ML11355A190

New York State (NYS) Pre-Filed Evidentiary Hearing Exhibit NYS00252C, NUREG-1150, Vol. 1, Sever Accident Risks: an Assessment for Five U.S. Nuclear Power Plants, Final Summary Report (December 1990) (NUREG-1150)

ML11355A190
Person / Time
Site:	Indian Point
Issue date:	12/21/2011
From:	- No Known Affiliation
To:	Atomic Safety and Licensing Board Panel
SECY RAS
Shared Package
ML11355A177	List: ML11355A180 ML11355A181 ML11355A182 ML11355A184 ML11355A185 ML11355A186 ML11355A188 ML11355A190 ML11355A191 ML11355A192 ML120040184
References
RAS 21594, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01, NUREG-1150 V1
Download: ML11355A190 (209)

Text

NYS00252C Submitted: December 21, 2011 Appendix B magnitude of the risk: the release fractions for the early release, the release fractions for the late release, and the time between start of the evacuation in the surrounding region and the start of the first release. It is difficult to take each of the nine radionuclide groups into account separately when grouping the source terms, so "effect weights" are determined for each release. These provide a means of considering all the fission products as if they were just one. The partitioning process consists of grouping the source terms together based on these effect weights. Each source term group is then further subdivided based on evacuation timing relative to the start of the release. For releases that have the possibility of causing early fatalities as well as latent cancer fatalities, the grouping is two-dimensional and is based on the source term's potential to cause both types of fatalities. In this analysis for Surry, there were 6,820 source terms with nonzero early fatality weights (EFWs) and nonzero chronic fatality weights (CFWs). For releases that have the possibility of causing only latent cancer fatalities, the grouping is one-dimensional; 11,771 source terms were of this nature.

The partitioning process is carried out by a computer code-PARTITION (Ref. B.58). The process is an interactive one, with the user choosing the number of cells or divisions to be used and selecting those grids that have so few points that they may be combined with a neighboring cell.

B.5.2 Effects Weights The early fatality weight (EFW) of a source term is a measure of the radiological potential of a source term to cause early fatalities in the absence of any mitigating effects except relocation. The chronic fatality weight (CFW) of a source term is, similarly, a measure of the radiological potential of a source term to cause latent cancer fatalities.

The calculation of the EFW has two parts. First, the releases of the 59 radionuclides other than I-131 are converted into equivalent amounts of 1-131. Then the total release, expressed in an equivalent amount of I-131, is used to estimate the number of resultant early fatalities.

The isotope conversion factor used to determine the equivalent amount of 1-131 for each isotope is based on the bone marrow dose from the three pathways that give an acute dose: cloudshine, groundshine, and inhalation.

The cloudshine or immersion dose results from being surrounded by air containing radioactive molecules.

The inhalation dose comes from breathing the contaminated air. Radioactive molecules are absorbed into the body from the air in the lungs. The groundshine dose comes from standing or walking on ground on which radioactive particles have been deposited. The cloudshine and groundshine doses are immediate, as the body receives beta or gamma radiation from radionuclides that decay outside the body. The inhalation dose is received some time later when the radionuclides absorbed from the air decay inside the body.

The conversion factor is computed from an equation that is presented and derived in Reference B.S. It depends upon the dose factor for each pathway, the shielding factor for each pathway, the breathing rate, and the deposition velocity. For each pathway and organ of the body, the dose factor is a constant that depends upon the type of radiation emitted by the isotope, the energy of that radiation, and, for the inhalation dose factor, the selective transport of the isotope to, and absorption in, the specific organ. For cloudshine, the dose factor relates the dose rate to the concentration in the air. For groundshine, the dose factor relates the dose rate to the concentration on the ground. For inhalation, the dose factor relates the dose rate to the amount of the isotope inhaled. The shielding factor accounts for the fact that some of the time the people will be indoors and will be partially shielded by the building. The deposition velocity measures the rate at which solid particles are deposited from the plume.

Table B.5 lists the dose factors used in calculating the isotope conversion factors and the isotope conversion factor itself for 11 representative isotopes. Complete information about the calculation of effects weights, with the values of the parameters used for all 60 isotopes, may be found in Reference B. 5.

The groundshine dose factor is the factor for an exposure of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; radioactive decay during this time is accounted for in computing this factor. The applicable concentration is the concentration at the beginning of the period. The inhalation dose factor used is the acute inhalation factor. The cloudshine and groundshine dose factors for Sr-90 are zero because it produces no gamma radiation. The groundshine dose factor for Kr-88 is zero because it is not deposited.

NUREG-1150 B-54 OAGI0000611 00418

Appendix B Table B.S Partitioning parameters and results.

Dose Factors Cloud- Ground- In hal* (ELCFk +

shine shine ation EF CLCFk)

(lE-15 (8 h) (Acute) Reactor Isotope IRk Sv-m3/ (l0-12 (10-9 Inventory Conv. (LCF/

Isotope Bq-s) Sv-rn3/Bq) Sv/Bq) Half-Life (10E+18 Bq) Factor 10E+l5 Bq)

Co-60 99.6 50.3 0.40 5.3 yr 0.025 6.6 59.2 Kr-88 116.0 o.o 0.0004 2.8 h 2.9 2.0 0.0003 Sr-90 0.0 o.o 1.7 28 yr 0.19 4.3 118.

Zr-95 29.2 0.17 0.28 66 d 5.5 2.5 2.1 Ru-106 8.1 4.6 0.087 369 d 1.0 0.71 5.2 Te-132 7.6 35.3 0.25 3.2 d 4.7 3.4 0.13 1-131 14.5 8.7 0.035 8.0 d 3.2 1.0 0.29 Cs-137 22.2 12.6 0.56 30 yr 0.24 2.8 114.0 Ba-140 7.1 7.3 0.47 13 d 6.2 1.9 0.53 La-140 94.8 44.2 0.14 40 h 6.4 5.4 0.083 Pu-239 0.0017 0.0014 2.4 24000 yr 0.0008 6.0 1565.0 Each isotope is converted into an equivalent amount of 1-131 by the equation:

EQNk = CFk lk STNk exp[ -A.k (TN + DTN/2)],

where:

N = 1 for the early release and N = 2 for the late release, EQNk = the equivalent amount of 1-131 for isotope k for release N, CFk = the isotope conversion factor for isotope k, lk = the inventory of isotope k at the start of the accident, STNk = the relea~e fraction of isotope k for release N, Ak = the decay constant for isotope k, TN = the time of the start of release N, and DTN = the duration of release N.

Release fractions are determined in the source term calculation for nine radionuclide groups; each isotope is assigned to one of these groups. The total 1-131 equivalent release is then found from:

The relationship between the size of the equivalent release and the number of early fatalities is nonlinear because of the threshold effect and is complicated by the variability of the weather and the uneven distribution of the population around the site. The last factors are treated by using the weather-averaged, mean, or expected value for early fatalities as calculated by MACCS (Ref. B.59), using the actual site weather and demographic data. The effects of release magnitude were determined by making complete MACCS runs for 1-131 releases of different sizes. The result is shown in Figure B.15. The MACCS B-55 NUREG-1150 OAGI0000611 00419

Appendix B RELATIONSHIP BETWEEN IODINE RELEASE and EARLY FATALITIES 1d--------------------------------------~

Figure B.15 Relationship between 1-131 release and mean early fatalities used in determining early effects weights for partitioning.

NUREG-1150 B-56 OAGI0000611_00420

Appendix B calculations assumed an instantaneous release at ground level, with no evacuation or sheltering. No immediate mitigative action was used because the purpose of the EFW is to measure the radiological potential for early fatalities. The relocation criteria normally used for MACCS were not changed, however.

In summary, the procedure in calculating the EFW for a release is to compute the 1-131 equivalent for each isotope for both the early and late release and then to total these values to obtain a total I-131 equivalent release. The curve relating the total equivalent release to mean early fatalities, Figure B.15, is then used to find the number of early fatalities, which is the early fatality weight, EFW. Releases with EQs less than 2E+18 Bq are assigned an early fatality weight of zero.

The method used to determine the chronic fatality weight is different. Because of the nearly linear relationship between the amount of an isotope released and the number of latent cancer fatalities, there is no need to convert the amount released for each isotope to an equivalent amount of a reference radionuclide. Instead, MACCS was used to determine the relationship between the amount released and the mean number of latent cancer fatalities for each site, using the weather and population data appropriate for that site. For each isotope, a MACCS run was made in which only that isotope was released. The entire inventory of the isotope in the reactor was released for the inert gases and 10 percent of the entire inventory for the other radioisotopes. The latent cancer fatalities due to the dose obtained in the first 7 days and those due to the chronic dose (received after the first 7 days) were obtained from the MACCS output. Since these fatalities are approximately linear with the amount released, the ratio of their total number to the amount released gives a reliable measure of such fatalities per unit release in the absence of any mitiga,ting actions. This method is not applicable to early fatalities because of the threshold effect.

The chronic fatality weight for each isotope is given by the equation and the total chronic fatality weight is then where the summation is over all isotopes. I" and STN" have been defined above, and CFW k = the chronic fatality weight, in latent cancer fatalities, for a release of an amount h (ST1.t + ST2.t) of isotope k; ELCFk = the number of latent cancer fatalities due to early exposure from a release of an amount Rk of isotope k; CLCF k = the number of latent cancer fatalities due to late exposure from a release of an amount Rk of isotope k; and Rk = the amount of isotope k released in the MACCS calculation used to determine ELCFk and CLCF".

The early exposure is that obtained in the first 7 days after the accident and the late exposure is the exposure obtained after the first 7 days. The distinction is made because slightly different methods of these two periods are used in MACCS. Table B.S lists values of the ratio (ELCF.t + CLCFk)/Rk for 11 representative isotopes. A total of 60 radionuclides are used in the consequence calculation. A complete listing of the conversion factors and CFWs for each may be found in Reference B.5.

Table B.S also lists the half-life of the isotopes, and the reactor inventory at the time the accident starts.

The half-life, the inventory, the EF isotope conversion factor, and the specific CFW, together with a rough idea of the release fractions for each radionuclide group, can be used to assess roughly the importance of the isotope to early and late offsite health effects. The 11 isotopes listed are all fairly B-57 NUREG-1150 OAGI0000611 00421

Appendix B important for at least one of the two consequence measures as this was one of the criteria for their selection. However, Kr-88 is clearly of little importance for chronic fatalities because the half* life and the specific CFW are low. Pu-239, on the other hand, can be seen to be of less importance than other isotopes for early fatalities because the inventory is very low and the isotope conversion factor is about the same size as that for more common fission products. The release fractions for Pu-239 also tend to be low.

The early and chronic fatality weights described here are not used in calculating consequences; they are only used in partitioning the source terms into groups of similar source terms. An average source term for each subgroup is used to calculate the offsite consequences with MACCS.

The process described in this section is applied to the source term for bin FFA*CAC-ABA-CA in Observation 4; the result is EFW =0. 0 and CFW =2. 7. The EFW is zero for this bin because the release is so low. Evacuation is not taken into account in determining the EFW, so the fact that the evacuation is complete before the FFA-CAC-ABA-CA release starts has no effect on the EFW although it may be very important in computing the actual consequences.

B.S.3 Partitioning Process and Results The partitioning process divides the "space" defined by the logarithm of the effect weights into a number of cells. For the source terms for which both EFW and CFW are nonzero, this produces a rectangular grid on a two-dimensional plot. For the source terms for which the EFW is zero, the "space" to be divided is one-dimensional; that is, partitioning involves defining cells based on CFW alone. In the Surry analysis, there are 11,771 source terms with EFW = 0.0. The source term for bin FFA-CAC-ABA*CA is one of these.

For the 11,771 source terms with EFW = 0.0, the range oflog 10 (CFW) is from -4.2 to 3.7. This range was divided into six groups or cells. The results of the initial division was:

Group 1 2 3 4 5 6 log1o(CFW) -4.2 -2.9 -1.6 -0.2 +1.1 +2.4 +3.7 Count 349 1553 2892 1599 2438 2940

% Weighted Freq. 7.9 33.2 49.3 2.5 4.9 2.1 The second line gives the values of log 10 (CFW) that divide the range into six cells or groups. The third line gives the number of source terms in each group, and the last line gives the percentage of the weighted frequency in that group. (The weighted frequency of a bin is the absolute frequency of the bin, or the PDS frequency multiplied by the bin probability for the observation that applies.) The sixth group has slightly more source terms in it than the third group, but the frequencies of the source terms in the sixth group are very low. Thus the percentage of the frequency in group 3 is 25 times as high as that in group 6. The source term for bin FFA-CAC-ABA-CA has CFW = 2. 7, and log10 (2. 7) =0.43, so the source term for bin FFA*CAC*ABA*CA goes into group 4. Group 4 includes all the source terms that have EFW = 0.0 and for which log10 (CFW) lies between -0.2 and +1.1. Source terms are placed in this group if they meet these criteria no matter what PDS or APB they represent. Although the number of source terms in group 4 is fairly high at 1,599, the frequency of these source terms on the whole is fairly low, and the fraction of the frequency in group 4 is only 2.5 percent.

It is not worth making separate calculations for groups that have a small fraction of the weighted frequencies. Based on the information given in the table immediately above, it was decided that three CFW groups would be sufficient. Groups 1, 4, and 6 were eliminated, and the source terms in those groups were pooled with the neighboring groups. Groups 4 and 6 were pooled with groups 3 and 5 because fractions of the weighted frequencies in groups 4 and 6 were so low. The frequency of group 1 is higher than that of group 5, but the consequences of group 1 are very low, so the absorption of the source terms of group 1 into group 2 has a negligible effect on the risk.

NUREG-1150 B-58 OAGI0000611 00422

Appendix B The final partitioning is:

Group 1 2 3 4 5 6 log1 0(CFW) -4.2 -2.9 -1.6 -0.2 +1.1 +2.4 +3.7 Count 0 1902 3223 0 6646 0

% Weighted Freq. 0 41.1 49.8 0 9.1 0 The log10 (CFW) for bin FFA-CAC-ABA-CA is just above the center value for group 4, so it was placed in group 5. The average values of the release fractions and the release characteristics for group 5 at the end of partitioning include the source terms originally in groups 4 and 6 that have been absorbed into group 5, not just the source terms originally in group 5.

Group 5 in the partitioning process for source terms with zero EF weight becomes source term 17 when the partitioning for source terms with nonzero EF weights are considered and empty groups are eliminated. The mean frequency of this group is 3.4E-6/reactor year, and the conditional probability of this group, with respect to the source terms with EFW = 0.0, is 0.084.

Each source term group is subdivided into three source term subgroups (STGs) on the basis of evacuation timing:

STGl (early evacuation): Evacuation starts at least 30 minutes before the release begins.

STGZ (synchronous evacuation): Evacuation starts between 30 minutes before and 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the release begins.

STG3 (late evacuation): Evacuation starts 1 or more hours after the release begins.

For source term 17, STG1 has 94 percent of the source terms, and STG2 has 6 percent of the source terms. There are no source terms in STG3. As would be expected from the very late release time for the source term for bin FFA-CAC-ABA-CA for Observation 4, this source term goes to STG1.

Consequence calculations are not done for source term group 17 as a whole; they are done for the subgroups since the timing differs markedly between the subgroups. The mean source terms for each subgroup form the basis for each consequence calculation. The properties of subgroup 1 of source term 17 are given in Table B.6. This information is used by the computer code MACCS (Ref. B.59) to calculate the offsite consequences. Although the source term for bin FFA-CAC-ABA-CA of Observation 4 had a zero early release, some of the other source terms placed in STG1 of source term 17 in the partitioning process had nonzero early releases, thus the mean early release fractions for STG1 are nonzero. The representation of the source term for FFA-CAC-ABA-CA by a source term with a nonzero early release does introduce a slight distortion. However, the early release is small, and it occurs at 13.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, which is well after the time at which the warning to evacuate is given, 6.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />. The small early release and the fact that the evacuation is completed before the release commences mean that there are no early fatalities from the early release for STG1. As the latent cancer fatalities and population dose do not depend on the release timing to any significant degree, the error introduced by the nonzero early release is negligible.

The results of partitioning are contained in two files. One file contains all the source terms that MACCS will use to calculate consequences. STG1 of source term 17 is the 49th source term in this file and is referred to as SUR-49 for the consequence calculation. The second output file indicates the STG in which each bin of each observation was placed in the partitioning process. For bin FFA-CAC-ABA-CA of Observation 4, this was STG1 of source term 17, now known as SUR-49.

B-59 NUREG-1150 OAGI0000611 00423

Appendix B Table B.6 Properties of source term 17, subgroup 1.

Frequency Minimum Maximum Weighted Property Value Value Mean Release Height 10 10 10 Warning Time 2.2Et4 3.6Et4 2.5Et4 Start Early Release 4.7Et4 5.1Et4 4.8Et4 Duration Early Release 0.0 3.6Et3 3.3Et2 Energy Early Release 0.0 7.0Et8 9.2Et5 ERF Xe, Kr 0.0 l.OE 0 1.4E-1 ERF I 0.0 l.SE-1 7.3E-3 ERF Cs, Rb 0.0 1.1E-1 5.4E-3 ERF Te, Sc, Sb 0.0 2.9E-2 1.2E-3 ERF Ba 0.0 1.4E-2 1.2E-4 ERF Sr 0.0 2.4E-3 2.3E-5 ERF Ru, etc. 0.0 1.1E-3 6.6E-6 ERF La, etc. 0.0 5.2E-3 2.8E-5 ERF Ce, Np, Pu 0.0 1.4E-2 1.4E-4 Start Late Release 4.7Et4 1.3Et5 1.1E+5 Duration Late Release 1.0Et1 2.2Et4 1.2E+4 Energy Late Release 0.0 7.0Et8 9.2Et5 LRF Xe, Kr 0.0 l.OE 0 8.1E-1 LRF I S.OE-6 1.3E-1 4.0E-2 LRF Cs, Rb 0.0 S.OE-2 3.9E-4 LRF Te, Sc, Sb 3.4E-11 9.6E-2 2.7E-4 LRF Ba 6.3E-14 1.7E-2 4.9E-5 LRF Sr l.OE-18 1.4E-3 2.7E-6 LRF Ru, etc. 5.2E-18 1.6E-3 4.2E-6 LRF La, etc. 5.2E-18 1.7E-3 6.5E-6 LRF Ce, Np, Pu 1.6E-13 1.4E-2 4.2E-5 Note: ERF means early release fraction, LRF means late release fraction, the release height is in meters, the energy of the release is in watts, and all times are in seconds.

B.6 Consequence Calculation The computer code MACCS (Ref. B.59) is used to determine the consequences of a release of fission products from the damaged reactor. Consequences are the offsite results of the accident expressed in societal terms; for example, number of early fatalities or the risk of latent cancer fatality to the population within 10 miles of the plant. A separate MACCS calculation is performed for the mean source term associated with each STG.

B.6.1 Description of Consequence Calculation The consequence calculation is an extensive calculation. The inventory of fission products in the reactor at the time of the accident and the release fractions for each radionuclide class are used to calculate the amount released for each of the 60 isotopes considered by MACCS. Then, for a large number of weather situations, the transport and dispersion of these radionuclides in the air downstream from the plant is calculated. The amounts deposited on the ground are computed for each distance downwind. Doses are computed for a hypothetical human at each distance from immersion in the contaminated air, from breathing the contaminated air, from the exposure due to radioactive material deposited on the ground, NUREG-1150 B-60 OAGI0000611 00424

Appendix B and from drinking water and eating food contaminated by deposited radioactive particles. The first three of these dose pathways result in immediate doses that can cause health effects within a few hours or days of the release. These are called acute effects. In addition to the three pathways that cause acute effects, long-term exposure from contaminated ground and ingestion also contributes to latent cancer fatalities and other delayed effects. These are known as chronic effects. Doses to an individual are converted to population doses using population data. Doses and health effects are calculated for nine organs of the human body.

The consequence calculation requires a large amount of supporting data. Files of weather data and demographic data specific to the plant region are required. Information is needed on land use (crops grown or dairy use) and land value in the surrounding area. Dose factors are used to relate the dose to each organ to the concentration of each of the isotopes as explained in Section B. 5. 2.

To assess the effects of different weather on the consequences, the complete transport, deposition, and dose calculation is repeated over 1,000 times for each source term. For each of 16 wind directions, the consequence calculation is performed for about 130 different weather situations. Weather data from the specific plant being modeled are used. The wind direction determines the population over which the plume from the accident passes. The atmospheric stability is also important as it determines the amount of dispersion in the plume downwind from the plant. Deposition is much more rapid when it is raining than when it is not. Each weather sequence contains information about how the wind direction, stability, and precipitation changes from hour to hour. The consequence calculation also computes the effects of the evacuation of the population from the immediate area around the plant. More information on the consequence calculation may be found in Reference B.59.

B.6.2 Results of Consequence Calculation As discussed in Section B.5.3, the source term f6r bin FFA-CAC-ABA-CA for Observation 4 was included in group SUR-49 in the partitioning process. The eight consequence measures used in the risk computation, with the mean or expected values computed for partition group SUR-49, are:

Early Fatalities 0.0 Early Injuries 4.2E-6 Latent Cancer Fatalities 1.1E+2 Population Dose-50 miles 2. 7E+5 person-rem Population Dose-region 6.9E+5 person-rem Economic Cost (dollars) 1.8E+8 Individual Early Fatality Risk-1 mile 0.0 Individual Latent Cancer Fatality Risk-10 miles 7.6E-5 The distribution for latent cancer fatalities is shown in Figure B.16. Note that these consequences assume that the release SUR-49 occurred.

The population doses are the effective dose equivalent whole body doses. The individual early fatality risk is the risk to an average individual within 1 mile of the site boundary. It is calculated using the actual population distribution within 1 mile of the site boundary. For SUR-49, there are no early fatalities and the early fatality risk within 1 mile is zero as well. This is due to the very small magnitude of the early release. As 0.5 percent of the population is assumed not to evacuate when told to do so, neither of these measures would be zero if the release were large enough to cause early fatalities. The individual latent cancer fatality risk is the risk to an average individual within 10 miles of the plant, excluding the food pathways. The low total release fractions for SUR-49 result in a low value for this risk measure also.

After the MACCS calculations are completed, the results for each weather trial (wind direction and weather sequence) for each STG are used in constructing complementary cumulative distribution functions, as discussed below in Section B. 7. 3. Averages over the weather trials determine the expected consequence values for each STG. These are extracted and assembled into a matrix for use in determining distributions of expected values of risk.

B-61 NUREG-1150 OAGI0000611 00425

Appendix B CANCER FATALITIES- SURRY 10 3

-g (I)

(I)

I I

0 I I

LE I s... I Q)

I c 1cf 0

I 0 I

(.)

I cQ) I I

j c I

.9 J I

1 I 10 d

I I I I 0.000 0.025 0.050 0.075 0.100 0.125 0.150 Probability Figure B.16 Distribution of latent cancer fatalities computed for STG SUR-49.

NUREG-1150 B-62 OAGI0000611 00426

Appendix B B. 7 Computation of Risk The risk measures that form the final result of a PRA are formed by merging the results of all the preceding analyses. Section B. 7.1 introduces the concepts and terms. Mean risk is discussed in Section B. 7 .2, and displays that show the variability in risk due to the weather and other variables are discussed in Section B.7.3.

B. 7.1 Introduction The final step in a complete risk calculation is putting together the results of all the steps described above to produce a measure of risk. The accident progression analysis and the source term analysis were carried out on conditional bases. That is, the accident progression analysis was performed for each PDS group for each observation without regard for the frequency of that PDS group. Similarly, for each observation in the sample, the source terms for each bin were calculated without taking the bin frequency into account.

The partitioning process, however, used the absolute frequency of each source term in determining which groups of source terms could be combined into neighboring groups and in determining the mean values used to represent each STG. To accomplish this, for each observation, the absolute frequency of each PDS group was obtained from the accident frequency analysis, and the conditional probability of the bins was obtained from the accident progression analysis. The consequence analysis was performed for each source term subgroup without regard for its absolute or relative frequency.

Risk is generally displayed in three forms: mean risk, histograms of risk, and complementary cumuiative distribution functions (CCDFs). For each sample member and for each consequence measure, the results are averaged over the weather conditions to obtain an expected value. If, for one consequence measure, the average of the 200 expected values is taken, the result is actually the mean value of the expected risk, or the mean value of the weather-averaged mean risk. It is usually referred to as just the mean risk. The mean values of expected risk do provide single numbers (for each consequence measure) that characterize the risk. However, they provide no information about the variability or uncertainty in the risk. Histograms of expected risk display the variation in weather-averaged expected risk among the members of the sample. Mean risk is discussed in Section B.7.2 below.

To display the variability in risk due to the weather, CCDFs are used. While a separate CCDF is formed for each observation, not all 200 are usually plotted at once. Instead, statistical measures of the sample of CCDFs are plotted. CCDFs are presented and explained in Section B.7.3.

B. 7.2 Calculation and Display of Mean Risk As described in Section B. 6, a separate consequence calculation is performed with MACCS for each source term subgroup, and the result was a large number of consequences. They are represented by Czvwk*

which is the value of consequence measure 1 for wind direction v, weather sequence w, and source term subgroup k. When a frequency-weighted average is formed over the wind direction and the weather sequences, a set of mean or expected consequence measures, c1k, is formed. As there are 52 source term subgroups, 52 expected values are computed for each of the eight consequence measures.

The expected risk for measure l and observation n can be expressed in terms of the results of the individual analyses by:

where:

Risk1n = expected risk for consequence measure I for observation n (consequences/reac-tor year);

fn(IEh) = frequency (per reactor year) of initiating event h for observation n; Pn (IEh- PDSi) = probability that initiating event h leads to PDSi for observation n; B-63 NUREG-1150 OAGI0000611 00427

Appendix B

. 't Pn (PDSi-+ APBj) = probability that PDSi leads to APBj for observation n; Pn (APBj-+ STGk) = probability that APBj was partitioned into source term subgroup k for observa-tion n; and C1k = expected value of consequence measure l for source term subgroup k.

All the terms in the equation change from observation to observation except Cu, . The distribution for initiating event frequency is part of the data used in the calculations performed in the accident frequency analysis. The summation over all the different initiating events is performed in the accident frequency analysis, and the output of the accident frequency analysis is actually the frequency for each PDS group for each observation.

Pn (PDSi-+ APBj) is the result of the accident progression analysis and the evaluation of the accident progression event tree. It consists of a list of APBs for each PDS group, with a probability for each, for each observation. The APB probability is conditional on the occurrence of the PDS group.

Pn (APBj-+ STGk) represents the combined result from the source term calculation and the partitioning process. For each observation, a source term is computed for each APB in that observation. The source terms for all 200 observations in the sample are placed in source term subgroups in the partitioning process. The outcome of the source term analysis and partitioning is the STG to which each APB in each observation is assigned and a mean source term for each STG. Pn (APBj-+ STG") is an element of the matrix that contains this information; the matrix element for given values of j and k is 1.0 if APBj was placed in STG" and 0.0 otherwise.

Risk1n is the expected risk for each observation. What is reported as the mean risk for measure l is really the expected or mean value of expected risk:

where nms is the number of observations in the LHS (200 for Surry). That is, the expected or mean value of risk is the average of 200 values of weather-averaged expected risk.

The distribution of the 200 values for the mean latent cancer fatality (LCF) risk are displayed in the form of a histogram. Such a histogram for LCFs is shown in Figure B.17 for 99.5 percent evacuation. The quantiles are obtained by ordering the 200 observations by the value of the independent variable. The 5th and 95th percentiles, the mean, and the median are shown. Not shown are the extreme values (Observation 123, 7.8E-5 LCFs/reactor year and Observation 76, 7.5E-2 LCFs/reactor year) since they are not indicative of the sample as a whole. The mean for Observation 4 is S.OE-3 LCFs/reactor year, which is near the 75th percentile and is well above the median.

The equation for risk given above provides the means for determining the risk due to certain subsets or groups of events and the contribution of these subsets to mean risk. For example, say the contributions of the APBs were desired. The risk due to APBk for observation n is:

Riskznj = I:hl:i~;k fn(IEh) Pn(IEh-+ PDSt) Pn(PDSi-+ APBj) Pn(APBj-+ STGk) Crk*

For each observation, the fractional contribution of APBj is:

Riskznj /Riskin*

The risk and the fractional contributions for combinations of APBs can be determined in an analogous manner.

NUREG-1150 B-64 OAGI0000611 00428

Appendix B Internal- 99.5% Evac SURRY Risk (per Reactor-year) 1~1~------------------~~~--------------,

. Latent Cancer Fatality Risk 95"

_j 10-~

- WEAN ~

.J i

J MEDIAN

_J

_j 10-!

. ..1

- 5" 16~tl----------------------------------------

Figure B. 17 Distribution of expected (weather-averaged) latent cancer fatality risk for Surry.

B-65 NUREG-1150 OAGI0000611_00429

Appendix B For the sample as a whole, the mean risk from APBk is:

( I:nRiSkznj)/nLHS*

Fractional contributions to mean risk for the entire sample can be determined in two ways. The expression is termed the mean fractional contribution to risk for APBi* The expression

[ (I:n Riskznj) /nLHS] /Riskz is termed the fractional contribution to mean risk for APBj. Figure 3.14 of the main report shows the fractional contribution to mean risk for groups of APBs. Because the distributions for risk often have very long tails and the mean is then determined by the few observations with the highest risk, the fractional contribution to mean risk and the mean fractional contribution to risk can be quite different. There is no consensus that one method of calculating the contribution to mean risk is preferable to the other.

The summations in the expression for Risk10 , and the computations necessary to obtain the statistical measures, are performed by a computer program named RISQUE. A description of this code may be found in an appendix to Reference B.S.

B.7.3 Calculation and Display of CCDFs As already indicated, the output from MACCS is a large number of consequences represented by Czvwk*

the magnitude of consequence measure I for wind direction v, weather sequence w, and source term subgroup k. When the results for each weather trial (combination of wind direction and weather sequence) are kept separate and the probability of each weather trial is taken into account, a complementary cumulative distribution function (CCDF) may be obtained for each STG. Figure B.18 displays the latent cancer fatality CCDFs for STG SUR-49 and for all 52 STGs. The CCDF for a single STG displays the effects of the variability of the weather and relates the magnitude of the consequence to the probability that it will be exceeded. (The cumulative distribution function (CDF) displays the probability that a certain value will not be exceeded. The CCDF displays the probability that a certain value will be exceeded. CCDFs are usually shown for historical reasons.) The CCDFs in Figure B.18 have conditional probability on the ordinate: each curve displays the latent cancer fatality results conditional on the occurrence of a release. For example, the top plot in the figure displays the results of the consequence analysis conditional on the SUR-49 release.

To understand how the CCDF for a single STG is formed, let the subscript u represent a combination of wind direction and weather sequence; then Czvwk may be written Cluk* Each combination of wind direction and weather sequence is denoted a weather trial. Cluk is now the value of consequence measure l for weather trial u and source term subgroup k. The CCDF for consequence measure l and STGk is formed from a set of results of the form:

u = 1, 2, .... , nWT, where:

Pu = probability that weather trial u will occur, and nWT = number of weather trials (about 2,500).

The set (Czuk. Pu) is ordered on the consequence measure (i.e., Czuk < C1, u+l, k). The results of the consequence evaluation include both Czuk and Pu.

Since it is the complementary cumulative probability that is plotted in Figure B.18, this figure results from plotting the set (Cluk* 1- CPu) where CPu is the cumulative probability defined by:

NUREG-1150 B-66 OAGI0000611 00430

Appendix B 10- 1 X

t!)

z

.... 10-2 0

w w

u X

w IJ.. 10- 3 0 SOURCE TERM m

0 SUBGROUP SUR-49 0:

0..

10- 4 3

10- 2 10-l 10* 0 10* 1 10* 2 10*

x. CANCER FATALITIES X

t!)

z

....0 10-2 w

w u

X w

3

u. 10-0 m

0 0:

Q.

10- 4 ALL SOURCE TERM SUBGROUPS 10-2 10-l 10+ 0 10. 1 10+ 2 10.. 3 10.4 X, CANCER FATALITIES Figure B.18 CCDFs for latent cancer fatalities for STG SUR-49 and for all 52 STGs.

B-67 NUREG-1150 OAGI0000611 00431

Appendix B u

CPu ;;; l: Pq.

q=l Figure B.18 shows the probability of exceeding a given consequence. For instance, the top plot shows that the conditional probability of exceeding 100 LCFs is about 0.10, given the occurrence of SUR-49.

The next step is to form the CCDF for each of the nLHS (200) observations that comprise the sample.

This is done by considering a large number of values on the abscissa in the lower plot in Figure B.18. Let X represent a value of a consequence measure; in this figure X would be a number of latent cancer fatalities. For each STGk> the ordinate (i.e., Y) of the point (X, Y) on the curve defined by (Ctuk* 1- CPu) gives the probability of exceeding X consequences. Let this probability be represented by Pxck(X). The next factor needed is fnk* the frequency of STGk for observation n. The equation for fnk is analogous to the equation for Riskan:

fnk =l:;l:j fn(PDS;) Pn(PDS;- APBj) Pn(APBj- STGk),

where all the terms have already been defined in Section B.7.2.

So for one STGk, the contribution to the CCDF for observation n is the set of points (X, Pxck(X)fnk),

where the product Pxck(X)fnk represents the frequency for observation n that STGk will result and that X will be exceeded. When all the STG" are considered, it may be seen that the set of points that defines the CCDF for observation n becomes where the summation is over all the source term subgroups. As there are 200 observations in the sample, 200 such CCDFs are calculated. The dashed lines on the plots in Figure B.19 are the CCDFs for Observation 4 for early fatalities (EFs) and LCFs.

While the CCDFs for all 200 observations for consequence measure l could be placed on one plot, the result is cluttered and hard to read. Instead, four statistical measures of the set of 200 curves are plotted.

The four measures of the sample are the Sth percentile, the 95th percentile, the median, and the mean.

They are shown on Figure B.19. These four curves do not represent specific observations. Instead, each point on these curves is a statistical measure of the sample at that value of the consequence. For example, consider the mean curve for latent cancer fatalities in Figure B.19. For 100 LCFs, there are 200 values of the exceedance frequency, one for each observation in the sample. As each observation is as likely as the next, these 200 values are summed and divided by 200 to determine the mean for 100 LCFs. This process is repeated for 105 LCFs, 110 LCFs, and so on. In this way, the points that comprise the mean curve are obtained. The result does not coincide with any one of the 200 observations. The 5th and 95th percentiles are obtained in an analogous manner. Since the 200 values for a given LCF value are ordered, the 5th percentile value is the value of the 10th observation.

The CCDF for each observation displays the effects of the variability of the weather, through the term Pu.

as well as some variability due to the sampling process, through the term fnk* The shape of the CCDF for a single observation depends upon the relative frequency of each STG in that observation, which in turn depends on all the sampled factors in the accident frequency analysis, the accident progression analysis, and the source term analysis. As the CCDFs for each STG are the same for all the observations in the sample, the differences among the CCDFs for the 200 observations are due to the different frequencies for each STG in each observation.

The CCDF can be read in a number of ways. Consider the median curve for LCF in Figure B.19; it shows that the median frequency of exceeding one to ten LCFs is between 3E-6/reactor year and 4E-6/reactor year; the median frequency of exceeding 100 LCFs is about 2E-6/reactor year; the median frequency of exceeding 1,000 LCFs is SE-7/reactor year; and the median frequency of exceeding 10,000 LCFs is SE-9/reactor year. The same interpretation is valid for the other measures of the sample of 200 CCDFs.

Another way to read a CCDF is to consider one panicular value of the consequence. Take 1,000 LCFs for NUREG-1150 B-68 OAGI0000611 00432

Appendix B SURRY INTERNAL EVENTS 99.5% EVACUATION 1Cf" 2 10-*

~

a::

g.c(

a::

ei

.e..

~

§ 8

e:

l.L.I

~ 10-*

§ SURRY INTERNAL EVENTS

~ 1Cf' 99.5% EVACUATION Figure B.19 Computed curves showing four statistical measures of 200 CCDFs for Surry for early fatalities and latent cancer fatalities. (The CCDF for Observation 4 is also shown.)

B-69 NUREG-1150 OAGI0000611_00433

Appendix B example: in 95 percent ofthe observations, the frequency that 1,000 LCFs would be exceeded is less than 4E-6/reactor year; while in half of the observations, the frequency that 1,000 LCFs would be exceeded is less than SE-7/reactor year.

Because of the wide range of the consequences, the CCDFs are plotted with a logarithmic scale on both axes. The distributions typically have long "tails" in both directions. For distributions like this, the mean value often reflects just a few high observations. Such is the case for the early fatalities in Figure B.19.

Above about 150 EFs, the mean value of the sample exceeds the 95th percentile. This means that the mean in this portion of the plot is determined by fewer than 10 observations out of the 200 in the sample.

B.8 Summary In this section, a specific accident at Surry has been followed all the way through a complete analysis, from the initiating event in the accident frequency analysis through to the offsite risk values computed by the consequence analysis. The example selected was a fast SBO accident; the sequence is denoted T1S1-QS-L, and the PDS is TRRR-RSR. To determine the uncertainty in risk, a sample of 200 observations was used for the Surry analysis. Observation 4 was followed in this example, and specific numbers for the important events and parameters for this observation were given above.

This accident is initiated by the LOSP. The emergency DG dedicated to Unit 1 (DGl) fails to start, and the swing DG (DG3) also fails to start, so all ac power is lost, which is designated a station blackout. The only means of heat removal from the reactor core in a station blackout situation is the steam-turbine-driven (STD) AFW train, which operates as designed initially. However, a secondary system safety relief valve fails to close, and the water lost out this valve fails the AFWS in about an hour. Offsite power is not restored by this time, and the plant staff fails to get one of the two DGs capable of supplying power to Unit 1 to start. With the failure of the STD-AFW train, and no ac power to run the motor-driven AFW trains, there is no heat removal from the reactor. The reactor coolant system (RCS) heats up until the pressure forces open the PORVs. Water (steam) loss through the PORVs continues, with the PORVs cycling open and closed, until enough water has been lost to reduce the liquid water level below the top of active fuel.

Without electric power, there is no way to replace the water lost from the RCS. After the water level has dropped some distance below the top of active fuel, the fuel above the water level heats up sufficiently to degrade.

The accident frequency analysis determined the frequency of the initiating events and the probabilities of the other failures that led to this state. The frequency of the initiating event for Observation 4 is

0. 09 9/reactor year, and the frequency of the cut set defined in Table B .1 is 3.4 E-8/reactor year. This cut set was placed with many others in sequence T1S1-QS-L, which has a frequency, for Observation 4, of 2.4E-7/reactor year. Sequence T1S1-QS-L was grouped with other tast station blackout sequences in plant damage state TRRR-RSR, which has a frequency of 4.8E-7/re~ctor year for Observation 4. As TRRR-RSR is the only PDS in PDS group 3, this is also the group frequency.

The core melt process and the response of the containment were treated in the accident progression analysis. Although the most likely outcome for TRRR-RSR was termination of the accident without failure of either the reactor vessel or the containment due to the recovery of offsite power, the path followed through the APET took the branch in which power was not restored in time to avert vessel breach. The RCS was at the PORV setpoint pressure at the start of core degradation since there were no breaks in the system. However, the path through the event tree took the branch in which the RCP seals failed, and the vessel failed with the RCS at intermediate pressure. While high-pressure melt ejection and direct containment heating accompanied the failure of the vessel, the pressure rise in the containment was insufficient to fail the containment. However, the core material attacked the concrete floor of the reactor cavity, and the containment failed by basemat meltthrough many hours after the start of the accident. This path through the event tree is designated accident progression bin FFA-CAC-ABA-CA. For the observation chosen, this bin is the most likely bin that has both vessel breach (VB) and containment failure (CF).

For Observation 4, the evaluation of the APET for PDS group 3 resulted in a conditional probability of 0.017 for bin FFA-CAC-ABA-CA. Bin FFA-CAC-ABA-CA was also generated in evaluating the APET for PDS group 1. The absolute frequency of this bin for both PDS groups, for Observation 4, is

3. 2E-8/reactor year. Only a small portion of this frequency came from the cut set listed in Table B .1.

NUREG-1150 B-70 OAGI0000611 00434

Appendix B In the source term analysis, the release fractions, the timing of the release, and the energy and height of the release were determined for bin FFA-CAC-ABA-CA. These values define the source term. In the partitioning process, the source term for bin FFA-CAC~ABA-CA of Observation 4 was grouped with other similar releases into source term group SUR-49. In the consequence analysis, the offsite consequences of the mean source term for SUR-49 were computed. SUR-49 has such small release fractions that it caused no early fatalities. The total release caused (in this calculation) 113 latent cancer fatalities when averaged over all weather conditions.

Finally, the results of the four constituent analyses were combined to determine risk. For the conse-quences averaged with respect to the weather variability, when all PDS groups and APBs are considered, the contribution of Observation 4 was slightly below the median for early fatalities and near the mean value for latent cancer fatalities. Although bin FFA-CAC-ABA-CA was the most likely bin in Observation 4 that had both vessel breach and containment failure, it was a relatively improbable bin in the entire sample, and its contribution to the risk measures was very small. The position of the CCDFs for Observation 4 is shown in Figure B.19.

B-71 NUREG-1150 OAGI0000611 00435

Appendix B REFERENCES FOR APPENDIX B B.1 R. J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, October 1990.

B.2 D. M. Ericson, Jr., (Ed.) et al., "Analysis of Core Damage Frequency: Internal Events Methodol-ogy," Sandia National Laboratories, NUREG/CR-4550, Vo1.1, Rev. 1, SAND86-2084, January 1990.

B.3 R. C. Bertucio and J. A. Julius, "Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Rev. 1, SAND86-2084, April 1990.

B.4 R. L. Iman and S. C. Hora, "Modeling Time to Recovery and Initiating Event Frequency for Loss of Offsite Power Incidents at Nuclear Power Plants," Sandia National Laboratories, NUREG/

CR-5032, SAND87-2428, January 1988.

B.5 E. D. Gorham-Bergeron et al., "Evaluation of Severe Accident Risks: Methodology for the Accident Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analyses,"

Sandia National Laboratories, NUREG/CR-4551, Vol. 1, Draft Revision 1, SAND86-1309, to be published.

• B.6 F. T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

B.7 J. M. Griesmeyer and L. N. Smith, "A Reference Manual for the Event Progression Analysis Code (EVNTRE)," Sandia National Laboratories, NUREG/CR-5174, SAND88-1607, September 1989.

B.8 T. A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April 1989.

B.9 Steam Explosion Review Group (SERG), U.S. Nuclear Regulatory Commission (USNRC), "A Review of the Current Understanding of the Potential for Containment Failure from In-Vessel Steam Explosions," NUREG-1116, June 1985.

B.10 D. B. Rhodes et al., "Reactor Coolant Pump Shaft Seal Stability During Station Blackout," Chalk River Nuclear Laboratories, NUREG/CR-4821, AECL-9342, May 1987.

B.11 C. A. Kittmer et al., "Reactor Coolant Pump Shaft Seal Behavior During Station Blackout," Idaho National Engineering Laboratory, NUREG/CR-4077, EGG-2365, April 1985.

B.12 C. H. Campen and W. D. Tauche, "Reactor Coolant Pump Seal Performance Following a Loss of All AC Power," Westinghouse Electric Corporation, Nuclear Energy Systems, WCAP-10542, 1986.

B.13 K. D. Bergeron et al., "User's Manual for CONTAIN 1.0, A Computer Code for Severe Reactor Accident Containment Analysis," Sandia National Laboratories, NUREG/CR-4085, SAND84-1204, July 1985.

B.14 K. D. Bergeron et al., "User's Manual for CONTAIN 1.1, A Computer Code for Severe Reactor Accident Containment Analysis," Sandia National Laboratories, NUREG/CR-5026, SAND87-2309, to be published.*

B.15 Fauske and Associates, Inc., "MAAP, Modular Accident Analysis Program User's Manual," Vols.

I and II, IDCOR Technical Report 16.2-3, February 1987.

B.16 M. Pilch and W. W. Tarbell, "Preliminary Calculations of Direct Heating of a Containment Atmosphere by Airborne Core Debris," Sandia National Laboratories, NUREG/CR-4455, SAND85-2439, July 1986.

$Available at the USNRC Public Document Room, 2120 L Street NW., Washington, DC.

NUREG-1150 B-72 OAGI0000611 00436

Appendix B B.17 W. W. Tarbell et al., "Results from the DCH-1 Experiment," Sandia National Laboratories, NUREG/CR-4871, SAND86-2483, June 1987.

B.18 M. Pilch and W. W. Tarbell, "High Pressure Injection of Melt from a Reactor Pressure Vessel-The Discharge Phase," Sandia National Laboratories, NUREG/CR-4383, SAND85-0012, September 1985.

B.19 W. W. Tarbell et al., "Pressurized Melt Ejection into Scaled Reactor Cavities," Sandia National Laboratories, NUREG/CR-4512, SAND86-0153, October 1986.

B.20 D. C. Williams et al., "Containment Loads Due to Direct Containment Heating and Associated Hydrogen Behavior: Analysis and Calculations with the CONTAIN Code," Sandia National Laboratories, NUREG/CR-4896, SAND87-0633, May 1987.

B.21 D. C. Williams and D. L. Y. Louie, "Containment Analysis of Direct Containment Heating Events in the Surry Plant," Proceeding of the American Nuclear Society/European Nuclear Society International Meeting, Thermal-Hydraulics Division (Washington, DC), October 31-November 4, 1988.

B.22 D. C. Williams, Sandia National Laboratories, letter to the NUREG-1150 Loads and Source Term Panels, "CONTAIN Calculations for Some DCH Scenarios in Sequoyah," dated April 6, 1988.

B.23 D. C. Williams et al., "Integrated Phenomenological Analysis of Containment Response to Severe Core Damage Accidents," Progress in Nuclear Energy, 19, 69, 1987.

B.24 L. Pong et al., "Surry S2D Severe Accident Containment Loads Calculations Using HMC,"

University of Wisconsin (Madison), UWRSR-34, March 1986.

B.25 United Engineers & Constructors, "Indian Point Units 2 and 3, Containment Capability Analysis,"

report prepared in support of the Indian Point Probabilistic Safety Study, March 1980.

B.26 W. J. Pananos and C. F. Reeves, "Containment Integrity at Surry Nuclear Power Station," Stone &

Webster Engineering Corp., TP84-13, 1984.

B.27 United Engineers & Constructors, "Containment Ultimate Capacity of Seabrook Station Units 1 &

2 for Internal Pressure Loads," February 1983.

B.28 D. S. Horschel, Sandia National Laboratories, letter to J. F. Costello, USNRC, on the testing of a reinforced concrete containment, dated August 2, 1987.

B.29 Y. R. Rashid et al., "State-of-the-Art Review of Concrete Containment Response to Severe Overpressurization," Transactions of the 9th SMIRT Conference (Lausanne, Switzerland),

August 17-21, 1987.

B.30 R. A. Dameron et al., "Analytical Correlation and Post-Test Analysis of the Sandia 1:6-Scale Reinforced Concrete Containment Test," Fourth Workshop on Containment Integrity (Arlington, VA), June 14-17, 1988.

B.31 S. J. Higgins, "A User's Manual for the Postprocessing Program PSTEVNT," Sandia National Laboratories, NUREG/CR-5380, SAND88-2988, November 1989.

B.32 R. L. Iman and M. J. Shortencarier, "A FORTRAN 77 Program and User's Guide for the Generation of Latin Hypercube and Random Samples for Use with Computer Models," Sandia National Laboratories, NUREG/CR-3624, SAND83-2365, June 1984.

B.33 H. N: Jaw et al., "XSOR Codes User's Manual," Sandia National Laboratories, NUREG/CR-5360, SAND89-0943, to be published.*

B.34 R. A. Lorenz, J. L. Collins, and A. P. Malinauskus, "Fission Product Source Term for the Light Water Reactor Loss-of-Coolant Accident," Nuclear Technology, 46, 404 (1979).

• Available at the USNRC Public Document Room, 2120 L Street NW., Washington, DC.

B-73 NUREG-1150 OAGI0000611 00437

Appendix B B.3S R. A. Lorenz, D. 0. Hobson, and G. W. Parker, "Fuel Rod Failure Under Loss-of-Coolant Conditions in TREAT," Nuclear Technology, 11, 502 (1971).

B.36 USNRC, "Technical Bases for Estimating Fission Product Behavior During LWR Accidents,"

NUREG-0772, June 1981.

B.37 E. L. Tolman et al., "TMI-2 Accident Scenario Update," Idaho National Engineering Laboratory, EGG-TMI-7489, December 1986.

B.38 D. W. Akers and R. K. McCardell, "Fission Product Relocation and Behavior in the TMI-2 Reactor Vessel," Trans. Am. Nuclear Soc., Vol. 57, pp. 418-19, Int. Conf. on Nuclear Fission:

Fifty Years of Progress in Energy Security, and Topical Meeting on TMI-2 Accident: Materials Behavior and Plant Recovery Technology, TANSAO 57, October 30-November 4, 1988.

B.39 J. A. Gieseke et al., "Source Term Code Package: A User's Guide," Battelle Columbus Division, NUREG/CR-4587, BMI-2138, July 1986.

B.40 M. D. Allen et al., "ACRR Source Term Experiment: ST-1," Sandia National Laboratories, NUREG/CR-5345, SAND89-0308, to be published.

• B.41 R. A. Sallach, "Vapor Pressure of Liquid CsOH," Sandia National Laboratories, Reactor Safety Research Semiannual Report, January-June, 1987, NUREG/CR-5039, Vol. 1., SAND87-2411, January 1988.

B.42 J. A. Gieseke et al., "Radionuclide Release under Specific LWR Accident Conditions," Battelle Columbus Laboratory, Vols. I-VI, BMI-2104, July 1983-July 1984.

B.43 R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios,"

Battelle Columbus Division, NUREG/CR-4624, Vols. 1-5, BMI-2139, July 1986.

B.44 H. Bunz et al., "NAUA Mod4," Kerforschungzentrum Karlsruhe, KfK-3554, West Germany, 1983.

B.45 R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios:

Supplemental Calculations," Battelle Columbus Division, NUREG/CR-4624, Vol. 6, BMI-2139, August 1990.

B.46 M. Khatib-Rahbar et al., "On the Uncertainties in Core Melt Progression, Fission Product Release, and Pressurization Loads for a BWR with Mark I Containment," Brookhaven National Laboratory, Draft BNL Technical Report A-3286, 1988.

B.47 E. Fuller, Electric Power Research Institute, letter to D. C. Williams, Sandia National Laboratories, on the decontamination factor of the Peach Bottom reactor building and fission product release from corium during core-concrete interaction, dated March 14, 1988.

B.48 S. E. Dingman et al., "Analysis of Peach Bottom Station Blackout with MELCOR," Proceedings of the 14th Water Reactor Safety Information Meeting (Gaithersburg, MD), NUREG/CP-0082, SAND86-2129C, February 1987.

B.49 R. M. Summers et al., "MELCOR In-Vessel Modeling," Proceedings of the 15th Water Reactor Safety Information Meeting (Gaithersburg, MD), NUREG/CP-0091, February 1988.

B.SO S. E. Dingman et al., "MELCOR Analyses for Accident Progression Issues," Sandia National Laboratories, NUREG/CR-5331, SAND89-0072, to be published.

• B.51 H. A. Morewitz et al., "Results of the GREST Code Comparison Exercise," Committee on the Safety of Nuclear Installations, Organisation for Economic Co-operation and Development, Nuclear Energy Agency, Paris, France, CSNI Report 116, 1986.

• Available at the USNRC Public Document Room, 2120 L Street NW., Washington, DC.

NUREG-1150 B-74 OAGI0000611 00438

Appendix B B.52 American Nuclear Society, "Report of the Special Committee on Source Terms," September 1984.

B.53 W. Schock, "General Valuation of the Results of the DEMONA Program," presentation at the DEMONA Final Colloquium, Kernforschungszentrum Karlsruhe, West Germany, June 1987.

B.54 P. Pasanen et al., "Behavior of Hygroscopic Aerosols: Test Results on Sedimentation in Tubes,"

Electric Power Research Institute, LACE TR-030, 1987.

B. 55 "Evaluation of Empirical Aerosol Correlations," performed by Rockwell International Corp.,

published by Electric Power Research Institute, EPRI NP-4927, 1985.

B.56 R. J. Lipinski et al., "Uncertainty in Radionuclide Release Under Specific LWR Accident Conditions," Sandia National Laboratories, SAND84-0410, Vols. 1-4, Draft, February-December 1985.

B.57 USNRC, "Reactor Risk Reference Document," NUREG-1150, Vols. 1-3, Draft for Comment, February 1987.

B.58 R. L. Iman et al., "PARTITION! A Program for Defining the Source Term/Consequence Analysis Interface in the NUREG-1150 Probabilistic Risk Assessments," Sandia National Laboratories, NUREG/CR-5253, SANDSS-2940, May 1990.

B.59 D. I. Chanin, H. N. Jow, J. A. Rollstin et al., "MELCOR Accident Consequence Code System (MACCS)," Sandia National Laboratories, NUREG/CR-4691, Vols. 1-3, SAND86-1562, Febru-ary 1990.

B-75 NUREG-1150 OAGI0000611 00439

APPENDIX C ISSUES IMPORTANT TO QUANTIFICATION OF RISK OAGI0000611 00440

CONTENTS Page C.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1 C.1.1 Description of Table C.1.1; Variables Sampled in Accident Frequency Analysis . . . . . . . . . . ................................................. C-3 C.1.2 Description of Table C.1.2; Questions in Surry APET . . . . . . . . . . . . . . . . . . . . . C-7 C.1.3 Description of Table C.1.3; Variables Sampled in Source Term Analysis . . . . . . C-12 REFERENCES FOR SECTION C.l................................................ C-13 C.2 Common-Cause and Dependent Failures....................................... C-15 C.2.1 Issue Definition ........................................... 0......... C-15 C.2.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-16 C.2.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-18 REFERENCES FOR SECTION C.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-20 C.3 Human Reliability Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-21 C.3.1 Issue Definition..................................................... C-21 C.3.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-21 C.3.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-22 REFERENCES FOR SECTION C.3................................................ C-23 C.4 Hydrogen Combustion Prior to Reactor Vessel Breach . . . . . . . . . . . . . . . . . . . . . . . . . . . C-24 C.4.1 Issue Definition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-25 C.4.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-27 C.4.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-33 REFERENCES FOR SECTION C.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-41 C.S PWR Containment Loads During High-Pressure Melt Ejection . . . . . . . . . . . . . . . . . . . . . C-42 C.5 .1 Issue Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-43 C.5 .2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-49 C.5.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-57 C.5.4 Differences in Treatment of HPME and DCH Between First and Second Drafts of NUREG-1150 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-61 REFERENCES FOR SECTION C.S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-62 C.6 Mechanisms for PWR Reactor Vessel Depressurization Prior to Vessel Breach . . . . . . . . C-64 C. 6.1 Issue Definition .. : . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-64 C.6.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-65 C.6.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-69 REFERENCES FOR SECTION C.6................................................ C-71 C. 7 Drywell Shell Meltthrough . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-73 C. 7.1 Issue Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-73 C. 7.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-76 C.7 .3 Treatment in PRA and Results .................................... 0 * * *

• C-80 REFERENCES FOR SECTION C. 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-81 iii NUREG-1150 OAGI0000611 00441

Page C.8 Containment Strength Under Static Pressure Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-83 C.8.1 Issue Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-83 C.8.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-84 C.8.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-89 REFERENCES FOR SECTION C.8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-92 C. 9 Containment Failure as a Result of Steam Explosions . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-94 C.9.1 Issue Definition.... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-94 C.9.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-96 C.9.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-99 REFERENCES FOR SECTION C.9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-101 C.lO Source Term Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-102 C.10.1 Issue Definition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-102 C.10.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-103 C.10.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-103 REFERENCES FOR SECTION C.10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-110 C.11 Analysis of Seismic Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-111 C.11.1 Issue Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-111 C.11.2 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-121 REFERENCES FOR SECTION C.11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-126 C.12 Analysis of Fire Issue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-128 C.12.1 Analysis Procedure for NUREG-1150 Fire Analysis . . . . . . . . . . . . . . . . . . . . . . . C-128 C.12.2 PRA Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-128 C.12.3 Issue Definition and Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-130 REFERENCES FOR SECTION C.12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-133 C.13 Containment Bypass Sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-134 C.13.1 ISLOCAs-Accident Sequence Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-134 C.13.2 ISLOCAs-Source Term Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-135 C.13.3 SGTRs-Accident Sequence Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-137 C.13.4 SGTRs-Source Term Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-139 REFERENCES FOR SECTION C.13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-141 C.14 Reactor Coolant Pump Seal Failures in Westinghouse Plants After Loss of All Seal Cooling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-14 2 C.14.1 Issue Definition ..... : ...............................................

