ML20199J204

a Review of the OCONEE-3 Probabilistic Risk Assessment Containment Performance,Radiological Source Terms and Risk Estimates

ML20199J204
Person / Time
Site:	Oconee
Issue date:	06/30/1986
From:	Ami Agrawal, Khatibrahbar, Park C, Pratt W BROOKHAVEN NATIONAL LABORATORY
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-A-3800 BNL-NUREG-51917, NUREG-CR-4374, NUREG-CR-4374-V03, NUREG-CR-4374-V3, NUDOCS 8607080211
Download: ML20199J204 (90)

Text

,,

/

1 NUREG/CR-4374 BNL-NUREG-51917 Vol. 3 A Review of the Oconee-3 Probabilistic Risk Assessment Containment Performance, Radiological Source Terms and l Risk Estimates Prepared by C. K. Park, A. K. Agrawal, M. Khatib-Rahbar, W. T. Pratt i

Brookhaven National Laboratory Prepared for U.S. Nuclear Regulatory Commission 8607080233 gggg39 hDR ADOCK 05000287 PDR 1

i

NOTICE This report was prepared as an account of wor'k sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of re-sponsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.

NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Of fice Post Of fice Box 37082, Washington, DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include N RC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; Licensee Event Reports; vendor reports and correspondence Commission papers;and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and N RC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances.

Documents available from the National Technical Information Service include NUREG series i

reports and technical reports prepared by other federal agencies and reports prepared by the Atomic

! Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

l Documents available from public and special technical libraries include all open literature items, such as books, journal arid periodical articles, and transactions. Feabral Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

I Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Division of Technical Information and Document Control, U.S. Nuclear Regolatory Com-mission, Washington, DC 20555.

j Copies of industry codes and standards used in a substantive manner in the NRC regulatory process

' are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the l American National Standards Institute,1430 Broadway, New York, NY 10018.

l l

L

NUREG/CR-4374 BNL-NUREG-51917 i

Vol. 3 A Review of the Oconee-3 i Probabilistic Risk Assessment  ;

, 1 i

Containment Performance, Radiological Source Terms and Risk Estimates Manuscript Completed: May 1986 Date Published: June 1986 Prepared by C. K. Park, A. K. Agrawal, M. Khatib-Rahbar, W. T. Pratt Brookhaven National Laboratory Department of Nuclear Energy Upton, NY 11973 I

I Prepared for i Division of Safety Review and Oversight Office of Nuclear Reactor Regulation i U.S. Nuclear Regulatory Commission Washington, D.C. 20555 NRC FIN A3800 I

I, 9

I

-iii-ABSTRACT A technical review of the Oconee-3 Probabilistic Risk Assessment (OPRA) has been performed with the objective of evaluating containment response, radiological source terms, and off-site consequences. In the OPRA study, a detailed structural analysis for determination of ultimate failure pressure of the containment has not been performed. A sensitivity study shows that the off-site consequences as well as the frequencies of release categories can be changed by a large magnitude depending on the assumptions used on the distri-butional parameters and the probability of containment isolation failure. The assessment of the OPRA shows that very late overpressurization failure is the dominant containment failure mode. The OPRA radiological releases are compa-rable in magnitude to those used in other recent studies. Cost-effectiveness analysis by a multiobjective optimization approach suggests that various con-tainment safeguards are designed to provide adequate safety margins for severe accidents.

-iv-ACKNOWLEDGEMENTS The authors are grateful to E. Chelliah (Project Manager), R. Barrett, and J. Rosenthal of the U. S. Nuclear Regulatory Commission for their review and many helpful remarks on this manuscript. The authors also wish to thank Ms. T. Skelaney for the excellent job in typing the manuscript. The work re-ported herein was conducted under the auspices of the United States Nuclear Regulatory Commission (USNRC), Office of Nuclear Reactor Regulation.

-v-CONTENTS Page ABSTRACT............................................................... iii ACKN0WLEDGEMENTS....................................................... iv LIST OF FIGURES........................................................ vi LIST OF TABLES......................................................... vii EXECUTIVE SUMMA.V...................................................... viii

1. INTR 000CTION...................................................... I 1.1 Background................................................... 1 1.2 Objective and Scope.......................................... I 1.3 Organization of the Report................................... 1

2. PLANT DESIGN FEATURES IMPORTANT TO SEVERE ACCIDENT ANALYSIS....... 3 2.1 S u mma ry o f P l a nt Sy s t em s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.2 Compa ri s on wi th Oth er Pl ants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3. ASSESSMENT OF CONTAINMENT PERFORMANCE............................. 9 3.1 Plant Damage Bins (PDBs)..................................... 9 3.2 Containment Event Tree (CET)................................. 13 3.3 Containment Capacity......................................... 20 3.3.1 Containment Capacity.................................. 20 3.3.2 Leakage............................................... 24 3.3.3 S e n s i t i v i ty A n a l y s i s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.4 Source Terms and Off-Site Consequences....................... 35 3.4.1 Radi onucl i de Invento ry and Rel ease. . . . . . . . . . . . . . . . . . . . 35 3.4.2 Comparison with Other Studies......................... 43 3.4.3 Off-Site Consequences................................. 47

4.

SUMMARY

AND CONCLUSIONS........................................... 51

5. REFERENCES........................................................ 52 APPENDIX A - COST-EFFECTIVENESS ANALYSIS: MULTI 0BJECTIVE OPT I MI Z AT I ON AP P R 0 ACH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1

-vi -

LIST OF FIGURES Figure Title Page 2.1 Oconee Unit 3 reactor building................................ 4 3.1 CET structure................................................. 19 3.2 Time-phased containment event tree with release category assignments................................................... 28 3.3 Frequencies of release categories, different CI ............... 30 3.4 Frequencies of release categories, different u and o.......... 31 3.5 Containment failure probability as a function of l oga ri thmi c standa rd devi ati on. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 3.6 Acute and latent fatalities vs. C1............................ 34 3.7 Acute and latent fatalities vs. u............................. 36 3.R Acute and latent fatalities vs. o............................. 37 A.1 Graphical illustration of noninferiority in an arbitrary feasible region in objective space............................ A-13 A.2 Mapping of decision space into objective space................ A-14 A.3 Illustration of PDB assignment................................ A-15 A.4 Time-phased containment event tree with release category assignments................................................... A-16 A.5 An example of the containment pressure history and failure pressure...................................................... A-17 A.6 Some n o n i n f e ri o r s ol u t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-18 i

l

-vi i -

LIST OF TABLES Table Title Page 2.1 Design Details for the Oconee Unit 3 and TMI Unit 2 Containments................................................... 5 2.2 Comparison of Selected Design Characteristics.................. 8 3.1 Imaortant Consequence Parameters and Ranges . . . . . . . . . . . . . . . . . . . . 10 3.2 The Core Melt Bins (0PRA)...................................... 11 3.3 Sequences Assigned to Core-Melt Bins........................... 12 3.4 The Containment Safeguard State Bins........................... 14 3.5 Correlation of Containment-Safeguard States with Consequence Parameters..................................................... 15 3.6 Relationship Between Containment Pressure and Containment-Safeguard States............................................... 16 3.7 Plant Damage Bin Frequencies: All Initiating Events (Modified Plant)............................................... 17 3.8 Top Events of the Containment Event Tree....................... 18 3.9 The Containment Failure Modes (CFMs)........................... 21 3.10 S i mpl i f i ed OPR A ' C ' Mat ri x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 3.11 Comparison of Containment Failure Pressure..................... 25 3.12 Base Model..................................................... 29 3.13 Defi ni ti ons of Rel ease Categori es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 3.14 O con e e Co re I nve nt o ry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.15 Summa ry of Fi s si on P roduct Rel ease Components . . . . . . . . . . . . . . . . . . 40 3.16 OPR A Rel eas e Cat ego ri es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.17 Comparison of Sandia Siting Release Fraction with 0PRA......... 44 3.18 Compa ri son of Rel eas e Catego ri es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 3.19 Comparison af OPRA and Siting Study Release Categories......... 46 3.20 A Compari s on of Popul at i on nensi ti es . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

-viii-I LIST OF TABLES Table Title Page 3,21 Summary of Consequence Ranges for Which Release Categories Affect Risk Curves............................................. 50 A.1 D ec i s i on Va r i ab l e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-19 A.2 Rool ean Exp ress i on f or PDBs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-20 A.3 Bool ean Expression for Rel ease Categories . . . . . . . . . . . . . . . . . . . . . . . A-21 A.4 Quantification of Release Categories for the Case of Figure A.5...................................................... A-22 A.5 Nominal Values of the Constants of the Reliability Cost Functions....................................................... A-23 A.6 Possible Reliability Cost Function Types........................ A-24 A.7 The Val ues of Deci s i on Va ri abl es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-25 A.8 R e l i a b i l i ty C o s t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A- 26 A.9 Rel ease Catego ry F requenci es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-27

-ix-EXECUTIVE

SUMMARY

The objective of this study is to provide a perspective on severe acci-dent propagation, containment response, radiological source terms and off-site consequences for the Oconee Unit 3 nuclear power plant. A technical assess-ment of the assumptions and methods used by the Oconee Probabilistic Risk Assessment (0PRA) for evaluating the contribution of the internally and exter-nally initiated accidents to severe accident risk at Oconee is made.

In the present study, principal containment design features important for severe accidents are discussed and compared with those of Zion, Indian Point, Millstone-3, and Seabrook designs. Those portions of the OPRA related to severe accident phenomenology, containment response, radiological source terms, and off-site consequences are described and evaluated.

The Oconee containment response to severe accidents is judged to be an important factor in mitigating the severe accident risk. The early contain-ment failure is not considered to be very credible for Oconee as a result of large containment capacity. The dominate containment failure mode is very late gradual overpressurization failure with 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> of warning time, which is very long compared to the Reactor Safety Study (RSS).

The OPRA radiological releases are comparable in magnitude with the other RSS-based studies. However, the OPRA oxidation releases are based on 10% of the fuel as compared with 50% in the RSS and 25% in the ZPSS studies.

A multiobjective optimization technique is also used to evaluate the cost-effectiveness of the Oconee-3 containment design. This evaluation is made by comparing the Oconee-3 containment design values to various non-inferior solutions to a multiobjective optimization problem formulated for a large dry containment design. The comparison suggests that there are indeed sufficient design margins for the Oconee-3 containment against severe accidents.

1. INTRODUCTION

1.1 Background

Recently, much efforts have been given to the definition of acceptable risk levels, either qualitatively or quantitatively.1 '+ Along with these efforts, there have been also significant development in the estimation of risks due to nuclear power plant operation.5-6 The latter methodology is called Probabilistic Risk Assessment (PRA).

PRA is a technique to estimate systematically and probabilistically var- )

ious risks (e.g., fatalities and property damages) due to the operation of l nuclear power plants. The risks may include those from normal operation, nor- '

mally expected transients, and loss of coolant accidents.

A number of utilities have undertaken PRA studies w..ich have been sub-mitted to the Nuclear Regulatory Commission (NRC) in support of various regu-latory actions. The Brookhaven National Laboratory (BNL) under contract to the NRC has been involved in reviewing the methodologies, assumptions, and results of the various PRA studies.

This report presents a review and evaluation of the containment perfor-mance, radiological release characteristics and consequences of the Oconee Unit 3 PRA (0PRA), which was performed by the Nuclear Safety Analysis Center (NSAC) of the Electric Power Research Institute (EPRI), Duke Power Company, and other participating utility companies.

1.2 Objective and Scope The objective of this review is to provide a perspective on severe acci-dent propagation, containment response together with radiological source term characteristics and consequences of the Oconee Unit 3 nuclear power plant. A technical assessment of the assumptions and methods used for evaluating the contribution of the internally and externally initiated accidents to the fre-quencg of core damage has been conducted by the Risk Evaluation Group at BNL.1 The study was sponsored by the Reliability and Risk Assessment Branch of the Division of Safety Technology, USNN.

In the present report, the various assumptions used in the determination containment capacity are reviewed. Sensitivity of the release f requencies and l consequences to various assumptions are examined. Those portions of the OPRA related to severe accident phenomenology, containment response, radiological source terms and consequences are also described and evaluated.

In the Appendix, a new cost-effectiveness evaluation method based on the multiobjective optimization is introduced and applied to the design of the Oconee plant.

1.3 Organization of the Report In Chapter 2 the Oconee plant design features important to severe acci-dent analysis are reviewed and compared with other plants. Chapter 3 contains the assessment of the Oconee Unit 3 containment performance, source terms and consequences. The results of sensitivity studies on the release frequencies

and the consequences due to the changes of containment capacity are also given in Chapter 3. Summary and conclusions are discussed in Chapter 5.

The cost-effectiveness of the design of the Oconee plant is evaluated using a multiohjective optimization approach as outlined in the Appendix. The approach is introduced and successfully applied to the containment performance criteria determination given the top level NRC proposed preliminary safety goals.16.17

l

2. PLANT DESIGN FEATURES IMPORTANT TO SEVERE ACCIDENT ANALYSIS In this section, those plant design features that may be important to an assessment of degraded core melt scenarios and containment analysis are re-viewed. These important features are then compared with other nuclear power plants in order to identify commonalities and differences for benchmark com-parisons.

2.1 Summary of Plant Systems Oconee Unit 3 is a pressurized-water reactor (PWR) with a large dry con-tainment. It is one of three such units comprising the Oconee Nuclear Sta-tion. The station primarily consists of three reactor buildings, a turbine building that is shared by all three units, and two connected auxiliary build-ings, one servicing Units 1 and 2, and the other servicing Unit 3. The reac-tor, designed and manufactured by Babcock & Wilcox, has a core consisting of 177 fuel assemblies. The balance of plant (B0P) was designed and constructed by the Duke Power, with the Bechtel Corporation designing the reactor build-ing. Oconee Unit 3 produces 2568 MWt at full power, generating about 860 MWe.

The dimensions and structural details of the Oconee containment are shown i n Fi gu re 2.1. The design data are given in Table 2.1, which also includes the design data, of the Three Mile Island Unit 2 (TMI-2). Because large dry PWR containments are similar in design and structural analyses have been per-formed for several such containments, a structural analysis of the containment at Oconee Unit 3 was not performed. The containment capacity assessment was based mainly on analyses of the containment of TMI 2, which is very similar to the containment of Oconee Unit 3, and pertinent information on other plants.

