numbsr of LHS Obuxrvations Note: As discussed in Reference 3.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 3.12 Population dose risks at Surry (internal initiators).

NUREG-1 150 3-22

3. Surry Plant Results In'

.6 q) i s.urety Goal I

5 10-95h .

E 10-' Z la

• c 10

<i.E-ICI Number of LHS Observations Key: M mean m = median th = percentile

-S

.Saety Goal

_h 10

'i IAV o-" I=

95th C

5th a ---

10-Number of LHS Observations Note: As discussed in Reference 3.4, estimated risks at or below 1-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 3.13 Individual early and latent cancer fatality risks at Surry (internal initiators).

3-23 NUREG-1150

3. Surry Plant Results SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY MEAN 21-S/AY MEAN

• E*3RY 5 5'~~

Plant Damage States

1. 80

2. ATWO

3. TRANSIENTS

4. LOCA I. BYPASS Figure 3.14 Major contributors (plant damage states) to mean early and latent cancer fatality risks at Surry (internal initiators).

SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY MEAN

• E-SJRY MEAN * .RE-WARY 1

5 5 Accident Progression Bins

1. YB. Early CF. Alpha Mode

2. VI, Early CF. RC$ Pressure 200 pala at VD

3. VS.Early CF. RCS Pressure '200 pals at Vs

4. YB, BUT and Late Look

6. Iypass S. V. No CF

7. No VS Figure 3.15 Major contributors (accident progression bins) to mean early and latent cancer fatality risks at Surry (internal initiators).

NUREG- 1150 3-24

3. Surry Plant Results I1 5-t

- m 95UL..

1O 10

?50-'

-Ia

R 10 5Ui0.

-14 10 10 .4 Number of LHS Observations Key: M = mean m = median th percentile In MLt.

U) 5th 1-0 LI M

15 U)

~~ 'I:

IC4 Number of LHS Observations Note: As discussed in Reference 3.4, estimated risks at or below E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 3.16 Early and latent cancer fatality risks at Surry (fire initiators).

3-25 NUREG-1150

3. Surry Plant Results 0

0 id 95ih 5t 0

Co o -

5th-.

Pi 0

10 0 Number of LHS Observations Key: M mean m median th = percentile

.4 j to

0

- .n 0

to 5th 0

4 Number of LHS Observations Note: As discussed in Reference 3.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 3.17 Population dose risks at Surry (fire initiators).

NUREG-1 150 3-26

3. Surry Plant Results ifa-I ON

.42 9-0 95i1Lh -

4i io-1 a

v ro:

11

. E

-Is Number of LHS Observations th10 Key: M = mean m = median th - percentile

_rS- ---- - I

~1o c~101

.0 6 o1

-l V

5th. 4

-"1 -1 10 -- I Number of LHS Observations Note: As discussed in Reference 3.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 3.18 Individual early and latent cancer fatality risks at Surry (fire initiators).

3-27 NUREG-1150

3. Surry Plant Results SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY (FIRE) (FIRE)

MEAN 3E-8/RY MEAN 2.TE-4/RY 1

2~~~~~~~

3 2 4 Accident Progression Bins

1. VB, Early CF. Alpha Mode

2. YB, Early CF, RCS Pressure 200 ple at VB

3. VB, Early CF, RCS Preasure 200 pe at VB

4. VS, BMT and Late Leak

6. Bypass

6. V. No CF

7. No VB Figure 3.19 Major contributors (accident progression bins) to mean early and latent cancer fatality risks at Surry (fire initiators).

That is, because of the high consequences of the late core melt; evacuation is assessed to be containment bypass sequences and low frequency complete before the release is estimated to of early containment failures, Event V and SGTR occur.

were more important risk contributors in the Surry analysis. The following general observations can

• The configuration of low-pressure piping out-be made from the risk results: side the containment leads to a high prob-ability that the release from an interfacing-

• The Surry containment appears robust, with system LOCA would be partially scrubbed by a low conditional probability of failure (early overlaying water. If the release were to take or late). This is responsible, to a large extent, place without such scrubbing, the contribu-for the low risk estimates for the Surry plant. tion to early fatality risk would be higher.

(In comparison with other plants studied in this report, risks for Surry are relatively high;

• Depressurization of the reactor coolant but, in the absolute sense, these risks are system by deliberate or inadvertent means very low and are well below NRC safety plays an important role in the progression of goals, as can be seen in Chapter 12.) severe accidents at Surry in that it decreases the probability of containment failure by

• Early fatality risk is dominated by bypass ac- high-pressure melt ejection and direct con-cidents, primarily from an interfacing-system tainment heating.

LOCA. This accident leads to rapid core damage; the radioactive release is assessed to

• Risks from accidents initiated by fires are take place before evacuation is complete. dominated by early containment failures and Steam generator tube rupture accident se- are estimated to be much lower than those quences with stuck-open SRVs result in very from internally initiated accidents.

NUREG-1150 3-28

3. Surry Plant Results REFERENCES FOR CHAPTER 3 3.1 R. C. Bertucio and J. A. Julius, "Analysis of 3.8 U.S. Code of Federal Regulations, Appen-Core Damage Frequency: Surry Unit 1," dix R, "Fire Protection Program for Nuclear Sandia National Laboratories, NUREG/ Power Facilities Operating Prior to Janu-CR-4550, Vol. 3, Revision 1, SAND86- ary 1, 1979," to Part 50, "Domestic Licens-2084, April 1990. ing of Production and Utilization Facilities,"

of Chapter I, Title 10, "Energy."

3.2 R. J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia Na- 3.9 T. A. Wheeler et al., "Analysis of Core tional Laboratories, NUREGICR-4551, Vol. Damage Frequency from Internal Events:

3, Revision 1, SAND86-1309, October Expert Judgment Elicitation," Sandia Na-1990. tional Laboratories, NUREGICR-4550, Vol.

2, SAND86-2084, April 1989.

3.3 USNRC, "Reactor Safety Study-An Assess-ment of Accident Risks in U.S. Commercial 3.10 USNRC, "Reactor Risk Reference Docu-Nuclear Power Plants," WASH-1400 ment," NUREG-1150, Vols. 1-3, Draft for (NUREG-75/014), October 1975. Comment, February 1987.

3.4 H. J. C. Kouts et al., "Special Committee 3.11 G. D. Kaiser, "The Implications of Reduced Review of the Nuclear Regulatory Commis- Source Terms for Ex-Plant Consequence sion's Severe Accident Risks Report Modeling," Executive Conference on the (NUREG-1150)," NUREG-1420, August Ramifications of the Source Term (Charles-1990. ton, SC), March 12, 1985.

3.5 A. Kolaczkowski and A. Payne, "Station 3.12 R. S. Denning et al., "Radionuclide Release Blackout Accident Analyses," Sandia Na- Calculations for Selected Severe Accident tional Laboratories, NUREGICR-3226, Scenarios-PWR, Subatmospheric Contain-SAND82-2450, May 1983. ment Design," Battelle Columbus Division, NUREG/CR-4624, Vol. 3, BMI-2139, July 3.6 D. L. Bernreuter et al., "Seismic Hazard 1986.

Characterization of 69 Nuclear Power Sites East of the Rocky Mountains," Lawrence 3.13 P. R. C. Voorhees, "Surry Nuclear Power Livermore National Laboratory, NUREG/ Station Estimation of Evacuation Times,"

CR-5250, Vols. 1-8, UCID-21517, January prepared for Virginia Power Company, 1989. March 1981.

3.7 Seismicity Owners Group and Electric Power 3.14 USNRC, "Safety Goals for the Operation of Research Institute, "Seismic Hazard Meth- Nuclear Power Plants; Policy Statement,"

odology for the Central and Eastern United Federal Register, Vol. 51, p. 30028, States," EPRI NP-4726, July 1986. August 21, 1986.

3-29 NUREG-1150

4. PEACH BOTTOM PLANT RESULTS 4.1 Summary Design Information

• Station blackout, The Peach Bottom Atomic Power Station is a

• Anticipated transient without scram General Electric boiling water reactor (BWR-4) (ATWS),

unit of 1065 MWe capacity housed in a Mark I containment constructed by Bechtel Corporation.

• Loss-of-coolant accidents (LOCAs), and Peach Bottom Unit 2, analyzed in this study, be-

• Transients other than station blackout and gan commercial operation in July 1974 under the ATWS.

operation of Philadelphia Electric Company (PECo). Some important system design features The relative contributions of these groups to mean of the Peach Bottom plant are described in Table internal-event core damage frequency at Peach 4.1. A general plant schematic is provided in Fig- Bottom are shown in Figure 4.3. From Figure 4.3, ure 4.1. it may be seen that station blackout sequences as a class are the largest contributor to mean core This chapter provides a summary of the results damage frequency. It should be noted that the obtained in the detailed risk analyses underlying plant configuration (as analyzed for this study) this report (Refs. 4.1 and 4.2). A discussion of does not reflect modifications that may be re-perspectives with respect to these results is pro- quired in response to the station blackout rule.

vided in Chapters 8 through 12.

Within the general class of station blackout acci-4.2 Core Damage Frequency Estimates dents, the more probable combinations of failures leading to core damage are:

4.2.1 Summary of Core Damage Frequency Estimates

• Loss of onsite and offsite ac power results in The core damage frequency and risk analyses per- the loss of all core cooling systems (except formed for this study considered accidents initi- high-pressure coolant injection (HPCI) and ated by both internal and external events (Refs. reactor core isolation cooling (RCIC), both 4.1 and 4.2). The core damage frequency results of which are ac independent in the short obtained from internal events are displayed in term) and all containment heat removal sys-graphical form as a histogram in Figure 4.2 (Sec- tems. HPCI or RCIC (or both) systems func-tion 2.2.2 discusses histogram development). The tion but ultimately fail at approximately 10 core damage frequency results obtained from in- hours because of battery depletion or other ternal and external events are provided in tabular late failure modes (e.g., loss of room cooling form in Table 4.2. effects). Core damage results in approxi-mately 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> as a result of coolant boiloff.

The Peach Bottom plant was previously analyzed in the Reactor Safety Study (RSS) (Ref. 4.3). The

• Loss of offsite power occurs followed by a RSS calculated a total point estimate core damage subsequent failure of all onsite ac power. The frequency from internal events of 2.6E-5 per diesel generators fail to start because of fail-year. This study calculated a total median core ure of all the vital batteries. Without ac and damage frequency from internal events of 1.9E-6 dc power, all core cooling systems (including per year with a corresponding mean value of HPCI and RCIC) and all containment heat 4.5E-6. For a detailed discussion of, and insights removal systems fail. Core damage begins in into, the comparison between this study and the approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> as a result of coolant RSS, see Chapter 8. boiloff.

4.2.1.1 Internally Initiated Accident

• Loss of offsite power occurs followed by a Sequences subsequent failure of a safety relief valve to reclose. All onsite ac power fails because the A detailed description of accident sequences im- diesel generators fail to start and run from a portant at the Peach Bottom plant is provided in variety of faults. The loss of all ac power fails Reference 4.1. For this summary report, the acci- most of the core cooling systems and all the dent sequences described in that report have been containment heat removal systems. HPCI grouped into four summary plant damage states. and RCIC (which are ac independent) are These are: available and either or both initially function 4-1 NUREG-11so

4. Peach Bottom Plant Results Table 4.1 Summary of design features: Peach Bottom Unit 2.

1. Coolant Injection Systems a. High-pressure coolant injection system provides coolant to the reactor vessel during accidents in which system pressure remains high, with 1 train and 1 turbine-driven pump.

b. Reactor core isolation cooling system provides coolant to the reactor vessel during accidents in which system pres-sure remains high, with I train and I turbine-driven pump.

c. Low-pressure core spray system provides coolant to the reactor vessel during accidents in which vessel pressure is low, with 2 trains and 4 motor-driven pumps.

d. Low-pressure coolant injection system provides coolant to the reactor vessel during accidents in which vessel pressure is low, with 2 trains and 4 pumps.

e. High-pressure service water crosstie system provides cool-ant makeup source to the reactor vessel during accidents in which normal sources of emergency injection have failed (low RPV pressure), with 1 train and 4 pumps for crosstie.

f. Control rod drive system provides backup source of high-pressure injection, with 2 pumps/210 gpm (total)/1,100 psia.

g. Automatic depressurization system for depressurizing the reactor vessel to a pressure at which the low-pressure in-jection systems can inject coolant to the reactor vessel: 5 ADS relief valves/capacity 820,000 lb/hr. In addition, there are 6 non-ADS relief valves.

2. Key Support Systems a. dc power with up to approximately 10-12-hour station batteries.

b. Emergency ac power from 4 diesel generators shared be-tween 2 units.

c. Emergency service water provides cooling water to safety systems and components shared by 2 units.

3. Heat Removal Systems a. Residual heat removal/suppression pool cooling system to remove heat from the suppression pool during accidents, with 2 trains and 4 pumps.

b. Residual heat removal/shutdown cooling system to remove decay heat during accidents in which reactor vessel integ-rity is maintained and reactor at low pressure, with 2 trains and 4 pumps.

c. Residual heat removal/containment spray system to sup-press pressure and remove decay heat in the containment during accidents, with 2 trains and 4 pumps.

4. Reactivity Control Systems a. Control rods.

b. Standby liquid control system, with 2 parallel positive dis-placement pumps rated at 43 gpm per pump, but each with 86 gpm equivalent because of the use of enriched boron.

5. Containment Structure a. BWR Mark I.

b. 0.32 million cubic feet.

c. 56 psig design pressure.

6. Containment Systems a. Containment venting-drywell and wetwell vents used when suppression pool cooling and containment sprays have failed to reduce primary containment pressure.

NUREG- 115 0 4-2

CD c

0 0

P.

z TO

-vaV

• _. ..- I LPCI,'RE l LPCs 2C CD M

r_

• Typical arrangement (5 ADS SRVs and 6 non-ADS SRVs)

(Ji 0>

Figure 4.1 Peach Bottom plant schematic.

4. Peach Bottom Plant Results Gore Damage Frequency (per RY) 1.OE-04 95th -

1.OE-06 Mean -

Median -

1.OE-06 5th _

1.OE-07 1.OE-08 Number of LHS samples Note: As discussed in Reference 4.4, core damage frequencies below 1E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

Figure 4.2 Internal core damage frequency results at Peach Bottom.

Table 4.2 Summary of core damage frequency results: Peach Bottom.*

5% Median Mean 95%

Internal Events 3.5E-7 1.9E-6 4.5E-6 1.3E-5 Station Blackout 8.3E-8 6.2E-7 2.2E-6 6.OE-6 ATWS 3. IE-8 4.4E-7 1.9E-6 6.6E-6 LOCA 2.5E-9 4.4E-8 2.6E-7 7.8E-7 Transient 6.1E-10 1.9E-8 1.4E-7 4.7E-7 External Events**

Seismic (LLNL) 5.3E-8 4.4E-6 7.7E-5 2.7E-4 Seismic (EPRI) 2.3E-8 7. E-7 3.1E-6 1. 3E-5 Fire 1. 1E-6 1.2E-5 2.OE-5 6.4E-5

• Note: As discussed in Reference 4.4, core damage frequencies below 1E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

• • See "Externally Initiated Accident Sequences" in Section 4.2.1.2 for discussion.

NUREG-1 150 4-4

4. Peach Bottom Plant Results Station Blackout U;:. Transients ATWS Total Mean Core Damage Frequency: 4.5E-6 Figure 4.3 Contributors to mean core damage frequency from internal events at Peach Bottom.

but ultimately fail at approximately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> HPCI fails to function because of random because of battery depletion or other late faults. The operator fails to depressurize after failure modes (e.g., loss of room cooling ef- HPCI failure and therefore the low-pressure fects). Core damage results in 10 to 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> core cooling systems cannot inject. Core as a result of coolant boiloff. damage occurs in approximately 15 minutes.

Within the general class of anticipated transient without scram accidents, the more probable com- Within the general class of LOCAs, the more binations of failures leading to core damage are: probable combination of failures leading to core damage is:

• Transient (e.g., loss of feedwater) occurs fol-

• A medium-size LOCA (i.e., break size of ap-lowed by a failure to trip the reactor because proximately 0.004 to 0.1 ft 2 ) occurs. HPCI of mechanical faults in the reactor protection works initially but fails because of low steam system (RPS) and closure of the main steam pressure. The low-pressure core cooling sys-isolation valves (MSIVs). The standby liquid tems fail to actuate primarily because of mis-control system (SLCS) does not function calibration faults of the pressure sensors, (primarily because of operator failure to ac- which do not "permit" the injection valves to tuate), but the HPCI does start. However, in- open. All core cooling is lost and core dam-creased suppression pool temperatures fail age occurs in approximately 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> fol-the HPCI. Low-pressure coolant injection lowing the initiating event.

(LPCI) is unavailable and all core cooling is lost. Core damage occurs in approximately 4.2.1.2 Externally Initiated Accident 20 minutes to several hours, depending on Sequences the time at which the LPCI fails because of A detailed description of accident sequences initi-different LPCI failure modes. ated by external events important at the Peach Bottom plant is provided in Part 3 of Reference

• Transient occurs followed by a failure to 4.1. The accident sequences described in that ref-scram (mechanical faults in the RPS) and erence have been grouped into two main types for closure of the MSIVs. SLCS is initiated but this study. These are:

4-5 NUREG-1 150

4. Peach Bottom Plant Results

• Seismic, and ences between the seismic core damage frequen-cies shown in Table 4.2 for the LLNL and the

• Fire. EPRI cases are due entirely to the differences be-tween the two sets of hazard curves. That is, the A scoping study has also been performed to assess system models, failure rates, and success logic the potential effects of other externally initiated were identical for both estimates.

accidents (Ref. 4.1, Part 3). This analysis indi-cated that the following external-event sources The seismic hazard associated with the curves de-could be excluded based on the low frequency of veloped by EPRI was significantly less than that of the initiating event: the LLNL curves. Differences between these curves result primarily from differences between

• Aircraft crashes, the methodology and assumptions used to develop

• Hurricanes, the hazard curves. In the LLNL program, consid-erable emphasis was placed on a wide range of

• Tornados, uncertainty in the ground-motion attenuation models, while a relatively coarse set of seismic tec-

• Internal flooding, and tonic provinces was used in characterizing each

• External flooding. site. By contrast, in the EPRI program consider-able emphasis was placed on a fine zonation for

1. Seismic Accident Frequency Analysis the tectonic provinces, and very little uncertainty in the ground-motion attenuation was considered.

The relative contribution of classes of seismically In any case, it is the difference between the two and fire-initiated accidents to the total mean fre- sets of hazard curves that causes the differences quency of externally initiated core damage acci- between the numeric estimates in Table 4.2.

dents is provided in Figure 4.4. As may be seen, the dominant seismic scenarios are transient 2. Fire Accident Frequency Analysis (38o) and LOCA sequences (27%) with the other contributors being substantially less. For these two The fire-initiated accident frequency analyses per-seismic accident initiators, the more probable formed for this report considered the impact of combinations of system failures are: fires beginning in a variety of separate locations within the plant. Those locations found to be most

• The transient sequence results from seismi- important were:

cally induced failure of ceramic insulators in the switchyard causing loss of offsite power

• Emergency switchgear rooms, (LOSP) in conjunction with loss of onsite ac power. This latter results primarily from loss

• Control room, and of the emergency service water (ESW) sys-tem (which provides the jacket cooling for

• Cable-spreading room.

the emergency diesel generators) and/or di-rect failures of 4 kV buses or the diesel gen- No other plant locations contributed more than erators themselves. The vast majority of fail- 1.OE-8 per year to the core damage frequency.

ures are seismically induced.

Fires in the cable-spreading room are assumed to

• The large LOCA sequence is initiated by pos- require manual plant trip and to fail the high-tulated seismically induced failures of the pressure injection and depressurization systems, supports on the recirculation pumps. Core namely: high pressure core injection (HPCI), re-damage results from this initiator in conjunc- actor core isolation cooling (RCIC), control rod tion with seismically induced failures of the drive (CRD), and automatic depressurization sys-low-pressure injection systems. The latter re- tems (ADS). In each case, the failure occurs be-quires ac power, and the dominant sources of cause of fire damage to the control cables.

failure of onsite ac power are the ESW or emergency diesel generator seismic failures as discussed above. Fires in the emergency switchgear rooms failed offsite power and in some instances portions of As discussed in Chapter 2, the seismic analysis in the emergency service water system, and core this report made use of two sets of hazard curves damage occurs because of a station blackout se-from Lawrence Livermore National Laboratory quence involving additional random failures of the (LLNL) (Ref. 4.5) and the Electric Power Re- emergency service water system (which provides search Institute (EPRI) (Ref. 4.6). The differ- jacket cooling to the diesel generators).

NUREG-1 150 4-6

4. Peach Bottom Plant Results Finally, two fire scenarios were identified for the allowed for recovery from the remote shutdown control room, both of which involve manual plant panel.

trip and abandonment of the control room. One scenario involved random failure of the RCIC sys- 4.2.2 Important Plant Characteristics (Core tem and a reasonable probability that the opera- Damage Frequency) tors fail to recover the plant using HPCI or ADS Characteristics of the Peach Bottom plant design in conjunction with LPCI from the remote shut- and operation that have been found to be impor-down panel. The other scenario failed the RCIC tant in the analysis of core damage frequency in-system because of a fire in its control cabinet but clude:

(SEISMIC)

TRANSIENTS LOSP LOCA (SEISMIC)

LOSP (FIRE)

RWTB (SEISMtC)

RVR (SEISMIC) TRANSIENTS (FIRE)

OTHER (SEISMIC)

STATION BLACKOUT (FIRE)

Total Mean Core Damage Frequency: 9.7E-5 Figure 4.4 Contributors to mean core damage freque ncy from external events (LLNL hazard curve) at Peach Bottom.

1. High-Pressure Service Water System ferent types of sequences. The Peach Bottom Crosstie operators are trained to use this system and The high-pressure service water (HPSW) sys- can do so from the control room. An exten-sive cleanup program would, however, be re-tem, if the reactor vessel has been quired after the system is initiated.

depressurized, can inject raw water to the re-actor vessel via the residual heat removal in-jection lines. Most components of HPSW are located outside the reactor building and thus 2. Redundancy and Diversity of Water are not affected by any potential severe reac- Supply Systems tor building environment that could cause other injection systems to fail in some acci- At Peach Bottom, there are many redundant dents. Therefore, this system offers diversity, and diverse systems to provide water to the as well as redundancy, and affects many dif- reactor vessel. They include:

4-7 NUREG-1150

4. Peach Bottom Plant Results High-pressure core injection (HPCI) with I had a failure-to-start probability that is much pump; better than the industry average, e.g., a fac-tor of -10 lower failure probability.

Reactor core isolation cooling (RCIC) with 1 pump;

5. Battery Capacity Control rod drive (CRD) with 2 pumps (both pumps required); Philadelphia Electric Company (PECo) has Low-pressure core spray (LPCS) with 4 performed analyses of the battery life based pumps; on the current station blackout procedures.

PECo estimates that the station batteries at Low-pressure core injection (LPCI) with 4 Peach Bottom are capable of lasting at least pumps; 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> in a station blackout. They have re-vised their station blackout procedure to in-Condensate with 3 pumps; and clude load shedding in order to ensure a High-pressure service water (HPSW) with 4 longer period of injection and accident moni-pumps. toring. The ability to ensure availability for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> reduces the frequency of core dam-Because of this redundancy of systems, age resulting from station blackout accident LOCAs and transients other than station sequences.

blackout and ATWS are small contributors to the core damage frequency.

6. Emergency Service Water (ESW) System CRD, condensate, and HPSW pumps are lo-cated outside the reactor building (generally The ESW system provides cooling water to away from potentially severe environments) selected equipment during a loss of offsite and represent excellent secondary high- and power. The system has two full capacity self-low-pressure coolant systems if normal injec- cooled pumps whose suction is from the Con-tion systems fail. These systems are not avail- owingo pond and a backup third pump with a able during station blackout. separate water source. Failure of the ESW system would quickly fail operating diesel

3. Redundancy and Diversity of Heat generators and potentially fail the low-Removal Systems pressure core spray (LPCS) pumps and the RHR pumps. The HPCI pumps and RCIC At Peach Bottom, there are several diverse pumps would fail (in the long term) from a means for heat removal. These systems are: loss of their room cooling after a loss of the Main steamlfeedwater system; ESW system.

Suppression pool cooling mode of residual heat removal (RHR); It should be noted that there is an outstand-ing issue regarding the need for ESW that in-Shutdown cooling mode of RHR; volves whether or not the LPCS/RHR pumps Containment spray system mode of RHR; actually require ESW cooling. PECo has and stated that these pumps are designed to oper-Containment venting. ate with working fluid temperatures ap-proaching 160'F without pump cooling. This This diversity has greatly reduced the impor- implies that in scenarios where the ESW sys-tance of transients with long-term loss of heat removal.

tem has been lost, these pumps could still op-erate; some RHR pumps would be placed in

4. Diesel Generators the suppression pool cooling mode and there-fore keep the working fluid at less than Peach Bottom is a two-unit site with four 160 0F. It is felt that there is significant valid-emergency diesels shared between the two ity to these arguments. However, because it is units. One diesel can supply the necessary uncertain whether the suppression pool water power for both units. DC power to start the can be maintained below 160'F in some se-diesels is supplied from vital dc station batter- quences and whether PECo has properly ac-ies. The four emergency diesels share a com- counted for pump heat addition to the sys-mon service water system that provides oil tem, the analysis summarized here assumes cooling, jacket, and air cooling. The Peach these LPCS/RHR pumps will fail upon loss of Bottom emergency diesels historically have ESW cooling.

NUREG-1 150 4-8

4. Peach Bottom Plant Results

7. Automatic and Manual Depressurization If the reactor is at decay heat loads, venting System using the 6-inch ILRT line or equivalent as a minimum is sufficient to lessen the contain-The automatic depressurization system ment pressure. However, in an ATWS se-(ADS) is designed to depressurize the reactor quence, three to four of the large 18-inch vessel to a pressure at which the low-pressure vent pathways need to be used in order to injection systems can inject coolant. The achieve the same effect. It is preferable to ADS consists of five safety relief valves capa- use a vent pathway from the torus rather than ble of being manually opened. The operator from the drywell because of the scrubbing of may manually initiate the ADS or may radioactive material coming through the sup-depressurize the reactor vessel, using the six pression pool.

additional relief valves that are not con-nected to the ADS logic. The ADS valves are It is significant to note that the 6-inch ILRT located inside the containment; however, the line is a solid pipe rather than ductwork, so instrument nitrogen and the dc power re- that venting by means of this pipe does not quired to operate the valves are supplied create a severe environment within the reac-from outside the containment. tor building; use of the 18-inch lines will re-sult in failure of the ductwork and severe en-

8. Standby Liquid Control (SLC) System vironments within the reactor building.

The SLC system provides a backup method that is redundant but independent of the 10. Location of Control Rod Drive (CRD)

Pumps control rods to establish and maintain the re-actor subcritical. The suction for the SLC The CRD pumps at Peach Bottom are not lo-system comes from a control tank that has cated in the reactor building (like most sodium pentaborate in solution with plants) but are in the turbine building.

demineralized water. Most of the SLC system Therefore, in a severe accident where severe is located in the reactor building outside the environments are sometimes created, the drywell. Local access to the SLC system CRD pumps are not subjected to these envi-could be affected by containment failure or ronments and can continue to operate.

containment venting.

4.2.3 Important Operator Actions

9. Venting Capability The emergency operating procedures (EOPs) at The primary containment venting system at Peach Bottom direct the operator to perform cer-Peach Bottom is used to prevent containment tain actions depending on the plant conditions or pressure limits from being exceeded. There symptoms (e.g., reactor vessel level below top of are several vent paths: active fuel). Different accident sequences can have similar symptoms and therefore the same

• 2-inch torus vent to standby gas treat- "recovery" actions. The operator actions that ment (SBGT), either are important in reducing accident frequen-

• 6-inch integrated leak rate test (ILRT) cies or are contributing to accident frequencies pipe from the torus, are discussed and can apply to many different ac-cident sequences.

0 18-inch torus vent path, 18-inch torus supply path, The quantification of these human failure events 0

S 2-inch drywell vent to SBGT, was based on an abbreviated version of the Two 3-inch drywell sump drain lines, THERP method (Ref. 4.7). These failure events 0 6-inch ILRT line from drywell, include the following:

0 18-inch drywell vent path, and

• Actuate core cooling 0 18-inch drywell supply path.

In an accident where feedwater is lost (which The types of sequences on which venting has includes condensate), the reactor vessel the most effect are transients with long-term water level starts to decrease. When Level 2 loss of decay heat removal. The chance of is reached, HPCI and RCIC should be auto-survival of the containment is increased with matically actuated. If Level 1 is reached, the venting; therefore, the core damage fre- automatic depressurization system (ADS) quency from such sequences is reduced. should be actuated with automatic actuation 4-9 NUREG- 115 0

4. Peach Bottom Plant Results of the low-pressure core spray (LPCS) and quantification of these human failure events low-pressure coolant injection (LPCI). If was derived from historical data (i.e., actual these systems fail to actuate, the operator can time required to perform these repairs) and attempt to manually actuate them from the not by performing a human reliability analysis control room. In addition, the operator can on these events.

attempt to recover the power conversion sys-tem (PCS) (i.e., feedwater) or manually initi- Transients where reactor trip does not occur (i.e.,

ate control rod drive (CRD) (i.e., put CRD ATWS) involve accident sequences where the in its enhanced flow mode). If automatic phenomena are more complex. The operator ac-depressurization failure was one of the faults, tions were evaluated in more detail (using the the operator can manually depressurize so SLIM-MAUD* method performed by Brook-that LPCS and LPCI can inject. Lastly, the haven National Laboratory (Ref. 4.8)) than for operator also has the option to align the the regular transients. These actions include the HPSW to LPCI for another core cooling sys- following:

tem.

• Manual scram

• Establish containment heat removal A transient. that demands the reactor to be tripped occurs, but the reactor protection Besides core cooling, the operator must also system (RPS) fails from electrical faults. The establish containment heat removal (CHR). operator can then manually trip the reactor Without CHR, the potential exists for operat- by first rotating the collar on the proper ing core cooling systems to fail. If an accident scram buttons and then depressing the but-occurs, the EOPs direct the operator to initi- tons, or he can put the reactor mode switch ate the suppression pool cooling mode of re- in the "shutdown" position.

sidual heat removal (RHR) after the suppres-sion pool temperature reaches 95 0 F. The

• Insert rods manually operator closes the LPCI injection valves and the heat exchanger bypass valves and opens If the electrical faults fail both the RPS and the suppression pool discharge valves. He the manual trip, the operator can manually also ensures that the proper service water sys- insert the control rods one at a time.

tem train is operating. With suppression pool cooling (SPC) functioning, CHR is being per-

• Actuate standby liquid control (SLC) formed. If system faults preclude the use of With the reactor not tripped, reactor power SPC, the operator has other means to pro- remains high; the reactor core is not at decay vide CHR. He can actuate other modes of heat levels. This can present problems since RHR such as shutdown cooling or contain- the CHR systems are only designed to decay ment spray; or the operator can vent the con- heat removal capacity. However, the SLC tainment to remove the heat. system (manually activated) injects sodium pentaborate that reduces reactor power to

• Restore service water decay heat levels. The EOPs direct the op-erator to actuate SLC if the reactor power is Many of the components/systems require above 3 percent and before the suppression cooling water from the emergency service pool temperature reaches 110'F. The opera-water (ESW) system in order to function. If tor obtains the SLC keys (one per pump) the ESW pumps fail, the operator can manu- and inserts the keys into the switches and ally start the emergency cooling water pump, turns only one to the "on" position.

which is a backup to the ESW pumps.

• Inhibit automatic depressurization system Specifically for station blackout, there are certain (ADS) actions that can be performed by the operating In an ATWS condition, the operator is di-crew: rected to inhibit the ADS if he has actuated SLC. The operator must put both ADS

• Recovering ac power switches in the inhibit mode.

Station blackout is caused by the loss of all ac power, i.e., both offsite and onsite power.

Restoring offsite power or repairing the diesel 'SLIM.-MAUD is a computer algorithm for transforming man-man and man-machine information into probability generators was included in the analysis. The statements.

NUREG-1 150 4-10

4. Peach Bottom Plant Results 0 Manually depressurize reactor - Operator failure to initiate emergency heat sink. The core damage frequency If the high-pressure coolant injection (HPCI) would be reduced by approximately 17 fails, inadequate high-pressure core cooling occurs. Because the ADS was inhibited, percent.

when Level 1 is reached, ADS will not occur - Operator failure to actuate standby liq-and the operator must manually depressurize uid control system. The core damage so that low-pressure core cooling can inject. frequency would be reduced by approxi-mately 16 percent.

4.2.4 Important Individual Events and - Operator miscalibrates reactor pressure Uncertainties (Core Damage sensors. The core damage frequency Frequency) would be reduced by approximately 12 percent.

As discussed in Chapter 2, the process of develop-ing a probabilistic model of a nuclear power plant Note that the top risk-reduction events do involves the combination of many individual not necessarily appear in the most frequent events (initiators, hardware failures, operator er- sequences since the latter sequences may re-rors, etc.) into accident sequences and eventually sult from the cumulative influence of many into an estimate of the total frequency of core lesser contributors.

damage. After development, such a model can also be used to assess the relative importance and

• Uncertainty importance measure (internal contribution of the individual events. The detailed events) studies underlying this report have been analyzed A second importance measure used to evalu-using several event importance measures. The re- ate the core damage frequency analysis re-sults of the analyses using two measures, "risk sults is the uncertainty importance measure.

reduction" and "uncertainty" importance, are For this measure, the relative contribution of summarized below. the uncertainty of individual events to the uncertainty in total core damage frequency is

• Risk (core. damage frequency) reduction im- calculated. Using this measure, the following portance measure (internal events) events were found to be most important:

The risk-reduction importance measure is - Mechanical failure of the reactor pro-used to assess the change in core damage fre- tection system.

quency as a result of setting the probability of - Failure of the diesel generators to con-an individual event to zero. Using this meas- tinue to run once started.

ure, the following individual events were found to cause the greatest reduction in core - Loss of offsite power or transients with damage frequency if their probabilities were the power conversion system available.

set to zero: - Miscalibration of the reactor pressure sensors by the operator.

- Operator failure to restore the standby liq-

- Mechanical failure of the reactor pro- uid control system after testing.

tection system. The core damage fre-quency would be reduced by approxi- 4.3 Containment Performance Analysis mately 52 percent.

4.3.1 Results of Containment Performance

- Transient initiators with the power con- Analysis version system available. The core dam-age frequency would be reduced by ap- The Peach Bottom Mark I containment design proximately 47 percent. concept consists of a pressure-suppression con-tainment system that houses the reactor vessel,

- Loss of offsite power initiating event. the reactor coolant recirculating loops, and other The core damage frequency would be branch connections to the reactor coolant system.

reduced by approximately 39 percent. The containment design consists of a light-bulb-shaped drywell and a water-filled toroidal-shaped

- Operator failure to restore the standby suppression pool. Both the drywell and the sup-liquid control system after testing. The pression pool are freestanding steel shells with the core damage frequency would be re- drywell region backed by a reinforced concrete duced by approximately 25 percent. structure. The containment system has a volume 4-11 NUREG-1 150

4. Peach Bottom Plant Results of 320,000 cubic feet and is designed to withstand 0.27. Figure 4.6 further displays the conditional a peak pressure of 56 psig resulting from a pri- probability distribution of early containment fail-mary system loss-of-coolant accident. The esti- ure for each plant damage state, thereby providing mated mean failure pressure for Peach Bottom's the estimated range of uncertainties in these con-containment system is 148 psig, which is very simi- tainment failure predictions. The important con-lar to that for large PWR containment designs. clusions that can be drawn from the information However, its small free volume relative to other in these two figures are: (1) there is a high mean containment types significantly limits its capacity probability (i.e., 50%) that the Peach Bottom to accommodate noncondensible gases generated containment will fail early for the dominant plant in severe accident scenarios in addition to increas- damage states; (2) early containment failures will ing its potential to come into contact with molten primarily occur in the drywell structure resulting in core material. The complexity of the events oc- a bypass of the suppression pool's scrubbing ef-curring in severe accidents has made predictions fects for radioactive material released after vessel of when and where Peach Bottom's containment breach; and (3) the principal cause of early would fail heavily reliant on the use of expert drywell failure is drywell shell meltthrough. The judgment to interpret and supplement the limited data further indicate that the early containment data available. failure probability distributions for most plant damage states are quite broad. Also presented in The potential for early containment failure (be- these displays of containment failure information fore or within roughly 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after reactor vessel is evidence that there is a high probability of early breach) is of principal concern in Peach Bottom's containment failure during external events such as risk analysis. For the Peach Bottom Mark I type fire and earthquakes. Specifically, the seismic of containment, the principal mechanisms that analysis indicates that the conditional probability can cause its early failure are (1) drywell shell of early containment failure from all causes, i.e.,

meltthrough due to its interaction with the molten direct containment structural failure or related core material released from the breached reactor failure from the effects of a core damage event, pressure vessel, (2) overpressure failure of the could be as high as 0.9.

drywell due to rapid direct containment heating following reactor vessel breach, and (3) stretching Additional discussion on containment perform-of the drywell head bolts (due to internal pressuri- ance (for all studied plants) is provided in Chapter zation) causing a direct leakage path from the sys- 9.

tem. Possible overpressure failures due to hydro-gen combustion effects are of negligible 4.3.2 Important Plant Characteristics (Containment Performance) probability for Peach Bottom since the contain-ment is inerted. In addition to the early modes of Characteristics of the Peach Bottom containment containment failure, core damage sequences can design and operation that are important during also result in late containment failure or no con- core damage accidents include:

tainment failure at all. 1. Containment Inerting The results of the Peach Bottom containment The Peach Bottom containment is main-analysis are summarized in Figures 4.5 and 4.6. tained in an inerted state, i.e., nitrogen Figure 4.5 contains a display of information in filled. This inerted containment condition which the conditional probabilities of 10 contain- significantly reduces the chance of hydrogen ment-related accident progression bins; e.g., V.B- combustion in the containment, thereby re-early WWF - >200, are presented for each of six moving a major threat to its failure. How-plant damage states, such as station blackout. This ever, hydrogen combustion in the reactor information indicates that, on a plant damage building is a possibility for some severe acci-state frequency-weighted average,

• the mean con- dent sequences.

ditional probability from internally initiated acci-dents of: (1) early wetwell failure is about 0.03, 2. Drywell Sprays (2) early drywell failure is about 0.52, (3) late The Peach Bottom drywell contains a spray failure of either the wetwell or drywell is about header that can be used to mitigate the ef-0.04, and (4) no containment failure is about fects of the actions of molten core material on the floor of the drywell. In particular, the

'Each value in the column in Figure 4.5 labeled "All" is spray system may provide sufficient water to obtained by summing the products of individual acci- prevent the molten core material from com-dent progression bin conditional probabilities for each plant damage state and the ratio of the frequency of that ing into contact with the drywell shell and po-plant damage state to the total core damage frequency. tentially causing its failure.

NUREG-1 150 4-12

PLANT DAMAGE STATE ACCIDENT (Mean Core Damage Fequency)

Internal Initiators---- Fire I Seismic PROGRESSION BIN VB > 200psi, early WWF VB < 200 psi, early WWF V3 > 200 psi, early DWF VB < 200 psi, early DWF VB, late WWF VB, late DWF VB, CV No CF No VB It 0

5 0

No Core Damage 0

CD P,

z VB = Vessel Breach WWF = Wetwell Failure M DWF Drywell Failure CV Containment Venting To I- CF = Containment Failure Lh Figure 4.5 Conditional probability of accident progression bins at Peach Bottom.

z I

0n 03 LEO 0

El 0r PC CD IC a)

°. i .E-1

.- q l P.L,_ dU 0Q co 1.-

Internal Initiators------- Fire Seismic PDS Group LOSP LOCAs ATWS Transients All LLNL Core Damage Mreq. 2.AE-06 1.5E-07 1.9E-06 1.8E-07 4.3E-06 2.OE-05 7.5E-05 Figure 4.6 Conditional probability distributions for early containment failure at Peach Bottom.

4. Peach Bottom Plant Results 4.4 Source Term Analysis in the reactor building and possibly to sprays and scrubbing by an overlaying water layer.

4.4.1 Results of Source Term Analysis The range of uncertainty in the release for the Failure of the drywell shell following vessel barium and strontium radionuclide groups is par-meltthrough is a characteristic of the risk- ticularly evident. The spread between the mean dominant accident progression bins for the Peach and median is two orders of magnitude. Although Bottom plant. Figure 4.7 illustrates the source the release is likely to be quite small, the mean terms for the early failure accident progression bin value of the release is as high as the mean value in which the reactor coolant system is pressurized for the tellurium release.

(> 200 psi) at the time of vessel failure. in com-parison with the bypass release that was illustrated Additional discussion on source term perspectives is provided in Chapter 10.

for Surry in Figure 3.7, the core fractions of the volatile groups (iodine, cesium, and tellurium) re-leased to the environment are slightly reduced. 4.4.2 Important Plant Characteristics For the majority of accident sequences in Peach (Source Term)

Bottom, the radionuclides released from fuel in- 1. Reactor Building vessel must pass through the suppression pool where substantial decontamination is possible. In The Peach Bottom containment is located sequences where the drywell spray system is oper- within a reactor building. A release of radio-able, the ex-vessel release will also be mitigated by active material to the reactor building will the spray or an overlaying pool of water. Both the undergo some degree of decontamination be-in-vessel and ex-vessel releases will receive further fore release to the environment. An impor-attenuation in the reactor building before release tant consideration in determining the magni-to the environment. Even if the decontamination tude of building decontamination is whether factor of some of these stages is small, the overall hydrogen combustion occurs in the building effect is to make the likelihood of a very large and whether combustion is sufficiently ener-release quite small. getic to fail the building. The range of decon-tamination factors for the reactor building used in the study is from 1.1 to 10 with a The Peach Bottom plant has instituted emergency median value of 3 for typical accident condi-operating procedures to vent the containment in tions.

the wetwell region to avoid failure by overpres-surization. Figure 4.8 shows the source terms for

2. Pressure-Suppression Pool the accident progression bin in which the contain-ment is vented and no subsequent failure of the The pressure-suppression pool is particularly containment occurs. The source terms for the effective in the reduction of the in-vessel re-volatile radionuclide groups are less than those for lease component of the source terms for the early drywell failure bin discussed previously. Peach Bottom. The range of decontamina-In both cases, scrubbing of the in-vessel release by tion factors used is from 1.2 to 4000 with a the suppression pool has the principal mitigating median of 80 for flow through the safety re-influence on the environmental release. The re- lief valve lines.

lease fractions for the less volatile groups are smaller for the vented accident progression bin The submergence is less and bubble size is but only by approximately a factor of one-half. larger for flow through the downcomers than There are two reasons why the differences be- for the spargers through which the in-vessel tween the environmental release of the ex-vessel release is most likely to enter the pool. As a species for the vented and drywell failure cases result, the decontamination factor for the ex-are not greater. The decontamination capability of vessel release or any in-vessel release that the suppression pool for ex-vessel release, in passes through the drywell is smaller, ranging which. the flow is through the downcomers, is from approximately 1 to 90 with a median of somewhat less than for the in-vessel release, which 10. Furthermore, the likelihood of failure of passes through spargers on the safety relief lines. the drywell at the time of vessel meltthrough Thus, even though the ex-vessel release must pass is predicted to be high. For scenarios involv-through the pool for the vented case, the decon- ing early drywell failure, the suppression pool tamination factor may be small. The ex-vessel re- would be bypassed during the period of core-lease for the drywell failure accident progression concrete interaction and radionuclide re-bin will at least be subjected to decontamination lease.

4-15 NUREG-1 150

z Ci Id

r 0 :r Release Fraction to M 1.OE+OO 0 IT ~~~~~~~~~~~~~~~95%

P

- man in 1.OE-01 median 5%

1.OE-02 i.OE-03 1.OE-04 1.OE-05 NG I Cs Te Sr Ru La Ba Ce Radionuclide Group Figure 4.7 Source term distributions for early failure in drywell at Peach Bottom.

Release Fraction 1.OE.00 LF mean 1.OE-01 median 6%

Th 1.OE-02 1.OE-03 1.OE-04 0

M M w 1.0E- 05 i,~~~~~~~.. ...M 0

NG I Cs Te Sr Ru La Ba Ce z

C Radionuclide Group re

.q 0

0d Figure 4.8 Source term distributions for vented containment at Peach Bottom.

4. Peach Bottom Plant Results

3. Venting included source terms and their frequencies, the licensed thermal power (3293 MWt) of the reac-The Peach Bottom containment can be tor, and the approximate physical dimensions of vented from the wetwell air space. By pre- the power plant building complex. The site-spe-venting containment failure, venting can po- cific parameters included exclusion area radius tentially prevent some scenarios from becom- (820 meters), meteorological data for 1 full year ing core damage accidents. In scenarios that collected at the site meteorological tower, the site proceed to fuel melting, venting can lead to region population distribution based on the 1980 the mitigation of the release of radioactive census data, topography (fraction of the area that material to the environment by ensuring that is land-the remaining fraction is assumed to be the release passes through the suppression water), land use, agricultural practice and produc-pool. The effect of venting on core damage tivity, and other economic data for up to 1,000 frequency is described in Chapter 8. Figure miles from the Peach Bottom plant.

4.8 illustrates the source term characteristics for the venting accident progression bins. Al- The consequence estimates displayed in these fig-though the source terms are somewhat less ures have incorporated the benefits of the follow-than for the early drywell failure accident ing protective measures: (1) evacuation of 99.5 progression bin, the uncertainties in the re- percent of the population within the 10-mile lease fractions are quite broad. At the high plume exposure pathway emergency planning end of the uncertainty range, it is possible zone (EPZ), (2) early relocation of the remaining that 40 percent of the core inventory of io- population only from the heavily contaminated dine could be released to the environment. areas both within and outside the 10-mile EPZ, and (3) decontamination, temporary interdiction, The effectiveness of venting to mitigate se- or condemnation of land, property, and foods vere accident release of radioactive material contaminated above acceptable levels.

is limited in the Peach Bottom analyses be-cause of the high likelihood of early drywell The population density within the Peach Bottom failure, particularly as the result of direct at- 10-mile EPZ is about 90 persons per square mile.

tack of the shell by molten core debris. If The average delay time before evacuation (after a direct attack of the containment shell is de- warning prior to radionuclide release) from the termined not to lead to failure or if effective 10-mile EPZ and average effective evacuation means are found to preclude failure, the ef- speed used in the analyses were derived from in-fectiveness of venting could be greater. How- formation contained in a utility-sponsored Peach ever, considering the range of uncertainties Bottom evacuation time estimate study (Ref. 4.9) in the source term analyses, the predicted and the NRC requirements for emergency plan-consequences of vented accident progression ning.

bins are not necessarily minor. The results displayed in Figures 4.9 and 4.10 are discussed in Chapter 11.

4.5 Offsite Consequence Results 4.6 Public Risk Estimates Figures 4.9 and 4.10 display the frequency distri-butions in the form of graphical plots of the com- 4.6.1 Results of Public Risk Estimates plementary cumulative distribution functions A detailed description of the results of the Peach (CCDFs) of four offsite consequence measures- Bottom risk is provided in Reference 4.2. For this early fatalities, latent cancer fatalities, and the 50-mile and entire site region population expo- summary report, results are provided for the fol-lowing measures of public risk:

sures (in person-rems). The CCDFs in Figures 4.9 and 4.10 include contributions from all source

• Early fatality risk, terms associated with reactor accidents caused by the internal initiating events and fire, respectively.

• Latent cancer fatality risk, Four CCDFs, namely, the 5th percentile, 50th Population dose within 50 miles of the site, percentile (median), 95th percentile, and the 0 a Population dose within the entire site region, mean CCDFs, are shown for each consequence measure. S Individual early fatality risk in the population within 1 mile of the Peach Bottom exclusion Peach Bottom plant-specific and site-specific pa- area boundary, and rameters were used in the consequence analysis

• Individual latent cancer fatality risk in the popu-for these CCDFs. The plant-specific parameters lation within 10 miles of the site.

NUREG-1 150 4-18

-1Z .OE-03 .1.0E- O Percentile Z5 1.OE ^04 *--- 5th I .OE-04 c - Mean

.Op-os e.OE-05

- 1.OE-o8 0E 1,

I.OE-07 I.OE-07 e <D P *rentil" 1.OE-08 , l.OE-08 -- Wh tO (U~~~~~~~~~~~~~~~~~~~~~~~~~~~~t 1 .OE-OO ' 1.OE-O9 - 60th oV \ o --- btn \\

w** 0 OE.. .O

• .OE-1.OEOO 1.OE+O t.OE*02 1.OE*03 1.OE.04 .OE+O5 I.OE.OO .OE*O1 1.OE*02 1.OE*03 .OEO 1.OE-05 .OE-oe Early Fatalities Latent Cancer Fatalities 0~~~~ t .oE-03 ^ .OE -03 r t.OE-04 .E.

C.) 0~~~~~~~~~~~~~~~~~~~~~~~~~~~~~a

- 1.oE-05 . -. 15..-

'L Cr IL.

Or~~~~~~~~~~~~~EPerCentilEe \ 0 l.OE-07 \.oE-08 tL ~~Percentile \ LPtetls\it

• D -- eatnt \ 0 1.OE-O8 -- 5th 0\

• 1.0E-08 0 'I(Dt C _~- Mean  : ,en\1 I .OE-O - 60th a) t.OE-0 - Both 0 1 S' 5th .6th . o 1.-.OE- 10 , i.oE- 10 z l.OE400 1.OE'02 IOE-04 I.OE*00 1OE.OB .OE*o0 1.OE.02 I.OE-04 1.OE-*0 t.oE-08' C~ Population Dose (person-rem) to -50 Miles Population Dose (person-rem) o -Entire Region D Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.9 Frequency distributions of offsite consequence measures at Peach Bottom (internal initiators).

z t

0 I.OE-03 I.OE-0Og C

t.OE- 10 i.OE-01 1.OE.02 1.01F.03 I ng.nA I = -

1.0110.o wavev; 05 Early Fatalltles C 1.OE-03 firI I .OE- 04 0

! 1.0E-05

• I-OB0 Z; 1.OE-07 0

CD 0 1 CE-08 to 0D - -- Oth 0 1OE-09 -601h

-. th a): OE0 I.OE- 10 l.OF- t.

