ML11228A233

Secy Paper/SECY-09-0045:; for the Commissioners, from B. Sheron, RES; Subject: Plan for Developing State-of-the-Art Reactor Consequence Analyses

ML11228A233
Person / Time
Site:	Peach Bottom, Surry
Issue date:	03/25/2009
From:	Sheron B Office of Nuclear Regulatory Research
To:	Diaz N, Jaczko G, Peter B. Lyons, Mcgaffigan E, Merrifield J NRC/Chairman, NRC/OCM
References
FOIA/PA-2011-0083, SECY-09-0045
Download: ML11228A233 (25)

Text

S, LI IAL USE ONLY -SENSITIVE EDTRSSIND I L INFORMANTJQ-MINýE TIIt-SI POLICY ISSUE INFORMATION March 25, 2009 SECY-09-0045 FOR: The Commissioners FROM: Brian W. Sheron, Director Office of Nuclear Regulatory Research

SUBJECT:

STATE-OF-THE-ART REACTOR CONSEQUENCE ANALYSES -

PEACH BOTTOM AND SURRY RESULTS PURPOSE:

The purpose of this paper is to inform the Commission of the results of the State-of-the-Art Reactor Consequence Analyses (SOARCA) for the Surry and Peach Bottom plants and to provide the Commission with the revised communication plan and a risk communication.

information booklet summarizing the SOARCA program for internal and external stakeholders.

This paper does not identify any new commitments or resource implications.

SUMMARY

The staff has completed an assessment of the Surry and Peach Bottom plants. The assessment of mitigation measures, including emergency operating procedures, severe accident management guidelines, and security-related mitigation measures, led the staff to conclude that all of the identified severe accident scenarios could reasonably be mitigated.

CONTACTS: Terry Brock, RES/DSA (301) 251-7487 Jason Schaperow, RES/DSA (301) 251-7452 Charles Tinkler, RES/DSA (301) 251-7496

'i~':4& S'9

ýTR'U M  !

The Commissioners Scenarios were also analyzed assuming all mitigation was not successful. The related accident progression and offsite consequence analyses confirmed that accident progression proceeds more slowly, offsite radiological releases are smaller and offsite consequences are less severe than indicated by earlier conservative and simplified analyses (e.g., NUREG/CR-2239, "Technical Criteria for Siting Criteria Development," commonly referred to as the 1982 Sandia siting study). The staff plans to complete the documentation of the current analyses in May 2009 and to initiate an external peer review and an uncertainty analysis. Completion of all activities and public release of information is planned for February 2010.

BACKGROUND:

In SECY-05-0233, "Plan for Developing State-of-the-Art Reactor Consequence Analyses," dated December 22, 2005, the staff proposed a plan to perform an updated realistic evaluation of severe reactor accidents and their offsite consequences. The staff indicated its intent that these analyses would reflect the accumulated improved understanding of severe accident behavior and potential consequences developed through the considerable research conducted by the U.S. Nuclear Regulatory Commission (NRC) and others over the last 25 years, and that the analyses would provide a body of knowledge on the more likely outcomes of such remote events. This information would be the basis for communicating that aspect of nuclear safety to Federal, State, and local authorities, licensees, and the general public. The staff also indicated that SOARCA would update quantification of offsite consequences documented in earlier studies (e.g., NUREG/CR-2239) that in some cases was based on overly conservative assumptions and simple bounding analyses to the extent that the earlier results are also overly conservative and can be misleading.

In a Staff Requirements Memorandum (SRM) dated April 14, 2006, the Commission approved the staff's plan and provided additional guidance in a number of areas. The Commission specifically concurred with the staffs approach to (1) use state-of-the-art analytical tools for accident progression and consequence analyses; (2) credit the use of Severe Accident Management Guidelines (SAMGs) and other new plant procedures, such as mitigative measures resulting from B.5.b (EA-02-026, Commission Order "Interim Safeguards and Security Compensatory Measures", February 25, 2002), and other like programs; and (3) use realistic site-specific evacuation scenarios and emergency planning modeling along with updated population and meteorological data. A summary of the staff's approach and results is provided in Enclosure 1. In this SRM, the Commission also directed the staff to develop communication techniques that could improve our communication of these complex analyses to the public. The communication techniques should address the role of mitigative strategies, identify important analysis assumptions, and discuss differences between the state-of-the-art analyses and the earlier analyses in the 1982 Sandia siting study. In response to this SRM item (and the subsequent SRM-COMSECY-06-0064 and SRM-SECY-08-0029 on this matter), the staff has undertaken a substantial effort to improve our risk communication of these severe low probability events as an integral part of the SOARCA project. The resulting revised communication plan (Enclosure 2) and risk communication information booklet (Enclosure 3) that utilizes current risk communication techniques for reporting the SOARCA results are provided.

ICIAL U Y -SENSITIV TE L INFORM N,

b C0N - SýE EI 1 ýL1NN RRMMAAT "

The Commissioners 3 In the April 2006 SRM, the Commission approved the staff s plan to focus on scenarios with a radiological release frequency greater than 10-6 per reactor year. The Commission also directed the staff to consider the potentially risk significant but lower frequency scenarios (e.g., the interfacing systems loss-of-coolant accident [LOCAl scenarios that bypass the containment). In response to this item, the staff modified its criterion for selecting scenarios to include events that bypass the containment with a core damage frequency (CDF) greater than 10. 7 per reactor year.

The staff also elected to use CDF as the metric for assessing nonbypass scenarios rather than radiological release frequency. This was a practical consideration (CDF values are available from Level 1 Probabilistic Risk Assessment (PRA) models). The staff briefed the Advisory Committee on Reactor Safeguards on the scenario selection process and adjusted the process to resolve their comments. While the objective of SOARCA was not to perform a level 3 Probabilistic Risk Assessment (PRA), we have confirmed our conclusion that we are addressing the most relevant accident scenarios by performing additional calculations and comparing our scenario selection criteria to the most probable and risk-significant scenarios identified in NUREG-1 150. The staff also compares the selected SOARCA scenarios against security related aircraft events, the results of which are discussed further in Enclosure 4.

In SRM-COMSECY-06-0064, dated April 2, 2007 the staff was directed to reduce the scope of the SOARCA project to not more than eight plants representing a spectrum of plant designs and was also directed to focus on a subset of the eight plants (e.g., a boiling water reactor [BWR]

and a pressurized water reactor [PWR] plant) to resolve methodological and technical issues.

The staff selected the Peach Bottom plant as the BWR representative and the Surry plant as the PWR representative for the first assessments, and these plants are the focus of this paper and enclosures. The plant staffs at both facilities were very cooperative and provided plant-specific information and facility tours, without which we could not have completed this study. The staff has the cooperation of one additional plant, the Sequoyah plant, but has suspended the analysis of the Sequoyah plant pending the results and insights expected from the external peer-review of the Peach Bottom and Surry results. In this SRM, the Commission also reiterated its direction to the staff to use improved risk communication techniques. As stated previously, the SOARCA project has devoted significant efforts in that regard and has actively engaged the Office of Public Affairs (OPA) in developing the revised (and enclosed) communication plan and in review of the SOARCA risk communication information booklet.

