ML20247D919
| ML20247D919 | |
| Person / Time | |
|---|---|
| Issue date: | 06/30/1989 |
| From: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | |
| References | |
| NUREG-1150, NUREG-1150-DRFT, NUREG-1150-V02-DRFT, NUREG-1150-V2-DRFT, NUDOCS 8907250337 | |
| Download: ML20247D919 (310) | |
Text
{{#Wiki_filter:. . NUREG-1150 Vol. 2 l l Severe Accicen~: Risis: An Assessment for Five U.S. Nuclear Power Pian ~:s Appendices Second Draft for Peer Review ) Formerly entitled " Reactor Risk Reference Document" U.S. Nuclear Regulatory Commission Office of Nuclear Regu.. :ary Research on atcoq 5 aj
%,...../
F18!!! 1150 R S'" PDR
e- , AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be availab!e from one of the following sources:
- 1. The NRC Public Document Room, 2120 L Street, NW, Lower Level, V!ashington, DC 20555
- 2. The Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7082
- 3. The National Technical information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publica-tions, it is not intended to be exhaustive.
Referenced documents available for inspection and copying for a fee from the NRC Public Document Room includo NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investi-gation noticest Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence. The following documents in the NUREG series are available for purchase from the GPO Sales Program; formal NRC staff and contractor reports, NRC-sponsored conference proceed-ings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regula-tions in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances. Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission. Documents available from public and special technical libraries inoltde all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries. Documents such es theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited. Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Information Resources Management. Distribution Section, U.S. Nuclear Regulatory Commission, Washington, DC 20555. Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copy-righted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018.
NUREG-1150 Vol. 2 Severe Accident Ri'sks: An Assessment for Five U.S. Nuclear Power Plants Appendices Second Draft for Peer Review Formerly entitled " Reactor Risk Reference Document" Manuscript Completed: May 1989 Date Published: June 1989 i l l l Division of Systems Research Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 l l u
,P* *'a
..... 1 i
i l l 1 i _ - _ - i
APPENDIX A RISK ANALYSIS METHODS i J I J
CONTENTS Page A.1 Introduction and Overview . ........... ... ... ...... ........ ..... .... . A-1 A.1.1 Introduction . ...... .......... . . ....... .. ... ....... .. . . A- 1 A.1.2 Oveniew of the Risk Analysis Process . . . . . . . . . . . .. . . ................. .. A-1 A.2 Accident Frequency Analysis Methods . . ... ................... ...... . ......A-6 A.2.1 Internal-Event Methods for Surry, Sequoyah, Peach Bottom. and Grand Gulf . . . A-6 A.2.2 Internal-Event Methods for Zion . . . . .. .. .... .. .... ....... .. . A-13 A.2.3 External-Event Methods for Surry and Peach Bottom . . .. . ... ...... .. A-17 A 2.4 Products of Accident Frequen.'y Analysis . . . . . ..... .......... . .... A-22 A.3 Accident Progression. Containment Loadings, and Structural Response Analysis . . . ... A-24 A .3.1 Introduction . .. ..... .... ...... . ..... ... . ... . .... . ... A-24 A.3.2 Development of Accident Pro'iression Event Trees . . ............. .... .... A-26 A.3.3 Structural Analysis . ... ... ....... . ....... . ......... ......... A-29 A.3.4 Probabilistic Quantification of APETs . ......... . ......... ...... . ... A-29 A.3.5 Grouping of Event Tree Outcomes . . . .... . .. ... ............ . .. A-29 A.3.6 Products of Accident Progression Analysis ...... .. . . ........ ...... A-29 A.4 Radioactive Material Transport (Source Term) Analysis . . . . . . . . . . .... . .. ... A-30 A.4.1 Introduction . .. .. . . . .. .... ... ... . .... A-30 A.4.2 Deve'opment of Parametric Models ... .. .... ......... ...... .... A-30 A.4.3 Development of Values or Probability Distributions . ... . . ... ... . . . . A-35 A.4.4 Grouping of Radioactive Releases . . . . ....... .... .... .. .. A-35 A.4.5 Products of Source Term Analysis . . . . .... . .. .. . . . . . A-35 A.5 Offsite Consequence Analysis . . . .. . .... . . . .... . . .. A-38 A.5.1 Introduction .. . . .... .. . . . . ..... ...... .. . A-38 A.5.2 Assessment of Pre-Accident Inventories . . .... ... .. .. .. ... ... A-38 A.5.3 Transport. Dispersion. and Deposition of Radioactive Material . . ... . .. . A-39 A.5.4 Calculation of Doses . . .... .. ... .. . . ..... .. A-39 A.5.5 Mitigation of Doses by Emergency Response Actions . . . .. ..... .... . A-40 A.S.6 Health Effects Modeling .. .. . . . .... ... ... . . . A-40 A.5.7 Products of Offsite Consequence Analysis . . . . . . ... A-41 1 A.6 Characterization and Combination of Uncertainties . .. .. . ..... .. . . A-41 A7 Elicitation of Experts . . . .... ... . . . . . .. . . ...... . . A- 15 A.8 Calculation of Risk . . . . ... .. . . . . . . . ... .. .. A-48 A.8.1 Methods for Calculation of Risk . . . . . .. . . .. .. A-48 A.8.2 Products of Risk Calculation . . .. . ..... .. .. A-50 A.9 Additional Explanation of Some Figures. Tables, and Terms . .. .. , A-50 A.9.1 Additional Explanation of Some Figures cnd Tables . . . . ... A-50 A.9.2 Explanation of Some Terms . . . .. A-54
- iis- NUREG-1150
l REFERENCES FOR APPENDIX A . . . . . ........................ .... ... ... ..... A-56 1 LIST 0F FIGURES A.1 Principal steps in NUREG-1150 risk analysis process. ... .......................A-2 A.2 Interfaces between risk analysis steps. ... . . ..... ............. . . . . . . . . . . . . A- 4 A.3 Models used in calculation of risk. ..........................................A-7 A.4 Steps in accident frequency analysis of Surry Sequoyah, Peach Bottom, and Grand G ulf. .. .. .. . ......... ...................... ... ...................A-8 A.5 Zion Probabilistic Safety Study master logic diagram. . . . . . . . . . . . . . ...............A-15 A.6 Example display of core damage frequency distribution. . . . . . . . . . . . . . . . ... ....... A-23 A.7 Example display of mean plant damage state frequencies. . . . . . . . . . . . ............. A-25 A.8 Schematic of accident progression event tree. . . . . . . . . . . . . . ......... ...... .. A-28 A9 Example display of early containment failure probability distribution. . . . .. .. .. .... A-31 A.10 Example display of mean accident progression bin conditional probabilities. . . . . . . . . . A-32 A.11 Simplified schematic of source term (XSOR) algorithm. . . . . . . . . . . . . . . . . . . . . . . . . . . A- 3 4 A.12 Example display of radioactive release distributions for selected accident progression bin. .. ........ .. . .............. ............ .......... . ..........A-36 A.13 Example display of source term complementary cumulative distribution function. . . . . . . A-37 A.14 Example display of offsite consequences complementary cumulative distribution function. . . ... .... .... . ... . ... ..... . .. ............ .... A-42 A.15 Principal steps in expert elicitation p ocess. . . .............. . . . . . . . . . . . . . . . . . A-4 6 A.16 Matrix formulation of risk arelysis calculation. .. . . .. ........... . . . . . . A-4 9 A.17 Example display of relative contributions to mean risk . .... ... . ........ . .. . A-51 A.13 Probability that f(PDSI) will fall in interval I m . . . . . .. ....... ..... .. ... . A-53 1 1 1 1 TABLE A.1 Issues considered by expert panels. .. ...... . . . ... ... ... ... A-4 3, l 1 l l l 1 1 1 NUREG-1150 - iv - i l L_.____.___. - -- -
Appendix A A.1 Introduction and Overview A.I.1 Introduction This appendix provides an overview of the NUREG-1150 risk analysis process, describing the different steps in the calculational process and the interrelationships among steps. This summary has been written for a reader familiar with risk analysis but does not discuss the subtleties and complexities of the methods used to perform the various analysis steps, The reader seeking a more comprehensive discussion is di-rected to References A.1 and A.2. The analysis methods used in NUREG-1150 were selected or developed to satisfy some special objectives of the project. In particular, the following were important considerations in the selection on methods: e The need to perform quantitative uncertainty analyses (considering both data and modeling uncer-tainties) as part of the calculations; e The need to make explicit use of the data base of severe accident experimental and calculational information generated by NRC's contractors and the nuclear industry, which resulted in the develop-ment of more detailed accident progression analysis models and the use of formal methods for elicit-ing expert judgment; e The ability to readily assess the impact of postulated modifications to the studied plants; e The ability to calculate and display intermediate results and a detailed breakdown of tha risk results, providing traceability throughout the computations; and e Computational pract cality. The selection of the methods also benefited from experience obtained in conducting the analyses pre-sented in the draft versions of NUREG-1150 (Ref. A.3) and supporting contractor reports (Refs. A.4, A.5, and A.6), and the reviews of these reports (Refs. A.7, A.8, and A.9). The remainder of this appendix discusses the individual steps in the NUREG-1150 risk analysis process. Section A.1.2 provides an overview cf the process, while Sections A.2 through A.8 describe individual steps in greater detail. Section A.2 contains separate discussion of the methods used in the accident frequency analysis of L,ternal events for the Surry, Sequoyah, Peach Bottom, and Grand Gulf plants; the internal-event analysis for the Zion plant; and the external-event analysis for the Surry ar'd Peach Bottom plants. Since the accident progression, source term, and offsite consequence analysis methods did not significantly differ among the plants or for internal and external events, the discussions in Sections A.3 through A.8 are applicable to all five plants and for both internally and externally initiated accidents. As noted above, the risk analyses of NUREG-1150 included the performance of quantitative uncertainty analysis, considering both data and modeling uncertainties. Section A.6 discusses how this uncertainty analysis was introduced and applied in the NUREG-1150 risk analyses. The methods by which expert judgrr.ents were obtained for use in the risk analyses are discussed in Section A.7. l The remaining sections of this appendix have been extracted from the contractor reports underlying NUREG-1150. Some editorial modifications have been made to improve the flow of the text. A.I.2 Overview of the Risk Analysis Process
- The risk analyses, performed in NUREG-1150 have five principal steps (as shown in Figure A.1): (1)ac-cident frequency (systerns) analysis; (2) accident progremion, containment loadings, and structural "This section adapted, with editorial modihcation, from Chapter 2 of Rcierence A.2. t l
A-1 NUREG-1150
Appendix A f
/
Accident Frequencies l
, Plant Damage States
/
Accident Progression, Containment Loadings, and Structural Response f Accident Progression Bins Transport of Radioactive Material
/
Source Term Groups 1 l Offsite Consequences
/
, , Consequence Measures
/
/
Risk Integration
)
Figure A.1 Principal steps in NUREG-1150 risk analysis process, NUREG-1150 A-2
Appendix A response analysis; (3) radioactive material transport (source term) analysis; and (4) offsite consequence analysis. A fifth analysis part, risk calculation, combines and analyzes the information from the previous four steps. The transfer of information between analysis steps is critical; thus three interfaces are illustrated in Figure A.2. Each distinct continuous line that can be followed from the left of the illustration to the box marked
" Risk Calculation" corresponds to a distinct group of accidents with a particular set of characteristics in each analysis step. Each of the analysis steps produces results that are useful for understanding the plant's response to that stage or aspect of the accident, and each part also provides an ingredient necessary to the calculation of overall risk.
Each of the analysis steps is supported by a variety of information sources and supporting analyses. An ideal study might use comprehensive mechanistic models to calculate the entire sequence of events leading to core damagc, release of radioactive material, and exposure to the public for each pouible accident. However, a large variety of accidents will be possible because there are a variety of initiating events and because " random" events occurring during the accident can change the progress of the accident. It is presently neither practical (too many possible accidents to follow) nor possible (mechanistic models do not exist for many parts of the process) to conduct such a study. As such, PRAs have relied on the use of a variety of simple models and calculational tools to substitute where integrated mechanistic calculations were not available. Soma of the tools assemble vesults from several existing mechanistic calculations to yield a more comprehensive result. Other models provide simplified mechanistic models with as rnuch of the detailed analysis as possible but which are able to efficiently calculate resuhs for the wide range of conditions needed to examine the set of possible accidents. The accident frequency analyses identify the combination of events that can lead to core damage and estimate their frequency of occurrences. Potential accident initiating events (including external events for two plants) were examined and grouped according to the subsequent plc ~ response required. Once these f groups were established, accident sequence event trees were developed that detailed the relationships among systems required to respond to the initiating event in terms of potential system successes and , I failures. The front-line systems in the event trees, and the related support systems, were modeled with fault trees or Boolean logic expressic .ns as required. The core damage sequence analysis was accomplished by appropriate Boolean reduction of the fault trees in the system combinations (the accident sequences) specified by the event trees. This Boolean reduction providos the logical combinations of failures (the cut sets) that can lead to core damage. Once the important failure events are identified, probabilities are assigned to each event and the accident sequences are quantified. Variations in these probabilities are explicitly considered in an ur ertainty analysis using a structured Monte Carlo approach. The NU. REG-1150 accident frequency analyses have the following products:
. The total core damage frequency from internal events and, where estimated, for extonal events; e The definitions and estimated frequencies of plant damage states; and e The definitions and estimated frequencies of accident sequences.
l Importance measures, including risk redt; tion, risk achievement, and uncertainty measures, have also l been assessed in NUREG-ll50 accident frequency analyses. I The accident progression, containment loadings, and structural response analysis investi gated the physical processes affecting the core after an initiating event occurs. In addition, this part of the analysis tracked the impact of the accident progression on the containment building. The principal tool used in NUREG-1150 for delineating and characterizing the possible scenarios in this study was the accident progression event tree. The event tree is a computational tool used to assernble a large variety of analysis results and data to yield a comprehensive result (in terms of the characteristics of alternative failure modes of the containment bui ding and related probabilities) for each of the many accidents. The event tree is particularly suited for the study of processes that are not completely understood, permitting the study of A-3 NUREG-1150
io t kl a isu Rl ca C e . c n e ui s
. i qs S ey C sa l C
A
.:::~ SBG DP T n n M PAS CoA i i n nn
= ==
** +
1 +
- G G :
y T .:::T e S S K mr es i
- i '
Ts y R el O ca S .:::- rn X uA o i i ' i S 1 2 3
- B B B B P P P .:: P n A A A .
A i o , j s I I st en re g n or ns mis oe ise t Piy n sr t t a al eet -r' _Z nn n c o e - drt ign I I - _ dCeoA Ape cr v - - -- _ i c - c& A e c d a 1 2-
- e S S S t D D :
,;::D n P P P ss !
mis ey tl sa yn SA 2CEa l
$ >E l
Appendix A alternative phenomenological models. The output of the accident progression event tree (APET) was a listing of numerous different outcomes of the accident progression. As illustrated in Figure A.2, these outcomes were grouped into accident progression bins (APBs) that, analog As to plant damage states, allow the collection of outcomes into groups that are similar in terms of the characteristics that are impor-tant to the next stage of the analysis, in this case source term estimation. Once the APET is constructed, the probabilities of the paths through the APET were evaluated by a computational tool, EVNTRE. EVNTRE also perform: the function of grouping similar outcomes into bins. The accidents that are grouped into a single bin are similar enough in terms of timing, energy, and other characteristics that a single source term estimate suffices for estimating the radiologicalimpact of any of the individual accidents within that bin. The qualitative product of the containment loadings analysis is a set of accident progression bins, Each bin consists of a set of event tree outcomes (with associated probabilities) that have a similar effect on the subsequent portion of the risk analysis, analysis of radioactive material transport. Quantitatively, the prod . uct consist oi a matrix of conditional failure probabilities, with one probability for each combination of plant damage state and accident progression bin. These probabilities are in the form of probability distri-butions, reRecting the uncertainties in accident pro: esses. The next step in the risk calculation was the source term analysis. Once again a relatively simple model was developed to allow consideration of alternative inputs and the at embly of information from m:ny sources. In this study, a plant-specific model was developed for each of the plants, with the suffix SOR built into the code name (shown as XSOR in Fig. A.2). For example, SURSOR is the source term model for the Surry plant. The results of the source term analysis were release fractions for groups of chemically similar radionuclides for each accident progression bin. As with the previous analyses, a large number of results were calculated, too many for direct transfer to the next part. The interface in this case is accom-plished through the calculation of " partitioned" source term groups. The large number of XSOR results are assessed and grouped in terms of their important parameters (i.e., early health threat poterrial and latent health threat potential) and by similarity of accident progression as it affects warning times to the surrounding population. The product of this step in the NUREG-1150 risk analysis was the estimate of the radioactive release magnitude (in the form of a probability distribution) with associated energy content, time, and duration of release for each of the specified accident progression bins. The offsite consequence analysis in this study was performed with the MACCS (MELCOR Accident Consequence Code Sptem) computer code, Version 1.5 (Ref. A.10). This code has been developed as a replacement for the CRAC2 code (Ref. A.11), which had previously been used by NRC and others to estimate consequences for nuclear power plant risk analyses and other studies. The MACCS calculations were performed for each of the partitioned source terms defined in the previous step. The procluct of this part of the analysis is a set of offsite consequence measures for each source term group. For NUREG-1150, the specific consequence measures discussed include early fatalities, latent cancer fatalities, population dose (within 50 miles and total), and two measures for comparison with NRC's safety goals (average individual early fatality probability within 1 mile and average individuallatent fatality probability within 10 miles) (Ref. A.12). The final stage of the risk analysis was the assemb?y of the outputs of the first four steps into an expression l of risk. As shown in Figure A.2, the calculation of rOk can be written in terms of the outputs of the individual steps in the analyses: Riskin = I IhI Ef In(IE f k ) Pn(IEh 3 - PDSj) Pn(PDSj - APBj) Pn(APBj -+ STG k) Cfk where: Riskin = Risk of consequence measur. ! for observation n (consequences / year); A-5 NUREG-1150
~
i 1 l Appendix A I i fn(IEh) = Frequency (per year) of initiating event h for observation n; Pn(IE3* PDSj) = Conditional probability that initiating event h will lead to plant damage state / for observation n; Pn(PDSj
- APBj) = Conditional probability that PDSj wi'.1 lead to accident progression bin j for obser-vation n; Pn(APBj
- STGr) = Conditional probability that accident progression bin J willlead to source term group k for observation n; and Cjk = Expected va!ue of consequence measure i conditional on the occurrence of source term group k.
In considering this equation, the reader should note that the frequency and probabilities noted are in the form of distributions, rather than single-valued. A specialized Monte Carlo (Latin hypercube sampling) technique is used to generate these distributions (Ref. A.13). As discussed in Section A.5, however, the consequence values used were expected values, reflecting variability in meteorology only. Because of the large information harading requirements of all these analysis steps, computer codes have been used to manipulate the data. Figure A.3 illustrates the computer codes used in the risk assembly process in this study. The purpose of each of these codes will be discussed in the following sections. A.2 Accident Frequency Analysis Methods A.2.1 Internal-Event Methods for Surry, Sequoyah Peach Bottom, and Grand Gulf
- The accident frequency analysis for the Surry, Sequoyah, Peach Bottom, and Grand Gulf plants consisted of 10 principal tasks. These are illustrated in Figure A.4. This section briefly discusses each major task and the interrelationships among tasks. These tasks are discussed in greater detail in Reference A.1.
The level of detail for each task is also discussed below. For simplicity, the level of detail is described as: (1) advanced relative to the state of the art; (2) state of the art; (3) slightly abbreviated; or (4) abbrevi-ated. For purposes of this discussion, a " state of the art" accident frequency analysis is defined as one similar in level of detail to PRAs of the early to mid-1980's (e.g., Ref. A.14). Methods that have been developed, but not yet in widespread use, are considered to be advanced relative to the state of the art. The principal steps in the accident frequency analysis of the Surry, Sequoyah, Peach Bottom, and Grand Gulf plants were: l e Pfar.t iaruiliarization analysis, e Accident sequence initiating events analysis, e Accident sequence event tree analysis, e Systems analysis, e Dependent and subtle failure analysis, o Human reliability analysis, e Data base analysis, e Accident sequence quantification analysis, l l
'This section extracted, with editorial modification, from Chapter 1 of Reference A.I.
1 NUREG-1150 A-6
\
i 1
C t N p n s p d u e su e m E S s e o rs d ino c r r UI eea t N gc ci r snote QS dclru O i c bg S eef E Y t tu uc I ms a n C i t u S A L iol T I rrdf i om C i l qes cp e r u n ar T , eenoir i
'ber gls c R tt a se A su u o a ns NN e c gst M orI O
al s A cra ne ec b oa sg C A Ma m P o ir f r a pgr r ceh o er t uh oc pou a r o Pfo mca k i S mp s e i s o R t
=
s ) M e k R dn Gl E l uo t t i T TIS s i n at n gmn S ( E S n o c areb i C C Y ) i t t mfiod n i L ns s R k RA e i r O nc o G UN idc9hs ec t S X mici re as s T S OA S A' c0 a r tesa he cr j 4 P a eeag B h c cl r e eo P A u r r r ( l odoP Sn f P a )j E B U N n P Q O o n A4 S TI S i s o I NSI s e i t s s n Si R E SS r T el a D D RLEY ge oer E N sgrpe e t P ( I CGA P r t R T V ioha rcs t i P t E t i pa )I CON N l l tn T S A RA ne V S lbt i a nr eeg D P de ev E P beo a P i c o df m
- P ccnd sa r i h
c I E A i I ( f ab P o h E l i f k S S I e f oe z MS j g s g r de s sa a EY n el n C e i r TL are S mio A im h SA lt t d T aes t M cas nde I YN un aem t o E dst n eur e E l e t at S T u nt SA _ Fv r cp qas _ e o x el C e rp F
>* 2Emo
N S I T T. r 1 OgsA R t h T..!. P- E E R R N E OY I T
~ RETAIN OG CA CAI T LMF R n.
AATE I
. NDNC I
F AN UU O
. +
. M .
A S TI T SS N E Y. . S I A L L A L J S P N A . Y-TS n Y NILSI L AI Y A MB L
. UlAA N
. +
HlN E A L J A R N t.
. N O
i O I E TI C A N EC
] T A
Z I U F R I
. QT E N L A
S A J.- - I U . L O L. I J. M 5 . S A F I AES T4 Y
. . A A L A T DBA N N A A
. . L
. S I
P S. T F S N EES Y F ERL VTA ,. L E N . - A A N N. . .
. T w
A . N S I E. . E S C N. E
+
DNY N E PAN L A SS U. . EF A uS I O . D r EY TL E' G S . i SA S NT S I I YN TN Y I sA N . AEL . _ E. T EN I I VA D . IN A . O .
+
_ C . A . y
; a':* j ;..!
Zc:o moi E > i
Appendix A e Plant damage state analysis, and e Uncertainty analysis. Each of these steps will be discussed below. Plant Familiarization Analysis The initial task of this analysis was to develop familiarity with the plant, forming the foundation for the development of plant models in subsequent tasks. Information was assembled using such sources as the Final Safety Analysis Report, piping and instrumentation diagrams, technical specifications, operating procedures, and maintenance records, as well as a plant site visit to inspect the facility and clarify and gather information from plant personnel. One week was spent in the initial plant visit. Regular contact was maintained with the plant staff throughout the course of the study. The analyses discussed in NUREG-1150 reflect each plant's status as of approximately March 1988. The level of detaliin this task was slightly abbreviated relative to the state of the art, in that plant personnel were not directly members of the analysis staff. At the conclusion of the initial plant visit, much of the information required to perform the remaining tasks had been collected and discussed in some detail with utility personnel so that the analysis team was familiar with the design and operation of the plant. Subsequent plant contacts were used to verify the information obtained and to identify plant changes that occurred during the analysis. Accident Sequence Initiating Event Analysis The next task was to identify potentially important initiating events and determine the plant systems re-quired to respond to these events. Initiating events of importance were generally those that led to a need for suberiticality and removal of decay heat by plant safety sysems. This analysis included several steps: e identification of initiating events to be included in the analysis by review of previous PRAs and plant data, including review of unusual or unique events that might have affec'.ed the specific plant;
- Identification of functions required to successfully prevent core damage by review of plant design and operational information; i
e loendrication of the " front-line" systems (e.g., eme,rgency core cooling systems) performing the l above functions by review of plant design and operational information; j
)
e Identification of the support systems (e.g., ac power, component cooling water) necessary for opera- ] tion of the front-line systems by review of plant design and operational information; J e Delineation of success criteria for each front-line system responding to each initiating event by review of available data and performance of additional calculations (e.g., as described in Ref. A.15); and j e Grouping of initiating events, based on similarity of system response. l The level of detailin this task was state of the art. At the conclusion of this task, the number and type of ; event trees to be constructed and the systems to be modeled had been identified. Thus, the scope of the 1 modeling effort in subsequent tasks was defined. l Accident Sequence Event Tree Analysis in this task, accident sequences leading to core damage were defined by constructing event trees for each ( initiating event group. In general, separate event trees were constructed for each group. l System event trees that included the systems responding to each initiating event group as defined in the ) accident sequence initiating event analysis were constructed. The event tree structure reflected system A-9 NUREG-1150
.__o
Appendin A interrelationships and aspects of accident phenomenology that determined whether or not the sequences led to core damage. Phenomenological information needed to construct these trees war obtained from the staff involved in the accident progression and containment loadings analysis. The level of detailin this task was advanced over the state of the art typically seen in Level 1 PRAs. At the conclusion of this task, models that identified all those accident sequences to be assessed in the accident sequence quantification analysis *ask had been constructed. Systems Analysis In order to estimate accident sequence frequencies, the success and failure probabilities must be deter-mined for each question (or " top event") on the synem event trees. Thus, the important contributors to failure of each system must be identified and quantified. The models used to facilitate this quantification were system fault trees. A fault tree represents the ways in which a certain undesired event may occur. Although the event tree questions were usually phrased in terms of system success, the fault tree top events were formulated in terms of system failure. With this transformation in mind, fault trees were constructed that reflected the success criteria specified in the three previous tasks. Each success criterion was transformed into a failure criterion that was developed for all the front-line systems included in the event trees. If these front-line systems depended on support systems, such as electric power or service water, then models were also developed for those systems. In a subsequent task, the support system trees were merged with the respective front-line system fau!t trees to describe the ways, including support system faults, that the undesired event may occur. Thus support system dependencies were included systemati-cally and automatically in the quantification process. This task interfaced with the human reliability, dependent and subtle failure, and data base analyses. Human errors associated with test and maintenance activities and certai , responses to ar;d recovery from accident situations were modeled directly in the fault trees. Dependent and subtle failures as a result of system interdependencies and component common-cause failures were also directly mdeled. The fault trees were developed to a levet of detail consistent with the data base used for q%..ying failure prob-abilities. The effort in this task ranged from state of the art to abbreviated, depending on what system was mod-eled. Typically, in prior systems analyses, each system is modeled in detail, that is, all failure modes and components are examined. The majority of the models in this study were detailed fault trees. These were supplemented with a few simplified fault trees, Boolean equatinns, or black box models (event probabili-ties or failure rates), based on guidelines that considered such things as the relative importance of the system, complex % of the system, dominant failure modes, availability of data, etc. Selection of the level of modeling detail for each system was one of the most important steps in the analysis and did, to a great extent, determine the amount of effort required to complete the accident frequency analys;s. All the front-line fluid systems required detailed fault trees, as did a few critical support systems. The outputs of l this task were models for each event found in the event trees. Dependent and Subtle Failure Analysis Nuclear power plants are sufficiently complex that dependent and subtle failures can be of significant importance in estimating the core damage frequency. Failures that are buried in the depths of the design and operation of the plant are often not easily identifiable. Dependent and subtle failures were categorized separately because they are very distinct types of failures. j The dependent failures included: e Direct functional dependencies that involve initiators, support systems, and shared equipment; and e Common-cause faults involving miscalibration, mismaintenance, and other failures that can affect multiple components. The subtle failures included:
)
NUREG-1150 A-10
Appendix A e Peculiar or unusual interactions of system design and interfaces, or system component operation; and e Subtle interactions identified in previous studies and PRAs or by PRA experts. The dependent failures were identified in the analysis process. When the subtle failures were identified they were added to the sequence event trees or fault trees, as appropriate. In rare cases, such events were modeled by changes to failure data or the cut-set expressions. The level of detailin this task was advanced over the state of the art. A significant effort was rr.ade to identify, model, ano @ntify dependent failures. Iluman Reliability Analysis This task involved the analysis of two types of potential human errors: (1) pre-accident errors, including miscalibrations of equipment or failure to restore equipment to operability following test and maintenance, and (2) post-accident errors, including failure to diagnose and respond appropriately to accidents. In the evaluation of pre-accident faults, test and maintenance procedures and practices were reviewed for each front-line and support system. The evaluation included the identification of components removed from service during the activity but which could potentially have been erroneously left in an inoperable state following the activity. For po.st-accident fauhs, procedures expected to be followed in responding to acci-dents modeled in the event trees were identified and reviewed for possible sources of human errors that could have affected the operability or function of responding systems. In order to support eventual se-quence quantification, estimates were produced for human error rates. In generating these estimates, screening values were used for initial calculations. For human errors expected to be significant in the analysis, nominal human error probabilities were evaluated using THERP techniques (Ref. A.16) and reflecting plant-specific characteristics. The level of detail in this task (both pre- and post-accident) ranged from state of the art to abbreviated. For the boiling water reactor (BWR) plants in NUREG-1150, a detailed human reliability analysis (HRA) was performed on the post-accident human faults for the anticipated transient wit'iout scram (ATWS) sequences (Ref. A.17). For the other BWR sequences, and for all the sequences for he pressurized water reactors, the screening procedure was used for post-accident faults. In this method, i n HRA specialist was present during the plant visit, interviewing operators and emphasizing the sequences and procedures most important to the analysis. The screening procedure was conservative; however, an) operator actions that yielded significant accident sequence results were identified and reassessed. Data Base Analysis This task involved the devel pment of a data base for quantifying initiating event frequencies and basic event probabilities (other than human errors) that appeared in the system fault trees. A generic data base representing typical initiating event frequencies as well as plant component failure rates and their uncer-tainties was developed. Data for the plant being analyzed, however, may have differed significantly from industrywide data. In this task, the operating history of the plant was reviewed to develop plant-specific initiating event frequencies and to determine whether any plant components had unusually high or low failure rates. Test and maintenance practices and plant experiences were also reviewed to determine the frequency and duration of these activities. This information was used to supplement the generic data base. The level of detail in this task was abbreviated from that normally se n for a Level 1 PRA. A data specialist was present during the plant visit and obtained plant-specific dato for those components most important to the analysis. This analysis was abbreviated in the sense that not all components were included and particular failures were not investigated in detail. Where plant-specific data were unavailable, inade-quate, or not significantly different from generic data, the latter were used. Accident Sequence Quantification Analysis The models from each previous step were initially integrated in the accident sequence quantification analysis task to calculate single-valued (mean) estimates for the accident sequence frequencies. This was a A-11 NUREG-1150
Appendix A time-consuming and iterative task generally performed at various times during the analysis. For example, the analyst typically estimated partial sequence frequencies conservatively early in the study. If the result-ing frequency of the accident sequence, considering only some of the failures involved, was very small, these sequences were dropped from further consideration. Thus this technique was used to rule out large numbers of event tree sequences and, in some cases, establish that certain systems did not need to be modeled. As the event tree and fault tree modeling proceeded, the analyst continued to develop the sequence quantification, while continually screening out low frequency accident sequences. For the acci-dent sequences that remained, a detailed quantification was performed in several steps, using the SETS code (Ref. A.18): o Preparation of a computer model representing the logic of the systems analysis fault trees; e Identification and correction of errors in the fault trees; e Assignment of failure probabilities to each basic event in the fault tree and entry of these into the computer model; e Combination of support system fault trees with the appropriate front-line system fault trees; 1 e Development of logic expressions and their complements, if used, for the fault trees; and e Development of accident sequence expressions with combinations of component faults (i.e., cut sets) and single-valued estimates of their frequencies. The results of this task included computerized models for the plant being analyzed. These models de-scribed the possible plant response to the set of important accident sequences. Quantification using single-valued estimates then provided an initial estimate of the frequency of each important accident sequence. The level of detailin this task was eqcivalent to the state of the art normally performed in a Level 1 PRA. Plant Damage State Analysis Plant damage state analysis provides the information necessary to initiate an accident progression analysis in a Level 2 PRA (discussed in Section A.3). The plant damage state definitions provide the status of plant systems at the onset of core damage. These definitions include descriptions of the status of core cooling systems, containment systems, .and support systems in sufficient detail to describe the state of the plant for the accident progression analysis. The development of plant damage state definitions was accom-plished by adding additional questions to the end of the accident sequence event trees. However, in many cases it was not necessary to actually draw the plant damage state event tree, but rather, the questions could be dealt with in a matrix format (see Section 11 of Reference A.1). The questions that defined the plant damage states were selected during an iterativ process with the accident progression analysis staff. During the actual analysis, the accident sequenc cut sets were re-grouped into plant damage states, based on the particular failures in the cut sets and the answers to the selected questions. Some accident sequences contained cut sets that contributed to several different plant damage states. Similarly, there were cases where several different accident sequences could have contrib-uted cut sets to the same plant damage state.