IOE*OO 1.OE. 02 I.OE.04 tOE.Oe I.OE.oe W.E 0 l o0E-O l.OEO 1;oE0

.08 POPUlation C)ose (perSon-rem) to -0 Miles Population Dose (porson-rom) to -Entire Region Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.10 Frequency distributions of offsite consequence measures at Peach Bottom (fire initiators).

4. Peach Bottom Plant Results The first four of the above measures are com- whereas, as explained in Chapter 2, the seismic monly used measures in nuclear power plant risk analysis has been conducted up to containment studies. The last two are those used to compare performance. Sensitivity analyses of seismic risk at with the NRC safety goals (Ref. 4.10). Peach Bottom are provided in Reference 4.2.

4.6.1.1 Internally Initiated Accident Results of fire risk analysis (variabilities in mean Sequences risks estimated from the meteorology-averaged conditional mean values of the consequence The results of the risk studies using the above measures) of Peach Bottom are shown in Figures measures are shown in Figures 4.11 through 4.13. 4.16 through 4.18 for early fatality, latent cancer The figures display the variabilities in mean risks fatality, population dose (within 50 miles of the estimated from the meteorology-averaged condi- site and within the entire site region), and individ-tional mean values of the consequence measures. ual early and latent cancer fatality risks. Major For the first two measures, the results of the first contributions to early and latent cancer fatality risk study of Peach Bottom, the Reactor Safety risks are shown in Figure 4.19. As can be seen, Study (Ref. 4.3), are also provided. As may be early and latent cancer fatality risks for fire at seen, the early fatality risk from Peach Bottom is Peach Bottom are dominated by early contain-estimated to be very low. Latent cancer fatality ment failure and drywell failure caused by drywell risks are lower than those of the Reactor Safety meltthrough and loads at vessel breach. Other risk Study. The risks of population dose and individual measures are slightly higher than those for inter-early fatality risk are also very low, and the indi- nally initiated events but well below NRC safety vidual latent cancer fatality risk is orders of mag- goals.

nitude lower than the NRC safety goals. These comparisons are discussed in more detail in Chap- 4.6.2 Important Plant Characteristics (Risk) ter 12.

The risk from the internal events are driven by The risk results shown in Figure 4.11 have been long-term station blackout (SBO) and anticipated analyzed to determine the relative contributions of transients without scram (ATWS). The domi-plant damage states and accident progression bins nance of these two plant damage states can be at-to mean risk. The results of this analysis are pro- tributed to both general BWR characteristics and vided in Figures 4.14 and 4.15. As can be seen plant-specific design. BWRs in general have more from these figures, and from the supporting docu- redundant systems that can inject into the reactor ment (Ref. 4.2), the major contributors to both vessel than PWRs and can readily go to low pres-early and latent cancer fatality risks are from sta- sure and use their low-pressure injection systems.

tion blackout (SBO) and anticipated transients This means that the dominant plant damage states without scram (ATWS). The dominant accident will be driven by events that fail a multitude of progression bins are early containment failure and systems (i.e., reduce the redundancy through drywell failure caused by drywell meltthrough and some common-mode or support system failure) or loads at vessel breach (due to direct containment events that only require a small number of systems heating, steam blowdown, or quasistatic pressure to fail in order to reach core damage. The station from steam explosion). blackout plant damage state satisfies the first of these requirements in that all systems ultimately 4.6.1.2 Externally Initiated Accident depend upon ac power, and a loss of offsite power Sequences is a relatively high probability event. The total probability of losing ac power long enough to in-As discussed in Section 4.2.1.2, the Peach Bot- duce core damage is relatively high, although still tom plant has been analyzed for two externally low for a plant with Peach Bottom's design. The initiated accidents: earthquakes and fire. The fire ATWS scenario is driven by the small number of risk analysis has been performed through the esti- systems that are needed to fail and the high stress mates for consequences and risk measures, upon the operators in these sequences.

4-21 NUREG-1 150

4. Peach Bottom Plant Results 1 -4 10 10

)10' l-So 0 10 1 -r1 Number of LHS Observations Key: M = mean m = median th = percentile 10 *;

RSS 95, 10-M. -I 5th 6th..

Number of LHS Observations Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.11 Early and latent cancer fatality risks at Peach Bottom (internal initiators).

NUREG-1150 4-22

4. Peach Bottom Plant Results 0

C:)

9'th C)

~Id 0

a)

Is 0

I i.m Sty, I

Number of LHS Observations Key: M - mean m = median th percentile 01-4 P4 1OG 95th, o

M 4.

d 0

t" 4.

~5IJ Number of LHS Observations Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.12 Population dose risks at Peach Bottom (internal initiators).

4-23 NUREG-1 150

4. Peach Bottom Plant Results 1- 1 -- - - -

>,-Safety Goal Mt10-'

0

R I

t10-1 I

4 la 0

I

-1 L

• X 10- I

<IXE-12I2 l-Is Number of LHS Observations 101 Key: M = mean m = median th = percentile

,..Safety Goal

&1i0 C) t)

1-4 0

t 5th.

10 S Number of LHS Observations Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.13 Individual early and latent cancer fatality risks at Peach Bottom (internal initiators).

NUREG-1 150 4-24

4. Peach Bottom Plant Results PEACH BOTTOM PEACH BOTTOM EARLY FATALITY LATENT CANCER FATALITY MEAN

• 2.0E-S/RY VEAN

• 4.SE-S/RY 2

1 1 4 4 3 Plant Damage State A ._ 3

1. LOCA

2. 80

3. ATWS

4. TRiANBIENTS Figure 4.14 Major contributors (plant damage states) to mean early and latent cancer fatality risks at Peach Bottom (internal initiators).

PEACH BOTTOM PEACH BOTTOM EARLY FATALITY LATENT CANCER FATALITY MEAN

• 2.6E-i/1Y MEAN

• 4.$E-SRY 1

7 6yj 6 4 4 Accident Progression Bins

1. VSt ECF. WW Failure. V Pru>200 pal. at VS S. VS. ECF. WW Failure, V Proeaa200 pal& at VS S VS. ECF. DW Failure. V Preo.'200 pale at Vs

4. V ECF. DW Failure, V Pream200 ple at VD S. VS. Late CF. WW Failure S. VD. Late CF. DW Failure

7. Va. Vent 8, Vs. No CF

9. No Va Figure 4.15 Major contributors (accident progression bins) to mean early and latent cancer fatality risks at Peach Bottom (internal initiators).

4-25 NUREG-1 150

4. Peach Bottom Plant Results Irod 3

.V 95th 10 -

0 lo' :

10' lo1 lo' e Number of LHS Observations Key: M = mean m = median th= percentile I!

10~

9th .

10 "IN 0I 4

0-45

.0 4

0 Number of LHS Observations Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.16 Early and latent cancer fatality risks at Peach Bottom (fire initiators).

NUREG-1 150 4-26

4. Peach Bottom Plant Results 4102 95th oam idE M

0 0

10 fth.

0 a10°-

Number of LHS Observations Key: M - mean m - median th - percentile 0

a 4

• I~~~~~~~~~~~~~~~~~~~~~

0 95tih 04 oa} in.

° 10

.° 10~

0 5th .

Number of LHS Observations Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.17 Population dose risks at Peach Bottom (fire initiators).

4-27 NUREG-1150

4. Peach Bottom Plant Results In V

0 10-"

C A '-13, l-5th, Number of LHS Observations Key: }1= mean m = median th = percentile 10 I 0

-4 95thb 4

0 P,

m.

0

.1 0

5th ,

Number of LHS Observations Note: As discussed in Reference 4.4, estimated risks at orbelow E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.18 Individual early and latent cancer fatality risks at Peach Bottom (fire initiators).

NUREG-1 150 4-28

4. Peach Bottom Plant Results PEACH BOTTOM PEACH BOTTOM EARLY FATALITY LATENT CANCER FATALITY (FIRE) (FIRE)

MEAN

• 3.SE-7/RY MEAN - 34E-2tRY 3 3

[1 6

4 Accident Progression Bins

1. V8, ECF, WW Failure, V Pr esi200 pia at VS

2. V, CF, WW Failure, V Proaa200 pi at VB

3. VB, ECF, W Failure, V Pre*i*200 pla t VB

4. V. ECF, DW Failure, V Preaec200 pla at VS S. B, Late CF, WW Failure S. V. Late CF, DW Failure

7. V, Vent S. VB, No CF

9. No VS Figure 4.19 Major contributors (accident progression bins) to mean early and latent cancer fatality risks at Peach Bottom (fire initiators).

4-29 NUREG-1 150

4. Peach Bottom Plant Results REFERENCES FOR CHAPTER 4 4.1 A. M. Kolaczkowski et al., "Analysis of CR-5250, Vols. 1-8, UCID-21517, January Core Damage Frequency: Peach Bottom 1989.

Unit 2," Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Revision 1, 4.6 Seismicity Owners Group and Electric Power SAND86-2084, August 1989. Research Institute, "Seismic Hazard Meth-odology for the Central and Eastern United 4.2 A. C. Payne, Jr., et al., "Evaluation of Se- States," EPRI NP-4726, July 1986.

vere Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/ 4.7 A. D. Swain III, "Accident Sequence Evalu-CR-4551, Vol. 4, Draft Revision 1, ation Program-Human Reliability Analysis SAND86-1309, to be published.' Procedure," Sandia National Laboratories, NUREG/CR-4772, SAND86-1996, Febru-4.3 USNRC, "Reactor Safety Study-An Assess- ary 1987.

ment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400 4.8 W. J. Luckas, Jr., "A Human Reliability (NUREG-75/014), October 1975. Analysis for the ATWS Accident Sequence with MSIV Closure at the Peach Bottom 4.4 H. J. C. Kouts et al., "Special Committee Atomic Power Station," Brookhaven Na-Review of the Nuclear Regulatory Commis- tional Laboratory, May 1986.

sion's Severe Accident Risks Report (NUREG- 1150)," NUREG-1420, August 4.9 Philadelphia Electric Company, "Evacuation 1990. Time Estimates with the Plume Exposure Pathway Emergency Planning Zone for the 4.5 D. L. Bernreuter et al., "Seismic Hazard Peach Bottom Atomic Power Station," Rev.

Characterization of 69 Nuclear Power Sites 0, July 1982.

East of the Rocky Mountains," Lawrence Livermore National Laboratory, NUREG/ 4.10 USNRC, "Safety Goals for the Operation of Nuclear Power Plants; Policy Statement,"

• Available in the NRC Public Document Room, 2120 L FederalRegister, Vol. 51, p. 30028, August Street NW., Washington, DC. 21, 1986.

NUREG-1150 4-30

5. SEQUOYAH PLANT RESULTS 5.1 Summary Design Information

• Transients other than station blackout and ATWS, and The Sequoyah Nuclear Power Plant is a two-unit site. Each unit, designed by Westinghouse Corpo-

• Interfacing-system LOCA and steam genera-ration, is a four-loop pressurized water reactor tor tube rupture (bypass accidents).

(PWR) rated at 1148 MWe and is housed in an ice condenser containment. The balance of plant The relative contributions of these groups to the systems were engineered and built by the utility, total mean core damage frequency at Sequoyah is the Tennessee Valley Authority. Sequoyah 1 shown in Figure 5.3. It is seen that loss-of-coolant started commercial operation in 1981. Some im- accidents as a group are the largest contributors to portant design features of the Sequoyah plant are core damage frequency. Within the general class described in Table 5.1. A general plant schematic of loss-of-coolant accidents, the most probable is provided in Figure 5.1. combinations of failures are:

• Intermediate (2" < D < 6"), small (1/2 < D <

This chapter provides a summary of the results 2"), and very small (D < 1/2") size LOCAs obtained in the detailed risk analyses underlying in the reactor coolant system piping followed this report (Refs. 5.1 and 5.2). A discussion of by failure of high-pressure or low-pressure perspectives with respect to these results is pro- emergency coolant recirculation from the vided in Chapters 8 through 12. containment sump. Coolant recirculation from the containment sump can fail because 5.2 Core Damage Frequency Estimates of valve failures, pump failures, plugging of drains or strainers, or operator failure to cor-5.2.1 Summary of Core Damage Frequency rectly reconfigure the emergency core cooling Estimates system (ECCS) equipment for the recircula-tion mode of operation.

The core damage frequency and risk analyses per-formed for this study considered accidents initi- Station blackout sequences as a group are the sec-ated only by internal events (Ref. 5.1); no ond largest contributor to core damage frequency.

external-event analyses were performed. The core Within this group, the most probable combina-damage frequency results obtained are provided tions of failures are:

in tabular form in Table 5.2 and in graphical form, displayed as a histogram, in Figure 5.2

• Station blackout with failure of the auxiliary (Section 2.2.2 discusses histogram development). feedwater (AFW) system. Core uncovery is This study calculated a total median core damage caused by failure of the AFW system to pro-frequency from internal events of 3.7E-5 per vide steam generator feed flow, thus causing year. gradual heatup and boiloff of reactor cool-ant. Station blackout also results in the un-availability of the high-pressure injection sys-5.2.1.1 Internally Initiated Accident tems for feed and bleed. The dominant Sequences contributors to this sequence are the station Twenty-three individual accident sequences were blackout followed by initial turbine-driven identified as important to the core damage fre- AFW pump unavailability due to mechanical quency estimates for Sequoyah. A detailed de- failure or maintenance outage, or failure of scription of these accident sequences is provided the operator to open air-operated valves after in Reference 5.1. For the purpose of discussion depletion of the instrument air supply.

here, the accident sequences have been grouped

• Station blackout with initial AFW operation into five summary plant damage states. These are: that fails at a later time because of battery depletion or station blackout, with reactor

• Station blackout, coolant pump (RCP) seal LOCA because of loss of all RCP seal cooling. Station blackout

• Loss-of-coolant accidents (LOCAs), results in a loss of seal injection flow to the RCPs and a loss of component cooling water

• Anticipated transients without scram to the RCP thermal barriers. This condition (ATWS), results in vulnerability of the RCP seals to 5-1 NUREG-1 150

5. Sequoyah Plant Results Table S.1 Summary of design features: Sequoyah Unit 1.

1. Coolant Injection System a. Charging system provides safety injection flow, emergency boration, feed and bleed cooling, and normal seal injection flow to the RCPs,* with 2 centrifugal pumps.

b. RHR system provides low-pressure emergency coolant injection and recirculation following LOCA, with 2 trains and 2 pumps.

c. Safety injection system provides high head safety injection and feed and bleed cooling, with 2 trains and 2 pumps.

2. Steam Generator Heat Removal Systems a. Power conversion system.

b. Auxiliary feedwater system, with 3 trains and 3 pumps (2 MDPs, 1 TDP).*

3. Reactivity Control Systems a. Control rods.

b. Chemical and volume control systems.

4. Key Support Systems a. dc power, with 2-hour station batteries.

b. Emergency ac power, with 2 diesel generators for each unit, each diesel generator dedicated to a 6.9 kV emer-gency bus (these buses can be crosstied to each other via a shutdown utility bus).

c. Component cooling water provides cooling water to RCP*

thermal barriers and selected ECCS equipment, with 5 pumps and 3 heat exchangers for both Units 1 and 2.

d. Service water system, with 8 self-cooled pumps for both Units 1 and 2.

5. Containment Structure a. Ice condenser.

b. 1.2 million cubic feet.

c. 10.8 psig design pressure.

6. Containment Systems a. Spray system provides containment pressure-suppression during the injection phase following a LOCA and also provides containment heat removal during the recircula-tion phase following a LOCA.

b. System of igniters installed to burn hydrogen.

c. Air-return fans to circulate atmosphere through the ice condenser and keep containment atmosphere well mixed.

• MDP: Motor-Driven Pump TDP: Turbine-Driven Pump RCP: Reactor Coolant Pump NUREG-1 150 5-2

(A I

U, C

TR

'Typical of each Cold Leg Loop 0

z tI 0'

Figure 5.1 Sequoyah plant schematic.

5. Sequoyah Plant Results Table 5.2 Summary of core damage frequency results: Sequoyah.*

5% Median Mean 95%

Internal Events 1.2E-5 3.7E-5 5.7E-5 1.8E-4 Station Blackout Short Term 4.2E-7 3.8E-6 9.6E-6 3.6E-5 Long Term 1.OE-7 1.4E-6 5.OE-6 1.7E-5 ATWS 4.3E-8 5.3E-7 1.9E-6 7.SE-6 Transient 2.5E-7 1.1E-6 2.6E-6 7.2E-6 LOCA 4.4E-6 1.8E-5 3.6E-5 1.2E-4 Interfacing LOCA 1.5E-11 2.OE-8 6.5E-7 2. 1E-6 SGTR 2.4E-8 4.1E-7 1.7E-6 7.1E-6

• As discussed in Reference 5.3, core damage frequencies below 1E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

_- - Core Damage Frequency (per RY) 95th -

1.OE-04 Mean Median 5th -

1.OE-05 1.OE-06 Number of LHS samples Note: As discussed in Reference 5.3, core damage frequencies below E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

Figure 5.2 Internal core damage frequency results at Sequoyah.

NUREG-1 150 5-4

5. Sequoyah Plant Results Transients

.N,.i..

Bypass (nt. Sys. LOCA/SGTR)

ATWS Station Blackout Total Mean Core Damage Frequency: .7E-5 Figure 5.3 Contributors to mean core damage frequency from internal events at Sequoyah.

failure. The failure to restore ac power and generator safety valve will be demanded if safety injection flow following any seal LOCA the power-operated relief valve is blocked.

leads to core uncovery. The time to core un- Subsequent failure of the PORV or safety covery following onset of a seal LOCA is a valve to reclose leads to direct loss of RCS function of the leak rate and whether or not inventory to the atmosphere. Failure of sub-the operator takes action to depressurize the sequent efforts to recover the sequence by reactor coolant system. RCS depressurization or closure of the PORV or safety valve leads to refueling water stor-Within the general group of containment bypass age tank inventory depletion and eventual accidents, the more probable combinations of fail- core uncovery.

ure are:

• Failure of RCS pressure isolation leading to 0 Steam generator tube rupture, followed by LOCAs in systems interfacing with the reac-failure to depressurize the reactor coolant tor coolant system (by overpressurization of system (RCS). Subsequent failure to depres- low-pressure piping in the interfacing sys-surize the RCS in the long term and thus limit tem). These sequences comprise 2 percent of RCS leakage leads to continued blowdown the total core damage frequency but are im-through the steam generator and eventual portant contributors to risk because they cre-core uncovery. An important event in this se- ate a direct release path to the environment.

quence is the initial failure of the operator to These accidents are of special interest be-depressurize within 45 minutes after the tube cause they prevent ECCS operation in the rupture. This leads to a relief valve demand recirculation mode and lead to containment in the secondary cooling system. The steam bypass.

5-5 NUREG-1150

5. Sequoyah Plant Results 5.2.2 Important Plant Characteristics (Core check valves used to isolate the high-pressure Damage Frequency) RCS from the low-pressure injection system.

The resultant flow into the low-pressure sys-Characteristics of the Sequoyah plant design and tem is assumed to result in rupture of the operation that have been found to be important in low-pressure piping or components outside the analysis of core damage frequency include: the containment boundary. Although core in-ventory makeup by the high-pressure injec-

1. Electric Power Crossconnects Between tion system is initially available, the inability Units 1 and 2 to switch to the recirculation mode would eventually lead to core damage. Because of The Sequoyah electric power system design the location of the postulated LOCA, all con-includes the capability to crosstie the 6.9 kV tainment safeguards are bypassed.

emergency buses at Unit 1 and Unit 2 and includes the capability to energize dc battery The failure scenarios of interest are those boards at Unit 1 from the batteries at Unit 2. that produce a sudden large backleakage These crossties help reduce the frequency of from the RCS that cannot be accommodated station blackout at Unit 1 and significantly by relief valves in the low-pressure systems.

reduce the possibility of battery depletion as Interfacing-system LOCA could therefore oc-an important contributor for those station cur in two ways:

blackouts that are postulated to occur. The crossties reduce the station blackout core a. Random or dependent rupture of valve damage frequency by less than a factor of 2. internals on both valves. Rupture of the As station blackout sequences only account upstream valve would go undetected un-for 20 percent of the total core damage fre- til rupture of the second valve occurred, quency, the crossties reduce total core dam- and age frequency by approximately 10 percent. b. Rupture of the downstream valve com-bined with the failure of the upstream

2. Transfer to Emergency Core Cooling and valve to be closed on demand. This sce-Containment Spray System Recirculation nario has an extremely low probability at Mode Sequoyah because the check valve test-ing procedures require leak rate testing The process for switching the emergency core after each valve use.

cooling system and the containment spray system from the injection mode to the recir- If an interfacing-system LOCA should occur, culation mode at Sequoyah involves a series a potential recovery action was identified and of operator actions that must be accom- considered in the analysis in which the op-plished in a relatively short time (20 min- erator may be able to isolate the interfacing-utes) and are only partially automated. system LOCA by closing the appropriate low-Therefore, operator action is required to pressure injection cold leg isolation valve.

maintain core cooling when switching over to the recirculation mode. Single operator er- 4. Diesel Generators rors during switchover from injection to recir- Sequoyah is a two-unit site with four diesel culation following a small LOCA can lead di- generator units. Each diesel is dedicated to a rectly to core uncovery. Recirculation failure particular (6.9 kV) emergency bus at one of can also result from common-cause failures the units. Each diesel generator can only be affecting the entire emergency core cooling connected to its dedicated emergency bus.

system and containment spray system. These However, the 6.9 kV buses can be crosstied failures include level sensor miscalibration to each other through the use of the shut-for the refueling water storage tank and fail- down utility bus, thus providing an indirect ure to remove the upper containment com- way to crosstie diesels and emergency buses.

partment drain plugs after refueling. The diesel generators have dedicated batter-ies for starting and can be loaded on the

3. Loss of Coolant from Interfacing-System emergency buses manually or with alternative LOCA power supplies. Emergency ac power is there-fore not as susceptible to failures of the sta-Interfacing-system LOCA results from fail- tion batteries as at those plants where station ures of any one of the four pairs of series batteries are used for diesel startup.

NUREG-1150 5-6

5. Sequoyah Plant Results S. Containment Design ing if the event is actually a LOCA and antici-pating whether high-pressure recirculation will The ice condenser containment design is im- be needed when the low RWST level alarm is portant to estimates of core damage fre- actuated.

quency because of the spray actuation set-points. The relatively low-pressure setpoints

• Feed and bleed cooling result in spray actuation for a significant per-centage of small LOCAs. The operation of For accident sequences in which main and the sprays will deplete the refueling water auxiliary feedwater are unavailable, feed and storage tank (RWST) in approximately 20 bleed cooling can be used to remove decay minutes, thus requiring fast operator inter- heat from the core. The operator is in-vention to switch over to recirculation mode. structed to initiate feed and bleed cooling if The reduced time available for operator ac- steam generator levels drop below 25 per-tion results in an increased human error rate cent. This point is reached approximately 30 for recirculation alignment associated with minutes after auxiliary feedwater (AFW) and this time interval. main feedwater become unavailable.

5.2.3 Important Operator Actions

• Anticipated transients without scram (ATWS)

Several operator actions are very important in preventing core uncovery. These actions are Five operator actions could potentially be re-discussed in this section with respect to the acci- quired during an ATWS sequence, depend-dent sequence in which they occur. ing on the particular course of the sequence.

These events are:

• Switchover to ECCS recirculation in a small LOCA - Manual reactor trip.

There are four major operator actions during - Trip turbine if not done automatically.

recirculation switchover:

- Start AFW if not started automatically.

- Switchover of high-pressure emergency core cooling system (ECCS) from injec- - Open block valve on power-operated tion to recirculation. relief valve (PORV) within 2 minutes if PORV is isolated previous to initiating

- Isolation of ECCS suction from RWST. event.

- Switchover of containment spray system - Emergency boration, if manual trip (CSS) from injection to recirculation, failed.

including isolation of suction from the RWST. Due to the fast-acting nature of an ATWS, all ATWS actions must be performed from

- Valving in component cooling water memory.

(CCW) to the residual heat removal (RHR) heat exchangers.

• Steam generator tube rupture

• Control of containment sprays during small Steam generator tube rupture (SGTR) acci-LOCAs dent sequences are considered to begin with a double-ended rupture of a single steam Virtually all small LOCAs will result in auto- generator tube. Very shortly thereafter, a matic containment spray actuation. If the op- safety injection signal will occur on low RCS erator does not control sprays early during a pressure. The immediate concern for the op-small LOCA, the RWST level will decrease erator, after identifying the event as an and switchover to recirculation will be re- SGTR, is to identify and isolate the ruptured quired. steam generator. There are three possible op-erator actions during an SGTR. These are:

All actions are performed in the main control room at one location. The time for diagnosis - Cool down and depressurize the RCS is relatively short (20 minutes) for determin- very shortly (45 minutes) after the 5-7 NUREG-1150

5. Sequoyah Plant Results event in order to prevent lifting the relief damage frequency if their probabilities were valves on the affected steam generator;, set to zero:

- Restore the main feedwater flow in the - Very small LOCA initiating event. The event of a loss of auxiliary feed flow; core damage frequency will be reduced and by approximately 38 percent.

- Isolate the steam generator that contains - Operator fails to control sprays during a the ruptured tube. small LOCA. The core damage fre-quency will be reduced by approxi-

• Interfacing-system LOCA recovery action mately 37 percent.

- Loss of offsite power initiating event.

The two RHR trains are physically isolated The core damage frequency will be re-from each other and are provided with sys- duced by approximately 21 percent.

tem isolation capability. To recover from an interfacing-system LOCA in the RHR system and to continue core cooling, the break must - Operator failure to properly align high-first be isolated and the reactor coolant pressure recirculation. The core damage system refilled. Since the RHR valves are not frequency will be reduced by approxi-designed to close against the pressure mately 15 to 20 percent.

differentials present during the blowdown, isolation of the affected loop and operation - Failure to recover diesel generators of the unaffected loop must be accomplished within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The core damage fre-following blowdown. The RHR valves can be quency will be reduced by approxi-closed from the control room. No credit for mately 14 percent.

local action is given because of the steam en-vironment following the blowdown. - Failure to recover ac power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The core damage frequency will be reduced by approximately 13 per-5.2.4 Important Individual Events and cent.

Uncertainties (Core Damage Frequency)

- Intermediate LOCA initiating events.

As discussed in Chapter 2, the process of develop- The core damage frequency will be re-ing a probabilistic model of a nuclear power plant duced by approximately 12 percent.

involves the combination of many individual events (initiators, hardware failures, operator er- - Small LOCA initiating events. The core rors, etc.) into accident sequences and eventually damage frequency will be reduced by into an estimate of the total frequency of core approximately 13 percent.

damage. After development, such a model can also be used to assess the importance of the indi-

• Uncertainty importance measure (internal vidual events. The detailed studies underlying this events) report have been analyzed using several event im-portance measures. The results of the analyses us-ing two measures, "risk reduction" and "uncer- A second importance measure used to evalu-tainty" importance, are summarized below. ate the core damage frequency analysis re-sults is the uncertainty importance measure.

For this measure, the relative contribution of

• Risk (core damage frequency) reduction im- the uncertainty of individual events to the portance measure (internal events) uncertainty in total core damage frequency is calculated. Using this measure, the largest The risk-reduction importance measure is contributors to uncertainty in the results are used to assess the change in core damage fre- the human error probabilities for failure to quency as a result of setting the probability of reconfigure the ECCS for high-pressure recir-an individual event to zero. Using this meas- culation. All other events contribute rela-ure, the following individual events were tively little to the uncertainty in overall core found to cause the greatest reduction in core damage frequency.

NUREG-1 150 5-8

5. Sequoyah Plant Results 5.3 Containment Performance Analysis ment failure due to effects such as hydrogen combustion, direct containment heating, and wall 5.3.1 Results of Containment Performance contact failure is 0.07, (2) late containment fail-Analysis ure due primarily to basemat meltthrough is 0.21, (3) containment bypass is 0.06, and (4) probabil-The Sequoyah primary containment consists of a ity of no containment failure or no vessel breach is pressure-suppression containment system, i.e., ice 0.66. It should be noted, however, that the condi-condenser, which houses the reactor pressure ves- tional probabilities of early containment failure for sel, reactor coolant system, and the steam genera- the loss of offsite power (LOSP) plant damage tors for the secondary side steam supply system. state are considerably higher than the averaged The containment system is comprised of a steel values, i.e., about 0.13 for LOSP sequences in-vessel surrounded by a concrete shield building volving vessel breach and 0.17 when those LOSP enclosing an annular space. The internal contain- sequences having no vessel breach are included.

ment volume, which has a total capacity of 1.2 Figure 5.5 further develops the conditional prob-million cubic feet, is divided into two major com- ability distribution of early containment failure for partments connected by the ice condenser system, each of the plant damage states, providing the es-with the reactor coolant system occupying the timated range of uncertainties in the containment lower compartment. The ice condenser is essen- failure predictions. Overall conclusions that can tially a cold storage ice-filled room 50 feet in be drawn from this information are discussed in height, bounded on one side by the steel contain- Chapter 9. However, it should be noted that Se-ment wall. The design basis pressure for quoyah's early containment failure probability de-Sequoyah's ice condenser containment is 10.8 pends heavily on the accuracy of our predictions psig, whereas its estimated mean failure pressure of core arrest probability, direct containment is 65 psig. This low-pressure design combined with heating, hydrogen combustion, and wall attack ef-the relatively small free volume made hydrogen fects.

control a design basis consideration, i.e.,

recombiners, and also a major consideration with Additional discussions on containment perform-respect to containment integrity for severe acci- ance (for all studied plants) are provided in Chap-dents, i.e., igniters and air-return fans. Similar to ter 9.

other containment design analyses for this study, the estimate of where and when Sequoyah's con- 5.3.2 Important Plant Characteristics (Containment Performance) tainment will fail relied heavily on the use of ex-pert judgment to interpret and supplement the Characteristics of the Sequoyah design and opera-limited data available (Ref. 5.4). tion that are important to containment perform-ance include:

The potential for early containment failure has been of considerable concern for Sequoyah since 1. Pressure-Suppression Design the steel containment has such a low design pres-sure. The principal mechanisms threatening the The Sequoyah ice condenser suppression de-containment are hydrogen combustion effects, sign can have a significant effect on certain overpressurization due to direct containment heat- accident sequence risk results. For example, ing, failure of the wall by direct contact with mol- the availability of ice in the ice condenser ten core material, and isolation failures. can reduce the risk significantly from events involving steam or direct containment heating The results of the Sequoyah containment analysis threats to the containment. In contrast, its are summarized in Figures 5.4 and 5.5. Figure 5.4 availability during some station blackout se-displays information in which the conditional quences can result in a potentially combusti-probabilities of ten containment-related accident ble hydrogen concentration at the exit of the progression bins; e.g., VB-early CF (during CD), ice bed. Further discussion of the ice con-are presented for each of five plant damage states. denser pressure-suppression system relative This information indicates that, on a frequency- to other PWR dry containments is contained weighted average,

• the mean conditional prob- in Chapter 9.

ability from internal events of (1) early contain-

2. Hydrogen Ignition System

• Each value in the column in Figure 5.4 labeled "All" is obtained by calculating the products of individual acci- The Sequoyah hydrogen ignition system will dent progression bin conditional probabilities for each plant damage state and the ratio of the frequency of that significantly reduce the threat to containment plant damage state to the total core damage frequency. from uncontrolled hydrogen combustion 5-9 NUREG-1 150

CA QI PLANT DAMAGE STATE c ACCIDENT (Mean Core Damage Frequency) zr PROGRESSION BIN LOSP ATWS Transients LOCAs Byass All (1.3BE-05) (2.07E-06) (2.32E-06) (3.52E-05) (2.3 E-06) (5.58E-05) 0.005 VB, early CF 0.014 0.003 0.002 0.005 g:

(during CD)

VB. alpha, 0.002 10.002 1 0.002 early CF (at VB)

VB > 200 psi, B0.064 10.014 0.031 80.035 early CE (at VB)

VB < 200 psi, B0.054 10.004 0.014 1 0.023 early CF (at VB)

VB, late CF 10.001 110.038 C

] 0.153 VB, BMT, very late CF 0.065 I. 1D0.039 D0.260 L 0.171 Bypass 10.001 I 0.134 10.006 B0.056 LIII VB, No CF D 0.200 D-1 0.471 H 0.137 11 0.301 _ 0.269 No VB, early CF 0.038 10.001 10.002 1 0.011 (during CD) 10.005 No VB 0.384 01100367 F] 0.371 D: n 0.171 BMT = Basemat Meltthrough CF = Containment Fbilure VB = Vessel Breach CD = Core Degradation Figure 5.4 Conditional probability of accident progression bins at Sequoyah.

.EO 95th, I A1.

I E-1 Mi-1.E-2_- M *.

O 0

Q ° 1.E I.

V X (a

5th-,

co 5th..

1.E O 1.E-5_

co M = mean 0 m = median th percentile >

z w

I<

Z, tTI PDS Group LOSP ATWS Transients LOCAs Bypass All 0 Core Damage Freq. 1.4E-05 2.1E-06 2.SE-06 3.5E-05 2.4E-06 5.6E-05 Figure 5.5 Conditional probability distributions for early containment failure at Sequoyah.

5. Sequoyah Plant Results effects except for station blackout sequences. In most accident sequences for Sequoyah, there is However, when power is recovered following substantial water in the cavity that can either pre-a station blackout, if the igniters are turned vent core-concrete attack, if a coolable debris bed on before the air-retum fans have diluted the is formed, or mitigate the release of radionuclides hydrogen concentration at or above the ice during core-concrete attack by scrubbing in the beds, the ignition could trigger a detonation overlaying water pool. As a result, a large release or deflagration that could fail containment. to the environment of the less volatile radionu-These blackout sequences, however, repre- clides that are released from fuel during core-sent a small fraction of the overall frequency concrete attack is unlikely for the Sequoyah plant.

of core damage.

In the station blackout plant damage state, con-tainment failure can occur late in the accident as

3. Lower Compartment Design the result of hydrogen combustion following power.

The design and construction of the seal table recovery. Figure 5.7 illustrates the source terms is such that if the reactor coolant system is at for a late containment failure accident progression an elevated pressure upon vessel breach, the bin in which it is unlikely that water would be core debris is likely to get into the seal table available to scrub the core-concrete releases. In room, which is directly in contact with the this case, decontamination by the ice bed is im-containment, and melt through the wall caus- portant in mitigating the environmental release.

ing a break of containment. The design of As discussed previously, for very wide ranges of the reactor cavity, however, does have the uncertainty covering many orders of magnitude, potential to cool the molten core debris and one or more high results can dominate the mean also mitigate the effects of potential direct such that it falls above the 95th percentile.

containment heating events for those se- 5.4.2 Important Plant Characteristics cuences where water is in the reactor cavity. (Source Term) 5.4 Source Term Analysis 1. Ice Condenser In addition to condensing steam, the ice beds 5.4.1 Results of Source Term Analysis can trap radioactive aerosols and vapors in a The absolute frequencies of early containment severe accident. The extent of decontamina-failure from severe accident loads and of tion is very sensitive to the volume fraction of containment bypass are predicted to be similar for steam in the flowing gas, which in turn de-the Sequoyah plant (Ref.. 5.2). Figure 5.6 illus- pends on whether the air-return fans are op-trates the release fractions for an early contain- erational. For a single pass through the ice ment failure accident progression bin. The mean condenser with high steam fraction, the values for the release of the volatile radionuclide range of decontamination factor used in this groups are approximately 10 percent, indicative of study was from 1.3 to 35 with a median of 7 an accident with the potential for causing early fa- for the in-vessel release and less than half as talities. The in-vessel releases in these accidents effective for the core-concrete release. For can be subject to decontamination by the ice bed the low steam fraction scenarios with a single or by containment sprays following release to the pass through the ice beds, the lower bound containment. The sprays require ac power and was approximately 1.1, the upper bound 8, are, therefore, not available prior to power recov- and the median 2. The values used for multi-ery in station blackout plant damage states. The ple passes through the ice bed when the con-decontamination factor of the ice bed is also af- tainment is intact and the air-return fans are fected by the unavailability of the recirculation running are only slightly larger, with a me-fans during station blackout. dian value of 3. Thus, the credit for ice bed retention is substantially less than the values The location and mode of containment failure are used for the decontamination effectiveness of particularly important for early containment fail- suppression pools in the BWRs.

ure accident progression bins. A substantial frac- 2. Cavity Configuration tion of the early failures result in subsequent bypass of the ice bed. In particular, if the contain- The Sequoyah reactor cavity will be flooded ment ruptures as the result of a sudden, high- if there is sufficient water on the containment pressure load, such as from hydrogen deflagra- floor to overflow into the cavity. If the con-tion, the damage to the containment wall could be tents of the refueling water storage tank are extensive and is likely to result in bypass.

NUREG-1 150 5-12

Release Fraction 1.OE+OO 95%

mean 1.OE-O1 median 6%

1.OE-02 up w-1 1.OE-03 1.OE-04

<A (n

D PA M 0 1.OE-05 --- -- -- ...

NG I Cs Te Sr Ru La Ba Ce ZI

(-I d Radionuclide Group M

c3e OI 0 Figure 5.6 Source term distributions for early containment failure at Sequoyah.

z sz ED CD C

Mo Release Fraction 0 1.OE.O0 r_

- mean 1.OE-01 median 5%

1.E-02 1.OE-03 1.OE-04 M M2 1.OE-05 NG I Cs Te Sr Ru La Ba Ce Radionuclide Group Figure 5.7 Source term distributions for late containment failure at Sequoyah.

5. Sequoyah Plant Results discharged into the containment (e.g., by the The consequence estimates displayed in these fig-spray system) and there is substantial ice ures have incorporated the benefits of the follow-melting, the water level in the cavity can be ing protective measures: (1) evacuation of 99.5 as high as 40 feet, extending to the level of percent of the population within the 10-mile the reactor coolant system hot legs. A decon- plume exposure pathway emergency planning tamination factor for the deep water pool was zone (EPZ), (2) early relocation of the remaining used in the analyses, which ranged from ap- population only from the heavily contaminated ar-proximately 4 to 9,000 with a median value eas both within and outside the 10-mile EPZ, and of approximately 10 for the less volatile (3) decontamination, temporary interdiction, or radionuclides released ex-vessel. If neither condemnation of land, property, and foods con-source of water to the containment is avail- taminated above acceptable levels.

able, however, there will be no water in the cavity. The population density within the Sequoyah 10-mile EPZ is about 120 persons per square mile. The average delay time before evacuation

3. Spray System (after a warning prior to radionuclide release) from the 10-mile EPZ and average effective The Sequoyah containment has a spray sys- evacuation speed used in the analyses were de-tem in the upper compartment to condense rived from information contained in a utility-steam that bypasses the ice beds and for use sponsored Sequoyah evacuation time estimate after the ice has melted. As in the Surry study (Ref. 5.5) and the NRC requirements for plant, the spray system has the potential to emergency planning.

dramatically reduce the airborne concentra-tion of radioactive material if the contain- The results displayed in Figure 5.8 are discussed ment remains intact for an extended period in Chapter 11.

of time.

5.6 Public Risk Estimates 5.5 Offsite Consequence Results 5.6.1 Results of Public Risk Estimates Figure 5.8 displays the frequency distributions in A detailed description of the results of the Se-the form of graphical plots of the complementary quoyah risk is provided in Reference 5.2. For this cumulative distribution functions (CCDFs) of four summary report, results are provided for the fol-offsite consequence measures-early fatalities, la- lowing measures of public risk:

tent cancer fatalities, and the 50-mile and entire site region population exposures (in person-rems).

• Early fatality risk, These CCDFs include contributions from all source terms associated with reactor accidents

• Latent cancer fatality risk, caused by internal initiating events. Four CCDFs, namely, the 5th percentile, 50th percentile (me-

• Population dose within 50 miles of the site, dian), 95th percentile, and the mean CCDFs, are shown for each consequence measure.

• Population dose within the entire site region, Sequoyah plant-specific and site-specific parame-

• Individual early fatality risk in the population ters were used in the consequence analysis for within 1 mile of the Sequoyah boundary, and these CCDFs. The plant-specific parameters in-

• Individual latent cancer fatality risk in the cluded source terms and their frequencies, the li- population within 10 miles of the Sequoyah censed thermal power (3423 MWt) of the reactor, site.

and the appropriate physical dimensions of the power plant building complex. The site-specific The first four of the above measures are com-parameters included exclusion area radius (585 monly used measures in nuclear power plant risk meters), meteorological data for 1 full year col- studies. The last two are those used to compare lected at the site meteorological tower, the site re- with the NRC safety goals (Ref. 5.6).

gion population distribution based on the 1980 census data, topography (fraction of the area that The results of Sequoyah risk analysis using the is land-the remaining fraction is assumed to be above measures are shown in Figures 5.9 through water), land use, agricultural practice and produc- 5.11. The figures display the variabilities in mean tivity, and other economic data for up to 1,000 risks estimated from the meteorology-averaged miles from the Sequoyah plant. mean values of the consequence measures. The 5-15 NUREG-1 150

z ce Q co 0

to ZIn 1 0 C 0

co 0 0 1-

,In CO To 1 c i 0 0

-x 1. ce ci 0

C D U- 0, 1.

a

• D 0 a_

U 0

0 C

x1to to CD CD 0 4C x w Lii 11 Early Fatalities Latent Cancer Fatalities 1.OE-03 1.OE-03 co 0

> .OE-04  ;-- - ----- -- -... .. . >~

I 1.OE- 04 T

9 t.OE-06

• 1.0E-05 CD2 jD a 1.0E-0O t.OE-08

- mean^-- 0

- t.OE-07 i-~~ - -. . ,ths  :,0 1.0E-07 D 1.06-06 a~~~~ \ U-

'aD 1.OE-08 W .06-08

---~~~\ \\\

.~ ~~~

...~ __4 _ C:

co Mean 0 1.0E-09 ooth 0 , - ,h C) ul 'IJ OF- n , ..... d ..... ..... .... .... ,. S ............ __ ...-

. __ - -- l- . ...-

O.6E.00 1.oE602 t.OE-04 1oE.060 1,.0.08 1.06.00 tOE-02 .OE-04 CoE0. 1o.408 Population Dose (person-rem) to -50 Miles Populatlon Dose (person-rem) to -Entire Region Note: As discussed in Reference 5.3, estimated consequences at frequencies at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 5.8 Frequency distributions of offsite consequence measures at Sequoyah (internal initiators).

5. Sequoyah Plant Results

-a g9ih.

10 1C4 0

4)

IN

,10 10-a. a Number of LHS Observations Key: M = mean m = median th = percentile f:N 95t-h .

M -a 10 14 13 Number of LHS Observations Note: As discussed in Reference 5.3, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 5.9 Early and latent cancer fatality risks at Sequoyah (internal initiators).

5-17 NUREG-1 150

5. Sequoyah Plant Results o0 951..h -

.4 1 0

5: 5t" a,

"-4

'4 10 Number of LHS Observations Key: M = mean m = median th = percentile 0

10 95Lh, 01 0

41 0

0010 0

• 1 Number of LHS Observations Note: As discussed in Reference 5.3, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 5.10 Population dose risks at Sequoyah (internal initiators).

NUREG-1150 5-18

5. Sequoyah Plant Results 10F1

.- Safety Goal i-95ih b 10 10F 4 Number of LHS Observations pa Key: M = mean m = median

'-4 th = percentile

-. Safety Goal 10' 95th ,

C M .

5th.,

W10O Number of LHS Observations Note: As discussed in Reference 5.3, estimated risks at or below 1-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 5.11 Individual early and latent cancer fatality risks at Sequoyah (internal initiators).

5-19 NUREG-1 150

5. Sequoyah Plant Results early and latent cancer fatality risks, while quite 5.6.2 Important Plant Characteristics (Risk) low in absolute value, are higher than those from the Surry plant analysis (see Chapter 3). Other Sequoyah risk analysis indicates that bypass se-risk measure estimates are slightly higher than the quences dominate early fatality risk. Timing is a Surry estimates. The individual early fatality and key factor in this sequence in relation to evacu-latent cancer fatality risks are well below the NRC ation. The release characteristics also contribute safety goals. Detailed comparisons of results are to the large effect of early fatalities because of the provided in Chapter 12. large magnitude of unmitigated source terms and the low energy of the first release. The low energy plume is not lofted over the evacuees but is held low to the ground after release. Another class of The risk results shown in Figure 5.9 have been accidents that is important to early fatality risk is analyzed to identify the relative contributions to station blackout. It is the early containment fail-mean risk of plant damage states and accident ure (that is, failure of containment at and before progression bins. These results are presented in vessel breach) associated with this accident class Figures 5.12 and 5.13. As may be seen, the domi- that contributes to early fatality risk.

nant contributor of early fatality risk is the bypass accident group, and particularly the interfacing- An interfacing-system LOCA at Sequoyah will dis-system LOCA (the V sequence), whereas the larg- charge into the auxiliary building where decon-est contributions to the latent cancer fatality risk tamination by automatically activated fire sprays is came from the station blackout and bypass acci- likely. Neither the probability of actuation nor the dent groups. For early fatality risk, the dominant decontamination factor has been well established.

contributor to risk is from accident sequences The effects of an interfacing-system LOCA could where the containment is bypassed, whereas, for either be higher or lower than those that have latent cancer fatality risk, major accident progres- been calculated in this study.

sion bin contributors are bypass accidents and early containment failures. The accident progres- Approximately equal contributions to latent can-sion bin involving accidents with no vessel breach cer fatality risk come from station blackout and appears as a contributor to early and latent cancer bypass. The bypass sequences contribute because fatality risks. This bin possesses risk potential be- of the large source terms and the bypass of any cause of early containment failure due to hydro- mitigating systems. The only other major contribu-gen events from loss of offsite power in which ac tion to latent cancer fatality comes from the power is recovered and breach is arrested and also LOCA sequences, mainly due to containment fail-from accidents involving steam generator tube ures at vessel breach with high (> 200 psia) reac-rupture in which vessel breach is arrested. tor coolant system pressure.

NUREGi-1150 5-20

5. Sequoyah Plant Results SEQUOYAH EARLY FATALITY SEQUOYAH LATENT CANCER FATALITY-MEAN

• 2.4E-G/RY MEAN

• 1.4E-2/RY 2

4 5

Plant Damage States 5 I.t T S. TRANSIENT*

4. LOCA

6. YPAS8 Figure 5.12 Major contributors (plant damage states) to mean early and latent cancer fatality risks at Sequoyah (internal initiators).

SEQUOYAf EARLY FATALITY SEQUOYAH LATENT CANCER FATALITY MEAN 2.GE-81HY MEAN *t.4E-2RY A

9 9

Accident Progression Bins 7 t VB, CF o VD

2. V. ECF. Alpho Mode S. V. ECF. CS Presurev20 po at VD

4. VS. ECF. RCS Pteuuet2* pe t V0

6. V. Lt CF S. VS. DVT. Very Lat Lak

7. NypaoC I V. No CP S. No VD Figure 5.13 Major contributors (accident progression bins) to mean early and latent cancer fatality risks at Sequoyah (internal initiators).

5-21 51NUREG-1150

5. Sequoyah Plant Results REFERENCES FOR CHAPTER 5 5.1 R. C. Bertucio and S. R. Brown, "Analysis 5.4 T. A. Wheeler et al., "Analysis of Core of Core Damage Frequency: Sequoyah Unit Damage Frequency from Internal Events:

1," Sandia National Laboratories, NUREG/ Expert Judgment Elicitation," Sandia Na-CR-4550, Vol. 5, Revision 1, SAND86- tional Laboratories, NUREG/CR-4550, Vol.

2084, April 1990. 2, SAND86-2084, April 1989.

5.2 J. J. Gregory et al., "Evaluation of Severe 5.5 Tennessee Department of Transportation, Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, "Evacuation Time Estimates with the Plume Exposure Pathway Emergency Planning Vol. 5, Revision 1, SAND86-1309, Decem-Zone," prepared for Sequoyah Nuclear ber 1990.

Plant, June 1987.

5.3 H. J. C. Kouts et al., "Special Committee Review of the Nuclear Regulatory Commis- 5.6 USNRC, "Safety Goals for the Operation of sion's Severe Accident Risks Report Nuclear Power Plants; Policy Statement,"

(NUREG-1150)," NUREG-1420, August Federal Register, Vol. 51, p. 30028, 1990. August 21, 1986.

NUREG-1 150 5-22

6. GRAND GULF PLANT RESULTS 6.1 Summary Design Information vided into two summary plant damage states.

These are:

The Grand Gulf Nuclear Station is a General Electric boiling water reactor (BWR-6) unit of

• Station blackout, and 1250 MWe capacity housed in a Mark III con-tainment. Grand Gulf Unit 1, constructed by Be-

• Anticipated transients without scram chtel Corporation, began commercial operation in (ATWS).

July 1985 and is operated by Entergy Operations.

Some important design features of the Grand Gulf The relative contributions of these groups to mean plant are described in Table 6.1. A general plant internal-event core damage frequency at Grand schematic is provided in Figure 6.1. Gulf are shown in Figure 6.3. It may be seen that station blackout accident sequences as a class are This chapter provides a summary of the results the largest contributors to core damage frequency.

obtained in the detailed risk analyses underlying It should be noted that the plant configuration as this report (Refs. 6.1 and 6.2). A discussion of analyzed does not reflect the implementation of perspectives with respect to these results is pro- the station blackout rule.

vided in Chapters 8 through 12.

Within the general class of station blackout acci-dents, the more probable combinations of failures 6.2 Core Damage Frequency Estimates leading to core damage are:

6.2.1 Summary of Core Damage Frequency

• Loss of offsite power occurs followed by the Estimates successful cycling of the safety relief valves (SRVs). Onsite ac power fails because all The core damage frequency and risk analyses per- three diesel generators fail to start and run as formed for this study considered accidents initi- a result of either hardware or common-cause ated only by internal events (Ref. 6.1). The core faults. The loss of all ac power (i.e., station damage frequency results obtained are provided blackout) results in the loss of all core cooling in tabular form in Table 6.2 and in graphical systems (except for the reactor core isolation form, displayed as a histogram, in Figure 6.2. cooling (RCIC) system) and all containment (Section 2.2.2 discusses histogram development.) heat removal systems. The RCIC system, This study calculated a total median core damage which is ac independent, independently fails frequency from internal events of 1.2E-6 per to start and run. All core cooling is lost, and year. core damage occurs in approximately hour after offsite power is lost.