In order to maintain the integrity of the containment building under accident conditions, the containment safety featu res include the reactor building spray system (RBSS), the reactor building cooling unit (RBCU), and the reactor building isolation system (RBIS).

The RBSS consists of two pumps in parallel trains that draw suction from the borated-water storage tank and spray water into the containment atmosphere upon actuation on a high-high reactor-building pressure signal.

The RBCU consists of three fan-cooling units with heat exchangers that cool the reactor-building atmosphere. Typically during normal operation two of the three operating cooling units maintain an acceptable environment in the reactor building. All three cooling units receive signals to start when a signal of high reactor-building pressure is generated by the Engineered-Safe-guards Actuation Systems (ESAS).

The RBIS isolates all penetrations connecting the containment to the out-side environment and any fluid penetrations that do not provide a safety func-tion under accident conditions.

The emergency core cooling systems (ELCSs) consist of the high-pressure injection (HPI) system, the low-pressure injection (LPI) system, and the pas-sive core-flooding system. These systems are intended to keep the core sub-critical and cooled under a variety of conditions.

.:W Ins.de i of liner plate el. 983' 5%"

.7.tz;;- -*..

. 8. 970' 8" i

~; . .

h,i :.* ' i .g. ,

v, ..

g,944,0" -j R.B. Spray headers .'

,, 7-- %" Liner plate .

M _

113' 11%"inside diameter

. a

.o

.i-- 3'-9"

k. h,

.- 33'4" .

,;t -

,geMain steam line Removable shielding .

Coolant 5: ,,. , 4' 0" >

Top of shielding pump ,,

., , 3'0" '.

't. floor el. 861' 6" motor  %. - - - 6: -

3A2

', ;2 l;t - Pressurizer

(

s r

. 4 Operating

.. r N.% M' i .]' ...

• s o o o ep 3 p....- , .

1

-l' floor Reactor

[.

[

.., h, _

k

'9.'

h. . N 1

~

el. 844' 6" t.

coolant h,(-bAux. feedwater

,.  ; r k'

pump

9 ,._

?

j ,

,' $ N Control 3A2 . I Wi'  ; 8. 816' 0"  :-" -"

7 d

h.

M i

\,  %

serv ce structure 3 - ,-

,  ?-T 5'0" .,' ,.'N Feedwater line

'*

• Grade el.

Steam l.  ! .. -

, - ., kI . l 3 ..

% ] 796 0 generator

.t-3A 10' 0" . '! ' i.

.' .1

.N - Base slab I.h ,' . '

Y.1 L' H !' M.}..  :'y; ,

.; ; \ el. 775' 0" f, s. i:,U ,' $ *;' ."N,k'.{.[.S'*. ,f .h'"i.~.h$kk,I Base siab el." 7[5-07 Steam d -

g.__; w . generator 0 10 20 \ 8 767'0" 3B

- v Bottom of reactor graphic scale Reactor - 8. 757' 2" skirt flg. el. 785' 6" vessel

8. 775' 6" Bottom of liner plate el. 775' 0" Figure 2.1 Oconee Unit 3 Reactor Building.

Table 2.1 Design Details for the Ocone'e Unit 3 and TMI Unit 2 Containments a,b b,c Parameter Oconee TMI2 Thickness of reactor building 3.75 4 wall (concrete), ft Thickness of reactor building 3.25 3.5 dome (concrete), ft Liner-plate thickness, inc.

Walls '

1/4 3/8 Dome 1/4 1/2 Base 1/4 1/4 Liner-plate material ASTM A-36 steel, ASME SA516, fy = 36 ksi Grade 55, fy = 30 ksi Concrete f = 5000 f = 5000 cu c Reinforcing Grade 40 and 60 All Grade 60 Prestress-tendon material ASTM A416 ASTM A416 Internal free volume of 1,910,000 2,050,000 containment structure, ft Design pressure, psia 74 75 (a)

(b) Data from the Oconee FSAR (Duke Power,1969).

The quantity fy is the yield strength; fc is the compressive (c) Data strength.

from the report by the Engineering Decision Analysis Company, Inc. (EDAC).

The HPI system consists of three high-head centrifugal pumps that provide injection flow in the event of various small or intermediate LOCAs. it is automatically actuated by the ESAS on low pressure in the reactor-coolant sys-tem or high pressure in the reactor building, drawing suction from the borated-water storage tank (BWST). One of the HPI pumps also operates con-tinuously to provide makeup flow to the reactor-coolant pumps, and to recircu-late the reactor coolant for purification and the control of bori c acid concent rati on. The HPI system can also be manually actuated to provide core-heat removal when the subcooling margin in the reactor-coolant system is in-adequate, for example, after a total loss of steam-generator feedwater.

The LPI system consists of two trains with a third installed spare pump.

It injects BWST water into the reactor vessel at low pressures and high flow rates to maintain core-heat removal for large-break LOCAs. When the BWST in-ventory is depleted, the LPI system draws suction from the reactor-building emergency sump; the switchover to this recirculation mode of cooling must be accomplished manually. Each LPI train is equipped with a heat exchanger for the long-term removal of decay heat. The LPI system also provides shutdown decay-heat cooling, taking suction from an RCS hot-leg.

The core-flooding system performs no normal function; it is designed to reflood the reactor core after the initial blowdown phase of a LOCA. Its pri-mary purpose is to limit peak cladding temperatures to within licensing cri-teria for design-basis accidents.

The systems described above rely to varying degrees on auxiliary systems to provide electric motive and control power as well as component cooling.

The low-pressure service water (LPSW) system is a once-through system with two low-pressure high-capacity pumps. It provides the heat sink for the LPI heat exchangers and the RBCU coolers. In addition, the LPSW system pro-vides motor and/or bearing cooling for the reactor-cooling pumps, emergency-feedwater pumps, and high-pressure injection pumps. The LPSW system also pro-vides cooling for various room coolers in the auxiliary building.

The component-cooling system cools the control-rod-drive mechanisms, the seals of the reactor-coolant pumps, and other components located in the reac-tor building. It is a closed-loop system, with heat rejected to the LPSW sys-tem through one of two heat exchangers.

During power operation, auxiliary power for the plant electrical loads is provided from transformer 3T off the main unit generator. The generator feeds the electric power grid through main transformer 3, through the Oconee 500-kV substation. After a reactor trip, the auxiliary loads are transferred to the startup source, transformer CT3, which is fed from the 230-kV substation. In the event of a loss of off-site power, one of the two Keowee hydroelectric units supplies power to Oconee through the startup transformers if the over-head path through the 230-kV substation is available, or via an underground feeder to transformer CT4, which supplies power to the standby buses common to all three units. Should these supplies be unavailable, power is available from the 100kV grid (and the two Lee Station combustion turbine generators if necessary) via transformer CTS.

Electric power is distributed through two main feeder buses to three 4-kV switchgear groups and stepped down to supply loads at the 600- and 208-V levels. If off-site power is lost, a load-shed signal is generated, and many nonessential loads, including the reactor-coolant pumps, are shed. However, the load shedding is much less extensive than that at most plants that rely on diesel-generator sets for emergency power because of the much larger capacity j of the Keowee hydro units. t Instrumentation and control power is provided through inverters from the dc power system and is backed (for essential loads) by the 120-V ac regulated-power system. The dc power systems of the three Oconee units are linked through an isolating-diode arrangement so that each unit serves as a backup for another. A separate dc power system is maintained by the station power batteries for nonsafety loads, such as the main turbine de emergency system.

Alternative shutdown cooling means is available from the standby shutdown f acility (SSF). The SSF has an independent diesel generator power source and is capable of supplying steam-generator cooling water and reactor-coolant makeup for all three units. The SSF is located within a bunkered installation and is designed primarily for use in security events, fires, and floods. The SSF is manually initiated and operated.

2.2 Comparison With Other Plants Table 2.2 sets forth the design characteristics of the Zion, Indian Point-2, Millstone-3, and Seabrook facilities as they compare to the Oconee-3 plant.

The power level of the Oconee-3 is about 70% to 85% of the other plants.

The free volume of the containment is about the same range. The design pres-sure is, on the other hand, much higher than that of others by about 10 or 15 psia. This signifies that the Oconee-3 containment is built to be very strong. Other design parameter values are comparable to each other.

l l

Table 2.2 Comparison of Selected Design Characteristics Zion indlan Point MIlistone Seabrook Oconee 0 10 Unit 3H,13 Deslan Parameters Unit 1 Unit 2 Unit 1,2 12 Unit 3 7

Reactor Power IMW(til 3,250 3,030 3,411 3,650 2,568 Containment Building:

6 6 6 6e 6 Free Volume (ft ) 2.73 x 10 2.61 x 10 2.3 x 10 2.7 x 10 1,91 x 10 Design Pressure (psla) 62 62 59.7 67.7 74 Initial Pressure (psla) 15 14.7 12.7/9.1 15.2 14.7 Initial Temperature (*F) 120 120 120/80 120 120 Primary System:

3 Water Volume (ft ) 12,710 11,347 11,671 13,140 11,478 3

Steam Volume (ft ) 720 720 7 2,012 700 Mass of UO2 in Core (Ib) 216,600 216,600 222,739 222,739 207468 Mass of Steel in Core (Ib) 21,000 20,407 7 19,000 Mass of Zr in Core (Ib) 44,500 44,600 45,296 45,234 42,200 Mass of Bottom Head (ib) 87,000 78,130 87,000 87,000 k Bottom Head Diameter (ft) 14.4 14.7 14.4 14.4 14.25 '

Bottom Head Thickness (ft) 0.45 0.44 0.45 0.45 0.42 Steam Generator System:

Inventory per Generator (Ibm) 77,000 82,000 113,600 112,000 Containment Building Coolers:

Sprays yes yes yes yes yes Fans (with safety function) yes yes no no yes Accumulator Tanks:

Total Mass of water (I b) 200,000 173,000 348,000 213,000 128,900 Initial Pressure (psla) 665 665 600 615 615 Temperature (*F) 150 150 80 100-150 110 RefueIInq Weter Storage Tank:

Total Mass of Water (Ib) 2.89 x 10 2.89 x 10 10 2.89 x 10

• Temperature ('F) 100 120 50 86 150 Reactor Cavity:

ConfIguratlon wet Wet Dry Dry / Wet Dry /Wot Concrete Material . Limestone Basaltic Basaltic Basaltic Basaltic

• Minimum (Mswimum Capacity = 3.9 x 10 lb)

3. ASSESSMENT OF CONTAINMENT PERFORMANCE In this chapter, the Oconee-3 containment responses, performance, and radiological source terms are reviewed and assessed.

The bridge between the systems analysis (or the front-end PRA) and the containment response and performance analysis (or the back-end PRA) is pro-vided by the plant damage bin (PDB) and the containment event tree (CET). The plant damage bins (PDBs) are used for grouping those accident sequences which provide similar environment to the containment. The containment event tree shows possible paths that physical phenomena and processes inside containment could take for the previously defined set of plant damage bins. Sections 3.1 and 3.2 review the definition of plant damage bin and the construction of the containment event tree in the Oconee-3 PRA.

For the quantification of CET, the containment capacity is one of the most important factors which needs to be considered. The assumptions on the distributional parameters and on the containment leakage used in the OPRA are

. reassessed in Section 3.3. Section 3.4 shows the results of tne sensitivity i

studies on the frequencies of the release categories and the public health risks, i.e., acute and latent fatalities due to changes of these assumptions.

Finally, in Section 3.4 the OPRA source terms and consequences are reviewed.

3.1 Plant Damage Bins (PDBs)

The plant damage bins (PD3s) were developed by combining core melt bins (CMBs) and containment safeguard states (CSSs) in the OPRA. The combination process was based on various parameters that exert the greatest effect on the off-site consequences. The parameters were identified in the analysis of plant systems, radionuclide release and transport, and physical processes inside the containment. These parameters referred to as the consequence parameters are related to the CMBs and CSSs and are listed in Table 3.1.

Three consequence parameters are then found to be applicable to the acci-dent sequences developed in the core melt event trees:

1. Rates of leakage from the reactor coolant system to the containment

a. Large LOCA leakage rates

b. Small LOCA leakage rates

c. Cycling relief valve leakage rates

2. Time from shutdown to the start of core / coolant boil-off, tsd

a. Less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />

b. More than 2 but less than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />

c. More than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />

3. Reactor coolant system pressure

a. More than 400 psi

b. Less than 400 psi The various combinations of these parameters are then inspected to deter-mine which ones are possible. Six core melt bins are found to be sufficient to encompass all of the sequences and are listed in Table 3.2. The sequences are accordingly assigned to each core melt bin (Table 3.3).

Table 3.1* Important Consequence Parameters and Ranges Consequence parameter Range Comments Rate of RCS leakage to Large LOCA Hydrogen burn before pres?ure containment Small LOCA vessel failure less likely Cycling relief at smaller leakage rates valve Containment isolaLion- Variations by a Increased release fractions failure (rate of leakage factor of 3 for some early-containment-to the atmosphere) ' lure scenarios Water in reactor cavity rater on centain- Oxidation release from con-ment floor tainment steam explosion (out-of-vessel coolability possible)

Radionuclide removal from Either spray train Spray operation decreases i containment atmosphere operating source term RCS pressure >400 psia In-vessel steam explosion less likely, energetic vessel failure Steam volumetric >50 vol. % steam Hydrogen inerted, burning concentration or <6.4 vol. 4 prevented oxygen Turbulence at the time Any fans or sprays Complete hydrogen burn of hydrogen burning operating more likely Heat removal during a Any sprays oper- Lower hydrogen burn l hydrogen burn ating before pressures burning

• Late recovery of contain- Before or after Could result in severe ment heat removal when vessel failure hydrogen burn steam concentrations are high Time from shutdown to t sd <2 hr Evacuation warning time start of coolant 2 hr <tsd <12 hr increases with increasing boiloff, tsd tsd >12 hr ' tsd -

Heat rejection to the Any fans or sprays Out-of-vessel coolability environment operating possibles containment steam l pressurization mitigated l Containment pressure <110 psia Possible containment over-

} >110 and <190 psia pressure failure (15-psi increases important)

>190 psia Certain containment over-pressure failure 4

• Reproduced from OPRA.