• C-142 C.14.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-142 C.14.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-144 REFERENCES FOR SECTION C.14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-151 NUREG-1150 iv OAGI0000611 00442

Page C.15 Zion Service Water and Component Cooling Water Upgrade ..................... . C-152 C.15 .1 Issue Definition .................................................... . C-152 C.15.2 Issue Analysis ..................................................... . C-152 C.15.3 Issue Quantification and Results ...................................... . C-153 C.15.4 Impact of Issues on Risk ............................................ . C-153 REFERENCES FOR SECTION C.15 .............................................. . C-154 FIGURES C.1.1 Example of NUREG-1150 "issue decomposition" ............................. . C-2 C.4.1 Cross section of Sequoyah containment ..................................... . C-28 C.4.2 Cross section of Grand Gulf containment .................................... . C-30 C.4.3 Ignition frequency as a function of initial hydrogen concentration in the Grand Gulf containment building (outer containment-wetwell region for accident progressions in which the RPV is at high pressure). . .......................... . C-31 C.4.4 Ignition frequency for various regions of the Sequoyah containment-illustrated for an assumed initial hydrogen concentration between 5.5 and 11 volume percent C-32 C.4.5 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and high initial steam concentrations) ......................................................... . C-34 C.4.6 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and low initial steam concentrations) ......................................................... . C-35 C.4.7 Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (fast station blackout scenarios with various levels of in-vessel cladding oxidation) ....................................... . C-36 C.4.8 Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (slow station blackout accidents with induced reactor coolant pump seal LOCA and various levels of in-vessel cladding oxidation) C-37 C.4.9 Frequency of hydrogen detonations in Grand Gulf containment (probability of a detonation per combustion event-i.e., given ignition). H and L refer to high and low steam concentrations, respectively ................................... . C-38 C.4.10 Frequency of hydrogen detonations in Sequoyah ice condenser or upper plenum (probability of a detonation per combustion event) ............................ . C-39 C.5.1 Cross section of Surry Unit 1 containment ................................... . C-44 C.5.2 Cross section of Zion Unit 1 containment ................................... . C-45 C.5.3 Calculated containment peak pressure as a function of molten mass ejected (Ref. C.5.8) ........................................................... . C-48 C.5.4 Example display of distributions for containment loads at vessel breach versus static failure pressure .................................................... . C-50 C.5.5 Surry containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity) ........................ . C-52 C.5.6 Surry containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity) ...................... . C-53 v NUREG-1150 OAGI0000611 00443

Page C.S.7 Surry containment load distributions generated by composite *of individual experts for each of the cases shown in Figure C.5.5 ................................. . C-54 C.5.8 Zion containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity) ........................ . C-55 C.5.9 Zion containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity) ...................... . C-56 C.S.10 Sequoyah containment loads at vessel breach; cases involving vessel breach at

~igh pressure. with co~t~inment sprays operating (wet cavity) and a substantial mventory of 1ce remarmng ................................................ . C-58 C.5.11 Sequoyah containment loads at vessel breach; cases involving vessel breach at

~igh pressure. without .c~mtainment sprays operating (dry cavity) and a substantial 1nventory of 1ce rematrung ................................................ . C-59 C.5.12 Sequoyah containment loads at vessel breach; cases involving vessel breach at high ~ressure with~ut conta~!Dent sprays operating (dry cavity) and a negligibly small 1nventory of tee remamtng ........................................... . C-60 C.6.1 Aggregate distribution for frequency of temperature-induced hot leg failure (Surry, Zion, and Sequoyah) .................................................... . C-67 C.6.2 Aggregate distributions for frequency of temperature-induced steam generator tube rupture ........................................................... . C-68 C.7.1 Configuration of Peach Bottom drywell shell/floor-vertical cross section ........... . C-74 C.7.2 Configuration of Peach Bottom drywell shell/floor-horizontal cross section ........ . C-75 C.7.3 Aggregate cumulative conditional probability distributions for Peach Bottom drywell shell meltthrough ....................................................... . C-78 C.7.4 Cumulative probability distributions composite of individuals on expert panel for this issue. (Six panelists (6 curves) are shown for each of four cases.) ............ . C-79 C.8.1 Containment failure pressure .............................................. . C-86 C.9.1 Frequency of alpha-mode failure conditional upon core damage ................. . C-100 C.1 0.1 In-vessel release distribution, PWR case with low cladding oxidation . . . . . . . . . . . . . . . C-1 0 5 C.10.2 RCS transmission fraction, PWR case at system setpoint pressure . . . . . . . . . . . . . . . . . C-106 C.10.3 RCS transmission fraction, PWR case with low system pressure . . . . . . . . . . . . . . . . . . . C-107 C.10.4 Revaporization release fraction for iodine, PWR case with two holes . . . . . . . . . . . . . . . C-109 C.11.1 Model of seismic hazard analysis............................................ C-112 C.11.2 LLNL hazard curves for Peach Bottom site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-114 C.11.3 10000-year return period uniform hazard spectra for Peach Bottom site ........... . C-115 C.11.4 Example of logic-tree format used to represent uncertainty in hazard analysis input (EPRI program) ................................................... . C-116 C.11. 5 EPRI hazard curves for Peach Bottom site ................................... . C-117 C.11.6 Surry external events, core damage frequency ranges (5th and 95th percentiles) .... . C-119 C.11.7 Peach Bottom external events, core damage frequency ranges (5th and 95th percentiles) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-120 C.11. 8 Contribution from different earthquake ranges at Peach Bottom ................. . C-125 C.11. 9 Mean plant level fragilities ................................................ . C-126 NUREG-1150 vi OAGI0000611 00444

Page C.14.1 Westinghouse RCP seal assembly (Ref. C.14.1) ............................... . C-143 C.14.2 Decision tree (Ref. C.14.1) ............................................... . C-144 TABLES C.1.1 Variables sampled in accident frequency analysis for internal initiators ............. . C-3 C.1.2 Questions in Surry APET ................................................. . C-9 C.1.3 Variables sampled in source term analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-12 C.2.1 Beta factor analysis for pumps-based on Fleming data ........................ . C-17 C.2.2 Beta factor analysis for valves-based on Fleming data ......................... . C-17 C.2.3 Beta factor models from EPRI NP-3967 .................................... . C-19 C.2.4 Risk-reduction measures for selected common-cause events in Surry and Peach Bottom analysis ................................................... . C-19 C.2.5 Results of sensitivity study in which common-cause failures were eliminated from fault trees ............................................................. . c. . zo C.3.1 Representative ranges of human error uncertainties (taken from Grand Gulf analysis) ............................................................... . C-22 C.3.2 Core damage frequencies with and without human errors ....................... . C-23 C.5.1 Mean conditional probability of containment failure for three PWRs .............. . C-61 C.6.1 Surry reactor vessel pressure at time of core uncovery and at vessel breach ........ . C-70 C.6.2 Surry reactor vessel pressure at time of core uncovery and at vessel breach (sensitivity study without induced hot leg failure and steam generator tube ruptures) .. C-70 C.6.3 Fraction of Surry slow blackout accident progressions that results in various modes of containment failure (mean values). . ..................................... . C-71 C.6.4 Fraction of Sequoyah accident progressions that results in HPME and containment overpressure failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-71 C.7.1 Probability of drywell shell meltthrough (conditional on a core damage accident of various types) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. C-81 C.8.1 Containment strength under static pressure loads: summary information ........... . C-91 C.10.1 APS recommendations for source term research (Ref. C.10.3) .................. . C-102 C.10.2 Source term issues ...................................................... . C-104 C.11.1 Seismic core damage and release frequencies from published probabilistic risk assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-112 C.11.2 Core damage frequencies ................................................. . C-122 C.11. 3 Comparison of contributions of modeling uncertainty in response, fragility, and hazard curves to core damage frequency .................................... . C-123 C.11.4 Dominant sequences at Peach Bottom ...................................... . C-124 vii NUREG-1150 OAGI0000611 00445

Page C.12.1 Dominant Surr)l: fire area core damage frequency contributors (core damage frequency/yr) (Ref. C.12.7) ............................................... . C-129 C.12.2 Dominant Peach Bottom fire area core damage frequency contributors (core damage frequency/yr) (Ref. C.12.8) ........................................ . C-129 C.12.3 Dominant Surry accident sequence core damage frequency contributors (Ref. C.12.7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-131 C.12.4 Dominant Peach Bottom accident sequence core damage frequency contributors (Ref. C.12.8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-131 C.13.1 Secondary side safety valve failure probabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-138 C.14.1 Aggregated RCP seal LOCA probabilities for Westinghouse three-loop plant.... . . . . . C-145 C.14.2 Aggregated RCP seal LOCA probabilities for Westinghouse four-loop plant . . . . . . . . . C-146 C.14.3 Sequoyah RCP seal LOCA model scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-148 C.14.4 Sequoyah RCP seal LOCA model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-150 C.15.1 Plant damage state comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-153 C.15.2 Comparison of mean risk values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-154 NUREG-1150 viii OAGI0000611 00446

Appendix C C.l Introduction It is well known that the methods of probabilistic risk assessment (PRA) have many kinds of uncertainties associated with them. To a varying extent, these uncertainties contribute to the imprecision in the estimates of risk to public health and safety from nuclear reactor accidents. The NRC contractor work underlying this report (Refs. C.1.1 through C.1.14) addresses many of these uncertainties and quantifies their impact on selected measures of risk. The method to incorporate uncertainties in the quantification of reactor risk involves identifying uncertainty "issues." In this context, an issue is a physical parameter, process, or event that cannot be characterized precisely but is potentially important to the frequency of core damage or to severe accident progression. Examples are operator error rates, hydrogen generation during core meltdown, and direct containment heating.

The total number of issues that was considered in the present analyses is quite large. A complete description of all issues is available in the contractor reports. To give the reader a feel for what information is available, three tables and the description of those tables from the Surry analysis (Ref.

C.1.10) have been included in this section.

This appendix summarizes the way in which a few important issues were treated in the five PRAs addressed in this report. In this context, "important" refers to subjective judgments made by the NRC staff and its contractors (based on results of the detailed analyses) that a particular issue has substantial influence on the quantification of risk. The objective of these descriptions is twofold:

1. To provide an answer to the following question: What aspects of the knowledge base supporting probabilistic risk assessment for nuclear power reactors are the principal contributors to our inability to precisely calculate risk?

2. To describe how areas known from previous work to have substantial uncertainty were addressed in the analyses described in NUREG-1150.

It should be noted that issues contributing to the uncertainty in risk are not necessarily significant contributors to a particular estimate of reactor risk. For example, issues that are threshold in nature (e.g.,

those governing the outcome of an event that either occurs or does not occur) can be important contributors at one end of the spectrum of risk estimates, yet be an insignificant contributor to risk estimates at the opposite end of the spectrum. Such issues may not even be major contributors to the mean value of risk. It is important to identify these issues-particularly those that contribute to estimates of risk near the high end of the spectrum. Improvements in the precision with which reactor risk analysis can be performed may be achieved by focusing future research on topics that are major contributors to the uncertainty in risk. Confidence that a selected measure of reactor risk is below some value can be improved by focusing research on topics that contribute to estimates of risk near the upper end of the spectrum.

Issues important to risk uncertainty are described in the following sections, which are organized in a similar fashion. First, an issue is defined in the context of its application within the risk analyses in this study. Since most issues are relatively high-level representations of uncertainty (i.e., they represent a composite of several interrelated sources of uncertainty), the specific source(s) of uncertainty included within each issue are delineated as part of the definition. The process of characterizing the contributing factors to the uncertainty associated with an issue is termed "issue decomposition." An example of issue decomposition is provided in Figure C.1.1, which considers the hypothetical issue of containment bypass.

Underlying this hypothetical issue are a variety of more basic events and processes. Each of these may have an associated uncertainty. Quantification of the uncertainty associated with the main issue, therefore, involves the aggregation of uncertainties of several interrelated items. This process can become quite complicated and is not addressed in detail in this appendix. A summary of each issue's quantification and the technical basis that supports this quantification is provided. For greater detail regarding issue decomposition and quantification of individual contributors to uncertainty, the reader is referred to References C.1.1 through C.1. 7 for issues related to estimating core damage frequency and References C.1.8 through C.1.14 for issues related to accident progression and consequences. Finally, the manner in which an issue was incorporated in the PRA(s) is described. Results of statistical analyses and other indicators of an issue's importance to risk uncertainty are presented.

C-1 NUREG-1150 OAGI0000611 00447

Appendix C Containment Bypass

~

Pre-Existing Induced Steam Generator Isolation Isolation Tube Rupture Failures Failures l nitiating Test and Maint. Errors

~ Transients - Events 1-Indication Failures

~

Water Hammer - Result of Core Damage -

Random Thermal-Hydraulic Aging ~ ~

~

Failures Aspects Operator 1-Actions Figure C.l.l Example of NUREG-1150 "issue decomposition."

NUREG-1150 C-2 OAGI0000611 00448

Appendix C C.l.l Description of Table C.l.l; Variables Sampled in Accident Frequency Analysis In the accident frequency analysis for internal events, a large number of variables were sampled. (A list of these variables may be found in Ref. C.1.3.) Only those variables found to be important to the uncertainty in the accident frequencies were selected for sampling in the integrated risk analysis. These variables are listed and defined in Table C.1.1. For the regression analysis, identifiers of eight characters or less were required, and these are listed in the first column. Where these differ from the identifiers used in the fault trees, these identifiers are listed in the description in brackets. Generally, the eight-character identifiers have been selected to be as informative as possible to those not familiar with the conventions used in systems analysis. For example, while Event K is commonly used to indicate the failure of the reactor protection system (RPS) to insert enough control rods to make the reactor subcritical, the identifier AU-SCRAM was chosen since it was felt that "auto scram" conveys more meaning to most readers than "K."

The second column in Table C.1.1 gives the range of the distribution for the variable, and the third column indicates the type of distribution used and its mean value. The entry "Experts" for the distribution indicates that the distribution came from the accident frequency analysis expert panel. The fourth and fifth columns in Table C.1.1 show whether the variable is correlated with any other variable, and the last column describes the variable. More complete descriptions and discussion of these variables may be found in the Surry accident frequency analysis report (Ref. C.1.3). This report also gives the source or the derivation of the distributions for all these variables.

Only two accident frequency variables were correlated in the integrated analysis. As indicated in Table C.1.1, DG-FRUN1 and DG-FRUN6 were correlated with each other since they represent failures to run for different times for the same equipment. The failures to run for the steam-turbine-driven auxiliary feedwater (AFW) pump (ATP-FR6 and ATP-FR24) should have been correlated for the same reason, but this correlation was omitted because of an oversight. Neither of the AFW pump failure-to-run variables was important in determining the uncertainty in risk, so the effect of omitting the correlation between them is not significant.

Table C.l.l Variables sampled in accident frequency analysis for internal initiators.

Correlation Variable Range Distribution Correlation With Description V-TRAIN 1.8E-13 Experts None Initiating event: frequency 1.5E-5 Mean=5.5E-7 (1/yr) of check valve failure in one of the LPIS trains.

IE-LOSP 2.6E-S LOSP Data None Initiating event: frequency 0.28 Mean=0.077 (1/yr) of LOSP. [IE-T1]

IE-A S.OE-5 Lognormal None Initiating event: frequency 0.0032 Mean=SE-4 (1/yr) of a large (dia. > 6 in.)

break in the RCS (LOCA).

IE-Sl l.OE-4 Lognormal None Initiating event: frequency 0.0063 Mean=0.001 (1/yr) of an intermediate size (6 in. > dia. > 2 in.) LOCA.

IE-S2 LOE-4 Lognormal None Initiating event: frequency 0.0063 Mean=0.001 (1/yr) of a small break (2 in. >

dia. > 0.5 in.) in the RCS.

IE-S3 0.0013 Lognormal None Initiating event: frequency 0.082 Mean=0.013 (1/yr) of a very small (0.5 in.

> dia.) break in the RCS (LOCA).

C-3 NUREG-1150 OAGI0000611 00449

Appendix C Table C.l.l (continued)

Correlation Variable Range Distribution Correlation With Description IE-T-ALL 0.67 Lognormal None Initiating event: frequency 41.6 Mean=6.6 (1/yr) of all transients that require scram (Surry data).

[IE-T]

lE-T-HIP 0.60 Lognormal None Initiating event: frequency 37.2 Mean=5.9 (1/yr) of all transients from high (>25%) power that require scram (Surry data).

[IE-TN]

IE-LMFWS 0.096 Lognormal None Initiating event: frequency 5.9 Mean;;::Q.94 (1/yr) of transients due to loss of the main feedwater system (Surry data). [IE-T2)

IE-SGTR 0.001 Lognormal None Initiating event: frequency 0.063 Mean=O.Ol (1/yr) of SGTRs (PWR data).

[IE-T7]

IE-DCBUS 2.5E-5 Lognormal None Initiating event: frequency 0.14 Mean=O.OOS (1/yr) for loss of a de power bus. [IE-TSJ DG-FRUN1 9.9E-6 Lognormal Rank 1 DG-FRUN6 Probability that the diesel 0.057 Mean=0.002 generator fails to run for 1 h, given that it starts.

[DGN-FR-1HR]

DG-FRUN6 6.0E-5 Lognormal Rank 1 DG-FRUN1 Probability that the diesel 0.34 Mean=0.012 generator fails to run for 6 h, given that it starts.

[DGN-FR-6HR]

DG-FSTRT 0.0022 Lognormal None Probability that the diesel 0.14 Mean=0.022 generator fails to start, given a demand to start. [DGN-FS]

UNFV-MOD 1.8E-4 Lognormal None Fraction of the time that the 0.27 Mean=0.014 reactor operates with an unfavorable moderator temperature coefficient. [Z]

AU-SCRAM 1.8E-6 Lognormal None Probability of failure of the 7.6E-4 Mean=6E-5 RPS to automatically insert sufficient control rods to terminate the reaction. [K)

MN-SCRAM 0.017 Max. Entropy None Probability of failure to effect 1.0 Mean=0.17 manual scram due to operator error and hardware faults. [R]

AUTO-ACT 4.8E-5 Lognormal None Probability of failure of one 0.020 Mean=0.0016 train of an automatic actuation system (generic). [ACT-FA)

NUREG-1150 C-4 OAGI0000611 00450

Appendix C Table C.l.l (continued)

Correlation Variable Range Distribution Correlation With Description CCF-RWST 1.5E-6 Lognormal None Probability of common-cause 0.0085 Mean=3E-4 failure of the recirculation mode transfer system due to miscali-bration of the water level sensors in the RWST (human error). (RMT-CCF-FA-MSCAL]

BETA2MOV 0.0089 Lognormal None Beta factor for common-cause 0.55 Mean=0.088 failure of two motor-operated valves (generic). [BETA-2MOV]

BETA-AFW 0.0057 Lognormal None Beta factor for common-cause 0.35 Mean=0.056 failure of the AFWS motor-driven pumps (generic).

BETA-LPI 0.015 Lognormal None Beta factor for common-cause 0.94 Mean=0.15 failure of the LPIS pumps (generic).

AFW-STMB 2.0E-8 Lognormal None Probability of common-cause 0.0070 Mean=l.OE-4 failure of all AFWS due to steam binding (backleakage through check valves from MFWS). [CCF-LK-STMBD]

MDP-FSTR 1.5E-5 Lognormal None Probability of failure to start 0.085 Mean=0.003 (per demand) for motor-driven pumps for which specific plant data were not available (generic). [MDP-FS]

AFWMP-FS 6.4E-4 Lognormal None Probability of failure to start 0.040 Mean=0.0063 (per demand) for AFW motor-driven pumps (from Surry data). [AFW-MDP-FS-FW3B]

AFWTP-FS 5.5E-5 Lognormal None Probability of failure to start 0.31 Mean=O.Oll (per demand) for AFW steam-turbine-driven pump (from Surry data). [TDP-FS]

ATP-FR6 1.5E-4 Lognormal None Probability of failure to run for 0.85 Mean=0.030 6 h for the AFW steam-turbine-driven pump (generic) .

[TDP-FR-6HR]

ATP-FR24 0.01 Max. Entropy None Probability of failure to run for 1.0 Mean=0.12 24 h for the AFW steam-turbine-driven pump (generic).

[TDP-FR-24HR]

PORV-BLK 0.0041 Lognormal None Probability of failure to open 0.25 Mean=0.040 (per demand) for the PORV block valves (MOVs).

[PPS-MOV-FT]

C-5 NUREG-1150 OAGI0000611 00451

Appendix C Table C.l.l (continued)

Correlation Variable Range Distribution Correlation With Description LPRS-MOV 2.6E-5 Lognormal None Probability of failure (per 0.15 Mean=O.OOS2 demand) for the suction MOVs in the LPRS due to hardware failures or plugging.

[LPR-MOV-FT]

MOV-FT 1.5E-5 Lognormal None Probability of failure to transfer 0.085 Mean=0.003 (per demand) for motor-operated valves (generic).

MNV-PG1 4.1E-6 Lognormal None Probability of failure due to 2.SE-4 Mean=3.6E-S plugging for manual valves that are flow-tested every month (generic). [XVM-PG-1MOJ MOV-PG3 LOE-5 Lognormal None Probability of failure due to 6.3E-4 Mean=l.OE-4 MOVs that are flow-tested every 3 months (generic).

[MOV-PG-3MO]

MOV-PG12 4.5E-5 Lognormal None Probability of failure due to 0.0028 Mean=4.4E-4 plugging for MOVs that are flow-tested every 12 months (generic). [MOV-PG-12MO]

AFW-OCC 1.5E-5 Lognormal None Probability of common-cause 9.5E-4 Mean=1.5E-4 failure of AFWS due to an inadvertently open crossconnect to Unit 2 (flow diversion).

[AFW-PSF-FC]

PORV-REC 1.5E-4 Lognormal None Probability of failure of the 0.85 Mean=0.030 pressurizer PORVs to reclose after opening (generic) .

[SOV-00]

SSRVO-SB 0.030 Max. Entropy None Probability of failure of an SG 1.0 Mean=0.27 SRV to reclose within 1 h during SBO (faulted steam generator). [QS-SBO]

SSRVO-U2 0.016 Max. Entropy None Probability of failure of a 1.0 Mean=0.16 secondary system SRV at Unit 2 to reclose within 1 h during SBO at both units.

[QS-UNIT2]

SOV-FT LOE-4 Lognormal None Probability of failure to transfer 0.0063 Mean=0.001 (per demand) for solenoid-operated valves (generic).

CKV-FT LOE-5 Lognormal None Probability of failure to open 6.3E-4 Mean=lE-4 (per demand) for check valves (generic).

NUREG-1150 C-6 OAGI0000611 00452

Appendix C Table C.l.l (continued)

Correlation Variable Range Distribution Correlation With Description HE-FDBLD 0.0071 Max. Entropy None Probability of failure of the 0.71 Mean=0.071 operator to initiate feed and bleed (human error-open PORVs, and start charging pump and align suction and discharge valves) .

[HPI-XHE-FO-FDBLD I HE-PORVS 0.0044 Max. Entropy None Probability of failure of the 0.44 Mean=0.044 operator to initiate feed and bleed (human error; diagnose situation and open PORVs).

[PPS-XHE-FO-PORVSJ HE-CST2 0.0065 Max. Entropy None Probability of failure of the 0.65 Mean=0.065 operator to align the AFWS suction to the backup CST during an SBO with a faulted SG. [AFW-XHE-FO-CST2]

HE-UNIT2 0.0036 Max. Entropy None Probability of failure of the 0.36 Mean=0.036 operator to provide AFW from Unit 2 via the crossconnect.

[XHE-FO-UNIT2]

HE-SKILL 1.3E-5 Lognormal None Probability of human error for 0.077 Mean=0.0026 skill-based human errors (rudimentary actions performed from memory).

[XHE-FO-SKILLBASE]

RCP-SL-F Experts None Probability of RCP seal failure before the onset of core damage.

C.l. 2 Description of Table C.I.2; Questions in Surry APET In addition to the number and name of the question, Table C.1.2 indicates if the question is sampled, and how the question is evaluated or quantified. In the sampling column, an entry of DS indicates that the sampling is from a distribution provided by one of the expert panels, or from the electric power recovery distribution. The item sampled may be either the branching ratios or the parameter defined at that question. For questions that are sampled and that were quantified internally, the entry ZO in the sampling column indicates that the question was sampled zero-one, and the entry SF means the questions were sampled with split fractions. The difference may be illustrated by a simple example. Consider a question that has two branches and a uniform distribution from zero to 1. 0 for the probability for the first branch.

If the sampling is zero-one, in half of the observations the probability for the first branch will be 1.0, and in the other half of the observations it will be zero. If the sampling is split fraction, the probability for the first branch for each observation is a random fractional value between zero and 1.0. The average over all the fractions in the sample is 0.50. The implications of ZO or SF sampling are discussed in Reference C.1.8.

If the sampling column is blank, the branching ratios for that question, and the parameter values defined in that question, if any, are fixed. The branching ratios of the plant damage state (PDS) questions change C-7 NUREG-1150 OAGI0000611 00453

Appendix C to indicate which PDS is being considered. Some of the branching ratios depend on the relative frequency of the PDSs that make up the PDS group being considered. These branching ratios change for every sample observation but may do so for some PDS groups and not for others. If the branching ratios change from observation to observation for any one of the seven PDS groups, SF is placed in the sampling column for the PDS questions.

The abbreviations in the quantification column of Table C.1.2 are given below, with the number of questions that have that type of quantification.

Type of Number of Quantification Questions Comments PDS 11 Determined by the PDS AcFrqAn 1 Determined in the accident frequency analysis Other 4 See Notes 1 through 4 Internal 17 Quantified internally in this analysis Summary 17 The branch taken at this question follows directly from the branches taken at previous questions ROSP 3 The probability of the recovery of offsite power is determined by distributions derived from the electric power recovery data for this plant UFUN-Str. 3 Calculated in the User Function, using distributions from the structural response expert panel UFUN-Int. 2 Calculated in the User Function, using an adiabatic pressure rise calculation determined internally In-Vessel 5 Distributions from the in-vessel accident progression expert panel Loads 2 Distributions from the containment loadings expert panel Struct. 1 Distribution from the containment structural performance expert panel N.A. 5 Fan cooler questions not applicable to Surry In some cases, a question may have more than one function so the entry under Quantification in Table C.1.2 can be only indicative. For example, Questions 43, 52, and 64 are listed as being quantified by the user function, based on distributions generated by the containment structural performance expert panel.

The actual situation is that a portion of the user function is evaluated which determines whether the containment fails using the load pressure and the failure pressure. The load pressure is determined in Questions 39 and 40 based on aggregate distributions from the containment loadings expert panel. The containment failure pressure is determined in Question 42 from the aggregate distributions from the containment loadings expert panel. If the failure pressure is lower than the load pressure, then the containment fails and the mode of failure is determined using the random number defined in Question 42 and a table of conditional failure mode probabilities contained in the user function. This table was also generated by the containment structural performance expert panel. The sampling is indicated to be zero-one because one of the four branches of these questions always has a probability of 1.0, and the other three always have a probability of zero.

NUREG-1150 C-8 OAGI0000611 00454

Appendix C Table C.l.2 Questions in Surry APET.

Question Number Question Sampling Quantification

1. Size & location of RCS break when the core uncovers? SF PDS

2. Has the reaction been brought under control? SF PDS

3. For SGTR, are the secondary system SRVs stuck open? SF PDS

4. Status of ECCS? SF PDS

5. RCS depressurization by the operators? SF PDS

6. Status of sprays? SF PDS

7. Status of fan coolers? N.A.

8. Status of ac power? PDS

9. RWST injected into containment? SF PDS

10. Heat removal from the steam generators? SF PDS

11. Did the operators depressurize the secondary before the SF PDS core uncovers?

12. Cooling for RCP seals? SF PDS

13. Initial containment condition? AcFrqAn

14. Event V-break location under water? SF Note 1

15. RCS pressure at the start of core degradation? Summary

16. Do the PORVs stick open? SF Note 2

17. Temperature-induced RCP seal failure? zo Note 3

18. Is the RCS depressurized before breach by opening Internal the pressurizer PORVs?

19. Temperature-induced SGTR? DS In-Vessel

20. Temperature-induced hot leg or surge line break? DS In-Vessel

21. Is ac power available early? SF ROSP

22. Rate of blowdown to containment? Summary

23. Vessel pressure just before vessel breach? zo Internal

24. Is core damage arrested? No vessel breach? SF Internal

25. Early sprays? Summary

26. Early fan coolers? N.A.

27. Early containment heat removal? Summary

28. Baseline containment pressure before VB? Internal

29. Time of accumulator discharge? Summary

30. Fraction of zirconium oxidized in-vessel during core p In-Vessel degradation?

31. Amount of zirconium oxidized in-vessel during core Summary degradation?

32. Amount of water in the reactor cavity at vessel breach? Summary C-9 NUREG-1150 OAGI0000611 00455

Appendix C Table C.1.2 (continued)

Question Number Question Sampling Quantification

33. Fraction of core released from the vessel at breach? p In-Vessel

34. Amount of core released from the vessel at breach? Summary

35. Does an alpha event fail both vessel & containment? SF Note 4

36. Type of vessel breach? zo In-Vessel

37. Does the vessel become a "Rocket" and fail the cont.? Internal

38. Size of hole in vessel (after ablation)? zo Internal

39. Total pressure rise at vessel breach? Large hole cases p Loads

40. Total pressure rise at vessel breach? Small hole cases p Loads

41. Does a significant ex-vessel steam explosion occur? Internal

42. Containment failure pressure? p Struct.

43. Containment failure and type of failure? zo UFUN-Str.

44. Sprays after vessel breach? Internal

45. Is ac power available late? SF ROSP

46. Late sprays? Summary

47. Late fan coolers? N.A.

48. Late containment heat removal? Summary

49. How much hydrogen burns at vessel breach? SF Internal

50. Does late ignition occur? Internal

51. Resulting pressure in containment? UFUN-Int.

52. Containment failure and type of failure? zo UFUN-Str.

53. Amount of core available for CCI? Summary

54. Is the debris bed in a coolable configuration? Internal

55. Does prompt CCI occur? Summary

56. Is ac power available very late? SF ROSP

57. Very late sprays? Summary

58. Very late fan coolers? N.A.

59. Very late containment heat removal? Summary

60. Does delayed CCI occur? Summary

61. How much hydrogen is produced during CCI? Internal

62. Does very late ignition occur? p Internal

63. Resulting pressure in containment? UFUN-Int.

64. Containment failure and type of failure? zo UFUN-Str.

65. Sprays after very late CF? Internal

66. Fan coolers after very late CF? N.A.

67. Containment heat removal after very late CF? Summary

68. Eventual basemat meltthrough (BMT)? Internal NUREG-1150 C-10 OAGI0000611 00456

Appendix C Table C.1.2 (continued)

Question Number Question Sampling Quantification

69. Eventual overpressure failure of containment? Internal

70. BMT before overpressure failure? Internal

71. Final containment condition? Summary Note 1. Whether the location of the break in the low-pressure piping would be under water in Event V at the time the core was uncovered was determined by a special panel that considered only this problem for the draft version of this analysis. As there was no new information available, there was no reason to change the conclusions reached by this group.

Note 2. There is little or no data on the failure rate of PORVs when passing gases at temperatures considerably in excess of their design temperature. The quantification was arrived at by discus-sions between the accident frequency analyst and the plant analyst.

Note 3. In the accident frequency analysis, a special panel was convened to consider the issue of the failure of RCP seals. The quantification of this question is not as detailed as that done in the accident frequency analysis but relies on the information producecJ. by this panel.

Note 4. The alpha mode of vessel and containment failure was considered by the Steam Explosion Review Group a few years ago. The distribution used in this analysis is based on information contained in the report of this group.

Key to Abbreviations in Table C.1.2 AcFrqAn The quantification was performed as part of the accident frequency analysis.

DS The branch probabilities are taken from a distribution; depending on the distribution, the sampling may be SF or ZO.

Internal The quantification was performed at Sandia National Laboratories by the plant analyst with the assistance of other members of the laboratory staff.

In-Vessel This question was quantified by sampling from an aggregate distribution provided by the expert panel on in-vessel accident progression.

Loads This question was quantified by sampling from an aggregate distribution provided by the expert panel on containment loadings.

N.A. Not Applicable.

P A parameter is determined by sampling from a distribution, in most cases an aggregate distribution from an expert panel.

PDS The quantification follows directly from the definition of the plant damage state.

ROSP This question was quantified by sampling from a distribution derived from the offsite power recovery data for the plant.

SF Split fraction sampling - the branch probabilities are real numbers between zero and one.

Struct. This question was quantified by sampling from an aggregate distribution provided by the containment structural performance expert panel.

Summary The quantification for this question follows directly from the branches taken at preceding questions or the values of parameters defined in preceding questions.

C-11 NUREG-1150 OAGI0000611 00457

Appendix C UFUN-Str. This question is quantified by the execution of a part of the User Function, using distribu-tions from the containment structural performance expert panel.

UFUN-Int. This question is quantified by the execution of a part of the User Function, using an adiabatic calculation for the pressure rise due to hydrogen combustion.

ZO Zero-One sampling-the branch probabilities are either 0.0 or 1.0.

C.1.3 Description of Table C.1.3; Variables Sampled in Source Term Analysis The variables that were sampled in the source term analysis are listed and summarized in Table C.1.3.

Those variables quantified by the source term expert panel are marked with an asterisk in Table C.1.3.

Table C.1.3 Variables sampled in source term analysis.

Variable Description FCOR

• Fraction of each fission product group released from the core to the vessel before or at vessel breach. There are two cases: high and low zirconium oxidation.

FVES

• Fraction of each fission product group released from the vessel to the containment before or at vessel breach. There are four cases: RCS at system setpoint pressure, RCS at high or intermediate pressure, RCS at low pressure, and Event V.

VDF Decontamination factor for pool scrubbing for Event V when the break location is underwater at the time of the release. There is one distribution, which applies to all radionuclide classes except inert gases.

FCONV* Fraction of each fission product group in the containment from the RCS release that is released from the containment in the absence of mitigating factors such as sprays.

There is one distribution for each case, which applies to all radionuclide classes except inert gases. There are five cases: containment leak at or before vessel breach with sprays operating, containment leak at or before vessel breach with sprays not operat-ing, containment rupture at or before vessel breach, very late containment rupture, and Event V. Note that FCONV does not account for fission product removal by the sprays. The case differentiation on spray operation is to account for differences in containment atmosphere temperature and humidity between the two cases.

FCCI* Fraction of each fission product group in the core material at the start of CCis that is released to the containment. There are four cases: low zirconium oxidation in the core and no overlaying water, high zirconium oxidation in the core and no overlaying water, low zirconium oxidation in the core with overlaying water, and high zirconium oxidation in the core with overlaying water.

FCONC* Fraction of each fission product group in the containment from the CCI release that is released from the containment in the absence of mitigating factors such as sprays.

The five cases are the same as those for FCONV, but there are separate distributions for each radionuclide class.

SPRDF Decontamination factor for sprays. Internal elicitation was used to develop a distribu-tion for this variable, which was used for all fission product groups except the noble gases. There is one distribution for each case, which applies to all radionuclide classes except inert gases. There are three cases: RCS release at high pressure and CF at VB, RCS releases not covered by the first case, and CCI releases.

NUREG-1150 C-12 OAGI0000611 00458

Appendix C Table C.l. 3 (continued)

Variable Description LATE!* Fraction of the iodine deposited in the containment that is revolatilized and released to the environment late in the accident. This variable applies only to iodine.

PLATE* Fraction of the deposited amount of each fission product group in the RCS that revolatilized after VB and released to the containment. There are two cases: one large hole in the RCS and two large holes in the RCS.

DST* Fraction of each fission product group in the core material that becomes aerosol par-ticles in a direct containment heating event at VB that is released to the containment.

There are two cases: VB at high pressure (1000 to 2500 psia) and VB at intermediate pressure (200 to 1000 psia).

FISGFOSG Fraction of each fission product group released from the reactor vessel to the steam generator, and from the steam generator to the environment, in an SGTR accident.

There are two separate distributions, FISG and FOSG, each of which has two cases:

SGTRs in which the secondary SRVs reclose and SGTRs in which the secondary SRVs stick open.

POOL-DF Decontamination factor for a pool of water overlaying the core debris during CCI.

There are two cases: a completely full (depth about 14 ft) cavity and a partially full cavity (accumulator water only, depth about 4 ft).

• Quantified by source term expert panel.

REFERENCES FOR SECTION C.l C.1.1 D.M. Ericson, Jr., (Ed.) et al., "Analysis of Core Damage Frequency: Internal Events Methodology," Sandia National Laboratories, NUREG/CR-4550, Vol. 1, Revision 1, SAND86-2084, January 1990.

C.1.2 T.A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April 1989.

C.1.3 R.C. Bertucio and J.A. Julius, "Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990.

C.1.4 A.M. Kolaczkowski et al., "Analysis of Core Damage Frequency: Peach Bottom Unit 2,"

Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Revision 1, SAND86-2084, August 1989.

C.1.5 R.C. Bertucio and S.R. Brown, "Analysis of Core Damage Frequency: Sequoyah Unit 1,"

Sandia National Laboratories, NUREG/CR-4550, Vol. 5, Revision 1, SAND86-2084, April 1990.

C.1.6 M.T. Drouin et al., "Analysis of Core Damage Frequency: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 6, Revision 1, SAND86-2084, September 1989.

C.1.7 M.B. Sattison and K.W. Hall, "Analysis of Core Damage Frequency: Zion Unit 1," Idaho National Engineering Laboratory, NUREG/CR-4550, Vol. 7, Revision 1, EGG-2554, May 1990.

C-13 NUREG-1150 OAGI0000611 00459

Appendix C C.1.8 E.D. Gorham-Bergeron et al., "Evaluation of Severe Accident Risks: Methodology for the Accident Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analy-ses," Sandia National Laboratories, NUREG/CR-4551, Vol. 1, Draft Revision 1, SAND86-1309, to be published.*

C.1.9 F.T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

C.1.10 R.J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, October 1990.

C.1.11 A.C. Payne, Jr., et al., "Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND86-1309, to be published.*

C.1.12 J.J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, December 1990.

C.1.13 T.D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1, SAND86-1309, to be published.*

C.1.14 C.K. Park eta!., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be pub-lished.*

"Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.

NUREG-1150 C-14 OAGI0000611 00460

Appendix C C.2 Common-Cause and Dependent Failures Since the completion of the Reactor Safety Study over 10 years ago, more than 25 PRAs have been completed. These PRAs and other reliability analyses performed on nuclear power plant systems indicate that among the major contributors to the estimated total frequency of core damage are events that involve dependent failures.

Dependent failures are failures that defeat the redundancy or diversity in engineered plant safety systems.

In the absence of dependent failures, separate trains of a redundant system, or diverse methods of providing the same safety function, may be regarded as independent. However, actual operating experience indicates that not all components of redundant systems are free from dependent failures; simultaneous failure of similar independent components occur as a result of a common cause. Such failures occur infrequently, and their interdependence can be very subtle. As a result, dependent failure data are too sparse to accurately estimate common-cause failure rates for many types of components.

Also, dependent failure mechanisms are often plant specific in nature, further limiting the availability of directly usable data.

System analysts generally try to include explicit dependencies in the basic plant logic model (i.e., in the structure of the fault and event trees). Functional dependencies arising from the reliance of frontline systems on support systems, such as emergency coolant injection on service water or on electrical power, are examples of types of dependent failures that are usually modeled as an integral part of the fault and event tree structure. Interaction among various components within systems, such as common maintenance or test schedules, common control or instrumentation circuitry, and co-location within plant buildings (common operating environments), are often included as basic events on system fault trees. Even though the fault and event tree models include the major dependencies that have been identified, in some cases it is not possible to identify the specific mechanisms of common-cause failure from the available data bases (e.g., Licensee Event Reports-LERs). In other cases, where there can be many different types of common-cause failure, each with low probability, it is not practical to model each type separately. A relatively simple method is often used to account for the collective contribution of these residual common-cause failures to system or component failure rates. The method correlates the common-cause failure rate of multiple similar components to the failure rate of a single component of the same type. This method, known as the modified beta factor method (Ref. C.2.1), was applied in the system analyses for this study. Quantification of the beta factors (the common-cause failure rate correlation parameters) for important components is based on limited data and was treated as an uncertainty issue.

C. 2.1 Issue Definition The Fleming report is used as a basis for beta factors for common-cause faults involving the failure of two out of two components (Ref. C.2.2). Quantification of higher order common-cause events, such as three of three or four of four, is based on an additional set of multipliers (e.g., those developed by Atwood (Ref. C.2.3)). These multipliers are applied to the beta factors to calculate failure rates for higher order common-cause faults. For the elicitation, the higher order multipliers are not treated specifically in this issue; but because the quantifiable estimates of higher order common-cause failures are functions of Fleming-based data factors, the treatment of the beta factors in this issue will also affect the higher order factors. The uncertainties associated with this issue center on the appropriateness, robustness, and interpretation of the Fleming data. A beta factor represents that fraction of component faults that could also result in faults for similar components in the same service. It is also the conditional probability of a component failure, given that a similar component has failed. Such failures are concurrent, or approximately so, and are not due to any other component fault. Mathematically, Fleming's data are manipulated to derive beta factors defined by f3 = A I (A+B),

where A = Nac + WcNpc + 1 B = Nai + WiNpi + 1 C-15 NUREG-1150 OAGI0000611 00461

Appendix C Nae = number of actual component failures due to common cause, Npe = number of potential* component failures due to common cause, Nai = number of actual independent failures, Npi = number of potential independent failures, and Wi, We = weighting factors for considering potential failures as actual failures.

Not all common-cause beta factors used in the present analyses are based on the Fleming report because either a more component-specific analysis existed elsewhere or the Fleming report did not analyze data for certain components. The beta factors not based on Fleming's work, are:

• BWR safety relief valves (fail to reclose)

• Batteries

• Air-operated valves The BWR SRV failure to reclose common-cause event was modeled with data from Reference C.2.2, using a nonparametric model instead of the beta factor model. BWRs have from eight to ten SRVs, so it was necessary to model the failure of various combinations of these valves. This is an exception to the assumption that was used for most other components, where the common-cause failure of k redundant components was modeled for only one failure combination, all k components. These SRV failures include all multiple SRV failures to reclose. The probabilities of these outcomes include the contribution of combinations of independent failures as well as common-cause failures. Reference C.2.4 discusses in detail the approach that was used to derive the common failure rate used in these situations for BWR SRVs failing to reclose.

The de power study (Ref. C.2.5) was the source for the beta factor for a common-cause failure of two redundant batteries. That study suggests a worst case beta factor of 0.4 for a two-battery configuration in the minimum standard de power system reported. Higher order beta factors were calculated with a formula based on the assumption that the conditional probability of the kth (k>2) battery failing, given that "k-1" have failed, is the average of 1.0 and the beta for "k-1" of k batteries failing:

k pk = TI [ (2i-z- 1.0 + Bz) /(2i-2)]

i =2 Air-operated valve (AOV) failures were not specifically addressed in the various references on common-cause failures. A screening value of 0.1 was chosen as a beta factor for two or even more AOVs failing from a common cause. This was the result of an expert judgment elicitation performed among the project staff (Ref. C.2.6).

C.2.2 Technical Bases for Issue Quantification The results of the common-cause beta factor statistical analysis of the Fleming data are shown on Table C.2.1 for pumps and Table C.2.2 for valves. Using Fleming's model, 5th, soth, and 95th binomial confidence intervals were calculated to measure the uncertainty in the data. The Fleming model weights the potential failures by a factor of 0.1 (i.e., 10 percent of potential failures evolve into actual failures).

The importance of considering potential failures in quantifying common-cause beta factors was examined in a sensitivity study that examined two extreme cases. The first (denoted Pa) case assumed all potential failures become actual component failures (We. W; = 1.0); the second (denoted /Jd) case assumed no contribution from potential failures (We, Wi =0.0). The impact of these assumptions on the median value of the common-cause beta factor for each of several components is indicated in Tables C.2.1 and C.2.2.

• Potential failures involve components that are capable of performing their functions but exhibit a degraded performance or an incipient condition which, if not corrected, could lead to failure.

NUREG-1150 C-16 OAGI0000611 00462

Appendix C Table C.2.1 Beta factor analysis for pumps-based on Fleming data.

Binomial Confidence Intervals Data*

Pumps 5 50 95 Nac Npc Nai Npi LPCIILPCS/RHR f3 0.10 0.15 0.25 7 4 40 27 Pa 0.16

/3d 0.13 PWR Safety Injection 13 0.15 0.21 0.26 15 4 59 18 Pa 0.20

/3d 0.21 PWR Aux. Feedwater 13 0.036 0.056 0.093 9 6 107 11 Pa 0.079 Pd 0.053 PWR Containment Spray j3 0.047 0.11 0.25 2 2 25 7 f3a 0.14 f3d 0.11 Service Water/ 13 0.012 0.026 0.065 2 10 111 4 Component f3a 0.075 Cooling Water {3d 0.026 13 =Beta factor f3a = Beta factor calculated by weighting all potential failures (Npc* Npi) at 1.0.

{3d = Beta factor calculated by weighting all potential failures from the model.

• See text for definition of terms.

Table C.2.2 Beta factor analysis for valves-based on Fleming data.

Binomial Confidence Intervals Data*

Valves 5 50 95 Nac Npc Nai Npi Motor-Operated Valves 13 0.08 0.09 0.11 72 43 778 64 Pa 0.12

/3d 0.08 Safety Relief Valves (3 0.022 0.07 0.30 0 0 11 19 (PWR) Pa 0.03

/3d 0.08 Relief Valves (3 0.16 0.22 0.28 27 23 107 29 f3a 0.27 f3d 13 = Beta factor f3a = Beta factor calculated by weighting all potential failures (Npc* Npi) at 1.0.

/3d = Beta factor calculated by weighting all potential failures from the model.

• See text for definition of terms.

C-17 NUREG-1150 OAGI0000611 00463

Appendix C The Pa and fJd values are not always respectively higher and lower than the base case values. This is because the assumption to disregard or fully credit potential events also affects the denominator of the Fleming model, which includes terms for potential common-cause and independent failures.

Expert judgment was elicited from two experienced system analysts regarding the uncertainty in beta factor estimates due to potential misclassification of available data:

Alan Kolaczkowski-Science Applications International Corp., and Arthur Payne, Jr.-Sandia National Laboratories.

Their consensus is that this uncertainty is adequately accounted for in current models. Their rationale is as follows:

1. Inclusion of Potential Failures in Data Base The fJa and fJd factors on Tables C.2.1 and C.2.2 indicate that the inclusion of potential common-cause and independent failures in the data base does not represent a significant source of model uncertainty. The most significant impact of assuming that all potential events in the data are actual failures is an increase by a factor of 2. 9 (service water system pump). There is almost no impact of deleting all potential failures from the data base.

2. Classification of Independent Failures The beta factor model is highly sensitive to the number of independent failures. This number dominates the denominator of the beta factor equation. A factor of n increase in the number of independent failures would result roughly in a factor of n decrease in the beta factor. A factor of n decrease in independent failures would have the inverse effect. It seems highly unlikely that the data classification could be so erroneous that enough independent failures could have been miscategorized to create significant error in the parameter estimates.

3. Classification of Common-Cause Failures A sensitivity analysis was performed to examine the impact of reclassifying common-cause data. In this analysis, Fleming's common-cause data were assumed to have been miscategorized by a factor of two (i.e., the observed failures were assumed to be common cause in nature twice as often or, alternatively, half as often as categorized by Fleming). The resulting range of beta factor values for these cases fell well within the uncertainty ranges of the current models (Ref. C.2.6). As a result, the experts whose judgments were elicited on this issue believe it unreasonable that the data could have been misinterpreted to such an extent that current models inadequately represent this uncertainty.

Because it is unlikely that significant misclassifications of events have occurred, the experts believe that the distributions for common-cause beta factors are peaked near the median and fall off rapidly from the median. Given the lack of information and historical insensitivities of the accident sequence analysis results to the actual distribution selected, the experts believe that the lognormal distributions indicated on Table C.2.3 adequately characterize the data and modeling uncertainties for this issue.

C.2.3 Treatment in PRA and Results The beta factors described above were used in the quantification of the system fault trees for each plant.

An indication of the importance of individual common-cause and dependent failures in the fault tree analysis for these plants is the decrement by which the total core damage frequency would be reduced if these failures were not to occur. This decrement (known as the risk-reduction measure) is shown in Table C.2.4 for selected common-cause events in the Surry and Peach Bottom analyses. Note that several of the common-cause events shown in Table C.2.4 were not quantified using Fleming's data (e.g., diesel generator failures). For these events, plant-specific information was used when available. A complete listing of the risk-reduction measures is provided in References C.2. 7 through C.2.11.

The collective contribution of common-cause failures to the mean total core damage frequency was investigated by performing a sensitivity study in which all beta factors were assigned a single (point NUREG-1150 C-18 OAGI0000611 00464

Appendix C Table C.2.3 Beta factor models from EPRI NP-3967.

Error Error Pumps Mean Factor Valves Mean Factor Low-Pressure Coolant Injection 0.15 3 Motor Operated 0.088 3 Low-Pressure Core Spray 0.15 3 Safety Relief (PWR) 0.07 3 Residual Heat Removal 0.15 3 Relief (BWR) 0.22 3 High-Pressure Safety 0.21 3 PWR Aux. Feedwater 0.056 3 (Motor-driven)

PWR Containment Spray 0.11 3 Service Water/Component 0.026 3 Cooling Water All distributions are assumed to be lognormal.

Table C.2.4 Risk-reduction measures for selected common-cause events in Surry and Peach Bottom analysis.

Common-Cause Event Mean Event Probability Risk-Reduction Measure*

Surry (mean total core damage frequency = 4.01E-S)

BETA-2MOV S.SOE-2 2.72E-6 (failure of 2 motor-operated valves)

BETA-3DG 1.80E-2 2.66E-6 (failure of 3 diesel generators)

BETA-2DG 3.80E-2 2.25E-6 (fai1ure of 2 cliesel generators)

BETA-LPI l.SOE-1 6.75E-7 (failure of multiple motor-driven pumps, low-pressure injection)

Peach Bottom (mean total core damage frequency = 4.50E-6)

BETA-SBAT 2.50E-3 1.97E-7 (failure of 5 station batteries)

BETA-3AOVS 5.50E-2 9.75E-8 (failure of 3 air-operated valves)

BETA-4DGNS 1.30E-2 3.52E-8 (failure of 4 diesel generators)

BETA-2SIPUMPS 2.10E-1 1.81E-8 (failure of 2 safety injection pumps)

• Decrement by which the total core damage frequency would be reduced if this event were not to occur.

C-19 NUREG-1150 OAGI0000611 00465

Appendix C estimate) value of zero, and the core damage frequency distribution was recalculated. The results of this analysis are summarized in Table C.2.5, which shows the extent to which the mean total core damage frequency for Surry, Sequoyah, Peach Bottom, and Grand Gulf is reduced when commonMeause failures are eliminated.

Table C.2.5 Results of sensitivity study in which common-cause failures were eliminated from fault trees.

Base Case Sensitivity Study Percent Plant Analysis No Common-Cause Failures Reduction Surry 4.01E-5 3.08E-5 23 Sequoyah 5.72E-5 4.57E-5 20 Peach Bottom 4.50E-6 4.07E-6 10 Grand Gulf 4.05E-6 3.10E-6 26 REFERENCES FOR SECTION C.2 C.2.1 Pickard, Lowe and Garrick, Inc., "Procedures for Treating Common Cause Failures in Safety and Reliability Studies, Procedural Framework and Examples," NUREG/CR-4780, Vol. 1, EPRI NP-5613, January 1988.

C.2.2 K.N. Fleming et al., "Classification and Analysis of Reactor Operation Experience Involving Dependent Failures," Pickard, Lowe and Garrick, Inc., EPRI NP-3967, June 1985.

C.2.3 C.L. Atwood, "Common Cause Fault Rates for Pumps," EG&G Idaho, Inc., NUREG/

CR-2098, EGGMEA-5289, February 1983.

C.2.4 D. M. Ericson, Jr., (Ed.) et al., "Analysis of Core Damage Frequency: Internal Events Methodology," Sandia National Laboratories, NUREG/CR-4550, Vol. 1, Revision 1, SAND86-2084, January 1990.

C.2.5 P. W. Baranowsky et al., "A Probabilistic Safety Analysis of DC Power Supply Requirements for Nuclear Power Plants," NUREG-0666, April 1981.

C.2.6 T.A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, Part 2 of 2-"Project Staff," SAND86-2084, April 1989.

C.2.7 R.C. Bertucio and J.A. Julius, "Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990.

C.2.8 A.M. Kolaczkowski et al., "Analysis of Core Damage Frequency: Peach Bottom Unit 2,"

Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Revision 1, SAND86-2084, August 1989.

C.2.9 R.C. Bertucio and S.R. Brown, "Analysis of Core Damage Frequency: Sequoyah Unit 1,"

Sandia National Laboratories, NUREG/CR-4550, Vol. 5, Revision 1, SAND86-2084, April 1990.

C.2.10 M.T. Drouin et al., "Analysis of Core Damage Frequency: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 6, Revision 1, SAND86-2084, September 1989.

C.2.11 M.B. Sattison and K.W. Hall, "Analysis of Core Damage Frequency: Zion Unit 1," Idaho National Engineering Laboratory, NUREG/CR-4550, Vol. 7, Revision 1, EGG-2554, May 1990.

NUREG-1150 C-20 OAGI0000611 00466

Appendix C C.3 Human Reliability Analysis Human performance has been found to be a dominant factor in major safety-related incidents at nuclear power plants, both in the United States and elsewhere. Examples include events such as those at Three Mile Island Unit 2, Davis-Besse, and Oyster Creek in the United States and at Chernobyl in the U.S.S.R.

In each of these, a complex interaction between humans and hardware led to a significant hazardous event and, in two cases, to offsite releases. Deficiencies in human performance occurred both before the initiation of the event, in areas such as maintenance, training, and planning, and in response to the event.

In the evaluation of human performance, different types of human errors have been identified. The first is generally an error where an intended action is not carried out, usually because of lapses in memory or lack of attention. Examples of these types of errors involve an operator missing a step in a procedure or accidentally selecting a wrong switch. The second type of human error is generally an action performed in accordance with a plan that is inadequate for the situation. The plan may be inadequate because there is an error in diagnosing the type of event or because the type of event has not been considered in preparing the plan and is not part of the operator's experience and training. The third type of human error is a deliberate deviation from practices thought necessary to maintain safety. These kinds of errors can be either routine (as in taking shortcuts) or exceptional (as in the case of Chernobyl).

Techniques have been developed fqr modeling some, but not all, of these types of human errors in PRAs.

In particular, the first two kinds of error described above are analyzed in the present analysis. Other types of errors have not been addressed in this analysis, principally because no methods have been developed to provide quantitative estimates of error rates for them. Those errors considered in this study, and the methods for modeling them, are discussed below.

C.3.1 Issue Definition Human reliability was not analyzed as a separate issue in these analyses; that is, the influence of alternative methods, models, or data were not evaluated. Rather, uncertainty distributions of the individual failure probabilities were estimated using standard human reliability methods. These failure probabilities were incorporated in the accident sequence quantifications.

In most cases, human errors were modeled as failures of people to take actions specified in procedures, including maintenance procedures, operating procedures, and emergency operating procedures. In a few cases, innovative actions were identified as ways to arrest sequences prior to the onset of core damage; failure probabilities for such actions were estimated. There were no evaluations of the consequences of mistakes, as in "if the operators mistook scenario A for scenario B, then they would .... "

The kinds of human actions represented in the analyses included human errors before the onset of an accident and errors and recovery actions following the start of an accident. The pre-accident errors are mostly failures by test and maintenance personnel to restore components to operation following maintenance (hence, rendering a system unavailable) or miscalibration of multiple sensors, such as containment pressure or reactor level sensors (hence, failing automatic initiation signals at the correct setpoint). Other pre-accident errors are failures of operators to perform tests correctly, such as failing to restore the standby liquid control system after testing, resulting in its being unavailable in the event of a demand.

Post-accident failures include failures to initiate or control emergency core coo1ing systems (ECCS),

control rods, the standby liquid control system, etc., or their critical support systems, following their failure to start or run automatically during an accident. Examples include recovering the operability of failed diesel generators and arranging crossconnections of service water systems between units following single-unit failures. In addition, there are post-accident actions that must be performed manually during certain accidents to prevent core damage; these are not simply starting systems that failed to start automatically. Examples include the implementation of feed and bleed or the changeover from high-pressure injection to recirculation cooling following depletion of the refueling water storage tank (RWST) during loss-of-coolant accidents at some PWRs (e.g., Sequoyah).

C.3.2 Technical Bases for Issue Quantification Quantitative estimates were made for the likelihoods of human errors using documented human reliability models. Failures in test and maintenance actions were quantified using a simplified version of the C-21 NUREG-1150 OAGI0000611 00467

Appendix C technique for human error rate prediction (THERP) (Ref. C.3.1). The original THERP method (Ref.

C.3.2) was developed and applied in the Reactor Safety Study to model human errors that can be analyzed using a task analysis (a step-by-step decomposition of an activity into simple items, such as "read meter," "tum switch," etc.). The THERP documentation provided a data base and rules of application for this approach to human reliability analysis. In the simplified approach developed for this study, bounding values were initially assigned for overall tasks, such as "restore pump," without performing a task analysis. A nominal failure probability of 3E-2 was assigned for all pre-accident failures, with adjustments made for factors such as people performing independent checks and the use of written verification sheets. Each of these factors reduced the nominal value by a factor of 10. Hence the existence of three factors would reduce the failure probability from 3E-2 to 3E-S.

The post-accident actions were categorized as to whether misdiagnosis of the plant state was considered credible. Misdiagnosis was not considered credible for manual scrams following failure of the automatic scram system, where operators are well trained and written procedures exist. Misdiagnosis was included for operators failing to recognize the condition of the plant and responding with an inappropriate strategy.

These misdiagnosis errors were quantified, using a time-reliability correlation described in Reference C.3.1. A time-reliability correlation provides an estimate of failure probability based on a time available for operators to take action following the onset of an event; this is a commonly used type of technique for this type of error.

These human reliability techniques provide single best estimate values with associated ranges of uncertainties. Table C.3.1 shows representative errors and associated uncertainty ranges used in the Grand Gulf accident sequence analysis.

Table C.3.1 Representative ranges of human error uncertainties (taken from Grand Gulf analysis).

Error Uncertainty Human Error Rate* Range*

Common-mode miscalibration of instrument 2.SE-5 10 Failure during isolation and repair of pump 3.0E-5 16 Operator failure to initiate level control (ATWS) l.OE-3 5

• Error rates and uncertainty ranges are expressed as the median and error factors of the distributions used in the sequence quantification.

C.3.3 Treatment in PRA and Results In this analysis, as in most published PRAs, human errors are most commonly represented in the system fault trees (much like component failures within systems), in the event trees (representing procedural actions), and in the recovery analysis of accident sequence cut sets. Therefore, many human errors are scattered throughout the system analysis models.

A small number of operator actions are represented in event trees. These are where a single action has a direct effect on the progression of an accident, as in the case of manual depressurization of a PWR to achieve "feed and bleed." Similarly, manual reactor trips are represented in ATWS-related event trees.