The Grand Gulf plant was previously analyzed in the Reactor Safety Study Methodology Applica-

• Station blackout accident that is similar to the tions Program (RSSMAP) (Ref. 6.3). A point es- one described above except that one SRV timate core damage frequency of 3.6E-5 from in- fails to reclose and sticks open. Core damage ternal events was calculated in that study. A point occurs in approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after offsite estimate core damage frequency of 2.1E-6 was power is lost.

calculated in this analysis for purposes of compari-son. A point estimate is calculated from the sum In addition to these two short-term accident sce-of all the cut-set frequencies, where each of the narios, this study also considered long-term sta-cut-set frequencies is the product of the point esti- tion blackout accidents. In these accidents, loss of mates (usually means) of the events in the cut offsite power occurs and all three diesel genera-sets. tors fail to start or run. The safety relief valves cycle successfully and RCIC starts and maintains 6.2.1.1 Internally Initiated Accident proper coolant level within the reactor vessel.

Sequences However, ac power is not restored in these long-term scenarios, and RCIC eventually fails because A detailed description of accident sequences im- of high turbine exhaust pressure, battery deple-portant at the Grand Gulf plant is provided in Ref- tion, or other long-term effects. Core damage oc-erence 6.1. For this report, the accident se- curs approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after offsite power is quences described in that reference have been di- lost.

6-1 NUREG-1 150

6. Grand Gulf Plant Results Table 6.1 Summary of design features: Grand Gulf Unit 1.

1. Coolant Injection Systems a. High-pressure core spray (HPCS) system provides coolant to reactor vessel during accidents in which system pressure remains high or low, with 1 train and 1 MDP.*

b. Reactor core isolation cooling system provides coolant to the reactor vessel during accidents in which system pres-sure remains high, with 1 train and 1 TDP. *

c. Low-pressure core spray system provides coolant to the reactor vessel during accidents in which vessel pressure is low, with 1 train and 1 MDP.*

d. Low-pressure coolant injection system provides coolant to the reactor vessel during accidents in which vessel pressure is low, with 3 trains and 3 pumps.

e. Standby service water crosstie system provides coolant makeup source to the reactor vessel during accidents in which normal sources of emergency injection have failed, with I train and pump (for crosstie).

f. Firewater system is used as a last resort source of low-pressure coolant injection to the reactor vessel, with 3 trains, 1 MDP,

• 2 diesel-driven pumps.

g. Control rod drive system provides backup source of high-pressure injection, with 2 pumps/238 gpm (total)/1103 psia.

h. Automatic depressurization system (ADS) depressurizes the reactor vessel to a pressure at which the low-pressure in-jection systems can inject coolant to the reactor vessel, with 8 relief valves/capacity of 900,000 lb/hr. In addition, there are 12 non-ADS relief valves.

i. Condensate system used as a backup injection source.

2. Heat Removal Systems a. Residual heat removal/suppression pool cooling system removes decay heat from the suppression pool during accidents, with 2 trains and 2 pumps.

b. Residual heat removal/shutdown cooling system removes decay heat during accidents in which reactor vessel integ-rity is maintained and reactor is at low pressure, with 2 trains and 2 pumps.

c. Residual heat removal/containment spray system suppresses pressure in the containment during accidents, with 2 trains and 2 pumps.

3. Reactivity Control Systems a. Control rods.

b. Standby liquid control system, with 2 parallel positive dis-placement pumps rated at 43 gpm per pump.

• TDP -Turbine-Driven Pump MDP - Motor-Driven Pump NUREG- 1150 6-2

6. Grand Gulf Plant Results Table 6.1 (Continued)

4. Key Support Systems a. dc power with 12-hour station batteries.

b. Emergency ac power, with 2 diesel generators and third diesel generator dedicated to HPCS but with crossties.

c. Suppression pool makeup system provides water from the upper containment pool to the suppression pool following a LOCA.

d. Standby service water provides cooling water to safety sys-tems and components.

5. Containment Structure a. BWR Mark III.

b. 1.67 million cubic feet.

c. 15 psig design pressure.

6. Containment Systems a. Containment venting is used when suppression pool cooling and containment sprays have failed to reduce primary con-tainment pressure.

b. Hydrogen igniter system prevents the buildup of large quantities of hydrogen inside the containment during acci-dent conditions.

Within the general class of ATWS accidents, the sort) source of low-pressure coolant injection most probable combination of failures leading to to the reactor vessel. The system has two die-core damage is: sel-driven pumps, making it operational under station. blackout conditions as long as dc

• Transient initiating event occurs followed by a power is available. The potential use of this failure to trip the reactor because of mechani- system is estimated to reduce the total core cal faults in the reactor protection system damage frequency by approximately a factor (RPS). The standby liquid control system of 1.5.

(SLCS) is not actuated and the high-pressure core spray (HPCS) system fails to start and run because of random hardware faults. The reactor is not depressurized and therefore the The reason for the relatively small impact on low-pressure core cooling system cannot in- the total core damage frequency is twofold.

ject. All core cooling is lost; core damage oc-curs in approximately 20 to 30 minutes after The firewater system is a low-pressure system; the transient initiating event occurs. the reactor pressure must be maintained be-low approximately 125 psia for firewater to be able to inject. If an accident occurs in which 6.2.2 Important Plant Characteristics (Core Damage Frequency) core cooling is immediately lost, the core be-comes uncovered in less time than that re-Characteristics of the Grand Gulf plant design and quired to align and activate the firewater sys-operation that have been found to be important in tem. If core cooling is provided and then lost the analysis of core damage frequency include: in the long term (e.g., at approximately greater than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the start of the acci-

1. Firewater System as Source of Coolant dent), firewater can provide sufficient Makeup makeup to prevent core damage. However, The firewater system as a core coolant injec- the dominant sequences at Grand Gulf are ac-tion system can be used as a backup (last re- cidents where core cooling is lost immediately.

6-3 NUREG- 1150

z W c)

~I Ax. ldg. Roof UN C>

CSS Dsohrge Vlys 0

CD (e

Io (One Tain Shown)

I4 I >AIq 1-Pup

• Typioal arrangement Figure 6.1 Grand Gulf plant schematic.

6. Grand Gulf Plant Results Table 6.2 Summary of core damage frequency results: Grand Gulf.*

5% Median Mean 95%

Internal Events 1.7E-7 1.2E-6 4.OE-6 1.2E-5 ATWS 8.5E-10 1.9E-8 1.1E-7 5.1E-7 Station Blackout 1.3E-7 1.1E-6 3.9E-6 1.1E-5

• As discussed in Reference 6.4, core damage frequencies below IE-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

Core Damage Frequency (per RY) 1.OE-04 C 1.OE-05 95th -

MeanL-Median -

1.OE-06 5th -

1..OE-07 1.OE-08 Number of LG samples Note: As discussed in Reference 6.4, core damage frequencies below E-5 per reac-tor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

Figure 6.2 Internal core damage frequency results at Grand Gulf.

6-5 NUREG-1 150

6. Grand Gulf Plant Results Station Blackout ATWS Total Mean Core Damage Frequency: 4E-6 Figure 6.3 Contributors to mean core damage frequency from internal events at Grand Gulf.

2. High-Pressure Core Spray (HPCS) System 3.. Capability of Pumps to Operate with Saturated Water The HPCS system consists of a single train The emergency core cooling pumps that de-with motor-operated valves and a motor- pend on the pressure-suppression pool as their driven pump and provides coolant to the reac- water source during accident conditions have tor vessel during accidents in which pressure is been designed to pump saturated water. Thus, either high or low. The bearings and seals of if the pool becomes saturated because of con-the HPCS pump are cooled by the pumped tainment venting or containment failure, the fluid. If the temperature of this water exceeds core cooling systems are not lost but can con-design limits, the potential exists for the HPCS tinue to cool the reactor core.

pump to fail. The bearings are designed to op-erate for no more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at a tempera- 4. Redundancy and Diversity of Water Sup-ture of 350'F. The peak temperature ply Systems achieved in any of the accidents analyzed is At Grand Gulf, there are many redundant approximately 3250 F. Even if the seals were and diverse systems to provide water to the to experience some leakage, the resultant reactor vessel. They include:

HPCS room environment would not adversely affect the operability of the pump. The avail- HPCS with 1 pump; ability of an HPCS system with such design characteristics is estimated to reduce the core Reactor core isolation cooling (RCIC) with 1 damage frequency by approximately a factor pump; of 7. The HPCS is powered by a dedicated diesel generator when required so that this Control rod drive (CRD) with 2 pumps (both system is truly an independent system. are required for core cooling);

NUREG-1 150 6-6

6. Grand Gulf Plant Results Condensate with 3 pumps; 6.2.3 Important Operator Actions Low-pressure core spray (LPCS) with 1 The emergency operating procedures (EOPs) at pump; Grand Gulf direct the operator to perform certain actions depending on the plant conditions or Low-pressure coolant injection (LPCJ) with 3 symptoms (e.g., reactor vessel level below the top pumps; of active fuel). Different accident sequences can have similar symptoms and therefore the same Standby service water (SSW) crosstie with 1 "recovery" actions. Operator actions that are im-pump; and portant include the following:

• Actuate core cooling Firewater system with 3 pumps.

In an accident where feedwater is lost (which Because of the redundancy of systems for includes condensate), the reactor water level LOCAs and transients, core cooling loss as a starts to decrease. When Level 2 (-41.6 result of independent random failures is of inches) is reached, high-pressure core spray (HPCS) and reactor core isolation cooling low probability. However, in a station black- (RCIC) should be automatically actuated. If out, except for RCIC and firewater, the core Level 1 (-150.3 inches) is reached, the ADS cooling systems are lost with a probability of should occur with automatic actuation of the unity because they require ac power. low-pressure core spray (LPCS) and low-pressure coolant injection (LPCI). If the reac-

5. Redundancy and Diversity of Heat tor level sensors are miscalibrated, these sys-Removal Systems tems will not automatically actuate. The op-At Grand Gulf there are several diverse erator has many other indications to deter-means for heat removal. These systems are: mine both the reactor water level and the fact that core coolant makeup is not occurring.

Main steam/feedwater system with 3 trains; Manual actuation of these systems is required if such failures occur in order to prevent core Suppression pool cooling mode of residual damage.

heat removal (RHR) with 2 trains; Shutdown cooling mode of RHR with 2 trains;

• Establish containment heat removal Containment spray system mode of RHR with Besides core cooling, the operator must also 2 trains; and establish containment heat removal (CHR). If Containment venting with 1 train. an accident occurs, the EOPs direct the op-erator to initiate the suppression pool cooling Although the various modes of RHR have mode of RHR when the suppression tempera-common equipment (e.g., pumps), there is ture reaches 950 F. The operator closes the still enough redundancy and diversity that, for LPCI valves and the heat exchanger bypass non-station-blackout accidents, independent valves and opens the suppression pool dis-random failures again are small contributors charge valves. He also ensures that the proper to the core damage frequency. service water system train is operating. With suppression pool cooling (SPC) functioning,

6. Automatic and Manual Depressurization CHR is being performed. If system faults pre-System clude the use of SPC, the operator has other means to provide CHR. He can actuate other The automatic depressurization system (ADS) modes of RHR such as shutdown cooling or is designed to depressurize the reactor vessel containment spray, or the operator can vent to a pressure at which the low-pressure injec- the containment to remove the energy.

tion systems can inject coolant to the reactor vessel. The ADS consists of eight safety relief

• Establish room cooling through natural circu-valves capable of being manually opened. The lation operator may manually initiate the ADS or may depressurize the reactor vessel, using the The heating, ventilating, and air conditioning 12 relief valves that are not connected to the (HVAC) system provides room cooling sup-ADS logic. The ADS valves are located inside port to a variety of systems. If HVAC is lost, the containment. design limits can be exceeded and equipment 6-7 NUREG-1 150

6. Grand Gulf Plant Results (i.e., pumps) can fail. If these conditions oc-

• Recovering ac power cur, the operator can open doors to certain rooms and establish a natural circulation/ven- Station blackout is caused by the loss of all ac tilation that prevents the room temperature power, both offsite and onsite power. Restor-from exceeding the design limits of the equip- ing offsite power or repairing the diesel gen-ment. erators was included in the analysis. The quantification of these human failure events For station blackout accidents, there are certain was derived from historical data (i.e., actual actions that can be performed by the operating time required to perform these repairs) and crew as follows: not by performing human reliability analysis on these events.

• Crosstie division 1 or 2 loads to HPCS diesel generator Transients where reactor trip does not occur (i.e.,

ATWS) involve accident sequences where the In a station blackout where the HPCS diesel phenomena are more complex. The operator ac-generator is available, the operator can tions were evaluated in more detail (Ref. 6.5) choose to crosstie this diesel to one of the than for the regular transient-initiated accident.

other divisions. The operator might choose These actions include the following:

this option when (1) the HPCS system fails and core cooling is required, or (2) in the

• Manual scram long term (e.g., longer than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) contain-ment heat removal is required to prevent con- A transient occurs that demands the reactor tainment failure. If the operator chooses to to be tripped, but the reactor protection sys-crosstie, the operator must shed all the loads tem (RPS) fails because of electrical faults.

from the HPCS diesel and then open and The operator can then manually trip the reac-close certain breakers. He can then load cer- tor by first rotating the collar on proper scram tain systems from either division I or from di- buttons and then depressing the buttons, or vision 2. he can put the reactor mode switch in the "shutdown" position.

• Align firewater

• Insert rods manually In an accident, particularly station blackout, If the electrical faults fail both the RPS and where core cooling was initially available (for the manual trip, the operator can manually in-approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) and then lost, the sert the control rods one a time.

firewater system can provide adequate core cooling. The operator must align the firewater

• Actuate standby liquid control (SLC) system hoses to the proper injection lines (described in the procedure) and then open the injection With the reactor not tripped, reactor power valves. remains high; the reactor core is not at decay heat levels. This can present problems since

• Depressurize reactor via RCIC steam line the containment heat removal systems are only designed to decay heat removal capacity.

In a station blackout, the diesel generators However, the SLC system (manually actu-have failed and only dc power is available (in ated) injects sodium pentaborate that reduces certain sequences). If core cooling is being reactor power to decay heat levels. The EOPs provided with firewater, then the reactor direct the operator to actuate SLC if the reac-must remain at low pressure, which requires tor power is above 4 percent and before the that at least one safety relief valve (SRV) must suppression pool temperature reaches 1101F.

remain open. For the SRV to remain open, The operator obtains the SLC keys (one per dc power is required. However, without the pump) from the shift supervisor's desk, inserts diesel generator recharging the battery, the the keys into the switches, and turns both to battery will eventually deplete, the SRV will the "on" position.

close, and the reactor will repressurize, which causes the loss of the firewater. The operator

• Inhibit automatic depressurization system can maintain the reactor pressure low by (ADS) opening the valves on the RCIC steam line.

This provides a vent path from the reactor to In an ATWS condition, the operator is di-the suppression pool. rected to inhibit the ADS if he has actuated NUREG-l 150 6-8

6. Grand Gulf Plant Results SLC. The operator must put both ADS - Failure to repair hardware faults of die-switches (key locked) in the inhibit mode. sel generator in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The core dam-age frequency would be reduced by ap-

• Manually depressurize reactor proximately 46 percent.

If HPCS fails, inadequate high-pressure core - Failure of a diesel generator to start.

cooling occurs. When Level 1 is reached, The core damage frequency would be ADS will not occur because the ADS was reduced by approximately 23 to 32 per-inhibited, and the operator must manually cent, depending on the diesel generator.

depressurize so that low-pressure core cooling can inject. The operator can either press the - Common-cause failure of the vital bat-ADS button (which overrides the inhibit) or teries. The core damage frequency manually open one SRV at a time. would be reduced by approximately 20 percent.

6.2.4 Important Individual Events and s Uncertainty importance measure (internal Uncertainties (Core Damage events)

Frequency)

A second importance measure used to evalu-As discussed in Chapter 2, the process of develop- ate the core damage frequency analysis results ing a probabilistic model of a nuclear power plant is the uncertainty importance measure. For involves the combination of many individual this measure, the relative contribution of the events (initiators, hardware failures, operator er- uncertainty of individual events to the uncer-rors, etc.) into accident sequences and eventually tainty in total core damage frequency is calcu-into an estimate of the total frequency of core lated. Using this measure, the following events damage. After development, such a model can were found to be most important:

also be used to assess the importance of the indi-vidual events. The detailed studies underlying this - Loss of offsite power; report have been analyzed using several event im-portance measures. The results of the analyses us- - Failure of the diesel generators to run, ing two measures, "risk reduction" and "uncer- given start; tainty" importance, are summarized below.

- Individual and common-cause failure of 0 Risk (core damage frequency) reduction im- the diesel generators to start; portance measure (internal events)

- Standby service water motor-operated The risk-reduction importance measure is valves (MOVs) fail to open; and used to assess the change in core damage fre-quency as a result of setting the probability of - High-pressure core spray and RCIC an individual event to zero. Using this meas- MOVs fail to function.

ure, the following individual events were found to cause the greatest reduction in core 6.3 Containment Performance Analysis damage frequency if their probabilities were set to zero. 6.3.1 Results of Containment Performance Analysis

- Loss of offsite power initiating event. The Grand Gulf pressure-suppression contain-The core damage frequency would be ment design is of the Mark III type in which the reduced by approximately 92 percent. reactor vessel, reactor coolant circulating loops, and other branch connections to the reactor cool-

- Failure to restore offsite power in 1 ant system are housed within the drywell struc-hour. The core damage frequency would ture. The drywell structure in turn is completely be reduced by approximately 70 per- contained within an outer containment structure cent. with the two volumes communicating through the water-filled vapor suppression pool. The outer

- Failure of the RCIC turbine-driven containment building is a steel-lined reinforced pump to run. The core damage fre- concrete structure with a volume of 1.67 million quency would be reduced by approxi- cubic feet that is designed for a peak pressure of mately 48 percent. 15 psig resulting from a reactor coolant system 6-9 NUREG-1150

6; Grand Gulf Plant Results loss-of-coolant accident. For this same design ba- but no pool bypass; and (5) 0.09 for no contain-sis accident, the inner concrete drywell structure ment failure.

is designed for a peak pressure of 30 psig. The mean failure pressure for Grand Gulf's contain- Further examination of these data, broken down ment structure has been estimated to be 55 psig. on the basis of the timing of reactor vessel breach This estimated containment failure pressure for and the nature of the containment threat, indi-Grand Gulf is much lower than the Peach Bottom cate: (1) prior to reactor vessel breach, hydrogen Mark I estimated failure pressure of 148 psig; combustion and slow steam overpressurization ef-however, Grand Gulf's free volume is several fects lead to frequency-weighted mean conditional times larger. The availability of Grand Gulf's large probabilities of containment failure of 0.20 and volume removed the design basis need to inert the 0.05, respectively; (2) at reactor vessel breach, containment against failure from hydrogen com- hydrogen combustion effects lead to a 0.24 condi-.

bustion following design basis accidents; however, tional mean probability of containment failure; subsequent severe accident considerations after (3) prior to reactor vessel breach, hydrogen com-the TMI accident resulted in the installation of bustion effects lead to 0.12 conditional mean hydrogen igniters. For the severe accident se- probability of drywell failure; (4) at reactor vessel quences developed in this analysis, hydrogen com- breach, steam explosion and direct containment bustion remains the major threat to Grand Gulf's heating effects can lead to pedestal failures and a containment integrity (in the station blackout ac- 0.16 conditional mean probability of drywell fail-cidents dominating the frequency of core damage, ure from both pedestal and overpressure effects; igniters are not operable). Similar to other con- and (5) dynamic loads from hydrogen detonations tainment design analyses, the estimate of where have a small effect on the structural integrity of and when Grand Gulf's containment system will either the containment or the drywell.

fail relied heavily on the use of expert judgment to interpret the limited data available. Figure 6.5 further displays plots of Grand Gulf's conditional probability distribution for each plant The potential for early containment and/or damage state, thereby providing the estimated drywell failure for Grand Gulf as compared to range of uncertainties in the outer containment Peach Bottom's Mark I suppression-type contain- failure predictions. The important conclusions ment involves significantly different considera- that can be drawn from the information are (1) tions. Of particular significance with regard to the there is a relatively high mean conditional prob-potential for large radioactive releases from Grand ability of early containment failure with a large by-Gulf is the prediction of the combined probabili- pass of the suppression pool's scrubbing effects, ties of simultaneous early containment and drywell i.e., 0.23; (2) there is a high mean probability of failures, which in turn produce a direct radioac- early containment failure, i.e., 0.48; and (3) the tive release path to the environment. The results principal threat to the combined efficacy of the of these analyses for Grand Gulf are shown in Fig- Mark III containment and drywell is hydrogen ures 6.4 and 6.5. Figure 6.4 displays information combustion effects.

in which the eight conditional probabilities of con-tainment-related accident progression bins; e.g., Additional discussions on containment perform-VB-early CF-no SPB, are presented for each of ance (for all studied plants) are provided in Chap-four plant damage states, e.g., ATWS. This infor- ter 9.

mation indicates that, on a-plant damage state fre-quency-weighted average* for internally initiated 6.3.2 Important Plant Characteristics events, there are mean conditional probabilities of (Containment Performance)

(1) 0.23 that the integrity of the drywell and the Characteristics of the Grand Gulf design and op-outer containment will be sufficiently affected that eration that are important during core damage ac-substantial bypass of the suppression pool will oc- cidents include:

cur; (2) 0.24 for early containment failure with no bypass of the suppression pool pathway from the 1. Drywell-Wetwell Configuration drywell; (3) 0.12 for late containment failure with pool bypass; (4) 0.23 for late containment failure With the reactor vessel located inside the drywell, which in turn is completely sur-

'Each value in the column in Figure 6.4 labeled "All" is a rounded by the outer containment building, frequency-weighted average obtained by summing the there needs to be a combination of failures in products of individual accident progression bin condi- both structures to provide a direct release tional probabilities for each plant damage state and the ratio of the frequency of that plant damage state to the path to the environment that bypasses the total core damage frequency. suppression pool, e.g., hydrogen combustion NUREG-1 150 6-10

6. Grand Gulf Plant Results

SUMMARY

SUMMARY

PDS GROUP ACCIDENT (Mean Core Damage Frequency)

PROGRESSION BIN GROUP STSB LTSB ATWS Transients All (3.a5E-06) (1.04E-07) (1.12E-07) (1.87E-08) (4.09E-06)

VB, early CF, 0.166 0.292 0.006 j 0.011 0.158 early SPB. no CS VB. early CF.

early SPB. CS 0.031 0.017 ] 0.237 ] 0.202 0.049 VB, early CF, 0.006 0.005 0.003 0.003 0.007 late SPB VB, early CF, no SPB

] 0.182 5 3; [ 0.331 0.218 VB, late CF 1 0.308 l 0.129 0.074 0.232 0.284 VB, venting 0.032 0.003 0.109 0,075 I 0.038 VB, No CF I0.053 0.003 A 0.036 0.092 0.050 No VB n 0.201 j0.015 0.025 0.050 n0.180 CF = Containment Failure CS = Containment Sprays CV = Containment Venting SPB = Suppression Pool Bypass VB = Vessel Breach Figure 6.4 Conditional probability of accident progression bins at Grand Gulf.

impairing the function of both the drywell and ties of noncombustible gases before failure containment. even though its estimated failure pressure is less than half that of a Mark I containment.

2. Containment Volume Its low design pressure, however, makes it sus-The Grand Gulf containment volume is much ceptible to failure from hydrogen combustion larger than that of a Mark I containment and effects in those cases where the igniters are as such can accommodate significant quanti- not working.

6-11 NUREG-1 150

6. Grand Gulf Plant Results

-p 1.EO 95tb,,

w

.E-i s0 0.4 i.E-2.

M = mean m = median 5th, th = percentile

-I PDS Group STSB LTSB ATWS Transients All Core Damage Freq. 3.9E-06 i.OE-07 I.JE-07 1.9E-08 4.1E-06 Figure 6.5 Conditional probability distributions for early containment failure at Grand Gulf.

3. Hydrogen Ignition System 4. Containment Spray System The Grand Gulf containment hydrogen igni-tion system is capable of maintaining the con- The Grand Gulf containment spray system has centration of hydrogen from severe accidents the capability to condense steam and reduce in manageable proportions for many severe the amount of radioactive material released to accidents. However, for station blackout acci-dent sequences, the igniter system is not oper- the environment for specific accident se-able. When power is restored, the ignition sys- quences. However, for some sequences, i.e.,

tem will be initiated; potentially the contain- loss of ac power, its eventual initiation upon ment has high hydrogen concentrations. Some power recovery and that of the hydrogen igni-potential then exists for a deflagration causing tion system could result in subsequent hydro-simultaneous failures of both the containment gen combustion that has some potential to fail building and the drywell structure. the containment and drywell.

NUREG-1 150 6-12

6. Grand Gulf Plant Results 6.4 Source Term Analysis would be forced to pass through the suppres-sion pool and the source term would be sub-6.4.1 Results of Source Term Analysis stantially mitigated. However, the likelihood of drywell failure is estimated to be quite sig-A key difference between the Peach Bottom nificant, such that early failure with suppres-(Mark I) design and Grand Gulf (Mark III) de- sion pool bypass occurs approximately one-sign is the wetwell/drywell configuration. If the quarter of the time if core melting and vessel drywell remains intact in the accident and the breach occur.

mode of containment failure does not result in loss of the suppression pool, leakage to the envi-ronment must pass through the pool and be sub- 3. Pedestal Flooding ject to decontamination.

The pedestal region communicates with the Figures 6.6 and 6.7 illustrate the effect of drywell drywell region through drains in the drywell integrity in mitigating the environmental release of floor. The amount of water in the pedestal re-radionuclides for early containment failure. In gion depends on whether the upper water Figure 6.6, both the drywell and the containment pool has been dumped into the suppression fail early and sprays are not available. The median pool, on the quantity of condensate storage release for the volatile radionuclides is approxi- that has been injected into the containment, mately 10 percent, indicative of a large release with and on the transient pressurization of the con-the potential for causing early fatalities. For the early tainment building resulting from hydrogen containment failure accident progression bin with the burns. The effect of water in the pedestal is drywell intact, as illustrated in Figure 6.7, the envi- either to result in debris coolability or to miti-ronmental source terms are reduced, since the flow gate the source term to containment of the of gases escaping the containment after vessel breach radionuclides released during core-concrete must also pass through the suppression pool before interaction. Water in the pedestal does, how-being released to the environment. ever, also introduce some potential for a steam explosion that can damage the drywell.

Additional discussion on source term perspectives (for all studied plants) is provided in Chapter 10. 4. Containment Sprays 6.4.2 Important Plant Characteristics Containment sprays can have a mitigating ef-(Source Term) fect on the release of radionuclides under

1. Suppression Pool conditions in which both the containment and drywell have failed. In other accident scenar-The pressure-suppression pool at Grand Gulf ios in which the in-vessel and ex-vessel re-provides the potential for substantial mitiga- leases must pass through the suppression pool tion of the source terms in severe accidents. before reaching the outer containment region, Since transient-initiated accidents represent a sprays are not nearly as important. This is, in large contribution to core damage frequency, part, because the source term has already the in-vessel release of radionuclides is almost been reduced and, in part, because the de-always subject to pool decontamination. Only contamination factors for suppression pools a fraction of such accident sequences (in and containment sprays are not multiplicative which a vacuum breaker sticks open in a since they selectively remove similar-sized safety relief valve discharge line) releases aerosols.

radionuclides directly to the drywell in this phase of the accident. The pool decontamina-tion factors used for the Grand Gulf design for 6.5 Offsite Consequence Results the in-vessel release range from 1.1 to 4000, with a median of 60. For the ex-vessel release Figure 6.8 displays the frequency distributions in component, the pool is less effective. The de- the form of graphical plots of the complementary contamination factors range from 1 to 90 with cumulative distribution functions (CCDFs) of four a median of 7. offsite consequence measures-early fatalities, la-tent cancer fatalities, and the 50-mile and the en-

2. Wetwell-Drywell Configuration tire site region population exposures (in person-reins). These CCDFs include contributions from If the drywell remains intact in a severe acci- all source terms associated with reactor accidents dent at Grand Gulf, the radionuclide release caused by internal initiating events. Four CCDFs, 6-13 NUREG-1150

z 0

Release Fraction 1.OE.00 1.OE-01 1.OE -02 1.OE-03 1.OE- 04 1.OE-05 NG I Cs Te Sr Ru La Ba Ce Radionuclide Group Figure 6.6 Source term distributions for early containment failure with drywell failed and sprays unavailable at Grand Gulf.

Release Fraction 1.OE+OO 1.OE-O1 I.OE-02 1.OE-03 F,

1.OE-04 N

z Q.

2 I

norm;..fx

, Jo -- N z: w NG I Cs Te Sr Ru La Ba Ce a d

CD 0' M Radionuclide Group 5M Figure 6.7 Source term distributions for early containment failure with drywell intact at Grand Gulf.

z tz 0

0

'-I QD i .oE-03' 0 0F, A

CD 0 -PC ent o O

b 1.OE-04 2 -t 52 0 _ Sn 5,

? 1.OE-05 0

(b

- .Oe a

0 I.OE-07 o 0 - .... i tr i 0 .OE-OB 0 O 0 i.OE-09 '., Q 0

0 U0 0

. F LU l.OE- 10 ui I.OEOO i.OE-oi 1.OE.02 1.OE03 1.OE.04 I.OE015 Early Fatalities i.OF-nl.

(a 0* 1.OE-04 0 0 0 v

0 I.OE -OS i-___- _-- - .--- - -'---' -- . _ m a

-0 1.E-08

,U I CD 2 tg.OE-07 C 0 u

co 0

'U* i.oe- OB 'C LT 0 i.oE-og lOE-09 601 I I 0

0 xU 1.OE-to 1.6OEOO 1.OE.02 1OE.04 1.OE.O5 1.OE.08 1.OE.OO lOE-02 t.OE-04 .oE.O8. 1OE.08 Population Dose (person-mem) to -50 Miles Population Dose (person-rerml) to -Entire Region Note: As discussed in Reference 6.4, estimated consequences at frequencies at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 6.8 Frequency distributions of offsite consequence measures at Grand Gulf (internal initiators).

6. Grand Gulf Plant Results namely, the 5th percentile, 50th percentile (me-

• Latent cancer fatality risk, dian), 95th percentile, and the mean CCDFs, are shown for each consequence measure.

• Population dose within 50 miles of the site, Grand Gulf plant-specific and site-specific pa-

• Population dose within the entire site region, rameters were used in the consequence analyis for these CCDFs. The plant-specific parameters in-

• Individual early fatality risk in the population cluded source terms and their frequencies, the li- within 1 mile of the Grand Gulf exclusion area censed thermal power (3833 MWt) of the reactor, boundary, and and the approximate physical dimensions of the

• Individual latent cancer fatality risk in the power plant building complex. The site-specific population within 10 miles of the Grand Gulf parameters included exclusion area radius (696 site.

meters), meteorological data for 1 full year col-lected at the meteorological tower, the site region The first four of the above measures are com-population distribution based on the 1980 census monly used measures in nuclear power plant risk data, topography (fraction of the area that is studies. The last two are those used to compare land-the remaining fraction is assumed to be with the NRC safety goals (Ref. 6.7).

water), land use, agricultural practice and produc-tivity, and other economic data for up to 1,000 The results of the Grand Gulf risk studies using miles from the Grand Gulf plant. the above measures are shown in Figures 6.9 through 6.11. The figures display the variabilities The consequence estimates displayed in these fig- in mean risks estimated from meteorology-aver-ures have incorporated the benefits of the follow- aged conditional mean values of the consequence ing protective measures: (1) evacuation of 99.5 measures. In comparison to the risks from the percent of the population within the 10-mile other plants in this study, Grand Gulf has the low-plume exposure pathway emergency planning est risk estimates. The results are much below zone (EPZ), (2) early relocation of the remaining those of the Reactor Safety Study (Ref. 6.8). The population only from the heavily contaminated ar- individual early and latent cancer fatality risks are eas both within and outside the 10-mile EPZ, and far below the NRC safety goals. Details of the (3) decontamination, temporary interdiction, or comparison of results are provided in Chapter 12.

condemnation of land, property, and foods con-taminated above acceptable levels. The results in Figure 6.9 have been analyzed to identify the relative contributions of accident se-The population density within the Grand Gulf 10- quences and containment failure modes to mean mile EPZ is about 30 persons per square mile. risk. These results are presented in Figures 6.12 The average delay time before evacuation (after a and 6.13. As may be seen, the mean early fatality warning prior to radionuclide release) from the risk at Grand Gulf is dominated by short-term sta-10-mile EPZ and average effective evacuation tion blackout sequences. The majority of early fa-speed used in the analyses were derived from in- tality risk is associated with the coincidence of formation contained in a utility-sponsored Grand early containment failure and early suppression Gulf evacuation time estimate study (Ref. 6.6) pool bypass.

and the NRC requirements for emergency plan-ning. The mean latent cancer fatality risk is also domi-nated by the short-term station blackout group.

The results displayed in Figure 6.8 are discussed The major contributors to risk are from (1) early in Chapter 11. containment and early suppression pool bypass, and (2) late containment failure.

6.6 Public Risk Estimates 6.6.2 Important Plant Characteristics (Risk) 6.6.1 Results of Public Risk Estimates As mentioned before, risk to the public from the operation of the Grand Gulf plant is lower than A detailed description of the results of the Grand the other four plants in this study. Some of the Gulf risk analysis is provided in Reference 6.2. plant features that contribute to these low risk es-For this summary report, results are provided for timates are described below.

the following measures of public risk:

• The very low early fatality risk at Grand Gulf 0 Early fatality risk, is due to a combination of low core damage 6-17 NUREG-1 150

6. Grand Gulf Plant Results i rn A I 95Utb -

t10-S 0

to' V 10-I~1O

-I W 6-1 a to-t0 Number of LIS Observations Key: M = mean m median th = percentile I' 10

-4F

-~ 95Uh4 I-' 10 c)

C.)

-S4 0b.)

Ia- Uh, 10 -a Number of UIS Observations Note: As discussed in Reference 6.4, estimated risks at or below E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 6.9 Early and latent cancer fatality risks at Grand Gulf (internal initiators).

NUREG-1150 6-18

6. Grand Gulf Plant Results ich t4) id 95fth....

&or 10 C2 1-2 0 10 5th-.

0c Number of LHS Observations Key: M = mean m = median th = percentile D 0 0

95thb -.

bo 5t Lid so 5t, r 10 10 Number of LHS Observations Note: As discussed in Reference 6.4, estimated risks at or below E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 6.10 Population dose risks at Grand Gulf (internal initiators).

6-19 NUREG-1 150

6. Grand Gulf Plant Results 10

-b Qa

0 1 l,

< 0 la Number of LHS Observations Key: M mean m median th percentile Irn s I -S.

.$afety Goal 0 10 M 1). 10-7 4

.n 10~'

95th..

M10- M.

-)

, 10 I U -'

10 a Number of LHS Observations Note: As discussed in Reference 6.4, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 6.11 Individual early and latent cancer fatality risks at Grand Gulf (internal initiators).

NUREG-1150 6-20

6. Grand Gulf Plant Results GRAND GULF GRAND GULF EARLY FATALITY LATENT CANCER FATALITY MEAN S.2E-9/RY MEAN 9.SE-4/RY 1 1 2 3 2 3 Plant Damage States

t. LONG TERM 80

2. SHORT TERM BO

3. ATWS

4. TRANSIENTS Figure 6.12 Major contributors (plant damage states) to mean early and latent cancer fatality risks at Grand Gulf (internal initiators).

GRAND GULF GRAND GULF EARLY FATALITY LATENT CANCER FATALITY MEAN

• 8.2E-9/RY MEAN 9.5E-41RY 1

4 5,8

/5

.4 2 3 D Accident Progression Bins

1. VS. ECF. EARLY SP BYPASS, CONT. SPRAYS NOT AVAIL.

2. V, ECF, EARLY SP BYPASS, CONT. SPRAYS AVAIL.

3. VB. ECF. LATE SP BYPASS

4. VD. ECF. NO SP BYPASS S. VS. LATE CF S. VB. VENT

7. v. NO CF

a. NO VB Figure 6.13 Major contributors (accident progression bins) to mean early and latent cancer fatality risks at Grand Gulf (internal initiators).

6-21 NUREG-1 150

6. Grand Gulf Plant Results frequency, reduced source terms (as a result the probability of early containment failure.

of suppression pool scrubbing), and low popu- Furthermore, in most cases, in-vessel releases lation density around the plant. The latter pass through the suppression pool.

leads to short evacuation delays and fast evacuation speeds. Timing is not as important

• There is a high probability of having water in for latent cancer fatalities. the reactor cavity following vessel breach.

Thus, there is a high probability that core de-

• Although the Grand Gulf plant has relatively bris would be coolable. Even when any core-high probability of early containment failure, concrete interaction may occur, it is generally caused mainly by hydrogen deflagration, the under water, and, therefore, the resulting re-probability of early drywell failure, which may leases are scrubbed by overlaying water (if not lead to a large source term, is about half of by the suppression pool).

NUREG-1 150 6-22

6. Grand Gulf Plant Results REFERENCES FOR CHAPTER 6 6.1 M. T. Drouin et al., "Analysis of Core Dam- (NUREG-1150)," NUREG-1420, August age Frequency: Grand Gulf Unit 1," Sandia 1990.

National Laboratories, NUREG/CR-4550, Vol. 6, Revision 1, SAND86-2084, Sep- 6.5 A. D. Swain III, "Accident Sequence Evalu-tember 1989. ation Program-Human Reliability Analysis Procedure," Sandia National Laboratories, 6.2 T. D. Brown et al., "Evaluation of Severe NUREG/CR-4772, SAND86-1996, Febru-Accident Risks: Grand Gulf Unit 1," Sandia ary 1987.

National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1, SAND86-1309, to 6.6 Mississippi Power & Light Company, be published.* "Evacuation Time Estimates for the Grand Gulf Nuclear Station Plume Exposure Path-6.3 S. W. Hatch et al., "Reactor Safety Study way Emergency Planning Zone," Revision 4, Methodology Applications Program: Grand March 1986.

Gulf No. 1 BWR Power Plant," Sandia Na-tional Laboratories and Battelle Columbus 6.7 USNRC, "Safety Goals for the Operation of Laboratories, NUREG/CR-1659/4 of 4, Nuclear Power Plants; Policy Statement,"

SAND80-1897/4 of 4, November 1981. Federal Register, Vol. 51, p. 30028, Au-gust 21, 1986.

6.4 H. J. C. Kouts et al., "Special Committee Review of the Nuclear Regulatory Commis- 6.8 USNRC, "Reactor Safety Study-An Assess-sion's Severe Accident Risks Report ment of Accident Risks in U.S Commercial

'Available In the NRC Public Document Room, 2120 L Nuclear Power Plants," WASH-1400 Street NW., Washington, DC. (NUREG-75/014), October 1975.

6-23 NUREG-1150

7. ZION PLANT RESULTS 7.1 Summary Design Information corporating some methods and issues (such as common-cause failure treatment, electric power The Zion Nuclear Plant is a two-unit site. Each recovery, and reactor coolant pump seal LOCA unit is a four-loop Westinghouse nuclear steam modeling) used in the other four plant studies.

supply system rated at 1100 MWe and is housed in a large, prestressed concrete, steel-lined dry The objective of this study was to perform an containment. The balance of plant systems were analysis that updated the previous Zion analyses engineered by Sargent & Lundy. Located on the and cast the model in a manner more consistent shore of Lake Michigan, about 40 miles north of with the other accident frequency analyses. The Chicago, Illinois, Zion 1 started commercial op- models were not completely reconstructed in the eration in December 1973. Some important de- small-event-tree, large-fault-tree modeling method sign features of the Zion plant are described in used in the study of the other NUREG-1150 Table 7.1. A general plant schematic is provided plants. Instead, the small-fault-tree, large-event-in Figure 7.1. tree models from the original ZPSS were used as the basis for the update. These models were then This chapter provides a summary of the results revised according to the comments from Refer-provided in the risk analyses underlying this report ence 7.3 and were enhanced to address risk issues (Refs. 7.1 and 7.2). A discussion of perspectives using methods employed by the other plant stud-with respect to these results is provided in Chap- ies.

ters 8 through 12.

This study incorporated specific issues into the 7.2 Core Damage Frequency Estimates systems and accident sequence models of the ZPSS. These issues reflect both changes in the 7.2.1 Summary of Core Damage Frequency Zion plant and general PRA assumptions that Estimates* have arisen since the ZPSS was performed. New The core damage frequency and risk analyses per- dominant accident sequences were determined by' formed for this study considered accidents initi- modifying and requantifying the event tree models ated only by internal events (Ref. 7.1); no exter- developed for ZPSS. The major changes reflect nal-event analyses were performed. The core the need for component cooling water and service damage frequency results obtained are provided water for emergency core cooling equipment and in tabular form in Table 7.2. This study calculated reactor coolant pump seal integrity. The original a total median core damage frequency from inter- set of plant-specific data used in the ZPSS and nal events of 2.4E-4 per year. Zion Review was verified as still valid and was used for this study. Additional discussion of the 7.2.1.1 Zion Analysis Approach Zion methods is provided in Appendix A.

The Zion plant was previously analyzed in the 7.2.1.2 Internally Initiated Accident Zion Probabilistic Safety Study (ZPSS), per- Sequences formed by the Commonwealth Edison Company, and in the review and evaluation of the ZPSS A detailed description of accident sequences im-(Ref. 7.3), commonly called the Zion Review pre- portant at the Zion plant is provided in Reference pared by Sandia National Laboratories. 7.1. For this summary report, the accident se-quences described in that reference have been Since previous analyses of Zion already existed, it grouped into six summary plant damage states.

was decided to perform an update of the previous These are:

analyses rather than perform a complete reanalysis. Therefore, this analysis of Zion repre-

• Station blackout, sents a limited rebaseline and extension of the dominant accident sequences from the ZPSS in

• Loss-of-coolant accident (LOCA),

light of the Zion Review comments, although in-

• Component cooling water and service water

'In general, the results and perspectives provided here do induced reactor coolant pump seal LOCAs, not reflect recent modifications to the Zion plant. The benefit of the changes is noted, however, in specific places in the text (and discussed in more detail in Section

• Anticipated transients without scram 15 of Appendix C). (ATWS),

7-1 NUREG-1 150

7. Zion Plant Results Table 7.1 Summary of design features: Zion Unit 1.

1. High-Pressure Injection a. Two centrifugal charging pumps.

b. Two 1500-psig safety injection pumps.

C. Charging pumps inject through boron injection tank.

d. Provides seal injection flow.

e. Requires component cooling water.

2. Low-Pressure Injection a. Two RHR pumps deliver flow when RCS is below about 170 psig.

b. Heat exchangers downstream of pumps provide recircula-tion heat removal.

c. Recirculation mode takes suction on containment sump and discharges to the RCS, HPI suction, and/or contain-ment spray pump suction.

d. Pumps and heat exchangers require component cooling water.

3. Auxiliary Feedwater a. Two 50 percent motor-driven pumps and one 100 percent turbine-driven pump.

b. Pumps take suction from own unit condensate storage tank (CST) but can be manually crosstied to the other unit's CST.

4. Emergency Power System a. Each unit consists of three 4160 VAC class 1E buses, each feeding one 480 VAC class 1E bus and motor control center.

b. For the two units there are diesel generators, with one being a swing diesel generator shared by both units.

c. Three trains of dc power are supplied from the inverters and 3 unit batteries.

5. Component Cooling Water a. Shared system between both units.

b. Consists of 5 pumps, 3 heat exchangers, and 2 surge tanks.

c. Cools RHR heat exchangers, RCP motors and thermal barriers, RHR pumps, SI pumps, and charging pumps.

d. One of 5 pumps can provide sufficient flow.

6. Service Water a. Shared system between both units.

b. Consists of 6 pumps and 2 supply headers.

c. Cools component cooling heat exchangers, containment fan coolers, diesel generator coolers, auxiliary feedwater pumps.

d. Two of 6 pumps can supply sufficient flow.

7. Containment Structure a Large, dry, prestressed concrete.

b. 2.6 million cubic foot volume.

c. 49 psig design pressure.

8. Containment Spray a. Two motor-driven pumps and 1 independent diesel-driven pump.

b. No train crossties.

c. Water supplied by refueling water storage tank.

9. Containment Fan Coolers a. Five fan cooler units, a minimum of 3 needed for post-accident heat removal.

b. Fan units shift to low speed on SI signal.

c. Coolers require service water.

NUREG-1 150 7-2

N z <D

t3 c'

I- cv 0

Figure 7.1 Zion plant schematic.

7. Zion Plant Results Table 7.2 Summary of core damage frequency results: Zion.

5% Median Mean 95%

Internal Events 1.1E-4 2.4E-4 3.4E-4* 8.4E-4

'See text (Section 7.2.1) for benefit of recent modifications.

• Interfacing-system LOCA and steam genera- nent cooling water system scenario, will be tor tube rupture (SGTR), and fully implemented within 60 days (of the date of Ref. 7.4) to supersede the standing order.

• Transients other than station blackout and ATWS.

The relative contribution of the accident types to

• When new heat-resistant reactor coolant mean core damage frequency at Zion is shown in pump seal -rings are made available by Figure 7.2. It is seen that the dominating con- Westinghouse, the existing -rings will be tributors to the core damage frequency are the changed when each pump is disassembled for loss of component cooling water and loss of serv- routine scheduled seal maintenance.

ice water. The more probable combinations of failures are: These actions provide a backup water source to the Zion station charging pump oil coolers.

• Reactor coolant pump seals fail because of the loss of cooling and injection. Core dam- As of October 1990, Commonwealth Edison had age occurs because of failure to recover the performed some of the noted actions (Ref. 7.5).

service watertcomponent cooling water sys- Sensitivity studies have been performed to assess tems in time to reestablish reactor coolant the benefit of the modifications made to date.

system inventory control. In cases with fail- These studies, discussed in more detail in Section ure of the service water system, containment C. 15 of Appendix C, indicate that the Zion esti-fan coolers are also failed. mated mean core damage frequency has been re-duced from 3.4E-4 per year to approximately

• Reactor coolant pump seals fail because of 6E-5 per year.

the loss of cooling and injection. The cooling system is recovered in time to provide injec- 7.2.2 Important Plant Characteristics (Core tion from the refueling water storage tank Damage Frequency)

(RWST). Recirculation cooling fails to con-tinue to provide long-term inventory control. Characteristics of the Zion plant design and op-eration that have been found to be important in To address the issue of the importance of compo- the analysis of the core damage frequency in-nent cooling water system failures, Common- clude:

wealth Edison (the Zion licensee) committed in 1989 to perform the following actions (Ref. 7.4): 1. Shared Systems Between Units

• Provide an auxiliary water supply to each The Zion nuclear station shares the service charging pump's oil cooler via either the serv- water and component cooling water (CCW) ice water system or fire protection system. systems between the two units. Power is sup-Hoses, fittings, and tools will be maintained plied to these systems from all five onsite die-locally at each unit's charging pump area al- sel generators.

lowing for immediate hookup to existing taps on the oil coolers, if required. As an interim 2. Crossties Between Units measure, a standing order in the control room will instruct operators as to how and Crossties between units exist for the conden-when to hook up auxiliary water to the oil sate storage tanks to provide water supply for coolers. the auxiliary feedwater system. Crossties also exist between Unit 1 and Unit 2 ac power

• Formal procedures, including a 10 CFR systems, as well as between Unit 1 and Unit 2 50.59 review addressing the loss of compo- dc power systems.

NUREG-1 150 7-4

7. Zion Plant Results CCW-Induced Seal OCA Bypass ATWS i Transients Station Blackout LOCA SW-induced Seal LOCA Total Mean Core Damage Frequency: 3.4E-4 Note: See text (Section 7.2.1) for benefit of recent modifications.

Figure 7.2 Contributors to mean core damage frequency from internal events at Zion.

3. Diesel Generators and ac power) also leads to loss of reactor coolant pump seal integrity. In contrast, Zion is a two-unit site with five emergency some other PWRs do not have a common diesel generators. One diesel generator is a dependency for both seal cooling and seal in-swing diesel that can be lined up to supply jection; therefore, at other PWRs, seal either unit. This differs from a number of LOCAs are only important in station black-other two-unit sites that have only four diesel out cases. As indicated above, the licensee generators on site. The Zion diesel genera- has committed to and implemented plant tors are dependent on a common service changes to reduce this dependency.

water system for sustained operation.

4. Support System Dependencies 5. Battery Depletion Time The component cooling water system supplies cooling water for the reactor coolant pump The battery depletion time following a com-thermal barriers and for the charging pumps plete loss of all ac power was estimated at 6 that supply seal injection. Failure of the com- hours, somewhat longer than that found at ponent cooling water system results in a ma- some other plants. The additional time tends jor challenge to reactor coolant pump seal in- to reduce the significance of the station tegrity. In addition, failure of the component blackout sequences as contributors to the cooling water support systems (service water core damage frequency.

7-5 75NUREG-1150

7. Zion Plant Results

6. Reactor Coolant Pump Seal Performance of the RWST. This action is not adequate for inventory control in the case of larger The inability of the reactor coolant pump LOCAs because of the limitations of the re-seals to survive loss of cooling and injection filling equipment.

without developing significant leakage domi-nates the core damage frequency. As noted Switchover to recirculation cooling and initiation above, the licensee has committed to replac- of feed and bleed cooling were included in the ing present seals with a new model. original Zion Probabilistic Safety Study and have been given close scrutiny by the licensee. Each 7.2.3 Important Operator Actions one of these actions is present in the emergency procedures. Appropriate consideration of the pro-Several operator actions and recovery actions are cedures, scenarios, timing, and training went into important to the analysis of the core damage fre- the determination of the human error probabilities quency. While the analysis included a wide range associated with these actions. Because of the im-of operator actions from test and maintenance er- portance and uncertainty associated with several rors before an initiating event to recovery a:Ztions of these actions, they were addressed in the sensi-well into an accident sequence, the following ac- tivity analyses. However, the refilling of the RWST tions surface as the most important: in the event of recirculation failure and recovery of CCW and service water were not included in

• Successful switchover to recirculation the original Zion Probabilistic Safety Study. Ap-propriate consideration of the procedures, scenar-The operator must recognize that switchover ios, timing, and training went into the determina-should be initiated, take action to open the tion of the human error probabilities associated proper set of motor-operated valves depend- with these actions. Because of the importance and ing on reactor coolant system conditions, and uncertainty associated with several of these ac-verify that recirculation flow is proper. tions, they were addressed in the sensitivity analy-ses.

