ML20134N832

Risk Evaluation & Insights

ML20134N832
Person / Time
Site:	Zion  File:ZionSolutions icon.png
Issue date:	08/26/1985
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20134N829	List: ML20134N826 ML20134N832
References
NUDOCS 8509050374
Download: ML20134N832 (77)

Text

_

o t i ENCLOSURE ZION RISK EVALUATION AND INSIGHTS 1

1 Reliability and Risk Assessment Branch Division of Safety Technology

, Office of Nuclear Reactor Regulation l

o t i

TABLE OF CONTENTS Page l

ACRONYMS ................................................................ vii 1 INTRODUCTION AND OVERVIEW ............................................ 1-1 l 1.1 History ......................................................... 1-1 1.2 Decision and Logic Framework .................................... 1-2 1.3 Conclusions ..................................................... 1-4 1.3.1 Qualitative Interplant Comparison ........................ 1-4 1.3.2 Zion Risk Insights ....................................... 1-4 1.3.3 Risk Reduction ........................................... 1-5 1.3.3.1 Prevention ............................ 1-5 1.3.3.2 Mitigation ......................................

.......... 1-6 1.4 Uncertainty ..................................................... 1-6 2 INTERPLANT COMPARISON ................................................ 2-1 2.1 Quantitative Comparison ......................................... 2-1 2.2 Qualitative Comparison .......................................... 2-2 2.2.1 Initiating Event Frequency ............................... 2-3 2.2.1.1 Loss of Offsite Power ........................... 2-3 2.2.1.2 Loss of Component Cooling Water ................. 2-4 2.2.1.3 Loss of a DC Bus ................................ 2-4 2.2.2 Plant Systems ............................................ ~2-5 2.2.2.1 Decay Heat Removal .............................. 2-5 2.2.2.2 Inventory / Makeup ................................ 2-6 2.2.2.3 Reactivity Control .............................. 2-7 2.2.3 Support Systems and Dependencies ... ..................... 2-7 2.2.3.1 Reactor Coolant Pump Seal LOCA .................. 2-8 2.2.3.2 Shared CCW and Service Water Systems .....'....... 2-8 Zion Risk Evaluation iii

TABLE OF CONTENTS (Continued)

Page ,

2.2.3.3 Pump Room Coolers ........................... 2-8 2.2.3.4 Diesel Containment Spray Pump ............... ... 2-8 ...

2.2.4 Containment Design ....................................... 2-8 2.2.4.1 Strengths of the Zion Containment ............... 2-9 2.2.4.2 Uncertainty Associated with Each Failure Mode ... 2-11 2.2.4.3 Comparison with Other Containments .............. 2-13 2.2.5 Site Evaluation .......................................... 2-14 3

INTRAPLANT COMPARISON ................................................ 3-1 3.1 Dominant Sequences and Insights .................................

L 3-1 3.1.1 Component Cooling Water System Failure ...................

3-2 3.1.2 Loss of DC Bus 112 ....................................... 3-3 3.1.3 Loss of Offsite Power Followed by a Loss of Component Cooling Water or Service W

, 'of ECS Cooling . . . . . . . . . . . ater and RCP Seal LOCA:Loss -

................................ 3-3 3.1.4 Interfacing System LOCA (Event V) ........................

I 3-5 3.1.5 Seismic Loss of All AC Power ............................. 3-6 i 3.1.6 Comparison of Study Results ..............................

3-6 3.2 Uncertainty ..................................................... 3-7 3.2.1 Internal Events .......................................... 3-7 3.2.2 External Events .......................................... 3-7 3.3 Plant Modifications Made During the Staff Review ................ 3-7 3.4 Sensitivity Studies ............................................. 3-9 3.4.1 Sensitivity Studies of Specific Areas ....................

3-9

\

3.4.1.1 Fire ......................... 3-9 3.4.1.2 RCP Seal LOCA ................ ..................

3-9 3.4.1.3 Containment Fan Coolers ......... ...............

........ 3-10 3.4.1.4 Two-Reactor Core Me.lt .................... ...... 3-10 3.4.1.5 Feed and Bleed ............................ ..... ..... 3-11 Zion Risk Evaluation iv

. s TABLE OF CONTENTS (Continued) a Page 3.4.2 Value-Impact Associated with Sensitivity Studies ......... 3-11 3.5 Risk Reduction ard Cost Benefit ................................. 3-12 3.5.1 Prevention ................... 3-12 3.5.2 Mitigation ................... ...........................

........................... 3-13 3.6.2.1 Impact of Mitigation in the ZPSS ................ 3-15 3.6.2.2 UCLA Assessment of Mitigation at Zion ........... 3-16 3.6.2.3 Staff Assessment of Mitigation Features ......... 3-16 3.5.3 Emergency Response ....................................... '3-20 4

CONCLUSIONS .......................................................... 4-1 4.1 Qualitat'ive Interplant Comparison ............................... 4-1 4.2 Zion Risk Insights .............................................. 4-1 4.3 Risk Reduction .................................................. 4-2 4.3.1 Prevention ............................................... 4-2 4.3.2 Mitigation................................................ 4-2 5

REFERENCES .......................................................... 5-1 Appendices A UCLA MITIGATION STUDY

=

Zion Risk Evaluation y

List of Figures Page 1.1 Approach for Zion / Indian Point action ..............................

1.2 1-8 Decision and logic framework ....................................... 1-9 2.1 Comparison of Zion core damage frequency with high density population plants ...............................

2.2 Key support system dependencies .................. ................. 2-16

................. 2-17 3.1' Potential modification to Zion diesel spray train .................. 3-21 List of Tables 1.1 Dominant sequence comparison ....................................... 1-10 2.1 U.S. nuclear power plants for which PRAs hav been performed .......

2.2 Estimated core alt frequency ..............e........................ 2-18 2.3 2-19 2.4 Frequency of core melt with failure or bypass of containment ....... 2-19 Comparison of Zion and Indian Point risk ...

2.5 ZPSS initiating event frequency .................................... 2-20 2.6 Important support system dependencies ................ ............. 2-21 2.7 ............. 2-22 Population statistics between 0 and 50 miles from plant sites ...... 2-23 3.1 ZPSS comparison of core melt and release frequency contributions 3.2 3-22 3.3 Dominant accident sequences identified by Sandia ................ .. 3-23 ..

3.4 Loss of offsite power followed by CCW/ service water failure ..... 3-25 3.5 Comparison of loss of offsite power sequence frequency .......... .. 3-26

.3.6 Estimates of frequency of loss of offsite power .................. . . 3-26 3.7 Estimates of core melt frequency caused by internal events ......... 3-26 Estimates of frequency of severe releases caused by 3.8 internal events .................................................... 3-27 ZPSS estimate of frequency of severe releases caused by external (seismic) 3.9 Sandia/Brookhaven/ events ..........................................

staff core melt frequency estimates with 3-27 and without consideration of fire ..................................

3.10 Core melt frequency estimates with and without consideration 3-27 of RCP seal LOCA ...................................................

3.11 Core melt frequency estimates with and without feed and bleed 3-27 cooling ............................................................ 3-28 3.12 Expected annual societal risks associated with Zion containment failure modes ...................................................... 3-28 Zion Risk Evaluation vi

ACRONYMS AE architect-engineer AFW- auxiliary feedwater ASLB Atomic Safety and Licensing Board ATWS anticipated transients without scram CCDF complementary cumulative distribution function CCW component cooling water CFR Code of Federal Regulations CHRS containment heat removal system DSI Division of Systems Integration DST Division of Safety Technology ECCS emergerycy core cooling system EPRI Electric Power Research Institute

,FVCS filtered vented containment system

.s INEL Idaho National Engineering Laboratory -

IPPSS Indian Point Probabilistic Safety Study loss-of-coolant accident LOCA LWR light-water reactor NRC Nuclear Regulatory Commission NRR Office of Nuclear Reactor Regulation NSAC Nuclear Safety Analy' sis Center NSSS- nuclear steam supply system PCHRS passive containment heat removal system PNL- Pacific Northwest Laboratory PORV power-operated relief valve PRA probabilistic risk analysis PSS Probabilistic Safety Study .

PWR pressurized-water reactor RCS reactor cooling system RHR - residual heat removal .

RPS reactor protection system RRAB Reliability and Risk Assessment Branch RSS Reactor Safety Study RSSMAP Reactor. Safety Study Methodology Applications Program UCLA University of. California at Los Angeles ZPSS Zion Probabilistic Safety Study Zion Risk Evaluation .vii W e

b b ZION RISK EVALUATION AND INSIGHTS 1 INTRODUCTION AND OVERVIEW 1.1 History In recent years, the staff of the Nuclear Regulatory Commission (NRC) has sought clues to determine if a particular reactor or group of reactors poses a disproportionate share of the risk posed by all power reactors licensed to operate by the Commission. Likewise, the staff looks for clues that a partic-ular class of accident sequences may be dominant contributors to risk at a particular plant or group of plants. Where clues to the origin of such domi-nant contributors to risk are founu, this information is used in the alloca-tion of staff priorities, and staff efforts are focused en reducing these dominant contributors to risk.

The particularly high population densities surrounding the Indian Point, Zion, and Limerick sites suggested that these plants might pose such a dispropor-1 tionate risk, if all other factors influencing the risk were equal. Thus, in early 1980 the NRC's Office of Nuclear Reactor Regulation (NRR) established a staff task action plan to investigate the risk and to investigate possible compensatory risk-reduction strategies. As part of this effort, the licensees

- of Zion and Indian Point undertook various studies, and the NRC staff issued certain Confirmatory Orders to these licensees.

In February 1980, the Zion and Indian Point licensees had reported to the staff the results of a 60-day Offshore Power Systems risk assessment. On the

. basis of this study, which attempted to consider plant-specific features, the licensees concluded that special features for mitigation of severe accidents were unnecessary.

However, on February 29, 1980 the NRC issued a Confirmatory

. Order to Commonwealth Edison, the Zion licensee., This Order stipulated that )

both the licensee and the NRC staff would take a number of " extraordinary interim measures" during a review of the Zion facility to determine what measures could be implemented that would further reduce the probability and/or i consequences of a severe accident. The licensee and the staff were to conduct parallel studies of severe accident sequences, phenomenology, and mitigation strategies. The original plan for these studies is shown in Figure 1.1. {

Commonwealth September 1981. Edison submitted the Zion Probabilistic Safety Study (ZPSS) in  !

' (The Indian Point licensees, Consolidated Edison and the Power c Authority of the State of New York, submitted the Indian Point Probabil-istic Safety Study in March 1982.

for Zion and Indian Point is repor)ted in NUREG-0850.The staff review of mitigation fe '

i After the ZPSS was submitted, the staff began a detailed review of the ZPSS and a reanalysis of the Zion risk. The overall review has been coordinated by the Reliability and Risk Assessment Branch (RRAB) of the NRR Division of Safety l

Technology (DST), which was also responsible for the review of the plant analysis. The containment and consequence analysis was reviewed by the Divi-sion of Systems Integration (DSI).

Zion Risk Evaluation 1-1

Contractors assisted the staff in the review of the ZPSS, and the results of their review are in NUREG/CR-3300 Volumes I and II. Sandia National Laboratory, which reviewed the plant analysis, was responsible for Volume I, which was published in May 1984. Brookhaven National Laboratory was responsible for Volume II, which is scheduled to be published in the fall of 1985. These con-tractor reports, the ZPSS itself, input from DSI (Houston, 1984, on containment, consequence and mitigation analysis), independent staff analysis, and additional information from the licensee make up the elements for the consideration of risk at Zion.

The purpose of this report is to use these elements to develop risk insights for Zion and provide a basis for potential risk-reduction recommendations. The intent has not been to confirm all of the revised core damage frequency esti-mates made by Sandia in an absolute sense because of the uncertainties asso-ciated with completeness, data, and modeling; the core melt frequencies deter-mined by Sandia appear to be consistent with other studies within the scope of the analysis performed and appear to be reasonably developed within the state-of-the-art. A discussion of the decision and logic framework used to derive potential recommendations for risk reduction at Zion follows.

The NRR staff is aware of pioneering work by IDCOR and REi on source term reduction, using Zion as a reference plant. The aspects of this work involving updated models of fission product chemistry and deposition models has not been employed in this evaluation. However, the staff has employed modern, state-of-the-art techniques in assessing containment capabilities, so this evalua-tion reflects some but not all of the new information.

1.2 Decision and Logic Framework Throughout the inquiry into risk, the objective of the NRC staff has been to determine whether Zion poses a disproportionate share of the risk posed by reactors licensed to operate by the NRC, and, if so, to fashion a risk-reduction strategy that would bring the Zion risk into line with that of other plants licensed to operate.

It has never been the intent of the staff to arrive at a definitive judgment on the acceptability of the absolute risk.

The decision logic originally proposed in the staff task action plan and detailed in NUREG-0850 centered on comparative risk assessment. In 1980 during the formulation of the action plan, the effectiveness of the contain-ment system in mitigating severe core damage or core melt accidents in light-water reactors generally was regarded as suspect. As a result, the original task action plan called for evaluating a proposed requirement that the effec-tiveness of the containment in mitigating the risk posed by severe reactor accidents be increased 10-fold to compensate for the fact that roughly 10 times as many people live in the environs of Zion than live around the average domestic nuclear plant.

But, as evidence and precedents accumulated, a number of factors led to the use of a decision logic broader than quantitative, comparative risk assessment.

First, the NRC has been conscientious about avoiding undue faith in the quanti-tative precision of probabilistic risk analysis (PRA), whether used in an absolute or comparative sense, and has tended toward more use of the qualita-tive insights into the strengths and weaknesses of safety systems emerging from Zion Risk Evaluation 1-2

s PRAs.

Second, in keeping with a number of recent NRC policy initiatives,* the staff increasingly uses a benefit-cost test to evaluate retrofit requirements. )

! Third, the internal evidence of many of the most recent PRAs--particularly i those of Zion and Indian Point--suggests (1) that earlier PRAs may have I missed important contributors to risk by failing to cover such accident initia-tors as seismic, fire, and storm events, and (2) that earlier PRAs may have been naive in their analysis of containment performance. Fourth, evidence sug-

gests that quantitative, bottom-line risk comparisons between the Zion PRA and earlier PRAs of other plants may reflect differences-resulting from the use of different_PRA methods that are as great or greater than the actual differences in comparative risk posed by the plants. (In short, the signal-to-noise ratio i

in comparing Zion risk estimates with the risk estimates for other plants i developed in earlier PRAs is thought to be poor.) Fifth, it is increasingly clear that the plant-to plant variations in the likelihood of particularly

- serious radiological accidents are large--as large as or larger than the plant-to plant variations in the density of the neighboring population. This informa-tion means that it is less clear than staff once thought that the plants at high population density sites pose a disproportionate societal risk.

Other factors are the Commission ruling on a.similar matter at Indian Point, and the Severe Accident Policy. These factors have led the staff to diversify l the decision logic in its analyses, in this instance, to develop a wide variety of perspectives on the desirability of retrofits to reduce the offsite

radiological risk posed by Zion.

The decision logic used in this study has been broadened to include the considerations shown in Figure 1.2. These include quantitative and qualitative inquiries intorisk.

comparative interplant comparative risk, absolute risk, and intraplant That is, consideration is given to the comparative impor-tance and character mightbesubject. From of the many severe accident scenarios to which the plant the results of these considerations, mechanistic conclu-

of design and operation. how the risk posed by the station relates to specifics sions can be drawn about In addition to deciding to use a broader decision logic than originally planned

the staff also has discarded the original task action plan proposed to require ,

a 10-fold improvement in the effectiveness of the Zion containment to compensate for the-high population density. This was done for several reasons. First, the l! Zion containment, as built, has many of the qualitative attributes of good con--

tainment performance that would be expected to result from mitigation retrofits.

4 Core melt accidents in an initially intact containment that has one or more operable containment heat removal systems are now expected to be well contained and to pose negligible offsite radiological risk. Second features-present at Zion aid in the prevention of severe a,ccidents.several These plant design include the offsite. and onsite power systems and the high pressure injection system.

. expenditures Third,to thealterabsolute the containment.risk, as assessed, is too small to warrant large containment performance have attendant risk

Fourth, possible retrofits to improve the improvements may reduce releases.in some accident scenarios but increase them in others. Fifth, 1-

• These: include the NRC's decision to voluntarily adhere to Executive Order 12291 (Federal Register, February 19,1981) the establishment of the NRC Committee i

.to Review Generic Requirements, and recent NRC policies on requiring backfits.

Zion Risk Evaluation- 1-3

A j' although it was once believed that planning how to mitigate the effects of an accident requires less knowledge about the precise nature of the accident i sequences than does planning how to prevent an accident, this_ idea is no longer held. It is as difficult to ensure that a mitigation improvement will really ,

• work as it is.to ensure that a prevention improvement will really work. Sixth, i

concepts for preventing accidents (prevention improvements) have been found i

that are much more economical than most conceptual mitigation improvements.

Seventh, it is now. understood that in the safety profile of nuclear power plants, economic risk is large compared with health risk. Prevention is effec-1 tive in reducing both. economic and health risks, whereas mitigation is.ineffec-

[

tive in reducing economic risk. Thus, strong incentives favor prevention over

. mitigation in reactor risk-reduction strategies. l 4-In considering the need for improvements, one can identify vulnerabilities by studying the dominant core melt and risk sequences and understanding the analytical bases behind these estimates, including the data, models, assumptions, j and uncertainties. Risk-reduction options can then be considered for the

vulnerabilities by estimating the percent of reduction and cost-benefit and 4 by evaluating the uncertainties.

j 1.3 Conclusions

The Zion Probabilistic Safety Study (ZPSS) is a comprehensive assessment of-

the risk at the Zion site, consistent in scope and detail with PRAs of its t vintage. Its treatment of external events and the containment analysis repre-l sent advancements over past work. Special consideration was given to displaying 1 j uncertainties and utilizing plant specific data. Using the' staff's.own defined.

decision and logic framework, the staff has been able to use the ZPSS, with some modifications, as a source document in considering risk reduction.  !

The staff concludes that Zion poses no undue risk to public health and safety.

l- This conclusion does not depend upon the continued enforcement of the Directors Order of February 1980. Those few clauses of the Directors Order that significantly affect our risk evaluation are complete or covered by other requirements (L. DelGeorge, _ September-1981; C. Reed, January 1984).

The staff has identified two modest changes in design and operation that would i be of material value in reducing dominant contributors to risk. Their imple-mentation is supported by the decision logic described above,-and are consis-i tent with the prevailing NRC policy on backfitting operating reactor (NRC Manual). The staff concludes that these improvements, described in 1.3.3 below, are reasonable, prudent, afford substantial additional protection of; 4

public health and safety and warrant implementation.