-{
Once the new plant damage state cut-set groups were formed, they were quantified in the same manner as the accident sequences. Single-valued estimates (using mean values) were generated and an uncertainty 1 analysis performed (as discussed below). l Uncertainty Analysis With the broad NUREG-1150 objective of assessing the uncertainties in severe accident hequencies and risks, the single-valued estimates of accident sequence and plant damage state frequencies were supple-mented with quantitative uncertainty analysis. Both parameter value (data) and modeling uncertainties were included in the analysis, which involved several steps: NUREG-1150 A-12
Appendix A i l l i i e Preparation of probability distributions for the set of basic events in the logic models; j e Elicitation of expert judgment for those issues or parameters for which insufficient information was available to readily prepare an uncertainty distribution; e Determination of the correlation between parameters in the logic models;
- Input of the logic models and probability distributions, including correlation factors, to a computer-ized analysis package (Ref. A.19) to perform the Monte Carlo sampling and importance calculations; and e Performance of additional sensitivity studies on certain key issues.
This analysis produced a frequency distribution from which mean, median, and 5th and 95th percentile values were obtained. The underlying logic models were also analyzed to rank the basic events according to their contribution to mean core damage frequency (using risk-reduction and risk-increase importance measures) and the uncertainty in this frequency. By combining data and modeling uncertainties, and using advanced techniques for the elicitation of expert judgment, the uncertainty analyses performed for NUREG-1150 represented a significant advancement in the state of the art compared with most previous Level 1 PRAs. Section /. 6 discusses this analysis in greater detail. A.2.2 Internal-Event Methods for Zion
- The analysis of the Zion Unit 1 Nuclear Plant for NUREG-1150 (Ref. A.20) used the large event tree.
small fault tree approach originally used in the Zion Probabilistic Safety Study (ZPSS) (Ref. A 21). Be-cause of the existence of the ZPSS, it was determined that an accident frequency analysis of the Zion ; plant could be included in NUREG-1150 at a greatly reduced level of effort and cost. To achieve this, many aspects of the probabilistic risk analysis process developed in the ZPSS were carried over into the NUREG-1150 analysis. The principal steps of the methods used in the analysis of Zion included: e Identification of initiating events, j i e Plant response modeling (including systems analysis), 1 l e Human reliability analysis (including recovery), ) l
. Data analysis, o Quantification, and ,
1 e Sensitivity / uncertainty analyses. Each of these steps is discussed in more detail in the following sections. Identification of Initiating Events ] The initiating event categories for which plant response models were developed were determined in the ZPSS and were used directly in the NUREG-1150 analysis with only minimal changes. The ZPSS used a j number of sources of information to establish these initiating event categories, including: l e Zion plant operating records, o Zion plant design features and safety analyses, f
'This section extracted, with editorial modificatic , irom Reference A.20.
A-13 NUREG-1150
Appendix A l
)
- Previous probabilistic risk analyses, and j e General industry experience.
Ira addition to these resources, the ZPSS analysis team developed a " Master Logic Diagram" to organize their thought process and structure the information. Figure A.5 shows the high-level Master Logic Dia-gram developed for the Zion Probabilistic Safety Study. Level I in the diagram represents the undesired event for which the risk analysis is being conducted, i.e., an offsite release of radioactive material. Level 11 answers the question: "How can a release to the environment occur?" Level 111 shows that a release of radioactive material requires simultaneous core damage and containment failure. Level IV answers the question: "How can core damage occur?" After several more levels of "how can" questions, the diagram arrives at a set of potential initiating events. The ZPSS listed 59 internal initiating events that were assigned to the first 13 initiating event categories shown in Figure A.S. The NUREG-1150 analysis was able to reduce the number of initiating event cate-gories by combining several that had the same plant response. For example, the loss of steam inside and outside the containment were collapsed into loss of steam. The zesult was 11 initiating event categories for the NUREG-1150 analysis. Plant Response Modeling The plant response modeling for the NUREG-1150 analysis was based on the ZPSS work and consists of three parts. The first part is event tree modeling. The ZPSS developed 14 event tree models, one for each of the initiating event categories and one for the failure of reactor trip condition (anticipated transient without scram). This last event tree is actually a subtree or extension to a number of the n'ain event trees but was separated out to easily quantify the frequency of ATWS. The ZPSS event trees were the basis for the NUREG-1150 event trees. Modifications were made to each of the original event trees to reflect the latest understanding of the intersystem dependencies. Many of the changes from the ZPSS to the NUREG-1150 analysis were based on the review of the ZPSS performed by Sandia National Laboratories under contract to the NRC staff (Ref. A.22) and comments on the draft version of this work (Ref. A.4). The second part of the plant response model was the development of electric power support states. The ZPSS analysis of the Zion electric power system and the dependencies of other plant systems on electric power resulted in the identification of eight unique electric power states. Each power state defined a combination of successful and failed power sources. Each electric power state had a unique impact on the set of systems included in the event tree tcp events. The final part of the plant response modeling was the analysis of the systems that provide the safety and ( support functions defined by the event tree top events. From the top event definitions and success criteria and the electric power states, a set of boundary conditions for each system analysis was developed. The j number of unioue boundary conditions determined the number of conditional split fractions that had to 1 l be modeled. A conditional split fraction is the system availability given a specific set of conditions su:.L S initiating event, the electric power state, and the operational status of other required support systems. For ustance, for the auxiliary feedwater system, seven conditional split fractions were needed. One (conditional split fraction "L11"), for example, was used for transients and loss-of-coolant accidents (LOCAs) with all power available. 1 The NUREG-1150 analysis for Zion made extensive use of the system analyses in the ZPSS. After verifi-cation of the current plant configuration, most conditional split fractions used in the NUREG-1150 analy-sis came directly from the ZPSS. In some cases, new conditional split fractions had to be developed to ! j accommodate event tree model changes. These included several for the component cooling water system, a l I NUREG-1150 A-14 l l, 1 J
Appendix A
!! a a.
,i! O !-! l-
.l J. ,ic.
. v . .. . i. 3 1!.... d.
.. =.-
-3 gga #4 g a I: j ail O ij i !!!!! O !! !g!-
11 er r8 0 _
- sg gg g gj.... j..
d_o
,, :, s j! s o ._ s_g a
3
.u 1, g 1g,....
a 3, . . si .o e il o r i !!! O !! -
!! ie n.
!! O i
m 3': zI b s O ji t, p-ni m o _ , .s a i
-!! O i
h, i 5 h, - g
. l i.. 0 ..
2 c ! o ju !! .... h, . . c
,g g -
--w is ai 4
0 m 1.]b. O !,[, h[ - 4 s
. . .a i$
3 i.g is.. m
.So 8 14 Si r$ ~!
-{ -
~
is.... E'
- 1. -.1g . . .s . .
#3 di :I
~
illi Q i!s.... I
-*g .i 12 . .
ii if 1 zE O
.!i ;18 i-
!.i. :.
-
- E t e 5 1 i 5 $ $ $ $ $ $
3 5 5 5 5 3 5 A-15 NUREG-1150 '
. ___j
Appendin A the service water system, and the high-pressure injection system, among others. For the most part, the new conditional split fractions were able to be constructed from pieces of system analyses existing in the ZPSS. Iluman Reliability Analysis The human reliability analysis identified the human actions of operation, maintenance, and recovery that should be considered in the probabilistic risk analysis process. It also determined the human error rates to ! be used in the quantification of these actions. The NUREG-1150 analysis included three types of human i actions: pre-initiator testing and maintenance actions; accident procedure actions; and recovery actions. Pre-initiator testing and maintenance actions included the types of human errors that could render a portion of the plant unavailable to respond to an initiating event. Examples of these errors were improper > restoration of a system after testing and miscalibration of instrument channes. Accident procedure actions are required for the plant to fully respond to an initiating event. These actions were generally called out in the emergency operating procedures. Examples of these human actions were establishing feed-and-bleed cooling, switching from the injection mode of emergency core cooling to con-tainment sump recirculation, and depressurizing below the steam generator safety valve setpoints during a steam generator tube rupture. Recovery actions may or may not be called out in the emergency operating procedures. These actions are taken in response to the failure of an expected function. Examples of there types of actions included recovering ac electrical power, manually starting a pump that should have received an auto-start signal, and refilling the refueling water storage tank in the event of emergency core cooling system recirculation failure. Pre initiator testing and maintenance actions were usually incorporated into the system models since most of them impacted only a single system. Accident procedure actions were typically included at the event tree level as a top event because they were an expected portion of the plant / operator response to the initiating event. These actions may have been included in the system models if they impacted only a single system. Recovery actions were included either in the event trees or the system models or applied to the , sequence models after processing of the plant response models. ' Pre-initiating event testing and maintenance errors were included in the system models and were taken directly from the ZPSS. The accident procedure errors were also taken from the ZPSS after verification that the emergency procedures and plant operating philosophies had not changed significantly from the time of the ZPSS. Recovery actions were developed specifically for the NUREG-1150 analysis and were applied to specific system models and to specific accident sequences as appropriate. Data Analysis The ZPSS performed an extensive analysis of plant-specific data to determine the failure rates and de-mand failure probabilities for all the basic events used in the models. The plant data collected included l component failure data, test frequencies and results, component service hours, and maintenance requen-cies and durations. This information was combined with generic failure data from sources such as Reactor Safety Study (Ref.
.A.23), IEEE-500 (Ref. A.24), and others by a single-stage or two-stage Bayesian update analysis. The generic data were reviewed and screened for applicability before being used as a prior distribution in the Bayesian updating process.
The NUREG-1150 analysis reviewed the plant operating history and determined that no significant changes had occurred that would invalidate any portion of the ZPSS data analysis.This was confirmed in discussions with the licensee. Therefore, the data used in the NUREG-1150 analysis were taken directly from the ZPSS. NUREG-1150 A-16
Appendix A Quantification For the NUREG-1150 analysis, the event tree models and the conditional split fraction values were input and processed using computer codes designed specifically for manipulation oflarge event tree, small fault tree models with support system states (i.e., the models used in the Zion Probabilistic Safety Study and other PR As)(e.g., Ref. A.25). Approximately 16,000 accident sequences were quantified. Each event tree was ana-lyzed eight times, once for each electric power state. For each analysis, the appropriate conditional split fractions were assigned to the top events. The results were single-valued estimate accident sequence frequencies. The accident sequences with a single-valued estimate frequency less than 1X10-09 per year were not processed any further and were dropped. Recovery actions pertaining to specific situations were applied to the appropriate remaining sequences. Again, any sequences that fell below the 1X10-09 cutoff were drooped. The remaining accident sequences were assigned to plant damage states (PDSs). The plant damage state frequencies were determined by summing the frequencies of all the sequences in a given PDS. Sensitivity / Uncertainty Analyses For purposes of sensitivity and uncertainty analyses, the accident sequences with a single-valued estimate frequency greater than or equal to 1X10-09 per reactor year were loaded into IRRAS 2>0 (Ref. A.26), a fault tree / event tree generation and analysis model developed for NRC. Six issues were identified for which sensitivity / uncertainty evaluations were desired. Thesv issues were determined by examining the results of the single-valued estimate quantification. For each of these issues, an expression of the uncertainty was developed. These expressions were used in combination with uncertainties in failure data in a specialized Monte Carlo analysis method (Latin hyper-cube sampling) (Ref. A.13) to generate a sample of 150 observations. These observation values were propagated through the system and sequence models using IRRAS 2.0 to generate 150 frequencies for each sequence and plant damage state. From these probability distributions for individual plant damage states and total core damage frequency were determined. This information was then passed on to the accident progression and risk analysis portions of the Zion study. A.2.3 External-Event Methods for Surry and Peach Bottom
- Seismic Accident Frequency Analysis Methods A nuclear power plant is designed to ensure the survival of buildings and emergency safety systems in earthquakes less than one of a specific magnitude (the " safe shutdown" earthquake). In contrast, the analysis of seismic risk requires consideration of the range of possible earthquakes, including those of magnitudes less than and greater than the safe shutdown earthquake. Seismic risk is obtained by combin-ing the frequencies of the spectrum of possible earthquakes, their potential (and very uncertain) effects on equipment and structures within the plant under study, and the subsequent effects on core and contain-l ment building integrity. In considering this, it should be noted that during an earthquake, all parts of the l plant are excited simultaneously. Thus, during an earthquake, redundant safety systerii components expe- i rience highly correlated base motion, and there is a high likelihood that multiple redundant components would be damaged if one is damaged. Hence, the " planned-for" redundancy of equipment could be compromised. This common-cause failure mechanism represents a potentially significant risk to nuclear power plants during earthquakes.
The simplified seismic accident frequency analysis method used in NUREG-1150 for the analysis of the l Surry and Peach Bottom plants is based, in part, on the results to two earlier NRC-sponsored programs. ; The first was the Seismic Safety Margins Research Program (SSMRP) (Ref. A.28). In the SSMRP, a detailed seismic risk analysis method was developed. This program culminated in a detailed evaluation of
'This section extracted. with editorial modification, from Part 3 of Reference A.27. j A-17 NUREG-1150 i
i
Appendix A the seismic core damage frequency of the Zion nuclear power station (Ref. A.29). In this evaluation, an attempt was made to accurately compute the responses of walls and floor slabs in the Zion structures, movements in the important piping systems, accelerations of all important valves, and the spectral acccl-erations at each safety system component (pump, electrical bus, motor control center, etc.). Correlation between the responses of all components was computed from the detailed dynamic response calculations. The important safety and auxiliary systems functions were analyzed, and fault trees were developed that traced failure down to the individual component level. Event trees related the system failures to accident sequences and radioactive release rnodes. Using these detailed models and calculations, it was possible to evaluate the frequency of core damage from seismic events at Zion and to determine quantitatively the risk importance of the components, initiating events, and accident sequences. The second NRC program used in the NUREG-1150 analyses was the Eastern feismic Hazard Characteri-zation Program (Ref. A.30), which performed a detailed earthquake hazard assessment of nuclear power plant sites cast of the Rocky Mountains. Results of these two programs formed the basis for a number of simplifications used in the seismic method reported here. There are seven steps required for calculating the frequency of seismically initiated core damage accidents in a nuclear power plant:
- Determination of the local earthquake hazard (hazard curve and site spectra);
i
- Identification of accident sequences for the plant that lead to the potential for release of radioactive j mate-ial (initiating events and event trees), i i
e Determination of failure modes for the plant safety and support systems (fault trees); e Determination of the responses (accelerations or forces) of all structures and components (for each earthquake level);
- Determination of fragilities (probabilistic failure criteria) for the important struc*.ures and compo-nents; e Computation of the frequency of core damage using the information from the first five steps; and
- Estimation of the uncertainty in the core damage frequencies.
Each of these steps of the simplified seismic accident frequency analysis method is summarized below. Determination of Local Earthquake Hazard The seismic analyses in this report made use of two data sources on the frequency of earthquakes of various intensities at the specific plant site (the seismic " hazard curve" for that site): the " Eastern United States Seismic Hazard Characterization Program," funded by the NRC at Lawrence Livermore National Laboratory (LLNL) (Ref. A.30); and the Seismic Hazard Methodology for the Central and Eastern United States Program, sponsored by the Electric Power Research Institute (EPRI) (Ref. A.31). In both the LLNL and EPRI program, seismic hazard curves were developed for all U.S. commercial power plant sites east of the Rocky Mountains, using expert panels to interpret available data. The NRC staff presently considers both program results to be equally valid (Ref. A.32). For this reason, two sets of seismic results are provided in this report. Section 11 of Appendix C discusses the analysis of seismic hazards in more detail. I Identification of Accident Sequences The scope of the NUREG-1150 seismic analysis includes loss-of-coolant accidents (LOCAs) (including vessel rupture and pipe ruptures of a spectrum of sizes) and transient events. Two types of transient events were considered: those in which the power conversion system (PCS) is initially available (denoted type T3 transients) and those in which the PCS is failed as a direct consequence of the initiating event (denoted NUREG-1150 A-18
Appendix A type T1 transients). The event trees developed in the internal-event analyses are used. For the seismic l analysis, the reactor vessel rupture and large LOCA event frequencies were based on a Monte Carlo analysis of steam generator and reactor coolant pump support failures. The frequency of Type T1 tran-sients is based on the frequency of loss of offsite power (LOSF). This is the dominant cause of this type of I transient (for plants such as those studied in NUREG-1150 in which LOSP causes loss of main feed- i water).,Given an earthquake of reasonable size, it is assumeo that a Type T? transient occurs with a probability of unity. Determination of Failure Modes l The internal-event fault trees were used in the seismic analysis with some modification to include basic events for seismic failure modes and to resolve the trees for pertinent cut sets to be included in the probabilistic calculation Probabilistic culling was used in the resolution of these trees in such a way as to , ensure that important correlated failure modes were not lost. Determination of Fragilities Component seismic fragilities were obtained both from a generic fragility data base and from plant-specific fragilities developed for components identified during the plant walkdown. The generic data base of fragility functions for seismically induced failures was originally developed as part of the SSMRP (Ref. A.28). Fragility functions for the generic categories were developed based on a combination of experimental data, design analysis reports, and an extensive expert opinion survey. The experimental data used in developing fragility curves were obtained from the results of component manu-facturers' qualification tests, independent testing lab failure data, and data obtained from the extensive U.S. Corps of Engineers SAFEGUARD Subsystem Hardness Assurance Program (Ref. A.33). These data were statistically combined with the expert opinion survey data to produce fragility curves for each of the generic component categories. Detailed structural fragility analyses were performed for all important safety-related structures at the NUREG-1150 plants. In addition, an analysis of liquefaction for the underlying soils was performed. These were included directly into the accident frequency analysis. Determination of Responses Building and component seismic responses were estimated from peak ground accelerations at several probability intervals on the hazard curve. Three basic aspects of seismic response-best estimates, variabil-ity, and correlation-were generated. Results from the SSMRP Zion analysis (Ref. A.29) and simplified methods studies (Ref. A.34) formed the basis for assigning scaling, variability, and correlation of re-sponses, in each case, computer code calculations (using the SHAKE code (Ref. A.35)) were performed to assess the effect of the local soil column (if any) on the surface peak ground acceleration and soil structure interactions. This permitted an evaluation of the effects of nonhomogeneous underlying soil conditions that could have strongly affected the building responses. l Fixed base mass-spring (eigen-system) models were either obtained from the plant's architect / engineer or were developed from the plant drawings. Using these models, the floor slab accelerations were calculated using the CLASSI computer code (Ref. A.36). This code uses a fixad-base eigen system model of the structure and input-specified frequency-dependent soil impedances and computes the structural response (as well as variation in structural response if desired). Variability in responses (floor and spectral accelera-tions) is assigned based on results of the SSMRP. Correlation between component failures was explicitly included in the analysis. In computing the correla-tion between component failures (in order to quantify the cut sets) it was necessary to consider correla- ! tions both in the responses and in the fragilities of each component. Inasmuch as there are no data as ye; on correlation between fragilities, the fragility correlations between like components were taken as zero, and the possible effect of such correlation quantified in a sensitivity study. The correlation between re-sponses is assigned according to a set of rules, i A-19 NUREG-1150
Appendix A Computation of Frequency of Core Damage Given the input from the five steps above, the SETS computer code (Ref. A.18) was used to calculate l required outputs (probabilities of failure, core damage frequency, etc.). Estimation of Uncertainty Using Monte Carlo techniques, frequency distributions of individual parameters in the seismic analysis were corr.bined to yield frequency distributions of accident sequences, plant damage states, and total core damage. Fire Accident Frequency Analysis Methods Nuclear power plants are designed to be able to safely shut down in the presence of a spectrum of possible fires throughout the plant (Ref. A.37). Nonetheless, some plant areas contain cabling for multiple trains of core cooling equipment. Fires in such areas (and in some cases in conjunction with random equipment failures not caused by a fire) can lead to accident sequences Eth relatively important frequencies. For this reason, the core damage frequency from fire-initiated accidents was assessed for two power plants (Surry and Peach Bottom). The principal steps in the the simplified fire accident frequency analysis method used in NUREG-1150 were as follows:
- Initial plant sisit, e Screening of potential fire locations, and e Accident sequence quantification.
Each of these steps is summarized below. Initial Plant Visit Based on the internal-event and seismic analyses, the general location of cables and components of the principal plant systems had previously been developed. A plant visit was then made to provide the analysis staff with a means of seeing the physical arrangements in each of these areas. The analyst had a fire zone checklist that would aid the screening analysis and the quantification step. The second purpose of the initial plant visit was to confirm with plant personnel that the documentation being used was in fact the best available information and to get clarification about any questions that might have arisen in a review of the documentation. As part of this, a thorough review of firefighting procedures was conducted. Screening of Potential Fif e Locations it was necessary to select'important fire locations within the power plant under study that have the greatest ; potential for producing accident sequences of high frequency or risk. j i The screening analysis was comprised of. ; e Identification of relevant fire zones I A thorough review of the plant Appendix R (Ref. A.37) submittal was conducted to permit the 1 division of this plant into fire zones. A fire zone can be defined as a plant area surrounded by a 3-hour-rated barrier or its equivalent. From this complete plant model, fire zones were screened from j further analysis if it could be shown that either no safety-related equipment or its associated power or ! control cabling was lccated within them. ) s NUREG-1150 A-20
Appendix A e Screening of fire zones on probable fire-induced initiating events Fire zones where the overall fire occurrence frequency is less than 1X10-6 per year were eliminated from further consideration. Also, certain fire-induced initiating events such as loss of offsite power could be eliminated if a particular fire zone contained none of its cabling. Therefore, even if a fire zone could not be screened as a whole, certain of the fire-induced initiators that might be postulated to occur within this zone could be eliminated.
- Screening of fire zones on both order and frequency of cut sets Cut sets containing random failure combinations of less than 1X10-4 were eliminated from further consideration. In this step, cut sets with multiple fire zone combinations are addressed. Any cut set containing three or more fire zone combinations was screened. These scenarios would imply the simultaneous failure of two or more 3-hour-rated fire barriers and therefore were considered probabilistically insignificant. Cut sets containing only two fire zones were eliminated on the following three criteria:
If there was no adjacency between the two areas; If there was an adjacency, it contains no penetrations; and I - On probability, with barrier failure probability set to 0.1.
- Analysis of each fire zone remaining to numerically evaluate and to cull on probability The remaining cut sets were now resolved with fire-zone-specific fire initiating event frequencies and then screened on a frequency criteria cf 1X10-8 per year.
Accident Sequence Quantification After the screening analysis has eliminated all but the probabilistically significant fire zones, quantification of dominant cut sets was completed as follows: e Determination of the temperature response in each fire zone l The modified COMPERN Ill code (Ref. A.38) was used to calculate time to damage of all critical cabling and components within a fire zone.
- Computation of component fire fragilities For those modeled components in the COMPBRN analysis, damageability temperatures were as-signed based on fire test experience.
- Assessment of the probability of barrier failure for all remaining combinations of fire zones The remaining cut sets that contained two fire zones had barrier failure probabilities calculated.
Those cut sets that were below 1X10-8 per year were eliminated from further consideration. e Performance of recovery analyses In a manner like that of the internal-event recovery analysis, recovery of random failures was applied on a cut-set by cut-set basis. For sequences less than 24 hours in duration, only one recovery action was allowed. If more than one recovery action was possible for any of these given etri sets, a consis-tent hierarchy of which recovery action to apply was used. In sequences of greater than 24 hours, two recovery actions were allowed. The only modifications to recovery probabilities were found in areas where a fire had to first be extinguished and then the area desmoked prior to the occurrence of a local action. This quantification was performed using specialized Monte Carlo techniques (Latin hypercube sampling) (Ref. A.13) so that individual parameter frequency distributions can be combined into frequency distribu-tions of accident sequences, plant damage states, and total core damage frequency. A-21 NUREG-1150
Appendix A Bounding Analysis of Other External Events Bounding analyses were performed for NUREG-1150 for those external events that were judged to poten-tially contribute to the estimated plant risk. Those events that were considered included extreme winds and tornadoes, turbine missiles, internal and external flooding, and aircraft impacts. Conservative probabilistic models were used in these bounding analyses to integrate the randomness and . uncertainty associated with event loads and plant responses and capacities. Clearly, if the mean initiating l frequency resulting from a conservative model was predicted to be low (e.g., less than 1X10-6), the' l l external event may be eliminated from further consideration. Using this logic, the bounding analyses identified those external events that needed to be studied in more detail as part of the risk analysis. In the case of both Peach Bottom and Surry, none of these "other external events" were found to be a poten-tially significant contributor to core damage frequency. , J A.2.4 Products of Accident Frequency Analysis The results of the accident frequency analyses discussed in this section can be displayed in a variety of ways. The specific products shown in NUREG-1150 are described in the following sections.