• Successful execution of feed and bleed cool-ing 7.3 Containment Performance Analysis The operator must recognize that secondary 7.3.1 Results of Containment Performance cooling is lost, establish sufficient injection Analysis flow, open both power-operated relief valves The Zion containment consists of a large, dry (and their block valves, if necessary), and containment building that houses the reactor pres-verify that adequate heat removal is taking sure vessel, reactor coolant system piping, and the place. secondary system's steam generators. The con-tainment building is a prestressed concrete struc-

• Recovery of the component cooling water ture with a steel liner. This building has a volume and service water systems of 2.6 million cubic feet with a design pressure of 49 psig and an estimated mean failure pressure of The operator must recognize that the failure 150 psia. The principal threats to containment in-of equipment or rising equipment operating tegrity from potential severe accident sequences temperatures are due to failure of the service are steam explosions, overpressurization from di-water or component cooling water systems, rect containment heating effects, bypass events, determine the cause of system failure, and and isolation failures. As previously discussed in take appropriate action to isolate ruptures, Chapter 2, the methods used to estimate loads restart pumps, and provide alternative cool- and containment structural response for Zion ing paths as required by the situation. made extensive use of expert judgment to inter-pret and supplement the limited data (Ref. 7.2).

• Actions to refill the RWST in the event of recirculation failure The results of the Zion containment analysis are summarized in Figures 7.3 and 7.4. Figure 7.3 This action requires that the operator recog- displays information in which the conditional nize the failure of recirculation cooling in suf- probabilities of four accident progression bins, ficient time that refill can begin before core e.g., early containment failure, are presented for damage occurs. The operator must then each of five plant damage states, e.g., LOCA.

carry out the procedure for emergency refill This information indicates that, on a plant damage NUREG-1150 7-6

7. Zion Plant Results PLANT DAMAGE STATE ACCIDENT (Mean Core Damage Frequency)

PROGRESSION BIN SBO LOCAs Transients V & SGTR All (9.34E-6) (3.14E-4) (1.36E-5) (2.59E-7) (3. 38E-4)

Early CF 10.025 10.014 10.012 10.014 Late CF 0.320 [10.250 U0.190 P0.240 Bypass I0.001 10.004 [ 3 10.007 No CF Key: CF = Containment Failure Figure 7.3 Conditional probability of accident progression bins at Zion.

7-7 NUREG-1150

7. Zion Plant Results lo-,

'-4) a) r-4 en .4)

A.0 0 a) co

-4 0 0-2

.C-4) 0 0

t4 Id 0 0

1t-3 Plant Damage States SBO LOCAs Transients All Core Damage Freq. (9.34E-6) (3.14E-4) (1.36E-5) (3.38E-4)

Figure 7.4 Conditional probability distributions for early containment failure at Zion.

NUREG-1 150 7-8

7. Zion Plant Results state frequency-weighted average,

• the mean con- 7.4 Source Term Analysis ditional probabilities from internal events of (1) early containment failure from a combination of 7.4.1 Results of Source Term Analysis in-vessel steam explosions, overpressurization, The containment performance results for the Zion and containment isolation failures is 0.014, (2) (large, dry containment) plant and the Surry (sub-late containment failure, mainly from basemat atmospheric containment) plant are quite similar.

meltthrough is 0.24, (3) containment bypass from The source terms for analogous accident progres-interfacing-system LOCA and induced steam gen- sion bins are also quite similar. Figure 7.5 illus-erator tube rupture (SGTR) is 0.006, and (4) trates the source term for early containment fail-probability of no containment failure is 0.73. Fig- ure. As at Surry, the source terms for early failure ure 7.4 further displays the conditional probability are somewhat less than those for containment by-distributions of early containment failure for the pass. Within the range of the uncertainty band, plant damage states, thereby providing the esti- however, the source terms from early containment mated range of uncertainties in these containment failure are potentially large enough to result in failure predictions. The principal conclusion to be some early fatalities.

drawn from the information in Figures 7.3 and 7.4 is that the probability of early containment The most likely outcome of a severe accident at failure for Zion is low, i.e., 1 to 2 percent. the Zion plant is that the containment would not fail. Figure 7.6 illustrates the range of source Additional discussion on containment perform- terms for the no containment failure accident pro-ance is provided in Chapter 9. gression bin. Other than for the noble gas and io-dine radionuclide groups, the entire range of source terms is below a release fraction of 10E-5.

7.3.2 Important Plant Characteristics (Containment Performance) Additional discussion on source term perspectives Characteristics of the Zion design and operation is provided in Chapter 10.

that are important to containment performance include: 7.4.2 Important Plant Characteristics (Source Term)

1. Containment Volume and Pressure Capa-bility 1. Containment Spray System The combined magnitude of Zion's contain- The containment spray system at the Zion ment volume and estimated failure pressure plant is not required to operate to provide provide considerable capability to withstand long-term cooling to the containment, in con-severe accident threats. trast to the Surry plant. Operation of the spray system is very effective, however, in re-

2. Reactor Cavity Geometry ducing the airborne concentration of aero-sols. Other than the release of noble gases The Zion containment design arrangement and some iodine evolution, the release of ra-has a large cavity directly beneath the reactor dioactive material to the atmosphere resulting pressure vessel that communicates to the from late containment leakage or basemat lower containment by means of an instru- meltthrough in which sprays have operated ment tunnel. Provided the contents of the re- for an extended time would be very small.

fueling water storage tank have been injected The source terms for the late containment prior to vessel breach, this arrangement failure accident progression bin are slightly should provide a mechanism for quenching higher than, but similar to, those of the no the molten core for some severe accidents containment failure bin illustrated in Figure (although there remains some uncertainties 7.6.

with respect to the coolability of molten core debris in such circumstances). 2. Cavity Configuration The Zion cavity is referred to as a wet cavity,

'Each value in the column in Figure 7.3 labeled "All" is a in that the accumulation of a relatively small frequency-weighted average obtained by calculating the amount of water on the containment floor products of individual accident progression bin condi- will lead to overflow into the cavity. As a re-tional probabilities for each plant damage state and the ratio of the frequency of that plant damage state to the sult, there is a substantial likelihood of elimi-total core damage frequency. nating by forming a coolable debris bed or 7-9 79NUREG-1 150

z 0

co Release Fraction 0d OR 1.OE+OO ED 95%

mean 1.OE-O1 median 5%

1.OE-02

-i3 0

1.OE-03 1.OE-04 1.OE-05 NG I Cs Te Sr Ru La Ba Ce Radionuclide Group Figure 7.5 Source term distributions for early containment failure at Zion.

Release Fraction 1 .OE+OO 96%

mean 1.OE-O1 median 6%

Th 1.OE-02 1.OE-03 1.OE-04 a N

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1.OE-05 z NG I Cs Te Sr Ru La Ba Ce C

Radionuclide Group CD tl LA~

0> Figure 7.6 Source term distributions for no containment failure at Zion.

7. Zion Plant Results mitigating by the presence of an overlaying an independent analysis by the Federal Emer-pool of water the release of radionuclides gency Management Agency (Ref. 7.8) and the from core-concrete interactions. NRC requirements for emergency planning.

The results displayed in Figure 7.7 are discussed 7.5 Offsite Consequence Results in Chapter 11.

Figure 7.7 displays the frequency distributions in 7.6 Public Risk Estimates the form of graphical plots of the complementary cumulative distribution functions (CCDFs) of four 7.6.1 Results of Public Risk Estimates*

offsite consequence measures-early fatalities, la- A detailed description of the results of the Zion tent cancer fatalities, and the 50-mile region and risk analysis is provided in Reference 7.2. For this entire site region population exposures (in person- summary report, results are. provided for the fol-rems). These CCDFs include contributions from lowing measures of public risk:

all source terms associated with reactor accidents caused by internal initiating events. Four CCDFs,

• Early fatality risk, namely, the 5th percentile, 50th percentile (me-

• Latent cancer fatality risk, dian), 95th percentile, and the mean CCDFs are

• Population dose within 50 miles of the site, shown for each consequence measure.

• Population dose within the entire site region,

• Individual early fatality risk in the population Zion plant-specific and site-specific parameters within 1 mile of the Zion exclusion area were used in the consequence analysis for these boundary, and CCDFs. The plant-specific parameters included source terms and their frequencies, the licensed

• Individual latent cancer fatality risk in the thermal power (3250 MWt) of the reactor, and population within 10 miles of the Zion site.

the approximate physical dimensions of the power The first four of the above measures are com-plant building complex. The site-specific parame- monly used measures in nuclear plant risk studies.

ters included exclusion area radius (400 meters), The last two are those used to compare with the meteorological data for 1 full year collected at the NRC safety goals (Ref. 7.9).

site meteorological tower, the site region popula-tion distribution based on the 1980 census data, The results of the Zion risk analyses are shown in topography (fraction of the area which is land- Figures 7.8 through 7.10. The figures display the remaining fraction is assumed to be water), variabilities in mean risks estimated from the me-land use, agricultural practice and productivity, teorology-based conditional mean values of the and other economic data for up to 1,000 miles consequence measures. The risk estimates are from the Zion plant. slightly higher than those of the other two PWR plants (Surry and Sequoyah) in this study. Indi-The consequence estimates displayed in these fig- vidual early and latent cancer fatality risks are well ures have incorporated the benefits of the follow- below the NRC safety goals. Detailed comparisons ing protective measures: (1) evacuation of 99.5 of results are given in Chapter 12.

percent of the population within the 10-mile plume exposure pathway emergency planning The risk results shown in Figure 7.8 have been zone (EPZ), (2) early relocation of the remaining analyzed to identify the principal contributors (accident sequences and containment failure population only from the heavily contaminated ar-eas both within and outside the 10-mile EPZ, and modes) to plant risk. These results are presented (3) decontamination, temporary interdiction, or in Figures 7.11 and 7.12. As may be seen, both condemnation of land, property, and foods con- for early and latent cancer fatality risks, the domi-taminated above acceptable levels. nant plant damage state is loss-of-coolant-accident (LOCA) sequences, which have the highest relative frequency and relatively high release The population density within the Zion 10-mile fractions. Zion plant risks are dominated by early EPZ is about 1360 persons per square mile. containment failure (alpha-mode failure, contain-About 45 percent of the 10-mile EPZ is water. ment isolation failure, and overpressurization The average delay time before evacuation (after a warning prior to radionuclide release) from the 10-mile EPZ and average effective evacuation *As noted in Section 7.2, sensitivity studies have been per-speed used in the analyses were derived from in- formed to reflect recent modifications in the Zion plant.

The impact on risk is displayed on the figures in this sec-formation contained in a utility-sponsored Zion tion. More detailed discussion on the sensitivity studies evacuation time estimate study (Ref. 7.7) and in may be found in Section C.15 of Appendix C.

NUREG-1 150 7-12

1=

I.OF-03 C,1, 0 1.OE-04 1.

E' 1.OE-05 1I. - .OE-00 a 0 C:

Cx 3 1,0E-07 I

1.06-08

,~1.

U.

01 0 1,~

.OE-0 wD 1. 0 dS I.OE- o t.OE.01 .0E+02 .E*03 oE604 1.0E-05 1.0E.08 Early Fatalities Latent Cancer Fatalities I-1I.OE-OS l.OE-03 - -_-

P--- - 1.0E-04 ------

0 12 co CD I?

Q. 1.06-06 0 0

C va

4) 1.06-07 0 1.0E-07 r_

LA.

• Percentle 034 e) 1.0E-08 * -- 5th U t.OE-08 ---

__I C 0

Moan 0L a) N a)1,OE-09 I- 50th U .OE-O9 - 601ht a}*X\s 0

a'

• - 5th :3 Lu -- - . . ...... . .. . I ,.

z 1.Q0_- ' WW 1.0E- 10 d

.OE.OO 1.0E02 1.OE.04 1.06O.0 1.0E-08 1.E0 0 1.01 02 tOE-OR *.OE-04 l.OE-08 P Population Dose (person-rem) to -50 Miles Population Dose (person-rem) to -Entire Region ;II Note: As discussed in Reference 7.6, estimated risks at or below E-7 per reactor year should be viewed with caution because of the LA CD potential impact of events not studied in the risk analyses.

Figure 7.7 Frequency distributions of offsite consequence measures at Zion (internal initiators).

7. Zion Plant Results I;..+

Number of LHS Obsrattons\,V J; - ^ ~~~~~~~Key:

M meanhi m n,*dlan t 10I Number of LHS Observations

.Notes As discussed in Reference 7.6, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

'Y' shows recalculated mean value based on plant modifications discussed in Section 7.2.1I.

- ~~Figure 7.8 Early and latent cancer fatality risks at Zion (internal initiators).

NUREG-1150 7-14 1004006 , 'WM ... -19 " M

7. Zion Plant Results a

uP 95ih ..

id' O -= +

to 5th ,.

idb C

04 Number of LHS Observations Key: M mean m - median 01S t - percentile t1i M , +

5th.

I4 o 1 P210 Number of LHS Observations Notes: As discussed in Reference 7.6, estimated risks at or below IE-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

"+"shows recalculated mean value based on plant modifications discussed in Section 7.2.1.

Figure 7.9 Population dose risks at Zion (internal initiators).

7-15 NUREG-1 150

7. Zion Plant Results 10 V

. Safety Goal t6 1CF - M9 10 L ,+

I'll 10 lo-l 5th.i a

Number of LHS Observations Key: M - mean m - median

- percentile 10 4)

.- ~Safety Goal C4)

g 10F,-'