4 d

1.3.1 -Qualitative Interplant Comparison

) ' By breaking down a PRA into its key segments--systems analysis , containment l

p analysis, and site consequence analysis--one can make qualitative interplant comparisons. The staff review of the Zion plant systems indicates-that the Zion units have strengths in the area of the response of plant systems to i

transients and small-break loss-of-coolant accidents (LOCAs). The staff has i

likely to contain most core melts, should they occur, resulting in a signifi-cant reduction in the magnitude of offsite consequences. For Zion, the site j i

1 also determined that large, dry containments (such as the Zion containment) are-b j ' Zion Risk Evaluation 1-4 l l 1

._. .u - . - - . _ . . . -. __ .. ... . _ . . . - _ , _ - _ _ _ _ _ - . _ _ _ , . , - _ _ - -

. o i

I I

l- characteristic obviously most important is the population density around the plant, which is at the high end of the population spectrum for plants licensed by the NRC.

r-4 1.3.2 Zion Risk Insights i

Table 1.1 compares the dominant accident sequences in the ZPSS with those i developed by the staff and its contractors, Sandia and Brookhaven. The ZPSS

i. estimates a total core melt frequency of 7x10 5/yr, with no single sequence j risk above 1x10 4/yr. ZPSS estimates the dominant core melt sequence to be a small LOCA with a failure of emergency core cooling system (ECCS) recirculation;

.the frequency of this sequence is 1.6x10.s/yr. The ZPSS estimates that a seismically initiated loss of all'ac power dominates the risk. Based on the

Sandia review of the ZPSS and additional information provided by the-licensee subsequent to this. review, the staff estimates the total core melt frequency

. to be 1.6x10 4/yr. The loss of component cooling water.is estimated to' dominate at 1x10 4/yr. Some loss of component cooling water events would 4

affect both Zion units because the systems are cross-connected. The loss of I offsite power initiated sequences are estimated to be more-significant than in ZPSS. The frequency of core melt from these sequences is estimated to be ,

5x10 8/yr. The staff review indicates that an interfacing systems LOCA (Event i

V) is about an order of magnitude more:likely than the ZPSS estimates because the residual heat removal (RHR) suction valves from the reactor cnolant system are not tested, as the ZPSS assumes. Although the seismically induced loss of:

I all ac power remains a dominant contributor, design-basis earthquakes (.17g) have a very small probability of causing loss of all ac power; earthquakes

• with ground accelerations between 2 and 3 times the design basis ground acceleration contribute the greatest portion of the seismic risk.

. 1.3.3 Risk Reduction >

! 1.3.3.1 Prevention i

j

^

A formal search for additional preventive actions was not within the scope of

the staff review; however, two items identified in the review have been corrected voluntarily by the licensee, which should help prevent a core melt accident. '

1-These items are (1) opening the normally closed power-operated relief valve (PORV) block valves and (2) improving the testing of the safety system room coolers.

Continued testing of RHR system check valves (as required by the Order (Denton,~1980).and agreed to by the licensee) should reduce the probability

of an interfacing systems LOCA. The staff recommends the testing of the RHR suction-valves'as well (as was assumed in.the ZPSS) to reduce the likelihood l

i of their failure. Cost-benefit calculations utilizing a rate of $1000/ person-rem of public. radiation dose avoided ~as a measure of cost effectiveness j'

indicate that-this testing is cost-beneficial if the testing costs less than

$450,000; the staff crudely estimates the cost of the testing at about $40,000.

Moreover, the staff should expand the review according to the criteria in Appendix R (Fire Protection) to Title 10 of the Code of Federal Regulations

.Part 50 (10 CFR 50). The review should determine'if the--10 CFR 50 Appendix R measures already taken or planned at Zion consider.the core melt sequences identified in the Sandia review. These sequences include postulated fires in 4

i. Zion Risk Evaluation- 1-5 I ,,

the. cable spreading. room, which could lead to a loss of all auxiliary feed-water, high pressure injection, and containment cooling.

Several procedures and related training required by the Order should aid in preventing a core melt accident. These procedures are now being implemented within the context of the new symptom oriented emergency procedure guidelines.

These include procedures related to station blackout, and loss of all feedwater.

1.3.3.2 ' Mitigation When the question of disproportionate risk was first raised regarding Indian Point and Zion, studies of additional mitigation features were begun. On the basis of these studies, the staff has reached five major conclusions as follows:

(1) The mitigation capabilities originally proposed as candidate backfits in the task, action plan are already present to a large degree in the large, dry containments at Zion.

(2) Although a filtered-vent system or a passive heat removal system would be effective in reducing the risk from some (but not all) core melt accident scenarios, such a system is unlikely to be cost effective. .

(3) Additional risk reduction from a core. retention device would not be effective in lowering the risk, nor would_it be cost effective. "

(4) Low cost systems to prevent containment failure caused by the burning of combustible gases are not likely to be-cost effective, but this is not clear because much uncertainty surrounds this evaluation. Because the Zion containments are not any more susceptible to hydrogen burn failures than are any other large, dry containments, examination of hydrogen control for containments of this type should be considered generically in ongoing NRC research programs.

(5) Modifying the diesel containment spray pumps so they can run and provide spray without ac power will increase the probability that containment integrity will remain intact after a core melt accident and an extended loss of ac power. In evaluating costs versus benefits, the staff considered a rate of $1000 cost per person-rem of public radiation exposure cvoided to be a measure of cost effectiveness. Cost-benefit estimates utilizing a $1000/per person-rem algorithm indicate that this particular modifica-tion is cost beneficial if it costs less than $1.5 million dollars per unit,~and if it does not affect the seismic qualification of the ,

diesel-driven containment spray pump. In addition, the modification would decrease the early fatality risk by 20%. Because the diesel contain- l ment spray capability (pump and hardware) already exists, and because .

component cooling water and service water problems could potentially affect '

-both units, the staff considers that this modification would be prudent. l

.1.4 Uncertainty There are large uncertainties associated with estimates'of core melt and risk in any PRA including the Zion PRAs done by both the licensee and the staff.

Sources of uncertainty can be grouped into four general areas: statistical,

-lion Risk Evaluation 1-6

o . i modeling (assumptions such as human error, common cause models, and others),

omissions, and computational. Each of these types of uncertainties is i

applicable to the various PRA segments discussed in this report--the core '

melt sequence estimates, the containment analysis, the source term, and the site / consequence analysis. In considering uncertainties in this report, the staff has tried to provide some qualitative insight in each of these various PRA segments rather than to propagate numerical estimates of uncertainties all the way through to the overall risk estimates. For example, in making the core  ;

i melt sequence estimates, Sandia estimates the sequence statistical uncertainties and uses sensitivity studies to clarify some key modeling assumptions. These

, assumptions include the reactor coolant pump seal LOCA assumption feed and bleed cooling, and containment' fan cooler performance in a severe, accident environment.

An excellent discussion on uncertainties, which pertains directly to this review, is on page 78, " Uncertainties in Risk Estimates", in Section II. A of the Indian Point ASLB recommendations to the Commission (NRC, 1983). The Indian Point ASLB points to two major omissions in the Indian Point PRA that may cause the risk estimates to be low. These omissions, which also apply to Zion, are sabotage and the effects of equipment aging. The ASLB also points out the tendency for modeling assumptions to be conservative (some argue they offset the major omissions) so that the estimates may be high. However, neither the ASLB nor the staff presumes this to be the case.

In the discussions of comparative risks and dominant sequences that follow, -

the staff summarizes the numerical-best estimate results of its review. One should use caution in drawing conclusions from these numerical estimates because the uncertainties associated with their derivation (models, data, etc.) and the uncertainties associated with incompleteness are substantial.

The more important use of this report, rather, should be from the insights gained and the value of potential improvements considering these uncertainties.

Because of these uncertainties, it should not be surprising that some of the insights or inferences to be drawn from a PRA, even a particularly good one,

>' may not be trustworthy. The inferences may depend upon parts of the model that are no better than rough approximations. On the other hand, some of the inferences to be drawn from a PRA may rest soundly on a logical modeling framework, and, on close examination, may prove to be unassailable.

These observations about the strengths and weaknesses of PRAs led the staff (during the ASLB hearing on the risk posed by Indian Point) to propose a guide-line for the reliable use of PRAs: each inference from a PRA to be considered for use in regulatory decisionmaking should be regarded as a hypo-thesis to be tested, rather than as an article to be believed or disbelieved on the basis of the pedigree of the PRA. One should attempt to identify the assumptions to which the inference is sensitive,-and weigh the evidence behind each of these critical assumptions. Alternatively one mi which the inference would go the other way,ght catalog and test the circumstances the evidence against thein contrary hypothesis. In any case, an inquiry into the relevant sources of uncertainty should be made for each PRA inference, in the immediate context of the inference and its pro This has been done for this case, posed role inthe and supports regulatory decision conclusions making.

summarized above.

Zion Risk Evaluation 1-7

8 I

e N. .

$ (WO ACTIVITIFS g iN PA H A 1.1.EI. UTil.ITlyt.@Y n , ,,n,i,,,,.,

==

a W

E E WITIG ATION 31yg ygx pgNol.0GY "

c FEATilkt3 -b  ?

g STuuY caCll ANtit' WirHNUs I NTElt l M STA l'P g .

lit:l'OllT n M*

2 m

u. qP j > v.

g pg Feesuses NitC STUDY g ...n

.- m.

v..

s -D Hi-QUIHt:

..... ............... ... . ..... . .. . . .. ... .. ... .. . .............. .. . . i

_, MITIG ATION kb iTATUHE ON Z/IP

, 'i' Z/IP PilOllAHAl.lSTIC lilSK ASSOSSMENTQ'H A)'ITill "l/IP COMI'I II'E l RISK > itI:POlrl. - M ini,'alue srun.

A N A l.YSIS (l't.G) 3/88" 1P i f 4 Ves a COMPl.LTE

-> ltEPOHT -> rosn zfn-NitQ ltl'Vil:W & I:VAI.tlATION i,p ,bog, arisoN INio (OPS) 8"'I l'M A K I NG

,s.

Nat' I AClloM ON telTIClLNLild i

• 1 NOV 1979 Fell 1900 JtfM E 191Kl AUG 19til NOV 19:11 l'Al.i. WI NTl:lt 19111 -d t-  !

= t

}

Figure 1.1 Approach for Zion / Indian Point action  !

I i

o

Does Zion prasInt disproporticnato risk?

N Are risk reduction features necessary? .

S '

5 -

E- Interplant Comparison i IntraplantReview m Is societal risk above average?

$ Is individual risk above average? I c

Identify Dominant Sequences

" [ _

quantitative PRA Qualitative Design Core Melt l Comparison Comparison Risk l lo o is core melt frequency Is risk reduction -

reduction available? achievable?

T Identify sequences > 10 4 Risk

/N Cost

• Uncertainty ,

Reduction Benefit  !

MitigationI N7 Design '

lPreventionj [ Operations l 4

lEmergencyResponse P

i t

. I i

Figure 1.2 Decision and logic framework

{

l  !

I n -

Tcblo 1.1 Dominint s2quence comparisen*

N

??

= .

! gg ZPSS Sandia/Brookhaven/ Staff Early Core damage Person- Core damage Early Person-

(( Sequence frequency fatalities ** ren** frequency fatalities ** rem **

E Component cooling water Notet 0 Notel ~2x10 4 Notel 40 failure a

((

Loss of offsite power 9x10 7 5.8x10.s 8.6 1.2x10 4 Notel 155 Small-break LOCA with ECCS 1.6x10 5 0 8.8x10 2 1.6x10 5 Note '

l 2 .

recirculation failure Large and medium LOCA 9.8x10.s 0 5.4x10 2 9.8x10 s Note 8 1 of Tiflure of a dc bus Note 8 0 Note 8 7x10 8 Note 8 1  ;

Seismically induced loss 5.6x10 8 1.6x10 4 241 5.6x10 8 6.4x10 4 144  ;

of all ac power Event V 1x10 7 3.9x10.s 4.3 ~1x10 s 6.2x10 4 28  ;

Tota 12 6.7x10 5 1.7x10 4 256 3.7x10 4 1.3x10 3 375 Internal events 5.7x10 5 1x10 8 15 3.6x10 4 6.2x10 4 231 External events 3 1x10 5 1.6x10 4 241 5.6x10 s 6.4x10 4 144 i Tota 12 6.7x10 5 1.7x10 4 256 3.7x10 4 1.3x10 8 375

• per unit per year

• • estimated out to 500 miles for each unit per year .

i Notes: ,  ;

8Not significant. "

2 includes other sequences in 10 s to 10 7 range not shown here.

aThe Sandia/Brookhaven/ staff estimates do not include fire sequences.

• 9 i

2 INTERPLANT COMPARISON 2.1 Quantitative Comparison Currently, probabilistic risk analyses (PRAs) have been published for at least 13 nuclear Table 2.1) power plants in the United States. These 13 plants (listed in represent the full range of designs that have been built in the United States. Four of these plants (Indian Point 2 and 3, Zion, and Limerick) are surrounded by areas of the highest population density.

A significant amount of reliability and risk information bearing on the ques-

' tion of comparison of various nuclear power plants has become available. How-ever, helpedthis comprehensive information has posed as many new questions as it has to answer.

Questions concerning expanded scope, consistency of approach, adequacy of data, level of detail, and analytical quality assurance are being raised, suggesting areas where comparison between studies could be faulted.

The state-of-the-art of PRA is evolving rapidly and continuously. Large amounts of resources in both private and government research are being expended to improve PRA methods and data.

Figure 2.1 compares the estimate of core damage frequency for the four plants in the areas of highest population density, showing the range of uncertainty.

It should be noted that the PRAs for these four plants evaluated both external and internal events.

Table 2.2 compares the core melt frequencies for the Zion and Indian Point plants, as estimated in the PRAs submitted by the licensees, in the staff /

contractor review, and in NRC staff Indian Point hearing testimony after cer-tain " fixes" had been done.

The similar Indian Point PRA and the Zion PRA were produced by the same contractor using methodologies. In addition, both were reviewed by Sandia. The Indian Point ASLB also stated, in its recommendations to the Commission, that the only

.PRA the ZPSSthat.could be " compared" to the Indian Point Probabilistic Safety-Study was (NRC, 1983).

. It should be noted that the staff has not checked all aspects of each PRA and its associated review for consistency.

The overall internal event core melt frequencies estimated in the PRAs are

• i within a factor of 2 of each other. The Indian Point Unit 2 external event core frequencymelt frequency at Zion. is about a factor of 7 higher than the total core melt well as some at UnitThe vulnerabilities

3) were corrected, associated with estimates and the revised this difference cated. The revised estimates for total core melt frequency are close to the (as are indi-total Zion estimates; however, the external event core melt frequencies at Zion are estimated to be less than those at Indian Point. (The Zion estimates do not include' core melt from fires because only bounding analyses have been done to date.)

~

Zion Risk Evaluation 2-1

one needs to look at more than core melt To move because frequency, towardnota risk comparison, all core me lt consequences are likely to be severe respect to death, injury, or cancer. A better indicator would be the frequency of a " severe release" (that is, a release that has the potential for significant health effect impacts). Such a release would be associated with core melt sequences for which the containment is not effective in preventing the release, possibly because of the failure of the containment cooling systems or a bypass of the containment (interfacing systems LOCA). However, because of the dissimi-larity of the containment analyses on the PRAs listed in Table 2.1, the staff does not think such a comparison would be very meaningful.

The Zion and Indian Point containment analysis methodologies are similar, so a comparison of the frequency of the events for these units (Table 2.3) does have some meaning. The frequency of internally initiated severe releases is quite low at both Zion and Indian Point, with the frequency at Indian Point appearing to be lower. Comparisons of the results indicate that the vulnerability to external events at Zion may be less than that at Indian Point. In the Zion PRA, only seismic events contributed to frequency of external event severe releases. In the Indian Point PRA, seismic, wind, and fire events were sig-nificant contributors.

The comparisons in Tables 2.2 and 2.3 consider frequency of relase only.

• Table 2.4 shows a more detailed comparison of differt it risk inditS for Zion and Indian Point; this comparison considers the specific types of release for different sequences, site characteristics, and evacuation assumptions. -

As the comparison in Table 2.4 shows, the Indian Point damage estimates (comple-mentary cumulative distribution function (CCDF) integral values) are higher than the Zion estimates, primarily because of the greater estimated vulnerability of the Indian Point units to external events. (It should be remembered that the estimate uncertainties are large.) The Zion estimates do not include a contribution from fire because Sandia found the ZPSS fire analysis incomplete.

Although Sandia included a-separate worst case fire analysis in NUREG/CR-3300 (Section 4 of Vol I) to provide an estimate of the potential impact of fire on risk, the staff has not included this estimate in its comparison because this is a bounding sensitivity study. However, if the bounding estimates are included, the early fatality risk would not change, and the other estimates would still be~in the range of risk at Indian Point 3 (after modifications have been made).

2. 2 Qualitative Comparison

• l

' Although quantitative comparisons of PRAs cannot be made because of the many methodological differences, the staff has attempted to assess the Zion units '

qualitatively so some general comparisons with other plants can be made. This discussion describes what the staff has learned about the design of the Zion units with respect to (1) the expected frequency of transients and accidents and (2) the capability of the plant systems to respond and prevent core damage.

This discussion also addresses the capability of the Zion containment system to mitigate the consequences of core damage accidents should they occur. On the basis of the discussion, the Zion plant is then compared qualitatively with other plants that have been analyzed.

Zion Risk Evaluation 2-2

- - w-- + ,en=.-* , - - -

T- y- r-

I The detailed PRA done by the licensee (Commonwealth Edison) and reviewed by Sandia, Brookhaven, and the staff provides a framework for considering the design aspects of the Zion units, in an overall sense, with respect to individ-ual systems and, very importantly, for considering the system dependencies that run through the plant. The specific aspects that will be addressed are Initiating ~ Event Frequency Plant Systems Support Systems and Dependencies Containment Design Although site characteristics are not part of the " design," they also will be addressed.

2.2.1 Initiating Event Frequency The ZPSS provides a considerable plant-specific data base for all types of events. The initiating event frequencies are summarized in Table 2.5.

As part of its effort, Sandia reviewed this part of the ZPSS and made compar-isons with other PRAs that have been completed. Sandia concluded that the ZPSS frequencies generally appeared to be consistent with other probabilistic analyses. The most si large LOCAs; however, thegnificant difftrence difference results appears to be solely from thethe frequencyofof application the two-stage Bayesian methodology using as data the fact that there are no large LOCAs in operating exper.ence to date. The difference is certainly not an indication that the likelihood of a large LOCA is higher at Zion than at other plants; it is merely that the Zion analysts are expressing their uncertainty regarding the estimate of frequency of a large LOCA.

Three initiating event frequencies stand out as being important in the Zion review. These events and their estimated frequencies are:

Loss of Offsite Power 0.08/yr Loss of Component Cooling Water 9.4x10 4/yr Loss of a DC Bus 0.28/yr Each of these is addressed separately below. '

2.2.1.1 Loss of Offsite Power The frequency estimate for a loss of offsite power is important because it can lead to a risk-significant sequence. In the ZPSS, this estimate was derived by combining the Zion experience (no losses of offsite power in about 11 years) with the generic. experience in the United States. One needs to be ver in assessing the' frequency of loss of-offsite power because grouping or not (y careful l grouping) plants considering plant-specific switchyard characteristics, grid characteristics, and operating experience can significantly affect the estimate.