It is not possible to state what range of uncertainty in the core damage frequencies and other risk measures results only from uncertainties in human reliability. However, analyses were performed to evaluate the sensitivity of core damage frequencies to human reliability values. These sensitivity studies were conducted by setting the human error probabilities for post-accident actions to zero and comparing the resulting core damage frequencies to those for the base case analyses. Requantifying the core damage frequency with these human error probabilities equal to zero led to reductions in the range of 3.5 to 6.6-a significant potential reduction. These are summarized in Table C.3.2. The highest factor, 6.6 for Grand NUREG-1150 C-22 OAGI0000611 00468

Appendix C Gulf, resulted largely from eliminating all cut sets involving diesel failure, because zero human error implied perfect recovery of the failed diesel. The core damage frequency for Grand Gulf is dominated by station blackout, and, hence, eliminating diesel failure results in a significant reduction in core damage frequency. It must be remembered that the calculated reduction in core damage frequency includes unrealistic equipment behavior as well as unrealistic human performance as a result of simplifying assumptions in the analysis. Specifically, "perfect" human repairs would be effective for only a subset of possible equipment failure modes. Recovery of diesel operability following major equipment damage within a short time is meaningless, regardless of the quality of the human performance. {To be more realistic, the analysis would require separating recoverable failure modes from unrecoverable failure modes and associating perfect recovery only with recoverable failure modes.)

In a different sense, these calculated reductions in core damage frequency are an upper bound. During analyses such as this, recovery actions (human actions to terminate sequences prior to core damage) are identified only for sequences important to the total core damage frequency; this is done to simplify the analysis and focus the analysts' efforts on the important factors in the analysis. Setting the human error probability to zero eliminates the initially dominant sequences that already include recovery actions, but no reconsideration of recovery was evaluated for the remaining sequences that did not include recovery. It is likely that recovery actions could be postulated in some of these sequences. Adding recovery actions to these newly dominant sequences would yield further reductions in core damage frequencies.

Table C.3.2 Core damage frequencies with and without human errors.

Core Damage Frequency Factor of Plant Base Case No Errors Reduction Grand Gulf 4.1E-6 6.2E-7 6.6 Peach Bottom 4.5E-6 9.5E-7 4.8 Sequoyah 5.7E-5 2.5E-5 3.5 Surry 4.0E-5 1.1E-5

3.8 REFERENCES

FOR SECTION C.3 C.3.1 A.D. Swain III, "Accident Sequence Evaluation Program-Human Reliability Analysis Proce-dure," Sandia National Laboratories, NUREG/CR-4772, SAND86-1996, February 1987 (with errata).

C.3.2 A.D. Swain III and H.E. Guttmann, "Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," Sandia National Laboratories, NUREG/CR-1278, Revision 1, SANDS0-0200, October 1983.

C-23 NUREG-1150 OAGI0000611 00469

Appendix C C.4 Hydrogen Combustion Prior to Reactor Vessel Breach L WR fuel assemblies and core structures contain substantial quantities of metallic materials that oxidize when heated to sufficiently high temperatures (i.e., those calculated to accompany core meltdown accidents). Oxidation of these metals, principally Zircaloy and stainless steel, can liberate sufficient quantities of hydrogen to generate substantial containment loads if released to the containment building and allowed to accumulate and subsequently burn. It is estimated (Ref. C.4.1) that approximately 270-370 kilograms of hydrogen were generated and released to the containment during the acc1dent at Three Mile Island Unit 2 (TMI-2). Combustion of this hydrogen during the TMI-2 accident resulted in a containment pressure spike of approximately 28 psig (peak pressure). Since the design pressure of the TMI-2 containment is approximately 60 psig, this pressure rise did not pose a serious threat to containment integrity. However, the pressure spike observed during the accident at TMI-2 provided much of the motivation for subsequent changes in NRC regulations regarding containment hydrogen control (10 CFR 50.44). These changes involved hardware backfits for plants with pressure-suppression containments-BWR Mark I, II, and III and PWR ice condensers.

Hydrogen combustion is the dominant contributor to early containment failure for both Grand Gulf (BWR Mark III) and Sequoyah (PWR ice condenser). The importance of hydrogen combustion for these plants stems from the fact that both plants have relatively small free volumes, have low containment failure pressures, and incorporate pressure-suppression systems, which condense steam released from the vessel and thereby allow flammable mixtures of hydrogen and air to form. Accidents that result in early containment failure allow radionuclides that are released during the core damage process to escape to the environment. Because these accidents result in an early release, the time available for many of the emergency response actions to mitigate the accident is reduced. Because of its importance to risk, a large amount of effort was devoted to modeling and representing the uncertainty in these events.

Hydrogen can be generated during three phases of the accident: during the core damage process, at vessel breach, and late in the accident from the interaction of the core debris with concrete. The first two sources of hydrogen are generally more important to risk because they can lead to early containment failure.

During the core degradation process, the oxidation of metal with steam in the reactor produces hydrogen, which is subsequently released to the containment. During transient-type accidents in a BWR, hydrogen is released through the c;afety relief valve (SRV) tailpipes into the suppression pool. Similarly, during transients in a PWR, the hydrogen is released through the power-operated relief valves (PORVs) into the containment. Hydrogen can also be released directly to the containment during a loss-of-coolant accident (LOCA). If this hydrogen is allowed to accumulate, combustible mixtures can form. Although both Grand Gulf and Sequoyah have hydrogen ignition systems that are designed to bum the hydrogen at low concentrations, during station blackouts (i.e., accidents in which both onsite and offsite ac power are lost), these systems are not available. Subsequent ignition of this hydrogen by either random ignition sources or by the recovery of ac power can result in loads that can threaten the integrity of the containment. Depending on the concentration of the hydrogen at the time of ignition, both deflagrations and detonations are possible.

In the analyses performed for this study, hydrogen combustion phenomena were decomposed into smaller parts or issues. The various issues that were considered included in-vessel hydrogen production, ignition probability, detonation probability, peak pressure rise from a deflagration, dynamic load from a detonation, structural capacity of the containment to quasistatic pressurization events, and structural capacity of the containment to dynamic loads. Each of these issues in itself is very complicated and involves a substantial amount of uncertainty. Because of the large amount of uncertainty associated with these issues and because of their importance to early containment failure and risk, many of these issues were presented to panels of experts. The amount of hydrogen produced in the reactor during the core degradation process was addressed by the in-vessel accident progression expert panel. Hydrogen combustion phenomena before vessel breach and containment loads at vessel breach were addressed by the containment loadings expert panel. The structural response to these loads was provided by the containment structural performance expert panel.

The interfaces and the transfer of information between the various related issues are managed in the accident progression event tree (APET). A brief description of the relationship between these issues is NUREG-1150 C-24 OAGI0000611 00470

Appendix C provided below. The amount of hydrogen that is produced in-vessel is obtained from distributions provided by the expert panel. This amount of hydrogen depends. on the type of accident that is being analyzed and the conditions in the reactor vessel during the core damage process. A certain fraction of hydrogen produced during core damage is released to the containment. The distribution of the hydrogen in the various compartments of the containment depends on the accident. Based on the amounts of hydrogen, steam, and air that are present in the containment, the flammability of the mixture is determined. If the mixture is flammable, the likelihood that it is ignited by a random source is determined. The ignition probability in the absence of igniters was provided by the containment loadings expert panel and is a function of the concentration of steam and hydrogen in the containment. If the hydrogen concentration is high enough, it is possible for a deflagration-to-detonation transition to occur. If the hydrogen bums as a deflagration, a quasistatic pressure load results, whereas a detonation would impose a dynamic load on the containment.

The peak pressure that results from a deflagration depends on hydrogen concentration, burn complete-ness, effectiveness of the heat transfer to surrounding structures, and the degree to which gases are vented to other compartments within the containment. The magnitude of the dynamic load that results from a detonation is a function of hydrogen concentration, steam concentration, and the geometry of the containment compartment within which the bum occurs. Given that a hydrogen combustion event occurs, it must be determined if the load is sufficient to fail the containment. The load obtained from the combustion event is compared to structural capacity of the containment. If the load is greater than the containment failure pressure, the containment fails. Based on the pressure at which the containment fails and the magnitude of the load, the mode of failure is determined (i.e., leak or rupture). The APET accesses Fortran subroutines, which are used to track the amount of hydrogen and oxygen in the containment during the course of the accident, to determine the hydrogen concentration and the flammability of the atmosphere in the containment during various time periods, and to determine the pressure rise due to hydrogen burns.

Combustion events can also occur at the time of vessel breach or late in the accident. At the time of vessel breach, hydrogen is produced by the rapid oxidation of metal that accompanies energetic events such as ex-vessel steam explosions and direct containment heating. The ejection of hot core debris from the vessel also provides numerous ignition sources. Because of the availability of both hydrogen and ignition sources, the likelihood of hydrogen combustion is high at the time of vessel breach. However, because the pressure rise at vessel breach results from many phenomena (e.g., direct containment heating (DCH), ex-vessel steam explosions, and hydrogen combustion) and hydrogen combustion is only one component, a single distribution was used to characterize the uncertainty in the pressure rise from these events. Thus, the pressure rise at vessel breach is addressed as a separate issue. Late in the accident, the interaction of the core debris with concrete produces both hydrogen and carbon monoxide, both of which are combustible.

The approach used to determine the likelihood of containment failure from late hydrogen and carbon monoxide combustion is similar to the approach used before vessel breach.

As an example, a detailed description of the hydrogen issue, hydrogen combustion prior to reactor vessel breach, is presented below.

C.4.1 Issue Definition Because of significant differences in containment configuration and other design features, this issue was posed in a slightly different way for each plant. However, in each case, the issue was posed to answer the following two fundamental questions:

1. What distributions characterize the uncertainty in the probability that hydrogen combustion will occur in the containment building prior to vessel breach?

2. Given that combustion occurs, what distributions characterize the uncertainty in the attendant peak static pressure and the maximum impulse loading (to the drywell wall for Grand Gulf and to the ice condenser walls for Sequoyah)?

The answers to these questions may depend on the accident scenario postulated. Therefore, a case structure was established to distinguish the initial conditions associated with accident sequences found to be important contributors to a plant's estimated core damage frequency. The case structure also provides C-25 NUREG-1150 OAGI0000611 00471

Appendix C a convenient tool for applying the generated probability distributions to the Grand Gulf and Sequoyah PRAs (as described in Section C.4.3).

Containment loads due to hydrogen combustion in Grand Gulf represent a significant challenge to containment integrity only during station blackout accident sequences, during which the igniters are inoperable. The case structure for Grand Gulf combustion loads, therefore, considers three variations of the station blackout accident sequence. These are summarized below:

Steam Air Partial Partial Containment Pressure Pressure Sprays Operate ac Power After Power Case (psi a) (kPa) (psi a) (kPa) Recovered? Recovery?

1 7 5 17 115 No No 2 7 50 17 115 Yes Yes*

3 20 135 18 120 Yes Yes*

Case 1 represents station blackout scenarios during which ac power is not recovered and a hydrogen bum is ignited spontaneously from a random ignition source. Cases 2 and 3 represent station blackout scenarios during which ac power is recovered prior to vessel breach; they differ from each other only in containment initial conditions.

Variations of station blackout are also the only accident scenarios in Sequoyah for which containment loads from hydrogen combustion represent a significant challenge to containment integrity. As in Grand Gulf, the ignition system is inoperable during these sequences; however, numerous "random" ignition sources are available in the Sequoyah containment. For example, sparks can be generated from movement of the intermediate deck doors in the ice condenser. The case structure for Sequoyah involves four variations of station blackout accident sequences, each of which yields different thermodynamic initial conditions. These may be summarized as follows:

Case 1: Station blackout; cycling power-operated relief valve (PORV) with the reactor pressure vessel at 2000-2500 psia.

Case 2: Station blackout; loss of pump seal cooling induces failure(s) of one or more reactor coolant pump (RCP) seals, resulting in a relatively low leak rate.

Case 3: Station blackout; loss of pump seal cooling induces failure(s) of one or more RCP seals, resulting in a relatively large leak rate.

Case 4: Station blackout; high temperatures in the reactor vessel upper plenum induce a creep rupture failure of hot leg piping of sufficient size to rapidly depressurize the reactor vessel.

For readers familiar with Reactor Safety Study (Ref. C.4.2) nomenclature for labeling accident sequences, Case 1 is the classic TMLB' accident scenario. Case 2 represents accident scenarios similar to S 3B, Case 3 represents scenarios similar to SzB, and Case 4 represents scenarios similar to AB.

The following discussion of this issue only addresses the potential range of containment loads that may result from the combustion of hydrogen prior to reactor vessel breach for th~ Grand Gulf and Sequoyah plants. Containment response analyses for the other three plants addressed in the present work did consider hydrogen combustion in the evaluation of containment loads; however, the importance of early hydrogen combustion to the uncertainty in reactor risk for these plants is minor in comparison to that observed in the Grand Gulf and Sequoyah analyses. Additionally, questions regarding safety concerns that may result from hydrogen combustion in the containment, such as equipment survivability, initiation of building fires, etc., are not part of this issue.

• sprays are assumed to initiate approximately 90 seconds after ignition.

NUREG-1150 C-26 OAGI0000611 00472

Appendix C C.4.2 Technical Bases for Issue Quantification The principal bases for quantifying the probability of hydrogen combustion during station blackout accident scenarios and the accompanying containment loads are calculations performed with several computer codes. These include early calculations performed with the MARCH2 code (Ref. C.4.3), more recent MARCH3 analyses (Refs. C.4.4 and C.4.5), HECTR calculations of hydrogen burns in an ice condenser containment (Refs. C.4.6 and C.4. 7), parametric analyses of Grand Gulf containment response to hydrogen burns using MELCOR (Ref. C.4.8), and calculations performed in support of the IDCOR program (Ref. C.4.9). These calculations are supplemented by a large body of information, available in the open literature, which discusses the strengths and weaknesses of the models employed by these codes, the experimental evidence on which many of the models are based, and the sensitivity of calculated containment loads to uncertain modeling parameters. The number of reports describing this information is too large to list here; however, a reasonably complete list is presented in References C.4.1 and C.4.10.

It is not uncommon for a relatively wide range of estimates of containment loads due to hydrogen combustion to be generated if several different analysts are asked to provide an estimate. Even for well-defined initial and boundary conditions (e.g., rate of release of a hydrogen/steam mixture to containment), the selection of different analytical tools and judgments regarding appropriate modeling parameters (e.g., flame speed, burn completeness) inevitably results in significant differences in containment loads. Although the sensitivity of estimated containment loads to many important modeling parameters has been quantified in a fairly comprehensive fashion, an analyst's judgment is still required to select the combination of parameters most appropriate to the particular problem being evaluated.

To characterize the distribution of containment loads that reflects the current state of knowledge and uncertainties in hydrogen combustion modeling, this issue .was presented to a panel of experienced severe accident analysts. For each plant, three analysts were asked to provide a distribution representing the probability that various mixtures of combustible gas, air, and diluents would ignite (in the absence of an operating igniter system) and a distribution for the attendant peak static pressure and/or maximum impulse. Participating in the Grand Gulf evaluations were:

James Metcalf-Stone & Webster Engineering Corp.,

Louis Baker-Argonne National Laboratory, and Martin Sherman-Sandia National Laboratories.

Participating in the Sequoyah evaluations were:

Patricia Worthington-U.S. Nuclear Regulatory Commission, James Metcalf-Stone & Webster Engineering Corp., and Martin Sherman-Sandia National Laboratories.

The following discussion summarizes the collective judgment of the panels and selected individual assessments where significant differences in judgment were observed.

Quantification of Ignition Frequency As indicated in the issue definition, there is some uncertainty regarding how and with what frequency a combustible mixture would ignite in the Grand Gulf or Sequoyah containment if the igniter system is inoperative. There is some evidence that the propensity for combustible mixtures to spontaneously ignite (because, for example, of the discharge of accumulated static charges) increases with increasing molar concentrations of combustible gas. The likelihood of spontaneous ignition of a given combustible gas concentration also increases with time.

An additional source of ignition during loss-of-ac-power accident scenarios in Sequoyah is the generation of sparks from movement of the intermediate and deck doors of the ice condenser. These doors, illustrated in Figure C.4.1, are normally closed to isolate the ice compartment from warm regions of the containment. Under accident conditions, when steam or other reactor coolant system effluents enter the bottom of the ice condenser, the doors open upward against their own weight. During severe accidents, gas flow rates through the ice condenser are not likely to be sufficiently high to hold all the doors open, and several doors may cycle open and shut as flow fluctuates. A comparable ignition source was not identified in the Grand Gulf containment building.

C-27 NUREG-1150 OAGI0000611 00473

Appendix C UPPER PRESSURE COMPARTMENT BOUNDARY UPPER PLENUM INTERMEDIATE DECK DOORS ICE CONDENSER LOWER COMPARTMENT Figure C.4.1 Cross section of Sequoyah containment.

NUREG-1150 C-28 OAGI0000611_00474

Appendix C Each panelist was asked to provide a distribution that represented his or her estimate for the probability that a given concentration of combustible gas would ignite in the absence of an operating ignition system.

For the Sequoyah containment, separate distributions were elicited for the ice condenser (i.e., region below the intermediate deck doors), the ice condenser upper plenum (i.e., region between the intermediate and top deck doors), and the containment upper compartment. Each of these regions is indicated in Figure C.4.1.

Distributions were elicited only for the outer containment in Grand Gulf (illustrated in Fig. C.4.2). The composition of the gas mixture in the drywell region of the Grand Gulf containment will be noncombus-tible (i.e., absent of sufficient oxygen or hydrogen to support combustion) prior to vessel breach, thus precluding ignition.

The panel's aggregate distribution (arithmetic average of the panelists' distributions) for Grand Gulf are shown in Figure C.4.3. The frequency of ignition in Grand Gulf is strongly dependent on the initial concentration of hydrogen. The absence of a readily identifiable ignition source in Grand Gulf results in relatively low probabilities of ignition for low hydrogen concentrations. Ignition frequency in the Sequoyah containment (shown in Fig. C.4.4) is less sensitive to initial hydrogen concentration than to the region of containment being considered. The potential for sparks from ice condenser door movement results in generally higher probabilities of ignition in the ice condenser upper plenum than in other areas.

Quantification of Containment Loads Due to Hydrogen Combustion As indicated in the issue definition, combustion loads are characterized for each of two possible events:

deflagration and detonation. Loads accompanying a deflagration are characterized by a distribution for the attendant peak static pressure. Detonation loads are characterized by the maximum impulse (to the drywell wall for Grand Gulf and to the ice condenser walls for Sequoyah). The likelihood that a particular combustion event would result in a deflagration or detonation is described by a conditional probability distribution (i.e., given the occurrence of a combustion event, what is the probability that it takes the form of a detonation?).

An aggregate distribution was generated for each permutation of cases (listed in Section C.4.1) and various ranges of plausible initial hydrogen and/or steam concentration. The ranges of initial conditions considered were:

Grand Gulf:

• Deflagration Loads: < 4%(H), 4-8%(H&L), 8-12%(H&L), 12-16%(H&L),

>16%(H&L)

• Conditional Probability of Detonation: 12-16%(H), 16-20%(H&L), >20%(L)

• Detonation Loads: >12%(H&L)

Sequoyah:

• Deflagration Loads: Loads calculated in containment event tree *

• Conditional Probability of Detonation: 14-16%, 16-21%, >21%

• Detonation Loads: > 14%

Nomenclature:  % refers to hydrogen mole fraction H refers to a"high" steam mole fraction (40-60%)

L refers to a"low" steam mole fraction (20-30%)

Distributions for each of the case/initial-condition permutations are not presented in this report. Selected aggregate distributions are shown and discussed below to iHustrate the range of values used in the PRA.

The reader is encouraged to review Reference C.4.11 for complete documentation of individual panelists' judgments as well as the panel aggregate for each case.

• Formula used to estimate peak static pressure is based on information provided by expert panelists. This formula is de-scribed in Reference C.4. J.l.

C-29 NUREG-1150 OAGI0000611 00475

Appendix C OUTER CONTAINMENT fl *****

DRY WELL I o SHIELD:'

WALL  :*

WEIR WALL HORIZONTAL VENTS SUPPRESSION POOL Figure C.4.2 Cross section of Grand Gulf containment.

NUREG-1150 C-30 OAGI0000611 00476

p r

0 b 1 a

b*

I I Grand Gulf I

I 0.8 t

y 0 0.6 f Legend:

('l Initial hydrogen concentration I

\.>)

N 0

t 0.4 -*"- H2 < 4%

-e- 4 < H2 < 8%

E X ~ 8 < H2 < 12 'fo c 0.2 e 12 < H2 < 16 %

e - H2, 16%

d i ~ I I I 0 I I I I n

z g 0 0.2 0.4 0.6 0.8 1 c Ignition Frequency (f) 0

)>

G>

d ti1 aI f ig 0 ....

...... Q.

0 0 v. S<"

0 0 (j) ()

...... Figure C.4.3 Ignition frequency as a function of initial hydrogen concentration in the Grand Gulf containment building (outer containment-wetwell 0

region for accident progressions in which the RPV is at high pressure).

0

--.1

--.1

z c :g

&l p (p

s

?

r ~

....... (')

Ul 0 0

b b

a 1I J1?A6 ik

• 7~ = ~< * '

i Sequoyah J

i 0.8 (5.5 < H 2 < 11 %)

t y

0 0.6 f

()

I

(,)

t-.:1 N

0 Legend:

t Initial hydrogen concentration E

X ~ Ice Condenser c

e -e- I.C. Upper Plenum e Containment Dome d

i n 0.4 g 0.2 0.6 0.8 1 0

)>

G>

Ignition Frequency (f) 0 f 0

0 0

(j)

...... Figure C.4.4 Ignition frequency for various regions of the Sequoyah containment-illustrated for an assumed initial hydrogen concentration between I

0 5.5 and 11 volume percent.

0 00

Appendix C Selected Distributions for Grand Gulf The range of estimated loads on the Grand Gulf containment generated by a hydrogen deflagration, initiating from various hydrogen concentrations, is shown in Figures C.4.5 and C.4.6. The former .

represents accident progressions in which the concentration of steam in containment at the time of ignition is relatively high, and the latter represents accident progressions with low initial steam concentrations. The distribution for the estimated strength of the containment pressure boundary and the wall separating the drywell from the outer containment is also indicated on these figures to illustrate the potential for structural failure. The likelihood of coincident failure of the containment shell and drywell wall is discussed in Section C.4.3.

Selected Distributions for Sequoyah The range of estimated loads on the Sequoyah containment generated by a hydrogen deflagration is shown in Figures C.4.7 and C.4.8. The former illustrates the range of loads generated during fast station blackout sequences, the latter illustrates the range of loads generated during slow blackout sequences with an intermediate-size break in the reactor coolant pump seals. In both figures, distributions for containment loads are shown for cases in which the quantity of hydrogen released to the containment corresponds to that generated from the oxidation of 20, 60, and 100 percent of the core Zircaloy inventory. To illustrate the potential for these loads to cause containment failure, the distribution for the estimated strength of the containment pressure boundary is also indicated on these figures.

Quantification of Hydrogen Detonation Frequency Detonations can occur if hydrogen is allowed to accumulate to concentrations greater than 12-14 volume percent in the presence of an ignition source and a sufficient concentration of oxygen. The current analysis indicates that the possibility of developing such conditions in either Grand Gulf or Sequoyah is low but cannot be dismissed. Figures C.4.9 and C.4.10 show aggregate distributions for the frequency of hydrogen detonations in Grand Gulf and Sequoyah, respectively (each showing the dependence on initial hydrogen concentration). The frequencies shown in these figures are conditional on hydrogen concentra-tions exceeding the values shown in the figure legends. The discontinuities in the distributions are a result of averaging the distributions of experts with substantially different judgments regarding detonation frequency, some of whom believe the frequency distribution to have thresholds (i.e., frequency cannot be lower than x or higher than y).

The conditions under which detonations were considered in the two plants are quite different, however. In Grand Gulf, large quantities of hydrogen may accumulate in the outer containment (as a result of substantial in-vessel metal-water reaction) and a global detonation may result. In the case of Sequoyah, a deflagration-to-detonation transition is a more likely means of creating a hydrogen detonation. The configuration of the ice condenser (a vertically oriented enclosed compartment with obstacles in the flow path) can promote flame acceleration and initiate a detonation in upper portions of the ice bed or the upper plenum.

C.4.3 Treatment in PRA and Results The probability distributions for this issue were implemented in the Grand Gulf and Sequoyah accident progression event trees. These trees (one for each plant) provide a structured approach for evaluating the various ways in which a severe accident can progress, including important aspects of the reactor coolant system thermal-hydraulic response, core melt behavior, and containment loads and performance. The accident progression event tree for each plant is a key element in the assessment of uncertainties in risk by accommodating the possibility that a particular accident sequence may proceed along any one of several alternative pathways (i.e., alternative combinations of events in the severe accident progression). The probability distributions (or split fractions) for individual and combinations of events within the tree provide the "rules" that determine the relative likelihood of various modes of containment failure.

C-33 NUREG-1150 OAGI0000611 00479

Appendix C legend for Loada: Initial Hydrogen Concentration

-e- 4 < H2 < 8% -A- 8 < H2 < 12 %

--T 12 < H2 < 16% -e- H2 > 16%

p r

0 b

Caaea with High Steam Concentrations 0

f 0.8

\.

N 0

t 0.6 E

X c

e 0.4 e \

\

d '

Prob,ablllty of i Drywall

\

wall n \

Survlvin'~ Load-P g 0.2 \

\

L ontainment 0

• ivlng Load-P a ~- .........

d 0 p 0 0.2 0.4 0.6 0.8 1 Pressure Difference (kPa

• 1.0E-3)

Figure C.4.5 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and high initial steam concentrations).

NUREG-1150 C-34 OAGI0000611_00480

Appendix C Legend for Loads: Initial Hydrogen Concentration

-e- 4 < H2 < 8% 8 < H2 < 12  %

-*- 12 < H2 c 16't'o -E- H2 > 16%

p r

0 b

0 f 0.8 N

0

\

Cases with t 0.6 \ Low Steam

\ Concentrations E \

X \ ,,

c \

e 0.4 e \

d Prob'-a,bi II t y of i ow:- ..wall n \

Surviving Load-P g 0.2

\

Probability of

\

L the 0~-ntal nment 0 \*

Survi\in~ad-P a

d 0 ----.

0 0.2 0.4 0.6 0.8 1 p

Pressure Difference (kPa

• 1.0E-3)

Figure C.4.6 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and low initial steam concentrations) .

C-35 NUREG-1150 OAGI0000611_00481

Appendix C 1

p r

~

-e- 20% Zr Oxid.

\

0 '

• ~ -B- 60% Zr Oxid.

b a -A- 100% Zr Oxid.

b 0.8

'* Legend for Loada i

t y '.

0 *

f 0.6 '

0 N

0 t

E .

~robablllty f>f Containment X

c 0.4

\ Surviving Load-P e '

0 e

d i

n

'0 g **

L 0.2

'.It 0 ' \

a \

d p

oL_~~~~L-~--~--L-~--~--L-~~~~

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 Pressure (kPa x tOE-03)

Figure C.4.7 Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (fast station blackout scenarios with various levels of in-vessel cladding oxidation).

NUREG-1150 C-36 OAGI0000611 00482

Appendix C 1

p r

-e- 20% Zr Oxid.

0 "\-B-60% Zr Oxid.

b a -- 100o/o Zr Oxid.

b i

j 0.8 . Legend for Loads

~

i **.

t .

y .*.

0 f '

0.6 N *.

0 t

f\robablllty of Containment E \ Surviving Load-P X

c 0.4

~

I I

e e

~

d ~

'I i \

n g

0.2 "I L \

0 a I Ill d

p '"'

0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 Pressure (kPa x tOE-03)

Figure C.4.8 Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (slow station blackout accidents with induced reactor coolant pump seal LOCA and various levels of in-vessel cladding oxidation).

C-37 NUREG-1150 OAGI0000611_00483

A.ppendix C p

r 0

b a

b Grand Gulf I

I I 0.8 t

y 0 0.6 f

N 0

t 0.4 Legend:

Initial hydrogen concentration E

X -e- 12 c H2 c 16 ~ (H) c 0.2 -lr 18 < H2 c 20 % (L) e e -e- H2 > 20 ljf, (L) d I

n g 0 0.2 0.4 0.6 0.8 1 FreQuency of Detonation f(D) f (D)

Figure C.4.9 Frequency of hydrogen detonations in Grand Gulf containment (probability of a detonation per combustion event-i.e., given ignition). H and L refer to high and low steam concentrations, respectively.

NUREG-1150 C-38 OAGI0000611 00484

Appendix C p

r 0

b a 1~------------------------------------~~

b 14 < H2 < 18 "

I I -b- 18 c H2 c 21 "

1 0.8 t -e- H2

• 21 ._

y 0

Legend:

f Initial hydrogen concentration N

0 t

E X

c e

e Sequoyah d

I n

g 0.2 0.4 0.6 0.8 1 Frequency of Detonation f(D}

f (O)

Figure C.4.10 Frequency of hydrogen detonations in Sequoyah ice condenser or upper plenum (probability of a detonation per combustion event).

C-39 NUREG-1150 OAGI0000611_00485

Appendix C As mentioned above, distributions for combustion loads were provided as input to the Grand Gulf accident progression event tree directly from the results of expert panel elicitations. An algorithm was created within the Sequoyah tree to calculate combustion loads as a function of "upstream" conditions such as the mass of hydrogen released from the reactor vessel, the distribution of the hydrogen through the containment, the compartment of the containment in which ignition took place, and other variables accounted for in the tree (e.g., bum completeness, potential for flame propagation). For each pass through the event tree in the risk uncertainty analysis, the likelihood of containment failure (and drywell failure for Grand Gulf) was determined by comparing the sampled value of the combustion loads against the sampled value of the containment pressure capacity.

Station blackout dominates the estimated core damage frequency for Grand Gulf, therefore rendering the igniters unavailable for most of the accident sequences important to risk. The attendant potential for hydrogen to accumulate and spontaneously ignite at relatively high concentrations received particular attention in this analysis. Of particular interest was the potential for hydrogen bums to induce a breach of the containment pressure boundary and result in suppression pool bypass. This combination of events could occur if a hydrogen burn were of sufficient magnitude to fail the containment shell and the drywell wall.

The outer containment (wetwell) pressure boundary is not an extremely strong structure in the BWR Mark III design (e.g., the Grand Gulf outer containment design pressure is 15 psig-103 kPa). As with all the pressure-suppression containment designs, heavy reliance is placed on the suppression pool to reduce thermodynamic loads on this structure. The structures forming the drywell, however, are much stronger (design pressure of 30 psid-207 kPa). The present analysis considers the possibility of combustion-generated loads failing either or both structures. If the containment pressure boundary is breached, but the drywell remains intact, the pressure-suppression pool is available throughout the accident to reduce the magnitude of the radioactive release to the environment. If, however, the loads accompanying a hydrogen bum (or some other event) are of sufficient magnitude to damage the drywell walls and allow for suppression pool bypass, the accompanying radioactive release can be substantial.

The contribution of hydrogen combustion to early containment loads in Grand Gulf is evident in the fraction of accident progressions with early containment failure caused by hydrogen burns. These are summarized below for each type of accident sequence that contributes greater than 1 percent of the mean total core damage frequency:

Fractional Fraction Fraction of Early Contribution to Resulting in Containment Failures Type of Mean Total Core Early Containment Caused by Hydrogen Burn Accident Damage Frequency Failure or Detonation Short-term station blackout 0.94 0.46 0.96 Lon&-term station blackout 0.02 0.86 0.44 ATWS 0.03 0.85 0.36 Transients 0.01 0.56 0.98 The vast majority of early containment failures for short-term station blackout (the dominant contributor to the Grand Gulf core damage frequency) is shown to be caused by loads generated by hydrogen combustion.

A substantially smaller fraction of the accident progressions in Sequoyah are estimated to result in early containment failure from hydrogen bums. The fraction results in early containment failure for the two most important types of core damage accidents in Sequoyah are summarized as follows:

NUREG-1150 C-40 OAGI0000611 00486

Appendix C Fractional Contribution Fraction Resulting in Type of to Mean Total Core Early Containment Failure Accident Damage Frequency from Hydrogen Burns LOCA 0.63 0.001 Station blackout 0.25 0.05 The majority of cases in which hydrogen combustion produces a load sufficiently large to compromise containment integrity involves deflagration (quasistatic) loads, not detonations (dynamic loads).

REFERENCES FOR SECTION C.4 C.4.1 National Research Council, Technical Aspects of Hydrogen Control and Combustion in Severe Light-Water Reactor Accidents, National Academy Press, Washington, DC, 1987.

C.4.2 U.S. Nuclear Regulatory Commission, "Reactor Safety Study-An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.

C.4.3 J.A. Gieseke et al., "Radionuclide Release Under Specific LWR Accident Conditions," Battelle Columbus Laboratories, BMI-2104, Vols. III and IV, July 1984.

C. 4.4 R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenar-ios," Battelle Columbus Division, NUREG/CR-4624, BMI-2139, Vols. 2 and 4, July 1986.

C.4.5 R.S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenar-ios: Supplemental Calculations," Battelle Columbus Division, NUREG/CR-4624, Vol. 6, BMI-2139, August 1990.

C.4.6 A.L. Camp et al., "MARCH-HECTR Analysis of Selected Accidents in an Ice-Condenser Containment," Sandia National Laboratories, NUREG/CR-3912, SAND83-0S01, January 1985.

C.4.7 S.E. Dingman et al., "Pressure-Temperature Response in an Ice Condenser Containment for Selected Accidents," Proceedings of the 13th Water Reactor Safety Research Information Meeting (Gaithersburg, MD), NUREG/CP-0072, February 1986.

C.4.8 S.E. Dingman et al., "MELCOR Analyses for Accideqt Progression Issues," Sandia National Laboratories, NUREG/CR-5331, SAND89-0072, to be published.*

C.4.9 Technology for Energy Corporation, "Integrated Containment Analysis," IDCOR Task 23.1, 1984.

C.4.10 A.L. Camp et al., "Light Water Reactor Hydrogen Manual," Sandia National Laboratories, NUREG/CR-2726, SAND82-1137, September 1983.

C.4.11 F.T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

~Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.

C-41 NUREG-1150 OAGI0000611 00487

Appendix C C.S PWR Containment Loads During High-Pressure Melt Ejection During cenain severe reactor accidents, such as those initiated by station blackout or a small-break loss-of-coolant accident (LOCA), degradation of the reactor core can take place while the reactor coolant system remains pressurized. Left unmitigated, core materials will melt and relocate to lower regions of the reactor pressure vessel. Molten material will eventually accumulate on the inner radius of the vessel bottom head and attack lower head structures. If the bottom head of the reactor vessel is breached, core debris may be ejected into the containment under pressure.* The blowdown of reactor coolant system gases atomizes ejected molten material and transpons the resulting particles through the containment atmosphere. The attendant exothermic oxidation of metal constituents of the molten particles and rapid transfer of sensible heat to the containment atmosphere is referred to as "direct containment heating."

The pressure rise in containment induced by high-pressure melt ejection (HPME) can be large enough to challenge containment integrity. Since containment failure immediately following reactor vessel breach can lead to a relatively large environmental release of radionuclides (and proportionally high conse-quences), uncertainties in the magnitude of containment loads at vessel breach are important contributors to the uncertainty in reactor risk.

A significant rise in containment pressure can be produced by HPME in PWR (large dry, subatmospheric, and ice condenser) containments and BWR (Mark I, II, and III) containments. These loads were, therefore, considered in the analyses for each of the plants examined in this study. The magnitude of the pressure rise depends strongly on details of reactor cavity (PWR)/pedestal (BWR) geometry and is, therefore, highly plant-specific. For the two BWRs examined in the present study, containment loads attributable to high-pressure melt ejection were not found to be the dominant contributor to the likelihood of early containment failure. This is a result of several factors, including the comparatively lower nominal reactor vessel pressure in BWRs, the capability of the suppression pool to attenuate, to some extent, the energy released from HPME, and (in Peach Bottom) the relatively high likelihood of other containment failure mechanisms (e.g., drywell shell meltthrough-refer to Section C.7). The discussion presented in the remainder of this section, therefore, focuses on PWR containment loads during HPME.

The containment loads associated with HPME are generated by the addition of mass and energy to the containment atmosphere from several sources:

1. Blowdown of reactor coolant system steam and hydrogen inventory into the containment.

2. Combustion of hydrogen released prior to and during HPME.

3. Interactions between molten core debris and water on the containment floor.

4. Direct containment heating.

Uncertainties in containment loads at vessel breach arise from the nonstochastic nature of some of these events (e.g., hydrogen burns), as well as a poor understanding of the phenomena governing others (e.g.,

direct containment heating).

In the preliminary containment response analyses (i.e., published in the February 1987 draft for comment release of this repon), each of these contributors to containment loads was treated individually. An estimate of the total rise in containment pressure at vessel breach was generated by the superposition of pressure increments from each contributor. This approach was acknowledged to compromise the synergistic aspects of the phenomena involved but was analytically convenient. Among the motivations for taking this approach was the desire to isolate the uncertainties associated with direct containment beating, a controversial and highly uncertain phenomenon that can have a significant impact on the estimation of risk.

Although more experimental and analytical information regarding direct containment heating has been generated for and incorporated into the final analyses for this study, substantial uncertainties persist and

"'In roughly 70+ percent of the PWR accident scenarios during which core degradation begins while the reactor pressure is at elevated pressures, an unisolatable breach in the primary system pressure boundary opens in hot leg piping, the pressurizer surge line, steam generator tubes, reactor coolant pump seals, or via a stuck-open power-operated relief valve. This break is sufficiently large to depressurize the reactor vessel prior to vessel breach. Containment loads during high-pressure melt ejection apply to the scenarios represented by the remaining 30 percent of the cases. The mechanisms for and likelihood of reactor vessel depressurization are treated as a separate uncertainty issue and are discussed in Section C.6.

NUREG-1150 C-42 OAGI0000611 00488

Appendix C the phenomenon continues to generate controversy. The motivation for isolating direct containment heating remains valid; however, the arguments in favor of treating containment response during this important stage of severe accident progression iri *a physically self-consistent manner prevailed. In the current analyses (presented in this document and NUREG/CR-4551 (Refs. C.S.1 through C.S.7)),

containment pressure rise at vessel breach is treated as a single issue representing the combined uncertainties associated with the synergism of the four events listed above. As a result, the pressure increment attributable to an isolated phenomenon (e.g., direct containment heating) is not separable.

C.S.l Issue Definition This issue characterizes the uncertainties in containment loads that accompany reactor vessel breach.

These uncertainties have been characterized over the entire range of possible initial reactor coolant system pressures. The largest loads (and, thus, the most significant challenges to containment integrity), however, are generated when the reactor vessel is breached while at elevated pressures. The following discussion will, therefore, focus on accident scenarios in which reactor vessel breach occurs at pressures between 500 psia (35 bar) and 2500 psia (170 bar). Further, pressure increments are characterized for three PWR containment designs-Surry Unit 1 (subatmospheric), Zion Unit 1 (large, dry), and Sequoyah Unit 1 (ice condenser). Diagrams of the Surry and Zion containments are shown in Figures C.5.1 and C.5.2, respectively. A similar diagram of the Sequoyah containment was discussed in Section C.4 (refer to Fig.

C.4.1).

A rise in containment pressure may result from one or more of the four events Hsted earlier. The blowdown of steam and hot gases from the reactor coolant system into the containment can be calculated with reasonable precision. The pressure rise attributable to this event may be augmented by the steam production accompanying an interaction of core debris and water on the cavity floor, the generation of energy from hydrogen combustion, and energy addition from direct containment heating. Each of these potential contributors to containment 'loads at vessel breach is subject to physical limitations.

• Potential ex-vessel interactions between core debris and water are of concern only for accident scenarios during which water covers the reactor cavity floor prior to vessel breach. In general, this implies the successful operation of containment sprays or a LOCA or both.

• Combustion of sufficient hydrogen to generate a substantial pressure rise is subject to physical requirements regarding minimum hydrogen concentrations, oxygen availability, and maximum inerting gas concentrations. Hydrogen concentrations in containment prior to vessel breach depend upon in-vessel core melt progression (primarily the fraction of the core Zircaloy oxidized before vessel breach, which was addressed as a separate issue) and the type of accident scenario being considered.

• Direct containment heating is a term that refers to a series of physicochemical processes that have been postulated to accompany the ejection of molten core debris from a reactor vessel under high pressure. If a large fraction of the ejected molten core debris is dispersed into the containment as fine particles, a substantial portion of the debris' sensible heat can be transferred rapidly to the atmosphere. The containment pressure rise accompanying direct containment heating depends on reactor cavity geometry, the mass of material dispersed by reactor vessel blowdown, and several other parameters described later.

The resulting pressure rise can be further supplemented by the release of chemical energy associated with the oxidation of metals in the particulate melt as they are transported through the containment atmosphere. The total energy release, and thus the pressure rise, attributable to these phenomena depend on the fraction of the core (molten mass) participating in the process and the model used to represent the events that accompany reactor pressure vessel breach.

Distinct cases are established to consider separately each plausible combination of debris characteristics and containment initial conditions. The case structure accounts for uncertainties in selected severe accident events and phenomena that precede reactor vessel breach. Uncertainties associated with the containment loads generated by processes and events that occur after the core debris leaves the reactor vessel are represented by the distribution of plausible pressure increments assigned to each case. The specific parameters and range of values used to define the case structure are:

C-43 NUREG-1150 OAGI0000611 00489

Appendix C g:

'CONTAINMENT SPRAYS 200 TON CRANE 0 GENERATOR MANIPULATOR CRANE

, .~ I~

~

~*

~

t 0

Figure C.S.l Cross section of Surry Unit 1 containment.

NUREG-1150 C-44 OAGI0000611_00490

Appendix C POLAR CRANE REACTOR CAVITY 9FT BASEMAT Figure C.5.2 Cross section of Zion Unit 1 containment.

C-45 NUREG-1150 OAGI0000611 00491

Appendix C Parameters Defining Case Structure Values Considered

1. Reactor vessel pressure prior to vessel breach High, Medium, Low p > 1000 psia 500 < p < 1000 psia p < 200 psia

2. Amount of unoxidized metal in melt High, Low 60 percent of initial inventory 25 percent of initial inventory

3. Fraction of molten core debris ejected High, Medium, Low Approx. SO percent of total Approx. 33 percent of total Approx. 10 percent of total

4. Initial size of hole in reactor vessel lower Large, Small head when breached Approx. 2.0 sq-meters Approx. 0.1 sq-meters

5. Presence (or lack) of water in reactor cavity Full, Half-full, Dry

6. Containment spray operation during HPME Yes: Operating No: Not operating A distribution of values for the incremental rise in containment pressure was generated for each PWR containment type analyzed (large dry, subatmospheric, and ice condenser) and for each combination of parameter values in the case structure. The relative likelihood of the cases was not considered as part of this issue but is determined in the evaluation of the accident progression event tree. Section C.5.3 discusses application of the estimated pressure increments for each case in the risk uncertainty analysis.

A qualitative description of how the above parameters influence containment response follows. The technical bases (experimental evidence, calculational results, or engineering judgment) for quantifying these influences are also indicated.

Reactor Vessel Pressure Reactor vessel pressure at the time of vessel breach characterizes the internal energy stored in reactor coolant system gases and provides the motive force for core debris dispersal. Higher initial pressures lead to larger pressure increments from reactor coolant system blowdown. Provided the initial reactor vessel pressure is sufficient to transport hot gases and reactive material (molten debris particles) to upper regions of the containment, the pressure rise attributable to direct containment heating is probably insensitive to the initial reactor vessel pressure. Attempts have been made to define a cutoff pressure (pressure below which substantial direct containment heating does not occur); however, the technical basis for a cutoff pressure is weak. In this assessment, direct containment heating is regarded as possible if the reactor vessel pressure at the time of vessel breach is greater than approximately 200 psia (14 bar). The likelihood of, and pressure rise associated with, hydrogen combustion and ex-vessel core-coolant interactions are largely insensitive to initial reactor vessel pressure.

Unoxidized Metal Content in Melt Among the important contributors to containment loads during high-pressure melt ejection is the energy release associated with the oxidation of unreacted metals (particularly Zircaloy) in the melt. The fragmentation and dispersal of debris throughout the containment atmosphere can significantly enhance the rate of Zircaloy oxidation by exposing a large surface area of unreacted metal to the containment atmosphere. The conceptual picture of hot, unreacted metals being dispersed in air atmosphere might suggest a strong relationship between the total energy released and the mass of unoxidized metal being NUREG-1150 C-46 OAGI0000611 00492

Appendix C dispersed. However, CONTAIN calculations (Ref. C.5.8) suggest that containment loads are relatively insensitive to the extent of in-vessel Zircaloy oxidation (mass of Zircaloy consumed in-vessel and, therefore, unavailable for oxidation during melt ejection). These calculations indicate only minor differences in containment pressurization when the unoxidized fraction of metal in the melt (dispersed at vessel breach) is increased from 50 to 70 percent of the initial inventory. It is not clear that a similar trend would be observed if the mass of dispersed metals were less than 50 percent of the initial inventory (i.e., if greater than 50 percent of the metal mass oxidized in-vessel or if a small fraction of the total mass of debris were to be ejected) .

Fraction of Molten Debris Ejected The amount of core material ejected from the vessel depends on the fraction of the core that has melted and collected at the bottom of the reactor vessel at the time of vessel breach. This is governed by the model used to represent in-vessel core melt progression (addressed in other uncertainty issues). Three nominal values were considered in this assessment (0.50, 0.33, and 0.10) to represent large (greater than 40 percent), medium (between 20 and 40 percent), and small (less than 20 percent) fractions of core melted and available for ejection, respectively. The results of parametric studies performed with the CONTAIN computer code (Ref. C.5.8) indicate that the containment pressure increment at vessel breach increases substantially with increasing fraction of melt ejected. Illustrative results of these calculations are shown in Figure C.5.3, which presents the predicted peak pressure for variations of a station blackout accident scenario in which progressively greater fractions of the initial core mass were assumed to be ejected. In these calculations, all the melt ejected is assumed to participate in direct containment heating.

Results of scaled high-pressure melt ejection experiments in the Surtsey facility (Refs. C.5.9 through C.S .13) indicate that not all ejected debris may participate, however.

Initial Size of Hole in Vessel When Breached Alternative conceptual models for in-vessel core melt progression suggest quite different modes of reactor vessel breach. One model assumes that a localized thermal attack of the vessel lower head results in the failure of one or more lower head penetrations. Such a model suggests an initial hole size in the neighborhood of 0.1 m2

• Much larger hole sizes are conceivable, however, particularly if the reactor vessel lower head fails by creep rupture or when the hole is ablated. The primary parameter affected by the initial hole size is the rate at which vessel blowdown occurs (larger initial hole size implying more rapid blowdown and melt ejection). The CONTAIN parametric studies referenced above also examined this sensitivity by varying the length of time required to blow down the reactor vessel. Substantially larger pressure rises were predicted when the blowdown period was shortened from 30 seconds to 10 seconds.

Presence of Water in Reactor Cavity At least two scenarios are conceivable when water interrupts the pathway for debris dispersal following reactor vessel breach (as it would if the reactor cavity were filled with water). One scenario is that one or more steam explosions will occur after only a fraction of the debris has been injected into the cavity and that the cavity water will then be dispersed ahead of the bulk of the injected debris. Another possibility is that the relatively cold water will be co-dispersed with the debris, exiting the cavity region as small droplets intermixed with the transported debris, steam, and hydrogen. Experiments with water-filled cavities (Ref.

C.S .13) have been inconclusive, in part because of the tendency of the experimental facilities to be destroyed by the debris-water interactions. Reality may involve some combination of these two scenarios.

The scenario resulting in co-dispersed water has received considerable attention. Of principal interest is the nature of the interaction between the debris particles and water droplets. The water may continue to quench the debris, mitigating the effects of direct containment heating. However, the fate of the steam generated by this quenching is uncertain. It could simply increase the partial pressure of steam in the containment, thereby producing a moderate addition to containment loads, or it might act as a source of oxygen for unquenched debris and substantially enhance the oxidation of metallic particles. This tradeoff was investigated in some detail in the CONTAIN sensitivity studies referenced above. The effects of co-dispersed water were shown to be quite sensitive to the timing and location of water addition, assumptions regarding droplet-debris reaction kinetics, and the amount of water involved.

C-47 NUREG-1150 OAGI0000611 00493

Appendix C Peak Pressure (bar) 10~--------------------------------------~

• Sequoyah 8 e Surry 6

/

4 A station blackout (TMLB) accident scenario was simulated for both plants.

Results are Illustrative only and may not correctly represent scenarios in 2

which alternative modeling assumptions are applied.

Refer to NUREG/OR-4896 for details.

o~------~--------~--------~--------~------~

0 0.2 0.4 0.6 0.8 1 Fraction of Core Melt Ejected Figure C.5.3 Calculated containment peak pressure as a function of molten mass ejected (Ref. C.5.8).

NUREG-1150 C-48 OAGI0000611 00494

Appendix C Containment Sprays and Ice Condenser The effect of containment sprays on containment loads from reactor vessel blowdown has been relatively well characterized by numerous containment response computer code calculations. In Surry, for example, it has been estimated (Ref. C.5.2) that the operation of containment sprays reduces the pressure rise at vessel breach by approximately 30 to 45 psi (2 to 3 bar). The impact of sprays on dispersed core debris is not well understood and was not explicitly examined in the CONTAIN sensitivity analyses (Ref. C.S.S).

For some plants, however, early spray operation may ensure a substantial inventory of water in the reactor cavity. The uncertainties in estimating the effect of this water were described above.

The presence of the ice condenser in the Sequoyah containment introduces significant uncertainties in estimating HPME loads for this plant. There are no experimental data regarding ice condenser performance under conditions representative of those accompanying HPME. In the present study, quantitative assessments of core debris capture and pressure suppression during HPME is largely based on the subjective judgment of experienced containment response analysts. Topics of particular concern include the potential for "channeling" (the preferential melting of a vertical column of ice, creating an early ice bypass pathway) and hydrogen detonations. The possibility of a rapid release of large quantities of hydrogen following reactor vessel breach, accompanied by effective steam condensation as the steam/hydrogen mixture passes through the ice beds, can generate conditions that favor hydrogen detonations in the upper regions of the ice condenser. The dynamic loads generated from such events are not explicitly included in this issue. The reader is referred to Section C.4 for more details on the treatment of hydrogen combustion phenomena in this containment design.

C.5.2 Technical Bases for Issue Quantification This issue was presented to a panel of experienced severe accident analysts. Six panelists addressed containment loads for the three PWR plants:*

Louis Baker-Argonne National Laboratory, Kenneth Bergeron-Sandia National Laboratories, Theodore Ginsberg-Brookhaven National Laboratory, James Metcalf-Stone & Webster Engineering Corp.,

Martin Plys-Fauske & Associates, Inc., and Alfred Torri-Pickard, Lowe & Garrick, Inc.

Each panelist provided a distribution of values for containment pressure rise following reactor vessel breach for each of the cases outlined in Section C.5.1. These distributions characterize the panelist's judgment for the range of plausible containment loads for each case and the relative confidence (i.e.,

degree of belief) that particular values within that range are the "correct" ones for the conditions specified by the issue case structure. Panelists based their judgments on the current body of experimental evidence and analytical information, a sample of which was summarized above.

A summary of the expert panel's judgments is provided below. In most instances, aggregate distributions (arithmetic average among the panelists for a particular case) are presented to illustrate observable trends between cases. Examples of individual panelists' distributions are also shown to illustrate the variance of opinion within the panel. Complete documentation of the elicitation of expert judgment from these analysts is provided in Reference C.5.2.

An estimate of containment loads has little meaning if isolated from a corresponding estimate of static pressure capacity. Therefore, for each plant, the appropriate distribution for its static failure pressure (discussed in detail in Section C.8) is shown on each plot of containment loads. An example display of containment loads versus a reference static failure pressure is shown in Figure C.S .4. The curve for containment loads (base pressure plus the pressure increment accompanying reactor vessel breach) is shown as a cumulative distribution function (CDF). The static failure pressure is shown as a complemen-tary cumulative distribution function (CCDF). The reason for this display format is to allow the reader to perform the following visual exercise:

• A minimum of three panelists addressed each plant. In general, each panelist was resj>onsible for addressing the uncertain-ties in containment loads for two of the three PWR plants (Surry, Zion, or Sequoyah). If any analyst wished to provide a judgment for more than two, he was free to do so.

C-49 NUREG-1150 OAGI0000611 00495

Appendix C

-B- Pressure Load at --*-- Prob of Containment Vessel Breach Surviving Load-P 1 ~--------------~~----------------~----~ .......

+mnmssssssssusssmsssssmsAmsssssmssmsssssmssssussssswmSI

\

cu 0.9

\

• \

\

\

m u 0.8 I

~ 0.7 i ..

v 0.6 \

\

e

\

~

\

p *.

r '.*

0 b

0.4

\

a 0.3 b

I I

~

0.2 i

t 0.1 y

01~----~~--~--~----~----~----~--~~~

0 2 4 6 8 10 12 14 Pressure (bar)

Figure C.5.4 Example display of distributions for containment loads at vessel breach versus static failure pressure.

NUREG-1150 C-50 OAGI0000611 00496

Appendix C Select a value (0.5 in the example-the median of the distribution) for the probability that the containment load at vessel breach is equal to or below some level. Read (horizontally) along the selected probability value, and determine the corresponding containment load (approximately 7 bar in the example). This means that the probability that the containment load at vessel breach is 7 bar or less is approximately 0.5. Next, read vertically upward to determine the point on the static failure pressure curve that intersects the same value of pressure, then left, back to the ordinate.

This final value of probability (0.95 in the example) is the probability that the containment will survive the imposed load (7 bar in the example).

This format for displaying the containment performance information allows the reader to examine the relative likelihood of the containment surviving a particular load and the corresponding likelihood of that load being produced. In performing this exercise, it must be remembered that the distributions displayed in this manner apply only to the initial and boundary conditions specified by the case structure.

Containment Load Distributions for Surry An important parameter in characterizing containment loads for high-pressure accident scenarios in Surry is the operation of containment sprays (or more specifically, the presence of water in the reactor cavity).

Figures C.5.5 and C.5.6 show the estimated containment loads for HPME cases with sprays operating and not operating, respectively, for vessel failure with the reactor coolant system at high pressure. In each figure, the four curves for containment loads represent the aggregate (arithmetic average) distribution for the expert panel for each of four cases (identified in the legend). The variables that change among these cases are the initial size of the hole in the reactor vessel lower head at vessel breach and the fraction of molten debris ejected. (Each may take on high or low values as indicated in Section C.5.1. Curves are not given for cases with a "medium" fraction of the core ejected.) The largest loads are generated when both parameters take on high values (with or without sprays operating). Significantly lower loads are likely for cases in which containment sprays operate.

The likelihood that the Surry containment would survive the median (50th percentile) loads is greater than approximately 90 percent for all cases in which the sprays operate or provided a small fraction of the core debris is ejected (with or without sprays). It should be noted that accident sequences for which containment sprays are assumed to operate generally result in a cavity at least partially filled with water.

The distributions shown in Figure C.5.5, therefore, assume a full cavity; those in Figure C.5.6, likewise, assume a dry cavity.

For Surry, the variance in the estimated containment loads among panelists is comparable to the variance among cases. Figure C.5.7 shows the distributions generated by each panelist for the four cases shown in Figure C.5.5. The range of median values for pressure rise among the panelists spans 30 to 60 psi (2 to 4 bar). This range increases to 120 psi (8 bar) at the distributions' upper bound. This trend is typical of virtually all the Surry cases.

Containment Load Distributions for Zion Example distributions of containment loads at vessel breach in the Zion Unit 1 containment are shown in Figures C.5.8 and C.5.9 (with and without containment sprays operating, respectively). The boundary conditions represented by the cases illustrated in these figures are the same as those shown in Figures C.5.5 and C.5.6 for Surry. The Zion containment is shown to be able to withstand high-pressure melt ejection loads (even at the upper end of the uncertainty range) with very high confidence.

The variance in the estimated containment loads (among panelists) for Zion is also very similar to that for Surry. The variance indicated in the individual distributions displayed in Figure C.5.7 (for Surry) is representative of that observed for Zion. Individual panelists' distributions for Zion are, therefore, not displayed in this document; the reader is encouraged to review Reference C.5.2 for this information.

Containment Load Distributions for Sequoyah The case structure for this plant includes an additional variable to account for uncertainties related to ice condenser performance (namely, the fraction of ice remaining at vessel breach). Distributions for Sequoyah containment loads for the cases similar to those displayed previously for Surry and Zion are C-51 NUREG-1150 OAGI0000611 00497

Appendix C HPME with sprays Surry: operating (cavity full)

Holt Fraction Mtl t Holt Fraction Melt LOADS: Size EJected SID E) toted

• • 8** Large Large **A** Large Small

-*K** Small Large --0* Small Small 0-~:-

0.9 ,' ,'

I

' ,I '

I

, I

' ~~ ,,' , ~'

0.8 ,, ,, ,, ,

¢' ~* ~/ !Zf' 0.7 I I

I I

I I

I I

I I

I I

I

,I I

I I

I

,I I

1 : ,' ,'

I I 1 I I I 1 I 0.6  : :

I I

I 1

I I

/

I I

/

I I

I I I I I I I I I 0.5 0d.

I I

I

~

I i d I

I I

I I I I

~ I I '

I I I I f I

, I

,I 0.4 ..

II I I I I I I II I

I I

I I

I I

I I

I Probability of II I I U I I u , ,

H

~ ' ,

I I Surviving Load-P

¢,' t¢ N I

' , ,' I II I I II I I It I I 0.1 #I II It I

I I

I

,~-~.0, .

0~--~~-L---~----L---~----~----~----~~

0 2 4 6 8 10 12 14 Pressure (bar)

Figure C.S .5 Surry containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity).

NUREG-1150 C-52 OAGI0000611_00498

Appendix C HPME without sprays Surry: operating (cavity dry)

Hole Fraction Melt Hole Fraction Melt LOADS: Size EJected Size EJected

• • E3** . Large Large **A-- . Large Small

--~-- Small Large - Small Small 0.9 0.8

't 0.7 I

I I

I I

I I

0.6 I I

I I

I I

I I

I I I I 0.5 /

x' ,'

ri I I I I I I I I 0.4 I I I I I I I I

~'

/

/ ,~ Probability of I

, I 0.3 I I I

"il r.i' I Surviving Load-P I I 0.2 I I

I I

I I

I I

I I I I I I I I 0.1 I I

I I

o~----~~~~----~----~----~----~~--~~~

0 2 4 6 8 10 12 14 Pressure (bar)

Figure C.5.6 Surry containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity).