I

Table 3.2 The Core Melt Bins (bPRA)

Core-Melt Bin Definition I Early core melt, small-LOCA leakage rates, RCS pressure above 400 psia II Late core melt, small-LOCA leakage rates, RCS pressure above 400 psia III Early core melt, cycling-relief-valve leakage rates, RCS pressure above 400 psia Late core melt, cycling-relief-valve leakage rates, RCS '

IV pressure above 400 psia V Early core melt with ECC injection failure, large-LOCA leakage rates, RCS pressure below 400 psia VI Early core melt with ECC recirculation failure, large-LOCA leakage rates, RCS pressure below 400 psia

Table 3.3 Sequences Assigned to Core-Melt Bins

• Core-Melt Bin Sequence Definition I 3.ThBPbYLWX Transient-induced LOCA, early recirculation TT 3 circulation failure I 8.T00YX Transient-induced LOCA, early recirculation 333 circulation failure I 9. TQU 3 Transient-induced LOCA, injection failure I 11.SUYX Small LOCA, early recirculation failures 333 I 12. SU 3 Small LOCA, early recirulation failures II 1. TQ8PUTT Y LNX S Transient-induced LOCA, late recirculation failure 11 7.TOUEX Transient-induced LOCA, late recirculation 33S failures II 10.SilIX Small LOCA, late recirculation failure 333 III 4. TOBPUTT Y LXT Loss of feedwater, early recirculation failure III 5. TOBPU T Loss of feedwater, injection failure III 6. TOBP Overpressure failure IV L ss of feedwater, late failure of HDI 2.TUBPUTl T *T cooling V 14. AU A Large LOCA, injection faHure V 15. E Reactor-pressure-vessel rupture VI 13. AVAA X large LOCA, recirculation failure VII 16. V Interfacing-systems LOCA

• Reproduced from OPRA.

The next step in establishing the plant damage bins (PDBs) is the identi-fication of the containment safeguard states (CSSs). After carefully examin-ing the effects of possible combinations of CSS availabilities, five CSS bins are defined (Table 3.4). Table 3.5 summarizes the relationship between the consequence parameters and the containment safeguard states. Table 3.6 illus-trates the impact of the CSSs on containment pressure.

Because the core melt bins contain information on the operation of the containment safeguards, there are finally 24 plant damage bins out of 30 pos-sible combinations (6 CMBs and 5 CSSs). The plant damage bin frequencies are summarized in Table 3.7.

3.2 Containment Event Tree (CET)

The containment event tree can now be constructed to model the possible paths that physical phenomena and processes inside containment could take for the previously defined set of plant damage bins. The containment event tree (CET) serves for quantifying the containment failure modes and the radiologi-cal releases. The structure of the tree is based on the various top events which represent distinct phenomena important to the progression of an acci-dent. For the OPRA, there are 17 top events as defined in Table 3.8.

The containment event tree uses as input the plant damage bins. Each of these hins, defined by the consequence parameters, exhibits different impacts on the progression of the core melt accident. These impacts are represented 3

by the choice of different branch point probabilities for CET top events or by the inclusion or exclusion of certain bins in CET sequences. Since the plant damage hins represent frequencies obtained from the probabilistic analysis, the CET output is the frequency of occurrence for containment failure by various modes and the characteristics of the radionuclide releases associated with each mode (energy, timing, and magnitude).

The rationale for including an event explicitly in the tree or incorpora-ting it into another event is based on the following two criteria:

1. Substantial effect on radionuclide release fractions, the time, the energy, and the duration of release.

2. Substantial effect on the outcome of later events in the containment event tree.

Therefore, any event that substantially alters radionuclide-release frac-tions is included explicitly in the tree. The particular containment failure mode is also included explicitly in the tree because it affects the time, the energy, and the duration of release; the other release characteristics are included implicitly. Finally, in order to best estimate the effect of certain processes on risk, events that significantly alter the likelihood or the out-come of more than one downstream process are included explicitly in the tree.

The number of paths in the CET can be reduced greatly, largely because of dependencies between the events or dependencies resulting from the plant-damage bins. For example, there are only 182 paths in the OPRA containment event tree (Figure 3.1). Figure 3.1 also includes various containment failure modes. The major dependencies identified are the following:

---.---__------m,-- - - - - . - - . - , - , _. - _ , . _ . _ r,- .r-- - - - - -----. , .--- --, ,

Table 3.4 The Containment Safeguard State Bins CS State Bin Definition A RB sprays only (with LPI coolers) or RBCUs and RB sprays activated early B RBCUs only C Neither RB sprays nor RBCUs D RBCUs and RB sprays activated at vessel failure E RB sprays without LPI coolers

Table 3.5 Correlation of Containment-Safeguard States

• with Consequence Parameters a RRS With RBS Without RBS and RRCus Neither RBS Parameter LPI Coolers LPI Coolers RBCUs only nor RBCUs Water in cavity X X X X X Radionuclide removal X X X Steam volumetric concentration

<50 vol . % X X X b

>50 vol . % X X Turbulence at time hydrogen burning X X X X Heat removal during hydrogen burning X X X Late recovery of X

heat removal X Heat rejection to X X environment X ta) Containment pressure is treated separately in Table 3.6.

(b)The steam volumetric concentration could also be less than 50 volume percent, depending on the core-melt bin.

• Reproduced f rom OPRA.

Table 3.6 Relationship Between Containment Pressure and Containment-Safeguard States

• Containment Required Pressure Containment-Safeguard (psia) State Comments

<110 Sprays with LPI coolers Sprays could reduce peak H2 pressures substantially

<110 Sprays without LPI coolers Same as above

<110 Sprays and RBCUs Same as above 110 to 190 Sprays with LPI coolers Steam overpressurization will not occur, but pressure in this range could result from H2 burn 110 to 190 Sprays without LPI coolers Same as above 110 to 190 Sprays and RBCUs Same as above

>190 Sprays without LPI coolers pressure will be initially suppressed while sprays draw ccid water from BWST; atter switch to recirculation, pressure will start increasing, eventually exceeding 190 psia be-cause no heat removal is available

>190 Neither sprays nor coolers If initiating transient is a high-energy-line break, containment fail-ure could occur earlier

• Reproduced from GPRA.

t

Table 3.7* Plant Damage Bin Frequencies: All Initiating Events (Modified Plant)a CM Bin CS State DDB Frequency b

I A 5.1-7 I B 6.7-6 I C 4.2-5 I D 1.1-6 I E 9.8-6 II B 1.7-6 II C 2.1-5 11 0 1.9-6 III A 9.4-6 ,

III B 5.4-6 III C 7.1-5 III D 1.8-5 III E 4.3-5 IV B 1.9-7 V A 3.2-6 V B 4.6 R V C 3.4-6 V E -.c VI A 4.4-6 VI B 5.3-6 VI C 3.7-8 VI E --

TOTAL 2.5-4 (a) Acronyms: CM, core melt; CS, containment safeguard, PDB, (b) plant-damage bin.7 (c)5.1-7 = 5.1 x 10-Negligible frequencies are indicated by two hyphens

(--).

• Reproduced from OPRA.

Table 3.8 Top Events of the Containment Event Tree

• C0 Core overheating CI Containment isolation HB1 Early hydrogen detonation (failing containment)

CM Core-meltdown coherency VSE In-vessel steam explosion CF Containment failure from a missile generated by an in-vessel steam explosion HB2 Early hydrogen burn (mitigating later burns)

RPV Reactor pressure vessel failure mode CSE Containment steam explosion RC Reactor-cavity structural failure CSF Containment-safeguard functionability HB3 Hydrogen burn (failing containment)

OVC Out-of-vessel coolability CC Retention of water overburden during core-concrete interactions HB4 Later hydrogen burn (failing containment)

OP Containment failure by overpressure MT Containment failure by melt-through

• Reproduced from OPRA.

n., ,.m.m m,,

3.

-d'i*

P. .

-r-c5Ei:. . ..

4 -g:

_ a  :.

m: .

m .:_::

i -c  : .

- m:  ;

m: ;

m. i... .

..~.

c H

i i .

I

- 2-C :5 i

-t_ . .

-1  : :

C i!

C *

.,, i .

r--t_ .,.

J. .:

- -! l Figure 3.1 CET structure. (Reproduced from 0PRA)

1. After the containment has failed, subsequent failure modes are precluded; for example, a containment isolation failure pre-cludes all failures from a hydrogen burn or steam and/or noncon-densable gas buildup.

2. An early hydrogen burn that does not f ail the containment pre-cludes later containment failures from hydrogen burns since insufficient hydrogen or oxygen would remain after the initial burn.

3. If the molten core drips slowly into the lower plenum, instead of falling as a coherent mass, three top events are precluded:

in-vessel steam explosion, energetic reactor vessel failure,and ex-vessel steam explosion.

4. If the reactor vessel does not fail energetically and there is no ex-vessel steam explosion, both a reactor cavity failure and a failure of containment safeguard functionality are precluded.

5. If the molten core is successfully cooled outside the vessel, the retention of radionuclides by a water overburden during core / concrete interactions is unnecessary, and containment fail-ure by overpressurization or basemat melt-through is precluded.

Of the 17 top events (see Table 3.8), four are used to describe the radionuclide source term in the containment: in-vessel steam explosion (VSE) and containment (ex-vessel) steam explosion (CSE), which control the magnitude and the probability of a radionuclide release by oxidation; out-of-vessel coolability (0VC), which determines both the occurrence and the extent of core-concrete interactions with the attendant release by the vaporization mechanism described in the Reactor Safety Study; and retention of a water overburden during core-concrete interactions, which would provide a condition necessary for the removal (scrubbing) of radionuclides released by vaporiza-tion. Two top events affect the source term less directly or to a lesser extent: mode of reactor-vessel failure (RPV) and functionability of contain-ment safeguards (CSF).

Six of the top events lead to direct containment failures; a con-tainment-isolation failure is also included. Table 3.9 shows the various containment failure modes considered in the OPRA study. Table 3.10 shows a simplified OPRA C-matrix in which the simplification was made not to make any adverse effect on the final risk estimates by disregarding very small values of the conditional probabilities.

3.3 Containment Capacity 3.3.1 Containment Capacity The ultimate capacity of the contairment to withstand increasing pressure loading is perhaps the most important factor in determining the risk of a nu-clear power plant. The Oconee-3 containment is a large dry design consisting of a reinforced concrete cylinder and hemispherical head with steel liner.

This containment is designed to accommodate a DBA pressure of 73.7 psia. It is tested per 10CFR50 Appendix J to assure leakage of no more than 0.25 volume

Table 3.9 The Containment Failure Modes (CFMs) 1 CFM Definition Connents 6 Containment isolation failure Early containment failure with a large leakage rate a In-vessel steam explosion Unlikely event in the DPRA o Steam explosion in the cavity Unlikely event in the OPRA Penetrations failure Unlikely event in the OPRA y Hydrogen detonation before linlikely event in the OPRA vessel failure y' Hydrogen burn after vessel failure y" Late combustible gas burn 6 Overpressure failure due to steam and noncondensable gases c Melt-through

$ Design leakage No containment failure I

i

Table 3.10 Simplified OPRA 'C' Matrix PDR RCIA IB 2 3 4 5 I A 1,0 B 1.0 C 0.01 0.99 0 1.0 E 1.0 II B 1.0 C 0.01 0.99 0 1.0 III A 1.0 B 1.0 C 0.01 0.99 0 1.0 E

1.0 IV B 1.0 C 0.14 0.74 0.12 D

1.0 V A 1.0 B

1.0 C 0.01 E

1.0 VI A 1.0 B

1.0 C 0.07 0.93 E

1.0 1

I l

I

percent per day at 115% of this DBA pressure, i.e., at 82.5 psia. Recently, more careful analyses and scale tests have demonstrated that the ultimate failure pressure is significantly higher. The Oconee PRA study has cited detailed structural analysis on the TMI containment which is very similar to the Oconee design and construction. The failure was calculated to be 2.5 times the DBA pressure. Atpressure forpressure, this higher TMI containment leakage will occur at a significantly higher rate.

In the OPRA study, a detailed structural analysis for ultimate failure pressure of the containment has not been performed. However, the failure pressure was determined based on the TM1 results and other scale experiments.

Thus, containment failure at 2.5 times of its design pressure, i.e., at 162.5 psia was estimated. The associated failure probability was " subjectively" assigned a value of 0.10 in the ODRA report. The failure probability distri-bution was fitted by a log-normal distribution noted below:

f(x) =

1 exp[ II (I" **- 6)2 ] (3.1)

(2T o x where ( and o are the two parameters. The failure probability for x < a is obtained by integrating Eq. (3.1). One gets O*U p(a)=f[1-erf(E-ina)] if a < e 6

/2 o if a > e t (3.3)

=f[1+erf(ina-()]/2 o where t 2 erf t =hh f e-u du, (3.4) a p(a) is the cumulative failure probability at pressure less than or equal to a.

The failure probability distribution can now be readily calculated using either Eq. (3.2) or Eq. (3.3) once the standard deviation, o, and C are known. The OPRA study, based on their failure mode and uncertainty analyses, has deduced a = 0.17. Using this value for o, a value for ( is obtained by requiring 10% probability of failure at 162.5 psia. Note that the median and 90 percentile failure pressures are calculated to be 202 psia and 251 psia, respectively. The median failure pressure, thus, is calculated to be 3.2 times the design basis pressure. In absence of any detailed structural analy-sis, this failure distribution curve appears unjustified. Thus, a modified failure probability distribution can be determined using the same log-normal

distribution with identical value for o as used in OPRA but instead assigning 90% failure probability at 2.5 times the DBA pressure, i .e. , at 162.5 psia.

Note that the BNL calculation indicates median failure pressure of 130 psia, which is significantly lower than the value used in OPRA (202 psia). Table 3.10 compares failure probabilities used in OPRA and the present modified equation indicating higher f ailure likelihoods at the same containment pres-sures. The impact of the change in the assumed distribution on consequences and release frequencies will be discussed later in Section 3.3.3.

As part of this review, a sensitivity calculation was performed by vary-ing the standard deviation value in the log-normal distribution. The failure distribution curve depends upon two parameters, o and C as already noted. For a given a value, C was computed by requiring a specified failure probability (0.1 in the case of OPRA study and 0.9 in BNL review) at 162.5 psia. The pre-sent sensitivity calculation was done using a = 0.08 but requiring ninety per-cent failure probability at 162.5 psia. This reduced standard deviation results in a much sharper failure probability distribution. For this set of parameters, there is less than one percent chance of failure for pressure up to 122 psia, which is considerably higher than the BNL value noted in Table 3.11.

