ML18151A386

Evaluation of Potential Severe Accidents During LOW Power and Shutdown Operations at Surry,Unit 1.Summary of Results

ML18151A386
Person / Time
Site:	Surry
Issue date:	10/31/1995
From:	Chu T, Pratt W BROOKHAVEN NATIONAL LABORATORY
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
CON-FIN-L-1922 BNL-NUREG-52399, NUREG-CR-6144, NUREG-CR-6144-V01, NUREG-CR-6144-V1, NUDOCS 9511270460
Download: ML18151A386 (115)

Text

NUREG/CR-6144 BNL-NUREG-52399 Vol. 1 I

I Evaluation of Potential I I

Severe Accidents During Low Power and Shutdown

. Operations at Surry, Unit 1

.mmary of Results Edited by T. L. Chu, W. T. Pratt Brookhaven National Laboratory Prepared for U.S. Nuclear Regulatory Commission

~

I

(_

• 9S11270460 95103i PDR ADOCK 05000280 P __ __________ _:_[:'Q~-- ~- l

AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited In NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, Washington, DC 20555-0001

2. The Superintendent of Documents, U.S. Government Printing Office, P. O. Box 37082, Washington, DC 20402-9328

3. The National Technical Information Service, Springfield, VA 22161-0002 Although the listing that follows represents the majority of documents cited In NRC publications, It is not in-tended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC bulletins, circulars, information notices, In-spection and investigation notices; licensee event reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents In the NUREG series are available for purchase from the Government Printing Office:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement reports, grantee reports, and NRC booklets and brochures. Also available are regulatory guides, NRC regula-tions In the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service Include NUREG-series reports and tech-nical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books.

Journal articles, and transactions. Federal Register notices. Federal and State legislation. and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference pro-ceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free. to the extent of supply, upon written request to the Office of Administration, Distribution and Mall Services Section, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001 .

Coples of Industry codes and standards used in a substantive manner in the NRC regulatory process are main-tained at the NRC Library, Two White Flint North, 11545 Rockville Pike. Rockville. MD 20852-2738. for use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organiza-tion or, If they are American National Standards. from the American National Standards Institute. 1430 Broad-way, New York, NY 10018-3308.

DISCLAIMER NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for any third party's use, or the results of such use, of any information, apparatus, product, or process disclosed in this report, or represents that its use L..--b-y_s_u_c_h_t_h_ir_d_p_a_rt_y_w_o_u_ld_n_o_t_i_n_fr-in_g_e_p-ri-va_t_e_ly_o_w_ne-d-ri_g_h_ts_._ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____. * .

• NUREG/CR-6144 BNL-NUREG-52399 Vol. 1 Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry, Unit 1 Summary of Results Manuscript Completed: September 1995 ate Published: October 1995 Edited by T.L. Chu and W. T. Pratt Contnbuting Authors T.L. Chu, Z. Musicki, P. Kohut, J. Jo, C.C. Lin, L. Neymotin, V. Mubayi, R.J. Budnitz,1 P.R. Davis,2 M.K. Ravindra,3 W. H. Tong,3 D. Bley,4 J. Yang, B. Holmes,5 G. Bozoki, C. J. Hsu, D.J. Diamond, D. Johnson,4 J. Lin,4 R. F. Su,6 V. Dang,6 D. Ilberg,7 S.M. Wong, N. Siu,6 Y.M.Hou4 Brookhaven National Laboratory Upton, NY 11973-5000 R. Robinson, NRC Project Manager Prepared for Division of Systems Technology Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 NRC FIN L1922 lFuture Resources Associated, Inc., Berkeley, CA 94704 2PRD Consulting, Sheridan, WY 82801 3EQE International, Inc., Irvine, CA 92715 4PLG, Inc., Newport Beach, CA 92660 5AEA Tuchnology, Risley, Warrington, England 6MIT, Cambridge, MA 02139 7Soreq Nuclear Research Center, Yavne 70600, Israel

ABSTRACT During 1989, the Nuclear Regulatory Commission (NRC) initiated an extensive program to carefully examine the potential risks during low power and shutdown operations. Two plants, Surry (pressurized water reactor) and Grand Gulf (boiling water reactor), were selected as the plants to be studied by Brookhaven National Laboratory (BNL) and Sandia National Laboratories (SNL), respectively. The objectives of the program are to assess the risks of severe accidents initiated during plant operational states (POSs) other than full power operation and to compare the estimated core damage frequencies (CDFs), important accident sequences and other qualitative and quantitative results with those accidents initiated during full power operation as assessed in NUREG-1150. The scope of the program includes that of a Level 3 PRA for internal events and a Level 1 PRA for seismically induced and internal fire and flood induced core damage sequences.

The objective of this report, NUREG/CR-6144, is to document the approach utilized in the PRA for the Surry plant, and discuss the results obtained. A phased approach was used in the Level 1 program. In Phase 1, which was completed in Fall 1991, a coarse screening analysis examining accidents initiated by internal events (including internal fire and flood) was performed for all plant operational states. The objective of the Phase 1 study was to identify potential vulnerable plant configurations, to characterize (on a high, medium, or low CDF basis) the potential core damage accident scenarios and risk , and to provide a foundation for a detailed Phase 2 analysis.

In Phase 2, mid-loop operation was selected as the plant configuration to be analyzed based on the results of the Phase 1 study. The objective of the Phase 2 study is to perform a detailed analysis of the potential accident scenarios that may occur during mid-loop operation, and compare the results with those ofNUREG-1150. The scope of the Phas~-2 study includes a Level 3 PRA. This volume summarizes the approach and results of the study. The internal events analysis

• is documented in Volume 2, which also contains an appendix that documents those parts of the Phase 1 study that deal with POSs other than mid-loop operation. Internal fire and internal flood analyses are documented in Volumes 3 and

4. A separate study on seismic analysis, documented in Volume 5, was performed for the NRC by Future Resources Associates, Inc. Volume 6 documents the accident progression, source terms, and risk analysis.

The core damage frequencies (per year) of the Surry plant due to different initiating events that may take place during mid-loop operations are estimated as follows:

Initiating Events Mean 5th Percentile 95th Percentile Internal Events SE-06 SE-07 2E-05 Internal Fires 2E-05 IE-06 SE-05 Internal Floods SE-06 2E-07 2E-05 Seismic Events EPRA Hazard Curves 9E-08 3E-10 4E-07 Seismic Events LLNL Hazard Curves 4E-07 IE-09 IE-06 This can be compared with the mean core damage frequency from internal events of 4E-05 per year estimated in the NUREG-1150 study for full power operations.

The offsite risk estimates for latent health effects of accidents during mid-loop operation were similar to the risk estimates for full power operation. The early health consequences are much lower than the full power results primarily due to the long time after reactor trip when the accidents occur in mid-loop operation (i.e., because of the natural decay of the short-lived isotopes of iodine and tellurium, which are primarily associated with early health effects). The uncertainties in risk for accidents during mid-loop operations are largely due to uncertainties associated with isolating the containment and achieving a pressure retaining capability.

Vol. 1 iii NUREG/CR-6144

• CONTENTS Page ABSTRACT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 FIGURES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii TABLES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Vlll FOREWORD ...................................................................... -. . . ix ACKNOWLEDGMENTS ................................................... -. . . . . . . . . . . . xi ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii 1 BACKGROUND 1 2 OBJECTIVE ........................ ....... ............ ............... .... ........ . 5 3 APPROACH AND LIMITATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.1 Level 1 ...................................................................... -. . 7 3.1.1 Traditional Internal Events ................. : . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.1.2 Internal Fires . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3 .1.3 Internal Floods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.1.4 Seismic Events ............................................................ 16 3.2 Level 2/3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 4 RESULTS ......................................................................... 23 4.1 Level 1 Results .................................................................. 23 4.1.1 Quantitative Results from Traditional Internal Events ............................... 23 4.1.2 Insights from Internal Event Analysis ........................................... 28 4.1.3 Quantitative Results from Internal Fire Analysis ................................... 30 4.1.4 Insights from Internal Fire Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 4.1.5 Quantitative Results from Internal Flood Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 4.1.6 Insights from Internal Flood Analysis ........................................... 33 4.1. 7 Quantitative Results from Seismic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 4.1.8 Insights from Seismic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 4.2 Level 2/3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 4.2.1 Plant Damage State Frequency ................................................ 35 4.2.2 Accident Progression Analysis ................................................ 37 4.2.3 Results of the Source Term Analysis : ........................................... 39 4.2.4 Consequence Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 4.2.5 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 4.2.6 Comparison with the Safety Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 4.2. 7 Insights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

• Vol. I V NUREG/CR-6144

CONTENTS (continued)

Page 5 CONCLUSIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 5 .1 Level I Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 5.2 Level 2/3 Conclusions ............................................................ 45 6 REFERENCES ................................................................ *..... 47 APPENDIX .......................................................................... A-1 NUREG/CR-6144 Vl Vol. I

• FIGURES Page 1 Contribution of the 15 POSs to the total core damage :frequency during low power and shutdown operation - Phase 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2 Distribution of the potentially high risk sequences - Phase 1 ..................................... 2

• Vol. I Vll NUREG/CR-6144

TABLES Page 1 Summary of Results: Core Damage Frequency by Initiating Event and Plant Operational States . . . . . . . . 24 2 Comparison of Total Core Damage Frequency with NUREG-1150 and IPE ........................ 25 3 Conditional Core Damage Frequency as a Function of the Time Windows and POSs (per year) ......... 26 4 Result of the Level 1 Uncertainty Analysis and Comparison with Full Power Operation (per year) ....... 27 5 Summary of Point Estimate Core Damage Frequencies for Fire Events (per year) . . . . . . . . . . . . . . . . . . . . 31 6 Summary of Point Estimate Core Damage Frequencies for Flood Events (per year) . . . . . . . . . . . . . . . . . . 32 7 Comparison of the PDS Core Damage Frequencies (per reactor year) for Mid-Loop and Full-Power Operation (Internal Events Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 8 Comparison of the Mean Probabilities of APBs Conditional on PDS Groups for Mid-Loop and Full-Power Operation (Internal Events Only) ................................... 38 9 Comparison of Distributions of Risks for Mid-Loop and Full-Power Operation (All Values per Reactor Year; Population Doses in P-Sv per Year) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 NUREG/CR-6144 Vlll Vol. I

• FOREWORD (NUREG/CR-6143 and 6144)

Low Power and Shutdown Probabilistic Risk Assessment Program Traditionally, probabilistic risk assessments {PRA) of severe accidents. in nuclear power plants have considered initiating events potentially occurring only during full power operation. Some previous screening analysis that were performed for other modes of operation suggested that risks during those modes were small relative to full power operation. However, more recent studies and oper:ational experience have implied that accidents during low power and shutdown could be significant contributors to risk.

During 1989, the Nuclear Regulatory Commission (NRC) initiated an extensive program to carefully examine the potential risks during low power and shutdown operations. The program includes two parallel projects performed by Brookhaven National Laboratory (BNL) and Sandia National Laboratories (SNL), with the seismic analysis performed by Future Resources Associates. Two plants, Surry (pressurized water reactor) and Grand Gulf (boiling water reactor), were selected as the plants to be studied.

The objectives of the program are to assess the risks of severe accidents due to internal events, internal fires, internal floods, and seismic events initiated during plant operational states other than full power operation and to compare the estimated core damage frequencies, important accident sequences and other qualitative and quantitative results with those accidents initiated during full power operation as assessed in NUREG-1150. The scope of the program includes that of a Level 3 PRA.

The results of the program are documented in two reports, NUREG/CR-6143 and 6144. The reports are organized as follows:

For Grand Gulf:

NUREG/CR-6143 Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations at Grand Gulf, Unit 1 Volume 1: Summary of Results Volume 2: Analysis of Core Damage Frequency from Internal Events for Operational State 5 During a Refueling Outage Part 1: Main Report Part IA: Sections I - 9 Part IB: Section 10 Part IC: Sections 11 - 14 Part 2: Internal Events Appendices A to H Part 3: Internal Events Appendices I and J Part 4: Internal Events Appendices K to M Vol. I ix NUREG/CR-6144

Volume 3:

FOREWORD (continued)

Analysis of Core Damage Frequency from Internal Fire Events for Plant Operational State 5 During a Refueling Outage Volume 4: Analysis of Core Damage Frequency from Internal Flooding Events for Plant Operational State 5 During a Refueling Outage Volume 5: Analysis of Core Damage Frequency from Seismic Events for Plant Operational State 5 During a Refueling Outage Volume 6: Evaluation of Severe Accident Risks for Plant Operational State 5 During a Refueling Outage Part 1: Main Report Part 2: Supporting MELCOR Calculations For Surry:

NUREG/CR-6144 Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations at Surry, Unit- I Volume 1: Summary of Results Volume 2: Analysis of Core Damage Frequency from Internal Events during Mid-loop Operations Part 1: Main Report Part IA: Chapters 1 - 6 Part lB: Chapters 7 - 12 Part 2: Internal Events Appendices A to D Part 3: Internal Events Appendix E Part 3A: Sections E. l - E.8 Part 3B: Sections E.9 - E.16 Part 4: Internal Events Appendices F to H Part 5: Internal Events Appendix I Volume 3: Analysis of Core Damage Frequency from Internal Fires during Mid-loop Operations Part 1: Main Report Part 2: Appendices Volume 4: Analysis of Core Damage Frequency from Internal Floods during Mid-loop Operations Volume 5: Analysis of Core Damage Frequency from Seismic Events during Mid-loop Operations Volume 6: Evaluation of Severe Accident Risks during Mid-loop Operations Part 1: Main Report Part 2: Appendices NUREG/CR-6144 X Vol. 1

• ACKNOWLEDGMENTS The authors wish to thank the following persons for their contributions to this study: the various staff members at the Surry Nuclear Power Plant for their help in obtaining technical information and for their assistance during the respective walkdowns (fire, flood, and seismic,) all of which made this analysis possible; Richard C. Robinson, Jr.

of the NRC for his help and guidance throughout the course of this study. Kenneth Russell of Idaho Nuclear Engineering Laboratory for his help in using IRRAS and for providing excellent code support during its use; and members of the Senior Consulting Group for their review and suggested improvements to the project. Finally, we want to thank Kathy Ryan and Barbara Kponou for their patience and secretarial support, and Cheryl Conrad for her technical support throughout the course of this study.

Vol. 1 xi NUREG/CR-6144

• Acronym ACRONYMS Definition ADHR Auxiliary Decay Heat Removal system APB Accident Progression Bin APET Accident Progression Event Tree ASEP Accident Sequence Evaluation Program ATWS Anticipated Transient Without Scram BNL Brookhaven National Laboratory BWR Boiling Water Reactor ccw Component Cooling Water CDF Core Damage Frequency cs Containment Spray CSD Cold Shutdown eves Chemical and Volume Control System CVT Cable Vault and Tunnel cw Circulating Water EF Error Factor EPRI Electric Power Research Institute ESGR Emergency Switchgear Room FMEA Failure Mode and Effect Analysis HAZOP Hazard and Operability Study HEP Human Error Probability HHSI High Head Safety Injection HRA Human Reliability Analysis HSD Hot Shutdown INEL Idaho National Engineering Laboratory IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events IRRAS Integrated Reliability and Risk Analysis System ISLOCA Interfacing Systems LOCA LLNL Lawrence Livermore National Laboratory LER Licensee Event Report LHS Latin Hypercube Sampling LOCA Loss -of Coolant Accident LOOP Loss of Offsite Power LPCI Low Pressure Coolant Injection system LP&S Low Power and Shutdown LPCS Low Pressure Core Spray system MCC Motor Control Center MFW Main Feedwater MW Megawatt NRC Nuclear Regulatory Commission PDS Plant Damage State PORV Pilot Operated Relief Valve POS Plant Operational State PRA Probabilistic Risk Assessment PRZR Pressurizer Vol. I xiii NUREG/CR-6144

Acronym Acronyms (continued)

Definition PSF Performance Shaping Factor PSIG Pound Per Square Inch Gauge PWR Pressurized Water Reactor RCIC Reactor Core Isolation Cooling system RCP Reactor Coolant Pump RCS Reactor Coolant System RHR Residual Heat Removal RPS Reactor Protection System RPV Reactor Pressure Vessel RSS Reactor Safety Study ( WASH-1400)

RWCU Reactor Water Cleanup system RWST Refueling Water Storage Tank SDC Shutdown Cooling SG Steam Generator SGTR Steam Generator Tube Rupture SNL Sandia National Laboratories sv Safety Valve SW Service Water TS Technical Specification NUREG/CR-6144 xiv Vol. 1

• 1 BACKGROUND Traditionally, probabilistic risk assessments (PRA) of severe accidents in nuclear power plants have considered initiating events (IEs) potentially occurring only during full power operation. Some previous screening analyses that were performed for other modes of operation suggested that risks during those modes were small relative to full power operation. However, more recent studies and operational experience have implied that accidents during low power and shutdown could be significant contributors to risk.

During 1989, the Nuclear Regulatory Commission (NRC) initiated an extensive program to carefully examine the potential risks during low power and shutdown operations. The program includes two parallel projects being performed by Brookhaven National Laboratory (BNL) and Sandia National Laboratories (SNL). Two plants, Surry (pressurized water reactor) and Grand Gulf (boiling water reactor), were selected as the plants to be studied.

Suny Unit 1 was chosen for this study in part because the Suny plant was previously analyzed in the Reactor Safety Study[!] and NUREG-1150,[21 and in part because Virginia Power offered to cooperate. The core damage frequency (CDF) during low power and shutdown calculated in this study is compared with that calculated in NUREG-1150 for accidents during full power. The Surry plant has two Pressurized Water Reactors (PWRs), each rated at 788 megawatts (electrical) capacity, and is located near Suny in Virginia. Grand Gulf, a boiling water reactor, was selected as the plant for a parallel analysis performed by Sandia National Laboratories.

A phased approach was taken in this project. In Phase I, a broadly scoped screening analysis,[31 which included internal fire, flood, and seismic events was completed in late 1991. The objective of the Phase I study was to identify potential vulnerable plant configurations, to characterize (on a high, medium, or low CDF basis) the potential core damage accident scenarios, and to provide a foundation for a detailed Phase 2 analysis. This analysis produced a preliminary Level I PRA for accidents initiated during low power and shutdown (LP&S) and also gave insights on potential accident scenarios and potentially vulnerable configurations during low power and shutdown conditions.

In Phase 1, plant outages were grouped into 4 outage types: refueling, drained maintenance, non-drained maintenance with use of the residual heat removal (RHR) system, and non-drained maintenance without the RHR system. Due to the continuously changing plant configuration in any outage, plant operational states (POSs) were defined and characterized within each outage type. Each POS represents a unique set of operating conditions (e.g., temperature, pressure, and configuration). For example, in a refueling outage, up to 15 POSs were used, representing the evolution of the plant throughout a refueling from low power down to cold shutdown and refueling, and back-up to low power. An extensive effort was made to collect Surry-specific data to characterize each POS, that included reviewing operating and abnormal procedures for shutdown operations, the shift supervisor's log books, and the monthly operating reports, and performing supporting thermal-hydraulic calculations.

'fl?.e Phase 1 study analyzed a total of 947 accident sequences or scenarios. Each of them was quantified and ranked according to the CDF of the scenario, timing of onset of core damage, and containment status. Figures I and 2 summarize the results of the quantification. Figure I shows the contribution of the 15 POSs to the total core damage frequency during low power and shutdown operation. POS 12, representing a cold shutdown condition late in a refueling outage, has the highest core damage frequency. This is due to high maintenance unavailabilities of

• equipment needed to mitigate an accident and conservatism introduced by the simplified model. Figure 2 shows the .

Vol. I NUREG/CR-6144

1 Background

50 40 u:-

0 0

'30

~ 20 C

~Q)

a. 10 .

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Plant Operational State (POS)

Figure 1 Contribution of the 15 POSs to the total core damage frequency during low power and shutdown operation - Phase 1 Potentially High Core Damage Frequency (22)

Startup of RCP 10 after improper boron dilation 157 Containment Open (261) 5 in POS 6 & 10 daring mid-loop 4 in POS 4 daring cold shutdown 1 in POS 7 daring fill after mid-loop 1 in POS 12 daring RCS heatap Figure 2 Distribution of the potentially high risk sequences -. Phase 1 NUREG/CR-6144 2 Vol. 1

• 1 Background distribution of the 460 potentially high risk sequences. A total of 11 sequences were found to have high frequency with early core damage when the containment is open, and 5 out of the 11 sequences occur during mid-loop operation.

To accurately address each of the conditions identified in the Phase 1 study in detail would represent a very large effort. Consequently, the NRC decided to perform a detailed Phase 2 analysis on mid-loop operation. This configuration was selected because many incidents have occurred during mid-loop operations throughout the world.

In addition, recent studies,[4l including Phase 1 of this program, found that the core damage frequency during mid-loop operation appears to be comparable to that of power operation. The Phase 2 internal event analysis is documented in Volume 2 of this report. The internal fire and internal flood analysis are documented in Volumes 3 and 4, respectively. A separate study on seismic analysis, documented in Volume 5, was performed for the NRC by Future Resources Associated, Inc.

A phased approach was also used in the Level 2/3 program and both phases addressed the risk from only mid-loop operation. The first phase of the Level 2/3 PRA was initiated in late 1991 and consisted ofan Abridged Risk Study.

This study was completed in May 1992 and was focused on accident progression and consequences, conditional on core damage. Phase 2 is a more detailed study in which an evaluation of risk during mid-loop operation was performed. The results of the Phase 2 Level 2/3 study are the subject of Volume 6.

This volume of the report summarizes information contained in the documentation of the detailed analyses (refer to Volumes 2 through 6 ofNUREG/CR-6144) performed for the Surry plant during mid-loop operation. A companion project for the Grand Gulf plant (a BWR) during cold shutdown was conducted by Sandia National Laboratories and is documented in NUREG/CR-6143.[51 Vol. 1 3 NUREG/CR-6144

• 2 OBJECTIVE The primary objective of this *study was to perform a detailed analysi~ of potential accidents that could occur at Surry while the plant is in mid-loop operation. The initiating events to be examined included: (I) internal initiators -

including fire and flood, and (2) seismic initiators.

The objectives of the Level 1 study are:

(I) Estimate the frequencies of severe accidents that might be initiated during mid-loop operation, (2) Compare the estimated core damage frequencies, important accident sequences, and other qualitative and quantitative results of this study with those of accidents initiated during full power operation (as assessed in NUREG-1150), and (3) Demonstrate methodologies for accident sequence analysis for plants in modes of operation other than full power.

The objectives of the Level 2/3 study are:

(1) Develop methods to compute the risk of the Surry plant during mid-loop operation and perform the study, utilizing to the extent possible the component analyses developed as part of the NUREG-1150 program, (2) Identify those factors that have the most impact on the risk estimates and highlight unique features of the risk analysis performed, and (3) Compare the results of the study against the risk of full power operation as evaluated in the NUREG-1150 study of Surry and the NRC safety goals .

• Vol. I 5 NUREG/CR-6144

• 3 APPROACH AND LIMITATIONS Due to the changing plant configuration during low power and shutdown operation, it was necessary to define different outage types, and different plant operational states (POSs) within each outage type. Within each POS, the plant configuration continues to change with time, and the decay heat continues to decrease. These factors significantly affect scenario frequencies. Therefore, a "time window" approach was developed in which different time windows were defined representing different levels of decay heat and success criteria. Within each time window, the approach used in performing the PRA for a particular POS in a particular outage type is similar to that used in the NUREG-1150 study. The following is a summary of the approach used in the key tasks of this study.

The approach can be readily adopted for studies of P0Ss other than mid-loop and for other PWRs. The key assumptions are discussed at the end of each subsection. A more detailed description of approaches that can be used to perform a Level 1 low power and shutdown PRA is given in an Appendix to this report.

3.1 Level 1 3.1.1 Traditional Internal Events

• Outage Types, Plant Operational States and Time Windows The outage types and POSs defined in Phase I of this study were also adopted in Phase 2. Three mid-loop POSs, in which the reactor coolant system (RCS) level is lowered to the mid-plane of the hot leg, were selected for detailed analysis. Two of them occur in a refueling outage, POSs R6 and Rl 0, and one in a drained maintenance outage, POS D6. The states are characterized by different levels of decay heat, and different plant configurations, such as the number of RCS loops that are isolated, and whether or not the RCS has a large vent. R6 represents a mid-loop operation that takes place early in a refueling outage allowing the RCS loops to drain quickly to permit eddy current testing of the steam generator tubes. RIO takes place after the refueling operation is completed to allow additional maintenance of equipment in the RCS loops. D6 represents mid-loop operation in which maintenance activities require the plant to go to mid-loop, and is characterized by the highest level of decay heat among the three mid-loop POSs.

To more accurately define the decay heat level when an accident is initiated, a time-window approach was developed. Four time windows after shutdown were defined, each with a unique set of success criteria reflecting the decay-heat level. For POSs R6 and D6, all four windows were needed. For POS RIO, only time windows 3 and 4 were applicable. A statistical analysis was made on the time to and duration of mid-loop to determine the probability that a given accident occurs in a particular time window, conditional on the accident occurring. In this approach, an event tree was developed for each accident initiating event, POS and time window. One hundred and sixty event trees were developed for 16 initiating events.

During the Surry Unit I refueling outage that started on February 28, 1992, the utility changed previous practice and avoided going to mid-loop operation. Although the plant staff intend to continue this new practice mid-loop operation cannot be totally avoided in the future. Therefore, with NRC concurrence, BNL developed the PRA model Vol. 1 7 NUREG/CR-6144

3 Approach and Limitations based on outages (that included mid-loop operation) before the February 1992 refueling. Since the results are also presented on a per-unit-time basis, the results can be used to draw conclusions on the management of mid-loop outages.

Initiating Event Analysis To identify initiating events, the existing studies, licensee\event reports, {LERs), published NRC documents, and current Surry operating procedures were reviewed. This approach should ensure that any incident that has occurred or any scenario that has been studied will be considered in the present study. However, a systematic approach, such as a failure mode and effect analysis (FMEA) or a hazard and operability study (HAZOP), to further assure that all possible initiating events in all possible operating states were identified was not performed.