C-53 NUREG-1150 OAGI0000611 00499

Appendix C a

o.t O.t **

,, . H H

o.a ,' 0.1 "

I 0.7 0.7 o.e 0.1 X I

0 p

I&

II o.e 0.1 0NiJ I I tl , ,,

I II I

1 I

I I

I Jl tl fl

,!J o.4 t I tl 0.4 I

1 I I

I tl I , ,.

o.~

tl tf I 1 I

'I 8Uffl(t u ,, 8urf~

0.1

~~~,'

I t I If I HPME with aprayt, larpholt, large Nit e)ulloll 0.1 ,," ,

/CJ : . H~MI! with .,,~

Laro- hoht.

ltlllaiiiMit e)loUon o.t ~*

II J.

r 1 I O.t

, J.

.,I I

0 0 2 4 Preu~r*

II (bar) 12

• 4 1're11ure (bar) 10 111 14 i3* Lold; Expert A

• t.- Lold; Expert 8

~ t.o.d: Expert c

• E>- LOid; Expert D Prob of Scnfvdty LMd-P c.,_Jatl.. Probeblllty 1

0.1 r{ O.t o.a

,,' ,'P".

,, ,' , , 0.1

, I O.T ',

O.T I I I O.t r II 0.1 I I' I I

I 1/ I I lo I I I I

~th' ,* ,,rtJb 0.1 0.4 I

~I It I II I I I

I I

I 0.1 0.4 ..* ...,'..',.,

,,,I fr/ I

,,,, lurry. *"

o.s ' I' HPM£ wllh aprayt. 0.3 , ,, '" aur,..

J!J,!/ 8mallhola, :I IVJ,': HPMI! with apraya, o.a '*~

I 'I Lar.....11 ejection 0.1

• I I f I I a-11 holt, I ltf fl I tl I f I

lllnaN Mit a)lotlon I lit

It I ' t (1.1 I /1 0.1 ;r.' '

rii.' GS'o' ,J.'

4 Pr..aura (bar) 12 4 Pre11ura (bar) 12 Figure C.S. 7 Surry containment load distributions generated by composite of individual experts for each of the cases shown in Figure C.S.S.

NUREG-1150 C-54 OAGI0000611 00500

Appendix C HPME with sprays Zion: operating (cavity full)

Hole Fraction Melt Hole Fraction Melt L.OADS: Size EJected 8lze EJected

--8-- . Large Large --A-- Large Small

• • K** Small Large --e-- Small Small Cumulative Probability

..C?$

0.9 I It I I I I I

I I

I I

I I I I I I I I I I I I I I I I I I I I 0.8 t t I I

~ '1-,' ~(

I I I I I I t I 0.7 t I

I I

I I

t I

r I I I t I I I t I I I r t ' 1 0.6 I f

I f

f I

I I

I t

I I

I t

I I

I I

I I

I I I I I I I I 0.5 di I I I I I irri I

I I

I I I I I I I I I I I I

• f ,

• 0.4 I I

r' I I If I

I I

I I

I I

I I

I I

I I I I I Probability of

/ , :'

0.3 I I

I I

I I

I I

t I I I I Surviving L.oad-P cfA, I I I I

¢ 0.2 f I I I I I I I I I I '

I I I I I I I I I I I I I I I #

H I I U I I 0.1 H II II I

I I

I I

I iiti o~~L---L- __ L __ _L __ _L_~L-~~~~--L-~

0 2 4 6 8 10 12 14 16 18 20 Pressure (bar)

Figure C.5.8 Zion containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity).

C-55 NUREG-1150 OAGI0000611_00501

Appendix C HPME without sprays Zion: operating (cavity dry)

Hole Fraction Melt Hole Fraction Melt LOADS: Slzt EJected Size EJected

• • B** Large Large **A** Large Small

--~-- Small Large **0* Small Small Cumulative Probability

~

1 ,4 ,'

0.9 t I

I I

r I

I I

1 I

I I

I I I I I I I I I I I I I I' I I 0.8 II I I t I I I I I I I I I I I

~ I I 11

• rp I

I I

I 0.7 It J I I

I I

I I I t t I

I I

,*: I I

I I

'I 0.6 II I I I I I I II I

I I

I I

I I

I I

I II t I 0.5 di I I I I I im I

I I

II I I I I I I I I I I I I I I 0.4 I I

~

I I I I I

I f

I I

I I

I I

I I

I I

I I I It I

I I

I I

I 1

Probability of I I I I 0.3 It I

I I I

I I

I I

I I

Surviving Load-P

~I I I

(!¢ I 0.2

• I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I 0.1 I I I I I I I I

I I

I I

di~'

o~~~--~--~--~----~--~---L--~~--~~

0 2 4 6 8 10 12 14 16 18 20 Pressure (bar)

Figure C.5.9 Zion containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity).

NUREG-1150 C-56 OAGI0000611 00502

Appendix C shown in Figures C.5.10 and C.S.11 (i.e., they represent the loads for high-pressure accident scenarios with and without containment sprays operating, respectively). Note that, for cases with a wet reactor cavity,* the distributions for containment pressure rise were observed to be relatively insensitive to the assumed size of the hole generated in the reactor vessel bottom head at vessel breach. Separate distributions are, therefore, not displayed in Figure C.S.10 for cases with different assumed hole sizes. At Sequoyah, there are accident progressions when the reactor cavity is deeply flooded* * (water level is well above the bottom of the reactor vessel, attaining a level as high as the hot legs). The expert judgment concerning this plausible situation is that pressure rise attendant to HPME is substantially mitigated.

Containment loads for the deeply flooded cases were assessed separately from the dry and wet cavity cases and, because the threat to containment integrity is minimal, they are not presented here. The reader is encouraged to consult Reference C. 5. 2 for full details of the containment loads for the cases with a deeply flooded cavity.

In Figures C.5.10 and C.S.11, the load distributions represent accident situations in which a substantial fraction (greater than 50 percent) of the initial inventory of ice remains in the ice condenser at vessel breach. Such conditions may arise during small-break LOCAs or station blackout. Other accident scenarios, however, may result in substantial ice depletion prior to reactor vessel breach (such as small-break LOCAs with failure of ECCS in the recirculation mode). Representative distributions of containment loads at vessel breach for these cases are shown in Figure C. 5 .12.

The value of the ice condenser for containment pressure suppression is readily apparent when comparing the distributions in Figure C.5.12 with those in Figures C.S.10 and C.5.11. The Sequoyah containment is considerably more likely to survive the static pressure loads generated at vessel breach if a substantial quantity of ice (i.e., greater than 10 percent of the initial inventory) remains in the ice condenser than when the ice inventory is depleted. The influence of containment spray operation on containment performance is noticeable, but far less dramatic.

C.5.3 Treatment in PRA and Results The probability distributions for this issue were implemented in the PWR accident progression event trees.

These trees (one for each plant) provide a structured approach for evaluating the various ways in which a severe accident can progress, including important aspects of reactor coolant system thermal-hydraulic response, core melt behavior, and containment loads and performance. The accident progression event tree for each plant is a key element in the assessment of uncertainties in risk; it considers the possibility that a particular accident sequence may proceed along any one of several alternative pathways (i.e.,

alternative combinations of events in the severe accident progression). The probability distributions for individual and combinations of events within the tree provide the rules that determine the relative likelihood of various modes of containment failure.

As mentioned in the introduction to Section C.S, uncertainties in containment loads accompanying high-pressure melt ejection are not major contributors to the overall uncertainty in risk for any of the three PWRs examined in this study. There are two reasons for this. First, comparison of the range of potential loads against the estimated strength of the large, dry containments (Surry and Zion) indicates high confidence that these containments can accommodate the pressure increment accompanying high-pressure melt ejection. A similar conclusion cannot be supported for the Sequoyah containment without additional assurance that some of the containment safety features operate (e.g., a substantial inventory of ice remains at the time of vessel breach). Secondly, accident sequences that have traditiona1ly been considered as "high-pressure" core meltdown accidents (e.g., a fast station black-out* * *) are estimated to result in a depressurized reactor vessel by the time of reactor vessel breach with a relatively high frequency. Depressurization mechanisms considered in the present analysis include temperature-induced hot leg failure and steam generator tube ruptures, reactor coolant pump seal

• For substantial quantities of water 'to accumulate on the containment floor and overflow into the Sequoyah cavity, the refueling water storge tank (RWST) inventory must dump onto the containment floor (e.g., via containment sprays) and approximately 25 percent of the ice inventory must melt.

• • Deep flooding of the cavity occurs with approximately 50 percent of the ice inventory and transfer of the RWST inventory onto the containment floor .

.., "'A fast station blackout involves the loss of electrical power and failure of steam-driven auxiliary feedwater, thus render-Ing all decay heat removal systems unavailable.

C-57 NUREG-1150 OAGI0000611 00503

Appendix C HPME with RWST dump (cavity wet)

Sequoyah: Substantial Ice remaining.

LOADS: (no aenaltlvlty to RPV hole alu)

. -A-. . Lg Frac Melt EJ *-~-. . Sm Frac Melt EJ Cumulative Probability 1 ~--------~----------------~----------------~------------------------~ , ,., ..

X A" I I' 0.9 I I' I I' I .I 0.8 ................................................ .,..................................................................................................................... .

I I' lA/

I I 0.7 ...................................... . I ...... ............... .t............................................................................................................. .

I I I I I

....................................,.I..................................................................................................................................................... ..

0.6 I I

I I 0.5 ............................~.........~ ......................................................................................................................................

I I I I I I 0.4 ....................... I I

I I I I I 0.3 ....................., ......r ........................................................................................................................................................ .

I I

'A..

~ .;... Probability of I I

.....................r ...., ...................................................................................................................................................... ..

0.2 I I I I Surviving Load*P I I 0.1 II

~

0----------~--~-----=~~----~-------~--~--~

0 2 4 6 8 10 12 14 16 18 Pressure (bar)

Figure C.S.lO Sequoyah containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity) and a substantial inventory of ice remaining.

NUREG-1150 C-58 OAGI0000611 00504

Appendix C HPME without RWST dump (cavity dry)

SeQuoyah: Substantial Ice remaining.

Hole Fraction Melt Hole Fraction Melt LOADS: Size EJected Size Elected

• -8** Large Large *-A-- Large Small

--~-- Small Large **G-* Small Small Cumulative Probability 1

z****** ,e***

0.9 ,~ ,,

t~ ~,

0.8

-t" f?J/

I 0.7 I I

I I

I 0.6 I I

I I

0.5 0.4 I I

r

' I' I

I I

f I

4 I

I 4

f I

I 0.3 . I I

I I

'f I

J

1. t If t

t¢ I

I Probability of 0.2 ..

II I

I$

I I

I f

,I I

I Surviving Load-P tl t I II 4 I

t.

I I 0.1 fl U I I

I I

tii,ti

-:: n:'r' 0~*----~~~~W---~----~----~*~~-*-*~------~----~----~----~

0 2 4 6 8 10 12 14 16 18 Pressure (bar)

Figure C.S .11 Sequoyah containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity) and a substantial inven-tory of ice remaining.

C-59 NUREG-1150 OAGI0000611 00505

Appendix C HPME without RWST dump (cavity dry)

Sequoyah: Little or no Jce remaining.

LOADS: (no sensitivity to RPV hole size)

--8.--

• Lg Frac Melt Ej --E-- : Sm Frac Melt Ej Cumulative Probability 1 ~----~--------------------~----------------~ I

.x '

0.9 '

I ' ,' '

0.8 I ,,

~*

0.7

.~. .

I '

Probability of ...

0.6

Surviving Load-P

./'

0.5

~.

I '

0.4 '

I

.I 0.3 .

I .I

• . ~

I o I 0.2 I o

. I I

I I

I I

I I

0.1 I '

0~--~----~--~~~~~--~--~----~----~--~

0 2 4 6 8 10 12 14 16 18 Pressure (bar)

Figure C.S .12 Sequoyah containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity) and a negligibly small inventory of ice remaining.

NUREG-1150 C-60 OAGI0000611 00506

Appendix C failures, and stuck-open power-operated relief valves (PORVs). These mechanisms are described in detail in Section C.6. The result of incorporating the potential for reactor vessel depressurization prior to vessel breach is a reduced frequency of high-pressure melt ejection and reduced containment loads at vessel breach. Another potential means of mitigating HPME loads at Sequoyah is deep flooding of the reactor cavity. However, deep flooding introduces a potential for an ex-vessel steam explosion. Challenges to containment integrity from ex~vessel steam explosions are discussed in Section C. 9.

As an illustration of the reduced frequency of high-pressure melt ejection and a resulting reduced frequency of early containment failure in the present analysis (from that estimated in the preliminary analyses-published in the February 1987 draft for comment release of this report (Ref. C.S.14)), Table C.5 .1 summarizes the relative likelihood of various modes of containment failure for each of the PWRs examined. The numbers shown in this table are frequency-weighted averages (i.e., they are the mean probability of containment failure given core damage). It is important to note that the probability of no containment failure is significant, and the average probability of early containment failure is shown to be low for all three plants.

Table C.5.1 Mean conditional probability of containment failure for three PWRs.

Containment Failure Mode Surry Zion Sequoyah Early failure with reactor vessel at pressure > 200 psi 0.004 0.02 0.04 Early failure with reactor vessel at pressure < 200 psi 0.0 0.02 Late containment failure <0.01 0.04 Containment bypass 0.12 0.006 0.06 Others (alpha,

• basemat meltthrough) 0.06 0.22 0.18 No containment failure or arrested core damage 0.81 0.76 0.66 with no vessel breach

• steam explosion-induced containment failure. The analyses supporting the quantification ofthis mode of containment failure are described in Section C.9.

C.5.4 Differences in Treatment of HPME and DCH Between First and Second Drafts of NUREG-1150 There are important differences in the role played by high-pressure melt ejection/direct containment heating (HPME/DCH) in the second and final versions of NUREG-1150 versus its role in the first draft.

In the latter, DCH contributed about 80 percent to the mean early fatality risk at Surry, while the contribution is substantially less in the current version of NUREG-1150, about 17 percent. Similar trends resulted for Zion. For Sequoyah, however, the change was in the opposite direction: HPME/DCH was a very minor contributor in the first draft of NUREG-1150, while it is significant in the current version of NUREG-1150.

Some of the implications of NUREG-1150 may be understood by first examining the reasons for the changes between the final version of NUREG-1150 and the first draft of NUREG-1150 results. A large number of factors are involved, with the following being especially noteworthy:

1. In the final version of NUREG-1150, much higher probabilities were assigned for partial or total depressurization of the vessel prior to vessel breach (VB) because of the occurrence of induced failures of the RCS boundary: hot leg and surge line LOCAs, pump seal LOCAs, and failure of PORVs to reclose. In the Surry analysis for the first draft, for example, the vessel remains pressurized in about 66 percent of the TMLB' accidents. while partial or complete depressurization occurs in 97 percent of the Surry TMLB' accidents in the final version.

2. The final version of NUREG-1150 takes credit for offsite power recovery during the period between the onset of core degradation and the occurrence of VB in station blackout accidents, which are the C-61 NUREG-1150 OAGI0000611 00507

Appendix C principal accident sequences leading to HPME/DCH. In Surry, for example, recovery occurs in 60 percent of the cases, and recovery arrests the accident (preventing HPME/DCH) in 90 percent of the recovered cases. The PWR analyses in the first draft of NUREG-1150 did not consider core damage arrest between onset of core degradation and VB.

3. The high end of the distribution for HPME/DCH loads in large, dry containments was reduced somewhat, relative to the first draft of NUREG-1150, but these changes were not large; containment-threatening loads were still considered quite credible. (In Surry, there was also an increased estimate of containment strength.) In ice condenser plants, however, the assessed threat was substantially increased, both because of increased appreciation of the potential role played by hydrogen in augmenting the DCH threat in these plants and also because of the recognition of the possibility of containment failure due to direct impingement of melt on the containment shell.

4. The ultimate strengths of the containment building under severe accident loads increased somewhat.

5. In the final version of NUREG-1150, steam generator tube ruptures (SGTRs) were included as accident initiators, and they contribute significantly to the role of bypass accidents for some consequence measures (their contribution is minor for early fatality risks, however). The first draft of NUREG-1150 did not consider SGTRs as initiators for severe accidents.

It should be noted that the changes summarized in points 1 and 3 above were heavily influenced by results from the Severe Accident Research Program during the interim period between the first and second drafts of NUREG-1150. Review of the NUREG-1150 expert elicitation documentation (Ref. C.5.2) shows that these research results played an important role in guiding the uncertainty distributions supplied for many important parameters, including both those governing DCH loads and those governing the probability of RCS depressurization.

The results noted above indicate that the most important single reason for the reduced contribution of HPME/DCH to mean risk in the large, dry containments is the perception that HPME/DCH scenarios are more likely to be prevented by the occurrence of unintentional RCS depressurization associated with induced failures of the RCS boundary and, to a lesser extent, by power recovery. In Sequoyah, this effect is more than compensated for by the increase in perceived threat from HPME/DCH phenomenology itself.

The degree to which the reduced importance of HPME/DCH in the Surry analysis depends upon RCS depressurization is especially noteworthy because this conclusion hinges upon such uncontrollable and unplanned factors as the temperature-induced failure of RCS components. This behavior is highly dependent on code predictions of core melt progression and the response of the RCS during degraded core accidents; the predictions have not been validated experimentally. The TMI-2 accident is also interesting in this regard because it provides evidence that degraded core accidents can progress quite far at elevated pressure without approaching temperature-induced failure of RCS components.

REFERENCES FOR SECTION C.S C.S.1 E.D. Gorham-Bergeron et al., "Evaluation of Severe Accident Risks: Methodology for the Accident Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analy-ses," Sandia National Laboratories, NUREG/CR-4551, Vol. 1, Draft Revision 1, SAND86-1309, to be published.*

C.5.2 F.T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

C.S.3 R.J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, October 1990.

C.S.4 A.C. Payne, Jr., et al., "Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND86-1309, to be published.*

• Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.

NUREG-1150 C-62 OAGI0000611 00508

Appendix C C.5.5 J.J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, December 1990.

C.5.6 T.D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1, SAND86-1309, to be published.*

C.5.7 C.K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be pub-lished.

• C.5.8 D.C. Williams et al., "Containment Loads Due to Direct Containment Heating and Associated Hydrogen Behavior: Analysis and Calculations with the CONTAIN Code," Sandia National Laboratories, NUREG/CR-4896, SAND87-0633, May 1987.

C.5.9 M. Pilch and W.W. Tarbell, "Preliminary Calculations of Direct Heating of a Containment Atmosphere by Airborne Core Debris," Sandia National Laboratories, NUREG/CR-4455, SANDSS-2439, July 1986.

C.5.10 W.W. Tarbell et al., "Results from the DCH-1 Experiment," Sandia National Laboratories, NUREG/CR-4871, SAND86-2483, June 1987.

C.5.11 M. Pilch et al., "High Pressure Melt Ejection and Direct Containment Heating in Ice Condenser Containments," Proceedings of the International Topical Meeting on Operability of Nuclear Power Systems in Normal and Adverse Environments, ANSIENS (Albuquerque, NM), Septem-ber 29-0ctober 3, 1986, SAND87-2141C.

C.5.12 M. Pilch and W.W. Tarbell, "High Pressure Ejection of Melt from a Reactor Pressure Vessel-The Discharge Phase," Sandia National Laboratories, NUREG/CR-4383, SAND85-0012, September 1985.

C.5.13 W.W. Tarbell et al., "Pressurized Melt Ejection into Scaled Reactor Cavities," Sandia National Laboratories, NUREG/CR-4512, SAND86-0153, October 1986.

C.5.14 U.S. Nuclear Regulatory Commission, "Reactor Risk Reference Document," NUREG-1150, Vols. 1-3, Draft for Comment, February 1987.

~Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.

C-63 NUREG-1150 OAGI0000611 00509

Appendix C C.6 Mechanisms for PWR Reactor Vessel Depressurization Prior to Vessel Breach The previous section addressed the range of thermodynamic loads to a PWR containment accompanying penetration of the reactor pressure vessel lower head by molten core debris and subsequent ejection of material into the containment atmosphere. These loads can present a significant challenge to containment integrity if penetration of the reactor vessel occurs at sufficiently high vessel pressure. For the three PWRs examined in this study, however, a substantial fraction of the severe accident progressions that started with the reactor vessel at high pressure depressurized before vessel breach. That is, many of the accident scenarios important to risk result in-by one means or another-a breach in the reactor coolant system (RCS) pressure boundary of sufficient size to reduce reactor vessel pressure below approximately 200 psi before reactor vessel lower head failure. An outcome of this result is that the uncertainties in high-pressure melt ejection loads are observed to have a relatively small impact on the overall uncertainties in reactor risk. This observation is a substantial change in results from those of preliminary analyses published in draft form in February 1987.

• Unlike the BWRs examined in this study, the PWRs do not have a system specifically designed to manually depressurize the reactor vessel. Feed-and-bleed operations can effect limited depressurization if the necessary systems are operable. Many of the accident sequences leading to core damage in the three PWRs examined in this study, however, include combinations of failures that render feed-and-bleed operations unavailable. This section addresses the other means by which the reactor vessel pressure may be reduced to levels below which high-pressure melt ejection loads do not threaten containment integrity:

• Temperature-induced failure of steam generator tubes,

• Temperature-induced failure of primary coolant hot leg piping or the pressurizer surge line,

• Failure of reactor coolant pump seals,

• Stuck-open power-operated relief valves (PORVs), and

• Manual (operator) actions to depressurize the RCS.

The estimated frequency of each of these events and their influence on reactor vessel pressure was incorporated in the accident progression analysis for the Surry, Sequoyah, and Zion plants. Manual depressurization was found to be ineffective for most PWR accident sequences because of limitations in the appropriate emergency procedures and the need for ac power to operate relief valves. This mechanism is, therefore, not discussed further. The manner in which the other hypothetical events were considered, the means of quantifying their likelihood, and illustrations of the impact they have on the results are discussed in the following sections.

C.6.1 Issue Definition The general issue is the frequency with which PWR severe accident progressions involve a breach in the RCS pressure boundary of sufficient size to reduce the reactor vessel pressure below approximately 200 psia. The mechanisms for depressurizing the reactor vessel that are considered in the present analysis are those listed in the introduction above. The first two mechanisms involve temperature-induced (i.e., creep rupture) failures of RCS piping. In both cases, the heat source for such failures is hot gases transported from the core via natural circulation or exiting the RCS through the PORV. The natural circulation pattern may involve an entire RCS coolant loop if water in the loop seals has cleared. If the loop seals have not cleared, a countercurrent natural circulation flow pattern may be established within the hot leg piping, transporting superheated gases and radionuclides from the core region of the reactor vessel to the steam generators. Effective cooling of the steam generator tubes is not available in many of the accident sequences considered in this analysis because of depletion of secondary coolant inventory earlier in the accident. Decay heat from radionuclides deposited in the steam generator inlet plenum and inside the tubes may also contribute to local tube heating. In either case, natural circulation flow (if established) may be interrupted by the frequent cycling of the pressurizer PORV or by the accumulation (and stratification) of hydrogen in the reactor vessel upper plenum and hot legs. The specific parameter to be quantified is the frequency with which creep rupture of hot leg piping or steam generator tubes results from the transfer of.heat from the core (via gas circulation) to RCS structures. The temperature-induced failures of interest here are limited to those that occur before reactor vessel failure.

NUREG-1150 C-64 OAGI0000611 00510

Appendix C Degradation and failure of reactor coolant pump seals may also result from overheating. In this case.,

overheating results from the loss of seal cooling water flow or loss of heat removal from the seal cooling water system. A number of potential "seal states" have been identified in reactor coolant pump performance studies, which result in a range of plausible leak rates from the reactor coolant system. The parameters to be quantified are the frequency of pump seal LOCAs, the relative likelihood of various leak rates that result from these failures, and the resulting value of reactor vessel pressure at the time of vessel breach.

The fourth mechanism considered in this analysis, stuck-open PORV(s), may result following the repeated cycling (opening and reseating) of the PORVs during the course of an accident. Such events have been observed (with relatively low frequency) during transient events in which plant conditions never exceed design basis conditions. PORVs have also been tested for their reliability to close after repeated cycles at design basis conditions. This issue considers the effect of beyond design basis conditions on the frequency with which PORVs fail to close after several cycles.

C.6.2 Technical Bases for Issue Quantification Two of the four mechanisms, temperature-induced hot leg failure and steam generator tube ruptures, were presented to a panel of experienced severe accident analysts. Each panelist was asked to provide a probability distribution representing his estimate of the frequency of each event. Their judgments were to be based on current information, made available to each of the panelists, and their own professional experience. The panelists participating were:

Vernon Denny-Science Applications International Corp.,

Robert Lutz-Westinghouse Electric Corp., and Robert Wright-U.S. Nuclear Regulatory Commission.

The individual distributions prepared by these panelists were then combined (i.e., an aggregate distribution was generated by averaging those of the three panelists) to develop a single distribution for application in the PRA. The methods used to aggregate individual panelists' distributions are described in Reference C.6.1.

The frequency of reactor coolant pump seal failures was addressed by an expert panel in support of the systems analysis for the PWRs (Ref. C.6.2). This panel's judgments were adopted for use in the accident progression event tree. Very limited data are available to support an assessment of the frequency of PORVs sticking open when subjected to severe accident conditions. A broad distribution was, therefore, assigned to the frequency of stuck-open PORVs. A summary of the technical bases for quantifying the frequency of RCS depressurization for each of these four mechanisms is given below.

Frequency of Hot Leg Failure A case structure was established to consider a spectrum of plausible severe accident conditions for which the frequency of hot leg failures needed to be quantified. The case structure was formulated around accident sequences that represent a significant contribution to the total core damage frequency. The cases considered were:

Case 1: A classic 'IMLB'* scenario (station blackout). RCS pressure is maintained near.2500 psia by the continuous cycling of the PORV. The secondary side of the steam generator is at the steam relief valve setpoint pressure (approx. 1000 psia) and is depleted of coolant inventory. Reactor coolant pump seal cooling is maintained at the nominal flow rate.

Case 2: Station blackout sequence during which reactor pump coolant seals fail, yielding a leak rate equivalent to a 0.5-inch-diameter break in each coolant loop. The steam generator secondary coolant inventory is depleted and the auxiliary feedwater system is unavailable.

Case 3: Same as Case 2 except the steam generators maintain an effective RCS heat sink with auxiliacy feedwater operating.

• Reactor Safety Study [WASH-1400] nomenclature for accident sequence delineation. The alphabetical characters repre-sent compound failures of plant equipment leading to the loss of plant safety functions. The characters TMLB' represent a transient initiating event, loss of decay heat removal, and loss of all electrical power.

C-65 NUREG-1150 OAGI0000611 00511

Appendix C The technical bases used by the panelists for characterizing the frequency of temperature-induced hot leg failures for each case were dominated by calculations performed with various severe accident analysis computer codes and by several different organizations. Those cited by the panelists in their elicitations (Ref. C.6.1) included TRAC/MELPROG calculations of TMLB' scenarios in Surry (Ref. C.6.3),

RELAPS/SCDAP calculations of similar accident scenarios (Ref. C.6.4), CORMLT/PSAAC calculations for Surry and Zion (Refs. C.6.5 and C.6.6), and MAAP calculations performed in support of the Ringhals Unit 3 PRA (Ref. C.6. 7) and the Seabrook PSA (Refs. C.6.8 and C.6.9). Ringhals Unit 3 is a three-loop plant with an NSSS similar to that of Surry; Seabrook is a four-loop plant with an NSSS similar to those of Sequoyah and Zion.

Only two specific references were cited by the panelists regarding experimental data or other physical evidence of natural circulation and its effect on heating RCS structures. These were the natural circulation experiments sponsored by EPRI (Ref. C.6.10) and the results of post-accident examinations of the Three Mile Island Unit 2 core debris and RCS structures (Ref. C.6.11). Information from neither of these sources is believed to have significantly influenced the panelists' judgments on this issue.

The aggregate distribution for the frequency of temperature-induced hot leg failures are shown in Figure C.6.1 for Cases 1 and 2 outlined above. The probability that Case 3 would result in an induced hot leg failure was judged to be essentially zero. The distributions shown in Figure C.6.1 are displayed in the form of a cumulative distribution function (CDF); that is, the curve displays the probability that the frequency of an induced hot leg failure is not greater than a particular value. The likelihood of an induced hot leg failure, given a station blackout accident during which the reactor vessel pressure remains high (i.e., no reactor coolant pump seal LOCAs, stuck-open PORVs, etc.), is shown to be relatively high; the median frequency is greater than 95 percent. In contrast, lower reactor vessel pressures in Case 2 (INith an early pump seal LOCA) make an induced hot leg failure unlikely; there is an 83 percent chance that a hot leg failure will not occur.

Frequency of Induced Steam Generator Tube Ruptures Essentially the same information (results of several computer code calculations) were used to characterize induced steam generator tube rupture (SGTR) frequency. All three panelists agreed that the likelihood of an induced SGTR is quite low. The three panelists noted that temperature-induced tube ruptures are driven by the same phenomena that drive temperature-induced hot leg failure (natural circulation flow of hot gases from the reactor vessel); therefore, the frequency distributions are correlated. Two of the panelists believed that the frequency of SGTR is very small because of the assumption that the hot leg would fail first, and neither of their distributions for frequency of induced SGTR exceeded a value of 0.0005. The aggregate distribution (shown in Fig. C.6.2) is dominated by a single panelist, whose distribution was strongly influenced by consideration of pre-existing flaws in steam generator tubes, resulting in the assumption that SGTR might occur before hot leg failure.

Frequency of Induced Reactor Coolant Pump Seal LOCAs The frequency of pump seal LOCAs of various sizes (corresponding to various pump seal states) was considered by a panel of experts as a systems analysis issue. Degradation mechanisms for reactor coolant pumps are highly plant- (or pump~) specific and can be quite complicated. Details of the analyses leading to the characterization of the various pump seal states and the corresponding spectrum of possible leak rates are not provided here but are available in the documentation of the expert panel elicitations (Ref.

C.6.2). An indication of the potential importance of modeling pump seal LOCAs, however, can be found by examining the accident progressions for which the reactor vessel pressure remains at or near the system setpoint (e.g., station blackouts with no other breach in the RCS pressure boundary). In the Surry analysis, approximately 71 percent of these accident progressions result in a failure of the seals in at least one reactor coolant pump. Of these, roughly one-third are estimated to result in a large enough leak rate to depressurize the reactor vessel to less than approximately 200 psia prior to reactor vessel breach; another third result in leak rates small enough to preclude any significant depressurization. In the remaining one-third of the cases, the reactor vessel is at intermediate pressure (200-600 psia) at the time of vessel breach (Ref. C.6.12).

NUREG-1150 C-66 OAGI0000611 00512

p r

0 b

a b

i 1- 1 i

t y

0 0.8 v CASE 2 (station blackout with RCP seal LOCA) f

(') 0.6 0\

I N

--l 0

t 0.4 E CASE 1 (station blackout X and no seal LOCA) c e 0.2 e

d i 0~----~~----~------~----~------~----~

n zc g 0 0.2 0.4 0.6 0.8 1 0

)>

tj ti1 F

Frequency of Induced Hot Leg Failure (F) ~

(I)

G> 0 ='

I 0

0

,_. ~

0 v. (')

0 0 (j)

_.. Figure C.6.1 Aggregate distribution for frequency of temperature-induced hot leg failure (Surry, Zion, and Sequoyah).

I 0

0 (J1

(.,)

Appendix C FreQuency of Induced SG Tube Rupture (F)

Figure C.6.2 Aggregate distributions for frequency of temperature-induced steam generator tube rupture.

NUREG-1150 C-68

Appendix C Frequency of Stuck-Open PORVs This issue was also addressed in the "front-end" analysis as an uncertainty issue (Ref. C.6.2). The RCS conditions under which PORVs will cycle after the onset of core damage, however, are expected to be significantly more severe than those for which the valves were designed and more severe than the conditions under which PORV performance has been tested. In lieu of specific analyses, test data, or operating experience, an estimate of frequency with which a PORV will stick open and an estimate for the resulting RCS pressure were generated as follows:

The valve is expected to cycle between 10 to 50 times during core degradation and prior to vessel breach. Extrapolation of the distributions for the frequency of PORV failure-to-close from the front-end elicitations indicates an overall failure rate (for 10 to 50 demands) in the neighborhood of 0.1 to 1.0. A uniform distribution from zero to 1.0 was, therefore, used in the Surry and Sequoyah analyses.

TRAC/MELPROG and Source Term Code Package (STCP) analyses were reviewed to characterize the rate at which a stuck-open PORV could depressurize the reactor vessel (Ref. C.6.12). The results of this review resulted in an estimate that there is an 80 percent probability that the reactor vessel pressure at the time of vessel breach will be less than 200 psia; in the remaining 20 percent of the cases, the vessel pressure will be at intermediate levels (200-600 psia).

C.6.3 Treatment in PRA and Results The probability distributions for this issue were implemented in the PWR accident progression event trees.

These trees (one for each plant) provide a structured approach for evaluating the various ways in which a severe accident can progress, including important aspects of RCS thermal-hydraulic response, core melt behavior, and containment loads and performance. The accident progression event tree for each plant is a key element in the assessment of uncertainties in risk; it considers the possibility that a particular accident sequence may proceed along any one of several alternative pathways (i.e., alternative combinations of events in the severe accident progression). The probability distributions for individual and combinations of events within the tree provide the rules that determine the relative likelihood of various modes of containment failure.

For the issue of reactor vessel depressurization, probability distributions for each of the mechanisms discussed above were incorporated in the accident progression event tree to determine reactor vessel pressure prior to vessel breach. As indicated in Section C.5, the containment loads accompanying vessel breach strongly depend on reactor vessel pressure. The load at vessel breach assigned to a particular accident progression, therefore, depends on the outcome of questions in the tree regarding reactor vessel depressurization. Selected results from the accident progression event tree analysis are summarized below.

The pressure history (as determined by the Surry accident progression event tree) for slow station blackout accident sequences* is summarized in Table C.6.1. This table shows the fraction of slow station blackout accident progressions for which the RCS pressure is at the PORV setpoint at high, intermediate, and low levels at the time the core uncovers and the time of reactor vessel breach.

A substantial fraction of the slow blackout accident progressions that start out with the RCS pressure at the PORV setpoint pressure are depressurized by one (or more) of the mechanisms described in Reference C.6.1 and result in a low pressure by the time of vessel breach.

A sensitivity study was performed to examine the effect of neglecting temperature-induced hot leg failure and steam generator tube ruptures on the observed results. Table C.6.2 summarizes the results of this study (presented in an identical format as Table C.6.1).

The results for pressure when the core uncovers are not affected by the change since temperature-induced hot leg failure and steam generator tube ruptures can only occur after the onset of core damage. The elimination of the possibility of these failures does affect the fraction of accident progressions involving reactor vessel breach at high pressure. The occurrence of high-pressure melt ejection is observed to roughly double in frequency.

• Slow station blackout accident sequences contribute more than one-half of the mean total core damage frequency for Surry.

The results indicated for this group of accident sequences are not generally applicable to other Surry accident sequences or other plants.

C-69 NUREG-1150 OAGI0000611 00515

Appendix C Table C.6.1 Surry reactor vessel pressure at time of core uncovery and at vessel breach.

Fraction of Slow Blackout Accident Progressions With Pressure-P at the Time of:

RCS Pressure Core Reactor (psia) Uncovery Vessel Breach 2500 0.54 0.06 1000-1400 0.13 0.10 200-600 0.33 0.19

<200 0.0 0.65 Table C. 6. 2 Surry reactor vessel pressure at time of core uncovery and at vessel breach (sensitivity study without induced hot leg failure and steam gen-erator tube ruptures).

Fraction of Slow Blackout Accident Progressions With Pressure-P at the Time of:

R CS Pressure Core Reactor (psi a) Uncovery Vessel Breach 2500 0.54 0.25 1000-1400 0.13 0.10 200-600 0.33 0.19

<200 0.0 0.46 The increase in accident progressions resulting in vessel breach at high pressure is not observed to significantly affect the likelihood of early containment failure, however. Table C.6.3 shows the fraction of slow blackout accident progressions that results in various modes of containment failure (including no failure) for the Surry base case analysis and for the sensitivity analysis in which induced hot leg failures and steam generator tube r:uptures were eliminated.

The insignificant change in results is largely attributable to *the strength of the Surry containment and its ability to withstand loads as high as those estimated to accompany high-pressure melt ejection with a relatively high probability (refer to Section C.S).

Qualitatively similar results are observed for Sequoyah. Elimination of the potential for early reactor vessel depressurization by induced hot leg failure or steam generator tube rupture (via a sensitivity analysis) has a noticeable, but not dramatic, influence on the likelihood of high-pressure melt ejection. Table C.6.4 shows the fraction of Sequoyah accident progressions (for two important types of core melt accidents) that results in high-pressure melt ejection

• for the base case analysis and the sensitivity analysis. In adjacent columns of this table are the fractions of the time that high-pressure melt ejection occurs and results in containment failure by overpressurization.

• The values shown only account for cases in which high-pressure melt ejection occurs in a cavity that is not deeply flooded.

Cases in which the cavity is deeply flooded do not usually generate loads sufficiently large to threaten containment integrity.

NUREG-1150 C-70 OAGI0000611 00516

Appendix C Table C.6.3 Fraction of Surry slow blackout accident progressions that results in various modes of containment failure (mean values).

Fraction of Slow Blackout Accident Progressions Resulting in Containment Failure Mode X Containment Base Case Sensitivity Failure Mode Analysis Analysis Structural Rupture 0.01 0.01 Leak 0.01 0.01 Basemat Meltthrough 0.07 0.06 Containment Bypass < 0.01 0.0 No Failure* 0.91 0.92

• Included in this category are accident progressions in which core damage is arrested in-vessel, thus preventing reactor vessel breach and containment failure. For Surry, these cases comprise approximately 60-65 percent of the "No Failure" scenarios.

Table C.6.4 Fraction of Sequoyah accident progressions that results in HPME and containment overpressure failure.

Fraction Resulting in Fraction of Columns (A)

HPME Without Cases in Which Containment a Flooded Cavity Overpressure Failure Occurs (A) (A)

Type of Core Base Case Sensitivity Base Case Sensitivity Damage Accident Analysis Analysis Analysis Analysis LOCA 0.11 0.11 0.16 0.16 Station Blackout 0.16 0.21 0.20 0.21 As might be expected, no change is observed for the LOCA accident scenarios. Negligible changes are also observed for station blackout scenarios.

REFERENCES FOR SECTION C.6 C.6.1 F. T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

C.6.2 T.A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April 1989.

C.6.3 J.E. Kelly et al., "MELPROG-PWR/MOD1 Analysis of a TMLB' Accident Sequence," Sandia National Laboratories, NUREG/CR-4742, SAND86-2175, January 1987.

C.6.4 P.D. Bayless, "Natural Circulation During a Severe Accident: Surry Station Blackout," EG&G Idaho, Inc., EGG-SSRE-7858, 1987.

C.6.5 V.E. Denny and B.R. Sehgal, "PWR Primary System Temperatures During Severe Accidents,"

ANS Transactions, 47, (317-319).

C-71 NUREG-1150 OAGI0000611 00517

Appendix C C.6.6 B.R. Sehgal et al., "Effects of Natural Circulation Flows on PWR System Temperatures During Severe Accidents," 1985 National Heat Transfer Conference, (223-234), 1985.

C.6.7 R.J. Lutz, Jr., et al., "Ringhals Unit 3 Severe Accident Analyses to Support Development of Severe Accident Procedures," Westinghouse Nuclear Technology & Systems Division, WCAP-11607, 1987.

C.6.8 M.G. Plys et al., "Seabrook Steam Generator Integrity Analysis," Fauske & Assoc.,

FAI/86-39, 1986.

C.6.9 K.N. Fleming et al., "Risk Management Actions to Assure Containment Effectiveness at Seabrook Station," Pickard, Lowe and Garrick, PLG-0550, 1987.

C.6.10 W.A. Stewart et al., "Experiments on Natural Circulation Flow in a Scale Model PWR Reactor System During Postulated Degraded Core Accidents," Proceedings of Third International Topical Meeting on Reactor Thermal Hydraulics (Newport, RI), ANS, Vol. 1, October 1985.

C.6.11 American Nuclear Society, Transactions of the ANSIENS Topical Meeting on the TMI-2 Accident (Washington, DC), October 30-November 4, 1988.

C.6.12 J.E. Kelly memorandum to R.J. Breeding, Sandia National Laboratories, "RCS Pressure at Vessel Breach," dated January 27, 1989 (with errata dated February 15, 1989).

NUREG-1150 C-72 OAGI0000611 00518

Appendix C C. 7 Drywell Shell Meltthrough The potential for early containment failure is an important contributor to the potential consequences of severe accidents and, thus, to risk. In this context, "early" means before or immediately following the time at which molten core debris penetrates the lower head of the reactor vessel. A number of plausible mechanisms for early containment failure were identified in the Reactor Safety Study, many of which have since been determined to be of extremely low probability and are currently considered to be negligible contributors to risk. More recent containment performance studies have identified a few mechanisms that were not considered in the Reactor Safety Study and have been found to be important contributors to the uncertainty in risk for some plants.

An early failure mechanism that has received a great deal of attention is penetration of a BWR Mark I containment resulting from thermal attack of the steel containment shell by molten core debris. The scenario for this mode of containment failure postulates that, as core debris exits the reactor pressure vessel and is deposited on the floor within the reactor pedestal, it flows out of the pedestal region through an open doorway in the pedestal wall and onto the annular drywell floor. For the debris to contact the drywell shell, it must flow across the drywell floor until it contacts the steel containment shell along the line where the shell is embedded in the drywell floor. Figures C. 7.1 and C. 7. 2 show the relevant geometry of the Peach Bottom drywell in vertical and horizontal cross sections, respectively. If hot debris contacts the drywell shell, two failure modes may occur: the combined effects of elevated containment pressure and local heating of the steel shell may result in creep rupture, or, if hot enough, the debris may melt through the carbon steel shell. Both of these plausible modes are considered in this issue and are collectively referred to as "drywell shell meltthrough."

C. 7.1 Issue Definition This issue represents the ensemble of uncertainties associated with the conditional probability of drywell shell meltthrough. (Failure is conditional on core meltdown progressing to the point that core debris penetrates and is discharged from the lower head of the reactor pressure vessel.) This probability is known to depend on the condition of the core debris (physical state, composition, release rate from the reactor vessel, etc.) as it relocates to the reactor pedestal floor. Distinct cases are established to consider separately each plausible combination of debris conditions at vessel breach. The case structure accounts for uncertainties in severe accident events and phenomena that precede the potential challenge to drywell integrity by drywell shell meltthrough.

Uncertainties associated with the processes and events that occur after core debris leaves the reactor vessel are represented by the probability distribution assigned to each case. The parameters considered in the case structure are:

Parameters Defining Case Structure Values Considered

1. Rate at which core debris flows High: R > 100 kg/sec out of the reactor vessel. Med: SO kg/sec > R > 100 kg/sec Low: 50 kg/sec> R

2. Reactor vessel pressure when core High: Near 1000 psia debris first begins to exit the vessel. Low: < 200 psia

3. Amount of unoxidized metals in melt. High: 65 percent of initial inventory (representing range: 50-80 percent)

Low: 35 percent of initial inventory (representing range: 20-50 percent)

4. Amount of debris superheat (temperature above High: > lOOK melting point of debris). Low:< lOOK C-73 NUREG-1150 OAGI0000611 00519

Appendix C BLOWOUT PANELS REFUELING BAY

~

• REACTOR *

.*~* VESSEL .

=~ *

~

Figure C. 7.1 Configuration of Peach Bottom drywell shell/floor-vertical cross section.

NUREG-1150 C-74 OAGI0000611 00520

Appendix C Concrete Drywell Drywell Steel Shell Structure Pd,ssible Point of

!Debris/Shell 1 Contact I

.I 3m I0

~~~--------*:~*~------

I

3m

..*:'I 0

I Figure C.7.2 Configuration of Peach Bottom drywell shell/floor-horizontal cross section.

C-75 NUREG-1150 OAGI0000611 00521

Appendix C

5. Presence (or lack of) water on drywell floor Yes: Sufficient to overfill sumps before debris is expelled from reactor vessel.

• and replenishable No: No water on drywell floor To account for the possibility that any permutation of these parameters may be important, the conditional probability of containment failure is quantified for each of the 48 cases. For each case, the containment failure probability is allowed to vary with time (after reactor vessel failure).

The uncertainties considered in characterizing the failure probabilities for each case include:

• Heat transfer characteristics of the debris on the concrete floor (e.g., thermal properties of melt and concrete, heat transfer coefficients for competing mechanisms, physical configuration of debris constituents, rate of internal heat generation).

• Heat transfer characteristics of the melt/steel shell interface (e.g., anticipated configuration and composition of debris in contact with steel, mechanism(s) for deterioration of shell thickness, properties of interfaces between debris and steel, and the steel shell and materials outside the shell) .

• Debris transport characteristics when flowing across drywell floor (e.g., rheology of molten corium, drywell floor area covered by debris, barriers to flow-sump pits, pedestal wall).

• Structural behavior of the carbon steel drywell shell when in contact with molten material (e.g.,

formation of eutectics, alternative failure mechanisms).

C. 7.2 Technical Bases for Issue Quantification This issue was presented to a panel of six experienced severe accident analysts:

David Bradley-Sandia National Laboratories, Michael Corradini-University of Wisconsin, George Greene-Brookhaven National Laboratory, Michael Hazzan-Stone & Webster Engineering Corp.,

Mujid Kazimi-Massachusetts Institute of Technology, and Raj Sehgal-Electric Power Research Institute.

The panelists' individual judgments for the conditional probability of containment failure by drywell shell meltthrough formed the basis for quantifying this issue. Each of the panelists used the results of several published analyses in their deliberations. References C. 7.1 through C. 7. 6 are among those identified by the panelists as having had an influence on their technical judgments. Complete documentation of the elicitation of expert judgment is provided in Reference C. 7. 7. A summary of the probability distributions that were generated by this process and a description of important areas of agreement and disagreement are presented below.

Each panelist generated a conditional probability distribution for each of the 48 cases outlined above.

However, as will be shown, the uncertainties associated with this issue (i.e., the divergence in quantitative judgment among the panelists) are quite large. Although collectively divergent, the panelists' judgments are individually self-consistent. As a result, the collective judgment of the panel for all cases can be reasonably characterized by a handful of aggregate probability distributions. To preserve the true characteristics of the panel's case-by-case judgments, however, the distributions for individual cases are retained in the analysis for Peach Bottom documented in Reference C.7.8 (refer to Section C.7.3). The aggregate distributions are quite useful for illustrating important similarities and differences in the rationales of the panelists and are discussed later.

Before discussing specific topics dominating uncertainty, it should be noted that there are some aspects of this issue on which the technical community appears to agree. The appropriate failure criterion for the drywell steel shell is generally accepted as a shell temperature exceeding 1100-1300K. This range

• This parameter includes the effects of spray operation.

NUREG-1150 C-76 OAGI0000611 00522

Appendix C envelopes the uncertainties related to alternative mechanisms for failure of the drywell pressure boundary.

At the lower end of this range, breach of the drywell pressure boundary could occur by creep rupture, particularly at elevated containment pressures. Alternatively, localized penetration of the steel shell by molten debris might occur if the debris in contact with the shell is sufficiently hot.

It is also generally agreed that the composition and temperature of the debris exiting the reactor pressure vessel are important properties to characterize when estimating the likelihood of hot debris reaching the drywell floor/wall interface. Specifying these properties, however, is limited by large uncertainties in core melt progression. These uncertainties have been treated parametrically (i.e., they are addressed through the case structure outlined above) .

• Unfortunately, the harmony ends here. Most panelists expressed a strong allegiance to a specific technical rationale that, in many cases, was physically inconsistent with rationales expressed by other panelists.

These dramatic differences in technical judgment reflect the polarized views on this issue that have developed in recent years. Over the full spectrum of plausible severe accident conditions, roughly half the technical community (as represented by the expert panel) appears to believe with near certainty that the drywell shell will fail following many core meltdown accidents; the other half is equally certain that it will not fail. If drywell shell meltthrough does occur, the containment pressure boundary is most likely to be breached within the first hour following reactor vessel penetration.

The variation of the conditional probability of drywell meltthrough among the 48 cases considered in this issue is not very wide. The net probability (i.e., arithmetic average of all panelists) of drywell shell meltthrough is no smaller than 0. 33 and no larger than 0. 8 7. The lowest failure probabilities correspond to cases in which water is assumed to cover the drywell floor; the highest correspond to cases in which the drywell floor is dry and debris flow rate, debris temperature (superheat), and debris unoxidized metal content are all at the high end of their range.

An illustration of the overall result for this issue is shown in Figure C. 7 .3. As mentioned above, the probability distributions for the 48 cases examined as part of this issue can be aggregated into five classes without introducing substantial error. These are displayed in the figure. Two classes characterize all the cases with low or medium flow rates of debris from the reactor vessel. The only single parameter significantly affecting the failure probability for these cases is the presence (or lack) of replenishable water on the drywell floor (all other parameters are observed to have a relatively minor influence on the probability of failure). Each of the remaining three classes represent "high flow" cases; one represents cases with water covering the drYwell floor, and two represent cases without water on the drywell floor.

Again, the presence (or lack) of water is the only single parameter significantly affecting the outcome. The values of other parameters (in certain combinations) influenced the panelists' judgments for these cases, however. The highest probability of drywell shell meltthrough is observed for cases in which two of the remaining three parameters take tm values at the high end of their range (denoted 2/3H in the figure's legend). Lower values are observed when at least two of the three parameters take on low values (denoted 2/3L).

A conclusion that might be drawn from Figure C. 7.3 is that the probability of drywell shell meltthrough is lowered by ensuring the presence of water on the drywell floor. This position is supported by some, but not all, of the panelists. It is important to keep in mind that the values displayed in Figure C.7.3 are averages of individual experts' judgments. As such, they tend to mask the divergence of technical views on many of the topics important to quantifying this issue. In this appendix, we do not intend to elaborate on the details of technical rationales expressed by individual panelists. The reader is encouraged to study Reference C. 7. 7 to gain a more thorough understanding of the phenomena and modeling assumptions disputed within the technical community. The following example is provided, however, to il1ustrate the divergence of technical views and explain why the average value of drywell shell meltthrough, displayed in Figure C.7.3, can be misleading.

Figure C. 7.4 displays the probability distributions generated by each panelist for four specific cases. The case definition is noted in the legend on each plot. The upper two cases represent scenarios with low core debris flow rates. The case shown in the upper left represents a scenario in which the drywell floor is dry; 0

The relative likelihood of one case over another is treated as a separate issue.

C-77 NUREG-1150 OAGI0000611 00523

Appendix C Cumulative Probability of Drywall Shell Melt-thru (Aggregation of Actual Cases)

Cumulative Probability of Failure 1 ~---------------------------------------,

0.9 0.8 0.7 0.6 0.5 0.4 ,,,,~~- ~---~ ------+--------------- ?* ------* *: -----------*---*------------------

1 .... -----------------------------------~---------------***-------------**-**----------

0.3 I I

I I

---*--- Low & Med flow w/H20

-B- Low & Med flow noH20

• -+- Hi flow, w/H20 0.1

-*"- Hi flow, noH20, 2/3H

~ Hi flow, noH20, 2/3L o~~_L~~~~~~~~~~

0 1 2 3 4 5 6 7 8 9 10 Time After Reactor Vsl Penetration (hr)

Figure C. 7. 3 Aggregate cumulative conditional probability distributions for Peach Bottom drywell shell meltthrough.

NUREG-1150 C-78 OAGI0000611 00524

Appendix C Cullllllatlw ProbabiUty of faDure O.t 0.8 0.1 Caae A11 ea.. A1S

' - flaw, LIIW IIIPV ,...,... Low flaw, Low IIIPV preuure, High fo -tal,'- luperhlat, 0.4 Hlth " -tal, ' - IIUI*IIIat.

No walilr Walilr on DW floor 0.1 o.a 0.1 0.1 0~---e----e----$--------~

0

• 0 I TIIM Aflet RIIOlor Yal P-tratlon (hr)

Cumulallw Probability of fafklr* CuiiiUiatllil Probablnty of Failure 0.11 v

./

0.1 v CIIIC1a High flow, Low IIIPV ,......,,,

o.e 0.1 ea.. c10 Hlth ,. --~ low euperh~at.

0.7 0.7 Mowa ..r High flow, LDW RPV preuure, 0.1 Hloh " -tal, hlolt euperlllat. 0.1 I

No wallr 0.1 0.1 0.4 0.4

~

v v o.s 0.1 O.J 0.1 0.1 0

0.1 0

~ __...---

0 I 0 I a 4 Figure C. 7. 4 Cumulative probability distributions composite of individuals on expert panel for this issue.

(Six panelists (6 curves) are shown for each of four cases.)

C-79 NUREG-1150 OAGI0000611 00525

Appendix C the case shown in the upper right represents a scenario in which sufficient water accumulates on the floor to overfill the drywell sump. The lower two plots depict the results for two of the high flow cases (both without water on the drywell floor). One (lower left) assumes a high fraction of unoxidized metals in the melt, high debris temperatures, and low reactor pressure vessel pressure (i.e., class 2/3H in Fig. C. 7 .3).

The plot in the lower right comer differs only by the assumption of low debris superheat.

Two important observations should be noted. First, the individual panelists' judgments appear binary (i.e.,

taking on values very near zero or unity). The results for the majority of cases appear this way, with at least one panelist providing a judgment at each end of the spectrum. Intermediate values were provided for relatively few cases, such as case C12 shown in the lower right corner of Figure C. 7 .4. This divergence of quantitative judgment explains why the values for the average probability appear constrained between 0.3 and 0.8. The average value for case A12 (upper left) is approximately 0.5 because three panelists provided values of 1 and three values of 0. In quantifying case A13 (upper right), one of the three panelists who was certain failure would occur in case A12 felt that the addition of water would prevent molten debris from reaching the drywell wall and, thus, changed his judgment from 1 to 0 for case A13.

The other two panelists believe that the debris would be largely unaffected by the presence of water on the floor and did not alter their quantitative judgment. The average failure probability, therefore, changed from 0.5 to 0.33. A similar, but less dramatic, effect is observed in cases C10 and C12 (lower two plots) for which the average values changed from 0.87 to 0.68, respectively.

The second observation is that, despite an apparent consensus among panel members that the largest source of uncertainty for this issue is the initial conditions (i.e., state of core debris and drywell floor prior to reactor vessel penetration), dramatically different quantitative judgments were provided for the same initial conditions. Moreover, most panelists were very confident that their judgments were correct for many cases (i.e., a conditional probability of 1.0 or zero was provided for several types of conditions). In reviewing the elicitation of the expert panelists, one difference in rationale appears to have had a strong influence on their judgments. Some panelists believe that the flow of corium across the drywell floor is hydrodynamically limited (i.e., governed by the rheology and transport properties of the flowing core debris/concrete mixture). Others believe that the flow is thermodynamically limited (i.e., governed by the heat transfer characteristics of the mixture).

C. 7.3 Treatment in PRA and Results The probability distributions for this issue were implemented in the Peach Bottom accident progression event tree. This tree provides a structured approach for evaluating the various ways in which a severe accident can progress, including important aspects of RCS thermal-hydraulic response, core melt behavior, and containment loads and performance. The accident progression event tree is a key element in the assessment of uncertainties in risk by accommodating the possibility that a particular accident sequence may proceed along any one of several alternative pathways (i.e., alternative combinations of events in the severe accident progression). The probability distributions (or split fractions) for individual and combinations of events within the tree provide the rules that determine the relative likelihood of various modes of containment failure.

Drywell shell meltthrough is represented as an explicit event in the Peach Bottom accident progression event tree, and the probability assigned to it is dependent upon the path taken through the tree. For example, each path through the tree involves events that imply a particular combination of initial conditions for a potential challenge to drywell integrity. Values for each of the parameters defining the case structure outlined in the previous section are, therefore, established by the outcome of events occurring earlier in the tree. For example, one path may imply conditions of low reactor vessel pressure (perhaps caused by early actuation of the automatic depressurization system), high unoxidized metal content in the debris leaving the reactor vessel (from low in-vessel cladding oxidation), low debris temperature and low flow rates of debris leaving the reactor vessel (from a small hole size in the reactor vessel lower head), and, finally, no water on the drywell floor (failure of drywell sprays). For these conditions, the conditional probability of drywell shell meltthrough is represented by the distributions for case A12 (shown in Fig. C.7.4).

The distributions generated by each of the panelists are given equal weight in the accident progression event tree analysis. This is accomplished by generating an aggregate distribution for each case in the case structure that represents the composite judgment of the expert panel. The aggregate distribution is NUREG-1150 C-80 OAGI0000611 00526

Appendix C generated by averaging the distributions prepared by the panelists. This is equivalent to randomly sampling values from each panelist's distribution but constraining the sampling process to ensure that each distribution is sampled an equal number of times. Additionally, drywell shell meltthrough is treated as a nonstochastic event (i.e., it either occurs or it does not occur). Therefore, the conditional probabilities generated by the expert panel are appropriately converted to event tree branch probabilities of 1 or zero.

For example, if a conditional probability of failure equal to 0.3 is selected for a particular path in the event tree, a branch point probability of 1 would be assigned to that branch in 30 percent of the sample members. Likewise, a value of zero would be assigned for the other 70 percent of the sample members.

Recall that the method used to perform the statistical uncertainty analysis is one involving multiple passes through the accident progression event tree. The values of the branch point probabilities are allowed to change from one pass to the next, generating a distribution of possible accident outcomes.

An indication of the importance of drywell shell meltthrough on the results of the Peach Bottom accident progression analysis is the mean probability that accident sequences contributing to the total core damage frequency are estimated to result in this mode of containment failure. Table C. 7.1 shows the mean conditional probability of drywell shell meltthrough for several important core damage accident groups.

Another indication of the importance of drywell shell meltthrough on the Peach Bottom results is the decrease in the mean conditional probability of containment failure (i.e., given a core damage accident) when shell meltthrough is assumed to be impossible. The mean probability of early containment failure (frequency-weighted for all accident sequences*) for the base case analysis (i.e., with the drywell shell meltthrough probabilities outlined above) is 0.56. This value decreases to 0.20 if drywell shell meltthrough is assigned a probability of zero. The remaining (20%) probability of early containment failure results from other containment failure mechanisms such as overpressure failure and ex-vessel steam explosions. The latter are described further in Section C. 9.