Recently, an independent assessment of the containment analysis tech-niques was made.18 The ultimate failure pressure for the Oconee-1 contain-ment, which is nearly identical to Oconee-3, was quoted as 151 psig. This f ailure pressure is in very good agreement with the value obtained by BNL.

Therefore:

1. The containment failure pressure (162.5 psia) appears to be 2.5 times the DBA pressure,

2. The OPRA study value of ten percent chance of failure at 162.5 psia appears unjustified,

3. Our review assumes 90 percent chance of failure at 162.5 psia, 4 The standard deviation value, which reflects uncertainty in contain-ment capacity, impacts very significantly the containment failure probabilities particularly, at lower containment pressures.

3.3.2 Leakage During accident sequences involving core damage, the containment struc-ture will be exposed to pressures and temperatures beyond those used in the design basis accident analysis. The containment response to these severe con-ditions is evaluated in OPRA study using the " threshold" model. The contain-ment is assumed intact until the internal loading causes gross failure. An assessment of the Oconee containment capacity was made in the previous sec-tion. Prior to reaching gross failure (also termed as catastrophic fai leakage from the containment is assumed to be the same as the The ORA valu DBA leakage ranges f rom 0.1 to 1% per day. For the Oconee-3 plant, it is spe-cified as 0.25 w/o per day at the predicted DBA pressure of 59 psig. This leakage rate is so small that it has no impact on the containment pressuriza-tion during a severe accident. This leakage, however, determines the off-site consequences over long term (i.e., over a period of tens of hours).

Table 3.11 Comparison of Containment Failure Pressure Failure Pressure, psia Failure Probability OPRA BNL 0.01 136. 90.

0.05 154. 99.

4 0.10 162.5 105.

0.50 202. 130 0.90 251. 162.5 0.45 267. 172.

i I

i 4

The use of the threshold model seems inadequate as no allowance is made for substantially larger leakages through degraded sealants around discon-tinuities. The extent of sealant degradation, and, hence the leakage area, is dependent upon several considerations of which the sealant material, exposure duration and temperature are the key parameters. Estimates of leakage area thus induced range up to 30 to 40 in 2,12 This area should be comgared with the equivalent ORA-based leak area of the order of 0.01 to 0.05 in . It is, therefore, apparent that rather large leakages can occur and, if the contain-ment pressurization is arrested, a gross failure may be averted. Otherwise, a catastrophic failure materialize. This model is known as ' leakage-before-failure' model .gy In terms of the impact of this model on off-site consequences, there are two opposing points of view: a gross failure of con-tainment may be averted and hence the off-site consequences would not be as severe as it would have been otherwise. On the other hand, the consequences of substantially higher leakages might be more significant at least for the long-term effects.

An estimate for the containment leakage is obtained by combining the effects of sealant degradation from the two largest contributors: vent and purge lines and equipment and personnel locks. Assuming total (i.e., com-plete) degradation of all sealant2 material around 48 inches vent and purge lines, a leakage area of 18.9 in is calculated. The leak area, as reported in NUREG-1037 (Ref.19) for the equipment and personnel locks, of 6.1 in 2 is used to give a total leakage area of 25 in . The corresponding leakage rate, using a simplifie flow discharge correlation, is given by the fol-lowingexpression:(choked I k+1N W = 2 /i T , 4 (3.5)

M kl'(k+1) I V where W/M is the release rate in terms of mass fraction, k is the ratio of specific heats at constant pressure and constant volume, R is the gas con-stant, T is the absolute temperature, V is the containment volume, and A is the equivalent leak area. Note that the mass-fraction release rate is inde-pendent of internal pressure, and that for a given containment and temperaturg it is directly related to the leak area. For Oconee-3, using V = 1.9 x 10 ft 3and T = 296 F, Eq. (3.5) gives:

Leakage Rate = 1.03 A in w/o per hour (3.6) or, alternately, Leakage Rate = 24.6 A in w/o per day (3.7)

2 where Ain is the leakage area in in2 . For the estimated hole of 25 in , the leakage rate is 25 w/o per hour, i.e, the entire content is turned out every four hours. If such leak area were to develop, which appears likely at least for the late gradual overpressurization sequences, then substantial reduction in the likelihood of gross f ailure should occur.

3.3.3 Sensitivity Analysis The sensitivity of the release frequencies and the public health risks to to the containment capacity discussed in the previous sections is addressed in this section. The study is based on the simplified Oconee-3 containment event tree (Figure 3.2).

One of the most important parts of the PRA is determination of the con-tainment capacity to sustain various internal loads (pressure, temperature, etc.) resulting from a core melt accident. The containment capacity is usually described by the containment failure probability distribution as a function of i There are many techniques to determine such a distribution.gernal pressure.In this study, therefore, it is assumed that the distribution is given (lognormal) and the sensitivity studies are done on the changes of the health risk indices and the frequencies of release categories due to the changes in the median failure pressure, the logarithmic standard deviation, and the containment isolation failure probability. As a base model, the sim-plified containment event tree (CET) is used (Figure 3.2). The containment capacity is assumed as in OPRA to follow a lognormal distribution with median of 200 psi and logarithmic standard deviation of 0.17. The containment isola-tion failure probability (CI) is assumed to be constant for all plant damage bins (PDBs). It is also assumed that the load distribution for each PDB does not change from that used in the Oconee-3 PRA. Table 3.12 shows the base model calculations and CI value of 1.4 x 10 2 is found to be appropriate.

Figures 3.3 and 3.4 show the changes of the frequencies of release cate-gories due to CI and the distribution parameters (u and c). The changes in CI mainly affect the frequencies of RC 2 and RC3: both are for radionuclide release due to containment isolation f ailure (see Table 3.13 for the defini-tions of release categories). The magnitude of changes in the frequencies of RC 2 and RC 3 is about the same order of magnitude as the changes of CI.

Given CI, RC 1A and RC IB are most sensitive to the changes of probability distribution parameters (Figure 3.4). This is because the frequencies of RC 1A and RC 18 are for releases due to overpressure failure (0P), and the proba-bility of OP is, in turn, very much dependent on the shape of the distribution as well as the median value. Figure 3.5 shows the lower tails of containment failure probability distributions as a function of the logarithmic standard deviation. The difference in the failure probabilities becomes larger as the pressure decreases. For example, at the pressure of 145 psi, there is about an order of magnitude difference in the probability.

.The effect of CI on the consequences (acute and latent fatalities) is shown in Figure 3.6. At low values of CI, (below 10 ") both acute and latent fatalities are insensitive to the variation of CI. Below 10 ", the contribution of CI to the health risks is small and, therefore, it may not be necessary greater thanto10-imp" rove CI further.to acute,

- to and latent 10 Jhe contribution of CI increases at v fatalities.

EARLY AT VESSEL LATE VERY RELEASE CATEGORY FAILURE LATE ASSIGrittENT CO CI OP1 HB3 OP2 HB4 OP3 RC4 or RC5 RC4 RC1B RC1B RCIA RCIA RC2,3 Figure 3.2 Time-phased containment event tree with release category assignments. (Reproduced from OPRA)

Table 3.12 Rase Model Mean Frequency (yr 1) Acute (#/yr) Latent (i/yr)

RC Oconee-3 Base Oconee-3 Base Oconee-3 Base 1A 2.9-8 3.4-8 1.74-6 2.04-6 8.70-5 1.02-4 1B 2.2-6 2.1-6 0.0 0.0 5.94-4 5.67-4 2 2.2-6 2.2-6 1.10-5 1,10-5 2.86-3 2.86-3 bl 3 3.1-7 1.2-6 0.0 0.0 3.10-5 1.20-4 4 1.6-4 1.6-4 0.0 0.0 1.76-3 1.76-3 5 9.0-5 9.0-5 0.0 0.0 0.0 0.0 TOTAL 2.54-4 2.54-4 1.27-5 1.30-5 5.33-3 5.41-3 (CI = 1.35-2 BASE ]Ip/o = 200/0.17 i

f

? Release Frequency

-0 -5 -4 10- 10 10 10 I I I i , ,

I

_ . _ CI _- 3,10-3 RCIA -

--- - C I = 3*10-2 CI = 3*10-1

_:. - _: _ _ _ _ _ _ _ _ _ .:. _ _: _ _ - .=

RClB e

RC2 _ _' - _' _'

_ _ _' _ _' _ * -' _~ _ _ _ _ _ _ _ _ _ _

7 1-RC3 i RC4 i

RCS Figure 3.3 Frequencies of release categories, different CI.

u a 180/0.17

- -- - 180/0.08 205/0.17 lI!

10_4 -

gl: gg-

. . . . . . . 205/0.08  : i.:

II:

Il!

1 lji 1.:

ll:

l- ll?

>, ll! li E 10 g l lll if 1.: ll1 i

ll: i:l

. i-- i:

7, ll:. ll:.

I: 1.:

a: -6 I 10 I':l-d '

l I'l:

l: 1:

l' ll:

l i: .

ll.: i.:

ll! - -

l i.: .i- i! :

ll! ll:

j 1.!

l:

lll I.. l- il:!

I l.

10-7 _

j ll ,l{ il,{ ;l}

l*: i: ll: 1:

il il: l

i. i.. il.

g. -

ll Il:. ll.:l. .

II:- Ij* :

1 l.

l:

1:,

, il ll.: II: 11: ll::

i. l. l.. .

i.

l ll 11: II: II: ll; RCIA RC1B RC2 RC3 RC4 RC5 Figure 3.4 Frequencies of release categories, different u and o.

Table 3.13 Definitions of Release Categories Release Category Definition RC 1A Early Overpressurization Containment Failure, Multi-puff Release RC IB Late Overpressurization Containment Failure, Single-puff Release, Warning Time 20 hrs.

RC 2 Containnent Isolation Failure Without Sprays Operating RC 3 Containment Isolation Failure With Sprays Operating RC 4 Very late Overpressurization Containment Failure, No Sprays Operating, Warning time 60 hrs.

RC 5 Design Leakage Only, Sprays Operating

/

s'

/

/

/

/

-l /

10 _.

/

a=0.17[

/

a /

c /

-2 10 - .

a =0.08 e

a /

% /

/

D- -3 n.

Y

- 10 iS S

k.

I I I I I 135 145 155 165 175 185 Containment Pressure (psi)

Figure 3.5 Containment failure probability as a function of logarithmic standard deviation.

b, I

C

/

/

)-

/

/

/ I

/ l 0

1

/ e s .

/ a I C

C e /

s / e s a s v

C a e

lB s s

a df t y 2 i

t e

B i I 0

/f l t

a a

1 i l

t a

F a

' f s t e t u n

/c A t l

e a

3

/ I 0 d n

1

, a i

t y

' t e

u c

l a

- A t

a - 6 F

- 4 3 t . -

n 1 0 e e 1 r t u a - g L i

- F 1 3 4 0 0 0 0 1 1 1 1 h.e - "a $

Figures 3.7 and 3.8 show the variations of acute and latent fatalities due to median failure pressure and logarithmic standard deviation, respectively. Both acute and latent fatalities show insensitivity at or greater than the median value of 220 psi. Above this, health effects are dominated by CI. As expected, acute and latent fatalities are decreasing functions of the median. Since the probability of containment failure is very sensitive to the shape of the distribution (determined by o), health effects are also very sensitive to o (Figure 3.7) as well as to p.

3.4 Source Terms and Off-Site Consequences 3.4.1 Radionuclide Inventory and Release Radionuclide inventory in Oconee-3 core was calculated by Duke Power as-suming 421 effective full power days burnup. Out of a very large number of nuclides, only 54 radionuclides, consistent with the Reactor Safety Study, '

were considered in the PRA. The resulting values are noted in Table 3.14.

This table also includes values obtained from the Sandia siting study (Ref.

24) after adjusting for the Oconee-3 power level. This adjustment correspond-ed to a multiplication factor of 2568/3412, i.e., 0.75. It is seen that the values used in OPRA are in broad agreement with the adjusted Sandia values.

In some cases, the OPRA values are higher by as much as 40 to 50 percent. Of particular importance is Ruthenium-105, which is 25 percent higher. This ra-dionuclide has an impact on early fatalities (half-life is 4.44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />).

The entire core inventory of radionuclides is grouped into eight groups just as it was done in the Reactor Safety Study. The release fractions of these groups depend on the detail sequence of an event as well as availability or lack of different mitigative features. In order to reduce the number of events to a manageable number, OPRA has identified six release categories.

For each of these release categories, their release fractions and other char-acteristics were defined in an OPRA report as described below.

The OPRA approach of calculating release of the radionuclides is similar to that used in RSS. Seven groups of isotopes were defined. These are noble gases (Xe, Kr), halogens (I, Br), alkali metals (Cs, Rb), tellurium group (Te, Sc, Sb), alkaline earths (Sr, Ba), noble metals (Ru, Rh, Pd, Mo, Tc), and ref ractories (La, Y, Ce, Pr, Nd, Zr, Nb, Np, Pu, Am, Cm). Iodine was broken up into elemental and organic chemical forms. Both gaseous and particulate forms of radionuclides were considered in release calculations.

Four basic mechanisms for radioisotope release were:

1. Gap release - occurs when the cladding ruptures and radionuclides are released to the reactor coolant system (RCS).

2. Melt release - occurs after core uncovery when decay heat causes the fuel to heat up and volatilize radionuclides from the melting core.

3. Ofidation release - occurs when part of the molten core is dispersed in the containment atmosphere and reacts with oxygen.

i

-2 -1 10 10 CI = 1.35*10-2 a = 0.17 Lognormal

-2 5x10-3 _

5x10 Acute Fatality

\

\

\

\

\

\

g Base Case h

\

\

ds N

N Base Case L'atent Fatality 10-3 I l I l l I I I i 10-2 170 180 190 200 210 220 230 240 u(psi)

Figure 3.7 Acute and latent fatalities vs. p.

l l

1 l

CI = 1.35*10-2

1. = 200 psi 3x10-2 ,,

Lognormal

/

/ '

/

/

Latent /

Fatality f

/

/

_ _ 4 ' Base Case 10'2 -

Acute 5x10-3 .

Fatality Base Case 10-3 I I  ;

0.10 0.20 ,

Figure 3.8 Acute and latent facilities vs. o.