In an April 3, 2007, memorandum to the Commission, "Treatment of Land Contamination and Offsite Economic Consequences in the SOARCA Project," the staff informed the Commission that significant technical limitations exist to the current economic modelsfor calculating land contamination consequences. The Commission directed the staff in SRM-COMPBL-08-0002/

COMGBJ-08-003, "Economic Consequence Model", dated September 10, 2008, to address the economic consequence modeling outside of the SOARCA project in a separate initiative. The staff is developing an options paper for Commission consideration. Therefore, SOARCA consequence calculations are in terms of human health effects, including prompt and latent cancer mortality risk for specific events. The staff is pursuing the issue of economic consequences separately.

In SECY-08-0029, "State-of-the-Art Reactor Consequence Analysis - Reporting Offsite Health Consequences," the staff outlined a number of options for reporting predicted latent health

ýS O - ý ýII TER ýNA ýO MA.

11,1]jdLSýE FOIiýqA N The Commissioners 4 effects and recommended an approach to assess and report latent health effects as the probability of an average individual's death from cancer (related to accident-related radiological releases) conditional to the occurrence of a severe reactor accident. The calculation would include health effects modeling assuming the linear no threshold (LNT) and 100 pISv (10 mrem) truncation dose response models, with results presented for three distances:

(1) 0 to 16.1 km (10 miles), (2) 0 to 80.5 km (50 miles), and (3) 0 to 161 km (100 miles). The primary intent of this recommendation was to improve risk communication by communicating results in a way that could be compared to the occurrence of cancer fatalities in the general population from causes other than a reactor accident. In an SRM dated September 10, 2008, the Commission approved the staffs recommendation for assessing and reporting latent health effects and directed the staff to continue to coordinate with NRC's Federal partners as consequence modeling technology evolves. The staff has proceeded to assess and report the results accordingly. In addition, the staff has included supplementary sensitivity analyses using two additional dose response models-a dose response model that truncates health effects below 360 mrem per year (akin to normal background dose rate) and a model based on the Health Physics Society position paper, "Radiation Risk in Perspective," which does not quantify health effects below 5 rem in a year or 10 rem in a lifetime. We have performed these additional analyses in an effort to provide more perspective on potential outcomes and to assist in risk communication. In the SRM dated September 10, 2008, the Commission also approved the staff's recommendation'to submit the Peach Bottom and Surry methodology and approaches for peer review by an external group of experts.

DISCUSSION:

In preparation for the detailed, realistic modeling of accident progression and offsite consequences, the staff had extensive cooperation from the licensees to (1) develop high-fidelity plant systems models; (2) define operator actions, including the most recently developed mitigative actions; and (3) develop models for simulation of site-specific and scenario-specific emergency planning. In addition, the staff met with the licensees and performed tabletop exercises with senior reactor operators, PRA analysts, and other licensee staff to gather information concerning scenario frequencies in their own PRAs and to establish the timing and nature of operator actions to mitigate the selected scenarios.

The staff identified two major groups of accident scenarios when we applied our scenario selection process using updated and benchmarked Standardized Plant Analysis Risk (SPAR) models and the best available plant-specific external event information. The first group, common to both Peach Bottom and Surry, was comprised of events commonly referred to as station blackout (SBO) scenarios, which include variations identified as short-term and long-term SBOs. These scenarios involve a loss of all alternating current (ac) power, and the short-term SBO also involves the loss of turbine-driven systems through loss of direct current (dc) control power or direct loss of the turbine system. The short-term SBO has a lower frequency because it involves more extensive system failures. These scenarios were typically initiated by some external events-fire, flood, or seismic initiators. Because the initiators were not always well differentiated in external events PRAs, the SBO was assumed-for the purpose of SOARCA analyses-to have been initiated by a seismic event, which is conservative because the seismic initiator was judged to be the most severe initiator in terms of timing, with respect to F ON ITI TER FO

The Commissioners the system failures occurring at the beginning of the scenario. Notwithstanding the SOARCA process, SBO scenarios are commonly identified as important contributors in PRA because of the common failure mode nature of the scenario and the fact that both containment safety systems and reactor safety systems are similarly affected.

The second scenario group, which was identified for Surry only, was the containment bypass scenario. For Surry, two bypass scenarios were identified and analyzed-one scenario involving an interfacing systems LOCA (ISLOCA) due to an unisolated rupture of low-pressure safety injection piping outside containment and the second scenario involving a thermally induced steam generator tube rupture. The latter occurs as a variant of an SBO scenario.

Again, these scenarios are generally understood to be important potential contributors to risk in PRAs.

The assessment of mitigation measures, including emergency operating procedures, severe accident management guidelines, and security-related mitigation measures, led us to the conclusion that all the identified scenarios could reasonably be mitigated. The security-related measures to provide alternative ac power and portable diesel-driven pumps were especially helpful in counteracting SBO scenarios. For the ISLOCA sequence, installed equipment was adequate to prevent core damage owing to the time available for corrective action. For all events except one, the mitigation was sufficient to prevent core damage. For the one event involving core damage, the Surry short-term SBO, the mitigation was sufficient to enable flooding of the containment through containment spray systems to cover core debris. The assessment of the mitigation measures was undertaken with support from integrated accident progression analyses using the MELCOR code, which incorporates our best understanding of plant response and severe accident phenomenology. MELCOR analyses were used to both confirm the timing available to take mitigation measures and to confirm that those measures, once taken, were adequate to prevent core damage or significantly reduce radiological releases.

In other instances, MELCOR analyses were performed crediting only installed equipment.

These analyses resulted in no core damage and revealed that success criteria in many PRAs are overly conservative. The SOARCA study has revealed a number of insights that many existing PRAs should consider adopting to more realistically estimate the risk of nuclear power plant operations. These insights include: 1) credit for the prevention and mitigation of severe accidents using SAMGs and security-related mitigation measures, 2) more realistic success criteria for core cooling, 3) credit for delayed timing of significant core damage, and 4) credit for delayed timing and reduced magnitude of offsite releases. In parallel with the SOARCA study, the staff has been incorporating security-related mitigation measures into its Standardized Plant Analysis of Risk (SPAR) models, reassessing SPAR model success criteria, and expanding several SPAR models to address severe accident progression (i.e., the development of a limited scope Level 2 PRA capability). Currently, there is no plan to expand the SPAR models to provide offsite consequence estimates. Following completion of the SOARCA peer review, the staff will assess how to appropriately incorporate SOARCA study insights in the SPAR models.