. The total core damage frequency for internal events and, where estimated, for external events.
For Part 11 of NUREG-1150 (plant-specific results), a histogram-type plot was used to represent the distribution of total core damage frequency as shown in Figure A 6. This histogram displays the fraction of Latin hypercube sampling (LHS) observations falling within each interval.' Four meas-ures of the distribution function are identified:
- Mean,
- Median, 5th percentile vable, and 95th percentile value.
A second display of accident frequency results is used in Part Ill of NUREG-1150, where results for all five plants are displayed together. This figure provides a summary of these four specific measures in a simple graphical form (also shown in Fig. A.6), i For those plants in which both internal and external events have been analyzed (Surry and Peach Bottom), the core damage frequency results are provided separately for the two classes of accident i initiators. 1
. The definitions and estimated frequencies of plant damage states.
The total core damage frequency estimates described above are the result of the summation of the frequencies of various types of accidents. For this summary report, the total core damage frequency has been divided into the contributions of five plant damage states:' Station blackouts, in which all ac power (coming from offsite and from emergency sources in the i plant) is lost; l Transient events with failure of the reactor protection system (ATWS events);
- Other transient events; !
I i
' Care should be taken in using these histograms to estimate probability density functions. These histogram plots were developed such that the heights of the individual rectangles were not adjusted so that the rectangular areas represented probabilities. The shape of a corresponding density function may be very different from that of the histogram. The histo-grams represent the probability distribution of the logarithm of the core damage frequency. " A more detailed set of plant damage states is prcvided in the supporting contractor reports.
NUREG-1150 A-22
Appendix A 95th : __ y 1 I m .
)
i 1 i i 5th - ; 1 i l Key ; i M = mean ! m = median l l I l Figure A.6 Example display of core damage frequency distribution. A-23 NUREG-1150
Appendin A Loss-of-coolant accidents (LOCAs) resulting from pipe ruptures, reactor coolant pump seal fall-ures, and failed relief valves occurring within the containment building; and LOCAs that bypass the containment building (steam generator tube ruptures and other " inter-facing-system LOCAs"). Figure A.7 provides an example display of mean plant damage state frequencies used in NUREG-1150. In addition to these quantitative displays, the results of the accident frequency analyses also can be dis-cussed with respect to the qualitative perspectives obtained. In NUREG-1150, qualitative perspectives are provided in two levels:
- Important plant characuristics. The discussion of important plant characteristics focuses on general system design and operational aspects of the plant. Perspectives are thus provided on, for example, the design and operation of the emergency diesel generators, or the capability for the feed and bleed mode of emergency core cooling.
e Important individual events. One typical product of a PRA is a set of "importance measures." Such measures are used to assess the relative importance of individual items (such as the failure rates of individual plant components or the uncertainties in such failure rates) to the total core damage fre-quency. While a variety of measures exists, two are discussed (qualitatively) in NUREG-1150. The first importance measure (risk reduction) shows the effect of significant reductions in the frequencies of individual plant component failures or plant events (e.g., loss of offsite power, specific human errors) on the total core damage frsquency. In effect, this measure shows how to most effectively reduce core damage frequency by reductions in the frequencies of these individual events. The sec-ond importance rneasure (uncertainty reduction) discussed in NUREG-1150 indicates the relative contribution of the uncertainty in individual events to the uncertainty in total core damage frequency. In effect, this measure shows how most effectively to reduce the uncertainty in core damage fre-quency by reductions in the uncertainty in individual events. A third importance measure, risk j achievement, is discussed in the contractor reports underlying NUREG-1150. As illustrated in Figure A.3, the results of this analysis are the first and second inputs to the risk calcula-tions, F(IE h), the frequency of initiating event h and P(IEh--*PDSj), the conditional probability of plant damage state i, given initiating event h. A.3 Accident Progression, Containment Loadings, and Structural Response Analysis
- A.3.1 Introduction j The purpose of the accident progression, containment loadings, and structural response analysis is to track the physical progression of the accident from the initiating event until it is concluded that no additional release of radioactive material from the containment building will occur. Thus the core damage process is studied in the reactor vessel, as the vessel is breached, and outside the vessel. At the same time, the analysis tracks the impact of the accident progression on the containment building structure, with particu- l J
lar focus on the threat to containment integrity posed by pressure loadings or other physical processes. j 1 The requirements of an ideal accident progression analysis would be knowledge, probably in the form of I the results of mechanistic calculations from validated computer codes, of the characteristics of the set of possible accident progressions resulting from individual plant damage states defined in the previous analy- l sis step. More than one accident progression can result from each plant damage state since random events i (hydrogen detonations, for example) occurring during the accident progression can alter the course of the ) accident. Given the frequency of the plant damage state and the probabilities of the random events, one could determine the outcomes and frequencies of the set of possible accidents. j
*This section extracted, with editorial' modification, from Chapter 2 of Reference A.2.
NUREG-1150 A-24
i Appendix A Station Blackout ,
]"m-nf Transients V
- i. / f LOCA
\. l AT WS l
Total Mean Core Damage Frequency: 4.5E-6 i l Figure A.7 Example display of mean plant damage state frequencies. A-25 NUREG-1150
Appendix A Knowledge of the characteristics of all possible accidents resulting from each plant damage state is clearly not available with current' technology. A large number of mechanistic codes that can predici some aspects of the accident progression are available. For example, MELPROG (Ref. A.39) and CONTAIN (Ref. A.40) can be used to track in-vessel and containment events, respectively, for very explicit accident progressions. Less detailed, but more comprehensive codes, such as the Source Term Code Package (STCP) (Ref. A.41), M AAP (Ref. A/2) and, more recently, MELCOR (Ref. A.43) have been devel-oped to predict generalized characteristics of more aspects of the accident in an integrated fashion. While these codes ; re very useful for developing a detailed understanding of accident phenomena and how the different phenomena interact, they do not meet the constraints imposed by a PRA; i.e., the ability to ana!yze a very wide range of scenarios with diverse boundary conditions in a timely and cost-efficient manner. In addition, the number of code calculations necessary to investigate uncertainty and sensitivity to inputs, models, and assumptions would be prohibitively expensive. Further, these codes have not been fully validated against experiments. Thus codes developed by different groups (for example, NRC and industry contractors) frequently include contradictory models and give different results for given sets of accident boundary conditions. Finally, these codes also do not contain models of all phenomena that may determine the progression of the accident. The information that was available with which to conduct the accident progression analysis for NUREG-1150 consisted of the diverse body of research results from about 10 years of severe accident research within the reactor safety community. This included a large variety of severe accident computer ; code calculations, other mechanistic analyses, and experimental results. Much of the information repre-sented basic understanding of some important phenomena. Because of the expense of developing and running large integrated codes, less information was in the form of integrated accident progression analy-r,es. That which was available was usually confined to analyses of a few types of accident sequences. All existing codes were recognized to have some limitations in their abilities to mechanistically model severe l accidents. , 1 Many new calculations were conducted specifically for NUREG-1150. For example, new CONTAIN code calculations were performed to assess pressure loadings on the containment and sensitivity of the loading calculations to various phenomenological assumptions (Ref. A.44). Most of the new calculations are de-scribed in the contractor reports supporting NUREG-1150. In particular, Reference A.45 contains a complete listing and description of the new supporting calculations. For the most part, the new calcula-tions were intended tc fill the largest gaps in the present state of knowledge of accident progression for the most important accidents. Given this state of information, the NUREG-1150 accident progression analysis was performed in a series of steps, including:
. Development of accident progression event trees, e Structural analyses, e Probabilistic quantification of event tree issues, and e Grouping of event tree outcomes.
Each of these steps is discussed below. i A.3.2 Development of Accident Progression Event Trees The NUREG-1150 accident progression analyses were conducted using plant-specific event trees, called accident progression event trees (APETs). The APETs consist of a series of questions about physical phenomena affecting the progression of the accident. A typical question would be "What is the pressure rise in the containment building at reactor vessel breach 7" A complete listing of the questions that make up the accident progression event tree for each plant studied in NUREG-1150 can be found in References A.46 through A.50. Typically, the event trees for each plant consisted of about 100 questions; each question could have ruultiple outcomes or branches. NUREG-1150 A-26
Appendin A The NUREG-1150 APETs were general enough to efficiently calculate the impact of changes in phen-omenological models on the accident progression in order to study the effect of uncertainties among these l models. This generality added complexity to the analysis since, with the ability to consider different mod-els, some paths through the tree, which would be forbidden for a specific model, had to be included when a variety of models was considered. The multiplicity of possible accident progression resuhs caused by the consideration of multiple models for some of the accident phenomena was amplified at each additional , stage of the accident progression since, in addition to creating more possible outcomes, a wider range in I boundary conditions at the subsequent events was made possible. Because of the flexibility and generality of the APETs, basic principles, such as hydrogen mass conservation, steam mass conservation, etc., were incorporated into the event trees in order to automatically eliminate pathways for which the principles are violated. This was accomplished with parameters, such as hydrogen concentrations in various compart-ments, passed along in the tree as each accident pathway was evaluated. At some questions in the tree, the parameters were manipulated using computer subroutines. The branch taken in each question could de-pend on the values of such calculated parameters. The consistency of phenomenological treatment
- oughout each accident was also ensured by allowing questions to depend on the branches or parameters taken in previous questions.
Figure A.8 schematically illustrates the APETs used in this study. The first section of the tree (about 20 percent of the total number of questions) was used to automatically define the input conditions associated with the individualplant damage state (PDS). Thus, if one of the characteristics of a PDS was the pressure in the reactor vessel at the onset of core damage, a question was included to set the initial condition according to that variable. The next part of the tree was then devoted to determining whether or not the accident was terminated before failure of the reactor vessel. Questions pertinent to the recovery of cooling
' nd coolability of the core were asked in this part of the tree. The next section of the tree continued the a
examination of the accident progression in the reactor vessel. As illustrated in Figure A.8, there were two principal areas of investigation for this part of the analysis: in-vessel phenomena that determined the radioactive release characteristics; and events that impacted the potential for containment loadings. The example in Figure A.8 shows the phenomena associated with the release of hydrogen during the in-vessel phase of accident progression and the resultant escape of that hydrogen into the containment building. The next stage illustrated in Figure A.8 continues the examination of the accident during, and immedi-ately after, reactor vessel breach. This included the continued core meltdown in the vessel and the simul-taneous loading and response of the containment building. A good example for this stage of the APET analysis is an examination of the coolability of the debris once out of the reactor vessel, followed by questions concerning the loading of the containment as a result of core-concrete interactions. The final stage of the illustrated APET is related to the final status of containment building integrity. Long-term overpressurization, threats from combustion events, and similar questions were asked for this stage of the accident progression. For convenience, some questions that summarized the status of the containment at specific times during the accident were also included. Throughout the progression of a severe accident, operator intervention to recover systems has the poten-tial to mitigate the accident's irnpact. Such actions were considered in the APET analysis, using the same rules as those used in the accident frequency analysis. The previous explanation has delineated the general flow of the accident progression event tree. What is not immediately apparent in this summary is the degree to which dependencies could be accounted for. An example of 'he dependency treatmer.1 is a series of questions that relate to hydrogen combustion. The outcomes of the event tree ques, ons that ask whether hydregen deflagration occurs sometime after vessel breach and what is the resulting pressure load from the burn are highly dependent on previous questions. The individual values for the probability of ignition and the pressure rise were dependent on: 1
. Previous hydrogen burn questions (the amount consumed in each previous burn was tracked, and the i concentration at the later time was calculated consistent with al; previous hydrogen events);
A-27 NUREG-1150
1 l l Appendix A i Boundary Recovery of in-Vessel Ex-Vassel . Final g Cond!! ions: g Core Prior to Processes and g Processes and g Outcome Plant Damago Vessel Dreach Containment Containment i States l I impact I impact i I I I I I l Late l I I l l containment Dobris g overpressure l coolability i I I I l Pressure No l l l l released? I Yes I in vessel i I I 1 I y ,, I l Recovery of l 'I go I System injection g g g g l Setpoint i I vos _ l y, i 1 I High l I I I g g Hydrogen g g l l Informocinte i I I vessel breach I l l I l I I I I I IPressuro increase I No g g g g due to H2 burn g during CCI gas I , I I I generation I I : I - 1 I I
~
I I l - 1 I I Sotpoint i l I ii Yos** I i I I I I I High i I I No i I I I I - I Intermoc+ ate g g g g g i l i I I Low I I I I I
- Amount of hydrogen released is sampled from continuous probability distribution
** Pressure increase is calculated from user function Figure A.8 Schematic of accident progression event tree.
NUREG-1150 A-28
Appendix A
- Questions concerning the steam loading to determine whether the atmosphere was steam inert; and
- Questions concerning the availability of power, which influenced the probability of ignition.
In turn, these questions all had further dependencies on each other and on other questions. For example, the steam loading questions were dependent on the power and equipment availability since heat removal system operation would impact the steam concentration. A.3.3 Structural Analysis The NUREG-1150 APETs explicitly incorporate consideration of the structural response of containment buildings, including a building's ultimate strength, failure locations, and failure modes. Use was made of available detailed structural analyses (e.g., Ref. A.51) and results of recent experimental programs (e.g., Ref. A.52). The judgments of experts were used to interpret the available information and develop the required input (probability distributions) for the APET (see Section A.7 for discussion of the.use of expert judgment). A.3.4 Probabilistic Quantification of APETs In general, phenomenological models were not directly substituted into the event trees (in the form of subroutines) at each question. Rather, the results of the model calculations were entered into the trees through the assigned branching probabilities, the dependencies of the questions on previous questions (the
" case structure") and/or tables of values that were used to determine parameters passed or manipulated by the event tree. Some questions in the trees, such as those concerning the operability of equipment and availability of power, were assigned probability distributions derived from data analogous to the process in the accicient frequency analysis. Timing of key events was identified through a review of available code calculations and other relevant studies in the literature. The process of assigning values to the branch point probabilities, creating the case structure, writing the user functions, and supplying parameter values or tables is referred to as "quantification" of the tree.
Once an accident progression event tree, with its list of questions, their branches and their case structure, its subroutines and its parameter tables, had been constructed by an analyst, it was evaluated using the computer code EVNTRE (Ref. A.53). EVNTRE can automatically track the different kinds of dependen-cies associated with the accident progression issues. This code was also built with specific capabilities for analyzing and investigating the tree as it was being built, allowing close scrutiny of the development of a complex model. For each plant damage state, EVNTRE evaluates the outcomes of the set of subsequent accident progressions predicted by the APET and their probabilities. A.3.5 Grouping of Event Tree Outcomes EVNTRE groups paths through the tree into accident progression bins. PSTEVNT (Ref. A.54) is a "rebin-ner" computer code that further groups the initial set of bins produced by EVNTRE.* To meet the needs of the subsequent source term analysis, the APET results are grouped into " accident progression bins." The accident progression bins were defined through interactions between the accident progression analysts and the source term analysts. Characteristics of the bins include, for example, timing of release events, size and location of containment failure, and availability of equipment and processes that remove radioac-tive material. As such, the bins are relatively insensitive to many of the individual questions in the tree as they focus on the ultimate outcomes, and through the use of these bins, the paths through the tree were greatly reduced in terms of the number of unique outcomes. A.3.6 Products of Accident Progression Analysis The qualitative product of the accident progression, containment loadings, and structural response analy-sis is a set of' accident progression bins. Each bin consists of a set of event tree outcomes (with associated
- EVNTRE grouping can be chosen to illust: ate the importance of a specific aspect of accident phenomenology, system performance, or operator performance, as long as that aspect is a distinct part of the APET. .
A-29 NUREG-1150
i I Appendix A i probabilities) that have a similar effect on the subsequent portion of the risk analysis, analysis of radioac-tive material transport. As such, the accident progression bins are analogous to the plant damage states described in Section A.2.4. i Quantitatively, the product consists of a matrix of conditional failure probabilities, with one probability for 1 each combination of plant damagt state and accident progression bin. These probabilities are in the form of probability distributions, reflecting the uncertainties in accident processes. In NUREG-1150, products of the accident progression analysis are shown in the following ways: l e The distribution of the probability of early containment failure
- for each riant dsmage state (as shown in Fig. A.9).
Measures of this distribution provided include:
- Mean,
- Median, 5th percentile value, and 95th percentile value.
. The mean probability of each accident progression bin for each plant damage state (as shown in Fig. A.10) .
As illustrated in Figure A.3, the result of this process is the third input to the risk calculation, P(PDSj -+ APBj),the conditional probability of accident progression bin / given plant damage state 1. A.4 Radioactive Material Transport (Source Term) Analysis" A.4.1 1. introduction The third part of the NUREG-1150 risk analyses is the estimation of the extent of radioactive material transport and release into the environment and the conditions of the release (timing and energy). As described above, the interface between this and the previous step (the interface being the accident pro-gression bin) is defined to efficiently transfer the important information, while maintaining a manageable set of calculations. The principal steps in the source term analyses were:
. Development of parametric models of material transport, e Development of values or probability distributions for parameters in the models, and e Grouping of radioactive releases.
Each of these steps will be discussed below. I A.4.2 Development of Parametric Models As noted previously, in a risk analysis it is not practical to analyze every projected accident in detail with a I mechanistic computer code. The method used for this part of the risk analysis was designed to be efficient er ough 'o calculate source terms for thousands of accident progression bins and flexible enough to allow ; for incorporation of phenomenological uncertainties into the analysis. l
*In this report, early containment failure includes failures occurring before or within a few minutes of reactor vessel breach i for pressurized wuter reactors and those failures occurring before or within 2 hours of vessel breach for boiling water 3 reactors. Containment bypass failures are categorized separately from early failures. i **This section adapted, with editorial modification, from Chapter 2 of Reference A.2.
NUREG-1150 A-30 i
Appendix A 18
.su ,
107 * * ' ) estu . esig
- n. -
g Obtb -
. M-. r
-= ..iu 5 g 10', - u. ,- . u.
eso
.5 - ,
] f W, -, l - t' E
.C 3 o- 3 , .
~
c
=
c
.e o
.s u : -
- n. s h 4, ** l
- I St h c 'C 10 ,
_I I ** I n. U h 6t h J I St u ** SLL
~ 6th d
' I 10' * -
W = mean m = median th = percentile ,,
. . . . . . . . . . . . - . . . . lp te r n al Init iato rs - - - - - - - - - - - - - - -- - - -
Plant Dan.ege States SD0 Alms T nnuents Lol As bypass FWA Fire Se a n.ac i Core Damage Req 2 79*10
- 1 41 '1 u n7t*10 6 07*10 3 45*10 4 06*10 1 09*10 I 90*ltI*
i i f Figure A.9 Example display of early containment failure probability distribut.an. - A-31 NUREG-1150
Appendix A-I 1 l e PLANT DAMAGE STATE (Mean Core Damage bquency) M9"'a*F ACCIDENT Weighted PROGRESSION sBo ATws Transie.a. LoCAs Bypes. Averase nre seis mic BIN (27BE-05) ( 41E-06) (l_76E-06) ' (6 07E-06) (3.45E-06) (4.06E-05) (1.09E-05) (192E-04) 0.003 0.003 0.005 0.003 0.005 0006 VB. alpha, , carly CF 0005 0 001 0 001 0.004 00?3 0 008 VB > 200 psi. sarly CF VB. < 200 psi. 0082 sarly CF VB, BWT, late CL 0.079 0.046 0.013 0.055 , 0.059 0.29 0.280 Bypass 0.003 0 07B 0.007 1000 D 12 0 001 P.31 0.52 0.21 0.56 0.34 0.69 043 VB. No CF 0 59 0.35 0.76 0.35 046 0 18 No VB Key: BMT
- Basemat Meit-Through CF = Containment Failure CL = Containment Lea VB = Venel Breach a
Figure A.10 Example display of mean accident progression bin conditional probabilities. J I NUREG-1150 A-32
l l Appendix A For the NUREG-1150 risk analyses, parametric models were developed that allowed the calculation of source terms for a wide range of projected accidents. While the basic parametric equation for the models was largely the same for all five plants studied, it was customized to reflect plant-specific features and conditions that could impact the source term estimates. As noted in Figure A.3, the codes that manipulate these prametric equations are called XSO'R, where the X Nfers to a plant-specific abbreviation; for example, the code for Peach Bottom is PBSOR (Ref. A.55). The parametric equations do not contain any chemistry or physics (except mass conservation), but de-scribe the source terms as the product of release fractions and transmission factors at successive stages in the accident progression for a variety of release pathways, a variety of projected accidents, and nine classes of radionuclides. (To allow a manageable calculation, the radionuclides were treated in terms of radionuclides groups that have similar properties, the same ninc groups that are defined in the Source Term Code rackage (Ref. A.41)). Fir.ure A.11 illustrates some of the release pathways and release frac-tions includ:d in the model. The release is broken up into constituent parts (release freions and trans-mission factors) in order to allow the input of a range of uncertainty within each part and to allow differ-ent components of the release to occur at different times. The basic narametric equations are of the form STj(i) + STh(i) + STe(i) + STj(i) + Special Terms, where (i) represents the radionuclides group, STj(i) represents releases from the fuel that occur in-vessel, STh(i) represents releases from the fuel that occur during high-pressure melt ejection, STe(i) rep.esents releases from the fuel when the fuelis out of the vessel, primarily during core-concrete interactions, and STf represents releases from the fuel that occur in-vessel but that plate out in the reactor coolant system (RCS) before the RCS integrity is lost and are released later. An example of a "Special Term" is an expression for releases from the plant for a bypass accident. The individual terms on the right-hand side of the equation above represent different radionuclides release pathways and are represented as products of release fractions and transmission factors. For example, the expression for STj(i) for PWRs is given by STj(i) = FCOR(i) * (FISG(i)
- FOSG(i) + (1-FISG(i))
- FVES(i)
- FCONV/DFE) where FCOR(i) is the fraction of initial inventory of nuclide group i release'd from the fuel in-vessel, FISG(i) is the fraction of material released from the core in-vessel that enters the steam generators, FOSG(i) is the traction of material entering the steam generators that leaves the steam generators and enters the environment, FVES(i) is the fraction of material entering the RCS that is released from the RCS, FCONV(i) is the fraction of the material released from the vessel that would be released from the containment in the absence of special decontamination mechanisms such as sprays that are included in DFE, and DFE is the decontamination factor to be applied to release from the vessel. The expression for BWRs is simpler because the terms related to the steam generators can be omitted. Similar expressions exist for STe(i), STh(i), and sty (i).
The parametric equation allows for uncertainty in the release fractions and for the effects of important boundary conditions, such as timing or temperature history to be included in the source term calculation. Any parameter in the equation can be represented by a probability distribution (this distribution can be sampled in the Monte Carlo analysis). All parameters (FVES(i) FISG(i), etc.) can be made to vary with accident progression bin characteristics, such as high pressure in the vessel. The accident progression bin characteristics are passed from the previous part of the risk analysis. The expression for STe(i)is associated with the core-concrete interaction releases. The impact of con-tainment conditions such a the availability of overlying water or the operability of sprays is included in the expression for STe(i). In addition, the timing and mode of containment failure or leakage is considered in order to calculate a release from containment to the environment. I A-33 NUREG-ll50
i Appendix A l j
\
Containment release et nvessel speces Containne,i release. hie Late g revolatilaaten revolaMaaton pea,,$e yg VM from the
'U-WessG4 Late containment M' Earty containment
- c. decontaminatiert F"" i depositon, etc.
Containment release et 1... l l CCIspeces % in vessei
-9 core redesse Decontaminate on:
suppression pool, Late cent decon pr t . sprays anti D'ter teatures H'9h Pessure Late , ejection release release of iodine v-from mater Release during
^ - -
poca 'ciefer gegn*
- g ,~y core.concree poo6s sprays.ete -
2 .['teracion l Figure A.11 Simplified schematic of source term (XSOR) algorithm. NUREG-1150 A-34
Appendix A Late revolatilization from the vessel and late release of iodine from water pools are included in the expres-sion for SPj(i). These secondary sources of radionuclides that were removed in earlier processes are kept track of in a consistent manner and made available for release at a later time. A.4.3 Development of Values or Probability Distributions Given the parametric equations used to define the source terms, it was necessary to define basic parame-ters. None of the parameters were internally calculated; the values must be specified by the user or chosen from a distribution of values by a sampling algorithm. Initially, the equations and the parameters for the equations were developed through detailed examination of the results of Source Term Code Package (STCP) analyses of selected accidents, performed specifically for the NUREG-1150 study (Refs. A.56 and A.57). Subsequent incorporation of calculations and experimental data from a variety of sources (e.g., STCP (Ref. A.41), CONTAIN (Ref. A.40), MELCOR (Ref. A.43), and other computer codes) has led to models that more broadly reflect the range of source term information available in the reactor safety research community. With the NUREG-1150 objective of the performance of quantitative uncertainty analysis, data on the more important parameters were constructed in the form of probability distributions. Such distributions were developed using expert judgment to interpret the available data or calculations. For a few parameters that were judged of lesser importance or not considered as uncertain, single-valued estimates were used in the XSOR models. These estimates were derived from STCP and other calculations, adjusted as needed for the boundary conditions associated with the accident progression bins. A.4.4 Grouping of Radioactive Releases The source term calculations performed with the XSOR codes have a one-to-one correspondence with the accident progression bins. With the large number of bins used in the detailed risk analyses and the consid-eration of parameter uncertainties, a large number of source term calculations was required. This number of calculations was tor reat to be directly used in the next step in the risk analysis, the offsite conse-quence analysis. The tfor th (tens of thousands of) source terms were grouped into abcut 59 groups. The source terms were grouped according to their potential for causing early tatalities, their potudal for causing latent cancer fatalities, and the warning time associated with them. This grouping was ccom-plished with the PARTITION code (Ref. A.58). Reference A.58 explains in more detail how the early fatality and latent fatality potentials and the warning times were calculated. Each source term group was represented by an average source term, where the averaging was weighted by the frequency ,of occurrence of the accidere progression bm Ci ving rise to that source term and where each (Monte Carlo) calculation for the uncertainty analysis was weighted equally. Characteristics such as the energy of release were not used to group the source terms, although each group was represented by an average energy of release. A.4.5 Products of Source Term Analysis The product of this step in the NUREG-1150 risk analysis process is the estimate of the radioactive release magnitude (in the form of a probability distribution), with associated energy content, time, and duration of release, for each of the specified source term groups. In NUREG-1150, radioactive release magnitudes are displayed in the following ways: e Distribution of release magnitudes for each of the nine isotopic groups for selected accident progres-sion bins (as shown in Fig. A.12); and e Frequency distribution (in the form of complementary cumulative distribution functions) of radioac-tive releases of iodine, cesium, strontium, and lanthanum (as shown in Fig. A.13). The results of the source term analysis are the fourth input to the risk calculation, (P(APBj-+ STGk ). the conditional probability that accident progression bin j will lead to source term group k. A-35 NUREG-1150 J
' Appendix A .
i i i i l i Release Fraction t 1.0E+00 = -- . ! l - us'
-- me an _ j
~~'
1.OE-01 g __
- 6%' _]
i 1.0E- 02 5 5 -- i 3 - 1.0E- 03 5 - -- ;
)
4 1.0E-04 =
~
A & -M 1.0E- 0 5 -l NG I Cs Te Sr Ru La Ba Ce Radionuclides Group 1 Figure A.12 Example display of radioactive release distributions for selected accident progression bin. NUREG-1150 A-36
! Appendix A (yr-l) ... Frequency of R > R* 6-8)
... Frequency of R > R* cesium Group -*
todine Group - * - = - ** *
"* ... *e
. . . , - .s , + e --e-.
e " * " "
'**** . . 4ww ... r.-...m..,. . .-
'~
' - - - .- - e - , , ,%, . * . . . . ,
l 'r; s,
- . 4.,,-
- e.. p g .
s.. , D, ag
+ ,
s..
- s.. ,
- e. ,
, [
't .
5, A-s ee . , e ( 6 s.. .. .... . a .* .... .s-- -
.. i .. . ".