The Zion offsite power system has a ring bus linked to six offsite power sources as well as to the two Zion station generators. The ZPSS estimate (0.08/yr) is low compared to the estimates in WASH-1400 (0.2/yr), the ANO-1 PRA (0.32/yr), i l

t Zion Risk Evaluation 2-3 l

4

! i and the work'on Generic Issue A-44 in NUREG/CR-3226 (0.092 local and 0.026 area-wide).

On the basis of the staff review of the'ZPSS, the work done by the Electric

~

Power Research Institute (EPRI) (EPRI, March 1982), staff comments on the Zion design,_and Sandia's review, the staff finds that the Zion plants are better i

than the average with respect to the likelihood of a loss of offsite power.

2.2.1.2 Loss of Component Cooling Water i

i i The loss of component cooling water (CCW) event, without recovery, could lead ,

directly to core damage. Assuming (1) a loss of reactor coolant pump seal  ;

integrity as a result of the loss of _CCW and (2) a failure of the ECCS the CCW cools the safety injection and charging pump bearings), a core elt m(because could result if there were no makeup for the lost reactor coolant. Therefore, i

the core damage frequency estimates are directly influenced by the initiating event. frequency (and, of course, the assumptions regarding seal-failure,_ECCS performance, and potential for recovery, which are described below). The i

j original.ZPSS estimates the loss'of CCW frequency to be 9.4x10 4/yr for pipe -  ;

break; however, this frequency is derived in the same way as the large LOCA  !

frequency _(that.is, by the two-stage Bayesian methodology). The licensee j recently submitted a revised esti nte influenced by the beliefs (1) that the original estimate included leaks (see WASH-1400) and (2) that, in fact, only

6% of the estimate would be " ruptures."

,i i

Sandia used the original ZPSS estimate (which comes from WASH-1400) in its i estimates, identifying that estimate as possibly conservative.

(This belief is supported by the NRC Office of Research (Ernst, September 1983). As dis-cussed below, this sequence dominates the core damage frequency estimate.

i i ~

i Because there is a lack of low pressure pipe break data, the NRR staff regards 5 both frequency estimates with skepticism, because neither is justified suffi- ,

ciently and the associated uncertainties are large. The ZPSS anal 1 stated that they would not have used what the 4

mate in their original analysis (9.4x10 4/yr)y call if they had modeled the ECCS- a "esti-break screening" y

] CCW cooling dependency, which they did notg I

Thestaffhasnoreasontobelievethatthelikelihoodoft$eCCWpipebreak j event at Zion is different from the likelihood of this event at other PWRs.

However, as discussed below, because the CCW and service water systems are cross connected between the Zion units, pipe break events and other losses may affect both units. Newer plants would have two separate trains of CCW so

• that a postulated break may only affect one CCW train. .

l 2.2.1.3 ' Loss of a de Bus j

j The Sandia review found this event to be important because it could lead to.a loss of main feedwater control 1 auxiliary feedwater (AFW) pump' power and s control theand power failure one of one motor-driven power-operated relief valve (PORV) solenoid. Without recovery of the de bus or local operation of

.! the failed components, with the conditional failure of the turbine-driven and motor-driven AFW pumps, and with the conditional failure of feed and bleed with i one PORV, core damage could occur. The ZPSS estimate for failure of the dc t

i t,

Zion Risk Evaluation 2-4 1

l

~

bus, 0.28/yr, is higher than qther estimates the staff has seen. For example, the ANO-1 integrated reliability evaluation program (IREP) estimates a factor of 10 lower, and Draft NUREG-0666 estimates a generic frequency of 6.7x10 3/yr.

The NUREG-0666 estimate is based on a review of licensee event reports (LERs) and on actual operating experience at reactors in the United States. The ZPSS estimate is based on Zion plant-specific operating experience.

Sandia reviewed the Zion reactor trip data in the ZPSS for the period between 1974 and 1979 and found that dc bus losses occurred at about the rate of the ZPSS estimate during this period at both units. The data also indicate that most bus losses were restored quickly. In addition, the staff learned that training, improved procedures, and mimic bus switchboard displays that were added to help the operators have contributed to a decrease in the number of these events.

2.2.2 Plant Systems The plant systems important in a safety analysis can be grouped as follows:

Decay Heat Removal Inventory / Makeup Reactivity Control Each of these groups can be further subdivided into front-line systems that carry out these functions, as follows:

Decay Heat Removal Main Feedwater and Power Conversion System Auxiliary Feedwater System Feed and Bleed Cooling (also controls inventory)

Inventory /Makuo LowPressureInjection High Pressure Injection - Charging Pumps and Safety Injection Pumps l Reactivity Control Reactor Protection ~ System ECCS (Boration) - Charging Pumps and Safety Injection Pumps 1

l Certain support systems are vital to each of the above systems / functions and to dependencies between systems. They include the de power, ac power, component l

cooling water, and service water systems. These systems are addressed in Sec-tion 2.2.3.

2.2.2.1 Decay Heat Removal (1) Main Feedwater and the Power Conversion System: Zion uses two (one-half-capacity) steam-driven main feed pumps for normal feedwater delivery to Zion Risk Evaluation 2-5

the steam generators. A third one-half-capacity motor-driven pump is used for startup and reserve. Procedures exist at Zion for the recovery of main feedwater following plant transients. (Such procedures were required by the Order and are now being implemented as part of the symptoir oriented emergency procedures.)

(2) Auxiliary Feedwater System: The Zion desi (100%) pumps and one turbine-driven (200%)gn pump. includesdescriptions Detailed two motor driven are in the Zion FSAR and in Section 1.5.2.3.9 of the ZPSS. Tha ZPSS reli-ability analysis estimates show the AFW system to be very reliable.

Although the Sandia review estimates indicate a little less reliability, that review concludes that the Zion AFW system is reasonably reliable and well within the range of reliabilities estimated for many of the pressurized water reactor (PWR) AFW systems in nuclear power plants in the United States (see Table 2.4-3, in Vol. I of NUREG/CR-3300). In this review, the staff noted that NUREG-0611 (the staff review of Westinghouse-designed plants) indicates that Zion has a below average AFW capability for an event involving a loss of ac power. This conclusion was reached because the turbina-driven AFW pump was dependent on ac power; however, this dependency has been eliminated.

(3) Feed and Bleed Cooling: This capability to remove decay heat would be utilized for a loss of all feedwater (main and auxiliary) and some very small LOCAs. Although it is acknowledged that this capability exists at i most mode.

PWRs, this capability does not constitute a licensing-basis cooling Three basic factors are needed to achieve successful cooling: feed capabilityfromthechargingorsafetyinjectionpumps,bleedcapability with the pressurizer PORVs (depressurization capability also) or safety valves, and, of course, the operator's manual control and initiation of the process.

On the basis of the ZPSS analysis, the Sandia review, and its own analysis, the staff has found that the feed and bleed capability is viable from a thermal-hydraulic standpoint. Zion has two 550 gpm charging pumps with a shutoff head

of 2670 psi 1520 psig. g, and two 650 gpm safety injection pumps with a shutoff head of  ;

The licensee has also implemented procedures for the operator to use this mode of cooling should it be necessary. (Zion also has a 200 gpm positive displacement charging pump that is not modeled in the ZPSS.) l

. l

\

Overall, because of Zion's high head charging pumps and associated procedures, the staff finds that Zion is likely to be as good or better than most PWRs with respect to this backup cooling mode.

2.2.2.2 Inventory / Makeup The high pressure to respond and low to a spectrum pressure safety injection systems at Zion are designed of LOCAs.

system incudes four pumps: As stated above the high pressure injection two 550 gpm charging pum,ps with a shutoff head of 2670 psig. psig, and two 650 gpm safety injection pumps with a shutoff head of 1520, The two sets of pumps, with parallel suction paths'from the refueling water ment. storage tank (RWST), provide a very good high pressure injection arrange- j The low pressure injection system also includes two 3000 gpm RHR pumps. '

All pumps are cooled by component cooling water. (This becomes important for Zion Risk Evaluation 2-6

the high pressure pumps, which are assumed to fail quite rapidly if CCW is lost. The liccasee believes that the RHR pumps can function without CCW cooling in the injection mode while pumping low temperature water from the RWST.)

The switch to recirculation cooling from the containment sump following a LOCA would be done manually at Zion. Many plants switch automatically.

Overall, the staff finds that once the high pressure makeup capability at Zion is actuated, it is better than at many plants. However, this capability at Zion is limited because (1) the switch to cooling must be done manually, and (2) it is dependent on CCW cooling, because the loss of CCW could potentially cause a loss of reactor coolant pump seal integrity and a small LOCA in conjunc-tion with a loss of high pressure injection.

2.2.2.3 Reactivity Control .

The reactivity control system most important to safety is the reactor protection system. Much work has been done regarding Westinghouse reactor protection systems since the Salem reactor protection system (RPS) failed in February 1983.

The ZPSS provides detailed plant-specific failure data for Zion (page 1.5-54).

Recorded there are five breaker failures: two at Unit 1 and three at Unit 2.

Considerin of1.8x10g/ demand.these breaker failures, the ZPSS estimates an RPS unavailability Sandia also uses this ZPSS estimate in its analysis.

However, there are two other aspects that are important regarding the Zion reactor trip breaker unavailability estimates. First, from discussions with the licensee, the staff has learned that there have been no breaker failures since 1979 when a recommended Westinghouse reactor trip breaker maintenance procedure was initiated. Second, NRC Generic Letter 83-28 requires imple-mentation of a vendor-recommended reactor trip breaker modification that will automate the shunt coil on the trip breakers.

The staff has assumed that the work done since the Salem event, plus the actions taken by the licensee since 1979, will bring the reliability of the reactor protection system into the range assumed by the staff for generic evaluations of Westinghouse plants (NRC, 1983). These evaluations assume a failure-to-scram probability of 3x10 5/ demand for Westinghouse reactors.

2.2.3 Support Systems and Dependencies The support systems important in this review are de power, ac power, component cooling water, and service water. The relationships of these systems to each other and to the front-line safety systems are shown in Figure 2.2. A corres-ponding list is in Table 2.6.

With respect to onsite emergency ac power, each Zion unit has two dedicated diesels. An additional " swing" diesel can serve either unit.

The staff finds that. Zion's capability to cope with loss of offsite power events (including the cross-connections of the CCW and service water systems) is better than the capability of many PWRs. This conclusion is based on the staff's understanding that, after a loss of offsite power, two cf the six service water pumps and one of the five CCW pumps will provide adequate cooling to their associated heat loads.

Zion Risk Evaluation 2-7

The treatment of support. system dependenc'ies is very important. Once all the support system dependencies have been identified, it can still be very difficult to predict the point of front-line system failure, because the dependent system may operate outside its design basis for some time without an operable support system. The degree of operator recovery is also difficult to assess.

On the basis of PRA work to date, it is not possible to directly compare Zion's support system dependencies to those of other plants because there are so many plant-to plant differences. It also should be noted that most PRAs to date have not treated the reactor coolant pump seal LOCA dependency (nor did WASH-1400). Overall, the staff finds that the assumptions made regarding such dependencies tend to be conservative (that is, a reactor coolant pump seal LOCA at a rate of 300 gpm per reactor coolant pump in 30 minutes upon loss of CCW).

The key dependency aspects identified in this review are: reactor coolant pump seal LOCA, shared CCW and service water systems, pump room coolers, and diesel containment spray pump.

2.2.3.1 Reactor Coolant Pump Seal LOCA The reactor coolant pump seal thermal barriers are cooled by CCW, which is cooled by service water. The seals are also cooled by seal injection from the

% charging pumps. CCW also cools the charging, safety injection, and low pressure injection pumps. Both the CCW and service water systems are ac dependent.

2.2.3.2 Shared CCW and Service Water Systems The CCW system and the SWS are cross-connected between Units 1 and 2 providing addition:.1 redundancy but allowing events that affect either system to affect both unit.s.

2.2.3.3 Pump Room Coolers ,

The service water system provides cooling to the RHR, safety injection, contain-ment spray, and charging pump room coolers. The room cooler fans are energized when the pumps are actuated (cooling water is normally valved in). In its review, Sandia found that the surveillance procedures did not explicitly address fan operability. The licensee has voluntarily revised the surveillance procedures (Lentine, May 1983).

2.2.3.4 Diesel Containment Spray Pump The containment spray injection system includes three pumps, one of which is diesel driven. The cooling water supply to this diesel is dependent on operation . .

of the ac-driven service water system.

2.2.4 Containment Design The following subsections assess the ability of the Zion containments to withstand the energetics associated with core meltdown and the uncertainties associated with the various potential containment building failure modes, and they compare the ability of the Zion containments to withstand core meltdown accidents to that of other containments.

Zion Risk Evaluation 2-8

e i

2.2.4.1 Strengths of the Zion Containment An important measure of the strength of a reactor containment is the effective-ness with which an initially intact containment can contain core melt accidents. -

A reactor containment might fail at the time of core meltdown because of une of two mechanisms, a pressure spike or an internal missile.

(1) Pressure Spike: The pressure within the containment may rise sharply at the time of reactor vessel meltthrough from one or a combination of the following effects: (1) steam and compressed gases released from the reactor coolant system; (2) steam generated if the molten core falls into a pool of water in the reactor cavity; or (3) hydrogen in the containment atmosphere burning because it is ignited by the molten core material.

\

The staff has concluded that these mechanisms will not cause the Zion containments to fail although PRAs of other plants have suggested that these failure mechanisms may be important to risk at other plants, parti-cularly those with smaller or weaker containment buildings. This is a very significant strength of the Zion containment and, as a result, there is a low probability that the containment would fail soon after the vessel failed. This low probability significantly reduces the risk associated with core melt accidents.

(2) Internal Missiles: A mechanism has been postulated by which the core meltdown process might generate reactor vessel missiles that might breach -

containment. This mechanism is a steam explosion as the molten core slumps into the water remaining in the lower hemisphere of the reactor vessel.

Molten core material poured into water may, in principle', give rise to explosive boiling of the water. However, recent theoretical and experi-mental analyses suggest that although steam explosions can take place, they are unlikely to approach the energy needed to burst the reactor vessel. In addition, the staff has found that ex-vessel steam explosions of sufficient magnitude to fail containment are also of very low probability.

For those accident sequences in which either or both containment heat removal systems are functional, the containment is predicted to be successful in retaining the fission products released to the containment atmosphere. Only a very slight leakage is predicted, and the offsite radiological risk is negli-gible. Although in these sequences, containment integrity may be threatened by the possible burning of hydrogen in the containment atmosphere, the staff finds that such hydrogen burns are unlikely to fail containment. Because such failures are thought to be unlikely, the risk contribution is low.

1 Another possible mechanism for containment failure would be a meltthrough of the containment basemat caused by the molten core debris. The staff considers this is unlikely. Moreover, if this were to happen, it would take 3 days or more and, in the opinion of the staff, the ground would be an effective filter for the particulates released. The effects of the airborne plume would be minor.

Zion Risk Evaluation 2-9

In short, the staff finds that in an initially intact containment, with one -

or more operable containment heat removal systems, core melt accidents can be expected to be well contained and to pose negligible offsite radiological risk.

It should be noted, however, that the staff is not completely confident that the containment heat removal systems can continue to function for a long time after a core melt accident. Cora debris particles might foul the containment spray recirculation system; fine particles in the containment atmosphere might foul the filters or cooling coils of the containtnent air coolers. The experi-

.nental evidence is ambiguous. The Sandia review of ZPSS (NUREG/CR-3300, Vol I) documents a sensitivity study on this issue; Brookhaven calculated the impact.on risk as part of its review and documents the results in NUREG/CR-3300, Vol II.) Although there is not a definitive answer on the operability of containment heat removal systems after core melt, the following statements can be made:

(1) Even if core melt accidents always cause the containment heat removal systems to fail, the predicted early fatalities would not be affected and the longer term damage indices (latent cancer fatalities, person-r,em exposures, etc.) would be increased by less than a factor of 3.

(2) The filters associated be bypassed with if they are the containment plugged air coolers (fan coolers) can with particulates.

(3) The location and geometry of the containment air coolers and the emergency sump are well isolated from regions likely to be fouled by core debris.

In accident sequences in which a common root causes the failure of both the core cooling and containment heat removal functions, the core will melt and the pressure in the containment building will gradually rise. Ultimately, the containment may fail in one of these three ways:

(1) The containment may rupture because of overpressure.

(2) The containment may begin to leak at a rate that limits the pressure increase.

(3) The core may melt through the basemat, thus relieving the pressure, before one of the other two failure modes occurs.

The staff review did not include an estimate of the likelihood that a small, gradual leak might develop and thus prevent an overpressure rupture. The analysis in NUREG-0850 indicates that the fraction of those scenarios in which overpressure failure precedes basemat meltthrough is high for the Zion contain-ments. Therefore, the staff supports the licensee's position for these classes of accidents: namely that there is a very high conditional probability that overpressurization fallure will occur several hours after vessel failure.

However, the timing of containment failure is a strong function of how much water is in the reactor cavity. This volume is uncertain and discussed in more detail in NUREG/CR-3300, Vcl II. The timing of the failure also is important to the severity of the radiological release in several ways. Not only does more time allow for more reliable evacuation, but the quantities of radioactive materials that ultimately escape diminish, in part because of Zion Risk Evaluation 2-10

radioactive decay (some of.the most hazardous radioisotopes have very short half-lives) and in part because radioactive particulates or gases soluble in water have more opportunity to fall out or plate out inside containment.

Thus, the quantity of hazardous material in the containment atmosphere that is potentially available for release decreases with time.

A large part of the offsite radiological risk projected for the Zion units originates from accidents in which there is failure of both core cooling and containment cooling. Virtually all of these accidents are postulated to result in a delayed overpressure failure of containment. These, in turn, contribute virtually all of the early injuries, latent casualties, and offsite i property damage. These scenarios are also important causes of early fatalities.

2.2.4.2 Uncertainty Associated with Each Failure Mode The discussion above indicates that the Zion containments have a good capability to withstand pressure spikes associated with reactor vessel meltthrough. This capability is important and significantly reduces the risk associated with core melt accidents. In addition, the staff has found that for sequences with i containment heat removal systems operating, any releases would be well contained.

i There is, however, uncertainty associated with the core meltdown phenomenon and the ability of the containment to withstand the associated loadings.

Recent studies (described below) have increased the apparent uncertainty with respect to some aspects of plant response to severe accidents. Areas impacted are the reactor cooling system (RCS) and containment response to core melt. -

, sequences involving the RCS at high pressure. There are two aspects as follows:

(1) A preliminary experiment series has been conducted at Sandia using a small vessel containing molten material, a cavity under the vessel that has a geometry similar to that at Zion, and a connecting volume to repre-sent the remainder of containment. (No attempt was made to scale the experiment to a nuclear plant on the basis of fluid behavior, and equipment that affects flow from the vessel cavity into containment was not simulated.)

The experiment showed there were significant pressurization effects from chemical reaction during melt blowdown. (Finely divided aerosols are generated by high pressure blowdown of the melt material from the reactor vessel. These aerosols contain materials which oxidize, generating heat.)

The phenomena is called direct heating of containment. The applicability of these experiments to a nuclear plant configuration has not been evaluated.