To quantify the benefits of the mitigative measures and to provide a basis for comparison to past analyses of unmitigated severe accident scenarios, the SOARCA project analyzed these same groups of scenarios assuming the event was unmitigated, leading ultimately to an offsite release. Overall, the MELCOR accident progression analyses confirmed that accident FlL EQ - L MITIV N M

F Y- IIIN NLI A N "

The Commissioners progression in severe accidents proceeds much more slowly than earlier conservative and simplified treatments indicated. The reasons for this are principally twofold. Research and development of better phenomenological modeling has produced results that show a much more protracted and delayed core degradation transient with substantial delays of reactor vessel failure. Furthermore consistent treatment of all aspects of accident scenarios including more complete modeling of plant systems also often yields delays in core damage and radiological release. In contrast, in past simplified treatments using qualitative logical models, bounding approaches have often been used that produce more conservative results.

In SOARCA, where initial conditions and analytical assumptions for the specific sequence are propagated throughout subsequent analysis and are analyzed in an integral fashion using MELCOR, it can be seen that accident conditions or attributes that contribute to a more severe response in one area may produce an ameliorating effect in another area. In the long-term SBO, the most likely accidents considered in SOARCA (assuming no mitigation), core damage was delayed for 10 to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> and reactor vessel failure was delayed for approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> (BWR) or 45 hrs (PWR) was available before the onset of offsite radiological release due to containment failure. In the 1982 siting study (in which the dominant event was identified as the Siting Source Term 1 release) it was assumed that a major release occurs in 1 1/2 hours. The SOARCA analyses clearly indicate that ample time is available for operators to take corrective. action even if initial efforts are assumed unsuccessful.

Moreover, these time delays also allow substantial time for input from plant technical support centers and emergency planning. Even in the case of the most rapid events (i.e., the unmitigated short-term SBO where core damage may begin in 1 to 3 hrs), reactor vessel failure is delayed for roughly 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, allowing time for restoration of cooling and prevention of vessel failure. In these cases, containment failure and radiological release are delayed for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (BWR) or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (PWR). For the bypass events, substantial delays occur or, in the case of the thermally induced steam generator tube rupture, analyses show the radiological release to be substantially reduced.

The SOARCA study also demonstrated that the magnitude of the fission product release is likely to be much smaller than assumed in past studies. Again, this is a result of extensive research and improved modeling as well as integrated and more complete plant simulation. The study predicted typical releases of important radionuclides such as iodine and cesium to be no more than 10 percent and more generally in the range of 0.5 to 2 percent. By contrast, the 1982 siting study assumed an iodine release of 45 percent and a cesium release of 67 percent.

As the result of the accident progression and source term analysis, combined with realistic simulation of emergency planning, offsite health consequences are dramatically smaller than reported in earlier studies. Because of the delayed nature of the releases and their diminished magnitude, no early acute health effects were predicted, close-in populations were evacuated, and no early fatalities occurred. Latent health effects are also quite limited, even using the most conservative dose response treatment. In fact, much of the latent cancer risk for the close-in population was derived from the relatively small doses received by populations returning to their homes in accordance with emergency planning guidelines. Here, the prediction of latent cancer risk, though very small, is strongly influenced by the relationship between low-dose health effects modeling and criteria for allowing return of populations. Estimates of conditional

.FC NL SE I NTE NF

F A L ýUENL Y E!,,!!E OR ONý The Commissioners (i.e., assuming the accident has occurred) individual latent cancer risk range from roughly 10-3 to 104, using the LNT dose response model (other dose models result in lower or much lower conditional risk). If one also accounts for the probability of the severe accident itself, the risk to an individual for an important severe accident scenario is on the order of 10-9 to 1010 per reactor year. In comparison, these risks are thousands of times smaller than the NRC safety goal and a million times smaller than the U.S. average risk of a cancer fatality.

The enclosures to this paper are the Executive Summary of the SOARCA NUREG, a revised communication plan for reporting results, an information booklet that utilizes the latest risk communication techniques for presentation of the results of SOARCA to internal and external stakeholders, and a separate safeguards enclosure that will be provided separately. The SOARCA communication activities have been coordinated with the Office of Public Affairs and communication staff from the Office of the Executive Director for Operations.

The staff plans to complete the NUREG documentation in May 2009 and the external peer review in January 2010. As a parallel effort, an uncertainty study will begin shortly to quantify the effect of epistemic and aleatory uncertainties on consequence estimates. Upon completion of this work, the staff will present these findings to the Commission along with options for their resolution and the staff's proposal to implement the communication plan.

COORDINATION:

The SOARCA project has been conducted as a coordinated effort involving the Office of Nuclear Regulatory Research, Office of Nuclear Security and Incident Response, Office of New Reactors, Office of Nuclear Reactor Regulation, and Office of Public Affairs. Moreover, the project was guided by a steering committee composed of senior managers from the above program offices. Regional offices have received interim briefings. The Office of the General Counsel reviewed this package and has no legal objection. The Office of the Chief Financial Officer reviewed this package and determined that it has no financial impact.

S ENý ElIl R NF( A11!TIOý

The Commissioners .- 8T We request this SECY paper not be made publicly available because it contains pre-decisional, sensitive internal information pending the completion of the external peer-review and uncertainty analysis.

IRA!

Brian W. Sheron, Director Office of Nuclear Regulatory Research

Enclosures:

1. Summary of Results for Peach Bottom and Surry plants

2. SOARCA Communication Plan, Rev. 3

3. SOARCA Information Booklet

4. Security-Related Scenarios (provided separately)

ýICIANL IV TER I RMAT.

WKILSEý ~Eýý O ý N The Commissioners We request this SECY paper not be made publicly available because it contains pre-decisional, sensitive internal information pending the completion of the external peer-review and uncertainty analysis.

Brian W. Sheron, Director Office of Nuclear Regulatory Research

Enclosures:

1. Summary of Results for Peach Bottom and Surry plants

2. SOARCA Communication Plan, Rev. 3

3. SOARCA Information Booklet

4. Security-Related Scenarios (provided separately)

WITS 200700117/EDATS: SECY-2008-0204 ADAMS Accession No.: ML090340075 WITS 200800185/EDATS: SECY-2009-0112 OFFICE RES/DSA RES/DSA/SPB RES/DSA/SPB Tech Editor D:RES/DSA NAME CTinkler TBrock JSchaperow JZabel (via email) JUhle (KGibson for)

DATE 2/10/09 2/10/09 2/10/09 2/03/09 2/18/09 OFFICE D: RES/DRA D: RES/DE NRO NRR NSIR NAME CLui MCase GHolahan (via email) JGrobe (via email) WDean DATE 2/19/09 2/19/09 3/05/09 3/11/09 3/04/09 OFFICE OPA OGC D:RES NAME SBurnell (via email) GMizuno (via email) BSheron DATE 3/04/09 3/04/09 03/ /09 IC USENSl El A Il RM N

FI Y-LSSSITIINTNALTI State-of-the-Art Reactor Consequence Analyses (SOARCA)

Executive Summary for the Full NUREG for Peach Bottom and Surry Background and Objective The evaluation of accident phenomena and offsite consequences of severe reactor accidents has been the subject of considerable research by the U.S. Nuclear Regulatory Commission (NRC), the nuclear power industry, and the international nuclear energy research community.