. ... . Release Fractlen Reneese Fraction l
l \ t i i 1
* (yr-1)'
,,, Frequency of R ,
... Frequene. of R > R* (fr-l) e e
- e==
1.anthanum Group ~~ { Stronuum Group . l . . .s 'a* t em 4 w em 4 *aw ... , l ... , i6- ^ - - ( -. ,, , e.. p .p+ ....***.,
. . . , e% &
4 s -
... , ' a ,! *<
... , 6 ,g*0 . ,
;g 4, * *
... , D h,
Release Fraction Renesee Fraction Figure A.13 Example display of source term complementary cumulative distribution function. A-37 NUREG-1150
Appendix A A.5 .Offsite Consequence Analysis A.S.1 ' Introd uction The severe reactor accident radioactive releases described in the preceding section are of concern because of their potential for impacts in the surrounding environment and population. The impacts of radioactive releases to the atmosphere from such accidents can manifest themselves in a variety of ways, such as early l and delayed health effects, loss of habitability of areas close to the power plant, and economic losses. The fourth step in the NUREG-1150 risk analyses is the estimation of these offsite consequences, given the radioactive releases generated in the previous step of the analysis. : i The principal steps in the offsite consequence analysis are: '
- Assessment of pre-accident inventories of radioactive material.
j
=
Analysis of the downwind transport, dispersion, and deposition of the radioactive materials released from the plant; e Analysis of the radiation doses received by the exposed populations via direct (cloudshine, inhala-tion, groundshine, and deposition on skin) and indirect (ingestion) pathways; Analysis of the mitigation of these doses by emergency response actions (evacuation, sheltering, and relocation of people), interdiction of milk and crops, and decontamination or interdiction' of land and buildings; e Calculation of the health effects of the release, including: Number of early' fatalities and early injuries expected to occur within 1 year of the accident, and the latent cancer fatalities expected to occur over the lifetimes of the exposed individuals; . The total population dose received by the people living within specific distances (e.g., 50 miles) of the plant; and Other specified measures of offsite health effect consequences (e.g., the number of early fatali-ties in the population living within 1 mile of the reactor site boundary). Each of these steps will be discussed in the following sections. The NUREG-1150 offsite consequence calculations were performed with Version 1.5 of the MACCS (MELCOR Accident Consequence Code System) computer code (Ref. A.10). A.5.2 Assessment of Pre-Accident Inventories The radionuclides core inventories were calculated using the SANDIA-ORIGEN code (Ref. A.59). For PWRs, a 3412 messwatt (MW) (thermal) Westinghouse PWR was used, assuming an annual refueling cycle and an 80 percent capacity factor. The core contains 89.1 metric tons of uranium (MTU), is initially i enriched to 3.3 percent U235, and is used in a 3-year cycle, with one-third of the core being replaced i cach year. The specific power is 38.3 MW/MTU, which gives the burnups at the end of 3-year cycle at j 11,183 megawatt-r'ays (MWD)/MTU 22,366 MWD /MTU, and 33,550 MWD /MTU for each of the three regions of the r. ore. i j For BWRs, a 3$78 MWT General Electric BWR-6 was used, assuming an annual-refueling cycle and an ; 80 percent capacity factor. The core contains 136.7 MTU and has initial enrichments of 2.66 percent and 2.83 percent U235. The 2.66 percent fuelis used for both the 3-year cycle and the 4-year cycle, while the 2.83 percent is used only for the 4-year cycle. The fuel on 4-year c! iles operates at roughly average power for the first three years and is then divided into two batches for the fourth year: half going to the core center (near average power) and half going to the periphery (about half of the average power). This complex fuel management plan yields five different types of discharged spent fuel. The inventory at the NUREG-1150 A-38
1 Appendix A end of annual refueling is then a blend of different types, since the code performed the actual calculation on a per fuel assembly basis. The core inventory of each specified plant studied was calculated by multiplying the standard PWR or BWR core inventory calculated above by the ratio of plant power level to the power level of the standard plant. For these risk analyses, nine groups were used to represent 60 radionuclides considered to be of most importance to offsite consequences: noble gases, iodine, cesium, tellurium, strontium, ruthenium, cerium, barium, and lanthanum. A.S.3 Transport, Dispersion, and Depos: tion of Radioactive Material The MACCS code uses an empirical straightline Gaussion model for calculations of transport and disper-sion of the plume that would be formed by the radioactive material released from the plant. These calcula-tions use the sequence of successive hourly meteorological data of the reactor site for several days begin-ning at the release (Ref. A.10). MACCS also calculates the rise of the plume vertically while it is transported downwind if the radionuclides release is accompanied by thermal energy. Actual occurrence and the height of the plume-rise would depend on the thermal release rate and the ambient meteorology-cal conditions at the time of the release (Ref. A.60). Depletion of the plume by radioactive decay and dry and wet deposition processes during transport are taken into account. Radioactive contamination of the ground in the wake of the plume passage due to the dry and wet deposition processes is also calculated. These calculations are performed up to a ver1 large distance, namely,1,000 miles, from the reactor. Beyond the distance of 500 miles frc.a the reartor, a sp,cial artifice of calculation is used to gradually deplete the plume of its remainir.g radionuclides contert in particulate form and deposit it on the ground. The purpose of doing this is to provide a nearly complete accounting of the radionuclides released in particulate form from the plant. The impact of relatively small quantities of the noble gases (which do not l deposit) leaving the 1,000-mile region is considered to be negligible. For this reason the 1,000-mile circu-lar region is recognized as the entire impacted site region for this study. The consequences for a given release of radioactive material would be different if the release occurred at different times of the year and different ambient weather conditions. Consequences would also be differ-ent for different wind directions during the accident due to variations with direction in the population distribution, land use, and agricultural practice and productivity of the site region. As such, the MACCS i code provides probability distributions of the consequence estimates arising from the statistical variability of seasonal and meteorological conditions during the accident. The models generally accomplish this by repeating the calculations for many weather sequences (each beginning with the release nf the radioactive material) which are statistically sampled from the historical hourly meteorological data of the reactor site for one full year. The product of the probability of a weather sequence and the probability of wind blowing toward a direction sector of the compass provides the obability for the estimate of the magnitude of each I i consequence measure for this weather sequence ar~ direction sector combination. Computer models employed in the past and present NRC studies use about 1,500 to 2,500 weather sequence and direction sector combinations. This produces a like number of magnitude and probability pairs for each conse-quence measure analyzed. Collectively, these pairs for a consequence measure provide a large data base j to generate its meteorology-based probability distribution. 1 A.S.4 Calculation of Doses MACCS calculates the radiological doses to the population resulting from several exposure pathways using a set of dose conversion factors described in References A.61 through A.63. During the early phase, which begins at the time of the radionuclides release and lasts about a week, the exposure pathways are the external radiation from the passing radioactive cloud (plume), contaminated ground, and radiation from the radionuclides deposited on the skin, and internal radiation from inhalation of radionuclides from the cloud and resuspended radionuclides deposited on the ground. Following the early phase, the long-term (chronk) exposure pathways are external radiation from the contaminated ground and internal radiation i from ingestion of (1) foods (milk and crops) directly contaminated during plume passage, (2) foods grown on contam;.ned wn, un.* (3) contaminated water, and from inhalation of resuspended radionuclides. A-39 NUREG-1150
Appendix A A.5,5 Mitigation of Doses by Emergency Response Actions In the event of a large atmospheric release of radionuclides in a severe reactor accident, a variety of emergency response and long-term countermeasures would be undertaken on behalf of tV publi: to mitigate the consequences of the accident. The emer;ency response measures to reduce the doses from the early expomre pathways include evacuation or sheltering (followed by relocation) of the people in the areas relatively close to the plant site and relocation of people from highly contaminated areas farther away from the site. The long-term countermeasures include decontamination of land and property to make them usable, or temporary or permanent interdiction (condemnation) o'Nhly contaminated land, property, and foods that cannot be effectively or economically decontamin . . These response measures are associated wiih expenses and losses that contribute to the offsite eco. iomic cost of the accident. The analysis of offsite consequences for this study included a " base case" and several sets of alternative emergency response actions. For the base case, it was assurned that 99.5 percent of the population within the 10-mile emergency phnning zone (EPZ) participated in an evacuation. This set of people was as-sumed to move away from the plant site at a speed estimated from the plant licensee's emergency plan, after an initial delay (to permit communication of the need to evacuate) also estimated from the licensee's plan. It was also assumed that the 0.5 percent of the population that did not participate in the initial evacuation was relocated within 12 to 24 hours after plume passage, based on the measured concentra-tions of radioactive materialin the surrounding area and the comparison of projected doses with proposed Environmental Protection Agency (EPA) guidelines (Ref. A.64). Similar relocation assumptions were made for the population outside the 10-mile plar:ning zone. Several alternative emergency response assumptions were also analyzed in this study's offsite consequence and risk analyses. These included: e Evacuation of 100 percent of the population within the 10-mile emergency planning zone; e Indoor sheltering of 100 percent of the population within the EPZ (during plume passage) followed i by rapid subsequent relocation after plume passage; I e Evacuation of 100 percent of the population in the first 5 miles of the planning zone, and sheltering followed by fast relocation of the population in the second 5 miles of the EPZ; and e In lieu of evacuation or sheltering, only relocation from the EPZ within 12 to 24 hours after plume passage, using relocation criteria described above. In each of these alternatives, the region outside the 10-mile zone was subject to a common assumption that relocation was performed based on comparisons of projected doses with EPA guidelines (as discussed above). A.5.6 IIcalth Effects Modeling The potential early health effects of radioactive releases are fatalities and morbidities (injuries) occurring within about a year in the population that would receive acute and high radiological doses from the early exposure pathways. The potential delayed health effects are fatal and nonfatal cancers that nuy occur in the exposed population after varying periods of latency and continuing for many years; and various types of genetic effects that may occur in the succeeding generations stemming from radiological exposures of the parents. Both early and chronic exposure pathways would contribute to the latent health effects. The early fatality models currently implemented in MACCS are based on information provided in Refer-ence A.65. Three body organs are used in the early fatality calculations: red marrow, lung, and lower large intestine (LLI). The organ-specific early fatality threshold doses used are 150 rems, 500 rems, and 750 rems, and LD3 o used are 400 rems,1,000 rems, and 1,500 rems to the red marrow, lung, and LLI respectively. The models incorporate the reduced effectiveness of inhalation dose protraction in causing early fatality and the tenefits of medical treatment. NUREG-1150 A-40
Appendin A The early injury models implemented in MACCS are also threshold models and are similar to those described in Reference A.65. The candidate organs used for the current analysis are the stomach, lungs, skin, and thyroid. The latent fatal and nonfatal cancer models implemented in MACCS are the same as described in Refer-ence A.65, which are based on those of the BEIR 111 Report (Ref. A.66). These models are nonthreshold ard linear-quadratic types. However, only a linear model was used for latent cancer fatalities from the chrod evp=re pathways since the quadratic term was small compared to the linear term because of low individual doses from these pathways. The specific organs used were red marrow (for leukemia), bone, breast, lung, thyroid, .LL1, and others (based on the LLI dose representing the dose to the other organs). Population exposure has been treated as a nonthreshold measure; truncation at low individual radiation dose levels has not been performed. A.5.7 Products of Offsite Consequence Analysis The product of this part of the analysis is a set of offsite consequence measures for each source term group. For NUREG-1150, the specific consequence measures discussed include early fatalities, latent cancer fatalities, total population dose (within 50 miles and total), and two measures for comparison with NRC's safety goals, average individual early fatality risk within 1 mile and average individuallatent fatality risk within 10 miles. In NUREG-1150, results of the offsite consequence analysis are displayed in the form of complementary cumulative distribution functioris (CCDFs), as shown in Figure A.14. The schedule for completing the risk analyses of this report did not permit the performance of uncertainty analyses for parameters of the offsite consequence analysis, although variability due to annual variations in meteorological conditions is included. Such an analysis is, however, planned far the risk analy$ of the LaSalle plant, now under way at Sandia National Laboratories under contract to NRC. The reader seeking extensive discussion of the methods used is directed to Reference A.67 and to Refer-ence A.10, which discusses the computer used to perform the offsite consequence analysis ,(i.e., the IWELCOR Accident Consequence Code System (MACCS), Version 1.5). Through the use of the MACCS code, the fifth part of the risk calculation was developed: Clk, the mean consequence (representing the meteorologically based statistical variability) for measure I given the source term group k. A.6 Characterization and Combination of' Uncertainties
- An important characteristic of the probabilistic risk analyses conducted in support of this report is that they have explicitly included an estimation of the uncertainties in the calculations of core damage fre-quene, ad risk that exist because of incomplete understanding of reactor systems and severe accident l phene - . na.
There are four steps in the performance of uncertainty analyses. Briefly, these are:
- Scope of Uncenainty Analyscs. Important sources of uncertainty exist in all four stages of the risk analysis, in this study, the total number of parameters th .t could be varied to produce an estimate of the uncertainty in risk was large, and it was somewhat limited by the computer capacity required to execute the uncertainty analyses. Therefore only the most important sources cof uncertainty were included. Some understanding of which uncertainties would be most important to risk was obtained from previous PRAs, discussion with phenomenologists, and limited sensitivity analyses. Subjective probability distributions for parameters for which the uncertainties were estimated to be large and important to risk and for which there were no widely accepted data or analyses were generated by expert panels. Those issues for which expert panels generated probability distributions are listed in Table A.1.
'This section adapted, with editorial rnodification, from Section 2 of Reference A.2.
A-41 NUREG-1150
Appendix A 8
-~ - ' -
r- - i
.-g>5 .
i.g e.f2.o Es,- 8 ,- - I sS u e e y '
" e ,
c i ll. - 8 / .' ! E .9
. . . - 3. : -
8.Y t c 83
,- -e .
1 82 - 2 w l ~ C
; 95 .
l ! ,3 j
! 88 . ?o o N
"j ! 8E E l
-Ee -Q .6 o- . o c - -
e i
- 8o ,' I e g j
- 5, .* : yg a
? , ; ;e!*, ! !8 3
, . .e . 6- -
E ge 2 e c
-3 7 i p u
. I :
8 5.ll '
's$ b
_ . . . i , . . . . ._ E . ... .
.1 v . 3 c c8 e , -
g - m , o y - p ew c
? ? Y . ? . 9 7- ? ? ? Y ? ? ,
7%
- 8 8 8 8 8 8 8 8 8 8 8 8 5
. 8_ 8_ 8_ _ 8_ ,
(seeA-soiseea se::) Aouence;3 e auecesora (see4-;oices, see) Aousneeeg e:~eceeons e o o en e W D o U" U 8 8 r-- . _,., ,_. . . . . . -, ,' o u 4
,M o v .M
. c sa:
c ae
. *-?
2 = go 2 e e ,- ' . - .l -3 3 u - 8 .-
- ,- .~o9 o
s u ll ,
.' - .- l. w nn .-
i89 ac. 9o - a G, *5 y
. 8. =E 9:r g c a
- E 8 a
~' 19E E
?? '
! 8.E
! gg .
m: 5
. .w ,/ ,.
1 o C la~o w n 198 5 < 4
=
! @ !! 18% e l
- : rs2:
- 2 r,, S-m g a" '1 I
s ! i
' ll 1 8 -
m _ _. _.. 8.a i 3 8 5 8 8 8 8 8 $ 8 5 9 8 8 8 8 9$ 8 8 8 8-8 8 8 8 8 8 8 5 8 8 8 8 DesA-;oloesa se::) Acuence,y eaueces:rg (seeA-sotopee so i Aouence;g sources:.g 1 I l NUREG-1150 A-42
Appendix A Table A.1 Issues considered by expert panels.
- Accident Frequency Analysis Panel Failure probabilities for check-valves in the quantification of interfacing-system LOCA frequencies (PWRs)
Physical effects of containment structural or vent failures on core cooling equipment (BWRs) Innovative recovery actions in long-term accident sequences (PWRs and BWRs) Pipe rupture frequency in component cooling water system (Zion) Use of high-pressure service water system as source for drywell sprays.(Peach Bottom)
- Reactor Coolant Pump Seal Performance Panel Frequency and site of reactor coolant pump seat failures (PWRs) e In-Vessel Accident Progression Panel Probability of temperature-induced reactor coolant system hot leg failure (PWRs)
Probability temperature-induced steam generator tube failure (PWRs) Magnitude of in-vessel hydrogen generation (PWRs and BWRs) Mode of temperature-induced reactor vessel bottoin head failure (PWRs and BWRs) { l
- Containment Loadings Panel Containment pressuie increase at reactor vessel breach (PWRs and BWRs) ;
Probability and pressure of hydrogen combustion before reactor vessel breach (Sequoyah and Grand i Gulf) Probability and effects of hydrogen combustion in reactor building (Peach Bottom) e Molten Core-Containment Interactions Panel Drywell shell meltthrough (Peach Bottom) Pedestal erosion from core-concrete interaction (Grand Gulf) e Containment Structural Performance Panel Static containment failure pressure and mode (PWRs and BWRs) Probability of ice condenser failure due to hydrogen detonation (Sequoyah) Strength of reactor building (Peach Bottom) Probability of drywell and containment failure due to hydrogen detonation (Grand Gulf) Pedestal strength during concrete erosion (Grand Gulf) e Source Term Expert Panel l In-vessel retention and release of radioactive material (PWRs and BWRs) l Revolatization of radioactive material from the reactor vessel and reactor coolant system (early and late) (PWRs and BWRs) l Radioactive releases during high-pressure melt ejection / direct containment heating (PWRs and BWRs) Radioactive releases during core-concrete interaction (PWRs and BWRs) Retention and release from containment of concrete-concrete interaction radioactive releases (PWRs and BWRs) Ice condenser decontamination factor (Sequoyah) Reactor building decontamination factor (Grand Gulf) Late sources of iodine (Grand Gulf) f A-43 NUREG-1150
Appendix A e Definition of Specific Uncertaireirn In order for uncertainties in accident phenomena to be included in this study's probabilistic riO nalyses they had to be expressed in terms of uncertainties in the parameters that were used in we s udy. Each section of the risk analysis was conducted at a slightly different level of detail. Howe .a. each analysis part (except for offsite consequence analysis, which was not included in the uncertainty analysis) did not calculate the characteristics of the accidents in as much detail as would a mechanistic and detailed computer code. Thus the uncertain input pa-rameters used in this study are "high level" or summary parameters. The relationships between fun-damental physical parameters and the summary parameters of the risk analysis parts are not always clear; 4 is lack .of understanding leads to what is referred to in this study as modeling uncertainties. In addition, the values of some important physical or chemical parameters are not known and lead to uncertaintiu in the summary parameters. These uncertainties were referred to as data uncertainties. Both types of uncertainties were included in the study and no consistent effort was made to differen-tiate between the effects of the two types of uncertainties. As noted above, paramen t were chosen to be included in the uncertainty analysis if they were estimated to be large am 'portant to risk and if there were no widely accepted data or analysis, e Development of Probability Distributions. Probability distributions for input parameters were devel-oped by a number of methods. As stated previously, distributions for the input parameters having the highest uncertainties and believed to be of the largest importance to risk were determined by panels of experts. The experts used a wide variety oft echniques to generate probability distributions,includ-ing reliance on detailed code calculations, extrapolation of existing experimental and accident data to postulated conditions during the accident, and complex logic networks. Probability distributions were obtained from the expert panels using formalized procedures designed to minimize bias and maxi-mize accuracy and scrutability of the experts' results. These procedures are described in more detail in Section A.7. Probability distributions for parameters believed to be of less importance to risk were generated by analysts on the project staff or by phenomenologists from several different national laboratories using tw* aques like those employed with the expert panels.
- Combin . certainties. A specialized Monte Carlo method, Latin hypercube sampling (Ref.
A.1T su to sample the probability distributions defined for the many input parameters. The samp. obs 7ati,ns were propagated through the constituent analyses to produce probability distribu-tions foi scre damage frequency and risk. Monte Carlo methods produce results that can be analyzed with a yh iety of techniques, such as regression analysis. Such methods easily treat distributions with wide ranges and can incorporate correlations between variables. Latin hypercube sampling provides for a more efficient sampling technique than straightforward Monte Carlo sampling while retaining the benefits of Monte Carlo techniques. It has been shown to be an effective technique when com-pared to other, more costly, methods (Ref. A.68). Since many of the probability distributions used in the risk analyses are subjective distributions, the composite probability distributions for core damage frequency and risk must also be considered subjective. As stated in Section A.1.2, the results of the risk analysis and its constituent analyses are subjective probability distributions for the quantities in the following equation: Risk g =Eh ElEjE kfn(IE ) hPn(IE
- hPDSj) Pn(PDSj- APBj) Pn(APBj
- STGk ) Cik where:
i Risk g = Risk of consequence measure I for observation n (consequences / year); fn(IEh) = Frequency (per year) of initiating event h for n observations; Pn(IEh-+ PDSj) = Conditional probability that initiating event h will lead to plant damage state i for observation n; NUREG-1150 A-44
Appendix A Pn(PDSj -+ APBj) = Conditional probability that PDSj will lead to accident progression bin J for obser-vation n; Pn(APBj -+ STGk) = Conditional probability that accident progression binj willlead to source term group k for observation n; and Clk = Expected value of consequence rneasure I conditional on the occurrence of source term group k. With Latin hypercube :;4mpting, the probability distributions are estimated with a limited number (about 200) of calculations of risk, each calculation being equally likely. That is, for the uncertainty analysis about 200 values of Risk yy are generated. Riskjy can then be described in a number of ways, such as a histogram describiri;; the distribution of Riskfy values, the average (mean) value of risk, etc. Explanations for the tables and figures in this document that show the results of the risk analysis and its constituent analyses are : mvided in Section A.9. Detailed discussion of the NUREG-1150 uncertainty analysis methods is provided in Reference A.2. A.7 Elicitation of Experts
- The risk analysis of severe reactor accidents inherently involves the consideration of parameters for which little or no experiential data exist. Expert judgment was needed to supplement and interpret the available data on these issues. The elicitation of experts on key issues was performed using a formal set of proce-dures, discussed in greater detail in Reference A.2. The principal steps of this process are shown in Figure A.15. Briefly, these steps are:
* .'clection of /ssues. As stated in Section A.6, the total number of uncertain parameters that could be included in the core damage frequency and risk uncertainty analyses was somewhat limited. The parameters considered were restricted to those with the largest uncertainties, expected to be the most important to risk, and for which widely accepted data were not available. In addition, the number of parameters that ersuld be determined by expert panels was further restricted by time and resource limitations. The parameters that were determined by expert panels are, in the vernacular of this project, referred to as " issues." An initial list of issues was chosen from the important uncertain parameters by the plant analyst, based on results from the draft NUREG-1150 analyses (Ref. A.3).
The list was further modified by the expert panels.
. Selection of Experts. L:ve: twnels of experts were assembled to consider the principalissues in the accident frequer.cy analyses (two panels), accident progression and containment loading analyses (three panels), containment structural response analyses (one panel), and source term analyses (one panel). The experts were selected on the basis of their recognized expertise in the issue areas, such as demonstrated by their publications in refereed journals. Representatives from the nuclear industry, the NRC and its contractors, and academia were assigned to each panel to ensure a balance of
" perspectives." Diversity of perspectives has been viewed by some (e.g., Refs. A.69 and A.70) as allowing the problem to be considered from more viewpoints and thus leading to better quality an-swers. The panels contained from 3 to 10 experts.
. Training in Elicitation Methods. Both the experts and analysis team members received training from specialists in decision analysis. The team members were trained in elicitation methods so that they would be proficient and consistent in their elicitation. The experts' training included an introduction to the elicitation and analysis methods, to the psychological aspects of probability estimation (e.g.,
the tendency to be overly confident in the estimation of probabilities), and to probabilky estimation. 1 The purpose of this training was to better enable the experts to transform their knowledge and judg-ments into the form of probability distributions and to avoid particular psychological biases such as
'This section adapted, with editorial modification, frorn Section 2 of Reference A.2.
A-45 NUREG-1150 I
Appendix A Selection Presentation Elicitation - of Technical - of Exporis Training Evidence - l l l 1 Selection of Preparation Presentation lesues of lesues oflesues Esport Preparation Discussion Elicitation of Analyses of Analyses of Experts J l Composition Review Aggregation and Documentation
\
Figure A.15 Principal steps in expert elicitation process. 1 l l NUREG-1150 A-46
Appendi:t A i 1 3 overconfidence. Additionally, the experts were given practice in assigning probabilities to sample i questions with known answers (almanac questions). Studies such as those discussed in Reference A.71 have shown that feedback on outcomes can reduce some of the biases affecting judgmental accuracy.
- Presentation and Review ofIssues. Presentations were made to each panel on the set of issues to be considered, the definition of each issue, and relevant data on each issue. Other parameters consid-ered by the analysis staff to be of somewhatlesser importance were also described to the experts. The purposes of these presentations were to permit the panel to add or drop issues depending on their judgments as to their importance; to provide a specific definition of each issue chosen and the sets of associated boundary conditions imposed by other issue definitions; and to obtain information from additional data sources known to the experts.
In addition, written descriptions of the issues were provided to the experts by the analysis staff. The descriptions provided the same information as provided in the presentations, in ' addition to reference lists of relevant technical material, relevant plant data, detailed descriptions of the types of accidents of most importance and the context of the issue within the total analysis. The written descriptions also included suggestions of how the issues :ould be decomposed into their parin using logic trees. The issues were to be decomposed because the decomposition of problems has been shown to ease the cognitive burden of considering complex problems and to improve the accuracy of judgments (Ref. A.72). For the initial meeting researchers, plant representatives, and interested parties were invited to pre-sent their perspectives on the issues to the experts. Frequently, these presentations took several days.
- Preparatim of Expert Analyses. After the initial meeting in which the issues were presented, the j experts were given time to prepare their analyses of the issues. This time ranged from 1 to 4 months.
The experts were encouraged to use this time to investigate alternative methods for decomposing the issues, to search for additional sources of information on the issues, and to conduct calculations. During this period, several panels met to exchange information and ideas concerning the issues. During some of these meetings, expert panels were briefed by the project staff on the results from other expert panels in orcier to provide the most current data.
- Expert Review and Discussion. After the expert panels had prepared their analyses a final meeting was held in which each expert discussed the methods he/she used to analyce the issue. These discus-sions frequently led to modifications of the preliminary judgments of individual experts. However, the experts' actual judgments were not discussed in the meeting because group dynamics can cause peo-ple to unconsciously alter their judgments in the desire to conform (Ref. A.73).
- Elicitation of Experts. Following the panel discussions, each expert's judgments were elicited. These elicitation were performed privately, typically with an individual expert, an analysis staff member trained in elicitation techniques, and an analysis staff member familiar with the technical subject. The clicitations were done with one expert at a time so that they could be performed in depth and so that ;
an expert's judgments would not be adversely influenced by other experts. Initial documentation of i the expert's judgments and supporting reasoning was obtained in these sessions. 1
- Composition and Aggregation of Judgments. Following the elicitation, the analysis staff composed probability distributions for each expert's judgments. The individual judgments were then aggregated to provide a single composite judgment for each issue. Each expert was weighted equally in the aggregation becatise this simple method has been found in many studies (e.g., Ref. A.74) to perform the best.
- Review by Experts. Ecch expert's probability distribution and associated documentation developed by l
, the analysis staff was reviewed by that expert. This review ensured that potential misunderstandings l ( were identified and corrected and that the issue documentation properly reflected the judgments of the expert. I I i A-47 NU REG-1 '150 ! l 1
Appendix A Detailed documentation of the expert elicitation is provided in References A 45 and A.75. A.8 Calculation of Riske A.8.1 Methods for Calculation of Risk The constituent parts of the risk calculation have been described in previous sections, As illustrated in Figure A.3, a number of computer codes were used to generate a variety of irnermediate information. This information is then processed by an additienal code, RISQUE, to calculate risk. RISQUE is a matrix ' manipulation code. As illustrated in Figure A.16 and explained in Section A.1.2, the elements of the risk calculauon can be represented in a vector / matrix format. l The initiating event frequencies f(IE) constitute a vector of nie dimensions, where nm is the number of initiating events. The plent damage state frequencies f(PDS) constitute a vector of nPDs dimension, j where nPDS is derived from f(IE) by multiplying it by the um by nPDs matrix [P(IE --+ PDS)). P(IEh- PDSj) is the conditional probability that initiating event h will result in plant damage state 1. For this study there are approximately 20 plant damage states. The f(PDS) vector is a product of the accident
- frequency analysis.