Table 3.14 Oconee Core Inventory Sandia Sandia Siting 0PRA Siting OPRA

[24] [24]

Isotope (curies) (curies) Isotope (curies) (curies) a Co-58 5.6+5 8.00+ 5 Sb-127 6.0+6 6.28+6 Co-60 3.4+3 3.00+5 Sb-129 2.0+7 2.24+7 Kr-85 5.0+3 5.45+5 I-131 6.6+7 6.92+7 KR-85m 2.3+7 1.80+7 I-132 9.8+7 1.01+ 8 Kr-87 4.3+7 3.33+7 I-133 1.3+8 1.42+8 Kr-88 5.5+7 4.72+7 I-134 1.5+8 1.55+8 Rb-86 3.6+5 9.99+4 I-135 1.3+8 1.33+8 Sr-89 7.2+7 6.51+7 Xe-133 1.4+8 1.43+8 Sr-90 3.9+6 4.43+6 Xe-135 2.8+7 5.72+7 Sr-91 9.0+7 8.14+7 Cs-134 1.0+7 1.26+7 Y-90 4.1+6 4.57+6 Cs-136 2.9+6 4.57+6 Y-91 9.0+7 8.44+7 Cs-137 4.9+6 6.16+6 Zr-95 1.1+8 1.16+8 Ba-140 1.3+8 1.24+8 Zr-97 1.2+8 1.17+8 La-140 1.8+8 1.26+8 Nb-95 1.0+8 1.16+8 Ce-141 1.1+8 1.16+8 Mo-99 1.3+8 1.29+8 Ce-143 1.1+8 1.07+8 Tc-99m 1.0+8 1.11+8 Ce-144 6.9+7 7.69+7 Ru-103 1.1+8 1.11+ 8 Pr-143 1.1+8 1.05+8 Ru-105 6.2+7 7.72+7 Nd-147 4.9+7 4.57+7 Ru-106 2.2+7 3.26+7 Np-239 1.4+9 1.66+9 Rh-105 4.2+7 7.06+7 Pu-238 9.0+4 1.92+5 Te-127 5.6+6 6.28+6 Pu-239 2.0+4 3.92+4 Te-127m 7.4+5 9.11+5 Pu-240 2.2+4 3.00+4 Te-124 1.9+7 2.09+7 Pu-241 4.0+6 7.54+6 Te-129m 5.0+6 5.67+6 Am-241 2.7+ 3 6.21+3 Te-131m 1.0+7 1.02+7 Cm-242 1.0+6 1.96+6 Te-132 9.8+7 9.95+7 Cm-244 6.3+4 1.15+5 (a)S.6 + 5 5 5.6 x 10s ,

4. Vaporization release - occurs when the molten core attacks the con-crete and generates gases which provide a release mechanism when they percolate through the melt.

These release mechanisms are consistent with the RSS study.

The gap release occurs first in an accident sequence. The amount of radionuclides released to the primary system is small compared to the other release mechanisms. The gap release is composed principally of noble gases.

The core melt release was assumed to start after the core was uncovered and the fuel had heated up to its melting point. In the RSS it was assumed that the core-melt release rate paralleled the rate of core melting up to the point where 80 percent of the core had melted. At that time the lower core grid plate was assumed to fail and the core was assumed to fall into the lower head. When the core falls to the bottom of the reactor pressure vessel (RPV),

the surface for release is noticeably smaller. Additionally, either a crust may form as a result of heat transfer to the water on top of the molten corium or the metal in the melt could transfer to the water on top of the molten cor-ium or the metal in the melt could migrate to the top due to density differ-ences. Either of these would provide a barrier inhibiting further release of radionuclides out of the melt.

An oxidation release was assumed to occur if high-temperature molten core material was finely dispersed into the oxygenerated containment atmosphere.

This release was assumed to occur only if an in-vessel steam explosion failed the containment.

During the postulated core-melt scenarios, the RPV was calculated to fail in the bottom head area due to attack by the molten fuel. Once the RPV had failed, the molten core dropped to the cavity floor and began attacking the concrete. The process of concrete attack produced non-condensible gases which bubbled through the melt and debris releasing additional radionuclides. This vaporization release was modeled as exponentially decreasing with time with a single characteristic half life of 30 minutes. For each of these four release mechanisms, OPRA study assumed a fraction that get released. These values are noted in Table 3.15. The rate of releasa from the fuel was assumed to be instantaneous for the gap and oxidation releases, and proportional to the rate of core melting for the meltdown release.

Using the above noted fission-produce releases for the four modes of re-lease, OPRA study made a number of CORRAL (Containment of Radionuclides Released after a LOCA) computer code calculations to define radionuclide release categories. These calculations were made for each plant damage bin.

Based on these CORRAL calculations and sequences in the containment event tree, OPRA defined six release categories. These categories were defined by examining sensitivities for the parameters used in the modeling of off-site consequences. In this way the variation in results within a release category was minimized. These sensitivities were also used to help define specific consequence-analysis parameters, such as the duration of release.

The fission product retention mechanism inside the containment is depen-dent on, among other things, the containment failure time. Recent studies based on NRC's Source Term Code Package using the NAUA code show that the i

Table 3.15 Summary of Fission Product Release Components Gap Meltdown Vaporization Steam Fission Release Release Release Explosion Product Fraction Fraction Fractiona Fractionb Xe, Kr 0.030 0.870 0.100 (X)(Y)(0.90)

I, Br 0.017 0.883 0.100 (X)(Y)(0.90)

Cs, Rb 0.050 0.760 0.190 ---

Te 0.0001 0.150 0.850 (X)(()(0.60)

Sr, Ba 0.000001 0.100 0.010 ---

Ru ---

0.030 0.050 (X)(Y)(0.90)

La ---

0.003 0.010 ---

aExponential loss over 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> with half-time of 30 minutes. If a steam expiosion occurs prior to this, only the core fraction not involved in the steam explosion can experience vaporization.

bX = fraction of core involved in the steam explosion. Y = fraction of inventory remaining for release by oxidation. Steam explosion fraction for Xd, Kr is the product of S, Y, and 0.90.

i models included in the Reactor Safety Study were overly conservative in regard to the prediction of the radiological releases associated with late contain-ment failure.

The resulting categories are similar to those of the Reactor Safety Study but categories specific to a steam explosion and those associated with con-tainment failure before the start of core melting were eliminated. An addi-tional category was added to scope the effects of an accident characterized by two different releases resulting from a containment failure at the time of reactor-vessel failure. The tools developed for aiding in rel ease-category definition were used to identify an important difference between the time of containment failure.

Each of the six release categories was characterized by the following set of parameters:

o

1. The time of the release,

2. The duration of the release,

3. The elevation of the release, 4 The energy of the release, and

5. The warning time for evacuation.

These parameters were used in the timing process.

The radionuclide release categories were chosen by 0PRA study on the basis of the time and mode of containment failure and whether or not contain-ment sprays were functioning. Accordingly, Table 3.16 identifies six release categories. These categories are:

OPRA-1A: Early Overpressurization Containment Failure, Multipuff Release It represents a catastrophic failure of the containment at about the time of reactor-vessel failure. This release, over a 30-minute duration, contains the radionuclides released during core meltdown and an oxidation release involving 10% of the core. The first puff release is followed by a vaporiza-tion release where the core debris attacks the concrete and effectively lasts for the next 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

OPRA-1B: Late Overpressurization Containment Failure, Single-Puff Release It is a catastrophic failure of the containment that occurs sometime after reactor-vessel failure. The duration of release is 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. This release contains 90 percent of the radionuclides remaining in the containment atmosphere at the time of failure, including the core-melt release, an oxida-tion release (10 percent of the core material), and the vaporization release.

OPRA-2: Containment Isolation Failure Without Sprays It represents containment-isolation failure prior to core meltdown and persists for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the start of core uncovering. The breach assured for this release is equivalent to a 6-inch diameter hole. This cate-gory also includes core-melt accident induced by a steam generator tube rup-ture and a stuck-open main steam safety relief valve.

l

Table 3.16 OPRA Release Categories f

Release Failure Failure Sprays

. Category Time Mode

• Operating 1A Early 0P --

IB Late OP --

2 Early CI No 3 Early CI Yes 4 Very Late OP No 5 Early OP Yes 4

• 0P: Overpressure.

CI: Containment-isolation failure.

i i

I l

-4

- - . - - , - , ----,,-e - , - - - - , - - , - , , - -

OPRA-3: Containment-Isolation Failure with Sprays Operating it represents a containment-isolation failure prior to core meltdown and persists for at least two hours after the start of core uncovering. The spray system is assumed to operate. The equivalent hole size for this release is also assumed to be 6-inches in diameter. The release fractions are based on one spray train working. If both trains succeed, the fractions will be smaller.

OPRA-4: Very late Overpressure Containment-Failure Without Sprays Operating This category represents a very late overpressure containment failure.

This very late failure tends to exhibit a constant risk roughly the same as the one assumed for a core-melt accident resulting in only design-basis leak-age. The release fractions obtained by assuming design-basis leakage rate are roughly equivalent to those obtained by assuming a containment overpressure failure about 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after warning.

OPRA-5: Design-Basis Leakage with Sprays Operating This category represents no containment failure. Sprays are assumed operating. The leakage occurs at the design-basis rate of 0.25 volume percent per day.

It should be added that a number of containment-isolation failures with only liquid-pathway releases were also identified in OPRA. The associated liquid releases to the auxiliary building was not considered to result in a significant atmospheric release. Therefore, OPRA study did not consider them more important than OPRA-4 or OPRA-5 releases except for the small percentage that would contribute to early overpressure f ailures.

The key parameters required in CRAC-type consequences analyses are noted in Table 3.17.

3.4.2 Comparison with Other Studies The OPRA release categories are compared with those defined in the Reac-tor Safety Study, and the Zion Study in Table 3.18. Key observations from this comparison are:

1. Early containment failure prior to core melting was not considered credible for Oconee because of its high capacity.

2. The contribution of the oxidation (steam explosion) release to the source term was included in each OPRA release categories. The Oconee release categories are based on an oxidation release involving 10% of the fuel, as opposed to 50% in the Reactor Safety Study and 25% in Zion.

The OPRA release categories are also compared with an independent siting study (Ref. 24) done by Sandia National Laboratories. In this siting study, five release categories were considered. These are compared with OPRA release categories in Table 3.19. Note that there is no equivalent to OPRA-2 (Con-tainment-isolation failure without sprays) in the Sandia siting study. Using

Table 3.17 Comparison of Sandia Siting Release Fractions with OPRA OPRA-1A OPRA-1B SST-2 OPRA-3 SST-1 Puff 1 Puff 2 Release Characteristics Time of Release, hr 1.5 2.5 3.0 24 3 1.5 Duration of Release, hr 2 0.5 2.5 0.5 2 1.5 d

Warning Time, hr 0.5 1.5 --

20 1 0.5 l Release Height, f t. 33 70 --

70 33 0 RelgaseEnergy, 0 289 77 289 0 33 10 Btu /tr 4

b Release Fractions j' Xe-Kr 1.0 0.82 0.18 1.0 0.9 1.0 CH31 2.5-5 5.0-6 3.0-5 3.0-5

! 0.45 3.0-3 Iodine 0.53 0.08 0.047 0.041 Cs-Rb 0.67 0.50 0.16 053 9.0-3 0.011 Te-Sb 0.64 0.19 0.51 0.056 0.03 0.01 Ba-Sr 0.07 0.062 0.01 5.8-3 1.0-3 1.4-3 Ru 0.05 0.10 .03 0.10 2.0-3 8.4-4 La 9.0-3* 2.5-3 6.3-3 7.0-4 3.0-4 1.4-4 '

l

• 9.0-3 E 9.0 x 10-3 f

Table 3.18 Comparison of Release Categories Reactor Safety Zion Oconee PRA Study Study Study PWR-la Z-la PWR-lb Z-lb **

PWR-2 Z-2A, Z-2B OPRA-1A,0PRA-1B Z-2R, Z-5t (0PRA-2)tt PWR-3 Z-3 6 PWR-4 PWR-4 OPRA-2tt PWR-5 PWR-5 OPRA-3 PWR-6 PWR-6, Z-8A OPRA-4 PWR-7 PWR-7, Z-8B OPRA-5

• Early containment failure before core melting was not considered credible.

• • The contributions of the oxidation (steam explosion) release to the source term was assessed for each OPRA release category. The Oconee release categories are based on an oxidation release involving 10% of the fuel, versus 50% in the Reactor Safety Study and 25% in Zion.

tZion release category Z-5 represents an early containment failure with sprays operating. In the Oconee PRA, containment failure resulting from steam explosion and hydrogen-burn-initiated overpres-sures with sprays operating were assigned low probabilities. There-fore, a release category equivalent to Z-5 was not defined for Oconee.

ttIn the Reactor Safety Study, large containment-isolation failures without sprays operating were placed in release category 2; smaller failures were placed in category 4. The Oconee PRA used a defini-tion of probability versus break size conditional on plant-damage bins for assessing breaches of isolation. Oconee category 2 is based on a 6-inch diameter hole.

QSince steam explosi ens were found to be of low probability (and identical contributions to the source term for other accidents), no Oconee equivalent was required.

Table 3.19 Comparison of OPRA and Siting Study Release Categories Sandia Siting Study Oconee PRA Study SST-1: Severe core damage, loss of OPRA-1A, OPRA-1B all ESF systems, direct breach of containment SST-2: Severe core damage, containment OPRA-3 fails to isolate, sprays operating SST-3: Severe core damage, containment OPRA-4, OPRA-5 fails by basement melt-through SST-4: Modest core damage, containment OPRA-4 (?)

leakage 01% per day SST-5: Limited core damage, design-basis OPRA-5 containment leakage Not used: Severe core damage, containment OPRA-2 fails to isolate, no sprays operating i

these release categories, Sandia computed conditional consequences for each of these source terms for a 1120 MWe PWR at Oconee site. They reported that release categories SST-1 and SST-2, by and large, determine early and late consequences and that other source terms do not even contribute one-half per-cent to the consequences. For this reason, a comparison of release fractions used in Sandia and OPRA was made in Table 3.17. It is seen that the release fractions used in OPRA study are conservative. Furthermore, the release frac-tion for noble metals (Ru-group) which dominate early f atalities is more than twice of that used in the Sandia siting study. The resulting consequence is expected, therefore, to be higher (ignoring the threshold effect) for OPRA release category.

3.4.3 Off-Site Consequences An evaluation of the off-site consequences, given a core melt accident, is made in this section. The OPRA. methodology is discussed and the signifi- ,

cant results are included. A comparison with independent siting study done by the Sandia National Laboratories is also made.