95h S: 1, M~ 10*

~~~+

T ,

5th , :1

.4 Number of LHS Observations Notes: As discussed in Reference 7.6, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of other health effects not studied in the risk analyses.

"+"shows recalculated mean value based on plant modifications discussed in Section 7.2.1.

Figure 7.10 Individual early and latent cancer fatality risks at Zion (internal initiators).

NUREG-1150 7-16

7. Zion Plant Results ZION EARLY FATALITY ZION LATENT CANCER FATALITY MEAN t.i-418Y MEAN 2.4r-&/RY 3

1 4 6

--w-w 5

Plant Damage Statea t 82o

2. ATWS S. TRANSIENTS

4. LOCA

5. YPASS Figure 7.11 Major contributors (plant damage states) to mean early and latent cancer fatality risks at Zion (internal initiators).

ZION EARLY FATALITY ZION LATENT CANCER FATALITY MEAN

• tE-4VAY MEAN * .4E-RIRY 1

2 Accident Progression Bins

1. YPA8

2. EARLY CONT. FAILURE Figure 7.12 Major contributors (accident progression bins) to mean early and latent cancer fatality risks at Zion (internal initiators).

7-17 NUREG-1 150

7. Zion Plant Results failure). This occurs because, although the condi- tainment isolation, and overpressurization tional probability of early failure is low, other fail- failures.

ure modes have even lower probabilities.

• The containment structure at Zion is robust, 7.6.2 Important Plant Characteristics (Risk) with a low probability of failure. This has led to the low risk estimates from the Zion plant.

• As discussed before, the dominant risk con- (In comparison with other plants studied in tributor for the Zion plant is early contain- this report, risks from Zion are relatively ment failure. The accident progression bin high; but, in the absolute sense, the risks are for early containment failure contains several very low and well below the NRC safety failure modes such as the alpha-mode, con- goals.)

NUREG-1 150 7-18

7. Zion Plant Results REFERENCES FOR CHAPTER 7 7.1 M. B. Sattison and K. W. Hall, "Analysis of 7.5 R. A. Chrzanowski, CECo, "March 13, 1989 Core Damage Frequency: Zion Unit 1," Letter from Cordell Reed to T. E. Murley,"

Idaho National Engineering Laboratory, NRC, NRC Docket Nos. 50-295 and NUREG/CR-4550, Vol. 7, Revision 1, 50-304, August 24, 1990.

EGG-2554, May 1990.

7.6 H. J. C. Kouts et al., "Special Committee 7.2 C. K. Park et al., "Evaluation of Severe Ac- Review of the Nuclear Regulatory Commis-cident Risks: Zion Unit 1," Brookhaven Na- sion's Severe Accident Risks Report tional Laboratory, NUREGICR-4551, Vol. (NUREG-1150)," NUREG-1420, August 7, Draft Revision 1, BNL-NUREG-52029, 1990.

to be published.*

7.7 Stone & Webster Engineering Corporation, 7.3 D. L. Berry et al., "Review and Evaluation of "Preliminary Evacuation Time Study of the the Zion Probabilistic Safety Study: Plant 10-Mile Emergency Planning Zone at the Analysis," Sandia National Laboratories, Zion Station," prepared for Commonwealth NUREG/CR-3300, Vol. 1, SAND83-1118, Edison Company, January 1980.

May 1984.

7.8 Federal Emergency Management Agency, 7.4 Cordell Reed, Commonwealth Edison Co. "Dynamic Evacuation Analyses: Independ-(CECo), "Zion Station Units 1 and 2. Com- ent Assessments of Evacuation Times from mitment to Provide a Backup Water Source the Plume Exposure Pathway Emergency to the Charging Oil Coolers," NRC Docket Planning Zones of Twelve Nuclear Power Nos. 50-295 and 50-304, March 13, 1989. Stations," December 1980.

7.9 USNRC, "Safety Goals for the Operation of Nuclear Power Plants; Policy Statement,"

• Available in the NRC Public Document Room, 2120 L Street FederalRegister, Vol. 51, p. 30028, August NW., Washington, DC. 21, 1986.

7-19 NUREG-1150

PART III Perspectives and Uses

8. PERSPECTIVES ON FREQUENCY OF CORE DAMAGE 8.1 Introduction there is substantial plant-to-plant variability among important accident sequences.

Chapters 3 through 7 have summarized the core damage frequencies individually for the five plants Figures 8.5 through 8.8 provide the results of the assessed in this study. Significant differences external-event analyses, and Figures 8.9 through among the plants can be seen in the results, both 8.12 give the breakdown of these analyses accord-in terms of the core damage frequencies and the ing to the principal types of accident sequences.

particular events that contribute most to those fre-quencies. These differences are due to plant-spe- 8.3 Comparison with Reactor Safety cific differences in the plant designs and opera- Study tional practices. Despite the plant-specific nature of the study, it is possible to obtain important per- Figures 8.13 and 8.14 show the internal core spectives that may have implications for a larger damage frequency distributions calculated in this number of plants and also to describe the types of present study for Surry and Peach Bottom along plant-specific features that are likely to be impor- with distributions synthesized from the Reactor tant at other plants. This chapter provides some of Safety Study (Ref. 8.6), which also analyzed these perspectives. Surry and Peach Bottom. The Reactor Safety Study presented results in terms of medians but 8.2 Summary of Results not means. It can be seen that the medians are lower in the present work, although observation of As discussed in Chapter 2, the core damage fre- the overlap of the ranges shows that the change is quency is not a value that can be calculated with more significant for Peach Bottom than for Surry.

absolute certainty and thus is best characterized by a probability distribution. It is therefore dis- There are two important reasons for the differ-cussed in this report in terms of the mean, me- ences between the new figures and those of the dian, and various percentile values. The internal- Reactor Safety Study. The first is the fact that event core damage frequencies are illustrated probabilistic risk analyses (PRAs) are snapshots in graphically in Figure 8.1 (Refs. 8.1 through 8.5). time. In these cases, the snapshots are taken The figure does not include the contributions of about 15 years apart. Both plants have imple-external events, which are discussed in Section mented hardware modifications and procedural 8.4. improvements with the stated purpose of increas-ing safety, which drives core damage frequencies downward.

In Figure 8.1 the lower and upper extremities of the bars represent the 5th and 95th percentiles of The second reason is that the state of the art in the distributions, with the mean and median of applying probabilistic analysis in nuclear power each distribution also shown. Thus, the bars in- plant applications has advanced significantly since clude the central 90 percent of the distributions (it the Reactor Safety Study was performed. Compu-should be remembered that the distributions are tational techniques are now more sophisticated, not uniform within these bars). These figures show computing power has increased enormously, and that the range between the 5th and 95th percen- consequently the level of detail in modeling has tiles covers from one to two orders of magnitude increased. In some cases, these new methods have for the five plants. There is also significant overlap reduced or eliminated previous analytical conser-among the distributions, as discussed below. The vatisms. However, new types of failures have also reader should refer to References 8.1 through 8.5 been discovered. For example, the years of expe-for detailed discussion of the distributions. rience with probabilistic analyses and plant opera-tion have uncovered the reactor coolant pump Figures 8.2 and 8.3 show the contributions of the seal failure scenario as well as intersystem depend-principal types of accidents to the mean core encies, common-mode failure mechanisms, and damage frequency for each plant. Figure 8.4 also other items that were less well recognized at the presents this breakdown, but on a relative scale. time of the Reactor Safety Study. Of course, this These figures show that some types of accidents, same experience has also uncovered new ways in such as station blackouts, contribute to the core which recovery can be achieved during the course damage frequencies for all the plants; however, of a possible core damage scenario (except for the 8-1 NUREG- 1150

8. Core Damage Frequency 1.OE-03 C

1.OE-04 0

R +

E D

A M

A G

E 1.OE-05 F

R E

a U

E N

C Y

1.OE-06 1.OE-07 SURRY PEACH GRAND SEQUOYAH ZION BOTTOM GULF 11Mean £1 Median Notes: As discussed in Reference 8.7, core damage frequencies below E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

"+" indicates recalculated Zion mean core damage frequency based on recent plant modifica-tions (see Section 7.2.1).

Figure 8.1 Internal core damage frequency ranges (5th to 95th percentiles).

NUREG-1150 8-2

8. Core Damage Frequency 1.OOOE- 06:

1.OOOE-06:

1.OOOE-07:

1.OOOE-08 L Peach Bottom Grand Gult M3 STATION BLAKOUT M ATWS M LOCA _ TRANSIENT Figure 8.2 BWR principal contributors to internal core damage frequencies.

1.OOOE-03 1.OOOE- 04 t.OOON-06_

l l 13 l  ;+

1.OOOE-05  : ~

1.OOOE-06 -_

Surry Sequoyah Zion

= STATION BLKOUT = ATWS L LOCA

_ TRANSIENT M INTF LOCA SEAL LOCA Notes: As discussed in Reference 8.7, core damage frequencies below 1E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

"+" indicates recalculated mean seal LOCA plant damage state frequency based on recent plant modifications (see Section 7.2.1).

Figure 8.3 PWR principal contributors to internal core damage frequencies.

8-3 NUREG-1150

8. Core Damage Frequency SEQUOYAH SURRY STATION BLACOUT STM GEN TUBE RUPT ATW9

. TRANSIENT s m ockM .. LOCA v ~~ T INTERF. SYS LOCA STATION BLACKOUT INTERF. SYST. LOCA ATVXTo GEN. TUBE RUPT TRANSIENT ZION BUKOUT LSTATIO SW-ND SEALLO PEACH BOTTOM GRAND GULF I BLACKOUT STATION BLACKOUT T RANSIENT ATWS VLOCA ATWS Figure 8.4 Principal contributors to internal core damage frequencies.

NUREG-1 150 8-4

8. Core Damage Frequency p

R 0

a A

D L

T y

a N

a I

1.OE-08 1.OE-07 1.OE-06 1.OE-05 1.OE-04 1.OE-03 1.OE-02 CORE DAMAGE FREQUENCY SEISMIC, LIVERMORE -- SEISMIC. EPRI -FIRE Figure 8.5 Surry external-event core damage frequency distributions.

p R

0 a

A B

L T

V N

S T

V 1.OE-08 1.OE-07 1.OE-06 1.OE-05 1.OE-04 .OE-03 1.OE-02 CORE DAMAGE FREQUENCY

---

SEISMIC, LIVERMORE --- SEISMIC, EPRI -FIRE Note: As discussed in Reference 8.7, core damage frequencies below 1E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

Figure 8.6 Peach Bottom external-event core damage frequency distributions.

8-5 NUREG- 1150

8. Core Damage Frequency 1.OE-03 H

C 0

R D

A 1.o1-04 E 1.OE-05 F

R E

U

° 1.OE-06 C

y 1.OE-07 INTERNAL SEISMIC SEISMIC FIRE LIVERMORE EPRI B Mean -E Median Figure 8.7 Surry internal- and external-event core damage frequency ranges.

1.OE2-03 C

O 1.OE-04 R

E A

M 1.OE2-05 A I E

F R 1.OE -08 E~ ~ ~ ITRA EIMC SIMCFR 1.OE

- 0LVEMOE PR 8Mean tiMedian Note: As discussed in Reference 8.7, core damage frequencies below E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

Figure 8.8 Peach Bottom internal- and external-event core damage frequency ranges.

NUREG- 1150 8-6

8. Core Damage Frequency SURRY PEACH BOTTOM TRANSIENT RWT BLDG LO LOCA FAILURE VESSEL RUPT VESSEL RUPTURE MALL LOCA TRANSIENT SEAL LOCA Figure 8.9 Principal contributors to seismic core damage frequencies.

SURRY PEACH BOTTOM TRANSIENT SEAL LOCA, LOSS OF TUCK-OPEN OFFSITE PWR PORV TRANSIENT Figure 8.10 Principal contributors to fire core damage frequencies.

8-7 NUREG-1150

8. Core Damage Frequency AUX BLDG = .

CONTROL ROOM CABLE VAULT & TUNNEL .

EMER. SWITCHGEAR ....

0 10 20 30 40 SO 60 70 X IE-7 PER YEAR Figure 8.11 Surry mean fire core damage frequency by fire area.

EMER SWGEAR RM 2A EMER SWGEAR RM 2B -

EMER SWGEAR RM 2C EMER SWGEAR RM 2D EMER SWGEAR RM 3A EMER SWGEAR RM 3B EMER SWGEAR RM 3C EMER SWGEAR RM 3D CONTROL ROOM CABLE SPREADING ROOM 0 10 20 30 40 50 60 70 X 1E-7 PER YEAR Note: As discussed in Reference 8.7, core damage frequencies below 1E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

Figure 8.12 Peach Bottom mean fire core damage frequency by fire area.

NUREG- 1150 8-8

8. Core Damage Frequency 1.OE-03 C

0 R

0 A

1.OE-04 NI A

0 E

F R

aU 1.OE-06 N

C y

1.OE-06 THIS STUDY REACTOR SAFETY STUDY R Mean -0 Median Figure 8.13 Comparison of Surry internal core damage frequency with Reactor Safety Study.

1.OE-03 C

aR 11 E 1.OE-04 0

A U

A Q

ft a 1.OE-06 F

R' H

a U

H 1.OE-06 N

C Y

1.OE-07 THIS STUDY REACTOR SAFETY STUDY 0- Mean E3Median Note: As discussed in Reference 8.7, core damage frequencies below E-5 per reactor year should be viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered) .

Figure 8.14 Comparison of Peach Bottom internal core damage frequency with Reactor Safety Study.

8-9 NUREG-1150

8. Core Damage Frequency recovery of ac power, the Reactor Safety Study In summary, there have been reductions in the did not consider recovery actions). Thus, the net core damage frequencies for both plants since the effect of including these new techniques and ex- Reactor Safety Study. The reduction in core dam-perience is plant specific and can shift core dam- age frequency for Peach Bottom is more signifi-age frequencies in either higher or lower direc- cant than for Surry; however, there is still consid-tions. erable overlap of the uncertainty ranges of the two studies. The conclusion to be drawn is that the hardware and procedural changes made since the In the case of the Surry analysis, the Reactor Reactor Safety Study appear to have reduced the Safety Study found the core damage frequency to core damage frequency at these two plants, even be dominated by loss-of-coolant accidents when accounting for more accurate failure data (LOCAs). For the present study, station blackout and reflecting new sequences not identified in the accidents are dominant, while the LOCA-induced Reactor Safety Study (e.g., the reactor coolant core damage frequency is substantially reduced pump seal LOCA).

from that of the Reactor Safety Study, particularly for the small LOCA events. This occurred in spite 8.4 Perspectives of a tenfold increase in the small LOCA initiating event frequency estimates, which was a result of 8.4.1 Internal-Event Core Damage the inclusion of reactor coolant pump seal fail- Probability Distributions ures. One reason for the reduction lies in plant The core damage frequencies produced by all modifications made since the Reactor Safety PRAs inherently have large uncertainties. There-Study was completed. These modifications allow fore, comparisons of frequencies between PRAs for the crossconnection of the high-pressure safety or with absolute limits or goals are not simply a injection systems, auxiliary feedwater systems, and matter of comparing two numbers. It is more ap-refueling water storage tanks between the two propriate to observe how much of the probability units at the Surry site. These crossties provide a distribution lies below a given point, which trans-reliable alternative for recovery of system failures. lates into a measure of the probability that the Thus, the plant modifications (the crossconnec- point has not been exceeded. For example, if the tions) have driven the core damage frequencies median were exactly equal to the point in ques-downward, but new PRA information (the higher tion, half of the distribution would lie above and small LOCA frequency) has driven them upward. half below the point, and there would be a 50 per-In this case, the net effect is an overall reduction cent probability that the point had not been ex-in the core damage frequency for internal events. ceeded.

Similarly, when comparing core damage frequen-In the case of Peach Bottom, the Reactor Safety cies calculated for two or more plants, it is not Study found the core damage frequency to be sufficient to simply compare the mean values of comprised primarily of ATWS accident sequences the probability distributions. Instead, one must and of transients with long-term failure of decay compare the entire distribution. If one plant's dis-heat removal. The present study concludes that tribution were almost entirely below that of an-station blackout scenarios are dominant. The pos- other, then there would be a high probability that sibility of containment venting and allowing for the first plant had a lower core damage frequency some probability of core cooling after containment than the second. Seldom is this the case, however.

failure has considerably reduced the significance Usually, the distributions have considerable over-of the long-term loss of decay heat removal acci- lap, and the probability that one plant has a dents. In addition, the plant has implemented higher or lower core damage frequency than an-some ATWS improvements, although ATWS other must be calculated. References 8.1 through events remain among the dominant accident se- 8.5 contain more detailed information on the dis-quence types. Moreover, more modern neutronic tributions that would support such calculations.

and thermal-hydraulic simulations of the ATWS sequences have calculated lower core power levels Although the distributions are not compared in during the event, allowing more opportunity for detail here, the overlap of such core damage mitigation such as through the use of low-pressure frequency distributions is clearly shown in Figure injection systems. Thus, for Peach Bottom, both 8.1. For example, one can have relatively high advances in PRA methodology and plant modifi- confidence that the internal-event core damage cations have contributed to a reduction in the esti- frequency for Grand Gulf is lower than that of mated core damage frequency from internal Sequoyah or Surry. Conversely, it can readily be events. seen that the differences in core damage NUREG-1 150 8-10

8. Core Damage Frequency frequency between Surry and Sequoyah are not It should be noted that the selection of categories very significant. is not unique in a mathematical sense, but instead is a convenient way to group the results. If the Interpretation of extremely low median or mean core damage frequency is to be changed, changing core damage frequencies (<lE-5) is somewhat dif- something common to the dominant PDS will ficult. As discussed in Section 1.3 and in Refer- have the most effect. Thus, if a particular plant ence 8.7, there are limitations in the scope of the had a relatively high core damage frequency and a study that could lead to actual core damage fre- particular group of sequences were high, a valu-quencies higher than those estimated. In addition, able insight into that plant's safety profile would the uncertainties in the sequences included in the be obtained.

study tend to become more important on a rela-tive scale as the frequency decreases. A very low It should also be noted that the importance of the core damage frequency is evident for Grand Gulf highest frequency accident sequences should be with the median of the distribution in the range of considered in relationship to the total core dam-1E-6 per reactor year. However, it is incomplete age frequency. The existence of a highly dominant to simply state that the core damage frequency for accident sequence or PDS does not of itself imply this plant is that low since the 95th percentile ex- that a safety problem exists. For example, if a ceeds 1E-5 per reactor year. Thus, although the plant already had an extremely low estimated core central tendency of the calculation is very low, damage frequency, the existence of a single, there is still a finite probability of a higher core dominant PDS would have little significance. Simi-damage frequency, particularly when considering larly, if a plant were modified such that the domi-that the scope of the study does not include cer- nant PDS were eliminated entirely, the next high-tain types of accidents as discussed in Section 1.3. est PDS would become the most dominant con-tributor.

Nevertheless, it is the study of the dominant PDS 8.4.2 Principal Contributors to Uncertainty and the important failures that contribute to those in Core Damage Frequency sequences that provides understanding of why the core damage frequency is high or low relative to In Section 8.4.3, analyses are discussed concern- other plants and desired goals. This qualitative un-ing some of the issues and events that contribute derstanding of the core damage frequency is nec-to the magnitude of the core damage frequency. essary to make practical use of the PRA results Generally, for the accident frequency analysis, the and improve the plants, if necessary.

issues that contribute most to the magnitude of the frequency are also the issues that contribute most Given this background, the dominant PDSs for to the estimated uncertainty. More detail con- the five studies are illustrated in Figures 8.2, 8.3, cerning the contributions of various parameters to and 8.4. Additional discussion of these PDSs can the uncertainty in core damage frequency may be be found in Chapters 3 through 7. Several obser-found in References 8.1 through 8.5. Perspectives vations on these PDSs and their effects on the on the contributions of accident frequency issues core damage frequency can be made, as discussed to the uncertainty in risk may be found in Chapter below.

12.

Boiling Water Reactor versus Pressurized Water Reactor 8.4.3 Dominant Accident Sequence Types It is evident from Figure 8.1 that the two particu-The various accident sequences that contribute to lar BWRs in this study have internal-event core the total core damage frequency can be grouped damage frequency distributions that are substan-by common factors into categories. Older PRAs tially lower than those of the three PWRs. While it generally did this in terms of the initiating event, would be inappropriate to conclude that all BWRs e.g., transient, small LOCA, large LOCA. Current have lower core damage frequencies than PWRs, practice also uses categories, such as ATWS, seal it is useful to consider why the core damage fre-LOCA, and station blackout. Generally, these quencies are lower for these particular BWRs.

categories are not equal contributors to the total core damage frequency. In practice, four or five The LOCA sequences, often dominant in the sequence categories, sometimes fewer, usually PWR core damage frequencies, are minor con-contribute almost all the core damage frequency. tributors in the case of the BWRs. This is not These will be referred to below as the dominant surprising in view of the fact that most BWRs have plant damage states (PDSs). many more systems than PWRs for injecting water 8-11 NUREG-1150

8. Core Damage Frequency directly into the reactor coolant system to provide Station blackout accidents contribute a high per-makeup. For BWRs, this includes two low- centage of the core damage frequency for the pressure emergency core cooling (ECC) systems BWRs. However, when viewed on an absolute (low-pressure coolant injection and low-pressure scale, station blackout has a higher frequency at core spray), each of which is multitrain; two high- the PWRs than at the BWRs. To some extent this pressure injection systems (reactor core isolation is due to design differences between BWRs and cooling and either high-pressure coolant injection PWRs leading to different susceptibilities. For ex-or high-pressure core spray); and usually several ample, in station blackout accidents, PWRs are other alternative injection systems, such as the potentially vulnerable to reactor coolant pump control rod drive hydraulic system, condensate, seal LOCAs following loss of seal cooling, leading service water, firewater, etc. In contrast, PWRs to loss of inventory with no method for providing generally have one high-pressure and one low- makeup. BWRs, on the other hand, have at least pressure ECC system (both multitrain), plus a set one injection system that does not require ac of accumulators. The PWR ECCS does have con- power. While important, it would be incorrect to siderable redundancy, but not as much as that of imply that the differences noted above are the most BWRs. only considerations that drive the variations in the core damage frequency. Probably more important For many types of transient events, the above ar- is the electric power system design at each plant, guments also hold. BWRs tend to have more sys- which is largely independent of the plant type.

tems that can provide decay heat removal than The station blackout frequency is low at Peach PWRs. For transient events that lead to loss of Bottom because of the presence of four diesels water inventory due to stuck-open relief valves or that can be shared between units and a mainte-primary system leakage, BWRs have numerous nance program that led to an order of magnitude systems to provide makeup. ATWS events and reduction in the diesel generator failure rates.

station blackout events, as discussed below, affect Grand Gulf has essentially three trains of emer-both PWRs and BWRs. gency ac power for one unit, with one of the trains being both diverse and independent from the BWRs have historically been considered more other two. These characteristics of the electric subject than PWRs to ATWS events. This percep- power system design tend to dominate any differ-tion was partly due to the fact that some ATWS ences in the reactor design. Therefore, a BWR events in a BWR involve an insertion of positive with a below average electric power system reli-reactivity. Except for the infrequent occurrence of ability could be expected to have a higher station an unfavorable moderator temperature coeffi- blackout-induced core damage frequency than a cient, an ATWS event in a PWR is slower, allow- PWR with an above average electric power system.

ing more time for mitigative action.

For both BWRs and PWRs, the analyses indicate In spite of this historical perspective for ATWS, it that, along with electric power, other support sys-is evident from Figures 8.2 and 8.3 that the tems, such as service water, are quite important.

ATWS frequencies for the two BWRs are not dra- Because these systems vary considerably among matically higher than for the PWRs. There are plants, caution must be exercised when making several reasons for this. First, plant procedures for statements about generic classes of plants, such as dealing with ATWS events have been modified PWRs versus BWRs. Once significant plant-over the past several years, and operator training specific vulnerabilities are removed, support-specifically for these events has improved signifi- system-driven sequences will probably dominate cantly. Second, the ability to model and analyze the core damage frequency of both types of ATWS events has improved. More modern plants. Both types of plants have sufficient redun-neutronic and thermal-hydraulic simulations of dancy and diversity so as to make multiple inde-the ATWS sequences have calculated lower core pendent failures unlikely. Support system failures power levels during the event than predicted in introduce dependencies among the systems and the past. Further, these calculations indicate that thus can become dominant.

low-pressure injection systems can be used without resulting in significant power oscillations, thus al- Boiling Water Reactor Observations lowing more opportunity for mitigation. Note that for both BWRs and PWRs the frequency of reac- As shown in Figure 8.1, the internal-event core tor protection system failure remains highly un- damage frequencies for Peach Bottom and Grand certain. Therefore, all comparisons concerning Gulf are extremely low. Therefore, even though ATWS should be made with caution. dominant plant damage states and contributing NUREG-1 150 8-12

8. Core Damage Frequency failure events can be identified, these items should Peach Bottom is an older model BWR that does not be considered as safety problems for the two not have a diverse diesel generator for the high-plants. In fact, these dominating factors should pressure core spray system. However, other fac-not be overemphasized because, for core damage tors contribute to a low station blackout frequency frequencies below 1E-5, it is possible that other at Peach Bottom. Peach Bottom is a two-unit site, events outside the scope of these internal-event with four diesel generators available. Any one of analyses are the ones that actually dominate. In the four diesels can provide sufficient capacity to the cases of these two plants, the real perspectives power both units in the event of a loss of offsite come not from understanding why particular se- power, given that appropriate crossties or load quences dominate, but rather why all types of se- swapping between Units 2 and 3 are used. This quences considered in the study have low fre- high level of redundancy is somewhat offset by a quencies for these plants. less redundant service water system that provides cooling to the diesel generators. Subtleties in the Previously it was noted that LOCA sequences can design are such that if a certain combination of be expected to have low frequencies at BWRs be- diesel generators fails, the service water system cause of the numerous systems available to pro- will fail, causing the other diesels to fail. In addi-vide coolant injection. While low for both plants, tion, station dc power is needed to start the die-the frequency of LOCAs is higher for Peach Bot- sels. (Some emergency diesel generator systems, tom than for Grand Gulf. This is primarily be- such as those at Surry, have a separate dedicated cause Grand Gulf is a BWR-6 design with a mo- dc power system just for starting purposes.) In tor-driven high-pressure core spray system, rather spite of these factors, the redundancy in the than a steam-driven high-pressure coolant injec- Peach Bottom emergency ac power system is con-tion system as is Peach Bottom. Motor-driven sys- siderable.

tems are typically more reliable than steam-driven systems and, more importantly, can operate over While there is redundancy in the ac power system the entire range of pressures experienced in a design at Peach Bottom, the most significant fac-LOCA sequence. tor in the low estimated station blackout fre-quency relates to the plant-specific data analysis.

It is evident from Figures 8.2 and 8.4 that station The plant-specific analysis determined that, be-blackout plays a major role in the internal-event cause of a high-quality maintenance program, the core damage frequencies for Peach Bottom and diesel generators at Peach Bottom had approxi-Grand Gulf. Each of these plants has features that mately an order of magnitude greater reliability tend to reduce the station blackout frequency, than at an average plant. This factor directly influ-some of which would not be present at other ences the frequency.

BWRs.

Finally, Peach Bottom, like Grand Gulf, has sta-Grand Gulf, like all BWR-6 plants, is equipped tion batteries that are sized to last several hours in with an extra diesel generator dedicated to the the event that the diesel generators do fail. With high-pressure core spray system. While effectively two steam-driven systems to provide coolant injec-providing a third train of redundant emergency ac tion and several hours to recover ac power prior power for decay heat removal, the extra diesel to battery depletion, the station blackout fre-also provides diversity, based on a different diesel quency is further reduced.

design and plant location relative to the other two diesels. Because of the aspect of diversity, the Unlike most PWRs, the response of containment analysis neglected common-cause failures affect- is often a key in determining the core damage fre-ing all three diesel generators. The net effect is a quency for BWRs. For example, at Peach Bottom, highly reliable emergency ac power capability. In there are a number of ways in which containment those unlikely cases where all three diesel genera- conditions can affect coolant injection systems.

tors fail, Grand Gulf relies on a steam-driven cool- High pressure in containment can lead to closure ant injection system that can function until the of primary system relief valves, thus failing low-station batteries are depleted. At Grand Gulf the pressure injection systems, and can also lead to batteries are sized to last for many hours prior to failure of steam-driven high-pressure injection sys-depletion so that there is a high probability of re- tems due to high turbine exhaust backpressure.

covering ac power prior to core damage. In addi- High suppression pool temperatures can also lead tion, there is a diesel-driven firewater system to the failure of systems that are recirculating available that can be used to provide coolant water from the suppression pool to the reactor injection in some sequences involving the loss of coolant system. If the containment ultimately fails, ac power. certain systems can fail because of the loss of net 8-13 NUREG-1 150

8. Core Damage Frequency positive suction head in the suppression pool, and to the additional redundancy available in the in-also the reactor building is subjected to a harsh jection systems. In addition to the normal high-steam environment that can lead to failure of pressure injection capability, Surry can crosstie to equipment located there. the other unit at the site for an additional source of high-pressure injection. This reduces the core Despite the concerns described in the previous damage frequency due to LOCAs and also certain paragraph, the core damage frequency for Peach groups of transients involving stuck-open relief Bottom is relatively low, compared to the PWRs, valves.

There are two major reasons for this. First, Peach Bottom has the ability to vent the wetwell through In addition, at Sequoyah there is a particularly a 6-inch diameter steel pipe, thus reducing the noteworthy emergency core cooling interaction containment pressure without subjecting the reac- with containment engineered safety features in tor building to steam. While this vent cannot be loss-of-coolant accidents. In this (ice condenser) used to mitigate ATWS and station blackout se- containment design, the containment sprays are quences, it is valuable in reducing the frequency automatically actuated at a very low pressure set-of many other sequences. The second important point, which would be exceeded for virtually all feature at Peach Bottom is the presence of the small LOCA events. This spray actuation, if not control rod drive system, which is not affected by terminated by the operator can lead to a rapid de-either high pressure in containment or contain- pletion of the refueling water storage tank at Se-ment failure. Other plants of the BWR-4 design quoyah. Thus, an early need to switch to may be more susceptible to containment-related recirculation cooling may occur. Portions of this problems if they do not have similar features. For switchover process are manual at Sequoyah and, example, some plants have ducting, as opposed to because of the timing and possible stressful condi-hard piping available for venting. Venting through tions, leads to a significant human error probabil-ductwork may lead to harsh steam environments ity. Thus, LOCA-type sequences are the dominant and equipment failures in the reactor building.* accident sequence type at Sequoyah.

The Grand Gulf design is generally much less sus- Station blackout-type sequences have relatively ceptible to containment-related problems than similar frequencies at all three PWRs. Station.

Peach Bottom. The containment design and blackout sequences can have very different char-equipment locations are such that containment acteristics at PWRs than at BWRs. One of the rupture will not result in discharge of steam into most important findings of the study is the impor-the building containing the safety systems. Fur- tance of reactor coolant pump seal failures. Dur-ther, the high-pressure core spray system is de- ing station blackout, all cooling to the seals is lost signed to function with a saturated suppression and there is a significant probability that they will pool so that it is not affected by containment fail- ultimately fail, leading to an induced LOCA and ure. Finally, there are other systems that can pro- loss of inventory. Because PWRs do not have sys-vide coolant injection using water sources other tems capable of providing coolant makeup without than the suppression pool. Thus, containment fail- ac power, core damage will result if power is not ure is relatively benign as far as system operation restored. The seal LOCA reduces the time avail-is concerned, and there is no obvious need for able to restore power and thus increases the sta-containment venting. tion blackout-induced core damage frequency.

New seals have been proposed for Westinghouse Pressurized Water Reactor Observations PWRs and could reduce the core damage fre-quency if implemented, although they might also The three PWRs examined in this study reflect increase the likelihood that any resulting accidents much more variety in terms of dominant plant would occur at high pressure, which has implica-damage states than the BWRs. While the se- tions for the accident progression analysis. (See quence frequencies are generally low for most of Section C.14 of Appendix C for a more detailed the plant damage states, it is useful to understand discussion of reactor coolant seal performance.)

why the variations among the plants occurred.

Apart from the generic reactor coolant pump seal For LOCA sequences, the frequency is signifi- question, station blackout frequencies at PWRs cantly lower at Surry than at the other two PWRs. are determined by the plant-specific electric A major portion of this difference is directly tied power system design and the design of other support systems. Battery depletion times for the

• The staff is presently undertaking regulatory action to three PWRs were projected to be shorter than for require hard pipe vents in all BWR Mark I plants. the two BWRs. A particular characteristic of the NUREG-1150 8-14

8. Core Damage Frequency Surry plant is a gravity-fed service water system the loss of main and auxiliary feedwater. Appro-with a canal that may drain during station black- priate credit for these actions was given in these out, thus failing containment heat removal. When analyses. However, there are plant-specific fea-power is restored, the canal must be refilled be- tures that will affect the success rate of such ac-fore containment heat removal can be restored. tions. For example, the loss of certain power sources (possibly only one bus) or other support The dominant accident sequence type at Zion is systems can fail power-operated relief valves not a station blackout, but it has many similar (PORVs) or atmospheric dump valves or their characteristics. Component cooling water is block valves at some plants, precluding the use of needed for operation of the charging pumps and feed and bleed or secondary system blowdown.

high-pressure safety injection pumps at Zion. Loss Plants with PORVs that tend to leak may operate of component cooling water (or loss of service for significant periods of time with the block water, which will also render component cooling valves closed, thus making feed and bleed less re-water inoperable) will result in loss of these high- liable. On the other hand, if certain power failures pressure systems. This in turn leads to a loss of are such that open block valves cannot be closed, reactor coolant pump seal injection. Simultane- then they cannot be used to mitigate stuck-open ously, loss of component cooling water will also PORVs. Thus, both the system design and plant result in loss of cooling to the thermal barrier heat operating practices can be important to the reli-exchangers for the reactor coolant pump seals. ability assessment of actions such as feed and Thus, the reactor coolant pump seals will lose bleed cooling.

both forms of cooling. As with station blackout, loss of component cooling water or service water 8.4.4 External Events can both cause a small LOCA (by seal failure) and disable the systems needed to mitigate it. The The frequency of core damage initiated by exter-importance of this scenario is increased further by nal events has been analyzed for two of the plants the fact that the component cooling water system in this study, Surry and Peach Bottom (Ref. 8.1 at Zion, although it uses redundant pumps and (Part 3) and Ref. 8.2 (Part 3)). The analysis ex-valves, delivers its flow through a common amined a broad range of external events, e.g.,

header. The licensee for the Zion plant has made lightning, aircraft impact, tornados, and volcanic procedural changes and is also considering both activity (Ref. 8.8). Most of these events were as-the use of new seal materials and the installation sessed to be insignificant contributors by means of of modifications to the cooling water systems. bounding analyses. However, seismic events and These measures, which are discussed in more de- fires were found to be potentially major contribu-tail in Chapter 7, reduce the importance of this tors and thus were analyzed in detail.

contributor. Figures 8.7 and 8.8 show the results of the core damage frequency analysis for seismic- and fire-ATWS frequencies are generally low at all three of initiated accidents, as well as internally initiated the PWRs. This is due to the assessed reliability of accidents, for Surry and Peach Bottom, respec-the shutdown systems and the likelihood that only tively. Examination of these figures shows that the slow-acting, low-power-level events will result. core damage frequency distributions of the exter-nal events are comparable to those of the internal While of low frequency, it is worth noting that events. It is evident that the external events are interfacing-system LOCA (V) and steam genera-significant in the total safety profile of these tor tube rupture (SGTR) events do contribute sig- plants.

nificantly to risk for the PWRs. This is because they involve a direct path for fission products to Seismic Analysis Observations bypass containment. There are large uncertainties in the analyses of these two accident types, but The analysis of the seismically induced core dam-these events can be important to risk even at fre- age frequency begins with the estimation of the quencies that may be one or two orders of magni- seismic hazard, that is, the likelihood of exceed-tude lower than other sequence types. ing different earthquake ground-motion levels at the plant site. This is a difficult, highly judgmental During the past few years, most Westinghouse issue, with little data to provide verification of the PWRs have developed procedures for using feed various proposed geologic and seismologic models.

and bleed cooling and secondary system blow-down to cope with loss of all feedwater. These The sciences of geology and seismology have not procedures have led to substantial reductions in yet produced a model or group of models upon the frequencies of transient sequences involving which all experts agree. This study did not itself 8-15s NUREG-1 150

8. Core Damage Frequency produce seismic hazard curves, but instead made the two resulting distributions are not very mean-use of seismic hazard curves for Peach Bottom ingful because of the large widths of the two distri-and Surry that were part of an NRC-funded butions.

Lawrence Livermore National Laboratory project that resulted in seismic hazard curves for all nu- The breakdown of the Surry seismic analysis into clear power plant sites east of the Rocky Moun- principal contributors is reasonably similar to the tains (Ref. 8.9). results of other seismic PRAs for other PWRs. The total core damage frequency is dominated by loss In addition, the Electric Power Research Institute of offsite power transients resulting from seismi-(EPRI) developed a separate set of models (Ref. cally induced failures of the ceramic insulators in 8.10). For purposes of completeness and com- the switchyard. This dominant contribution of ce-parison, the seismically induced core damage fre- ramic insulator failures has been found in virtually quencies were also calculated based upon the all seismic PRAs to date.

EPRI methods. Both sets of results, which are pre-sented in Figures 8.5 through 8.8, were used in A site-specific but significant contributor to the this study. More detailed discussion of methods core damage frequency at Surry is failure of the used in the seismic analysis is provided in Appen- anchorage welds of the 4 kV buses. These buses dix A; Section C. 11 of Appendix C provides more play a vital role in providing emergency ac electri-detailed perspectives on the seismic issue as well. cal power since offsite power as well as emergency onsite power passes through these buses. Although As can be seen in Figures 8.5 and 8.6, the shapes these welded anchorages have more than ade-of the seismically induced core damage probability quate capacity at the safe shutdown earthquake distributions are considerably different from those (SSE) level, they do not have sufficient margin to of the internally initiated and fire-initiated events. withstand (with high reliability) earthquakes in the In particular, the 5th to 95th percentile range is range of four times the SSE, which are contribut-much larger for the seismic events. In addition, as ing to the overall seismic core damage frequency can be seen in Figures 8.7 and 8.8, the wide dis- results.

parity between the mean and the median and the Similarly, a substantial contribution is associated location of the mean relatively high in the distri- with failures of the- diesel generators and associ-bution indicate a wide distribution with a tail at ated load center anchorage failures. These an-the high end but peaked much lower down. (This chorages also may not have sufficient capacity to is a result of the uncertainty in the seismic hazard withstand earthquakes at levels of four times the curve.) SSE.

It can be clearly seen that the difference between Another area of generic interest is the contribu-the mean and median is an important distinction. tion due to vertical flat-bottomed storage tanks, The mean is the parameter quoted most often, but e.g., refueling water storage tanks and condensate the bulk of the distribution is well below the storage tanks. Because of the nature of their con-mean. Thus, although the mean is the "center of figuration and field erection practices, such tanks gravity" of the distribution (when viewed on a lin- have often been calculated to have relatively ear rather than logarithmic scale), it is not very smaller margin over the SSE than most compo-representative of the distribution as a whole. In- nents in commercial nuclear power plants. Given stead, it is the lower values that are more prob- that all PWRs in the United States use the refuel-able. The higher values are estimated to have low ing water storage tank as the primary source of probability, but, because of their great distance emergency injection water (and usually the sole from the bulk of the distribution, the mean is source until the recirculation phase of ECCS be-

"pulled up" to a relatively high value. In a case gins), failure of the refueling water storage tank such as this, it is particularly evident that the en- can be expected to be a substantial contributor to tire distribution, not just a single parameter such the seismically induced core damage frequency.

as the mean or the median, must be considered when discussing the results of the analysis. 2. Peach Bottom Seismic Analysis

1. Surry Seismic Analysis As can be seen in Figure 8.9, the dominant con-tributor in the seismic core damage frequency The core damage frequency probability distribu- analysis is a transient sequence brought about by tions, as calculated using the Livermore and EPRI loss of offsite power. The loss of offsite power is methods, have a large degree of overlap, and the due to seismically induced failures of onsite ac differences between the means and medians of power. Peach Bottom has four emergency diesel NUREG- 150 8-16

8. Core Damage Frequency generators, all shared between the two units, and scenario is evident in Figure 8.11, which breaks four station batteries per unit. Thus, there is a down the fire-induced core damage frequency by high degree of redundancy. However, all diesels location in the plant. The most significant physical require cooling provided by the emergency service location is the emergency switchgear room. In this water system, and failure to provide this cooling room, cable trays for the two redundant power will result in failure of all four diesels. trains were run one on top of the other with ap-proximately 8 inches of vertical separation in a There is a variety of seismically induced equip- number of plant areas, which gives rise to the ment failures that can fail the emergency service common vulnerability of these two systems due to water system and result in a station blackout. fire. In addition, the Halon fire-suppression sys-These include failure of the emergency cooling tem in this room is manually actuated.

tower, failures of the 4 kV buses (in the same manner as was found at Surry), and failures of the The other principal contributor is a spuriously ac-emergency service water pumps or the emergency tuated pressurizer PORV. In this scenario, fire-re-diesel generators themselves. The various combi- lated component damage in the control room in-nations of these failures result in a large number cludes control power for a number of safety sys-of potential failure modes and give rise to a rela- tems. Full credit was given for independence of tively high frequency of core damage based on the remote shutdown panel from the control room station blackout. None of these equipment failure except in the case of PORV block valves; discus-probabilities is substantially greater than would be sions with utility personnel indicated that control implied by the generic fragility data available. power for these valves was not independently However, the high probability of exceedance of routed.

larger earthquakes (as prescribed by the hazard curves for this site) results in significant contribu- 2. Peach Bottom Fire Analysis tions of these components to the seismic risk. Figure 8.10 shows the mechanisms by which fire leads to core damage in the Peach Bottom analy-Fire Analysis Observations sis. Station blackout accidents are the dominant contributor, with substantial contributions also The core damage likelihood due to a fire in any coming from fire-induced transients and losses of particular area of the plant depends upon the fre- offsite power. The relative importance of the vari-quency of ignition of a fire in the area, the ous physical locations is shown in Figure 8.12.

amount and nature of combustible material in that area, the nature and efficacy of the fire-suppres- It is evident from Figure 8.12 that control room sion systems in that area, and the importance of fires are of considerable significance in the fire the equipment located in that area, as expressed analysis of this plant. Fires in the control room in the potential of the loss of that equipment to were divided into two scenarios, one for fires initi-cause a core damage accident sequence. The ating in the reactor core isolation cooling (RCIC) methods used in the fire analysis are described in system cabinet and one for all others. Credit was Appendix A and in Reference 8.7; Section C.12 given for automatic cycling of the RCIC system of Appendix C provides additional perspectives on unless the fire initiated within its control panel.

the fire analysis. Because of the cabinet configuration within the control room, the fire was assumed not to spread

1. Surry Fire Analysis and damage any components outside the cabinet where the fire initiated. The analysis gave credit Figure 8.10 shows the dominant contributors to for the possibility of quick extinguishing of the fire core damage frequency resulting from the Surry within the applicable cabinet since the control fire analysis. The dominant contributor is a tran- room is continuously occupied. However, should sient resulting in a reactor coolant pump seal these efforts fail, even with high ventilation rates, LOCA, which can lead to core damage. The sce- these scenarios postulate forced abandonment of nario consists of a fire in the emergency the control room due to smoke from the fire and switchgear room that damages power or control subsequent plant control from the remote shut-cables for the high-pressure injection and compo- down panel.

nent cooling water pumps. No additional random failures are required for this scenario to lead to The cable spreading room below the control room core damage. It should be noted that credit was is significant but not dominant in the fire analysis.

given for existing fire-suppression systems and for The scenario of interest is a fire-induced transient recovery by crossconnecting high-pressure injec- coupled with fire-related failures of the control tion from the other unit. The importance of this power for the high-pressure coolant injection 8-17 NUREG-1150

8. Core Damage Frequency system, the reactor core isolation cooling system, fire-initiated core damage sequences are signifi-the automatic depressurization system, and the cant in the total probabilistic analysis of the two control rod drive hydraulic system. The analysis plants analyzed. Moreover, these analyses already gave credit to the automatic CO2 fire-suppression include credit for the fire protection programs re-system in this area. quired by Appendix R to 10 CFR Part 50.

The remaining physical areas of significance are the emergency switchgear rooms. The fire-in-duced core damage frequency is dominated by Although the two plants are of completely fire damage to the emergency service water system different design, with completely different fire-in conjunction with random failures coupled with initiated core damage scenarios, the possibility of fire-induced loss of offsite power. In all eight fires in the emergency switchgear areas is impor-emergency switchgear rooms (four shared be- tant in both plants. The importance of the emer-tween the two units), both trains of offsite power gency switchgear room at Surry is particularly high are routed. It was noted that in each of these ar- because of the seal LOCA scenario. Further, the eas there are breaker cubicles for the 4 kV importance of the control room at Surry is compa-switchgear with a penetration at the top that has rable to that of the control room at Peach Bottom.

many small cables routed through it. These pene-trations were inadequately sealed, which would al-low a fire to spread to cabling that was directly This is not surprising in view of the potential for above the switchgear room. This cabling was a suf- simultaneous failure of several systems by fires in ficient fuel source for the fire to cause a rapid for- these areas. Thus, in the past such areas have mation of a hot gas layer that would then lead to a generally received particular attention in fire pro-loss of offsite power. Since both offsite power and tection programs. It should also be noted that the the emergency service water systems are lost, a significance of various areas also depends upon station blackout would occur. the scenario that leads to core damage. For exam-ple, the importance of the emergency switchgear Perspectives: General Observations on Fire room at Surry could be altered (if desired) not Analysis only by more fire protection programs but also by changes in the probability of the reactor coolant Figures 8.7 and 8.8 clearly indicate that pump seal failure.

NUREG-1 150 8-18

8. Core Damage Frequency REFERENCES FOR CHAPTER 8 8.1 R. C. Bertucio and J. A. Julius, "Analysis of 8.6 USNRC, "Reactor Safety Study-An Assess-Core Damage Frequency: Surry Unit 1," ment of Accident Risks in U. S. Commercial Sandia National Laboratories, NUREG! Nuclear Power Plants," WASH-1400 CR-4550, Vol. 3, Revision 1, SAND86- (NUREG-75/014), October 1975.

2084, April 1990.

8.7 H. J. C. Kouts et al., "Special Committee 8.2 A. M. Kolaczkowski et al., "Analysis of Review of the Nuclear Regulatory Commis-Core Damage Frequency: Peach Bottom sion's Severe Accident Risks Report Unit 2," Sandia National Laboratories, (NUREG-1150)," NUREG-1420, August NUREG/CR-4550, Vol. 4, Revision 1, 1990.

SAND86-2084, August 1989.

8.8 M. P. Bohn and J. A. Lambright, "Proce-8.3 R. C. Bertucio and S. R. Brown, "Analysis dures for the External Event Core Damage of Core Damage Frequency: Sequoyah Unit Frequency Analyses for NUREG-1150,"

1," Sandia National Laboratories, NUREG/ Sandia National Laboratories, NUREG/

CR-4550, Vol. 5, Revision 1, SAND86- CR-4840, SAND88-3102, November 1990.

2084, April 1990.

8.9 D. L. Bernreuter et al., "Seismic Hazard 8.4 M. T. Drouin et al., "Analysis of Core Dam- Characterization of 69 Nuclear Power Sites age Frequency: Grand Gulf Unit 1," Sandia East of the Rocky Mountains," Lawrence National Laboratories, NUREGICR-4550, Livermore National Laboratory, NUREG/

Vol. 6, Revision 1, SAND86-2084, Septem- CR-5250, Vols. 1-8, UCID-21517, January ber 1989. 1989.

8.5 M. B. Sattison and K. W. Hall, "Analysis of 8.10 Seismicity Owners Group and Electric Power Core Damage Frequency: Zion Unit ," Research Institute, "Seismic Hazard Meth-Idaho National Engineering Laboratory, odology for the Central and Eastern United NUREG/CR-4550, Vol. 7, Revision 1, States," Electric Power Research Institute, EGG-2554, May 1990. EPRI NP-4726, July 1986.

8-19 NUREG- 1150

9. PERSPECTIVES ON ACCIDENT PROGRESSION AND CONTAINMENT PERFORMANCE 9.1 Introduction nected to the reactor coolant system fails outside the containment. The radionuclides can escape to The consequences of severe reactor accidents de- secondary buildings through the reactor coolant pend greatly on containment safety features and system piping without passing through the contain-containment performance in retaining radioactive ment. A similar bypass can occur in a core melt-material. The early failure of the containment down sequence initiated by the rupture of a steam structures at the Chernobyl power plant contrib- generator tube in which release is through relief uted to the size of the environmental release of valves on the steam line from the failed steam radioactive material in that accident. In contrast, generators.

the radiological consequences of the Three Mile Island Unit 2 (TMI-2) accident were minor be- Although the five plants analyzed in the present cause overall containment integrity was main- study were selected to span the basic types of con-tained and bypass was small. Normally three barri- tainment design used in the United States, it ers (the fuel rod cladding, the reactor coolant cannot be assumed that the containment system pressure boundary, and the containment performance results obtained are characteristic of pressure boundary) protect the public from the re- a class of plants. The loads in an accident lease of radioactive material generated in nuclear sequence, the relative frequencies of specific fuel. In most core meltdown scenarios, the first accident sequences, and the load level at which two barriers would be progressively breached, and the containment fails can all be influenced by the containment boundary represents the final design details that vary among reactors within a barrier to release of radioactivity to the environ- class of containments. (Additional discussion of ment. Maintaining the integrity of the contain- the extrapolability of PRA results is provided in ment can affect the source term by orders of mag- Chapter 13.)

nitude. The NRC's 1986 reassessment of source term issues reaffirmed that containment perform- 9.2 Summary of Results ance "is a major factor affecting source terms" (Ref. 9.1). If the containment function is maintained in a se-vere accident, the radiological consequences will be minor. If the containment function does fail, In most severe accident sequences, the ability of a the timing of failure can be very important. The containment boundary to maintain integrity is longer the containment remains intact relative to determined by two factors: (1) the magnitude of the time of core melting and radionuclide release the loads, and (2) the response to those loads of from the reactor coolant system, the more time is the containment structure and the penetrations available to remove radioactive material from the through the containment boundary. Although containment atmosphere by engineered safety fea-there is no universally accepted definition of con- tures or natural deposition processes. Delay in tainment failure, it does not necessarily imply containment failure or containment bypass also gross structural failure. For risk purposes, contain- provides time for protective action, a very impor-ment is considered to have failed to perform its tant consideration in the assessment of possible function when the leak rate of radionuclides to early health effects. Thus, in evaluating the per-the environment is substantial. Thus, failure could formance of a containment, it is convenient to occur as the result of a structural failure of the consider no failure, late failure, bypass, and early containment, tearing of the containment liner, or failure of containment as separate categories char-a high rate of a leakage through a penetration. acterizing different degrees of severity. For those Finally, valves that are open during normal opera- plants in which intentional venting is an option, tion may not close properly when the accident oc- this is also represented as a separate category.

curs. Failure of the containment isolation system can result in leakage of radioactive material to a Not all accident sequences that involve core dam-secondary building or directly to the environment. age would necessarily progress to vessel failure, as illustrated by the TMI-2 accident. The operator In some accidents, the containment building is may recover a critical system (such as by the re-completely bypassed. In interfacing-system loss- turn of offsite power) or the state of the plant may of-coolant accidents (LOCAs), check valves iso- change (for example, the system pressure may fall lating low-pressure piping fail, and the piping con- to a point where low-pressure emergency coolant 9-1 NUREG-1150

9. Accident Progression systems can be activated) allowing the core to be coolant system at high pressure, the probability of recovered and the accident to be terminated. The overheating and rupturing steam generator tubes likelihood of containment failure in terminated after the onset of core damage, with subsequent accidents is typically less than in accidents involv- bypass of the containment, is of the same magni-ing vessel failure, and the radiological conse- tude as the probability of early containment fail-quences are usually very small. ure from high-pressure ejection of core debris with direct containment heating. In Figure 9.1, 9.2.1 Internal Events the smaller spread in uncertainty in the downward direction for the Zion plant is due to the higher The probability of early containment failure and frequency of containment isolation failure, which vessel breach conditional on the indicated class of establishes a lower bound for the distribution.

sequence (and the mean frequency of the class) is illustrated in Figure 9.1 for three classes of acci- The results for the Sequoyah plant indicate that dent sequences in the pressurized water reactors early containment failure is somewhat more likely (PWRs) analyzed in this study and in Figure 9.2 for ice condenser designs than for large, high-for three classes of accident sequences in the boil- pressure containments. The mean likelihood of ing water reactors (BWRs) analyzed (Refs. 9.2 early failure is approximately 12 percent (8 per-through 9.6). Containment bypass scenarios are cent includes vessel breach, 4 percent does not).

not included in these figures, and the results are Early containment failure is primarily the result of for internally initiated accidents. For different loads at vessel failure. For scenarios in which the plant designs, the nature of the loads and the re- vessel is at high pressure at the time of vessel sponse of the containment are different, even for breach, early failure results from overpressuriza-the same accident class. tion (including the pressure load from hydrogen The predicted likelihoods of early containment burning) or from direct attack of the containment failure in the Zion (large, dry design) plant and by hot debris following failure of the seal table. If the Surry (subatmospheric design) plant are quite the vessel is at low pressure at vessel breach, the small (mean value of about 1 percent). The prin- principal failure mechanism is overpressurization.

cipal mechanisms leading to these failures are loads resulting from high-pressure melt ejection in The predicted probability of early failure of accident sequences with high reactor coolant sys- the Peach Bottom and Grand Gulf pressure-tem (RCS) pressures (at time of vessel breach) suppression containments is substantially higher and in-vessel steam explosions in sequences with than for the PWR containment designs. For low RCS pressures at vessel breach. Both phe- Grand Gulf, the mean probability of early failure nomena involve substantial uncertainties. is approximately 50 percent while at Peach Bot-tom the mean probability of early failure is about The principal reason that the probability of early 56 percent.

containment failure from loads at vessel breach is so small in the Surry and Zion analyses is that the In the Peach Bottom (Mark I design) plant, fail-reactor coolant system is not likely to be at high ure is predicted to occur primarily in the drywell pressure when vessel meltthrough occurs. Some of as a result of direct attack by molten core debris.

the mechanisms that were found to be effective in Drywell rupture due to pedestal failure or rapid depressurizing the vessel are hot leg or surge line overpressurization (more quickly than the water failure at elevated temperature, failure of a reac- columns in the vent lines can be cleared) is also tor coolant pump seal, or a stuck-open relief an important contributor to early containment valve. If an extreme case at Surry is selected, failure. If failure occurs in the drywell, releases of which is a large core fraction ejected, a dry cavity, radionuclides from fuel after vessel failure will not no sprays, a large hole in the vessel, and high re- pass through the suppression pool. Late failure of actor coolant system pressure, the conditional containment is also most likely to occur in the probability of containment failure is approximately drywell but in the form of prolonged leakage past 30 percent. However, this is a very unlikely case. the drywell head.

For cases with small holes in the reactor vessel and a small or intermediate fraction of the core ejected, which are much more likely, the prob- At Grand Gulf, early containment failure in ability of containment failure is a few percent or station blackout is dominated by hydrogen defla-less. grations. Hydrogen detonations are also small contributors to early failure. For short-term sta-For accident sequences at Surry and Zion in tion blackouts (the dominant plant damage state which core uncovery is initiated with the reactor groups), the conditional probability of early NUREG-1 150 9-2

9. Accident Progression Conditional Probability 9.SE- y-IT yni e 1.OE-OI 2.SE-5 yr-I I_.

1.QE-02 6 th I.OE-03 1.OE-04 Surry Zion Sequoyah

a. tation blackout Conditional Probability 1.OEOO 3.6E-5 yr-i _5th I.O2-01 3iE-A Yr-i 1.oE-02 _i yr-i O.IE-8 _flmda

_ th I.OE-03 I.OE-0 -

Surry Zion Sequoyah

b. Lose-of-coolant accidents Conditional Probability I.OEOO _

oath 2.SE-8 yr-i I.OE-0 ,.4E-5 Yr-i modian I.OE-02 _th 1.8E-8 yr-i 1.OE-04 I.OE-04L Surry Zion Sequoysh

c. Transients Figure 9.1 Conditional probability of early containment failure for key plant damage states (PWRs).

9-3 NUREG- 1150

9. Accident Progression Conditional Probability t OE-OO _H21t-i5 yr-I fl_ 4.0E- yrt1 tOE-Ot median t.OE-02 tth 1.OE-03 1.0E-04 Peach Bottom Grand Quit

a. atation blaokout Conditional Probability 1.02400 ttE-C yr-I 1.1E-7 yr-I 1.05-01 I median 1.0E-02 _ th t.OE-03 1.0E-04 Peach ottom Grand Gulf

b. Anticipated transients without scram Conditional Probability IOOan-1.E-7 yr-I 1t9E-8 yr-I _ 96th I.OE-01 median 1.02-02 8th 1.0E-03 t.OE-04 Peach Bottom Grand Gult

c. Transients Figure 9.2 Conditional probability of early containment failure for key plant damage states (BWRs).

NUREG-1 150 9-4

9. Accident Progression containment failure is 50 percent. About half of plant to avoid a large early release of radioactive the early containment failures occur before vessel material appears to be particularly good because breach, and the other half occur at or shortly after of the small fraction of failures that result in either vessel breach. For the long-term station black- early failure or bypass.

outs, the mean conditional probability of early containment failure is 85 percent. It should be noted that the averaging of contain-ment failure mode probabilities for different plant The probability of drywell failure at Grand Gulf is damage states can be misleading. To a large de-somewhat less than that of containment failure gree, the relative probability of bypass at Zion is and occurs in approximately one-half the early substantially smaller than at Surry because the fre-containment failures. Drywell failures before ves- quency of plant damage states, other than the in-sel breach result from rapid hydrogen deflag- terfacing-system LOCA, is higher. On an absolute rations in the wetwell. At the time of vessel frequency scale, as shown in Figure 9.3, the per-breach, however, drywell failures are primarily formances of the Surry and Zion containments in from drywell pressurization loads at vessel breach severe accidents are quite similar. In Sequoyah, (steam blowdown, direct containment heating, ex- the probability of early failure is somewhat larger vessel steam explosions, and hydrogen combus- than for the other PWRs analyzed and on a fre-tion). Failure of the drywell is more likely when quency-weighted mean basis is essentially the vessel breach occurs with the vessel at high pres- same as for bypass. The most likely outcome for sure. these plants is that the containment will not fail.