Event Tree Analysis In Phase 1 of this study, accident scenarios were developed for all Low Power and Shutdown POSs. For those POSs that are similar to power operations, (e.g., low power operations), the relevant NUREG-1150 event trees developed for Surry were reviewed and modified (if necessary) to reflect the current plant design and operation. For other POSs, event trees were developed in group discussions, involving typically four or more BNL staff members with expertise in PWR operations, PRA, human reliability analysis (HRA), and thermal-hydraulics. Communications with the staff at Virginia Power clarified questions on the plant's design and operations.

In Phase 2, the event trees developed for the mid-loop POSs were reviewed and modified to incorporate additional information obtained in the system analysis, and to reflect current understanding of the expected operator responses to the accidents. A two-day meeting with Virginia Power operations personnel was held to discuss potential accident scenarios, and the expected responses of the plant and operators.

System Analysis The fault tree models, developed as part ofNUREG-1150 study, were reviewed and modified (when necessary) to develop two fault tree models for the plant applicable to shutdown and to low power operation for each system. The system configuration during shutdown was identified by reviewing the operating procedures used during shutdown, shift supervisor's log books, and the system training manual.

Definition of Core Damage In the NUREG-1150 study, core damage was defined to be when the RCS level reached the top of active fuel. Due to relatively high decay heat levels, the difference between*this time and the time of cladding failure is small. Under low power and shutdown conditions, the decay heat level will be significantly lower, and therefore, the difference between these.two times becomes more significant. In this study, core damage was therefore defined to be the collapsed RCS level reaching 2.5 feet above the bottom of the core. This is based on the result of a MELCOR calculation of the RCS level in the core region when the cladding temperature reaches 1340°F. Phenomena such as clad oxidation and ballooning have an impact on core behavior above I340°F. Time to core damage is used in the Level 1 study to determine the time available for operator actions such as initiating safety injection. The more realistic estimate of the time available has the tendency of lowering the associated human error probabilities.

NUREG/CR-6144 8 Vol. 1

0 3 Approach and Limitations Supporting Thermal-Hydraulic Analysis The main purpose of the thermal-hydraulic analysis was to support the development of event trees and quantification of accident sequences. Thermal-hydraulic considerations are the basis of the time-window approach. Basically, the time windows were defined by the times when the success criteria of important mitigating functions change significantly.

• In the Phase I study, assumptions were made based on simple "back of the envelope" calculations. It was found that more detailed calculations were needed to confinn the simple calculations, and support the assumptions made. In the Phase 2 study, a more detailed calculation was done to detennine the timing of a feed and bleed operation d~ring mid-loop operation. The calculation also gave infonnation on the amount of water from the refueling water storage tank (RWST) needed to sustain the feed and bleed operation, as well as the timing of core uncovery for different initial conditions.

The MELCOR code[6l was used to assess whether or not gravity feed from the R WST could be used to provide long tenn cooling (i.e., 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> decay heat removal). It was found that although gravity feed is sufficient only when the decay heat is low, it can buy a few hours for restoring other means of removing decay heat even when the decay heat is high.

For reflux cooling, the studies at the Idaho National Engineering Laboratory (INEL),£71,[SJ WestinghouseJ9l and Virginia Powerl10l were used to detennine the success criteria The analysis of feed and spill, gravity feed and reflux cooling were used to detennine the boundary of the time windows.

Quantification A Bayesian approach[IIJ was used to estimate the initiating event frequencies. The basic event data for hardware

• failures wex:e derived from the NUREG-1150 data base for Surry. The IRRAS computer coder121 was used to quantify the fault tree and event tree, with a truncation limit of 10-10

• An uncertainty analysis of the total core damage frequency was perfonned by propagating the uncertainty of the parameters used in the model.

Human Reliability Analysis Two types of human error events were identified and modeled in this study: pre- and post-accident errors. The pre-accident errors identified in the full power study for Surry2 were adopted, together with others identified in the system analysis task and added to the system fault trees:

• To evaluate human actions and recovery actions that follow an initiator, the event scenario, required actions, important factors affecting operator performance, and the consequences of the action being unsuccessful were qualitatively defined. Two types of post accident human errors were modeled, failure to diagnose and failure to carry out the needed action given successful diagnosis. They were used in the fault trees for the top events of the event trees. It was assumed that, given failure to diagnose, the operator would fail to perform the needed actions; therefore, core damage would result. The same basic event representing failure to diagnose was used in all fault trees for a given event tree. On the other hand, failure to carry out the action given successful diagnosis would only fail the specific top event of the event tree.

Vol. I 9 NUREG/CR-6144

3 Approach and Limitations The qualitative evaluation of the actions and the important parameters that affect operator's performance were used to derive the human error probabilities (HEPs) by adapting the success likelihood index methodology.£1 31 This methodologyll 4l assumes that the likelihood of operator error in a particular situation depends on the combined effects of a small set of performance-shaping factors (PSFs) that influence the operator's ability to accomplish the action.

To quantify the HEPs, the PSFs were rated with weights that reflect the relative influence of each PSF on the likelihood of the success of the action, and a score that reflects whether the PSF helps or hinders the operator in carrying out the actions. With the rating for PSF, the numerical model was calibrated using well defined actions obtained from analysis for other PRAs. Calibration ensures that the error probabilities* are realistic and consistent with the data, observed human behavior, and the results from comparable expert evaluations of similar activities.*

Data Base Analysis An extensive effort was devoted to collecting data to characterize the plant during shutdown.

(1) A data base of initiating events was compiled for the initiating event analysis.

(2) The shift supervisor's log books, outage schedules, minimum equipment list, and monthly operating reports were reviewed to collect the data needed to estimate the frequency of shutdown, duration of plant operational states, and maintenance unavailabilities.

(3) The shift supervisor's log books were reviewed to determine the time that the plant is in different configurations. For example, the reactor coolant loops were found to be isolated for a long period in a refueling.

Key Assumptions:

The following is a discussion of the various modeling, issues and how they were treated.

Changing Plant Practices and Information Staff at the Surry plant are aware of the potential safety concerns of reduced inventory operations and they are constantly making improvements regarding such operations. This is reflected in improvements in the operating procedures and abnormal procedures used during shutdown, as well as changes in plant practice. The most significant change in plant practice started in the refueling outage of Unit I in 1992, during which mid-loop operation was totally avoided; this appears to be the new policy. Another way of reducing the risk is to carry out reduced inventory operation while the fuel in the core is removed during refueling.

Modifications made to the model developed for this study account for procedures and other plant information available as of April 30, 1993. Regarding the plant's policy of avoiding mid-loop operation, it was decided that this study would use the data collected from past outages before the Unit I refueling outage of 1992. Consequently, the core damage frequency reported in this study could be overestimated by making this assumption. However, it is emphasiz.ed that the core damage frequency calculated in the current study was reduced significantly by changes made before April 1, 1993.

NUREG/CR-6144 10 Vol. 1

3 Approach and Limitations Changing Plant Configuration Due to the activities taking place during shutdown, the plant configuration changes with time, which affects the likelihood of initiating events and the ability to mitigate the accidents. In this study, the constantly changing plant configuration was approximated by a number of discrete configurations, namely: different outage types, POSs, and time windows. The changing configuration was also reflected by the different basic events and different event trees for each of these configurations. The following is a description of the basic events and how they varied.

Initiating Event Frequency The initiating events were assumed to occur with constant rates independent of the outage type or POS. The conditional probability that an initiating event occurs in a POS was calculated as the product of the rate and the duration of the POS. The initiating event frequency is the frequency of the POS multiplied by the conditional probability. The frequency that it occurs in a given time window of a given POS of a given outage type is the initiating event frequency times the conditional probability of the time window of the given POS.

Loop Isolation Probability Isolating the loops makes it impossible to establish reflux cooling. Loop isolation probability was estimated by judgment using the information from the log books for outages, and an outage plan for a refueling outage. It was estimated as a function of the outage types, and time windows.

Removal of Pressurizer Safety Valves The fraction of time that the safety valves are removed in a given time window of a given POS in a given outage type was estimated by judgment, using information from the log books for outages, and an ou!age plan for a refueling outage. With the safety valves removed, it is possible to use gravity feed from the R WST, but not reflux cooling because of inventory loss through the opening.

Maintenance Unavailabilities Maintenance unavailability was estimated as a function of the P0Ss of a refueling outage by reviewing the log books for three refueling outages. The data was collected for the period when the plant was at mid-loop. Due to lack of sufficient information, it was assumed to be independent of the time windows. It was also assumed that the data for a refueling outage is applicable to a drained maintenance outage.

Success Criteria The success criteria for shutdown conditions were determined by reviewing various studies, and performing supporting thermal-hydraulic analysis based on the Surry-specific design. The changing level of decay heat was accounted for by defining four time windows after shutdown, each with its own set of success criteria. In general, whenever the success criteria for one system or mitigating function changes, a new time window needs to be defined, and potentially, more than four time windows could be needed. The use of four windows, therefore, was a trade-off between the accuracy of the model and the level of effort needed to arrive at a solution. It was determined that four time windows give an adequate representation.

Vol. 1 11 NUREG/CR-6144

3 Approach and Limitations During development of the time window approach, it was recognized that the procedure for loss of RHR (AP-27.00) is conservative with respect to the success criteria for reflux cooling and feed-and-spill, and does not include all possible methods of establishing recirculation. These are the areas in which the plant model used in this study deviated from the abnormal procedure for the plant. The following describes how these issues were treated.

Reflux Cooling In AP 27.00, the number of steam generators (SGs) needed for reflux cooling is given as a function of the decay heat (e.g., 3 SGs are needed for the first 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> after shutdown). This value is based on thermal-hydraulic considerations documented in a Virginia Power technical report.CID] From a review of existing studies performed by INE07*8l and WestinghouseC9l on reflux cooling, and independent BNL calculations, it was determined that one steam generator is sufficient for reflux cooling. Therefore, based on more detailed calculations, it appears that one SG is sufficient, while the abnormal procedure states that three would be needed. The issue is, how much credit should be given to reflux cooling when less than three SGs are available. In this study, the conservative success criterion based on the procedure was used in the logic model, and whenever reflux cooling was failed due to insufficient SGs, a recovery action was entered with a failure probability of 0.1.

Feed-and-Spill In AP27.00 and its supporting study,lIOJ the number of pumps and PORVs needed for this operation was determined based on the flow from the RWST needed to maintain sub-cooling, the capacity and shut-off head of the pumps, and the relieving capability of the PORVs. For example, during the first 129 hours0.00149 days <br />0.0358 hours <br />2.132936e-4 weeks <br />4.90845e-5 months <br /> after shutdown, 2 charging pumps and 2 PORVs would be needed. This success criterion was derived from the requirement to maintain sub-cooling, and is more stringent than the criterion needed for feed-and-bleed during an accident that occurs during full power operation. An alternative to feed-and-spill, (i.e., feed-and-steam), which is also discussed in reference [10], is much less demanding in terms of the needed flow. However, feed and steam is not the recommended method because of the difficulty in maintaining the level, and the potential for over pressurization. In this study, a success criterion of 1 charging pump and 1 PORV was used, based on the understanding that this is sufficient to prevent core damage.

Recirculation AP 27.00 instructs the operators to establish high pressure recirculation by using the low-pressure injection pump to take suction from the containment sump, and discharge to the suction of the high pressure injection system: this requires that a low .head injection pump and a charging pump are available. In the fault tree model for recirculation, two alternative methods also are modeled, low-pressure feed-and-steam (by taking suction from the containment sump), and low-pressure feed and spill (by taking suction from the sump and using spray recirculation). In these modes, low-head injection is needed. The feed-and-steam mode requires that the safety valves be removed to provide an adequate vent path, and does not require cooling of the sump water. The feed-and-spill operation requires operation or"the spray recirculation systems to cool the water in the sump, so that sub-cooling in the reactor vessel can be established.

Operator Response Operator actions modeled in this study were identified when developing the event trees. The identification process involved reviewing abnormal and emergency procedures, and discussing the accident scenarios with plant personnel.

NUREG/CR-6144 12 Vol. 1

3 Approach and Limitations In most cases, the operator's responses to various accidents are identified in the procedures. For example, abnormal procedures for loss of RHR, loss of instrument air, and loss of offsite power give guidance on what to do in case of respective losses during shutdown. However, the latter two procedures are no!._\Vritten speci,fically for shutdown conditions. In case of a station blackout, the procedure written for power operation (1-ECA-0.0), does not address shutdown conditions. Therefore, only the relevant steps in the procedure are applicable to shutdown conditions.

Similarly, for other initiating events, such as loss of component cooling, spurious safety injection, and loss of a vital bus, there is no specific procedure for shutdown conditions, and the ability of the operators to use the relevant steps in the procedures for power operation becomes very important. As discussed under success criteria, some of the operator actions modeled in this study are not explicitly spelled-out in the existing plant procedures, and some recovery actions modeled are extension of the existing procedures.

The operator actions needed to mitigate an accident are included in the high level fault trees. A high level fault tree models one method of mitigating the accident, e.g., feed-and-spill operation which typically contains two human error events, and one transfer to the fault tree for hardware failures. One human error event represents the failure of the operator to diagnose, so that the correct actions cannot be decided upon; the other represents failure to carry out the action after correct diagnosis. Assuming that the failure to diagnose would lead to core damage, many of the dominant core damage cutsets are caused by such events. Human error probabilities (HEPs) were quantified using the method of failure likelihood index that involves assessing weights and scores on various performance-shaping factors, and calibration using the HEPs from existing studies.

3.1.2 Internal Fires Fire Area Identification and Scenario Development Fire areas in which important equipment is located were identified. The areas are defined such that a fire in a certain location within the area might cause an initiating event by disrupting RHR operation. Cable routing information within the area was also included in the analysis (both for power and control cables) for important systems.

Important systems were identified in the internal event PRA as providing alternate core cooling paths. Systems and components when damage by a fire could result in an initiator and possibly a degraded configuration of an alternate core cooling path. This information was eventually included in the event trees and fault trees developed for the internal event PRA. Whether or not a certain cable would be damaged by a fire in a certain location would be decided by the fire growth calculations. The probability of damage would be determined by the fire suppression model.

Fire Frequency Calculations Fire frequency calculations were performed for important fire areas and for equipment found in these areas.

Equipment classes were broken into subclasses (e.g., switchgear panels were divided up into bus panels, monitor control center (MCC) panels, un-interruptible power supply panels, etc.). Cable fires and transient fires were also considered. Large fires and small fires were calculated separately. Generic and Surry-specific fire events were obtained from the updated Sandia Fire data base,r 15 l which considers events through 1989. These events were used to calculate Surry specific fire frequencies in specific categories. These fire frequencies were then prorated to account for the fraction of fires in that category that can occur at a specific location.

Vol. 1 13 NUREG/CR-6144

3 Approach and Limitations Fire Growth Modeling Once a certain critical location was identified (e.g., cables for important equipment pass nearby), the fire growth model was used to determine if a fire in that location would damage the cable (which may be located at a certain horizontal or vertical distance from the fire source). If damage does occur, the time to damage was also calculated.

The model used for fire frequency calculations is the computer code COMPBRN-IlleY 6l While this model is an important advance in fire analysis the predications of the code remain uncertain because a number of aspects are not modeled well and simplifying assumptions have to be made) 161,[171 Fire Suppression and Damage Fraction Calculation After fire initiation (and if detection occurs) suppression efforts will start to bring the fire under control. Detection and suppression may consist of combinations of manual and automatic systems. These systems may suppress the fire before damage to a critical cable occurs. (The time to damage is input from the fire growth calculations). The probability of damage in a certain scenario is the damage fraction, and is input as a basic event representing damage to the particular component in the PRA model, given the occurrence of a fire in that location. The suppression model uses transition rates among various states in the suppression path toward the eventual control of the fire.l 18l,[I 9J,l20J The transition rates and a particular combination of suppression steps determine the probability of suppression within a certain time and in the plant area that contains the detection and suppression equipment.

Fault Tree and Event Tree Modifications The damage fraction calculated was input into the modified internal PRA model as a basic event representing a possible failure mode in a given component following a fire. The internal PRA model for a given initiator (caused by fire) was modified to account for additional equipment that may be damaged in a fire. Failure modes due to fire (e.g., spurious operation or power loss) were added to the internal failure modes of the component. The event tree shows core damage sequences given a fire in a certain location and given occurrence of the initiating event. The sequence frequencies were evaluated by IRRAS 5.0,[121 the computer program used in the internal PRA quantification.

Key Assumptions:

(1) Multiple initiators were not considered (e.g., loss of offsite power subsequent to a fire) for probabilistic reasons. For example, loss of offsite power probability in any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period is about 7E-4 for the Surry plant at mid-loop. Multiplying this by the mid-loop time fraction of 0.066 means that the fire frequency at a given location would have to be a few times 10-3 in order for it to survive screening. No such scenarios were found.

(2) Barrier failure was not considered as it was determined to be probabilistically unimportant. For initiator-causing fires that occur near an important barrier (very few examples were found), the combination of fire frequency, probability of equipment failures causing an initiator, the mid-loop POS fraction, and barrier failure probability (on the order of 10-2-10-3)C1 7l was such that the fire scenario frequency was below the screening value. Also, comparing this probability to the conditional core damage probability for most scenarios (0.1) leads to screening of this consideration. It should be noted that during the plant visits (including during shutdown), it was observed that all normally closed fire doors were kept closed.

NUREG/CR-6144 14 Vol. 1

• (3) 3 Approach and Limitations Certain cables were not traced due to lack ofresources and/or because the scenarios would be probabilistically unimportant, would not lead to an initiator, or would be an irrelevant post-initiator for the particular initiators possible in the fire area (various compressed air systems, diesel generator cables, ventilation system cables, etc.). In some instances assumptions were made regarding the location of these and other cables (i.e., cables in conduits for which no precise tracing system is available at Surry).

(4) It was assumed, for purposes of fire frequency calculations, that other plants are similar to Surry in terms of the *amount of equipment of a certain type in the plant fire areas (e.g., number of switchgear cabinets in the emergency switchgear room).

(5) Relay fires were screened probabilistically, because the combination of a relay fire frequency, mid-loop fraction, and the conditional probability of initiator occurrence was below the screening value.

(6) It should be noted that both power and control cables were traced and spurious operation following hot shorts was treated. Lack of electrical coordination between the 4160 V emergency buses and the 480 V load centers was also taken into account.

3.1.3 Internal Floods The approach used in the internal flood event analysis was based on approaches used in past PRAs, especially the methodology used in the full power studyl21and the plant-specific Individual Plant Examination (IPE)l21 l,1221of the Surry plant. The basic steps in the analysis involve the following:

Identification of Flood Areas Taking Into Consideration Spatial Interaction of Flood Areas In the Phase I study,131a screening analysis was performed to identify the potential flood areas. These areas were used as the basis for the second phase effort. The potential pathways for flood propagation were identified using the information obtained during a plant visit as well as information available from the NUREG-1150 and IPE studies.

The spatial interactions and the various pathways between high risk areas (i:e., Turbine Building and Emergency Switchgear Room and Auxiliary Building) were inspected and evaluated for potential flood damage.

Flood Event Frequency Analysis The initiating frequency data was developed based on actual flooding events' and updated to include plant-specific features and data. The data was gathered from various sources including the IPE Surry flood analysis, industry sources, licensing event reports (LERs). In some cases, plant-specific models were developed especially with regard to the most important circulating water (CW) and service water (SW) lines in the Turbine Building. These two sources of flood dominate the risk, and therefore required special treatment. The most dominant failure mechanism for large pipes is pipe rupture due to water hammer events. Generic pipe failure data and modelsl231were used when plant-specific data was unavailable with the exception of the CW and SW lines. The effects of flood barriers and other mitigating mechanisms were also considered in the development of damage states.

The equipment damage due to internal flood was determined as a function of flood level. The flood level depends on various factors such as the leakage rate, area of interconnections, drainage pathways, and potential mitigating Vol. I 15 NUREG/CR-6144

3 Approach and Limitations actions. In order to take these factors into account, simple flood damage categories or damage states were developed.

The damage states effectively incorporate the time dependency of the flood event and any potential mitigating or recovery actions. The damage states reflect a particular flood-exceedance frequency at a particular location with a predefined equipment damage level. This allows the incorporation of any partial failures due to flooding or differentiation between equipment damages at a particular location.

The flood initiating frequencies were developed to incorporate simple recovery actions as expected from the existing experience or data base. In addition, the data base was examined for its applicability to the Surry plant and modified to take into account certain plant-specific features.

Location and Scenario Identification The identification of potential accident scenarios and flood locations was accomplished by initially using the general arrangement diagrams and the RHR system fault tree developed for the internal event analysis. The fault tree identifies all equipment and support components required for the RHR system operation. These were located and identified on the plant drawings and correlated with the flood areas as identified during the analysis. The scenario development also included the identification of potential propagation pathways and their physical nature ( doors, stairways, etc.) which may limit the flood rate. In addition, drainage potential and other mitigating features which could help in the recovery process were also identified. Once the flood scenarios were identified, the effect on other front line systems or their components was determined. This was limited to only those systems which were required to prevent core damage and were identified by examining the internal event trees for the loss ofRHR function and/or station blackout. The appropriate equipment and/or its support were located and placed in the appropriate flood areas.

The quantification takes into account the rate of water flow into the area or height of the flood and establishes generally a critical flood level in each specific plant area. The time available for any recovery action was estimated by defining the critical volume and the applicable flow rate. This approach allows the incorporation of simple recovery actions in the quantification without greatly modifying the existing fault trees and internal event trees.

Plant Response Analysis The internal flood analysis utilized the system fault trees and event trees developed for the internal event study. The flood events were categorized as to their effect on the residual heat removal system and were mapped to the corresponding event tree for internal events. The event trees were modified to take into account the specific accident evolution of the flood event. In addition, the system fault trees were also modified according to the effects of the flood on equipment used to mitigate the accident. The relevant human error probabilities were also modified as timing and potential spatial interactions complicated the accident progression.

3.1.4 Seismic Events In this study, only a Level I seismic PRA was performed. The key elements are:

( 1) Seismic hazard analysis - estimation of the frequency of various levels of seismic ground motion (acceleration) occurring at the site.

NUREG/CR-6144 16 Vol. 1

3 Approach and Limitations (2) Seismic fragility evaluation - estimation of the conditional probabilities of structural or equipment failure for given levels of ground acceleration.

(3) Systems/accident sequence analysis - modeling of the various combinations of structural and equipment failures that could initiate and propagate a seismic core damage accident sequence.

(4) Evaluation of core damage frequency - assembly of the results of the seismic hazard, fragility, and systems analyses to estimate the frequencies of core damage for various accident sequences and for the plant as a whole.

Key Assumptions:

(1) The seismic study adopted all of the assumptions made in the interna_l events analysis without exception. Most importantly, the loss-of-offsite-power (LOOP) event trees were adopted directly. This included the definitions of the top events and underlying thermal-hydraulic and other assumptions that support these event trees, namely those corresponding to mid-loop operation.

(2) Only refueling outages were considered in this analysis. Indeed, only certain specific operating states within the standard refueling outages at Surry were considered. Outages for other reasons frequently occur at nuclear power plants, and they are of two broad types: controlled shutdowns and uncontrolled (rapid) shutdowns.

Although these outages for other reasons can produce different plant operating states and configurations unique to the reason for the shutdown, resources in this analysis did not permit examining outage configurations other than those for refueling. In any event, refueling outages contribute a majority of the shutdown time.

(3) It was assumed that the only seismic events of concern are those that cause loss-of-offsite-power (LOOP) transients. Seismic events of lower acceleration than those causing LOOP are expected to have a negligible probability of causing severe plant accidents for two reasons: (i) Critical plant equipment, including the residual heat removal (RHR) system, can withstand significantly higher accelerations than that which is sufficient to cause LOOPJ24J,l251 Thus, loss of core-cooling capability will have a very low probability for seismic events too small to cause a LOOP. (ii) With offsite power available, sources of water sufficient to cool the core from alternative pumping sources will generally be available even if the RHR system fails.

(4) It was also assumed that a seismic-initiated LOOP is non-recoverable in the time frame of interest in this study (from about one to several hours). This is a reasonable and only slightly conservative assumption, because the LOOP initiator is most likely to arise from the seismic-caused failure of the ceramic insulators in the plant substation.12 4*251 Replacement of these insulators would likely require several hours at a minimum, and probably much longer. Additionally, other damage caused by the earthquake (for example, to offsite transmission systems and offsite switch yards) would likely hamper efforts to recover offsite power.

(5) The ~mgineering methodology used to develop probabilistic seismic fragility curves employed a successive-screening approach, in which structures and equipment that are judged to be very strong under earthquake loading were screened out first. In this manner, the number of items for which actual numerical fragilities had to be developed was limited. Also, for a few items the study team was unable to obtain enough information, Vol. 1 17 NUREG/CR-6144

3 Approach and Limitations either because access to some parts of the plant was limited or because engineering information in the appropriate form was not available. For these items, generic fragilities were used.

(6) The seismic failures of identical equipment in similar locations were assumed to be fully correlated. This means, for example, that when a postulated earthquake causes one diesel generator to fail, it was assumed that the other diesel generator(s) would also fail. This simplifying assumption is probably conservative in many cases, but perhaps not overly so for truly identical equipment. Sensitivity studies performed in several past seismic PRAs have shown that the bottom-line results are sensitive to this assumption at a level of about a factor of plus-or-minus two.

(7) Equipment failure from seismic-induced relay chatter is outside the scope of this analysis. While relay chatter can be important,£261 it is a complicated issue, and the resources to study it were not available within this project. In any event, relay chatter is being studied at every U.S. nuclear plant as part of the current IPEEE program,1271and it is expected that almost all of the relays that are especially sensitive to relay chatter will be identified and, if appropriate, modified in the course of the IPEEE studies.

(8) Both the Lawrence Livermore National Laboratory (LLNL)l28l !llld Electric Power Research Institute (EPRI)l29l seismic hazard curves were used to produce two parallel results.

3.2 Level 2/3 A phased approach was also used in the Level 2/3 program; however, both phases addressed the risk from only mid-loop operation. The first phase of the Level 2/3 PRA was initiated in late 1991 and consisted of an Abridged Risk Study. This study focused on accident progression and consequences, conditional on core damage. Phase 2 is a more detailed study in which an integrated evaluation of risk due to internal events during mid-loop operation was performed. Risk estimates were not made for accidents initiated by internal fires, internal floods, and seismic events.

As this study is limited to accidents during mid-loop operation, it is not a complete risk estimate for accidents that could occur during low power and shut down operation. The approach adopted in the Phase 2 study is mostly based on the NUREG-1150 approach. The sections below therefore describe only those elements of the methodology which are different from the NUREG-1150 approach.