The analysis of off-site consequence is probabilistic. Given that a re-lease occurs at any random time, there are many factors that would affect the consequences. The most important factors are (1) the weather conditions (wind speed, wind direction, atmospheric turbulence, and rainf all), (2) the popula-tion distribution, and (3) the evacuation trajectories.

The principal model used in OPRA is the CRACIT code which is a modified version of the computer code CRAC. The latter was originally developed for the WASH-1400 Reactor Safety Study. The major modifications and/or improve-ments made for CRACIT include (1) changes to the spatial-interval concept to allow for changes in wind direction as a function of time and space, (2) changes to the dispersion model to allow for wet deposition, revised plume-rise and lid-penetration models, models for trapping and fumigation under inversion lias, and a terrain model, and (3) the characterization of plume t raj ectory. A number of CRACIT runs were performed by selecting start dates randomly. Calculations followed the start date sequentially hour by hour until the plume of radioactive material had traveled far away from the region of the site. The radiation-dose calculations were essentially the same as those used in the Reactor Safety Study. The simulated radiation exposures were then used to estimate the health effects, and the latter were combined to form frequency distributions of consequences versus probability for a given release category.

The population distribution data for the area around the Oconee site were obtained from two sources. The first was information collected by the 1

Duke Power Company for the area within 50 miles by the plant. Data beyond the 50-mile radius was taken from a 1970 census population-density map of the United States.

In order to allow for azimuthal variation of population distribution, the CRACIT code requires data on fine grids. The collected data were subdivided by the plant operator in 11.25 degrees sectors to produce a total of thirty two sectors. Distance intervals are 0.5 mile for distances of 0. to 5 miles from the plant, 1 mile for distances of 5 to 10 miles, 2 miles for 10 to 20 miles, and 5 miles for 20 to 50 miles. Beyond the 50-mile radius, the spacing

is changed progressively outward from 50 to 60, 60 to 80, 80 to 100,100 to 150, 150 to 200, 200 to 500, 500 to 1100, and 1100 to 2000 miles. This spacing method provides a fine grid near the plant, where it is important because of the high doses that would be received there and the large popula-tion at long distances are also represented adequately.

An assessment of this fine-grid population data could not be directly made. A comparison of the integrated population distribution for different radial annuli, however, was made with that used in an independent siting study done by the Sandia National Laboratory (Ref. 24). Table 3.20 shows this com-parison for the population densities between Sandia and OPRA data for the Oconee site. Also included are the corresponding numbers for the Indian Point site from the Sandia study. The following observations are made:

1. In general, OPRA population data are consistent with the Sandia study.

2. OPRA data show 10 to 20% higher density than the ones used in Sandia, and

3. Oconee population distribution is significantly lower than the Indian Point.

A detailed compilation of the meteorological conditions at the Oconee site was made by Duke Power based on their collection of data for the vicinity of the Oconee plant and the National Weather Service data for adjacent regions. An assessment of this detailed data was not made.

The evacuation model used in OPRA is based on their evacuation pl an .

Evacuation was considered in a region up to 10 miles away from the plant.

Essentially all people living in the 10-mile radius of the plant are cleared in 2.5 to 3.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> after start of evacuation. The average speed of evacua-tion is about 15 miles per hour. In comparison, the evacuation model used in the Sandia study is based on 10 mph speed in conjunction with a normal distri-bution with 15, 50, and 85 percentile delay time of approximately 1, 3, and 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, respectively.

Table 3.21 reproduced from the OPRA to show the range of consequences associated with each release category. It must be noted that the mean condi-tional consequences are not available in the PRA, thus, CCDFs need to be integrated to obtain the mean values.

Table 3.20 A Comparison of Population Densities Population Densities (people per sq. mile)

Inner / Outer Sandia Siting Study 0PRA Study Annular Radei in Miles Indian Point OCONEE OCONEE O-5 750 42 43 s

5 - 10 617 176 203 10 - 20 732 68 77 20 - 30 2046 163 198 30 - 50 2462 72 85 50 - 100 304 77 91 100 - 200 196 94 140 t

Table 3.21* Summary of Consequence Ranges for Which Release Categories Affect Risk Curves Release Cancer Thyroid f Early Early Population-Dose Category Fatalities Cancers Fatalities Injuries (man-rem) Comments 1A 6000-11000 6000-8000 1000-7000 2000-4000 1x108 x 3x10 8 RCIA ranges represent the highest-consequence portions of the CC0Fs 1B 100-1000 60-1000 No effect No effect 1x106 to 4x10 8 RC1B ranges represent a narrow segment of the intermediate-consequence of the CC0Fs 2 100-6000 60-6000 1-2000 700-2000 1x106 to 1x10 8 RC2 ranges represent intermediate- to high- ,

consequence portions 8' of all CCDFs and low-to high-consequence portions for early fatalities 3 No effect No effect No effect No effect No effect 4 1-100 0-60 No effect 1-800 0 to 1 x 10 6 RC4 ranges represent the low- to inter-mediate- consequence portions of the CC0Fs 5 No effect No effect No effect No effect No effect

• Reproduced from OPRA.

4.

SUMMARY

AND CONCLUSIONS A review of the Oconee-3 Probabilistic Risk Assessment (OPRA) was con-ducted with the broad objective of evaluating containment response, radiolog-ical source terms, and off-site consequences. The review included a technical assessment of the assumptions and methods used in the OPRA study.

Those design features important to an assessment of degraded core melt scenarios and containment analysis were reviewed.

Our assessment of the containment capacity showed the risks and the re-lease frequencies were very sensitive to the assumptions used in the deter-mination of the containment capacity. This is characterized by the contain-ment failure probability distribution for the overpressurization failure mode and the containment isolation failure probability. The OPRA results show that dominant containment failure mode is very late overpressurization fpilure with 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> of warning time. (The frequency of RC4 is 1.6x10- and this accounts for about 64% of total core melt frequency.

The OPRA radiological releases (source term bins) are comparable with other RSS based studies (Reactor Safety Study, Zion Study, and Sandia Siting Study). Key observations from this comparison include:

1. Early containment failure prior to core melting is not considered to be credible for Oconee as a result of large containment capacity.

2. The Oconee radiological releases are based on an oxidation release involving 10% of the fuel, as opposed to 50% in the Reactor Safety Study and 25% in Zion.

3. The release fraction for the Ru-group which dominates early fatali-ties is more than twice of that used in the Sandia Siting Study.

The multiobjective optimization approach was used to evaluate the cost-effectiveness of the Oconee-3 containment design. The evaluation was made by comparing the Oconee-3 values to various noninferior solutions to a multi-objective optimization problem formulated for a large dry containment design given top level preliminary safety goals as objective functions. The compari-son suggests that the Oconee-3 containment is designed to provide adequate safety margin for severe accidents.

5. REFERENCES

1. Alvin M. Weinberg, " Nuclear Safety and Public Acceptance," Nuclear News, October 1982.

2. U. S. Nuclear Regulatory Commission, "Toward a Safety Goal: Discussion of Preliminary Policy Considerations," NUREG-0764, for Comment, March 1981.

3. U. S. Nuclear Regulatory Commission, " Safety Goals for Nuclear Power Plant Operation," NUREG-0880, Revision 1, May 1983.

4. U. S. Advisory Committee on Reactor Safeguards, "An Approach to Quantita-tive Safety Goals for Nuclear Power Plants," NUREG-0739, October 1980.

5. U. S. Nuclear Regulatory Commission, "Probabilistic Risk Assessment (PRA): Status Report and Guidance for Regulatory Application," NUREG-1050, Draft Report, February 1984.

6. V. Joksimovich, "A Review of Plant Specific PRAs," Risk Analysis, Vol. 4, No. 4, 1984.

7. Duke Power Company, "0conee PRA: A Probabilistic Risk Assessment of Oconee Unit 3," NSAC 60, June 1984.

8. Commonwealth Edison Company, " Zion Probabilistic Safety Study," September 1981.

9. Philadelphia Electric Company, " Limerick Probabilistic Safety Study,"

September 1982.

10. Power Authority of the State of New York and Consolidated Edison Company,

" Indian Point Probabilistic Safety Study," March 1982.

11. Northeast Utilities, " Millstone Unit 3 Probabilistic Safety Study,"

August 1983.

12. B. J. Garrick et al., "Seabrook Station Probabilistic Safety Assessment,"

Pickard, Lowe and Garrick, Inc., PLG-0300, December 1983.

13. M. Khatib-Rahbar et al., " Review and Evaluation of the Millstone Unit 3 Probabilistic Safety Study: Containment Failure Modes, Radiological Source Terms and Off-Site Conseqc3nces," NUREG/CR-4143, BNL/NUREG-51907, September 1985.

14. M. Khatib-Rahbar et al ., "A Review of the Seabrook Station Probabilistic Safety Assessment: Containment Failure Modes and Radiological Source Terms," NUREG/CR-4540, BNL/NUREG-51961, February 1986.

15. N. Hanan et al., "A Review of the Oconee-3 Probabilistic Risk Assess-ment," Vol . I and 2, NUREG/CR-4374, BNL/NUREG-51917, February 1986.

16. N. Z. Cho, I. A. Papazoglou, and R. A. Bari, "A Methodology for Allo-cating Reliability and Risk," NUREG/CR-4048, November 1984.

17. C. Park, "Multiobjective Optimization Approach to Containment Performance Criteria," Ph.D. Dissertation, Univ. of Michigan, January 1986.

18. L. Greimann, F. Fanous, and D. Bluhm, " Final Report - Containment Analy-sis Techniques - A State-of-the-Art Summa ry ," NUREG/CR-3653, Sandia National Laboratories, March 1984

19. USNRC, " Containment Performance Working Group - Containment Leak Rate Estimates," (For Comment) Draft Report, NUREG-1037, April 1984.

20. B. E. Miller, A. K. Agrawal, and R. E. Hall, "An Estimation of Pre-Existing Containment Leakage Areas and Purge and Vent Valve Leakage Areas Resulting from Severe Accident Conditions," A-3741, 11/15/84 (Draft report dated August 1984) transmitted via letter to V. Noonon, June 29, 1984. See also A. K. Agrawal and R. E. Hall .

21. J. L. Cohon, "Multiobjective Progransning and Planning," Academic Press, New York, 1978,

22. K. K. Aggarwal and J. S. Gupta, "On Minimizing the Cost of Reliability Systems ," IEEE R-24, 205,1975.

23. United Engineers A Constructors Inc., " Capital Cost: Pressurized Water Reactor ' Plan," Vol .1, NUREG-0241, June 1977.

24 D. C. Aldrich at al ., " Technical Guidance for Siting Criteria Develop-ment," NUREG/CR-2239 (SAN 081-1549), 1982, Sandia National Laboratories.

APPENDIX A COST-EFFECTIVENESS ANALYSIS: MULT10BJECTIVE OPTIMIZATION APPROACH A.1 Introduction The cost-effectiveness of the Oconee-3 containment is analyzed using mul-tiobjective optimization approach.u* In Ref. 17 Park used the multiobjec-tive optimization approach proposed by Cho et al .Ig to derive a finite manage-able set of self-consistent relations between the safety goals proposed by the Nuclear Regulatory Commission (NRC)3 and specific sets of measures of contain- 4 ment performance.

The fundamental elements of the proposed approach are three fold 16: 1) a global set of measures of plant performance (top level risk indices or "objec-tive function") which would be subject to a preference assessment by a deci-sion maker, 2) a model or prescription for relating the global set of measures of plant performance to the specific set of measures of plant performance (system and component unavailabilities, etc. or " decision variables"), and 3) a method for deriving a finite, manageable set of self-consistent rel ations between the global and specific sets of measures.

As a global set of measures of plant performance, Cho et al . chose core damage frequency, expected acute fatality, expected latent fatality, and the cost of achieving a particular set of values for the first three members of the global set. These are a set of attributes which can be studied, compared, i and traded-off by the decision maker.

Central to the approach is the identification and use of the cost. It should be recognized that the cost of achieving a particular set of values for the other members of the global set represents a necessary dimension from the I

l point of view of who must make practical, real world decisions, and from the

! point of view of those who must obtain feasible engineering solutions.

l The second fundamental element was identified to be the probabilistic risk assessments (PRAs) which derive top level risk values from plant-specific failures and vulnerabilities.

The third element was identified to be a multiobjective optimization pro-cedure performed on the PRA model with the global set regarded as objective functions.

The expected results from this analysis are various sets of values of containment safeguard system reliabilities which collectively satisfy the safety goals in a cost-effective way. These sets are noninferior to each other. By noninferior it is meant that a set of reliability values is favored for at least one of the members of the global set. These sets are called non-inferior solution sets (NISS), which can be used as reference values for future improvement of the plant.

• The reference nunbers in the Appendix are consistent with those used in the main report.

A-2 In Section A.2, the multiobjective optimization and noninferiority con-cept are briefly described. Application to the Oconee plant is made in Sec-tion A.3. In Section A.3, the specific steps involved in the application of the methodology to the Oconee-3 containment are explained. The noninferior solutions thus obtained are compared with the current Oconee-3 design values.

A.2 Methodology: Multiobjective Optimization and Noninferiority The general multiobjective optimization problem with n decision varia-bles, m constraints, and p objectives can be described as:

minimize Z (X) = (Zi (X), Z 2(X_), ... Z (X_))

p subject to gj(X) < 0, i = 1 ... m (A.1)

Xj c Fd ,j e j = 1. "

where Z_ is the multiobjective objective function and Z, i

... Zp are the p individual objective functions.

For the purpose of this work, the following three objective functions are identified:

1. Expected acute fatalities, A(=Z1 )

2. Expected latent fatalities, L(=Z2)

3. Reliability cost, G(=Z3 )

The first two objective functions are included because they constitute current proposed safety goals and the final measures of public health risks calculated by various PRAs. The third objective function, the total reliabil-ity cost, is included because it represents both technical and economical lim-itations. Therefore it is a necessary ingredient of the decision making process.

The functional relationships between the objective functions and the de-cision variables are provided by PRA models and reliability cost functions.

Two constraints are used, one for acute and one for latent fatalities.

These are:

gi = A < ASG ,

(A.2) 92 = L i LSG >

where A 3 g, LSG = safety goals for acute and latent fatalities, respectively.