As part of an NRC initiative to assess plant response to security-related events, updated analyses of severe accident progression and offsite consequences were completed utilizing the wealth of accumulated research and incorporating more detailed, integrated, and realistic modeling than past analyses. The results of those security-related studies confirmed and quantified what was suspected but not well-quantified -namely, that some past studies of plant response and offsite consequences (for non-security events) could be extremely conservative, to the point that predictions were not useful for characterizing results or guiding public policy. In some cases, the overly conservative results were driven by the combination of conservative assumptions or boundary conditions. In other cases, simple bounding analysis was used in the belief that if the result was adequate to meet an overall risk goal, bounding estimates of consequences could be tolerated. The subsequent misuse and misinterpretation of such bounding estimates further suggests that communication of risk attributable to severe reactor accidents should be based on realistic estimates of the more likely outcomes.

The State-of-the-Art Reactor Consequence Analyses (SOARCA) project involves the reanalysis of severe accident consequences to develop a body of knowledge regarding the realistic outcomes of severe reactor accidents. In addition to incorporating the results of over 25 years of research, it is the objective of this study that this updated plant analysis include the significant plant improvements and updates (e.g., system improvements, training and emergency procedures and offsite emergency response), which have been made by plant owners and are not reflected in earlier NRC assessments. These improvements to plant safety also include those enhancements recently made in connection with security-related events. Thus, a key objective of this study was to evaluate the benefits of the recent mitigation improvements in preventing core damage events or in minimizing the offsite release should one occur. The NRC expects that the results of this evaluation would provide the foundation for communicating severe-accident-related aspects of nuclear safety to Federal, State, and local authorities; licensees; and the general public. This evaluation of severe accident consequences also would update the quantification of offsite consequences found in earlier NRC publications such as NUREG/CR-2239, "Technical Guidance for Siting Criteria Development," dated December 1982, and NUREG/CR-2723, "Estimates of the Financial Consequences of Reactor Accidents,"

dated September 1982.

This report describes the analysis of two reactors, the Peach Bottom Atomic Power Station and the Surry Power Station, which served as pilot plants for the study. Peach Bottom is generally representative of a major class of U.S. operating reactors, General Electric boiling water reactor Enclosure 1 FIC US L- SITIVE I LINF A

IYJ!! ! 1p11111- if!ilZ Z Wf ALINE

-2 (BWR) designs that that have Mark I containments. Surry is generally representative of a second major class of U.S. operating reactors. Westinghouse pressurized water reactor (PWR) designs with large, dry containments. This analysis of Peach Bottom and Surry is being reviewed by the Advisory Committee on Reactor Safeguards and will be the subject of an external peer review.

Method The approach was to utilize the detailed, integrated, phenomenological modeling of accident progression (reactor and containment thermal-hydraulic and fission product response) that is embodied in the MELCOR code coupled with modeling of offsite consequences (MACCS code) in a consistent manner (e.g., accident timing) to estimate offsite consequences for important reactor accidents. The approach is described below.

Scenario Selection The process of selecting sequences for analyses in the SOARCA project was the subject of considerable deliberation, discussion, and review. The central focus of this reassessment is to introduce the use of a detailed, best-estimate, self-consistent quantification of sequences based on current scientific knowledge and plant capabilities. The essence of the analysis methodology is the application of the integrated severe accident progression modeling tool, the MELCOR code, together with the improved MACCS code and the incorporation of site-specific and updated sequence-specific emergency planning. Because the priority of this work was to bring more detailed, best- estimate, and consistent analytical modeling to bear in determining realistic outcomes of severe accident scenarios, it was apparent that the demonstration of the benefits of this state of the art modeling could most efficiently be demonstrated by applying these methods to a set of the more important severe accident sequences.

What sequences should then be analyzed to demonstrate the benefits of our improved understanding incorporated into detailed, best-estimate modeling and the many plant improvements that have been realized over the last 25 years? To efficiently achieve these objectives, it seemed logical that we should select sequences that result in substantial offsite releases but also reflect probabilistic considerations - focusing on the more credible yet low-frequency accident sequences. By this approach, we could avoid the needless quantification of many sequences that are extremely low in probability or pose only residual risk. Further, SOARCA is intended to provide perspective on the question, "What are the likely outcomes and what is our best estimate of the risk if a severe accident were initiated at a nuclear plant?" The updated SOARCA requantification of consequences might include consideration of those sequences important to risk as demonstrated by a full-scope level 3 PRA. In practice, that is not feasible since there are no current full scope level 3 PRAs generally available, considering both internal and external events, to draw upon. Fortunately, the preponderance of level 1 PRA information, combined with our insights on severe accident behavior obviates the need for such information in selecting sequences. Ample PRA information is available on dominant core damage sequences, especially internal event sequences. This information, combined with our understanding of containment loadings and failure mechanisms together with fission product OF I U ,S ITIV TE ALl RMA

-3 release transport and deposition, allow us to utilize core damage frequency (CDF) as a surrogate screening criterion for risk. Thus, for SOARCA we elected to analyze sequences with.

a CDF greater than 10-6 per reactor-year. In addition, we included sequences that have an inherent potential for higher consequences (and risk), with a lower CDF - those with a frequency greater than 10-7 per reactor-year. Such sequences would be associated with events involving containment bypass or leading to an early failure of the containment. By the adoption of these criteria, we are reasonably assured that the more probable and important sequences will be captured.

The sequence selection criteria identify risk-significant sequences in both an absolute and relative sense. It can be shown (see Appendix D of NUREG-1860) that a core damage frequency (CDF) of 10-4 per reactor-year and a large early release frequency (LERF) of 10-5 per reactor-year are acceptable surrogates to the latent and early quantitative health objectives (QHO) contained in the Commission's Safety Goal Policy Statement [51 FR 28044]. The American Society of Mechanical Engineer's "Standard for Probabilistic Risk Assessment for Nuclear Power Plants," ASME RA-Sb-2005, which was endorsed by the staff in RG 1.200, defines a significant sequence as one of the set of sequences that, when rank ordered by decreasing frequency, aggregate to 95 percent of the CDF or that individually contribute more than 1 percent of the CDF. Therefore, the SOARCA sequence selection criteria are consistent with previously issued regulatory guidance. More importantly, they help to place severe accidents into their proper risk context. A search for high-consequence severe accidents, without consideration of the likelihood of their occurrence, can be an exercise that loses the perspective that one is entering a realm of very low residual risk, a realm where the risk quantification is suspect (often conservative) and may be more misleading than revealing.