Accident Frequency Analysis The Level 1 analysis, including fault trees, event trees, recovery actions, etc., of the significant accident sequences leading to core damage and their frequencies, was carried out by the IRRAS code.1 121 A newly added feature of IRRAS which became available recently was used to group the minimal cut sets into the plant damage states (PDSs).

Seven characteristics were used to construct the plant damage states.

The first characteristic identifies the time frame in which the accident occurs. A major difference between a PRA at full power and at mid-loop operation is the extended time period following shutdown during which an accident can occur. This time period allows for a significant decay of the power level, extends the time available for various phenomena and for recovery actions and leads to a lower value of the radionuclide inventory which can potentially be released. This feature of the shutdown PRA was modeled in the Level 1, accident frequency analysis through the NUREG/CR-6144 18 Vol. 1

• 3 Approach and Limitations construction of four "time windows" for various time periods following shutdown. Each time window has its own decay heat level and success criteria for accomplishing various recovery actions prior to core damage. The first PDS characteristic therefore identifies the time window in which the accident occurs.

The second characteristic provides the status of ac power. Of particular interest is whether or not ac power is

• available and if it is not available whether it can be recovered. Human error is an important contributor to the core .

damage accident frequency for mid-loop operation. The third characteristic therefore identifies if human error contributed to the accident and if it did what was the type of error. The status of the reactor coolant system can significantly impact accident progression and this is therefore addressed in the fourth PDS characteristic. For some plant damage states recovering coolant injection after the start of core damage can prevent further core damage and terminate the accident prior to the core melting through the reactor vessel. The fifth characteristic deals with the issue of restoring coolant injection. If core damage occurs and containment integrity is lost then operation of the containment sprays can reduce the airborne fission product aerosol concentration and reduce the amount of radionuclides released to the environment. The sixth characteristic gives the status of the spray system. Finally the status (injected or not injected) of the refueling water storage tank is given in the seventh characteristic.

Using the above characteristics, the Level l cutsets were binned into 48 plant damage states. These plant damage states were further binned into four PDS groups to be processed by the accident progression event tree (APET) analysis. The main consideration in binning was the similarity of accident progression after core damage.

PDS Group I consists of station blackout accidents.

PDS Group 2 consists of accidents attributable to human error.

PDS Group 3 consists of accidents in which core cooling is lost during recirculation.

PDS Group 4 consists of accidents where core cooling is lost because of loss of the 4 kV bus.

Accident Progression Analysis The accident progression event tree developed for mid-loop operation has been developed largely based on the APET developed for full power operation in the NUREG-1150 study. Some questio!1s were removed and other questions pertinent to mid-loop operation (such as time windows and containment closure) were added. The APET for mid-loop operation consists of 40 questions compared to 71 questions in the full power APET. Due to resource limitations, a formal expert elicitation procedure could not be implemented to construct ranges of values and distributions for key variables. Assignments of these values and ranges were therefore made internally at BNL. The timing of key events in the accident progression is based on calculations carried out with the MELCOR code.161 A very important issue which has a major impact on the result is the status of the containment at accident initiation.

Assignments of the possible values of this status were made based on discussions and exchange of written communications with the Surry plant personnel. The APET was quantified using the EVNTREl301code as in the full power study. It was again necessary to combine the numerous outcomes of the APET into accident progression bins (APBs) for input to the source term analysis. A similar approach to that used in the full power study was also used in.the current analysis. The only additional information needed for the current study was the time window in which the accident occurred. Thus information identifying the time window was carried throughout all of the constituent analyses.

Vol. 1 19 NUREG/CR-6144

3 Approach and Limitations Source Term Analysis The source term analysis used for mid-loop operation was similar to the approach used for full-power operation.

The SURSOR£311] code was reviewed for its applicability to shutdown conditions by an expert group consisting of staff from BNL and SNL. The source term ranges in SURSOR were also compared against predictions with the MELCOR code. In general SURSOR was considered appropriate for use in the current study. The APBs were therefore processed through the SURSOR code in a similar manner to the full power study. The output from SURSOR is a larger number of source terms which need to be grouped into representative source terms. The process was done in the full power study using PARTITION.£3 21

• Methodologically, the important difference between NUREG-1150 and the present study is a reworking of the partition approach to reflect the long time interval and consequent decay of the inventory in the current study. In effect, accident progression bins and source term groups are defined for each time window. The partitioning of the source terms and the assignment of health effect weights is carried out through a partition procedure designated PARTITION-LPS.

Consequence Analysis The consequence measures for the average source term in each source term group were calculated by the MACCS code.£331 The latest release of MACCS, Version 1.5.11.1, which incorporates the important BEIR V update to the latent cancer-dose relationship,l34l was used to compute consequences. In contrast, the NUREG-1150 study used an earlier version of MACCS, Version 1.5.11, to compute consequences. The more recent version of MACCS gives a higher (by approximately a factor of 3) number of latent cancers, than the earlier MACCS version for the same value of population dose.

Risk Integration and Uncertainty The integrated risk was obtained by combining the individual results of each of the constituent analyses. The approach. was similar to the NUREG-1150 approach. Distributions were assigned to important variables (some distributions were identical to those used in NUREG-1150, others were developed specifically for mid-loop operation) and samples were then created by randomly picking values from the distributions using Latin Hypercube Sampling.£351 For each sample the values assigned to each variable were propagated through the integrated analysis to determine risk estimates for each consequence measure. By repeating the calculation for 100 samples (or observations) distributions of risk estimates were obtained from which the uncertainty in risk was determined.

Key Assumptions (Level 2/3 Study):

(1) Discretization of time windows and decay heat levels: Decay heat level is a key parameter in the accident analysis due to the long time interval, depending on the POS and outage type, over which an accident can potentially occur during mid-loop operation. Four time windows with corresponding decay heat levels were constructed in the Level 1 analysis and it was assumed that the decay heat level (which varies continuously) of each time window can, be adequately represented by its value at the mid-point of the time window.

(2) Containment Status: Several assumptions had to be made on the status of the containment during mid-loop operation. The pressure capability ranges from no pressure retaining capability (le~age at inception of release)

NUREG/CR-6144 20 Vol. 1

• 3 Approach and Limitations to full design capability (as at full power operation). The ability of containment to retain fission products released from damaged fuel is the dominant factor affecting risk.

(3) Source Term: It was assumed that the source term code, SURSOR, which was developed for the full power study would adequately apply to low power and shutdown conditions as well. This assumption was checked

\.

through spot comparisons with calculations based on the mechanistic code MELCOR and by a review performed by a Source Term Advisory Group comprised of BNL and SNL staff.

(4) Consequences: The consequence calculation assumed the same emergency response for the offsite population in the low population zone surrounding Surry and the same long-term protective actions as the NUREG-1150 study.

(5) Onsite Doses: The scoping calculation of onsite doses assumed that the releases were directly from the containment to the environment through the equipment hatch and not through the personnel hatch so no in-building doses were calculated.

Strengths and Limitations (Level 2/3 Study)

The strengths of the Level 2/3 study are:

• {I)

(2)

It is a systematic and integrated evaluation of risk during mid-loop operation at the Surry Unit 1 plant, including accident frequency, accident progression, source term and consequence analysis with a determination of uncertainty in each of the component analyses and in the final risk measures.

The integrated analysis takes into account the long time after shutdown that the accidents can occur and the impact of the consequent decay in power level and radio nuclide inventory on the risk. In particular, new latent cancer weights were derived for source term partitioning and used in the consequence calculation.

(3) The newest version of the MELCOR code, Version 1.8.2, was used to calculate the timing of key events in the accident progression which were then used in the accident progression event tree.

(4) The accident progression event tree has sufficient detail to account for a significant portion of the likely paths of evolution of the accident. *

(5) The study includes a scoping calculation of onsite dose rates at locations in the vicinity of the plant during the accident.

The Level 2/3 study has the following main limitations:

(1) There was no formal expert elicitation process used, as in the NUREG-1150 study, to provide values and distributions for key variables in the accident progression. Assignments for these variables had to be made internally at BNL or derived from analogy with full power conditions. The selection of the key variables themselves was also made internally at BNL. Thus the uncertainty analysis is not as robust as it could have been with input from an expert panel.

Vol. 1 21 NUREG/CR-6144

3 (2)

Approach and Limitations The scope of the Level 2/3 stud)'. is limited to accidents initiated by internal events (due to equipment failure or human error) during mid-loop operation. Risk estimates were not made for accidents initiated by internal fires, internal floods and seismic events. The final risk numbers should therefore not be interpreted to reflect the risk of all plant operational states during low power and shutdown operation.

NUREG/CR-6144 22 Vol. 1

4 RESULTS 4.1 Level 1 Results 4.1.1 Quantitative Results from Traditional Internal Events Table 1 summarizes the results of the event tree quantification, showing the core damage frequency as a function of the initiating events and P0Ss. The core damage frequency is the frequency that core damage occurs while the reactor is at mid-loop, and includes the fraction of a year that the reactor is at mid-loop. POS 6 of a drained maintenance outage (D6), and POS 6 of a refueling outage are the most dominant POSs. The characteristics of these POSs are high decay heat level and a relatively short time available for operator action. In contrast, POS 10 of a refueling outage has a very low decay heat, and its core damage frequency is approximately one order of magnitude lower.

Table 2 compares the results of this study with those ofNUREG-1150 and the individual plant examination (IPE) performed by the utility for Surry. The results are displayed in two ways. The core damage frequency, shown in the first row, is the frequency that core damage occurs when the plant is at mid-loop (the core damage frequencies in the parentheses are the contributions due to over-draining events), and the core damage frequency, shown in the third row, is the core damage frequency (minus the contribution of over-draining events) divided by the fraction of time the plant is at mid-loop (second row). The former accounts for the fact that the plant is at mid-loop only a small fraction of the time, while the latter is the core damage frequency conditional on the plant being at mid-loop. The core damage frequency of mid-loop operation is approximately an order of magnitude lower than the CDF estimated in NUREG-1150 for power operation. However, the plant is only at mid-loop operation approximately 7% of a' calendar year. The numbers in the parentheses of the third FOW of the table are the conditional probability of core damage due to over-draining events, given that the plant enters mid-loop operation in the POS.

The core damage frequencies shown in the first row of Table 2 are additive. _That is, the sum of the core damage frequencies of the three POSs is the total core damage frequency of mid-loop operation. This total (5 E-06 per year) can be added to the core damage frequency of power operation (e.g., 4 E-05 per year for NUREG-1150). Therefore, the sum of 4.5 E-05 per year is the frequency per year that core damage occurs while the plant is at full power or mid-loop operation.

The core damage frequency shown in the third row of Table 2 is conditional on the plant being at mid-loop. The fact that the conditional core damage frequency of mid-loop operation (7.6E-05 per year) is higher than that of full power operation (4E-05 per year) indicates that mid-loop operation may be more vulnerable to core damage than full power operation. However, the plant is at mid-loop only a small fraction of the time.

Table 3 lists the conditional core damage frequency as a function of the time windows and P0Ss. The conditional core damage frequency is the rate at which core damage occurs given that the plant is in the time window of the POS.

It is obtained by dividing the core damage frequency by the fraction of time the plant is in the time window of the POS. The conditional core damage frequency is a measure that can be used to compare the vulnerability of the time windows and P0Ss with respect to core damage. It can be seen, fromTable 3, that for each POS the conditional Vol. 1 23 NUREG/CR-6144

4 Results Table 1 Summary of Results: Core Damage Frequency by Initiating Event and Plant Operational States

• Initiating Event Point Estimate Core Damage Frequency (per year)

R6 RIO D6 Total

1. Loss ofRHR RHR2A-Over Draining l.SE-7

• 5.3E-8 2.6E-7 4.9E-7 RHR2B-Failure to Maintain Level 2.lE-08 2.0E-8 2.9E-8 7.0E-8 RHR3-Non-Recoverable Loss of RHR l.5E-7 8.4E-9 3.0E-7 4.6E-7 RHR4-Non-Recoverable Loss of Operating Train of 7.6E-9 l.2E-9 2.3E-8 3.2E-8 RHR RHR5-Recoverable Loss of RHR 4.0E-8 4.lE-09 9.3E-8 l.4E-7

2. LOOP-Loss of Offsite Power LI-Both lH and lJ Energized L2- l H and 2H energized, not lJ L3-1H energized, not lJ, unit 2 blackout Bl-Unit 1 Blackout 3.3E-7 l.OE-7 4.2E-8 4.SE-8 7.0E-8 l.3E-8 l.3E-8 l.lE-8 7.6E-7 l.7E-7 9.9E-8 l.7E-7 l.2E-6 2.9E-7 l.5E-7 2.3E-7 B2-2 Unit Blackout 3.SE-8 4.2E-8 l.lE-7 l.9E-7

3. 4KV-Loss of 4 kV Bus l.4E-7 l.9E-8 2.4E-7 4.0E-7

4. VITAL-Loss of Vital Bus 2.SE-8 5.lE-9 7.3E-8 l.lE-7

5. AIR-Loss of Outside Instrument Air 7.9E-10 - 3.2E-9 4.0E-9

6. CCW-Loss of CCW 6.3E-8 l.lE-10 2.lE-7 2.7E~7

7. SWGR-Loss of Emergency Switchgear Room Cooling 3.6E-8 l.2E-8 7.4E-8 l.2E-7

8. ESFAS-Inadvertent Safety Feature Actuation 2.7E-7 2.7E-8 6.SE-7 9.SE-7

9. Dilute-Boron Dilution (CDF) 6.SE-08 TOTAL l.5E-6 3.0E-7 3.3E-6 5.lE-6*

Notes:

• Not including boron dilution R6 = Plant operational State 6 of a refueling outage RIO = Plant operational State 10 of a refueling outage D6 = Plant operational State 6 of a drained maintenance NUREG/CR-6144 24 Vol. 1

Table 2 Comparison of Total Core Damage Frequency (CDF) with NUREG-1150 and IPE Study Results PWR Low Power and Shutdown Study R6 RIO D6 TOTAL (Mid-Loop POSs, Internal Event Only, Point Estimate) CDF* per year l.6E-06 3.IE-07 3.3E-06 5.IE-06 (1.SE-07)** (5.SE-08)** (2.7E-07)** (5.0E-07)**

Fraction of a year the plant l.6E-02 l.SE-02 3.SE-02 6:6E-02 is in mid-loop Conditional CDF*** per year . 8.3E-05 l.7E-05 8.7E-05 7.6E-05****

(CDP) (3.0E-U7) (1.SE-07) (2.3E-07) (2.4E-07)

NUREG-1150 (Internal Events Only, 4.0E-05 at Power, Mean Value)

IPE (Internal Event Only, Point Estimate) 7.4E-05

• CDF reflects the fraction of time the plant is at mid-loop

• • Contribution of over-draining events

• • • Frequency of core damage given that the plant is at mid-loop

• • • • Average over the POSs (CDP) probability of core damage due to over-draining upon entering the POS

4 Results Table 3 Conditional Core Damage Frequency As a Function of the Time Windows and POSs (per year)

R6 RIO D6 Average Window 1 (13hr-75hr) l.OE-03 - 3.4E-04 3.SE-04 Window2 7.6E-05 - 5.9E-05 7.3E-05 (7 5hr-240hr)

Window 3 5.SE-05 6.SE-05 5.2E-05 5.6E-05 (240-768hr)

Window4 l.9E-05 l.6E-05 l. IE-05 l.SE-05

(> 768hr)

Average 8.3E-05 l.7E-05 8.7E-05 7.0E-05 Notes:

R6 = Plant Operational State 6 of a refueling outage RIO = Plant Operational State 10 of a refueling outage D6 = Plant Operational State 6 of a drained maintenance core damage frequency decreases with time window. This is due to the relaxed success criteria and more time available for operator actions in the later time windows. The conditional core damage frequency for R6 or RIO is higher than for D6 mainly because the RCS loops have a high probability of being isolated in a refueling outage which makes reflux cooling impossible. For example, in window l, the probability that the loops are isolated in a refueling outage is 0.3, and the probability that reflux cooling fails in a drained maintenance outage is O.l(modeled as a recovery action). The difference between R6 and RIO in windows 3 and 4 is due to the difference in maintenance unavailabilities.

The averag12s in Table 3 represent the averaged (weighted by the frequency that initiating events occur) conditional core damage frequency. For example, the averaged conditional core damage frequency for R6 is SE-05 per year, while that for D6 is 9E-05 per year. This does not contradict the comparison made earlier for a given time window of the POSs, because given that plant is in D6 the plant is more likely to be in the earlier time windows that have higher conditional core damage frequency. The averaged conditional core damage frequency over the POSs, shown in the last column of Table 3, does show the trend of decreasing with decay heat.

Table 4 lists the key uncertainty characteristics of the core damage frequencies for mid-loop operation and power operation, and shows that the core damage for mid-loop operation has a larger dispersion than that of power operation. Note also that the mean CDF in Table 4 is ~lightly different for the total CDF in Tables 1 and 2. This is because the numbers in Tables 1 and 2 are point estimates whereas the information in Table 4 reflects an uncertainty analysis.

NUREG/CR-6144 26 Vol. 1

0

• Table 4 Result of the Level 1 Uncertainty Analysis and Comparison with Full Power Operation (per year)

Study Mean 5th 50th 95th Error Percentile Percentile Percentile Factor Internal Full Power Operation - NUREG 1150 (per year) 4.0E-05 6.SE-06 2.3E-05 l.3E-04 4.4 Events Full Power Operation- IPE 7.4E-o5* - - - -

Mid-Loop Operation (per year) 4.9E-06 4.SE-07 2.IE-06 l.5E-05 5.7 Internal Full Power Operation - NUREG 1150 (per year) l.IE-05 - - - -

Fires Full Power Operation- IPE ** - - - -

Mid-Loop Operation (per year) 2.2E-05 l.4E-06 9.IE-06 7.6E-05 7.2 Internal Full Power Operation - NUREG 1150 (per year) *** - - - -

Flood Full Power Operation- IPE 5.0E05 .. - - - -

Mid-Loop Operation (per year) 4.SE-06 2.2E-07 l.7E-06 l.SE-05 9.0 Seismic Full Power Operation - NUREG 1150 LLNL l.2E-04 - - - 33 Events (per year) .

EPRI 4.0E-05 - - - 4.4 Full Power Operation- IPE ** - - - -

Mid-Loop Operation (per year)**** LLNL 3.5E-07 l.3E-09 4.0E-08 1.4E-06 32 EPRI 8.6E-08 2.5E-I0 9.7E-09 3.7E-07 37

• point estimate

• • not available

• • • below truncation of l .OE-08 per year

• • • • refueling outage only (no drained maintenance)

4 Results 4.1.2 Insights from Internal Event Analysis The following insights were gained from this study. They are based on the Surry-specific design and operation.

Their applicability and significance with respect to other PWRs would have to be assessed separately.

Operator Response The dominant cause of core damage was the operator's failure to mitigate the accident. {There is very large uncertainty in the human error probabilities used in this study.) In general, it would be beneficial to have good training, procedures, and instrumentation to ensure that the utility's staff can respond to shutdown accidents.

Procedures for Shutdown Accidents Very few procedures are available for accidents during shutdown; the procedure for loss of decay heat removal, AP 27 .00, is the only one that was written specifically for the shutdown scenarios analyzed in this study. The procedure is conservative with regard to the equipment needed to establish reflux cooling and feed-and-bleed. In this study, the use of fewer than the number of steam generators specified in the procedure for reflux cooling was treated as a recovery action, and a more realistic success criteria was used for feed-and-bleed when the decay heat is high. In most cases, the information in the procedures for power operation is helpful, for shutdown accidents. For example, the procedure for station blackout, ECA-0.0, gives instructions for dumping steam to the condenser. Credit for this

• procedure was taken into account in this study. However, some procedures written for power operation would mislead the operator if followed during shutdown. For example, the procedure for loss of offsite power, AP 10.00, stat.es that "When the EDG is the only source of power to an emergency bus, the Component Cooling Pump should NOT be in service". During shutdown, CCW flow to the RHR heat exchanger is necessary for decay heat removal.

Therefore, following this procedure under these circumstances would not be the most appropriate operator response.

Instrumentation The level instrumentation used during mid-loop operation (i.e., standpipe level instrumentation and ultra-sonic level instrumentation) has limited applicability during a shutdown accident. The standpipe system indicates the correct level only when there is no build-up of pressure in the system. The ultra-sonic level instrumentation only provides level indication when the level is within the reactor coolant loops, and therefore, may not be useful during a feed and bleed operation.

Supporting Thermal-Hydraulic Analysis The thermal-hydraulic behavior of the reactor coolant system is rather complex, mainly because the pressurizer is usually the relief path for coolant or steam, and the vessel head does not have a large vent. When performing thermal-hydraulic analysis in support of the PRA effort, c.onsideration must be given to longer term system behavior, at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> into the accident. In this study, such calculations were done for feed-and-bleed operation using a charging pump, and with gravity feed from the RWST. Additional calculations would be helpful to better understanding the effectiveness of reflux cooling, and feed and bleed using a low pressure injection pump. In this study, the conservative results of the Virginia Power Technical Report# 865 (Revision 1, dated July 3, 1992)£101were used to determine the number of steam generators needed as a function of time after shutdown, because such criteria NUREG/CR-6144 28 Vol. 1

4 Results are explicitly written in the procedure for loss of RHR. In the event trees and fault trees, it was conservatively assumed that if there were too few steam generators, then no credit was given to reflux cooling. In this case, reflux cooling still would help. In fact, a review of the studies performed by Westinghousel91 and the Idaho National Engineering Laboratory17,81 found that one steam generator is sufficient for any level of decay heat. To take some credit for reflux cooling in this case, a recovery action with failure probability 0.1 was applied to those core damage cutsets that involve failure of reflux cooling due to insufficient steam generators. It was assumed that hot-leg injection using a low head injection pump is adequate to prevent core damage. Due to the low shut-off head of the pumps, approximately 150 psig, the concern is that if boiling takes place in the system, the low head pump may be unable to inject.

Maintenance Unavailability A review of shift supervisor's log books and minimum equipment lists for three refueling outages showed that the maintenance unavailabilities of equipment that can be used to mitigate an accident were very high. For example, two out of three charging pumps were found to be tagged out practically throughout the whole mid-loop period. The two low-head injection pumps also were unavailable a large fraction of the time. Generic Letter 88-17, requires the plant to have one high-head pump and one low-head pump available. For the purpose of quantification it was assumed that charging pump A, charging pump cooling water pump A, and low head injection pump B are available. From the check list used for reduced inventory conditions, it was assumed that the maintenance of diesel generators, 4 kV emergency buses, and stub buses is not allowed .

• Maintenance unavailability was found to be the dominant cause of equipment unavailability. In combination with human errors, maintenance of the charging pump cooling water pump, the charging pump, and the low head injection pump appear in the dominant cutsets for some of the core damage sequences.

Isolation of Reactor Coolant Loops Isolation of the RCS loops is an important contributor to the core damage frequency. Review of the plant shutdown experience indicated that the reactor coolant loops are isolated for extended periods in a refueling outage, making the steam generators unavailable for decay heat removal upon loss ofRHR. In a cold shutdown condition, the steam generators are usually maintained in the wet lay-up condition with the secondary side filled with water. During mid-loop operation, the availability of the SGs makes reflux cooling a possible method of mitigating a loss ofRHR; this might be the only mitigation function available in a station blackout.

Single Failures of the RHR System The RHR system at Surry has no active safety function (i.e., it does not perform the safety injection function in scenarios initiated at full power). Consequently, many single component failures can cause loss ofRHR. In the RHR system, a single suction line from the loop A hot leg and a single flow control valve HCV-1758 are used. During its operation, a single CCW header provides cooling to both RHR pump seal coolers and the operating RHR heat exchanger, and two CCW return lines from the RHR system are used. Hence, a failure of the trip valve 109A or B in one of the two CCW return lines can cause loss of the system. These trip valves also fail closed on loss of instrument air, or vital bus. Closure of the TV-109 valves is a significant contributor to loss ofRHR. It was assumed that the opening of the RHR flow control valve HCV-1758 as a result of loss of vital bus III will cause RHR pump run out: this also was a significant contributor to loss of RHR.

Vol. I 29 NUREG/CR-6144

4 Results Valve Arrangement of Auxiliary Feedwater System and Main Steam System during Shutdown The auxiliary feedwater system has six motor operated valves in the flow path to the steam generators, that are normally closed during shutdown. They are difficult to locate during a station blackout. Similarly, the main steam non-return valves are normally closed during shutdown, and have to be opened to use steam dump to the condenser.

These valves depend on offsite power and would be very difficult to open without it.

Potential for Plugging the Containment Sump when Recirculation is Needed Because of various activities, transient material and equipment are brought into containment during shutdown. For example, large plastic Herculite sheets are often used to separate work areas from the rest of the containment. When an accident requiring recirculation from the containment sump occurs (as in time windows 1 and 2) the material would increase the potential for plugging the containment sump.

4.1.3 Quantitative Results from Internal Fire Analysis Table 5 summarizes the point estimate results from the internal fire analysis. The results of an uncertainty analysis on the core damage frequency due to fires is included in Table 4. The quantification indicates that scenarios in the emergency switchgear room (ESGR), the cable vault and tunnel, and the containment are important contributors to the CDF. The most dominant scenarios occur in the cable vault and tunnel (due to proximity of many emergency cables from both divisions in a closed, constrained space) and in the ESGR, where many emergency cables from both divisions come, together in close proximity (before entering the control room). In the containment, the relatively high CDF is due to a relatively high scenario frequency combined with non-separation of RHR trains over significant distances. Other scenarios are also important, due to moderate damage from the fire combined with a relatively high scenario frequency.

P0Ss D6 and R6 are much more important than RIO (as RIO occurs in later time windows). D6 is more important than R6 due to constraints imposed by a drained maintenance outage and its tendency to occur in earlier time windows.

The earlier time windows are more important than the later ones, with window 4 being relatively unimportant.

Windows 1 and 2 are of the highest importance, with window 2 being significantly more important than window 1.

While the decay heat is higher and the success criteria are more stringent in window 1, this window is relatively short duration and the outages tend to occur in the later time windows. The most risk significant fire initiator occurs in the cable vault tunnel area, in window 2 and POS D6, followed by a few scenarios in the ESGR, in the same window and POS.