Similarly, to obtain the accident progression bin frequencies, the plant damage state vector is multiplied by the accident progression tree output matrix [P(PDS -* APB)]. The [P(PDS --* APB)] matrix is the princi-pal product of the accident progression analysis. ThisnPDs by nAPB matrix represents the conditional ; probability that an accident grouped in plant damage state I will result in an accideni grouped in the jth . accident progression bin. For this study, there are between a few hundred and a few thousand accident I progression bins (nAPB = 1000), depending on the plant. The result of the previous calculation is multiplied by a third matrix that represents the outcome of the source term and partitio<ning analyscs [P(APB --* STG)). This nAPB by nsTo matrix represents the conditional probability that an accident progression bin f will be assigned to source term group k. There are approximately 50 source term groups (nsTo = 50). This yields a vector f(STG) of frequencies of the source term groups. The final element of the risk calculation is a matrix representing the consequences for each uf the sonne term groups C. The nsTo by nc matrix is the product of the consequence analysis, where nc represents the number of consequence measures. For this study, eight consequence measures were calculated (nc - 8). Risk is the product of the frequency vector for the source term groups f(STG) and the conse-quence matrix C. Risk is an eight component vector, for the eight consequence measures, and represents conse'quences averaged over the source term groups. There are nLHs sets of vectors and matnces described above, one for each sample member. Each sample member represents a unique set of valuea for each uncertainty issue and is equally likely. Since conse-quence uncertainty was not included in I.HS sampling, only one consequence matrix C is required; the last term in Figure A.16 is the same for each and every sample member. The ma.rix manipulations der.ribed above were carried out using the t'" JE code. The risk calculation is a fairly straightforward pecess, but the number of numerical manipulauons is lirge, since the risk vector must be chsateci nim times, where nt.Hs is 150 for the Zion calculation,200 for the Surry, Sequoyah, and Peach Bottom calculations, and 250 for the Grand Gulf calculation. Results form a distribution in risk values that represent the uncertainty associated with the issues.
'This section adapted. with editorial modification, from section 2 of Reference A.2.
NUREG-1150 A-48
g 3 f' > s - e ~ C t n n l K- K S S S u I I I s R. R. R. e . . R . K . K . K k S t S g S j I I s R K S R K S I R K S i I I I R R R - R
= = -=
c _ _ C C_ _. C C e 1 n 1 n nG 1 n nG c C. C. T S C. T S . ns . n n . n ei . P. P. P. us . qy . . el ) ) ) sa G 2 G 2 G 2 nn T S C 1 1 T S 1 C 1 . . . . T S C 1 oA ( ( G ( 1 G C C t g C t 1 - T S C t 1 T - S t t 2 j 2 n _C :C n_ _ C C . . C C . . .C X X X_ m g g G T G T G T G_ T r n n n S n S n S n S es 1 P. g 1 S P 1 B P Ti P. P. s . n . nA . n A ey ) G
. P. ) .
. P. ) .
. P.
cl . . G . . G. T . . T . . ra S
. S
. . T S
un 4 g 4 4 oA B j B 2 1 B 2-S P P 1 P P 1 P P 1 1 _ A g A B P A B ( g ( g ( P n 1 A j 1 A j P j 2 n j 2 n P_P :P P P . . P _ P_ P P . . .P X X X _ _ ]B _ _ - n o g p g g_ B P A P B P B P tis 1 n n 9 n n A S n 1 - A nS A - nsi P. P. D P. D ess . . n P
. n P
dey P. P. P. _ i rl ) . . ) . ) . . cga B . . B . B . . P P . P . . con A A A A rA 4 2 1 4 2 1 4 2 P S P j S P 1 S 1 P 1 D D S D S - P j P 1 1 D P P D L ( t 1 P j ( 1 2 n ( j 2 n - P_P :P _ P_ P P ..P _ . P_ P P ...P
~
X X X _. L s S S O
~
si m P ~ ms ey f. f. n n
) .
) .
)
'f.
tl S S sa S . D . D S D yn P . P H P SA ( f j (
- 1- L (
1 2 f f n f - ft-S S S - H H H L L L _ gf. OhEEg o . 3 F ge.w E' g[$,*
.[g exmf[mo
~
~ Appendin A i
,~
The Monte Carlo-based' techniques are amenable to statistical examination to provide insights concerning the result. Descriptive statistics such as central measures, variance, and range can be calculated. The relative importance of the ksues to uncenainty in risk can be determined through examination of the results with statistical techniques such as, regression analysis. The individual observations can also be ex - amined. For example, if the final distribution contains some results that are quite different from all the others (say five observations an order of magnitude higher in consequences than any other observations),- the individual five sample members can be examined as separate complete risk analyses to determine the important effects causing the overall result. One of the key developments in this program is the automation of the risk assembly process. The most significant advantage of this methods package is the ability to recalculate an entire risk result very effi-ciently, even given major changes in the constituent analyses. The manipulation of these models in sensi-tivity studies allows efficient, focused examination of particular issues, and significant ability for examining changes in the plants or in the analysis. The objectives of the program included not only calculations and conclusions concerning the risk results; but also intermediate resuhs were quite important. Each of the analysis steps resulted in intermediate outputs. The intermediate outputs were examined by analysts to ensure the correctness of each step. The nomenclature and representation of the results described in this section are used consistently throughout the documentation of both the methods and the results for a specific p* ant. The same intermediate results are illustrated for each facility and the terminology t' sed to describe those results is consistent with that developed here. A.8.2 Products of Risk Calculation The risk analyses performed in the NUREG-1160 project can be displayed in a variety of ways. The specific products shown in NUREG-1150 are described in the following sections, with similar products provided for early fatality risk, latent cancer fatality risk, average individual early fatality risk within 1 mile - (for comparison with NRC safety goals (Ref. A.12)), average individual latent cancer fatality risk within 10 miles of the site boundary (for safety goal comparison), population dose risk within 50 miles, and population dose risk within the entire region. e The total risk from internal events and, where estimated, for external events Reflecting the uncertain nature of risk results, such results can be displayed using a probability distri-bution. For Part II of NUREG-1150 (plant-specific results), a histogram is used to represent this probability distribution (like that shown in Fig. A.6). Four measures of the probability distribution I are identified in NUREG-1150:
- Mean, Median.
5th percentile, and 95th percentile. '
- Contributions of plant damage states and accident progression bins to mean risk The risk results generated in the NUREG-1150 project can be studied to determine the relative contribution of individual plant damage states and accident progression bins to the mean risk. An example display of the results of such a study is shown in Figure A.17.
A.9 Additional Explanation of Some Figures, Tables, and Terms A.9.1 Additional Explanation of Some Figures and Tables Most of the results presented in this report are genera!ized or summary results. They are similar to the intermediate results described in Section A.8.1. However, the groupings of postulated accidents that take l NUREG-1150 A-50
~7 !
Appendix A ; l i1 SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY i l WE AN e SE-8/RY WE AN e s.2E-3/RY 2 . . . .
.. ' .' 42 i
,jiqili: 6
,,,d': ... .
3
, 7.
3
/i 2
/. !J irl"'
ij;;" g (*i. 5 (\ Ni .: .: .a .
- 5 *~ #
- n Plant Damage States
- 1. S BO
- 2. AT WS
- 3. TR ANSIENTS 4.LOCA
- 6. SYPA 88 SURRY EARLY FATALITY SURRY LATENT CANCEF: FATALITY WE AN e #E-4/RY WEAN e 6.2E-8/PY l
r:-
,97=- - .
n g,.s ei rQ : . . . s __ 4 3 '
.,!lf U\\\ ......,.l 3
- :i :
iiii !!!!!!"j !! != iii :n y .
.iii[ (tx,:i 1
,u.w.!!P'/. .
.::n:
.d!i!!!
- ::i! li
, 4.,
m.:...
*,iP i 5 a aa ,
j Accident Progression Bina f
- 1. VB. Early CF Alphe Mode
- 2. VB. Early CF. RCS Pressure *200 pela at VB
- 3. VB. Early CF. RCS Proteure a200 pois et vB 4.vs.s.uT
- s. eye. . ens t ieLe.=
e.vs.N. Cr
- 7. Ne ve l
I l 1 a Figure A.17 Example display of relative contributions to mean risk. I A-51 NUREG-1150
Appendix A place at the end of each constituent part of the risk calculation are more general in this document than in the contractor reports and than described in Section A.8.1. For example, in reporting the results for the Surry power plant only five (generalized) plant damage states are used, rather than the nine plant damage states described in the supporting documents. The descriptions of the results at both levels of detail are consistent with each other, and one can derive the more generalized results present'e d in this document from those presented in the supporting documents. Details of this derivation are presented in the support-ing documents. Since a Latin hypercube sample of size nLHs is being used for the risk analyses, there are nLHs values of the generalized frequency vectors f(IE), f(PDS), f(APB), f(STG), and RISK. (PDS, APB, and STG refer to the generalized groupings of projected accidents used in this report.) Due to the nature of Dan hypercube sampling, each of these observations has probability equal to 1/nLHs. Thus, the mean value of. the ith element of the vector f(PDS), (i.e., f(PDSj)is given by f(PDSj)m,an = En f(PDSj)n/nLHs where f(PDSj)n is the frequency of the generalized plant damage state i for Latin hypercube member n. Further, individual analysis results for the nLHs sample elements can be ordered 'from the smallest to largest and then used to estimate desired quantiles (i.e., 5th, median, and 95th), where the 'q'th quantile is the value of the variable that is greater than or equal to 'q' percent of the observed results. Median is the commonly used term ior the 50th quantile. i The nLHs values of f(PDSj) can also be used to construct estimated probability density functions for f(PDSj). The estimated density function is constructed by discretizing the range of values of f(PDSj) into a number of equalintervils. The esth aated density function over each of these intervals is the fraction j of Latin hypercube members with values mat fall ethin that interval. In Figure A.18. Pm is an estimate of l the probability that f(PDSj) will fall in interval Im. However, because most of the histograms / density plots presented M NUREG-1150 span several orders of magnitude, the plots are provided on a logarith-mic scale. Thus the corresponding histogram / density functions presented are for the logarithm of the variable under condderation. In these cases, the histogram / density functions represent the probability that the logarithm of the variable falls in various intervals. Whether a density function is for a variable or its logarithm can be recognized by the scale used on the axis corresponding to the variable. Explanation of Figure A.6: Figure A.6 represents an estimated probability density function, as explained above, for the total core damage frequency. The total core damage frequency for a single observation is related to the vector f(PDSh ) by total core damage frequency = TCDF = lI f(PDSj). Total core damage frequency is calculated for each observation and used to estimate a core damage histogram as described above. Explanation of Figure A 7: Figure A.7 shows the mear; value of the total core damage frequency, where the rnean is over all the Latin hypercube members, as explained above. The fractional contributions indicated by sections of the pie charts are the ratios of the mean values of the frequencies of the general-ized plant damage states f(PDSj) to the mean value of the total core damage frequency. Explanation of Figure A.10: Figure A.10 is a table of mean transition (the mean taken over all Latin hypercube members) (P(PDS-+APB)), using generalized plant damage states and generalized accident progression bins. The generalized plant demage states and accident progression bins are described in the figure and the figure key. Explanation of Figures A.13 and A.14: The results of the risk analyses are also used in the construction of complementary cumulative distribution functions (CCDFs). Examples of mean CCDFs appear in NUREG-1150 A-52
I Appendix A ' I f(PDS[): i I frequency i i ) of PDSI i t i Im 4 I t Pm probability that f(PDS I ) e im i j Figure A.18 Probability that f(PDSj) will fall in interval Im. - A-53 NUREG-1150
Appendix A Figures A.13 and A.14. The CCDFs in Figure A.13 are for source term magnitude. The CCDFs in Figure A.14 are for consequence results and incorporate both stochastic weatler variation and variation /uncer-tainty in accident initiation, progression, and source term characteristics. In figures of this type,1he value on the ordinate (y-axis) gives the frequency at which the corresponding value on the abscissa (x-axis) is exceeded. A discussion of the construction of the CCDFs is provided in Appendix B. A.9.2 Explanation of Some Terms An uncertain variable (often called a random variable in statistical texts) can take on any of several possible values, but it is impossible to predict which value will be observed in any given trial. The possible specific values are called realizations of the uncertain variable. Although there is no precise knowledge which realization will occur, there is a rule that tells 'which of the possible realizations is most likely; in fact, the rule quantifies the likelihood of each possible realization. The rule is called a probability distribu-tion. For any possible realization, the probability distribution tells the pr.obability of that value occurring. i There is controversy about the meaning of the probability distribution. The two principal interpretations are the frequentist and the subjective approaches. The frequentist orientation defines the probability as the frequency of obtaining the specific value in a very long number of independent trials. For example, if the uncertain variable took the value x1500 times out of 1000 trials, then the probability attached to the value x1 is 0.50. The subjective approach defines the probability as an individual's degree of belief in the likelihood of obtaining the specific value. The subjective probability can be defined as the odds that an individual would be equally willing to give or take on a bet that the uncertain variable would have the specific value. For example, if an individual will accept even money odds that the uncertain variable will
]
have the va'lue x1 and is equally willing to take either side of the bet, then his probability for the value x1 .J is 0.50. ! For many variables, the probability distribution for their realizations is unknown or the laws of nature affecting the probability distribution are imperfectly understood. However, an expert might understand I which laws could apply, and have an opinion as to which law is more likely. If the expert combines his knowledge of the known parts of the situation with his opinions about the relevant unknown parts, he can ) develop a personal estimate of the probability distribution. This is a subjective probability distribution ' (SPD). It is subjective because it varies from one expert to another. SPDs are manipulated by precisely the same rules as probability distributions based on actual data. 1 1 If in : ; pup of experts who are representative of the possible pool of experts each expert produces a subjective j robability distribution, the distributions of the group members can be aggregated or combined in such a way that the aggregate distribution can be generalized to the entire pool of possible experts.' The most important uncertain variables of this study were developed by groups of experts and so aggre-gated. There is an important difference in interpretation between subjective probability distributions and data-based probability distributions. The latter represent the probability that a specific value will occur on a given trial. The SPD expresses a degree of belief that the value might occur. The distribution can be considered a distribution of belief rather than of knowledge. It must not be supposed that any value will be realized with the probability indicated by the SPD, nor even that an occurrence must be contained within the experts' aggregated range. However, although experts are sometimes wrong, the aggregated opinions of experts should be superior to the opinions of non-experts. Most of the variables in this study are actually continuous and have an infinite number of possible realiza-tions. Almost all uncertain variables have a minimum possible value and a maximum possible value; the distance between the two is the range of the uncertain variable. The probability that the uncertain variable will take on just one value out of an infinite number of possible values within the range is zero. However, it is possible to speak of the density of probability about any specific value. The rule that describes the
'This is so because (absent any other information about the population) the sample mean is the best estimate of the popula-tion mean, and the population mean (absent any special information about individuals in the population) is the best esti-mate of the responses of any member of the population.
NUREG-1150 A-54
Appendix A density of probability over the range of the variable is the probability density function (PDF). It is the probability that a realization will occur within the neighborhood of each value, divided by the width of the neighborhood. The integral of the PDF over the range is 1.0; this says that any realization must be within the range. The integral of the PDF between the minimum value of the range and any specific point in the range is the probability that the next realization will have a value less than or equal to the specific point. If the integralis carried out for ever) point in the range, the resulting function is the cumulative distribution function (CDP) or cumulative probability distribution (CPD). The CDF was used to characterize the uncertainty in each of the sampled variables considered in this study, but does not explicitly appear in this report. The compicmentary cumulative distribution function (CCDF) is closely related to the CDF. It is the probability that the "true" realization will be greater than any specific point in the range. The CCDF is simply 1.0 minus the CDF at every point. The CCDF is used in some instances in this report. The PDF is difficult to compute accurately from a limited sample of data. However, the PDF can be approximated by thefrequency histogram. This is the number of observations falling in each finite interval of the range. If the intervals are suitably chosen, the frequency histogram can be a good approximation of the PDF. Frequency histograms are often used in this report. Initiating events are characterized by their frequency-the number of times such events can be expected to occur per year. As long as the frequency is substantially less than 1.0, this is equivalent to the probability of the event occurring in any given year. Succeeding events are characterized by their conditionalprob-ability. The conditional probability of B given A is the probability that B will occur if A has already occurred. The characterization of succeeding events can also be thought of as a relatirefrequency, that'is, their frequency relative to the frequency of the preceding event. The methods for manipulation of chains of conditional probabilities are well known. Additionalinformation on statistics and probability can be found in References A.76 through A.80. l l A-55 NUREG-1150
Appendin A REFERENCES FOR APPENDIX A A.1 D. W. Ericsor, Jr., (Ed.) et al., " Analysis of Core Damage Frequency: Methodology Guidelines," Sandia Nati'nal Laboratories, NUREG/CR-4550, Vol.1, Rev.1, SAND 86-2084, to be pub-lished.' A.2 E. D. Gorham-Bergeron et al., " Evaluation of Severe Accident Risks: Methodology fo- the Acci-dent Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analyses," Sandia National Laboratories, NUREG/CR-4551, Vol.1, Draft Revision 1, SAND 86-1309, to be pub-lished.' A.3 United States Nuclear Regulatory Commission (USNRC), " Reactor Risk Reference Document," NUREG-1150, Vols.1-3, Draft for Comment, February 1987. A.4 M. T. Drouin et al., " Analysis of Core Damage Frequency from Internal Events: Methodology Guidelines," Sandia National Laboratories, NUREG/CR-4550, Vol.1, SAND 86-2084, September 1987. A.5 A. S. Benjamin et al., " Evaluation of Severe Accident Risks and the Potential for Risk Reduction: Surry Power Station, Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol.1 Draft for 1 Comment, SAND 86-1309, February 1987. A.6 A. S. Benjamin et al., " Containment Event Analysis for Postulated Severe Accidents: Surry Nuclear Power Station, Unit 1," Sandia National Laboratories, NUREG/CR-4700, Vol.1, Draft for Com-ment, SAND 86-1135, February 1987. l A.7 H. J. C. Kouts et al., " Methodology for Uncertainty Estimation in NUREG-1150 (Draft): Conclu- l l sions of a Review Panel," Brookhaven National Laboratory, NUREG/CR-5000, BNL-l NUREG-52119, December 1987. A.8 W. E. Kastenberg et al., " Findings of the Peer Review Panel on the Draft Reactor Risk Reference Document, NUREG-1150," Lawrence Livermore National Laboratory, NUREG/CR-5113, UCID-21346, May 1988. A.9 L. LeSage et al., "Instial Report of the Special Committee on Reactor Risk Reference Document (NUREG-1150)," American Nuclear Society, April 1988. 1 A.10 D. I. Chanin et al., "MELCOR Accident Consequence Code System (MACCS)." Sandia National Laboratories, NUREG/CR-4691, SAND 86-1562, to be published.' A.11 L. T. Ritchie et al., "CRAC2 Mode.1 Description," Sandia National Laboratories, NUREG/ CR-2552, SAND 82-0342, April 1984. l A.12 USNRC, " Policy Statement on Safety Goals for the Operation of Nuclear Power Plants," Federal l Register, Vol. 51, p. 28044, August 4,1986. A.13 M. D. McKay et al., " A Comparison of Three Methods for Selecting Values in Input Variables in the Analysis of Output from a Computer Code," Technometrics 21(2), 1979. A.14 G. J. Kolb, " Interim Reliability Evaluation Program: Analysis of the Arkansas Nuclear One-Unit 1 Nuclear Power Plant," Sandia National Laboratories, NUREG/CR-2787, Vol.1, SAND 82-0978, August 1982. A.15 M. T. Drouin et al., " Analysis of Core Damage Frequency: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 6 Rev.1, SAND 86-2084, to be published.'
'Available in the NRC Public Document Room 2120 L Strec: NW., Washington, DC.
NUREG-1150 A-56 i
Appendix A A.16 A. D. Swain III, " Accident Sequence Evaluation Program Human Reliability Analysis Procedure," Sandia National Laboratories, NUREG/CR-4772, SAND 86-1996, February 1987. A.17 W, J. Luckas, Jr., "A Human Reliability Analysis for the ATWS Accident Sequence with MSIV Closure at the Peach Bottom Atomic Power Station," Brookhaven National Laboratory, May 1986. A.18 D. W. Stack, "A SETS User's Manual for Accident Sequence Analysis," Sandia National Labora-tories, NUREG/CR-3547, SAND 83-2238, January 1984. A.19 R. L. Iman and M. J. Shortencarier, "A User's Guide for the Top Event Matrix Analysis Code (TEMAC)," Sandia National Laboratories NUREG/CR-4598, SAND 86-0960 August 1986. A.20 M. B. Sattison and K. W. Hall, " Analysis of Core Damage Frequency: Zion Unit 1," Idaho Na-tional Engineering Laboratory, NUREG/CR-4550, Vol. 7. Rev.1, EGG-2554, to be published.' l A.21 Commonwealth Edison Company of Chicago, " Zion Probabilistic Safety Study," September 1981. A.22 D. L. Berry et al., " Review and Evaluation of the Zion Probabilistic Safety Study: Plant Analysis," Sandia Natioral Laboratories, NUREG/CR-3300, SAND 83-1118, May 1984. A.23 USNRC, " Reactor Safety Study-An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975. A.24 Institute of Electrical and Electronics Engineers, Inc. (IEEE), "IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations," IEEE Standard 500-1984, 1983 A.25 Houston Lighting and Power Company, " South Texas Project Probabilistic Safety Assessment," April 1989. A.26 K. D. Russell et al., " Integrated Reliability and Risk Analysis System (IRRAS) Version 2.0 User's Guide," Idaho National Engineering Laboratory, NUREG/CR-5111, EGG-2535, to be published.' A.27 R. C. Bertucio and J. A. Julius, " Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Rev.1. SAND 86-2084, to be published.' A.28 G. E. Cummings, " Summary Report on the Seismic Safety Margins Research Program," Lawrence Livermore National Laboratory, NUREG/CR-4431, UCID-20549, January 1986. A.29 M. P. Bohn et al., " Application of the SSMRP Methodology to the Seismic Risk at the Zion Nu-clear Power Plant," Lawrence Livermore National Laboratory, NUREG/CR-3428, UCRL-53483, January 1984. A.30 D. L. Bernreuter et al., " Seismic Hazard Characterization of 69 Nuclear Power Sites East of the Rocky Mountains," Lawrence Livermore National Laboratory, NUREG/CR-5250, Vols.1-8, UCID-21517, January 1989. A.31 Seismicity Owners Group and Electric Power Research Institute " Seismic Hazard Methodology for the Central and Eastern United States," EPRI NP-4726. July 1986. A.32 J. E. Richardson, USNRC, letter to R. A. Thomas, Seismicity Owners Group, " Safety Evaluation Review of the SO'3/EPRI Topical Report Titled ' Seismic Hazard Methodology for the Central and Eastern United States,'" dated September 20,1988. A.33 SAFEGUARD Shock Test Program, U.S. Army Corps of Engineers, Huntsville Division, ilNDDSP-72-151-ED-R, Vol.1,1973.
- AvadaNe in the NRC PuNic Document Room, 2120 L Street NW. War.hington, DC.
A-57 NUREG-1150
Appendix A-A.34 M. P. Bohn and J. A. Lambright, " Recommended Procedures for Simplified External Event Risk Analyses," Sandia National Laboratories, NUREG/CR-4840, SAND 88-3102, to be published.' A.35 P. B. Schnabel, J. Lysmer, and H. B. Seed, " SHAKE-A Computer Program for Earthquake Re-sponse Analysis of Horizontally Layered Sites," Earthquake Engineering Research Center, Univer-sity of California at Berkeley, EERC 72-12, 1972. A.36 H. L. Wong and J. E. Luco, " Soil-Structure Interaction: A Linear Continuum Mechanics Approach (CLASSI)," Department of Civil Engineering, University of Southern California, CE79-03,1980. A.37 Code of Federal Regulations, Appendix R,
- Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1,1979," to Part .50, " Domestic Licensing of Production and Utilization Facilities," of Title 10. " Energy " i A.38 V. Ho et al., *COMPBRN lli-A Computer Code for Modeling Compartment Fires," University of California at Los Angeles, UCLA-ENG-8524, November 1985.
A.39 S. E', Dosanjh (Ed.), "MELPROG-PWR/ MOD 1: A Two-Dimensional, Mechanistic Code for . Analysis of Reactor Core Melt Progression and Vessel Attack Under Severe Accident Conditions," ! Sandia National Laboratories, NUREG/CR-5193, SAND 88-1824 May 1989. ) A.40 K. D. Bergeron et al., " User's Manual for CONTAIN 1.0. A Computer Code for Severe Reactor Accident Containment Analysis," Sandia National Laboratories. NUREG/CR-4085. SAND 84-1204, July 1985. A.41 J. A. Gieseke et al., " Source Term Code Package: A User's Guide," Battelle Columbus Division, NUREG/CR-4587, BMI-2138, July 1986. A.42 Fauske and Associatcs, Inc., "MAAP Modular Accident Analysis Program User's Manual," Vols. I and II, IDCOR Technical Report 16.2-.3, February 1987. A.43 R. M. Summers et al., "MELCOR In-Vessel Modeling," NUREG/CP-0090 October 1987. l c A.44 N. K. Tutu et al., " Estimation of Containment Loading Due to Direct Containment Heating for the Zion Plant," Brookhaven National Laboratory, NUREG/CR-5282 BNL-NUREG-52181, to be published.' A.45 F. T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major input Parame-l ters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2 Draft Revision 1, SAND 86-1309, to be published.' A.46 R. J. Breeding et al., " Evaluation of Severe Accident Risks: Surry Unit 1," Sandia National Labo-ratories NUREG/CR-4551, Vol. 3 Draft Revision 1, SAND 86-1309, to be published.' A.47 A. C. Payne, Jr., et al., " Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND 86-1309, to be pub-ushed.' A.48 J. J. Gregory et al.,
- Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551 Vol. 5, Draft Revision 1, SANDB6-1309, to be published.'
A.49 T. D. Brown et al., " Evaluation of Severe Accident Risks: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 6 Draft Revision 1, SAND 86-1309, to be published.* A.50 C. K. Park et al., " Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratories. NUREG/CR-4551, Vol. 7. Draf t Revision 1. BNL-NUREG-52029, to be published."
*AvaHable in the NRC Pubhc Document Room. 2120 L Street NW.. Washington, DC.
l NUREG-1150 A-58
l i Appendi:t A i 1 A.51 K. Mokhtarian et al., " MARK I Containment Severe Accident Analysis for the MARK I Owners' Group," CBI NA-CON, Inc., April 1987. A.52 D. B. Clauss, " Comparison of Analytical Predictions and Experimental Results for a 1:8-Scale Steel Containment Model Pressurized to Failure," Sandia National Laboratories, HUREG/CR-4209, SAND 85-0679, September 1985. , i A.53 J. M. Griesmeyer and L. N. Smith, " A Reference M:mual for the Event Progression and Analysis Code (EVNTRE)," Sandia National Laboratories, NUREG/CR-5174, SAND 88-1607, to be pub-lished.' A.54 S. J. Higgins, "A User's Manual for the Post Processing Program PSTEVNT," Sandia National Laboratories, NUREG/CR-5380, SAND 88-3093, to be published.* A.55 H. N. Jow et al., "XSOR Codes User's Manual," Sandia National Laboratories, NOREG/CR-5360, SAND 89-0943, to be published.' A.56 R. S. Denning et al., " Radionuclides Release Calculations for Selected Severe Accident Scenarios," Battelle Columbus Division, NUREG/CR-4624, Vols.1-5, BMI-2139, July 1986. A.57 R. S. Denning et al., " Radionuclides Release Calculations for Selected Severe Accident Scenarios: Supplemental Calculations," Battelle Columbus Divismn. NUREG/CR-4624. Vol. 6 BMI-2139, to be published.' AJ8 R. L. Iman et al., "A User's Guide for PARTITION: A Program for Defining the Source Term / Consequence Analysis Interfaces in the NUREG-1150 Probabilistic Risk Assessments," Sandia Na-tional Laboratories, NUREG/CR-5253, SAND 88-2940, to be published.' A.59 D. Bennett, "S ANDI A-ORIGEN Users Manua'," Sandia National Laboratories, NUREG/ CR-0987, SAND 79-0299, October 1979. i A.60 G. A. Briggs, " Plume Rise Prediction," Proceedings of Workshop: Lectures on Air Pollution and Environmental Analysis, American Meteorological Society, Boston, MA,1975. A.61 D. C. Kocher, " Dose Rate Conversion Factors for External Exposure to Photons and Electrons," J Oak Ridge National Laboratory, NUREG/CR-1918 ORNL/NUREG-79, August 1981. j A.62 International Commission on Radiological Protection, " Recommendations of ICRP," Publica- I tion 26, Annals of ICRP, Vol.1. No. 3,1977. A.63 International Commission on Radiological Protection, " Limits for Intakes of Radionuclides by Workers," Publication 30, Annals of ICRP, Vol. 2, Nos. 3 and 4,1978. { A.64 U. S. Environmental Protection Agency, " Manual of Protective Action Guides and Protective Ac-tions for Nuclear Incidents," Office of Fadiation Programs, Draft,1989. A 65 J. S. Evans et 'al., " Health Effects Model for Nuclear Power Plant Accident Consequence Analy-sis," Harvard University, NUREG/CR-4214, SAND 85-7185, August 1985. A.66 U.S. National Research Council, National Academy of Sciences. Committee on the Biological Ef- . fects of Ionizing Radiation, "The Effects on Populations of Exposure to Low Levels of Ionizing l Radiation: 1980," National Academy Press,1980. A.67 J. C. Helton et. al " Incorporation of Consequence Analysis Results into the NUREG-1150 Proba-bilistic Risk Assessments," Sandia National Laboratories, NUREG/CR-5382, SAND 88-2695, to be published.' 'Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC. A-59 NUREG-1150 ;
App ndix A A.68 R. L. Iman and J. C. Helton, "A Comparison of Uncertainty and Sensitivity Analysis Techniques for Computer Models," Sandia National Laboratories, NUREG/CR-3Fi, SAND 84-1461, May 1985. A.69 P. A. Seaver, " Assessments of Group Preferences and Group Uncertainty for Decision Making," University of Southern California Social Sciences Research Institute,1976. A.70 J. M. Booker and M. A. Meyer, " Sources and Effects of Interexpert Correlation: An Empirical Study," IEEE Transactions on Systems, Man, and Cybernetics, Vol.18, No.1, pp.135-142, 1988. A.71 S. Lictenstein et al., " Calibration of Probabilities: The State of the Art to 1980," in Judgment Under Uncertainty: Heuristics and Blases, Cambridge University Press,1982. A.72 J. S. Armstrong et al., "Use of the Decomposition Principle in Making Judgments," Organizational Behavior and Human Performance, '4: 257-263,1975. A.731. C. Janis, Victims of Group Think: A Psychological Study of Foreign Policy Decisions and Flas-coes, Houghton Mifflin, Boston, MA. A.74 H. F. Martz e al., " Eliciting and Aggregating Subjective Judgments-Some Experimental Results," Proceedings of the 1984 Statistical Symposium on National Energy issues (Seattle, Wash.), NUREG/CP-0063,1984. A.75 T. A. Wheeler et al., " Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND 86-2084,' April 1989. A.76 I. J. Good. " Axioms of Probability," in Encyclopedia of Statistical Sciences, Vol.1, pp 169-176, Wiley, New York,1983. i A.77 Sverdrup, " Frequency Interpretation in Probability and Statistical Inference," in Encyclopedia of l Statistical Sciences, Vol. 3, pp. 225-231, Wiley, New York,1983. A.78 T. L. Fine, " Foundation of Probability," in Encyclopedia of Statistical Sciences, Vol. 3, pp. 175-184, Wiley, New York,1983. A.79 R. V. Hogg and A. T. Craig, Introduction to Mathematical Statistics, 3rd Ed., Macmillan, New York,1970. A.80 V. Barnett, Comparative Statistical fr(erence, 2nd Ed., Wiley, New York,1982.
' Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
NUREG-1150 A-60
l APPENDIX B AN EXAMPLE RISK CALCULATION l 1 1 9
'1
.(
CONTENTS Page B.1 Introduction . . . . . . ........................................................ B-1 B.2 Accident Frequency Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-1 B.2.1 Overview of Accident Frequency Analysis . . ............................. B-1 B.2.2 Description of Accident Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-7 B.2.3 Quantification of Cut Set . . . . . . . . . . .. ........... .......... .. ..... B-8 B.2.4 Accident Sequence and PDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-9 B.3 Accident Progression Analysis . . . . . . . . . . ........... ... .................... B-10 B.3.1 Introduction ............... ........ ..... ........................ B-11 B.3.2 Discussion of APET Questions . . ............. . . .......... ....... B-16 B.3.3 Quantification of APET Questions by Expert Judgment . . . ..... .. ...... .. B-22 B.3.4 Binning Results of APET . . . . . .. ... .... . . . ... .......... ....... B-37 B.4 Source Term Analysis ......... . . .... . ... .......... ............ . B-39 B.4.1 Equation for Release Fraction for Iodine . . . . . . . .. .. .. ............. B-40 B.4.2 Discussion of Source Term Factors ............ . .. . .... .. ....... . B-41 B.4.3 Quantification of Source Term Factors by Experts . . . . . . . . . . .......... .. B-44 B.4.4 Releases for All Fission Products . . . . . . . . . . . . .. ...... ........ .. . B-52 B.5 Partitioning of Source Terms . . .. .... .. .... . . .... .... ... .. ..... B-54 B.5.1 Introduction . . . .... ... . . .... . ... . ....... . ........ ...... B-54 B.5.2 Effects Weights . . . . . . .... . ... ...... ... . .... . ........... B-55 B.5.3 Partitioning Process and Results .. ...... ... .. . . .... .... ...... B-59 B.6 Consequence Calculation . . . . . . ..... .... ... ... ... . ... . .... B-60 B.6.1 Description of Consequence Calculation . . . . . .... .. .... .. . ... ... B-61 l B.6.2 Results of Consequence Calculation . . . . . .... ............ . ... ...... B-62 I B.7 Computation of Risk . . .. .. . ..... . .. ........ ............ B-62 B.7.1 Introduction ...... ...... ... .......... .. ...... ....... . .. B-64 ) B.7.2 Calculation and Display of Mean Risk . . . ... .. .. .. ... ........ B-64 B.7.3 Calculation and Display of CCDFs . . . ... . ..... . .... .... . ... B-67 B.8 Summary . ........ .. . . .... . . .. . . .... ... .... .. ... B-71 REFERENCES FOR APPENDIX B . . . . . . . ... . .... .. . ........ . .. . .. B-73 LIST OF FIGURES B.1 Event t ce for T1S-SBO at Surry Unit 1. . . . . . . .. . ...... .. .. .. B-4 B.2 Reduced fault tree for DG 1 at Surry Unit 1. . . ..... ..... . ... . . . . . . B-5 B.3 Reduced fault tree for AFWS at Surry Unit 1. . . . . . . . . ... . . .. ..... . . . . B- 6
- iii - NUREG-1150 L_ .-
B.4 Sheet 1. Simplified diagram of first part of Surry accident progression event tree. . . . . . . . B-14 B.4 Sheet 2. Simplified diagram of second part of 6.ry accident progression event tree. . . . . . B-15 B.5 Event tree used b; all three experts in determining the probabilities of different leak rates for a single reactor coolant pump. . . . . . . ........... ... ... ... .. ...B-25 B.6 First part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps. . .. . ..... . . . ... .B-26 B.7 Second part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps. ...... ...... . .. ... ..B-27 B.8 Results of expert clicittion for pressure rise at vessel breach for Surry. . . ....... ...B-33 B.9 Simplified section of Surry containment. . . ... .. .. .... ... ..............B-34 B.10 Results of expert elicitation for static failure pressure of Surry containment. ...........B-36 B.11 Results of expert elicitation for FCOR, fraction of the fission products released from core to vessel for the nine radionuclides groups. .. ... . . .. . .... ... . .B-47 B.12 Results of expert elicitation for FCOR, fraction of fission products released from core to vessel for the nine radionuclides groups. . . . . . .. . . . . .. .. ..B-48 B.13 Results of expert elicitation for FCONV, fraction of fission products in containment from RCS release that is released to environment. . ... ... .... . .. .......B-51 B.14 Distributions for late release of iodine from containment in volatile form. ...... ... .B-53 B.15 Relationship between I-131 release and mean early fatalities used in determining early effects weights for partitioning. ... .. . . ......... . .. . . .. .....B-57 B.16 Distribution of latent cancer fatalities computed for STG SUR-49. . .. .B-63 B . . '7 Distribution of upected (weather-averaged) latent cancer fatalit- :sk for Surry. . . . .B-66 ) B.18 CCDFs for latent cancer fatalities for STG SUR-49 and for all 52 5TGs. . . . . ... . ..B-68 B.19 Computed curves showing four statistical measures ~of 200 CCDFs for Surry for early fatalities and latent cancer fatalities. .. ... .. .... . . ... .... . ..... .... .B-70 LIST OF TABLES B.1 Most likely cut set in Surry sequence TIS-QS-L quantification for observation 4. .. . . . . B-3 B.2 Selected questions in Surry APET. . .... .. . ...... ... .... ............B-12 B.3 Aggregate results for RCP seal failure with existing o-ring material. . . ... ... .....B-28 B.4 Isotopes in each radionuclides release class. . . . ......' ........... .... . .. .B-39 B.5 Partitioning parameters and results. . . ...... . . .. ..... .. . . . .B-56 B.6 Properties of source term 17, subgroup 1. . . .. . . ....... ..B-61 NUREG-1150 - iv -
Appendix B B.1 Introduction In this appendix an example calculation' is followed through the entire analysis from the initiating event in the accident frequency analysis to the offsite risk. This discussion has been prepared for the reader seeking detailed information on how the risk calculations were performed. It is assumed that the reader is familiar with nuclear power plants in general and with severe accident risk analysis in particular. Since the accident frequency analysis is generally more familiar to the PRA community, and the accident frequency analyses performed for NUREG-1150 have fewer novel features than the other analyses, the discussion of the accident frequency analysis in this appendix is abbreviated. Thus, even though the accident frequency analysis requires a level of effort comparable to that required for the other analyses, the discussion of the risk calculation from the identification of the initiating event through the definition of the plant damage state (PDS) does not reflect that fact. The example selected for this discussion is a fast station blackout (SBO) accident for Surry. This accident, often denoted TMLB in previous PRAs, is estimated to be one of the more likely accidents, and is of historical interest. Surry was chosen because the accident progression event tree (APET) for Surry is simpler than the APETs for the other plants. The PDS designation for the fast SBO accident is TRRR-RSR. (The PDS nomenclature is explained in Section B.2.3.) This PDS has the third highest mean core damage frequency (MCDF) at Surry. Several accident sequences comprise this PDS; the one chosen for this example is T1S-QS-L, which has the highest frequency of the sequences in TRRR-RSR. (This sequence is defined in detail in Section B.2.1.) PDS TRRR-RSR is the only PDS in PDS group 3, fast SBOs. The example will be followed through the APET to accident progression bin (APB) GFA-CAC-ABA-DA. (The APB nomenclature is explained in Section B.3.4.) For the observation chosen, this bin is the most lilrely to have both vessel breach (VB) and containment failure (CF). The computation of the source term for this bin will be followed through the source term analysis, and this source term will then be grouped with other similar source terms in the - partitioning process. Finally, offsite consequences will be determined for the subgroup to which the source term for GFA-CAC-ABA-DA was assigned, and the results of all the analyses will be combined to obtain the measures of risk. To determine the uncertainty in risk, the accident frequency analysis, the accident progression analysis, and the source term analysis were performed many times, with different values for the important parame-ters each time. A sample of 200 observations was used for the Surry analysis. The Latin hypercube sampling method, a stratified Monte Carlo method, was used. In this example, one sample member or observation, Observation 4, will be followed all the way through the risk analysis. It was chosen because it was the median observation for early fatality risk for 100 percent evacuation. B.2 Accident Frequency Analysis The accident frequency analysis determines the expected frequencies for the many different types of core
- damage accidents that can occur. This appendix is not intended to present methods, as that is summarized
( in Appendix A, and presented in detailin Reference B.2. Nevertheless, many aspects of the methods will become apparent in this discussion. Section B.2.1 is a overview of the accident frequency analysis, and Section B.2.2 contains a description of the accident sequence. Section B.2.3 describes the quantification of the cut set, and Section B.2.4 dicusses how the accident sequences are grouped into PDSs. B.2.1 Overview of Accident Frequency Analysis Development of the chronology and frequency of the accident sequences involves many tasks or constitu-ent analyses. These include:
' Adapted from Reference B.1. "TMLB' was defined in previous studies as a transient loss of offsite power (T) with failure of the oower conversion system (M) and the auxiliary feedwater system (L), and failure of the emergency ac power system with no recovery of offsite ac power in 1 to 3 h (B').
B-1 NUREG-1150
I. Appendix B e Initiating event analysis, including determination of the system success criteria, e Everit tree analysis, including accident sequence delineation, ) i e Systems analysis, inc uding fault tree construction, I e Dependent and subtle failure analysis, e Human reliability analysis, e Data base analysis, including development of the data base, 1 i e Elicitation of expert judgment, e Accident sequence quantification, including recovery actions, I e Grouping of the accident sequences into PDSs, and ' l
- Uncertainty analysis. I 1
These tasks are performed approximately in the order given above. The quantification and the assignment ] of the sequences to PDSs are performed several times in iterative fashion as the information available ) evolves and the requirements of the subsequent analyses change. An accident sequence is a particular accident defined by the initiating event and failures of the systems required to respond to the initiator. Sequences are defined by specifying what systems fail to respond to the initiator. In the accident frequency analysic, models (event trees, fault trees) are constructed for all the important safety systems in the plant (usually at the pump and valve level of detail). Failure rates for equipment such as pumps and valves are developed from failure data specific to the plant being analyzed and from generic nuclear power plant data bases. The models and the failure rates are used by the computer program that calculates the thousands of possible failure combinations, denoted cut sets, that lead to core damage. Each cut set consists of the initiator and the specific hardware or operator failures that produce the system failures. The initiator and the failures are often referred to as " events." For example, a water injection system could fail because the pump failed to start, or because the normally closed, motor-operated dis-charge valve failed to open. Cut sets that include the pump failure and cut sets that include the valve failure, but are otherwise identical, occur in the same accident sequence since the pump and valve failures have the same effect on a system level. The accident sequence followed for this example is TIS-QS-L, which is the highest frequency sequence that contributes to PDS TRRR-RSR. This sequence is the most probable of several sequences that involve station blackout and early failure on the auxiliary feedwater system (AFWS). The mean frequency for TRRP-RSR is 4.8E 6/reactnr year, and TIS-OS-L contributes about 75 percent of that. For Observation 4, the frequency of TRRR-RSR is 4.8E-7/ reactor year, and the frequency of T1S-QS-L is 2.4E-7/ reactor year. (It k ourely coincidental that the frequency of TRRR-RSR for Observatir- 4 is one-tenth of the average frequency over all 200 observations.) Sequence T1S-QS-L is comprised of 216 cut sets. The cut set with the highest frequency, consisting of nine events, is given in Table B.1. The cut set equation for T1S-QS-L is: TIS-QS-L = (IE-TI) * (OI P-DGN-FS-DGO1) * (/DGN-FTO) * (OEP-DGN-FS-DG03) * (NRAC-111R; * (RiiC-MIE-FO-DGEN) * (NOTQ) * (QS-SBO) * (AFW-XHE-FO-CFr2)
+ .. (215 other cut sets)
The frequency of each cut set varies from observation to observation because the probabilities of some of the events are sampled from distributions. For Observation 4, the frequency of the cut set in Table B.1 is NUREG-1150 B-2
'l!
Appendix B l 3.4E-8/ reactor year. This cut set defines one group of specific failures that cause the accident, which will be followed through the entire analysis in this appendix. Each event listed in Table B.1 is discussed in some detail in Section B.2.3 below, i Table B.1 Most likely cut set in Surry sequence T1S-QS.L quantification for observation 4. Event Quantification Description IE-T1 0.0994 Initiating Event: LOSP OEP-DGN-FS-DG01 0.0133 DG 1 fails to start
/DGN.FTO 0.966 DG 3 may be aligned to Unit 1 OEP-DGN-FS-DG03 0.0133 DG 3 fails to start NRAC-1HR 0.44 Failure to restore offsite electric power within 1 h i REC-XHE-FO-DGEN 0.90 Failure to restore a DG to operation within I h I NOTQ 0.973 RCS PORVs successfully reclose during SBO QS-SBO 0.0675 Stuck-open PORV or SRV in the secondary system AFW-XHE-FO-CST 2 0.0762 Failure of operator to open the manual valve from the AFW pump suction to CST 2 ,
Entire cut set 3.4E-8 Frequency (per year) for Observation 4 Figure B.1 shows the event tree for T1S-station blackout at Unit 1. Three of the paths through this tree lead to core damage situations that are in PDS TRRR-RSR. Accident sequence 24. T1S-OS-L, is the most likely of these three. The logical expression for this wquence, according to the cd.amn headings or top events, is: TIS-OS-L = TIS
- NRAC HALFHOUR * /r,
- QS
- L, where /Q indicates not-Q, or success. System success states like /Q are sometimes omitted during quantifi-cation if 'he state results from a single event since the success value is very close to 1.0. T1 is a loss of offsite power (LOSP) initiator, and the "S" in TIS indicates that it is followed by failure of the emergency ac power system (EACPS). Failure of EACPS, although not shown explicitly in Figure B.1, is determined by a fault tree, and T1S = T1
- Failure of EACPS, where failure of EACPS is failure of diesel generator (DG) 1 and DG 3 or failure of DG 1 and DG 2.
(Failure of only DG 2 and DG 3 implies success of DG 1, which is not SBO for Unit 1. If DG 1 and DG 2 fail, it is assumed that DG 3 is assigned to Unit 2. Failure of all 3 DGs is included in a different sequence.) Note that T1 appears as IE-T1 in the cut set; the SBO is implied by events OEP-DGN-FS-DG01, /DGN-ITO, and OEP-DGN-FS-DG03. The cut set considered in this appendix has the failure of DG 1 and DG 3. A simplified depiction of the fault tree for DG 1 is shown in Figure B.2. The fault tree for DG 3 is similar. The heavier line in Figure B.2 indicates the failure, OEP-DGN-FS-DG01, in the cut set of interest. The other failures are included in other cut sets. (Figs. B.2 and B.3 are illustrative only and do not provide an accurate representation of the complete fault trees. The complete fault trees are given in Appendix B.2 of Ref. B.3.). In Figure B.1, the cut set of interest is part of sequence.19, TIS-QS-L, which is shown by the heavier line. The first top event is the initiator, discussed above. The second top event concerns the recovery of offsite ac power within 39 minutes (NRAC-HALFHOUR). This is the time between the initiation of the accident and the time when the operators must start to refill the service water canal if core damage is to j be avoided when the steam-turbine-driven AFW pump fails to start. (If the electric-motor-driven AFW I pumps can be restored to action by 60 minutes, core damage can be avoided. These pumps require l 1 B-3 NUREG-1150 _g
E R R R R R G Y R D R C R Y R D R C R D A O D R C R S D D R S R S R M R R - R - R R R - R - R - A - - R - R - - - R - D R R R - R R R R R R R R R R R R R R R R R R R R R R R R R L R R 3 R ' R R R 3 R 2 R 2 P T T. $ T T T T S T S T S l . E R O C KKMKMKMKMKMMKMKMKMMKMHKMM OOC OC OC OC OC C OC OC OC C OC C OC C l - S S R R N S N 7 - - e R 7 - - R t L 1 c N R L L N S S R n 7 - - N S S 7 - - - - NL e R LL - - - - R22 2 2 1 - - - u q NS S 0000 NWWWWL R S S S 7 - - - - - - - - - - - - - - - NL O O Q e R22222222 ' S S S sssS - - - - - -
- *N WWWWWWWWL
- - - - - 0 O -oooO 0 0 0- e- - - -
S S S S S S S S S 1 I I I I I I 1 1 1 1 1 1 I 1 S 5 5 5 S1 IS I5 1 SI SI IS I5 ISI S S S S S T T T T T T T T T T T T T T T T T T T T T T T T T 1 2345 678 901 2345 6789O1 2345 1 1 1 1 1 1 1 1 1 1 ? 222 22
- N S CE R 7 AV U R RE O N N S.H I I I ! I CL A S
- t. A C R RE O N NS L I I I L A -
PA C L CEO S RSL '
.S RE -
ER PP 0 OO 2 LL U - AO 2 EO MW SC F C R 1 AEU R RNO N NO H i _ I I W F L A I - G S S C I C' _ R Q CFR ALU - RAO NHH 1 I _ i S _ 0 I I _ 8TN T _ 5AU Zh1O1 n $ [
r e l h t O s G
~n D oe msu o f
I maer oCu C t y la f c F o ee1 n r g m _ rG eD m _ F E e - c t u n Orna I 1 oe f t G n D ia M J I f o S ls o t rUD l a I s s eB w E L I 1 t F o nu 1
- o. o0f - R 0 1 P 61 S G G 4 Q D D S S 1 F T -
N yr r G ce o D nw1 e f H e P go r P G a e mC D 1 T 1 P
= i F
1t t oa t S r E O E A G f ol ar D e emw r ur o o laN P i F oS f e U rB I J lu0I i0 a1 F4
" %C$?
k35E zl t f o C 2
^
Dr f e B I ow so x i oP d o n L e n e f p
^
I oLs e p I e r uel nv 2 A e n lj BuV ec T S i Fe C n S - e f o O i v I . F g L m E
- e e
p H t r - X ot ue
- t l
t in c i W u a eaL F - OA f' E r l l eBnST e Fa epC
~
ht O
~
f o O P n - I e T D T is o r - e - v -
^
d I ie f - i l p - n m t u i s O I P y I Ot o l t a C Ts e A
^
Ar e r) r- g . f e F 0 o f9 I ow so a1
- oP s is 1 b o i
=
L e ry n P t uit e r igl i v B t o fb - m t e s a PS _ O Dne ib Wm F 1I r e I Do ho _
^
Ay S orT f ogS Tt s Tr ( p t o l ,W na _ M I egF o, F 1 r
.e LyA u _
tl ii na f Ue yh _ rt r . ut S ha r-oS L I Pg D Mg OI A tt a St e Wc Fid s a fQ An _
- i 1 S r
=I o1 n PT n f
e v u e= g
,A P R eP O r _
I D. r in a II Do t t t3 goT r Me l l l uB o a f a g .F e _ dc en ce ur t df e r a ee t RR I PS Do Mts na F O 3 B e r u g i _ F Z$ oiC .S
Appendix B service water cooling, and it takes 20 to 30 minutes to refill the service water canal. Therefore, ac power must be restored by 30 minutes if AFWS is to be restored by 60 minutes.) In the cut set listed in Table B.1, the steam turbine-driven AFWS runs until the condensate storage tank (CST) is depleted at about 60 minutes after the start of the accident. The AFWS fails at that time because the operators fail to switch the pump suction to the backup CST. This failure is event AFW-XHE-FO-CST 2. Thus, the appropriate power recovery time for this cut set is NRAC-1HR, which replaces NRAC-HALFHOUR in the cut set, although the failure (lower) branch for NRAC-HALFh0UR is indicated on the event tree. The third top event is RCI, failure of reactor coolant system integrity, Event Q. In the cut set being followed, the succeu branch is taken here, i.e., the PORVs cycle correctly and do not stick open. The fourth top event in Figure B.1 is SGI, failure of steam generator (secondary side) integrity. In this cut set, a relief valve on the main steam line sticks open, Event QS, so the failure branch is taken. The fifth top event, L, is failure of the AFWS. The AFWS fails as discussed above, so the lower branch is taken. None of the subsequent top events are applicable since the failures that have already occurred are sufficient to , cause core damage, so there are no further branches on the path to sequence 19. l Figure B.3 is a simplified fault tree for the AFWS. The motor-driven AFW trains, of course, require ac electrical power and are not available for this accident. The heavier line in Figure B.3 indicates the failure that occurs in the cut set considered for this example. The other failures are included in other cut sets. A general description of this accident sequence follows in the next section, More detail on the methods used in the accident frequency analysis may be found in Reference B.2. Details of the specific analysis for Surry may be found in Reference B.3. B . 2. 2 Description of Accident Sequenca A LOSP initiator, IE-T1, starts this transient accident by tripping the reactor and the main steam turbine, j The DG assigned to Unit 1, DG 1, fails to start, OEP-DGN-FS-DG01. DG 3 also fails to start, OEP-DON- ! FS-DG03. (DG 2 is dedicated to Unit 2.) The event /DGN-FTO indicates that the DG that can supply I power to either unit at Surry, DG 3, may be aligned to supply power to Unit 1 since DG 2 is successfully powering Unit 2. The failure to start of DG 1 and DG 3 causes a complete failure of ac power at Unit 1-SBO. However, de power is initially available from the Unit 1 batteries. The pressure boundary of the reactor coolant system (RCS) is intact, so loss of water from it is not an immediate problem. However, all the systems capable of injecting water into the RCS depend on pumps driven by ac electric motors. Thus, if decay heat cannot be removed from the RCS, the pressure and temperature of the water in the RCS will increase to the point where water will flow out through the j PORVs, and there will be no way to replace this lost water. .' Heat removal after shutdown is normally accomplished by the AFWS. Surry's AFWS has three tiains: two , I of these trains have pumps driven by ac electric motors, and these trains are unavailable due to the SBO. The only means of heat removal in a blackout situation is the steam-turbine-driven AFW train. In the accident defined by the cut set in Table B.1, the steam-turbine-driven AFW train is initially available as steam is being generated in the steam generators (SGs) to drive the steam turbine, and de power is available for control purposes. The initiating LOSP causes the main steam isolation valves (MSIVs) to close, preventing the steam being generated in the SGs that is not needed by the APWS turbine from flowing to the main condenser. The normal means of venting excess steam from the secondary system is through the atmospheric dump valves (ADVs), but in this sequence they are failed in the closed position due to the loss of ac power. Thus, pressure relief takes place through one or more of the secondary system safety-relief valves (SRVs). In this accident sequence, at least one of the secondary system SRVs fails to reclose, which causes water to be lost at a significant rate from the secondary system. This is event QS in Figure B.1; it is denoteo QS-SBO in the cut set. The AFWS initially draws from the 100,000-gallon condensate storage tank > (CST). With an SRV stuck open, the AFWS will draw from the CST at 1,000 to 1,500 gpm to replace the water lost through the SRV, thus depleting the CST in 1.0 to 1.5 hours. A 300,000-gallon bacicup water supply (CST 2) is available, but the AFWS cannot draw from this tank unless a manual valve is opened. In B-7 NUREG-1150
Appendix B this cut set, the operators fail to open this valve, and the AFWS fails. This human error is event AFW-XHE-FO-CST 2. There are two other human errors in this cut set. One is the failure to restore offsite power within 1 h (NRAC-1HR), and the other is the failure to restart a DG (REC-XHE-FO-DGEN). In the path to sequence 19 shown in Figure B.1, the failure to recover offsite power is NRAC-HALFHOUR. In this particular cut set, the time to failure of the AFWS is longer than in the majority of cut sets in sequence TIS-QS-L, and this failure is replaced by NRAC-1HR. With the failure of the turbine-driven AFW train, and no ac power to run the motor-driven AFW trains, the primary system (RCS) beats up until the pressure forces steam th ough the PORV(s). Water loss through the PORV(s) continues, with the PORV(s) cycling open and closed, until enough water has been lost to reduce the liquid water level below the top of active fuel (TAF). The PORVs do not stick open; this is event NOTQ. Without electric power, there is no way to replace the water lost from the RCS. The uncovering of the TAF (UTAF) marks the transition of the accident from the accident frequency analysis to the accident progression analysis. The onset of core degradation follows shortly after the UTAF. B . 2. 3 Quantification of Cut Set Table B.1 giver '.he specific cut set being considered in this example, and shows the quantification of each event in the cut set for Observation 4. A discussion of how each quantification was derived follows. , IE-T1 is the initiating event: LOSP. The frequency of this initiating event was sampled from a distribution. l The quantification for Observation 4 is 0.0994. This value is above the mean value of 0.0077. The distri-l bution for LOSP was derived from the records of the Surry station and reliability data for the power grid to which the Virginia Electric Power Company belongs, using the methods in Reference B.4. This analysis , uses Bayesian models for both the frequency of LOSP and the time to recovery of offsite power. Utility I data from 63 LOSP incidents were analyzed to develop a composite offsi'e power model that combined the effects of failures of the grid, events at the plant (e.g., switchyard problems), and severe weather. The model can be adjusted to reflect specific site features such as switchyard design, type of grid, and local weather history. OEP-DON-FS-DG01 is the failure of DG 1 to start. The probability of this event was sampled from a distribution. The quantification for Observation 4 is 0.0133. This value is slightly below the mean value of l 0.022. The distribution for this event was derived from the Surry plant records of DG operation for 1980 l to 1988. In this period, there were 484 attempts to start the DGs and 19 failures. Eight of these failures were ignored since they occurred during maintenance. A lognormal distribution with an error factor of three was used to model the uncertainty in this event. The error factor was based on a very narrow chi squared uncertainty interval.