Drywell shell meltthrough is also an important contributor to each of the measures of risk for Peach Bottom. For example, Peach Bottom severe accident progressions (from all types of accident sequences) that result in drywell shell meltthrough contribute approximately 70 percent of the mean estimate for latent cancer fatality risk and 60 percent of the mean estimate for early fatality risk.

Table C. 7.1 Probability of drywell shell meltthrough (conditional on a core damage accident of various types).

Type of Core Damage ~ean Frequency* of ~ean Probability of Accident Accident Type Drywell Shell Meltthrough LOCAs l.SOE-7 0.32 Transients 1.81E-7 0.32 Station blackout 2.08E-6 0.44 ATWS 1.93E-6 0.42

• These frequencies consider mternally mihated events only.

REFERENCES FOR SECTION C. 7 C.7.1 M.G. Plys, J.R. Gabor, and R.E. Henry, "Ex-Vessel Source Term Contribution for a BWR Mark-I," International ANS/ENS Topical Meeting on Thermal Reactor Safety (San Diego, CA), February 1986.

C.7.2 L.S. Kao and M.S. Kazimi, "Thermal Hydraulics of Core/Concrete Interaction in Severe LWR Accidents," MIT Nuclear Engineering Dept., MITNE-276, June 1987.

C.7.3 S.A. Hodge, "BWRSAT Approach to Bottom Head Failure," Presentation to NUREG-1150 Review Group, November 1987.

~These frequencies consider internally initiated events only.

C-81 NUREG-1150 OAGI0000611 00527

Appendix C C.7.4 D.A. Powers, "Erosion of Steel Structures by High Temperature Melts," Nuclear Science and Engineering, 88, 1984.

C.7.5 G.A. Greene, K.R. Perkins, and S.A. Hodge, "Mark I Containment Drywell, Impact of Core/Concrete Interactions on Containment Integrity and Failure of the Drywell Liner," Source Term Evaluation for Accident Conditions, paper IAEA-SM-281136, IAEA, Vienna, Austria, October 26-November 1, 1985.

C.7.6 J.J. Weingardt and K.D. Bergeron, "TAC2D Studies of Mark I Containment Drywell Shell Meltthrough," Sandia National Laboratories, NUREG/CR-5126, SAND88-1407, August 1988.

C.7.7 F.T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

C.7.8 A.C. Payne Jr., et al., "Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND86-1309, to be published.*

• Available in the NRC Public Document Room, 2120 L Street NW., Washinglon, DC.

NUREG-1150 C-82 OAGI0000611 00528

Appendix C C.S Containment Strength Under Static Pressure Loads Since the containment building of a nuclear power plant constitutes the ultimate barrier between the in-plant environment and the outside atmosphere, its anticipated performance during a severe accident has a substantial impact on the risk characteristics of the plant. Uncertainty regarding the capability of a containment to withstand the challenges associated with severe accidents can, therefore, be an important contributor to the uncertainty in risk.

In the risk models of this study, determining containment performance involves assessing the probability that the containment would be breached under a range of hypothesized severe accident conditions. In addition to the likelihood of failure, other critical factors in the characterization of containment performance are:

• Failure size: The larger the hole in the containment, the more rapid the escape of radioactive material in the containment atmosphere to the outside environment. This reduces the time available for radioactive material to deposit within the containment building and also reduces the opportunity for effective offsite emergency response.

• Location of failure: The retention of radioactive material by a breached containment building may be highly dependent upon the location of failure relative to containment systems designed to mitigate accident conditions. For example, in an ice condenser containment, failure of the containment in the lower compartment permits radioactive material to bypass the ice compartments while escaping to the outside environment. In contrast, containment failure in the upper compartment, provided the ice condenser is not degraded, requires that radioactive material pass through the ice compartments before escaping to the outside. In the latter case, retention of material by the ice would substantially reduce the radioactive release.

Consideration of these elements of containment performance, in conjunction with assessment of the degree and the timing of potential challenges to the containment, provides the basis for determining the likelihood and the consequences of scenarios involving containment failure.

C.S.l Issue Definition This issue addresses the response of each of the five containments to the potential pressure loads associated with severe accident conditions. Other containment failure mechanisms, such as penetration by missile, structural failure due to impulse loads (e.g., from hydrogen detonation), and meltthrough by molten material, are excluded from the scope of this issue. These are discussed elsewhere in Appendix C.

The set of plants evaluated in this study was selected to encompass a broad spectrum of containment designs. Consequently, details of important severe accident conditions and modes of containment response differ substantially among the plants analyzed. For this reason, the issue of containment performance is discussed largely on a plant-specific basis. However, it is possible to characterize broadly the range of qualitatively distinct pressure loads that may result from severe accident conditions. These are:

• Gradual pressure rises; Gradual pressurization of the containment building would result from the protracted generation of steam and noncondensible gases through the interaction of molten core material with the concrete floor beneath the reactor vessel. This pressurization process could last from several hours to several days, depending upon accident-specific factors such as the availability of water in the containment and the operability of engineered safety features. An additional mechanism for gradual pressurization in BWR pressure-suppression containments is the generation of steam from the suppression pool in the circumstance that pool heat removal capability is degraded.

• Rapid pressure rises: The high-pressure expulsion of molten material from the vessel, the deflagration of combustible gases, and the rapid generation of steam through the interaction of molten fuel with water in the containment are phenomena that could lead to pressure rises in the containment over a period of a few seconds. Such pressure rises may be viewed as rapid in a thermophysical context; however, from a structural perspective, they are effectively static. It is C-83 NUREG-1150 OAGI0000611 00529

Appendix C essential, nevertheless, to distinguish between gradual and rapid pressure rises in the characterization of containment performance since the rate of pressure increase may have a significant influence upon determining the ultimate mode of containment failure.

This influence stems from the possibility of multiple containment failures or the development of one failure mode into another more severe mode. For example, where gradual containment pressuriza-tion results in containment breach by leakage, the pressure relief associated with the leak prevents further pressurization, and, thus, precludes more severe modes of containment failure. For rapid pressure rises, however, an induced leak would not preclude continued pressurization of the containment and, therefore, a more severe failure of the containment building could ultimately result. Hence, while the distinction between gradual and rapid pressure rises will not influence the pressure at which failure first occurs, it may influence the ultimate severity of that failure.

While the question of containment failure location is largely specific to the individual containment geometries, the approach to characterizing potential failure sizes is more generic. Three possible failure sizes were distinguished in this study: leak, rupture, and catastrophic rupture. Working quantitative definitions of each failure size were based on thermal-hydraulic evaluations of containment depressur-ization times.

• A leak was defined as a containment breach that would arrest a gradual pressure buildup but would not result in containment depressurization in less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The typical leak size was evaluated for all plants to be on the order of 0.1 ft2.

• A rupture was defined as a containment breach that would arrest a gradual pressure buildup and would depressurize the containment within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. For all plants, a rupture was evaluated to correspond to a hole size in excess of approximately 1.0 ft2 *

• A catastrophic rupture was defined as the loss of a substantial portion of the containment boundary with possible disruption of the piping systems that penetrate or are attached to the containment wall.

A panel was assembled to address issues of containment structural performance with severe accident loads. Its members were:

D. Clauss, Sandia National Laboratories, C. Miller, City College of New York, K. Mokhtarian, Chicago Bridge and Iron, Inc.,

J. Rashid, ANATECH, W. Von Riesemann, Sandia National Laboratories, S. Sen, Bechtel, R. Toland, United Engineers and Constructors, A. Walser, Sargent and Lundy, J. Weatherby, Sandia National Laboratories, and D. Wesley, IMPELL.

The experts provided distributions that defined the probability of failure as a function of pressure and of the mode and location of failure. The distinction between rapid and gradual static pressurization cases in determining ultimate failure size was treated within the methodological framework of this study (see Section C.8.3). The experts only addressed initial failure sizes (i.e., they did not distinguish between the rapid and gradual pressurization cases).

C.8.2 Technical Bases for Issue Quantification Detailed structural evaluations of various scopes exist for each of the containments assessed by the expert panel. These evaluations, supplemented by calculations performed by the experts in support of the elicitation process, provided the basis for quantification of this issue for each plant.

Zion The Zion large, dry containment building, shown in Section C.S, is a concrete cylinder with a shallow-domed roof and a flat foundation slab. The thickness of the concrete is 3.5 feet in the walls, 2. 7 NUREG-1150 C-84 OAGI0000611 00530

Appendix C feet in the dome, and 9 feet in the basemat. The containment wall and dome are prestressed by a system of tendons, with each tendon composed of 90 1/4-inch-diameter steel wires, while the foundation slab is reinforced with bonded, reinforcing steel. The entire structure is lined with a 1/4-inch welded steel plate attached to the concrete by means of an angle grid, stitch-welded to the liner plate, and embedded in the concrete. The free volume of the containment is approximately 2.6 million cubic feet and its design internal pressure is 47 psi g.

The three experts who addressed the Zion containment performance issue had access to existing detailed structural calculations of containment response at Zion reported in References C.8.1 to C.8.3.

Two potential failure locations were identified by the expert panel: in the midsection of the cylindrical wall and at the junction between the basemat and the wall. Based upon source term considerations, the distinction between these failure locations was preserved in the risk analyses since failure in the cylindrical wall permits a direct release of radioactive material to the outside environment while failure at the cylinder-basemat intersection occurs approximately 16 feet below ground level. Some degree of ex-containment fission product decontamination prior to atmospheric release would, therefore, be antici-pated in the latter case.

The mechanism for failure in the midsection of the cylindrical wall was assessed to be yielding of the hoop tendons. To develop probability distributions over potential failure pressures, a range of failure criteria of 1 to 2 percent strain in the hoop tendons was assumed. The resulting probability of failure was in the pressure range of 130-140 psig. Leak was anticipated to be the predominant failure size for failure pressures up to 138 psig. For higher failure pressures, breach by rupture was assessed to be more likely.

The possibility that failure would first occur at pressures up to 150 psig was also identified, in which case catastrophic rupture was assessed to be the most likely failure size. However, it was believed that for gradual pressurization cases, the prior occurrence of a leak due to a tear in the liner would likely preclude catastrophic failure of the containment. Reference C.8.1 constituted the main analytical basis for evaluation of this failure location.

The alternative containment breach location identified involved the cracking of concrete at the shear discontinuity between the cylinder wall and the basemat. Only one of the three experts assessed this failure mode to be credible based primarily on Reference C.8.2. Uncertainty in the failure pressure associated with this location was broad. The bulk of probability was assigned to the failure pressure range of 110-180 psig. Failure by leak was assessed to be the most likely size of breach at the wall-basemat junction, although containment rupture was identified as a possibility toward the upper end of the failure pressure range.

Figure C. 8.1 displays the range of failure pressures for the Zion containment at the Sth-9 5th percentile levels. This range is 108-180 psig, which includes all failure sizes and locations. It is based on the distribution that resulted from aggregation of the three expert-specific probability distributions.

Surry The Surry containment building, depicted in Section C.S, is comprised of a vertical right cylinder with a hemispherical roof and a flat foundation slab. It is constructed from reinforced concrete and lined with a 1/4-inch steel plate. The containment atmosphere is maintained during operation at below ambient pressure (at approximately 10 psia), the design internal pressure is 45 psig, and the containment free volume is 1. 8 million cubic feet.

Four experts addressed the issue of containment performance at Surry. The limited availability of structural calculations for the Surry containment led the experts to rely partially upon detailed calculations performed for similar containments, such as Indian Point (Ref. C.8.3).

All failure locations identified for Surry provided direct pathways to the outside environment and the distinction between these locations was, therefore, unnecessary from a risk perspective. Yielding of one of the steel hoop bars that reinforce the vertical concrete wall was identified as a likely mode of failure by all the experts. The likely location of failure was assessed to be near the intersection of the wall with the dome. Evaluation of this failure location was based partially upon the analysis of Reference C.8.4.

Leakage due to the formation of a tear in the steel liner was also identified as the most likely failure mode C-85 NUREG-1150 OAGI0000611 00531

Appendix C 100.0

..... Hlah temp.:

casos 110 0 (a) 14D.O 0.

• J

~

110.0 1000 (e) 0.

~ eo.o

.a i ao.o 10.0 X X X

t X X X oo Zion Surry Soquoyah Poach Botlum Crand Cult (a) Of1well te.mperalure

• BOOOF 95lh porc:enhlo t.

(b) Drywell temperature

• 12000F (e) Drywell preuure capacaty - pro .. uro dirferenUal aero** wall Olh 6th xoe~ian an&ornal pressure Figure C. 8.1 Containment failure pressure.

in light of the results of the 1: 6 scale model reinforced concrete containment test performed at Sandia National Laboratories (Ref. C.8.5). Other potential modes of containment breach identified were failure around pipe and electrical penetrations and failure due to distortion of the hatch opening. However, no consensus existed regarding the credibility of these other modes.

The probability distribution over potential failure pressures resulting from aggregating the distributions of each expert is summarized in Figure C. 8 .1. The Sth-9 5th percentile range of potential failure pressures extends from approximately 95 psig to 150 psig. Leakage was assessed as the most likely mode of failure for breaches occurring up to 140 psig, while ruptures were the *most likely modes of breach for failure pressures in the 140-150 psig range. While higher failure pressures were judged unlikely, the dominant mode of failure beyond 155 psig was assessed to be catastrophic rupture.

Sequoyah The Sequoyah ice condenser containment, shown in Section C.4, is a freestanding steel structure consisting of a cylindrical wall, a hemispherical dome, and a bottom liner plate encased in concrete. The cylinder varies from 1-3/8-inch thickness (at the bottom) to 112 inch (at the dome junction); the dome varies from 7/16-inch thickness (at the cylinder junction) to 15/16 inch (at the apex); and the bottom liner plate is 1/4-inch thick. Vertical and horizontal stiffeners are provided on the outside of the shell.

Three volumes comprise the inside of the containment shell: the lower compartment, the ice condenser, NUREG-1150 C-86 OAGI0000611 00532

Appendix C and the upper compartment. The reactor vessel and reactor coolant system are located in the lower compartment. The ice condenser consists of an annular volume that partially lines the containment wall (subtending an angle of 300 degrees at the center of the containment) and is comprised of a series of ice compartments located between an upper and a lower plenum. The ice condenser is lined with corrugated steel insulating panels designed to withstand an outside pressure of 19 psig. The role of the ice condenser is that of a passive heat sink intended to reduce steam pressures generated in design basis accident conditions.

The only significant structure within the upper compartment is the polar crane. Since the containment is equipped with the ice condenser pressure-suppression system, it is designed to an internal pressure of only 10.8 psig, with a free volume of 1.2 million cubic feet. A concrete shield building surrounds the steel shell.

However, it is not a significant barrier to fission product release since its pressure capacity is substantially less than that of the shell.

Structural assessment of the Sequoyah containment required certain severe accident considerations specific to the ice condenser design. The location of containment failure relative to the position of the ice condenser and the structural integrity of the ice condenser are crucial factors in determining the concomitant radioactive release. If the route taken by radioactive aerosols to the outside environment involves passage through the ice, significant retention of radioactive material within the containment would be expected. Failure of the containment in the lower compartment or significant disruption of the ice would involve bypass of the ice compartments. Since the ice condenser constitutes the only passageway from the reactor vessel to the upper compartment, failure in the latter will avoid ice condenser bypass.

Ultimately, however, the effect of failure location upon the source term is determined by the availability of ice, which in turn is dependent upon the accident sequence under consideration.

A further concomitant of the compartmentalized nature of the ice condenser containment is the possibility of localized accumulations of hydrogen and the possibility of containment failure through hydrogen deflagration or detonation. While the issue of containment response to hydrogen deflagration was subsumed in the case of rapid pressurization, the effects of hydrogen detonation and the associated dynamic loads were considered separately by the experts. Response of the Sequoyah containment to impulse loads is discussed in Section C.4.

Three experts addressed the issue of containment response to pressure loads at Sequoyah based on the detailed analyses of References C.8.1 and C.8.6 and on supplemental hand calculations. Membrane failure in the cylindrical wall of the upper compartment via either rupture or catastrophic rupture was identified as the most likely mode of containment failure. Failure criteria adopted involved a range of strain levels (2-10%) in the shell membrane. Since the ice condenser is attached to the cylindrical wall and subtends an angle of 300 degrees at the central containment axis, 516 of the ruptures in the wall of the upper compartment are expected to occur in the ice condenser. Catastrophic rupture of the wall, in contrast, would always fail the ice condenser.

One expert identified the possibility of failure in the lower compartment due to a crack in the weld at the point of embedment. Such a failure would result in ice condenser bypass. Based upon results of the 1:8 scale steel containment pressurization tests (Ref. C. 8. 7), two experts identified the possibility of containment leakage due to ovalization of the equipment hatch flange. The equipment hatch, a door 20 feet in diameter, is located in the upper compartment, and its failure would not result in ice condenser bypass.

Rupture or catastrophic rupture were assessed to be the most likely modes of failure in the Sequoyah containment. The only failure location associated with leakage involved ovalization of the hatch. While one expert predicted the occurrence of such a leak in the 65-70 psig range, a second expert believed that such a failure would not be likely to occur below 120 psig and that shell rupture would probably occur first. The third expert excluded this failure possibility completely. At the 5th-95th percentile levels, the range of failure pressures resulting from aggregating the individual expert distributions was 40-9 5 psig.

For aU potential failure pressures, the probability of ice condenser bypass exceeded the probability of no bypass by factors of between 5 and 10. This stems from the dominance of the catastrophic rupture failure modes at Sequoyah. Catastrophic rupture is assumed always to fail the ice condenser since the ice compartments subtend most of the containment wall area. As discussed earlier, all failures in the lower C-87 NUREG-1150 OAGI0000611 00533

Appendix C compartment bypass the ice. The probability distribution over potential failure pressures at Sequoyah is summarized in Figure C. 8.1.

Peach Bottom The Peach Bottom containment, shown in Section C.7, is of the Mark I pressure-suppression type. The steel "light-bulb-shaped" drywell that contains the reactor vessel is a steel spherical shell intersected by a circular cylinder. The top of the cylinder is closed by a head bolted to the drywell. The pressure-suppres-sion chamber, or the wetwell, is a toroidal steel vessel located below and encircling the drywell. The wetwell and drywell are interconnected by eight circular vent pipes. The containment is enclosed by the reactor building, which also contains the refueling area, fuel storage facilities, and other auxiliary systems.

In the event of primary system piping failure within the drywell, a mixture of drywell atmosphere and steam would be forced through the vents into the suppression pool resulting in steam condensation and pressure reduction. The design internal pressure of the containment is 56 psig and the free volumes of the drywell and wetwell are 159,000 cubic feet and 119,000 cubic feet, respectively.

From a source term perspective, the location of containment failure relative to the suppression pool and to structures external to the containment is important. Three experts evaluated containment performance at Peach Bottom. Based on prior detailed analyses of Mark I designs (Refs. C.8.1 and C.8.8) and on calculations supporting the opinion elicitation process, several failure locations were considered credible:

• Wetwell above the water line. In this case, the suppression pool would not be bypassed.

• Wetwell below the water line. Consequent drainage of the wetwell would effectively result in pool bypass.

• Drywell near the vent pipes. This would result in suppression pool bypass although some credit would be taken for fission product decontamination by the reactor building.

• Drywell head. In this case, the suppression pool would be bypassed although some credit would be taken for fission product decontamination in the refueling area.

The relative likelihood of leak versus rupture was considered dependent on the failure location and the associated failure mechanisms. For example, one expert assessed the relative likelihood of a leak occurring in the wetwel! below the water line to be low since any leak at that location would develop rapidly into a rupture. The predicted failure mechanism was a crack in the hoop direction, which would rapidly unzip, given the absence of a mechanism to arrest the rupture.

Because of the small volume of the Peach Bottom containment, the possible effect upon containment pressure capacity of the high drywell temperatures expected to occur in scenarios involving the attack of concrete beneath the vessel by molten core debris was considered. Such temperatures could be as high as 800°F to 1200°F and might substantially reduce material strengths. One expert assumed, for example, that material strength in the drywell at the vent pipes would be reduced by between 25 percent and 90 percent and that gasket resiliency at the drywell head would be lost. Since wetwell temperatures were assessed to be at saturation, high drywell temperatures were determined to have little impact upon the pressure capacity of the wetwell.

In low-temperature conditions, the range of possible failure pressures for the Peach Bottom containment was determined to be 120-17 4 psig. This reflects the Sth-9 5th. percentile interval of the probability distribution resulting from aggregating the expert-specific distributions. Conditional upon containment failure in the lower part of this range, 50 percent of probability was associated with leakage at the drywell head while the remaining failure probability was dominated by wetwell leakage above the suppression pool. At the top edge of the failure pressure range, wetwell rupture above and below the suppression pool were each assessed to account for 25 percent of the total failure probability, with catastrophic wetwell rupture accounting for a further 10 percent. Leakage in the drywell (principally at the head) accounted for approximately 25 percent of the conditional failure probability, with wetwellleakage accounting for the remaining 15 percent.

Two high drywell temperature cases were considered by the experts: 800°F and 1200°F. The 5th-95th percentile failure pressure ranges were assessed to be 75-150 psig and 6-67 psig, respectively. With the NUREG-1150 C-88 OAGI0000611 00534

Appendix C drywell at 800°F, failure at the lower edge of the pressure range was assessed to be dominated by leakage in the drywell, principally (90% of the probability) through degradation of the head gasket. Toward the higher end of the failure pressure range, wetwell leaks above the suppression pool accounted for 30 percent of the failure probability, drywellleakage for a further 40 percent, and rupture at the drywell head for 12 percent. In the highest drywell temperature regime, i.e., 1200°F, the reduction in material strengths was assessed to ensure failure in the drywell. At the lower boundary of the failure pressure range, leakage in the drywell (principally at the head) was assessed to account for 9 5 percent of the failure probability while, at the upper boundary of the failure pressure range, drywell ruptures (principally in the main body of the drywell) were assessed to be as likely as leaks. Figure C.S.l summarizes the aggregated probability distributions over possible containment failure pressures at Peach Bottom.

Grand Gulf The Grand Gulf containment, shown in Section C.4, is of the Mark III pressure-suppression type. It is constructed from reinforced concrete lined with a 1/4-inch welded steel plate. The circular foundation mat, the cylindrical wall, and the hemispherical dome are 9.5, 3.5, and 2.5 feet thick, respectively. The containment volume is divided into two main compartments: the drywell, which is the central cylindrical volume of the containment and houses the reactor vessel; and the wetwell, which constitutes the outer annular volume and the dome. These compartments are connected at the base of the containment via an annular pool that provides a passive heat sink for steam in design basis accident conditions. The drywell wall, composed of reinforced concrete, is 5 feet thick and lined with 1/4-inch steel plate. Since the Grand Gulf containment is equipped with pressure-suppression features, its nominal design internal pressure is only 15 psig. The drywell has a design internal pressure of 30 psid (i.e., the differential pressure across the drywell-wetwell boundary). The free volumes of the wetwell and the drywell are 1.4 million and 270,100 cubic feet, respectively.

From a severe accident perspective, an important feature of the Mark III design is the relative configuration of the drywell, the suppression pool, and the wetwell. This configuration ensures that, provided the integrity of the drywell wall is not compromised, radioactive material released from the fuel would need to pass through the suppression pool to escape from the containment, if breached. This would result in significant radioactive material retention by the pool. In assessing performance of the Mark III, it is important, therefore, to determine the response to severe accident conditions not only of the outer containment but also of the drywell.

Given the low-pressure capacity of the Grand Gulf containment relative to anticipated pressure loads, the study project team assessed minimal uncertainty to be associated with response of the Grand Gulf containment to severe accident pressurization levels. To use expert resources most efficiently, therefore, the issue of static overpressurization at Grand Gulf was not taken to the expert panel on containment structural performance issues. The required probability distributions were developed by a structural expert at Sandia National Laboratories, who had been a member of the original panel. Detailed structural evaluations of containment performance at Grand Gulf reported in Reference C.8.1 provided a basis for the expert's evaluation. The dominant failure location of the containment due to static overpressurization was assessed to be at the intersection of the cylinder wall and the dome.

The lower bound of the Grand Gulf distribution over failure pressures was assessed to be approximately twice the design internal pressure. The upper distribution bound was identified with the calculated ultimate material strength of the steel-reinforced concrete containment. A distribution between these bounding points was then developed.

Pressure capacity distributions for the drywell were developed in a similar way. Based on the various potential failure locations in the drywell, the wall was assessed to be the weakest structure and therefore the most likely failure point. The expert determined that the failure criterion was, in terms of the pressure differential across the drywell, independent of the direction of the pressure gradient. At the 5th-95th percentile level, the range of potential failure pressures for the Grand Gulf containment and drywell were 38-72 psig and 50-120 psid, respectively. Figure C.8.1 summarizes the underlying probability distribu-tions.

C.8.3 Treatment in PRA and Results Within the accident progression event trees (APETs) developed in this study, the probability of containment failure associated with each identified accident progression path was determined by C-89 NUREG-1150 OAGI0000611 00535

Appendix C comparing the value of the containment load selected from its distribution to the selected value of the load capability. As part of the overall uncertainty analyses, Monte Carlo methods were used to randomly select values for containment loads and load capacity from their distributions (Ref. C.8.9). Among the elements of each sample member were a containment failure pressure, with the corresponding failure size and failure location. For some plants, more than one load and capacity pair may be selected to simultaneously represent alternative challenges to containment integrity. In the Peach Bottom analysis, for example, one combination would dictate the containment pressure capacity, the failure size, and the failure location corresponding to rapid pressure rises at vessel breach. Another combination would characterize containment response to gradual pressure rises.

Each sample member also contained a series of pressure loads corresponding to load-generating events that occur over the time represented by the accident progression. For each accident progression, the loads and the load capacities in the sample member are compared in a time-ordered way. If the first load exceeds the corresponding pressure capacity, the containment is assumed to fail at that time (unless preceded by containment breach due to some other failure mechanism, such as impulse loading or thermal attack). The location and the size of the failure are specified in the sample member. A relative frequency of 1 (i.e., the split fraction) is then attached to the selected failure size and location conditional upon the prior path taken through the containment event tree. If none of the loads exceeded the pressure capacity, then the containment is assumed to retain its integrity unless breached by some other mechanism.

Based upon the findings of the expert panel on containment structural performance issues, the pressure at which a containment first failed was modeled to be independent of the pressurization rate. However, the ultimate size and location of failure was coupled to the pressurization rate in this study. Since the experts focused largely on the issue of the initial mode of containment failure, their distributions over failure size and location could not be used directly in the treatment of rapid pressure rises. For example, if leak were the initial failure size resulting from rapid pressurization, then, since a leak could not* halt further pressurization, whether a more severe breach of the containment would occur subsequently was considered.

To generate probability distributions over ultimate failure modes in the case of rapid pressure rises, both the containment failure pressure and the peak pressure load in any one sample member were considered for each case. If the failure pressure exceeded the peak pressure, failure was assumed not to occur. If, however, the peak pressure exceeded the failure pressure, then a probability distribution over potential failure modes was constructed, which accounted for the possibility that containment rupture or cata-strophic rupture could occur after a leak developed and before the peak pressurization level was reached.

Sampling from this distribution provided the ultimate failure size and location.

In the Grand Gulf analysis, drywell and containment performance were evaluated in similar ways.

Structural performance of the drywell became an issue for conditions in which a pressure differential is established across the drywell-wetwell boundary. This occurs in cases of rapid pressurization (e.g.,

hydrogen deflagration in the wetwell or loads from vessel breach) where the inertia of water in the suppression pool prevents immediate pressure equalization across the boundary. Within each sample member, the pressure differential for each accident progression was compared to the sampled drywell pressure capacity. High correlations were imposed in sampling from probability distributions over the drywell and the containment pressure capacities since the same basic uncertainties were involved in each.

Table C. 8.1 summarizes the failure pressure ranges and the likely modes of containment overpressure failure identified by the expert panel for each plant.

The influence of the containment failure pressure on risk and uncertainty in risk for each plant is dependent ultimately on the predicted severe accident pressure loads and the relative likelihood of containment breach by other mechanisms, such as thermal attack. Since scenarios involving failure or bypass of the containment at or before vessel breach were found to be the dominant contributors to offsite risk, the importance of overpressure failure modes to risk may be characterized in terms of their contribution to bypass and early containment failures. Similarly, the importance of uncertainty in the failure pressure can be evaluated in terms of the impact upon the conditional probability of early containment failure of varying the failure pressure within its range of uncertainty. These importance NUREG-1150 C-90 OAGI0000611 00536

Appendix C Table C.S.1 Containment strength under static pressure loads: summary information.

Design Failure Containment Free Internal Pressure Volume Pressure Range(a) Sizes/Locations Plant (Millions of Cubic Feet) (psi g) (psig) Dominant Failure Zion 2.6 47 108-180 Leak/rupture in cylinder wall or basemat/wall intersection Surry 1.8 45 95-150 Leak/rupture near dome/wall intersection Sequoyah 1.2 11 40-95 Gross rupture of the contain-ment or rupture in the lower compartment Peach 0.16 (drywell) 56 120-174 Leak at drywell head or Bottom 0.12 (wetwell) leak/rupture of wetwell high temp case: (b) Leak at drywell head or in 75-150 wetwell above suppression pool high temp case: (c) Leak at drywell head or 6-67 rupture of drywe11 wall Grand 0.27 (drywell) 15 38-72 Leak/rupture near dome/wall Gulf 1. 4 (wetwell) intersection Drywell: 30(d) 50-120 (d) 5\ ,.,_.,.,- *mg<

Dcywell temperature at 800°F Dcywell temperature at 1200°F

$ Dzywell/wetwell pressure differential in psi measures are discussed briefly for each plant. For direct comparison among plants, attention is confined to internal initiating events.

Early containment failure scenarios dominate all offsite risk measures at Zion. The robustness of the Zion containment ensures, however. that the mean frequency of early containment breach conditional on core damage is small (approximately 1%). Ten percent of early containment failures are due to overpressure, the remainder being associated with in-vessel steam explosions (see Section C.9) and pre-existing containment isolation failures. Variations in the failure pressure within its range of uncertainty result in a minimal change to the risk profile at Zion, given the high strength of the containment relative to anticipated loads.

Similarly, the Surry containment appears to be extremely robust. Its mean frequency of early failure conditional on core damage is less than 1 percent. Accident scenarios involving bypass of the containment dominate all offsite risk measures while early containment failures contribute approximately one-quarter or less. Less than 60 percent of early failures are associated with containment overpressure. The remainder result from in-vessel steam e?'plosions. As for Zion, variation of the containment failure pressure within its reasonable range of uncertainty would be expected to result in minimal change in the risk profile at Surry because of the high strength of the containment.

At Sequoyah, approximately 73 percent of mean early fatality risk results from scenarios involving bypass of the containment; the remaining mean early fatality risk is *due to early containment failures in loss-of-offsite-power sequences. Early containment failures account for the remaining early fatality risk and for approximately one-half of the latent cancer fatality risk. Containment overpressure accounts for approximately 90 percent of early failures, while direct contact of molten debris with the steel containment, impulse loads from hydrogen detonation, in-vessel steam explosions, pre-existing isolatioq.

failures, and ex-vessel steam explosions constitute the remaining 10 percent. The mean frequency of containment failure conditional on core damage is approximately 7 percent. Comparison of this value with C-91 NUREG-1150 OAGI0000611 00537

Appendix C the early failure frequency of the large, dry containments reflects the lower pressure capacity of the ice condenser design. The overlap between anticipated pressure loads and the range of containment failure pressures at Sequoyah leads to the conclusion that uncertainty in the overpressure criterion may have an impact on uncertainty in risk.

Scenarios involving early failure of the drywell dominate all offsite risk measures at Peach Bottom both because of the high mean conditional frequency of this mode of failure (approximately 50%) and because of the associated bypass of the suppression pool by radioactive material. The dominant mechanism for early drywell failure is attack of the drywell wall by molten debris on the cavity floor. The mean conditional frequency of early wetwell failure at Peach Bottom is approximately 3 percent. This is dominated by overpressure failures. The contribution to risk of early wetwell failure is minor, however (approximately 1% for the mean estimate of early and latent cancer fatality risk). Consequently, uncertainty in the failure pressure level at Peach Bottom has minimal influence upon uncertainty in risk.

At Grand Gulf, overpressurization is the dominant mechanism for failure of the containment and for failure of the drywell. Scenarios involving early failure of both the containment and the drywell are the principal contributors to all offsite risk measures. The mean frequency of these scenarios conditional upon core damage is approximately 20 percent. Variation of the containment failure pressure within its estimated range of uncertainty has a minimal impact on the performance of the Grand Gulf containment, given its low structural strength relative to the anticipated pressure loads, principally from hydrogen deflagration.

Considerable overlap exists between the range of drywell failure pressures and the range of anticipated pressure loads on the Grand Gulf drywell. The assumption that the drywell failure pressure lies toward the lower end of its uncertainty range could, therefore, result in a significant increase in mean offsite risk. The assumption of a high drywell failure pressure would not be expected to decrease risk significantly, however, since additional mechanisms exist for early failure of the drywell wall. These mechanisms involve pedestal collapse at the time of vessel breach, due either to overpressure or an ex-vessel steam explosion (see Section C. 9), and subsequent failure of the drywell wall, due to damage incurred by penetrating pipes.

In summary, containment failures due to overpressure are significant contributors to risk at all plants except Peach Bottom. Uncertainty in structural failure pressure has the potential to significantly influence uncertainty in risk only for the Sequoyah containment and the Grand Gulf drywell. For other containment structures, there is limited overlap between the range of anticipated pressure loads and the uncertainty range of failure pressures.

More details of the treatment of containment structural performance issues in this study can be found in Reference C. 8 .1 0.

REFERENCES FOR SECTION C.8 C.8.1 IDCOR Technical Report 10.1, "Containment Capability of Light Water Nuclear Power Plants,"

July 1983.

C.8.2 S. Sharma et al., "Ultimate Pressure Capacity of Reinforced and Prestressed Concrete Containment," Brookhaven National Laboratory, NUREG/CR-4149, BNL-NUREG-51857, May 1985.

C.8.3 T.A. Butler and L.E. Fugelso, "Response of the Zion and Indian Point Containment Buildings to Severe Accident Pressures," Los Alamos Scientific Laboratory, NUREG/CR-2569, LA-9301-MS, May 1982.

C.8.4 W.J. Pananos and C.F. Reeves, "Containment Integrity at Surry Nuclear Power Station," Stone

& Webster Engineering Corp., TP84-13, 1984.

c.s.s R.A. Dameron et al., "Analytical Correlation and Post-Test Analysis of the Sandia 1:6-Scale Reinforced Concrete Containment Test," Fourth Workshop on Containment Integrity (Ar-lington, VA), June 14-17, 1988.

NUREG-1150 C-92 OAGI0000611 00538

Appendix C C.9 Containment Failure as a Result of Steam Explosions A steam explosion is the result of rapid transfer of thermal energy from a hot liquid to water over a time scale of the order of milliseconds. Industrial experience has revealed that such explosions have the potential to do significant damage.

The possibility that certain severely degraded reactor core conditions, involving the flow of molten core material into a pool of water in the lower plenum of the reactor vessel, could be conducive to the occurrence of a steam explosion was first assessed in the Reactor Safety Study, WASH-1400. The in-vessel steam explosion scenario may be of particular significance in determining the risk profile of a nuclear power plant since, not only does this phenomenon allow the possibility of catastrophic pressure vessel breach, but the concomitant generation of a missile consisting of the upper head of the vessel could lead to failure of the containment building. An in-vessel steam explosion is a phenomenon, therefore, that could breach the last two barriers between fission products in the core and the ex-containment environment virtually simultaneously. Containment failure resulting from an in-vessel steam explosion was termed "alpha-mode failure" in the Reactor Safety Study.

The sequence of events constituting the hypothesized alpha-mode failure scenario is as follows: Because of either failure of the reactor coolant system boundary or loss of the core heat removal function, the core uncovers. The generation of fission product decay heat and the exothermic oxidation of fuel cladding results in core degradation until liquefaction of the fuel occurs. The relocation of liquefied material to cooler locations near the lower core support plate results in freezing of the fuel and the consequent formation of a crust. This crust supports the molten material that is formed. When the mass of molten material reaches a critical limit, the crust can no longer support it, and the material flows coherently into any water remaining in the lower plenum of the vessel. A steam explosion occurs, generating an upward moving slug of water and molten fuel, which lifts the upper head of the vessel. The reactor head then acts as a missile that perforates any structures above the vessel and, ultimately, penetrates the containment building.

The risk impact of a steam explosion is not confined to the in-vessel phase of a severe accident. When water is present in the reactor cavity or pedestal region at the time of vessel failure, the contact of molten core debris with the water may result in a steam explosion. If the containment geometry is such that an ex-vessel water pool could contact the containment wall or could contact structures that, if disrupted, would result in impairment of the containment function, then ex-vessel steam explosions can have potentially significant risk impact.

It should be noted that an ex-vessel steam explosion may result not only in an impulse load, but also in a quasistatic pressure load on containment structures. Indeed, in assessing pressure loads at vessel breach, the expert panel on containment loading issues accounted for the possibility of load contributions from ex-vessel steam explosions in the development of their probability distributions (see Section C. 5). The current section, however, focuses upon challenges to containment structures associated uniquely with the dynamic loads resulting from ex-vessel steam explosions.

The consequences associated with in-vessel and ex-vessel steam explosions, as with other scenarios resulting in early breach of the containment building, are potentially significant. Determining the risk posed by steam explosion scenarios, however, demands not only an evaluation of the resultant consequences but also an assessment of their probability of occurrence. Evaluation of this probability is the focus of the steam explosion issue.

C.9.1 Issue Definition The range of accident scenarios addressed in the containment analyses of this study includes alpha-mode failure and containment breach due to an ex-vessel steam explosion. The current discussion focuses on the specific accident scenarios and plants for which the steam explosion phenomenon is of the greatest potential risk significance.

C.9.1.1 In-Vessel Steam Explosions For in-vessel steam explosions, attention is confined to large, dry containment PWR reactor systems.

While there currently exists no clear basis for the assumption that other reactor/containment types are less NUREG-1150 C-94 OAGI0000611 00539

Appendix C vulnerable to alpha-mode failure, different modes of containment breach were identified in this study as dominating at other plants. The alpha-mode probability distributions developed in the resolution of this issue were applied, however, to all the plants studied. The accident scenarios of particular concern relative to alpha-mode failure are those in which core degradation occurs at low reactor coolant system pressures since experiments indicate that high ambient pressures tend to reduce the likelihood of, although not preclude, the triggering of a steam explosion (Ref. C.9.1).

To quantify the accident progression models in these analyses, the in-vessel steam explosion issue was defined in terms of the probability, conditional upon core degradation at low ambient pressures, of the occurrence of alpha-mode failure.

While numerous small and intermediate scale simulant tests have provided substantial data, and related analytical models of steam explosion phenomena exist (Refs. C.9.2 and C.9.3), there is limited agreement within the technical community regarding the probable phenomena that govern the onset and the effects of an in-vessel steam explosion. Much of the uncertainty about steam explosion phenomenology is associated with the applicability of small and intermediate scale test results (typically involving a melt mass of less than 40 lb) to actual reactor scales and geometries (involving molten fuel masses of up to 280,000 lb in a PWR). Additionally, there is no consensus regarding the appropriateness of the various analytical models that have been useq to evaluate the phenomena governing the alpha-mode scenario.

The fundamental energetic condition for alpha-mode failure is that, of the thermal energy contained in the reactor fuel, the amount converted ultimately into the kinetic energy of an upward moving missile is sufficient to permit penetration of the containment building. The maximum total heat content of the fuel elements of a typical PWR is of the order of 105 megajoules (MJ). The energy required to fail the reactor vessel is of the order of 103 MJ, while energies sufficient to fail a large, dry containment building are also of the order of 103 MJ. Simple energy balance considerations, therefore, cannot provide a basis for excluding the alpha-mode failure scenario. Hence, the crucial questions surrounding the alpha-mode issue relate to the ultimate partition of energy, both with respect to its form (thermal, kinetic, strain, and gravitational) and with respect to the mechanical elements of the system in which it resides (molten debris, in-vessel water, reactor internals, containment building shield, and upward and downward moving missiles).

The energy partition question can be addressed through decomposition of the alpha-mode failure scenario into several phases. The first phase involves the transfer of thermal energy from the molten fuel to water in the lower plenum of the reactor vessel. Subissues relating to this phase are the availability of molten core debris and water for interaction over explosive time scales, the geometry of the debris (since this determines the efficiency of the thermal interactions), and the existence of a steam explosion trigger. The second phase involves the generation of an upward moving slug (water, melt, and structural materials) within the vessel. Subissues relating to this phase are the fraction of thermal energy involved in the steam explosion that is converted to kinetic energy, possible failure of the lower head of the vessel thereby relieving the in-vessel explosive pressures, and the distribution of kinetic energy between the upward moving slug and a downward moving slug.

The third phase involves failure of the vessel upper head. Related subissues are the fraction of the initial energy of the slug that is dissipated as strain energy in the upper internal structural components of the vessel (e.g., upper core support plate, control rod drives) and, if the upper head of the vessel fails, the energy of the missile thereby generated. The fourth phase involves the impact of the missile upon the vessel shield where the relevant issue is the associated degree of energy dissipation. The final phase involves failure of the containment building. The crucial issue here is, given the loss of kinetic energy by the missile associated with its ascension to the containment boundary, the capability of the missile to penetrate the containment.

In 1984, a panel of experts was convened to summarize current understanding of steam explosion phenomena and to assess the likelihood of alpha-mode failure. The 13-member Steam Explosion Review Group (SERG) represented substantial cumulative experience in the experimental investigation and the analytic modeling of severe accident phenomena. Findings of the panel were published in June 1985 (Ref.

C.9.4). The mandate of the panel also included review and assessment of analytical work undertaken by Berman et al. (Ref. C.9.5), which addressed the likelihood of alpha-mode failure. To encapsulate the spectrum of expert views on the steam explosion issue, this study drew upon both the findings of SERG C-95 NUREG-1150 OAGI0000611 00540

Appendix C and the judgment provided by the primary author of the work reviewed by SERG. The views of each participating expert were then weighted equally in arriving at the final characterization of uncertainty in the likelihood of alpha-mode failure.

Prior to their use in this study, members of the SERG panel reviewed the probability distributions relating to alpha-mode failure that, based upon the earlier findings of SERG, had been developed at Sandia National Laboratories. Through consideration of the way in which their findings had been interpreted and of relevant information acquired since publication of the SERG report, the same panel members modified the distributions tentatively developed. These modified distributions provided the basis for this study.

C.9.1.2 Ex-Vessel Steam Explosions Each plant evaluated in this study was screened for potential vulnerabilities to ex-vessel steam explosions.

The containment design assessed to display the most significant vulnerability was Grand Gulf. The scenario of concern in the Mark III design is one in which a steam explosion impulse is delivered to the reactor pedestal through water on the drywell floor. The likelihood of a deep water pool in the drywell at Grand Gulf is high during the course of a severe accident. A dominant mechanism for this is the expulsion of water from the suppression pool as a result of pressurization of the wetwell through hydrogen deflagration. Upon receiving the explosion impulse, the pedestal collapses, resulting in failure of the drywell wall due either to impact by the unsupported vessel or damage by the penetrating steam line and feedwater pipes. Loss of the drywell wall then permits bypass of the suppression pool by fission products in the event of pre-existing or subsequent containment failure. The potentially significant risk impact of drywell failure at Grand Gulf stems from the relatively high likelihood of containment overpressure either prior to or following vessel breach.

The Zion and Surry containments were not assessed to have significant vulnerability to impulse loads from ex-vessel steam explosions since water in the cavity would not directly contact structures that are both vulnerable and essential to the containment function. Initial assessment of the Peach Bottom and Sequoyah containment designs identified potential vulnerability to ex-vessel steam explosions, associated principally with pedestal collapse (Peach Bottom) and seal table disruption or vessel dislocation (Sequoyah). However, scoping shock wave hydrodynamics calculations and application of underwater impulse correlations (based on Ref. C.9.6) revealed minimal threat to these containments from ex-vessel steam explosions.

Attention was focused therefore on the Grand Gulf containment. The ex-vessel steam explosion issue was couched in terms of three parameters:

• The likelihood (conditional frequency) of an ex-vessel steam explosion occurring conditional upon the presence of water in the cavity at vessel breach.

• The likelihood of pedestal failure conditional upon the occurrence of a steam explosion.

• The likelihood of drywell failure due to collapse of the pedestal.

Evaluation of these parameters was based upon impulse loading calculations performed at Sandia and upon the elicitation of judgments from the expert panel on containment structural performance issues (see Section C.8).

C.9.2 Technical Bases for Issue Quantification C.9.2.1 In-Vessel Steam Explosions The approach adopted by most of the experts in determining the probability of alpha-mode failure was jecomposition of the scenario into a sequence of events and the assignment of a probability, or a range of probabilities, to each constituent event (Ref. C. 9. 4). These events constituted elements of the four phases of alpha-mode failure defined in the previous section. The product of event-level probabilities was then equated with the probability of alpha-mode failure. Other experts adopted variant approaches in which probabilistic judgment was exercised directly at the level of the compound-event alpha-mode failure, or in which probability distributions reflecting uncertainty in relevant physical parameters were propagated NUREG-1150 C-96 OAGI0000611 00541

Appendix C through deterministic models to determine the probability of alpha-mode failure. These latter approaches do not permit straightforward extraction of the probabilities associated with the primary-level events, and direct comparison of the event likelihoods assessed by all the experts is therefore difficult. The range of views in each phenomenological area is described here, and direct comparisons of expert-specific probabilities are made where possible.

Initial Conditions For the energy involved in a steam explosion to be commensurate with the energies associated with vessel and containment failure, sufficient amounts of molten material and water must be available to participate.

Additionally, a coherent pour of melt into the water is required to ensure maximal participation of the melt available over explosive time scales. While some experts assigned a low likelihood to the required initial conditions, based on the premise that the meltdown process would involve the incoherent dripping of molten material into the lower plenum, others assigned probabilities in the range of 0. 75 to 1.0 for the occurrence of the required conditions. These higher probabilities were based generally upon identification of a scenario in which a crust of refrozen melt at the lower core support plate breaks suddenly, permitting the coherent release of molten material into the lower plenum. Substantial uncertainty was identified regarding the process of the core degradation and fuel relocation.

Molten Core/Water Mixing The degree of interpenetration between the melt and water in the lower plenum determines the efficiency of thermal interaction between the two media. Currently no widely accepted model of molten fuel/water mixing under severe accident conditions exists. \Vhile efficient mixing has been observed in several small and intermediate scale tests (Ref. C.9.7), various experts argued that scaling effects prevent the conclusion that efficient mixing would occur in full-scale reactor geometries. One analytical model involves a process in which hydrodynamic instabilities break up the fuel jet as it pours into the lower plenum. Rapid steam production (although not as rapid as that associated with a steam explosion) then expels water from the mixing region, thereby severely limiting the potential for effective mixing.

This process of jet fragmentation and fluidization as a result of hydrodynamic instabilities was not accepted by all participating experts, however. A process in which a blanket of steam forms around the jet body, thus limiting access by water to the jet, was the basis for an alternative model. This model confines fragmentation of the melt to the leading edge of the jet, thereby reducing the potential for mixing.

The initial mixing of melt and water as a condition for large-scale steam explosions was questioned by some experts. It was observed that, even for an initial configuration involving minimal fragmentation of the melt, the occurrence of small steam explosions sufficient to disrupt the melt could create boundary conditions conducive to the onset of a larger explosion. While no model of the net effects of preliminary steam explosions upon in-vessel melt/water configurations exists, the observation of multiple steam explosions in small-scale tests prevents the exclusion of such scenarios from consideration. Where probabilities were assigned specifically to the event of large-scale mixing conditional upon a coherent melt pour, they ranged from 10..2 to 0. 3.

Explosion Trigger While large-scale mixing of melt with water provides boundary conditions required for significant thermal interactions between the two media, the question of whether that interaction takes the form of a steam explosion is dependent upon whether a trigger is present. The mechanism for triggering a steam explosion is poorly understood. One model involves the onset of oscillations in the steam film barrier isolating a molten fuel fragment from water. Where these oscillations permit direct contact of fuel with water, a trigger occurs. Experiments reveal that the existence of a trigger is extremely sensitive to initial conditions (Ref. C.9.1) and that triggering becomes less likely at high ambient pressures. For low reactor coolant system pressure scenarios, those experts who provided a probability relating specifically to the occurrence of a trigger assessed it to be equal to unity.

Explosion Efficiency Fundamental thermodynamic factors limit the efficiency with which the thermal energy involved in a steam explosion may be converted into kinetic energy. While this theoretical, maximum conversion ratio C-97 NUREG-1150 OAGI0000611 00542

Appendix C is in the range of 40-50 percent (based upon Hicks-Menzies conditions), the value appropriate for a reactor configuration depends upon the constraints provided by the internal vessel geometry. The experts agreed that conversion ratios of up to 15 percent are possible.

Slug Formation and Vessel Head Impact The primary mechanism for transmittal of the kinetic energy generated by the steam explosion to the upper head of the vessel is the formation of an upward-moving slug composed of molten fuel, water, and structural material. The resultant impulse upon the upper head could also be supplemented by the transmittal of an impulse from the lower core support plate, through the core barrel, to the upper head flange. The possibility also exists that the pressures generated by the steam explosion could result in failure of the lower head, thereby venting explosive pressures in the vessel and reducing the energy delivered to the upper head. Much of the uncertainty associated with the likelihood of upper head failure relates to the distribution of material within the vessel. For example, uncertainty regarding the fraction of the molten fuel and water inventories above the trigger location was taken into account explicitly by some of the experts in determining the possible mass and composition of the upward-moving slug. Uncertainty was identified also in estimating the fraction of the slug's kinetic energy dissipated as strains within the upper internal components of the vessel. Expert-specific point-value probabilities assigned to the event of upper head failure and the generation of a missile capable of failing containment (conditional upon significant thermal energy conversion) ranged from 10..2 to 1, although one expert provided a probability range extending from 10-4 to 1.

Vessel Head Failure and Containment Breach Following bolt failure at the upper head flanges, development of the alpha-mode failure scenario involves impact of the dislocated vessel head against the missile barrier positioned above the vessel. The barrier is perforated, thus attenuating the energy of the missile. The missile continues to rise, expending kinetic energy to acquire gravitational potential energy, and ultimately impinges upon the containment wall. Some of the experts based their assessments of the likelihood of containment failure upon detailed structural calculations. Those experts who assigned probabilities to individual events within the alpha-mode scenario generally absorbed the structural uncertainties into their assessment of the probability of vessel head failure by defining such a failure as one that generates a missile capable of penetrating the containment.

C.9.2.2 Ex-Vessel Steam Explosions The scenario of concern at Grand Gulf is one in which molten debris is released from the breached vessel into a deep water pool (about 7 meters) on the drywell floor. A steam explosion is triggered, which delivers an impulse load to the reactor pedestal. The pedestal collapses leaving the reactor vessel unsupported. The drywell wall then fails as a result of damage caused by the penetrating vessel piping or by direct contact by the vessel. The accident progression models developed for this study decompose the ex-vessel steam explosion scenario into three phases: (1) occurrence of the steam explosion, (2) subsequent failure of the pedestal, and (3) subsequent failure of the drywell wall.

Occurrence of Steam Explosion The parameter evaluated for this phase of the scenario is the fraction of occasions upon which a steam explosion would be triggered conditional upon the release of molten debris from the vessel to an underlying water pool. An estimate of 0.86 for this parameter was based upon intermediate-scale experimental results in which 8 6 percent of tests involving the release of molten thermite into water at low ambient pressures resulted in a significant steam explosion (Ref. C.9. 7).

Failure of Pedestal Assessment of the dynamic load capacity of the pedestal was based upon adaptation of information elicited from the expert panel on containment structural performance issues regarding the strength of the drywell wall and upon supplementary information provided by a structural expert from Sandia, who had been a member of the original panel. The expert aggregate probability distribution over potential failure impulse levels for the Grand Gulf drywell wall extends from 3.5 to 18 psi-s. Since the pedestal and the drywell wall at Grand Gulf are both composed of reinforced concrete of similar thickness, the dynamic NUREG-1150 C-98 OAGI0000611 00543

Appendix C load capacity of the pedestal was assumed to be comparable to that of the drywell wall. While the impulse capacity range for the drywell wall was based on the assumption of loads associated with hydrogen detonations, the similarity in impulse duration between steam explosion and gas detonation loads (typically milliseconds) was assessed to warrant adoption of the range, given its broadness. Supplementary evaluations of the pedestal impulse capacity by an internal Sandia expert on containment structural performance issues confirmed the appropriateness of this range.

Estimation of the impulse delivered to the pedestal conditional upon the occurrence of a steam explosion was based on the Similitude Equations (Ref. C. 9. 6). These equations, reflecting the correlation between underwater explosion size, distance from the explosion center, and impulse level, were adopted to determine the relationship between the mass of debris participating in the steam explosion and the impulse to the pedestal. Calculations revealed that, with less than 1 percent of the core participating in the explosion, the impulse to the pedestal would reach the lower edge (i.e., 3.5 psi-s) of the uncertainty range over pedestal failure loads. The upper edge of the range (18 psi-s), based upon shock wave hydrodynam-ics calculations, would be reached if 10 percent of the core participated in the explosion. It was noted that release from the vessel of 10 percent of the core corresponds to the 90th percentile level of the aggregate distribution over core release levels at BWR vessel breach.

It was concluded that, conditional upon the trigger of a steam explosion in the Grand Gulf drywell, failure of the pedestal is credible. To reflect maximal uncertainty regarding the fraction of ex-vessel steam explosions that would result in pedestal failure, a uniform probability distribution was assigned to the interval between the fraction zero and the fraction 1.

Failure of Drywell Wall The final parameter associated with the ex-vessel steam explosion issue at Grand Gulf is the fraction of occasions that collapse of the pedestal results in failure of the drywell wall. This question was addressed by two members of the expert panel on containment structural performance issues. Based upon their engineering judgment and supporting hand calculations, each expert provided a single point estimate of the required parameter. These two point estimates were averaged to generate a single estimate for input to the Grand Gulf risk model. This average was 0.17.

C.9.3 Treatment in PRA and Results C.9.3.1 In-Vessel Steam Explosions Of the 14 experts (13 in SERG and one additional expert as discussed in Section C.9.2) participating in the steam explosion evaluation process, 12 provided probabilities for alpha-mode failure conditional upon core damage in a PWR at low reactor coolant system pressure. Two of these experts collaborated in the generation of probabilities; thus, their results reflected a single approach. Eleven independent sets of probabilities were ultimately provided.

The extreme sensitivity of the onset of a steam explosion to prevailing physical boundary conditions (Ref.

C.9.7) provides a strong basis for treating alpha-mode failure as a stochastic phenomenon. This means that, conditional upon a specified plant damage state, the associated range of possible physical conditions within the vessel results in the situation that alpha-mode failure would occur only on some fraction of occasions. The probabilities assigned by the participating experts were therefore interpreted as estimates of the relative frequency of alpha-mode failure, i.e., as the fraction of severe accidents resulting in failure of the containment building due to an in-vessel steam explosion. In conformance with the approach to uncertainty characterization used in this study, probability distributions were constructed over these relative frequencies on an expert-specific basis. Aggregation over the expert distributions then provided the net representation of uncertainty regarding the frequency of alpha-mode failure.

Construction of the expert-specific distributions was based upon identification of a best-estimate frequency with the median of the distribution, identification of an upper estimate with the 95th percentile, and identification of a lower estimate with the 5th percentile. Use of an entropy-maximization algorithm (Ref.

C. 9. 8) in conjunction with these distribution constraints ensured that uncertainty was appropriately preserved in formulation of the expert-specific probability distributions. Details of this approach to the use of probabilistic information were reviewed by each participating expert.

C-99 NUREG-1150 OAGI0000611 00544

Appendix C Figure C.9.1 displays the cumulative probability levels that bound the expert-specific distributions. These bounds exclude two experts who assessed the likelihood of alpha-mode failure to be so low that they assigned zero probability to the scenario. This figure also displays the final aggregate distribution based upon the 11 expert-specific distributions (including the two experts who assigned zero probabilities). Note that the aggregate distribution is not completely encapsulated by the bounding distributions because of the effect of the two experts who assigned zero probabilities. It can be seen that the median relative frequency of alpha-mode failure for the aggregate distribution is approximately 4E-5. That is, there is equal net probability that less than, or more than, four in a 100,000 core damage scenarios occurring at low ambient pressure will result in alpha-mode failure of the containment building. It can be seen also that the greatest median frequency proposed by any one expert was of the order of one in a 100, while the smallest finite median frequency was of the order of one in 100,000. Hence, while no consensus existed regarding details of the phenomenology of steam explosions, the conclusion that, at the median level, alpha-mode failure is unlikely was shared by each participating expert. In each plant study, the aggregate distribution displayed in Figure C.9.1 provided the basis for sampling alternative values of the frequency of alpha-mode failure conditional upon core degradation at low pressure. The frequency of alpha-mode failure conditional upon core degradation at high reactor coolant system pressure was set at one order of magnitude below the frequency associated with the low-pressure case in each sample member. This reflects the experimental observation that high ambient pressures tend to reduce the likelihood of a steam explosion trigger (Ref. C.9.1}.

Although the median relative frequency of the alpha-mode scenario is low, the high relative likelihood of core degradation at low reactor coolant system pressures in PWRs (see Section C.6) has the effect of highlighting the alpha-mode scenario as a mechanism for early failure of the containment, especially at Surry and Zion for which other early failure mechanisms are of low likelihood. At Surry, for example, while about half of the mean frequency of early containment failure conditional upon core damage is (a)lncludes 2 experts who

• • • • aned aero frequency (b)Exc:luolu* :! uXJI**rb "ho

• • • ianed at~ro lraq.aency I

• • • • • • • • • • • • • Bound upon ex per\ -*p*c*!lc

.. cumulta\1ve probabilltaes(b)

Figure C.9.1 Frequency of alpha-mode failure conditional upon core damage.