Extrapolation of the data without consideration of these restrictions indicates the containment is % greater jeopardy at the time of blowdown than initially thought. '

(2) However, there are accident phenomena which may make this containment failure mode less likely. Some part of the RCS pressure boundary (such as the hot legs or perhaps steam generator tubes) will fail before there j is significant reactor core movement. If this judgment is correct, high pressure blowdown of molten core material into the reactor vessel cavity is less likely than represented in the PRAs. A hot leg mode of pressure relief is less of a challenge to containment than lower plenum failure.

Relief via steam generator tubes or the hot legs has not been considered j (in this manner) in the ZPSS. For these and other reasons, pending the results of further research, the direct heating effect has not been con-sidered in our numerical estimates of the risk at Zion. ,We note further Zion Risk Evaluation 2-11

further that failure of the steam generator tubes is not expected in those Zion sequences which comprise the largest portion of the core melt frequency; if there is failure of some portion of the RCS boundary before failure of the lower reactor vessel head, it would more likely be the hot

legs. The reason for this is that the Zion sequences of highest expected frequency are those in which there is feedwater available to the steam generator. If the steam generator tubes were to rupture, a path to the atmosphere bypassing containment would be produced. However, it is likely that tnere would be considerable deposition of fission products in the primary and secondary systems, so that the release would not be nearly as severe as that due to an interfacing LOCA.

The staff is continuing to evaluate this recent information. There is on going work, and additional work is planned to further investigate the uncertainties associated with high pressure blowdown of melt material and multidimensional fluid flow within the reactor pressure vessel and the remainder of the RCS during heat up and core melt. Sandia is investigating procurement of a 1/10th-scale containment for additional testing of high pressure blowdown of the RCS into containment. Idaho National Engineering Laboratory (INEL) and Pacific Northwest Laboratory (PNL) are conducting analytic investigations with the advanced computer codes RELAP-5 and COBRA-NC to study flow patterns within the RCS and to assess the impact on calculated results when multidimensional phenomena are considered (as contrasted to the assumption of one-dimensional flow used in the Zion study).

The following paragraphs address the additional uncertainties associated with each containment failure mode.

(1) Steam-Explosion-Induced Failure: On the basis of work performed by Theofanous and Corradini, the staff has assumed a conditional probability of 10 4 for a steam explosion-induced failure of containment. A sensi-tivity study of this failure mode found that uncertainty has very little impact on the longer term damage indices (thyroid cancers, total latent cancers, and person rems of exposure) and that the 10 4 conditional proba-bility would have to increase more than 2 orders of magnitude before it would influence these risk measures. However, as expected, early fatali-ties are rather more sensitive to this failure mode. Increasing the condi-tional probability by an order of magnitude increases risk due to early fatalities by approximately 25%.

(2) Early Versus late Gradual Overpressurization Failure: In its assumptions, U1e staff has neglected the potential for early failure of the containment building soon after the failure of the reactor vessel (because the staff assumes the probability of this event is negligibly small); rather, the staff has assumed that containment failure would occur many hours after vessel failure. The staff has used, in the past, a conditional probability of 5x10 3 for early containment failure. By allocating a conditional probability of 5x10 3 to an early failure release category, only the early damage indices are changed, and these are changed by less than 10%. Note that this applies only if internal events are considered. If internal and external events are considered, the change has negligible impact on all-damage iridices.

. Zion Risk Evaluation 2-12

.___--___.___-__-___--___---__.-___1

c #

'p' (3) . Hydrocen' Burn Failure: There are uncertainties'with regard to the amount I

of hyc rogen that might.be generated how it will be released to contain- -

ment, and the containment loading as,sociated with its combustion. In addition, there is uncertainty regarding the containment failure pressure versus probability distribution used in NUREG/CR-3300, Vol II. Thus, in

_ view of these considerations, the staff finds it prudent to assume an

' uncertainty of + 1 order of magnitude on all the conditional probabilities for the hydrogeli burn failure modes.

The impact of changing the' containment probabilities by an order of magni-tude was calcuated.in NUREG/CR-3300, Vol II. . The changes have no im on early fatalities but do influence the longer term damage indices. pact An increase in the hydrogen burn failure mode conditional probabilities by a factor of 10 increases latent fatalities by a factor of 4, if only internal events are considered. If external events are considered, the increased hydrogen burn failure only a factor of 2. If the conditional probability would change total latent fatalities by probability of hydrogen burn fail-ure is increased to unity (an increase by a factor of 50), the total latent I fatalities mately 10.(including external events) would change by a factor of approxi-A decrease in the conditional probabilities of hydrogen burning by only about 25L10 has a smaller effect and reduces latent fatalities by a factor of (4) Failure by Basemat Penetration:

In its review, the staff gave failure by basemat penetration a low probability. The staff has found that uncertain- '

ties regarding debris bed coolability and basemat penetration have_very little impact on overall risk at Zion simply because of the low consequences associated with this failure mode.

(5) Faf ure To Isolate Containment Buildina: . A sensitivity study on this failure Vol II. mode will be included in the final version of NUREG/CR-3300, The Brookhaven study shows that the conditional probability for this failure mode can be-increased to 0.1 without significantly influencing the staff risk estimates. The early fatalities are unaffected, and latent fatalities increase by only approximately 30L This is not the case for a failure to isolate the containment purge lines.

of 0.1 for this failure mode would have a significant influence on staffA conditional pro risk estimates for early fatalities.-

1985) for the probability of a large (2 to 28 sq inches) leak due to con-Recent sta tainment isolation failure is in the 10-3 to 10-2 range. Probability of failure to isolate a containment purge line would be estimated at the lower end of this. range, or about 10-8 2.2.4.3 Comparison with Other Containments The staff has. attempted to (1) indicate how well the Zion containments could contain core melt accidents and (2) estimate the uncertainty associated with the potential failure modes. The following paragraphs compare the Zion containments core melt. with other containments in regard to their ability to mitigate For accident sequences without containment heat removal ~ systems (CHR5s) opera-ting, the staff has found that the pressure spike associated with vessel

. failure will not cause the Zion containments to fail. Core melt accidents in-Zion Risk Evaluation 2-13

I i

an initially intact containment with one or more cperable containment heat removalradiological offsite systems are risk.

expected to be well contained and to pose negligible Plants with smaller and/or weaker containments than Zion are thought to be less reliable at containing such core melt accidents.

Some plants utilize passive devices (ice or pools of water) to capture steam and heat in the containment atmosphere.

power supply to perform their function. These require no actuation signal or Designers of reactor plants with passive steam condensation devices take advantage of this feature to enable the use of smaller and/or weaker containment buildings. However, the heat absorption capability of these devices is finite and would be overwhelmed in time if no active heat removal system dissipates the reactor decay heat to the environment.

Containments of this design are also predicted to fail as a result of overpressurization in loss-of-all cooling accidents.

is then reduced to which containment design will fail as a result of theThe question buildup of noncondensable gases generated during core melt and core / concrete interactions.

have an advantage over plants that use passive devices (pressure containments).

This advantage results because the volume of the large, dry containments is larger than the volume of the pressure suppression containments.

Failure time is a strong function of the containment volume, because the

_' passive devices (ice or pools of water pressure from the noncondensable gases.) will not mitigate the buildup of factors for these containments may be significant.On the other hand, the c'econtamination The Zion ments. containments can also be compared with other PWR large, ory contain-Extensive analyses of the Indian Point Units 2 and 3 containments have shown their ultimate capacities to be similar to those of the Zion containments.

Thus, because the containment volumes at Zion and Indian Point are about equal, the ability of these containments to contain core melt accidents shculd be similar.  !

Indian Point containments. 'At Indian Poir.t,However, there is an important generates very little gas when it interacts with core debris.the At concrete used is basalt, whic Zica, a lime-stone concrete is used, which results in significantly larger gas release rates.

Consequently, there is much greater potential at Zion for pressurization (and hence containment failure) during core / concrete interactions than there is at Indian Point.

ticnal probability of overpressure failures of containment is assumed for Zion and about 0.4 for Indian Point. .

2.2.5 Site Evaluation 1 1

By far the most important difference between the Zion site and the average nuclear power plant site is the population density in the surrounding area.

United 2.7 Table shows the population within 50 miles of 111 plant sites in the States.

If circles of 10, 30, and 50 miles in diameter are drawn around the Zion site, the population in each circle is about 10 times greater than the population in similar circles around the " median" site. This distri-bution for the Zion site is true even though about half of the area within these circles (Lake Michigan) is uninhabited. In short, if the same Zion plant were located at an " average" site, the risks to individuals would not change, but the societal risks would be about 10 times smaller, simply because Zion Risk Evaluation 2 '.4

there are roughly 10 times as many people at risk around the Zion site as there are at an average site.

In addition, it should-be noted that because of the high population densities, the'value of the land around the site is also higher than the value of land around other sites.

i

=

a l

Zion Risk Evaluation 2-15

.-_,_s:. _ . ,,s -- . - ' ' '

, q_ 7.__ . . _._ 3_____ .,

9 2 ,

^

Ir Linieelch

?

c.

O o .

b Inelian Point 2 N .

I

?

A 1 leistian f* neis 'J I

• H 73% Range d Mean Value A I lion 1 l 1 I I l.l l I I I I I IIl i I I I I I d} 1 l__.l _1_UJ.l.l _ l i I I io

• io 5 io

• in '

FitEOLIEtJCY PEll HE ACTOli YE All *

-Figure 2.1 Comparison of-Zion core damage frequency with higli elensity population plants: uscertainty range of internal and external events (Note: Results presented on this figure are taken, directly from published PRAs without modification. The PRAs were not necessarily performed

.usisig consistent methodologies or assumptions. Many of the PRAs evaluate designs that have subsequently been altered.)

_ . ____________ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . - _ c>

• 9 P D c:y M:licup. RCS Int:gelly- ~

4 Cent:Imn:nt llost Removcl inv:ntary Control

> R:ccias Cosl:nt Cccling cnd N

Pump Seele Integelty ,

O l *

)k J N *

)k ]k ) k n

I.-._._L

~

. I L - -_,__ i I

, r_. __ _- .-_ l T

- I l t '

l I I

! E I I I I I r,+ I

E Aunlliery Low Pressure liigh Pressure I Conseinment Feedwater injection sprey Contelament injection ..

Fan Coolers Motor - Diesel W Turbino / L /k Af fkl h./ k I J J L J k h, h.

L J L J L e--

+ -

. M .t.,

l g... ....

l

. g. . . -

, r;-

g . . ., ..

e.: u __ I__ ,

1 __ ..

.t_.L __ _ _ - =.:,

I l l l

. n s l a Componer.t .

l Pump l Cooling 4- - -

[,',*,* -+

, Room Water Coolere 8

8 s i , I i _J

t l

, . l

. 8 I II

, e l 8 .. _ .. . DC Power. AC Power.

Dettestes , , , . - , , , , _ Diesel Generators'

,, , _ 4 figure 2.2 Key support. system dependencies l

l i

Table 2.1 U.S. nuclear power plants for which PRAs.have been performed E2 PRA Document Year of Power E Plant sponsor reporting PRA publication NSSS* AE** MW(e)

u CE ANO-1 IREP/NRC NUREG/CR-2787 1981 B&W Bechtel 836

[ Vol 1 Big Rock Point *** Consumers Power BRP PRA 1981 GE Bechtel 71 Browns Ferry 1 IREP/NRC NUREG/CR-2802 1982 GE TVA 106$

Calvert Cliffs 2 RSSMAP/NRC NOREG/CR-1659 1982 CE Bechtel 850 Vol 3 Calvert Cliffs 1 IREP/NRC NUREG/CR-3511 1984 CE Bechtel 850 Crystal River IREP/NRC NUREG/CR-2515 1982 B&W Gilbert 825

^'

i* Grand Gulf RSSMAP/NRC NUREG/CR-1659 1981 GE Bechtel 1250 5; Vol 4 Indian Point 2*** PASNY/ CON ED IPPSS 1982 4l UE&C 873 Indian Point 3*** PASNY/ CON ED IPPSS 1982 W UE&C 965 Limerick *** Phil Elec LGS PRA/ SARA 1981 GE Bechtel 1055 Midland *** Consumers PowerI Midland PRA 1984 B&W Bechtel 852 Millstone 1 IREP/NRC NUREG/CR-3085 1983 GE EBASCO 652 Millstone 3*** Northeast Mills' tone 3 1983 W S&W 1150  :

Utilities PSS .

• NSSS = nuclear steam supply system vendor. -

• • AE = architect engineer.

• • • Included a risk assessment incorpcrating " externally" initiated events.

i

~

. . . . ,1 Et Table 2.1 U.S. nuclear power plants for which PRAs have been performed -

??:

5' PRA Document Year of Power Ee Plant sponsor reporting PRA publication NSSS* AE** MW(e) m kb. Oconee 3 RSSMAP/NRC NUREG/CR-1659 1981 B&W Bechtel 886

'E Vol 2 Si Oconee 3*** EPRl/NSAC/ PRA of Oconee 3 .1984 B&W Bechtel & 860

8 Duke Power Duke Power Co ,.

Peach Botton RSS/NRC WASH-1400 1975 GE Bechtel 1056 Public Service Seabrook 1983 W UE&C 1150 i Seabrook**

• i of NH and Yankee Station PSS '

i Atomic Electric RSSMAP/NRC NUREG/CR-1659 1978 W TVA 1148 Sequoyah s, Vol 1 ...

L.

tong Island PRA of Shoreham 1983 GE S&W 819 ',

2P Shoreham Lighting Co Nuclear Power

• Plant Station -

Surry RSS/NRC WASH-1400 1975 W S&W 775-Yankee Rowe Yankee Atomic PRA of Yankee 1982 W S&W 175 Electric Nuclear Power

- Station

. Zion *** Commonwealth ZPSS 1981 W S&L 1100 Edison

!l .

• NSSS = nuclear steam, supply system vendor.

• • AE = architect engineer.

• • • Included a risk assessment incorporating " externally" initiated events.

.I a .

i Table 2.2 Estimated core melt frequency, per year PRA submitted Staff / hearing testi-by licensee Sandia review mony, after fix*

Internal Internal Internal and and and Plant Internal external Internal external Internal external 2

Zion 1, 2 5.7x10 5 6.7x10 s 3.6x10 4 3.7x10 4 1.5x10 4 1.6x10 4 Indian 9x10-s 4.7x10 4 2.2x10 4 9x10 4 2.4x10 4 3.5x10 4 Point 2 Indian 1.3x10-4 1.9x10 4 9.0x10 5 3.5x10 4 2.9x10 4 3.5x10 4 Point 3 Note: The ZPSS and IPPSS estimates are means; all others are point estimates.

• The staff core melt frequency estimates for Zion are derived from the Sandia 4

estimates with component cooling water and service water success criteria of -

1 pump, 2 pumps respectively.

i Table 2.3 Frequency of core melt with failure or bypass of containment (severe release), per year Utility-submitted PRA Staff review Internal Internal -Internal and

and and external,

Plant Internal external Internal ** external ** after fix

Zion 1, 2 3.4x10 7 6x10 8 6x10 8 1x10 s* ..

Indian lx10 8 3x10 4 4.5x10 7 3x10 4 3x10 5**

Point 2 Indian 8x10 7 6x10 5 4x10 7 2x10.s 2x10.s**

Point 3

• This estimate does not include fire. Bounding analysis would increase the estimate to about 6x10 5/yr. l

• • Staff results include revisions to contractor estimates as well as  !

credit for fixes.

l l

-Zion Risk Evaluation 2-19

Table 2.4 Comparison of Zion and Indian Point risk,8 casualties per unit year

• f q'

Zion estimates Indian Point estimates Sandia/ Sandia/ Unit 3 Unit 2 l

, . ZPSS2 Brookhaven/ Brookhaven/ internal, internal,

! E" ZPSS2 internal, NRC NRC internal, external, external,  ;

1 o Parameter internal external internal 3 external 3'4 after fix after fix  :

Early fatalities 1x10 5 1.7x10 4 6.3x10 4 1.3x10 3 3.8x10 3 1.5p02 ,

Early injuries 2.8x10 4 3.7x10 3 2.8x10 3 1.0x10 2 3.4x10 2 9.5x10 2 i Thyroid cancers ' 5 2.6x10 3 3.6x10 2 1.6x10 3 3.8x10 3 2.4x10 2 4.3x10 2 p r.,

{

Total latent cancers 1x10 3 1.7x10 2 2.0x10 2 1.5x10 2 9x10 2 1.6x10 1 _,

Person rems 15 256 94 246 1430 2610  !

Notes: 'All estimates should be considered as " point estimates",out to 500 miles. [ .

I l 2" Point estimate" values from ZPSS are used; these estimates are based largely on WASH-1400 i.

re) ease categories and are more appropriate for relative comparison to the Indian Point l

results. '

i 1

3 Sandia estimates that the frequency of the interfacin l These estimates are for an Event V frequency of 1x10 g/yr.(See systems LOCA

. discussion of (Event V) is 1x10 7/yr.

Dominant ,

Sequences and insights in Section 3.) All estimated early fatalities for internally initiated events come from this sequence.

4These estimates are without fire analysi's.

S ZPSS estimates thyroid cancer cases while NRC estimates cancer fatalities; about 10%

of the cases are fatal. .

m .

Table 2.5 ZPSS initiating event frequency, mean values Initiating event category Occurrence / year

.Large LOCA 9.4x10 4 Medium LOCA 9.4x10 4 Small LOCA~ 3.5x10 2 Steam generator tube rupture 2.4x10 2 Steam break inside containment 9.4x10 4

~

Steam break outside containment 9.4x10 4 Loss of main feedwater 5.2 Trip of one main steam isolation valve 2.5x10 1 Loss of reactor cooling system 3.6x10 1 Core power excursion 2.3x10 2 .

Turbine trip 3.7 Turbine trip: loss of offsita power 5.8x10 2 Turbine trip: loss of service water 9.4x10 4 Spurious safety injection .. 6.4x10 1 Reactor trip 3.8 1

Reactor trip: loss of component cooling 9.4x10 4 Reactor trip: loss of dc bus 2.8x10 1 Interfacing system LOCA -

1.1x10 7 I

i i

I Zion Risk Evaluation 2-21 1 1

. _ _ ~. _. _ ._ _ . _

Table 2.6 Important support system dependencies-

. Support system- Dependencies

, Component cooling water Reactor coolant pump seals 4

Highpressureinjectionpumps Low pressure-injection pumps RHR heat exchangers Service water Component cooling water Diesel generators f

Containment fan coolers Pump room coolers (RHR, safety injection, charging,containmentspray)

! Diesel containment spray pumps

AFW motors l' ,

i-4

, i i

4 Zion Risk Evaluation 2-22

^

O r

Tabla 2.7 Populctien 5tctistiC5 betwe:n o cnd 50 clis5 from p1Cnt sites tt .

] $ POPWLAf t pN STATISTIC 5- 1979 REVISIDN 5/79

• RA5Et OH TNE TEAR 1970 35 FOPULATION STATISTICS WITNIN 0-50 MILES

• - TOTAL WNHRER OF SITl;5  !!!