Another yardstick for assessing the impact of low-frequency events is to consider the increase in the consequences that would be necessary to offset the lower frequency. Conceptually, an event with a larger radiological release could have greater risk ifthe increase in the radiation release is larger than the decrease in frequency of the event. For example, all other considerations equal, a 10-8 per reactor year event must have a radiological release more than 10 times the magnitude of an event with a frequency of 10. per reactor year in order to pose greater risk. Since we are including events with substantial volatile releases on the order of 1 to 10 percent, it is, practically speaking, not feasible to achieve greater latent cancer fatality risk by increasing the magnitude of the release by more than a factor of 10.

Other than the magnitude of the radiological release, a major impact on risk is derived from the timing of the offsite release. In this respect, we have examined candidate SOARCA sequences with timing in mind, both the timing of core damage along with the timing of containment failure.

As part of this consideration, we addressed, for the Peach Bottom plant, an additional sequence, the short term station blackout (SBO), even though it did not satisfy our screening criterion. The short-term SBO frequency is roughly an order of magnitude lower than the long-term SBO (3x10- 7 per reactor-year versus 3x10 6 per reactor year); however, the short-term SBO has a more prompt radiological release and a slightly larger release over the same interval of time. Our initial qualitative assessment of the short-term SBO led us to conclude that it would not have greater risk.significance than the long-term SBO. Because while it was a more prompt release (8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> versus 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />), the release was delayed beyond the time needed for 0 IcONL NSI I

'_ FCý Oý 4IVE I ý IN R ýT "

successful evacuation. In order to conclusively demonstrate the points regarding risk versus frequency for lower frequency events, we nonetheless included a detailed analysis of the short-term SBO. Table 5 shows the results of that analysis, and it can be seen that the absolute risk is indeed smaller for the short-term SBO than for the long-term SBO. Table 6 shows the same trends for the Surry sequences, where the lower frequency sequences may have greater conditional risk but smaller or equivalent absolute risk than other higher frequency sequences.

Finally, we routinely considered core damage initiators and phenomenological containment failure modes in SOARCA that have been considered in the past, except for those which have been excluded by extensive research (alpha mode failure, direct containment heating, and gross failure without prior leakage). Our detailed analysis includes modeling of behavior (including fission product transport and release) associated with long-term containment pressurization, Mark I liner failure, induced steam generator tube rupture, hydrogen combustion, and core concrete interactions.

We also have compared the SOARCA sequences against those identified as important to risk in NUREG-1 150 for the Surry and Peach Bottom plants. Adjusting for the improvements in our understanding of phenomena due to the research completed since the NUREG-1 150 study was completed (roughly 18 years ago), we have found that, with one exception, SOARCA addresses the more likely and important sequences identified in that landmark study. The one exception-a sequence identified in NUREG 1150 that has not been analyzed for the SOARCA project-involved an extreme earthquake that directly results in a large breach of the reactor coolant system (large loss-of-coolant accident [LOCA]), a large breach of the containment, and an immediate loss of safety systems. We conclude that this sequence is not appropriate for consideration as part of SOARCA for a number of reasons. Foremost, the state of quantification of such extreme and low-frequency seismic events is poor, considerable uncertainty exists in the quantification of the seismic loading condition itself, and a detailed soil-structure interactions analysis was not performed for the plant (and its equipment) response to the seismic loads.

The analysis of the plant's components to the seismic acceleration-commonly referred to as fragility analysis-is a key component, and the lack of detailed analysis in this area makes current consideration of this event incompatible with the thrust of SOARCA, which is the performance of detailed, realistic analyses. Further, recent experience at nuclear plants in Japan strongly suggests that nuclear plant designs possess inherently greater capability to withstand the effects of extremely large earthquakes. In addition, it would not be sufficient to perform a nuclear plant risk evaluation of this event (even if it were currently feasible) without also performing an assessment of the concomitant nonnuclear risk associated with such a large earthquake. This assessment would have to include an analysis of the general societal impacts of an extremely large earthquake-larger than that generally considered in residential or commercial construction codes (past or present)-such that a potentially significant impact would be had on the public health irrespective of the nuclear plant response. Such an analysis has not been performed for the areas surrounding the plants selected for SOARCA and would have to accompany an evaluation of nuclear plant risk to provide the perspective on the incremental risk posed by operation of the plant.

While we conclude that analysis of such an extreme earthquake that involves simultaneous failures of the reactor system, safet stems, and containment is not warranted as part of L LY- ITI 0

JO1,1E'I RNN SOARCA, we. believe that such events because of their potential for risk should be assessed as part of a separate future study. This future study, which will be integrated into the NRC seismic research program, will include the development of detailed mechanistic models for site-specific plant response as well as assessment of the nonnuclear seismic impacts on the general public.

In summary, SOARCA addresses the more likely (though still remote) and important sequences that are understood to compose much of the severe accident risk from nuclear plants. We conclude that the general methods of SOARCA (i.e., detailed, consistent, phenomenologically based, sequence specific, accident progression analyses) are applicable to PRA and should be the focus of improvements in that regard.

Mitigation Measures In preparation for the detailed, realistic modeling of accident progression and offsite consequences, the staff had extensive cooperation from the licensees to develop high fidelity plant systems models, define operator actions including the most recently developed mitigative actions, and develop models for simulation of site-specific and scenario-specific emergency planning. Further, in addition to input for model development, licensees provided information-from their own PRA on accident scenarios. Through table-top exercises (with senior reactor operators, PRA analysts, and other licensee staff) of the selected scenarios, licensees provided input on the timing and nature of the operator actions to mitigate the selected scenarios.

The licensee input for each scenario was used to develop timelines of operator actions and equipment lineup or setup times for the implementation of the available mitigation measures.

This includes mitigation measures beyond those treated in current PRA models. Mitigation measures treated in SOARCA include Emergency Operating Procedures (EOPs), Severe Accident Management Guidelines (SAMGs), and post-9/-11 mitigation measures. Post-9/11 mitigation measures refer to additional equipment and strategies required by the NRC following the terrorist attacks of September 11, 2001, to further improve severe accident mitigation capability, NRC inspectors completed the verification of licensee implementation (i.e.,

equipment, procedures, and training) of post-9/1 1 mitigation measures in December, 2008.

Scenarios identified in SOARCA included both externally and internally initiated events. The externally initiated events frequently included events for which seismic, fire, and flooding initiators were grouped together. For the externally initiated events, the timeline of operator actions was developed assuming the initiator was a seismic event because the seismic initiator was judged to be the most severe initiator in terms of timing and with respect to how much equipment would be available to mitigate. Thus, there is some conservatism in attributing all of the event likelihood to a seismic initiator.

Accident Progression and Fission Product Release At the beginning of this project, an independent expert panel was assembled to review the proposed severe accident modeling approach of MELCOR to identify priority areas that would benefit from improvement prior to undertaking the SOARCA calculations. MELCOR is NRC's detailed mechanistic model that incorporates our best understanding of plant response and

" . ' -SE6T severe accident phenomenology. The SOARCA project team evaluated comments and recommendations made by the panel, and refinements or adjustments were made to the code and input files to improve the models.