NUREG-1150 C-100 OAGI0000611 00545

Appendix C associated with the alpha-mode scenario, this total mean frequency is less than 10..2. For the pressure-suppression containment types, the likelihood of alpha-mode failure is low relative to other containment failure mechanisms.

C.9.3.2 Ex-Vessel Steam Explosions The three parameters required to characterize the likelihood of drywell failure due to ex-vessel steam explosions at Grand Gulf are defined in Section C.9.2. Each of these was an input to the Grand Gulf accident progression event tree. Conditional upon vessel breach and wet cavity conditions, the fraction of occasions upon which the drywell fails as the result of an ex-vessel steam explosion was equated with the product of these three parameters. The fraction of steam explosions leading to pedestal failure was identified as the most significant source of uncertainty because of uncertainty regarding the amount of molten material that would participate in the explosion. In the Monte Carlo uncertainty analysis, this parameter was sampled from a uniform probability distribution over the interval of fractions zero to 1.

Based upon the parameter values described in the Section C. 9 .2, it can be deduced that the mean fraction of occasions on which failure of the vessel, in wet cavity conditions, results in breach of the drywell wall as a result of a steam explosion is approximately 0.07.

While Grand Gulf is the containment for which the threat posed by ex-vessel steam explosions is the most significant, the relative importance of this mechanism for drywell failure compared to others is small.

Conditional upon core damage at Grand Gulf, less than 10 percent of early drywell failures result from an ex-vessel steam explosion. The dominant causes of drywel1 failure are associated with pressurization of the drywell atmosphere at the time of vessel breach.

More details of the treatment of steam explosions in this study can be found in Reference C.9.9.

REFERENCES FOR SECTION C.9 C.9.1 D.E. Mitchell, M.L. Corradini, and W.W. Tarbell, "Intermediate Scale Steam Explosion Phenomena: Experiments and Analysis," Sandia National Laboratories, NUREG/CR-2145, SAND81-0124, October 1981.

C.9.2 T.G. Theofanous et al., "An Assessment of Steam-Explosion-Induced Containment Failure,"

Nuclear Science and Engineering, 97, 259, 1987.

C.9.3 M. Berman, "A Critique of Three Methodologies for Estimating the Probability of Containment Failure Due to Steam Explosions," Nuclear Science and Engineering, 96, 173, 1987.

C.9.4 Steam Explosion Review Group, "A Review of the Current Understanding of the Potential for Containment Failure from In-Vessel Steam Explosions," USNRC Report NUREG-1116, June 1985.

C.9.5 M. Berman et al., "An Uncertainty Study of PWR Steam Explosions," Sandia National Laboratories, NUREG/CR-3369, SAND83-1438, July 1984.

C.9.6 R.H. Cole, Underwater Explosions, Princeton University Press, 1948.

C.9.7 B.W. Marshall et al., "Recent Intermediate-Scale Experiments on Fuel-Coolant Interactions in an Open Geometry," Proceedings of the ANS/ENS International Topical Meeting on Thermal Reactor Safety (San Diego, CA), February 1986.

C.9.8 S.D. Unwin, "IMPAGE. An Information Theory-Based Probability Assignment Generator.

Brief Code Description and User's Guide," Brookhaven National Laboratory, Technical Report A-3829, August 1987.

C.9.9 F. T. Harper et aL, "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

C-101 NUREG-1150 OAGI0000611 00546

Appendix C C.l 0 Source Term Phenomena The magnitude and timing of release of radioactive material from a nuclear reactor in a severe accident depend on a variety of thermal, hydraulic, and mechanical processes, as well as the chemistry and physics of fission product release and transport. Uncertainties in core melt progression, containment loads, and containment performance produce uncertainties in the release to the environment. In this study, however, each accident progression bin represents a particular state of melt progression and containment performance. Thus, uncertainties associated with how and when the containment fails are reflected as uncertainties in the likelihoods of the accident progression bins rather than in the parameters that describe the release to the environment. This section addresses the phenomena that affect the magnitude of release of the elemental groups in an accident progression bin, not its likelihood. These phenomena relate directly to the chemistry and physics of fission product release and transport. Some uncertain aspects of core melt progression (e.g., the time~temperature history of the fuel as fission products are being released) are included implicitly in the assessment of uncertainties, however.

C.lO.l Issue Definition Following the Three Mile Island accident, the NRC established an Accident Source Term Program Office to evaluate the realism with which the analytical methods available at that time could predict severe accident source terms. In 1981, the NUREG-0772 report, "Technical Bases for Estimating Fission Product Behavior During LWR Accidents" (Ref. C.10.1), reviewed the state of the art and identified research needs in a number of areas. In response to these needs, the NRC undertook a substantial effort to direct severe accident research toward development of improved methods of analysis supported by a more comprehensive data base (Ref. C.10.2).

In 1986, the NRC published the NUREG-0956 report, "Reassessment of the Technical Bases for Estimating Source Terms" (Ref. C.10.3). One of the purposes of the present study was to develop a perspective on how changes in source term methodology, as represented in NUREG~0956, affect estimated risk to the public from severe accidents. In their review of NUREG-0956, the American Physical Society (APS) identified the principal areas of uncertainty in severe accident analysis and made recommendations for future research. The research needs that relate directly to the release and transport of radioactive materials are listed in Table C.l 0 .1. Additional research has been performed in each of these areas subsequent to the APS review, and the results have been incorporated into the current study.

Table C.lO.l APS recommendations for source term research (Ref. C.l0.3).

1. Vaporization of low volatility fission products

2. Release of refractory materials in core~concrete interaction

3. Transport of radionuclides through reactor

4. Tellurium behavior

5. Release of volatile forms of iodine

6. Generation mechanisms for aerosols

7. Effectiveness of suppression pools and ice beds

8. Growth and deposition of aerosols

9. Change of sequence by fission product heating

10. Intercomparison of aerosol codes

11. Aerosol deposition on pipes

12. Integrated severe accident code The simplified source term codes, XSOR,

• which were developed to support the uncertainty analysis for this study, represent source term processes as integral parameters such as release fractions, decontamina~

tion factors, and transmission factors. The chemistry and physics of these processes are contained in the mechanistic codes against which the XSOR parameters are benchmarked. The same parametric represen~

tation of source terms will be used in this section to discuss source term uncertainties:

• A separate code was written for each of the plants: SURSOR, SEQSOR, ZISOR, PBSOR, and GGSOR.

NUREG-1150 C-102 OAGI0000611 00547

Appendix C

1. Fraction of initial inventory of species released from the fuel prior to vessel breach,

2. Fraction of release from fuel that transports from the reactor vessel into the containment,

3. Fraction of initial core inventory released during core-concrete interaction,

4. Fraction of source term to the containment atmosphere that subsequently is released to the environment,

5. Decontamination factors for engineered safety features or water pools,

6. Fraction of species deposited in reactor coolant system that is subsequently revaporized, and

7. Fraction of iodine in suppression pools or water pools that is subsequently evolved.

C.10.2 Technical Bases for Issue Quantification The status of each of the major areas of severe accident uncertainty identified by the APS has been reviewed in Appendix J of draft NUREG-1150 (Ref. C.10.4). A "Review of Research on Uncertainties in Estimates of Source Terms from Severe Accidents in Nuclear Power Plants," (Ref. C.10.5), was also undertaken by a panel of eminent scientists under the leadership of Dr. H. Kouts. These reports discuss areas of source term uncertainties qualitatively and identify needs for further research.

In the current study, it was necessary to develop a quantitative characterization of the uncertainties in source term phenomena. A panel of experts in source term phenomena was assembled to develop the uncertainty distributions for the most important phenomena. Table C.10.2 identifies the experts and lists the issues elicited. The bases on which the experts made their judgments differed. In each case, computer analyses and experimental data were available to the experts. In many instances, the experts performed their own calculations. Each expert provided documentation on the rationale supporting his elicitation.

The variety of considerations by the experts is too broad to reproduce in this appendix for the source term issues. The reader is referred to Reference C.10.6 for a detailed discussion of the bases for the elicitations.

C.10.3 Treatment in PRA and Results In-Vessel Release Within the range of uncertainties, the experts were not able to distinguish between the magnitude of release for different accident sequences other than for different degrees of zirconium oxidation. Thus, distributions for only four cases were developed: PWR-high oxidation, PWR-low oxidation, BWR-high oxidation, and BWR-low oxidation. The results for the four cases are similar. Figure C.10.1 il1ustrates the distribution 'obtained for the PWR. case with low zirconium oxidation. The uncertainty range

• fc:>r the release of iodine and cesium is from approximately 10 percent to 100 percent of the initial core inventory, for tellurium from 1 percent to 90 percent, for barium and strontium from very small to 50 percent, and for the involatiles from very small to a few percent.

In-Vessel Retention Four cases were considered for the PWRs: setpoint pressure (2500 psia), high pressure (1200-2000 psia),

intermediate pressure (150-600 psia), and low pressure (50-200 psia). Three cases were considered for the BWRs: fast (e.g., short-term station blackout), high pressure; fast, low pressure; and slow (e.g.,

long-term station blackout), high pressure.

In all cases 100 percent of the noble gases were assumed to escape from the reactor coolant system. For the PWR, the estimated fractional releases at setpoint pressure are typically small, as illustrated in Figure C.10.2. For all species the range is from 0.001 percent to 80 percent, with median fractional release of 9

• 5th percentile and 95th percentlle values are used to characterize the range.

C-103 NUREG-1150 OAGI0000611 00548

Appendix C Table C.lO. 2 Source term issues.

Technical Experts P. P. Bieniarz, Risk Management Associates A. Drozd, Stone & Webster Engineering Corp.

J. A. Gieseke, Battelle Columbus Division R. E. Henry, Fauske and Associates T. Kress, Oak Ridge National Laboratory Y. H. Liu, University of Minnesota D. Powers, Sandia National Laboratories R. C. Vogel, Electric Power Research Institute D. C. Williams, Sandia National Laboratories Source Term Issues Elicited

1. In-vessel fission product release

2. Ice condenser DF-Sequoyah

3. Revolatilization (from RCS/RPV) after vessel breach

4. Core-concrete interaction (CCI) release

5. Release from containment

6. Late sources of iodine-Grand Gulf and Peach Bottom

7. Reactor building DF-Peach Bottom

8. Releases during direct containment heating percent for iodine and 3 percent for the bulk of the other aerosols. As illustrated in Figure C.l 0. 3, at low pressure the range for fractional release is 12 percent to 99 percent for the iodine, with a median of 50 percent, and from 4 percent to 99 percent for the bulk of the other aerosols. The high and intermediate pressure cases fall between the system setpoint case and low-pressure case.

The distributions for the BWR cases are similar to those described for the PWR cases. The distributions for the two high-pressure cases are similar to the distribution for the PWR setpoint pressure case in that the majority of the distribution indicates a small release, but at the upper end of the range the release is substantial (---80 percent). The distribution for the low-pressure case is similar to that of the PWR low-pressure case.

Core-Concrete Release Distributions were obtained for 16 different cases. Zion, Sequoyah, and Surry were each treated separately. A common distribution was obtained for Peach Bottom and Grand Gulf because the same type of concrete was used in the construction of the two plants. For each plant, four scenarios were considered for a wet or dry cavity and high or low zirconium oxidation.

NUREG-1150 C-104 OAGI0000611 00549

Appendix C u

J*

~

u Q = )(aJCr a:ur J t.A u

• =Cs.Ab

• ::1

• =&o Te.Sb

.. =Sf'

..., *=~*

• =\A.tc

• =ea.*

... --~~---P--~--~~--~--~--~--~--~----f o.o ** 20A JO.O 40.0 M.o so.o 10.0 ao.o .o.o eoo.a Rill* ca.M ftooction Figure C. 10.1 In-vessel release distribution, PWR case with low cladding oxidation.

C-105 NUREG-1150 OAG\0000611_005

Appendix C 0.1 f*

1...

c3 Q =l*.tcr o: I.Br 1.2

• "==Te.Sb Cs.Rb

• = A.tosol 0.1

......- .....--..---r--..,,---.,...-...,..--,..-_,..--T-.....

o.o *** ao.o .so.o .... so.o 10.0 :ro.o ao.o to.o eoo.o R-'tclt* froc:Uon Figure C.10.2 RCS transmission fraction, PWR case at system setpoint pressure.

NUREG-1150 C-106 OAGI0000611_00551

Appendix C tA~------------------------------------------

.l:

~

aE a= Xe.Kr 0 :z I.Sr

• =Cs.Rb

• =

• :z Te.Sb Awosol 10.0 20.0 .10.0 40.0 10.0 10.0 70.0 M.At to.O 100.0 Re&.as. ffac:Uon Figure C.10.3 RCS transmission fraction, PWR case with low system pressure.

Release fractions for five elemental groups were evaluated: tellurium, strontium, barium, lanthanum, and cerium. The uncertainty distributions obtained from the experts indicate broad ranges of uncertainty. The fractional release of tellurium is likely to be quite large. Median values of the release fraction for the different cases typically are approximately 50 percent, and the upper bound release is approximately 90 percent. The lower bound release fractions vary from 2 percent to 10 percent. Barium and strontium are indicated to be substantially less volatile than tellurium but at the upper end of the uncertainty range could also lead to substantial release. Median values for the release of these species vary from 2 percent to 5 percent for the different cases. The release fractions for the lanthanum and cerium groups are substantially smaller. Median values are typically less than 0.1 percent. Upper bound values are typically less than 10 percent of the inventory, except for the cerium group release in the BWR cases, which extends to 20 percent.

Containment Release Fraction This factor is defined as the fraction of radioactive material released to the containment atmosphere that eventually leaks to the environment. Eighteen different distributions were developed associated with different plant types, whether the release was from fuel in-vessel or ex-vessel, the timing of containment failure, the mode of containment failure, and in some cases whether the suppression pool was saturated.

C-107 NUREG-1150 OAGI0000611 00552

Appendix C It is difficult to generalize the results because of the variety of containment conditions .analyzed. In some early failure cases, however, the transmission fraction is quite high for the entire range of uncertainty. In an early containment failure case for the Sequoyah plant, in which the failure leads to bypass of the ice bed, the fractional release of radioactive material ranges from 25 percent to 90 percent of the material released from the reactor coolant system.

Decontamination Factors for Engineered Safety Features Distributions for decontamination factors (DFs) were developed for suppression pools, ice condensers, overlaying water pools (for the core-concrete interaction release), containment sprays, and for the Peach Bottom reactor building. Only the ice condenser and Peach Bottom reactor building DFs were submitted to the panel of experts for quantification. The NUREG-1150 analysis staff developed the distributions for the other factors.

Although the range of uncertainty in the water pool DFs is large, water pools are sufficiently effective in decontamination that the resulting source terms are not dominant contributors to the plant risk. In comparison to the suppression pool DF, the ice condenser is not as effective in the removal of radioactive material. Four cases were considered by the experts:

Case 1: Air-return fans on, delayed containment failure, multiple passes through ice bed, no direct containment heating, low steam fraction.

Case 2: Air-return fans on, early containment failure, single pass through ice bed, no direct containment heating, low steam fraction.

Case 3: Air-return fans off, single pass through ice bed, no direct containment heating, high steam fraction.

Case 4: Direct containment heating, single pass through ice bed, high gas velocity, high steam fraction.

For a typical case, with multiple passes through the bed, low steam content, and without high-pressure melt ejection, the range of DF was from 1.2 to 20 with a median value of 3.

Distributions were developed for six cases for the DF of the Peach Bottom reactor building. The variations in conditions were associated with combinations of the mode of drywell failure (rupture, shell meltthrough, or head seal leakage) and whether the suppression pool was saturated. For the head seal leakage cases, the leak is into the refueling bay rather than into the reactor building and smaller DFs were assessed. For a typical case involving drywell rupture with the suppression pool subcooled, the range of DF is 1.1 to 10 with a median value of 3.

Revolatilization from Reactor Coolant System Radioactive material deposited on surfaces within the BWR reactor vessel and PWR reactor coolant system can be reevolved after vessel failure because of the self-heating of the radioactive material. For the PWRs, two cases were considered: one hole in the reactor coolant system or two holes in the reactor coolant system. The latter case offers the opportunity of a chimney effect and a greatly different environment. For the BWRs, two cases were also considered: high drywell temperatures or low drywell temperatures.

Variations to these cases were considered by some of the experts.

Distributions were developed for three elemental groups: iodine, cesium, and tellurium. In all cases, the fractional release is greatest for the iodine and least for the tellurium. Figure C.l 0.4 illustrates the distribution for the release of iodine for the PWR case with two holes in the reactor coolant system. The range for this case, which produced the greatest release, is from 0 percent to 70 percent, with a median release of 20 percent. Median releases of iodine for the other cases varied from 3 percent to 10 percent.

Cesium release fractions were comparable to the iodine values but slightly reduced. The median release of tellurium was 0 percent in all cases, but the upper bound varied from 20 percent to 60 percent. This skewed distribution is indicative of a general belief by the experts that there will be little or no revaporization of tellurium but with a recognition that substantial revaporization cannot be ruled out.

NUREG-1150 C-108 OAGI0000611 00553

Appendix C

\.0 O.t 0.1 0.7 1::-

~ 0.1

-8 ct

• o.s

~

ia G.4 o.s a= EXP. A.

o= EXP.B

& = c (XP.

G.2 **==EXP.O AVE.

0.1 o.o-4!W-.,---,--.,...-..,..--,.--,.-......,~-..--,.....--f u ~ u u ~ u u v u o.t LO Revop<<<zotlon R-.ase Fraction Figure C.10.4 Revaporization release fraction for iodine, PWR case with two holes.

Late Release of Iodine This issue addresses the potential for the long-term release of iodine from suppression pools and reactor cavity water. Four cases were considered: a subcooled suppression pool, a saturated suppression pool, a flooded drywell, and a limited supply of water in the pedestal that mostly boils away.

The release from the subcooled suppression pool is limited. The upper bound of the distribution is 10 percent and the median is 0.1 percent. Release from the saturated pool is somewhat greater. The median release is 0.5 percent and the upper bound release is 80 percent.

The releases from the flooded cavity cases are substantially larger. For the case with a large volume of water, the range of release is from 10 percent to 90 percent, with a median of 50 percent. The limited water supply case has a range of 20 percent to 100 percent, with a median of 80 percent.

Summary of Results By examining the ranges used to represent the source term factors (e.g., release from fuel in-vessel and fractional release from reactor coolant system), it is evident why the ranges of the environmental release fractions are large. To begin with, the source distributions for the release of radionuclides from fuel in-vessel and ex-vessel are very broad. Even radionuclides that are typically not considered to be volatile, such as barium and strontium, have ranges of uncertainty that extend as high as 50 percent for in-vessel release. Similarly, the decontamination factors that are applied to these release terms can vary over a range of three orders of magnitude. In some instances, the separation between the mean and the median of the source term distribution for the environmental release of a radionuclide can be as large as three orders of magnitude. These very broad distributions are the result of sampling from multiplicative factors, each of which has a wide distribution. No specific source term issues stand out as dominating the uncertainty because there are a number of contributors.

C-109 NUREG-1150 OAGI0000611 00554

Appendix C It is important to recognize that the origin of the uncertainties in the source term issues does not completely arise from uncertainties in the chemistry of fission product interactions or the physics of aerosol transport. Uncertainties in core melt progression, in thermal-hydraulic behavior within the reactor coolant system, and in thermal-hydraulic behavior within containment (and secondary buildings) also have a major effect on the uncertainties in calculated source terms.

REFERENCES FOR SECTION C.lO C.1 0.1 USNRC, "Technical Bases for Estimating Fission Product Behavior During LWR Accidents,"

NUREG-0772, June 1981.

C.10.2 J. T. Larkins and M. Cunningham, "Nuclear Power Plant Severe Accident Research Plan,"

NUREG-0900, January 1983.

C.10.3 M. Silberberg et al., "Reassessment of the Technical Bases for Estimating Source Terms," NRC Report NUREG-0956, July 1986.

C.10.4 USNRC, "Reactor Risk Reference Document," NURBG-1150, Appendix J of Vol. 3, Draft for Comment, February 1987.

C.10.5 H. Kouts, "Review of Research on Uncertainties in Estimates of Source Terms from Severe Accidents in Nuclear Power Plants," Brookhaven National Laboratory, NUREG/CR-4883, BNL-NUREG-52061, April 1987.

C.10.6 F.T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.

NUREG-1150 C-110 OAGI0000611 00555

Appendix C C.ll Analysis of Seismic Issues Since the first attempt in the Reactor Safety Study in the mid-1970's to quantify seismic risk, some 25 plant-specific seismic PRAs have been completed. These later PRAs have shown that seismic events can be significant contributors both in terms of core damage frequency and the potential for releases of radioactive material. There are many reasons for these findings. The foremost reason is that like many other external events, a seismic event not only acts as an initiator but can also compromise mitigating systems because of its common-cause effects. Secondly, the large uncertainties associated with the rare (particularly for Central and Eastern United States sites) but large seismic events that are significant to risk analyses result in large uncertainties in the outcome of the risk study. Uncertainties in these risk measures also make seismic events significant contributors when risk indices, such as mean frequencies, are used as measures. Table C.11.1 (reproduced from Ref. C.11.1) shows results of some seismic PRAs. Prior to discussing the issue of the uncertainty in the seismic hazard and its impact on PRA results and interpretation, a brief overview of both the seismic risk analysis procedure and seismic hazard methods is described in the following section.

C.ll.l Issue Definition The elements of the seismic risk analysis procedure can be identified (Ref. C.11.2) as analyses of (1) the seismic hazard at the site, (2) the response of plant systems and structures, (3) component fragilities, (4) plant system and accident sequences, and (5) consequences. The results of these analyses are used as inputs in defining initiating events, in developing system event trees and fault trees, in quantifying accident sequences, and in modifying the accident progression event trees and consequence models to reflect the unique features of seismic events. There are uncertainties associated with each step of the risk analysis procedure. However, a number of studies (Ref. C.11.3), including the seismic risk studies performed in connection with NUREG-1150 (Parts 3 of Refs. C.11.4 and C.11.5), have shown that the uncertainties in the first element, the seismic hazard analysis, dominate the uncertainties in the overall results.

As shown in Figure C.11.1, the major steps involved in performing the site-specific hazard analysis are as follows:

• Identification of the sources of earthquakes, such as faults (Fl, F2) and other seismotectonic sources (A1, A2, A3);

• Evaluation of the earthquake history of the region to assess the frequencies of occurrence of earthquakes of different magnitudes or epicentral intensities (recurrence) and determination of maximum magnitude;

• Development of attenuation relationships (including random uncertainty) to estimate the intensity of earthquake-induced ground motion (e.g., peak ground acceleration) at the site (attenuation); and

• Integration of all the above information to generate the frequencies with which different values of the selected ground-motion parameter would be exceeded (seismic hazard).

Because of the brevity of the historical record and lack of full understanding of earthquake processes and their effects in much of the United States, considerable uncertainties are associated with each of the above steps, resulting in the large uncertainties in the seismic hazard estimates. An accepted procedure for including the uncertainties of the parameters in the hazard analysis is to postulate a set of hypotheses (e.g., specific source configuration, specific value of slope parameters in recurrence relation). A probability value is assigned to each of these hypotheses, based on the analyst's expert judgment. A seismic hazard curve representing the annual frequency of exceeding a specified peak ground acceleration

.is generated from each hypothesis resulting in a family of different hazard curves, each representing probability of exceedance (see Fig. C.11.1 (d)). Such a family of hazard curves has generally been used in past PRA applications.

Two major programs have been undertaken in the past few years to develop methods and data banks to estimate the seismic hazard at all locations of the United States east of the Rocky Mountains. The first program conducted by the Lawrence Livermore National Laboratory (LLNL) under the auspices of the NRC is entitled the Seismic Hazard Characterization Project (Ref. C.11.6). The method used in the LLNL project embodies the four steps described above. In order to capture the uncertainties, both the random (physical) uncertainty and the modeling (knowledge) uncertainty, expert judgment was used to C-111 NUREG-1150 OAGI0000611 00556

Appendix C Table C.ll.l Seismic core damage and release frequencies from published probabilistic risk assess~

ments.

Seismic Seismic Core Damage Release %of Rank Dominant Frequency Frequency Total of Earthquake SSE (mean) (mean) Core Release Level Plant Type (g) per Year per Year Damage Sequence (g)

Zion 1 & 2 PWR 0.17 5.6E-6 3 1 >0.35 Indian Point 2 PWR 0.15 1.4E-4 1.4E-4 30 1 >0.30 (rev. 4.8E-5)

Indian Point 3 PWR 0.15 3.1E-6 2.4E-6 1 8 >0.3(}-

/

(rev. 2.5E-5)

Limerick BWR 0.15 4.0E-6 2.0E-7 1 >0.35 Millstone 3 PWR 0.17 9.4E-S 68 3 >0.3 Seabrook PWR 0.25 2.9E-5 13 30 >0.3 Oconee 3 PWR 0.15 6.3E-5 6.0E-5 25 1 >0.15

(? A3 K2 Reactor v

~

~x Magnitude. m; Sources Recurrence (a) ~(b) tncreasing c.,

a>c:

c:"

magnitude m;

6-"' *~

e~

=~

~ .. .e

'ii u

c-c:o c( <

Peak ground Oistanee. R acceleration Seismic haunS Auenuation (d) (c)

Figure C.11.1 Model of seismic hazard analysis.

NUREG-1150 C-112 OAGI0000611 00557

Appendix C assess parameter values and models in the fields of seismicity modeling and ground-motion prediction modeling. To this end two panels were formed. The S-Panel was made up of experts on seismicity and zonation; experts on ground-motion prediction formed the G-Panel. The independence of the experts was promoted by encouraging them, if they so preferred, to use their own information and data bases. The method developed was not intended to lead to some kind of artificial consensus, but rather the display of the full range of judgments was to be retained. The judgments of the experts were elicited through a series of written questionnaires, feedback meetings, and feedback questionnaires.

To propagate uncertainties in parameter values and models and develop a probability distribution of the hazard, an approach based on simulation was used. Using a Monte Carlo approach, each of the parameters was sampled a large number of times from its respective probability distribution, which described its uncertainty. With each hazard curve resulting from a given simulation was associated a weight, or probability of being the true hazard curve, which was calculated as the product of the probabilities or weights of each of the random parameter values used in that simulation. For each pair of seismicity and ground-motion experts (respectively S-Expert and G-Expert) described earlier, a typical simulation was carried out as follows:

e Draw a map from the distribution of maps for this S-Expert,

• For each one of the seismic sources in a sample map, draw a set of seismicity parameters from their respective distribution, i.e.:

A value for the a parameter of the recurrence law (see Fig. C.ll.l(b)),

A value for the b parameter of the recurrence law (b is allowed to have three levels of correlation with a, as specified by the S-Expert, Fig. C.ll.l(b)), and The value of the upper magnitude (or intensity) cutoff;

• Draw a ground-motion model from the distribution of models; and

• Draw a value for the random uncertainty parameter, which is associated with the selected ground motion, for the appropriate Eastern United States region (Northeast, Southeast, North Central, or South Central).

The hazard was calculated for each of the seismic sources and combined for all sources. Each simulation gives a possible hazard curve. For each site, typically 2, 750 curves (50 simulations for each of the possible combinations of 5 G-Experts and 11 S-Experts) were developed. Percentiles, usually the 15th, 50th, and 85th, were then used to describe the uncertainty in the hazard. Typical hazard curves are presented in Figure C.11.2 for the Peach Bottom site.

In addition to the hazard curves for 69 nuclear plant sites east of the Rocky Mountains, the LLNL project also generated uniform hazard spectra for various return periods for each site. Uniform hazard spectra for the Peach Bottom site are presented in Figure C.11. 3.

The second program was undertaken by the Electrical Power Research Institute (EPRI) (Ref. C.11. 7) with similar objectives to the LLNL program. While the LLNL and EPRI approaches have many similarities, that is, they rely upon expert judgment, there are significant differences in the manner in which the expert judgment was solicited and in the treatment of ground motions (Ref. C.11.8). EPRI's major effort was aimed at developing a structured approach to the delineation and characterization of seismic sources. On the other hand, LLNL's approach was that of the solicitation of expert judgment from individuals, among whom there was a moderate amount of interaction, while EPRI relied upon the use of expert teams, among whom there was a great deal of interaction through workshops and meetings devoted to specialized seismological and tectonic topics. For example, instead of the 11 individuals, (primarily seismologists) upon whom LLNL relied for the seismic zoning input, EPRI used six teams, each of which spanned the disciplines of geology, seismology, and geophysics. After discussion and interaction, each team agreed upon a common input. In order to ensure uniformity in data assumptions, EPRI compiled a common geological, geophysical, and seismological data base. With respect to seismicity recurrence parameters, a good deal of effort was expended in defining uniform statistical techniques for estimating these parameters. The teams had the option, based on these studies, of allowing variations within the C-113 NUREG-1150 OAGI0000611 00558

Appendix C

[.U.S SEISWIC HAZARO CHARACTERIZATION LOWER W.GHITUO£ Of INTCCRATIOH 'S 5.0 PERCENTilES= 15 ** 50. ~D 85.

-t HAZARD CURVES USING ALL EXPERTS 10

-2 0 ::

..,(

10 0::

-3

'"'a. 10 w

u

~

0 w

0

-4 10

!>(

w 0

t-

-s

~

CD

..,(

m tO 0

0::

Q.

~

tO

-7 tO 0

....+ ACCELERATION CM/S£c**2 PEACH BOTTOM Figure C.11.2 LLNL hazard curves for Peach Bottom site.

NUREG-1150 C-114 OAGI0000611_00559

Appendix C

(.U.S SEISM~C HAZARD CHARACTERIZATION LOW(R MACNlTUD£ or IHT(GRATION IS 5.0 l0000.-Y£~R RETURN PERIOD CONSTANT PERCENTILE SP(CTRA FOR PERCENTILES = 15 ** 50. AND 85.

3 10 2

10 w

en a->- 10 t

t-0

..J 0

10

-I tO c~ l"l .., V)CD~

N 0 10 to PERIOD (SEC) e PEACH BOTTOM Figure C.11. 3 10000-year return period uniform hazard spectra for Peach Bottom site.

C-115 NUREG-1150 OAGI0000611_00560

Appendix C seismic sources themselves. Instead of employing an expert panel for the ground motion, EPRI used three models to reflect uncertainties in the ground-motion estimates. EPRI felt that ground-motion model development is less subjective and fairly well defined and any needed evaluation could be done by its consultants (Ref. C.11.9). In the EPRI approach, in contrast to the Monte Carlo approach used by the LLNL, uncertainties in seismic sources, seismicity parameters, maximum magnitude, and ground-motion models are propagated through and represented in a logic-tree format (Fig. C.11.4). Each level of the tree represents one source of uncertainty; each terminal node represents one "state of nature." Correspond-ing to each terminal node, there is a hazard curve. The probability associated with a terminal node (and with the corresponding hazard curve) is the product of the probabilities associated with all intermediate branches in the path from the root to the terminal node. Results for the Peach Bottom site from the EPRI program are shown in Figure C.11.5. The uniform hazard spectra obtained from the EPRI program, in general, exhibit similar characteristics to the LLNL results. According to Reference C.11.1 0, which compared preliminary results of both studies of nine test sites, the most significant differences in the results of the LLNL and EPRI studies that primarily affect the uncertainty distributions are (see also Ref.

C.11.11):

• A larger number of ground-motion models, encompassing a large range of opinions, are used in the LLNL project than in the EPRI study; and

• The EPRI study has less uncertainty in the seismicity parameters, leading to lower uncertainty in the estimate of the hazard.

Thus, there are now two sets of hazard curves available for use at sites east of the Rocky Mountains.

Issues associated with the use of these two sets of hazard curves, associated uncertainties, and consideration of uniform hazard spectra in the PRA applications are discussed below.

The primary issue in the seismic risk analysis is the large uncertainty associated with the computed results and use of these results in decisionmaking. The uncertainties, as discussed earlier, largely stem from uncertainties in hazard estimates. In addition to the issue of the uncertainty in hazard, publication of uniform hazard spectra will also have an impact on the PRA application.

SEISMICITY HAZARD GROUND At~Al.Y$1S PARAMETER$ t.IAXIIAUiol MOTION COMOWA TIO,. CASES:

'-,.UWITliOES FUNCTIOtiS OF ACTIVE SOURCES Ct,$2,M2,C1 C I,S2,MZ,G3 Figure C.11.4 Example of logic-tree format used to represent uncertainty in hazard analysis input (EPRI program) .

NUREG-1150 C-116 OAGI0000611 00561

Appendix C PEACH BOTTOM

--- = L!EAN HAZARD 225 400 875 900 ACCELERATION CM/SEC*-2 Figure C.11.5 EPRI hazard curves for Peach Bottom site.

C-117 NUREG-1150 OAGI0000611 00562

Appendix C

• Uncertainty in Hazard Estimates: As seen in Figure C.11.2, from the large spread between the 15th percentile and 85th percentile of the hazard calculations, it is evident that seismic hazard estimates are associated with substantial uncertainties. In terms of ground~motion parameters, the LLNL results (Ref. C.11.12) indicate that, for a fixed annual probability of exceedance, the difference between the 15th and 85th percentile curves corresponds to approximately a factor of 4 or larger in both peak ground acceleration (PGA) and spectrum~related ground~motion estimates. When the probability of exceedance at the 15th and 85th percentile levels are compared at a fixed PGA, large differences, ranging from a factor of 40 to 100, can be observed, depending upon the PGA level.

Sensitivity studies have shown that the largest contribution to modeling uncertainty is caused by the uncertainties associated with the models relating ground motion to distance and magnitude. It should also be noted that the mean hazard, because it is sensitive to a highly skewed distribution, can lie above the 85th percentile of the hazard. Median hazards are not strongly affected by the extreme values of the probability distributions.

Sensitivity studies on the LLNL results indicate that individual expert judgment can, under certain conditions, dominate the hazard calculation. Specifically, if a site in question is a rock~based site where distant large earthquakes are the major contributors to the overall seismic hazard, the inclusion or exclusion of the input from one ground-motion expert (G-Expert 5) leads to significant differences in the hazard. This effect is particularly evident at the 85th percentile and mean hazard estimates.

The widely recognized difficulties in the estimation of the likelihood of rare events are compounded in the case of seismic hazard estimation by the lack of knowledge with respect to basic causes and future locations of earthquakes in the Eastern United States. This is clearly illustrated by the resu!ts of two independent studies, the LLNL and the EPRI studies. These studies represent the most comprehensive efforts of their kind undertaken to date. Although attempts have been made (Ref.

C.11.1 0) and studies are under way to understand and reduce the differences between the results of these studies, the methods of each of these studies should be viewed as valid. Because of the inherent uncertainties, results from both sets of hazard curves should be included in a risk study (Ref.

C.11.12). Reducing the combined range of uncertainties to a single point estimate ignores the fundamental message. Enveloping the uncertainty is also inappropriate in that the least well-defined aspects are the upper and lower bounds. Therefore, in NUREG-1150 studies, both sets of curves are used independently and results are presented side by side (Figs. C.11.6 and C.11. 7). The use of these two sets of hazard curves and associated risk analysis results are discussed in Section C.11.2.

• Uniform Hazard Spectra: As discussed earlier, the LLNL and EPRI studies have also provided estimates of uniform hazard spectra for each Eastern and Central United States site. As described in Section C.11.2, the NUREG-1150 studies used LLNL and EPRI hazard curves but did not use uniform hazard spectra. One of the major findings of both the LLNL and EPRI studies is that the estimated uniform hazard spectra for eastern earthquakes are higher at high frequencies and lower at low frequencies compared to standard broadband spectra (e.g., spectra given in Ref. C.11.13) based on recorded western earthquakes. The spectra used in the NUREG-1150 analyses were developed using primarily western records. Implications of the differences between these spectra on the risk analysis will be studied in detail in a later study but the inference for Surry is quite clear. For all structural frequencies of interest, the uniform hazard spectra are below the median spectra used in the analysis. This should result in smaller plant response for a given PGA. The overall effect, with all else remaining the same, will be a reduction in the core damage frequency. For the Peach Bottom site, the impact on the mean core damage and distribution is also not expected to be significant since, at the frequencies of important structures, both response spectra are similar. These issues will be addressed in additional staff studies. Additional issues associated with the use of uniform hazard spectra are related to partitioning of uncertainties among hazard curves, spectra, and fragility analyses. Both the PGA hazard curves and uniform spectra reflect uncertainty in the underlying seismological parameters as well as randomness in the ground-motion estimates. In addition, peak-to~valley variability and random variability between horizontal components may also be included in these two estimates. Many times these uncertainties are included in the fragility analysis.

Thus, clear understanding of uncertainties is needed to avoid double counting or underestimation.

NUREG-1150 C-118 OAGI0000611 00563

Appendix C c

0 R

E 1.0E .. 04 D

...A A.

e i 1.0E-05 f

R E

aE 1.0E .. 06 N

cy INTERNAL SEISMIC SEISMIC FIRE LIVERMORE EPRI 8- Mean tl Median Figure C.11. 6 Surry external events, core damage frequency ranges (5th and 95th percentiles).

C-119 NUREG-1150 OAGI0000611 00564

Appendix C c

0 1.0E*04 fl I

I)

A A

G 1.0E*05 I

f li 1.0E*06 u

I G

y 1.0E*07 INTERNAL 8E18N1C 8EI8MIC FIRE UVERWORE EPRI GMean {] Median Figure C.11. 7 Peach Bottom external events, core damage frequen~y ranges (5th and 95th percentiles) .

• NUREG-1150 C-120 OAGI0000611 00565

Appendix C C.ll. 2 Treatment in PRA and Results In the NUREG-1150 seismic analyses, both the LLNL and EPRI hazard estimates have been used. These estimates, as shown in Figures C.11.2 and C.11.5, are given at selected confidence levels of 15 percent, 50 percent, and 85 percent and mean curves (it is also possible to get results for 5 percent and 95 percent confidence level). In principle, one can use the entire set of 2, 750 hazard curves that were generated for each site in the LLNL study. However, since the results are presented in the form of Figure C.11.2, one has to resort to fitting a distribution to the hazard uncertainty at any given PGA and then discretize the distribution into a chosen set of hazard values in order to obtain a discrete set of hazard curves. This approach was used in Reference C.11.14, which also used the LLNL input. In NUREG-1150, it was assumed that the seismic hazard could be approximated by a lognormal distribution that fit the calculated 50th percentile and mean. While the lognormal assumption is a good approximation, the actual distributions vary. The differences can be seen by comparing the actual calculated hazard curves at a different percentile from the LLNL study with that determined from the lognormal fit. The EPRI hazard results can deviate more from a lognormal distribution. In the NUREG-1150 studies, the full lognormal distribution was used in drawing samples for the Monte Carlo analyses. Therefore, no discretization was necessary.

Sensitivity studies have been carried out for both Surry and Peach Bottom analyses to understand the impact of the lognormal assumption as well as to assess the potential effect of contributions from the tail of the assumed distribution. (See individual plant studies (Parts 3 of Refs. C.11.4 and C. U.S) for further discussions.) Since the distribution is derived by fitting it to the mean, there should be minimal impact on the mean core damage frequency from this approximation.

The necessity of the above approach of fitting a distribution to the uncertainty will also result in not simulating the real nature of hazard curves that may intersect each other. The correlation of hazard values at different accelerations arising out of the same source/ground-motion hypothesis model cannot also be consistently treated. The major contributions to the hazard cannot a priori be correlated with the size of the contributing earthquakes. For example, the study results (Ref. C.11.6) indicate that although some plant sites in the New England area exhibit relatively high seismic hazards, the contribution to the overall hazard from earthquakes with magnitudes of 6.5 or larger is significantly less than the contribution from these large earthquakes to plant sites near New Madrid, Missouri, or those near Charleston, South Carolina. Such a deaggregation of hazard curves and uniform hazard spectra can be extremely useful in understanding the relative contribution from large magnitude (potentially damaging) events versus low magnitude (less damaging) events. It is very important to understand that PGAs have not been shown to be good indicators of the damage potential of an earthquake for ductile structures/components since low magnitude events can produce a large PGA but little damage (e.g., Ref. C.11.15). (This concern has been alleviated to some extent in the LLNL and EPRI studies by the use of a minimum magnitude of 5.0, the magnitude below which damage to the engineered structures is considered unlikely.) To better character-ize damage potential, information with respect to the frequency content of the motion and duration are vital. The fragility analysis used in the NUREG-1150 studies takes into account, to some extent, the earthquake magnitude effects by using the concept of an effective ductility (see Parts 3 of Refs. C.11.4 and C.11.5 for detailed discussions). However, detailed building/component response analysis (including nonlinear effects, if necessary) using magnitude-dependent spectral shapes can be used to remove further conservatisms, if any, included in the plant response/fragility analysis. Consequences of a building failure can also be evaluated more realistically.

While such understanding of hazard curves will not necessarily result in less uncertainty or changes in core damage frequencies, perspectives into which magnitude earthquakes and characteristics of the associated ground motion that contribute to these frequencies can be extremely useful. Recovery actions, not usually considered acceptable in seismic PRAs, may be feasible for the lesser magnitude events. In the additional staff studies, the deaggregation of the hazard curve into various magnitude ranges will be considered to the extent possible.

The seismic risk analysis method used in NUREG-1150 requires the use of earthquake time histories to determine the vibratory motion within the nuclear power plant. Peak ground accelerations from the seismic hazard curves were used to anchor a set of real earthquake records (time histories) for each site.

These scaled earthquake records were then used to perform a probabilistic response analysis. The seismic hazard studies, while not providing time histories, do, along with defining peak accelerations, define C-121 NUREG-1150 OAGI0000611 00566

Appendix C seismic hazard also in terms of uniform hazard spectra. They are based upon the limited data available from Eastern United States earthquakes and the most current models prepared by seismological experts in the field. They are different from the response spectra of the time histories that were used, which were derived from Western United States earthquakes. The seismic hazard spectra based on eastern earthquakes are higher at high frequencies and lower at low frequencies. Issues associated with the uniform hazard spectra and their use in the PRA application were discussed in Section C.11.1 along with the possible impact on the results of NUREG-1150 studies. This issue will be addressed in additional staff studies as discussed above.

After the establishment of the hazard curves and the spectra for use in the plant response calculations, the remaining steps of the seismic risk analysis (that is, plant system and accident sequence analysis and quantification) are described in Appendix A to NUREG-1150 and in plant-specific external-event analyses (Parts 3 of Refs. C.11. 4 and C.ll. 5). Estimates ofthe core damage frequencies for the Surry and Peach Bottom plants are reproduced in Figures C.11.6 and C.11.7. Values of mean, 5th, 50th, and 95th percentile estimates are also given in Table C.11.2.

Sensitivity studies conducted specifically for Surry and Peach Bottom in this program and other sensitivity studies have shown that the uncertainty in seismic hazard curves dominates the uncertainty in the seismic core damage frequency. Table C .11. 3 shows results of sensitivity analysis performed for Peach Bottom to ascertain the relative contribution of the hazard curve, the seismic response, and the seismic fragility modeling uncertainties to the overall core damage frequency.*

The base case mean, 95th percentile, and 50th percentile core damage frequencies are shown in the first column. The second column shows the corresponding values with the hazard curve fixed at its median value (i.e., with no modeling uncertainty). This results in an error factor of 3.5 versus the error factor of 30.1 for the base case. Clearly, the hazard curve is contributing the vast majority of the uncertainty to the base case results. Note also that the mean core damage frequency is reduced by a factor of 6.1 when no hazard curve uncertainty is included. The third column shows a case wherein all the fragility and response modeling uncertainties are simultaneously set to zero. The error factor for this case is 25.5, which shows that the reduction in response and fragility uncertainties has little effect on the overall core damage uncertainty. For this case, the mean core damage frequency is reduced only by a factor of 1.9. Thus, the fragility and response uncertainties play little role in determining the mean core damage frequency.

However, conservatisms associated with the fragilities (median values and uncertainties) and assumed consequences, given a failure of a certain component, may have significant impact on core damage Table C.11.2 Core damage frequencies.

5th Median 95th Mean Surry LLNL 3.92E-7 1.48E-5 4.38E-4 1.16E-4 EPRI 3.00E-7 6.12E-6 1.03E-4 2.50E-5 Fire 5.37E-7 8.32E-6 3.83E-5 1.13E-5 Internal 6.75E-6 2.30E-5 1.31E-4 4.01E-5 Peach Bottom LLNL 5.33E-8 4.41E-6 2.72E-4 7.66E-5 EPRI 2.30E-8 7.07E-7 1.27E-5 3.09E-6 Fire 1.09E-6 1.16E-S 6.37E-5 1.96E-5 Internal 3.50E-7 1.90E-6 1.30E-5 4.50E-6

~Note that the hazard curves used in this sensitivity analysis are not the same as ones used m the final calculation, however, the conclusions are the same. See Part 3 of Reference C.ll.S for the final results.

NUREG-1150 C-122 OAGI0000611 00567

Appendix C Table C.11.3 Comparison of contributions of modeling uncertainty in response, fragility, and hazard curves to core damage frequency.

No Modeling No Modeling Base Uncertainty Uncertainty in Pcm Case in Hazard Response, Fragility Mean 1.55E-5 2.25E-6 8.13E-6 95% 5.78E-5 6.53E-6 3.SOE-5 50% 1.92E-6 1.87E-6 1.37E-6 Pcm (95%) 30.1 3.5 25.5 Pcm (50%)

E (Pem base case] 1.0 6.1 1.9 E[Pcm]

frequencies if a single loss dominates the contribution. Dominant sequences and their contributions can also be affected by fragility/consequence assumptions.

• These results show quite clearly that the uncertainty in the hazard curve is the dominant factor in both the mean value of core damage frequency and in the uncertainty of the core damage frequency. Further, as discussed in the plant-specific analyses (Part 3 of Ref. C. U.S), it is the mean hazard curve that drives the mean estimate of core damage frequency. Again, this shows the dominant influence of the hazard curve uncertainty (which determines the mean hazard curve) in determining the mean core damage frequency.

Sensitivity studies are also conducted in the plant-specific analyses to examine the importance of the basic seismic failure events to the estimates of mean core damage frequencies. These studies show that for a dominant component, if no failure is assumed, the percentage reduction in the core damage frequency would be in the range of 40 percent. Note that given large uncertainties associated with the seismic results, a change in the mean core damage frequency by a factor of two or so may not be that significant.

However, the fragility of the plant (conditional failure probability at a given PGA) may improve appreciably.

In Table C.11.4, dominant sequences and their contributions to the mean core damage frequency are listed for the Peach Bottom plant for both the LLNL and the EPRI hazard curves. Similar studies for the Surry plant are also discussed in the plant-specific studies. Observations discussed here are equally valid for both plants. As seen from this table, although the numerical values are quite different for each sequence when the LLNL or the EPRI hazard curves are used, the order is the same and the relative contributions are slightly varied. This is not surprising since the two mean curves do not intersect each other or indicate drastically different characteristics, such as one being truncated at some acceleration value. If this were the case, then one might expect ranking of sequences and elimination or addition of some sequences. Since the order of dominant sequences remains the same for both the hazard curves, perspectives gained as to the dominant components are also robust. Perspectives as to dominant sequences and components could also be affected if the spectral shapes associated with the different hazard curves were quite dissimilar. However, the uniform hazard spectra from both the LLNL and EPRI studies seem to exhibit similar characteristics.

For the Peach Bottom plant, Figure C.11.8 shows contributions from the different earthquake ranges to the mean core damage frequencies resulting from the use of both the LLNL and the EPRI hazard curves.

For both the hazard curves, the majority of contributions is coming from an earthquake range between 0.45g to 0.75g consistent with the Peach Bottom mean plant fragility curve (Fig. C.11.9) for which roughly the 50 percent conditional core damage frequency occurs around 0.6g. Thus, there is a relative robustness as to which earthquake range contributes to the mean core damage frequencies.

C-123 NUREG-1150 OAGI0000611 00568

Appendix C Table C.ll. 4 Dominant sequences at Peach Bottom.

Total Mean Pcm =7.66E-5 (LLNL), 3.09E-6 (EPRI)

Dominant Sequences LLNL EPRI T1-33 3.69E-5 (48%) 1.61E-6 (52%)

ALOCA-30 1.84E-5 (24%) 6.70E-7 (21%)

RVR-1 8.92E-6 (11%) 3.27E-7 (11%)

S1LOCA-70 6.67E-6 (9%) 1.85E-7 (6%)

RWT-1 2.76E-6 (4%) 1.75E-7 (6%)

S2 LOCA-42 1.20E-6 (2%) 4.90E-8 (2%)

By Sequence LLNL EPRI Transients (LOSP) 3.69E-5 (48%) 1.61E-6 (52%)

LOCAs 2.59E-5 (34%) 9.04E-7 (29%)

Vessel Rupture 8.92E-6 (11%) 3.27E-7 (11%)

RWT Bldg Failure 2.76E-6 (4%) 1.75E-7 (6%)

Several long-term studies are planned to better understand some of the issues associated with the hazard definition; however, it is clear that results of seismic risk analysis will have large uncertainties associated with them. From examination of Table C.11.2, it is evident that conflicting conclusions can be obtained when point estimates are used as risk indices. For example, if the median estimates are used to determine the relative importance between the seismic initiators and the internal initiators, one will conclude that for the Surry analysis, with either the LLNL hazard or the EPRI hazard estimates, the contribution to the total core damage frequency is larger from the internal initiators than the seismic initiators. Conversely, if the means are used, one would conclude that, based on the use of the LLNL hazard curves, the contribution from the seismic initiators is much larger than that from the internal initiators. Based on the results from the EPRI hazard curve, the conclusion would be that internal initiators contribute more than seismic initiators. These findings illustrate the confusion that can result if single estimates are used to characterize the risk.

One clear conclusion is that the distribution of the seismic-induced core damage frequencies are more uncertain than the internal frequencies and their distribution overlaps with the distribution from other initiators and cannot be ignored. In light of the large uncertainties, any decisionmaking should take into account the full range of uncertainty as well as engineering insights and understanding obtained regarding the integrated plant response to a seismic event. Some of the robust findings, such as perspectives regarding dominant sequences and components, were discussed in the preceding paragraphs and can be used to evaluate the need to further refine the analysis or enhance safety by improving the plant procedures or implementing cost-effective fixes.

NUREG-1150 C-124 OAGI0000611 00569

Appendix C 36 0

0 30 1-ENI Hazard OIII'W 0 0 n o 25 t '

r

• I b d

.. 20 f-tI "'

a 0 0 16 n

• t f 0 r 10 1ft *q n ' .

I 0

.225 .875 .1525 .675 .825 .075 1.125 Peak ground acceteratlon (In G) so 0

0 0

25 LLNL HazaN Cun.

0 n 0 t r r

I

• 20 b d u

• t In 15 I a 0 II n

• L.

t f 10 o r

• *Q 5

" 0 I . I __._ I I

.225 .875 .525 .875 .US #IS 1.125 Peak Ground IIOoMrallon (In G)

Figure C.11. 8 Contribution from different earthquake ranges at Peach Bottom.

C-125 NUREG-1150 OAGI0000611_00570

Appendix C 1

0 0.8

• t *I f I 0.6 f

• • *I

• I *I 0.4 r

'*r *

' 0.2 0

0 0.2 0.4 0.8 0.8 1 1.2 t4 Ptak ground acceltratlon (0)

• Surry + PHch Bottom Figure C.l 1.9 Mean plant level fragilities.

REFERENCES FOR SECTION C.ll C.11.1 P. G. Prassinos, "Evaluation of External Hazards to Nuclear Power Plants in the United States:

Seismic Hazard," Lawrence Livermore National Laboratory, NUREG/CR-5042, Supplement 1, UCID-21223, April 1988.

C.11.2 J. W. Hickman et al., "PRA Procedures Guide. A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants," American Nuclear Society, NUREG/CR-2300, Vols. 1 and 2, January 1983.

C.11.3 M. K. Ravindra et al., "Sensitivity Studies of Seismic Risk Models," Electric Power Research Institute (EPRI), EPRI NP-3562, June 1984. .

C.11.4 R. C. Bertucio and J. A. Julius, "Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990.

C.11.5 A. M. Kolaczkowski et al., "Analysis of Core Damage Frequency: Peach Bottom Unit 2,"

Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Revision 1, SAND86-2084, August 1989.

C.11.6 D. L. Bernreuter et al., "Seismic Hazard Characterization of 69 Nuclear Power Plant Sites East of the Rocky Mountains," Lawrence Livermore National Laboratory, NUREG/CR-5250, Vols.

1-8, UCID-21517, January 1989.

C.11.7 Seismicity Owners Group (SOG) and EPRI, "Seismic Hazard Methodology for the Central and Eastern United States," EPRI NP-4726, July 1986.

NUREG-1150 C-126 OAGI0000611 00571

Appendix C C.11.8 L. Reiter, "Current Trends in the Estimation and Application of Probabilistic Seismic Hazard in the United States," Proceedings of IAEA Specialists Meeting on Earthquake Ground Motion (Moscow, USSR), March 24-28, 1986.

C.11.9 Letter from L. Reiter, NRC, to R. A. Thomas, SOG, Review Comments on EPRI Ground Motion Models for Eastern North America, dated August 3, 1988.

C.11.10 D. L. Bernreuter et al., "Seismic Hazard Characterization of the Eastern United States:

Comparative Evaluation of the LLNL and EPRI Studies," Lawrence Livermore National Laboratory, NUREG/CR-4885, UCID-20696, May 1987.

C.11.11 Letter from J. E. Richardson, NRC, toR. A. Thomas, SOG, Safety Evaluation Review of the SOG/EPRI Topical Report, "Seismic Hazard Methodology for the Central and Eastern United States," EPRI NP-4726, dated September 20, 1988.

C.11.12 Memorandum from G. Bagchi, NRC, to L. Shao, NRC, Publication of NUREG/CR-5250, "Seismic Hazard Characterization of 69 Nuclear Power Plant Sites East of the Rocky Moun-tains," dated March 21, 1989.

C.11.13 U.S. Atomic Energy Commission, Regulatory Guide 1.60, "Design Response Spectra for Nuclear Power Plants," Revision 1, December 1973.

C.11.14 P. G. Prassinos et al., "Seismic Failure and Cask Drop Analyses of the Spent Fuel Pools at Two Representative Nuclear Power Plants," Lawrence Livermore National Laboratory, NUREG/

CR-5176, UCID-21425, January 1989.

C.11.15 J. W. Reed et al., "A Criterion for Determining Exceedance of the Operating Basis Earth-quake," EPRI NP-5930, July 1988.

C-127 NUREG-1150 OAGI0000611 00572

Appendix C C. 12 Analysis of Fire Issue Based on plant operating experience over the last 20 years, it has been observed that typical nuclear power plants will have three to four significant fires over their operating lifetime. Previous probabilistic risk assessments (PRAs) have shown that fires are a significant contributor to the overall core damage frequency, contributing anywhere from 7 percent to 50 percent of the total, considering contributions from internal, seismic, flood, fire, and other events (Refs. C.12.1 and C.12.2). There are many reasons for these findings. The foremost reason is that like many other external events, a fire event not only acts as an initiator but can also compromise mitigating systems because of its common-cause effects. An overview of the fire risk analysis procedure is described in the following sections. These sections will give the necessary background for the subsequent discussion of the fire issues.

C.12.1 Analysis Procedure for NUREG-1150 Fire Analysis As described in detail in Reference C.12.3, the elements of a fire risk analysis procedure can be identified as (1) screening and (2) quantification of the remaining unscreened fire areas.

The screening analysis is comprised of:

1. Identification of relevant fire zones. Those Appendix R (Ref. C.12.4) identified fire zones that had either safety-related equipment or cabling for such equipment were determined to require further analysis.

2. Screening of fire zones based on probable fire-induced initiating events. Determination of the fire frequency for all plant locations and determination of the resulting fire-induced initiating events and "off-normal" plant states were made.

3. Screening of fire zones based on both order and frequency of cut sets.

4. Numerical evaluation and culling of remaining fire zones based on frequency.

After the screening analysis has eliminated all but the probabilistically significant fire zones, quantification of dominant cut sets is completed as follows:

1. Determine temperature response in each fire zone.

2. Compute component fire fragilities. The latest version of the fire growth code, COMPBRN III (Ref.

C.12.5), with some modifications is used to calculate fire propagation and equipment damage. These fire calculations are only performed for the fire areas that survived the screening analysis.

3. Assess the probability of barrier failure for all remaining combinations of fire areas. A barrier failure analysis is conducted for those combinations of two adjacent fire areas which, with or without additional random failures, remain after the screening analysis.

4. Perform a recovery analysis. In a fashion similar to that of the internal-event analysis, recovery of non-fire-related random failures is addressed. Appropriate modifications to recovery probabilities are addressed as necessary.

5. Perform an uncertainty analysis to estimate error bounds on the computed fire-induced core damage frequencies. As in the internal-event analysis, the TEMAC code (Ref. C.12.6) is used in the uncertainty analysis.

Additional detail on the fire analysis methods used in NUREG-1150 may be found in Reference C.12.3.

C.12.2 PRA Results Tables C.12.1 and C.12.2 provide the core damage frequency results for the Surry and Peach Bottom fire risk assessments, respectively (Refs. C.12.7 and C.12.8). All fire areas that survived the screening process are listed. When comparing fire-induced core damage frequency with the total from all other initiators (including seismic, using the LLNL seismic hazard curves), fire is 7 percent of the total for Surry and NUREG-1150 C-128 OAGI0000611 00573

Appendix C Table C.12.1 Dominant Surry fire area core damage frequency contributors (core damage frequency/yr) (Ref. C.12. 7).

5th 95th Fire Area Mean Percentile Median Percentile Emergency Switchgear Room 6.1E-6 3.9E-9 3.1E-6 2.0E-5 Control Room 1.6E-6 1.2E-10 4.7E-7 6.9E-6 Cable Vault/Tunnel 1.5E-6 6.5E-10 7.0E-7 5.8E-6 Auxiliary Building 2.2E-6 5.3E-7 1.6E-6 5.6E-6 Charging Pump, Service Water Pump Room 3.9E-8 1.4E-10 5.7E-9 1.6E-7 Total 1.1E-5 5.4E-7 8.3E-6 3.8E-5 Table C.12. 2 Dominant Peach Bottom fire area core damage frequency contributors (core damage frequency/yr) (Ref. C.12.8).