1 HINIHule POPHLATION= 77R4 .HARIHHH POPHl.ATION-lF4Fl439 pt HC AN POPULAfl0N= 1705750 HEDIAN POPULATION- 948747 902 PERCENTILE POPULATION- 4055400 p STANNARD DEVIATloN-2196315.2 COEF. OF VARIATION- 1.287 3

57 NO. SITE NAME POPULATION NO. SITE NAHE . POPULATION NO. 5tTE WAHE POPULA' TION 3

,i

I SUN DE S P.RT 7704 -38 SEQUOYAN 659415' 75 $USQUENANNA 151717) 4 2 PEast.E SPRINC5 74814 19 CVTR 661462 76 YANKEE ROWE 1530765 3 NUHs0Lht BAT 100728 40 PMIPPS BEND 691304 77* SURRY 1550000 4 alc RPCE POINT 128611 41 FORT CALMOUN 711117 78 PlQUA 1654091

5 ARRAW545 150464 42 SUNNER 724009 79 TURKEY PolNT 1660498 4

6 WOLF CREEE 165677 43 OCONEE 730291 SO ZIMMER 1786790 7 CRYSTAL river 169900 44 CARROLL COUNTY 733928 88 NEW ENCLAND 186293) '

, O COOPER 171095 45 CLINTON 768871 82 THREE MILE ISLAND 1860000 l 9 BRUNSHICK 174966 46 C0HANCNE PEAK 781124 33 MONTICELLO 1956232 '

7 w

10 Wrr$5 164 WPP55 2 le192s 184296 47 40 NORTN ANNA plNE HILE PolMT 827809 e4 Davis ats5E 2052000 j

b*

II , 841725 85 PRAIRl[ 151AND 2057725 12 50UTN TERA 5 196206 49 FITZPATRICK B4)P25 86 ELK RIVER 2101115

l)

• DIABLO CANTON 209444 50 stLLEFONTE R45R18 47 CALVERT CL'.Fr5 2305635

I4 PATMFINDER 242751 St NART5Vit.LE R69776 88 ERIE 2411857 i 15 NATCN 251612 52 RTRON R8172I 89 PERRY 2583218.

16 CRAND CULF 269314 53 1.ASALLE 91840) 90 MI LLS TO N E 2591658 i IF CALLAWAY 299254 54 WEW NAVEN 921367 91 DOUCLAS PolNT

• 3167529 18 NALLAH 307945 55 NAVEN 927246 92 JAMESPORT 3173511 4

19 S A INT LUCI E 318784 56 Up00 970248 9) NADDAH NECE 32677)!

l 21 FARLET 120667 57 PAL 15ADES 984252 94 OYSTER C R E r. K 1290000

! 21 LACE 055E 321073 58 BONUS 999000 95 FORKED RIVER 1290000 -

1 23 PALO vtant 320088 59 HIDLAND 1000000 96 5AN ONOFRE 157247e 1

23 T F. I.L OW CREEK 144716 60 SNEARON NARRIS 1062200 97 SEASROOK 360549) 1 24 WPP55 365 3459 35 61 COOK  !!20000 93 SHIPPINCPORT 1735300 25 SEACIT 366247 62 TROJAN 3146885 99 BEAVER VALLET 1900000 i 26 TTRONE 172980 63 vtalIONT TAMEEE 1149204 103 BRAIDUDOD 408866)

! 27 vpCTLE .456631 64 STERLING 1854697 101 PEACH OOTTOH 4121297 1 20 HAINE 7ANKEE 486000 65 CINNA 1213870 102 FILCRIH 4214545

)

29 ROSINSON 530017 66 HAROLE NILL 1245001 IO) SALEH 4771288 30 DUANE ARNOLD $52745 67 CATAWBA 1245504 104 NDPE CREEK 4773288 5 PolNT BEACM 31 $64251 68 CNERDEEE 1308327 105 Sil0 R E N A H 4440860

} 32 EEUAgNEE S24631 69 NCCUIRE. .. 1380228 106 FESHI 5446957 33 QUAD-CITIES 601843 70 RANCMO SECO 1381581 107 DRESDEN 6305057 i 14 SROWNS FERRY 625608 71 GREENE COUNTT 1383978 10s BAILLY 6747815 l

15 alvra SEND 627983 72 FORT ST. VRAIN 1396284 109 LIMERICK 7036199 i'

16 S t. A C E TOR 641797 73- WATERFORD 1479345 110. Il0N 7083759 17 WATT 5 RAR 657836 74 'PERKIN5 1506152 lit INDIAN POINT 17471479 J

_ - - _ _ ____ _ _ __ _ _ _ . - _ ,, . ~ . _, __._I

l e

3 INTRAPLANT COMPARISON 3.1 Dominant Sequences and Insights To draw meaningful insights, it is necessary to look at the sequences that are I judged to be dominant contributors to core damage frequency and risk. The following paragraphs (1) identify the ZPSS and Sandia dominant sequences and explain the associated events, and l

(2) discuss insights gained from the comparisons of the Sandia review with  !

L the ZPSS and the uncertainties involved.

l-Table 3.1 lists the dominant sequences as given in the ZPSS (Table 8.10-1).  !-

This table indicates the following regarding the ZPSS results:

(1) Total core melt frequency is about 7x10 5/yr.

(2) Core melt frequency is dominated by the small LOCA with failure of recirculation; the frequencies of all other sequences are less than 10%.

(3) No sequence frequencies are estimated to exceed 1x10 4/yr.

(4) The probability of a core melt resulting in severe release is very low for almost all sequences (except seismic loss of ac, station blackout, and Event V).

(5) Although its dominance is not clearly shown in Table 3.1, seismic loss of ac power dominates risk. This is discussed later in this section.

The list of dominant accident sequences determined in the Sandia review is given in Table 3.2. On the basis of its review of the ZPSS, Sandia concluded that the sequences that contribute to the overall frequency of core damage may be different from those depicted by the ZPSS. The Sandia review resulted in the following areas of disagreement:

(1) the frequency of a component cooling water pipebreak (2) the frequency of loss of a de bus (3) the probability of failing to restore ac power after a station loss of offsite power (4) the component cooling water and service water success criteria Zion Risk Evaluation 3-1

. . i 4

-Since the Sandia review was completed additional information was provided by the licensee on service water success criteria. Based on this information and staff evaluation the Sandia estimates are modified accordingly in Table 3.2.

In addition, Sandia identified the dependency of the high pressure injection pumps and charging pumps on component cooling water. This dependency makes the loss of component cooling water sequences more important. The ZPSS does not model this dependency, but assumes that the ECCS pumps would be cooled by the pumped RWST water. The licensee subsequently agreed with Sandia, but the ZPSS was not updated to reflect this assumption.

The following paragraphs address each of the sequences Sandia estimated to have a frequency higher than 1x10 5/yr and compare them to the ZPSS estimates. The loss of de power sequence (s7x10 8/yr) is discussed (because it was omitted from the ZPSS), as are the seismic loss of ac power (6x10 6/yr) and interfacing sys-tems LOCA (*1x10 8/yr) sequences (because of their risk significance).

As stated earlier, the Sandia estimates do not include a contribution from i fire because Sandia found the ZPSS fire analysis incomplete. Sandia includes 4

a separate fire analysis sensitivity study to estimate the potential impact of fires on core melt frequency and risk. If the Sandia fire estimates are i

included, the early fatality risk would not change and the core melt frequency would increase by about 25%.

i 3.1.1 Component Cooling Water System Failure ($1x10 4/yr)

Sandia estimates this initiating event will occur at the rate of about 2x10 4/yr assuming 2 component cooling water pumps are necessary to provide adequate cooling. Based on staff review, 1 pump is considered adequate reducing the i

estimate to about 1x10 4/yr. The licensee, on the other hand, estimates a frequency of 3x10 S/yr. The large difference stems from the estimation of the frequency of pipe ruptures that would lead to a loss of system function.

The staff considers both estimates highly uncertain. Surprisingly, both estimates are based on the same information (from WASH-1400) but with different interpretations. There is no independent basis on which low pressure system pipe rupture rates can be predicted with any degree of certainty at this time, although research is being done in this area.

A loss of component cooling water would remove cooling from the reactor coolant pump thermal barriers and charging pumps, which provide seal injection, so seal 4

integrity could be lost. The ZPSS assumes that each reactor coolant pump will leak at a rate of 300 gpm 30 minutes after the loss of CCW. ' The lost of CCW will also remove cooling from the safety injection pumps so they are assumed to  :

fail. The result of this sequence would be a 1200 gpm LOCA with no ability to l i

make up the lost reactor coolant inventory, The assumptions regarding the RCP seal LOCA and ECCS failure are quite simplis-4 tic and perhaps conservative. Westinghouse is performing tests and the staff has a program underway to determine the likelihood and magnitude of seal leakage.

{

The assumption that the charging pump and safety injection pumps will fail is based on information provided by the licensee. However, at this time, the staff recommends using a 300 gpm leak rate assumption (Noonan, 1983).

1 l Zion Risk Evaluation 3-2 1

Overall, the staff regards both the licensee's and Sandia's pipe break estimates with skepticism; however, the staff has not produced any better estimates.

Thus, the uncertainties must be kept in mind when the results are considered.

The effects of uncertainties associated with the RCP seal LOCA assumption are shown in detail in NUREG/CR-3300, Vol I (Section 4). A summary of a sensitivity study on the RCP seal LOCA, in Section 3.4 below, includes the effect on core melt frequency and risk (person-rems).

Further, it should be noted that although this postulated sequence has not been identified in previous PRAs, it is not peculiar to Zion. The staff expects that many plants are similar with respect to the CCW/RCP seal /ECCS dependency, but would differ with respect to CCW design.

3.1.2 Loss of DC Bus 112 (s7x10 8/yr)

This sequence was not identified in the ZPSS, but was identified in the Sandia .

review and is therefore included here. The frequency of loss of the dc bus (discussed above, under Initiating Events) is estimated to be about 0.2/yr.

This is based on actual operating experience data at Zion. Sandia estimates that there have been six events in 33 de bus years (11 years, 3 buses per unit). The loss of de bus 112 would cause a reactor trip and loss of main feedwater. It also would cause the loss of one motor-driven AFW pump and one PORV. Both failure of the remaining AFW system (motor plus turbine pumps) and failure to recover the lost de bus would have to occur for there to be a potential core damage situation. No credit is given in this estimate for feed and bleed capability using one PORV. Although this is likely to be a conserva-tive assumption (as both the staff and the licensee have noted), the staff has not quantified the probability of success. Through conversations with the licensee, the staff has learned that the plant switchboards were modified to assist the operator in de power switching operations, which should reduce the likelihood of this sequence.

3.1.3 Loss of Offsite Power Followed by a Loss of Component Cooling Water or Service Water and RCP Seal LOCA: Loss of ECCS Cooling (6x10 8/yr--

core nelt with containment cooling, 1.5x10 8/yr--core melt without containmentcooling)

The ZPSS did not identify these sequences as significant. The basic sequence entails a loss of offsite power followed by the total probability of the loss of component cooling water as a result of the failure of the CCW or service water system and the failure to restore ac power before the core is uncovered.

At Zion, both the CCW and service water systems are cross-connected between Units 1 and 2. Of critical importance in the calculation is the assumption regarding how many CCW and service water pumps must be operating to prevent a LOCA because of the failure of RCP seals and a loss of the CCW-cooled charging pump / safety injection pumps. If nonessential cooling loads are isolated by the operator, one CCW pump and two service water pumps should be sufficient.

The Sandia study assumes that two operating CCW and two operating service water pumps will prevent an RCP seal failure LOCA. In a letter dated September 9, Zion Risk Evaluation 3-3

1983 (Lentine), the licensee stated that one operating CGW and three operating service water pumps are appropriate success criteria. (However, because the licensee uses a much more optimistic model for ac power recovery, the licensee considers these sequences unimportant.) In the judgment of the staff, one CCW pump seems to be adequate (Mattson, 1983).

In discussions with the staff and by letter (Cascarano, 1984), the licensee states that two service water pumps are adequate if both units are tripped, because service water heat loads are greater for an operating unit (CCW loads and containment fan coolers), and two service water pumps may not be adequate for the case in which one unit experiences a loss of offsite power and the other unit remains on line. The impact of the CCW/ service water success criteria on the frequency of this sequence using Sandia's offsite power recovery model is shown in Table 3.3.

Two points worth noting are (1) There is no significant difference between the total sequence frequencies of the two CCW/two service water pump configuration versus the one CCW/

three service water pump configuration, considering the uncertainties.

(2) The one CCW/two service water pump configuration reduces, by a factor of

.% about 20, the frequency of core melt with containment cooling available after a loss of offsite power, and reduces, by a factor of about 3, the frequency of core melt with no containment cooling available.

It is the judgment of the staff that one CCW pump and 2 SW pumps are reasonable success criteria to assume for risk estimates. Not only are the success criteria a source of uncertainty (as seen in Table 3.3) but so are the offsite ac power recovery models, as stated above. Table 3.4 compares the Sandia sequence estimates with those in the ZPSS. This comparison shows the different ac recoyery model effects using the same sequences as in Table 3.3.

Table 3.4 shows that the ZPSS estimates differ drastically from those of Sandia and the staff. The ZPSS offsite power recovery estimates are based primarily on data on forced outages on the licensee's transmission lines for 15 years, ccupled with an operator response time model. This ZPSS points out that the Zion site is somewhat different from other plants because the Zion switchyard is an important intertie point for the licensee's grid. Six trans-mission circuits are interconnected through a ring bus, and the lines diverge geographically soon after leaving the switchyard. Although the ZPSS does not provide detailed data on forced outages, it notes that there have been no -

extended multiple-line outages in more than 1100 forced outage events that stemmed from all causes. The ZPSS notes that in the Dresden event on November 19, 1965 (in which a series of severe tornadoes disabled five redun-dant transmission lines), offsite power was restored from at least one line within about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. For these reasons, the licensee does not believe that the loss of offsite power sequence estimates for Zion should be made using generic assessment recovery models.

Zion Risk Evaluation 4

o The staff has been conducting considerable research on the reliability of off-site power system in terms of the estimates of the frequency of outages as a function of time. The work done in connection with Generic Task A-44 (Station Blackout) has been done primarily by the staff and by personnel from Oak Ricge National Laboratory. (The A-44 work is believed to be the most extensive study of its kind). Although the results of this work have not yet been published, the staff believes that they will indicate that some plants / grids are more reliable than others. The staff expects that Zion will prove to be one of the more reliable sites.

The A-44 work also shows that the frequency of outages of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or longer is controlled by severe weather occurrences, which are not expected often. However, should this severe weather occur, offsite power is likely to be out for an extended period. The A-44 estimate for long outages is, therefore, a function of the susceptibility of the area to severe weather and the data on events that have occurred.

In its review of the ZPPS, Sandia used regionalized data from EPRI NP-2301 (EPRI,1982). No indepth analysis of the Commonwealth Edison grid data was performed.

The staff has compared the ZPSS and Sandia estimates with those generated by the staff in the models being developed in connection with A-44. The results of this comparison are given in Table 3.5.

Because the staff has found the A-44 work the best available resource to judge the reasonableness of the ZPPS estimates, the staff concludes that the Sandia estimates, which are quite close to those of A-44, are appropriate.

3.1.4 Interfacing System LOCA (Event V) (s1x10 8/yr)

This sequence, which was identified in the ZPSS, results from the loss of internal integrity of both RHR suction valves. These valves are in series

' inside Integrity pumps. containment in the single loss is postulated to besuction the resultline from(1the of either the RCS rupturehot leg)to t of both valves, or (2) the possibility that one valve fails to close on demand before the RCS pressurizes during startup but indicates that it is closed and the other valve ruptures. A detailed explanation of the models, quantification, data, and uncertainties is in NUREG/CR-3300 (Vol I, Section 3.2.15).

Of interest in this sequence are four points:

(1) The uncertainties associated with the Event V estimates are large.

(2) The particular sequence and failure modes have not been identified in previous PRAs. -

(3) The estimated ZPSS Event V frequency (1x10 7/yr) assumes an annual test is performed that would detect failures of the valve disks as a result of rupture (see ZPSS, Section 1.3.4.1.6.2). Through conversations with the Zion Risk Evaluation 3-5

licensee, the staff has learned that such periodic tests are not performed.

Without such a periodic check of valve integrity, the probability of an interfacing systems LOCA via this path would be substantially higher than the 1x10 7/yr estimated b The staff estimates that it would be approximately 1x10 8/yr. y Sandia.

(4) This sequence makes up virtually all of the early fatality risk associated with internal events and about half of the total early fatality risk (assuming an event frequency of s1x10 8/yr; see Table 1.1). ,

For these reasons, the staff recommends that these valve integrity checks be performed. Because of the importance of the generic implications of such tests, the staff also recommends that they be considered on a generic basis.

3.1.5 Seismic Loss of All AC Power (6x10 8/yr)

In this sequence, a seismic event large enough to fail offsite power and the service water pumps occurs. Failure of the service water pumps causes the diesels to fail as a result of a lack of cooling. An RCP seal LOCA results fron the loss of seal cooling, and no ac power is available for the ECCS or containment cooling systems.

To put this sequence into perspective, one should note that the design-basis earthquake for Zion is .17g. The probability such as ground acceleration will cause a seismic loss of all ac power is entirely negligible. On the other hand, the mean probability of this sequence for a ground acceleration twice that of the design basis earthquake is 14%, so that the earthquakes of safety significance are those with at least twice the design basis acceleration. The majority of the risk comes from earthquakes causing between two and three times the design basis ground accelerations.

3.1.6 Comparison of Study Results To enable a better understanding of the overall contribution of each of the dominant sequences to the frequency of core melt or core damage and to the two measures of risk (early fatalities and person rems of exposure), Table 1.1 compares the Z. DSS and Sandia/Brookhaven/ staff estimates. This table should be considered in the context of both the discussion above and the following:

(1) The CCW failure sequence estimates are quite uncertain and perhaps con-servative. These consequences (and the loss of offsite power sequences) are likely to affect both units.

(2) The Sandia/Brookhaven/ staff review estimates the early fatality risk from a seismic event to be higher than ZPSS. The risk is high because the estimate assumes there will be no evacuation for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the severe seismic event. ZPSS used the same evacuation assumptions for internal and external events.

Zion Risk Evaluation 3-6

a o

~

(3) The higher frequency of an Interfacing System LOCA is due to the apparent lack of testing of the RHR suction valves as assumed in the ZPSS.

l

' (4)' The higher frequency of core damage from the loss of offsite power sequences is due primarily to the offsite power recovery model assumed.

l (5) None of the revised estimates include fire risk, because the reviewers t

found the fire analysis incomplete.

l 3.2 Uncertainty 3.2.1 Internal Events

! As stated previously, the staff has not attempted to propagate uncertainties I

in the results of its review; instead the staff has tried to point out uncer-tainties throughout the various PRA segments. Table 3.6 compares the statisti-cal uncertainty estimates that have been made by the licensee in the ZPSS and

, by Sandia.

l l

Table 3.6 shows that the Sandia point estimate lies outside the ZPSS bounds for core melt frequency. Table 3.6 also shows that the ZPSS point estimate falls within the Sandia range of uncertainty. The comparison in Table 3.6 is not intended to imply the correctness of one bound or the other, but only to demonstrate the importance of modeling assumptions, because they are the major reason for the differences in this comparison.