MELCOR plant system models for Peach Bottom and Surry also were upgraded based on updated information from the licensees (e.g., system flow rates and actuation criteria). In addition, updated containment structural and leakage performance models were added to the MELCOR Peach Bottom and Surry models based on an extensive containment experimental research program conducted at Sandia National Laboratories that revealed concrete containments would experience an increase in leakage that would prevent catastrophic failure.

With respect to Peach Bottom, improved modeling of drywell head leakage was incorporated.

The use of MELCOR for SOARCA represents a significant and fundamental improvement over past consequence and risk studies.

The assessment of mitigation measures, including emergency operating procedures, severe accident management guidelines, and security-related mitigation measures, led us to the conclusion that all the identified scenarios could reasonably be mitigated. The assessment of the mitigation measures was undertaken with support from integrated accident progression analyses using the MELCOR code. MELCOR analyses were used to both confirm the timing available to take mitigation measures and to confirm that those measures, once taken, were adequate to prevent core damage or to significantly reduce radiological releases. In other instances, MELCOR analyses using only installed equipment revealed that PRA success criteria were overly conservative, indicating core damage where MELCOR analysis indicated no core damage.

To quantify the benefits of the mitigative measures and to provide a basis for comparison to past analyses of unmitigated severe accident scenarios, the SOARCA project analyzed these same groups of scenarios conservatively assuming the event proceeded as unmitigated and led ultimately to an offsite release.

Offsite Radiological Consequences An independent expert panel was assembled to review the proposed severe accident modeling approach of MACCS to identify areas that would benefit from improvement. The SOARCA project team evaluated the comments and recommendations made by the panel team and made refinements or adjustments to the code and input files to improve the models.

Improvements made to the code and input files include use of 64 radial directions for plume travel instead of 16 as well as use of short (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> long) plume segments.

MACCS models for Peach Bottom and Surry are based on 1 year of hourly weather data from the licensees' meteorology towers and were updated to include site-specific population distributions for 2005. Also, site-specific public evacuation models were developed for each scenario based on the licensees' updated Emergency Preparedness programs and state emergency response plans to reflect the actual evacuation time estimates and road networks at Peach Bottom and Surry.

A- I I CIA SE Y- N EIN LINFOR ION

( v These public evacuation models also are more detailed in that they use multiple evacuating cohorts. A cohort is any population subgroup, such as schoolchildren, general public, and special needs individuals that moves or shelters differently from other population subgroups.

Each cohort moves at a different time and speed and may have different sheltering characteristics that allow more realistic representation of shielding factors applied to the population. Cohorts modeled within the EPZ included the general public, school children, special facilities such as hospitals, and a nonevacuating cohort. The nonevacuating cohort of 0.5 percent of the public was used to represent those individuals who may not follow the protective action recommendations. Research of large-scale evacuations has shown that only a small percentage of the public does refuse to evacuate (NUREG/CR-6864, 2005), and establishing this cohort helps to quantify this small population group.

A cohort outside the EPZ was used to represent a shadow evacuation. A shadow evacuation occurs when people evacuate from areas that are not under an evacuation.order, and shadow evacuations are commonly observed in large-scale evacuations (NUREG/CR-6864, 2005). An estimate of about 20 percent of the public in the area from 16 to 32 km (10 to 20 miles) from the plant was assumed to evacuate as a shadow evacuation when an evacuation order is issued for residents of the EPZ. This, 20-percent value was derived from a national telephone survey conducted to support NUREG/CR 6953, Volume II, "Review of NUREG-0654, Supplement 3,

'Criteria for Protective Action Recommendations forSevere Accidents"' (2008).

The offsite consequence analysis is based on the fission product release to the environment for the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of the accident. The truncation of the release at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is intended to reflect the eventual termination of the release as a result of continually escalating mitigation action using both onsite and offsite resources. Because the release for the Surry long-term SBO does not start until 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />, consequence calculations for this sequence instead use a release truncation time of 72 to provide a basis for comparison to past analyses of unmitigated severe accident scenarios.

Metrics for the offsite radiological consequence estimates are provided for each important scenario expressed as the average individual likelihood of an early fatality and latent cancer fatality conditional to the occurrence of a severe reactor accident and expressed as a risk metric factoring in the frequency of the scenario. The modeling of latent cancer fatality risk has been an issue of considerable controversy because evidence regarding risk is inconclusive in the low-dose region. To provide additional information on the potential range of health consequences, the SOARCA project has developed latent cancer risk estimates assuming the linear-no-threshold model (LNT) and a range of truncation doses below which the cancer risk is not quantified. The LNT model is a basic assumption in many regulatory applications. Dose truncation values were used to help provide insight into the latent cancer health effects relative to the dose received by different exposure groups. Inclusion of dose truncation values is not meant to imply any NRC endorsement of a truncation value. Rather, it allows various audiences to readily understand the calculated consequences in a context that resonates with their assumptions of the dose-response relationship. Dose truncation values used for SOARCA included 10 mrem/year representing a small dose, 360 mrem/year representing background radiation levels in the environment, and 5 rem/year with a 10 rem lifetime cap representing the Health Physics Society Position Statement in "Radiation Risk in Perspective," August 2004.

ý-NSl ý ý ý

O ~ ~~SE -S _8 EINLITL Results and Conclusions Scenario Selection The result of our scenario selection process, using updated and benchmarked Standardized Plant Analysis Risk (SPAR) models and the best available plant-specific external events information, was the identification of two major groups of accident scenarios. The first group, common to both Peach Bottom and Surry, was events commonly referred to as SBO scenarios that include variations identified as short-term and long-term SBO. These scenarios involve a loss of all alternating current (ac) power, and the short-term SBO also involves the loss of turbine driven systems through loss of direct current control power or direct loss of the turbine system. The short-term SBO has a lower frequency because it involves more extensive system failures. These scenarios were typically initiated by some external events-fire, flood, or seismic initiators. The initiators were not always well differentiated in external events PRA. For the purpose of SOARCA analyses, it was assumed the SBO was initiated by a seismic event, which is conservative. Notwithstanding the SOARCA process, SBO scenarios are commonly identified as important contributors in PRA because of the common failure mode nature of the scenario and the fact that both containment safety systems as well as reactor safety systems are similarly affected.

The second scenario group, which was identified for Surry only, was the containment bypass scenario. For Surry, two bypass scenarios were identified and analyzed-one involved an interfacing systems LOCA (ISLOCA) due to an unisolated rupture of low pressure safety injection piping outside containment, and the other scenario involved a thermally induced steam generator tube rupture. The SPAR model frequency for the ISLOCA of 3x1 0 8/reactor-year falls below the SOARCA screening criteria for bypass events (1x10 7/reactor-year). However, SOARCA analyses included this scenario because the licensee's PRA for Surry included an ISLOCA frequency of 7xl0 7/reactor year and it has been commonly identified as an important contributor in PRA. The thermally induced steam generator tube rupture scenario occurs as a variant of an SBO scenario. This scenario also is generally understood to be an important potential contributor to risk in PRA. The scenarios are listed in Tables 1 and 2.