Fd in Eq. (A.1) represents a technologically feasible region for the decision variables. If there are n decision variables, Fd is an

A-3 n-dimensional space. Each point in F d, i.e., a set of decision variables, X, corresponds to a particular design configuration, and through PRA models and reliability cost functions, it is used to calculate public health risks (A and L) and total reliability cost.

In single-objective problems the goal of a solution is to find the feasi-ble solution (s) that gives the best value of the objective function. This notion of optimality is no longer valid for multiobjective problems because a solution which minimizes one objective will not, in general, minimize the other objectives. A new concept called noninferiority is introduced as a re-placement of the more strict optimality concept in a single-objective optimi-zation.

A feasible solution to a multiobjective optimization problem is non-inferior if there exists no other feasible solution that will yield an improvement in one objective without causing a degradation in at least one other objective. Or mathematically, a solution -X* is noninferior if there exists no feasible X such that

-~ ~ - ~ ~Z(X) < Z (X*)

(A.3) 1.e., Zi (X_) 1 Zj(X*), i = 1, 2, ... p, where a strict inequality is satisfied for at least one 1. If such a feasible solution X exists, then X* is inferior.

The multiobjective optimization process and the concept of noninferiority can be illustrated graphically. For simplicity, it is assumed that there are two objective functions and two decision variables. Noninferiority is illus-trated in Figure A.1 and the mapping of the decision space into objective space is shown in Figure A.2.

In Figure A.1, Ro is a set of feasible solutions in the objective space and No (line ADEB) are noninferior solutions. Point C is inferior to those solutions of points D and E because D gives smaller value of Zi without increasing Z2 , and similarly E gives smaller value of Z2 without increasing Z. The solutions of interest are those that lie on No .

i The multiobjective optimization can proceed as follows (Figure A.2):

Step 1: Identification of feasible region in decision space (Fd )-

Step 2: Mapping of decision space into objective space, Z = f(x), Fd+Ro.

Step 3: Finding noninferior solutions in objective space (No ).

In other words, exclusion of all dominated points in Ro, and consequently all dominated points in Fd from being viable alternatives.

A-4 Step 4: Decision making on the noninferior solutions to determine final design option.

Step 1 is the step to identify the feasible region that corresponds to the current technological limits. Step 2 is achieved by the mathematical re-lationships provided by PRA models and cost functions. Various noninferior solution generating techniques can be used in Step 3. Once the noninferior solutions are generated, the results are presented to the decision maker (s) and, in Step 4, the final design options (s) can be chosen by the preference assessment of the decision maker's.

A.3 Application In the previous section, the multiobjective optimization approach and the noninferiority concept were briefly discussed. A new solution technique called the direct method was used to find noninferior solutions to the multi-objective optimization problem formul ated for the Oconee-3 nuclear power pl ant. Note that the expected results are a set of optimized system relia-bilities which satisfy top level safety goals. It should also be noted that there can be more than one set of solutions because there are more than one objective to be optimized and each solution is noninferior to others at least in one objective.

Three objective functions and eight decision variables were identified for a large dry containment such as that of Oconee-3. The mathematical rela-tionships between the objective functions and decision variables are provided by the PRA models. Two different reliability cost function types for system reliability cost are assumed, and the total reliability cost is calculated by summation of all system reliability costs.

The three objective functions and eight decision variables are described in Section A.3.1. Sections A.3.2 and A.3.3 are devoted to the PRA models and the reliability cost models, respectively. The PRA models are used to calcu-late acute and latent fatalities in the objective functions. The total relia-bility cost is calculated by the cost models. The results and discussions are in Section A.3.4.

A.3.1 Objective Functions and Decision Variables For the purpose of this study, the following three objective functions are identified:

1. Expected Acute Fatalities, A

2. Expected latent Fatalities, L

3. Total Reliability Cost, G The first two objective functions are included because they constitute current proposed safety goals and the final measures of public health risk calculated by various PRAs. The third objective function, the total reliabil-ity cost, is included because it represents both technical and economical lim- ~

itations to a certain level of system reliabilities. Thus it is a necessary ingredient in the decision making process.

A-5 The proposed multiobjective optimization approach can be applied to cases with objective function (s) different from those used in this study. For exam-ple, off-site damage and cleanup cost could be included in the objective func-tions. These additional objective functions may significantly reduce the num-ber of viable design options (i.e., the number of noninferior solutions), and consequently, the optinum ranges of decision variables are expected to be narrower. In addition, it may be difficult to find appropriate mathematical relationships between these additional objective functions and the decision variables.

Eight decision variables are identified for three containment functional categories. These eight decision variables are mainly for a large dry con-tainment. A different set of decision variables could be used for a different containment types. A list of the decision variables is given in Table A.1.

The containment functional categories are:

1. Mitigation

2. Structural Capacity

3. Bypass For the mitigation furction, there are four decision variables related to the safety systems incorporated in the containment: the unavailabilities of 4

the containment spray system (CSS), the containment cooling unit (F), and the 4

heat removal system (RHR). CSS is further divided into two decision variables

according to its operating mode, i.e., injection mode (CSSI) and recirculation mode (CSSR).

The structural capacity of the containment is usually represented by a containment failure probability distribution in PRA studies. The distribu-tional parameters are estimated by various methods with an assumed distribu-tion type. For example, the lognormal distribution is a two-parameter distribution. In this case, a median and a standard deviation are estimated from the structural and material properties of the containment. For sim-plicity in this study, a lognormal distribution is assumed and the value of the standard deviation used is that found in the Oconee-3 PRA. The median value of the distribution is calculated by the thin shell theory of structural mechanics.

Three decision variables are identified in this functional category: the amount of reinforcing steel, characterized by the cross sectional area of the reinforcing steel (As), the size of the containment, characterized by the radius of the cylinder portion of the containment (R), and leak-tightness of the containment. The decision variable for the leak-tightness is described as the probability of the containment isolation failure (CI).

As a possible way of bypassing the containment, the interfacing system LOCA (V) is considered. The decision variable V may also include the proba-bility of steam generator tube rupture with stuck-open safety valves. Those accidents provide direct paths to the environment from the reactor.

Since the choice of the decision variables is one of the most important steps involved in the proposed methodol ogy, its completeness and possible J

A-6 variations when this methodology is applied to othdr plants should be care-fully reviewed.

A.3.2 Probabilistic Risk Assessment (PRA) Models Once the objective functions and decision variables are identified, the mathematical relationships between them are provided by the results of PRA studies. Since the PRA is known as the best method for systematically evalua-ting the risk of nuclear power plants, it seems reasonable to use PRA models as mathematical relationships between the objective functions (acute and latent fatalities) and the decision variables (system reliabilities). The reliability cost is not provided by PRA models. It is calculated by the sum-mation of each system's reliability cost. Two basic function forms of the system reliability cost are assumed.

Two of three objective functions, acute and latent fatalities, are calcu-lated by the PRA models. The total ' reliability cost is calculated by the cost <

model s .

The PRA models for acute and latent fatalities can be written as follows:

A={ ai [ fj Cji i J L = { tj [ fj Cj i

1 J where A = expected number of acute fatalities, L = expected number of latent fatalities, a j ,1 i = average numbers of acute and latent fatalities of release category 1, fj = annual frequency of plant damage bin j, and Cji = conditional probability of release category i given plant damage bin j.

Once the plant site and release categories are given, average numbers of acute and latent fatalities (aj and 1 )1 are considered to be constant. On the other hand, annual frequency of each plant damage bin (PDB), fj and con-ditional probability of release category i given plant damage bin j (Ci j) are functions of the core melt sequence of events, the containment safeguard states (CSS), and containment failure modes. These are, in turn, functions of decision variables. Though Eq. (A.4) for acute and latent fatality calcula-tion is general enough to be applied to any nuclear power plant, numerical values for each parameter or variable are plant specific. Detailed procedures to calculate fj and C j are i shown next based on the Oconee-3 PRA models.

A-7 The determination of annual frequency, fj , is described. The pl ant damage bins (PDBs) are defined as a combination of the core melt bins (CMBs) and containment safeguard states (CSSs). Each CMB is characterized by differ-ent physical phenomena which affect the amount of radionuclide release to the containment and the course of accident progress. Since the containment safe-guard states are not necessarily independent of the core melt sequence of events, the dependencies must be carefully reviewed. The Boolean equations for the plant damage bins are accordingly expressed as a function of those de-cision variables.

In the Oconee-3 PRA, the plant damage bins are determined by the combina-tion of six core melt bins and five containment safeguard states. Because the core melt bins contain information on the operation of the containment safe-guards, there are 24 PDBs out of possible 30 combinations.

Since many core melt sequences already imply the failure or success of a certain containment safeguard function (s), each core melt sequence, identified by the Oconee-3 PRA, is reviewed carefully and the plant damage bins are assigned accordingly. For example, the CMB I event tree sequence, SYs Xs, represents a small break LOCA initiating event with successful high pressure injection (HPI). One of the minimal cutsets of this sequence, S

• YRBSH

• LPSUMPMF

• RESUMPMF, is the sequence of events representing high pressure recirculation (HPR) fail-ure, because drain valves on the suction line from the containment sunp were left open before the event, resulting in flooding of the HPI pump room, and loss of the sump inventory. Due to the loss of the sump inventory, the spray system fails in the recirculation mode. Therefore, this particular cutset would be either PDB 1B or 1C depending on the failure of the fan coolers.

This procedure is illustrated in Figure A.3. The final Boolean expression would be either:

9.0

• 10 8

• F for PDB 1B, or 9.0

• 10 8

• F for PDB 1C.

Note that the numerical value in the above equation is the annual frequency of occurrence of this particular sequence of events. By assigning the PDB as illustrated in Figure A.3, the total core melt frequency, initially assumed to be given, does not change. Final PDB expressions as a function of the con-tainment safeguard states are shown in Table A.2.

The determination of the conditional probability in the containment matrix (Ci j) is now described. The containment event tree (CET) is used for quantifying containment failure modes and radionuclide releases. The CET uses as input the plant damage bins (PDBs). In other words, the CET determines the conditional probability of each release category given PDB conditions. These conditional probabilities constitute the containment matrix.

A-8 Each PDB characterizes its own containment environment and thus affects the probabilities of different containment failure modes. The particular con-tainment failure mode affects the time, the energy, and the duration of radio-nuclide release. It also affects the radionuclide release fraction and the warning time.

Instead of using the complete, and complex Oconee-3 PRA CET, a simplified

~

time-phased containment event tree (Figure A.4) is used in this study. Though simplified, it includes major important features which should be considered in the quantification of release categories. One of the features is that the timing of the containment failure is explicitly included. In addition, most of the 17 top events, except those remaining in the simplified CET, have either little contribution to the ' risks or very low probability of occurrence.

Using the CET, the Boolean expression for each release category is given in Table A.3. Six release categories were identified for the Oconee-3 PRA to encompass the differences among plant damage bins and sequences in the con-tainment event tree.

Note that the NOT gate is explicitly used in the Boolean expression.

Since each top event used in the CET may affect another, the rare event approximation is no longer valid. For example, containment isolation (CI) is shown as one of the top events, with successful response being defined as the maintenance of a leakage rate below the technical specification limits. The loss of containment isolation precludes a containment failure by overpressuri-zation. It nay also affect subsequent hydrogen burns. Also earlier hydrogen burns may preclude or significantly reduce the possibility of later hydrogen burns.

Since the failure pressure of the containment in this study varies de-pending on the containment structural capacity, this NOT gate representation is almost imperative in the quantification of each release category. Figure A.5 shows a typical containment pressure history (a small break LOCA with a failure of all containment safeguards, i.e., the containment safeguard state C) and two different containment failure pressures. Quantification of release categories for this particular case is shown in Table A.4. Note that the num-erical values used here are only for the purpose of illustration. Actual numbers must be calculated by the load-capacity model, which will be explained later in this section. While the NOT gate representation shows always correct quantification for each release category, the rare event approximation is no longer valid if the probabilities become higher and also the rare event approximation does not show the dependencies between events.

The quantification of each release category has been done by the load-capacity model . The load is expressed by the resultant internal pressure given the plant damage bin. The internal pressure distributions were adopted from the Oconee-3 PRA calculations and adjusted by the volume change.

The capacity of the containment is the strength to sustain the internal load and can be described by the containment failure probability distribution as a function of pressure. The distribution is assumed to be lognormal with the logarithmic standard deviation of 0.17 which follows the assumptions used

A-9 in the Oconee-3 PRA. The estimation of the median failure pressure is calcu-lated using the thin shell theory of structural rechanics.

The quantification starts with the calculation of the top event probabil-ities by the load-capacity model and then proceeds to the calculation of the conditional probability of each release category given the sequence of events similar to the procedure explained in Table A.4.

A.3.3 Reliability Cost Model One of the three objectives to be optimized is the reliability cost. The cost models used in the study are described in this section.

The reliability cost should be understood as the hardness (or easiness) to achieve a certain level of reliability of the system and/or component, which in turn satisfies given constraints on the undesirable consequences of accidents. The undesirable consequences in this study are given as the ex-pected numbers of acute and latent fatalities due to the radionuclide releases. Therefore, the reliability cost model should reflect both direct and indirect costs to ac.hieve a desired level of reliability.

The two basic reliability cost models used in this study are given by Eqs. (A.5) and (A.6).

b gj=a4 X$ I + c j, and (A.5) g j=a(f-1) j i

+c,j (A.6) where gi = the reliability cost of the system 1, Xi = the reliability of the system i in an appropriate unit, i

aj,bj,ci = constants.

Equation (A.5) is used for the reliability cost calculation of the first two decision variables, As, and R (Table A.1). Equation (A.6) is used for the rest of the decision variables. The numerical values of the constants used are shown in Table A.S.

The function t 3 its constants are determined by considering the following factors:2gpe and

1. Cost is monotonically increasing function of reliability.

2. Cost is very high for a high reliability component.

A-10

3. Constants at are determined by considering current capital cost and associated reliability.

4 If the reliability cost for As changes linearly, then the exponent of Eq. ( A.5) would be 1. The cost of material purchase may increase linearly. However, there would be at least two reasons it would be greater than 1: the higher is the amount of A s, the more steel work is needed. The labor cost for steel work is known to be expensive compared with other labor costs (welding is one of the most expensive labors in nuclear power plant construction). The other cause would be indirect cost due to longer construction time.