Before the recovery actions were applied, the core damage frequency due to fire events at mid-loop was 2.7E-05/yr.

After application of recovery actions, the core damage frequency was reduced to 1. 7E-05/yr. Note that this point estimate differs from the total core damage frequency of Table 5, i.e., 1.SE-05/yr. This is because the total core damage frequency of Table 5 was calculated simply as the sum of the frequencies of the sequences, while the point estimate of 1.7E-05/yr was calculated using the minimum-cutset-upper-bound method implemented in the IRRAS computer code. The recovery actions do not reduce the core damage frequency significantly, because they are only NUREG/CR-6144 30 Vol. 1

4 Results effective in windows 3 and 4 (in order to satisfy the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> success criterion), whereas windows 1 and 2 are more dominant.

Table 5 Summary of Point Estimate Core Damage Frequencies for Fire Events (per year)

Fire Area R6 D6 RIO Total Emergency Switchgear Room 4.IE-06 8.2E-06 2.IE-07 l.3E-05 Containment 7.0E-08 5.SE-07 5.0E-09 6.3E-07 Cable Vault and Tunnel l.3E-06 2.7E-06 7.4E-08 4.0E-06 Normal Switchgear Room l.SE-08 3.SE-08 1.4E-09 5.IE-08 Main Control Room 7.0E-08 5.3E-07 4.4E-09 6.0E-07 Total 5.SE-06 l.2E-05 2.9E-07 l.8E-05 Notes:

R6 = Plant Operational State 6 of a refueling outage RIO = Plant Operational State 10 of a refueling outage D6 = Plant Operational State 6 of a drained maintenance Table 4 summarizes the result of the uncertainty analysis for core damage accidents. The results on internal fires were obtained by performing uncertainty analysis using 500 Latin Hypercube Sampling (LHS) samples. Also shown in the table is the uncertainty analysis results of the internal event analysis as well as the mean value of the internal fire analysis ofNUREG-1150.

4.1.4 Insights from Internal Fire Analysis Fires during shutdown are not as prevalent as fires during power operation (after the construction events are taken out). However, a greater potential does exist for fires in certain categories (e.g., transient or welding igniting cables or other equipment fires) during shutdown operations, but the possibility of some types of fires is reduced (e.g.,

deenergized equipment, oil dripping on hot piping). A fire at shutdown is liable to be detected much sooner and extinguished in its early phases, because of increased floor traffic. (Credit is taken for this by disallowing events that were discovered in the smoking stage (without flames) or early enough such that deenergizing equipment extinguished the fire.) At Surry, a fire watch is in place during welding operations and the fire doors are kept closed.

Human error events are not prominent contributors individually in terms of the Fussell-Vesely importance measure (a few percent). Part of the reason for lack of importance of individual HEPs is that there are many events, each applicable in a small fraction of sequences; another reason is in the values assigned; the third reason is that in many important scenarios hardware failures dominate due to heavy damage by fire.

Vol. 1 31 NUREG/CR-6144

4 Results Table 4 provides a comparison of the fire induced core damage frequency during mid-loop operation with that of power operation. Although the plant spends much less time in mid-loop, the core damage frequency is comparable to that of power operation. The main reason for this result is the routing of cables needed to support RHR operation or to mitigate an accident during mid-loop operation. The cable routing is such that a single fire at a few critical locations can damage almost all the equipment need to mitigate the accident, while during power operation much fewer critical locations exist.

4.1.5 Quantitative Results from Internal Flood Analysis

• The main results of the flood analysis are presented in Table 6, listing the point estimate core damage frequencies of the analyzed operating states. The results of the uncertainty analysis are shown in Table 4, indicating the uncertainty bounds of the core damage frequency due to internal floods. It was found that the most dominant contributors to core damage due to internal floods are accident scenarios ll1.itiated in the Turbine Building leading to the draining of the intake canal. This potentially could result in a flood encompassing the plant Emergency Switchgear Rooms (ESGR) leading to a two unit loss of all emergency power (F 1 and F2 scenarios). The scenarios account for approximately 85% of the total core damage frequency (CDF) due to internal floods. This result is mainly due to the specific features of the Surry circulating water system and may not be applicable to other plants.

The second most dominating flood scenario involves flooding of the Safeguard/Auxiliary Building in combination with the unavailability of the Refueling Water Storage Tank (RWST). The contribution of these scenarios ( F4 and FS) is approximately 13% of the total internal CDF.

Table 6 Summary of Point Estimate Core Damage Frequencies for Flood Events (per year)

Scenario Core Damage Frequency with Recovery POS6 POS6 POSlO Total Refueling Drained Refueling Turbine Building Fl l.9E-06 9.3E-08 l.SE-06 3.SE-06 Turbine Building F2 4.SE-07 2.2E-08 3.6E-07 8.3E-07 Auxiliary Building F3 4.7E-08 4.3E-08 l.2E-08 l.OE-07 Auxiliary Building F4 l.6E-07 5.7E-08 6.7E-08 2.SE-07 Safeguard Area FS 2.0E-07 8.9E-08 9.4E-08 3.SE-07 Spray in Containment F6 - - - -

Mechanical Equipment Room No. #3 - F7 l.OE-08 1.SE-08 7.SE-09 3.3E-08 Total-Fiood 2.SE-06 3.2E-07 2.0E-06 5.IE-06 NUREG/CR-6144 32 Vol. 1

• 4 Results 4.1.6 Insights from Internal Flood Analysis The internal flood CDF is dominated by Turbine Building flood events. These events are primarily initiated by either valve or expansion joint failures in the main inlet lines of the circulating water system. These failures may lead to pipe ruptures upstream of the condenser water box and inlet valves. At Surry the circulating water system is gravity fed from a very large capacity intake canal and its isolation may not be accomplished in a timely manner. This is in contrast with other common design arrangements where dedicated pumps provide the required cooling water flow through the system. In these designs, stopping the pumps would effectively isolate the system limiting potential water outflow.

The potential draining of the intake canal inventory in the Turbine Building is dominant due to a plant specific spatial interdependence. For both units the Emergency Switchgear Rooms are located in the Service Building on the same elevation as the Turbine Building basement. These areas are separated b_y a fire door with 2-foot high flood dikes in front of them. A large scale flood could potentially overflow the dikes and enter into the two unit ESGR, leading to the potential loss of emergency power in both units, including the loss of Residual Heat Removal (RHR) stub busses. The normal off-site power supply to the plant would not be affected since the normal SGR is located at higher elevation in the Service Building.

Another important contributor to the internal flood CDF is due to flood events originated or entering into the Auxiliary Building. These flood scenarios, mainly from supply pipe ruptures from the R WST, result in the loss of all Component Cooling Water (CCW) and consequently the RHR function at the plant. This coupled with the unavailability of the RWST inventory to be injected into the reactor core leads to core damage. Again, the plant-specific spatial arrangement of piping and equipment is the main reason for the development of the accident scenario and its risk significance.

4.1. 7 Quantitative Results from Seismic Analysis Table 4 shows the base case results. The base case consists of the Surry plant (systems and fragilities) at the Surry site with EPRI and LLNL seismic hazard curves. In this table, the mean, median, 5 percentile and 95 percentile frequencies of the two plant operating states are shown. It is seen from the table that mean annual frequency c,fthe two plant operating states is less than 10-6 per year using either the LLNL or the EPRI seismic hazard curves.

Therefore, it can be concluded that the seismic contribution to the mean annual core damage frequency during bot~

POS 6 and POS 10 is very small at Surry Unit I.

The comparison of core damage-frequency results is also shown in Table 4. From examining the table, several important observations emerge:

• During shutdown conditions, the total annual mean CDF arising from earthquakes is small compared to the CDF arising from internal initiators: a factor of about 15 smaller for the LLNL seismic hazard curves and a factor of about 60 smaller using the EPRI hazard curves .

• Vol. I 33 NUREG/CR-6144

4 Results The seismic mean CDF during shutdown is small compared to the mean CDF at full power from seismic initiators from NUREG-1150: a factor of about 350 times smaller for the LLNL hazard curves and about 300 times smaller for the EPRI hazard curves.

• The Error Factor (EF) in this seismic study is significantly greater than the EF in the CDF from internal initiators during shutdown This is primarily due to the large uncertainty in the seismic hazard curves but another contribution arises from the uncertainty in the seismic fragilities.

4.1.8 Insights from Seismic Analysis A number of important insights emerge from this Surry analysis, including:

Core Damage Frequency The core damage frequency for earthquake-initiated accidents during refueling outages in POS 6 and POS 10 is found to be low in absolute terms, below 10-6/year. The reasons for this are (i) Surry's seismic capacity in responding to earthquakes during shutdown is excellent, well above its design basis and similar to its ability to respond to earthquakes during full-power conditions; (ii) the Surry site is--oI,J,e of the least seismically active locations in the United States; (iii) the Surry plant is only in POS 6 and POS 10 (epmbined) for an average (mean) of6.6% of the time.

The core damage frequencies are also low relative to the frequencies during POS 6 and POS 10 for internal initiators.

This can be seen in Table 4.

The Results are Plant Specific The results for Surry are highly plant-specific, in the sense that the seismic capacities, the specific sequences that are found to be most important, and the seismicity of the site are all difficu_lt to generalize to other reactors elsewhere.

Shutdown Seismic Sequences are Similar to Full-Power Seismic Sequences Nevertheless, it is important to observe that all of the sequence types, components, and human errors that errt~rge in the key sequences in this analysis are similar or identical to sequences, components, and human errors that\it'ppear in typical full-power seismic PRAs. That is, nothing that has arisen as important in this study appears to be unique to earthquakes occurring during shutdown conditions. Whether this observation can be generalized to other reactors at other sites is unknown.

Sensitivities

• Sensitivity studies reveal that if the Surry reactor were moved to the Zion site in Illinois (a typical midwestern site) or the Pilgrim site in Massachusetts (one of the most seismically active sites among all of the reactor sites in the eastern U.S.), the mean annual CDF from this study would increase by factors of about 1.8 and 10, respectively .

NUREG/CR-6144 34 Vol. 1

• 4 Results Uncertainties While there are significant uncertainties in the numerical values of core damage frequencies found in this study (see Table 4), the above conclusions are relatively robust-they do not depend on the detailed numerical values found.

4.2 Level 2/3 Results 4.2.1 Plant Damage State Frequency The CDF analysis is coupled to the accident progression analysis through the plant damage states (PDS). Of particular interest is the characteristics of the PDS groups and their relative contribution to the core damage frequency estimates. The PDS characteristics are important because they strongly influence the subsequent accident progression. Table 7 displays the PDS contributors to the core damage frequency for this study. Four statistical_

measures (namely the 5th percentile, median, mean and 95th percentile) on the distributions of the various PDS groups are given in Table 7. Similar results from the full power study are also included in the table.

Accident sequences in which the operators did not correctly diagnose the situation or take proper actions were the largest contributor (approximately two-thirds of the total) to the mean core damage frequency for mid-loop operation.

Accident sequences that lead to station blackout during mid-loop operation (loss of the 4 kV Bus is similar to a station blackout) contribute about IO percent to the mean CDF. Other accidents were identified that resulted in loss of core 1

cooling after depletion of the refueling water storage tank and failure of recirculation. The leading cause of recirculation failure was found to be plugging of the suction from the sump. These accidents contribute about 20 percent to the mean core damage frequency.

Station Blackout accidents were the largest contributor (approximately two-thirds of the total) to the mean core damage frequency for accidents initiated by internal events during power operation. Other accidents initiated by loss-of-coolant accidents (LOCAs ), transient events and anticipated transient without scram (A TWS) contributed about 25 percent to the mean CDF. Accidents that result in containment bypass (steam generator tube ruptures (SGTR) and interfacing systems LOCAs) contributed less than 10 percent to the mean CDF.

The plant damage states in Table 7 cannot be directly compared because the plant configuration during mid-loop operation is different than the configuration during full power operation. For example a Station Blackout during full power operation will have a different accident progression than a Station Blackout during mid-loop operation. An important difference is that the containment may not be isolated during mid-loop operation whereas the containment was found to be isolated for most of the accidents at full power. Differences in the status of containment integrity

• during mid-loop and full power operation have an important influence on the accident progression analysis and risk estimates. In the following sections differences in the plant configuration (and hence plant damage states) between mid-loop and low power are indicated.

Vol. I 35 NUREG/CR-6144

4 Results Table 7 Comparison of the PDS Core Damage Frequencies (per reactor year) for Mid-Loop and Full-Power Operation (Internal Events Only)

Full-Power Operation PDS 5th Percentile Median Mean 95th Percentile Station Blackout Short Term l.2E-7 l.5E-6 5.4E-6 2.IE-5 Long Term l.6E-6 l.IE-5 2.2E-5 6.4E-5 ATWS 2.9E-8 4.2E-7 l.4E-6 6.5E-6 LOCAs l.2E-6 3.9E-6 6.IE-6 2.0E-5 Interfacing LOCA 3.6E-11 4.9E-8 l.6E-6 8.2E-6 SGTR 4.5E-7 l.4E-6 l.8E-6 4.7E-6 Total 9.8E-6 2.5E-5 4.IE-5 l.OE-4 Mid-Loop Operation PDS 5th Percentile Median Mean 95th Percentile Station Blackout l.9E-8 1.2E-7 4.0E-7 l.7E-6 Human Errors 2.IE-7 l.OE-6 2.8E-6 l.3E-5 Loss of Recirculation 5.3E-8 4.IE-7 7.8E-7 3.3E-6 Loss of 4 kV Bus 8.9E-9 8.9E-8 2.2E-7 l.3E-6 Total 3.2E-7 2.0E-6 4.2E-6 l.9E-$

NUREG/CR-6144 36 Vol. 1 *

• 4~

4.2.2 Accident Progression Analysis The plant damage states developed for the mid-loop and full power studies cannot be directly compared. An attempt was therefore made to summarize the results of the accident progression analyses performed for the two studies in such a way that differences in containment status could be ascertained for each of the plant damage states. Table 8 summariz.es the probability of accident progression bins (APB) conditional on the various PDS groups for full power operation and for mid-loop operation. The table has been constructed in such a way that APBs have the same meaning in both studies. For example accidents that "bypass" containment were identified in the full-power study but not in the mid-loop study, whereas "containment not isolated" was an important APB for accidents during mid-loop operation but not for full power.

The most significant difference in the results given in Table 8 relates to the probability of the containment not being isolated. In the full power study the probability for the containment not being isolated was very small because during power operation the Surry containment is maintained at a subatmospheric pressure and therefore containment leakage would be detected. However, the probability of the containment not being isolated was determined to be high for most of the plant damage states during; mid-loop operation. In fact, the plant damage state that is the largest contributor to the mean core damage frequency (PDS 2 - Human Error) has a very high conditional probability for the containment being open. This is because it was determiried in the accident progression analysis that if operator error due to failure to diagnose the accident led to core damage then the operators probably would not have taken measures to isolate containment.

Another difference between the results in Table 8 relates to accidents that bypass the containment. In the full power study accidents that bypass the containment contribute less than 10 percent to the mean CDF but, because they are high consequence events, they are large contributors to the risk estimates. However, in the mid-loop study accidents that bypass the containment (such as SGTRs or interfacing systems LOCAs) were not included because the configuration of the plant precludes such events.

The probability for early containment failure caused by such phenomena as hydrogen combustion, direct containment heating and steam explosions was found to be very low for all PDS groups in the full study. This is because the failure pressure of the containment was determined to be much higher than the design pressure and the loads predicted from the phenomena were generally lower than the failure pressures. The probability for early containment failure was also found to be small for accidents during mid-loop operation except for accidents involving station blackout and loss of the 4 kV bus. For these accident sequences the mean conditional probability for early containment failure was determined to be between 0.1 and 0.2. The cause of early containment failure was determined to be hydrogen combustion, which is a problem during mid-loop operation for two reasons. Firstly, if the operators are able to isolate containment during an accident in mid-loop operation there is a possibility that they may not be able to achieve full pressure retaining capability in the time available. The higher containment failure probability in the mid-loop study therefore reflects the lower pressure retaining capability of the containment relative to the capability expected during power operation. Secondly, for accidents involving station blackout it is unlikely that an ignition source would be available to ignite the hydrogen until power is recovered. This means that large quantities of unburned hydrogen could accumulate in containment. The higher early containment failure probability for station blackout accidents during mid-loop operation therefore also reflects the possibility that power will be restored after a large quaritity of hydrogen has accumulated in containment.

• Vol. 1 37 NUREG/CR-6144

Table 8 Comparison of the Mean Probabilities of APBs Conditional on PDS Groups for Mid-Loop and Full-Power Operation (Internal Events Only)

Plant Damage State Groupst Accident Full-Power Operation* Mid-Loop Operation**

Progression Bin SBO ATWS Transients LOCAs Bypass All*** SBO Human Loss of Loss of All***

Groups Error Recirculation 4 kV Bus (2.SE-5) (l.4E-6) (l.8E-6) (6.lE-6) (3.4E-6) (4.lE-5) (4E-7) (2.8E-6) (7.8E-7) (2.2E-7) (4.2E-6)

Early .01 Neg. Neg. .01 - .01 .17 - .03 .11 .03 Containment Failure Late .08 .05 .01 .05 - .06 - - - - -

Containment Failure Containment Neg. .08 .01 - 1.0 .12 - - - - -

Bypass Containment - - - - - - .28 .95 .10 .28 .69 Not Isolated No VB, .31 .52 .22 .59 - .34 .37 .02 *- .39 .07 No CF VB, No CF .6 .35 .76 .35 - .47 .18 .03 .87 .22 .21

• Reproduced from NUREG/CR-4551, Volume 3

• • Reproduced from NUREG/CR-6144, Volume 6

• • • The values given under the "All" column are frequency-weighted averages and not totals.

t Values given in parentheses are core damage frequency per reactor year for each plant damage state group.

VB Vessel Breach CF Containment Failure

- Neg. Negligible (<0.01)

4 Results The conditional probability of late containment failure, caused by the core debris penetrating the basemat or by overpressurizing the containment (due to the accumulation of steam and noncondensible gases) was determined to be between 0.01 and 0.1 for accidents during full power operation. Both of these failure mechanisms were eliminated for accidents during mid-loop operation based on deterministic calculations. The calculations indicated that the decay heat levels for accidents during mid-loop operation were not sufficiently high to cause late containment failure by basemat penetration or containment overpressurization.

Finally, the mean conditional probability of the containment being intact (i.e., isolated, not bypassed, no excessive leakage, and no containment failure) was detennined to be high (i.e., between 0.8 and 0.9) for all PDS groups in the full power except for the PDS group containing bypass accidents. As noted above, bypass accidents contribute less than 10 percent to the mean CDF in the full power study. The mean conditional probability of the containment being isolated varied over a wide range for accidents during mid-loop operation. The range varied from 0.05 (Human Error PDS) to about 0.9 for accidents involving loss of recirculation. However, as the Human Error PDS is the largest contributor to the mean CDF the probability of the containment being intact conditional on the mean CDF for all internal events during mid-loop operation was less than 0.3. This compares with a probability of the containment being intact conditional on the mean CDF for accidents during power operation of over 0.8. This difference in containment integrity during mid-loop and full power operation has an important influence on the risk estimates.

4.2.3 Results of the Source Term Analysis The source term model (SURSOR) used in the full power study was considered suitable for use in the mid-loop study with only minor modifications. This suitability was based on comparisons with calculations from a deterministic code, MELCOR, and the views expressed by an expert review panel drawn from staff at Sandia and Brookhaven National Laboratories. Therefore, as the same source term model was used in the two studies the source terms are similar for similar accident progression bins. Although the source term calculations are similar for the two studies the risk estimates for mid-loop operation are influenced by the changing radionuclide inventories for the various accidents because they can occur a long time after shutdown. In order to account for the changing radionuclide inventory the partitioning method used in the full power study to combine the source terms into a smaller number of representative source tenn groups had to be modified for the mid-loop study. Therefore, a direct comparison of the source term groups determined for the two studies would be difficult because of the changing inventory associated with accidents during mid-loop operation.

4.2.4 Consequence Analysis The approach used to calculate offsite consequences was similar in both studies. The major difference was that the latest version of the MACCS code was used to evaluate the offsite consequence measures in the mid-loop study.

The latest version of MACCS incorporates the BEIR V update to the latent cancer versus dose relationship~ whereas the full power study used in an earlier version of MACCS, which did not include the latest BEIR V update. The latest BEIR V update gives a factor of approximately three times higher latent cancers for the same value of population dose.

Vol. 1 39 NUREG/CR-6144

4 Results 4.2.5 Risk Analysis Table 9 pr~sents statistical measures of the distributions for seven consequence measures for *accidents during mid-loop operation obtained from this study. Similar statistical measures for full power operation obtained from the NUREG-1150 study of Surry are also included in the table.

Table 9 indicates that the mean risk of offsite early health effects is over two orders of magnitude lower for accidents during mid-loop operation than for full power in spite of the lack of mitigative features. This is due to the natural decay of the radionuclide inventory (because the accidents occur a long time after shutdown) particularly the short-lived isotopes of iodine and tellurium, which are primarily associated with early health effects. The statistical measures for latent cancer fatalities (only I 000 miles was reported in Ref. I) differ by a factor of approximately three, although the statistical measures for population dose (1000 miles) for mid-loop and full power operations are similar. This difference is largely explained by differences in the latent cancer versus dose relationship in the different versions ofMACCS (as noted above) used in the two studies.

PDS 2 is the largest contributor to risk for all consequence measures. The reason for this is that for accidents where operator errors, such as failure to diagnose or take proper action, play a major role in determining the progression of the accident, it was judged unlikely that actions to isolate containment would be taken. As shown in Table 8, the mean conditional probability of the containment being unisolated was estimated to be almost 0.95 for the accident sequences belonging to PDS group 2.

4.2.6 Comparison with the Safety Goals Comparison of the results of this study against the NRC safety goals is done for the two quantitative health objectives identified in the Commission's policy statement of August 1986. These objectives deal with individual early fatality and latent cancer fatality risks within 1 mile and 10 miles of the site, respectively. The numerical value of these objectives are given in Table 9. The 95th percentile of the distribution for individual latent cancer fatality risk falls more than an order of magnitude below the objective. The 95th percentile of the distribution for individual early fatality risk falls over two orders of magnitude below the corresponding health objective. The health objectives, however, apply to the total risk of the Surry Plant. The risk estimates of this study are for accidents initiated by internal events during mid-loop operation and therefore reflect only 1a fraction of the total risk at Surry.

4.2. 7 Insights The main finding of the study is that during mid-loop operation the risk of consequence measures related to long-term health effects, latent cancer fatalities and population dose, are high, comparable to those at full power, despite the much lower level of the decay heat and the radionuclide inventory. The reason for this is that containment is likely to be unisolated for a significant fraction of the accidents initiated during mid-loop operation so the releases to the environment are potentially large and the radionuclide species which mostly contribute to long-term health effects (such as cesium) have long half-lives. Accident sequences involving failure to correctly diagnose the situation or take proper actions are the largest contributors to the integrated risk. Another finding of the study is that the risk of early fatalities is low despite the unisolated containment due to the decay of the short-lived radionuclide species NUREG/CR-6144 40 Vol. 1

Table 9 Comparison of Distributions of Risks for Mid-Loop and Full-Power Operation (All Values per Reactor Year; Population Doses in P-Sv per Year) 5th Percentile Median Mean 95th Percentile Sigma Mid- Full- Mid- Full- Mid- Full- Mid- Full- Mid- Full-Loop Power Loop Power Loop Power Loop Power Loop Power Early Fatalities 1.3E-10 7.6E-10 3.6E-09 7.0E-08 4.9E-08 2.0E-06 l.6E-07 5.4E-06 l.7E-07 N.A.

Latent Fatalities within 50 mi l.6E-04 N.A. 8.3E-04 N.A. 2.5E-03

• N.A. 8.SE-03 N.A. 3.7E-03 N.A.

Latent Fatalities within 1000 mi 8.0E-04 3.IE-04 5.3E-03 2.2E-03 l.6E-02 5.2E-03 5.5E-02 l.9E-02 2.SE-02 N.A.

Population Dose within 50 mi 3.SE-03 5.9E-03 2.0E-02 2.7E-02 5.SE-02 5.SE-02 l.9E-Ol 2.SE-01 8.SE-02 N.A.

Population Dose within 1000 mi l.9E-02 l.9E-02 1.2E-Ol 1.3E-0I 3.7E-01 3.lE-01 1.3E+OO l.2E+OO 5.9E-0I N.A.

Individual Early Fatalities Risk within 1 mi* 6.0E-12 l.4E-l 1 1.3E-I0 8.7E-I0 l.7E-09 1.6E-08 6.9E-09 4.9E-08 5.5E-09 N.A.

Individual Latent Fatalities Risk within 10 mi~ l.2E-I0 l.6E 0 IO 7.5E-I0 4.9E-I0 2.IE-09 1.7E-09 7.IE-09 8. IE-09 3.0E-09 N.A.

N.A. - Not Available

• NRC quantitative health objectives:

• Individual early fatality risk within one mile to be less than 5 x 10*7 per reactor year.

• Individual latent cancer fatality risk within 10 miles to be less than 2 x 10*6 per reactor year.

4 Results such as iodine and tellurium which contribute to early fatality risk. The integrated risk estimates have a range of uncertainty extending over approximately two orders of magnitude from the 5th to the 95th percentile of the distribution.

Containment Status The major factor driving the risk is the status of containment during mid-loop operation. It was determined that there is a high probability that the containment is either unisolated or that it would not have full-pressure retaining capability during mid-loop operation. This is particularly the case if the operators fail to diagnose the accident as it was judged unlikely that they would take action to isolate containment or could succeed in doing so within the available time frame. This factor played a significant role in influencing the risk estimates of mid-loop operation.

During the course of the study, Surry plant personnel made available new procedures for containment closure during mid-loop operation. However, it was difficult to assess the adequacy of these procedures in ensuring the pressure retaining capability of the containment within the time frame encompassed by this study. This feature contributed significantly to the uncertainty in containment status and the estimate of risk.

Availability of Containment Sprays There is no requirement at Surry for the containment sprays to be available during shutdown. Plant records show that the spray systems could be inoperable because of maintenance. Spray availability was modeled as an uncertainty parameter in the integrated risk analysis. Since the sprays perform an important safety function in mitigating the effects of releases, spray unavailability contributed both to the risk and its uncertainty.