'The same is also true for the frequency of severe release shown in Table 3 .,7 which is based on an estimate of slow overpressurization of containment, the dominant risk release category.

On the basis of the results of the Sandia review, the staff concludes that the uncertainties may be larger than those displayed for the internal event analysis in the ZPSS. The ZPSS estimate does fall within the Sandia range, while the Sandia estimate is above the ZPSS upper bound. Again, this difference results because.Sandia has used different success criteria and a different offsite power recovery model. The staff point estimates differ from those of Sandia i

because of different success criteria for component cooling water and service water. However, the staff did not estimate uncertainties.

3.3.2 External Events To assess uncertainties resulting from external events, Sandia contracted seismicexperts(JackBenjamin& Associates). Thejudgmentoftheseseismic experts, based on a detailed review of the seismic fragility analysis and a l cursory review of the seismic hazard analysis, is that the mean frequency of core melt due to seismic events given in the Zion PRA is on the conservative l side. In their judgment, if the system analysis is correct it is unlikely that the true value of the seismic core melt frequency is more than a factor l of 10 different from the estimate, but a factor of 2 or 3 is possible.

4 Another important consideration is the seismic safety margin research program (SSMRP). The goal of this program is to develop a complete, fully coupled analysis procedure for estimating the risk of an earthquake-induced radioactive Zion Risk Evaluation 3-7

o. i o.

i release from a commercial nuclear power plant. NUREG/CR-3428 presents the risk estimates for Zion using the SSMRP methodology. For the base case, the '

median frequency of core melt is estimated to be 3x10 5/yr, with upper (90%)

and lower (10%) bounds of 8x10 4/yr and 6x10 7/yr. (Detailed comparisons between the ZPSS and SSMRP estimates are scheduled to be available soon.)

3.3 Plant Modifications Made During the Staff Review l During the staff review of the ZPSS, the licensee made several modifications i

to the Zion units that were in addition to the correction of errors or omissions found in the study. These were as follows:

(1) When the PRA was submitted, both PORV block valves were normally shut so j that manual actuation was required to open them following an anticipated transient without scram (ATWS). Subsequently, the normal block valve position was changed to "open." (The valves had been kept shut because of PORV leakage; however, the licensee stated that the PORVs were then

! modified to prevent leakage.)

l l

(2) Sandia personnel found that the room cooler surveillance for the RHR, safety injection, containment spray, and charging pumps was inadequate.

The service water system provides cooling to these coolers. The room cooler fans are energized when the pumps in the room are actuated. The surveillance procedures did not explicitly address fan operability. The licensee voluntarily revised the surveillance procedures and so notified .

the staff (Lentine May 1983). A sensitivity study showing the impact of thismodificationIsinNUREG/CR-3300(VolI,Section4).

(3) The licensee notified the staff on September 9, 1983 (Lentine, September 1983) that an emergency procedure was being put in place that would provide greater assurance that the containment spray injection system can L be utilized if necessary during the recirculation mode. This modification enhances the capability of the Zion plant to maintain containment cooling /

integrity after a core melt.

(4) In its letter transmitting the ZPSS (Lentine, September 1981), the licensee stated an intention to continue to test the RHR system check valves as required by the Confirmatory Order of 1930, because the ZPSS showed it to be of significant value to safety.

l 3.4 Sensitivity Studies Using the Sandia/Brookhaven/ staff models, the staff review of the ZPSS can evaluate the effects of differing assumptions and capabilities.

l l

' In the following sections, the staff presents sensitivity studies on the risk estimates (1) to display the uncertainties inherent in risk estimates (2) to indicate the potential benefits to be gained from further work to reduce these uncertainties or to verify the assumptions used Zion Risk Evaluation 3-8

l l

l These studies address five areas: fire; RCP seal LOCAs; containment fan coolers; i sequences with the potential of affecting both units; and " feed and bleed" core i cooling capability. A value impact assessment associated with the sensitivity i studies also is given.

3.4.1 Sensitivity Studies of Specific Areas 3.4.1.1 Fire

! NUREG/CR-3300 (Vol I, Section 4.6) gives Sandia's concerns about the shortcomings of the Zion fire analysis. These include concerns about hot gas layer effects, operator error assumptions, capable location, and the fact that the RCP seal LOCA sequence is not modeled. Sandia attempted to estimate the impact of these concerns using information from the Indian Point review and most likely e

" worst-case" assumptions. With these assumptions, the core melt sequence frequencies from fire are estimated to be as high as about 5x10 s/yr. The -

room. Table 3.9 most comparesdominant risk isestimates the new Sandia posed with by athefire in the cable spreading Sandia/Brookhaven / staff estimate not considering fire.

3.4.1.2 RCP Seal LOCA An important assumption in the Sandia review of the ZPSS is that a failure of i the CCW or service water system will cause a LOCA and cause the failure of the ECCS. Because not all past PRAs have considered this dependenc some have commented that the Sandia assumption is conservative,y the staffand because has done a sensitivity study to point out its importance. Table 3.10 shows core melt frequency estimates with and without an RCP seal LOCA. The impact on other risk indices can be estimated using NUREG/CR-3300. Table 3.10 shows that the RCP seal LOCA assumption and its uncertainty are very important to l

estimates of core damage frequency and risk. (For the case of no RCP seal LOCA, the sequences associated with DC battery depletion may be important.

These study.) sequences were not quantitatively treated in ZPSS or this sensitivity 3.4.1.3 Containment Fan Coolers The Sandia/Brookhaven/ staff estimates assume that the containment fan coolers

• are not impacted by the effects of a core damage environment. This assumption does not, of course, affect core damage frequency, but could affect the risk estimate. A bounding calculation provides insight into the importance of the  !

l fan coolers and their survival in the post-core melt environment. Also I

important to this injectionsystem: sensitivity The estimate study for person remsis /yrthe status would increaseof the from 246containment r

to 863/yr for each unit, if no credit is given for the o ment spray injection by refilling the RWST as necessary.perator However, using if fullcontain-credit is given for refilling the RWST, the importance of the fan coolers is negligible. ,

. )

i l

! Zion Risk Evaluation 3-9

)

m

~

3.4.1.4 Two-Reactor Core "elt .

In some cases it is possible for an accident to affect both units at a site.

An event such as a very large earthquake would affect the site as a whole, and both units would be subjected to the same accident initiator. Because the Zion CCW and service water systems are cross connected, both internal and external events that affect these systems will affect both units.

ZPSS Section 8.11 addresses site, or two-reactor, risk. The ZPSS gives both unrelated and related failure estimates. The increase in risk as a result of unrelated failures is a factor of two. The staff agrees with the ZPSS statement that the additional contribution to risk as a result of related failures is considerably more complex. The ZPSS states that a conservative approach would be to assume simultaneity of release, in both magnitude and timing. The ZPSS two reactor risk " envelope" using this approach is shown in ZPSS Figure 8.10-7.

It is close to the 90th percentile curve for early fatalities, except in the tail or large consequence / low probability area.

One aspect of two-unit risk not discussed in the ZPSS is the internally initiated two reactor sequence related to the cross-connected CCW and service water systems. Because these systems play an important role in Sandia's dominant sequence estimates, they are also very important to the two-reactor estimate.

. .s For two reactors, NUREG/CR-3300 (Vol I, Section 4.5) estimates a frequency of core damage of 1.8x10 4/yr and a frequency of a large release of 3.6x10 8/yr.

A seismic event would be the dominant cause of this large release sequence. -

The staff estimate of the two reactor core melt frequency is somewhat less -

about 1.1x10 4/yr, because of differing success assumptions for the component-cooling water and service water systems. The 1.1x10 4/yr frequency results from combining the CCW pipe break frequency estimate with the RCP seal LOCA dependency. The staff considers this estimate to be conservative and very uncertain. ,

Moreover, a considerable CCW and service water system reliability benefit is gained because these systems are cross connected. The staff has not done a detailed study to consider " tradeoffs". The frequency of a large release seismic initiator that could affect both units may be reasonable, but a detailed study '

of each unit's release timing and magnitude has not yet been done. The only two-unit estimate that has been made by the staff is in NUREG/CR-3300 (Vol II, Appendix C). This estimate assumes a double source term is released all at once, which is probably conservative. The lar source term is the effect on early fatalities, gest impact which in doubling increases the of by a factor about 16. .

3.4.1.5 Feed and Bleed Interest is often expressed about the importance of feed and bleed to core damage frequency and risk. To provide an estimate of its importance, the Sandia/ Brookhaven/ staff model can be altered so no credit is assumed for feed Zion Risk Evaluation 3-10

and bleed cooling. (Some credit is given in the model for recovery of main

1. feedwater after turbine trip, reactor trip, and main steam isolation valve closure events; no credit is given after loss of main feedwater or loss of offsite power events.) Table 3.11 shows core damage frequency estimates with and without feed and bleed cooling.

3.4.2 Value-Impact Associated with Sensitivity Studies The staff has evaluated the potential values and impacts of modifications or additional work using the benefit / cost algorithm of $1000 per person-rem of radiation dose averted.

(Section 4 below addresses additional considerations.)

The staff considered impacts up to 50 miles from the plant. If 500 miles were used, the population dose estimates would approximately double.

The estimates given below are for both Zion units; they were calculated using the following formula: '

(2 units) Estimated $1000 per 30 yr _. Present person-rems person-rem plant life worth averted per year Specific value impacts for four areas of concern and the staff's conclusions regarding each are as follows:

(1) Fire: 2(473)($1000)(30) = $28' million Considering the potential benefit, the staff considers that additional work and modifications in the fire hazard areas to be reviewed according to Appendix R to 10 CFR 50 appear prudent. ,

, (2) RCP Seal LOCA Assumption: 2(88.7)($1000)(30) = $ 5.3 million Considering the impact of assuming that the RCP seal LOCA is not a problem,

-' the staff believes that it would be prudent to continue to study this issue as an item of reasonably-high priority. Generic Issue 23 addresses this issue. It also may be prudent for the licensee to make low cost modifications.

(3) Containment Fan Coolers: 2(301)($1000)(30) = $18.1 million  !

This estimate assumes that the fan coolers will fail after all core melt accidents which is a conservative assumption. No credit is given for operation,of the containment spray injection system by refilling the RWST as necessary. On the basis of these considerations, the staff believes that the current research on engineered safety features in degraded core environments appears to be prudent and cost effective.

Zion Risk Evaluation 3-11

. s (4) Feed and Bleed Cooling: 2(20)($1000)(30) = $1.2 million On the basis of this estimate, revising procedures (which has been done at Zion) and training operators in this cooling mode appear to be cost-beneficial. Instituting this type of training was included as part of the 1980 Confirmatory Order (Item 7 to Appendix A, Loss of All Normal Emergency Feedwater).

3.5 Risk Reduction and Cost Benefit The staff evaluated risk reduction and cost benefit in the areas of prevention and mitigation. These areas are discussed below.

3.5.1 Prevention One way to reduce risk is through prevention of ( v reduction of the likelihood of) a core melt accident. Although a thorough sear h for additional prevention features was not within the scope of the staff's Zion review, the review did identify several ways to reduce risk through prevention of a core melt accident.

Those ways, which are discussed in Section 3.3 above, include (1) making the normal PORV block valve position "open" rather than closed.

This reduces the necessity of ra valves during an ATWS sequence. pid operator action to open the block (2) improving the surveillance procedures for safety system room coolers.

This greatly improves reliability of the mitigating systems.

(3) continuing to test the RHR (low pressure to high pressure) system check valves.

The staff also considered other ways to reduce risk through prevention. These include reducing the possibility of fire, eliminating the possibility of a LOCA caused by RCP seal failure, and enhancing the capability for core cooling via the feed and bleed technique. In addition, as discussed in Section 3.1.4, the staff recommends that RHR suction valve integrity checks be performed at each refueling outage. The staff's findings in these areas are as follows:

(1) Fire O

Sandia was not able to complete a best estimate fire review because of the unanswered questions about the Zion fire analysis. However, Sandia was able to do a bounding analysis to determine the need for or benefit to be derived from more work in the fire area. The bounding estimates of expected annual risk indicate no increase in early fatalities but a  !

factor of 5 increase in latent fatalities and person-rems of exposure. '

On the basis of the $1000/ person rem algorithm, additional work to ensure that the Sandia sequences are addressed in the context of Appendix R appears prudent. -

Zion Risk Evaluation 3-12

, o -

.~ -

(2) RCP Seal LOCA .

As shown in Section 3.5.1.3, the RCP seal LOCA assumption used in the ZPSS and Sandia studies is important'to the risk and core melt estimates.

When no RCP seal LOCA dependency is assumed, core melt frequency is reduced by a factor of 4 and exposure levels are reduced from 247 person-rems /yr to about 76. (To 50 miles, exposure levels are decreased from 128 person-rem / year to 39 person rem / year). Again using the $1000/ person -

rem algorithm, the staff finds that there would be value in continued research and testing by industry and the staff.

(3) Feed and Bleed i

Sensitivity studies show that without a feed and bleed capability, the estimated core melt frequency increases a factor of 3.5 and the estimate of person rem /yr exposure increases by 37 yr. (To 50 miles, exposure levels increase by 20 rem / year.) (These procedures were required by the Order and are part of the system oriented emergency procedures.

(4) RHR Suction Valve Integrity Tests The staff estimate that, without RHR suction valve integrity tests the frequency of event V would be about 1x10 s/yr, and would decrease an order of magnitude or more (a factor of 30) with annual valve integrity tests. Such testing would reduce the expected annual population dose -

1

• within 50 miles of the plant by 15 person-res/ year (per unit), or 450 person-rem over the plant lifetime. At $1000/ person rem, the benefits of such testing is $450,000. (The population dose within 500 miles would be reduced by about 28 person-rem / year.) The staff crudely estimates that the cost of testing the valves (discounted to the present at a 5% discount rate) is $42,000, assuming the testing is similar to the leak testing required for near-term-operating-license plants (draft staff analysis performed for prioritization of generic issue 96). Thus, the testing seems clearly cost-beneficial. In addition the testing would reduce substantiallytheearlyfatalityrisk,asdiscussedinSection3.1.4.

'l Occupational exposure doses have not been estimated precisely, but rough estimates indicate that they do not impact the cost-benefit analysis significantly. They would not affect the cost-effectiveness of the modification. Resources required by the NRC would be minimal. Con-sidering the decrease in early fatalities, as well as the decrease in expected annual population dose, there is a substantial increase in the protection of the health and safety of the public.

3.5.2 Mitigation The purpose of a mitigation feature is to mitigate the consequences of severe accidents that are beyond the design basis of nuclear reactor containment buildings by reducing or eliminating one or several of the potential contain-ment building failure modes discussed in this report. It is, however, important to stress that the existing containment buildings adequately mitigate the consequences of a wide range of postulated accidents that are more severe than those considered in the original design of the building. A new mitigation feature combined with an existing containment building design will mitigate the consequences of an even wider range of severe accidents.

1 Zion Risk Evaluation. 3-13 l

The safety benefit of a mitigation feature can be determined qualitatively by assessing its capability to eliminate or reduce the effect of a particular containment building failure mode. This can be done without a PRA. However, useful insight can be achieved by quantifying the safety benefit of a mitiga-tion feature by using the PRA approach. This approach produces a quantitative measure of safety benefit by determining the risk reduction resulting from such,a feature, and hence the effect on the public.

Any practical engineered safety system will have some inherent unreliability and potential negative characteristics that must be taken into account in any assessment of its safety benefit. Thus, practical engineering conceptual designs are considered that meet certain functional requirements and design criteria. On the basis of the conceptual designs, unreliability can be estimated. In addition to unreliability, it is very important to consider the potential negative characteristics of a mitigation feature. In a PRA context, these negative features can be considered " attendant risks" (that is, new risks that are introduced by the character of the feature itself). Although the staff has not integrated unreliability and the potential negative characteristics of mitigation features into a PRA for Zion in the discussion that follows the staffwillconsiderthepotentialbenefitofidealmitigationfeatures.

Ideal features prevt.nt the following containment failure modes by meeting the following requirements:

(1) For combustible gas control (preventing hydrogen burn (y) failure mode),

either (a) provide for the controlled burnine of an amount of combustible gas sufficient to render the containment building inert by oxygen depletion so that thermal or pressure loadings from controlled burnin vital equipment or the containment building to fail or (b) g render do notthe cause containment atmosphere inert either before or after the start of an accident so that the containment building does not fail as a result of the pressure loadings contributed by this activity.

(2) For control of gradual overpressurization of the containment building (preventing overpressurizaton (6) failure mode) provide a reliable means to remove the energy causing overpressurization,so that (a) the containment building failure pressure is not exceeded and pressure is brought below the design pressureithin w(b)about the containment building 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the start of the control measures. The basis for recommending the 12-hour period is the need to limit the initial leakage that would occur at pressures in excess of those the building was designed to withstand.

(3) For control of basemat penetration (preventing basemat penetration (c]

failure mode), ensure that interactions between the core and concrete are limited by establishing a coolable debris bed in the reactor cavity.

On the basis of these three requirements, the following options are available for further consideration for Zion: ,

l (1) to control combustible gases controlled hydrogen burning containment inerting Zion Risk Evaluation 3-14

. .. c o

s (2) to control building overpressurization filtered vented containment system (FVCS) passive containment heat removal system (PCHS) an improved containment spray system

! (3) to prevent basemat penetration a system to flood the reactor cavity l

a core retention system As long as these features function ideally as designed, are 100% reliable, and do not themselves introduce any negative characteristics, the impact of these l features on releases of radioactive materials from the containment building l can be determined by assigning a probability for failure of zero to those t

accident failure modes for which the mitigation feature is designed. .

3.5.2.1 Impact of Mitigation in the ZPSS The ZPSS included a study of three potential features for mitigating core melt accidents:

l (1) a filtered, vented containment (2) a core ladle (3) an improved diesel-driven containment spray system To understand the effect these features have on the established risk, it is important to briefly review the results of the ZPSS.

In evaluating the risk caused by internally initiated accidents, the ZPSS found I

(1) The total frequency of core melt is 5.7x10 5 per year for internal initia-tors.

(2) The loss of recirculation cooling for the small- and large-break LOCAs

, with containment safeguards available accounts for 28% of this frequency.

(3) Events with no safeguards represent approximately 0.6% of the core melt frequency estimates, and the Event V sequence (interfacing system LOCA) represents about 0.2%.  ;

(4) Because 99% of the core melt sequences do not lead to containment failure, the internal risk is dominated by the Event V sequence.'

In evaluating the risk caused by externally initiated accidents, the ZPSS found .

(1) The incremental risk from external events is dominated by seismic initiators and fires.

Zion Risk Evaluation 3-15 l

(2) The total frequency of core celt f. rom external initiators is 1.0x10 5 per year.

(3)' The dominant risk that would result from a seismic event is loss of ac power, which would lead to failure of containment safeguards.