5th 95th Fire Area Mean Percentile Median Percentile Emergency Switchgear Room 2A 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency Switchgear Room 2B 3.6E-6 3.5E-9 2.0E-6 1.3E-5 Emergency Switchgear Room 2C 4.7E-6 4.2E-9 2.2E-6 1.7E-5 Emergency Switchgear Room 2D 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency Switchgear Room 3A 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency Switchgear Room 3B 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency Switchgear Room 3C 7.4E-7 4.6E-10 1.6E-7 3.0E-6 Emergency Switchgear Room 3D 8.1E-7 5.3E-10 1.7E-7 3.3E-6 Control Room 6.2E-6 4.2E-10 1.4E-6 S.OE-6 Cable Spreading Room 6.7E-7 9.1E-9 1.7E-7 2.3E-6 Total 2.0E-5 l.lE-6 1.2E-5 6.4E-5 C-129 NUREG-1150 OAGI0000611 00574

Appendix C 19 percent of the total for Peach Bottom. These fire areas grouped by sequence are given in Tables C.12.3 and C.12.4 for Surry and Peach Bottom, respectively.

The overall fire-induced mean core damage frequency for Surry Unit 1 was found to be 1.1E-5 per reactor year. The dominant contributing plant areas are the emergency switchgear room, auxiliary building, control room, and cable vault/tunnel. Fires in these four areas comprise 99 percent of the total fire core damage frequency. In the cases of the emergency switchgear room, cable vault/tunnel, and the auxiliary building, a reactor coolant pump seal loss-of-coolant accident (LOCA) leads to core damage.

The fire itself fails cabling for both the high-pressure injection and component cooling water systems resulting in a seal LOCA. For the control room, a general transient with a subsequent stuck-open power-operated relief valve leads to a small LOCA. Failure to control the plant from the auxiliary shutdown panel results in core damage.

The overall fire-induced mean core damage frequency for Peach Bottom Unit 2 was found to be 1.9E-5 per reactor year. The dominant contributing plant areas are the control room, emergency switchgear room 2C, and emergency switchgear room 2B. Fires in these three areas comprise 75 percent of the total fire core damage frequency. In the case of the control room, a general transient occurs with smoke-induced abandonment of the area. Failure to control the plant from the remote shutdown panel results in core damage. For the two emergency switchgear rooms, a fire-induced loss of offsite power and failure of one train of the emergency service water (ESW) system occurs. Random failure of the other two ESW trains results in station blackout and core damage.

Detailed tracing of control and power cabling revealed that fires can damage the most plant safety functions in cable "pinchpoint" areas. Because of this added detail (cable location identification) as compared with past fire PRAs, many more fire scenarios arose in the initial phases of screening. However, most of these scenarios could be screened from further study by allowing for operator recovery of random failures. The final number of fire areas that survived screening and the total fire-induced core damage frequency for both Peach Bottom and Surry is similar to that found in previous fire PRAs but for dissimilar reasons involving plant-specific cabling configurations. These cable pinchpoint areas were also found in most cases to fail all containment cooling and spray systems. A review of past fire PRAs revealed a similar conclusion with respect to containment systems failure.

C.12. 3 Issue Definition and Discussion The critical fire risk issues and their effect on core damage frequency estimates will be discussed in this section. Uncertainty analysis results (documented in Refs. C.12.7 and C.12.8) highlighted the importance of most of the following issues.

A fire analysis must rely on a partitioning scheme (for fire frequency) to determine fire occurrence frequencies for any given plant area. Additional partitioning within most plant areas will occur because cable "pinchpoint" areas have typically been found to occur in 10 percent or less of these critical plant fire zones. This additional partitioning, based on fire propagation code calculations, is used to determine not only the area of influence of a fire but also the size of the fire required to damage the critical components or their cabling. In older fire PRAs (from the early 1980's), the COMPBRN I code (Ref.

C.12.9) was used to determine fire zone specific area ratios and fire size estimates. Larger area ratios and longer time-to-damage estimates were calculated in the NUREG-1150 fire PRAs. As was discussed previously, the modified COMPBRN III code (Ref. C.12.5) was used for the Surry and Peach Bottom fire propagation predictions. For NUREG-1150, small fires were not found to cause damage in most cases.

Therefore, fire frequencies were decreased to take credit for the fact that most fires in the data base would not have yielded damage. For plant areas where hot gas layer formation was not predicted, area ratios of 10 percent or less also led to reduced fire frequencies to reflect the situation that a postulated fire could only cause damage in a very specific area within a fire zone. These factors (area ratio and fire size estimate) reduced core damage frequency estimates from what would have been previously predicted (using COMPBRN). However, a competing effect also occurred. Shorter time to damage estimates had the effect of allowing less credit for manual suppression of these fire scenarios (with this impact being overshadowed by the other impacts noted above). Fire testing and code experts walked down each of the Peach Bottom and Surry fire areas to determine the reasonableness of the COMPBRN III predictions. It was their opinion, for the situations that occurred in NUREG-1150, that COMPBRN III yielded reasonable predictions. An analysis of the potential effect of COMPBRN results on fire-induced core NUREG-1150 C-130 OAGI0000611 00575

Appendix C Table C.12.3 Dominant Surry accident sequence core damage frequency contributors (Ref.

C.12.7).

Mean Core Damage Sequence Fire Area Frequency/yr Emergency Switchgear Room 6.1E-6 Auxiliary Building 2.2E-6 Cable Vault/Tunnel l.SE-6 Control Room 1.6E-6 Charging Pump, Service Water Pump Room 3.9E-8 KEY Symbol Definition Failure of the charging pump system in the high-pressure injection mode.

Failure of the charging pump system in the seal injection flow mode.

Failure of the SRVs/PORVs to close after a transient.

Transient consisting of a turbine trip with main feedwater available.

Failure of component cooling water to thermal barriers of all reactor coolant pumps.

Table C.12.4 Dominant Peach Bottom accident sequence core damage frequency contributors (Ref. C.l2.8}.

Mean Core Damage Sequence Fire Area Frequency/yr Emergency Switchgear Room 2A 7.4E-7 Emergency Switchgear Room 2B 3.6E-6 Emergency Switchgear Room 2C 3.6E-6 Emergency Switchgear Room 2D 7.4E-7 Emergency Switchgear Room 3A 7.4E-7 Emergency Switchgear Room 3B 7.4E-7 Emergency Switchgear Room 3C 7.4E-7 Emergency Switchgear Room 3D 8.1E-7 T3U,U2X1U3 Control Room 6.2E-6 Cable Spreading Room 6.7E-7 T,Bu,w,x2w2 W3U4V2V3Y Emergency Switchgear Room 2C S.lE-7 T,Bu,w,x2w2 WaU4V2VaY Emergency Switchgear Room 2C 2.7E-7 C-131 NUREG-1150 OAGI0000611 00576

Appendix C Table C.12.4 (continued)

KEY Symbol Definition Failure of all ac power (station blackout).

Loss of offsite power transient.

Transient consisting of a turbine trip with main feedwater available.

Failure of the high-pressure coolant injection (HPCI) system.

Failure of the reactor core isolation cooling (RCIC) system.

Failure of the control rod drive (CRD) system (2 pump mode).

Failure of the CRD system (1 pump mode).

Failure of the low-pressure core spray (LPCS) system.

Failure of the low-pressure coolant injection (LPCI) system.

Failure of the suppression pool cooling mode of the residual heat removal (RHR) system.

Failure of the shutdown cooling mode of the RHR system.

Failure of the containment spray mode of the RHR system.

Failure to depressurize the reactor coolant system via SRVs or the automatic depressurization system.

Failure to depressurize the reactor coolant system to allow the shutdown cooling mode of the RHR system to operate.

y Failure of primary containment venting (including makeup to the pool as required).

damage frequency predictions was conducted as part of the Fire Risk Seeping Study (Refs. C.12.10 and C.12.11). This analysis concluded that up to a factor of 20 difference was possible for some scenarios.

A second critical issue was the probability of operator recovery from the remote shutdown panel. In the NUREG-1150 fire analysis, this recovery action was quantified on a consistent basis with recovery probabilities calculated for the internal-event analyses. However, since no detailed development of control and actuation circuits was performed, complex control system interactions were not analyzed. If these types of interactions exist for either Surry or Peach Bottom, the effect would be to decrease the credit for recovery from the remote shutdown panel and to increase the fire-induced core damage frequency.

In two studies where detailed models were developed, interactions between the remote shutdown panel and the control room were found. These interactions existed even though the remote shutdown panel was found to be electrically independent of the control room.

The control systems interaction and fire code prediction issues are two of six issues addressed in the Fire Risk Scoping Study. Four other issues that will not be covered in detail here but also have the potential to have a significant effect on fire-induced core damage frequency are:

1. Manual fire brigade effectiveness,

2. Total environment survival,

3. Fire barrier effectiveness, and

4. Fixed fire suppression system damage effects.

Since the Fire Risk Scoping Study was being conducted concurrently with the NUREG-1150 fire analyses, these issues were not addressed in the Surry and Peach Bottom studies. However, any of these issues has the potential to increase the fire core damage frequency when included in an assessment.

NUREG-1150 C-132 OAGI0000611 00577

Appendix C A final issue is the Bayesian updating of generic fire initiating event frequencies to determine plant-specific fire frequencies. Several studies have found fire frequency on a plant-wide basis of 0.15 per reactor year.

Therefore, any average plant will have only three to four significant fires over its operational lifetime. As was discussed previously, the NUREG-1150 fire analyses used a Bayesian updating procedure to determine plant-specific fire frequencies (for both Surry and Peach Bottom). The plant areas updated were:

1. Control room,

2. Cable spreading room,

3. Auxiliary building, and

4. Electrical switchgear room.

When comparing the Bayesian updated frequencies with the generic fire frequencies for these areas, no more than a factor of 3 difference typically occurred. These plant-specific frequencies were found to be both higher and lower than the average depending on a given plant's operating experience. Since this affects every fire cut set, no more than a factor of 3 difference (as compared with generic estimates) in core damage frequency estimates also occurred.

REFERENCES FOR SECTION C.12 C.12.1 Public Service Company of New Hampshire and Yankee Atomic Electric Company, "Seabrook Station Probabilistic Safety Assessment," Section 9 .4, December 1983.

C.12.2 Philadelphia Gas and Electric Company, "Severe Accident Risk Assessment Limerick Generat-ing Station," Chapter 4, Main Report, Report #4161, April 1983.

C.12.3 M. P. Bohn and J. A. Lambright, "Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150," Sandia National Laboratories, NUREG/CR-4840, SAND88-3102, November 1990.

C.12.4 U.S. Code of Federal Regulations, Appendix R, "Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979," to Part 50, "Domestic Licensing of Production and Utilization Facilities," of Chapter I, Title 10, "Energy."

C.12.5 V. Ho et al., "COMPBRN III-A Computer Code for Modeling Compartment Fires," Oak Ridge National Laboratory, NUREG/CR-4566, ORNLITM-10005, April 1986.

C.12.6 R. L. Iman and M. J. Shortencarier, "A User's Guide for the Top Event Matrix Analysis Code (TEMAC)," Sandia National Laboratories, NUREG/CR-4598, SAND86-0960, August 1986.

C.12.7 J. A. Lambright et al., "Analysis of Core Damage Frequency: Peach Bottom Unit 2 External Events," Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Part 3, SAND86-2084, December 1990.

C.12.8 J. A. Lambright et al., "Analysis of Core Damage Frequency: Surry Unit 2 External Events,"

Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Part 3, SAND86-2084, December 1990.

C.12.9 N. 0. Siu, "COMPBRN-A Computer Code for Modeling Compartment Fires," University of California at Los Angeles, NUREG/CR-3239, UCLA-ENG-8257, May 1983.

C.12.10 V. F. Nicolette et al., "Observations Concerning the COMPBRN III Fire Growth Code,"

Sandia National Laboratories, SAND88-2160C, April 1989.

C.12.11 J. A. Lambright et al., "Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," Sandia National Laboratories, NUREG/

CR-5088, SAND88-0177, January 1989.

C-133 NUREG-1150 OAGI0000611 00578

Appendix C C.13 Containment Bypass Sequences Accident sequences that involve bypass of the containment, thereby having a direct release path to the environment, were assessed to be important at all three PWRs and were risk. dominant at the Surry and Sequoyah plants. The two categories of bypass sequences that were found to be important to the NUREG-1150 PWRs are interfacing-system loss-of-coolant accidents (ISLOCAs) and steam generator tube ruptures (SGTRs). The ISLOCA sequences can lead to a direct release path to the environment if failures occur that connect the high-pressure reactor coolant system (RCS) to a low-pressure interfacing system and subsequent failure of the low-pressure boundary occurs outside containment. SGTR sequences can lead to a direct release path to the environment if an SGTR event causes subsequent failure of the secondary side pressure boundary, usually through a stuck-open relief valve. Many different factors influence the initiation and progression of these accident sequences. Some of those factors were evaluated by expert panels, while others were evaluated by the analysis teams. Additional details on these analyses may be found in References C.13.1 and C.13.2.

C.13.1 ISLOCAs-Accident Sequence Issues This section discusses those issues that arose in the accident sequence analysis of the interfacing-system loss-of-coolant accidents.

C.13.1.1 Issue Definitions ISLOCAs are sequences in which the pressure isolation valves that separate low-pressure systems from the RCS fail, thus subjecting the low-pressure system piping and components to full RCS pressure. In many cases, the low-pressure system will subsequently fail, and there is a high probability that the failure will occur outside containment, usually in the auxiliary building or the safeguards area. As the RCS loses coolant inventory, makeup will be provided from the refueling water storage tank (RWST). When the water in the RWST is depleted, recirculation cooling is not possible because the water has been lost outside containment. Core damage will then occur if an alternative water supply is not provided. At issue in the accident sequence analysis is the frequency of check valve failures that represent the initiating event for this sequence. This issue was addressed by members of the accident frequency analysis expert panel, including:

Dennis Bley-Pickard, Lowe, and Garrick, Inc.,

Gary Boyd-SAROS, Inc.,

Robert Budnitz-Future Resource Associates, Inc.,

Karl Fleming-Pickard, Lowe, and Garrick, Inc., and Garreth Parry-NUS Corporation.

C.l3.1.2 Technical Basis for Issue Quantification Three check valve failure scenarios were identified for the Surry and Sequoyah plants. (ISLOCAs were not found to be important at Zion because of the plant-specific configuration of the high-to-low pressure system interfaces.) The three scenarios considered by the expert panel were:

1. Random independent rupture (catastrophic leakage) of the two check. valves in series.

2. Failure of one check. valve to reclose upon RCS repressurization, followed by random rupture of the other valve.

3. The undetected failure of one valve during operation (between test periods), followed by rupture of the other valve. The undetected failure can be caused by opening of the disc or severe deterioration of the seat. This failure is not detected because the other valve is holding pressure. When the other valve fails, the ISLOCA is initiated.

The panel provided an ISLOCA initiating event frequency distribution considering the three failure modes listed above along with possible common-cause failures affecting valves in the same line. The model for Sequoyah was slightly different from the one for Surry because the accumulators inject between the two NUREG-1150 C-134 OAGI0000611 00579

Appendix C check valves at Sequoyah, thus making failures of the outboard check valve detectable. The expert panelists considered information from valve specialists and available data bases in developing their positions. A high degree of uncertainty is evident in the distributions because of the lack of directly applicable data.

C.13.1.3 Treatment in PRA and Results The results of the interfacing-system LOCA expert elicitation were used as the primary basis for determining the frequency of the ISLOCA initiating event. The plant analysts provided information on the check valve testing frequency and procedures that influenced the models. Additionally, for Sequoyah some ISLOCAs can be isolated, depending upon the break location. The plant analysts provided the probability that the operators would isolate the break, if possible. Except for the probability of isolating the break at Sequoyah, the ISLOCA events are assessed to proceed to core damage with unity probability, given the initiating event. The probability distributions for the initiating event that resulted from the expert elicitation are shown below. These distributions are for a single high-to-low pressure interface. At Surry, there are three such interfaces, while Sequoyah has four.

Frequency per Reactor Year Percentile Surry Sequoyah 5th 1.3E-11 1.2E-11 50th 1.6E-8 9.5E-9 95th 1.7E-6 1.2E-6 Mean 3.8E-7 2.7E-7 C.l3.2 ISLOCAs-Source Term Issues This section discusses those issues that arose in the source term analysis of ISLOCAs. In the source term analysis, this accident was usually referred to as Event V.

C.l3. 2.1 Issue Definition A number of factors influence the source terms that result from ISLOCA sequences. Because the check valve failures result in large leakage paths, the RCS will be at low pressure. The in-vessel behavior is expected to be similar to that of other, non-bypass, low-pressure sequences. Releases from the auxiliary building are strongly influenced by the location of the break in the auxiliary building and whether or not the break is ultimately covered by water, thereby leading to pool scrubbing. Fire suppression sprinklers in the auxiliary building may also act to reduce the releases. Some of these issues were addressed by the source term expert panel, some by an expert panel for the first draft of NUREG-1150, and some by the analysis teams.

C.l3.2.2 Technical Basis for Issue Quantification The releases for ISLOCA are calculated with the regular early and late release equations in the XSOR codes (see the description of the XSOR codes in Appendix A and in Ref. C.13.3). There are specific distributions for ISLOCA for the factor that accounts for the release from the vessel and for the factor that accounts for the release from the building. For ISLOCA, the vessel release factor, which represents the fraction released from the vessel to the containment in non-bypass accidents, is redefined to represent the release fraction from the vessel to the auxiliary building through the high-pressure and low-pressure piping. Because ISLOCA is a low-pressure sequence, the distributions for the ISLOCA vessel release factor are similar to those for non-bypass low-pressure accidents. For ISLOCA, the building release factors, which represent the fraction released from the containment building in non-bypass accidents, are redefined so that they account for the release fraction from the auxiliary building to the environment.

These factors do not include the effects of pool scrubbing or auxiliary building sprays; reductions of the release due to mitigating effects such as these are accounted for by a separate decontamination factor.

The distributions for the ISLOCA building release factor are similar to those for an early rupture of containment.

C-135 NUREG-1150 OAGI0000611 00580

Appendix C At Surry, the releases from an ISLOCA will be reduced by passage through a water pool if the pipe break location is under water. Pool scrubbing at Surry is treated by a specific pool scrubbing distribution that is used for the decontamination factor. At Sequoyah, the ISLOCA releases will be reduced if the thermally activated auxiliary building fire spray system operates. Spray scrubbing at Sequoyah is treated by a specific spray scrubbing distribution that is used for the decontamination factor. The decontamination factor is applied in addition to the building release factor. Some of the distributions used in determining the ISLOCA release were determined by the source term expert panel, some by an expert panel for the first draft of NUREG-1150, and some by the project staff.

C.13.2.3 Treatment in PRA and Results The ISLOCAs were treated similarly to the non-bypass accidents in the PWR XSOR codes insofar as possible. The vessel release factor and the building release factor were redefined for application to ISLOCAs.

The vessel release factor is denoted FVES in SURSOR and SEQSOR. Distributions for this factor for the non-bypass accidents were determined by the source term expert panel. Distributions for FVES for ISLOCA were determined by the project staff; they were based on the low-pressure non-bypass FVES distributions of the source term expert panel. It was determined that the Ba, Sr, Ru, La, and Ce radionuclide classes would all behave as aerosols, so the distributions for these classes are identical. Three points on the distributions for the nine radionuclide classes are given below for Surry and Sequoyah. NG denotes the noble gases. In SURSOR and SEQSOR this accident is called Event V.

FVES distributions for Event V for Surry and Sequoyah Percentile NG I Cs Te Ba Sr Ru La Ce 5 l.OE+O 1.6E-1 l.SE-6 6.4E-2 l.OE-1 l.OE-1 l.OE-1 l.OE-1 l.OE-1 50 1.0E+6 6.1E-1 6.0E-1 2.5E-1 3.5E-1 3.5E-1 3.5E-1 3.5E-1 3.5E-1 95 1.0E+0 9.0E-1 9.7E-1 9.3E-1 9.6E-1 9.6E-1 9.6E-1 9.6E-1 9.6E-1 There are two building release factors in SURSOR and SEQSOR. FCONV is the fraction of the fission products in the auxiliary building from the RCS release that is released to the environment in the absence of mitigating factors. FCONC is the fraction of the fission products in the auxiliary building from the core-concrete interaction (CCI) release that is released to the environment in the absence of mitigating factors. The RCS release is sometimes called the early release, and the CCI release is sometimes referred to as the late release. Distributions for FCONV and FCONC for ISLOCA were determined by the project staff.

It was determined that, for the escape from the containment for the early release, one distribution could be applied to all radionuclide classes except the noble gases. FCONV is unity for the noble gases since they are not held up or absorbed in the reactor vessel. The values for the 5th, 50th, and 95th percentiles for the Surry and Sequoyah are:

FCONV distributions for Event V for both Surry and Sequoyah Percentile FCONV 5 1.6E-1 so S.OE-1 95 8.6E-1 For the escape of fission products released during CCI, it was concluded that iodine and cesium would behave similarly, and all the other radionuclides except noble gases would behave as aerosols. The values for the 5th, 50th, and 95th percentiles for Surry and Sequoyah are given below.

NUREG-1150 C-136 OAGI0000611 00581

Appendix C FCONC distributions for Event V for Surry and Sequoyah Percentile NG I Cs Te Ba Sr Ru La Ce 5 1.0E+O 1.1E-1 1.1E-1 9.3E-2 9.3E-2 9.3E-2 9.3E-2 9.3E-2 9.3E-2 50 1.0E+0 S.OE-1 S.OE-1 4.7E-1 4.7E-1 4.7E-1 4.7E-1 4.7E-1 4.7E-1 95 1.0E+0 7.7E-1 7.7E-1 7.7E-1 7.7E-1 7. 7E-1 7. 7E-1 7.7E-1 7.7E-1 At Surry, much of the low-pressure piping that will be exposed to full RCS pressure in Event V is located near the floor in an area of the auxiliary building that will retain water. Since the contents of the RCS and the RWST will escape out the break before the onset of core damage, there is a good chance the pipe break will be under several feet of water when the release commences. Whether the pipe break is under water is determined in the accident progression analysis, based on the results of a panel convened for the first draft of NUREG-1150 to consider this specific question. The conclusion of this panel was that the mean probability that the Event V low-pressure pipe break at Surry will be under water is 0.85.

At Sequoyah, the pipe break is likely to be in an area of the auxiliary building that has heat-activated fire sprays (unlike Surry, which has no such sprays). There is no possibility at Sequoyah that the water escaping from the low-pressure pipe break in Event V will collect so that the pipe break will be under several feet of water when the release commences. It was decided by the project staff that there would be a high probability that the releases would be subject to scrubbing by fire sprays (the mean probability was assessed to be about 0.80).

The source term expert panel decided that the uncertainty in the distribution used for the decontamina-tion factor for sprays or passage through a water pool was less important than the uncertainty in whether the sprays were on or whether the pipe break was under water. The decontamination factors for both sprays and pool scrubbing were therefore determined by the project staff. There is a single decontamina-tion factor distribution that applies to all radionuclide classes except the noble gases, which are not affected by sprays or a passage through water.

Decontamination factor (DF) distribution for Event V at Surry (pool scrubbing) and at Sequoyah (sprays)

Percentile DF 5 4.1E+3 50 6.2 95 1.8 C.l3.3 SGTRs-Accident Sequence Issues This section discusses those issues that arose in the accident sequence analysis of the steam generator tube ruptures.

C.l3.3.1 Issue Definition A steam generator tube rupture is a unique initiator because it represents a failure of the RCS boundary into the secondary side. As a result of the tube rupture, the secondary side may be exposed to full RCS pressures. These pressures are likely to cause relief valves to lift on the secondary side. If these valves fail to reclose, an open pathway from the vessel to the environment can result. Thus, this accident has some of the same characteristics as an ISLOCA. In determining the frequency of SGTR sequences, there are a number of important issues, including the SGTR initiating event frequency, the likelihood that the operators will depressurize the RCS to a pressure lower than in the secondary side so as to terminate the loss of coolant, and the response of the secondary side safety valves. The plant analysts addressed all the issues except those dealing with the safety valves; the latter were addressed in an elicitation process C-137 NUREG-1150 OAGI0000611 00582

Appendix C involving the project staff. The nature and response of safety valves to various types of demands were the focus of the elicitation process.

C.13.3.2 Technical Bases for Issue Quantification The consideration of secondary side safety valve behavior considered the following four questions:

1. What is the probability of a secondary safety valve demand?

2. What is the probability that, given a safety valve demand, liquid or two-phase flow through the safety valves occurs?

3. What is the probability of failure to reclose, given that the safety valves pass liquid or a two-phase mixture?

4. How many demands of the secondary safety valves will occur?

The evaluation of these questions was based on consideration of plant emergency operating procedures, thermal-hydraulic calculations, and data from actual SGTR events, such as at North Anna. The likelihood of a secondary side safety valve demand depends largely on the status of the atmospheric dump valves (ADVs) and their block valves. If the ADVs are operating in an unblocked mode, their operation may preclude demands of the safety valves. On the other hand, if the ADVs are blocked, demand of the safety valves is likely. The passage of liquid through the valves depends on the ability of the operators to prevent filling up of the faulted steam generator. The operators need to control the RCS pressure and reduce the flow from the high-pressure injection system in order to preclude liquid flow through the safety valves.

Given that liquid flow occurs and that multiple demands are considered likely, it was assessed that there was a high likelihood that the safety valves would stick open.

C.13.3.3 Treatment in PRA and Results For the PRAs, the plant analysts identified the possible situations where safety valve demand might be of concern. The mean probabilities of having a stuck-open safety valve were assessed for the eight cases identified below. Cases 2 and 6 were assessed to be inapplicable because it is impossible to control RCS pressure if safety injection is not also controlled.

Table C.13.1 Secondary side safety valve failure probabilities.

Case 1 2 3 4 5 6 7 8 Primary Pressure Controlled y y N N y y N N Safety Injection Controlled y N y N y N y N ADVs Blocked y y y y N N N N Mean Probability of Stuck-Open Safety Valve .28 NA 1.0 1.0 0.0 NA .15 .15 Cases conditional upon the failure of the operators to depressurize were assessed to be the most likely to lead to safety valve demand and subsequent failure. The plant analysts then combined this information with the analysis of operator actions to depressurize and take other mitigative steps in order to determine an overall frequency of SGTR core damage events. These frequencies were estimated to be quite low at the three PWRs in NUREG-1150; however, they remain important relative to other sequences because of the possibly large source term that can result from a bypassed containment.

NUREG-1150 C-138 OAGI0000611 00583

Appendix C C.13.4 SGTRs-Source Term Issues This section discusses those issues that arose in the source term analysis of the steam generator tube ruptures.

C.13.4.1 Issue Definition The magnitude of the source term from an SGTR accident depends on the integrity of the secondary system and the containment. If the integrity of both is maintained, the releases may be quite small. On the other hand, if the safety valves on the secondary system stick open, then a direct path from the vessel to the environment is created and the releases may be very high. If the safety valves on the secondary system do not stick open, the releases depend on the time at which the containment fails (if at all) as in non-bypass accidents. Thus, there are two pathways from the reactor vessel to the environment. The one pathway is through the broken steam generator tube and out through the safety valves on the secondary system. The second pathway is the same as the pathway for non-bypass transient accidents: into the containment through a safety or relief valve (if open) until the vessel fails and directly after the vessel fails; and from the containment to the environment through the failure in the containment (if it fails). If the safety valves on the secondary system stick open, the first pathway dominates. This accident is of considerable concern because of the potentially large releases that might result. If the safety valves on the secondary system do not stick open, the releases by the second (non-bypass) pathway are more important.

C.13.4.2 Technical Basis for Issue Quantification The equation used to determine the early release for SGTR accidents differs from the usual early release equation in that it contains an additional term for the release through the secondary system and the secondary system safety valves. If the secondary safety valves are stuck open, this bypass term accounts for the bulk of the release. For the non-bypass or normal pathway to the environment via the containment, the SGTR accidents are treated no differently than similar non-bypass accidents. Only the vessel release factor has a specific distribution for the SGTR accidents. This distribution was determined by the project staff.

The additional (bypass) term for the RCS release for SGTR accidents consists of two factors. One represents the fraction released from the core that enters the secondary side of the steam generator; the second is the fraction entering the secondary side of the steam generator that is released to the environment through the safety valves. No removal factors, such as building or spray decontamination factors, are applied to this release path. For the SGTRs where the secondary system safety valves reclose, the distributions for these two factors were determined by the project staff. For the SGTRs where the secondary system safety valves stick open, the distributions for these two factors were determined by an expert panel convened specifically to consider the release from this type of SGTR.

C.13.4.3 Treatment in PRA and Results For the non-bypass pathway to the environment via the containment, the radioactive material released from the PWRs are computed using the same equation used for non-bypass accidents. The only factor for which specific distributions are defined is the vessel release factor, FVES, which represents the fraction passing from the vessel to the containment. It cannot be the same as in a non-bypass accident since some of the fission products escape from the vessel into the steam generator. Distributions for FVES for SGTRs were determined by the project staff. In this situation, the Ba, Ru, La, and Ce radionuclide classes would an behave as aerosols so the distributions for these classes are identical. Strontium is somewhat less likely to be released.

FVES distributions for SGTRs for Surry and Sequoyah Percentile NG I Cs Te Ba Sr Ru La Ce 5 1.0E+2 2.4E-2 2.4E-2 8.8E-2 1.3E-2 9.4E-3 1.3E-2 1.3E-2 1.3E-2 so 1.0E+0 1.7E-1 1.7E-2 3.2E-1 5.8E-2 4.4E-2 5 .SE-2 5 .8E-2 5.8E-2 95 1.0E+0 8.7E-1 8.2E-1 9.5E-1 7.3E-1 6.7E-1 7.3E-l 7.3E-1 7.3E-1 C-139 NUREG-1150 OAGI0000611 00584

Appendix C In SURSOR and SEQSOR, FISG represents the fraction released from the core that enters the steam generator; and FOSG represents the fraction entering the steam generator that is released from the steam generator to the environment. For SGTRs in which the secondary system safety valves reclose, the distributions for FISG and FOSG were determined by the project staff and separate distributions were defined for each of these factors. It was determined that the Ba, Sr, Ru, La, and Ce radionuclide classes would all behave as aerosols so the distributions for these classes are very similar.

FISG distributions for SGTRs with the secondary safety valves reclosing for Surry and Sequoyah Percentile NG I Cs Te Ba Sr Ru La Ce 5 2.5E-1 1.1E-1 l.OE-1 2.9E-1 1.6E-1 1.7E-1 1.7E-1 1.7E-1 1.6E-1 50 S.SE-1 2.9E-1 2.8E-1 5.6E-1 3.3E-1 3.4E-1 3.4E-1 3.4E-1 3.3E-1 95 9.5E-1 8.5E-1 7.7E-1 l.OE+O 9.0E-1 9.0E-1 9.0E-1 9.0E-1 9.0E-1 FOSG distributions for SGTRs with the secondary safety valves reclosing for Surry and Sequoyab Percentile NG I Cs Te Ba Sr Ru La Ce 5 2.9E-1 2.0E-1 2.0E-1 2.6E-1 2.6E-1 2.SE-1 2.5E-1 2.6E-1 2.6E-1 50 6.7E-1 5.3E-1 5.4E-1 S.OE-1 5.2E-1 5.3E-1 5.3E-1 5.3E-1 5.3E-1 95 1.0E+0 1.0E+0 1.0E+O 9.2E-1 1.0E+0 1.0E+0 l.OE+O 1.0E+O 1.0E+0 For SGTRs in which the secondary system safety valves stick open, the distributions for FISG and FOSG were determined by a special source term expert panel that considered only the releases from this type of SGTR accident. The panel declined to provide separate distributions for FISG and FOSG and provided distributions for the product FISG

• FOSG. Because the bypass term for the SGTR release consists of just the product of FISG and FOSG, and these factors appear nowhere else in the release equation, this was acceptable. The experts provided separate distributions for iodine, cesium, tellurium, and aerosols and specified that they applied to all the PWRs. There is no retention in the steam generators for the noble gases. The aerosol distribution applies to the Ba, Sr, Ru, La, and Ce radionuclide classes. The panel concluded that there was a very good chance that there would be little retention of radionuclides in the steam generator and the piping.

FISG

• FOSG distribution for SGTRs with the secondary safety valves stuck open for Surry and Sequoyah Percentile NG I Cs Te Ba Sr Ru La Ce 5 1.0E+0 2.0E-5 2.8E-7 3.8E-5 3.8E-5 3.8E-5 3.8E-5 3.8E-5 3.8E-5 50 1.0E+O 2.7E-1 2.6E-1 1.7E-1 2.4E-1 2.4E-1 2.4E-1 2.4E-1 2.4E-1 95 1.0E+0 S.OE-1 7.8E-1 7.7E-1 7.6E-1 7.6E-1 7.6E-1 7.6E-1 7.6E-1 As implemented in SURSOR and SEQSOR, rather than change the equation for the SGTRs in which the secondary system safety valves stick open, the distributions for the product FISG

• FOSG were placed in the data array for FISG and the data array for FOSG was set to 1.0.

NUREG-1150 C-140 OAGI0000611 00585

Appendix C REFERENCES FOR SECTION C.13 C.13.1 T. A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April 1989.

C.13.2 F. T. Harper et at., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551. Vol. 2, Revision 1, SAND86-1309, December 1990.

C.13.3 H. N. Jow et al., "XSOR Codes User's Manual," Sandia National Laboratories, NUREG/

CR-5360, SAND89-0943, to be published.*

• Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.

C-141 NUREG-1150 OAGI0000611 00586

Appendix C C.14 Reactor Coolant Pump Seal Failures in Westinghouse Plants After Loss of All Seal Cooling C.14.1 Issue Definition The ability of reactor coolant pump seals to remain intact during loss of all seal cooling is a concern for PWRs. As the three PWRs studied for NUREG-1150 are all Westinghouse plants, results of the analysis of this study are only applicable to Westinghouse plants.

One of the potential concerns during a station blackout is the possibility of a loss-of-coolant accident (LOCA) created by failure of the reactor coolant pump (RCP) seals to maintain a restricted flow between the reactor coolant system and the containment.

The Westinghouse RCP shaft seal is a three-stage seal assembly, as shown in Figure C.14.1. The number one seal is a film-riding controlled leakage seal, whereas the number two and three stages are rubbing-face type seals. The leakage across the number one seal cools the seal assembly. The high-pressure subcooled leakage is supplied by an injection system upstream of the number one seal. Part of the injection water flows through the seal assembly. The remainder flows into the water coolant system as makeup water.

Backup cooling is provided by a water-to-water heat exchanger parallel to the labyrinth seal. During a station blackout, both injection and cooling water would be lost.

High-temperature reactor coolant water would then flow up the shaft into the seal system. The shaft and the seal assembly would experience abnormal temperature distributions. This condition will affect the angle between the faceplates of the RCP seals and the gap between the faceplates of the number one film-riding seal.

The gap between the number one seal faceplates is determined by a force balance, which can be affected by flow rate, the angle between the faceplates of the seal ring and runner, enthalpy, and inlet pressure.

The fluid pressure profile between the seal faceplates determines the opening forces on the seal. The closing force on the seal is proportional to the differential pressure across the seal and acts on the upper surface of the seal ring. If these forces are unbalanced, the gap will increase or decrease as necessary until the forces are balanced.

The number two seal stage is designed to withstand full system pressure without loss of integrity in the event that number one seal stage fails. In the event that both number one and number two seals fail, the number three seal stage is not expected to limit leakage. The size of a resultant leak rate is dependent on the combinations of seal ring failures and a-ring failures in the various seal stages.

At issue is the leak rate in gallons per minute as a function of time, due to seal failure caused by loss of cooling to the pump shaft, which is expected during station blackout. The hypothesized failure modes involve loss of the seal ring geometry and degradation of the elastomer material. (Additional detail on this analysis may be found in Ref. C.14.1.)

C.14.2 Technical Bases for Issue Quantification For this issue, three experts participated in these evaluations:

M. Hitchler-Westinghouse Electric Corporation, J. Jackson-Nuclear Regulatory Commission, and D. Rhodes-Atomic Energy of Canada Limited These experts developed a consensus structure with which to analyze the issue. The result was a logic tree that describes the possible failure combinations of seal rings and o-rings and the resultant leak rates for a single pump. This logic tree is shown in Figure C.14.2. The 21-gpm leak per pump is considered to be a successful restriction of flow.

The experts then provided assessments for the failure probabilities for the four events of the logic tree.

Assessments were made for two different a-ring elastomer materials. The old a-ring material, which is currently in use at Surry, Sequoyah, and Zion, has exhibited significant degradation in some experiments.

NUREG-1150 C-142 OAGI0000611 00587

Appendix C PRELIMINARY OPERATING PARAMETERS L MOTOR INLET SEAl FLOW RATE PRESSURE NO.1 22SO 3 GPM NO, 3 SEAL RING ASSEMBLY NO. 2 50 3GPH NO.3 6 100 Cc:JHR NO, 3 SEAl. SPACER TO WASTE ,..__

PROCESSING J--- NO. 2 SEAL HOUSING SYSTEM

.._~- NO. 2 SEAL SI>ACER

-:.i'----=......1-"'""l NO. 2 SEAl RING ASSEMtu.Y NO.1 AUNNER RETAINER SLEEVE NO, 1 SEAL RUNNER ASSEMBLY SEALING SURFACE NO.1 r*wuu ..

RCP Typical Shah Seal Arrangement Figure C.14.1 Westinghouse RCP seal assembly (Ref. C.14.1).

C-143 NUREG-1150 OAGI0000611 00588

Appendix C Elastomer 1st Stage 2nd Stage 1st Stage 2nd Stage Failure Binds Binds Pop Open Pop Open Yes Yes Yes No Yes No Yes No No Yes No Yes No Yes No Yes No No Figure C.14.2 Decision tree (Ref. C.14.1).

The new o-ring elastomer has been shown to be much less susceptible to degradation when subjected to similar experimental conditions. In addition to the type of o-ring material in the RCP seals, elicitations were taken for pressurized and depressurized reactor coolant system (RCS) status. Successful cooldown and depressurization will subject the pump seals to cooler, less harsh conditions.

Total RCS leak rate is based on leak rates from all RCP pumps (3 for Surry, 4 for Sequoyah and Zion).

Therefore, in addition to developing an assessment for a single RCP, it was necessary to postulate the degree of correlation between similar failures in different pumps. That is, the assessment included consideration of whether the seals fail independently or have the same leakage.

C.14.3 Treatment in PRA and Results In order to evaluate the station blackout event tree, it is necessary to have a relationship between leak rate and probability of leak rate versus time. The results for each expert were averaged to calculate aggregate leak rates and their probabilities. The calculations were done for the following three cases:

1. Old o-ring material-with RCS cooldown

2. Old o-ring material-without RCS cooldown

3. New a-ring material-without RCS cooldown The experts developed very different assessments for correlating component failures between pumps.

They reached a consensus on this point: if two similar components in two pumps failed (e.g., first stage seal rings in two different pumps), then the same component could be assumed to fail in all other pumps.

This assumption simplified the problem of calculating total RCP seal leak rate probabilities for determining the possible failure combinations for a two-pump model for each expert.

'The results are shown in 'Table C.14.1 for a three-loop Westinghouse plant and Table C.14.2 for a four-loop plant. These tables show the probability of various leak rates at different points in time after loss of cooling to the seals. In order to incorporate this information into the sequence models, it was necessary to calculate a time of initial seal failure and a core uncovery time for each possible failure scenario. A NUREG-1150 C-144 OAGI0000611 00589

Table C.14.1 Aggregated RCP seal LOCA probabilities for Westinghouse three-loop plant.*

Old 0-Rings Time New 0-Rings Time (h) (h)

Leak Rate (gpm) I 1.5 I 2.5 I 3.5 I 4.5 I 5.5 I 1.5 I 3.6 I 3.5 I 4.5 I s.s 63 .306 .290 .274 .274(.258) ** .274(.241) .817 .816 .814 .812 .811 103 - - - - - 7.7E-3 7.7E-3 7.7E-3 7.7E-3 7.7E-3 183/224"** .148 .037 .050 .048(.064) .047(.079) .014 .014 .016 .017 .019 294 - - - - - 1.9E-3 1.9E-3 1.9E-3 1.9E-3 1.9E-3 372 8.5E-3 S.OE-3 4.5E-3 3.7E-3 3.3E-3 4.5E-4 5.0E-3 5.3E-3 5.7E-3 6.0E-3 516/526/546 3.5E-4 3.4E-4 3.2E-4 3.2E-4 3.2E-4 .145 .145 .145 .145 .145 nI .001 0 0 0 4.7E-4 4.7E-4 4.7E-4 4.7E-4 4.7E-4 f-"

602/614 0

v. 750 .530 .660 .660 .660 .660 7.7E-3 7.7E-3 7.7E-3 7.7E-3 7.7E-3 1440 4.3E-3 4.3E-3 4.3E-3 4.3E-3 4.3E-3 5.0E-3 5.0E-3 S.OE-3 5.0E-3 S.OE-3

• This table is Table 5.4-1 of Reference C.14.1.

• • Parentheses denote calculations that change if no depressurization is assumed. All other probabilities are for depressurized conditions.

• "*Similar leak rates have been lumped together. These values are the probabilities of being at a particular leak rate at a particular time.

z c:

0  ::tl ~

"0

)> tr1 Cl>

G> 0  ;:l 0 I 0.

0 0

f-"

f-" s:r 0 v. n (j) 0 I

0 0

(J'1

<D 0

z c:: ~g

~

Table C.14.2 Aggregated RCP seal LOCA probabilities for Westinghouse four-loop plant.*

0 I ~

p VI Old 0-Rings Time New 0-Rings Time

()

0 (h) (h)

Leak Rate (gpm) I 1.5 I 2.5 I 3.5 I 4.5 I 5.5 I 1.5 I 3.6 I 3.5 I 4.5 I 5.5 1.5 2.5 3.5 4.5 5.5 1.5 3.6 3.5 4.5 5.5 84 .302 .286 .271 .274(.255) .271(.239) ** .810 .809 .809 .807 .805 244/245*** .148 .038 .053 .051(.067) .049(.081) .014 .016 .0-17 .0198 .020 313 - - - - - .010 .010 .010 .010 .010 433 .011 .012 .028 9.9E-3 9.3E-3 6.0E-4 6.0E-4 6.0E-4 6.0E-4 6.0E-4 480 1.3E-3 1.3E-3 1.3E-3 1.3E-3 1.3E-3

<( 543 - - - - - 2.6E-3 2.6E-3 2.6E-3 2.6E-3 2.6E-3

~

0\ 688/698/728 1.2E-3 1.2E-3 1.1E-3 l.lE-3 .146 .146 .146 .146 .146 .146 796 - - - - - 2.7E-3 2.7E-3 2.7E-3 2.7E-3 2.7E-3 1000/1026 .530 .659 .659 .665 .666 8.3E-3 8.3E-3 8.3E-3 8.3E-3 8.3E-3 1230 1.6E-6 1.6E-3 1.6E-3 1.6E-3 1.6E-3 1920 4.2E-3 4.2E-3 4.2E-3 4.2E-3 4.2E-3 4.2E-3 4.2E-3 4.2E-3 4.2E-3 4.2E-3

• This table is Table 5.4-2 of Reference C.14.1.

• • Parentheses denote calculations that change if no depressurization is assumed. All other probabilities are for depressurized conditions.

• • • Similar leak rates have been lumped together. These values are the probabilities of being at a particular leak rate at a particular time.

0

)>

G>

0 0

0 0

(j)

I 0

0 (J'1

<D

Appendix C series of individual scenarios were defined that identify the time of seal failure, the initial leak rate, the progression of leak rate, and the probability of the scenario.

For Sequoyah (a four-loop plant), a total of 17 scenarios were identified and are shown in Table C .14. 3.

They include the initial leak rate, the time of initial seal failure, any increases in leak rate, the time at which the leak rate increases, and the probability. These 17 scenarios were used to develop point estimate probabilities (i.e., no uncertainty stated) for seal failure and core uncovery. These values were not used in the uncertainty analysis. In order to calculate the probability distributions for seal LOCA sequences, the 17 scenarios were consolidated into seven states. There are six failure states and one success rate (the 84 gpm state is a success state) . The seven seal states are summarized below:

Time to Transfer Leak Path (gpm) (hours) Probability 1000* 1-1/2 .5298 240 - 1000 2-1/2 .1253 240* 1-1/2 .049 433- 1000 2-1/2 .0051 1920* 1-1/2 .0042 433* 1-1/2 .0042 84 * (success) .2704

• Constant leak rate This probability distribution is interpreted as a representation of the experts' collective degrees of belief in the seven states that represent possible outcomes for seal LOCA. The occurrence of a seal LOCA is therefore treated as a modeling uncertainty with respect to time and size. These states were sampled as either a zero or unity probability in the TEMAC uncertainty analysis.

The following discussion illustrates how the seal LOCA model was integrated into the station blackout event trees. (Two constraining criteria were applied to this task: (1) the event heading for nonrecovery of ac power would be separate from the event heading for seal LOCA, and (2) a minimum number of headings would be used.)

The conclusion of the expert panel was that, at 90 minutes after loss of all cooling, the seal temperatures would have increased enough to be at risk of failure. Prior to 90 minutes, there is no risk of seal failure.

After 90 minutes, with no cooling, the seal may fail or may remain intact. Leaks may slowly develop and increase with time, or they may have a constant leak rate. If a seal LOCA occurs, core uncovery can be averted if ac power is restored, thus enabling restoration of ?afety injection flow.

The calculation of the core damage frequency due to seal LOCA is based on a weighted average of the 17 seal failure scenarios. The conditional probability of core damage, given a station blackout, is calculated as follows:

where P' CD = conditional probability of core damage, P1 = probability of being at risk for an SLOCA, Pz = probability that a SLOCA occurs, and P3 = probability of not recovering ac power prior to core damage.

C-147 NUREG-1150 OAGI0000611 00592

Appendix C Table C.14.3 Sequoyah RCP seal LOCA model scenarios.*

Time to Leak Path Transfer (gpm) (hours) Probability 84 .. .2707 240** .0490 240-1000 2-1/2 .1253 240-1000 3-1/2 .0021 240-1000 4-1/2 .0021 240-1000 5-1/2 .0010 433 .. .0042 433-1000 2-1/2 .0051 433-1000 3-1/2 .0013 433-1000 4-1/2 .0006 433-1230 2-1/2 .0013 700** .0011 700-1000 2-1/2 .00007 700-1000 3-1/2 .00007 10oo** .5298 123o** .0016 192o** .0042 TOTAL .9995

• This is Table D.S-2 in Reference C.14.2.

.. Constant leak rate The probability of being at risk for a seal LOCA is the probability that ac power has not been restored within 90 minutes of a loss of a seal cooling. The probability of a seal LOCA is given by the results of the expert elicitation. There are 17 seal LOCA scenarios, each with a characteristic uncovery time and a specific probability. All seal failure scenarios are assumed to start at 90 minutes from loss of cooling. The probability of not recovering is just the probability of nonrecovery of ac power prior to the characteristic core uncovery time associated with each seal scenario. Note that the nonrecovery term must be conditional on nonrecovery of ac power in the first 90 minutes. The conditional probability of core damage can be written as:

17 PCD = l: [P(t)NRAC

• P(t)rsl(i)

• P' (t +Pi)NRAcl i =1 where

= seal LOCA scenario index, and t, in this case, equals 90 minutes, Pi = core uncovery time associated with the ith scenario, NUREG-1150 C-148 OAGI0000611 00593

Appendix C P(t)NRAc = probability of nonrecovery of ac power by timet, given loss of power at t = 0.

P(t)NRAC = 1 - P' (t)NRAc where P" is the cumulative probability of recovery of ac power, P(t)ral(l) = probability of ith seal LOCA scenario, and P'(t + .Bl)NRAC = conditional probability of nonrecovery of ac power by time t + ,8;, given no recovery at time t.

1-P'(t+,B)NRAc 1 - P' (t)NRAC Recognizing the form for P'NRAC'* the equation reduces to:

17 I: P(t)rst(i)

• P(t+,Bi)NRAC i=1 The values for P(t)rsl(l) and P(t +,B1)NRAc are shown in Table C.14.4. Core uncovery times were calculated for the case with and without secondary depressurization.

C-149 NUREG-1150 OAGI0000611 00594

zc::: ~

't:l

!:1::1 CD ti1  ::s

<?

0 lll Leak Path Time to Transfer Table C.14.4 Sequoyah RCP seal LOCA model.*

Time to CU (hr)

Time to RAC (hr)

Pro b.

NRAC Pro b.

CD Time to CU (hr)

Time to RAC (hr)

Pro b.

NRAC Pro b.

CD 0.

x*

(')

(gpm) (hours) Pro b. (with secondary depressurization) (without secondary depressurization) 84** - .2707 19 20.5 .046 - 8.9 10.4 .046 240** - .0490 8.1 9.6 .046 .00225 4.6 6.1 .056 .00274 240-1000 2-112 .1253 2.2 3.7 .10 .01253 2.15 3.65 .103 .01291 240-1000 3-1/2 .0021 3.06 4.56 .08 .00017 2.91 4.4 .084 .00018 240-1000 4-1/2 .0021 3.9 5.4 .067 .00014 3.7 5.2 .068 .00014 240-1000 5-1/2 .0010 4.7 6.2 .054 .00005 4.4 5.9 .058 .00006 433** - .0042 4.2 5.9 .058 .00024 3.1 4.6 .079 .00033 433-1000 2-1/2 .0051 2.06 3.56 .108 .00055 1.96 3.46 .110 .00056

(') 433-1000 3-1/2 .0013 2.73 4.23 .088 .00011 2.52 4.0 .093 .00012

....I lll 433-1000 4-1/2 .0006 3.41 4.91 .073 .00004 3.1 4.6 .079 .00005 0

433-1230 2-1/2 .0013 1.86 3.36 .112 .00015 1.78 3.28 .115 .00015 700** - .0011 2.6 4.1 .090 .00010 2.0 3.5 .108 .00012 700-1000 2-1/2 .00007 1.8 3.3 .115 - 1.7 3.2 .118 700-1000 3-1/2 .00007 2.17 3.67 .103 - 2.0 3.5 .108 1000* * - .5298 2.07 3.6 .105 .05563 1.85 3.35 .115 .06093 1230** - .0016 1.1 2.6 .135 .00022 1.1 2.6 .135 .00022 1920 - .0042 .75 2.25 .162 .00065 .75 2.25 .162 .00068 Total .9995 .07283 .07919

~This is Table D. 5-3 of Reference C.14.2.

• *constant leak rate.

0

)>

G>

0 0

0 0

(j)

I 0

0 (J'1

<D (J'1

Appendix C REFERENCES FOR SECTION C.14 C.14.1 T. A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April 1989.

C.14.2 R. C. Bertucio and S. R. Brown, "Analysis of Core Damage Frequency: Sequoyah Unit 1,"

Sandia National Laboratories, NUREG/CR-4SSO, Vol. 5, Revision 1, SAND86-2084, April 1990.

C-151 NUREG-1150 OAGI0000611 00596

Appendix C C.lS Zion Service Water and Component Cooling Water Upgrade In April 1989, the licensee for Zion Unit 1, Commonwealth Edison Co., made commitments to the NRC to make plant and procedure changes to address the major contributor to the core damage frequency, the development of an unmitigated reactor coolant pump (RCP) seal loss-of-coolant accident (LOCA) caused by a loss of the component cooling water (CCW) or service water (SW) system (Ref. C.15.1). The status of these commitments was provided in another letter to the NRC (Ref. C.15.2) in which the status was reported as:

1. Zion Station provided an auxiliary water supply to each charging pump's oil cooler via the fire protection system (FPS). Hoses, fittings, and tools are locally available at each unit's charging pump area, allowing for immediate hookup to existing taps on the oil coolers, if required. This action was completed in April 1989.

2. A formal procedure change was made to AOP 4.1, entitled "Loss of Component Cooling Water," on April 12, 1989, providing instruction to the operators to align emergency cooling to the centrifugal charging pumps. Specific instructions are included for each charging pump with a diagram of the lube oil cooling valves and piping.

3. As of May 1990, the new heat-resistant RCP seal o-rings were unavailable from Westinghouse.

Therefore, during the latest unit outages, the RCP seal o-rings were not replaced. When the new o-rings are available, the existing o-rings will be changed when each pump is disassembled for routinely scheduled seal maintenance.

C.lS.l Issue Definition The scope of this issue is the evaluation of the plant and procedure changes that provide an auxiliary source of cooling water to the charging pump oil coolers. The base case Zion analysis, as documented in Reference C.15.3, models the failure of the component cooling water (CCW) or service water (SW) systems as a challenge to the integrity of the RCP seals. The failure of CCW causes overheating of the charging pumps that supply seal injection water. CCW also provides the RCP seal cooling water. The CCW system uses the SW system as its heat sink.

The failure of both seal cooling and seal injection (via failure of the charging pumps due to overheating) places the RCP seals in jeopardy of failure. The failure model for the RCP seals states the mean probability of having a seal LOCA, given a loss of seal injection and seal cooling as 0.73. Failure of seal injection or seal cooling separately does not challenge seal integrity.

C.15.2 Issue Analysis The changes made by Commonwealth Edison Co. are designed to break the common-cause failure mechanism represented by the CCW and SW systems. Since exact design, procedure, and training changes were not available, the following assumptions were made in the analysis:

1. The auxiliary water supply provided by the FPS is connected such that charging pump oil cooler heat is reject.ed without depending on the rest of th~ CCW system or any of the SW system.

2. The FPS does not depend on any support from the SW system.

3. The failure to provide an auxiliary water supply to the charging pump oil coolers is dominated by the operator actions to properly determine that such action is necessary and the proper execution of the task and not by hardware failures of the FPS.

'* *; I

4. The operator action to provide an alternative source of cooling water is comparable to the operator action to diagnose the need for feed and bleed cooling and manually starting the high-pressure injection system; therefore, a comparable failure probability may be used. To account for the large uncertainty in this value, an error factor of 10 is deemed appropriate. The failure probability assigned for the failure to provide an alternative source of water to the charging pump oil coolers is a lognormal distribution with a mean of 0.01 and an error factor of 10.

NUREG-1150 C-152 OAGI0000611 00597

Appendix C The base case analysis gave credit for the operators recovering cenain CCW and SW failures by shedding unnecessary loads, staning standby pumps, and isolating piping sections where possible. These actions were modeled in the event trees as top event RE and specifically conditional split fractions (CSFs) RE1 and RE2. These CSFs were assigned a failure probability of 0.13.

The provision of an alternative water supply to the charging pump oil coolers was modeled as a change to the recoverability of the CCW and SW systems. Thus, RE1 and RE2 were changed from 0.13 to 0.01.

C.1S.3 Issue Quantification and Results The 203 highest frequency accidents and 58 plant damage states were requantified and a new Latin hypercube uncenainty analysis was performed using the failure probability data described above. Table C.15.1 shows the comparison of the plant damage state results between the base case and this sensitivity analysis. The change in the core damage frequency from a mean value of 3.4E-4 to 6.2E-5 per reactor year represents a decrease of about 81 percent.

Table C.15.1 Plant damage state comparison.

Base Case Sensitivity Case Frequency per Frequency per Plant Damage State reactor year  % reactor year  %

LOCAs 3.1E-4 93.2 3.9E-5 62.7 ATWS and transients 7.5E-6 4.0 1.4E-5 21.9 Station blackouts 9.3E-6 2.8 9.3E-6 15.0 Bypass 2.6E-7 2.6E-7 0.4 Total 3.4E-4 100.0 6.2E-5 100.0 C.15.4 Impact of Issues on Risk The impact of the sensitivity analysis described above was a significant reduction in the mean core damage frequency, which was obtained by reducing the plant damage states involving CCW and SW induced seal LOCAs. Other plant damage states remained unchanged. Thus, in the sensitivity study, CCW and SW induced seal LOCAs contribute only 24 percent to the mean core damage frequency compared with 86 percent in the base case. This reduction in LOCAs means that other plant damage states such as bypass and station blackout (SBO) become larger contributors to the lower mean core damage frequency. The contribution of SBO accidents increased from about 2 percent to over 10 percent in the sensitivity study.

Bypass accidents contributed 2. 7 percent to the mean core damage frequency in the sensitivity study compared with 0.5 percent in the base case. As station blackout and bypass accidents tend to be more challenging (in terms of containment performance) than LOCAs, the risk estimates should not be reduced by as large a fraction as the mean core damage frequency. Table C .15. 2 presents new mean risk estimates based on the sensitivity study and compares them with original base case risk. The results in Table C.15.2 indicate that the risk measures did in fact decrease by smaller fractions than the mean core damage frequency. The early fatality risk decreases by 75 percent and the latent cancer fatality risk by 67 percent.

The new mean risk estimates were not obtained by performing a completely new uncertainty analysis as was done for the accident frequency analysis (as described in Section C.15 .3). The mean risk estimates in Table C.15 .2 were obtained by using mean risk values conditional on the occurrence of the various plant damage states. The mean risk estimates that were used are given in Reference C.15 .4. The conditional mean risk measures were simply multiplied by the new mean frequencies in Table C.15.1 and summed to obtain the new risk estimates. This approach is not as rigorous as a complete requantification of the uncenainty analysis in which new distributions for the risk measures would have been obtained. However, the approach is straightforward and gives a reasonable estimate of how the mean risk estimates would be C-153 NUREG-1150 OAGI0000611 00598

Appendix C reduced by the changes made by Commonwealth Edison Company to eliminate the common-cause failure mechanism represented by the CCW and SW systems.

• Table C.15.2 Comparison o~ mean risk values.

Sensitivity Risk Measure (per reactor year) Base Case Case Early Fatalities 1.1E-4 2.0E-5 Total Fatalities-Entire Region 2.4E-2 8.1E-3 Total Fatalities-50 Miles 1.1E-2 3.3E-3 Individual Early Fatalities l.OE-8 2.0E-9 Individual Latent Cancer Fatalities 1.1E-8 2.5E-9 Frequency of One Fatality

• 6.4E-7 1.2E-7 Population Dose (person-rem)-50 Miles S.SE+l 1.7E+1 Population Dose (person-rem)-Entire Region 1.4E+2 4.6E+1 REFERENCES FOR SECTION C.lS C.15.1 Letter from Cordell Reed, Commonwealth Edison Co. (CECo) toT. E. Murley, NRC, dated March 13, 1989.