Possibility of Core Damage Arrest The inclusion of the possibility of arresting the core degradation process before vessel failure is an important feature of this analysis as it was for the full power study. Termination of the accident in-vessel can significantly reduce some of the fission product releases and thus the risk. The potential for core recovery depends on the nature of the accident progression and is different for the various PDS groups. Overall, the conditional probability of core damage arrest ranged from 0.23 (5th percentile) to 0.44 (95th percentile) with a mean of0.35.

Comparison with Full Power Study The mean core damage frequency for accidents during mid-loop operation is about an order of magnitude lower than the mean frequency of accidents caused by internal events at full power. However, the risk distributions obtained for comparable long term health consequences are very similar in the two studies. What this finding implies is that the lower decay heat and lower radionuclide inventory of the mid-loop operating state, compared with full power, is offset by the likelihood of containment being unisolated. Finally, the mean risk of early health effects is over two orders of magnitude lower for accidents during mid-loop operation than for accidents during full power operation.

This is due to the natural decay of those radionuclide species which have the greatest impact on early fatality risk because accidents during mid-loop operation occur a long time after shutdown.

NUREG/CR-6144 42 Vol. 1

5 CONCLUSIONS This study was successful in developing a methodology to estimate the risk associated with the operation of a PWR during mid-loop operation. The methodology developed_ and the lessons learned from its application provide the NRC with new tools that could be used in subsequent analyses. The study concentrated the effort on mid-loop operation only. The core damage frequency contributions of other low power and shutdown P0Ss were analyzed in the coarse screening analysis of the Phase 1 study. The following sections summarize the conclusions of the study.

5.1 Level 1 Conclusions Internal Events This study shows that the contribution to the total core damage frequency due to internal events during mid-loop operation at the Surry plant is lower by an order of magnitude than that of power operation. This is mainly due to the much smaller fraction of time that the plant is at mid-loop. The core damage frequency conditional on the plant being at mid-loop is actually higher than that of power operation by nearly a factor of two.

Only a few procedures are available for mitigating accidents that may occur during shutdown. Procedures written specifically for shutdown accidents would be useful. Realistic thermal-hydraulic analysis should be used as the basis of the procedures.

It was assumed that the reduced-inventory checklist was followed, and the maintenance unavailability of equipment not on the list were found to be dominant contributors to system unavailability. However, the checklist is believed to be sufficient for ensuring the availability of essential equipment. The dominant cause of core damage is due to operator errors. It is recognized that there is very large uncertainty in the human error probabilities used in this study.

The time window approach developed in this study provides a more realistic approach to account for changing decay heat levels during shutdown. Without using this approach, the core damage frequency estimates would be an order of magnitude higher.

Internal Fires A comparison of the fire induced core damage frequency during mid-loop operation with that of power operation shows that, although the plant spends much less time at mid-loop, the core damage frequencies are comparable.

The main reason for this finding is that the routing of the cables needed to support RHR operation or mitigate an accident during mid-loop operation is such that a single fire at a few critical locations can damage almost all the equipment need to mitigate the accident. During power operation, considerably fewer critical locations exist.

Ri1>k significant scenarios were found mainly in the emergency switchgear room (ESGR), the cable vault and tunnel (CVT), and in the containment. In the ESGR, several important scenarios (which are also the most risk significant ESGR scenarios) occur in locations where many cables for the Hand the J emergency divisions come together in close proximity. The tunnel part of the CVT is a constrained space, where damage would quickly propagate to both divisions (serving many different emergency equipment). In the containment, the risk significance stems from

• the relatively high fire frequency and non-separation of the two RHR divisions.

Vol. 1 43 NUREG/CR-6144

5 Conclusions Three mid-loop POSs, in which reactor coolant system level is lowered to the mid-plane of the hot leg, were analyzed. Two of them occur in a refueling outage (P0Ss R6 and RlO) and one in a drained maintenance outage (POS D6). P0Ss D6 and R6 are much more important than RlO (as RlO occurs in later time windows). D6 is more important than R6 due to constraints imposed by a drained maintenance outage and its tendency to occur in earlier time windows. The earlier time windows are more important than the later ones, with window 4 being relatively unimportant. Windows 1 and 2 are of the highest importance, with window 2 being significantly more important than window 1. While the decay heat is higher and the success criteria are more stringent in window 1, this window is of relatively short duration, and mid-loop tends to occur in the later time windows. The most risk significant fire initiator occurs in the cable vault tunnel area, in window 2 and POS D6, followed by a few scenarios in the ESGR, in the same window and POS.

Internal Floods In general, the risk contribution from flood events is relatively significant and is dominated by potential flood events in the ESGR coupled with loop isolation. The internal flood CDF is dominated by Turbine Building flood events. These events are primarily initiated by either valve or expansion joint failures in the main inlet lines of the circulating water system. These failures may lead to pipe ruptures upstream of the condenser water box and inlet valves. At Surry the circulating water system is gravity fed from a very large capacity intake canal and its isolation may not be accomplished in a timely manner. This is in contrast with other common design arrangement where dedicated pumps provide the required cooling water flow through the system.

The potential draining of the intake canal inventory in the Turbine Building is dominant because of a plant-specific spatial interdependence. For both units the Emergency Switchgear Rooms are located in the Service Building on the same elevation as the Turbine Building basement. These areas are separated by a fire door with 2-foot high flood dikes in front of them. A large scale flood could potentially overflow the dikes and enter into the two unit ESGR, leading to the potential loss of emergency power in both units, including the loss of stub busses that support the RHR pumps. The normal off-site power supply to the plant would not be affected since the normal switch gear room is located at higher elevation in the Service Building.

The flood initiating event analysis has, in general, indicated that shutdown (and specifically mid-loop operation) does not pose a significant increase in flood risk. A possible exception is flood events coupled with loop isolation, which can occur in later Time Windows 2, 3 and 4.

Seismic Events The core damage frequency for earthquake-initiated accidents during refueling outages in POS R6 and POS RIO was found to be low in absolute terms, below 10-6/year. The reasons for this are (I) Surry's seismic capacity in responding to earthquakes during shutdown is excellent, well above its design basis and similar to its ability to respond to earthquakes during full-power conditions; (ii) the Surry site enjoys one of the least seismically active locations in the United States; (iii) the Surry plant is only in POS R6 and POS RlO (combined) on average for a relatively short period.

The seismic mean CDF during shutdown is small compared to the mean CDF at full power from seismic initiators:121 a factor of about 350 times smaller for the LLNL hazard curves and about 300 times smaller for the EPRI hazard curves.

NUREG/CR-6144 44 Vol. 1

• 5.2 Level 2/3 Conclusions 5 Conclusions A systematic evaluation ofrisk has been performed for mid-loop operation at the Surry Unit 1 plant. The analysis includes accident frequency, accident progression; source terms, consequences, risk, and a determination of the uncertainty in each of the component analyses and in the final risk measures. The analysis takes into account the long time after shutdown that the accidents can occur and the impact of the consequent decay in power level and radionuclide inventory on the risk. The inclusion of this time factor in a risk analysis is a new development in PRA technology and represents a strength of the study from the methodological standpoint.

The results contained in this report are based on the analysis of accident frequency during mid-loop operation where the accident sequences leading to core damage were binned into four plant damage states (PDS) groups: PDS I (station blackout events), PDS 2 (human errors, failure to diagnose or take proper actions on the part of the operators), PDS 3 (recirculation cooling failure), and PDS 4 (loss of 4 kV bus). These PDSs served as the entry point for the further analysis of accident progression, the determination of potential recovery actions, and the evaluation of source terms, consequences, and risk.

The main finding of the study is that during mid-loop operation the risk of consequence measures related to long-term health effects, latent cancer fatalities, and population dose, are high, comparable to those at full power, despite the much lower level of the decay heat and the radionuclide inventory. The reason for this is that there is a lack of mitigative features for a significant fraction of the accidents initiated during mid-loop operation so the releases to the environment are large and the radionuclide species which mostly contribute to long-term health effects (such as cesium) have long half-lives. PDS 2 (diagnostic and corrective action failures) makes the largest contribution to the risk. Another finding of the study is that the risk of early fatalities is low despite the unisolated containment due to the decay of the short-lived radionuclide species, such as iodine and tellurium which contribute to early fatality risk.

The risk estimates have a range of uncertainty extending over approximately two orders of magnitude from the 5th to the 95th percentiles of the distribution .

• Vol. I 45 NUREG/CR-6144

6 References

1. U.S. Nuclear Regulatory Commission, "Reactor Safety Study, An Assessment of Accident Risks in U.S.

Commercial Nuclear Power Plants," WASH-1400, NUREG-75/014, 1975.

2. U.S. Nuclear Regulatory Commission, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," NUREG-1150, December 1990.

3. Chu, T.-L., et. al., "PWR Low Power and Shutdown Accident Frequencies Program, Phase I-Coarse.

Screening Analysis," Draft Letter Report, November 1991. Available in the NRC Public Document Room, 2120 L Street, NW, Washington, DC.

4. Institut de et de Surte Nucleaire, "A Probabilistic Safety Assessment of the Standard French 900 MWe Pressurized Water Reactor," Main Report, April, 1990.

5. Whitehead, D. W., et al.,"Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Grand Gulf, Unit I," NUREG/CR-6143, SAND93-2440, Sandia National Laboratory, June 1994.

6. Summers, RM., et.al., "MELCOR 1.8.0: A Computer Code for Nuclear Reactor Severe Accident Source Term and Risk Assessment Analysis," NUREG/CR-5531, Sandia National Laboratories, January 1991.

7. Naff, S.A., et.al., "Thermal-Hydraulic Processes During Reduced Inventory Operation with Loss of Residual Heat Removal," NUREG/CR-5855, Idaho National Engineering Laboratory, April 1992.

8. Wald, L.W., et.al., "Consequence of the Loss of Residual Heat Removal Systems in Pressurized Water Reactors," NUREG/CR-5820, Idaho National Engineering Laboratory, May 1992.

9. Audreycheck, T.S., et. al., "Loss of RHRs Cooling while the RCS is partially filled," WCAP - 11916, Westinghouse Electric Corporation, July 1988.

10. Virginia Power Company, "Background and Guidance For Ensuring Adequate Decay Heat Removal When RCS Loop Stop Valves are Closed, Surry and North Anna Power Stations," NE. Technical Report No.865, Revision 1, June 1992.

11. Chu, T. L. "A Computer Program for Estimating Initiating Event Frequency Using a Two-Stage Bayesian Approach," Letter Report, L-1922, Brookhaven National Laboratory, 1994.

12. Russell, K. D., et al., "Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) Version 5," Idaho National Engineering Laboratory, NUREG/CR-6116, July 1994.

13. Embrey, D. E., "The Use of Performance Shaping Factors and Quantified Expert Judgment in the Evaluation of Human Reliability: An Initial Appraisal," Brookhaven National Laboratory, prepared for U.S. Nuclear Regulatory Commission, NUREG/CR-2986, May 1983.

Vol. 1 47 NUREG/CR-6144

6 References

14. Chien, S; H., A. A. Dykes, J. W. Stetkar, and D. C. Bley, "Quantification of Human Error Rates Using a SLIM-Based Approach," Proceedings ofthe 1988 IEEE Fourth Conference on Human Factors and Power Plants, Monterey, California, June 5-9, 1988.

15. Wheelis, W. T., "User's Guide for a Personal Computer-Based Nuclear Power Plant Fire Data Base,"

NUREG/CR- 4586, SAND86-0300. Updated to include events through December 1989.

16. Vincent Ho, et al., "COMPBRN III: An Interactive Computer Code for Fire Risk Analysis," EPRI-NP-7282, May 1991.

17. Siu, N. "Modeling Issues in Nuclear Plant Fire Risk Analysis," presented at the EPRI Workshop on Fire Protection, Baltimore, MD, February 9-10, 1989.

18. Nathan Siu and George Apostolakis, "Modeling The Detection And Suppression of Fires in Nuclear Power Plants," from International ANS/ENS Topical Meeting on Probabilistic Safety Methods and Applications, February 24- March 1,1985.

19. Siu, N. and George Apostolakis, "A Methodology for Analyzing the Detection and Suppression of Fires in Nuclear Power Plants", in Nuclear Science And Engineering, 94, pp. 213-226 (1986).

20. Pickard, Lowe and Garrick, Inc. (PLG, Inc.), "Beznau Risk Analysis Plant with NANO", prepared for Nordostschweitzerische Kraftwerke AG, PLG-0511, December 1989.

21. Virginia Power, Surry Nuclear Power Plant, Individual Plant Examination Program, Appendix E: Internal Flooding, August 31, 1991. Available in the NRC Public Document Room, 2120 L Street, NW, Washington, DC.

22. Virginia Electric and Power Company, Internal Flooding Analysis for the Individual Plant Examination, Supplemental Report, Surry Units 1 and 2, November 1991. Available in the NRC Public Document Room, 2120 L Street, NW, Washington, DC.

23. Thomas, H. M. "Pipe and Vessel Failure Probability," Reliability Engineering 2 (1981) 83-124~

24. Bohn, M.P., J.A. Lambright, S.L. Daniel, J.J. Johnson, M.K. Ravindra, P.O. Hashimoto, M.J. Mraz, and W.H. Tong, "Analysis of Core Damage Frequency:

• Surry Power Station, Unit 1, External Events",

NUREG/CR-4551, Vol. 3, Rev. l, Part 3, Sandia National Laboratories, December 1990.

25. Lambright, J.A., M.P. Bohn, S.L. Daniel, J.J. Johnson, M.K. Ravindra, P.O. Hashimoto, M.J. Mraz, W.H.

Tong, and D.A. Brosseau, "Analysis of Core Damage Frequency: Peach Bottom Unit 2, External Events,"

NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, Sandia National Laboratories, December 1990.

26; Budnitz, R.J., H.E. Lambert, and E.E. Hill, "Relay Chatter and Operator Response After a Large Earthquake," NUREG/CR-4910, Future Resources Associates, Inc., August 1987.

27. Chen, J.T., et al., "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," NUREG-1407, U.S. Nuclear Regulatory Commission, June 1991.

NUREG/CR-6144 48 Vol. 1

6 References

28. Bernreuter, D.L., J.B. Savy, R.W. Mensing and J.C. Chen, "Seismic Hazard Characterization of69 Nuclear Plant Sites East of the Rocky Mountains," NUREG/CR-5250, Lawrence Livermore National Laboratory, January 1989.

29. Electric Power Research Institute, "Probabilistic Seismic Hazard Evaluations at Nuclear Power Plant Sites in the Central and Eastern United States: Resolution of the Charleston Earthquake Issue," Prepared by Risk Engineering Inc., Yankee Atomic Power Company and Woodward Clyde Consultants, EPRI Report NP-6395-D, April 1989.

30. Griesmeyer, J. M. and L. N. Smith, "A Reference Manual for the Event Progression Analysis Code(EVNTRE)," NUREG/CR-5174, Sandia National Laboratories, September 1989.

31. Jow, H. N., W. B. Murfin and J. D. Johnson, "XSOR Codes User's Manual," NUREG/CR-5360, Sandia National Laboratories, December 1989.

32. Iman, R. L., et al., "PARTITION: A Program for Defining the Source Term/Consequence Analysis Interface in the NUREG-1150 Probabilistic Risk Assessments, User's Guide," Sandia National Laboratories, NUREG/CR-5253, May 1990.

33. Chanin, D., J. Rollstin, J. Foster, andL. Miller, "MACCS Version 1.5.11.1: A Maintenance Release ofthe Code," NUREG/CR-6059, October 1993.

34. National Research Council Committee on Biological Effects of Ionizing Radiation (BEIR V), "Health Effects of Exposure to Low Levels oflonizing Radiation," National Academy of Sciences, Washington, DC, 1990.

35. Iman, R. L., et al., "A FORTRAN 77 Program and Users Guide for the Generation of Latin Hypercube and Random Sampling Use with Computer Codes," Sandia National Laboratory, NUREG/CR-3624, March ,. l 1984 .

• Vol. 1 49 NUREG/CR-6144

APPENDIX APPROACHES FOR PERFORMING A LEVEL 1 LOW POWER AND SHUTDOWN PRA

• CONTENTS Page A.l Objective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1 A.2 Characterization of Outages and Plant Operational States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1 A.3 Identification oflnitiating Events and Accident Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-9 A.3.1 Special Initiating Events or Issues to Be Addressed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-9 A.4 Determination of Success Criteria and Time Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-22 A.5 System Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-30 A.6 Development of Event Trees and Accident Scenarios ..................................... A-30 A.7 Human Reliability Analysis ......................................................... A-31 A.8 Presentation of Results ............................................................. A-32 A.9 References .................................... : . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-33 FIGURES A.3-1 An Example Procedure Event Tree Taken from NSAC-84 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-11 TABLES A.2.1 List of Plant Information that Can Be Use to Identify and Characterize the Shutdown POSs . . . . . . . A-2 A.2.2 Parameters Used in the Definition and Characterization of POSs . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-3 A.2.3 Plant Operational States for a Refueling Outage at Surry Unit 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-5 A.2.4 Plant Operational States for a Refueling Outage at Grand Gulf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-8 A.3.1 Approach Used in Identifying PWR Initiating Events ..................................... A-12 A.3.2 PWR Initiating Events Categories .................................................... A-12 A.3 .3 Estimated Initiating Event Frequency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-13 A.3.4 References Used in Identifying BWR Initiating Events .................................... A-15 A.3.5 BWR Initiating Event Categories ..................................................... A-18 A.3 .6 BWR Initiating Event Frequencies and Applicability to POSs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-19 A.4.1 Systems and Functions for PWRs ..................................................... A-24 A.4.2 Systems and Functions for BWRs . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-24 A.4.3 References to Thermal-Hydraulic Analyses for PWRs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-25 A.4.4 Thermal-Hydraulic Analyses Performed for Reference [4] for Grand Gulf ..................... A-26 A.4.5 Success Criteria for Mitigating Features Used in Reference [3] .............................. A-27 A.4.6 Definition and Characterization of Time Windows Used in Reference [3] ..................... A-28 Vol. 1 A-iii NUREG/CR-6144

APPENDIX - APPROACHES FOR PERFORMING A LEVEL 1 LOW POWER AND SHUTDOWN PRA A.I Objective The objective of this appendix is to provide a summary of the methods that can be used for performing a Level 1 LP&S PRA. As guidance[i,2J already exists for those methods typically used in performing a full power PRA, they will not be discussed in detail in this appendix. Only those methods that are unique to LP&S conditions are discussed. It is assumed that the readers are PRA practitioners who are familiar with the methods used in performing a full power PRA. This appendix focuses on internal events only, excluding internal fires and floods. The approach for analyzing internal fires or floods is the same as that for a full power PRA. The only difference is that the event trees and fault

'trees developed during the internal event analysis for LP&S conditions have to be used. This appendix is based on the methods used in the three latest LP&S PRAslJ.5Jperformed in the United States. In most cases, different methods exist for the tasks, and it is not possible at this time to prescribe the best method to use. Therefore, a few methods will be discussed with some comparison provided. The most important tasks of a shutdown PRA are identification of the shutdown configuration, and determination of success criteria and how they vary with decay heat. The documentation needed for each of the tasks for a LP&S PRA is also discussed.

A.2 Characterization of Outages and Plant Operational States Characterization of plant operational states defines the initial conditions for accident scenario development.

Table A.2.1 lists the plant information that can be used to identify and characterize the shutdown P0Ss. The applications of each item to a shutdown PRA are also listed. Table A.2.2 lists important parameters that need to be determined for each POS and how they are used in a shutdown PRA. Tables A.2.3 and A.2.4 list the POSs defined for the Surry and Grand Gulf plants, respectively.

Vol. 1 A-1 NUREG/CR-6144

Appendix Table A.2.1 List of Plant Information That Can Be Used to Identify and Characterize the Shutdown POSs Plant Information Description Application Outage Plan Planned major activities and plant 1. Definition of plant configuration configurations during an outage 2. Duration of POSs

3. Maintenance unavailability Shift Supervisor's Log Actual detailed activities during an 1. Definition of plant configuration Books outage, status of major components 2. Duration of POSs and systems 3. Maintenance unavailability Operating Procedures for Detailed steps of how operators 1. Definition of plant configuration Shutdown Conditions change the conditions of the plant 2. Duration of POSs

3. Maintenance unavailability

4. Identification of initiating events Test and Maintenance Detailed steps of operators in 1. Maintenance unavailability Procedures performing the test and maintenance 2. Identification of initiating events

3. Definition of plant configuration Monthly Operating Actual timing of major activities and 1. Definition of plant configuration Reports plant configurations 2. Duration of POSs Minimum Equipment Actual condition of major equipment 1. Definition of plant configuration l

Lists 2. Maintenance unavailability System Training Manual General discussion of conditions of 1. Success criteria of systems systems and components during 2. Operability of systems in different different plant conditions accident sequences in different POSs NUREG/CR-6144 A-2 Vol. 1

Appendix Table A.2.2 Parameters Used in the Definition and Characterization of POSs Parameter Source of Information PRA Application Frequency Graybook, shift supervisor's log Quantification of accident books, outage plans scenarios Plant Configuration Operating procedures, shift Initial condition for accident supervisor's log books scenarios development System Availability Shift supervisor's log books, Fault tree quantification system training manuals Shutdown Activities Operating procedures, shift Definition of POS Boundaries, supervisor's log books, outage plan System availability Time to Core Uncovery/Damage Determination of success criteria, quantification of HEPs Maintenance Unavailability Shift supervisor's log books Fault tree quantification RCS Integrity Operating procedures, shift Scenario development supervisor's log books, outage plan Containment Integrity Operating procedures, shift Quantification of containment supervisor's log books, outage plan event tree Reactivity Operating procedures, shift Scenario development supervisor's log books, outage plan Reactor Coolant Temperature Operating procedures, shift Initial condition for accident supervisor's log books, outage plan scenarios development Reactor Coolant Pressure Operating procedures, shift Initial condition for accident supervisor's log books, outage plan scenarios development Reactor Vessel Level Operating procedures, shift Initial condition for accident supervisor's log books, outage plan scenarios development Time after Shutdown Operating procedures, shift Initial condition for accident supervisor's log books, outage plan scenarios development Duration of POSs Operating procedures, shift Quantification of accident supervisor's log books, outage plan frequency Vol. 1 A-3 NUREG/CR-6144

Appendix Table A.2.2 (continued)

Parameter Source of Information PRA Application PWR POS Dependent Parameters Fraction of Time the Steam Operating procedures, shift Availability of steam generators as Generators Are Drained supervisor's log books, outage plan a heat sink, definition of POS boundaries Fraction of Time the Steam Operating procedures, shift Quantification of accident Generator Nozzle Dam Is in Place supervisor's log books, outage plan scenarios Fraction of Time the Pressurizer Operating procedures, shift Availability of reflux cooling and Safety Valves Are Removed supervisor's log books, outage plan, gravity injection from RWST test procedures Fraction of Time the RCS Loops Operating procedures, shift Availability of cooling using steam Are Isolated supervisor's log books, outage plan generators, definition of POS boundaries Fraction of Time the Steam Operating procedures, shift Availability of cooling using steam Generator Manways Are Off supervisor's log books, outage plan generators, definition of POS

.boundaries Fraction of Time the Vessel Head Operating procedures, shift Definition of POS boundaries, Is Off supervisor's log books, outage plan quantification of accident scenarios BWR POS Dependent Parameters Fraction of Time the Hydraulic Operating procedures, shift Determination of initial conditions, Test Is in Progress

• supervisor's log books, outage plan availability of safety relief valves Fraction of Time the Suppression Operating procedures, shift Availability of suppression pool Pool Is Empty supervisor's log books, outage plan function Fraction of Time the Suppression Operating procedures, shift Availability of suppression pool Pool Is at Reduced level supervisor's log books, outage plan function Fraction of Time the Vessel Level Operating procedures, shift Operability of natural recirculation Is Sufficient for Natural supervisor's log books, outage plan function Recirculation Cooling Fraction of Time the Vessel Level Operating procedures, shift Operability of forced recirculation Is Sufficient for Forced supervisor's log books, outage plan function Recirculation Cooling Fraction o(Time the Containment Operating procedures, shift Control of radioactivity release Is Open supervisor's log books, outage plan NUREG/CR-6144 A-4 Vol. 1

• Table A.2.3 Plant Operational States for a Refueling Outage at Surry Unit 1 Appendix Activities Level K T p Standard (OF) (psig) T.S.

Mode I Low Power

• Transfer to manual RX In =1.0 547 2235 1,2 Operation & control Przr. (<15%

RX

• Transfer to manual SG level Power)

Shutdown control

~0.9823Ts<3> 547 2235 2 Cooldown

• Borate RCS <1.0 3 With SG

• Stop 2 RCPs

• Block auto SI &

accumulators

• Establish LTOP <350°F In <0.96Adm<4> 345 345 Przr.

• 3 Cooldown WithRHR

• Disable Engineered Safeguards

• Initiate RHR In Przr.

<0.96Adm<4> 200 345 4

4 Cooldown

• No longer need Ctmt 5 WithRHR Integrity or Ctmt vacuum (5)

• Secure SGs In <0.96Adin<4> 140 345 Przr.

5 Drain RCS

• Deenergize Przr heaters 5,6 To Mid-loop

• Stop last RCP

• Cooldown Przr by fill up Mid- <0.96Adm<4> <140 0 loop 6 Mid-loop

• Possible loop isolation 5,6 Operation Mid- <0.96Adm<4> <140 0 loop Vol. I A-5 NUREG/CR-6144

Appendix Table A.2.3 (continued)

Activities Level K T p Standard (OF) (psig) T.S.

Mode 7 Fill for

• Remove vessel head & upper 6 Refueling internals structure

• Establish Refueling Ctmt Integrity Refuel <0.95Ts<2> <140 0 Cavity Full 8 Refueling

• Move fuel assemblies per 6 refueling sequence Refuel <0.95TS<3> <140 0 Cavity Full 6

9 Drain RCS to

• Install vessel upper internals Mid-loop structure & head After

• No longer need Refueling Refueling Ctmt.

Integrity Mid- 0.96Adm<4> <140 0 loop 10 Mid-loop

• Possible further loop 5,6 Operation isolation After Refueling Mid- <0.96Adm<4> <140 0 loop 11 Refill RCS

• Pressurize RCS & jog RCP 5,6 completely for RCS vent & Fill

• Unisolate any and all loops RCS <0.96Adm<4> <140 <125 Full 12 RCSHeatup

• Pressurize RCS, start RCP 5 Solid and & energize Przr. htrs Draw Bubble

• Establish Ctmt. Integrity and Ctmt. vacuum In <0.98Adm<4> 200 345 Przr.