(4) Seismic events pose the dominant risk because the loss of containment safeguards leads to containment overpressurization.

The ZPSS finds that total risk at Zion is (1) majorseismicevents,90%

(2) Event V sequences, 5%

(3) loss of all ac power and auxiliary feedwater, 3%

In the ZPSS, the three mitigation features listed above (a filtered, vented containment; a core ladle; and an improved diesel-driven containment spray system) did little to reduce the risk because the were ineffective against the dominant sequences the(yEvent did not mitigate against V sequence or the or seismicevents). As an example, the filtered vent was studied first for

%. internal initiators. The ZPSS showed that the frequency of late overpressuri-zation was reduced by 2.5 orders of magnitude. Even though this release category was effectively eliminated, the low aressure interfacing LOCA (Event V sequence) was dominant, and the change in ris( was small. For external events, the ZPSS assumed that the filtered vent system was seismic category 1, and lhad the same probability of failure at a given ground acceleration as did the refueling water storage tank. Because seismic events beyond the design basis dominate risk, little risk reduction was seen in this case. If the seismic risk and the Event V seq'uence were eliminated, the mitigation features considered could be expected to have a more dramatic effect on risk reduction.

3.5.2.2 UCLA Assessment of Mitigation at Zion To explore some of the inherent limitations of the ZPSS mitigation study, the staff contracted a study at the University of California at Los Angeles (UCLA).

A portion of the study focused on the potential for reducing risk for filtered vented containment systems; this study, which was applied to the Zion plant, is dest.ribed in some detail in Appendix C. Basically, it verified the import-ance of the Event V saquence and seismically initiated core melt on potential risk reduction. It also indicates that other factors (such as assumptions about hydrogen production, residual risks as a result of filtered vent releases, .

protection of the basemat, and enhanced risk reduction) are important in the consideration of combinations of mitigation systems.

3.5.2.3 Staff Assessment of Mitigation Features Since the completion of the ZPSS and UCLA studies, NRC contractors at Sandia and Brcokhaven have reviewed the ZPSS (NUREG/CR-3300, Vols I and II). The staff i

Zion Risk Evaluation 3-16

o 0 '

has reviewed their results, and the staff's conclusions regarding the poten-tial benefit of the installation of mitigation features at Zion are based on the staff's (and contractors') evaluation of risk, not on the ZPSS estimates.

Estimates of the safety benefit (risk reduction) of the mitigation features can be determined in several different forms as follows:

(1) by plotting CCDF curves comparing the societal risks (early fatalities, delayed cancer fatalities).before and after mitigation strategies are incorporated (2) by plotting curves of individual risks as a function of distance from the facility before and after mitigation strategies are incorporated (3) by comparing the numerical values

• obtained by integrating the CC0F curves have that been represent implemented the risks before and after mitigation strategies In its evaluation, the staff has used form (3). Numerical values were determined by multiplying the conditional expected values for societal consequences for each release category (as listed in Tables 3.4 and 3.5 of NUREG/CR-3300, Vol II) by the probability for each release category (as listed in Table 4.33 of .

NUREG/CR-3300, Vol II) and summing to determine-the total risk numerical values for each of the failure modes under consideration. A summary of the risks associated with each failure mode is given in Table 3.12. '

Table 3.12 shows that the gradual overpressurization failure mode dominates the early fatality damage measure.

However this applies to accident sequences l initiated by externally initiated (seismic), events in which evacuation of the population .s assumed to be impeded by the external initiator. For overpressuri-zation failure as a result of accident sequences initiated by internal events, in which evacuation of the population is unimpeded, no early fatalities are predicted.

i b

The staff notedfailure pressurization abovemode:

that three features are available to mitigate the over-system. FVCS, PCHRS, and an improved containment spray All of these failure mode; however systems could potentially prevent the overpressurization i the FVCS has the attendant risk that would result from

" opening" the containm,ent and experiencing the releases associated with the filter inefficiency. To reduce the early fatality risk, the systems would have to survive the seismic event responsible for the accident. Not only is seismic qualification of systems expensive, but the earthquakes of concern are those producing earthquake. ground accelerations at least twice that of the design basis However, the present containment spray is seismically qualified, and it may not of be so expensive seismically-induced failure.to modify it in apump (The diesel-driven wayatwhich retains present has a 50 its low probab chance of failure for orthquakes with 44 times the ground acceleration of a design basis earthq

• These numerical values represent the values expected for societal risk. As with of riskthe CCDF curves themselves, the comparison can be made for a variety measures.

Zion Risk Evaluation 3-17

. . l The gradual overpressurization failures arising frcm internal events contribute only 39 person rem / year to 500 miles, or 19 person rem / year to 50 miles, to the population dose. At $1000 per person-rem, and a 30 year remaining lifetime for the plant, a feature which only mitigated internally-initiated overpressurization failures would have to cost less than $570,000 to be cost-effective.

A feature which mitigated both internally-initiated and externally-initiated overpressurization events would reduce the population dose within 500 miles by 188 person rem, and within 50 miles by 96 person-rem. At $1000 per person rem, and a 30 year remaining lifetime, the mitigation feature would have to cost less than $2.9 million dollars. The assumption here is that the mitigation features would mitigate all overpressurization events. The staff has not performed a detailed cost estimate for each of the three mitigation features listed above; however, using the $1000 per person rem algorithm, the staff can reasonably conclude that a FVCS or PCHRS is very unlikely to be cost effective, whether or not the system is seismically qualified.

It may be possible to improve the reliability of the containment spray system during station blackout events in a cost effective manner because each Zion unit already has a diesel spray pump. A containment spray system independent of ac power would avert almost all the risk associated with internally initiated station blackout events, and, more importantly, would eliminate events.40% of the risk associated with seismically initiated station blackout about (In a seismic event in which either the auxiliary building shear wall failed or the refueling water storage tank failed, containment overpressurization would still occur.)

This modification would involve eliminating the need to cool the diesel pumps with valves service water that is supplied from ac powered pumps, and changing several to de power.

is shown in Figure 3.1. Such a system modification is described in the ZPSS and This modification is similar in concept to turbine-driven AFW pump modifications made at many PWRs in the past few years. The staff estimates that, over the 30 year remaining lifetime of the plant, the expected population dose to persons within 50 miles of the plant would be reduced by 1530 person rem (per unit) by this modification. Using a

$1000/ person-rem algorithm, the modification is cost-effective if the modification to each unit costs less than $1.5 million. The staff has not made a cost estimate for the modification, although it would appear that it is cost-effective.

any appreciable benefit.The modification would have to be seismically qualified for reduced by about 20L Moreover, the risk of early fatalities would be ,

dose averted within 50 milesThe benefit estimate given above was for population based on $1000/ person-rem, wo;uld double.if 500 miles were used, the benefit estimate, Occupational exposure incurred as a result of making the modification is judged minimal. The resource cost to the NRC is minimal. There is substantial Increase in the public health and safetyfatalities.

early by this modification, especially considering the reduction in expected The potential benefit to be gained by eliminating the two other failure modes listed in Table relatively 3.12 (burning of combustible gases and basemat penetration) is small. On the basis of the $1000/ person-rem algorithm and considering population doses to 50 miles, it is worth 'only $40,000'per unit to eliminate basemat penetration; therefore, a core retention device would not be Zion Risk Evaluation 3-18

1 cost effective. By similar arguments, it is worth $0.4 million per unit to eliminate the burning of combustible gases failure mode. However, the staff finds that there is considerable uncertainty associated with the probability of this failure mode, and thus this estimate may be rather conservative.*

Therefore, the staff considers the $0.4 million value to be an upper bound on the potential benefit of removing this particular failure mode. The staff's best estimate of the potential benefit would be significantly lower. Thus, it is not clear that installation of a controlled hydrogen burning system would be cost effective. However, the Zion containment is not any more susceptible d to hydrogen burn failures than are other large, dry containments. Therefore, the staff proposes to examine hydrogen control for large, dry containments generically through its ongoing research programs. These programs include understanding the phenomena and potential mitigation strategies.

The staff's task action plan developed in 1980 to study the need for retrofits at Indian Point and Zion placed a heavy emphasis on mitigation factors such as hydrogen control, controlled filtered venting of containment, and a core reten-tion device. This was done because it was not clear, then, that the plants as built provided effective mitigation of the offsite radiological consequences of core melt accidents. At that time, it was plausible that hydrogen burris or pressure surges associated with vessel meltthrough might breach containment in most core melt accident scenarios. More recent staff studies have shown that this is not the case. In 1980 it was plausible that the gases that evolved from core / concrete interaction, together with other contributors in the pres-sures and temperatures in the containment following core melt, might lead to .

. fatalities gross early offoverpressure failure of containment and high projections for early the site. Again the staff's more recent studies indicate that this is not the case. Rather, the staff has found that gradual overpressure failure of containment (1) will not take place with an operating containment heat removal system, (2) will take a long time to develop in any case, and (3) will not produce early fatalities as a result of internally initiated events.

radiological Basemat risk. meltthrough has been found to produce very little offsite Thus most of the desirable attributes of retrofits once proposed as ways to mitigate accident consequences are already present in these

• Estimates of containment failure via hydrogen burning may be conservative for a number of reasons.

of hydrogen would haveFor the Zion containment to fail, at least 3000 pounds to burn. This quantity of hydrogen is equivalent to a 150% zirconium reaction (significant steel oxidation must occur). In addition, a high steam mole fraction would also be required to cause containment failure during the hydrogen burn (but too much would make the containment inert).

Finally, it must be assumed that all of the hydrogen burns in one severe combustion event. If the hydrogen burns in a series of burns, the containment integrity will not be challenged. However, uncertainties associated with combination phenomena (such as non uniform distribution and the potential for flame this acceleration failure and detonation) make the staff's continued consideration of mode necessary.

Zion Risk Evaluation 3-19

.. o )

plants.

Further, because both Zion units already have diesel containment spray pumps, additional risk reduction is available at relatively low cost with a rather straightforward system modification.

The staff estimates of risk at Zion are very small fractions of the competing background nonnuclear risks (according to the Indian Point ASLB; NRC, 1983).

In addition, as described above, only relatively inexpensive features (or strategies) would be potentially attractive for further risk reduction under the benefit-cost guidelines presented here. Therefore, in addition to recom-mending modification of the diesel containment spray sytem, the staff intends to continue pursuing mitigation options for Zion, within the context of the policies outlined in draft NUREG-1070, "NRC Policy on Future Reactor Designs:

Decisions on Severe Accident Issues in Nuclear Power Plant Regulation," dated April 18, 1984. The staff considers this approach consistent with the approach for Zion and Indian Point action as described on Figure 1.1 of NUREG-0850--

namely that, if the staff determined that Zion did not pose undue risk (see Section 1.2 above), then the matters relating to mitigation would be considered as part of the generic activities for all operating reactors.

3.5.3 Emergency Response Emergency response improvements were not within the scope of this review and were not considered. The staff is aware of ongoing efforts to improve the generic emergency planning requirements.

8-Zion Risk Evaluation 3-20

l lI ,l I

+ -

(W . =

.M SM Y WE

.M ET R ST

.OS E S RY T A OY FS 'T TS A ,

q B ,

3 -

- p W E g N

!' s T

! V S '  !,

W -

R - n i

- a 4 R

, A' rj

~

&V

~

O T

C t

r y

V U a I

j g

$g 3; ]

D E

l r

p s

2 3 e V y s e

i X. .

d n

t o

? i1 Y P 3

R ,- I K Z -

o 1

< E E N t1 T

T 3 '

N I

A T n9 A G o -

B R N t l

i e t r O P / O au -

W T M ' e cg E A U N We AS i i N R P fF l

l E M i dS h

h i P

O

@/ #

F O

R oS mP Z

S l C. a

- D i :

t e

- W nc T ' er

- E F '- t u lI I1 N oc PS g ' 6 1 l T T

F  ;

S

< -3 1 I V N M 3

>V E R A e

- ' M L r

EN u I A g e

- DA F _

i

] I '

I ST MF f TN OO UO O T OC R U H

f 's/ # fy//j L S O

R L T ES N E Y S O I AR C D RE - -

PD S A S A

OE TH No [ ~ c.o" w4~

T .

/

N Table 3.1 ZPSS compsrisen of cera melt and release frsqu:ncy contributions--

impact of containment and engineered safety systems r] .

3

= .

F .

m N

"'*" ^^""*I Centalnment Split Hean Annust tems with .

frequence of Serious f respect to Sequence gg ( ,""g {,, Fraction to Serlous telease Release

{'

g Core Iselt ,

g,g,,,g,ggg g,,,,,,c,

]W I4 1.67 9 4 c8 1 stPC $nall LOCA: Failure of Recirculation Coeling 1.62 5*

24 2 86 5elselt Less of All AC Power 5.60 6 l-0 5.60 6 I SS 34LPL Large LOCA: Fallure of Rectrculation Coollag 4.89 6 l.4 4.89 10 5 38 4 ALPL Hedlue LOCA: Failure of Rectrculation Cooling 4.89 6 14 4.89 10 6 es s siFC Less of Hain reedwater: AlW5. Failure to Cantrol Pressure 3.e9 6 :1 4 3.89 10 8 Rise (l.e., f ailure of Augmented Aunillary Feenhgater or PrimaryPressureRelief)

F4 6 SE PS furbine Irlp: AlW5 Failure to Control Pressure Rise 2.76 6 14 2.76-10 7

. (i.e.. Failure of Augmented Ausillary feedwater er ca Primary Pressure teller)

• l.64.6 14 1.64 10 9 8 4 88' 7 Stf( 5purlous safety injectioni Fall ri to Contral the St.

m settreulation Cooling -

to 88 8 sLC s

5purlous 5ately injectlens Less of Offsite Power. Loss of 1.43 6 14 l.43-10

• ' E5f Buses les and 149 large LOCA: Fallure of low Pressure lajettlon 1.32 6 l.4 1.32 10 11 93 1Aset le pf 10 AntC Medlue LOCA: Fallure of Low Pressure injection 4.36 7 14 4.36 11 less of Mala feedwater: Loss of Offsite Power. Loss of E5F 2.91 7 2-4 5.82-11 12 95 il vsr.

Suses 148 and 149. Fallure eI~AustIIary Fer3 water 2.23 7 24 4.46 11 13, 88 12 714. Weatter Irlp: tess of Of fsite Po or. toss of [5F Buses 148 ,

and .549-Fallure of Auslliary Icedwater .

ps 3 3 vg-c- turbine Irlp: toss of Of fstre Power. Less of [5F Euses 148 2.14 7 24 4.78 11 15 l' end 149. Failure of Ausillary f eedwater Iurbine Irly Due te less of Offstte Powert loss of all AC 2.00 7 1.0 2.00 7 2 at 14 ff Power. Fallure of Aviillary reedwater i 14 1.33 11 16  ;

g6 in 1E Less of Main Feedwater: Fallure of Ausillary Feedwater. l.33 7 Fa.llure of Bleed and Feed Coeling 1.16 V laterf acing System LOCA (RHR inlet vahes) 1.05 7 1.0 1.05-7 3

• 11 rthand notatten meaning 1.62 a 10-5 .

*1.62-5 = 1.62 x 10 5 RC = release category PDS = plant

• damage state l

8 W g

Table 3.2 Dominant accident sequences ident.ified by Sandia Plant Annual Rank Sequence damage state

• frequency **

1. CCW failure (causing failure of all SEFC six10 4 charging and safety injection pumps, RCP seal LOCA) 2.*** Small LOCA; failure of recirculation SLF 1.6(-5) cooling

3. Failure of de bus 112, causing failure TEFC 7(-6) of one PORV and loss of ac bus 148; failure of auxiliary feedwater 4.*** Seismic; loss of all ac power SE 5.6(-6) 5.*** Large LOCA; failure of recirculation ALF 4.9(-6) cooling >

6.*** Medium LOCA; failure of recirculation ALF cooling 4.9(-6)

7. Loss of offsite power; CCW failure; SEFC 1.9x10 8 failure to recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (recovery prior to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />)

8. Loss of offsite power; CCW failure; SEFC 1.6x10 8 failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (recovery prior to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) 9.*** Large LOCA; failure of low pressure AEFC o injection 1.4(-6)

10. Loss of offsite power; failure of TEFC 1.2x10 8 auxiliary feedwater; failure of feed and bleed; failure to restore offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (recovery prior to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />)

11. Loss of offsite power; failure of TEFC 9x10 7 auxiliary feedwater; failure of feed and bleed; failure to restore power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (recovery prior to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />)

12. Loss of offsite power; CCW failure; SEC 6.6x10 7 failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; failure of containment fans

• See notes at the end of this table.

Zion Risk Evaluation 3-23

O O Table 3.2 (Continued)

Plant Annual Rank Sequence damage state

• frequency **

13. Loss of offsite power; CCW failure; SE 1.2x10-6 failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; failure of containment sprays and fan coolers

14. Loss of offsite power; CCW failure; SEFC 9x10-7 failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

Interfacing system LOCA **** V ~1(-6)

• Plant Damage States:

S = small LOCA F = containment fan coolers operate A = large LOCA C = containment sprays operate E = early core melt V = interfacing systems LOCA L = late core melt

• • Point estimates: 2(-4) = 2x10 4

• • • Sequences identified by the ZPSS to be dominant

• • • • Included here because of its potential impact on risk Sandia actually estimates 1(-7) for this sequence, based on the assumption that the RHR suction valves are tested each refueling outage. The ZPSS states that this testing is performed, but the staff subsequently learned that such testing is currently not being done. It is estimated that without such periodic testing of both valves, the sequence frequency would increase by about a factor of 10.

• • • • • These sequence estimates are based on review of the ZPSS by Sandia as modified by more recent information on component cooling water and service water success criteria of 1 pump and 2 pumps respectively. l l

i Zion Risk Evaluation 24

. l

D

• Table 3.3 Loss of o.ffsite power followed by CCW/ service water (SW) failure (sequence frequency per year)

CCW-SW success criteria %

Rank Sequence

• 2CCW-2SW** 1CCW-35W 1 . 1CCW-25W***

2. Loss of offsite power; failure 4.6x10 s 2.7x10 5 1.9x10 8 of CCW/SW; failure to recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; containment cooling available, (sprays and fans) 3.. Loss of offsite power; failure 4.0x10 5 2.3x10 s 1.6x10 8 of CCW/SW; failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />; containment cooling available (sprays and fans)

4. Loss of offsite power; failure 1.8x10 s 1.5x10 s 6.6x10 7 to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; containment cooling available (sprays only)

• 1

6. Loss of offsite power; failure 7.8x10 8 2.0x10 8 4.9x10 8 of CCW/SW; failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; containment cooling available (fans and sprays)

11. Loss of offsite power; failure 4.7x10 8 5.5x10 8 5.6x10 7 of CCW/SW; failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; containment cooling (fans and sprays) fails TOTAL 1.2x10 4 7x10 s 4.7x10 8

• Basad on Table 3.2

• • Success criteria used in Sandia point estimate.

• • • This criteria is considered the bcst estimate. .