C.15.2 Letter from R. A. Chrzanowski, CECo, to NRC Document Control Desk, August 24, 1990.

C.15.3 M. B. Sattison and K. W. Hall, "Analysis of Core Damage Frequency: Zion Unit 1," Idaho National Engineering Laboratory, NUREG/CR-4550, Vol. 7, Rev. 1, EGG-2554, May 1990.

C.15.4 C. K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be pub-lished. *

• Avaibble in the NRC.PublicDocument Room, 2120 LStreet NW., Washington, DC.

NUREG-1150 C-154 OAGI0000611 00599

NRC FORM335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER (2-89) (Assigned by NRC, Add Vol.,

NRCM 1102, Supp., Rev., and Addendum Num-3201, 3202 bers, 1f any.)

BIBLIOGRAPHIC DATA SHEET (See Instructions on the reverse) NUREG-1150 Vol. 2

2. TITLE AND SUBTtTLE

3. DATE REPORT PUBLISHED Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants MONTH I YEAR Appendices A, B, and C December 1990 Final Report 4. FIN OR GRANT NUMBER

5. AUTHOR(S) 6. TYPE OF REPORT Final Technical

7. PERIOD COVERED (lnclustve Dates)

~*

8. PERFORMING ORGANIZATION -NAME AND ADDRESS (If NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address; If contractor, provide name and malting address.)

Division of Systems Research Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555

9. SPONSORING ORGANIZATION- NAME AND ADDRESS (If NRC, type "Same as above"; If contractor, prov1de NRC Div1s1on, Off1ce or Reg1on, U.S. Nuclear Regulatory Commission, and mailing address.)

Same as 8. above.

10. SUPPLEMENTARY NOTES

11. ABSTRACT (200 words or less)

This report summarizes an assessment of the risks from severe accidents in five commercial nuclear power plants in the United States. These risks are measured in a number of ways, including: the estimated frequencies of core dam-age accidents from internally initiated accidents, and externally initiated accidents for two of the plants; the perform-ance of containment structures under severe accident loadings; the potential magnitude of radionuclide releases and offsite consequences of such accidents; and the overall risk (the product of accident frequencies and consequences).

Supporting this summary report are a large number of reports written under contract to NRC which provide the de-tailed discussion of the methods used and results obtained in these risk studies.

Volume 2 of this report contains three appendices, providing greater detail on the methods used, an example risk cal-culation, and more detailed discussion of particular technical issues found important in the risk studies.

12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers in locating the report.) 13. AVAILABILITY STATEMENT Unlimited

14. SECURITY CLASSIFICATION severe accidents (This Page) risk analysis probabilistic risk analysis Unclassified (Thi* Report)

Unclassified

15. NUMBER OF PAGES

16. PRICE NRC FORM 335 (2-89)

OAGI0000611 00600

THIS DOCUMENT WAS PRINTED USING RECYCLED PAPER.

OAGI0000611 00601

NUREG-1150 Vol. 3 Severe Accident Risks:

An Assessment for Five U.S. Nuclear Power Plants Appendices D and E Final Report U.S. Nuclear Regulatory Commission Office of Nuclear Regulatory Research OAGI0000611 00602

AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street, NW, Lower Level, Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publica-tions, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investi-gation notices; Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceed-ings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regula-tions in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Information Resources Management, Distribution Section, U.S.

Nuclear Regulatory Commission, Washington, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copy-righted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute, 1430 Broadway, New York, NY 10018.

OAGI0000611 00603

NUREG-1150 Vol. 3 Severe Accident Risks:

An Assessment for Five U.S. Nuclear Power Plants Appendices D and E Final Report Manuscript Completed: January 1991 Date Published: January 1991 Division of Systems Research Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 OAGI0000611 00604

ABSTRACT This report summarizes an assessment of the risks the report itself were substantially changed. A from severe accidents in five commercial nuclear second version of the report was published in June power plants in the United States. These risks are 1989 as a draft for peer review. Two peer reviews measured in a number of ways, including: the of the second version were performed. One was estimated frequencies of core damage accidents sponsored by NRC; its results are published as the from internally initiated accidents and externally NRC report NUREG-1420. A second was initiated accidents for two of the plants; the sponsored by the American Nuclear Society performance of containment structures under (ANS) ; its report has also been completed and is severe accident loadings; the potential magnitude available from the ANS. The comments by both of radionuclide releases and offsite consequences groups were generally positive and recommended of such accidents; and the overall risk (the that a final version of the report be published as product of accident frequencies and conse- soon as practical and without performing any quences) . Supporting this summary report are a major reanalysis. With this direction, the NRC large number of reports written under contract to proceeded to generate this final version of the NRC that provide the detailed discussion of the report.

methods used and results obtained in these risk studies. Volume 3 of this report contains two appendices.

Appendix D summarizes comments received, and This report was first. published in February 1987 staff responses, on the first (February 1987) draft as a draft for public comment. Extensive peer of NUREG-115 0. Appendix E provides a similar review and public comment were received. As a summary of comments and responses, but for the result, both the underlying technical analyses and second (June 1989) version of the report.

iii NUREG-1150 OAGI0000611 00605

CONTENTS Page APPENDIX D-RESPONSES TO COMMENTS ON FIRST DRAFT OF NUREG-1150 D.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-1 D.2 Objectives and Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4 D.2.1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4 D.2.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5 D.3 Overall Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6 D.3.1 Uncertainty Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6 D.3.2 Expert Judgment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-8 D.3.3 Quality Assurance, Consistency, and State of the Art . . . . . . . . . . . . . . . . . . . . D-9 D. 3. 4 Other Comments on Methods ....................... *. . . . . . . . . . . . . . . . D-11 0.4 Tracing and Documenting Calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-13 D.4.1 Tracing Calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-13 D.4.2 Completeness of Documentation...... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-13 D.4.3 Display of Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-14 D.S Accident Frequency Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-14 D.5.1 Logic . . . . . . . . . . . . . . . . . . . ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-14 0.5.2 Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-16 D. 6 Containment Loads and Structural Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-17 0.6.1 Accident Progression Event Tree: Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-17 D.6.2 Containment Loading Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-18 D. 6. 3 Containment Structural Response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-21 D. 7 Source Terms and Consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-23 D. 7.1 Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-23 0.7.2 Supporting Data Base and Modeling Assumptions . . . . . . . . . . . . . . . . . . . . . . . D-25 D.7.3 Comparisons with Accident at Chernobyl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-29 D.8 Uses of NUREG-1150 As a Resource Document................................ D-30 D.8.1 Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-30 D.8.2 Cost/Benefit Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-31 D.8.3 Safety Goal Comparisons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-32 0.8.4 Extrapolation of Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-32 REFERENCES FOR APPENDIX D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-33 APPENDIX E-RESPONSE TO COMMENTS ON SECOND DRAFT OF NUREG-1150 E.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-1 E.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-3 E.3 Documentation and Display of Results... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-7 E.4 Use of Expert Judgment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-10 E.S Accident Frequency Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-13 E.5.1 Human Reliability Analysis E-13 v NUREG-1150 OAGI0000611 00606

Page E.5.2 External-Event Analysis......... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-15 E.5.3 Other Accident Frequency Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-16 E. 6 Accident Progression Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-20 E. 7 Source Terms and Consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-24 E.7.1 Source Terms..................................................... E-24 E. 7. 2 Offsite Consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-26 E.B Uses of NUREG-1150 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-27 REFERENCES FOR APPENDIX E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-30 ATTACHMENT TO APPENDIX E................................................ EA-1 TABLES D.1 Authors of public comment letters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2 0.2 Members of Kouts Committee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-3 0.3 Members of Kastenberg Committee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-3 D.4 Members of ANS Special Committee on Reactor Risk Reference Document.......... D-3 E.1 Membership of Special Committee to Review the Severe Accident Risks Report. . . . . . . E-2 E.2 Membership of American Nuclear Society Special Committee on NUREG-1150. . . . . . . E-2 vi OAGI0000611 00607

APPENDIX D RESPONSES TO COMMENTS ON FIRST DRAFT OF NUREG-1150 OAGI0000611 00608

CONTENTS Page D.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . D-1 D.2 Objectives and Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4 D.2.1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4 D.2.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5 D.3 Overall Methods......................................................... D-6 D.3.1 Uncertainty Analysis . . . . . . . . . . . . * . . . . . . . . . . . . . . . . . . . . . . . . . . ........ D-6 D.3.2 Expert Judgment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ........ D-8 D.3.3 Quality Assurance, Consistency, and State of the Art . . . . . . . . . . . . ........ D-9 D.3.4 Other Comments on Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ........ D-11 D.4 Tracing and Documenting Calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-13 D.4 .1 Tracing Calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-13 D.4.2 Completeness of Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-13 D.4.3 Display of Results ...................................... *... . . . . . . . . . D-14 D.S Accident Frequency Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-14 D.5.1 Logic ................................ :. . . . . . . . . . . . . . . . . . . . . . . . . . D-14 D.5.2 Quantification ................... :. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-16 D. 6 Containment Loads and Structural Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-17 D.6.1 Accident Progression Event Tree: Logic................................ D-17 D.6.2 Containment Loading Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-18 D. 6. 3 Containment Structural Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-21 D. 7 Source Terms and Consequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-23 D.7 .1 Methods D-23 D.7.2 Supporting Data Base and Modeling Assumptions........................ D-25 D.7.3 Comparisons with Accident at Chemobyl............................... D-29 D.S Uses of NUREG-1150 As a Resource Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-30 D.8.1 Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... D-30 D.8.2 Cost/Benefit Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... D-31 D.8.3 Safety Goal Comparisons ................* . . . . . . . . . . . . . . . . . . . . . . . ..... D-32 D.8.4 Extrapolation of Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... D-32 REFERENCES FOR APPENDIX D............................................. D-33 D-iii OAGI0000611 00609

D.l Introduction*

The previous draft of NUREG-1150, "Reactor Risk Reference Document," was issued as a draft report for public comment in February 1987. At that time, a notice was published in the Federal Register announcing the availability of the report and requesting comment (Ref. D.1). Distribution was made to approximately 850 people or organizations in the United States and abroad.

To assist readers of the document, a 2-day seminar was held in April1987 on the methods used in the risk analyses of draft NUREG-115 0. A notice of this seminar was sent to all persons receiving the draft report and published in the Federal Register (Ref. 0.2). The seminar took place in Rockville, Maryland, and was attended by 173 people from various organizations, including Federal agencies, State agencies, utilities, architect/engineering firms, and consulting firms.

In response to the request for comments, the NRC staff received 55 letters from 45 authors totaling approximately 800 pages. The authors of these letters and their affiliations are listed in Table D.l. All letters received are available for inspection in the NRC Public Document Room.

In addition to these reviews and comments, draft NUREG-1150 was reviewed by three formal peer review committees. Two of these reviews were initiated by the NRC; the third review was initiated by the American Nuclear Society. Also, as part of the normal review process within the NRC, the staff discussed the methods and results of draft NUREG-1150 with the Advisory Committee on Reactor Safeguards on several occasions (Ref. D.3).

1. Review by Kouts Committee One of the major advances of the risk analyses discussed in draft NUREG-1150 was the performance of quantitative uncertainty analyses. The specific approach used to perform these uncertainty analyses was reviewed by a panel of five experts, chaired by Dr. Herbert Kouts of Brookhaven National Laboratory.

The members of this committee are listed in Table D.2. The committee performed its review from April to October of 1987. Its findings were published as Reference D.4 in December 1987.

2. Review by Kastenberg Committee The NRC invited Professor William Kastenberg, University of California at Los Angeles, to form and chair a committee to peer review the entire breadth of risk analyses, as documented in draft NUREG-1150 and supporting contractor reports. Lawrence Livermore National Laboratory was funded by NRC to provide technical and administrative support. The members of the committee, listed in Table D.3, were selected by Professor Kastenberg. The committee performed its review from June 1987 to March 1988, with its findings published as Reference D.S in May 1988.

3. Review by American Nuclear Society The American Nuclear Society (ANS) chartered a special committee chaired by Dr. Leo LeSage of Argonne National Laboratory to study and critique draft NUREG-1150. The members of this committee are listed in Table D.4. The committee started its work in the fall of 1987 and published its findings as Reference D.6 in April 1988.

4. Overview of Comments and Responses It is the nature of reviews of documents such as draft NUREG-115 0 that extensive comments are received and that most of the comments are critical. Before discussing the principal (negative) comments, it is worth describing the principal positive comments that were expressed in letters and committee reports:

• It is believed that the NUREG-1150 study is the first comprehensive treatment of both modeling and data uncertainty in risk. In prior PRAs, the accounting of uncertainty has been limited to data uncertainties.

• This appendix was published in the second draft ofNUREG-1150, reflecting comments on the first draft report (1987). It has not been modified for this (final) version of NUREG-1150 except for updating the reference list.

D-1 NUREG-1150 OAGI0000611 00610

Appendix D Table D.l Authors of public comment letters.

Abe, K. Japan Atomic Energy Research Institute, Japan Artigas, R. General Electric, San Jose, CA Booker, J. E. Gulf States Utilities Company, St. Francisville, LA Boyer, V. S. Philadelphia Electric Company, Philadelphia, PA Brons, J. C. New York Power Authority, White Plains, NY Butterfield, L. D. Commonwealth Edison, Chicago, IL Caisley, J. Organisation for Economic Co-operative Development/Nuclear Energy Agency (OECD/NEA), Paris, France Campbell, R. M. Massachusetts Voice of Energy, Boston, MA Chubb, Walston Murrysville, PA Cogne, F. Institut de Protection et de Surete Nucleaire, Commissariat a l'Energie Atomique, France Colvin, J. F. Nuclear Management and Resources Council, Washington, DC Cullingford, M. International Atomic Energy Agency, Vienna, Austria Edwards, D. W. Yankee Atomic Electric Company, Framingham, MA Gardner, R. Stone & Webster Engineering Corporation, Boston, MA Gridley, R. L. Tennessee Valley Authority, Chattanooga, TN Hayns, M. R. United Kingdom Atomic Energy Authority, Culcheth, United Kingdom Hiatt, S. L. Ohio Citizens for Responsible Energy, Inc., Mentor, OH Hintz, D. C. Wisconsin Public Service Corporation, Green Bay, WI Hobbins, R. R. Idaho Falls, ID Hockenbury, R. W. Rensselaer Polytechnic Institute, Troy, NY Hoegberg, L., et al. Swedish Nuclear Power Inspectorate, Sweden Janecek, R .. F. BWR Owners' Group, Chicago, IL Khobare, S. K. Bhabha Atomic Research Centre, Bombay, India Kingsley, 0. D., Jr. System Energy Resources, Inc., Jackson, MS Kowalski, S. J. Philadelphia Electric Company, Philadelphia, PA Kranzdorf, R. San Luis Obispo, CA Langley, J. R. Mark III Containment Hydrogen Control Owners' Group, St. Francisville, LA Lash, T. R. Illinois Department of Nuclear Safety, Springfield, IL Levenson, Milton Bechtel Western Power Corporation, San Francisco, CA Lewis, M. I. Philadelphia, PA Liu, K. C. Atomic Energy Council, Taipei, Taiwan McNeill, C. A., Jr. Public Service Electric and Gas Company, Hancocks Bridge, NJ Myers, R. Clean Air Council, Philadelphia, PA Newton, R. A. Westinghouse Owners' Group, Pittsburgh, PA Reiman, L. Finnish Centre for Radiation and Nuclear Safety, Finland Sholly, S. & Harding, J. San Jose, CA Soda, K. Japan Atomic Energy Research Institute, Japan Spangenberg, F. A., III Illinois Power Company, Clinton, IL Speelman, J. E. Netherlands Energy Research Foundation, Netherlands Stewart, W. L. Virginia Electric and Power Company, Richmond, VA Taylor, J. Electric Power Research Institute, Palo Alto, CA Tucker, H. B. Duke Power Corporation, Charlotte, NC Vaughan, J. Department of Energy, Washington, DC Warman, E. A. Stone & Webster Engineering Corporation. Boston, MA Zaffiro, C. Energia Nucleare e delle Energie Alternative, Rome, Italy NUREG-1150 D-2 OAGI0000611 00611

Appendix D Table D.2 Members of Kouts Committee.

Herbert Kouts, Chairman Brookhaven National Laboratory Allen Cornell Stanford University Reginald Farmer Consultant, United Kingdom Steven Hanauer Consultant, Technical Analysis, Inc.

Norman Rasmussen Massachusetts Institute of Technology Table D.3 Members of Kastenberg Committee.

William Kastenberg, Chairman University of California, Los Angeles George Apostolakis University of California, Los Angeles John Bickel Northeast Utilities Roger Blond Science Applications International, Inc.

Simon Board Central Electricity Generating Board, United Kingdom Michael Epstein Fauske and Associates, Inc.

Peter Hoffman National Nuclear Research Center, Federal Republic of Germany Frank King Ontario Hydro Company, Canada Simon Ostrach Case Western University John Reed Jack R. Benjamin and Associates, Inc.

Robert Ritzman Electric Power Research Institute John Stetkar Pickard, Lowe and Garrick, Inc.

Theofanis Theofanous University of California, Santa Barbara Raymond Viskanta Purdue University Table D.4 Members of ANS Special Committee on Reactor Risk Reference Document.

Leo LeSage, Chairman Argonne National Laboratory Edward Warman, Vice Chairman Stone and Webster Engineering Corporation Richard Anoba Carolina Power and Light Company Ronald Bayer Virginia Power Company R. Allan Brown Ontario Hydro, Canada James Carter III International Technology Corporation J. Peter Hosemann Paul Sherrer Institute, Switzerland W. Reed Johnson University of Virginia Walter Lowenstein Electric Power Research Institute Nicholas Tsoulfanidis University of Missouri Willem Vinck Consultant, Belgium

• The methods developed during the study are desirable because uncertainty can be quantified, the contribution of various sources of uncertainty can be determined, the net impact of hypothetical design changes can be assessed, and important technical issues can be identified.

• It is believed that the basic methods used to generate the risk distributions are sound.

• It is believed that important advances made in severe accident analysis since the last major risk study, the Reactor Safety Study (Ref. D. 7) done in 1975, are reflected.

D-3 NUREG-1150 OAGI0000611 00612

Appendix D

• The detailed models of events and phenomena that load a containment and the response of the containment structure using event trees place added emphasis on the importance of the containment function. This seems desirable.

• It is believed that a reasonable approach was used to represent the capacity of a containment with technical issues about the failure pressure, failure location, and failure size and including interde-pendencies among the various phenomena.

• Engineering judgment was used when data were unavailable. Gaps in th~ understanding of severe accident phenomena were represented with technical issues and used as a means of investigating various hypotheses of severe accidents. This is believed to be acceptable and may be the only way to advance a risk assessment.

• Past risk assessments were reviewed to identify previously uncovered subtle interactions among components with formal investigations thereafter. This is a desirable practice because it takes advantage of previous work.

Most of the critical comments on draft NUREG-1150 were on four broad subjects. Some of them were attributable to technical deficiencies in the risk analyses while others were related to inadequate documentation. The four major areas of concern pertained to: (1) methods that were considered to be inadequate for obtaining and using expert judgments; (2) information that was considered to be outdated; (3) calculations that were considered to be inscrutable; and (4) results that were considered to be improperly presented or displayed. These areas are discussed in Sections 0.3.2, D.3.3, D.4.1, and D.4.3 below.

It should be noted that some comments addressed potential new and long-term research programs, especially in the area of severe accident phenomenology. Such comments are not discussed here.

In the following sections, the comments received on draft NUREG-1150 have been grouped into seven major topics: (1) objectives and scope; (2) overall methods; (3) tracing and documenting calculations;

( 4) accident frequency analysis; (5) containment loads and structural response; (6) source terms and consequences; and (7) regulatory uses of NUREG-1150. With the large number of comments received in each of these areas, it was not possible to list and respond to individual comments. As such, individual comments on similar subjects have been paraphrased and responses then made to these paraphrased comments.

D.2 Objectives and Scope 0.2.1 Objectives Comment: Clear objectives should be established and explained for NUREG-1150, and the report should be focused on those objectives.

Response

The objectives of NUREG-1150 have been reviewed and clarified in response to comments on the draft report. These objectives are outlined in Chapter 1 of this report; they are:

• To provide a current assessment of the severe accident risks of five nuclear power plants of different design, which:

Provides a snapshot of risks reflecting plant design and operational characteristics, related failure data, and severe accident phenomenological information available as of March 1988; Updates the estimates of NRC's 1975 risk assessment, the Reactor Safety Study; Includes quantitative estimates of risk uncertainty in response to a principal criticism of the Reactor Safety Study; and NUREG-1150 D-4 OAGI0000611 00613

Identifies plant-specific risk vulnerabilities for the five studied plants, supporting the development of the NRC's individual plant examination (IPE) process;

• To summarize the perspectives gained in performing these risk analyses, with respect to:

Issues significant to severe accident frequencies, containment performance, and risks; Risk significant uncertainties that may merit further research; Comparisons with NRC's safety goals; and The potential benefits of a severe accident management program in reducing accident frequencies; and

• To provide a set of PRA models and results that can support the ongoing prioritization of potential safety issues and related research.

Comment: The manner in which the results of NUREG-1150 are to be used in the regulatory process should be discussed.

Response

Since the publication of draft NUREG-1150, the NRC staff has developed an integration plan for regulatory closure of severe accident issues (Ref. D.8). In this plan, the role of NUREG-1150 is described as one of the principal supporting resource documents to this regulatory closure process. Further discussion of the uses of NUREG-1150 is provided in Chapter 13 of NUREG-1150.

D.2.2 Scope Comment: The scope of NUREG-1150 is narrowly defined, making the risk study incomplete. Many types of accident initiators are unaccounted for, including earthquakes, floods, and other external events; reactor coolant pump seal failure; steam generator tube ruptures; and instrument air losses. Other phases of plant operation need to be considered in addition to normal full-power operation, including power ascension and descension; shutdown; and operation with Mark I containment buildings de-inerted.

Accidents in spent fuel pools should be taken into account.

Response

The scope of the current version of NUREG-1150 has been expanded to reflect comments made on the draft report. An improved reactor coolant pump seal LOCA model has been developed, and steam generator tube ruptures have been explicitly considered. As in the draft report, the effect of failures in supporting systems (ac and de power, instrument air, auxiliary cooling water systems) has been included in the system fault trees. In addition, external events have been included in the analyses for two of the plants (Surry and Peach Bottom) to determine the core damage frequency and containment performance associated with a range of external initiators. The NRC staff intends to evaluate the significance of external events at the remaining plants in a later study, currently scheduled for completion in FY 1990.

With these changes, the staff believes that NUREG-1150 presents an adequate representation of the risk associated with the five plants analyzed, subject to the constraints established by tl)e state of the art of probabilistic risk analysis.

To confirm that the scope is appropriate, the NRC is initiating a separate study of the risk associated with low power and shutdown conditions for two of the plants studied in NUREG-115 0. The results are expected to be available in FY 1990. The risk associated with spent fuel pool accidents is being assessed separately in studies responding to NRC's Generic Issue 82, "Beyond Design Bases Accidents in Spent Fuel Pools." When completed, these will be examined to determine if further efforts are advisable.

Because of the small fraction of time that the BWR Mark I containment is de-inerted during startup and the approach to shutdown conditions, compared to the length of the operating cycle, and the small D-5 NUREG-1150 OAGI0000611 00614

Appendix D frequency of accidents occurring in these times, the NRC does not intend to further study the risk implications associated with de-inerting.

Comment: NUREG-1150 should take credit for accident management strategies to reduce the likelihood of a core damage accident or to mitigate its consequences.

Response

Both the draft and present versions of NUREG-1150 explicitly consider the effects of plant operational procedures to provide water and cooling to a reactor core to prevent its damage. Procedures for performing such actions are obtained from the specific plant under study. These are reviewed ~o assess the probabilities of successful use in associated accident scenarios. These probabilities are then incorporated into the accident frequency analyses for that plant.

The present version of NUREG-1150 also incorporates the effects of plant operational procedures on mitigating the consequences of core damage accidents. Procedures in place at the individual plants were used to assess the probability of successful operator action.

Comment: Accident sequences with frequencies below lE-7 per year have not been considered. Events at 1E-8 or 1E-9 per year might be significant, either individually under particular conditions or cumulatively when many such sequences are excluded.

Response

Given a set of initiating events, event tree/fault tree analysis like that performed for NUREG-1150 permits the examination of logical accident sequences. The trees were quantified by calculating each branch to its end; when a branch frequency fell below a cutoff frequency, it, and hence the accident sequences it represents, were excluded from the analysis. The cutoff frequency used in the present version of NUREG-1150 is lE-8 per year for internally initiated events, which is sufficiently low to retain more than 9 5 percent of the accident sequences contributing to the core damage frequency. However, in several instances accident sequences with a frequency below these levels were explicitly included to ensure adequate representation of a wide spectrum of accidents.

D.3 Overall Methods D.3.1 Uncertainty Analysis Comment: The treatment of uncertainty is questionable and inherently biased. The large uncertainty bands and high risk estimates may result from the methods used; uncertainty in variables may have been combined without compensating to prevent many variables from realizing worst case values. Other methods exist for quantifying uncertainty, such as the Optimistic/Central/Pessimistic (OCP) method and sensitivity studies.

Response

The Latin hypercube sampling (LHS) method used in NUREG.,.-1150 is a form of Monte Carlo sampling, an algorithm for sampling from individual parameter distributions and, based on the risk model, combining these individual distributions into a single distribution. More generally, such sampling is known as mathematical experimentation and is used in other disciplines (Ref. D.9). This mathematical experimentation is used to propagate uncertainty through large mathematical functions that preclude propagating uncertainty analytically. The validity of the results is dependent upon the validity of the assumptions made about the distributions of the variables. The displays of risk may give the impression that the risk estimates are rigorous classical statistics but they must be taken in context, realizing the strengths and the weaknesses of the methods used to compute the estimates and the underlying data base.

LHS was favored over the OCP approach on the basis of theoretical grounds and the potential of each method. Probabilistic techniques constitute a theoretically sound and standard technique for combining NUREG-1150 D-6 OAGI0000611 00615

Appendix D uncertainties; the LHS framework contains a basis for implementing such a technique. In contrast, the OCP framework requires that a series of pessimistic or optimistic assumptions be combined without quantifying the likelihood that the combination of assumptions could arise.

The LHS algorithm for generating Monte Carlo samples is one that has undergone extensive review in the open literature and is used both in the United States and abroad. The estimators of LHS are unbiased when the variables are uncorrelated. Bias may occur when the variables are correlated, but this is a characteristic of Monte Carlo sampling in general and not a characteristic of LHS.

Some specific aspects of the use of LHS in draft NUREG-1150 had the potential to introduce bias. In the draft report, the uncertainty in individual parameters was represented in a discrete manner. Because such use may cause bias, the discrete parameters were replaced with continuous parameters for the present version of NUREG-1150. Because the methods used to obtain expert judgments and to formulate distributions based on the judgments can introduce bias, formal methods designed to minimize bias were used in the present risk analyses. This is discussed in greater detail in Section D.3.2.

As noted in the Introduction, the treatment of uncertainty in draft NUREG-115 0 was reviewed by a peer committee; their findings are published as Reference D.4, and all their major comments have been incorporated in the present analyses.

Comment: The conclusion that the uncertainties have increased over a dozen years of research does not seem correct. NUREG-1150 does not portray the progress made in hardware modifications, operator experience, and research since the publication of the Reactor Safety Study (Ref. D. 7) in 1975.

Furthermore, the conclusions in draft NUREG-1150 are similar to those of the Reactor Safety Study, meaning that draft NUREG-1150 is inconsistent with almost every study published in the 1980's, all of which show a trend of lower estimates of risk. After a decade of severe accident research, it is unsettling to see risk results spread over several orders of magnitude.

Response

It is clear that the technical information base on the frequencies and consequences of severe reactor accidents is substantially better now than in 1975 when the Reactor Safety Study (Ref. D.7) provided its analysis of risk and the uncertainty in risk.

In the Reactor Safety Study, the rigorous quantification of uncertainty was performed only for uncertain-ties in component failure rates. The overall uncertainties shown in consequences were developed by subjective judgments at a very coarse level. The peer review of the final version of the Reactor Safety Study, known as the "Lewis Report" (Ref. D.10), concluded that these uncertainty estimates were significantly underestimated.

The subjective uncertainty estimates developed and used in NUREG-1150 address uncertainties at a rigorous level and make extensive use of experimental and calculated results developed since 1975. Both the level and the basis improve the realism of the uncertainty analysis. These improvements are a direct result of an improved knowledge base (including the effects of phenomena not known in 1975) that permits a more accurate treatment and .characterization of unknown parameters and modeling of physical

.processes. The large uncertainties simply reflect the state of knowledge in the severe accident area.

Comment: Uncertainty in offsite consequences was not factored into the risk estimates. This leads to misleading risk estimates.

Response

With the exception of the variability of site meteorology, uncertainties in the consequence analysis have not been included in either the draft or present version of NUREG-1150 because of time constraints. The NRC staff recognizes that there are significant uncertainties in the consequence estimates due to uncertainties in modeling and in input data. Best estimate values of the model parameters for natural processes (plume behavior, deposition, etc.) have been used in Version 1.5 of the MACCS code D-7 NUREG-1150 OAGI0000611 00616

Appendix D (Ref. D.11) for the current NUREG-1150 analysis. While the lack of accounting of consequence uncertainties can have an influence on overall risk results, it does not prevent the development of important perspectives on plant design and operation.

Some of the key parameters in the uncertainty of offsite consequence analyses relate to post-accident protective actions (e.g.,. emergency response and long-term countermeasures). That is, offsite conse-quences can be affected by the effectiveness of emergency response of the local population and by the radioactive contamination levels above which crops and land are removed (condemned) from public use.

The sensitivity of consequences and risks to the protective actions is discussed in Volume 1 of NUREG-1150 and in References D.12 through 0.16.

In addition to the risk studies of the five plants discussed in this report, the NRC staff is supporting the risk analysis of the LaSalle plant, a BWR-5, Mark II plant. It is planned that this risk analysis will include an analysis of the uncertainties in offsite consequences and the effect on risk estimates. This work is scheduled for completion in mid-FY 1990.

D.3.2 Expert Judgment Comment: The protocol for obtaining expert judgment is not rigorous and yielded judgments with unsound bases. Technical subject areas should be kept separate, and experts should work within those areas (i.e., within their field of expertise). Panels should be composed of experts from all portions of the nuclear industry. The experts should be given a less restricted role in selecting and identifying uncertainty issues. Expert groups should interact to ensure that consistency is maintained throughout the analysis.

Response

The protocol used to elicit and to aggregate expert judgment has been substantially improved for the present version of NUREG-1150 and is discussed in Section 7 of Appendix A. Standard and rigorous techniques were used; among the developers and the reviewers of the protocol were experts in diverse areas of uncertainty analysis and survey methods, including decision analysts, social psychologists, and statisticians from national laboratories, private companies, and universities. Seven groups of experts were established, each group working within a specific technical area. Each group included representatives from industry, academia, and the national laboratories.

For the current version of NUREG-1150, the experts were allowed to add issues to or delete issues from the list of issues presented to them. The context in which the issues entered the analyses was explained to the experts. The experts were encouraged to modify the statements of the issues to improve technical clarity and to define interdependencies among issues and between issues and other parameters in the analysis. The exchange of information between panels was effected primarily by the project analysis staff.

The information exchanged concerned requirements for specific phenomenological information about an earlier phase of a postulated accident sequence that was needed to answer a question about a later phase of the accident.

Comment: Expert judgments are requested for inappropriate portions of the risk analyses. When adequate data exist to define uncertainty, expert judgment should not be used as a substitute. When little*

or no data exist, experts should not be asked to guess at distributions; instead, the particular uncertainty variable should not be included in the uncertainty analysis. No attempt should be made to quantify technical issues with expert judgments unless there is an adequate basis for that judgment.

Response

For the present version of NUREG-1150, expert judgments were not used when available data were adequate to provide the required information. In some cases, such data became available during expert panel meetings, and issues were dropped from consideration by the panels.

While it is inappropriate to ask experts to simply guess at issue distributions, it is also inappropriate to exclude issues from consideration because of the scarcity of relevant data. Potentially important issues NUREG-1150 D-8 OAGI0000611 00617

Appendix D should be considered, even if the data are scarce and the basis for engineering judgment is very limited, because it is often the paucity of data that renders an issue an important contributor to uncertainty.

In technical areas where significant data .existed, expert judgment still played an important role in ascertaining the relevance of the data to a particular application in the risk analysis. As an example, large uncertainties inherent in the models of containment performance precluded an accurate prediction of the location of failure under specific accident loadings. Various calculations of containment response were sometimes found to be conflicting, even when similar analytical methods were used. In 1987, at the Sandia National Laboratories, a scale model of a concrete containment was tested under conditions simulating a slow pressurization from steam and noncondensible gas generation from a severe accident (Ref. D .17). Organizations from the United States and abroad tried to predict the failure location and pressure. Only one of these predictions was close to the test results. For the purposes of NUREG-1150, the available data on both the experimental result and the reasons why calculated results differed were key to the assessment.

Comment: When distributions were assigned to variables, often high weights were assigned to the extremes of these distributions. This is unusual and should be justified. Integrated analyses based on models benchmarked against data would show that extremes could not be realized.

Response

Documentation of the rationale for uncertainty distribution development, including the results of relevant code calculations and experimental results, was an important step in the elicitation process used in this report. This documentation is provided as Reference D.18. If high weights were assigned to the extremes of the distributions, then the associated documentation should provide the rationale. Discrete distributions were *replaced with continuous distributions to permit a better characterization of the uncertainties, particularly in the tails of the distributions.

D.3.3 Quality Assurance, Consistency, and State of the Art Comment: A thorough review of the draft NUREG-1150 study is needed. The study does not appear to have been checked for inconsistent and meaningless results because some of the results are questionable or contradict results reported elsewhere in the same documents. The computer codes used in the risk analyses should be properly validated, documented, and peer reviewed, which also appears not to have been done.

Response

The review of NUREG-1150 has been performed at two levels: an external level, including peer review and public comment on the draft report; and an internal review by the various organizations involved in the plant risk analyses. For the specific issues identified in this comment, internal review processes were used to ensure consistency and validity. This internal review had the following elements:

• QA/QC Review of Principal Analysis Areas: For each major area of analysis performed for the present version of NUREG-1150 (accident frequency, containment performance and source terms, offsite consequences), a QA team was established and the analyses were reviewed. This process for the accident frequency analysis is documented in References D.19 through D.23. Approximately 25 percent of the resources were spent on reviewing the work. The method was initially reviewed by a Senior Consultant Group, and then more detailed reviews were conducted by a Quality Control Team. These latter reviews occurred periodically over more than 2 years. In addition to the reviews that NRC and its contractors sponsored, the utilities involved have performed reviews and provided extensive comments that have been incorporated, as. appropriate, into the analyses. This formal review process continued throughout the reanalysis effort. The modeling of core melting phenomena, source terms, and consequences as well as the risk analysis in the current version of NUREG-1150 were subject to a quality assurance review that is discussed in Appendix A to NUREG-1150.

• Review of Computer Models: A large number of computer codes were used in the performance of the risk studies described in this report. A number of them have been reviewed or benchmarked in D-9 NUREG-1150 OAGI0000611 00618

Appendix D other contexts and will not be discussed in detail here. These include: Source Term Code Package (Ref. D.24); CONTAIN (Ref. D.25); MELCOR (Ref. D.26); and MELPROG (Ref. D.27). Other codes were, however, developed or first used for this study. For such codes, various types of quality assurance checks were specifically performed as part of the NUREG-1150 study. The LHS code was reviewed in 1984; a user's manual was written (Ref. D.28) and the code.has been released to the National Energy Software Center at Argonne National Laboratory. LHS has been in use at Sandia National Laboratories for several years. Since the draft analyses, the EVNTRE and PSTEVNT codes (Ref. 0.29) were subject to line-by-line scrutiny and a series of functional tests. User's manuals were written for these codes, and the codes are being released to the National Energy Software Center.

The XSOR codes were subject to a line-by-line review by project staff at the Sandia National Laboratories (SNL) and to an independent validation/verification study done at the Battelle Columbus Division and reported as Reference D.30. The PARTITION code (Ref. D.31) was subject to a functional review by the project staff. Its user's manual will be published in 1989. The RISQUE code was functionally reviewed by the SNL staff and elsewhere (Ref. D.29); a list of this code is included as an appendix to Reference D.32. Benchmarking and verification of the current version of the MACCS code, Version 1.5, is now under way. A review has been performed of the chronic exposure pathway modeling (Ref. D.33).

• Cross-Plant Reviews: 'For the accident progression, source term, and consequence modeling, general consistency in phenomenological assumptions and the level of treatment of severe accident phenomena was achieved across the five-plant analyses. This was accomplished primarily through a series of informal interactions among plant analysts and review of the treatment of specific phenomena by the project leader. For example, the Surry accident progression event tree (APET) was used as a base to build the Zion and Sequoyah APETs. The Grand Gulf and Peach Bottom analysts worked jointly to adapt parts of the Grand Gulf APET to Peach Bottom. The treatment of hydrogen (important to the Sequoyah and Grand Gulf analyses) was derived jointly by the Sequoyah and Grand Gulf analysts.

• Utility Reviews: An important element of a risk study of a nuclear power plant is the assurance that the risk model is an accurate and up-to-date representation of that plant. For the four plants in this study for which an essentially new risk analysis was performed (Surry, Sequoyah, Peach Bottom, and Grand Gulf), contact with the appropriate utility was maintained throughout the conduct of the study.

For the Zion plant, where the accident frequency analysis was a modification of an existing PRA (Ref. D.34), the analysts met with the utility to discuss plant design and operational changes that had occurred since the performance of that PRA.

The present version of NUREG-1150 will undergo a multifaceted review in the near future. This will be a critical review of all important aspects of the document through a formal peer review, university research, professional society discussions, and a public workshop. The emphasis in these forums will be on the responsiveness of the present version of NUREG-1150 to comments on the draft report as well as on how the technology for assessing risk can be improved.

Comment: The analyses of draft NUREG-115 0 are not state of the art. The most advanced theoretical and analytical techniques are not always used. Some data are even outdated while other data are ignored or are inappropriately applied.

Response

A discussion of the methods that were used in the current version of NUREG-1150 is provided in Appendix A. The broad diversity of experts who interpreted published data for the current analyses ensured that the data were up to date and correctly applied. These data reflect the design and operational status of the five plants as of March 1988.

Comment: There must be a consistent and distinct use of terms such as randomness and uncertainty, frequency and probability. In the draft NUREG-1150 report, terminology is sometimes used loosely.

NUREG-1150 D-10 OAGI0000611 00619

Appendix D

Response

The consistency of terminology used in the present version of NUREG-1150 has been improved.

Comment: There is a general disregard for technical rigor in the draft NUREG-1150 risk analyses.

Response

It appears that such a general conclusion was reached based on specific deficiencies in the draft risk analyses, including the process for obtaining expert judgments, the apparent lack of quality assurance reviews, the use of unreviewed and undocumented computer codes, and the reliance on severe accident information from NRC contractors to a greater extent than on that from other sources. Each of these specific issues is discussed elsewhere in this appendix. The NRC staff and its contractors believe that the present version of NUREG-1150 is based on analyses with appropriate technical rigor.

D.3.4 Other Comments on Methods Comment: The NUREG-1150 results do not appear to be reproducible. It appears that the results seem dependent on the particular experts whose judgments were factored into the analyses. A different selection of experts would make different judgments that would lead to different risk estimates. This point goes beyond just the subjective judgment of experts and extends into the analytical techniques. If another random number generator were to be used in the sampling scheme for generating uncertainty estimates, different uncertainty bands and hence risk estimates would result.

Response

The selection of experts will have an effect on the results of the risk analyses discussed in this report, as well as in any other circumstance where expert judgment is used. However, given the necessity of using expert judgment, the formal 'procedures used for the present version of NUREG-1150 offer the following advantages: the expert panels are established using experts from a wide spectrum of interests, minimizing the potential impact of any one group; the use of judgments is explicitly acknowledged; and the rationales underlying judgments are documented.

With any analysis involving a Monte Carlo process, it is inevitable that the results will vary somewhat, depending on the details of the sampling algorithm and the way it is implemented. The variability associated with the sampling process has been investigated as part of the analysis process and found to be small (Ref. 0.32). As discussed in Chapter 2, the reader should recognize that the estimated mean values can vary by no more than a factor of two, depending on the Monte Carlo sample that is used. This variability can also impact the relative contribution of factors (e.g., plant damage state frequencies) to the

• mean, particularly when there are a small number of contributors.

Comment: The methods used to calculate risk are complex and subjective, which is in part because of the performance of uncertainty analysis. The risk-dominant issues should be quantitatively defined with detailed calculations or experimental evidence.

Response

The present version of NUREG-1150 has made extensive use of mechanistic computer code calculations and pertinent experimental results a'vailable from both NRC-sponsored research and that sponsored by the nuclear industry. However, the spectrum of accident conditions is wide, precluding mechanistic calcula-tions for all conditions. For potentially important uncertainty issues, such as containment loadS at vessel breach, expert judgment was obtained for a variety of generalized conditions such as vessel breach at high pressure, intermediate pressure, or low pressure, with a flooded reactor cavity or a dry reactor cavity.

Typically, the experts could base their judgments on the results of mechanistic code calculations or experiments of only some of these conditions. Parametric codes were used to predict the source terms for a wide range of sequence variations.

Comment: The practice of evaluating complex physical and chemical phenomena in nuclear reactor accidents is not well conceived. This evaluation should be done using such classical methods as scaling analysis, zeroth order estimates, and ideal model simulations.

D-11 NUREG-1150 OAGI0000611 00620

Appendix D

Response

Subsequent to the accident at Three Mile Island on March 28, 1979, the NRC undertook a major research effort to develop an improved understanding of severe accident behavior (Ref. D.35). The focus of this effort has been the development and validation of computer codes that estimate the variety of complex processes that can occur in a severe accident. A two-tiered approach to code development has been followed. At one level, detailed mechanistic codes have been developed that analyze a specific aspect of severe accident behavior, such as the use of the CORCON code to analyze the attack of concrete by hot core debris. The second level involves the development of codes that treat all aspects of a severe accident but in less phenomenological detail. Both of NRC's codes of this type, the Source Term Code Package and MELCOR, were used in the source term estimation in this risk study. In the current version of this study, greater use was made of the detailed mechanistic codes than in the draft report. The general approach to the development of the suite of NRC severe accident codes has been reviewed previously by a number of peer committees and is responsive to the recommendations of the review by the American Physical Society (Ref. D.36). These codes are supported by a range of experiments to obtain fundamental data, separate effects, and integral confirmation.

Comment: Various aspects of the draft risk studies lack consistency within each risk study and among the risk studies leading to an unevenness in the overall approach. The level of detail of modeling in each analysis varies, lacking in some portions and extremely detailed in others. A given technical issue is treated differently at different plants. The analysis of the Zion plant is less detailed than the analysis of the other plants.

Response

With the exception of the Zion accident frequency analysis, the NUREG-1150 methods have been applied consistently for all five plants. Within a specific plant analysis, issues were treated at varying levels of detail, with additional consideration given to potentially more important issues. This is not an unusual*

practice in PRAs. Issues common to more than one plant were analyzed using the same methods for each plant. However, the resulting outcome (e.g., the impact on core damage frequency) can vary among plants because of plant design and operational differences.

The Zion accident frequency analysis was indeed different from that performed for the other four plants.

This difference is a result of the availability of a relatively recent PRA performed for the utility (Ref.

0.34) and extensively reviewed by the NRC staff and its contractors (Ref. D.37). For the present version of NUREG-1150, this PRA (as reviewed) was updated to reflect plant design and operational characteris-tics as of March 1988. The accident frequency analysis methods in NUREG-1150 used for the Zion plant are discussed in Appendix A, Section A.2.2, to this report.

Comment: Because many aspects of severe accidents cannot be quantified, assumptions are made about the aspects to account for them in the risk calculations. Too often such assumptions lack a firm basis.

Furthermore, a given assumption varies from one plant to the next. The assumptions are made conservatively to ensure safety but in doing so make the risk estimates unrealistic. An example is the short battery life assumed in station blackout sequences.

Response

Efforts were made to make reasonable assumptions in all parts of both the previous draft and *the present version of the NUREG-1150 analyses; the bases for the assumptions have been thoroughly documented in the present version of NUREG-1150.

In the analysis of Peach Bottom for draft NUREG-1150, the batteries were assumed to be depleted in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> during a station blackout. The assumption was based on information from the Philadelphia Electric Company (PECo), the utility operating that plant. After additional review by PECo and accounting for operator actions for load shedding, the assumption was changed for the present version of NUREG-1150 to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The Grand Gulf analysis also assumed a 12-hour battery life.

NUREG-1150 D-12 OAGI0000611 00621

Appendix D Comment: There is a tendency to overemphasize the numerical aspects of probabilistic risk assessment.

While the quantitative aspects are important, it is also important as a structured and comprehensive framework for safety analyses.

Response

The intended uses of NUREG-1150 are discussed in detail in Chapter 13, "NUREG-1150 As a Resource Document." These uses do not focus on the bottom-line quantitative results but on the perspectives gained from the development and application of the complex logic models used to calculate the risk estimates.

D.4 Tracing and Documenting Calculations D.4.1 Tracing Calculations Comment: The document is inscrutable. It is nearly impossible to follow the development of the results through the calculations. Intermediate results at key points in the calculations would have been useful in understanding the risk estimates. Some conclusions are unsubstantiated and cannot be traced back to their supporting calculations. Although technical issues are delineated, how they affect the results is not discernible.

Response

The present version of NUREG-1150 has been extensively restructured, relative to the draft report, to improve its clarity. In particular, the report has been more explicitly described as a summary report, written for people not expert in PRA and, as appropriate, directing the reader to sections of the supporting contractor reports for additional detail.

The risk calculations are very complicated, requiring extensive computer calculations to perform the analyses. Documentation of these analyses is found in supporting contractor reports; this documentation has been restructured to improve the traceability of the work and to expand the discussion of the underlying rationale. An example calculation has been developed for the reader seeking details of the risk analyses, with a description provided of both the individual steps of the risk analysis process and the products of the individual steps. The example calculation is provided in Appendix B.

Comment: Because the sequences are grouped into plant damage states, there is difficulty in connecting what follows core damage with containment failure. This could lead to gaps in the development of specific scenarios and detract from those situations where accident management could be effective.

Response

PRAs such as those conducted in support of NUREG-1150 consider hundreds of thousands of distinct failure combinations leading to severe accident sequences. It is a practical necessity that grouping of these sequences be performed. Plant damage states have been used in many recent PRAs to accomplish such a grouping.

D.4.2 Completeness of Documentation Comment: NUREG-1150 represents a large amount of information but many topics are insufficiently discussed, such as descriptions of models, treatment of processes of a severe accident, underlying assumptions, and uses of the risk estimates. The expert judgments and the methods used to obtain those judgments must be fully documented; each judgment should be attributed to the particular expert who gave it, together with the basis and the reasoning for the judgment.

Response

NUREG-1150 is a summary of large and complex risk studies of five nuclear power plants. All aspects of the study cannot be conveyed in such a summary report. The methods used, supporting rationale, and D-13 NUREG-1150 OAGI0000611 00622

Appendix 0 results are discussed in detail in the set of supporting documents (Refs. 0.12 through 0.16, D.19 through 0.23, 0.32, 0.38, and D.39). Other supporting information, such as on the principal accident analysis codes used in the study, is described in other available documents.

As discussed in Section 0.3.2, the process of obtaining and using expert judgments has been substantially improved for the present version of NUREG-1150. Extensive documentation of the bases for these judgments is a major aspect of the new elicitation process. This documentation is provided in References 0.18 and 0.39.

D.4.3 Display of Results Comment: Traditional methods of displaying uncertainty, such as cumulative distribution *functions, probability density distributions, best estimates, and central estimates should be provided. The presenta-tion of ranges alone without means or other best estimates tends, as in draft NUREG-1150, to focus excessive attention on the extremes and obscures the advances made in nuclear safety since the Reactor Safety Study.

Response

The present version of NUREG-1150 uses traditional displays of uncertainty. These displays include probability density functions (approximated by histograms) with mean, median, and 5th and 95th percentile values shown. Complementary cumulative distribution functions are used to convey results of source term and offsite consequence results. Other displays, such as bar charts and pie charts, are used to convey supplemental information.

D .5 Accident Frequency Analysis D.S.l Logic Comment: No thermal-hydraulic analyses were done to define what constitutes a successful operation of a given system. Instead, success and failure were defined from previous studies on other plants.

Response

Numerous thermal-hydraulic studies were available from which conclusions could be drawn relative to safety systems performance under a range of plant conditions. In addition, information was obtained from knowledgeable personnel at the plant sites to better understand system responses under abnormal conditions and some plant-specific thermal-hydraulic calculations (Refs. D.20 and 0.22) using the MELCOR (Ref. D.11) and the LTAS (Ref. 0.40) codes. The combination of general analyses and plant-specific information is believed to be adequate to define success criteria.

Comment: Support systems and the activation and control of various systems by other systems were not taken into account in the accident frequency analysis.

Response

Support systems and their impact on emergency core cooling, containment safeguard systems, and other front-line systems were explicitly considered in both the draft and the present version of NUREG-1150.

Detailed system-by-system analyses were performed to determine the potential impact of support systems.

Those dependencies that were critical to the functioning of a system were then included in the models.

Actuation and control dependencies between systems were taken into account, although a detailed study of each actuating and control device was not performed. Instead, these dependencies were represented with generic failure rates with significant uncertainty bounds. This approach is considered adequate because such failures have not been found important in reviewing the results of other PRAs.

Comment: Prior PRAs, from which much information was derived, were used even though many changes in plant hardware and operation have occurred since the PRAs were performed that are not reflected by these PRAs.

NUREG-1150 D-14 OAGI0000611 00623

Appendix D

Response

Prior PRAs provided a basis from which to start the risk studies. Plant design and operational information, obtained from the individual utilities, was obtained and used to perform the actual risk studies.

Comment: The mathematical treatment of common-cause failure (CCF) is more consistent and detailed than in many previous studies. Nonetheless, the importance of CCF dictates that a more comprehensive and quantitative treatment of the factors affecting it be undertaken. The CCF modeling should be improved as several examples illustrate: For a station blackout, the notion of a CCF of the batteries is difficult to accept because the batteries are monitored, are in use, and are checked daily; for a loss of component cooling water (CCW), the CCF of the CCW pumps is difficult to accept because some pumps are nomially operating while others are kept in a standby mode; the fuel supply to diesel generators is not mentioned as a potential CCF, etc. In PRAs, CCF must be modeled realistically.

Response

The NUREG-1150 study treated common-cause failure in as realistic a way as presently possible. The objective was to estimate risk using the best available information and tools given the limitations of available data.

The analyses reported in the supporting documentation had the following characteristics with respect to CCF:

• System interdependencies were modeled in the fault tree analysis and common-mode failures were included as appropriate.

• Common-mode failures of pumps, valves, batteries, diesel generators, and other hardware were explicitly considered.

• To the extent possible, the current analyses used plant-specific data. However, where the plant-spe-cific information was inadequate to generate new CCF models, such failures were treated with realistic generic models, including recent advances in the methods for creating such models.

• Common-cause failures induced by earthquakes were considered when two plants were analyzed; the external-event analysis examined other potential sources of common-mode failures such as fire.

Nevertheless, it is recognized that there are a number of things that are not done in these analyses. These excluded activities were:

• Unique CCFs that might be postulated as a result of faulty construction or counterfeit parts are not modeled, except as they may appear in the common-cause failure data base.

• Detailed examination of the root causes for CCFs was not made.

• The CCF analysis inherently lacks reliable and identifiable data. Under these circumstances, it is often necessary to rely heavily upon engineering judgment, leading to the possibility for disagree-ments about the outcomes.

While present CCF models are believed to be reasonable, it is also clear that improvements can be made.

To this end, the NRC has ongoing programs for developing improved models for CCF analysis.

Comment: Inappropriate application of models of human reliability focused on procedural errors and resulted in low human error contributions to core melt frequency.

Response

Human error contributed less to the core melt frequency than expected, but, in most cases, there are reasons for the lower values. These include:

D-15 NUREG-1150 OAGI0000611 00624

Appendix D

• The low probabilities due to human errors were not necessarily a consequence of a simple analysis.

For example, low human error probabilities were produced for the BWR ATWS sequence using an extremely detailed human reliability analysis (Ref. D.41).

• Some small values reflect the availability (at the plant) and consideration (in the analysis) of symptom-based procedures. With such procedures, an operator responds to an accident treating conditions that are indicated on the control panel, such as ensuring that the reactor is tripped, the turbine is tripped, the vital electrical buses are energized, and so on. These conditions are treated without recognizing the sequence. The use of such procedures improves the performance of the operators and likewise reduces human error values.

• In some circumstances, low operator error values are the result of the combination of probabilities for several independent actions. When such circumstances occurred, additional checks were performed to ensure the reasonableness of the results obtained. In the current analyses, all combinations of human errors less than lE-4 required additional analysis and justification; few of these cases occurred.

D.5.2 Quantification Comment: Generic failure data are used in the risk studies, yet each study is claimed to be plant specific.

Furthermore, generic data are sometimes used even when plant-specific data are available.

Response

Plant-specific information has been obtained (where available) and used for key systems in each plant.

Where such information is inadequate for these key systems and for less important systems, generic data have been employed. As a result there is a mix of information sources underlying the analysis. This is discussed in more detail in Section A.2.1 of Appendix A.

Comment: Calculations by the industry indicate that it is important to thoroughly examine the probability that the automatic depressurization system (ADS) in boiling water reactors would not fail when it is assumed that de power fails.

Response

Analysis performed for the boiling water reactors indicated that the ADS is dependent upon de power in that both the logic for control and the valve power come from de sources. The logic system is failed if the primary de supply bus and the switching relay to the backup bus are lost. Two de buses would have to fail to lose all valve power. Given this dependency, the expected life of batteries in station blackout conditions was an important issue. In the analyses for draft NUREG-1150, effective battery life was estimated to be 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (in station blackout conditions) for the Peach Bottom plant. Based upon reviews and discussions with the Philadelphia Electric Company and accounting for operator load-shedding actions, this battery life was extended to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for the present risk analysis. A 12-hour battery life was also calculated for the Grand Gulf analysis.

Comment: Confidence limits on the success probabilities assigned to the fault trees appear to be derived from the high and low probabilities of operator action. This is not mathematically correct, and such limits should be viewed only as upper and lower bounds.

Response

Operator actions were treated the same as all other events in the fault trees. That is, the failure probability of each action was assigned a mean value and a probability distribution. The combination of individual event probabilities was then performed using mathematical sampling techniques, ensuring the appropriate mathematical treatment.

Comment: The analysis of a rupture of a steam generator tube is incorrect because the frequency of a credible tube rupture sequence is multiplied by the probability of auxiliary feedwater system failure, thus NUREG-1150 D-16 OAGI0000611 00625

Appendix D lowering the frequency of a legitimate core melt accident sequence by three to four orders of magnitude.

There is no reason to believe a value of 9E-9/reactor year when detailed plant-specific PRAs have consistently estimated the frequency in the range of 1.6E-6 to l.OE-5/reactor year.

Response

The analysis of steam generator tube rupture frequency and consequences has been substantially modified for the present version of NUREG-1150. Core damage frequencies obtained using the new analyses are consistent with the values cited above as results from other recent PRAs.

Comment: The models of core degradation are unrealistic. Severe fuel damage is defined to cover all cases where fuel cladding is damaged, but cladding integrity is not a measure of fuel damage and results in an overestimate of risk when it is defined as such.

Response

The models that are used to predict fuel damage do not attempt to describe all the complex phenomena associated with severe core degradation in detail. The thermal-hydraulic model in the Source Term Code Package (STCP) (Ref. D.24) uses simplified models and assumptions for the treatment of some of the very complex steps in the core degradation process, such as fuel slumping into the lower plenum of a reactor vessel. However, the current version of NUREG-1150 did not rely heavily on the thermal-hydrau-lic model in the STCP for the estimation of the core meltdown process. The results of analysis with the MELCOR code (Ref. D.26), the MELPROG code (Ref. D.27), and the MAAP code (Ref. D.42) assisted project analysts and other experts in estimating the magnitude of parameters directly associated with core melt progression, such as hydrogen production and the mode of reactor vessel failure. Although the MELCOR code and the MELPROG code predict some core meltdown processes in more detail than the models in the STCP, the simplifications in the models of these codes must also be recognized.

In the current version of NUREG-1150, core damage is defined as a significant core uncovery occurrence with reflooding of the core not imminently expected. The result is a prolonged uncovery of the core that leads to damaged fuel and an expected release of fission products from the fuel.

The current version of NUREG-1150 treats the recovery of core with fuel damage differently from earlier probabilistic risk analyses. Under a broad range of conditions, given that a water supply is recovered prior to vessel failure, the likelihood of recovering a core and arresting an accident was evaluated. Based largely on the experience of the accident at Three Mile Island Unit 2, debris bed coolability analyses, and supplemental calculations of head failure, the likelihood of arresting further core damage decreased as the fraction of the fuel relocated to the bottom head at the time of coolant recovery increased.

D.6 Containment Loads and Structural Response D.6.1 Accident Progression Event Tree: Logic Comment: The large amount of detail in the accident progression event trees (APETs) gives the impression that more is known about containment events and phenomena than is actually known. It is difficult to believe the results of a complex tree that yields a tremendous number of pathways that are then aggregated into a dozen or so groups. Not only does a complex tree give a false impression but it limits any review of how the tree was constructed.

Response

The rationale for developing a detailed APET is to provide an explicit treatment of all phenomena that can have a significant impact on the accident progression and. the magnitude of the fission product source terms. Even if the existing capability to predict some of these phenomena is limited, it is important that the phenomena be recognized, at least for characterizing the uncertainty in the results.

The size of an APET does not affect the clarity of the results. Pathways with similar characteristics can be grouped to form simpler event trees as has been done to present results in the current version of the main report.

D-17 NUREG-1150 OAGI0000611 00626