Intentional venting of the containment was con- Using early containment failure or containment sidered to prevent overpressurization failure of the bypass as a measure for comparison, the perform-containment for both Peach Bottom and Grand ance of the two BWR containments analyzed does Gulf. The mean probability of sequences in which not appear as good as the performance of the containment venting occurs and no containment PWR. containments. It is important to recognize failure occurs is approximately 10 percent for that early containment failure or bypass is a pre-Peach Bottom station blackout sequences and 4 requisite for a large release of radionuclides, but percent for Grand Gulf. The values are small, that mitigative features within the plant can sub-mostly because of the high probability of early fail- stantially limit the release that occurs. This is par-ure mechanisms for which venting is ineffective. ticularly true for the pressure-suppression contain-Furthermore, for the short-term station blackout ment designs, where the suppression pool or ice plant damage state that dominates the core melt condenser can retain radionuclides even if the frequency at Grand Gulf, ac power is not available containment has failed. (The BWR frequency of initially to permit venting. bypass is assessed to be quite small. Therefore, only early failures (with the potential for some Figure 9.3 illustrates the frequency of early failure radionuclide scrubbing by the suppression pool) or bypass of containment (the two types of failure are important.) The frequency of release of differ-with the potential for a large release of radionu- ent quantities of radionuclides is discussed in clides) for internally initiated accidents in each of Chapter 10.

the five plants. (Peach Bottom scenarios in which the containment has been vented but subsequent 9.2.2 External Events early containment failure has occurred are catego-rized as early containment failures.) Note that, on Plant damage states that result from external a basis of absolute frequency, early containment events are quite similar to those that arise from failure or bypass for the BWR designs analyzed is internally initiated accidents except that their rela-similar to that of the PWRs because of the lower tive frequencies differ substantially. In addition, predicted frequency of core damage in the BWRs. containment status may be affected by the initiat-ing event. Figure 9.5 illustrates the relative prob-The relative probabilities of early containment abilities of early containment failure, bypass, late failure, bypass, late failure, venting, and no con- failure, venting, and no failure (no vessel breach tainment failure are illustrated in Figure 9.4 for or vessel breach with no containment failure) for each of the plants. For the Surry plant, the likeli- the two plants for which external-event analyses hood of bypass, an interfacing-system LOCA, or were performed. The results for internal initiators, steam generator tube rupture is somewhat greater fire, and seismic are compared in the figure. The than that of early failure from severe accident importance of early containment failure relative to loads. In Figure 9.4, the capability of the Zion the importance of bypass is reversed in the Surry 9-5 NUREG-1 150

9. Accident Progression 1.OE-04 Frequency of Early Failure or Bypass (yr )

j- 96th mean median 1.OE-05 Uft 6th 1.OE-06 1.OE-07 1.OE-08 Surry Zion Sequoyah Peach Grand Bottom Gulf Figure 9.3 Frequency of early containment failure or bypass (all plants).

NUREG-1 150 9-6

9. Accident Progression Surry Zion Late Failure Failure Bypass Bypass Early Early Failure Failure wwy No Vessel Breac No Vessel Brea or or Vessel Breach/No Containment Failure Vessel Breach/No Containment Failure Sequoyah Late Failure Bypass Early Failure No Vessel Brea or Vessel Breach/No Containment Failure Peach Bottom Grand Gulf Early Failure Early Failure Vent Vent Late Failure Late Failure Vssel Breach No Vessel Breacc or or Vessel Breach/No Containment Failure Vessel Breach/No Containment Failure Figure 9.4 Relative probability of containment failure modes (internal events).

9-7 NUREG-1150

9. Accident Progression Surry - Internal Events Peach Bottom - Internal Events Early Failure Late Failure Early Failure Late Fail C .:: Vent No Vessel Ue or No Vessel Bre or Vessel Breach/No Containment Failure Vessel Breach/No Containment Failure Surry- Fire Peach Bottom - Fire I n_---..,~ Late Failure Early Failure Early Failure Ven t No Vessel B r Vessel Breach or Late Failr Vessel Breach/No Containment Failure Vessel Breach/No Containment Failure Surry - Seismic Peach Bottom - Seismic Late Failure bypass Early Early Failure Failure Vent Late Failure No Vessel rea or Vessel Breaeh/No Containment Failure Figure 9.5 Relative probability of containment failure modes (internal and external events, Surry and Peach Bottom).

NUREG-1150 9-8

9. Accident Progression external-event analysis compared to the internal depressurization prior to lower head failure analysis. In the seismic analysis, the conditional are large, however.

probability of early failure is predicted to increase significantly (to approximately 8 percent). The in-

• Containment bypass sequences (severe acci-creased failure likelihood is associated with sub- dents initiated by steam generator tube rup-stantial motion of the reactor coolant system com- tures, tube ruptures induced by hot circulat-ponents in an earthquake and resulting damage to ing gases, or interfacing-system LOCAs) the containment. In the fire analysis, there are no represent a substantial fraction of high-externally initiated bypass accidents, the likeli- consequence accidents. The absolute fre-hood of bypass induced by overheating of steam quency of these types of failure is small, how-generator tubes is assessed to be negligible, and ever.

there is only a very slight increase in early contain-ment failure.

• The potential exists for the arrest of core degradation in a significant fraction of core Perspectives on the differences between external- damage scenarios within the reactor vessel as event and internal-event containment perform- the result of recovery procedures (such as in ance for the Peach Bottom plant are similar to the TMI-2 accident). The likelihood of con-those described for Surry. In the fire analysis, tainment failure is very small in these scenar-some increase in early containment failure is pre- ios.

dicted. In the fire sequences, there is a reduced potential for the recovery of ac power, which re-

• A substantial likelihood exists that the con-sults in a reduced probability of injection recovery tainment will remain intact even if the acci-and an increased likelihood of drywell shell dent progresses beyond the point of lower meltthrough. head failure.

In the BR seismic analysis, the probability of

• The likelihood of early containment failure in containment survival in a severe accident is small; seismic events is higher than for internally the increased likelihood of early containment fail- initiated accidents.

ure is the result of substantial motion of the reac-tor vessel and subsequent damage to the contain- Sequoyah Plant (Ice Condenser Design) ment during a major earthquake (well beyond the plant's design level) and a reduced recovery po-

• The likelihood of early failure in a severe ac-tential that increases the likelihood of contain- cident for the Sequoyah plant is higher than ment failure as described for the fire sequences. for the large, dry and subatmospheric designs but is less than for the BWRs analyzed. Early failure is primarily associated with loads im-9.2.3 Additional Summary Results posed at the time of vessel breach (from a number of mechanisms, including direct con-Based on the results of the five-plant risk analyses tainment heating and hydrogen combustion).

summarized in Chapters 3 through 7, and dis-cussed in detail in References 9.2 through 9.6, the

• Containment rupture from high overpressure following perspectives on containment perform- loads at the time of vessel breach is likely to ance in severe accidents can be drawn. result in significant damage to the contain-ment wall and effective bypass of the ice bed.

Zion and Surry Plants (Large, Dry and Subatmospheric Designs)

• Containment bypass is potentially an impor-tant contributor to the frequency of a large 0 Large, dry and subatmospheric containment early release of radioactive material.

designs appear to be quite robust in their ability to contain severe accident loads. This

• The high likelihood of a deeply flooded reac-study shows a high likelihood of maintaining tor cavity plays an important role in mitigat-integrity throughout the early phases of se- ing severe accident consequences at Se-vere accidents in which the potential for a quoyah. The deeply flooded cavity assists in large release of radionuclides is greatest. The reducing the loads at vessel breach, in pre-uncertainties in describing the magnitude of venting direct attack of molten fuel debris on severe accident loads at vessel breach for the containment wall, and in avoiding molten pressurized scenarios and the likelihood of core-concrete interactions.

9-9 NUREG-1150

9. Accident Progression

• There is substantial potential for the arrest of drogen deflagration is the principal mecha-core damage prior to vessel failure. There is, nism for early containment failure.

however, some likelihood of containment failure from hydrogen combustion events.

• Failure of the integrity of the drywell is pre-dicted to accompany containment failure in

• A substantial likelihood exists for contain- approximately one-half the sequences involv-ment integrity to be preserved throughout a ing early containment failure (resulting in by-severe accident, even if the accident pro- pass of the suppression pool for radionuclides gresses beyond vessel breach. released after vessel breach). Drywell failure is primarily the result of loads from rapid combustion events prior to reactor vessel Peach Bottom Plant (Mark I Design) breach and loads at vessel breach associated with overpressurization by direct containment

• The analyses indicate a substantial likelihood heating, ex-vessel steam explosions, and hy-for early drywell failure in severe accident drogen combustion in the wetwell region.

scenarios, primarily as the result of direct Scrubbing of releases occurring before vessel attack of the drywell shell by molten core de- breach can still occur in sequences in which bris. the drywell fails and the suppression pool is eventually bypassed.

• Considerable uncertainty exists regarding the likelihood of failure of the drywell as the re-

• There is a large potential for the arrest of sult of direct attack by core debris. Although core damage prior to vessel failure. If large this is the dominant failure mechanism in the quantities of hydrogen are produced in the analyses, other loads on the drywell can lead process of recovery, hydrogen combustion to early drywell failure, such as rapid over- could result in containment failure.

pressurization of the drywell. A sensitivity study was performed in which the drywell

• Venting was not found to be particularly ef-meltthrough mechanism of failure was elimi- fective in preventing containment failure for nated. The resulting reduction in mean early accident scenarios involving core damage.

containment failure probability was from Furthermore, venting was not as effective in 0.56 to 0.2 (Ref. 9.3). reducing core damage frequency in Grand Gulf as it was in Peach Bottom.

• The principal benefit of wetwell venting indi-cated by the study is in the reduction of the 9.3 Comparison with Reactor Safety core damage frequency. Although venting is Study not effective in eliminating some early dry-well failure mechanisms, venting could elimi- Prior to the time the Reactor Safety Study (RSS) nate other sequences that would result in (Ref. 9.7) analyses were undertaken, there had overpressure failure of the containment. been no relevant experimentation or modeling of either the loads produced in a severe accident or

• There is substantial potential for the arrest of the response of a containment to loads exceeding core damage prior to vessel failure. The like- the design basis. As a result, the characterization lihood of containment failure in arrested sce- of containment performance in the RSS is simplis-narios is small. tic in comparison to the present study.

• The likelihood of early containment failure is Containment Failure Modes higher for fire and seismic events than inter- Figure 9.6 compares estimates for the present nally initiated accidents because of the de- study with those of the RSS for the cumulative creased likelihood of ac and dc recovery re- failure probability as a function of internal pres-sulting in higher drywell shell meltthrough sure for the Surry plant. The current study indi-probabilities. cates that the Surry containment is substantially stronger than did the RSS characterization. In the Grand Gulf Plant (Mark III Design) RSS analyses, failure was assumed to involve rup-ture of the containment with substantial leakage to

• Grand Gulf containment was predicted to fail the environment. The current study subdivides at or before vessel breach in a substantial failure into different degrees of leakage. Failure at fraction of severe accident sequences. Hy- the low-pressure end of the range would most NUREG-1 150 9-10

9. Accident Progression Cumulative Failure Probability 1

0.8 0.6 0.4 0.2 0

0 20 40 60 80 100 120 140 160 180 200 Pressure (Psig)

Figure 9.6 Comparison of containment failure pressure with Reactor Safety Study (Surry).

Cumulative Failure Probability I

0.8 0.6 0.4 0.2 0

0 20 40 60 80 100 120 140 160 180 200 220 240 Pressure (Psig)

Figure 9.7 Comparison of containment failure pressure with Reactor Safety Study (Peach Bottom).

9-11 NUREG-1 150

9. Accident Progression likely be the result of limited leakage, such as fail- were station blackout, an interfacing-system ure at a penetration rather than a substantial rup- LOCA, and the failure of an instrumentation line ture of the containment wall. As the failure pres- penetrating the lower head. Figure 9.8 illustrates sure increases, the likelihood of rupture versus the range of early failure probability for station leakage also increases. At pressures close to the blackout in the current analyses and provides the ultimate strength of the shell, the potential for point estimate from the RSS as a comparison. The gross rupture of the containment exists but was RSS estimate of early failure likelihood is substan-found to be unlikely. tially higher than the present analysis even though the phenomenon of direct containment heating Figure 9.7 compares the current study with RSS had not been identified at the time of the RSS. In estimates for cumulative failure probability as a addition to the lower assumed failure pressure of function of pressure for the Peach Bottom plant the containment, the RSS prediction of the rate of (Mark I design). The curves are quite similar, containment pressurization was unrealistically with the current perspective being of a slightly less high.

strong containment than the RSS representation.

The curve presented from the current study is rep- The current perspective on the behavior of the resentative of a cool drywell (less than 500° F). interfacing-system LOCA in which the break oc-Cumulative distributions were also developed in curs outside the containment resulting in bypass is the current study for higher drywell temperatures. essentially the same as in the RSS. The RSS did At 1200° F the median failure pressure was as- not identify the potential for rupture of a steam sessed to be 45 psig as opposed to 150 psig at low generator tube as a potentially important initiator temperatures. of a severe accident.

The third important sequence in the RSS, involv-Failure location in the Mark I design can be as ing an instrumentation line rupture, is no longer important as failure time. In the RSS, the most considered a core meltdown sequence. In the RSS likely failure location was assessed to be at the up- analyses, if the containment spray injection pumps per portion of the toroidal suppression pool. It was assumed that, following containment failure, were to fail, damage was assumed to occur to the the pool would no longer be effective in scrubbing spray recirculation pumps resulting in loss of con-tainment heat removal, containment failure, and radioactive material. In the current analyses, other mechanisms of containment failure, such as consequent loss of emergency coolant makeup direct attack of the drywell wall by molten core water to the vessel. More detailed analyses (Ref.

debris, were found to be more important than 9.8) indicate, however, that condensed steam overpressure failure. The dominant location of would provide sufficient water in the containment overpressure failure is assessed to be the lifting of sump to prevent damage to the recirculation spray the drywell head by stretching the head bolts. pumps, avoiding conditions resulting in contain-Gases leaking past the head enter the refueling ment failure and core meltdown.

bay where limited radionuclide retention is ex-pected rather than into the reactor building where Comparison of Peach Bottom Results more extensive retention could occur. (However, In the RSS analyses for the Peach Bottom plant, the leakage into the reactor building can also re- two sequences dominated the risk: a transient sult in severe environments that can cause equip- event with loss of long-term heat removal from the ment failure.) Another structural failure from suppression pool and an anticipated transient overpressure identified as likely in this study is at without scram (ATWS). Loss of long-term heat the bellows in the downcomer, which would result removal is an extended accident in which heating in leakage from the wetwell vapor space to the re- of the suppression pool leads to overpressure fail-actor building. Thus, although the estimated fail- ure of the containment and consequent loss of ure pressures identified in this study and in the makeup water to the vessel. With the procedures RSS are quite similar, the modes and locations of now available to vent the Peach Bottom contain-failure are quite different. ment to outside the reactor building, the likeli-hood of loss of long-term heat removal leading to Comparison of Surry Results core meltdown has been reduced to the point where it is no longer a substantial contributor to Risk in the RSS is dominated by a few key se- core damage frequency or risk.

quences for each plant. Containment performance in these sequences was a major aspect of their risk In the RSS analyses, early containment failure was significance. The three key sequences for Surry considered a certainty in the ATWS sequence.

NUREG-1 150 9-12

9. Accident Progression Probability of Early Containment Failure 1.0 96th Reactor Safe ty

• $ Study 0.8h Reactor S ety Study 0.6 F median_

mean 0.4 0.2 oath Gth fl mean 0.0 Station Blackout ATWS Surry Peach Bottom egend 0 95th % E Sth % [3- mean -E median Figure 9.8 Comparison of containment performance results with Reactor Safety Study (Surry and Peach Bottom).

Figure 9. 8 indicates that early failure is still gration and detonation and core-concrete interac-considered quite likely for this sequence. The tions. In some instances, such as direct attack of mechanisms resulting in failure and location of the Mark I containment shell by molten material failure are different, however. and direct containment heating, research is still being pursued (Ref. 9.9). Although the residual In summary, changes have occurred in predicting uncertainties are in some instances great, the containment performance for the two plants ana- methods are adequate to support meaningful lyzed in the RSS. There have been substantial im- Level 2 PRA analyses.

provements in the ability to model severe accident phenomena and system behavior in severe acci- The accident progression event tree analysis tech-dents. For Surry, the high likelihood of maintain- niques developed for this study involve a very de-ing containment integrity indicated in the present tailed consideration of threats to containment in-study is the most significant difference in perspec- tegrity. A number of large computer analyses were tive between the two studies. required to support the quantification of event probabilities at each branch of the event tree. The analysis team for this study had the considerable 9.4 Perspectives advantage of access to researchers involved in the development and application of computer codes 9.4.1 State of Analysis Methods used in the analysis of core melt progression, core-concrete attack, containment behavior, The analysis of severe accident loads and contain- radionuclide release and transport, and hydrogen ment response involves substantial uncertainty be- combustion.

cause of the complexity of core meltdown proc-esses. After a decade of research into severe Computer analyses cannot, in general, be used di-accident phenomena subsequent to the TMI-2 ac- rectly and alone to calculate branching probabili-cident, methods of analysis have been developed ties in the accident progression event tree. Since that are capable of addressing nearly every aspect the greatest source of uncertainty is typically of containment loads, including hydrogen defla- associated with the modeling of severe accident 9-13 NUREG-1150

9. Accident Progression phenomena, the results of a single computer run ties in severe accidents. The principal source of (which uses a specific model) do not characterize hydrogen is the reduction of steam by chemical the branching uncertainty. It is therefore neces- reaction of metals, particularly zirconium and sary to use sensitivity studies, uncertainty studies, iron. Carbon monoxide would only be produced and expert judgment to characterize the likeli- in the later stages of an accident involving the at-hood of alternative events that affect the course of tack of concrete by molten core debris. Because an accident. The effort undertaken in this study to of the timing of carbon monoxide release, its pro-elicit expert opinion was substantial. The expense duction does not represent a threat of early failure of the overall accident progression analysis tech- to the containment but can contribute to delayed niques (expert elicitation and computer analysis to failure.

support event tree quantification) employed in this study is currently a drawback to their wide- Rapid gas combustion was not found to be a sub-spread use. However, methods to apply the mod- stantial threat to containment for the Surry (sub-els, the distributions, and the computer codes to atmospheric), Zion (large, dry), or Peach Bottom other plants at a reasonable cost are under study. (Mark I) containments. The Surry and Zion de-signs are sufficiently robust to survive deflagrations 9.4.2 Important Mechanisms That Defeat (rapid burning). At Surry and Zion, the likeli-Containment Function During Severe hood of global detonations that could fail the con-Accidents tainment (by impulsive loads) was assessed to be small. The contribution of hydrogen combustion The challenges to containment integrity that to the pressure rise in the containment at the time would occur in a severe accident depend on the of vessel failure in the event of high-pressure melt nature of the accident sequence, as well as the ejection of molten fuel was considered, but the design of the plant. The various containment de- likelihood of early failure of containment was also signs analyzed in this study responded differently assessed to be small.

to different severe accident challenges.

Hydrogen combustion is not a threat to the Mark Containment Bypass and Isolation Failure I design because it normally operates with a nitro-gen-inerted containment and thus has insufficient When an accident occurs, a number of valves oxygen concentration to support combustion.

must close to isolate the containment from the en-vironment. On the basis of absolute frequency, Hydrogen combustion was found to be a substan-failure to isolate the containment was not found to tial threat to the integrity of the Sequoyah (ice be a likely source of containment failure for any condenser) and Grand Gulf (Mark III) designs. A of the plants analyzed. Primarily because of the very small contribution, about 1 percent, to early low frequency of early containment failure by failure from hydrogen combustion prior to vessel other means, containment isolation failure is a breach is predicted for the station blackout se-relatively important contributor to early failure at quences in Sequoyah. In arrested sequences, the Zion. The subatmospheric containment and containment failure probability is increased 5 per-nitrogen-inerted Mark I containments are particu- cent because of ignition sources from the recovery larly reliable in this regard since it is highly likely of ac power. Approximately 12 percent mean that leakage would be identified during operation. early containment failure probability arises at the time of vessel breach, largely as the result of hy-Containment bypass is an important contributor to drogen combustion.

large early releases of radionuclides for the Surry (subatmospheric), Sequoyah (ice condenser), and For the Grand Gulf plant, there is a substantial Zion (large, dry) containment designs. The princi- likelihood of containment failure before vessel pal contributors are accidents initiated by interfac- breach in the short-term station blackout se-ing-system LOCAs and by steam generator tube quence because of the unavailability of igniters. At ruptures. The predicted frequency of these events the time of vessel breach, hydrogen combustion is quite small, however, and their dominance of loads can again occur, which can fail the contain-risk is the result of the relatively lower frequency ment (the percentages of containment failure be-of other means to obtain large early releases. fore and at vessel breach are similar). Two addi-tional reasons combine to make hydrogen events Gas Combustion extremely important at Grand Gulf: (1) the BWR core contains an extremely large amount of zirco-Hydrogen and carbon monoxide are the two com- nium that is available for hydrogen production, bustible gases potentially produced in large quanti- and (2) the suppression pool is subcooled in the NUREG-1150 9-14

9. Accident Progression short-term station blackout sequences resulting in present analysis of approximately 30 percent when condensation of the steam from the drywell or the the pedestal region is wet and 80 percent when vessel and leading to hydrogen-rich mixtures in the pedestal region is dry (Ref. 9.3).

the containment that are readily ignited.

Molten debris attack was also predicted to be a Loads at Vessel Failure threat to the Sequoyah (ice condenser contain-ment) in high-pressure sequences in which molten The increase in containment pressure that could debris could be dispersed into the seal table room, occur at vessel failure represents an important which is outside the crane wall and adjacent to the challenge to containment for each of the five de- steel wall of the containment. The likelihood of signs (see Appendix C). In the Zion (large, dry) failure was considerably less than for Peach Bot-and Surry (subatmospheric) designs, loads at ves- tom, however.

sel breach from high-pressure melt ejections (rapid transfer of heat from dispersed core debris Steam Explosions accompanied by chemical reactions with unoxi-dized metals in the debris) represent a mechanism When molten core material contacts water, the that can result in containment loads high enough potential exists for rapid transfer of heat, produc-to fail containment. The predicted likelihood of tion of steam, and transfer of thermal energy to failure for these scenarios in the Surry and Zion mechanical work. Considerable research has been designs was found to be small, in part because undertaken to determine the conditions under most high-pressure sequences were predicted to which steam explosions can occur and their ener-depressurize by one or more means prior to vessel getics. At pressures near atmospheric, it is gener-failure and because the overlap between the con- ally concluded that steam explosions would be tainment load distribution and the containment likely if molten core material drops into a pool of failure distribution was small. water. However, the energetics and coherence of the molten fuel-coolant interaction are very un-Although loads at vessel breach have been studied certain. At high steam pressure, steam explosions more extensively for PWR containments, they are found to be more difficult to initiate.

were found to be an important contributor to early containment failure in the Sequoyah (ice con- Steam explosions represent a variety of potential denser) and Peach Bottom (Mark I) plants and to challenges to the containment. If the interaction early drywell failure in Grand Gulf (Mark III). In were to occur in the reactor vessel at the time the Sequoyah and Grand Gulf analyses, hydrogen when molten core material slumps into the lower combustion is also a principal contributor to early plenum, the possibility exists of tearing loose the containment failure from the loads at vessel upper head of the vessel, which could impact and breach. At Grand Gulf, pedestal failure, due to fail the containment (this has been called the "al-dynamic loads from ex-vessel steam explosions or pha mode" of containment failure since the issu-subcompartment pressure differential, can also re- ance of the RSS). The analyses in this study indi-sult in drywell failure at this stage of the accident. cate that the potential for this type of event to result in early containment failure is less than 1 Direct attack of the drywell shell is the dominant percent for each of the plants. For Surry and failure mechanism at vessel breach in the Peach Zion, steam explosions represent a significant Bottom plant. Overpressurization can also lead to fraction of the early failure probability, but only leakage failure in the drywell by lifting the drywell because the overall likelihood of early failure is head or to failure in the wetwell. small.

Direct Attack by Molten Debris When molten core material drops into water out-side the vessel, the potential failure mechanisms Direct attack of the drywell wall by molten debris are different. In the Grand Gulf plant, a shock in the Peach Bottom (Mark I) design has been the wave could propagate through water and impact subject of considerable controversy among severe the concrete structure that provides support to the accident experts (see Section C.7 of Appendix reactor vessel. Substantial motion of the vessel C). Essentially half the experts whose opinions could then lead to the tearout of penetrations were elicited believed that containment failure through the drywell wall. Because of the shallow would occur, and half believed that it would not water pool at Peach Bottom, dynamic loads from occur. The numerical aggregation of these diverse steam explosions do not represent a similar views led to a mean likelihood of failure in the mechanism for failures.

9-15 NUREG-1150

9. Accident Progression In addition to potentially producing missiles and The Peach Bottom drywell, however, is relatively shock waves, steam explosions can also rapidly small. Substantial convective and radiative heat generate large quantities of steam and hydrogen. transfer from hot core debris could result in very The steam produced from molten fuel-coolant in- high drywell wall temperatures. Failure could re-teractions ex-vessel following vessel breach is an sult from the combination of high pressure in the important contributor to the static drywell over- drywell and decreased strength of the steel con-pressure failure in the Grand Gulf and Peach Bot- tainment wall. Overheating the drywell is only a tom plants. contributor to scenarios in which the drywell spray is inoperative. If the sprays are operational, the Gradual Overpressurization drywell temperature will be much lower than for the dry case.

Figure 9.9 illustrates the assessed pressure capa-bility for the five plants analyzed. The ability of a Drywell heating in the Peach Bottom plant repre-containment to withstand the production of gases sents a delayed containment failure mechanism.

in a severe accident depends on the volume of the Since the likelihood of early failure by other containment as well as its failure pressure. One of mechanisms is high, drywell overtemperature fail-the principal sources of pressurization in a severe ure is not a substantial contributor to risk.

accident is steam production. In each plant de-sign, however, engineered safety features are pre- Loss of Vessel Support sent to condense steam in the form of suppression In the earlier section on steam explosions, a pools, ice beds, sprays, air coolers, or in some de- mechanism was described for drywell failure in signs, combinations of these systems. Steam pres- the BWR designs in which structural failure of the surization is only a major contributor to the total reactor pedestal results in vessel motion (tipping pressure if, in the scenario being analyzed, the or falling) and the tearout of piping penetrations heat removal system has become inoperative; e.g., through the drywell wall. Quasistatic pressuriza-the spray system has failed, the suppression pool tion of the pedestal region can result in the same has become saturated, br the ice has melted. phenomenon. Erosion of the pedestal by molten core attack of the concrete can also lead to the Large quantities of hydrogen are predicted to be same effect. In this event, however, considerable released in severe accidents, both in-vessel during time is required for the erosion to occur, and the the melting phase and ex-vessel during core- failure would be late and the importance to risk is concrete attack, debris bed quenching, or high- diminished. The likelihood of this mechanism of pressure melt ejection. If the hydrogen does not failure is generally small for the BWRs analyzed, burn, it will contribute to the containment pres- in part because other mechanisms are likely to re-sure. Carbon monoxide and carbon dioxide pro- sult in failure earlier in the accident.

duced during core-concrete attack also contribute to containment pressurization. Basemat Meltthrough For each of the five plants analyzed, some poten-Because of its relatively small volume, the Peach tial exists for core debris to be quenched as a par-Bottom (Mark I) design is more vulnerable to ticulate debris bed and cooled in the reactor cav-overpressurization failure by noncondensible gas ity or pedestal region if a continuous source of generation. If the accident progression proceeds water is available. A significant likelihood exists, to vessel penetration and the molten core attacks however, that, even if a replenishable water sup-the concrete, it is unlikely that containment integ- ply is available, molten core debris will attack the rity can be maintained in the long term unless concrete basemat. If the core-concrete interaction other factors mitigate gas production. does occur, the presence or absence of an over-laying water pool is not expected to have much Overheating effect on the downward progression of the melt front.

The effect of high temperature in the drywell on containment failure probability and mode was The depth of the basemat of the Peach Bottom considered in the Peach Bottom analysis. Al- containment, directly under the vessel, is so great though very high gas temperatures can be that it is unlikely that the basemat would be pene-achieved as the result of hydrogen combustion in trated before the occurrence of other failure the other plant designs, the structure temperatures modes. For the other plants, basemat penetration are not predicted to reach temperatures at which is possible, but the projected consequences are the strength of the structure would be substantially minor in comparison with those of aboveground reduced or sealant materials would be degraded. failures.

NUREG-1 150 9-16

9. Accident Progression Cumulative Failure Probability 0.8 0.6 0.4 0.2 0

0 60 100 150 200 250 Pressure (Psig)

Figure 9.9 Cumulative containment failure probability distribution for static pressurization (all plants).

9.4.3 Major Sources of Uncertainty ues set to a specific value. Sensitivity studies were performed on the Mark I drywell shell The perspectives on the major sources of uncer- meltthrough issue and the PWR RCS depres-tainty described in this section come from four surization scenarios. These studies were only sources: performed for the accident progression analysis; no source term or consequence in-0 Regression analysis-based sensitivity analyses sights are available.

for the mean values for risk. Simple linear regression models were used to represent the

• The subjective judgment of the analysts per-complex risk models, and adequate results forming the plant-specific studies.

were obtained. Better results would require Importance of Accident Progression Analysis more complex regression models. Insights for Variables to Rank Regression Analyses for this section are deduced from the risk regres- Annual Risk sion studies (regression analyses for condi-tional containment failure probabilities re- The majority of the variables important to the quired for more detailed accident progression rank regression analyses performed for Surry were insights were not performed). Results of the initiating event frequencies of the containment these studies are presented in References 9.2 bypass events and the source term variables. The through 9.6. only accident progression event tree variable that was demonstrated to be important to the uncer-tainty in risk for internal events was the probabil-

• Partial rank correlation analyses for the risk ity of vessel and containment breach by an in-complementary cumulative distribution func- vessel steam explosion; this variable was tions. Results of these studies are presented moderately important to the uncertainty in total in References 9.2 through 9.6. early fatality risk (Ref. 9.2).

• Sensitivity studies in which separate analyses The regression analyses performed for Sequoyah were performed with certain parameter val- showed the containment failure pressure and 9-17 NUREG-1 150

9. Accident Progression loads at vessel breach to be accident progression High-Pressure Melt Ejection and Vessel variables somewhat important to the uncertainty Depressurization in both total early fatality risk and total latent can- For the Surry and Zion plants, early containment cer fatality risk (Ref. 9.4). failure resulting from loads at vessel breach is as-sessed to have low probability, on the order of 1 The probability of drywell meltthrough was the percent. Sensitivity studies were performed to only accident progression variable that was at all determine the dependence of this result on expert important to uncertainty in the early fatality risk judgments made about various reactor coolant sys-or the latent cancer fatality risk for the internal tem depressurization mechanisms prior to vessel regression analysis for Peach Bottom (Ref. 9.3). breach. A sensitivity study was performed for Surry (Ref. 9.2), which removed depressurization The amount of hydrogen produced in-vessel, the by temperature-induced breaks. This study indi-probability of drywell failure following pedestal cated that removal of only temperature-induced failure, the pressure load in the drywell at vessel failures for depressurization does not result in a breach, and the amount of hydrogen produced significant increase in the likelihood of early con-and released at and shortly after vessel breach tainment failure (from roughly 1 percent to were accident progression variables that were roughly 2 percent). This probability study, there-found to be important to the uncertainty in early fore, implies that other depressurization mecha-fatality risk by the Grand Gulf regression analyses. nisms, such as the failure of reactor coolant pump The probability of drywell failure following pedes- seals and stuck-open relief valves, are also impor-tal failure and the pressure load in the drywell at tant. However, a sensitivity study was also per-vessel breach were found to be important to the formed for Zion (Ref. 9.6) in which all depress-uncertainty in latent cancer fatality risk (Ref. urization mechanisms were removed. The result 9.5). of this study was a relatively small increase in the likelihood of early containment failure. For acci-The majority of variables important to the rank dents initiated by LOCAs (which dominate the es-regression analyses performed for Zion were re- timated core damage frequency), this change re-lated to failure or recovery of the component sulted in essentially no change in the conditional cooling water (CCW) system and the source term probability of early containment failure. The variables. The only accident progression event probability of early failure increased by a factor of tree variable that was demonstrated to be impor- 5 for accidents initiated by transients (from tant to the uncertainty in risk was the probability roughly 0.01 to 0.06) and by a factor of 2 for ac-of vessel and containment breach by an in-vessel cidents initiated by station blackout (from roughly steam explosion. This result was also obtained 0.03 to 0.06). The reason for the relatively small from the Surry regression analyses. The probabil- impact of removing all depressurization mecha-ity of a steam explosion failure was found to be nisms on the probability of early containment fail-important to the uncertainty in both early and la- ure is that the Zion containment is expected to tent health risk measures at Zion. The importance withstand high-pressure melt ejection loads (even of seal LOCA failure to risk uncertainty was ex- at the upper end of the uncertainty range) with pected, given the large contribution of these very high confidence (refer to Section C.5 of Ap-events to the core damage frequency. Upgrades to pendix C for a more detailed discussion). Also, at the Zion service water and CCW systems have the these small probability levels, in-vessel steam ex-potential to reduce the importance of these events plosions contribute to the likelihood of early con-as discussed in Appendix C (Section C.15) (Ref. tainment failure. If the reactor coolant system 9.6). pressure remains high, the likelihood of triggering a steam explosion is decreased. Thus, the slightly Direct Attack of Drywell Shell in Peach higher probability of early containment failure re-Bottom sulting from high-pressure melt ejection loads will The divergence of opinion of the panel of contain- be offset to some degree by the lower probability ment performance experts, in itself, is an indica- of containment failure from in-vessel steam explo-tor of the uncertainty in the associated phenom- sions.

ena. A sensitivity study was performed to Uncertainties associated with high-pressure melt determine the impact on containment perform- ejection also affect the early containment failure ance of eliminating this failure mechanism. The likelihood for the other three plants. The signifi-mean early failure probability (averaged over all cance of this issue is greatest for the Sequoyah sequences) was reduced from 56 percent to 20 and Grand Gulf plants, which have lower over-percent (Ref. 9.3). pressure capacity and which are vulnerable to the NUREG-1150 9-18

9. Accident Progression hydrogen produced in the oxidation of dispersed tack, steam explosions, and hydrogen generation) core debris by steam. are sensitive to the details of core melt progres-sion, particularly the later stages of progression in Containment Failure by Steam Explosions which molten core material enters the lower head of the vessel. The mass of material potentially The production of missiles by in-vessel steam ex- available for dispersal at head failure, the compo-plosions only appears as a significant contributor sition of this material, the timing of head failure, to early failure or bypass in the Zion analyses. and the mode of head failure have a substantial The contribution of alpha-mode containment fail- indirect impact on the likelihood of early contain-ure is the result of the very low probability of ment failure through their effects on early failure other modes of early failure or bypass and is itself mechanisms.

a low value. Quasistatic and shock loading from an ex-vessel steam explosion is indicated to be a Containment Bypass potentially important contributor to drywell failure for Grand Gulf. Ex-vessel steam explosions also The containment bypass sequences have been dis-contribute to quasistatic overpressurization failure cussed throughout this report as special scenarios in the Peach Bottom plant. (in which the containment function has failed) and will be briefly mentioned here. The contain-Core Melt Progression ment bypass initiating event frequencies, transmis-sion factors, and decontamination factors were Many of the uncertain phenomena that have the demonstrated to be the variables most important potential to lead to early containment failure to the uncertainty in all risk measures in both the (e.g., high-pressure melt ejection, drywell shell at- Surry and Sequoyah rank regression analyses.

9-19 NUREG-1 150

9. Accident Progression REFERENCES FOR CHAPTER 9 9.1 M. Silberberg et al., "Reassessment of the 9.5 T. D. Brown et al., "Evaluation of Severe Technical Bases for Estimating Source Accident Risks: Grand Gulf Unit 1," San-Terms," United States Nuclear Regulatory dia National Laboratories, NUREG/

Commission (USNRC) Report NUREG- CR-4551, Vol. 6, Draft Revision 1, 0956, July 1986. SAND86-1309, to be published.*

9.2 R. J. Breeding et al., "Evaluation of Severe 9.6 C. K. Park et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia Na- Accident Risks: Zion Unit 1," Brook-tional Laboratories, NUREG/CR-4551, Vol. haven National Laboratory, NUREG/

3, Revision 1, SAND86-1309, October CR-4551, Vol. 7, Draft Revision 1, BNL-1990. NUREG-52029, to be published.*

9.3 A. C. Payne, Jr., et al., "Evaluation of Se- 9.7 USNRC, "Reactor Safety Study-An Assess-vere Accident Risks: Peach Bottom Unit ment of Accident Risks in U.S. Commercial 2," Sandia National Laboratories, NUREG! Nuclear Power Plants," WASH-1400 CR-4551, Vol. 4, Draft Revision 1, (NUREG-75/014), October 1975.

SAND86-1309, to be published.*

9.8 R. S. Denning et al., "Radionuclide Release 9.4 J. J. Gregory et al., "Evaluation of Severe Calculations for Selected Severe Accident Accident Risks: Sequoyah Unit 1," Sandia Scenarios-PWR, Subatmospheric Contain-National Laboratories, NUREG/CR-4551, ment Design," Battelle Columbus Division, Vol. 5, Revision 1, SAND86-1309, Decem- NUREG/CR-4624, Vol. 3, BMI-2139, July ber 1990. 1986.

9.9 USNRC, "Revised Severe Accident Re-

• Available in the NRC Public Document Room, 2120 L search Program Plan: Fiscal Year 1990-Street NW., Washington, DC. 1992," NUREG-1365, August 1989.

NUREG-1150 9-20

10. PERSPECTIVES ON SEVERE ACCIDENT SOURCE TERMS 10.1 Introduction It is widely believed that the approximate treat-ment of source term phenomena in the Reactor Safety Study (RSS) (Ref. 10.7) analyses led to a Shortly after the accident at Three Mile Island, substantial overestimation of severe accident con-the NRC initiated a program to review the ade- sequences and risk. The current risk analyses pro-quacy of the methods available for predicting the vide a basis for understanding the differences that magnitude of source terms for severe reactor acci- exist in source terms calculated using the new dents. After considerable effort and extensive methods relative to those calculated using the RSS peer review, the NRC published a report entitled methods and the impact of these differences on "Reassessment of the Technical Bases for Estimat- estimated risk.

ing Source Terms," NUREG-0956 (Ref. 10.1).

The report recommended that a set of integrated 10.2 Summary of Results computer codes, the Source Term Code Package (STCP) (Ref. 10.2), be used as the state-of-the- Some examples of source terms (fractions of the art methodology. for source term analysis provided core inventory of groups of radionuclides released that uncertainties were considered. The STCP to the environment) were provided for accident methodology provided a starting point for source progression bins for each of the analyzed plants in term estimates in this study. In addition, the char- Chapters 3 through 7. As expected, the magnitude acterization of source term uncertainties was sup- of the source term varies between different acci-ported by calculations with other system codes dent progression bins depending on whether or such as MELCOR (Ref. 10.3) and MAAP (Ref. not containment fails, when it fails, and the effec-10.4), detailed special. purpose codes such as tiveness of engineered safety features (e.g., BWR CONTAIN (Ref. 10.5), as well as small codes suppression pool) in mitigating the release. How-written for this project to examine specific source ever, within an accident progression bin, which term phenomena. Because it was impractical to represents a specific set of accident progression perform an STCP calculation for each source term events, the uncertainty in predicting severe acci-required and the STCP does not contain models dent phenomena is great.

for all potentially important phenomena, simpli-fied methods of analysis were developed with ad- In Figure 10.1, the predicted frequency of radio-justable parameters that could be benchmarked active releases is compared among the five plants.

against the more detailed codes. Probability distri- In this figure, the mean distribution is presented, butions, which had been developed from the allowing differences in plant behavior to be illus-elicitations of the source term panel of experts, trated. The y-coordinate in the figure represents were provided for many of the parameters in the the predicted frequency with which a given magni-simplified computer codes. A large number of tude of release (the x-coordinate) would be ex-source term estimates were generated for each ceeded. The location of the exceedance curve is plant by sampling from the probability distribu- determined by the frequencies of accident se-tions in the simplified codes. quences in addition to the spectrum of possible source terms for those sequences.

Source terms are typically characterized by the It is not obvious in examining a radionuclide fractions of the core inventory of radionuclides source term what the potential health impact that are released to the environment, as well as would be to the public from a specified magnitude the time and duration of the release, the size dis- of release. Based on the compilation of a number tribution of the aerosols released, the elevation of of consequence analyses, however, one method the release, the warning time for evacuation, and (Ref. 10.8) has been developed that provides an the energy released with the radioactive material. approximate relationship for the minimum All these parameters are required for input to the fractions of radionuclides released that result in MACCS (Ref. 10.6) consequence code. Although early fatalities or early injuries. For the release of the illustrations and comparisons of source terms iodine, for example, the thresholds for early in this chapter emphasize the magnitude of esti- fatalities and early injuries occur at release frac-mated release, it is important to recognize that the tions of the core inventory of approximately 0.1 other characteristics of the source term noted and 0.01, respectively. Figure 10.1 does not indi-above, such as the timing of release, can also have cate major differences in the exceedance curves an important effect on the ultimate consequences. for the five plant analyses. For the iodine group, 10-1 NUREG-1150

10. Severe Accident Source Terms Frequency of R > R* (yr-I)

Iodine Group -Surry I.O~~~~u04 _ __^^ ~~~~~~~~~~~~ Zion

"_ Sequoyah Pach Bottom Grand Cult LIDE-05 .:_4- ~f y= S _t I.OE*OF_0Q7 I.OE-08 '

I.OE-09 I I I I H ill I I I I IIH [ I I I I H ill I I I I t1 L.OE-05 I.OE-04 I.OE-03 I.OE-02 I.OE-01 1.0E+00 Release Fraction Frequency of R > R* (yr-1)

I.OE-OS0_ _

Cesium Group -

-~~~~~~~~~~~~~~~~~~~~~ -- Zlon 1.9E-04

- Sequoyab

- Peach Bottom l.OE-05 Grand Gulf 50.. t b o0 - --

I.OE-07 I.OE-08 1.0E-05 I.OE-04 I.OE-03 I.OE-02 LE-0 1.OE+00 Release Fraction Figure 10.1 Frequency of release for key radionuclide groups.

NUREG-1150 10-2

10. Severe Accident Source Terms Frequency of R > R (yr-1)

I.OE-03 Strontium Group -Srry

'--- Zion 1.05-04 lE.'. Sequoyah Peach Bottom 1.E05 Grand Culf

.OE 1.OE-07 l.OE-09 I.OE-05 I.OE-04 L.OE-03 l.OE-02 lOE-01 1.OE+0o Release Fraction Frequency of R > R* (yr-i) 1 .OE-03_

Lanthanum Group - 2urr

• - Son I.OE-04 Sequoyah Peach Bottom 1.0E-05 *M Grand Gulf I.OE-05 I.OE-09 I I III tell]IIII IlI III

.OE-05 I.OE-04 I.OE-03 lOE-02 I.OE-01 I.OE+00 Release Fraction Figure 10.1 (Continued) 10-3 NUREG-1150

10. Severe Accident Source Terms the frequency of exceeding a release fraction of the molten core-concrete interaction by 0.1 ranges from 1E-6 to 5E-6 per reactor year for scrubbing in the overlaying pool of water.

the five plants. Similarly, for a release fraction of 0.01, the exceedance curves range from 2E-6 to 10.3 Comparison with Reactor Safety 1E-5 per reactor year. The most outstanding fea- Study ture of these curves is their relative flatness over a wide range of release fractions. For the iodine, In the Reactor Safety Study (RSS) (Ref. 10.7),

cesium, and strontium groups, the curves decrease source terms were developed for nine release only slightly over the range of release fractions categories ("PWR1" to "PWR9") for the Surry from 1E-5 to E-1 and then fall rapidly from 0.1 plant and five release categories for the Peach to 1. For the lanthanum group, the rapid decrease Bottom plant ("BWR1" to "BWR5"). The RSS in the curve occurs at a release fraction that is release categories are directly analogous to the ac-approximately a decade lower. As a result of the cident progression bins in the current study in that flatness of the exceedance curves, the frequency they are characterized by aspects of accident pro-of accidents with source terms that are marginally gression and containment performance that affect capable of resulting in early fatalities is only the source term. For example, the PWR1 release slightly less than the frequency of accidents cover- category represented early containment failure re-ing a very broad spectrum of health consequences sulting from an in-vessel steam explosion with up to the occurrence of fatalities. However, the containment sprays inoperative. A point estimate frequency of source terms with the potential for for release fractions (fraction of the core inven-multiple early fatalities falls rapidly with increased tory of an elemental group released to the envi-release. ronment) for seven elemental groups (in the cur-rent study, the number of elemental groups has Based on the results of the source term analyses been expanded to nine) was then used to repre-for the five plants, a number of general perspec- sent this type of release.

tives on severe accident source terms can be drawn: In the current study, source terms were developed for a much larger number of accident progression

• The uncertainty in radionuclide source terms bins. A distribution of release fractions was also is large and represents a significant contribu- obtained for each of the elemental groups corre-tion to the uncertainty in the absolute value sponding to the individual sample members of the of risk. The relative significance of source uncertainty analysis.

term uncertainties depends on the plant damage state. In order to simplify the presentation in this report, the results of similar accident progression bins

• Source terms for bypass sequences, such as have been aggregated to a level that is comparable accidents initiated by steam generator tube to that used in the RSS. Figure 10.2 provides a rupture (SGTR), can be quite large, poten- comparison of an important large release category tially comparable to the largest Reactor (PWR2) from the RSS for Surry with a compara-Safety Study source terms. ble aggregation of accident progression bins (early containment failure, high reactor coolant system

• Early containment failure by itself is not a re- pressure) from the current study.* Also shown in liable indicator of the severity of severe acci- Figure 10.2 is a low release category from the dent source terms. Substantial retention of RSS (PWR7) with a comparable aggregation of ac-radionuclides is predicted to occur in many cident progression bins from the current study of the early containment failure scenarios in (late failure). No range is shown for the noble gas the BWR pressure-suppression designs, par- release for this study because no permanent reten-ticularly for the in-vessel period of release tion mechanisms were assumed to affect these during which radionuclides are transported to gases. The point estimates of the release of the suppression pool. Containment spray sys- radionuclides in the RSS early containment failure tem and ice condenser decontamination can bin are more representative of the upper bounds also substantially mitigate accident source terms.

'Because of the aggregation of accident progression bins,

• Flooding of reactor cavities or pedestals can some of the range of the source terms represents variation eliminate the core-concrete release of radio- in accident progression as well as modeling uncertainty.

The distribution was developed from all of the sample nuclides, if a coolable debris bed is formed, members within the aggregated bins without considera-or can significantly attenuate the release from tion of the relative frequencies of these bins.

NUREG-1150 10-4

10. Severe Accident Source Terms Release Fraction I .OEOO InL~~~~~~~~~~ma t.OE-O1 A -- Median 6~~~~~~~6 1.OE-02 A Rss 1.OE-03 1.OE-04 II ^MrAni V -U O N6 I Cs Te Sr Ru La Ba Ce Elemental Group

a. Comparison with Bin PWR2 Release Fraction 1.OE-05 IN I111 VW NG I Cs Te Sr Ru La Ba Ce Elemental Group

b. Comparison with Bin PWR7 Figure 10.2 Comparison of source terms with Reactor Safety Study (Surry).

10-5 NUREG-1150

10. Severe Accident Source Terms of the range in the current study than the mean or sults of more mechanistic codes, was found to be the median. For the late failure comparison, the a practical necessity in performing a PRA that in-results for this study are somewhat higher than cludes a complete treatment of phenomenological those obtained for the RSS. The difference is re- uncertainties. Research is in progress in some of lated to the types of failures in the late failure bin. the key areas of uncertainty that influence source In the RSS, the PWR7 source terms were based term results. In a number of cases, the STCP did on a release associated with meltthrough of the not have models that represent potentially impor-basemat in scenarios with containment sprays op- tant phenomena, such as revaporization from re-erable. The late failure bin in the current study actor coolant system surfaces and reevolution of also includes overpressure failure cases with a di- iodine from water pools. Later codes, such as rect release from the plant to the atmosphere. Of MELCOR (Ref. 10.3), which have at least rudi-particular significance is the nontrivial release of mentary models for these processes, should pro-iodine that is associated with late release mecha- vide greater assurance of consistency in the analy-nisms, which were not considered in the RSS. sis. These advanced codes may not, however, remove the need for parametric codes capable of Figure 10.3 compares release fractions for an ag- performing a large number of analyses inexpen-gregation of early drywell failure accident progres- sively.

sion bins from the current study with the BWR2 and BWR3 release categories. In the current study, a range of reactor building decontamination Improvement in Understanding factors is considered depending on the mode of drywell failure and variations in thermal-hydraulic Since the Reactor Safety Study (RSS), substantial conditions in the building. The BWR2 release improvements have been made in understanding fractions are at the upper bounds of the ranges in severe accident processes and source term phe-the current study, and the BWR3 releases are nomena. A major shortcoming of the RSS was the near the mean values. limited treatment of the uncertainties in severe ac-cident source terms. In the intervening years, par-The second example compares results for an isola- ticularly subsequent to the Three Mile Island acci-tion failure in the wetwell region from the RSS, dent, major experimental and code development release category BWR4, with the venting accident efforts have broadly explored severe accident be-progression bin from the current study. The RSS havior. In this study, care has been taken to dis-results are very similar to the mean release terms play the assessed uncertainties associated with the for the venting bin, with the exception of the io- analysis of accident source terms. Many of the se-dine group, which is higher because of the late vere accident issues that are now recognized as release mechanisms (reevolution from the sup- the greatest sources of uncertainty were com-pression pool and the reactor. vessel) considered pletely unknown to the RSS analysts 15 years ago.

in the current study.

Overall, the comparison indicates that the source terms in the RSS were in some instances higher 10.4.2 Important Design Features and in other instances lower than those in the cur-rent study. For the early containment failure acci- In Chapter 9, performance of the containments of dent progression bins that have the greatest im- the five plants was described with respect to the pact on risk, however, the RSS source terms timing of the onset of containment failure and the appear to be larger than the mean values of the magnitude of leakage to the environment. In par-current study and are typically at the upper bound ticular, the likelihood of early containment failure of the uncertainty range.

• was used as a measure of containment perform-ance. Environmental source terms are affected by 10.4 Perspectives more than just the mode and timing of contain-ment failure, however. The following paragraphs 10.4.1 State of Methods describe the effect of different safety systems and plant features on the magnitude of source terms.

The use of parametric source term methods, in which the parameters are fit to reproduce the re-Suppression Pools

• Additional comparisons with the Reactor Safety Study Suppression pools can be very effective in the re-may be found in Reference 10.9. moval of radionuclides in the form of aerosols or NUREG- 150 10-6

10. Severe Accident Source Terms Release Fraction A -

I .OE+00

T~~~~~~~~~~~~~~~~6 I.OE-01

-- mdian A

A I.OE-02 A Ras 1.OE-03 1.OE-04 1.OE-05 Cs Te S

. r. ... La a C NG I Cs Te Sr Ru La Ba Ce Elemental Group

a. Comparison with Bins BWR2 and BWR3 Release Fraction 1.OE+00 1,OE-01 1.OE-02 1.OE-03 1.OE-04 1.OE-05 NG I Cs Te Sr Ru La Ba Ce Elemental Group

b. Comparison with Sin BWR4 Pigure 10.3 Comparison of source terms with Reactor Safety Study (Peach Bottom).

10-7 NUREG-1 150

10. Severe Accident Source Terms soluble vapors. Some of the most important operational for an extended time, is to reduce the radionuclides, such as isotopes of iodine, cesium, concentration of radioactive aerosols airborne in and tellurium, are primarily released from fuel the containment to negligible levels in comparison during the in-vessel release period. Because risk- with non-aerosol radionuclides (e.g., noble gases) dominant accident sequences in BWRs typically with respect to potential radiological effects. For involve transient sequences rather than pipe shorter periods of operation, sprays would be less breaks, the in-vessel release is directed to the sup- effective but can still have a substantial mitigative pression pool rather than being released to the effect on the release.

drywell. As a result, the in-vessel release is sub-jected to scrubbing in the suppression pool, even The Sequoyah (ice condenser) design has con-if containment failure has already occurred. For tainment sprays for the purpose of condensing the Peach Bottom plant, decontamination factors steam that might bypass the ice bed, as well as for used in this study for scrubbing the in-vessel com- use after the ice has melted. The effects of the ponent ranged from approximately 1.2 to 4000, sprays and ice beds in removing radioactive mate-with a median value of 80. Since the early release rial are not completely independent since they of volatile radioactive material is typically the ma- both tend to remove larger aerosols preferentially.

jor contributor to early health effects, the effect of the suppression pool in depressing this component In the Peach Bottom plant, drywell sprays can be of the release is one of the reasons the likelihood operated in sequences in which ac power is avail-of early fatalities is so low for the BWR designs able. Scrubbing of radioactive material released analyzed. from fuel during core-concrete attack can be ac-complished by a water layer developed on the Depending on the timing and location of contain- drywell floor, as well as by the spray droplets.

ment failure, the suppression pool may also be ef- Containment spray operation in Grand Gulf is fective in scrubbing the release occurring during most important for scenarios in which both the core-concrete attack or reevolved from the reac- containment and drywell have failed. In the short-tor coolant system after vessel failure. In the term station blackout plant damage state, power Peach Bottom analyses, containment failure was recovery that is too late to arrest core damage can found to be likely to occur in the drywell early in still be important for the operation of containment the accident. Thus, in many scenarios the sup- sprays and the mitigation of the extended period pression pool was not effective in mitigating the of ex-vessel release from fuel.

delayed release of radioactive material. Similarly, in the Grand Gulf design, drywell failure accom- Ice Condenser panied containment failure in approximately one- The ice beds in an ice condenser containment re-half the early containment failure scenarios ana- move radioactive material from the air by proc-lyzed. As a result, the suppression pool was found esses that are very similar to those in the BWR to be ineffective in mitigating ex-vessel releases in pressure-suppression pools. The decontamination a substantial fraction of the scenarios for both factor is very sensitive to the volume fraction of BWR plants analyzed. steam in the flowing gas, which in turn depends on Although the decontamination factors for suppres- whether the air-return fans are operational. For a sion pools are typically large, radioactive iodine typical case with the air-return fans on, the magni-captured in the pool will not necessarily remain tude of the decontamination factors was assessed there. Reevolution of iodine was found to be im- to be in the range from 1.2 to 20, with a median portant in accident scenarios in which the contain- value of 3. Thus, the effectiveness of the ice bed ment has failed and the suppression pool is boil- in mitigating the release of radioactive material is ing. likely to be substantially less than for a BWR sup-pression pool.

Containment Sprays Drywell-Wetwell Configuration If given adequate time, containment sprays can The Mark III design has the apparent advantage, also be effective in reducing airborne concentra- relative to the Mark I and Mark II designs, of the tions of radioactive aerosols and vapors. In the wetwell boundary completely enclosing the dry-Surry (subatmospheric) and Zion (large, dry) de- well, in effect providing a double barrier to radio-signs, approximately 20 percent of core meltdown active material release. As long as the drywell sequences were predicted to eventually result in remains intact, any release of radioactive material delayed failure or basemat meltthrough. The ef- from the fuel would be subject to decontamination fect of sprays, in those scenarios in which they are by the suppression pool. For this reason, failure NUREG-1 150 10-8

10. Severe Accident Source Terms of the Mark III containment is not as important jected to a decontamination factor of 1.3 to 90 to severe accident risk as the potential for with a median value of 4.

containment failure in combination with drywell failure. Figures 6.5 and 6.6 illustrate the differ- In the interfacing LOCA sequences in the PWRs, ence in the environmental source terms for the some retention of radionuclides was assumed in early containment failure bins with and without the auxiliary building (in addition to water pool drywell failure. With the drywell intact, the envi- decontamination for submerged releases). In the ronmental source term is reduced to a level at Sequoyah analyses, retention was enhanced by which early fatalities would not be expected to oc- the actuation of the fire spray system.