/DGN-FTO indicates that DG 2 has started and is supplying power to Unit 2. Thus, DG 3, the " swing" DG i at Surry, may be aligned to supply power to Unit 1. The Surry station consists of two units. Emergency 4 I
power is supplied by three DGs; DG 1 can supply power only to Unit 1, DG 2 can supply power only to i Unit 2, and DG 3 can be aligned to supply power to either unit. If DG 2 starts and runs initially, DG 3 is not required for Unit 2. The probability of this event was sampled from a distribution. The quantification for Observation 4 is 0.966, which is almost equal to the mean value (0.97) of this distribution. The distribution was developed from Surry plant data on DG operation at Unit 2 in a manner similar to that for the previous event. OEP-DON-FS-DG03 is the failure of DG 3 to start. The quantification for Observation 4 is 0.0133, the same as for OEP-DON-FS-DG01 above. The same distribution was used for both DG 1 and DG 3, and the sampling was fully correlated. NRAC-1HR is the failure to restore offsite power within 1 h. Initially, the probability of this event was sampled from a distribution obtained using the offsite power recovery methods of Reference B.4. As the uncertainty in this event proved to be only a small contributor to the uncertainty in the core damege i frequency in the uncertainty analysis performed for the accident frequency analysis alone, it was not i sampled in the integrated analysis. For the integrated analysis, NRAC-1HR was set to the mean value of the distribution, 0.44, for every observation in the sample. NUREG-1150 B-8
Appendix B REC-XHE-FO-DGEN is the failure to restore a DG to operation within 1 h. The probability of this event was sampled from the distribution for this operation that appears in the Accident Sequence Evaluation Program (ASEP) generic data base (Ref. B.2). The uncertainty in this event was not a significant con-tributor to the uncertainty in the core damage frequency. It was not sampled in the integrated analysis, and REC-XHE-FO-DGEN was set to the mean value of the distribution,0.90, for every observation in the sample. NOTO indicates that the RCS PORV(s) successfully reclose during SBO. Event Q is the failure of the RCS PORV(s) to reclose in an SBO sequence, so NOTO is success. The probability of this event was sampled from a distribution in the stand-alone version of the accident frequency analysis. Because the uncertainty in NOTO was not a significant contributor to the uncertainty in the core damage frequency, NOTQ was set to 0.973, the complement of the mean value of the distribution for Event Q, for the integrated analysis. The distribution for Event Q was taken from the ASEP generic data base (Ref. B.2). QS-SBO is the failure of a PORV or SRV in the secondary system to reclose after opening one or more times. For an SBO, the PORVs on the secondary side, also known as the atmospheric dump valves, are not operable, so it is the SRVs that open. The probability of this event was sampled from a distribution. The quantification for Observation 4 is 0.0675, which is considerably less than the mean value (0.27) of this distribution. The distribution for QS-SBO was determined from elicitation of several members of the project staff. They used an analysis of the events that take place in the secondary system during an SBO. This analysis considered the number of times an SRV may be expected to open and the rate at which the SRVs at Surry are expected to fail to reclose (Ref. .B.3). AFW-XHE-FO-CST 2 is the failure of the operator to open the manual vab es to the auxiliary condensate storage tank, CST 2. This action is necessary to provide a supply of water for the AFWS after the primary condensate storage tank is depleted. The probability of this event was sr.inpled from a distribution derived using a standard method for estimating human reliability. AFW-XHE-FO-CST 2 is the failure to success-fully complete a step-by-step operation following well-designed emergency operating procedures with a moderate level of stress. The metaod used is presented in Reference B.2, and detailed results may be found in Reference B.3 The quantification for Observation 4 is 0.0762, which is slightly above the mean value (0.065) of this distribution. B.2.4 Accident Sequence and PDS The cut set gives specific hardware faults and operator failures. In determining the general nature of the accident, however, many cut sets are essentially equivalent. These cut set are grouped together in an accident sequence. For example, consider the cut set described above. In the description of the accident, it would have made little difference whether there was no ac power because DG 1 was out of service for maintenance (see Fig. B.2) or whether DG 1 failed to start as in the cut set in Table B.1. The fault is different, and the possibilities for recovery may be different, but the result is the same on a system level. The, both cut sets occur in accident sequence T1S-QS-L, along with many other cut sets that also result in the same combination of system failures. In the example, the important development for defining the accident is that DG 1 has failed. Exactly how it failed must be known to determine the probability of failure, but is rarely important in determining how the accident progresses after UTAF. The accident frequency analysis results in many significant accident sequences, typically dozens and per-haps a hundred or so. As the accident progression analysis is a complex and lengthy process, accident sequences that will progress in a similar fashion are grouped together into PDSs. That is, sequences with similar times to UTAF, similar plant conditions at UTAF, and that are expected to progress similarly after UTAF, are grouped together in a PDS. Figure B.1 shows the three sequences that are placed together in PDS TRRR-RSR. They are T1S-QS-L, T1S-L. and T1S-O-L. (A fourth sequence, T1S-O-QS-L, sequence 25, would have been placed in TRRR-RSR, but was eliminated due to its low frequency.) T1S-QS-L is by far the most likely of these accident sequences and has been described above. Sequence T15-L is similar to T1S-OS-L, but has the AFWS failing at the very start of the accident because of failures in the steam turbine-driven AFW train itself (such as fail to start, fail to run, etc.). In T1S-O-L, which is much less probable than either T1S-OS-L or T1S-L an RCS PORV sticks open, and there is no way to replace the water lost through this valve. B-9 NUREG-1150 ;
Appendix B C The process of assigning accident sequences to PDSs forms the interface between the accident frequency analysis and the accident progression analysis. The characteristics that define the PDSs are determined by the accident progression analysts based on the information needed in the APET. These characteristics are carefully reviewed with the staff that performs the accident progression analysis to ensure that all situations are included, that the definitions are clear, and that there are no ambiguous cases. Then, every cut set is examined to determine its appropriate PDS. This often requires an iteration through the event tree and fault tree analyses since assignment to the proper PDS may require information, for example, about the containment spray systems, that was not needed to determine the core damage frequency. Thus, it is possible that the cut sets that form a single accident sequence might be separated into two (or more) different PDSr, although this never occurs in the Surry analysis. The seven letters that make up the Surry PDS indicator denote characteristics of the plant condition when the water level falls below the TAF and consideration of the accident passes from the accident frequency analysis to the accident progression analysis. For PDS TRRR-RSR, each character in the PDS designation is explained below. Recoverable means the system is not operating, but can operate if ac power is recov-cred. T: RCS is intact at the onset of core damage; R: Emergency core cooling is recoverable; R: Containment heat removal is recoverable; R: AC power can be recovered from offsite sources; R: The contents of the refueling water storage tank (RWST) have not been injected into the con- l tainment, but can be injected if ac power is recovered, j i S: The steam turbine-driven AFWS failed at, or shortly after, the start of the accident, the electric motor-driven AFWS is recoverable; R: Cooling for the reactor coolant pump (RCP) seals is recoverable. 1 A more complete description of the PDS nomenclature may be found in Reference B.1. The assignment of sequences to PDSs is discussed in Reference B.3. For internal initiators at Surry, 25 PDSs were above the cutoff frequency of 1.0E-7/ reactor year for the accident progression analysis. They were placed in seven PDS groups based on the initiating events. The seven PDS groups for internal initiators at Surry, in order by decreasing r man core damage frequency, are:
- 1. Slow f
- 2. Loss-of , olant accidents (LOCAs); i
- 3. Fast SBO;
- 4. Event V (interfacing-system LOCA);
- 5. Transients;
- 6. ATWS (failure to scram the reactor); and
- 7. Steam generator tube ruptures.
The example being followed here goes to the third PDS group, Fast SBO, which consists of only a single , PDS, TRRR-RSR. l l B.3 Accident Progression Analysis i The accident progression analysis considers the core degradation process and the response of the contain-ment and other safety systems to the events that accompany core degradation. Of particular interest is whether the containment remains intact, since this determines the magnitude of the fission product release in many accidents, in the analyses conducted for NUREG-1150, the accident progression analysis is performed by use of a large event tree. While a simple event tree like that shown in Figure B.1 can be NUREG-1150 0-10
i Appendix B
\
easily illustrated and evaluated with a hand calculator, the event trees used for the accident progression ; analysis are too large to be depicted in a figure and have so many paths through them that they can only be evaluated by a computer program. B.3.1 Introduction The APET for Surry consists of 71 questions. Many of these questions are not of particular interest for i PDS TRRR-RSR; therefore, only about half the questions are listed in Table B.2 and shown in Figure B.4. A full listing of the questions in the Surry APET and detailed discussions of them may be found in Appendix A of Reference B.1. A discussion of how the event trees are defined and evaluated may be found in the methodology discussion in Reference B.S. Many of the branching ratios and parameter values used were determined by expert panels. More detail on this subject may be found in Part I and Part VIII of Reference B.6. EVNTRE, the computer code used to evaluate the APET, is documented in Reference B.7. Figure B.4 shows the 38 questions displayed and discussed for this example. Only the path chosen for this example is followed from beginning to end in this figure. That is, at each question, only the branch chosen for this example continues on to the next question. In the complete evaluation of the .APET for Observa-tion 4 for PDS Group 3, many of the branches shown as ending in Figure B.4 do terminate because they have zero probability. However, many other branches shown as ending in Figure B.4 have nonzero probability and do propagate to the end of the tree. They are undeveloped in Figure B.4 because of space limitations. In Figure B.4, which is best read in conjunction with Table B.2, the probability of the branch taken is shown above the line. It is the probability of that branch for the entire question and may have contribu-tions from paths other than the one followed for this example. That is, all paths through the APET pass through every question. The probability of a particular branch . ' Figure B.4 reflects all paths, not just the one being followed in this example, and thus may be different frc 1 the probability for this path. Below the line in Figure B.4 is the branch mnemonic abbreviation. This is a t ecinct way of referringto each branch in the tree and it is useful to have this information when relating 'his abbreviated Surry APET to the complete APET listed in Appendix A of Reference B.1. The complete APET contains case structure, which is not shown in Figure B.4. By defining different cases for a question, different branch probabilities may be defined that depend on the branches taken at previ-ous questions. For example, the branch taken at Question 15, RCS Pressure at UTAF?, depends upon the RCS Integrity at UTAF, Question 1. This dependency is implemented by defining a number of cases. Case 2 is the system setpoint pressure (2500 psia) case for Question 15. One of the applicability conditions for Case 2 is that there be no break in the RCS at UTAF, i.e., that Branch 6 was taken at Question 1. For i Case 2, the probability for the first branch, system setpoint pressure, is 1.0. Only the total branch prob- I ability for the path of interest can be shown in Figure B.4. There is no way to show branching probabilities as functions of the case structure for each question in a compact plot of the APET such as ths. As discussed above, for Observation 4, the accident frequency analysis determined that PDS TRRR-RSR had a frequency of 4.8E-7/ reactor year. As PDS Group 3 censists solely of TRRR-RSR, the frequency of l Group 3 is also 4.8E-7/ reactor year for Observation 4. The APET is evaluated without regard to this j frequency, and the result is a conditional probability for each path given the occurrence of PDS Group 3. j There are too many paths through the APET for us to be able to keep and treat each path individually. i Therefore, paths that are similar as far as the release of fission products and risk are placed together in accident progression bins (APBs or just " bins") as explained in Section B.3.4. For the bin that results , from the path followed in this example, denoted GFA-CAC-ABA-DA, the conditional probability is j 0.017. The absolute frequency of this bin from PDS Group 3 is the product of these two values, or 8.1E-9/ reactor year. Table B.2 lists the 38 questions shown in Figure B.4. These are the most important questions for following TRRR-RSR through the APET. The question is often given in abbreviated form to avoid using two linen. The " Branch Taken or Parameter Defined" column gives the branch taken at that question for the path i B-11 NUREG-1150 )
Appendin B Table B.2 Selected questions in Surry APET. Branch Taken or Source of Parameter Quantifi. Question Defined cation - Meaning of Branch or Parameter
- 1. RCS Integrity at UTAF? Br.6 PDS Def. RCS intact-water loss is through cycling i
PORVs l
- 8. Status of ac Power? Br.2 PDS Def. Will be available when offsite power recov-cred
- 10. Heat Removal from SGs? Br.2 PDS Def. .Will be available when offsite power recov-ered
- 12. Cooling for RCP Seals? Br.2 PDS Def. Will be available when offsite power recov- l ered-
- 13. Initial Cont. Condition? Br.3 Acc.Freq. Containment intact 15 RCS Pressure at UTAF? Br.1 Summary RCS is at system setpoint pressure (2500 psia)
- 16. PORVs Stick Open? Br.2 Internal PORVs do not stick open
- 17. T-I RCP Seal Failure? Br.1 Acc.Freq. RCP seals fail
- 19. T-I SGTR7 Br.2 Experts No steam generator tube rupture '
- 20. T I Hot Leg Failure? Br.2 Experts No hot leg or surge line failure
- 21. AC Power Early? Br.2 Distrb. Offsit e ac power is not recovered before VB
- 23. RCS Pressure at VB? Br.3 Internal The RCS is at intermediate pressure (200 to 600 psia) ;
- 28. Cont. Pressure before VB7 Par.1 Summary The containment is at 26 psia just before VB
- 29. Time of Accm. Discharge? Br.2 Summary The accumulators discharge during core melt
- 30. Fr. Zr Oxidized in-Ves.? Par.2 Experts 0.866 of the Zr is oxidized in-vessel
- 31. Amt. Zr Oxidized In-Ves.? Br.1 Summary A high fraction of Zr is oxidized in-vessel l
- 32. Water in Cavity at VB? Br.2 Summary The reactor cavity is dry at VB ;
l 33. Fr. Core Released at VB? Par.3 Experts 0.544 of the core is released at VB
- 34. Amt. Core Released at VB? Br.1 Summary A high fraction of the core is released at VB
- 35. Alpha Mode Failure? Br.2 Experts. The is no alpha rnode failure ' .;
~
- 36. Type of Vessel Breach? Br.1 Experts High-pressure melt ejection occurs at VB l i
- 38. Size of Hole m Vessel? Br.1 Internal The hole in the vesselis large - l
- 39. Pressure Rise at VB? Par.4 Experts The pressure rise at VB is 56.8 psig !
- 41. Ex-Vessel Steam Explosion? Br.2 Internal There is no ex-vessel steam explosion at VB ;
- 42. Cont. Failure Pressure? Par.7 Experts The containment failure pressure is 148.4 -l psig i Par.8 The LHS number for failure mode is 0.808 l
- 43. Containment Failure? Br.4 Calc. The containment does not fail at VB
- 45. AC Power 12te? Br.1 Distrb. Offsite ac power is recovered during early l CCI !
- 46. 12tc Sprays? Br.1 Summary Containment sprays are recovered during l carly CCI .l
- 49. How much H 2Burns at VB? Par.8 Internal 0.30 of the hydrogen burns at VB
- 50. I2te Ignition? Br.1 Experts Ignition occurs during early CCI !
Par.9 Internal 95 percent of the hydrogen burns ifignition ! l occurs l NUREG-1150 B-12 1
'l Appendix' B Table B.2 (Continued)
Branch { Taken or Source of Parameter Quantifi-Question Defined cation Meaning of Branch or Parameter Par 10 Internal The pressure rise scale factor is 1.12 -
- 51. 12te Burn? Pressure Rise? Br.1 Calc. Hydrogen combustion occurs during early :j CCI : '
Par.11 Calc. The load pressure is 100.2 psia
- 52. -Containment Failure? Br.4 Calc. The containment does not fail during early CCI
- 53. Amount of Core in CCI? Br.2 Internal . A medium amount of the core is involved in CCI
- 54. Is Debris Bed Coolable? Br.1 Internal - The debris bed is coolable if water is available
- 55. Does Prompt CCI Occur? - Br.1 Summary Prompt CCI occurs
' 62. ,Very late Ignition? Br.2 Experts Ignition does not occur during or after late CCI
- 65. Basemat Meltthrough? Br.1 Internal The basemat eventually melts through
- 71. Final Cont. Condition? Br.3 Summary The only containment failure is basemat meltthrough {
4 i I l 1 l .
'l
-)
i l l ! i l B-13 NUREG-1150 , l
1 3ed (3 P r 4 nCl u o i nr e7 o osB 5 4 b a iR t sI F S S iCaeV t s 8 t = t e l P- e r ea uTa e 0 B uF R 3 P Q S 1 E Q- . l 6 k : c 2 t 1 it ? nS o ise t sV p n [S O t V n 3 nta i ni r o etiB t t sa y? vV
/ y r
i eRO e a D t QP uO 7 R 4 O Q-uWC . 6 - 8 '
- 9. P 3. CR l t
5 r ' 1 u7 nsA oe irT sPU e sF r P 1 3 nZ r to . d it smi-V M iz e x n
's. (
O x r h T ( eSt S eA OI Z-u 0. S- u Q Ca i R 1 E O 0. H 1 t t
- t :
3 n? 0 1 en 3n ede ?. nl a mio oi i it i i nt i o CeW r or se 6 3 t sn adn t 8 t e r. x s l - 3 i eI u no oC 9 9 u FOIn = Q C 9 Q 2 P r
- r 2 9 1
f o?ls 2 f t o? e t n o ge a nolag ioe ura M d i it ins C t m mh C sl oP S s iuc d e P eTcs D u oC s i c Q CR 0 a 1 B O t AcD 0. A 1 1
- la S
- t 0v? 8 n: 7 a f
1 nmG os \ 2 eeB nmrVu i s p io eS t R ii onse tst aeosr 6 et Rm s H 2 u a or a enrf = 0 G uoPe i Qef H 1 S QC b 1 P f f
? 3 r
- 'e 8 f r 2 u no os e
w nss7 / iu t o P i oeB r V i st P t r d ea C sP f P uS C t A eS a 7 d u 4 m i A Q C Q 0 a 1 B R 9 i I
- fi l
y :
- t 1 1 i r 7 r i S
ngF 2 e oeA nw? y i t t nT V oot r sI U R ipa t s P 1 e O eCE C uSt 6 A QCa 0 P- uA 8 a h R 1 B Q 3 E S
- A 0g B
n o 2 e? nL er /AL t is iouot H-nsis t i ees sHi a l B d r y e1 F t r igl uF E t a cr c o na QT 0 o 1 n SAPA - n ?: ZEii:8 .
6 1 n? 4 n
?
s \
\ 7 nl mo en otey io nia ad int i
tia a r t i sL p sFt n T e p e u S 2 7 S- u no 4 Q 9 L Q CoC 2 0 pM.
- ?
5 r 8 h
\\ \
4 e 6t g nw? au ooe t nmo o e r ipa P i s sh t t s a-t eC L 2 C e t 4 T uA 7 A- uBt e 2 M Q 9 L Q M 0 B [-
- t :
3 n 2 4 e 6 e? nm? on r e nan oL o t n it iu i i t Ig s tail F t yi e nF a C s eeg r n 2 uo I
- uVI 2 L QC 0 o 1 n Q 7 9 n o
(
- t g 2 n ?
i s 5: tp? 4 e nmre p 5noc mur nu ue r o s 48 8 or c i il t s taisa 4 80 i t s sI PO t e uonFePr 1
= = e u o eC 3 p
I QC 67 QD C 9 mC r PP 3. P C 1 i t n 4 e o Veo s l s smio eas
?
n fE S 4 ie t 5 sb nria obl sD
?
l e o o ( ' sC t l exSp Y uE x E g E g o e uid 6 B Q g e 0 D
, n Q 9 C B.
9: es g 3f
- ?
l 3i is 5 oC n R7 p nt C oeB irV 8, o nun I s u i t 6 t soi C e sst a 5 emre C ue QrP
=
uAoC 8' d 9 e 4 Q P 3 M
- t 8 ol 3
l e? 2 n 7 n Hse o
\e 5 e nm?er i
t f oe s s on iiu s o t ai l F e zeV H st a C u in 0 g enF uo Q S I 1 L r QC 0. Lo g 1 n (
?
h ? !s
? se
- p 6
3 f ac 1 ni 5 2 noer n rR o u e 0 ioeB t p iBr 0 n r s yl eTs e t se et su 1
= B 2
u s 7 uas 4 Q e 9 3 N Q LeP r 1 1 P 5 3 L H-V 5 e 3d n o?e ioMr t al sh i u 3 9
/
9 p h a 0 5 t n oteo iat
?
i i n 5 2 1
- 9. 1=
( e a l sLn e n ulpF 9 g 9 A u = 4 g i 0 QA o Q 91 5 i 9 n PP 3 L
- 7: _ Z
. 1
Appendin B being followed through the APET. If a parameter is defined in the question, the parameter number is given. The " Source of Quantification" column gives the source of the branch probability or the distribu-tion for the parameter value for this question. PDS Def. means that the branch taken is determined by the definition of the PDS. Acc. Freq. means that the split between the branches at this question was deter-mined in the accident frequency analysis. " Summary" indicates that the branch taken at this question is determined solely by the brsnches taken at previous questions. " Internal" means that the split between the branches, or the parameter value, was determined by the SARRP analysts, usually with assistance from other experts in various nationallaboratories. "Distrb." means that the probability of offsite power recov-ery was determined from distributions of power recovery as a function of time prepared for each reactor site. " Experts" indicates that the sampling is from a distribution determined by one of the expert panels that considered the 34 most important issues for risk. A discussion of each question follows in Section B.3.2. An expanded discussion of a few questions that were quantified by panels of experts follows in Section B.3.3. Finally, the binning of the results of the evaluation of the APET is discussed in Section B.3.4. B.3.2 Discussion of APET Questions Question 1. RCS Integrity at,UTAF? I This question defines the state of the RCS at the start of the accident progression analysis. UTAF indicates the uncovering of the TAF, which is the nominal starting point for this analysis. The first character in the PDS definition, "T", indicates that TRRR-RSR has no failures of the RCS pressure boundary. Branch 6 is chosen; the water loss is through the cycling PORVs. Question 8. Status c,f ac Power? Branch 2 is chosen as indicated by the fourth characMr in the PDS definition. This is the "available" state, and it indicates that ac power will be available tNughout the plant if offsite power is recovered efter UTAF. The accident frequency analysis concluded that recovery of power from the diesel generators was of negligible probability. Recovery of offsite power in time to prevent core damage was considered by the accident frequency analysis. Recovery of offsite power after the ostensible onset of core damage but before vessel failure is more likely than not for TRRR-RSR. Recovery of power would allow the high-pressure injection system (HPIS) and the containment sprays to operate as these are also in the available state at UTAF. (The questions concerning emergency core cooling system (ECCS) and spray states are not listed in the interest of brevity.) Question 10. IIcat Removal from SGs? As determined by the sixth letter of the PDS indicator, Branch 2 is chosen. This bramch indicates that the steam-turbine-driven AFWS is failed, but the electric-motor-driven AFWS is available to operate when power is restored. Question 12. Cooling for RCP Seals? The last character of the PDS definition indicates that the accident frequency analysis concluded that there would be no cooling water flow to the RCP seals unless ac power was recovered. Thus, Branch 2 is taken. Question 13. Initial Containment Condition? The Surry containment is maintained below atmospheric pressure, at about 10 psia, during operation. The accident frequency analysis concluded that the probability of a preexisting leak is negligible and that the probability of an isolation failure at the start of the accident was 0.0002. The more likely branch, no containment failure (Branch 3), is followed in this example. Question 15. RCS Pressure at UTAF? This question summarizes the information in the previoas questions to determine the RCS pressure at the onset of core damage. As there is no break in the pressure boundary and no heat removal by the AFWS, NUREG-1150 B-16
Appendix B the only water loss mechanism is the cycling PORVs: the RCS must be at the setpoint pressure of the PORVs, about 2500 psia. This pressure range is indicated by Branch 1. Question 16. PORVs Stick Open? After the core degradation process has proceeded for some time, the PORVs will be passing hydrogen and ' superheated steam and will be operating at temperatures well in excess of those for which they were designed. Based on the rate at which PORVs fail to reclose at normal operating conditions, the number of cycles expected, and allowing for degraded performance at high temperatures, failure of the PORVs was estimated to be of indeterminate probability. As there was no information available on PORV perform - ance at temperatures considerably above the design temperature, a uniform probability distribution from 0.0 to 1.0 was used for this question. That is, the probability that the PORVs will stick open is equally likely to be anywhere between 0.0 and 1.0. In Observation 4, the value for PORV failure is 0.0528. This example follows the more likely branch, Branch 2, and the PORVs reclose. Question 17. Temperature-Induced (T-1) RCP Seal Failure? In normal operation,' the seals around the shafts of the reactor coolant ptimps-(RCPs) are kept from overheating by a flow of relatively cool water. If this cooling flow is not available, the seal material may become too hot and fail. Failure of the RCP seals is important in both the accident frequency analysis hnd the accident progression analysis. In the accident frequency analysis, whether the seals fail, and when they fail, determines the time to UTAF and the RCS pressure at UTAF. In the accident progression analysis, if the seals have not failed before UTAF, whether the seals fail after UTAF may determine the RCS pres-sure when the vessel fails. The containment loads at VB are strongly dependent on the RCS pressure at that time. As part of the accident frequency analysis, an expert panel was convened specifically to consider the failure of RCP seals. One of their conclusions was that the seals must be deprived of cooling for some time before failure is likely. In TRRR-RSR, UTAF occurs fast enough that the probability of RCP seal failure calculated in the accident frequency analysis was negligible That is, by the time the seals have been without cooling long enough to have a significant chance of failure, the water level has dropped below the TAF and the consideration of the accident has passed to the accident progression analysis. In the accident sequence chosen for this example, then, seal failure only occurs in the accident progression analysis. In the accident frequency analysis, the question of RCP seal failure is sampled zero-one: thatis, in some observations a seal-failure branch has a probability of 1.0, and in other observations the no-seal-failure branch has a probability of 1.0. The accident progression analysis samples RCP seal failure the same way for consistency. For the entire sample, the probability of seal failure for this case where the RCS is at setpoint pressure (2500 psia) is 0.71. That is, of the 200 observations,142 have seal failure and 58 have no seal fai'are. In Observation 4, the seals fail, so Branch 1 is taken. More discussion on the matter of RCP seal 'ai. lure may be found in Section B.3.3 and in Reference B.8. l Question 19. T-I Steam Generator Tube Rupture (SGTR)? ; After some period of core melt, the gases leaving the core region are expected to be quite hot. If these - l gases heat the steam generator (SG) tubes sufficiently, failure of the tubes msy be possible. The expert ! panel that considered this issue concluded that temperature-induced (T-1) SGTR was possible but very , unlikely if the RCS was at PORV setpoint pressure, and not possible if the system was at less than setpoint j pressure (Ref. B.6). The failure of the RCP seals has reduced the RCS pressure below the setpoint of the i PORVs, so, for Observation 4, there is no possibility of T-I SGTR, and Branch 2 is taken. ' Question 20. T-I Ilot Leg Failure? The very hot gases leaving the core region during melt may also heat the hot leg or the surge line to ; temperatures where failure is possible. The experts considered this failure much more likely than T-I , SGTR, but only if the RCS was at, or near, the PORV setpoint pressure (Ref. B.6). The failure of the RCP l seals has reduced the RCS pressure considerably below the setpoint of the PORVs, so, for Observation 4, j there is no possibility of T-I hot leg or surge line failure. Branch 2 is taken. B-17 NUREG-1150
~ Appendi:t.B Question 21. AC Power Early?