NUREG/CR-6144 A-6 Vol. 1

• Table A.2.3 (continued)

Appendix Activities Level K T p Standard (OF) (psig) T.S.

Mode 13 RCSHeatup

• Start other RCPs 4

• Enable Engineered Safeguards

• Secure RHR In <0.9823TS<3> 350  ::::345 Przr.

14 RCSHeatup

• Flow test MDAFWs <1.0 3 With

• Disable L TOP protection SGs >350°F

• Unblock accumulators

• Verify auto SI reestablished

• Dilute RCS In ~0.9823TS<3> 547 2235 Przr.

15 RX Startup

• Flow test TDAFW =1.0 547 2235 1,2

&Low

• Transfer to auto SG level (<15%

Power

• Transfer to auto RX control power)

Operation Full Power Operation (1) The time is based on the October 1986 refueling outage of Unit 2. Both duration of POS and cumulative time after shutdown are shown.

(2) The operating procedures listed are based on the most updated information as of yet. Some of these procedures' numberings are different from those prevailing in October 1986.

(3) Shutdown Margin Requirements - Per Technical Specifications (1.0 Defmitions)

CSD (Cold Shutdown) Condition - RX subcritical by at least 1% /1 K/K (:. K ~ =0.99) and Tavg is ~200°F.

ISD(Intermediate Shutdown) Condition - RX subcritical by ~ 1.77% /1 K/K (:. K ~ =0.9823) and Tavg is

>200°F but <547°F.

HSD(Hot Shutdown) Condition - RX subcritical by~ 1.77% /1 K/K (:.K~=0.9823) and Tavg is >547°F.

(4) Shutdown Margin Administrative Limits - Per 1-0P-lC, Shutdown Margin Calculation A further requirement states that except for during the approach to criticality, the minimum boron concentration allowed in a shutdown core must be the greater of the following:

Critical Boron for the 0% power insertion limit OR The boron required to maintain the administratively (Adm*) required shutdown margin> 5500 pcm (K=0.945) from BOL (beginning of life) to 9000 MWD/MTU and >4000 pcm (K<=0.960) after 9000 MWD/MTU.

(5) As in the recently implemented OP-RC-005, before entering Reduced Inventory within 150 hours0.00174 days <br />0.0417 hours <br />2.480159e-4 weeks <br />5.7075e-5 months <br /> of shutdown, containment integrity must be established.

Vol. 1 A-7 NUREG/CR-6144

Table A.2.4 Plant Operational States for a Refueling Outage at Grand Gulf POS Plant Condition Activities . Heat Removal Level K T(°F) p Standard Notes Control (psig) T.S.Mode 1 Low Power Transfer to Turbine Feedwater =1.0 550 1000 1,2 Operation& manual RX Generator or (<15% (Mode Switch Reactor Shutdown control Turbine bypass Power) in Run or Valve(steam Startup/Hot dump to Standby) condenser) 2 Hot Shutdown Cooldown Turbine bypass Feedwater <1.0 >200 >500 3 (Mode Valve (steam Switch in dump to Shutdown) condenser) 3 Hot Shutdown Initiation of RHR Turbine bypass Feedwater <1.0 >200 >100 3 Recirculation onSDC Valve(steam Pumps no dump to longer condenser) needed 4 Hot Shutdown RHRonSDC RWCU <1.0 >200 100 3 RCICAuto Isolation at 60 psig 5 Cold Shutdown Vessel Head RHRonSDC RWCU <1.0 <200 0 4 (Mode Removal Switch in Shutdown) 5 (Vessel Head Detensioned) 6 Refueling (Vessel Preparation for RHRonSDC Level at <1.0 <140 0 5 Head off) Refueling Steam Lines 7 Refueling Refueling RHRonSDC Upper <1.0 <140 0 5 Refueling

< Operation Operation Pool Transfer

~

- Filled Tube Open

Appendix A.3 Identification of Initiating Events and Accident Scenarios Definition of Initiating Event An initiating event during shutdown can be defined as one of the following:

• loss of decay heat removal,

• pressure transient that can potentially challenge the RCS integrity,

• loss of RCS inventory,

• and reactivity transients.

Two approaches have been used in identifying and quantifying the initiating events. They are discussed below:

(1) . Data Analysis Approach References [3] and [4] used an approach in which data on incidents that have actually occurred, and studies of accident scenarios that have been identified were reviewed in order to identify initiating events. The collected data was used to estimate the frequencies of the initiating events. Table A.3.1 summarizes the approach used in identifying accident initiating events that may occur at PWRs and provides references to relevant documents.

Table A.3.2 lists the initiating events ofa PWR. Table A.3.3 lists the POS specific initiating event frequencies for a PWR. Tables A.3.4 to A.3.6 provide similar information for a BWR.

(2) Procedure Event Tree Approach References [5] and [6] used the procedure event tree approach to define and quantify initiating events. Figure A.3-1 is an example of such an event tree. The top events of the trees are either major operator actions identified in the operating procedures for shutdown conditions or failure of hardware used during shutdown conditions. Failure of the operator or hardware may lead to different types of initiating events represented by the sequences in the procedure event tree. The failure probability of the operator is quantified using an applicable human reliability analysis approach, and hardware failure is modeled by fault trees with component hardware failure data. The end states of the procedure event trees transfer to the applicable accident event trees that model the mitigation of the accidents.

A.3.1 Speciai Initiating Events or Issues to Be Addressed RCS Pressure Relief Capability During an outage, the relief valves that can potentially relieve RCS pressure have to be identified and their capacity evaluated for the shutdown condition. Typically for a PWR, the PORVs, and possibly the RHR relieve valve and the relief valves in the letdown flow path, can relieve pressure during shutdown. Whether or not the valves are available in different accident scenarios has to be evaluated.

Vol. I A-9 NUREG/CR-6144

Appendix Weakness in RCS Pressure Boundaty During an outage (for some plants), a weakness in the RCS pressure boundary may be introduced, e.g., steam generator nozzle dam or thimble tube seals for PWRs. Any such weakness has to be specifically addressed in the PRA. Two types of scenarios are possible: (1) failure of the weakness as an initiating event and (2) failure as a result of some other scenarios that challenge the pressure boundary. Both possibilities have to be developed and quantified. When identifying weakness in the RCS pressure boundary, all systems and components that may be connected to the RCS should be taken into consideration. For example, the residual heat removal system at PWRs has a design pressure that is significantly lower than that of the RCS. In Appendix I of Reference [3], scenarios involving challenges to the RHR system were identified.

• In those scenarios, the RCS pressure may exceed the design pressure of the RHR even if the PORVs and RHRreliefvalve are operable.

French Scenario Reference [7] identified a fast reactivity accident scenario that may occur during de-boration. Reference [8] evaluated the scenario for three PWRs and took into consideration a number of deterministic issues, such as reactivity effects and ll mixing of the injected unborated water with the reactor coolant. It was found that the mixing issue cannot be easily resolved and depends on the geometry of the connection between the injection line and the cold leg. This scenario has .

to be evaluated on a plant-by-plant basis.

Adverse Configuration Reference [9] identified a plant configuration during shutdown that has the potential for rapid core uncovery as a result of loss of RHR. In this configuration, the hot legs are isolated and an opening or weakness in the pressure boundary exists in the cold leg. A small pressure increase in the RCS can push the coolant out of the vessel and uncover the core.

Generic Letter 88-17! 101 specifically addresses this issue and requires the plants to implement protection against the scenario. Each plant's implementation has to be evaluated in terms of the its effectiveness against the likelihood of the scenario.

Reactivity Accidents Reference [11] evaluated different categories ofreactivity accidents for PWRs and BWRs. The following scenarios are judged to be significant and should be analyzed based on plant specific design:

• PWR-French scenario

• PWR-LOCNSGTR with the secondary side coolant diluting the primary coolant BWR-Flushing of boron during an ATWS

• BWR-Reactivity event initiated while in unstable operation

• BWR-Refueling Accident Spent Fuel Pool Accident NUREG/CR-4982[ 121addresses spent fuel pool accidents and identifies failure of the refueling cavity seals and a fuel transfer cask drop as potential accident scenarios during a refueling outage.

NUREG/CR-6144 A-10 Vol. 1

• Figure A.3-1 An Example Procedure Event Tree Taken from NSAC-84 ENTRY L

• C AFTER L*CAFTEII TYGONTUBE L*CAFTEA TEMPORARY PRESSURE PZR LEVEL LEVEL SYSTEM LEVEL I EVEI. TRANS GOING TO NO AHR COOLING POINT REFUELING EXCESS FROM TREE 1 DECREASE DECREASE INSTALLED DECREASE INST Al.LED MAINTAINED IEQUENCE !RANCH T050 PSIG T020'J< CORRECTLY TO 684 FEET CORRECTLY CHARGING 12 LC LP TG 1.L TL RF Cl. RM TAEE 3 I 2 TREE 8 r l I

LC 1 I I 4 COP 3, COP .CA LCI I LC 1 1 TREE 3 r I TREE 5 I I I I LC 1 l

I l 10 COP 3. COP otA LC I I 12 LC I 13 TREE 3 I

14 TREE&

I I I 10 LC 1 I

ie I l 17 COP 3,COP 4A LC 1 I ,e LC 1 ia TREE 3 r 20 TREE 5 FROM I l r 21 LC 1 TREE 1 I l 22 23 COP3,COP4A LC 1 I 24 LC 1 25 TREE 3 r 28 TREE 5 I I I 27 LC 1 l

28 COP3,COP4A I I 29 LC 1 I 30 LC I 31 TAEE 3 I 32 TREE 5 I l 33 LC 1 I

I l 34

15 COP 3, COP 4A.

LC 1 I 38 LC 1 "C

"C 0

I

~-

Q..

Appendix Table A.3.1 Approach Used in Identifying PWR Initiating Events

• I. Loss of RHR Events Review of Shutdown Incident Reports NSAC-52, AE0D/C503, Seabrook Shutdown Study Search of Computerized Data Base-Sequence Coding Search System II. Review of Existing Shutdown Studies NSAC-84, Seabrook, French Study, NUREG/CR-5015 III. Review of Procedures Used at Shutdown Operating Procedure, Test Procedure, Maintenance Procedure IV. Review of Initiating Events for Power Operations NUREG/CR-4550 Volume I, Generic Transients for PWRs NUREG/CR-4550 Volume 3, Support System Failures, Subtle Interactions Surry Probabilistic Risk Assessment for the Individual Plant Examination V. Review ofNRC Generic Letters, Information Notices, Bulletin, circulars VI. Review of Other Studies That Identified Scenarios at Shutdown NUREG/CR-4999 Low Temperature Over Pressurization NUREG/CR-5368 Reactivity Accidents NUREG-1269 Diablo Canyon Incident Augmented Investigation Team Report NUREG-1410 Votgle Incident Investigation Team Report WCAP-11916 Loss of RHRS While the RCS is Partially Filled Westinghouse PRA ofLOCAs in Modes 3 and 4 NUREG/CR-4407 Pipe Break Frequency Estimation for NPP NUREG/CR-6144 A-12 Vol. 1

• Table A.3.2 PWR Initiating Events Categories Appendix I. Loss ofRHR Spurious Closure ofRHR Suction Valves Loss ofRHR due to Low Vessel Inventory A. overdraining during drain down B. failure to maintain level Total Non-recoverable Loss ofRHR Loss of operating Train of RHR Recoverable Loss of RHR Inability to Initiate RHR II. Loss of Offsite Power (LOOP) and Station Blackout III. Support System Failures Loss ofa 4 kV Bus Loss of 480V Bus Loss of a DC Bus Loss of a 120 V Vital AC Bus Loss of Instrument Air Loss of Component Cooling Water Loss of Service Water Loss of Emergency Switchgear Room Cooling IV. LOCAs Pipe Ruptures in RCS A: Large LOCA S 1: Medium LOCA S2: Small LOCA S3: Small-Small LOCA H LOCA-Diversion of Flow J LOCA-LOCAs in Connected Systems K LOCA-Maintenance Induced LOCAs V. Interfacing System LOCA VI. Steam Generator Tube Rupture Vol. 1 A-13 NUREG/CR-6144

Appendix Table A.3.2 (continued)

VII. Inadvertent Safety Feature Actuation VIII. Transients Transient with loss ofMFW (no challenge to RPS)

Transient with loss ofMFW (challenge to RPS)

Transient with MFW Available (no challenge to RPS)

Transient with MFW Available (challenge to RPS)

IX. Pressurized Thermal Shock X. Reactivity Accidents Addition of Diluted Accumulator Water Addition of Diluted RWST Water Dilution When Cleaning Cavity Dilution due to Steam Generator Maintenance Uncontrolled Boron Dilution from CVCS Boron Dilution via RHR Startup ofRCP after Improper Boron Dilution Backfill Cooldown after STGR Rod Ejection Misloading of Fuel Assembly Uncontrolled Bank Withdraw XI. Heavy Load Drop Accident NUREG/CR-6144 A-14 Vol. 1 *

• I. Loss of RHR Table A.3.3 Estimated Initiating Event Frequency Appendix I I Mean Value I Error Factor I N.A.

RHR2A l .62E-02/DEMAND 1.97 RHR2B 1.220E-05/hr 3.27 RHR3 4.09E-06/hr 3.79 RHR4 5.28E-06/hr 3.82 RHR5 2.12E-05/hr 2.21 RHR6 l .29E-02/DEMAND 1.54 II. LOOP POS 1,15 POS 2-14 9.13E-6/hr 6.96E-6/hr III. Support System Failures Mean Error Factor Loss of a 4 kV Bus (4 kV)

POS 6,10 ~

2.lOE-05/hr 2.4 POS 3,4,5,8,9,11,12,13 2.63E-05/hr 2.14 Loss of a 120 V Vital 5.58E-06/hr 3.94 Loss of Instrument Air-Outside Containment 2.12E-06/hr 2.86 Loss of Component Cooling Water 3.76E-06/hr 6.35 Loss of Emergency Switchgear Room Cooling POS 6,10 l.8 lE-08/hr 4.0 POS 3,4,5,7,8,9,l l,12,13 6.13E-08/hr 4.0

• Vol. 1 A-15 NUREG/CR-6144

Appendix Table A.3.3 (continued)

IV. Loss of Coolant Accident POS 1 & 15 POS2 & 14 POS 3,4,12,13 A 5.0E-4/y 2.5E-5/y l.7E-5/y SI I.OE-3/y 5.0E-5/y 3.3E-5/y S2 l.OE-3/y 6.0E-5/y 3.3E-5/y S3 l.3E-3/y 6.5E-4/y 4.3E-4/y H - Recoverable Flow Diversion via RHR 5.0E-3/y via CVCS l .OE-3/y Drain Valves l.OE-3/y J - LOCAs in Connected System via RHR 5.0E-3/y via eves 3.0E-3/y K - Maintenance Induced LOCA via RCS 2.0E-3/y via RHR l .OE-3/y V. Interfacing LOCA I I POS1 I POS2 I POS14 I POS15 I LPSI (CDF) 3.00E-10/y 8.90E-9/y l.22E-08/y l.OOE-08/y RHR Suction & 3.2E-8/y 9.3E-7/y l.28E-6/y l.OE-6/y Discharge (CDF)

RHR-CVCS (CDF) 3.2E-12/y 9.56-11/y 1.31-lOy l.lE-10/y ACC 1.83-7/y 5.44-6/y 7.44-5/y 6.l lE-6/y POS3 POS4 POS 12, 13 I RHR-RWST(CDF) I 2.38-8/y I 2.92-7/y I 9.15-7/y NUREG/CR-6144 A-16 Vol. 1

• Appendix Table A.3.3 (continued)

VI. Steam Generator Tube Rupture POSs 1,2,14,15 l.OOE-02/yr POSs 3;4,12,13 l.OOE-03/yr VII. Inadvertent Safety Feature Actuation Mean Error Factor 1.06E-04/hr 1.15 VIII. Transients T2 l.09E-3/hr T2a l.82E-3/hr T3 l.24E-3/hr T3a 8.3E-3/hr Mean Error Factor LTOP POS 3,4,12,13 l .06E-04/hr 1.15

• IX. Pressurized Thermal Shock (CDF)

X. Reactivity Accidents (CDF)

Accumulator RWST 8.0E-10/y 2.5E-10/y l.05E-07/y CVCS (French) 6.8E-08/y RCP (French) 2.8E-05/y Refueling 1.2E-07/y

• Vol. 1 A-17 NUREG/CR-6144

Appendix Table A.3.4 References Used in Identifying BWR Initiating Events

1. M.T. Drouin et al.,"Analysis of Core Damage Frequency: Grand Gulf, Unit I; Internal Events,"

NUREG/CR-4550, SAND86-2084, Vol. 6, Rev. 1, Part 1, September 1989.

2. D.J. Diamond et al., "Reactivity Accidents: A Reassessment of the Design-Basis Events,"

NUREG/CR-5368, BNL-NUREG- 52198, September 1989.

3. D.P. Mackowiak et al., "Development of Transient Initiating Event Frequencies for Use in Probabilistic Risk Assessments," NUREG/CR-3862, EGG-2323, May 1985.

4 H. R. Booth, "Analysis of Refueling Incidents in Nuclear Power Plants," NSAC-129, December 1988.

5. D. M. Ericson, ed., "Analysis of Core Damage Frequency: Internal Events Methodology,"

NUREG/CR-4550, SAND86-2084, Vol. 1, Rev. 1, January 1990.

6.

7.

R.E. Wright et al., "Pipe Break Frequency Estimation for Nuclear Power Plants,"

NUREG/CR-4407, EGG-2421, May 1987.

G. Vine et al., "Residual Heat Removal Experience Review and Safety Analysis: Boiling Water Reactors," NSAC-88, March 1986.

8. T. A. Wheeler et al., "Analysis of Core Damage Frequency From Internal Events: Expert Judgment Elicitation," NUREG/CR-4550, SAND86-2084, Vol. 2, April 1989.

9. D. W. Whitehead, J. L. Darby, B. D. Staple, B. Walsh, T. M. Hake, and T. D. Brown, "BWRLow Power and Shutdown Accident Frequencies Project, Phase 1 - Coarse Screening Analysis," Vol. 1, Draft Letter Report, Sandia National Laboratories and Science and Engineering Associates, Inc.,

November 23, 1991 update, (Available at the USNRC Public Document Room).

10. P. Lam et al., "Operating Experience Feedback Report- Service Water System Failures and Degradation," NUREG-1275, Vol. 3, November 1988.

NUREG/CR-6144 A-18 Vol. 1

• Appendix

. Table A.3.5 BWR Initiating Event Categories T1: Loss of Offsite Power T2: Transient with Loss of the Power Conversion System T3A: Transient with PCS Initially Available T3a: Transients Involving Loss ofFeedwater T3c: Loss of Plant Service Water A: LargeLOCA AHy: Large LOCA during Hydraulic Test S1: Medium LOCS between 0.007 and 0.4 sq ft.

Srn Medium LOCA during Hydraulic Test Sz: Small LOCA < 0.007 sq ft.

SzH: Small LOCA during Hydraulic Test S3: Very Samll LOCA S3H: Very Small LOCA during Hydraulic Test V: Interfacing System LOCA R: Vessel Rupture H1: Diversion of Vessel Inventory to the Suppression Pool via RHR H2: Diversion to the Condenser vir RWCU 11: LOCA in Operating Connected System (RCIC) 12: LOCA in Operating Connected System(RHR)

K: Test/Maintenance Induced LOCA Ern: Isolation from Operating RHR-Shutdown Cooling Loop E1c= Isolation ofRWCU as SDC Em: Isolation of ADHRS Only E1T: Isolation of Common RHR Suction Line E1v: Isolation of Common Suction Line for ADHRS E2B Loss of Operating RHR-Shutdown Cooling System E2c: Loss ofRWCU as DHR E20: Loss of ADHRS only E2T: Loss of Common RHR Suction Line Eiv: Loss of Common Suction Line for ADHRS T4A: Rod Withdraw Error T4a: Refueling Accident T4c= Instability Event TsA: Loss of All Standby Service Water Tsa: Loss of Turbine Building Cooling Water Tse= Loss of All Plant Service Water(includes Radial Well)

Tso= Loss of All Component Cooling Water TAB: Loss of IE 4160 V AC Bus B Toa: Loss of IE 125 V DC Bus B T1A: Loss of Instrument Air ToRv: Inadvertent Open Relief Valve at Shutdown Tmp: Inadvertent Overpressurization(Makeup Greater Than Letdown)

T1HP: . Inadvertent Overpressurization via Spurious HPCS Actuation TmF: Inadvertent Overfill via LPCS orLPCI TRPT: Loss of Recirculation Pump TLM:.

• Loss of Makeup Vol. 1 A-19 NUREG/CR-6144

Appendix TableA.3.6 BWR Initiating Event Frequencies and Applicability to P0Ss r POS1 POS2 POS3 POS4 POSS POS6 POS7 Tr 0.07 0.13 0.13 0.13 0.13 0.13 0.13 T2 1.63 0.44 0.44 NA NA NA NA T3A 4.54 1.00 1.00 NA NA NA NA T3B 1.06 0.25 0.25 NA NA NA . NA T3c 0.16 0.07 0.07 NA NA NA NA A 0.00 0.00 0.00 0.00 0.00 0.00 0.00 AHY NA NA NA NA 0.00 NA NA Sr 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Srn NA NA NA NA 0.00 NA NA S2 0.00 0.00 0.00 0.00

• 0.00 0.00 0.00 S2H NA NA NA NA 0.00 NA NA S3 0.00 0.00 0.00 0.00 0.00 0.00 0.00 S3H NA NA NA NA 0.00 NA NA V NA NA NA NA NA NA NA R NA NA NA NA NA NA NA H1 NA NA NA 0.06 0.06 0.06 0.06 H2 NA NA NA NA NA NA NA Jr  ?  ?  ? NA NA NA NA J2 NA NA NA 0.02 0.02 0.02 0.02 K - - - - - - -

Em NA NA NA 0.06 0.06 0.06 0.06 Ere NA NA NA NA 0.00 NA  ?

Em NA NA NA NA 0.06 0.06 0.06 EIT NA NA NA 0.36 0.36 0.36 0.36 Erv NA NA NA NA 0.36 0.36 0.36 EiB NA NA NA 0.07 0.07 0.07 0.07 Eic NA NA NA NA 0.00 NA  ?

NUREG/CR-6144 A-20 Vol. 1

• Appendix Table A.3.6 (continued)

Initiator POS1 POS2 POS3 POS4 0.07 0.07 0.07 E20 NA NA NA NA 0.07 0.07 0.07 E2T NA NA NA 0.04 0.04 0.04 0.04 E2v NA NA NA NA 0.04 0.04 0.04 T4A NA NA NA NA NA NA NA T4B NA NA NA NA NA NA NA T4c NA NA NA NA NA NA NA TsA NA NA NA 0.02 0.02 0.02 0.02 TsB 0.02 0.02 0.02 0.02 0.02 0.02 0.02 Tse 0.02 0.02 0.02 0.02 0.02 0.02 0.02 Tsn NA NA NA 0.02 0.02 0.02 0.02 TAB NA NA NA 0.00 0.00 0.00 0.00

• TnB TIA ToRv TJOp NA 0.18 NA NA NA 0.18 NA NA NA 0.18 NA NA 0.01 0.18 0.07 0.00 0.01 0.18 0.07 0.00 0.01 0.18 NA NA 0.0.1 0.18 NA NA TIHP NA NA NA 0.01 0.01 NA NA TIOF NA NA NA 0.02 0.02 NA NA TRPT NA NA NA 0.07 0.07 NA NA TLM NA NA NA 0.01 0.01 NA NA Vol. 1 A-21 NUREG/CR-6144

Appendix A.4 Determination of Success Criteria and Time Windows For initiating events occurring during shutdown conditions, different systems or functions can potentially be used to mitigate the accident. The conditions under which a system or function are effective and their success criteria have to be determined based on thermal-hydraulic considerations. Tables A.4.1 and A.4.2 list the different systems and functions that have been identified for PWRs and BWRs respectively. Tables A.4.3 and A.4.4 list the studies that evaluate the effectiveness of these systems and functions for PWRs and BWRs respectively. It should be mentioned that for a specific plant, the plant specific design has to be taken into consideration in determining the timing and success criteria.

Decay heat is an important parameter that has to be correctly accounted for in a PRA for shutdown conditions. It affects the success criteria used and the timing of the accident scenarios. In a realistic analysis, the decay heat and accident timing have to be well defined. A way to account for decay heat was developed in Reference [3] in which a "Time Window" approach was used to determine the success criteria and timing for accidents that may occur during mid-loop operation at the Surry plant. The following is a generalization of the time window approach applied to a shutdown POS:

(1) Determination of Success Criteria as a Function of Decay Heat The success criteria for the mitigating functions in the event tree analysis have to be determined based on the decay.heat level, initial conditions of a POS, and preceding events in the accident sequences. For given initial conditions and preceding events in a sequence, the decay heat determines the success criterion for a mitigating function. Table A.4.5 is an example, taken from Reference [3], that shows how the success criteria change with decay heat for the Surry plant.

(2) Definition of Time Windows after Shutdown Based on the Changing Success Criteria with Decay Heat The time windows are defined based on the time after shutdown when the success criteria of a system or function change with decay heat. In general, whenever the success criteria for one system or mitigating function changes, a new time window needs to be defined, and potentially, a large number of time windows could be needed. To reduce the number of time windows to a manageable number, several potential windows can be merged into a single time window. Table A.4.6 lists the four time windows that were used in Reference [3]. In this study, a total of more than ten time windows could have been used. The use of four windows (as shown in the table) is, therefore, a trade-off between the accuracy of the model and the level of effort needed to arrive at a solution. It is up to the analysts to demonstrate that the merging of the time windows gives an adequate representation without sacrificing the accuracy of the analysis. With the time windows defined, the decay heat level for each time window is better defined, and the timing of the accident scenarios can be better defined. The timing of the scenarios is an important factor that affect the performance of the operators and is an important input to the human reliability analysis.