cur, even for early failure of the outer contain-ment. The potential advantages of the drywell- Containment Venting wetwell configuration were found to be limited in In the Peach Bottom (Mark I) and Grand Gulf this study by the significant probability of drywell (Mark III) designs, procedures have been imple-failure in an accident. mented to intentionally vent the containment to avoid overpressure failure. By venting from the Cavity Flooding wetwell air space (in Peach Bottom) and from the The configuration of PWR reactor cavity or BWR containment (in Grand Gulf), assurance is pro-pedestal regions affects the likelihood of water ac- vided that, subsequent to core damage, the re-cumulation and water depth below the reactor lease of radionuclides through the vent line will vessel. The Surry reactor cavity is not connected have been subjected to decontamination by the by a flowpath to the containment floor. If the suppression pool.

spray system is not operating, the cavity will be dry As discussed in Chapter 8, containment venting to at vessel failure. In the Peach Bottom (Mark I) the outside can substantially improve the likeli-design, there is a maximum water depth of ap- hood of recovery from a loss of decay heat re-proximately 2 feet on the pedestal and drywell moval plant damage state and, as a result, reduce floor before water would overflow into the the frequency of severe accidents. The results of downcomer. The other three designs investigated this study indicate, however, only limited benefits have substantially greater potential for water accu- in consequence mitigation for the existing proce-mulation in the pedestal or cavity region. In the dures and hardware for venting. Uncertainties in Sequoyah design, the water depth could be as the decontamination factor for the suppression much as 40 feet. pool and for the ex-vessel release and in the reevolution of iodine from the suppression pool If a coolable debris bed is formed in the cavity or are quite broad. As a result, the consequences of pedestal and makeup water is continuously a vented release are not necessarily minor. Fur-supplied, core-concrete release of radioactive ma- thermore, the effectiveness of venting in the two terial would be avoided. Even if molten plant designs is limited by the high likelihood of core-concrete interaction occurs, a continuous mechanisms leading to early containment failure, overlaying pool of water can substantially reduce which would result in bypass of the vent.

the release of radioactive material to the contain-ment. 10.4.3 Important Phenomenological Uncertainties Reactor Building/Auxiliary Building Retention In order to identify the principal sources of uncer-Radionuclide retention was evaluated for the tainties in the estimated risk, regression analyses Peach Bottom reactor building, but an evaluation were performed for each of the plant types in this was not made for the portion of the reactor build- study. In general, in these regression analyses, the ing that surrounds the Grand Gulf containment, dependent variable is risk expressed in terms of which was assessed to have little potential for re- consequences per year (e.g., early fatalities per tention. The range of decontamination factors for year or latent cancer fatalities per year). For the aerosols for the Peach Bottom reactor building Surry plant (Ref. 10.10), however, additional re-subsequent to drywell rupture was 1. I'to 80 with a gression analyses were performed in which the de-median value of 2.6. The location of drywell fail- pendent variable is the quantity of release per year ure affects the potential for reactor building de- for each of the radionuclide groups. These analy-contamination. Leakage past the drywell head to ses are particularly useful in investigating how un-the refueling building was assumed to result in certainties in source term variables affect the re-very little decontamination. Failure of the drywell leases of different radionuclides. Also determined by meltthrough resulted in a release that was sub- were partial correlation coefficients that represent 10-9 NUREG-1150

10. Severe Accident Source Terms the importance of uncertain variables as a func- lurium, barium, strontium, and ruthenium. For tion of the magnitude of the environmental re- the involatile radionuclides, lanthanum and ce-lease. rium, the release of radionuclides during core-concrete interactions is also an important con-Relative Importance of Source Term tributor.

Variables The Surry analyses also indicate that the uncer-The results of these regression analyses indicate tainties in source term variables tend to have rela-that uncertainties in source term variables are im- tively more importance for large releases. For portant contributors to the uncertainties in risk small releases of radionuclides, the uncertainties but are often not the largest contributors. The are dominated by the uncertainties associated with relative contribution of uncertainties in source the accident frequencies.

term variables depends on the characteristics of each plant damage state as illustrated in the Peach Plant-Specific Importance of Source Term Bottom and Sequoyah regression analyses (Refs. Variables to Uncertainty in Risk 10.11 and 10.12). In general, the five plant analy- Consistent with the discussion in the previous sec-ses indicate that the importance of the aggregate tion, the largest contributors to uncertainty in of variables that affect release frequencies (acci- early fatality risk for the Surry plant (Ref. 10.10) dent frequency variables and accident progression are the frequency of the interfacing-system LOCA variables) is similar to or greater than the impor- sequence and two source term variables, retention tance of the aggregate of variables that affect in the steam generator (in an SGTR accident) and source term magnitude. release from the fuel during in-vessel melt pro-gression. For latent cancer fatality risk, the fre-Source term variables tend to have less impor- quency of SGTR accidents becomes of higher im-tance to the uncertainty in latent cancer fatality portance and the frequency of interfacing-system (or population dose) risk than to the risk of early LOCAs of reduced importance. Steam generator fatalities. Because of the threshold nature of early retention and in-vessel release of radionuclides fatalities, these risk results are particularly sensi- are of comparable importance to the accident fre-tive to pessimistic values of source term variables. quency variables.

Importance of Source Term Variables to The Zion results (Ref. 10.13) are similar to those Uncertainty in Environmental Release for Surry but reflect a reduced significance of the interfacing-system LOCA sequence and an in-Based on analyses performed for the Surry plant creased importance of steam explosions as a mode (Ref. 10.10), the importance of source term vari- of early containment failure (this results from a ables is seen to be different for different groups of much lower frequency of interfacing-system radionuclides. The uncertainty in the release of LOCA in Zion). Release of radionuclides from noble gases is dominated by the uncertainty in ac- fuel in-vessel, steam generator retention (in an cident frequency variables. The relative uncertain- SGTR accident), and containment retention of ties in release fractions for the noble gases and in material released prior to vessel breach (as ap-retention mechanisms (only volumetric holdup is plied in a steam explosion scenario) are the most assumed) are small. important source term contributors to the uncer-tainty in early fatality risk. For latent cancer fatal-The character of the risk-dominant accident se- ity risk, containment failure from a steam explo-quences at Surry plays an important role in deter- sion is of reduced significance and, as a result, mining the importance of the source term vari- containment retention is not an important con-ables for the other radionuclide groups. The tributor to risk uncertainty.

steam generator tube rupture (SGTR) accident and the interfacing-system LOCA sequences (the For early fatality risk at Sequoyah (Ref. 10.12),

risk-dominant sequences) involve bypass routes in the frequency of the interfacing-system LOCA is which radionuclides released from the core trans- the most important contributor to uncertainty.

port to the environment without being subjected Containment failure by overpressurization is a to containment deposition processes. As a result, more likely early failure mechanism for Sequoyah steam generator retention and the release of than for the large, high-pressure containments at radionuclides from the fuel during in-vessel melt Zion and Surry. As a result, accident progression progression are the largest contributors to uncer- mechanisms such as pressure rise at vessel breach tainty for the volatile radionuclides, iodine and and containment failure pressure are also impor-cesium, and for the semivolatile radionuclides, tel- tant contributors to risk uncertainty for the NUREG-1150 10-1 0

10. Severe. Accident Source Terms Sequoyah design. The most significant source dent sequences. For fire initiators, the contribu-term variables are in-vessel retention fraction, tions from the various source term variables are containment retention fraction for the in-vessel similar but slightly reduced consistent with greater release, and steam generator deposition (in an uncertainty in the initiator frequency.

SGTR accident). For latent cancer fatality risk, the frequency of the SGTR accident is the most For latent cancer fatality risk at Peach Bottom, important contributor to uncertainty; none of the the important source term variables are the same source term variables is significant. as for the early fatality risk but are relatively less important than the contribution from uncertainties in the accident frequencies.

Regression results were obtained for internal in-itiators, fire events, and seismic events for the In the Grand Gulf analyses (Ref. 10.14), the Peach Bottom plant (Ref. 10.11). For early fatal- source term variables were indicated to be less im-ity risk from internal initiators, release from fuel portant than the accident sequence and accident in-vessel, release during core-concrete interac- progression variables. The most significant source tions, and fractional release from containment of term variable was indicated to be the release frac-the core-concrete source terms are the most im- tion from containment following vessel failure.

portant contributors to uncertainty. The contain- The decontamination factor for the suppression ment building decontamination factor, late release pool, spray decontamination factor, in-vessel re-of iodine, reactor coolant system retention, and lease of radioactive material, and in-vessel reten-revaporization also contribute at a level similar to tion of radioactive material were also identified as the contribution from the frequencies of the acci- moderate contributors to the uncertainty in risk.

10-1 1 NUREG-1 150

10. Severe Accident Source Terms REFERENCES FOR CHAPTER 10 10.1 M. Silberberg et al., "Reassessment of the quence Modeling," Executive Conference Technical Bases for Estimating Source on the Ramifications of the Source Term Terms," U.S. Nuclear Regulatory Commis- (Charleston, SC), March 12, 1985.

sion (USNRC) Report NUREG-0956, July 1986. 10.9 L. LeSage et al., "Report of the Special Committee on NUREG-1150, The NRC's 10.2 J. A. Gieseke et al., "Source Term Code Study of Severe Accident Risks," Ameri-Package, A User's Guide (Mod. 1)," Bat- can Nuclear Society, June 1990.

telle Columbus Division, NUREGI CR-4587, BMI-2138, July 1986. 10.10 R. J. Breeding et al., "Evaluation of Se-vere Accident Risks: Surry Unit 1," Sandia 10.3 R. M. Summers et al., "MELCOR In- National Laboratories, NUREG/CR-4551, Vessel Modeling," Proceedings of the Fif- Vol. 3, Revision 1, SAND86-1309, Octo-teenth Water Reactor Safety Information ber 1990.

Meeting (Gaithersburg, MD), NUREG/

CP-0091, February 1988. 10.11 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit 10.4 Fauske and Associates, Inc., "MAAP 2, " Sandia National Laboratories, Modular Accident Analysis Program Us- NUREG/CR-4551, Vol. 4, Draft Revision er's Manual," Vols. I and II, IDCOR 1, SAND86-1309, to be published.*

Technical Report 16.2-3, February 1987.

10.12 J. J. Gregory et al., "Evaluation of Severe 10.5 K. D. Bergeron et al., "User's Manual for Accident Risks: Sequoyah Unit 1," Sandia CONTAIN 1.0, A Computer Code for Se- National Laboratories, NUREG/CR-4551, vere Reactor Accident Containment Vol. 5, Revision 1, SAND86-1309, De-Analysis," Sandia National Laboratories, cember 1990.

NUREG/CR-4085, SAND84-1204, July 1985. 10.13 C. K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven 10.6 D. I. Chanin, H. Jow, J. A. Rollstin et al., National Laboratory, NUREG/CR-4551, "MELCOR Accident Consequence Code Vol. 7, Draft Revision 1, BNL-System (MACCS)," Sandia National NUREG-52029, to be published.*

Laboratories, NUREG/CR-4691, Vols.

1-3, SAND86-1562, February 1990. 10.14 T. D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," San-10.7 USNRC, "Reactor Safety Study-An As- dia National Laboratories, NUREG/

sessment of Accident Risks in U. S. Com- CR-4551, Vol. 6, Draft Revision 1, mercial Nuclear Power Plants," SAND86-1309, to be published.'

WASH-1400 (NUREG-75/014), October 1975.

10.8 G. D. Kaiser, "The Implications of Re- *Available in the NRC Public Document Room, 2120 L duced Source Terms for Ex-Plant Conse- Street NW., Washington, DC.

NUREG-1150 10-12

11. PERSPECTIVES ON OFFSITE CONSEQUENCES 11.1 Introduction were initially developed for each of the five plants.

They spanned a wide spectrum of plant damage Frequency distributions, in the form of comple- states, phenomenological scenarios, and source mentary cumulative distribution functions term uncertainties for each plant that led to (CCDFs), of four selected offsite consequence radionuclide releases to the atmosphere. How-measures of the atmospheric releases of ever, for the purpose of the manageability of the radionuclides in reactor accidents (with all source offsite consequence analysis, such large numbers terms contributing) have been presented in Chap- of source terms for each plant were reduced to a ters 3 through 7 for the five plants* covered in this much smaller number (about 30 to 60) of repre-study. For each consequence measure, the 5th sentative source term groups.

percentile, 50th percentile (median), 95th per-centile, and the mean CCDFs were shown. This Each source term group was treated as a single chapter provides some perspectives on the offsite source term in the offsite consequence analysis consequence results for these plants. code, MACCS (Ref. 11.2). The MACCS analyses incorporated the mitigating effects of the offsite Section 11.2 provides a discussion on the basis of protective actions. The magnitudes of the selected the CCDFs. Section 11.3 discusses, summarizes, consequence measures and their meteorology-and compares the consequence results for the five based probabilities were calculated by MACCS for plants displayed in the mean and the median each source term group and were used to generate CCDFs. Section 11.4 compares the results from the meteorology-based CCDFs. These conditional the mean and median CCDFs with those of the CCDFs of the consequence measures for all indi-Reactor Safety Study (Ref. 11.1). Sections 11.5 vidual source term groups served as the basic data and 11.6, respectively, provide discussions on po- set for further analysis. When the conditional tential sources of uncertainty in consequence CCDFs of a consequence measure were weighted analysis and on sensitivities of the mean CCDFs to by the frequencies of the source term groups, the the assumptions on the offsite protective measures 5th percentile, 50th percentile (median), 95th to mitigate the consequences. percentile, and the mean values of the frequencies at various magnitude levels of the consequence Some of the perspectives provided in this chapter measure were obtained and displayed as CCDFs relate to the effectiveness of various methods of in Chapters 3 through 7.

offsite emergency response. For these five plants, it appears that evacuation is the most effective Thus, in this procedure, both the frequencies of emergency response for the risk-dominant acci- the source term groups and the probabilities of the dent sequences. However, as discussed below, the site meteorology (which in combination with the calculated effectiveness of a response is sensitive source term groups lead to the various conse-to assumptions on the timing of warnings to people quence magnitude levels) have been used in gen-offsite before radioactive release, the estimated erating the percentile and mean CCDFs. (The delay before evacuation and the effective speed of construction of these CCDFs is discussed in Sec-evacuating populations, and the energy of the re- tion A.9 of Appendix A.)

lease. In this chapter, the results of sensitivity studies on some of these factors are discussed.

The reader should not infer that these results sig- 11.3 Discussion, Summary, and nal a modification to NRC's emergency response Interplant Comparison of Offsite guidance. Rather, they provide a glimpse of the Consequence Results type of technical assessment that would be re-quired in NRC's reevaluation of emergency re- The various percentile and the mean CCDFs of sponse. the consequence measures shown in Chapters 3 through 7 display the uncertainties in the offsite 11.2 Discussion of Consequence CCDFs consequences stemming from the in-plant uncer-tainties up to the source terms and their frequen-As discussed in the earlier chapters, a large num- cies and the ex-plant uncertainties due to the vari-ber of source terms, each with its own frequency, ability of the site meteorology. The 5th and 95th percentile CCDFs provide a reasonable display of

• See Figures 3.9, 3.10; 4.9, 4.10; 5.8; 6.8; and 7.7, re-spectively, for Surry, Peach Bottom, Sequoyah, Grand the bounds of the offsite consequences frequency Gulf, and Zion. distributions for the five plants.

11-1 NUREG-1 150

11. Offsite Consequences Tables 11.1 and 11.2 present the information groups for Peach Bottom and Grand Gulf are contained in the mean and the median CCDFs in typically smaller than those for the other three tabular form. Entries in these tables are the ex- plants because of suppression pool scrubbing.

ceedance frequency levels of 10-5, 10-6, 10-7, This lowered the early fatality magnitudes for 10-8, and 10-9 per reactor year and the magni- these two plants.

tudes of the consequences that will be exceeded at these frequencies for the five plants.

• Several source term groups for Surry and Se-quoyah with large quantities of radionuclides As stated in Chapters 3 through 7, the CCDFs of associated with the early release phase are the consequence measures presented in those also associated with large thermal energy in chapters (and, therefore, the results shown in Ta- this phase. This resulted in vertical rise of the bles 11.1 and 11.2) incorporate the benefits of plume in several meteorological scenarios, re-evacuation of 99.5 percent of the population ducing the potential for large early fatality within the 10-mile plume exposure pathway emer- magnitudes.

gency planning zone (EPZ), early relocation of the remaining population from the heavily con-

• The time of warning before the start of the taminated areas both within and outside the radionuclide release strongly influences the 10-mile EPZ, and other protective measures. De- effectiveness of the emergency response, par-tails of the assumptions on the protective meas- ticularly the evacuation. The source term ures are presented in Table 11.3. groups for Peach Bottom and Grand Gulf with potential for early fatalities, unless mitigated The results shown in Tables 11.1 and 11.2 for the by emergency response, are also associated five plants are discussed below. with warning times that are well in advance of the release compared to those for the other Early Fatality Magnitudes three plants because the most important acci-dent sequences for the BWRs develop more The early fatality magnitudes (persons) at various slowly than those for the PWRs of this study.

exceedance frequencies for a plant are driven by In contrast, warning times are close to the the core damage frequency and the radionuclide start of the release (about 40 minutes before release parameters of the source term groups for the release) for the source term groups con-the plant; the site meteorology and the population taining the fast-developing interfacing-system distribution in the close-in site region; and the ef- LOCA accident sequences for Surry and Se-fectiveness of the emergency response. These fac- quoyah, which also have large quantities of tors are different for the five plants. Therefore, radionuclides in the release.

different values of early fatality magnitudes are shown for equal levels of exceedance frequencies.

• The Zion site has the highest population den-sity within the 10-mile EPZ among the five Some of the plant/site features contributing to the plants (although about half of the area in this differences between the early fatality CCDFs of zone for Zion is water). It is followed by the five plants are discussed below: Surry, Sequoyah, Peach Bottom, and Grand

• Core damage frequencies for the internal in- Gulf.

itiators for Peach Bottom and Grand Gulf are

• For Zion, Surry, and Sequoyah, relatively lower than those for the other three plants. long evacuation delay times after the warnings Therefore, the early fatality CCDFs for Peach and slow effective evacuation speeds were cal-Bottom and Grand Gulf are associated with culated. For Peach Bottom and Grand Gulf, relatively low exceedance frequencies. relatively short evacuation delay times and

• Quantities of radionuclides associated with the fast effective evacuation speeds were calcu-early phase of the release* in the source term lated. Values of these parameters were based on the utility-sponsored plant-specific studies and the NRC requirements for emergency

'Virtually all source term groups developed for this study planning. The utility-sponsored evacuation have two release phases-an early release phase and a later release phase. Early fatalities are essentially due to time estimate studies, however, were not the early release. This is because the wind direction may evaluated in terms of how well they realisti-change before the later release, so that the later release cally represent the sites.

would not always add to the radiation dose of the same people who were affected by the early release, and evacuation or relocation would likely be completed before In the MACCS calculations, early warnings before the later release would occur. the radionuclide release and short evacuation NUREG-1150 11-2

Table 11.1 Summaries of mean and median CCDFs of offsite consequences-fatalities.

Exceedance Early Fatalities (persons)a Latent Cancer Fatalities (persons)a Frequency (ry-1) 1* 2* 3* 4* 5* 6* 7* 1* 2* 3* 4* 5* 6* 7*

10-5 Int.b 0 0 0 0 0 - 0 0 6(1)c 0 0 -

0 0 0 0 0 0 0 0 0 2(1) 0 0 7(2) 1(3)

Fire 0 0 - - - - - 0 6(2) - - -

O O - - - - - 0 0o 1 0~~~~ 00 10-6 Int. 0 0 0 0 0 - - 1(3) 1(3) 4(3) 3(2) 8(3) -

0 0 0 0 0 0 0 4(2) 2(2) 1(3) 0 2(3) 5(3) 5(3)

Fire 0 0 - - - - - 1(1) 8(3) - - - -

0 0 - - - - - 7(0) 3(3) 10-7 Int. 3(0) 0 5(1) 0 2(2) - - 8(3) 8(3) 9(3) 1(3) 3(4) - -

0 0 2(0) 0 2(0) 2(2) 2(0) 4(3) 3(3) 6(3) 6(2) 1(4) 2(4) 2(4)

Fire 0 0 - - - - - 4(2) 2(4) - - - - -

0 0 - 2(1) 1(4) - - -

10-8 Int. 4(1) 0 4(2) 0 3(3) - - 2(4) 2(4) 2(4) 3(3) 8(4) - -

\ 0 0 5(1) 0 5(1) 1(3) 3(2) 9(3) 1(4) 1(4) 2(3) 2(4) 3(4) 3(4)

Fire 0 1(0) - - - - - 5(3) 4(4) - - - - -

0 0 - - - - 6(1) 2(4) - - - -

I-10-9 0

Int. 1(2) 1(0) 2(3) 0 4(3) - - 4(4) 4(4) 2(4) 6(3) 1(5) - -

8(0) 0 2(2) 0 8(2) 4(3) 2(3) 2(4) 2(4) 2(4) 3(3) 4(4) 4(4) 5(4) 5)

Fire 1(1) 3(0) . 2(4) 5(4) - - - - -

0 0 - - - - - 1(3) 4 (4) - - - - 0 D

• Plant Names: 1 = Surry; 2 = Peach Bottom; 3 = Sequoyah 4 = Grand Gulf; 5 = Zion; 6 = RSS-PWR; 7 = RSS-BWR

a. First line of entries corresponds to mean CCDF; second line corresponds to median CCDF. CD

b. Int. Inteinal initiating events

c. 6(1) 6 X 10.1 = 60 0-

z t-'

a 0

Table 11.2 Summaries of mean and median CCDFs of offsite consequences-population exposures.

0 CD (3'

Exceedance 50-Mile Region Population Exposure (person-rem)a Entire Site Region Population Exposure (person-rem)a 0 Frequency D CD' (ry-1) 1* 2* 3* 4* 5* 1* 2* 3* 4* 5*

.0 10-5 0 Int.b 7(2)c 0 1(5) 0 5(3) 2(3) 0 4(5) 0 9(3) CD' 2(2) 0 4(4) 0 3(3) 3(2) 0 1(5) 0 4(3)

Fire 5(1) 1(6) - - - 1(2) 3(6) - - -

0 2(3) - - - 3(3) - - -

10 6 Int. 1(6) 3(6) 3(6) 2(5) 2(7) 8(6) 7(6) 2(7) 2(6) 5(7) 6(5) 6(5) 1(6) 1(2) 3(6) 2(6) 1(6) 7(6) 2(2) 1(7)

Fire 3(4) 1(7) - - - 1(5) 5(7) - - -

2(4) 6(6) - - - 6(4) 2(7) - - -

10-7 Int. 8(6) 1(7) 8(6) 6(5) 8(7) 5(7) 5(7) 6(7) 9(6) 2(8) 5(6) 6(6) 4(6) 3(5) 3(7) 2(7) 2(7) 3(7) 3(6) 7(7)

Fire 6(5) 3(7) - - - 2(6) 1(8) - - -

1(5) 1(7) - - - 2(5) 7(7) - - -

10-8 Int. 2(7) 2(7) 2(7) 1(6) 2(8) 1(8) 1(8) 9(7) 2(7) 3(8) 9(6) 1(7) 7(6) 6(5) 7(7) 6(7) 8(7) 6(7) 9(6) 1(8)

Fire 6(6) 5(7) - - - 3(7) 2(8) - - -

5(5) 3(7) - - - 6(5) 1(8) - - -

1O-~~~~~~~~~~~~

10-9 Int. 3(7) 4(7) 4(7) 2(6) 4(8) 2(8) 2(8) 1(8) 3(7) 4(8) 1(7) 2(7) 1(7) 1(6) 1(8) 1(8) 1(8) 1(8) 2(7) 2(8)

Fire 2(7) 6(7) - - - 9(7) 3(8) - -

1(6) 4(7) - - 8 (6) 2(8) -

• Plant Names: 1= Surry; 2 = Peach Bottom; 3 = Sequoyah 4 = Grand Gulf; 5 = Zion

a. First line of entries corresponds to mean CCDF; second line corresponds to median CCDF.

b. Int. = Internal initiating events

c. 7(2) = 7 X 102 = 700

Table 11.3 Offsite protective measures assumptions.

1. Emergency Response Assumptions

a. Within 10-mile plume exposure pathway emergency planning zone (EPZ):

Evacuation of people after a delay* following the warning given by the reactor operator on the imminent radionuclide release.

Average evacuation delay times (hr): Surry 2.0, Peach Bottom 1.5, Sequoyah 2.3, Grand Gulf 1.25, Zion 2.3.

Average effective radial evacuation speeds (mile/hr): Surry 4.0, Peach Bottom 10.7, Sequoyah 3.1, Grand Gulf 8.3, Zion 2.5.

b. Outside of 10-mile EPZ:

Early relocation of people: within 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />s/24 hours after plume passage from areas where the projected lifetime effective whole body dose equivalent (EDE), as defined in ICRP Publications 26 and 30, from a 7-day occupancy would exceed 50 rems/25 reins.

Note: These assumptions are also extended inward up to the plant site boundary for the nonevacuating or nonsheltering people.

2. Protective Action Guides (PAGs) for Long-Term Countermeasures

a. FDA "emergency" PAG for directly contaminated foods and animal feeds-dose not to exceed 5-rem EDE and 15-rem thyroid (Ref. 11.3).

b. EPA's proposed PAGs for continuation of living in contaminated environment-dose not to exceed:

• 2-rem EDE in the first year

• 0.5-rem EDE in the second year 0

from groundshine and inhalation of resuspended radionuclides.

Note: EPA's criteria (Ref. 11.4) are approximated in MACCS as dose not to exceed 4-rem EDE in 5 years.

0

c. In absence of any Federal agency criteria for ingestion dose to an individual from foods grown on contaminated soil via root up-O takes, MACCS assumes a PAG of 0.5-rem EDE and 1.5-rem thyroid for this pathway, which is similar to FDA's "preventive" PAG CD for directly contaminated food and animal feeds (Ref. 11.3).

-~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~0 CD o

• Time steps involved during the delay are: (1) notification of the offsite authorities, (2) evaluation and decision by the authorities, (3) public notification advising evacu-ation, and (4) people's preparation for evacuation.

11. Offsite Consequences delay times for Peach Bottom and Grand Gulf en- fatality magnitude and does not contribute sub-abled the evacuees to have a substantial head start stantially to the differences in the cancer fatality on the plume. This, coupled with relatively fast CCDFs for the five plants. The long-term protec-effective evacuation speeds, enabled the evacuees tive measures, such as temporary interdiction, to almost always avoid the trailing radioactive condemnation, and decontamination of land, plumes. Thus, the relatively lower core damage property, and foods contaminated above accept-frequencies, lower magnitudes of source term able levels are based on the same protective ac-groups in the early phase of release, early warn- tion guides (PAGs) for all plants. Further, the site ings, lower population densities, lower evacuation differences for the five plants are not large enough delays, and higher evacuation speeds made the beyond the distances of 50 to 100 miles to con-Peach Bottom and Grand Gulf early fatality tribute substantially to the differences in the latent CCDFs in Figures 4.9 and 6.8 lie in the low fre- cancer fatality CCDFs.

quency and low magnitude regions, and early fa-tality magnitude entries in Table 11.1 small or nil. Population Exposure Magnitudes Surry and Sequoyah fit between Peach Bottom! Population exposure magnitudes (person-rem*) at Grand Gulf and Zion. For Surry and Sequoyah, various exceedance frequencies include the con-warnings close to release in the interfacing-system tributions from the early and chronic exposures.

LOCA accident sequences made evacuation less These magnitudes reflect the dose-saving actions effective for these sequences. Also, evacuation of the protective measures and, therefore, are the was less effective in the plume rise scenarios for residual magnitudes.

those source terms for which early release phases Variations of the population exposure magnitudes were associated with large quantities of radio- for the five plants at equal exceedance frequency nuclides and large amounts of thermal energy (se- levels were similar to those of the cancer fatality quences with early containment failure at vessel magnitudes discussed earlier.

breach). With the plume rise, the highest air and ground radionuclide concentrations occur at some The relative contributions of the exposure path-distance farther from the reactor (instead of oc- ways to the population dose for a given plant are curring close to the reactor without plume rise). In highly source term dependent. Examples of rela-such cases, the late starting evacuees from the tive contributions of early and chronic exposure close-in regions moving away from the reactor in pathways (see Chapter 2 and Appendix A) to the the downwind direction encounter higher concen- meteorology-averaged mean estimates of the trations and receive higher doses. 50-mile and entire region population dose for se-lected source term groups for the five plants are shown in Table 11.4. For brevity of presentation, Latent Cancer Fatality Magnitudes only four source term groups that are the top con-tributors to the risks of the population dose for the The estimates of latent cancer fatality magnitude five plants are selected. These source term groups at various exceedance frequencies include the are designated only by their identification num-benefits of the protective measures discussed bers in Table 11.4. The chronic exposure pathway above. Contributions from radiation doses down is shown subdivided in terms of direct (ground-to very low levels have been included. If future shine and inhalation of resuspended radionu-research concludes that it is appropriate to trun- clides) and ingestion (food and drinking water) cate the individual dose at a de minimis level, re- pathways.

duced latent cancer fatality estimates would be obtained. For a qualitative understanding of the results shown in Table 11.4, it should be noted that:

Variations of the latent cancer fatality magnitude

• All radionuclides contribute to the early expo-for the five plants at equal exceedance frequency sure pathway; all nonnoble gas radionuclides levels primarily arise because of differences in the contribute to the chronic direct exposure source term groups and their frequencies, site me- pathway; and only the radionuclides of io-teorologies, and differences in the site demogra- dine, strontium, and cesium contribute to the phy, topography, land use, agricultural practice chronic ingestion exposure pathway.

and productivity, and distribution of fresh water bodies up to 50 to 100 miles from the plants.

• Effective dose equivalent (EDE) (as defined in ICRP Emergency response in the close-in regions has Publications 26 and 30) in the unit of rem is used in the only a limited beneficial impact on delayed cancer definition of person-rem.

NUREG-1 150 11-6

Table 11.4 Exposure pathways relative contributions (percent) to meteorology-averaged conditional mean estimates of population dose for selected source term groups.

Source Term Group 50-Mile Region* Entire Region*

Identification Early Chronic Exposure Early Chronic Exposure Plant Name Number Exposure Direct Ingestion Exposure Direct Ingestion Surry 9 28 68 2 10 69 20 33 51 41 3 14 74 12 37 33 58 5 9 79 12 49 13 80 7 9 58 33 Peach Bottom 28 28 66 2 15 77 7 34 42 47 5 24 68 5 37 38 52 5 20 72 6 40 23 70 3 10 81 8 Sequoyah 32 49 36 8 11 68 20 I 35 42 47 6 8 59 32 43 49 28 19 11 73 15 44 59 29 9 12 75 13 Grand Gulf 19 24 62 12 17 46 42 25 16 65 16 4 54 41 28 10 72 16 3 41 57 32 41 39 17 12 62 25 Zion 139 50 46 1 27 56 16 175 .71 21 2 49 39 8 142 24 73 1 23 60 15 0 136 44 49 2 12 67 20 1o C,

z 'The difference between 100 percent and the sum of the pathway contributions is the relative population dose to the decontamination workers. (1) 0 CD tl 0 0 0 en

11. Offsite Consequences

• Early exposure pathway population dose esti- pathway has higher contributions both in the mated is largely unmitigated, except for the 50-mile and entire region compared to the other evacuated and relocated people. In addition plants. This is because the Grand Gulf site region to cloudshine and cloud inhalation during has a smaller population size and a larger area de-plume passage, it includes the groundshine voted to farming than the other four sites of this and inhalation of resuspended radionuclides study.

for a period of 7 days after the radionuclide release. 11.4 Comparison with Reactor Safety Study

• Chronic exposure pathway involves dose inte-gration from 7 days to all future times (i.e., The mean and the median CCDFs of two of the the sum total of the dose over time). selected consequence measures, namely, early fa-talities and latent cancer fatalities, displayed in Chapters 3 through 7 for the internal initiators of

• In the MACCS analysis, the protective actions the reactor accidents and summarized in Table to mitigate the chronic exposure pathways are 11.1, may be compared with the CCDFs displayed largely confined to the 50-mile region of the in the Reactor Safety Study (RSS). However, the site. Outside the 50-mile region, the mitigative RSS CCDFs are the results of superpositions of actions (based on the PAGs) are generally not the meteorology-based conditional CCDFs for the triggered in MACCS because of the relatively RSS "release categories" after being weighted by low levels of contamination (however, some- the median frequencies of the release categories.

times they are triggered depending on the me- The CCDFs shown in Chapters 3 through 7 are teorology and the source term magnitudes). calculated in a different way from the RSS CCDFs. Thus, they are not strictly comparable.

• Protective actions are not assumed for water ingestion. The RSS CCDFs of early fatalities and latent can-cer fatalities are shown in the RSS Figures 5-3 Except for Grand Gulf, Table 11.4 shows that in and 5-5, respectively. The magnitudes of delayed the 50-mile region the early exposure pathway cancer fatalities shown in the RSS CCDFs are ac-population dose and the chronic direct exposure tually the magnitudes of their projected uniform pathway population dose are roughly similar; the annual rates of occurrence over a 30-year period.

chronic ingestion pathway makes smaller contri- Thus, these RSS rate magnitudes need to be mul-butions. For the entire region, the chronic direct tiplied by a factor of 30 to derive their total mag-exposure pathway has increased contributions nitudes. After performing this step, the RSS re-relative to the early exposure pathway. This is be- sults have been entered in Table 11.1 for cause at longer distances the early exposure path- comparison with the results of this study.

way has weakened as a result of low air and ground concentrations and the short (i.e., 7 days) Table 11.1 shows that, for one or more early fa-integration time for ground exposure. Relative tality magnitudes, the mean and median frequen-contributions of the chronic ingestion exposure cies for the three PWRs of this study (Surry, Se-pathway are also higher for the entire region. This quoyah, and Zion) and the median frequency for is because the chronic direct exposure is depend- the RSS-PWR are similar and are less than 10-6 ent on population size and the chronic ingestion per reactor year. However, Table 11.1 also shows exposure is dependent on farmland and water that these frequencies for the two BWRs of this body surface area. An increase in the population study (Peach Bottom and Grand Gulf) are signifi-size with distance from a plant generally occurs cantly lower than that for the RSS-BWR. For one less rapidly compared to the increase in the area or more early fatality magnitude, the median fre-with distance. quency is less than 10-6 per reactor year for the RSS-BWR; whereas, the mean and median fre-For Grand Gulf, generally the contributions from quencies are less than 10-8 per reactor year for-the early exposure pathway are lower than the Peach Bottom and less than 10-9 per reactor year chronic direct exposure pathway in the 50-mile for Grand Gulf.

region relative to the other four plants and are due to the characteristics of the selected source Further, the comparison of the early fatality mag-term groups. For the entire region, the relative nitudes in the median exceedance frequency contributions of the early exposure pathway and IRSS "release categories" are analogous to the source term chronic direct exposure pathway are similar to the groups in the present study but were developed by differ-other plants. However, the ingestion exposure ent procedures.

NUREG-1150 11-8

11. Offsite Consequences range of 10-9 to 10-7 per reactor year shows that

• Protective action guide dose levels for control-the RSS estimates are significantly higher than the ling the long-term exposure are different.

estimates for the five plants of this study.

• There are other miscellaneous differences be-tween the accident consequence models and Table 11.1 shows that for the one or more latent input data used in this study and the RSS.

cancer fatality magnitudes, the mean and median frequencies of only one plant (Sequoyah) of this

• Different procedures were used for construct-study and the median frequencies for the RSS- ing the CCDFs.

PWR and RSS-BWR are similar and are less than 10-4 per reactor year. However, these frequencies 11.5 Uncertainties and Sensitivities for the other four plants of this study are an order of magnitude lower than that for the RSS; i.e., There are uncertainties in the CCDFs of the less than 10-5 per reactor year. offsite consequence measures. Some of these un-certainties are inherited from the uncertainties in The RSS estimates of latent cancer fatality magni- the source term group specifications and frequen-tudes for the median exceedance frequency range cies, However, even after disregarding the source of 10-9 to 10-5 per reactor year are higher (in term group uncertainties, there are significant un-some instances significantly higher) than those for certainties in the CCDFs of the consequence the five plants of this study-except for Zion at the measures due to uncertainties in the modeling of median exceedance frequency of 10-9 per reactor atmospheric dispersion, deposition, and transport year where they are about equal. of the radionuclides; transfer of radionuclides in the terrestrial exposure pathways; emergency re-There are several factors contributing to the dif-ferences in the frequency distributions of the sponse and long-term countermeasures; offsite consequences for this study and the RSS. dosimetry, shielding, and health effects; and un-certainties in the input data for the model pa-Some of these factors are mentioned below:

rameters.

• Accident sequence frequency differences. Because of time constraints, uncertainty analyses for the offsite consequences, except for the uncer-

• Source term characterization difference. tainties due to variability of the site meteorology, Most of the source terms of this study have have not been performed for this report. They are two releases-an early release and a later re- planned for future studies. For this study, only lease. Early fatalities from a source term are best estimate values of the parameters for repre-mostly the consequences of the early release. sentation of the natural processes have been used Cancer fatalities are the consequences of both in MACCS. An analysis of sensitivity of the early and later releases. On the other hand, CCDFs to the alternative protective measure as-the RSS source terms did not have such a sumptions is provided in the following section.

breakdown in terms of early or later release.

Therefore, the early fatalities from an RSS 11.6 Sensitivity of Consequence source term were the consequences of the en- Measure CCDFs to Protective tire release, as were the latent cancer fatali- Measure Assumptions ties.

Emergency response, such as evacuation, shelter-ing, and early relocation of people, has its greatest

• Consequence analyses for this study are site beneficial impact on the early fatality frequency specific, using data for the site features de- distributions. The long-term protective measures, scribed in Chapters 3 through 7. The RSS such as decontamination, temporary interdiction, consequence analysis was generic; it used and condemnation of contaminated land, prop-composite offsite data by averaging over 68 erty, and foods in accordance with various radio-different sites. logical protective action guides (PAGs), have their largest beneficial impact on the latent cancer fa-

• In the present study, evacuation to a distance tality and population exposure frequency distribu-of 10 miles is assumed; whereas, in the RSS, tions.

evacuation to a distance of 25 miles was as-sumed. 11.6.1 Sensitivity of Early Fatality CCDFs to Emergency Response

• Health effect models of this study are differ- Four alternative emergency response modes ent from those of the RSS. within the 10-mile EPZ, as characterized in Table 11-9 NUREG-1 150

11. Offsite. Consequences 11.5, are assumed in order to show the sensitivity tering modes of response assumed in this of-early fatality CCDFs to these response modes. study.)

Table 11.6 summarizes the early fatality mean Sequoyah CCDFs in tabular form for Surry, Peach Bottom, 1 Evacuation is more effective than relocation Sequoyah, and Grand Gulf for two alternative for eceedance frequencies higher than 10-8 emergency response modes, and Zion for all four per readtor year.

alternative emergency response modes. Several inferences are drawn later in this section regarding 2. in the low frequency region (i.e., 10-8 per the effectiveness of these alternative emergency reactor year or less), the early relocation response modes for the five plants based on these mode is more effective than evacuation. This data. However, more analysis is needed to support "crossover" of the early fatality mean CCDFs these inferences for emergency response and to for the two response modes is likely because provide detailed insight into the underlying com- of the dominance of the low frequency large peting processes involved that diminish or en- source terms that also have short warning hance the effectiveness of any emergency re- times before release and/or high energy con-sponse mode.

tents and calculated long evacuation delay In particular, the effectiveness of evacuation is time and slow effective evacuation speed.

very site specific and source term specific. It is Because of the short warning time before re-largely determined by two site parameters, lease and a long delay between the warning namely, evacuation delay time and effective and the start of evacuation, many evacuees evacuation speed, and two source term parame- become vulnerable to the radiation exposures ters-warning time before release and energy asso- from the passing plume and contaminated ciated with the release (which, during some mete- ground rather than escape these exposures.

orological conditions, could cause the radioactive Because of the plume-rise effect (for the hot plume to rise while being transported downwind). plumes), the peak values of the air and Therefore, it cannot be extrapolated across the ground radionuclide concentrations occur at source terms for a plant or across the plants for some distance farther from the plant. In such similar source terms. a case, the evacuees from close-in regions moving in the downwind direction move from The CCDFs discussed here include contributions areas of lower concentrations to areas of from many source term groups. The effectiveness higher concentrations and receive a higher of any emergency response mode judged from the dose. It should be noted that, while evacuat-sensitivity of the early fatality mean CCDF for a ing, the people are out in the open and have plant is essentially the effectiveness for the domi- minimal shielding protection. For the above nant source terms in specific frequency intervals situations, the sheltering mode also would included in the CCDF. With these caveats, the in- show the same crossover effect.

ferences based on the data shown in Table 11.6 are as follows: However, the crossover effect showing that relocation or sheltering may be more effec-Zion tive than evacuation may not be realistic be-cause of uncertainties in the consequence

1. Evacuation from the 0-to-5 mile EPZ com- analysis.

bined with sheltering in the 5-to-1O mile EPZ is as effective as evacuation from the entire Peach Bottom, Grand Gulf 10-mile EPZ. Effectiveness of evacuation in close-in regions of radius less than 5 miles The source terms and features of these two low population density sites make evacuation a very and sheltering in the outer regions will be effective mode of offsite response.

evaluated in future studies. (See Chap-ter 13.) Surry Although entries in Table 11.6 show that evacu-

2. Sheltering, due to better shielding protection ation is more effective than relocation from the indoors, is more effective than early reloca- state of normal activity, some low probability tion from the state of normal activity. (See accident sequences for Surry are similar to those Tables 11.3 and 11.5 for distinctions be- of Sequoyah (short warning times of the interfac-tween evacuation, early relocation, and shel- ing-system LOCA accident sequences and large NUREG-1150 11-10

Table 11.5 Assumptions on alternative emergency response modes within 10-mile plume exposure pathway EPZ for sensitivity analysis.

a. Evacuation (see Table 11.3).

b. Early relocation in lieu of evacuation or shelter: Extends the assumptions for relocation outside the 10-mile EPZ (see Table 11.3) inward up to the plant site boundary.

c. Sheltering* (getting to and remaining indoors) in lieu of evacuation, followed by fast relocation after plume passage.

d. Evacuation for the inner 0-5 mile region and sheltering* in the outer 5-10 mile region followed by fast relocation after plume passage.

• Sheltering assumptions details: After an initial delay of 45 minutes from the reactor operator's warning, people get indoors and remain indoors and are relocated to uncontaminated areas within a maximum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of remaining indoors. However, virtually all source terms analyzed in this study have two release phases-an early (first) release and a later (second) release. If there is a sufficient time gap (about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) between the two release phases, then people from indoors can be relocated to uncontaminated areas during this gap and avoid the exposure from the second release. With this perspective, two cases of relocation earlier than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are implemented in calculations as follows:

• Relocation within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after termination of the initial (the first) release, if the second release does not occur within this 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; otherwise,

• Relocation within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after termination of the second release (provided this relocation time is earlier than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of indoor occupancy; otherwise, relocation is at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of indoor occupancy).

The dose for the above extra 4-hour period is assumed to account for the dose during the period of waiting for the plume to leave the area after termination of the release and the dose during people's transit to.the relocation areas.

0 Z

z~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ n 0

C 3~~~~~~~~~~

o D CT~~~~~~~~~

11. Offsite Consequences Table 11.6 Sensitivity of mean CCDF of early fatalities to assumptions on offsite emergency response.

Exceedance 10-mile EPZ Early Fatalities (persons)

Frequency Emergency (ry-1) Response Mode* Surry Peach Bottom Sequoyah Grand Gulf Zion 10-5 a. Evacuation 0/0 0/0 0 0 0

b. Relocation 0/0 0/0 0 0 0

c. Shelter At ** *t *t 0

d. Evac/Shelter * *2 * *I 0 10-6 a. Evacuation 0/0 0/0 0 0 0

b. Relocation 0/0 0/2(1) 6(0) 0 6(0)'

c. Shelter 22 I* 2* *2 0

d. Evac/Shelter ** 2* 2* 2* 0 10-7 a. Evacuation 0/0 0/0 5(1) 0 2(2)

b. Relocation 2(1)/0 1(1)11(2) 7(1) 2(0) 1(3)

c. Shelter 2* ** ** 2* 7(2)

d. Evac/Shelter ** * ** 2* 2(2) 10-8 a. Evacuation 4(1)/0 0/0 4(2) 0 3(3)

b. Relocation 2(2)/0 7(1)13(2) 2(2) 2(1) 8(3)

c. Shelter * *2 *2 2* 6(3)

d. Evac/Shelter 2* * *2 2* 3(3) 10-9 a. Evacuation 1(2)/1(1) 0/0 2(3) 0 4(3)

b. Relocation 9(2)/5(1) 2(2)/5(2) 6(2) 8(1) 2(4)

c. Shelter *2 *2 *2 22 9(3)

d. Evac/Shelter *2 ** *

• 4(3)

Note: Under each plant name, the first entry is for the internal initiators and the second entry is for fire.

• See Table 11.3 for assumptions.

• No data 0

a. 6(0) = 6x10 = 6 thermal energy for the sequences with early con- The potential for latent cancer fatalities and tainment failure at vessel breach). Analyses of the population exposure is assumed to exist down to sensitivity of early fatality CCDFs to sheltering, or any low level of radiation dose and, therefore, a combination of evacuation and sheltering, have over the entire site region. Although both early not been performed for Surry (nor for Peach Bot- and chronic exposure pathways contribute to tom, Sequoyah, and Grand Gulf). these consequence measures, only the chronic exposure pathways are expected to be mitigated by the long-term countermeasures such as 11.6.2 Sensitivity of Latent Cancer Fatality decontamination, temporary interdiction, or con-and Population Exposure CCDFs to demnation of contaminated land, property, and Radiological Protective Action Guide foods based on guidance provided by responsible (PAG) Levels for Long-Term Federal agencies in terms of PAGs. This implies Countermeasures that, if the radiation dose to an individual from a NUREG- 1150 11-12

11. Offsite Consequences chronic exposure pathway would be projected to Table 11.7 shows that there is practically no dif-exceed the PAG (or intervention) level for that ference between the consequence magnitudes for pathway, countermeasures should be undertaken the five plants for the two PAGs for continuing to to reduce the projected dose from the pathway so live in the contaminated environment at the ex-that it does not exceed the PAG level. Therefore, ceedance frequency of 10-5 per reactor year. This the latent cancer fatalities and the population ex- is because the source terms with frequency 10-5 posures stemming from the chronic exposure per reactor year or higher have low release magni-pathways are expected to be sensitive to the PAG tudes such that the resulting environmental con-values. taminations are below both the EPA and RSS PAG-based trigger levels for protective actions The chronic exposure pathways base case PAGs (i.e., no protective actions are needed).

are shown in Table 11.3. The only alternative PAG used for this sensitivity analysis is the RSS PAG for the groundshine dose to an individual for At lower exceedance frequencies, source terms continuing to live in the contaminated environ- with larger release magnitudes contribute and the ment. The RSS PAG adopted here is 25-rem EDE two PAGs reduce the consequences to different from groundshine and inhalation of resuspended extents. The RSS PAG is less restrictive than the radionuclides (instead of the RSS 25-rem whole EPA PAG. Thus, the long-term consequence body dose from groundshine only) in 30 years. magnitudes with the RSS PAG are generally This alternative is used to replace the base case higher than those with the EPA PAG at equal ex-PAG of 4-rem EDE in 5 years. ceedance frequencies. However, the economic consequences, discussed in the supporting con-Summaries of the latent cancer fatality and popu- tractor reports (Refs. 11.5 through 11.9), would lation exposure mean CCDFs for both cases for show just the opposite behavior, i.e., economic the five plants for the internal initiating events are consequences would be higher for the EPA PAG shown in Table 11.7. than for the RSS PAG.

11-13 NUREG- 1150

z O

I Table 11.7 Sensitivity of mean CCDFs of latent cancer fatalities and population exposures to the PAGs CD) for living in contaminated areas-internal initiating events.

0 Exceedance Cancer Fatalities (persons) 50-Mile Pop. Exp. (person-rem) Entire Region Pop. Exp. (person-rem) Cl)

Frequency (ry-1) 1* 2* 3* 4* 5* 1* 2* 3* 4* 5* 1* 2* 3* 4* 5*

.0

(_

10-5 Cl)

EPA+ 0 0 6(1)a 0 0 7(2) 0 1(5) 0 5(3) 2(3) 0 4(5) 0 9(3)

RSS+ 0 0 6(1) 0 0 7(2) 0 1(5) 0 5(3) 2(3) 0 4(5) 0 9(3) 106 EPA 1(3) 1(3) 4(3) 3(2) 8(3) 1(6) 3(6) 3(6) 2(5) 2(7) 8(6) 7(6) 2(7) 2(6) 5(7)

RSS 2(3) 2(3) 5(3) 3(2) 1(4) 2(6) 4(6) 5(6) 2(5) 3(7) 1(7) 1(7) 3(7) 2(6) 8(7) 10-7 .

EPA 8(3) 8(3) 9(3) 1(3) 3(4) 8(6) 1(7) 8(6) 6(5) 8(7) 5(7) 5(7) 6(7) 9(6) 2(8)

RSS 9(3) 1(4) 1(4) 2(3) 4(4) 1(7) 2(7) 1(7) 1(6) 2(8) 6(7) 7(7) 6(7) 1(7) 2(8) 10 8 EPA 2(4) 2(4). 2(4) 3(3) 8(4) 2(7) 2(7) . 2(7) 1(6) 2(8) 1(8) 1(8) 9(7) 2(7) 3(8)

RSS 2(4) 4(4) 2(4) 4(3) 1(5) 2(7) 4(7) 2(7) 2(6) 3(8) 2(8) 2(8) 1(8) 2(7) 4(8) 10-9 EPA 4(4) 4(4) 2(4) 6(3) 1(5) 3(7) 4(7) 4(7) 2(6) 4(8) 2(8) 2(8) 1(8) 3(7) 4(8)

RSS 5(4) 4(4) 3(4) 6(3) - 4(7) 6(7) 4(7) 3(6) 4(8) 3(8) 5(8) 2(8) 4(7) 4(8)

• Plant Names: I = Surry; 2 = Peach Bottom; 3 = Sequoyah; 4 = Grand Gulf; 5 = Zion

+ Long-term relocation PAGs:

EPA = 4-rem EDE in 5 years from groundshine-an approximation of EPA-proposed long-term relocation PAG RSS = 25-rem EDE in 30 years from groundshine-RSS long-term relocation PAG

a. 6(1) = 6 X 101 = 60

11. Offsite Consequences REFERENCES FOR CHAPTER 11 11.1 U.S. Nuclear Regulatory Commis- 11.5 R. J. Breeding et al., "Evaluation of Severe sion,"Reactor Safety Study-An Assess- Accident Risks: Surry Unit 1," Sandia Na-ment of Accident Risks in U.S. Commer- tional Laboratories, NUREG/CR-4551, cial Nuclear Power Plants," WASH-1400 Vol. 3, Revision 1, SAND86-1309, Octo-(NUREG-75/014), October 1975. ber 1990.

11.2 D. I. Chanin, H. Jow, J. A. Rollstin et al., 11.6 A. C. Payne, Jr., et al., "Evaluation of Se-

"MELCOR Accident Consequence Code vere Accident Risks: Peach Bottom Unit System (MACCS)," Sandia National Labo- 2, " Sandia National Laboratories, ratories, NUREG/CR-4691, Vols. 1-3, NUREG/CR-4551, Vol. 4, Draft Revision SAND86-1562, February 1990. 1, SAND86-1309, to be published.*

11.3 U.S. Department of Health and Human 11.7 J. J. Gregory et al., "Evaluation of Severe Services/Food and Drug Administration, Accident Risks: Sequoyah Unit 1," Sandia "Accidental Radioactive Contamination of National Laboratories, NUREG/CR-4551, Human Food and Animal Feeds; Recom- Vol. 5, Revision 1, SAND86-1309, De-mendations for State and Local Agencies," cember 1990.

Federal Register, Vol. 47, No. 205, pp.

47073-47083, October 22, 1982. 11.8 T. D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," San-11.4 U.S. Environmental Protection Agency, dia National Laboratories, NUREG/

"Manual of Protective Action Guides and CR-4551, Vol. 6, Draft Revision 1, Protective Actions for Nuclear Incidents," SAND86-1309, to be published.*

Draft, 1989.

11.9 C. K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551,

'Available in the NRC Public Document Room, 2120 L Vol. 7, Draft Revision 1, BNL-Street NW., Washington, DC. NUREG-52029, to be published.*

1 1-15 NUREG- 1150

12. PERSPECTIVES ON PUBLIC RISK 12.1 Introduction fatality risk results of all five plants from internally initiated accidents are plotted together in Figure One of the objectives of this study has been to 12.1. Individual early fatality and latent cancer fa-gain and summarize perspectives regarding risk to tality risks from internally initiated accidents are public health from severe accidents at the five compared with the NRC safety goals* (Ref. 12.8) studied commercial nuclear power plants. In this in Figure 12.2. Similar risk results from externally chapter, risk measures for these plants are com- initiated (fire) accidents for the Surry and Peach pared and perspectives drawn from these com- Bottom plants are presented in Figures 12.3 and parisons. 12.4. Estimates of the frequencies of a "large re-lease" of radioactive material (using a definition of large as a release that results in one or more As discussed in Chapter 2, the quantitative assess- early fatalities) are presented in Figure 12.5.

ment of risk involves combining severe accident sequence frequency data with corresponding con- Based on the results of the risk analyses for the tainment failure probabilities and offsite conse- five plants, a number of general conclusions can quence effects. An important aspect of the risk be drawn:

estimates in this study is the explicit treatment of uncertainties. The risk information discussed here

• The risks to the public from operation of the includes estimates of the mean and the median of five plants are, in general, lower than the the distributions of the risk measures and the 5th Reactor Safety Study (Ref. 12.10) estimates percentile and the 95th percentile vaiues. The risk for two plants in 1975. Among the five plants results obtained have been analyzed with respect studied, the two BWRs show lower risks than to major contributing accident sequences, plant- the three PWRs, principally because of the specific design and operational features, and acci- much lower .core damage frequencies esti-dent phenomena that play important roles. mated for these two plants, as well as the mitigative capabilities of the BWR suppres-The assessments of plant risk that support the dis- sion pools during the early portions of severe cussions of this chapter are discussed in detail in accidents.

References 12.1 through 12.7 and summarized in Chapters 3 through 7 for the five individual plants.

• Individual early fatality and latent cancer fa-Appendix C to this report provides more detailed tality risks from internally initiated events for information on certain technical issues important all of these five plants, and from fire-initiated to the risk studies. This work was performed by accidents for Surry and Peach Bottom, are Sandia National Laboratories (on the Surry, Se- well below the NRC safety goals.

quoyah, Peach Bottom, and Grand Gulf plants) and Idaho National Engineering Laboratory and

• Fire-initiated accident sequences have rela-Brookhaven National Laboratory (on the Zion tively minor effects on the Surry plant risk plant). compared to the risks from internal events but have a significant impact on Peach Bot-tom risk.

12.2 Summary of Results

• The Surry and Zion plants benefit from their Estimates of risk presented in Chapters 3 through strong and large containments and therefore 7 for the five plants studied are compared in this have lower conditional early containment section. Risk measures that are used for these failure probabilities. The Peach Bottom and comparisons are: early fatality, latent cancer fa- Grand Gulf have higher conditional prob-tality, average individual early fatality, and aver- abilities of early failure, offsetting to some age individual latent cancer fatality risks for inter- degree the risk benefits of estimated lower nally initiated and externally initiated (fire) events core damage frequencies for these plants.

(additional risk measures are provided in Refs.

12.3 through 12.7). For reasons discussed in Chapter 1, seismic risk is not discussed here.

'Throughout this report, discussion of and comparison with the NRC safety goals relates specifically and only to In order to display the variabilities in the noted the two quantitative health objectives identified in the risk measures, the early fatality and latent cancer Commission's policy statement (Ref. 12.8).

12-1 NUREG-1 150

12. Public Risk Early fatality/ry 1.OE-03 1.OE-04 1.OE-05 1.OE-06 1.OE-07 41 Li 1.OE-08 1.OE-09 I

1.OE-10 RSS PWR SURRY PEACH SEQUOYAH GRAND ZION RSS BWR BOTTOM GULF Latent cancer fatality/ry 1.OE+OO 1.OE-01 1.OE-02 1.OE-03 1 .OE-04 RSS PWR URRY PEACH SEQUOYAH GRAND ZION RSS BWR BOTTOM GULF Notes: As discussed in Reference 12.9, estimated risks at or below 1E-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.

"+" indicates recalculated mean value based on recent modifications to the Zion plant (as discussed in Section C.15).

Figure 12.1 Comparison of early and latent cancer fatality risks at all plants (internal events).

NUREG-1150 12-2

12. Public Risk Individual early fatality/ry 1.OE-0f F Legend

<z=- Safety Goal 06%

nmoan 1.OE-07 median 1.OE-Of

+

1.OE-0 1.0E-1C Li I

1.0E-1 1 SURRY PEACH SEQUOYAH GRAND ZION BOTTOM GULF Individual latent cancer fatality/ry 1.OE-05

_: Legend

- - Safety Goal 1 1.OE-06 -Mean 1

-j%

1.OE-07 1.OE-08 1 .OE-09 1.OE-10 SURRY P EACH SEQUOYAH GRAND ZION BOTTOM GULF Notes: As discussed in Reference 12.9, estimated risks at or below IE-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.

"+" indicates recalculated mean value based on recent modifications to the Zion plant (as discussed in Section C. 15).

Figure 12.2 Comparison of risk results at all plants with safety goals (internal events) .

12-3 NUREG-1 150

12. Public Risk Early fatality/ry 1.OE-03 Legend 1 .OE-04 1.OE-05 1.OE-06 1.OE-07 1.OE-08 1 .OE-09 1.0E-10 SURRY SURRY PEACH BOTTOM FIRE FIRE ILatent cancer fatality/ry 1.0E+00 :

Legend I 95%

-- mean 1.OE-01 : medan- l 1.0E - 02:

LII-~~~~5 1.OE-03i 1.OE-04 SURRY PEACH BOTTOM FIRE FIRE Note: As discussed in Reference 12.9, estimated risks at or below 1E-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 12.3 Comparison of early and latent cancer fatality risks at Surry and Peach Bottom (fire-initiated accidents).

NUREG- 1150 12-4

12. Public Risk IIndividual early fatality/ry 1.OE-06

<~=-Safety Goal Legend 1.OE-07 -~~~~~ l--mnean l medianl 1.OE-08 1.OE-09 _ 0---

1.OE-10 1.OE- 1 I~ ~ I SURRY PEACH BOTTOM FIRE FIRE Individual latent cancer fatality/ry 1.OE-05 Legend

-<s=-Safety Goal I n I 1 .OE-06 --mean I m d net n 1.OE-07 1.OE -08 1 .CE-09

- 0 1.OE-10I SURRY PEACH BOTTOM FIRE FIRE Note: As discussed in Reference 12.9, estimated risks at or below 1-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 12.4 Comparison of risk results at Surry and Peach Bottom with safety goals (fire-initiated accidents).

12-5 NUREG-1150

12. Public Risk Probability I1 of a large release 1.OE-05

• Laos* 141666 - Rele* that sn reult In nd for ore sfly at1i1ties.

+Legend 1.OE-06 medis I 1.OE -07 1.OE-08 1.OE-09 1.OE-10 SURRY PEACH SEQUOYAH GRAND ZION BOTTOM GULF Probability of a large release 1.OE-05 1.OE-06 1.OE-07 1.OE-08 I.OE-09 1.OE-10 SURRY - FIRE PEACH BOTTOM - FIRE Notes: As discussed in Reference 12.9, estimated risks at or below 1E-7 should be viewed with cau-tion because of the potential impact of events not studied in the risk analyses.

"+" indicates recalculated mean value based on recent modifications to the Zion plant (as dis-cussed in Section C. 15).

Figure 12.5 Frequency of one or more early fatalities at all plants.

NUREG-1 150 12-6

12. Public Risk

• The principal challenges to containment to vessel breach. Dominant containment failure structures vary considerably among the five modes were from steam overpressurization. In the plants studied. Hydrogen combustion is a sig- present study, risk is dominated by long-term sta-nificant threat to the Sequoyah and Grand tion blackout and ATWS accident sequences. The Gulf plants (in part because of the inop- dominant containment failure mode is drywell erability of ignition systems in some key acci- meltthrough.

dent sequences), while direct attack of the containment structure by molten core mate-rial is most important in the Peach Bottom The RSS did not perform an analysis of accidents plant. Few physical processes were identified initiated by fires. As such, comparisons of the pre-that could seriously challenge the Surry and sent study's fire risk estimates with the RSS are Zion containments. not possible.

• Emergency response parameters (warning Since the publication of the RSS in 1975, a vast time, evacuation speed, etc.) appear to have amount of work has been done in all areas of risk a significant impact on early fatality risk but analysis, funded by government agencies and the almost no effect on latent cancer fatality risk. nuclear industry. Major improvements have been made in the understanding of severe accident 12.3 Comparison with Reactor Safety phenomenology and approaches to quantification of risk, many of which have been used in this Study study. These efforts have helped in lowering the Results of the present study (for internal initia- estimates of overall risk levels in the present study to some extent by reducing the use of conservative tors) are compared with the Surry and Peach Bot-tom results in the Reactor Safety Study (RSS) in and bounding types of analyses. Equally impor-Figure 12.1. In general, for the early fatality risk tant, some plants have made modifications to plant systems or procedures based on PRAs, les-measure, the Surry risk estimates in this study are sons learned from the Three Mile Island accident, lower than the corresponding RSS PWR values.

Similarly, the present Peach Bottom risk estimates etc., thus reducing risk. On the other hand, new issues have been raised and the possibility of new are lower than the RSS BWR estimates. For the phenomena such as direct containment heating latent cancer fatality risk measure, the patterns in and drywell meltthrough has been introduced, the results are less clear; the RSS risk estimates which added to the previous estimates of risk. For for both of the plants lie in the upper portion of issues that are not well understood, expert judg-the risk estimates of this study. merits were elicited that frequently showed diverse conclusions. The net effect of this improved un-Focusing on the major contributors to risk, it may derstanding is that total plant risk estimates are be seen that, in the RSS, the Surry risk was domi- lower than the RSS estimates, but the distributions nated by interfacing-system LOCA (the V se- of these risk measures are very broad.

quence), station blackout (TMLB'), and small LOCA sequences, with hydrogen burning and overpressure failures of containment. While the 12.4 Perspectives estimated risks of the interfacing-system LOCA accident sequence are lower in the present study As discussed above, plant-specific features con-because of a lower estimated frequency, it is still tribute largely to the estimates of risks. In order to an important contributor to risk. Also important compare the variables and characteristics of the (because of their large source terms) are contain- three PWR plants (Surry, Sequoyah, and Zion) ment bypass accidents initiated by steam genera- and two BWR plants (Peach Bottom and Grand tor tube rupture, compounded by operator errors Gulf) in this study, the dominant contributors to (which result in core damage) and subsequent early and latent cancer fatality risks for the PWRs stuck-open safety-relief valves on the secondary and BWRs from internally initiated events are side. Early overpressurization containment failure shown in Figures 12.6 through 12.10. Dominant at Surry is much less probable. contributors to risk from fire-initiated accidents for Surry and Peach Bottom are compared in Fig-In the Peach Bottom analysis of the RSS, risk was ure 12.9. Perspectives on risks for the five plants dominated by transient-initiated- events with loss from these comparisons, supplemented by infor-of heat removal (TW type of sequence) and mation in the supporting contractor reports (Refs.

ATWS accidents with failure of containment prior 12.1 through 12.7) are discussed below.

12-7 NUREG- 1150

12. Public Risk SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY MEAN

• 2E-G/RY MEAN * .2E-31RY 6

Plant Damage States

1. So

2. ATWS S. TBANtENIS

4. LOCA

e. BYPASS SEQUOYAH EARLY FATALITY SEQUOYAH LATENT CANCER FATALITY MEAN 2.SE-SIRY MEAN

• 1.4E-2/RY 42 1 2

4 5

Plant Damage States 5

1. 890

2. AWS

3. TRANSIENTS

4. LOCA

0. BYPASS ZION EARLY FATALITY ZION LATENT CANCER FATALITY MEAN

• 1.IE-4/RY MEAN

• 2.4E-2/RY 1

4\ 6 6

Plant Damage States IL 80

2. ATWS

3. TRANSIENTS