F SEO SITIVEI ALINFO N

I.. I *r

,o -s_9 E TER FO 10 Table 1. Peach Bottom Scenarios Selected for Consequence Analysis Scenario Initiating Event Core damage Description of scenario frequency (per reactor-year)

Long-term SBO Seismic, fire, Immediate loss of ac power and flooding 3x1 0-6 eventual loss of control of turbine-driven systems due to battery exhaustion Short-term SBO Seismic, fire, 3x10-7 Immediate loss of ac power and flooding turbine-driven systems Table 2. Surry Scenarios Selected for Consequence Analysis Scenario Initiating Event Core damage Description of scenario frequency (per reactor-year)

Long-term SBO Seismic, fire, Immediate loss of ac power and flooding 2x10-5 eventual loss of control of turbine-driven systems due to battery exhaustion Short-term SBO Seismic, fire, 2x10-6 Immediate loss of ac power and flooding turbine-driven systems Thermally Seismic, fire, Immediate loss of ac power and induced steam flooding 5xl0-7 turbine-driven systems, generator tube consequential tube rupture rupture Interfacing Random failure Check valves in high-pressure systems LOCA 1 of check valves piping fail open causing low-3x10 8 pressure piping outside containment to rupture, followed by operator error MitiQation Measures The assessment of mitigation measures, including emergency operating procedures, severe accident management guidelines, and security-related mitigation measures, led us to the conclusion that all the identified scenarios could reasonably be mitigated. The security-related measures to provide alternative ac power and portable diesel-driven pumps were especially helpful in counteracting SBO scenarios. For the ISLOCA scenario, installed equipment was adequate to prevent core damage owing to the time available for corrective action. For all events except one, the mitigation was sufficient to prevent core damage. For one event, the The licensee's PRA core damage frequency was 7x10 7 .

L S El N MTO

, # - L 1

II !,111L.......lrI TE ý INFR~~tiil_ý Surry short-term SBO, the mitigation was sufficient to enable flooding of the containment through the containment spray system to cover core debris. The assessment of the mitigation measures was undertaken with support from integrated accident progression analyses using the MELCOR code. MELCOR analyses were used to both confirm the timing available to take mitigation measures and to confirm that those measures, once taken, were adequate to prevent core damage or significantly reduce radiological releases. In other instances, MELCOR analyses using only installed equipment revealed that PRA success criteria were overly conservative, indicating core damage, where MELCOR analysis indicated no core damage.

Accident Proqression and Fission Product Release To quantify the benefits of the mitigation measures and to provide a basis for comparison to past analyses of unmitigated severe accident scenarios, the SOARCA project analyzed these same groups of scenarios assuming the event proceeded as unmitigated, leading ultimately to an offsite release. The overall result of the MELCOR accident progression analyses was the confirmation that accident progression in severe accidents proceeds much more slowly than earlier conservative and simplified treatments indicated. The reasons for this are principally twofold-(1) research and development of better phenomenological modeling has produced a

.much more protracted and delayed core degradation transient with substantial delays of reactor vessel failure and (2) all aspects of accident scenarios receive more consistent treatment, which includes more complete modeling of plant systems and also often yields delays in core damage and radiological release. Bounding approaches have often been used in past simplified treatments using qualitative logical models. In SOARCA, where specific self-consistent scenarios are analyzed in an integral fashion using MELCOR, it can be seen that accident conditions or attributes that contribute to a more severe response in one area may produce an ameliorating effect in another area.

In the most likely accidents considered in SOARCA (assuming no mitigation)-the long- term SBO-core damage was delayed for 10 to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> and reactor vessel failure was delayed for approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> (BWR) or 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> (PWR) were available before the onset of offsite radiological release due to containment failure. In the 1982 siting study, for the dominant event (identified as the SST1 release), it was assumed that a major release occurs in 11/2 hours. The SOARCA analyses clearly indicate that ample time is available for operators to take corrective action even if initial efforts are assumed unsuccessful. Further, these time delays also allow substantial time for input from plant technical support centers and emergency planning. Even in the case of the most rapid events (i.e., the unmitigated short-term SBO where core damage may begin in 1 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />), reactor vessel failure is delayed for roughly 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> allowing time for restoration of cooling and preventing vessel failure. In these cases, containment failure and radiological release is delayed for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (BWR) or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (PWR). For the bypass events, substantial delays occur or, in the case of the thermally induced steam generator tube rupture, the radiological release is shown by analyses to be substantially reduced. Tables 3 and 4 provide key accident progression timing results for SOARCA scenarios.

ýL - "IV

LYT 111MION Table 3. Peach Bottom Accident Progression Timing Results Scenario Time to start of Time to lower Time to start of release to core damage head failure environment (hours)

(hours) (hours)

Long-term SBO 10 20 20 Short-term SBO 1 8 8 Table 4. Surry Accident Progression Timing Results Scenario Time to start of Time to lower Time to start of release to core damage head failure environment (hours)

(hours) (hours)

Long-term SBO 16 21 45 Short-term SBO 3 7 25 Thermally 3 7.5 3.5 induced steam generator tube rupture __.

Interfacing 9 15 10 systems LOCA The SOARCA study also demonstrated that the magnitude of the fission product release is likely to be much smaller than assumed in past studies, again as a result of extensive research and improved modeling and as a result of integrated and more complete plant simulation. Typical releases of important radionuclides such as iodine and cesium are predicted to be no more than 10 percent and are more generally in the range of 0.5 to 2 percent. By contrast, the 1982 siting study assumed an iodine release of 45 percent and a cesium release of 67 percent. Figures 1 and 2 provide the fission product release results for iodine and cesium.

FIIA S NLY - SITIV L

)~ . -1 odin Release to1 teEnY- for U tateCaRa Iodine Release to the Environment for Unmitigated Cases 0.7 0.6 0.5 7i 0.4 0)

C 0) 0.3 0L 0.2 0.1 0

0 .12 24 36 48 Time (hr)

Figure 1. Iodine Releases to the Environment for SOARCA Unmitigated Scenarios Cesium Release to the Environment for Unmitigated Cases 0.7 0.6 0

w 0.5 o 0.4 C 0.3

.o 0.2 LL 0.1 0

0 12 24 36 48 Time (hr)

Figure 2. Cesium Releases to the Environment for SOARCA Unmitigated Scenarios I L E - T ALI ORMA

. , - I' Sequences involving large early releases have influenced the results of past PRAs and consequence studies. For example, the 1982 Siting Study results were controlled by an internally initiated event with a large early release that was assigned a frequency of lxl0 5/year.