(3) Collection of Data on the Time after Shutdown When a POS Is First Reached and Duration of the POS The time after shutdown when a POS might start and the duration of the POS are data that have to be collected for the specific plant being analyzed. Data from other plants can potentially be use as the population data in the statistical analysis. The time when a POS is reached can be identified in the Monthly Report of Operation that each plant submits to the NRC. The duration of the POS can be identified in the shift supervisor's log books for the past outages. The POSs defined in a PRA represent a simplified model of a constantly changing plant configuration. Therefore, data on NUREG/CR-6144 A-22 Vol. 1

Appendix the duration of a POS may involve the analyst's judgment on the plant condition when reviewing the shift supervisor's log books.

(4) Statistical Analysis of Time to and Duration of the POS The data collected in the preceding step is used in the statistical analysis to derive the probability distributions for the time when a POS is reached and the duration of the POS.

(5) Determination of Distributions of Time When the Accident Initiators Occur The time when the accident initiators occur can be expressed as the time when the POS is reached plus the time duration of the POS multiplied by a uniform distribution between Oand 1. This is based on the assumption that the initiating event occurs with a constant rate within the POS. Therefore, its probability distribution can be easily determine from the distributions for the time at which the POS is reached and the duratioJ). of the POS. Some accidents may occur at the beginning of a POS, e.g., over-draining to mid-loop operation occurs at the beginning of a mid-loop POS. For these initiating events, the time when the initiating event occurs is the same as the time when the POS is reached.

(6) Determination of the Conditional Probabilities that the Accident Initiating Events Occur in the Time Windows The conditional probability that the accident initiating event occurs in a time window, given that it occurred in the POS, is simply the probability that the accident initiating event occurs in the time window which can be evaluated using the probability distribution determined in Step 4.

(7) Use of the Conditional Probabilities in Quantifying the Accident Scenarios The annual frequency that an initiating event occurs in a POS is equal to the frequency of the POS times the probability that the initiating event occurs given that the plant is in the POS. The frequency that an initiating event category, IEk, occurs in a particular POS j of a particular type of outage, I, can be expressed as:

Frequency ( outage I) per year Probability (IEk I POS j of outage I),

whe.re Probability (IEkl POS j of outage I) = hourly rate (IEk) duration of POS j of outage I.

\

In the time window approach, the frequency that an initiating event occurs in a given time window, window~. of a particular POS j of a particular type of outage type, I, is the above frequency multiplied by the conditional probability of the time window given that the initiating event occurred in the specified POS and outage type, i.e.,

Frequency (outage I) per year Probability( IEk I POS j of outage I)

Probability (window~ I IEk in POS j of outage I)

Vol. 1 A-23 NUREG/CR-6144

Appendix Table A.4.1 Systems and Functions for PWRs (1) Residual Heat Removal System (2) Low Pressure Injection System (3) High Pressure Injection System (4) Natural Circulation/ Reflux Cooling (5) Gravity Feed from RWST (6) High Pressure and Low Pressure Recirculation Systems (7) Containment Spray System (8) Steam Generator Recirculation and Transfer System (9) Spent Fuel Pool Cooling System Table A.4.2 Systems and Functions for BWRs (I) Control Rod Drive Pumps (2) Feedwater System (3) Condensate System (4) Recirculation System (5) Turbine Bypass Valves

( 6) Auxiliary Decay Heat Removal System (7) Reactor Core Isolation Cooling System (8) Safety Relief Valves (9) High Pressure Core Spray System (IO) Low Pressure Core Spray System (11) Low Pressure Coolant Injection System (12) Spent Fuel Cooling System NUREG/CR-6144 A-24 Vol. I

Appendix Table A.4.3 References to Thermal Hydraulic Analyses for PWRs I. Audreycheck, T.S., et al.,"Loss ofRHRs Cooling While the RCS is Partially Filled," WCAP - 11916, Westinghouse Electric Corporation, July 1988.

2. Naff, S.A., et al., "Thermal-Hydraulic Processes During Reduced Inventory Operation with Loss of Residual Heat Removal," NUREG/CR-5855, Idaho National Engineering Laboratory, April 1992.

3. Wald, L.W., et al., "Consequence of the Loss of Residual Heat Removal Systems in Pressurized Water Reactors," NUREG/CR-5820, Idaho National Engineering Laboratory, May 1992.

4. "Loss of Residual Heat Removal System," Diablo Canyon, Unit 2, April 10, 1987, NUREG-1269, U.S. NRC, June 1987.

5. "Loss of Vital AC Power and the Residual Heat Removal System During Mid-Loop Operations at Vogtle Unit 1 on March 20, 1990," NUREG-1410, U.S. NRC, June 1990.

6. Chu, T.L., et. al., "Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry Unit 1, Analysis of Core Damage Frequency from Internal Events During Mid-Loop Operations," Brookhaven National Laboratory, NUREG/CR-6144, Volume 2, Chapter 5, June 1994.

Vol. I A-25 NU~G/CR-6144

Appendix Table A.4.4 Thermal Hydraulic Analyses Performed in Reference [4] for Grand Gulf (1) For different decay heat level, the following were determined:

injection flow needed to remove decay heat without steaming

• injection to remove decay heat with steaming

• time to boiling of vessel water

• time to top of fuel due to boil off time to suppression pool over heat (2) Capacity of a SRV to relieve steam at different system pressure (3) Number ofSRVs needed to relieve water in support ofECCS injection (4) For different initial suppression pool levels, decay heat levels, initiating events and modes ofECCS injection, determine whether or not suppression pool makeup would be needed (5) Determine time when containment failure pressure is reached due to heating of flooded containment with no heat removal (6) Determine time to boil off of suppression pool inventory to where ECCS is lost.

(7) Estimate the time available to restore makeup if makeup is lost and letdown is isolated, before recirculation from the core to the down comer is lost.

NUREG/CR-6144 A-26 Vol. 1

Appendix Table A.4.5 Success Criteria for Mitigating Features Used in Reference [3]

Feature Time Window Success Criteria Short Term Long Term Reflux Cooling < 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> 3 SGs AFW to3 SGs

>= 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> and 2 SGs AFWto2 SGs

<475 hours

>= 475 hours0.0055 days <br />0.132 hours <br />7.853836e-4 weeks <br />1.807375e-4 months <br /> 1 SG AFWto 1 SG Feed-and- Spill < 107 hour0.00124 days <br />0.0297 hours <br />1.76918e-4 weeks <br />4.07135e-5 months <br /> lLHSI * (SV removed + 2 PORV)

> 107 hours0.00124 days <br />0.0297 hours <br />1.76918e-4 weeks <br />4.07135e-5 months <br /> lLHSI * (SV removed+ 1 *PORV).

< 129 hours0.00149 days <br />0.0358 hours <br />2.132936e-4 weeks <br />4.90845e-5 months <br /> 2HHS1 * (SV removed+ 2 PORV)

> 129 and 1HHS1 * (SY removed+ 2 PORV)

< 138 hours0.0016 days <br />0.0383 hours <br />2.281746e-4 weeks <br />5.2509e-5 months <br />

>= 138 hours0.0016 days <br />0.0383 hours <br />2.281746e-4 weeks <br />5.2509e-5 months <br /> 1HHS1 * (SV removed + 1 PORV) -

Gravity Feed < 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> at least 1 SV removed , less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of subcooling

> 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> and at least 1 SV removed, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of subcooling

< 150 hours0.00174 days <br />0.0417 hours <br />2.480159e-4 weeks <br />5.7075e-5 months <br />

> 150 hours0.00174 days <br />0.0417 hours <br />2.480159e-4 weeks <br />5.7075e-5 months <br /> and at least 1 SV removed, 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> of subcooling less than 768 hours0.00889 days <br />0.213 hours <br />0.00127 weeks <br />2.92224e-4 months <br />

>= 768 hours0.00889 days <br />0.213 hours <br />0.00127 weeks <br />2.92224e-4 months <br /> at least 1 SV removed, sufficient for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Recirculation <= 3 days needed

> 3 days and not needed if R WSTs are cross tied, otherwise needed

<=10 days

> 10 days not needed Spray <=3 days needed to prevent recirculation failure Recirculation

> 3 days and not needed ifRWSTs are cross tied, otherwise needed to prevent

<=10 days recirculation failure

> 10 days not needed Vol. 1 A-27 NUREG/CR-6144

Appendix Table A.4.6 Definition and Characterization of Time Windows Used in Reference [3)

WINDOWl WIND0W2 WIND0W3 WINDOW4 II Definition <= 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> > 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> and > 240 hours0.00278 days <br />0.0667 hours <br />3.968254e-4 weeks <br />9.132e-5 months <br /> and > 32 days

<=240 hours <= 32 days Representative 13 .23 MW (2days)° 10 MW (5 days) 7 MW (12 days) 5 MW(32 days)

Decay Heat Success Criteria Reflux Cooling 3 SGs 2SG 2SG I SG Feed and Bleed LHSI lLHSI*(SV removed lLHSI*(SV removed lLHSI *(SV removed lLHSI *(SV removed

+2PORV) +2PORV) + lPORV) + lPORV)

HHSI IHHSl*(SV removed lHHSl*(SV removed . IHHSl*(SV removed lHHSl*(SV removed

+ 1 PORV) + 1 PORV) + 1 PORV) + 1 PORV)

Gravity Feed I SV removed

• LHSI 1 SV removed

• LHSI 1 SV removed

• LHSI I SV removed

• LHSI flow path provides flow path provides flow path provides flow path provides 4.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> for operator 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> for operator 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for operator sufficient cooling for actions (with less than actions (with 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> actions (with 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (with more 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of subcooling) of subcooling) ofsubcooling) than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> of sub cooling)

Recirculation needed(HPR + 1 RWST, needed not needed not needed LPF&Steam

+ LPF&Spill) 2 RWST, not needed Recirculation needed 1 RWST, NEEDED not needed not needed Spray 2 RWST, not needed Probability that IE Occurs in the Window D6 0.117 0.436 0.375 7.20E-02 (0.31)* (0.454) (0.21) (2.6E-02)

R6 l.7E-02 0.543 0.41 3.4E-02 (5.82E-02) (0.7) (0.24) (1.48E-03)

RIO 0.0 0;0 0.016 9.84E-01 (2.2E-02) (0.98)

• RHR2A based on time to mid-loop NUREG/CR-6144 A-28 Vol. 1

Appendix Table A.4.6 (continued)

WIND0W1 WIND0W2 WIND0W3 WIND0W4 Decay Heat 13.23 MW(2 days) 10 MW(5 days) 7 MW(12 days) 5 MW(32 days)

Time to Boiling 15 min. 20 min. 27min. 37min Time to Tygon 23min. 31 min. 43 min. 59 min.

Tube Rupture(40 psia)

TimetoPRT 51 min. 63 min. 78 min. 96min.

Rupture(lOO psig)

Time to 165 psia 41 min. with 2 PORV 63 min. with 2 PORV 227 min. with 2 PORV 352 min. with 43 min. with 1 PORV 60 min. with 1 PORV 89 min. with 1 PORV 2PORV 147 min. with 1 PORV Time to 615 psig 145 min. with 1 - - -

PORV - with two TimetoRWST 10 hrs 13.5 hrs 18.7 hrs 38.6 hrs Depletion TimetoAFW 743 min. 669 min. 925 min. 628 min.

Initiation(with 25%SG inventory remaining)

Time to Core 120 min. 157 min. 209min. 273 min.

Uncovery Time to Core 219 min. 297min. 411 min. 557 min.

Damage Vol. 1 A-29 NUREG/CR-6144

Appendix A.5 System Analysis System configurations during shutdown conditions can be identified by reviewing system training manuals, operating procedures used during shutdown conditions, and shift supervisor's log books. Typically, 2 or 3 different configurations may be needed to model a system. For example, for the residual heat removal system, one configuration for power operation and one for shutdown conditions would be needed. Discussions with systems engineers would be useful to better define the system configuration. Typically, the shutdown configuration of a system may differ from that of power operations in the following way:

Valves may be in a different normal position than that of power operations.

Automatic signals may not exist during shutdown, or may not operate in the way that supports the functions needed to mitigate an accident.

A system or component may be in a condition that makes it impossible to operate. For example, the turbine driven auxiliary feedwater pump does not have the steam needed to run during a cold shutdown.

Test or maintenance may make a system or component unavailable for a long time: For example, the steam generators at the Surry plant are isolated in a refueling outage for a long time.

The following are typical changes needed to convert the system fault trees developed for power operations into those suitable for shutdown conditions:

• Different failure modes of a valve may be applicable due to the different normal position.

• If the automatic signal for actuating a component does not exist during shutdown, then failure of the signal should not be a cause of failure of the component. If the component requires operator action for its actuation, the human error event has to be modeled in the fault trees.

• The physical condition of the plant may prohibit the operation of some items of equipment. The equipment should be identified and not included in the system analysis.

• Maintenance unavailabilities of equipment have to be estimated and modeled in the fault trees. In principle, they could vary from one POS to another.

A.6 Development of Event Trees and Accident Scenarios The development of event trees and accident scenarios requires a good understanding of the plant response to the initiating event. For accidents that happen during LP&S conditions, there may not be any emergency procedures that instruct the operator as to an appropriate course of action. Whatever procedures and training are* available have to be used. This includes procedures developed for accidents during power operations which may have relevant steps that are applicable to shutdown accidents. Ultimately, the scenarios developed have to be discussed with plant personnel such as operators and system engineers, to ensure they are realistic.

NUREG/CR-6144 A-30 Vol. I

App.endix The event trees that delineate the accident scenari~s can be developed in the same way ~vent tre~s itre d~vel~ped for a PRA for power operation. The following is a summary of the approaches used in existing studiesl3-61:

Surry LP&S Studyl3l _ In this study, the event trees were developed by using the mitigating functions defined in the abnormal procedure for loss of RHR as top events. The event trees are small and the fault trees for the top events include hardware fail?r(?S of systems ~d human e1!or events.

• G~d Gulf Studyl4l - In this stu:dy the event tr~*es were'.flevel~ped. in sta~es. Fjrst,. generic functional event trees were developed, followed by the generic system-level event trees, and last, the initiating event specific system-level event trees were developed. The latter include many levels of transfers from one event tree to the other, and became difficult to solve. The advantage of such approach is that the sequences are more explicitly defined. The disadvantage is that solving the event trees is very time consuming.

Zion1 51 and Seabrookl61 Studies - These studies used the same type ~f event trees as the Surry LP&S smyp(Cfli that the large event tree approach was used instead of the large fault tree approach.

A.7 Human Reliability Analysis Human reliability analysis (HRA) is a very important part of a PRA for LP&S conditions. The human reliability analysis in a PRA consists of the following key tasks:

Identification of operator actions/errors Different types of human errors can be identified, and defined based on their impact on the plant. For example, diagnosis errors and action errors, errors committed before the initiating events and errors committed after the initiating events.

• Inclusion of human error events in the logic model for accident scenario quantification Depending on the types of human errors, they can be included in different parts of a PRA model. Typically, pre-initiating event errors are included in system fault trees: Post-initiating events can be included in system fault.trees or as top events of event trees.: In Reference [3], diagnosis errors are consistently applied to all core damage sequences, and failure to diagnose is assumed to caused-failure of all mitigating functions. Action errors can be included in the logic model for the hardware that they affect.

Quantification of human error. probabilities For each clearly defined human error, different methods can be used to estimate the human error probability.

Reference [3] used the success likelihood index methodologyl 131, and Reference [4] used the Accident Sequence Evaluation Program Human Reliability Analysis Procedure (ASEP HRAP). 1141 Vol. I A-31 . NUREG/CR-6144

Appendix 4.8 Presentation of Results For each of the tasks ofa LP&S PRA, the following documentation should be provided.

• Outage Types and Plant Operational States The definition of outage types should be provided such that all possible outages are included. The boundaries between POSs should be clearly defined. Descriptions of major activities in each of the POS should be prnvided.

A table showing the frequency and duration of the POSs should also include the source of data that was used.

Initiating Event Analysis A table of initiating events should be provided for each POS, providing quantitative estimates of the IE frequencies. Detailed discussions should be provided on the effects each IE has on the plant and the automatic response of the plant subsequent to the IE.

• Success Criteria a

For *each POS, table of different methods of providing inventory makeup, decay heat removal, and reactivity control should be provided. The way in which the train level success criteria change with the decay heat should also be described. Support4lg thermal-hydraulic analyses that determine the success criteria need to be provided.

For each mitigating function, descriptions on the operator actions and the. time needed to activate the function are needed.

• System Analysis For each system that can be used to mitigate an accident, a description of the system configuration during each POS, including the conditions of the support systems, and actuation signals is needed. For each system included in the analysis, the physical condition needed for system operation should be described. It is also important to verify that the conditions are satisfied for those scenarios in which the system is operational. If operator actions are needed, they should be described and the amount of time estimated.

Event Tree Analysis and Accident Scenario Development The dominant scenarios that contribute to at least 90% of the total core damage frequency (including the basic

- events and their probabilities used in the quantification) should be described.

• Human Reliability Analysis Human error events that appear in the dominant_ core damage scenarios, including the methods of the HEP quantification, should be described.

• Results The results should be presented in terms of core damage frequency and conditional core damage frequency for each time window in each POS. A comparison of the conditional core damage frequencies among the P0Ss with CDF for power operation should be provided. .The reasons for any differences in the results should be explained.

NUREG/CR-6144 A-32 Vol. 1

Appendix A.9 References

1. Bari, R. A. et al.., "Probabilistic Safety Analysis Procedures Guide", Brookhaven National Laboratory, NUREG/CR-2815, August 1985.

2. "PRA Procedures Guide, A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants," NUREG/CR-2300, Volumes 1 and 2, January 1983.

3. Chu, T.-L. et. al., "Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations at Surry Unit-1, Analysis of Core Damage Frequency from Internal Events During Mid-Loop Operations", Brookhaven National Laboratory, NUREG/CR-6144, Volume 2, June 1994.

4. Whitehead, D. et. al., "Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations Grand Gulf, Analysis of Core Damage Frequency from Internal Events during Plant Operational State 5 of a Refueling Outage", Sandia National Laboratories, NUREG/CR-6143, Volume 2, June 1994.

5. Kiper, K. L. et. al., "Seabrook Probabilistic Safety Study, Shutdown (modes 4,5, and 6)", New Hampshire Yankee, Volumes 1 and 2, May 1988.

6. Bley, b. C. et al., "Zion Nuclear Plant Residual Heat Removal PRA," EPRI/NSAC Report NSAC-84, prepared by Pickard, Lowe, and Garrick, Inc., July 1983.

7. "A Probabilistic Safety Assessment of the Standard French 900 MWe Pressurized Water Reactor, Institute de Protection et de Surete Nucleaire, EPS 900, Main Report, April 1990.

8. Diamond, D. J. et. al., "Probability and Consequences of Rapid Boron Dilution in a PWR, a Scoping Study",

Brookhaven National Laboratory, NUREG/CR-5819, June 1992.

9. Audreycheck, T. S. et. al.,"Loss of RHRs Cooling while the RCS is partially filled," WCAP - 11916, Westinghouse Electric Corporation, July 1988.

10. "Loss of Decay Heat Removal", Generic Letter 88-17, US NRC, October 17,1988.

11. Diamond, D. J., C. J. Hsu, R. Fitzpatrick, "Reactivity Accidents, A Reassessment of the Design-Basis Events",

Brookhaven National Laboratory, NUREG/CR-5368, January 1990.

12. Sailor, V. L. et al., "Severe Accidents in Spent Fuel Pools in Support of Generic Safety Issue 82," NUREG/CR-4982, BNL-NUREG-52093, July 1987.

13. Chien, S. H., A. A. Dykes, J. W. Stetkar, and D. C. Bley, "Quantification of Human Error Rates Using a SLIM-Based Approach," Proceedings of the 1988 IEEE Fourth Conference on Human Factors and Power Plants, Monterey, California, June 5-9, 1988.

14. Swain, A. D., "Accident Sequence Evaluation Program . Human Reliability Analysis Procedure,"

NUREG/CR-4772, February, 1987.

Vol. 1 A-33 NUREG/CR-6144

Distribution List Kiyoharu Abe RM. Andrews Dept. of Reactor Safety Research Nuclear Installations Insp.

Nuclear Safety Research Center St. Peters House Tokai Research Establishment Balliol Raod, Bootle JAERI Merseyside L20 3 IZ Tokai-mura, Naga-gun UNITED KINGDOM lbaraki-ken, JAPAN George Apostolakis Massachusetts Institute of Sarbes Acharya Technology Department of Energy 77 Massachusetts Avenue NS-I/FORS Cambridge,MA 02139 Washington, DC 20585 Director of Reactor Engineering Dr. Ulvi Adalioglu Argonne National Laboratory Cekmece Nukleer Arastraima ve 9700 S Cass Ave Egitim Merekezi Bldg 208 P.K. I Argonne, IL 60439 Havaalani/ISTANBUL TURKEY Ephraim Asculai Division of Nuclear Safety Dr. Eng. Kiyoto Aizawa Wagramestrasse, 5 Senior Engineer P.O. Box 100 Reactor Eng. Dev. Department A-1400 Wien PNC AUSTRIA 9-13, Chome, Akasaka Minato-K, Tokyo JAPAN Vladimar Asmolov Head, Nuclear Safety Department I. V. Kurchatov Institute Harry Alter of Atomic Enegry Manager Applied Tech Moscow, 123181 Nuclear Systems Tech RUSSIA NE-46 US DOE Washington, DC 20585 Dist-I

J. de Assuncao Scott Bigelow Cabinete de Proteccao e S-CUBED Seguranca Nuclear 2501 Yale SE, Suite 300 Ministerio da Indusstria Albuquerque, NM 87106 Ave. de Republica 45-6 1000 Lisbon PORTUGAL Prof. Dr. Dr.-Ing. E. H. Adolf Birkhofer Gesellschaft fur Anlagen und Reaktorsicherheit

• H.P. Balfanz, Head (GRS)mbH Institute of Probabilistic Forschungsgelande Safety Analysis D-8046 Garching TUVNord Federal Republic of Germany Grosse Bahnstrasse 31 D-22525 Hamburg 54 GERMANY David Black American Electric Power 1 Riverside Plaza Pat Baranowsky Columbus, OH 43215 USNRC-AEOD/RRAB MS: T-4A9 Harold Blackman Idaho National Engineering Lab.

Librarian LMIT MS: 3850 Technical Information Section P.O. Box 1625 Battelle Pacific Northwest Lab Idaho Falls, ID 83415-3850 P. 0. Box999 Richland, WA 99352 Dennis Bley Buttonwood Consulting AndreaBesi 17291 Buttonwood St.

Institute for Systems Engineering Fountain Valley, CA 92708 and Informatics CEC Joint Research Centre CPN 1 Roger Blond 1-21020 Ispra (Varese) Booz-Allen & Hamilton ITALY 4330 East West Highway Bethesda, MD 20814 Vicki Bier Dept. of Industrial Engineering M.P. Bohn University of Wisconsin-Madison Division 6449 1513 University Avenue, Room 389 Sandia National Laboratories Wisconsin, WI 53706 Albuquerque, NM 87185 Dist-2

• Dr. Mario Bonaca Manager, Reactor Engineering Northeast Utilities P.O. Box270 Hartford, Conn. 06141 Arthur Buslik USNRC-RES/PRAB MS: T-10E50 Edward Butcher USNRC-NRR/SPSB Robert B. Borswn MS: O-IOE4 Nuclear Power Division B & W Nuclear Tech 1700 Rockville Pike Technical Library Suite 525 B&W Nuclear Service Co Rockville, MD 20852 P. 0. Box 10935 Lynchburg, VA 24506 Stephen Boult Electrowatt Engineering Services Stefaan Caeymaex (UK) Ltd. Safety & Systems Section Grandford House Nuclear Generation Dept.

16 Carfax, Horsham TRACTEBEL West. Sussex RH12 IUP Avenue Ariane 7 ENGLAND B-1200 Bruxelles BELGIUM Gary Boyd Leonard Callan, Administrator Safety & Reliability Optimization U.S. Nuclear Regulatory Commission Services Harris Tower and Pavilion 9724 Kingston Pike, Suite 102 611 Ryan Plaza Drive, Suite 400 Knoxville, TN 37922 Arlington, TX 76011-8064 David M. Brown J. Calvo Paul C. Rizzo Associates, Inc. Division of PSA & Hwnan Factors 300 Oxford Drive Consejo de Seguridad Nuclear Monroeville, PA 15146-2347 Calle Justo Dorado, 11 28040 Madrid SPAIN TomD. Brown Sandia National Laboratories Dept. 6413 A. L. Camp P.O. Box 5800 Division 6412 Albuquerque; NM 87185 MS: 0748 Sandia National Laboratories Albuquerque, NM 87185-0748 Robert J. Budnitz Future Resources Associates, Inc.

.2039 Shattuck Avenue, Suite 402 Berkeley, CA 94704 Dist-3

John Forbes Campbel S. Chakraborty HM Superintending Inspector Swiss Federal Nuclear Safety Health & Safety Executive Inspectorate St. Peter's House Hauptabteilung fur die Sicherheit Balliol Road der Kernanlagen Bootle L20 3 lZ CH-5232 Villigen-HSK UNITED KINGDOM SWITZERLAND Erulappa Chelliah Leonel Canelas USNRC-RES/PRAB New University of Lisbon MS: T-10E50 Quinta de Torre 2825 Monte de Caparica .

PORTUGAL Mike Cheak NUS 910 Clopper Road Harold Careway Gaithersburg, MD 20878 General Electric Co., MIC 754 175 Curtner Ave.

San Jose, CA 95129 Nilesh Chokshi USNRC-RES/SSEB MS: T-IOLI D. D. Carlson Division 6411 Sandia National Laboratories Peter Cooper Albuquerque, NM 87185 SRD/AEA Technology Wigshaw Lane Jose E. De Carlos Culcheth CSN International Codrdinator Cheshire WA3 4NE Consejo de Seguridad Nuclear England Calle Justo Dorado 11 28040 Madrid SPAIN Susan E. Cooper Science Applications Int'!. Corp.

11251 Roger Bacon Drive Annick Camino Reston, VA 22090 International Atomic Energy Agency Wagramerstrasse 5, P.O. Box 100 A-1400 Vienna Michael Corradini AUSTRIA University of Wisconsin 1500 Johnson Drive Madison, WI 53706 Dist-4

E.R. Carran Gerald Davidson ANSTO Reasearch Establishment Fauske and Associates, Inc.