Zion Risk Evaluation 3-25

Table 3.4 Comparison of loss of offsite power sequence frequency Sequence

• Sandia estimate ZPSS estimate '

2 4.6x10.s 4.2x10 8 3 4.Ox10.s 1.8x10 5 4 1.8x10 5 <2.3x10 8 6 7.8x10 s <9.9x10 9 11 4.7x10 8 <5.9x10 9

• From Table 3.2.

Table 3.5 Estimates of frequency of loss of offsitepower(peryear)

Source of estimate 1-hour loss 8-hour loss 3

ZPSS 0.004 <10 s Sandia/EPRI NP-2301 0.03 0.008 4 NRC staff A-44 work

• 0.04* 0.01

• A-44 draft information assumes frequencies of 0.06/yr for the generic plant and about 0.04/yr for better than average plants. The staff assumes that Zion is better than. average.

Table 3.6 Estimates of core melt frequency caused by internal events (per year)

Confidence limits Source Point estimate L95 U95 ZPSS 5x10 5 5x10 8 3x10 4 Sandia 4x10 4* 2x10 s* 2x10 3*

• Sandia estimate. Differs from staff estimate because of differing success criteria for service water and component cooling water. Staff point estimate is 1.6x10-4 Zion Risk Evaluation' 3 ._

Table 3.7 Estimates of frequency of severe releases caused by internal events (peryear)

Confidence limits Source Point estimate L95 U95 ZPSS 2x10 7 1x10 8 4x10 8 Sandia 6x10 8* 1x10 8* 3x10 s*

• See footnote at bottom of Table 3.6. Staff point estimate of severe release frequency is 2.5x10-6/yr.

Table 3.8 ZPSS estimate of frequency of severe releases caused b events (per year)y external (seismic)

Confidence limits Source Point estimate (mean) L95 U95 ZPSS 6x10 8 4x10 8 1x10 4 Table 3.9 Sandia/Brookhaven/ staff core melt frequency estimates with and without consideration of fire (per year)

Parameter With fire Without fire Core damage frequency 2.1x10 4 1.6x10 4

. Person-rems of exposure 1213 247 (to 500 miles) e i Person-rems of exposure 601 128 (to 50 miles)

Zion Risk Evaluation 3-27

Table 3.10 Core mel't frequency estimates with and without consideration of RCP seal LOCA (per year)

With RCP seal LOCA Without RCP Parameter assumption seal LOCA

_ Core damage frequency 1.6x10 4 4x10 s Person-rems of exposure 247 76 (to 500 miles)

Person rems of expos ~ure 128 39 (to 50 miles) 4 1

Table 3.11 Core melt frequency estimates with and j

without feed and bleed cooling (per year)*

With feed and Without feed and Parameter bleed cooling bleed cooling Core damage frequency 1.6x10 4 5.6x10 4 Person-rems of exposure 247 284 (to 500 miles)

Person rem of exposure 128 148 a

(to 50 miles)

• Based on Sandia estimates in NUREG/CR-3200 Vol.

Table 3.12 Expected annual societal risks associated with Zion containment failure modes (per year)

Containment failure Early Early latent Total Person- Person- -

mode fatalities injuries fatalities . thyroid rems rens**

Burning of -

1.7(-5)* 1.4(-3) combustible 4.0(-4) 27 14.5 gases Gradual over- -

9.3x10 4 2.3(-3) pressurizaton 5.1(-4) 39 19 (internally initiated events only)

Zion Risk Evaluation 3-28 i _

i Table 3.12' Expected annual societal risks associated with Zion containment failure modes (per year)

(cont'd)

Containment -

failure Early Early Latent Total Person- Person-mode fatalities injuries fatalities thyroid rems rems **

Gradual over- 6.72(-4) 6.81(-3) 8.96(-3) 2.1(-3) 152 78 pressurizaton (externally initiated eventsonly)-

Basemat - -

1(-4) penetration 4(-5) 1. 6 1. 3 Interfacing 6.2(-4) 1.9(-3) 1.7(-3) 7.2(-4) 28 15 systems LOCA***

Note: *4.91(-5) = 4.91 x 10 s

• • Person-rems to 50 miles

• • • Using Sandia's. frequency estimate of 1x10 7/yr, if there is no periodic valve testing, these estimates are lower by about a factor of 10.

o

. Zion Risk Evaluation 3-29

4 Conclusions The Zion Probabilistic Safety Study (ZPSS) is a comprehensive assessment of the risk at the Zion site, consistent in scope and detail with ongoing PRAs.

Its treatment of external events and the containment analysis represent advancements over what has been done in the past. Special consideration was given to displaying uncertainties and utilizing plant-specific data. Using its own defined decision and logic framework, the staff has been able to use the ZPSS as a source document in considering risk reduction.

4.1 Qualitative Interplant Comparison By breaking down a PRA into its key segments--systems analysis, containment analysis, and site consequence analysis--one can make qualitative interplant comparisons. The staff review of the Zion plant systems indicates that the Zion units have strengths in the area of the response of plant systems to transients and small LOCAs. The staff has also determined that large, dry containments (such as the Zion containment) are likely to contain most core melts should they occur, resulting in significant reduction in the magnitude of offsite consequences. For Zion, the site characteristic obviously most important is population density around the plant, which is at the high end of the population spectrum for plants licensed by the NRC.

4.2 Zion Risk Insights Table 1.1 compares the dominant accident sequences in the ZPSS with those developed by the staff and its contractors, Sandia and Brookhaven. The ZPSS estimates a total core melt frequency of 7x10.s/yr, with no single sequence risk above 1x10 4/yr. ZPSS estimates the dominant core melt sequence to be a small LOCA with a failure of emergency core cooling system (ECCS) recirculation; the frequency of this sequence is 1.6x10 s/yr. The ZPSS estimates that a seismically initiated loss of all ac power dominates the risk. Based on the Sandia review of the ZPSS and additional information provided by the licensee subsequent to this review, the staff estimates the total core melt frequency to be 1.6x10 4/yr. The loss of component cooling water is estimated to dominate at 1x10 4/yr. Some loss of component cooling water events would affect both Zion units because the systems are cross-connected. The loss of l

offsite power initiated sequences are estimated to be more significant than in ZPSS. The frequency of core melt from these sequences is estimated to be 5x10 6/yr. The staff review indicates that an interfacing systems LOCA (Event i V) is about an order of magnitude more likely than the ZPSS estimates because the residual heat removal (RHR) suction valves from the reactor coolant system are not tested, as the ZPSS assumes. Although the seismically induced loss of all ac power remains a dominant contributor, design-basis earthquake (.17g) have a very small probability of causing loss of all ac power; earthquakes with ground accelerations between 2 and 3 times the design basis ground acceleration contribute the greatest portion of the seismic risk.

Zion Risk Evaluation 4-1 1

, e 1

F 1

4.3 Risk Reduction 4

4.3.1 Prevention 1

A formal search for additional preventive actions was not within the scope of the staff review; however, two items identified in the review have been corrected

voluntarily by the licensee, .which should help prevent a core melt accident.

These items are (1) opening the normally closed power-operated relief valve (PORV) block valves and (2) improving the testing of the safety system room coolers. ,

Continued testing of RHR system check valves (as required by the Order (Renton,.1980) and agreed to by the licensee) should reduce the probability of an interfacing systems LOCA. The staff recommends the testing of the RHR suction valves as well (as was assumed in the ZPSS) to reduce the likelihood of their failure. Moreover, the staff should expand the review according to the criteria in Appendix R (Fire Protection).to Title 10 of-the Code of i Federal Regulations Part 50 (10 CFR 50). The review would determine if the i 10 CFR 50 Appendix R measures already taken or planned at Zion consider the.

core melt sequences identified in the Sandia review. These sequences include I postulated fires in the cable spreading room, which could lead to a loss of all auxiliary feedwater, high pressure injection, and containment cooling.

Several procedures and related training required-by the Order should aid in -

preventing a core melt accident. These procedures are now being implemented

! within the context of the new symptom oriented emergency procedure guidelines.

i These include. procedures related to station blackout, and loss of all j feedwater.

4.3.2 Mitigation l When the question of disproportionate risk was first raised regarding Indian

i. Point and Zion, studies of additional mitigation features were begun. On the i

basis of these studies, the staff has reached five major conclusions as follows:

(1) The mitigation capabilities originally proposed in the task action plan are already present to a large degree in the large, dry containments at Zion. '

i (2) Although a filtered-vent system or a passive heat removal system would be effective in' reducing the risk from some (but not all) core melt accident scenarios, such a system is unlikely'to be cost effective.

~

(3). Additisnal risk reduction from a core retention device would not be effective in lowering the risk, nor would it be cost effective.

,' (4) Low cost systems to prevent containment. failure caused by the burning of combustible gases are not likely to be cost effective, but this is not clear because much uncertainty surrounds this evaluation. Because the Zion containments are not any more susceptible to hydrogen burn failures than are any other large, dry containments, examination of hydrogen t

Zion Risk Evaluation 4-2

.. - ~

4 control for, containments of this type should be considered generically in ongoing'NRC research programs.

, -(5). Modifying the diesel containment spray pumps so they can run and provide i spray without ac power will increase the probability that containment integrity will remain intact after a core melt-accident and an extended >

loss of ac power. In evaluating costs versus benefits, the staff considered a rate of $1000 ~ cost.per person-rem of public radiation exposure avoided to be a measure of cost effectiveness. Cost-benefit estimates utilizing a'$1000/per person-rem algorithm indicate that-this particular modifica-tion is cost beneficial if it' costs less than $1.5 million dollars per unit, and if it-does not affect the seismic qualification of the ,

diesel-driven containment spray pump. In addition, the modification would decrease the early fatality risk by 20%. Because the diesel contain-ment. spray capability.(pump and hardware) already exists, and because Lcomponent cooling water and service water problems could potentially affect both units,.the staff considers that this' modification would be prudent.

I Zion ~ Risk Evaluation 4-3

.. h

l

+ 0 l

l i

l 5 REFERENCES Cascarano, R. , Commonwealth Edison, letter to H. R. Denton, NRC,

Subject:

Zion Generating Station Units 1 and 2 Service Water Success Criteria, August 21, 1984.

Commonwealth Edison, " Zion Probabilistic Safety Study," 1981.

Consumers Power Company, " Big Rock Point Probabilistic Risk Analysis," 1981.

De1 George, L. 0., Commonwealth Edison, letter to H. R. Denton, NRC, September 8, 1980. -

Denton, H. R. , NRC, letter to Peoples Power Corp. ,

Subject:

Confirmatory Order, February 29, 1980.

Dircks, W. J., Memorandum to Chairman Palladino, Commissioner Roberts, Commissioner Asselstine, Commissioner Bernthal, and Commissioner Zech, July 2, 1985.

Electric Power Research Institute (EPRI), " Loss of Offsite Power at Nuclear Power Plants: Data and Analysis," EPRI NP2301, March 1982.

Ernst, M., NRC, memorandum to T. Speis and R. Mattson, September 16, 1983.

Federal Register, Executive Order 12291, 46 FR 13193-98, February 19, 1981.

Houston, W., NRC, memorandum to F. Rowsome, March 28, 1984.

Lentine, F. , Commonwealth Edison, letter to H. R. Denton, NRC, May 19, 1983.

-- , letter to H. R. Denton, NRC, September 9, 1983.

Mattson, R., NRC, memorandum to T. Speis, August 16, 1983.

." Noonan, V. S., NRC, memorandum to A. Thadani, August 16, 1983.

Philadelphia Gas and Electric Co., " Limerick Generating Station P'robabilistic Risk Analysis," 1981.

Power Authority of the State of New York / Commonwealth Edison Company, " Indian Point Power Station Units 2 and 3," 1982.

Reed, C., Commonwealth Edison, letter to H. R. Denton, NRC, January 27, 1984.

U.S. Atomic Energy Commission, WASH-1400, " Reactor Safety Study" (republished as NUREG-75/014).

Zion Risk Evaluation 5-1

~ 1

a v U.S. Nuclear Regulatory Commission, Indian Point Atomic Safety.and Licensing Board, " Recommendations to the Commission in the Matter of Consolidated Edison Company of New York and the Power Authority of the State of New York," October 24, 1983.

-- , NRC Draft Manual Chapter 0514.

-- , NUREG-0611, " Generic. Evaluation of Feedwater Transients and Small-Break Loss of-Coolant Accidents in Westinghouse-Designed Operating Plants,"

January 1980.

-- , NUREG-0666, "A Probabilistic Safety Analysis of DC Power System Require-ments for Nuclear Power Plants," April 1981.

-- , NUREG-0850, Vol 1, " Preliminary Assessment of Core Melt Accidents at the Zion and Indian Point Nuclear Power Plants, and Strategies for Mitigating Their Effects," November 1981.

-- , NUREG-0880, " Safety. Goals for Nuclear Power Plants: a Discussion Paper,"

issued for comment, February 1982.

f

-- , NUREG-1070, "NRC Policy on Future Reactor Designs; Discussion on Severe

.,. Accident Issues in Nuclear Power Plant Regulation," draft, April 1984.

-- , NUREG/CR-1659, Vol 1, " Reactor Safety _ Study Methodology Applicat'.ons Program: Sequoyah #1 PWR Power Plant," Sandia Laboratories, April 1981.

-- ,-NUREG/CR-1659, Vol 2, " Reactor Safety Study Methodology Applications Program, Oconee #3, PWR Power Plant," Battelle Memorial Institute, Columbus, Ohio, February 1981; Revision 1, May 1981.

-- , NUREG/CR-1659, Vol 3, " Reactor Safety Study Methodology Applications, Calvert Cliffs.No. 2," Battelle Memorial Institute, Columbus, 1982.

-- , NUREG/CR-1659, Vol.4, " Reactor Safety Study Methodology Applications Program, Grand Gulf, No.1 BWR Power Plant," Sandia Laboratories, November 1981.

-- , NUREG/CR-2239, " Technical Guidance for Siting Criteria Development,"

Sandia Laboratories, December 1982.

-- , NUREG/CR-2515, " Crystal River-3 Safety Study,I' Science Applications, Inc., March 1982.

. ,~

-- , NUREG/CR-2787, Vol 1, " Interim Reliability Evaluation Program: Analysis

- of the Arkansas Nuclear _ One' . Unit 1, Nuclear Power Plant," August 1981.

-- , NUREG/CR-3300,'Vol I, " Review and Evaluation of the Zien Probabilistic Safety; Study and Plant Analysis," Sandia, May 1984 (Vol II in preparation).

~

-- , NUREG/CR-3428, " Application of the SSMP Methodology to the Seismic Risk at Zion Nuclear Power Plant," February 1984.

Zion Risk Evaluation-  : 5-2

f. r 9{

j.'.

t I

APPENDIX A

! UCLA MITIGATION STUDY i

i To learn more about the inherent limitations of the ZPSS, the NRC staff contracted

~for a similar mitigation study to be done by personnel at the University of i California at Los Angeles (UCLA). A portion of the UCLA study focused on the i

risk-reduction potential for filtered. vented containment systems (FVCSs) and was

! applied to the Zion plant. Using information from the ZPSS, both internal and external risks were considered and a containment event tree that accounts for

! competing (or attendant) risks was developed and employed in the analysis.

/

In contrast to the ZPSS, in the UCLA study the probabilities of the Event V

[i sequence and the containment failure mode (failure to isolate containment) were considered to be negligible because of design and operational modifica-1*- tions. With this change, a risk-reduction factor based on person-rems (ratio of risk without mitigation to risk with mitigation) of about 9 was obtained. l

] If the Event V sequence was not removed, a factor of 2.7 was obtained, which

is close to the value of 2 reported in ZPSS.

With respect to external events, the UCLA study took a different approach. ~

i Although the ZPPS identified eight different seismic containment structural L failures, only.one was considered to have the potential to contribute signifi-j cantly to the risk: failure because of-the impact between the containment and

!. the auxiliary building.- Using the methodology described in NUREG/CR-2666, it

!; was determined that in 3.4% of the cases in which an earthquake causes a core melt, the containment also fails structurally. Thus, if the containment

fails,-the mitigation system has no effect.

.Also in contrast to the ZPSS, the UCLA study considered two. cases involving

' the fragility of the FVCS. In the first (Case A), it was. assumed that the FVCS was so resistant to earthquakes that the

, -containment failure is negligibly small. Therefore, probability.it would given fail beforeinitiated a seismically j core melt, it can be shown that if the containment also fails (3.4% of the

cases), the FVCS will have no positive effect and therefore there is no risk

} reduction. However,:if the containment does not fail (96.6% of the cases), the FVCS will work and the risk reduction factor will apply.

! In the second (Case B), a family of. fragility curves is assigned to the FVCS j that is the same as that for the containment. In this case, given a seismically

induced core melt, there is a 35% chance.that either the containment, or the l FVCS, or bo Hence, it can be shown that in 65% of the cases where

there was seismically ath will fail.

induced core melt, there will-be risk reduction because

both the vent filter and the containment do not. fail.

J For these two cases, the risk-reduction factor (based on person-rems) for both l' internal and external initators was determined to be as follows:

i l

!' Zion Risk Evaluation A '

1 i' -

l

, m i

+ t' Overall risk Case reduction factor A 15.0 B 2.8 These values can be compared to the risk reduction factor of 1.5 determined in the ZPSS, which includes the Event V sequence and utilizes'a new release category (2RV) for the filtered release.

Another aspect of the UCLA work focused on alternative mitigation features to cope with containment building overpressurization, containment basemat penetra-tion, and the sudden burning of large amounts of hydrogen. The mitigation features considered included an FVCS or a passive containment heat removal system (PCHRS) in the form of heat pipes for controlling containment overpressurization; a core ladle system or deliberate reactor cavity flooding for'basemat protection;

-t and controlled hydrogen burning or containment inerting.

2

For purposes of comparison, the mitigation studies were divided into two types

those with a PCHRS and those with FVCS. In all cases, risk reduction factors between 10 and 300 were determined if the Event V sequence were suppressed and the features were seismically strengthened. The PCHRS options yield -

substantially larger risk reductions than the FVCS because of.~the residual filtered releases. The risk reduction attainable with the PCHRS options were a

severely jeopardized if the system were not designed against sei'mic s and hydrogen-burning events. In this case, the risk reduction varied between 1.3 and 3.2, depending on the data set. A sensitivity study also showed the importance of the assumptions of containment failure as a result of hydrogen burning,

'a For the original ZPSS data set, hydrogen burns were not important because they i contribute little to risk. If the probability of containment failure as a O result of a hydrogen burn were increased, the amount of risk reduction became y sensitive to assumptions regarding hydrogen generation. ,

,s In summary, the UCLA study verified the importance of the Event V sequence and 1: seismically initiated core melt to risk reduction. It showed that other factors--

9 -

such as assumptions on hydrogen production, residual risks as a result of filtered

- vented releases, protection of-the basemat, and the enhanced risk reduction--are

important when combinations of mitigation systems are considered.

t

( Reference i

j,' U.S. N'uclear Regulaory Commission, NUREG/CR-2666, W. K5stenberg et al., "PWR Severe Accident Delineation and Assessments," January 1983.

i Q

d 4{5 d . .,

~*

Zion Risk Evaluation A-2 .

,q