However, in the SOARCA study, no sequences with a frequency above lxl07/year resulted in a large early release, even considering external events and neglecting post-9/11' mitigation measures. This is a result of research conducted over the last 2 decades that has shown that phenomena earlier believed to lead to a large early release are of extremely low probability or physically unfeasible. This research was focused on phenomena that have been previously assumed to be prime contributors to severe accident risk, including direct containment heating and alpha mode failure.

The PWR SBO with a thermally induced steam generator tube rupture has in the past been believed to result in a large, relatively early release potentially leading to higher offsite consequences. However, MELCOR analysis performed for SOARCA showed that the release was small owing to thermally induced failures of other reactor coolant system components after the tube rupture. Also, the release was somewhat delayed; for the short-term SBO where no injection occurred at the start of the accident, the tube rupture and release began about 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the event. Further, core damage, tube rupture, and radiological release could be delayed for. many hours if auxiliary feedwater were available even for a relatively short time period.

Offsite Radioloqical Consequences The result of the accident progression and source-term analysis, combined with realistic simulation of emergency planning, is that offsite health consequences are dramatically smaller than reported in earlier studies. Because of the delayed nature of the releases and their diminished magnitude, no early acute health effects were predicted; close-in populations were evacuated and no early fatalities occurred. Latent health effects are also quite limited, even using the most conservative dose response treatment. Much of the latent cancer risk for the close-in population was in fact derived from the relatively small doses received by populations returning to their homes in accordance with emergency planning guidelines. For example, for the Peach Bottom long-term SBO, about 70 percent of the latent cancer risk to individuals within 50 miles is from returning home. Here, the prediction of latent cancer risk, though very small, is strongly influenced by the relationship between low-dose health effects modeling and criteria for allowing return of populations.

Estimates of conditional (i.e., assuming the accident has occurred) individual latent cancer risk range from roughly 103 to 1 0 4, using the linear-no-threshold (LNT) dose response model (other dose models result in lower or much lower conditional risk). If one also accounts for the probability of the severe accident itself, the risk to an individual for an important severe accident scenario is on the order of 10-9to 10-10 per reactor year. These risk estimates are thousands of times smaller than the NRC safety goal for latent cancer fatality risk of 2x1 06 per reactor-year and a million times smaller than the U.S. average risk of a cancer fatality of 2x1 03 per year.

Tables 5 and 6 provide the risk estimates for individual SOARCA scenarios using the LNT dose IýC ý ON L ý 'N R IN M

-~

FOR ON response model. The risk estimates are based on an assumed truncation of the release at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> as a result of continually escalating mitigation actions, including containment and reactor building flooding.

Table 5. Peach Bottom Results for Scenarios Without Successful Mitigation and Assuming LNT Dose Response Model Conditional risk Absolute risk of of latent cancer, latent cancer Core damage fatality for an fatality for an frequency individual individual located (per located within within 10 miles Scenario reactor-year) 10 miles (per reactor-year)

Long-term SBO 3x10 6 2x10-4 6x10 10 Short-term SBO 3x10-7 2x10-4 7x10-1 1 Table 6. Surry Results for Scenarios Without Successful Mitigation and Assuming LNT Dose Response Model Conditional risk Absolute risk of of latent cancer latent cancer Core damage fatality for an fatality for an frequency individual individual located (per located within within 10 miles Scenario reactor-year) 10 miles (per rea6tor-year)

Long-term SBO 2xl 0-' 5xl 0.' 7xl 010 Short-term SBO 2x10-6 9x10.5 1x1010 Thermally induced steam generator tube 5x10-7 3x10-4 1x1010 rupture 11 Interfacing systems 3x1 0-8 7xl 0-4 2x1l0 LOCA To provide additional information on the potential range of health consequences, the SOARCA project has developed latent cancer risk estimates assuming the LNT and a range of truncation doses below which the cancer risk is not quantified. Dose truncation values used for SOARCA included 10 mrem/year representing a small dose, 360 mrem/year representing background

)v OFFI ~15 IF radiation levels in the environment and 5 rem/year with a 10 rem lifetime cap representing the Health Physics Society Position Statement in "Radiation Risk in Perspective," August 2004.

Tables 7 and 8 show the results of sensitivity calculations for dose truncation values for background and the Health Physics Society Position. Using these truncation values makes the already small latent cancer fatality risk estimates even smaller, in some cases by orders of magnitude. Using the 10 mrem/year truncation value made a relatively small change in the latent cancer risk from the LNT model.

SOARCA analysis included predictions of individual latent cancer fatality risk for 3 distance intervals, 0 to 10 miles, 0 to 50 miles, and 0 to 100 miles. The analysis indicated that individual latent cancer risk estimates generally decrease with increasing distance due to plume dispersion and fission product deposition closer to the site.

As noted above, the SOARCA offsite consequence estimates are dramatically smaller than reported in earlier studies. For example, the Siting Study predicted 92 early fatalities for Peach Bottom and 45 early fatalities for Surry for the SST1 source term. In contrast, SOARCA predicted that the early fatality risk was 0 for both sites. Also, the Siting Study predicted 2,700 cancer fatalities for Peach Bottom and 1,200 for Surry for the SST1 source term using the LNT model. Although the exact basis for these cancer fatality estimates could not be recovered, literature searches and sensitivity analyses with MACCS suggested .that these estimates are for the population Within 500 miles of the site. Although SOARCA does not include the same latent cancer fatality consequence metrics as the Siting Study, an indirect comparison is possible.

SOARCA predicted that the conditional risk of latent cancer fatality for an individual located

.within 10 miles assuming LNT was 2x104 for Peach Bottom and from 5x10-5 to 7x104 for Surry.

Multiplying this conditional risk by the population within 10 miles of each site roughly corresponds to about 10 cancer fatalities for Peach Bottom and 10 to 100 for Surry for the population within 10 miles. SOARCA estimates for large distances would make the SOARCA predictions larger due to a larger exposed population in combination with the LNT assumption, while application of dose truncation criteria would make the SOARCA predictions smaller.

IV ýUSE ý111 Y - INTERNAL -ATION

Table 7. Peach Bottom Results for Scenarios without Successful Mitigation for LNT and Alternative Dose Response Models Absolute risk of latent cancer fatality for an individual located within 10 miles (per reactor-year)

Linear No Health Physics Scenario Threshold Background Society Long-term SBO 6x10-10 3x10-11 5x10- 12 Short-term SBO 7x10-11 6x10 12 4x10-12 Table 8. Surry Results for Scenarios Without Successful Mitigation for LNT and Alternative Dose Response Models Absolute risk of latent cancer fatality for an individual located within 10 miles (per reactor-year)

Linear No Health Physics Scenario Threshold Background Society Long-term SBO 7x1010 2x10 1 1 2xl 0 1 4 Short-term SBO 1x10-10 lxl0-11 2x1 0-14 Thermally induced steam generator tube 1x1 0 1 ° 4xl 0 1 ' 3xl 012 rupture Interfacing systems 2x10-1 1 8x10-12 5x101 2 A_5x1__-12 LOCA PF IALU ONL IVE LIN ION