Lucas Heights Reserch Labs. 16 W 070 West 83rd Street Private Mail Bag 1 Burr Ridge, IL 60521 Manai, NSW 2234 AUSTRALIA Peter R. Davis PRD Consulting Massimo Cozzone P.O. Box 2046 A.N.P.A. Sheridan, WY 82801 Via V. Brancati, 48 I-00144 Rome ITALY P. De Gelder Secretary, BELGIAN NUCLEAR SOCIETY (BNS)

George Crane A VNuclear 1570 E. Hobble Creek Dr. Avenue du Roi 157 Springville, Utah 84663 B-1060 Brussels BELGIUM Mark Cunningham USNRC-RES/PRAB Lennart Devell MS: T-10E50 Studsvik Nuclear Studsvik Energiteknik AB S-611 82 Nykoping S. Daggupaty SWEDEN Environment Canada 4905 Dufferin Street Downsview J. Devooght Ontario, M3H ST4 Service de la Metrologie Nucl CANADA University Libre de Bruxelles Faculte des Sciees Appliqu.

50 Avenue F-D Roosevelt Louise Dahlerup Bruxelles 5 Inspectorate of Nuclear Inst. BELGIUM Danish Civil Defense &

Emergency Planning Agency 16, Datavej G. Diederick DK-3460 Birkerod Commonwealth Edison Co.

DENMARK LaSalle County Station RR1,Box220 2601 North 21st Rd.

John Darby Marsielles, IL 61341 SEA, Inc.

6100 Uptown Blvd. NE Albuquerque, NM 87110

• Dist-5

Chuck Dobbe Idaho National Engineering Lab.

EG&G MS: 3 840 P.O. Box 1625.

Idaho Falls, ID 83415 ENEA/DISP (2)

Attn: Alvaro Valeri Alfredo Bottino Via Vitaliano Brancati, 48 00144 Roma EUR ITALY V. Dang Paul Scherrer Institute Walter P. Engel Wuerenlingen PRAG MGR Analysis & Reg Matter Villigen CH-5231 NE-60 Switzerland CRYCITY US DOE Washington, DC 20585 Mary Drouin USNRC-RES/PRAB MS: T-10E50 John Flack USNRC-RES/PRAB MS: T-10E50 Duke Power Co. (2)

Attn: Duncan Brewer Steve Deskevich Karl Fleming 422 South Church Street Pickard, Lowe & Garrick Charlotte, NC 28242 2260 University Drive Newport Beach, CA 92660 Bill Eakin Northeast Utilities Terry Foppe Box270 Safety Analysis Engineering Hartford, CT 06141 Rock-y Flats Plant Energy Systems Group Rockwell International Corp Stewart D. Ebneter P.O. Box464 USNRC Golden, CO 80401 101 Marietta St., Suite 2900 Atlanta, GA 30323-0199 RH. Gauger Manager-Reliability Engr Adel A. El-Bassioni NE Div USNRC-NRR/PRAB Holmes & N arver Inc.

MS: 0-10E4 R Roanne Circle Irvine, CA 92714 Dist-6 *

• Robert Gobel Clark University Center for Technology, Environment and Development 950 Main St.

Sharif Heger UNM Chemical and Nuclear Engineering Department Farris Engineering, Room 209 Albuquerque, NM 87131 Worcester, MA 01610-1477 Jon C. Helton Paul Govaerts Dept. of Mathematics Studiecentrum voor Kernenergie Arizona State University (SCK/CEN) Tempa, AZ 85287 Boeretang, 200 B-2400 Mol BELGIUM Dr. P. M. Herttrich Gesellschaft for Anlagen und Reaktorsicherheit (GRS)mbH Mr. Gubler Schwertnergasse 1 International Atomic Energy Agency 5000 Koln 1 NENS/SAD B0842 GERMANY Wagramerstrasse 5, P.O. Box 100 A-1140 Vienna AUSTRIA Dr. D.J. Higson Radiological Safety Bureau Australian Nuclear Science &

• Paul M. Haas, President Technology Organisation Concord Associates, Inc. P.O. Box 153 725 Pellissippi Parkway Roseberry, NSW 2018 Suite 101, Box 6 AUSTRALIA Knoxville, TN 37933 Dr. Mitsumasa Hirano Deputy General Manager F. T. Harper Institute of Nuclear Safety Division 6413 NUPEC MS: 0748 3-6-2, Toranomon, Minato-ku Sandia National Laboratories Tokyo 108 Albuquerque, NM 87185-0748 JAPAN Dr. U. Hauptmanns Dr. S. Hirschberg Gesellschaft Fur Anlagen und Paul Scherrer Institute Reaktorsicherheit (GRS) mgH Vurenlingen and Villigen Schwertnergasse 1 CH-5232 Villigen PSI D-5000 Koln 1 SWITZERLAND GERMANY

• Dist-7

Steven Hodge Y.M.Hou Oak Ridge National Laboratories PLGinc.

P. 0. BoxY Suite 400 Oak Ridge, TN 37831 4590 Mac Arthur Boulevard Newport Beach, CA 92660 Gary Holahan USNRC-NRR/DSSA Der-Yu Hsia MS: 0-8E2 Institute of Nuclear Energy Research Lung-Tan 325 TAIWAN NJ. Holloway A72.l Atomic Weapons Establishment Alejandro Huerta-Bahena Ademaston National Commission on Nuclear Reading RG7 4PR Safety and Safeguards (CNSNS)

UNITED KINGDOM Insurgentes Sur N. 1776 C. P. 04230 Mexico, D. F.

MEXICO Brian Holmes AEA Technology Risley Peter Humphreys Warrington WA3 AT England Griff Holmes Westinghouse Electric Co.

US Atomic Energy Authority Wigshaw Lane, Culcheth Warrington, Cheshire UNITED KINGDOM, WA3 4NE

• Energy Center East W. Huntington Bldg. 371 Commonwealth Edison Co.

P.O. Box 355 LaSalle County Station Pittsburgh, PA 15230 RRl,Box 220 2601 North 21st Rd.

William Hopkins Marsielles, IL 61341 Bechtel Power Corporation 15740 Shady Grove Road Gaithersburg, MD 20877 J.S. Hyslop USNRC-RES/PRAB MS: T-10E50 Idaho National Engineering Lab. (2)

Attn: Doug Brownson Darrel Knudson EG&G MS: 3 840 P.O. Box 1625 Idaho Falls, ID 83415 Dist-8

Idaho National Engineering Lab. (2) Edward Jordan Attn: Art Rood USNRC-AEOD/DO Mike Abbott MS: T-4Dl8 EG&G MS: 2110 P.O. Box 1625 Idaho Falls, ID 83415 Dr. H. Kalfsbeek DG/XII/D/1 Commission of the European Communities D. Ilberg Rue de la Loi, 200 Soreq National Research Center B-1049 Brussels Yavne 70600 BELGIUM Israel Yoshio Kano Hanspeter Isaak General Mngr. & Sr. Engineer Abteilung Strahlenschutz Systems Analysis Section Hauptabteilung fur die Sicherheit 0-arai Engineer. Centr, PNC der Kemanlagen (HSK) Higashi-Ibaraki-gun CH-5303 Wurenlingen lbaraki-Ken, 133-13 SWITZERLAND JAPAN Brian Ives William Kastenberg UNC Nuclear Industries UCLA P. 0. Box490 Boelter Hall, Room 5532 Richland, WA 99352 Los Angeles, CA 90024 Kamiar Jamili BanyKaufer DP-62/FTN OECD/NEA Department of Energy "Le Seine St. Germain" 12 Washington, D.C. 20585 Boulevard des Iles 92130 Issy-les-Moulineaux FRANCE D. Johnson*

PLG Inc.

Suite 400 Paul Kayser 4590 Mac Arthur Boulevard Division de la Radioprotection Newport Beach, CA 92660 Avenue des Archiducs, I L-1135 Luxembourg-Belair LUXEMBOURG Robert Jones USNRC-NRRJDSSA/SRXB MS: 0-8E21 Ken Keith TVA W20 D201 400 West Sunnnit Hill Knoxville, TN 37092 Dist-9

G. Neale Kelly Communities the Commission of *European Joint Research Centre Rue de la Loi 200 John G. Kolias Institute of Nuclear Technology and Radiation Protection N.R.C.P.S. "Demokritos" P.O. Box 60228 B-1049 Brussels GR-153 10 Aghia Paraskevi BELGruM Attiki GREECE John Kelly Sandia National Laboratories S. Kondo P. 0. Box 5800 Department of Nuclear Engineering MS 0742 Facility of Engineering Albuquerque, NM 87185 University of Tokyo 3-1, Hongo 7, Bunkyo-ku Tokyo Knolls Atomic Power Laboratory (2) JAPAN Attn: Ken McDonough Dominic Sciaudone Box 1072 D.Lamy Schenectady, NY 12301 CEN/SCK Dept. Scientific Irradiation Experiment & Study BR2 Dr. K. Koberlein Boeretang, 200 Gesellschaft fur B-2400Mol Reaktorsicherheit mbH BELGIUM F orschungsgeliinde D-8046 Garching GERMANY Dr. J.M. Lanore CEA/IPSN/DAS Centre d'Etudes Nucleaires de Alan Kolaczkowski Fontenay-aux-Roses Science Applications International B.P. n° 6 Corporation 92265 Fontenay-aux-Roses CEDEX 2109 Air Park Rd. S. E. FRANCE Albuquerque, NM 87106 Jose A. Lantaron Consejo de Seguridad Nuclear Jim Kolanowski Sub. Analisis y Evaluaciones Commonwealth Edison Co. Calle Justo Dorado, 11 35 1st National West 28040 Madrid Chicago, IL 60690 SPAIN Dist-10

• Josette Larchier-Boulanger Electricte de France Direction des Etudes Et Recherches 30, Rue de Conde 75006 Paris B.T.F. Liwaang Dept. of Plant Safety Assessment Swedish Nuclear Power Inspec.

P.O. Box 27106 S-10252 Stockholm FRANCE SWEDEN H. Larsen Peter Lohnberg Head of Department Expresswork International, Inc.

Riso National Laboratory 1740 Technology Drive P.O. Box49 San Jose, CA 95ll0 DK-4000 Roskilde DENMARK Steven M. Long USNRC-NRR/SPSB MS: 0-10E4 Lawrence Livermore Nat'l Lab. (4)

Attn: George Greenly Marvin Dickerson D. Eugenio Gil Lopez Rolf Lange Consejo de Seguridad Nuclear Sandra Brereton Calle Justo Dorado, 11 Livermore, CA 94550 28040 Madrid SPAIN TimJ. Leahy Idaho National Engineering Lab. Los Alamos National Laboratory (2)

LMIT MS:3850 Attn: Kent Sasser P.O. Box 1625 N-6, K-557 Idaho Falls, ID 83415 Los Alamos, NM 87545 Shengdar Lee Christiana H. Lui Yankee Atomic Electric Company USNRC-RES/PRAB 580 Main St. MS: T-10E50 Boston, MA 17407 John Luke J. Lin Florida Power & Light PLGinc. P.O. Box 14000 Suite 400 Juno Beach, FL 33408 4590 Mac Arthur Boulevard Newport Beach, CA 92660 Daniel Manesse ISPN Boite Postale n° 6 92265 Fontenay-aux-Roses CEDEX FRANCE Dist-11

Fred Mann Michael McKay Westinghouse Hanford Co. Los Alamos National Laboratory WIA-53 A-1, MS F600 Services P.O. Box 1970 P.O. Box 1663 Richland, WA 99352 Los Alamos, NM87545 Nadia Soido Falcao Martins Zen Mendoza Comissao Nacional de Energia Nuclear SAIC R General *severianao 90 S/408-1 5150 El Camino Real Rio de Janeiro Suite C3 I BRAZIL Los Altos, CA 94022 Hany F. Martz Dr. J. Mertens Analysis and Assessment Division Division of Risk Analysis &

Los Alamos National Laboratoiy Reactor Technology Los Alamos, NM 87545 Institute of Safety Research Research Centre Julich (KF A)

D-52425 Julich Herbert Massin GERMANY Commonwealth Edison Co.

35 1st National West Chicago, IL 60690 Jim Meyer Scientech 11821 Parklawn Dr.

Hideo Matsuzuru Suite 100 Tokai Research Establishment Rockville, MD 20852 Tokai-mur Maka-gun Ibaraki-ken, 319-11 Joe Minarick JAPAN Science Applications Int'l Corp.

301 Laboratoiy-Road P.O. Box 2501 Jim Mayberiy Oak Ridge, TN 37830 Ebasco Services 60 Chubb Ave.

Lyndhurst, NJ 07071 Jose I. Calvo Molins, Head Division of P.S.A. and Human Factors Consejo de Seguridad Nuclear Andrew S. McClymont Calle Justo Dorado, 11 IT-Delian Corporation 28040 Madrid 1340 Saratoga-Sunnyvale Rd. SPAIN Suite 206 San Jose, CA 95129 Dist-12 *

• David L. Morrison USNRC-RES/DO MS: T-10Fl2 Oak Ridge National Laboratory (2)

Attn: Steve Fisher Sherrel Greene MS-8057 P.O. Box 2009 Ken Muramatsu Oak Ridge, TN 37831 Risk Analysis Laboratory Japan Atomic Energy Research Institute Tokai-mura, Naka-gun Ken O'Brien lbaraki-ken, 319-11, Tokyo University of Wisconsin JAPAN Nuclear Engineering Dept.

153 Engineering Research Blvd.

Madison, WI 53706 Joseph A. Murphy USNRC-RES/DO MS: T-10Fl2 Theresa Oh INEL Tech Library EG&G MS: 2300 Kenneth G. Murphy, Jr. P. 0. Box 1625 US Department of Energy Idaho Falls, ID 83415-2300 19901 Germantown Rd.

Germantown, MD 20545 N. R. Ortiz, Director Nuclear Energy Technology Shankaran Nair Division 6400 Central Electricity Sandia National Laboratories Generating Board Albuquerque, NM 87185 Berkeley Nuclear Laboratories Berkeley Gloucestrshire CL 13 9PB Robert Ostmeyer UNITED KINGDOM U.S. Department of Energy Rocky Flats Area Office P. 0. Box 928 RayNg Golden, CO 80402 NEI 1776 Eye St. N Suite 300 Robert Palla Washington, DC 20006-2496 USNRC-NRR/DSSNSCSB MS: 0-8H7 G. Niederauer Los Alamos National Laboratory Gareth Parry P. 0. Box 1663 NUS Corporation MSK575 910 Clopper Rd.

Los Alamos, NM 87545 Gaithersburg, MD 20878

• Dist-13

Vern Peterson Building T886B EG&G Rocky Flats P.O. Box464 Golden, CO 80402 William Raisin NEI 1726 M. St. NW Suite 904 Washington, DC 20036 G. Petrangeli Ann Ramey-Smith ENEA Nuclear Energy ALT Disp USNRC-RES/PRAB Via V. Brancati, 48 MS: T-10E50 00144 Rome ITALY Dale Rasmuson USNRC-AEOD/RRAB Ing. Jose Antonio Becerra Perez MS: T-4A9 Comision Nacional De Seguridad Nuclear Y Salvaguardias Insurgentes Sur 1806 M. K. Ravindra 01030 Mexico, D. F. EQE International, Inc.

MEXICO Suite 400 18101 Von Karman Avenue Irvine, CA 92715 Urho Pulkkinen Technical Research Centre of Finland John Ridgely Laboratory of Electrical & USNRC-RES/AEB Automation Engineeering MS: T-10K8 Otakaari 7B, 02150 Espoo 15 FINLAND Richard Robinson (2)

USNRC-RES/PRAB Blake Putney MS: T-10E50 Science Applications International Corporation 5150 El Camino Real, Suite C31 M. Roch Los Altos, Ca 94022 Manager of Design, Nuclear Department TRACTEBEL Dr. V. M. Raina Avenue Ariane 7 Project Manager-Risk Assessment B-1200 Bruxelles Ontario Hydro HI 1 Gl BELGIUM 700 University Ave.

Toronto, Ontario M5G 1X6 A.E. Rogers CANADA General Electric Co 175 Curtner Ave MC-489 San Jose, CA 95125 Dist-14

Judy Rollstin Dr. S. Serra GRAM Inc Ente Naxionale per !'Energia 8500 Menual Blvd. NE Electtrica (ENEL)

Albuquerque, NM 87112 via G.B. Martini 3 1-00198 Rome ITALY Marc Rothschild Halliburton NUS H. Shapiro 1303 S. Central Ave. Licensing & Risk Branch Suite 202 Atomic Energy of Canada Ltd.

Kent, WA 98032 Sheridan Park Research Comm.

Mississauga, Ontario L5K 1B2 CANADA Christopher Ryder USNRC-RES/PRAB MS: T-10E50 Richard R Sheny USNRC-ACRS MS: T-2E26 Takashi Sato, Deputy Manager Nuclear Safety Engineering Section Nathan 0. Siu Reactor Design Engineering Dept. Center for Reliability and Nuclear Energy Group, Toshiba Corp. Isogo

• Risk Assessment Engineering Center Idaho National Engineering Lab.

8, Shinsugita-cho, Isogo-ku, LMIT MS: 3850 Yokohama 235, JAPAN P.O. Box 1625 Idaho Falls, ID 83415-3850 ,

Martin Sattison Idaho National Engineering Lab. E. Soederman LMIT MS: 3850 ES-Konsult AB P. 0. Box 1625 Energy and Safety Idaho Falls, ID 83415-3850 P.O. Box 3096 S-16103 Bromma SWEDEN Dr. U. Schmocker Hauptabteilung fur die Sicherheit der Kemanlagen Themis P. Speis CH-5232 Villigen HSK USNRC-RES/DO SWITZERLAND MS: T-10Fl2 A.J. Seebregts Desmond Stack ECN Nuclear Energy Los Alamos National Laboratory Westerduinweg, 3 Group Q-6, Mail Stop K556 Postbus 1 Los Alamos, NM 87545 NL-1755 PettenZG THE NETHERLANDS Dist-15

Jao Van de Steen Technaµyne Engineer. Consultants (3)

KEMA Laboratories Attn: David Chanin Utrechtseweg, 310 Jeffery Foster Postbus 9035 Walt Murfin NL 800 ET Arnhem Suite A225 THE NETHERLANDS 8500 Menual Blvd. N Albuquerque, NM 87112 Eli Stem Israel AEC Licensing Div.

P.O. Box 7061 Ashok Thadani Tel-Aviv 61070 USNRC-NRR/ADT ISRAEL MS: 0-12Gl8 Dr. Egil Stokke T. G. Theofanous Advisory Group University of California, S. B.

OECD Halden Reactor Project Department of Chemical and Nuclear P.O. Box 173 Engineering N-1751 Halden Santa Barbara, CA 93106 NORWAY Catherine Thompson Stone & Webster Engineering Corp USNRC-RES/PRAB Technical Information Center MS: T-IOE50 A. Hosford 245 Summer Street 245/01 Soren Thykier-Nielsen Boston, MA 02210 Riso National Laboratory Postbox49 DK4000 Roskile Dennis Strenge DENMARK Pacific Northwest Laboratory RTO/ 125 P.O. Box 999 W. H. Tong Richland, WA 99352 EQE International, Inc.

Suite 400 18101 Von Karman Avenue R. F. Su Irvine, CA 92715 Tai Power 2F 78 Minchuan East Road, Section 5 Taipei R. Toossi TAIWAN (Republic of China) Physical Research, Inc.

25500 Hawthorn Blvd.

Torrance, CA 90505 Dist-16

Ennio Traine Magiel F. Versteeg ENEL Ministry of Social Affairs Via Vialiano, 48 and Employment 00144 Rome P.O. Box 90804 ITALY 2509 LV Den Haag THE NETHERLANDS UlfTveten Environmental Physics Section Martin Virgilio Institutt for Energiteknikk USNRC-NRR/DSSA Postboks 40 MS: 0-8E2 N-2007 Kjeller NORWAY R. Virolainen, (Chairman PWG5)

Systems Integ. Off. (STUK)

US Department of Energy P.O. Box268 Energy Library Kumpulanite 7 Room G 034/GTN SF-60101 Helsinki AD-622.1 FINLAND Washington, DC 20585 Seppa Vuori US Department of Energy Technical Research Centre of Finland NS-50 (GTN) Nuclear Engineering Laboratory NS-10.1 Lonnrotinkatu 3 7 S-161 P.O. Box 169 Washington, DC 20585 Sf-00181 Helsinki 18 FINLAND U.S. Environmental Protection Agency (2) Dr. Ian B. Wall I Attn: Allen Richardson 81 Irving A venue I Joe Logsdon Atherton, CA 94027 '1 Office of Radiation Programs Environmental Analysis Division Washington, DC 20460 Edward Warman Stone & Webster Engineering Corp.

P.O. Box 2325 Harold V anderMolen Boston, MA 02107 USNRC-RES/PRAB MS: T-10E50 J.E. Werner Reactor Research & Techn Division Dr. A. Valeri US DOE Idaho Operations A.N.P.A. MS: 1219 Via Vitaliano Brancati, 48 850 Energy Drive I-00144 Rome Idaho Falls, ID 83401-1563 ITALY Dist-17

)

Dr. Wolfgang Werner Keith Woodard Safety Assessment" Consulting GmbH PLG, Inc.

Veilchenweg 8 7315 Wisconsin Ave.

D 83254 Breitbrunn Suite 620 East GERMANY Bethesda, MD 20814-3209 Westinghouse Electric Corp John Wreathall Technical Library The WreathWood Group P. 0. Box355 4157 MacDuffWay East209 Dublin, OH 43016 Pittsburgh, PA 15230 Westinghouse Electric Corp Carlo Zaffiro NTD A.N.P.A.

Central File Nuclear Safety Directorate for Nuclear P. 0. Box 355 Via Vitaliano Brancate, 48 408 I-A 1-00144 Rome Pittsburgh, PA 15230 ITALY Westinghouse Electric Company (3)

Attn: John Lacovin Dr. X. Zikidis Burt Morris Greek Atomic Energy Comm.

Griff Holmes N.R.C.P.S. "Demokritos" Energy Center East, Bldg. 371 GR-153 10 Agia Paraskevi P.O. Box355 Attiki Pittsburgh, PA 15230 GREECE Westinghouse Savannah River Co. (2) Internal Distribution Attn: Kevin O'Kula Jackie East R. A Bari, Bldg. 197C Safety Technology Section John Baum, Bldg 703 M 1991 S. Centennial Ave., Bldg. I L. Chu, Bldg. 130 Aiken, SC 29803 D. Diamond, Bldg. 130 J. Jo, Bldg. 130 P. Kohut, Bldg. 475B Donnie Whitehead C. C. Lin, Bldg. 130 Department6412,MS:0747 V. Mubayi, Bldg. 130 Sandia National Laboratories Z. Musicki, Bldg. 130 P.O. Box 5800 L. Neymotin, Bldg. 130 Albuquerque, NM 87185-0747 W. T. Pratt, Bldg. 130 A Tingle, Bldg. 197C S.M. Wong,Bldg. 130 J. W. Yang, Bldg. 130 R. Youngblood, Bldg. 130 Dist-18 *

)

U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER fA*8igned by NRC, Add Vol., Supp,, R*v,,

• nd Addendum Numbera, if any.)

BIBLIOGRAPHIC DATA SHEET NUREG/CR-6144 (Sm, Instructions on the reverstJJ BNL-NUREG-52399 Vol. I

2. TITLE AND SUBTITLE

3. DATE REPORT PUBLISHED Evaluation of Potential Severe Accidents During Low Power and MONTH YEAR Shutdown Operations at Suny, Unit 1:

October 1995

4. FIN OR GRANT NUMBER Summary of Results L-1922

6. AUTHOR(SI 8. TYPE OF REPORT Technical Edited by T. L. Chu and W. T. Pratt

7. PERIOD COVERED /Inclusive D11tesJ 09/01/90 - 09/30/95

8. PERFORMING ORGANIZATION - NAME AND ADDRESS fll NRC, provids Dlvision, Otlla* o, Region. U.S. Nucloo, R11gul11to,y Commi#ion, and ma,1ing addr11s.s; if contreotor, p,ovid6 nam* *nd moiling *ddre&S.J Brookhaven National Laboratoiy Department of Advanced Technology, Bldg. 130 P.O. Box 5000 Upton, New York 11973-5000

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (If NRC, type *same.., abov11*; ii cont1actor, p,ovide NRC Di¥7lli~ 01/ico or Region, U.S. Nucloor R8f1uletory Commimon, andm*iling address.}

Division of Systems Technology Office of Nuclear Regulatoiy Research U.S. Nuclear Regualtoiy Commission Washington, DC 20555-0001 10.suPPLEMENTARYNOTEs R. Robinson, NRC Project Ma~ager 11

• ABSTRACT (200 worM or Je..J This document contains a summarization of the results and insights from the Level 1 accident sequence analyses of internally initiated events, internally initiated fire and flood events, seismically initiated events, and the Level 2/3 risk analysis of internally initiated events (excluding fire and flood) for Suny, Unit I. The analysis was confined to mid-loop operation, which can occur during three plant operational states (identified as POSs R6 and Rl Oduring a refueling outage, and POS D6 during drained maintenance). The report summarizes the Level I information contained in Volumes 2 - 5 and the Level 2/3 information contained in Volume 6 ofNUREG/CR-6144.

12. KEYWORDS/DESCRIPTORS (Li8t wa1tD or phre!M6 th*t wr"JJ usi3, ,~.,chen in loceting th* ,*port.I 3. AVAILABILITY STATEMENT Unlimited Low Power and Shutdown, Probabilistic Risk Assessment, PRA, PWR, Risk, Suny, 14. SECURITY CLASSIFICATION Plant Operational State, Insights, Mid-loop, Internal Events, Fire, Flood, Seismic {ThiaP*g*J Unclassified m,;a R*porl}

Unclassified

16. NUMBER OF PAGES

18. PRICE NRC FORM 336 (2-891

Printed on recycled paper Federal Recycling Program

NUREG/CR-6144, EVALUATION OF POTENTIAL SEVERE ACCIDENTS DURING LOW POWER OCTOBER 1995

, ~/01. 1 AND SHUTDO~~RATIONS AT SURRY, UNIT 1:

S. . .Y OF RESULTS UNITED STATES SPECIAL FOURTH-CLASS MAIL NUCLEAR REGULATORY COMMISSION POSTAGE AND FEES PAID WASHINGTON, DC 20555-0001 USNRC PERMIT NO. G-67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE, $300 SVCS 2.(]555