4. LOCA

6. BYPASS Figure 12.6 Contributions of plant damage states to mean early and latent cancer fatality risks for Surry, Sequoyah, and Zion (internal events).

NUREG-1 150 12-8

12. Public Risk PEACH BOTTOM PEACH BOTTOM EARLY FATALITY LATENT CANCER FATALITY MEAN 2.OE-/RY MEAN 4.6E-3/RY I1 1

31 4 3 Plant Damage States 3

1. LOCA

2. 680 S. ATWS

4. TRANSIENT$

GRAND GULF GRAND GULF EARLY FATALITY LATENT CANCER FATALITY MEAN

• 8.2E-R/RY MEAN

• 9.6E-4/RY 1 1 2 3 2 3 w

Plant Damage States

1. LONG TERM OBO

2. SHORT TERM 8BO

3. ATWS

4. TRANSIENTS Figure 12.7 Contributions of plant damage states to mean early and latent cancer fatality risks for Peach Bottom and Grand Gulf (internal events).

12-9 NUREG-1 150

12. Public Risk SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY MEAN 2E-f/AY MEAN 4.21-3RY Accident Progression Bins

1. Ve, Early CF. Alpha Mod.

2. VD, Early CF. nCS Prsasr. '200 pals at VD

3. VD. Early CF. RCS Praauw 200 po at VS

4. VB. BMT and Late Look

6. Bypass S. VB. No CF

7. No VB SEQUOYAH EARLY FATALITY SEQUOYAH LATENT CANCER FATALITY UEAN 2BE-E/RY MEAN tAN-2/RY 0 ' X Accident Progression Bins 7

1. Va. CF Before Va

2. VS, ECF. Alpha Mod*

. YE.BEF. RO Preaauro'200 ps at VS

4. VS. ECF. RG Pre.aura'200 pats at V S. VD, Late CF B. VS. BMT. Very Late Leak T. Bypss S Va. No CF

9. No VB ZION EARLY FATALITY ZION LATENT CANCER FATALITY MEAN

• 1.11-4/1Y MEAN 2.4E-2/NtV 1

2 Accident Progression Bns

. YPASS

2. EARLY CNT. FAILURE Figure 12.8 Contributions of accident progression bins to mean early and latent cancer fatality risks for Surry, Sequoyah, and Zion (internal events).

NUREG-1 150 12-10

12. Public Risk PEACH BOTTOM PEACH BOTTOM EARLY FATALITY LATENT CANCER FATALITY MEAN 2E-8/RY MEAN 4.8E-3/RY 4

4 4 Accident Progression Bins

1. VB, ECF, WW Failure. V Pressv200 pals at VB

2. VB, ECF, WW Failure, V Pross4200 pls at VS

3. VB, ECF. DW Failure, V Prewa200 pals at VS

4. VS, ECF, DW Failure V Pross4200 pals at VS

6. VB, Late CF, WW Failure I. VL, Late CF, DW Failure

7. VS, Vent

8. VB, No CF

9. No VD GRAND GULF GRAND GULF EARLY FATALITY LATENT CANCER FATALITY MEAN

• 82E-9/RY MEAN

• 9.6E-4/RY 4

8~~~~~~ 8~~~~~~~~ 8 2 3 5 Accident Progression Bins

1. B, ECF, EARLY SP BYPASS, CONT. SPRAYS NOT AVAIL.

2. VB, ECi, EARLY SP BYPASS, CONT. SPRAYS AVAIL S. VB ECF, LATE SP BYPASS

4. VB ECF, NO SP BYPASS

8. YB, LATE CF 8.- VB, VENT

7. VB, NO CF

8. NO vY Figure 12.9 Contributions of accident progression bins to mean early and latent cancer fatality risks for Peach Bottom and Grand Gulf (internal events).

12-1 1 NUREG-1150

12. Public Risk SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY (FIRE) (FIRE)

MEAN

• 3.8E-8/RY MEAN 2.7E-4/RY 1

3 4

2 Accident Progression Bins

1. VB, Early CF, Alpha Mode

2. VB, Early CF. RCS Pressure 200 pala at VB

3. YB. Early CF, RCS Pressure 200 pia at VB

4. YB. BMT and Late Leak

6. Bypass B. VB, No CF

7. No YB PEACH BOTTOM PEACH BOTTOM EARLY FATALITY LATENT CANCER FATALITY (FIRE) (FIRE)

MEAN

• 3.6E-7/RY MEAN - 3.4E-2/RY 3 3 1

6 4

Accident Progression Bins

1. YB, ECF, WW Failure, V Press>200 puia at VB

2. VB, ECF, WW Failure, V Prewa'200 paia at VB

3. YB, ECF, DW Failure, V Presa)200 psia at VB

4. YB, ECF, DW Failure. V Pressc200 psia at VB

6. YB, Late CF, WW Failure

6. V8, Late CF, DW Failure

7. VB. Vent

8. VB, No CF

0. No VB Figure 12.10 Contributions of accident progression bins to mean early and latent cancer fatality risks for Surry and Peach Bottom (fire-initiated accidents).

NUREG-1 150 12-12

12. Public Risk Accident Sequences Important to Risk Containment Failure Issues Important to Risk

• At Surry, containment bypass events

• Mean early fatality risks at Surry and Se- (interfacing-system LOCAs and steam gen-quoyah and latent cancer fatality risk at erator tube ruptures) are assessed to be most Surry are dominated by bypass accidents important to risk. Other containment failure (Event V and steam generator tube rupture modes of less importance are: static failure accidents). Sequoyah latent cancer risk is at the containment spring line from loads at dominated equally by loss of offsite power se- vessel breach (i.e., direct containment heat-quences and bypass accidents. The risk at ing loads, hydrogen burns, ex-vessel steam Zion is dominated by medium LOCA se- explosion loads, and steam blowdown loads);

quences resulting from the failure of reactor or containment failure from in-vessel steam coolant pump seals, induced by failures of explosions (the "alpha-mode" failure of the the component cooling water system (CCWS) Reactor Safety Study). These failure modes or service water system. Zion has the feature have only a small probability of resulting in that CCWS (supported by the service water early containment failure.

system) cools both the reactor coolant pump seals and high-pressure injection pump oil

• At Zion, the conditional probability of early coolers, thus creating the potential for a containment failure is small, comparable to common-mode failure. (As discussed in that of Surry. Those containment failure Chapter 7, steps have been taken by the modes that contribute to this small failure plant licensee to address this dependency.) probability include alpha-mode failure, con-tainment isolation failure, and overpress-urization failure at vessel breach.

• BWR risks are driven by events that fail a multitude of systems (i.e., reduce the redun-

• In previous studies, the potential impact of dancy through some common-mode or sup- direct containment heating loads was found port system failure) or events that require a to be very important to risk. In this study, the small number of systems to fail in order to get potential impact is less significant for the to core damage, such as ATWS sequences. Surry and Zion plants. Reasons for this re-The accidents important to both early fatality duced importance include:

and latent cancer fatality risk at Peach Bot-tom are station blackouts and ATWS; the ac- - Temperature-induced and other depres-cident most important at Grand Gulf is sta- surization mechanisms that reduce the tion blackout. probability of reactor vessel breach at high reactor coolant system pressure,

• For the Peach Bottom plant, the estimated either eliminating direct containment risks from accidents initiated by fires, while heating (DCH) or reducing the pressure low, are greater than those from accidents in- rise at vessel breach. These depressuri-itiated by internal events. Fire-initiated acci- zation mechanisms are stuck-open dents are similar to station blackout accidents power-operated relief valves, reactor in terms of systems failed and accident pro- coolant pump seal failures, accident-in-gression. As such, the conditional probability duced hot leg and. surge line failures, of early containment failure is relatively high, and deliberate opening of PORVs by op-principally due to the drywell shell melt- erators; and through failure mode (see Chapter 9 for ad-ditional discussion) (the conditional probabil- - The size and the strength of the Surry ity is somewhat higher because of the lower containment (the maximum DCH load probability of ac power recovery). For the has only a conditional probability of 0.3 Surry plant, the fire risks are estimated to be of failing the containment).

smaller than those from internal events. This is because of two reasons: the frequency of Additional discussion of the issue of direct core damage from fire initiators is lower; and containment heating may be found in Section fire-initiated accidents result in low condi- 9.4.3 and Section C.5 of Appendix C.

tional probabilities of early containment fail-ure. As noted above, the internal-event risks

• At Sequoyah, containment bypass events are are dominated by containment bypass acci- assessed to be most important to mean early dents. fatality risk. Another failure important to 12-13 NUREG-1 150

12. Public Risk early fatality risk is early failure of contain- active material; if large amounts of water can ment. In particular, the catastrophic rupture enter the cavity (e.g., as at Sequoyah), re-failure mode dominates early containment leases during core-concrete interactions can failures, which occur as a result of pre-vessel- be significantly mitigated.

breach hydrogen events and failures at vessel breach. The failures at vessel breach are the

• Site parameters such as population density result of a variety of load sources (individu- and evacuation speeds can have a significant ally or in some combinations), including di- effect on some risk measures (e.g., early fa-rect containment heating loads, hydrogen tality risk). Other risk measures, such as la-burns, direct contact of molten debris with tent cancer fatality risk and individual early the steel containment, alpha-mode failures, fatality risk, are less sensitive to such parame-or loads from ex-vessel steam explosions. ters. Latent cancer fatality risks are sensitive The bypass mode of containment failure and to the assumed level of interdiction of land early containment failures dominate the and crops. (These issues are discussed in mean latent cancer risk at Sequoyah and more detail below.)

contribute about equally to this consequence measure. Factors Important to Uncertainty in Risk In order to identify the principal sources of uncer-

• At Peach Bottom, drywell meltthrough is the tainties in the estimated risk, regression analyses most important mode of containment fail- have been performed for each of the plants in this ure. Other containment failure modes of im- study. A stepwise linear model is used, and, in portance are: drywell overpressure failure, general, the dependent variable is a risk measure static failure of the wetwell (above as well as (e.g., early fatalities per year) although some below the level of the suppression pool), and study has been done on the Surry plant using fre-static failure at the drywell head. quencies of radionuclide releases (discussed in Section 10.4.3). The independent variables con-

• At Grand Gulf, the risk is most affected by sisted of individual parameters and groups of cor-containment failures in which both the dry- related parameters. Also, the analyses are gener-well and the containment fail. As discussed ally performed for the complete risk model, in Chapter 9, roughly one-half the contain- although in some cases analyses are performed on ment failures analyzed in this study also re- specific plant damage states. The extent to which sulted in drywell failure. The principal causes this model accounted for the overall uncertainty of the combined failures were hydrogen com- (the R-square value) varied considerably, from bustion in the containment atmosphere and roughly 30 percent in the analysis of latent cancer loads at reactor vessel breach (direct contain- fatality risk in the Sequoyah plant to roughly 75 ment heating, ex-vessel steam explosions, or percent in the analysis of early fatality risk in the steam blowdown from the reactor vessel). Surry plant.

Source Term and Offsite Consequence Issues The results of the regression analyses indicate the Important to Risk following:

• BWR suppression pools provide a significant

• For Surry, the uncertainty in all risk meas-benefit in severe accidents in that they effec- ures is dominated by the uncertainties in pa-tively trap radioactive material (such as io- rameters determining the frequencies of con-dine and cesium) released early in the acci- tainment bypass accidents (interfacing-system dent (before vessel breach) and, for some LOCA and steam generator tube rupture containment failure locations, after vessel (SGTR)) and the radioactive release magni-breach as well. tudes of these accidents. More specifically, the most important parameters are the initiat-

• Accidents that bypass the containment struc- ing event frequencies for these bypass acci-ture compromise the many mitigative fea- dents, the fraction of the core radionuclide tures of these structures and thus can have inventory released into the vessel, and the significant estimated radioactive releases. As fraction of material in the vessel in an SGTR-noted above, such accidents dominated the initiated core damage accident that is re-risk for the Surry and Sequoyah plants. leased to the environment. With the high risk importance of bypass accidents, it is not sur-

• The design of the reactor cavity can signifi- prising that uncertainties in bypass accident cantly influence long-term releases of radio- parameters are important to risk uncertainty, NUREG-t 150 12-14

12. Public Risk while other parameters such as those relating important parameter uncertainties were those to source terms in containment, containment for the initiating event frequency, the prob-strength, etc., are not found to be important. ability that releases will be scrubbed by fire sprays in the vicinity of the break, and the

• For Zion, the regression analyses also indi- decontamination factor of the fire sprays.

cated that accident frequency and source For the SGTR-initiated core damage acci-term parameter uncertainties were most im- dent, the most important parameters are the portant. More specifically, the most impor- initiating event frequency, the fraction of the tant parameters were the initiating event fre- core radionuclide inventory released into the quencies for loss of component cooling water vessel, and the fraction of material in the ves-(CCW)/service water (SW), the failure to re- sel that is released to the environment.

cover CCW/SW, the fraction of the core radionuclide inventory released into the ves- For the station blackout, LOCA, and tran-sel, the radionuclide containment transport sient plant damage states, the uncertainty in fraction at vessel breach, and the fraction of early fatality risk is accounted for by parame-radionuclides released to the environment ters from the accident frequency, accident through the steam generators. The impor- progression, and source term analysis, with tance of the loss of CCW/SW frequencies is none of these groups or any small set of pa-not surprising, given the large contribution of rameters dominating. In this circumstance, accidents initiated by these events to the core the parameters relating to the containment damage frequency. Also, those source term failure pressure, the fraction of the core par-parameters that influence the release frac- ticipating in a high-pressure melt ejection, tions for early containment failure and bypass and the pressure rise at vessel breach for low-events are not surprisingly important to some pressure accident sequences appeared as risk measures. The only accident progression somewhat important for each of these plant parameter that was demonstrated to be im- damage states (but, again, did not by them-portant to the uncertainty in risk was the selves or in combination dominate the uncer-probability of vessel and containment breach tainty estimation).

by an in-vessel steam explosion. This result

• For Peach Bottom, the regression analysis for occurs because the probability of early con- the complete internal-event model indicated tainment failure from all other causes is ex- that the risk uncertainty is dominated by un-tremely low at Zion, so that (at these very certainties in radioactive release uncertain-low probability levels) uncertainty in the in- ties-more specifically, the dominating pa-vessel steam explosion failure mode becomes rameters relating to the fraction of the core more significant. The importance of the radionuclide inventory released into the ves-steam explosion failure mode is also more sel before vessel breach, the fraction of the significant because the accident progression radionuclide inventory released during core-analysis for Zion indicates that the reactor concrete interaction that is released from coolant system (RCS) is not likely to be at containment, and the fraction of the radio-high pressure when vessel breach occurs. nuclide inventory remaining in the core ma-This means that loads at vessel breach from terial at the initiation of core-concrete inter-direct containment heating are likely to be action that is released during that interaction.

smaller than would have been the case if RCS pressure were high. Also, at low RCS pres- The regression analysis on the fire risk model sure, the probability of triggering an in-vessel does not show such a clear domination by steam explosion is increased. any parameters. The early fatality risk uncer-tainty is dominated by radioactive release

• For Sequoyah, the regression analysis for the parameters (the fraction of core radionuclide complete risk model did not account for a inventory released to the vessel before vessel large fraction of the uncertainty. As such, re- breach, the fraction of radionuclide inven-gression analyses were performed for individ- tory remaining in the core material at the ual plant damage states (PDSs). For the con- initiation of core-concrete interaction that is tainment bypass PDSs (which dominated the released during that interaction, and the frac-mean risk at Sequoyah), the most important tion of the radionuclide inventory released uncertainties related to accident frequency during core-concrete interaction that is and source term issues. More specifically, for released from containment). The latent can-the interfacing-system LOCA PDS, the most cer fatality risk uncertainty is dominated by 12-15 NUREG-1 150

12. Public Risk accident frequency parameters (fire initiating The last two options are used in the Zion plant event frequencies, diesel generator failure-to- analysis only. Results of the analyses are pre-run probability). sented in Figure 12.11.

• For Grand Gulf, the uncertainty in early As discussed in Section 11.3, radionuclide release health effect parameters (early fatalities and magnitudes associated with the early phase of an individual early fatalities within 1 mile) is not accident for Peach Bottom and Grand Gulf are dominated by any small set of parameters. typically smaller than those for the other three Rather, it is accounted for by a number of plants because of the mitigative effects of suppres-parameters that determine the frequencies sion pool scrubbing. The source term groups for and radioactive release magnitudes of those Peach Bottom and Grand Gulf were typically events leading to early containment failure, found to have longer warning times than for the such as the amount of hydrogen generated PWRs studied because the accident sequences de-during the in-vessel portion of the accident veloped more slowly. Further, Peach Bottom and progression, and the frequency of loss of off- Grand Gulf have very low surrounding population site power. The uncertainties in the other risk densities, which leads to shorter evacuation delays measures are dominated by uncertainties in and higher evacuation speeds. The effect of all accident frequency parameters (including these considerations is that, for Peach Bottom and loss of offsite power frequency, diesel genera- Grand Gulf, evacuation is more effective in reduc-tor failure-to-start probability, diesel genera- ing early fatality risk than for Surry, Sequoyah, tor failure-to-run probability, and the prob- and Zion.

ability that the batteries fail to deliver power when needed). For Surry and Sequoyah, the risk-dominant acci-dent is the interfacing-system LOCA (the V se-Impact of Emergency Response and quence). This accident has a very short warning Protective Action Guide Options time, and, consequently, evacuation actions are Sensitivity calculations were performed as a part not very effective. Also for Sequoyah, some high-of this study to assess the impacts of different consequence releases occur from containment emergency response and protective action guide failure at vessel breach; these releases are highly options on estimates of risks for the five plants. energetic and cause plume rise. This reduces early fatality risk, as is indicated in the case of Option 2 Emergency Response Options for Sequoyah; however, this also reduces the ef-fectiveness of evacuation. Further details on In order to study the effects of emergency re- emergency response options are provided in sponse options under severe accident conditions Chapter 11.

on public risk, the plants were analyzed using the following assumptions, and changes in the early Protective Action Options fatality risk were calculated:

• Base Case: 99.5 percent evacuation from 0 In this study an interdiction criterion of 4 rems to 10 miles (effective dose equivalent (EDE)) in 5 years has been used for groundshine and inhalation of re-

• Option 1: 100 percent evacuation from 0 suspended radionuclides. Sensitivity calculations to 10 miles have been performed using the equivalent of the Reactor Safety Study (RSS) criterion, i.e., 25-rem

• Option 2: 0 percent evacuation with early EDE in 30 years. The impact of such an alterna-relocation from high contamination areas tive criterion on mean latent cancer fatality risk is shown in Figure 12.12. As may be seen, the RSS

• Option 3: 100 percent sheltering criterion is less restrictive than the criterion used in this study, and the corresponding latent cancer

• Option 4: 100 percent evacuation from 0 fatalities using the RSS criterion are higher by 12 to 5 miles and 100 percent sheltering from 5 percent (for Grand Gulf) to 47 percent (for Peach to 10 miles Bottom).

NUREG- 1150 12-16

12. Public Risk Early fatality/ry 1.OE-03 SURRY PEACH SEOUOYAH GRAND ZION 3 BOTTOM B12 GULF B4 1.OE-04 2 2

1.OE-05 :B1 2

1.OE-06 2 B

I 1,0E-07 B LEGEND 1.OE-08 )EAN MEDIAN CON TD.

1.OE-09 BELOW Aj~~~I T 1.OE-10 BASE CASE (B) 99.6% Evacuation from 0 to 10 miles EMERGENCY RESPONSE OPTIONS (1 TO 4)

1. 100% Evacuation from 0 to 10 miles

2. 0% Evacuation with early relocation from high contamination areas

3. 100% Sheltering

4. 100% Evacuation from 0 to 5 miles, and 100% sheltering from 5 to 10 miles Note: As discussed in Reference 12.9, estimated risks at or below E-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 12.11 Effects of emergency response assumptions on early fatality risks at all plants (internal events).

12-17 NUREG-1 150

12. Public Risk MEAN LATENT CANCER FATALITY RISK/YR 0.05 0.04 F 0.03 F 0.02 F 0.01 0 ,. .:t.:Z-wNSSSSSSS\^XS SURRY SEQUOYAH PEACH GRAND ZION BOTTOM GULF BASE CASE X RSS PAG Figure 12.12 Effects of protective action assumptions on mean latent cancer fatal-ity risks at all plants (internal events).

NUREG-1 150 12-18

12. Public Risk REFERENCES FOR CHAPTER 12 12.1 E. D. Gorham-Bergeron et al., "Evalu- dia National Laboratories, NUREG/

ation of Severe Accident Risks: Method- CR-4551, Vol. 5, Revision 1, SAND86-ology for the Accident Progression, 1309, December 1990.

Source Term, Consequence, Risk Integra-tion, and Uncertainty Analyses," Sandia 12.6 T. D. Brown et al., "Evaluation of Severe National Laboratories, NUREG/CR- Accident Risks: Grand Gulf Unit 1,"

4551, Vol. 1, Draft Revision 1, SAND86- Sandia National Laboratories, NUREG/

1309, to be published.* CR-4551, Vol. 6, Draft Revision 1, SAND86-1309, to be published.

• 12.2 F. T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major 12.7 C. K. Park et al., "Evaluation of Severe Input Parameters," Sandia National Lab-Accident Risks: Zion Unit 1," Brook-oratories, NUREG/CR-4551, Vol. 2, haven National Laboratory, NUREG/

Revision 1, SAND86-1309, December CR-4551, Vol. 7, Draft Revision 1, BNL-1990.

NUREG-52029, to be published.*

12.3 R. J. Breeding et al., "Evaluation of Se-vere Accident Risks: Surry Unit 1," San- 12.8 USNRC, "Safety Goals for the Operation dia National Laboratories, NUREG/ of Nuclear Power Plants; Policy State-CR-4551, Vol. 3, Revision 1, SAND86- ment," Federal Register, Vol. 51, p.

1309, October 1990. 30028, August 21, 1986.

12.4 A. C. Payne, Jr., et al., "Evaluation of 12.9 H. J. C. Kouts et al., "Special Committee Severe Accident Risks: Peach Bottom Review of the Nuclear Regulatory Com-Unit 2," Sandia National Laboratories, mission's Severe Accident Risks Report NUREG/CR-4551, Vol. 4, Draft Revision (NUREG-1150)," NUREG-1420, August 1, SAND86-1309, to be published.* 1990.

12.5 J. J. Gregory et al., "Evaluation of Severe 12.10 USNRC, "Reactor Safety Study-An As-Accident Risks: Sequoyah Unit 1," San- sessment of Accident Risks in U.S. Com-

• Available in the NRC Public Document Room, 2120 L mercial Nuclear Power Plants," WASH-Street NW., Washington, DC. 1400 (NUREG-75/014), October 1975.

12-19 NUREG- 1150

13. NUREG-1150 AS A RESOURCE DOCUMENT 13.1 Introduction - Characterization of the importance of plant operational features and areas po-NUREG-1150 is one element of the NRC's pro- tentially requiring improvement; gram to address severe accident issues. The entire program was discussed in a staff document - Analysis of alternative safety goal imple-entitled "Integration Plan for Closure of Severe mentation strategies; and Accident Issues" (SECY-88-147) (Ref. 13.1).

NUREG-1 150 is used to provide a snapshot of the - Emergency preparedness and conse-state of the art of probabilistic risk analysis (PRA) quences.

technology, incorporating improvements since the

• Data on the major contributing factors to risk issuance of the Reactor Safety Study (Ref. 13.2).

This chapter discusses the and the uncertainty in risk for use in:

results of NUREG-1150 (and its supporting contractor - Prioritization of research; studies, efs. 13.3 through 13.16) as a resource document and examines the extent to which infor- - Prioritization of generic issues; and mation provided in the document can be applied in regulatory activities. This is accomplished by - Use of PRA in inspection.

applying NUREG-1150 results and principles to selected regulatory issues to illustrate how the in- In the following sections, these uses will be dis-formation and insights described in Chapters 3 cussed in greater detail, using examples based on through 12 of this document can be used in the the risk analysis results discussed in previous regulatory process. The discussion will concen- chapters.

trate on technical issues although it is recognized that there are other issues (e.g., legal, procedural) that must be taken into account when making 13.2 Probabilistic Models of Accident regulatory decisions. Sequences NUREG-1150 identifies the dominant accident This report includes an examination of the severe sequences and plant features contributing signifi-accident frequencies and risks and their associ- cantly to risk at a given plant as well as the plant ated uncertainties for five licensed nuclear power models used in the study. The plant models and plants and uses the latest source term information results underlying the report can be used to sup-available from both the NRC and its contractors port the development of staff guidance on and the nuclear industry. The information in the licensee-performed studies (individual plant ex-report provides a valuable resource and insights to aminations, accident management studies) and the various elements of the severe accident inte- staff work in other areas related to severe acci-gration plan. The information provided and how it dents (e.g., improving containment performance will be used include the following: under severe accident conditions). Such uses are discussed in greater detail in the following sec-

• Probabilistic models of the spectrum of possi- tions.

ble accident sequences, containment events, 13.2.1 Guidance for Individual Plant and offsite consequences of severe accidents Examinations for use in:

Plant-specific PRAs have yielded valuable per-

- Development of guidance for the indi- spectives on unique plant vulnerabilities. The vidual plant examinations of internally NRC and the nuclear industry both have consider-and externally initiated accidents; able experience with plant-specific PRAs. This ex-perience, coupled with the interactions of NRC and the nuclear industry on severe accident is-

- Accident management strategies; sues, have resulted in the Commission's formulat-ing an integrated systematic approach to an ex-

- Analysis of the need and appropriate amination of each nuclear power plant now means for improving containment per- operating or under construction for possible sig-formance under severe accident condi- nificant risk contributions (sometimes called "out-tions; liers") that might be plant specific and might be 13-1 NUREG-l1SO

13. Resource Document missed without a systematic approach. In Novem- in these analysis procedures are not plant specific ber 1988, the NRC requested (by generic letter) and are therefore adaptable to other plant analy-that each licensed nuclear power plant perform an ses.

individual plant examination (IPE) to identify any plant-specific vulnerabilities to severe accidents As noted above, plant-specific PRAs have yielded (Ref. 13.17). The technical data generated in the valuable perspectives on unique plant vul-course of preparing NUREG-1150 on severe acci- nerabilities. These perspectives are, in general, dent frequencies, risks, and important uncertain- not directly applicable to other plants, although ties were used in developing the analysis require- they provide useful information to the study of ments described in the IPE generic letter and the plants of similar NSSS (nuclear steam supply sys-supplemental guidance on the IPE external-event tem) and containment design. At the present analysis (Ref. 13.18).* These studies will also aid time, the principal contributors to the likelihood the staff in evaluating individual submittals, assess- of a core damage accident at boiling.water reac-ing the adequacy of the identification of plant- tors (BWRs) include sequences related to station specific vulnerabilities by the licensee, and evalu- blackout or anticipated transients without scram ating any associated potential plant modifications. (ATWS). Accident sequences making important contributions to the frequency of core damage ac-The extent to which NUREG-1 150 results are ap- cidents at pressurized water reactors (PWRs) in-plicable to different classes of reactors or to oper- clude those initiated by a variety of electrical ating U.S. light-water reactors as a group is illus- power system disturbances (loss of a single ac bus, trated in Table 13.1. The generic insights which initiates a transient; loss of offsite portions presented in NUREG-1150 are indicative of items of the equipment needed to respond to the tran-that may be applicable within a class of plants. sient; loss of offsite power; and complete station This includes the identification of possible vul- blackout), small loss-of-coolant accidents nerabilities that may exist in plants of similar de- (LOCAs), loss of coolant support systems such as sign. These insights cannot be assumed to apply to the component cooling water system, ATWS, and a given plant without consideration of plant design interfacing-system LOCAs or steam generator and operational practices because of the design tube ruptures in which reactor coolant is released differences that exist in U.S. plants, particularly outside the containment boundary. All have the those involving ancillary support systems (e.g., ac potential for being important at PWRs.

power, component cooling water) for the engi-neered safety features and differences in details of containment design. NUREG-1150 provides a wide spectrum of phenomenological and operational data (much of For some issues, the state of knowledge is very it of a very detailed nature). For example, infor-limited, and it is not possible to identify plant- mation on hydrogen generation has been com-specific features that may influence the issue be- piled from experimental and calculational results cause sensitivity analyses have not been per- as well as interpretations of these data by experts.

formed. In other cases, the methodology is This data base provides an important source of broadly applicable, but the results are highly plant information that may be used for NSSS contain-specific. In spite of the plant-specific nature of ment types similar to those studied here but is many of the results, much can be learned from somewhat less applicable for different NSSS con-one plant that can be applied to another. Example tainment types. The operational data base in-types of generic applicability are presented in Ta- cludes component failure rates, maintenance ble 13.1. times, and initiating-event frequency data. Much of these data are generic in nature and thus appli-The NUREG-1150 methods refer not only to the cable for selected classes of plants.

analytical techniques employed but the general structure and framework upon which the analyses The analyses presented in Chapters 3 through 7, were conducted. These methods include the un- when combined with the information gained from certainty analysis, expert elicitation methods, acci- earlier PRA work sponsored by both NRC (e.g.,

dent progression event tree analysis, and source Ref. 13.19) and utilities, make it clear that the term modeling. The general approaches adopted quantitative results (core damage frequencies and risk results) calculated for internal and external In addition, NUREG-1150 provides extensive and de- initiators cannot be considered applicable to an-tailed analyses of five nuclear power plants and thus of- other plant, even if the plant has a similar NSSS fers licensees of those plants an opportunity to use these design and the same architect-engineer was in-studies in developing their IPEs and submitting them on an expedited basis. volved in the design of the balance of plant.

NUREG-1 150 13-2

13. Resource Document Table 13.1 Utility of NUREG-1150 PRA process to other plant studies.

Applicability Example Results Class of Plants Plant Population

1. Methods (e.g., uncertainty, elicitation, event tree/ high high fault tree)

2. General perspectives (e.g., principal contributors to medium low core damage frequency and risk)

3. Supporting data base on design features, operational high medium characteristics, and phenomenology (e.g., hydrogen generation in core damage accidents, operational data)

4. Quantitative results (e.g., core damage frequency, low low containment performance, risk)

Site-specific requirements and differing utility re- licensees. The NRC will focus on developing the quirements often lead to significant differences in regulatory framework under which the industry support system designs (e.g., ac power, dc power, programs will be developed and implemented, as service water) that can significantly influence the well as providing an independent assessment of response of the plant to various potential acci- licensee-proposed accident management capa-dent-initiating events. Further, different opera- bilities and strategies. NUREG-1150 has been tional practices, including maintenance activities used by the NRC staff to support the development and techniques for monitoring the operational re- of the accident management program. NUREG-liability of components or systems can have a sig- 1150 methods provide a methodological frame-nificant influence on the likelihood or severity of work that can be used to evaluate particular an accident. strategies, and the current results provide some in-sights into the efficacy of strategies in place or that 13.2.2 Guidance for Accident Management might be considered at the NUREG-1150 plants.

Strategies Thus, the NUREG-1150 methods and results will support a staff review of licensee accident man-Certain preparatory and recovery measures can be agement submittals.

taken by the plant operating and technical staff that could prevent or significantly mitigate the PRA information has been used in the past to in-consequences of a severe accident. Broadly de- fluence accident management strategies; however, fined, such "accident management" includes the the methods used in NUREG-1150 can bring measures taken by the plant staff to (1) prevent added depth and breadth to the process, along core damage, (2) terminate the progress of core with a detailed, explicit treatment of uncertainties.

damage if it begins and retain the core within the The integrated nature of the methods is particu-reactor vessel, (3) maintain containment integrity larly important, since actions taken during early as long as possible, and finally (4) minimize the parts of an accident can affect later accident pro-consequences of offsite releases. In addition, acci- gression and offsite consequences. For example, dent management includes certain measures taken an accident management strategy at a BWR may before the occurrence of an event (e.g., improved involve opening a containment vent. This action training for severe accidents, hardware or proce- can affect such things as the system response and dure modifications) to facilitate implementation of core damage frequency, the retention of radioac-accident management strategies. With all these tive material within the containment, and the tim-factors taken together, accident management is ing of radionuclide releases (which impacts evacu-viewed as an important means of achieving and ation strategies). It is possible that actions to maintaining a low risk from severe accidents. reduce the core damage frequency can yield accident sequences of lower frequency but with Under the staff program, accident management much higher consequences. All these factors need programs will be developed and implemented by to be considered in concert when developing 13-3 NUREG-1150

13. Resource Document appropriate venting strategies. The treatment of Effect of Feed and Bleed on Core Damage uncertainties is another key aspect of accident Frequency at Surry management. Generally, procedures are devel- The NUREG-1 150 analysis for Surry includes the oped based on "most likely" or "expected" out- use of feed and bleed cooling for those sequences comes. For severe accidents, the outcomes are in which all feedwater to the steam generators is particularly uncertain. PRA models and results, lost (thus causing their loss as heat removal sys-such as those produced in the accident progres-sion event trees, can identify possible alternative tems). Feed and bleed cooling restores heat re-outcomes for important accident sequences. By moval from the core using high-pressure injection making this information available to operators and (HPI) to inject into the reactor vessel and the response teams, unexpected events can be recog- power-operated relief valves (PORVs) on the nized when they occur, and a more flexible ap- pressurizer to release steam and regulate reactor proach to severe accidents can be developed. The coolant system pressure.

recent trend toward symptom-based, as opposed An examination has been made to determine to to event-based, procedures is consistent with this what extent feed and bleed cooling decreases core need for flexibility. damage frequency at Surry. The current Surry model includes two basic events representing fail-To demonstrate the potential benefits of an acci- ure modes for feed and bleed cooling in the event dent management program, some example calcu- of a loss of all feedwater. These modes are: opera-lations were performed, as documented in Refer- tor failure to initiate high-pressure injection and ence 13.20. For this initial demonstration, these operator failure to properly operate the PORVs.

calculations were limited to the internal-event ac- In order to examine the impact of feed and bleed cident sequence portion of the analysis. Further, cooling, both basic events were assumed to always the numerical results presented are "point esti- occur. As shown in Figure 13.1, the resulting total mates" of the core damage frequency as opposed core damage frequency for Surry (if feed and to mean frequency estimates. Selected examples bleed cooling were not available) then increases from the initial analysis are presented below. by roughly a factor of 1.3. That is, the availability of the feed and bleed core cooling option in the Surry design and operation is estimated to reduce core damage frequency from 4E-5 to 3E-5 per Effect of Firewater System at Grand Gulf reactor year.

Gas Turbine Generator Recovery Action at The first NUREG-1150 analysis of the Grand Surry Gulf plant (Ref. 13.21) did not credit use of the firewater system for emergency coolant injection The present NUREG-1150 modeling and analysis because of the unavailability of operating proce- of the Surry plant have not considered the bene-dures for its use in this mode and the difficulties fits of using onsite gas turbine generators for re-in physically configuring its operation. However, covery in the event of station blackout accidents.

since that time, the licensee has made significant Both a 25 MW and a 16 MW gas turbine genera-system and procedural modifications. As a result, tor are available to provide emergency ac power to the firewater system at Grand Gulf can now be safety-related and non-safety-related equipment.

used as a backup source of low-pressure coolant These generators were not included in the analysis injection to the reactor vessel. The system would because, as currently configured, they would not be used for long-term accident sequences, i.e., be available to mitigate important accident se-where makeup water was provided by other injec- quences.

tion systems for several hours before their subse-quent failure. The firewater system primarily aids An examination has been made of the effect on the plant during station blackout conditions and is core damage frequency at Surry of including the considered a last resort effort. gas turbine generators as a means of recovery from station blackout sequences. To give credit for the addition of one generator for emergency An examination has been made of the benefit of ac power, it is assumed that Surry plant personnel these licensee modifications to the Grand Gulf have the authority to start the gas turbines when plant. As shown in Figure 13.1, these analyses required and that 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is required to start the showed that the total core damage frequency was gas turbines and energize the safety buses. In the reduced from 4E-6 to 2E-6 per reactor year be- analysis, the gas turbines were assumed to be cause of these changes. available 90 percent. of the time.

NUREG-1150 13-4

13. Resource Document 1.OOOE-03 Legend PCV: Primary Containment Venting FWS: Firewater System F&B: Feed and Bleed CC: Cross-Connects GTG: Gas Turbine Generator 0: Base case point estimate X Sensitivity point estimate CC 1.OOOE- 04 F&B x GTO PCV 1.OOOE-05 FWS

_ E 1.OOOE-06 Peach Grand Surry Surry Surry Bottom Gulf Figure 13.1 Benefits of accident management strategies.

13-5 NUREG-1150

13. Resource Document The use of the onsite gas turbine was estimated to quency witho-u containment venting of 9E-6, reduce core damage frequency from 3E-5 to about a factor of 2.6 increase over the 2E-5 per reactor year. NUREG-lSO value of 4E-6.

13.2.3 Improving Containment Performance High-Pressure Injection and Auxiliary Feed-water Crossconnects at Surry The NRC has performed an assessment of the need to improve the capabilities of containment The Surry Unit 1 plant is configured to recover structures to withstand severe accidents (Ref.

from loss of either the high-pressure injection 13.1). Staff efforts focused initially on BWR (HPI) system or the auxiliary feedwater (AFW) plants with a Mark I containment, followed by the system by operator-initiated crossconnection to review of other containment types. This program the analogous system at Unit 2. While these ac- was intended to examine potential enhanced plant tions provide added redundancy to these systems, and containment capabilities and procedures with new failure modes (e.g., flow diversion pathways) regard to severe accident mitigation. NUREG-that were included in the modeling process for 1150 provided information that served to focus at-Surry have been created. The alignment of the tention on areas where potential containment per-Unit 1 and Unit 2 HPI and AFW systems for formance improvements might be realized.

crossconnect injection is modeled as a recovery NUREG-1 150 as well as other recent risk studies action. indicate that BWR Mark I risk is dominated by station blackout and anticipated transient without Analysis of the importance of crossconnect injec- scram (ATWS) accident sequences. NUREG-tion at Surry includes two parts. First, credit for 1150 further provided a model for and showed crosscornect injection was removed from all ap- the benefit of a hardened vent for Peach Bottom plicable dominant sequences, which were then re- (discussed above and displayed in Figure 13.1).

quantified. Second, sequences that were previ- The staff is currently pursuing regulatory actions ously screened out of the analysis were checked to to require hardened vents in all Mark I plants, determine if they would become dominant in the using NUREG-1150 and other PRAs in the cost-absence of crossconnect injection. As shown in benefit analysis.

Figure 13.1, the point estimate of the total core damage frequency without crossconnects is E-4, The NUREG-1150 accident progression analysis compared to the value of 3E-5 for internally initi- models were used by the staff and its contractors ated events in the base case. in the evaluation of possible containment im-provements for the PWR ice condenser and BWR Mark III designs. The result of the staff reviews of Primary Containment Venting at Peach these designs (and all others except the Mark I)

Bottom was that potential improvements would best be The primary containment venting (PCV) system at pursued as part of the individual plant examina-Peach Bottom is used to prevent primary contain- tion process (discussed in Section 13.2.1).

ment overpressurization during accident se- 13.2.4 Determining Important Plant quences in which all containment heat removal is Operational Features lost. Most sequences of this type involve failure of the residual heat removal systems. Because of the NUREG-1150 will provide a source of informa-existence of this venting capability, no such acci- tion for investigating the importance of opera-dent sequences appeared as dominant in the tional safety issues that may arise during day-to-NUREG-1150 analysis for Peach Bottom. day plant operations. The NUREG-1150 models, methods, and results have already been used to The effect of the PCV system on the core damage analyze the importance of venting of the suppres-frequency at Peach Bottom was determined by ex- sion pool, the importance of keeping the PORVs amining the sequences screened out in the and atmospheric dump valves unblocked, the im-NUREG- 150 analysis that included the PCV sys- portance of operational characteristics of the ice tem as an event (primarily the sequences involving condenser containment design, the importance of loss of containment heat removal). Credit for the operator recovery during an accident sequence, PCV system was removed from these sequences, and the importance of crossties between systems.

which were then summed and added to the cur- These operational and system characteristics, as rent point estimate of the core damage frequency. well as many others, are described in detail in As shown in Figure 13.1, this results in a point Chapters 3 through 7. For example, characteris-estimate of the Peach Bottom core damage fre- tics of the Surry plant design and operation that NUREG-1150 13-6

13. Resource Document have been found to be important include crossties A number of design, operational, and siting fac-between units, diesel generators, reactor coolant tors are important to this measure of plant risk pump seals, battery capacity, capability for feed and determine the relative location of a specific and bleed core cooling, subatmospheric contain- plant's risk range in comparison with other plants ment operation, post-accident heat removal sys- and with the safety goal. At a general level, core tem, and reactor cavity design. damage frequency, containment and source term performance, and surrounding population demo-13.2.5 Alternative Safety Goal graphics all can affect the risk range. Thus, using Implementation Strategies the Surry plant as an example, the combination of On August 21, 1986, the Commission published a a relatively low core damage frequency, relatively Policy Statement on Safety Goals for the Opera- good containment performance, and a low popu-tion of Nuclear Power Plants (Ref. 13.22). In this lation density act to ensure with a high probability statement, the Commission established two quali- that the risk is below the safety goal.

tative safety goals supported by two risk-based quantitative objectives that deal with individual The NUREG-1150 results can also be used to and societal risks posed by nuclear power plant support the analysis of alternative safety goal im-operation. The objective of the policy statement plementation approaches. One subject of discus-was to establish goals that broadly define an ac- sion in the staff's work is the need for a supple-ceptable level of radiological risk that might be mental definition of containment performance in imposed on the public as a result of nuclear power severe accidents using the probability of a large plant operation. release as a measure. An acceptable frequency for such a release was defined as 1-6 per reactor The Commission recognized that the safety goals year. A potential definition of a large release is could provide a useful tool by which the adequacy one that can cause one or more early fatalities.'

of regulations or regulatory decisions regarding The present NUREG-1 150 risk analyses have changes to the regulations could be judged. Safety been evaluated to provide the frequency of such a goals could be of benefit also in the much more release, as shown in Figure 13.4. The mean large difficult task of assessing whether existing plants release probabilities are below 1E-6 per reactor that have been designed, constructed, and oper-. year. Further staff work in assessing alternative ated to comply with past and current regulations definitions is planned as part of the safety goal conform adequately with the intent of the safety implementation program, and it is expected that goal policy. NUREG-1150 methods and results will be used.

The models and results of NUREG-1150 can be 13.2.6 Effect of Emergency Preparedness on used in a number of ways in the NRC staff's Consequence Estimates analysis and implementation of safety goal policy.

For example, the five plants studied for this report NUREG-1150 provides information for develop-have been compared with the two quantitative ing protective action strategies that could be fol-health objectives, as shown in Figure 13.2 for in- lowed near a nuclear power plant in case of a ternal initiators. Figure 13.3 compares Surry and severe accident. In developing strategies, consid-Peach Bottom with the quantitative health objec- eration must be given to several types of protective tives for fire initiators. As may be seen, the pre- actions, such as sheltering, evacuation, and relo-sent risk estimates for these five plants (consider- cation and various combinations. These strategies ing internally initiated accidents) and for the are influenced by the types of severe accidents Surry and Peach Bottom plants (considering fire that might occur at a nuclear power plant, their initiators) fall beneath the quantitative health ob- frequency of occurrence, and the radioactive re-jective risk goals. In addition, however, it may be lease expected to result from each accident type seen that the risk estimates among the five plants as well as by the topography, weather, population vary considerably. An analysis of the plant design density, and other site-specific characteristics.

and operational differences that cause this vari-ability can provide valuable information to the NUREG-1150 provides assessments of a broad staff in its consideration of the balance of the pre- spectrum of potential core damage accidents that sent set of regulations and the areas of regulation could occur at a nuclear power plant. These as-that could most benefit from improvement. sessments permit the evaluation of hypothetical The staff has reviewed the NUREG-1 150 results 'The Commission has now indicated that this is not an at a broad level to determine the causes of the appropriate definition and has asked the staff to review variability among plant risks shown in Figure 13.2. and propose an alternative definition.

13-7 NUREG-1 150

13. Resource Document IIndividual early fatality/ry 1.OE-06 Legend

-==<--Safety Goal 9l%

S~afi 1.OE-07 median 8 i

1.OE-08 i

I 1.OE-09 I 1.OE-10

_71 1.OE- 1 SURRY PEACH SEQUOYAH GRAND ZION BOTTOM GULF Individual latent cancer fatality/ry 1.OE-05 Legend

<- Safety Goal 1.OE-06 mean madlian...f 1.0E-07 1.OE-08 1.OE-09 1.0E-10 SURRY PEACH SEOUOYAH GRAND ZION BOTTOM GULF Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 13.2 Comparison of individual early and latent cancer fatality risks at all plants (internal initiators).

NUREG-1 150 13-8

13. Resource Document Individual early fatality/ry 1.OE -08 Legend

- - Safety Goal 1.OE-07 1.0E-08 1.0E-09 1.01E-10 1.OE-1 1 SURRY PEACH BOTTOM FIRE FIRE Individual latent cancer fatality/ry 1.OE-05 l~~~~~~~~ I Legend -

-sf===Safety Goal 1.OE-06 -mean median- L 1.OE-07 1.OE-08 11.OE-09 1.OE-10 SURRY FIRE a1 4 PEACH BOTTOM FIRE Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 13.3 Comparison of individual early and latent cancer fatality risks at Surry and Peach Bottom (fire initiators).

13-9 NUREG-1150

13. Resource Document FProbability of a large release 1.OE-05 Large :*vsls - Release Ibt ar result n one or moot early 18atal91*es Legend l.OE -06 lY 5sll*

-Mean Median- 5 1.OE-07 1.OE-08 IT -

1.OE-09 1.01E-10 SURRY PEACH SEQUOYAH GRAND ZION BOTTOM GULF 1.OE-05 1.OE-06 1.OE-07 1.OE-08 1.0E-09 1.OE-10 SURRY - FIRE PEACH BOTTOM - FIRE Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 13.4 Frequency of one or more early fatalities.

NUREG-1 150 13-10

13. Resource Document dose savings for a spectrum of accidents and pro- row dose for the various possible response modes vide a means for evaluating potential reduction in assuming an early containment failure at Zion early severe health effects (injuries and fatalities) with source term magnitudes varying from low to in the event of an accident by implementing emer- high. Figure 13.6 shows similar results for a late gency response strategies. containment failure at Zion.

The most important considerations in establishing Use of the above assumptions indicates that if a emergency preparedness strategies are the warning large release occurs (Fig. 13.5), there is a large times before release to initiate the emergency re- probability of doses exceeding 200 rems within 1 sponse and magnitude of the release of the radio- to 2 miles from the reactor. Sheltering does not active material to the environment. The warning significantly lower this probability. Thus, if a large time and magnitude of radioactive release are in release can occur, it is prudent to consider prompt turn strongly influenced by the time and size of evacuation prior to the start of the release.

containment failure or bypass. If the containment fails early, the radioactive release is generally At 3 miles and beyond, it is possible to avoid larger and more difficult to predict than if the doses exceeding 200 rerns by sheltering in large containment fails late. buildings even if a large release were to occur.

Thus, people in large buildings such as hospitals To evaluate the effectiveness of various protective would not necessarily have to be immediately actions, the conditional probabilities of acute red evacuated, but could shelter instead. Of course, bone marrow doses exceeding 200 reins and 50 further reductions in dose are possible by evacu-reins were calculated for several possible actions, ation.

using Zion plant source terms as examples. Doses were calculated on the plume centerline for vari- At 10 miles, no protective actions except reloca-ous distances from the plant. The actions evalu- tion would be necessary to avoid 200-rem doses.

ated are: Sheltering in large buildings or evacuation prior to release would probably keep doses below 50 reins.

• Normal activity-assumed that no protective actions were taken during the release but as- 13.3 Major Factors Contributing to sumed that people were relocated within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of plume arrival. Risk

• Home sheltering-sheltering in a single family NUREG-1150 results can be used to identify home (see Table 11.5 for a definition of dominant plant risk contributors and associated sheltering). The penetration fractions for uncertainties. A discussion of these dominant risk groundshine and cloudshine were representa- contributors is found in Chapters 3 through 8 and tive of masonry houses without basements as Chapter 12. This section focuses on the use in well as wood frame houses with basements. guiding research, generic issue resolution, and in-Indoor protection for inhalation of radio- spection programs.

nuclides was assumed. People were relocated Because of its integrated nature, discussion of from the shelter mode within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of uncertainties, and reliance on more realistic as-plume arrival. sessments, PRA-based information found in

• Large building shelter-sheltering in a large NUREG-1150 and its supporting documents can building, for example, an office building, be used to guide and focus a wide spectrum of hospital, apartment building, or school. In- activities designed to improve the state of knowl-door protection for inhalation of radionu- edge regarding the safety of individual nuclear clides was assumed. People were relocated power plants, as well as that of the nuclear indus-from the shelter mode within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of try as a whole. The resources of both the NRC plume arrival. and the industry are limited, and the application of PRA techniques and subsequent insights pro-

• Evacuation-doses were calculated for people vides an important tool to aid the decisionmaker starting to travel at the time of release, 1 in effectively allocating these resources.

hour before start of release, and 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after start of release. An evacuation speed of 2.5 The nature of the many decisions necessary to al-mph was assumed. locate regulatory resources does not require great precision in PRA results. For example, in assign-Figure 13.5 shows the conditional probabilities of ing priorities to research or efforts to resolve ge-exceeding a 50-rem and a 200-rem red bone mar- neric safety issues, it is sufficient to use broad 13-1 1 NUREG-1150

13. Resource Document Probability of Exceeding 50-Rem Acute Red Bone Marrow Dose 1

Early Containment Fallure

t. C42tiNs Normal "tvivly

• a

t. e0t o h tieor a.Sheter In arge building

4. tat eveesatlos 1 efre. elese If . lt t t release 0.8 a. alert evasvtti I y ater geesae 0.6 4 4 *~~~~~~

0.4 0.2 0 1 mile 3 miles 5 miles 10 mil*

Distance from Reactor Probability of Exceeding 200-Rem Acute Red Bone Marrow Dose 1

Early Containment Failure

1. CD=tls=e cerea sIsily

4. CeEeeees1hr Isis,. rlese C. alerlft 1sVeeeat at relsae 0.8 e. lert oaseleier I ,.. Wto. relosse i

0.6 0.4 a~~~~~~~~~~~~~~~~

0.2 LI , . . . ___________ ___________

I mile 3 mniles a miles 10 mile.

Distance from reactor Figure 13.5 Relative effectiveness of emergency response actions assuming early contain-ment failure with high and low source terms.

NUREG-1 150 13-12

13. Resource Document Probability of Exceeding 50-Rem Acute Red Bone Marrow Dose 1

Late Containment Failure

1. Cotilt ora activity 2 Whitar or*mnt S Shalter N tarp, building

4. Start evetuatjom hr before relase S. Start at rltear action 0.8 - S. Start evacuation I hr ate rse*

0.6 0.4 I 2

0.2 0 1 mile 3 miles s miles 10 mileS Distance from Reactor Probability of Exceeding 200-Rem Acute Red Bone Marrow Dose 1

Late containment failure

t. Cestintla frermal aetiity

2. B ilk at sheldt uder 8.

relSaf n t rse bu ild ing 4 Start *esV0ation 1 hr bater releats S. stalt 4VaGqatioh it I4leazs

. Start evieatirn I hr *fte? eease 0.8 0.6 0.4 0.2 I _ .__

0 I mile 3 miles 6 miles 10 miles Distance from Reactor Figure 13.6 Relative effectiveness of emergency response actions assuming late contain-ment failure with high and low source terms.

13-13 NUREG-1150

13. Resource Document categories of risk impact (e.g., high, medium, and to these issues would have to be based largely on low) (Ref. 13.24). In a similar manner, informa- subjective judgment.

tion from PRAs can be used to guide the alloca-tion of resources in inspection and enforcement PRA is being usefully applied to setting priorities programs (see Section 13.3.3). for generic safety issues and to evaluating new is-sues as they are identified. In this effort, each is-13.3.1 Reactor Research sue is assessed as to its nature, its probable core damage frequency and public risk, and the cost of As noted earlier, the nature of the decisions nec- one or more conceptual fixes that could resolve essary to allocate resources does not require great the issue. A matrix is developed whereby each is-precision in PRA results. In prioritizing research sue is characterized as of high, medium, or low efforts, it is sufficient to use broad categories of probability, or whether the issue should be sum-risk impact (e.g., high, medium, and low). A marily dropped from further regulatory considera-given issue can be evaluated in terms of the num- tion. This matrix considers both the absolute mag-ber of plants affected, the risk impacts on each nitude of the core damage frequency or risk and plant, the effect of modifications in reducing the the value/impact ratio of conceptual fixes. Risk-risk, and the effect of additional knowledge on reduction estimates are normally made using sur-improving the prediction of plant risk or severe rogate PWRs and BWRs, based on existing PRAs.

core damage frequency or on reducing or defining more clearly the associated uncertainties. These A principal benefit of PRA-based prioritization, generic measures of significance, combined ap- compared to other methods for allocating re-propriately with other information (e.g., cost of sources to safety issues, is that important assump-resolving the issue) can be used to evaluate the tions made in quantifying the risk are displayed issue under consideration. and uncertainties in the analyses are estimated. A principal limitation is that some of the issues, such 13.3.2 Prioritization of Generic Issues as those dealing with human factors, are only subjectively quantified. Thus, the uncertainties The NRC has been setting priorities for generic can be large. However, on balance, PRA-based safety issues for several years using PRA as one prioritization has been found to be quite useful.

informational input (Ref. 13.25). In prioritizing Although uncertainties may be large, the process efforts to resolve generic safety issues, it is suffi- forces attention on these uncertainties to a much cient to use broad categories of risk impact (e.g., higher degree than if the quantification were not high, medium, and low) in which only order-of- attempted. Also, the uncertainties are normally magnitude variations are considered important. part of the issues themselves and not just an arti-The reasoning is that a potential safety issue would fact of the PRA analysis.

not be dismissed unless it were clearly of low risk.

Thus, one or more completed PRA studies can Since, as discussed above, the prioritization is often be selected as surrogates for the purpose of done on an approximate (order-of-magnitude) assigning such priorities, even though they clearly basis, the new information developed in do not fully represent the characteristics of some NUREG-1150 is not expected to substantially plants, provided the nature of the difference is change previously developed priority rankings.

reasonably understood and can be qualitatively However, a sample of key issues will be re-evaluated. examined to determine whether, based on the up-dated information in NUREG-1150, changes in As with any priority-assignment method, the final dominant accident sequences or performance of results must be tempered with an engineering mitigative systems could substantially affect the evaluation of the reasonableness of the assign- previous rankings.

ment, and the PRA-based analysis can serve as 13.3.3 Use of PRA in Inspections only one ingredient of the overall decision.

The importance to NRC of risk-based inspection One of the most important benefits of using PRA data is exemplified by the following statement in as an aid to assigning priorities is the documenta- NRC's 5-Year Plan: "Probabilistic risk assessment tion of a comprehensive and disciplined analysis techniques will be applied to all phases of the in-of the issue, which enhances debate on the merits spection program in order to insure that in-of specific aspects of the issue and reduces reli- spection activities are prioritized and conducted in ance on more subjective judgments. Clearly, some an integrated fashion." Within NRC, the Risk issues would be very difficult to quantify with rea- Applications Branch of the Office of Nuclear Re-sonable accuracy, and the assignment of priorities actor Regulation has the responsibility of directly NUREG-1150 13-14

13. Resource Document providing risk-based information to the regional inspection activities can be found in a recently is-offices and resident inspectors. This ongoing ef- sued inspection module entitled "Risk Focused fort has resulted in the development of plant- Operation Readiness Inspection Procedures."

specific, and in some cases generic, PRA perspec- This module focuses on how to use PRA perspec-tives that help to provide an optimization of tives and conduct a risk-based team inspection inspection resources and a prioritization of inspec- based on risk insights. The spectrum of reactor tion resources on the high-risk aspects of a plant. plant design types addressed in NUREG-1150 Using draft NUREG-1150 data, team inspection provide a broad risk data base that in many in-procedures based on plant-specific PRA informa- stances can be used to assist in inspection-type de-tion have been developed and implemented on cisions even for plants without a PRA.

such plants as Grand Gulf. Formalization of these 13-15 NUREG-1150

13. Resource Document REFERENCES FOR CHAPTER 13 13.1 U.S. Nuclear Regulatory Commission Consequence, Risk Integration, and Uncer-(USNRC), "Integration Plan for Closure of tainty Analyses," Sandia National Labora-Severe Accident Issues," SECY-88-147, tories, NUREG/CR-4551, Vol. 1, Draft May 25, 1988. Revision 1, SAND86-1309, to be pub-lished.

• 13.2 USNRC, "Reactor Safety Study-An As-sessment of Accident Risks in U.S. Com- 13.11 F. T. Harper et al., "Evaluation of Severe mercial Nuclear Power Plants," WASH- Accident Risks: Quantification of Major 1400 (NUREG-75/014), October 1975. Input Parameters," Sandia National Labo-ratories, NUREG/CR-4551, Vol. 2, Revi-13.3 D. M. Ericson, Jr.,(Ed.) et al., "Analysis sion 1, SAND86-1309, December 1990.

of Core Damage Frequency: Internal Events Methodology," Sandia National Laboratories, NUREG/CR-4550, Vol. 1, 13.12 R. J. Breeding et al., "Evaluation of Severe Revision 1, SAND86-2084, January 1990. Accident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREG/CR-4551, 13.4 T. A. Wheeler et al., "Analysis of Core Vol. 3, Revision 1, SAND86-1309, Octo-Damage Frequency from Internal Events: ber 1990.

Expert Judgment Elicitation," Sandia Na-13.13 A. C. Payne, Jr., et al., "Evaluation of tional Laboratories, NUREG/CR-4550, Severe Accident Risks: Peach Bottom Vol. 2, SAND86-2084, April 1989.

Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 13.5 R. C. Bertucio and J. A. Julius, "Analysis 1, SAND86-1309, to be published.*

of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, 13.14 J. J. Gregory et al., "Evaluation of Severe NUREG/CR-4550, Vol. 3, Revision 1, Accident Risks: Sequoyah Unit 1," Sandia SAND86-2084, April 1990. National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, De-13.6 A. M. Kolaczkowski et al., "Analysis of cember 1990.

Core Damage Frequency: Peach Bottom Unit 2," Sandia National Laboratories, 13.15 T. D. Brown et al., "Evaluation of Severe NUREG/CR-4550, Vol. 4, Revision 1, Accident Risks: Grand Gulf Unit 1,"

SAND86-2084, August 1989. Sandia National Laboratories, NUREG/

CR-4551, Vol. 6, Draft Revision 1, 13.7 R. C. Bertucio and S. R. Brown, "Analysis SAND86-1309, to be published.*

of Core Damage Frequency: Sequoyah Unit 1," Sandia National Laboratories, 13.16 C. K. Park et al., "Evaluation of Severe NUREG/CR-4550, Vol. 5, Revision 1, Accident Risks: Zion Unit 1," Brook-SAND86-2084, April 1990. haven National Laboratory, NUREG/

CR-4551, Vol. 7, Draft Revision 1, BNL-13.8 M. T. Drouin et al., "Analysis of Core NUREG-52029, to be published.*

Damage Frequency: Grand Gulf Unit 1,"

Sandia National Laboratories, NUREG/ 13.17 USNRC, "Individual Plant Examination for CR-4550, Vol. 6, Revision 1, SAND86- Severe Accident Vulnerabilities-10 CFR 2084, September 1989. §50.54(f)," Generic Letter 88-20, Novem-ber 23, 1988.

13.9 M. B. Sattison and K. W. Hall, "Analysis of Core Damage Frequency: Zion Unit 1," 13.18 USNRC, "Procedural and Submittal Guid-Idaho National Engineering Laboratory, ance for the Individual Plant Examination NUREG/CR-4550, Vol. 7, Revision 1, of External Events (IPEEE) for Severe Ac-EGG-2554, May 1990. cident Vulnerabilities," NUREG-1407, Draft Report for Comment, July 1990.

13.10 E. D. Gorham-Bergeron et al., "Evaluation of Severe Accident Risks: Methodology for 'Available in the NRC Public Document Room, 2120