5. Since the containment volume increases with R3 , and the surface area increases with R 2 , it is believed that the exponent of Eq. (A.5) for R should be greater than 2. If the containment becomes larger, more ground works and cement works are also necessary.

6. The exponents for the rest of the components are assumed to be 1.0.

ci's are all assumed to be zero.

The total reliability cost G is calculated as a summation of the relia-bility cost of each component, i.e.,

G=[g j (A.7) i Since a certain technology could be used to improve reliabilities of two dif-ferent components, the above equation may be conservative. Other possible types of the reliability cost function are listed in Table A.6.

Since it is hard to determine the exact forms of the cost function, para-metric sensitivity analyses have been done on the above two basic function types given by Eqs. ( A.5) and ( A.6) . The results are given in Appendix III.2 of Ref. 17.

A.3.4 Results and Discussions A new approach, multiobjective optimization, was used to determine lower level containment performance criteria (CPC) given top level safety goals.

The mathematical relationships between the objective functions and the deci-sion variables in the optimization process were provided by the Oconee-3 PRA models and the reliability cost function models, which were described in the previous sections. The direct method l7 'vas used to find the noninferior solu-tion sets (NISS) to this multiobjective optimization problem. The results are shown and discussed in this section.

The noninferior solutions can be examined in three aspects: in objective function space, in decision variable space, and in the release categories.

The noninferior solutions (NISS) in decision variable space and in the release categories can give us some guidelines on how to design containment. From these we can get some insight on the optimum ranges or limits on the decision variables and on the release frequencies. On the other hand, the NISS in the

A-11 objective function space can help in the trade-offs among the objective functions.

The direct method generated 74 noninferior solutions, among which the following solutions are chosen for further examinations (Figure A.6):

S12: S12 has the lowest cost and violates both safety goals (A and L),

S57: S57 violates A but satisfies L with least margin among solutions, S61: S61 satisfies L but exceeds A with smallest margin among solutions, S21: S21 satisfies both L and A. The margin to A is the smallest among solutions, S1: S1 has the lowest acute and latent fatality values and highest cost.

For each of these solutions, Tables A.7 through A.9 show the changes in the reliabilities of decision variables (Table A.7), three objective function values (Table A.7), reliability cost for each decision variable (Table A.8) and the frequencies of release categories (Table A.9). Examination of these tables and figure leads to the following observations:

1. The Oconee-3 risk indices (acute and latent fatalities divided by core melt frequency) are well below the values of proposed safety goals by about two orders of magnitude.

2. Among those five selected solutions for further comparison, S21 sat-isfies safety goals and is the closest one to the Oconee-3 design.

3. Compared with S21, the Oconee-3 design is generally more conservative in every decision variables except the size of the containment repre-sented by R (Containment radius). The strength of the containment is represented by A s (the amount of steel reinforcement). The value of A s for the Oconee-3 is about 2.8 times greater than that of S21. The containment of Oconee-3, therefore, is very strong and con-sequently the release frequencies for overpressurization release cat-egories (RCIA and 1B) are significantly lower than that of S21 (Table A.9).

4. The reliabilities of the containment safeguard systems of the Oconee3 pl ant are higher than that of S?1 (CSSI, CSSR, RHR and F). The Oconee-3 containment also has a lower containment isolation failure ,

probability, and consequently frequencies of RC2 and 3 are lower than that of S21. The containment bypass frequency (V) is also low by an order of magnitude. In general, from these observations, the Oconee3 is over-designed.

5. S12 is the least cost solution. However, acute and latent fatalities are well above the safety goals (by about 4 and 2 order of magnitude, respectively).

A-12

6. S1 is the highest cost and the lowest ac6te and latent fatalities solution (about four orders of magnitude below the safety goals).

7. The highest cost (SI) or the highest public health risks (S12) may reduce the preference toward these two solutions.

8. S21 costs slightly higher than S61. Decreased acute fatalities in S21 are the trade-offs with the increased cost and latent fatalities from S61.

9. S57 would be preferred because of its relatively low cost. It also satisfies the latent fatality safety goal.

10. The increased costs from those of S61 to S21 are mainly spent on As and R whose functions are to increase the structural capacity of the containment with the expense of those costs for spray systems (Table A.8). As a consequence, the frequency of early release (RC- 1A) is e reduced and the frequency of RC2 (release due to isolation failure without spray systems) is increased (Table A.9).

e m

A-13 A

2 N

o A

D , C l

3/

N o E B

7 2

1 Figure A.1 Graphical illustration of noninferiority in an arbitrary feasible region in objective space.16 Ro = feasible region in objective space No = noninferior solutions

i

^ }\

X DECISI0ft SPACE Z OBJECTIVE SPACE 2 2 O

i y Z_ = f(X_) tr d }

l Y

t I

fl P C, ) -

X=f-I(Z)

I i > ,

l x Z 1 3 i

i Figure A.2 Mapping of decision space into objective space.16 1

J s

i CUT SET CMB Containment Safeguards PDB j

I I BSRN F assignment 2-l 4 S*YRBSH*LPSUMPMF*RESUMPMF I success failure failure, F IC h, I=0 BSRN=1 success, F IB

)

i l

1 z

Figure A.3 Illustration of PDB assignment.

i i

A-16 EARLY AT VESSEL LATE VERY RELEASE CATEGORY FAILURE LATE ASSIGrif1ErlT CO CI OP1 HB3 OP2 HB4 OP3 I

RC4 or RCS RC4 RCIB RC1B RCIA RCIA RC2,3 4

]

Figure A.4 Time-phased containment event tree with release category assignments.

l

A-17 150 -

FAILURE PRESSURE 1 (P5d A /s 1

OP OP 1

FAILURE PRESSURE 2

_q----------- ,

2 2 OP OP tC 36 1 2

100 -

SL 2L 50 -

t 1 I I I 0 100 200 300 400 Accident Time (min)

Figure A.5 An example of the containment pressure history and failure pressure.

4

A-18 i

LOG 10(A/ ) LOG 10(L/CM) LOG 10(G) 7.0 -

S12 3.0 -

6.0 - 11.0 -

2.0 -

I 5.0 -

1. 0 -

557 SAFETY

0. 0 -- GOALS 4.0 _ 10 _

561 f S21 j

- 1. 0 - f 3.0 -

i \ /

i g i N

-2. 0 - \ f

\ /

OCONEE\2.0- .0-

\

-3.0 - \

N /

V 1.0 -

-4. 0 -

S1 _

i Figure A,6 Some noninferior solutions.

A-19 Table A.1 Decision Variables Decision Variable Description Function

• Range 1 As(ft2 /ft) Amount of reinforcing C 8 - 32 steel 2 R (ft) Radius C 50 - 100 3 CSSI Unavailability of spray M 10 1.0 system in injection mode 4 CSSR Unavailability of spray M 10 5 - 1.0 system in recirculation mode 5 RHR Unavailability of resid- M 10 1.0 ual heat removal system 6 F Unavailability of fan M 10 1.0 cooler system 7 Cl Probability of contain- C 10 1.0 ment isolation failure 8 V Probability of contain- B 10 0.1 ment bypass Key: C = Capacity, M = Mitigation, B = Bypass

A-20 Table A.2 Boolean Expression for PDBs PDB Boolean Expression

• IA (4.71-7) F

• BSRC + (1.12-6) F

• RHR

• I + (2.80-7)

F

• T + (1.91-7) F

• BSRN IB (1.91-7) F

• I

• BSRN + (1.35-6) F

• I * (5.36-6) F IC (1.91-7) F

• I

• BSRN + (5.36-6) F + (1.20-8) I

+ (1.35-6) F

• I + (7.71-7)

ID (1.12-6) F

• I IE (1.91-7) F

• BSRN

• BSRC + (1.40-6) F

• T

• BSRC

+ (1.20-8) T IIB (1.10-6) F + (1.01-6) F

• BSRN IIC (1.10-6) F + (1.01-6) F

• BSRN IID (1.01-6) 7

• BSRN IIIA (1.46-5) F

• I

• BSRC + (8.76-6) I

• BSRC IIIB (1.46-5) T

• I IIIC (1.46-5) F

• I + (1.46-5) I + (5.50-8) 1110 (1.46-5) F

• I IIIE (1.46-5) F

• I

• BSRC + (8.76-6) I

• BSRC + (5.87-6) I IVB (1.92-7) 7 IVC (1.92-7) F IVO (1.0-15)

VA (3.10-6) F

• I + (3.10-6) F

• BSRC VB (4.40-8) F + (3.10-6) F

• BSRC VC (3.10-6) F

• I + (4.40-8) F VE (3.10-6) F

• T

• BSRC VIA (4.80-6) F

• BSRC + (4.80-6) F

• BSRN VIB (4.80-6) F

• BSRN + (4.76-6) F VIC (4.80-6) F

• BSRN + (4.76-6) F + (1.30-8)

VIE (4.80-6) F

• BSRN

• BSRC

• Key: F, failure of 3 of 3 fans, I, failure of 2 of 2 spray trains to deliver water to containment in the injection mode; BSRN, failure of 2 of 2 spray trains in the recirculation mode; BSRC, failure of RHR sys-tem to cool spray water during spray operation in the recirculation mode.

NOTE: (4.71-7) = 4.71 x 10-7

A-21 Table A.3 Boolean Expression for Release Categories Release Category Boolean Expression RC 1A (1-CI) [0P1 + (1-0P1) HB3]

RC IB (1-CI) (1-0P1) (1-HB3) [0P2 + (1-0P2) HB4]

RC 2 CI + V RC 3 CI RC 4 (1-CI) (1-0P1) (1-HB3) (1-0P2) (1-HB4)

RC 5 (1-CI) (1-0P1) (1-HB3) (1-0P2)

(1-HB4) (1-0P3)

A-22 Table A.4 Quantification of Release Categories for the Case of Figure A.5 l* 2**

RC Bcolean P P 1A (1-CI) (1-0P1) OP2 0.0392 0.3564 1B (1-CI) OP1 0.0099 0.099 NOT 2 CI 0.01 0.01 gate 3 0 0 0 4 (1-CI) (1-0P1) (1-0P2) 0.9409 0.534 5 0 0 0 SUM 1 1 1 Rare 1A OP2 0.04 0.4 Event IB OP1 0.01 0.1 App. 2 CI 0.01 0.01 3 0 0 j 0 4 1 1 1 5 0 0 0 SUM 1.06 1.51

• 0Pli = 0.01, OP23 = 0.04, CI = 0.01.

• • 0P12 = 0.1, OP22 = 0.4, CI = 0.01.

NOTE: The numerical values are used only for the purpose of illustration.

A-23  :

l l

Table A.5 Nominal Values of the Constants of the Reliability Cost Functions

-No. System Cost Function a b c b

1 A s

aX +c 1.2 x 10 6 2 0 b

2 R AX +c 2.9 x 10 2 3 0 3 CSSI a(hl)b+c 5 x 10" 1 0 4 CSSR a(hl)+c 1 x 10 7 1 0 5 RHR a(hl)+c 5 x 10" 1 0 4

6 F 10 0 a(hl)b+ 1 1 7 CI a(hl)b+c 5 x 10 4 1 0 8 V a(hl)b+c 1.0 1 0

A-24 Table A.6 Possible Reliability Cost Function Types No. Functions 1 ag EXP(1/X i) ,

2 ag TAN (2(1-X 4

)) + b$

3 a j( - 1) + b $

a 4 109( )

x 3

5 -X a

4 6 +b Xg-X9 a

4 7 7 + b; i

X 8 )

a$ EXP (- i 9 a j( - 1) + b 4 10 aX bj j4 4

Table A.7 The Values of Decision Variables S12 S57 561 S21 S1 Oconee-3 Ratio

• A 8.79 9.81 8.44 9.68 30.62 27.5 3.63 R 55.21 59.94 85.55 87.90 84.95 61.0 1.59 CSSI 4.44-2 4.07-2 1.08-2 5.21-2 2.13-2 1.0-3 4.82 CSSR 9.82-1 5.28-1 3.45-1 4.80-1 4.99-2 1.0-1 19.7 RHR 1.02-2 7.39-3 6.04-2 1.43-2 9.80-2 1.0-3 13.3 F 2.97-2 2.82-2 1.19-1 1.54-2 1.48-6 1.0-3 4.01 CI 3.58-2 5.58-1 2.12-2 1.08-2 1.14-5 3.0-3 4.89+4 3 V 8.30-2 4.81-4 3.46-8 8.90-6 1.08-10 1.4-7 7.69+8 $

A/CM 8.04+3 7.21+1 1.93 1.05 2.51-5 0.05 3.20+8 L/CM 2.0R+6 1.35+4 1.1R+2 2.41+2 2.83 21.0 7.35+5 G 1.50+3 1.95+8 3.24+8 3.31+8 2.19+10 9.28+9 1.46+2

• RATIO = largest smallest I

A-26 Table A.8 Reliability Costs S12 S57 S61 S21 S1 A 9.26+7 1.15+8 8.55+7 1.13+8 1.13+9 s

R 4.92+7 6.29+7 1.83+8 1.98+8 1.79+8 CSSI 1.08+6 1.18+6 4.57+6 9.09+5 2.29+6 l CSSR 1.79+5 8.96+6 1.90+7 1.08+7 1.91+8 RHR 4.86+6 6.72+6 7.78+5 3.44+6 4.60+5 F 3.26+5 3.45+5 7.39+4 6.37+5 6.78+9 Cl 1.35+6 3.95+4 2.31+6 4.59+6 4.38+9 V 1.10+1 2.08+3 2.89+7 1.12+5 9.24+9

" " " w -- - - . ., o%---eea ww< , y. - <- -+,---y-.e- -+--y-y-----+-+-_.-um+4 --

y- - 9

Table A.9 Release Category Frequencies Release Categories S12 S57 S61 S21 S1 Oconee-3 i RC 1A 5.03-5 2.16-5 1.65-5 1.50-7 7.3-21 5.64-9 9

RC IB 6.87-8 1.28-6 1.95-6 2.87-7 2.43-16 8.74-8 RC 2 8.30-2 4.90-4 3.47-7 9.08-6 2.61-10 6.81-7 1

RC 3 1.16-6 1.97-5 7.93-7 3.79-7 4.42-10 1.92-7 RC 4 4.22-12 8.10-9 1.23-5 1.65-5 1.34-5 1.37-5 RC 5 1.81-10 1.19-7 3.52-5 3.47-5 3.87-5 3.86-5 Y

Z

,