This question determines whether offsite power is recovered in time to restore coolant injection to the core before vessel failure. Distributions giving the probability of offsite power recovery as a function of time for the Surry plant are sampled to obtain the values used in this question (Ref. B.4). The times _. marking the beginning and the end of the time period considered were determined by considering the rate at which this accident progresses and the nature of the plant. For PDS TRRR-RSR, case 2 of this question is applict.ble; the time period is 0.5 to 2.0 h after the start of the accident (LOSP). The average value for power recovery in this period for this case is 0.565. The value in Observation 4 is slightly above average at 0.614. If power is recovered during this period, it is likely that vessel breach will not occur. Because an example that proceeds to vessel breach is desirable, the less likely branch is chosen at this question. Branch 2 indicates that offsite power is not available in the plant during this period but may still be recovered in the future. Question 23. RCS Pressure at VB? This question determines the pressure in the RCS, including the vessel, just before the vessel fails. For the cases with large breaks in the RCS or with no breaks in the RCS, this pressuie is.well known. For cases j with small (S2) or very small (S3) breaks, the pressure at VB depends upon the time between core slump -! and VB, and the rate at which the pressure decays away following the steam spike at core slump. The RCP ; seal failure may te of large S3 or small S2 size, although all are classed as S3 breaks in this analysis. j Taking into account the range of break sizes and the likely delay between core slump and vessel breach, it ; was estimated that it ens equally likely that the RCS pressure at VB would be in the .High range, the. ( I Intermediate range, or the ;_nw range (Ref. B.6). This question is sampled zero-one. In Observation 4 the Intermediate range is selectea. Therefore, all of the accident, except the 5.3 percent with the PORVs stuck open, goes to Branch 3. 4 Question 28. Containment Pressure before VB? The total pressure in the containment just after vessel breach consists of the baseline pressure before breach plus the pressure rise associated with the events at VB. (The pressure rise at VB is considered in Questions 39 and 40.) The containment pressure before VB is a function of spray operation and the magnitude of the blowdown from the RCS. The path followed in this example has no sprays and no large break. The results of detailed mechanistic simulation codes indicate that the containment will be around 26 psia in this case Parameter 1 is set to 26 in this question. As the RCS pressure was above the accumu-lator setpoint when the core uncovered, and is below the setpoint (due to the RCP seal failure) at VB, the j accumulators must have discharged during the core mek. Branch 2 is chosen. ; Question 30. Fraction of the Zr Oxidized In-Vessel? The fraction of the Zr oxidized in the vessel before VB determines the rate of the core degradation. process and temperatures of the gases leaving the core region. The amount of unoxidized Zr in the core. , debris leaving the vessel is also important in determining the nature of the core-concrete interaction 1 (CCI). The expert panel provided distributions for this parameter for cases that depended upon the RCS q pressure and the time of accumulator discharge (Ref. B.6). The path followed here has setpoint pressure in the RCS at the start of core melt and accumulator discharge during core melt. Observation 4 contains the value 0.866 for parameter 2 for this case. The median value for this distribution is 0.45: the value in i Observation 4 is the 91st percentile value. As the fraction of Zr oxid! zed in the vessel is related to the temperature of the gas leaving the core by a known physical mechanism, the value for this parameter is as rank correlated with the probability of T-I hot leg failure as possible. Question 31. ~ Amount of the Zr Oxidized In-Vessel? The expert panel that considered containment loads at vessel breach gave distributions for two discrete ; levels of in-vessel Zr oxidation. Therefore, the oxidation fractions obtained from a continuous distribution : in the previous question must be sorted into two ranges or classes. This is accomplished by Question 31;. the fraction 0.40 divides the fraction of Zr oxidized in-vessel into High and Low ranges. The value of NUREO-1150 B-18
- - _ - _ _ _ _ _. - _ _ _ _ _ _ _ - _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _________m
l Appendix B parameter 2 selected from the experts' distribution in the previous question. 0.866, falls in the High range: Branch 1 is taken. Question 32. Water in Reactor Cavity at VB? At Surry, the cavity is not connected to the containment sumps at a low level. The only way to get an appreciable amount of water in the cavity before VB is for the sprays to operate. As there is no electric power to operate the spray pumps in this blackout accident, the cavity is dry at VB in the path followed in this example. This is indicated by Branch 2. Question 33. Fraction of the Core Released from the Vessel at Breach? ! The expert panel provided a distribution for the amount of the core ejected promptly when the vessel fails (Ref. B.6). This is the fraction of the core that can be redistributed in the containment by the subsequent gas blowdown in a direct containment heating event. Observation 4 contains the value 0.544 for parame-ter 3. This is the 92nd percentile value. The median value is 0.27. Question 34. Amount of the Core Released from the Vessel at Breach? This question sorts the parameter values obtained from the experts' distribution in the previous question into three classes. The fraction 0.40 divides the High range from the Medium range for the fraction of core released at VB. The value of parameter 3 selected from the experts' distribution in the previous ! question falls in the High range; Branch 1 is chosen, j Question 35. Alpha Mode Failure? 1 An alpha mode failure is a steam explosion (fuel-coolant interaction) in the vessel that fails the vesselin I such a way that a missile fails the ccatainment pressure boundary as well. The distribution for this failure mode was constructed from the individual distributions contained in the Steam Explosion Review Group report (Ref. B.9) modified and updated as explained in Reference B.6. The alpha mode failure probabil-ity in Observation 4 is 0.00011. This is considerably less than the mean value. It is so low that alpha mode failures are truncated within the tree and do not appear in the results. The path selected for this example follows the more probable branch, Branch 2. l l Question 36. Type of Vessel Breach? 1 This question determines the way in which the vessel fails. The possible failure modes are pressurized ejection, gravity pour, or gross bottom head failure. A panel of experts considered the relative likelihood of these possible failure modes (Ref. B.6). Their aggregate conclusion is sampled zero-one. The mode selected in Observation 4 is pressurized ejection (also denoted high-pressure melt ejection). For the whole sample, this failure mode is selected 60 percent of the time for the case where the vesselis at a high or intermediate pressure. Branch 1 indicates pressurized ejection upon vessel breach. Question 38. Size of Hole in Vessel? The experts who considered the loading of the conta'inment at vessel breach gave pressure rise distribu-tions that depend upon the size of the hole in the vessel. Hole size was also to have been determined by the experts, but no usable results were obtained. The hole size question was considered by a national laboratory expert in this field (Ref. B.6). He concluded that a small hole (nominal size = 0.1 m2) was much more likely than a large hole (nominal size = 2.0 m2). This question is sampled zero-one. Only 10 percent of the time is the large hole branch, Branch 1, selected as it was in Observation 4. l Question 39. Pressure Rise at VB? l The magnitude of the pressure rise in containment that accompanies vessel breach was determined by a panel of experts (Ref. B.6). In defining their distributions, the experts took into account all the pressure rise mechanisms, including vessel blowdown, steam generation, hydrogen burns, ex-vessel steam explo-sions, and direct containment heating. The pressure rise at vessel breach is treated in two questions, 39 ! B-19 NUREG-1150
Appendix B and 40, in the Surry APET because the experts considering this issue defined so many cases. The large hole cases are considered in Question 39. The applicable case for the path being followed in this example is case 11: large hole, high fraction of the core ejected at breach, RCS at intermediate pressure, and dry cavity. For Observation 4, the 34th percentile value, 56.8 psig, was selected for this case. Parameter 4 is set to this value. This issue is discussed further in Section B.3.3. Question 41. Ex-Vessel Steam Explosion? This question determines whether a significant steam explosion occurs when the hot core debris falls into water in the reactor cavity upon vessel breach. In the path for this example, the cavity is dry, so there is no steam explosion, which is indicated by Branch 2. Question 42. Containment Failure Pressure? Two sampled variables are determined in this question. The first is the failure pressure of the contain-ment. It is sampled from a distribution provided by structural experts who considered the Surry contain-ment specifically. The other value is a random number between 0.0 and 1.0 that is used to determine the mode of failure if the containment fails. The value for the failure pressure in Observation 4 is 148.4 psig. This is the 93rd percentile value. The mean and the median failure pressures are around 127 psig. The ; random number selected for determining the mode of failure is 0.808 for Observation 4. Thus, in this question, parameter 6 is assigned a value of 148.4 psig and parameter 7 is assigned a value of 0.808. This issue is discussed further in Section B.3.3 and in Reference B.6. 1 I Question 43. Containment Failure and Type of Failure? This question determines if the containment fails shortly after vessel breach and, if it fails, the mode of failure. This calculation is done in a FORTRAN " user function" which is evaluated at this question in the j APET. Failure is determined b) comparing the load pressure with the failure pressure (Refs. B.5 and j B.6). In the user function, the failure pressure is converted to absolute pressure (163.1 psia) and the load pressure is calculated by summing the baseline containment pressure (parameter 1, see Question 28), 26 psia, and the pressure rise at VB (parameter 4, see Question 39), 56.8 psi. The load pressure, 82.8 psia, is less than the failure pressure so there is no containment failure at vessel breach in Observation 4. No ! containment failure is indicated by Branch 4. j Question 45. AC Power Late? This question determines whether offsite power is recovered after vessel breach and during the initial period of CCI. The same basic distributions sampled in Question 21 are sampled again to obtain the probability of power recovery in this period. The average value for power recovery in this period for this case is 0.888. The value in Observation 4 is slightly above average at 0.927. This is the probability that power is recovered in this period if it was not recovered in the previous period, and it applies only to the fraction, 0.386, that did not have power recovered in the previous period. The most likely branch, Branch 1, is taken here; the path being followed in this example thus has power recovery at this point. Question 46. Late Sprays? As the sprays were available to operate at the start of the accident (Question 6, not discussed in the interest of brevity), they operate now that power has been restored throughout the plant. Branch 1 is selected for the path of interest. Question 49. Ilow Much Ilydrogen Burns at Vessel Breach? The restoration of power means that the sprays will begin to operate in the containment and . net ignition sources will probably be present. The sprays will condense most of the steam in the containment and may convert the atmosphere from one that was inert because of the high steam concentration to one that is flammable. To determine the hydrogen concentration in the containment atmosphere during this period, the fraction of the available hydrogen burned at VB must be known. For the path of interest, pressurized NUREG-1150 B-20
Appendix B ejection at VB with no sprays operating (the sprays were recovered after VB), there is a good chance that all or most of the the containment would have been effectively inert at VB because of the steam concen-tration. It was estimated internally that, on the average 30 percent of the hydrogen produced in-vessel would burn at VB. Thus, parameter 8 is set equal to 0.30. Question 50. Late Ignition? This question determines the likelihood of ignition and sets the values of two parameters. The experts who considered ignition concluded that, if electric power was available, ignition was almost ensured in a matter of seconds or minutes, given that the atmosphere was flammable. In the path of interest, due to power recovery and the de-inerting of the containment, ignition is essentially ensured. Parameter 9 is the conver-sion ratio for hydrogen combustion, i.e., the fraction of the hydrogen that burns if there is ignition. The Surry containment is fairly open, and steam condensation due to the spray action is expected to make it well mixed at this time. The conversion factor is estimated to be 0.95, and parameter 9 is set to this value. Parameter 10 is the scale factor applied to the adiabatic pressure rise. A distribution was obtained for this value internally. The value for Observation 4 is 1.12, the 91st percentile value, and parameter 10 is set to this value. (Values of the scale factor greater than 1.0 account for the possibility that local flame accelera-tion will result in pressures greater than those calculated for deflagrations using the adiabatic assumptions. Global detonations were not considered at Surry.) Question 51. Late Burn? Pressure Rise? In this question, a FORTRAN " user function" is evaluated to determine if the containment atmosphere is flammable and, if it is, the total pressure that results from the ensuing deflagration. The amount of hydro-gen in the containment is computed from the fraction of the Zr oxidized before vessel failure (parameter 2, see Question 30) and the fraction of the existing hydrogen that burned at vessel failure (parameter 8 see Question 49). This assumes that the ignition takes place before CCI or early in the CCI, i.e., before any appreciable amount of hydrogen has been generated by the CCI. The fraction of the hydrogen avail-able that is consumed in the deflagration is given by the conversion ratio, parameter 9, read in the previ-ous question. The baseline pressure is determined from the masses of the different gas species in the containment assuming a 50 percent steam mole concentration. The pressure rise calculated with the adi-abatic assumptions is multiplied by the scale factor (parameter 10, Question 50) to obtain the final load pressure. For Observation 4 and the path of interest, 253 kg-moles of hydrogen burned resulting in an adiabatic pressure rise of 64.7 psia. The scaled pressure rise is 72.6 psia, and the total load pressure is 100.2 psia. Parameter 11 is set to this value. Question 52. Containment Failure and Type of Failure? This question determines if the containment fails several hours after vessel breach. If CCI occurs, failure at this time would be during the initial portion of CCI. This is designated the " Late" period. If the containment fails, the mode of failure is determined. This calculation is done in a FORTRAN " user function" as in Question 43. Failure is determined by comparing the load pressure with the failure pres-sure (parameter 6, see Question 42). The failure pressure is 163.1 psia. The load pressure is 100.2 psia, so there is no late containment failure for Observation 4. This is indicated by Branch 4. Question 53. Amount of Core in CCl? This question determines the amount of core available for CCI. should it take place. The path being followed has pressurized ejection at VB and a large fraction of the core ejected from the vessel. Pressur-ized ejection means that a substantial portion of the core material was widely distributed throughout the containment. For this case, it was estimated that between 30 and 70 percent of the core would be avail-able to participate in CC1. This is the Medium range for CCI, indicated by Branch 2. Question 54. Is Debris Bed Coolable? This question determines if the core debris in the reactor cavity will be coolable, assuming that water is available. The path being followed has pressurized ejection at VB, so a substantial portion of the core B-21 NUREG-1150
Appendix B material was widely distributed throughout the containment, and this portion of the core debris is likely to be coolable. It was internally estimated that, for this case, the probability of the debris in the cavity being in a coolable configuration is 80 percent (Ref. B.6). Note that for the debris to actually be cooled, in addition to the debris being in a coolable configuration, water must be present in the cavity at vessel breach and must be continuously replenished thereafter. This question only determines whether the debris configuration is coolable. The most likely branch, Branch 2, is followed for the example path, indicating that the debris bed configuration is potentially coolable. In the path being followed, the reactor cavity is dry at vessel breach, so whether the debris bed is coolable is a moot point. Question 55. Does Prompt CCI Occur? The reactor cavity is dry at vessel breach since the sprays did not operate before VB, so CCI begins promptly. While the sprays are recovered in the period following VB, they may not start to operate until some time after vessel breach. It was internally concluded that if the cavity was dry at VB, the debris would heat up and form a noncoolable configuration, pd that, even if water was provided at some later time, the debris would remain noncoolable. Thus, prompt CCI occurs, and Branch 1 is chosen. Question 62. Very Late Ignition? Ignition leading to a significant hydrogen burn does not occur during the late portion of CCI, or after CCI, in the path being followed through the Surry APET for this example. Jgnition occurred in the previous J period and ac power has been available since that time. As an ignition source has been present since the late burn, any hydrogen that accumulates after the burn will burn off whenever a . flammable concentration is reached. Burns at the flammable concentration limit will not threaten the Surry containment. There-fore, Branch 2, no ignition, is taken at this question. Question 68. Basemat Meltthrough? The path of interest has a medium amount of the core involved in CCI and the sprays start after VB and operate continuously thereafter. As the basemat at Surry is 10 feet thick, eventual penetration of the basemat by the CCI was internally judged to be only 5 percent probable for this case (Ref. 'B.6). Branch 2 ; is followed at this question. Although this branch indicates basemat meltthrough and is less probable than the other branch, it is taken because the source term and risk analyses are not of much interest if there is no failure of the containment. Question 71. Final Containment Condition? This is the final question in the Surry APET; it summarizes the condition of the containment a day or more after the start of the accident. Only the most severe failure is considered, that is, if the containment failed at vessel breach, a later basemat meltthrough would be ignored. In the path followed through the APET, there were no above-ground failures, so Branch 3 is selected, indicating basemat meltthrough. B.3.3 Quantification of APET Questions by Expert Judgment This section contains detailed quantification of three questions in the APET that were considered by the expert panels. The first is Question 17: probability of RCP seal failure. The second is Question 39: pres-sure rise in the containment at VB. The last is Question 42: containment failure pressure. Temperature-Induced RCP Seal Failure Question 17 determines whether there is a temperature-induced failure of the RCP seals. This failure mechanism is considered in the accident frequency analysis as well as in the accident progression analysis I as it is important to be*h The panel of experts that considered RCP seal failure was convened as part of the accident frequency analysis, and the results of that panel were used here as well. These experts l I concluded that the seal degradation depended primarily on the amount of time the seals had spent at elevated temperatures. For fast SBO accidents such as TRRR-RSR, the seal failure would not occur before UTAF. (It could, however, occur after UTAF.) Thus, for the accident sequence and PDS considered in this example, RCP seal failure is primarily of interest in the accident progression analysis. NUREG-1150 B-22
Appendix B The RCP seal is designed to allow a small amount of leakage (3 gpm) of primary coolant water dtiring normal operation. The purpose of the leakage is to cool the shaft of the pump. This leak rate is well within the capacity of the normal makeup system. During an SBO with loss of the AFWS, there is no heat removal from the RCS and no cooling flow to the RCP seals. As the temperature and pessure of the primary system rise, the ability of the RCP seals to controlleakage at acceptable levels determines whether the integrity of the RCS will be maintained. Significant leakage of primary water through the seals will hasten the uncovering of the core and reduce th) time available for restoration of ac power and core cooling. The RCP seal is a complex multistage labyrinth seal that uses elastomer o-rings and free-floating seal plates. The integrity of the o-rings and the stability of the plates depend on the pressure in the RCS arid the temperature of the water passing through the seal. Should the RCP seals fail, the size of the leak and the time of failure are functions of the combination of o-ring and seal plate failures in the seal assembly. In the operating history of Westinghouse reactors, there has never been a seal failure caused by loss of seal cocling. However, there have been six incidents where seal cooling has been lost in U. S. Westin-ghouse reactors. In each case, the loss of seal cooling lasted less than 1 hour, which is the minimum time considered necessary to degrade the seal o-rings. While instability of the seal plates could occur at any time after the loss of seal cooling, this phenomenon has not been observed in any of the incidents to date. The o-ring material has been tested by both the Idaho National Engineering Laboratory (INEL) (Refs. B.10 and B.!!) and the French national electrical utility, EDF. These tests showed that the o-ring mate-rial can be degraded when subjected to off-normal temperatures and pressures. Both Westinghouse (Ref. B.12) and Atomic Energy af Canada Ltd. (AECL) (the latter under contract to the USNRC) have performed extensive analyses of the performance of the RCP seal assemblies under off-normal conditions. Neither these tests or analyses, nor the incidents to date, have provided sufficient data for a quantitative probability model of RCP sealleak rate as a function of time after loss of primary cooling on which all parties can agree. Furthermore, the analyses by Westinghouse and AECL are pro-prietary. For these reasons, the resolution of this issue was delegated to a separate panel of three experts who were familiar with the problem and who had access to this proprietary information. The three e .perts on (Fis panel were: Michael Hitchler, Westinghouse, Jerry Jackson, USNRC, and j David Rhodes, AECL. ' Which expert provided each distribution is not identified. The expens are described below as A, B, and ! C, which is not necessarily the order given above. They were asked to determine the probability of failure ! of the Westinghouse RCP shaft seals and corresponding leak rates under SBO conditions. More detail on ; this issue may be found in Reference B.8. i i With the approval of the panel, the issue of RCP seal failures was decomposed into two questions: 1. What is the likelihood of the various combinations of'o-ring and seal plate failures in a single RCP, and what is the resulting leak rate for each combination of failures? 2. What correlation, if any, exists between pumps for each combination of similar o-rings and seal plates j failures? The first question simplified the issue by focusing attention on the specific leak paths that might develop in a single pump. The second question expanded the scope of the panel's analysis to develop total leak rates for all of the RCPs. (Surry has three pumps.) In resolving the first question, the experts agreed to develop a single event tree that would represent the set of all possible failure combinations and their corresponding leak rates for a single pump. A consensus was reached on the expected leak rate assigned to each set of failures. Each expert assigned his own B-23 NUREG-1150
Appendix B . probabibties to the various events of the event tree to arrive at his own estimate of single pump leak rate probabilities. To resolve the second question, each expert gave his judgmerits regarding the correlation of failures of event tree events between pumps. Then the experts' correlation elicitation were used to extend each expert's single pump model to obtain leak rates and their probabilities for all three pumps. The single pump event tree is shown in Figure B.S. The probabilities on the tree are those for Expert A. It should be not,d that som2 of the event probabilities on the tree are shown as functions of time. The experts conauded that degradation of o-ring elastomer material is dependent on the length of time that the o-rings are exposed to uncooled primary water. The extension of Expert A's elicitation to a three-pump model is shown in Figures B.6 and B.7. Figure B.7 is the contin"ation of Figure B.6; it shows the various failure combinations for the first stage seal plates of the three pumps, based on Expert A's elicita-d tion on the correlation of first stage seal failures. The five outcomes en Figure B.6 are passed on to Figure D.7, where the first stage o-ring and second stage component failures are shown. The resuit is 16 possible outcomes on Figure B.7 each with a time-dependent probability. Similar trees were developed for Experts B and C, but each expert's tree was unique because of differences in their elicitation. 7 To illustrate the method used, the path to outcome 5 in Figure B.7 will be followed. Expert A concluded that this was the most likely outcome; the path starts on Figure B.6, where the upper branch taken at top event B1 indicates success; that is, the first stage seal ring of pump 1 does not fail. The first stage seal rings also do not fail fcc pump 3 '. and 3, so transfer path 1 is reached on Figure U.6. Transfer path 1 is the top entry path on Figure B 7, aad Expert A concluded that this was the most likely transfer path (probability = 0.951). In the path t' outcome 5 in Figure B.7 the first stage o-ring fails, so the lower branch is taken at top event "First Star,. O-Ring." Fo the probability cf this branch, Expert A developed a time-dependent model, denoted f1(t) nn Figure B.?. Expert A was of the opinion that if the o-ring failed in the seal for one pump, they would fail on the other pumps as well, so the lower path at top event "First Stage O-Ring" represents the failure of the o-rings in all three pumps. At the next top event, the second stage seal rings j do not fail, so the upper branch is taken. Expert A assigned a probability of 0.80 to this branch. At the i l final top event, the second stage o-ring fails in all three pumps. Expert A represented the probability of this failure by another function of time, denoted f3(t). Outcome 5 on Figure B.7 is a 250-gpm leak in all thre pumps, for 750 gpm total. The probability of this outcome is a function of time, rising from 0.0 at I hour after the loss of core cooling to 0.76 at 2.5 hours. Experts A and C had fairly similar models for the single pump fault tree. Both treated failure of the first stage o-rings as a step function of time. Experts A and C concluded that failure would be virtually certain by 1.5 hours and 2.0 hours, respectively. Both reasoned that the first stage seal plates would be very I reliable, but that integrity of the seals would be compromised by high probability failures of the first and second stage o-rir.gs and second stage seal plates. Experts A and C judged that the likelihood of a second stage failure was somewhat dependent on the status of the first stage as first stage failure could corapro-mise the ability of the second stage to succeed. Expert B's model was considerably more opt;mistic than those of Experts A ar.d C. He also concluded that the probability of o-ring failure would be e function of time, but with a maximum value of 0.15 for the first stage and 0.50 for the second stage. His probability for seal plate failure was similar to those of Experts A and C, but he did not think that the second stage was dependent on the status of the firn stage. The most significant difference between Expert B ar:d Experts A and C is the failure of the o-rings as a function of time. Expert B thought that the o-rings would degrade slowly, and by 4 hours after loss of cooling to the primary system, the primary system would have been depressurized by the operators. He believed that the o-rings would not fail in the depressurized environment. Experts A and C were of the opinion that the degradation of the o-rings would be so rapid that the question of depressurization within 4 hours was moot. With respect to the correlation of o-ring and seal plate faults between pumps, Expert C's elicitation was the most simplistic. He concluded that similar components would behave similarly in different pumps. Thus, his three-pump leak rate model was exactly the same as his single-pump model, except that the leak rates of the single-pump model are multiplied by three. Experts A and B had significantly more complex NUREG-1120 B-24
H T A P 1 2 3 4 5 6 7 8 9 E T A R m m m n m m m m p p p u p p p K g P g g g g g g p g A 1 2 0 E L 2 N I 8 1 1 C 5 0 5 6 7 0 5 0 8 2 2 . 2 4 E G A T G S N DR I N-OC ) ) C - t ( t ) t E 2 ) t ( 3 ) ( t ) S f 1
- (
2 f t ( 3 f t ( 1 1 1 f 1 f E G AG TN SIR D L NA 1 1 1 OE 0- 0- 0-CS E E E E 0 0 0 S 0 0 0 2 2 2 E G AG T SIN T R - SO R FI E GG AN TI SR TL S EA 2 R 0-I S E F 0 5 2 L LE AD EO SM PA CC RO L mb 2hBL
~
r
B O 2 2 R 1 2 2 0 0-P 0 . E E E E E 0 0 0 3 O 1 2 2 2 3 E 5 1 S 9 1 1 1 3 5 5 5 E B 5 62 5 T A 2 8 2 8 1 5 1 2 8 1 M 1 T 1 B B B S B B H T A P R . E F S N A R 2 3 4 5 T 1 3 B 2 B 1 B S P AM U TP R EE PE XR EH T 2c5aiC w* e'E
E T A R K m p ( p m (
#g m p
m y t m p g m y t pg m p m p g m y y g m t m p g m p g 0 A 6 6 0 0 4 4 2 0 0 0 0 0 4 E 1 4 5 5 4 6 2 0 5 0 5 5 2 8 4 5 7 4 L 5 5 7 7 3 3 1 1 H T A 0 1 2 3 4 5 6 P 2 3 # 5 6 8 9 1 1 1 1 1 1 1 E G A T-SG N DIR N-O0
) n ) t C t
( t t t (
)
t (
)
E 2 f
)
t ( a t
)
t ( 2 1 t ( 3 1 t ( S - - - - - 1 2 f 1 3 1 1 2 1 1 3 1 E G AG TN SIR DL 1 1 1 1 1 1 NA 0- 0- 0- 0- 0- 4 OE E E E E E E CS 0 0 0 0 0 0 E 0 0 0 0 0 0 S 2 2 2 2 2 2 E G A G T S IN T-R S0 R I
)
t (
)
t (
) )
F 1 1 t ( 1 1 P 1 1 1 1 1 "1 E GG AN TIRE S A S S S TLT S EAS P P P P M M M M R IS U U U U F ' P P P P s 3 2 1 3 S U R IO E V E F R S ER U N G A P I 2 2 R M F T O 4 E 0-E R 0 0 F 6 3 1 15 e 2cEOL
Appendix B elicitation for correlation of faults between pumps. Both had similar models for the correlation of first stage seal plate failures. They both judged that the first stage seal plates could fail independently of each other, but they agreed to a simplifying assumption that, should similar components in any two pumps fail, the third pump would experience the same failure. Thus, Expert B's model for first stage seal plate failures is the same as that of Expert A in Figure B 6. The probabilities for several of the five outcomes for the first stage seal plate failure tend to be somewhat lower for Expert B than for Expert A. However, both models show the first outcome (all three first stage seals succeed) to be the most dominant outcome by far. For the second stage, Experts A and B both concluded that the second stage o-rings would all fail in the same manner. But, Expert A concluded that the second stage seal plates would all fail in the same man-ner, while Expert B judged that the second stage seal plates would fail independently. The final RCP seal LOCA leak rates were calculated by averaging the leak rate probabilities of the three experts for various time intervals. Each expert's leak rate probabilities were given equal weight with re-spect to the others. The results are shown in Table B.3. (The o-rings in the RCP seals can be made from two types of material. The new materialis much more resistant to degradation at high temperatures. The experts considered both types of material. All the pressurized water reactors (PWRs) considered for NUREG-1150 had o-rings made of the old material when these analyses were performed. Table B.3 shows only the results for seals with o-rings composed of the old, less heat-resistant, material.) Table B.3 Aggregate resuiM for RCP seal failure with existing o-ring material. Leak Rate 1.5 2.5 3.5 4.5 5.5 ) (gpm) (h) (h) (h) (h) (h) 63 0.31 0.29 0.27 i 0.27(0.26) 0.27(0.24) 183 to 224 0.15 0.04 0,05 0.05(0.06) 0.05(0.08) 372 0.008 0.005 0.005 0.004 0.003 ; 516 to 546 0.0004 0.0003 0.0003 0.0003 0.0003 602 to 614 0.001 0.0 0.0 0.0 0.0 750 0.53 0.66 0.66 0.66 0.66 1440 0.004 0.004 0.004 0.004 0.004 The entries in the table give the probability of having the total leak rate shown at the times listed. Values i in parentheses denote the probabilities that apply if the RCS is not depressurized. 1 The time dependence'shown in Table B.3 cou'.d not be incorporated directiy into the accident frequency analysis. Instead, eight RCP seal states were defined, and Table B.3 was used to derive probabilities for these states. Some of the less likely leak rates were combined with similar leak rates. The result for the Surry accident frequency analysis was: Seal State Probability Total Leak Rate and the Time Seals Fail
- 1. 0.29 Design leakage (no failure)
- 2. 0.014 183 gpm at 90 minutes
- 3. 0.53 750 gpm at 90 minutes
- 4. 0.0043 1440 gpm at 90 minutes ,
- 5. 0.016 183 gpm at 150 minutes
- 6. 0.13 467 gpm at 150 minutes
- 7. 0.0040 561 gpm at 150 minutes
- 8. 0.016 183 gpm at 210 minutes NUREG-1150 B-28
l Appendix B i I 1 l in the accident frequency analysis, each of these eight RCP seal states was considered separately as the different flow rates and different times of failure led to UTAF at.different times. This level of detati could not be accommodated in the accident progression analysis. The APET considered only two RCP seal states: fai!ed and not failed. Based on the results of the expert panel given above, the failed state has a probability of 71 percent. The failed state was designated as an S3 break (less than 2-in, diameter) even though the most likely flow rate, 750 gpm total, is in the lower end of the range of flows of the S2 breaks l (0.5-in. to 2-in. diameter). This assignment, initiated in the accident frequency analysis, keeps the RCP seal failures separate from the stuck-open PORV cases, since the latter were all classified as S2 breaks, and avoids having to split the RCP seal failures between the two break sizes. As mentioned in the discussion of Question 17, the accident frequency analysis sampled this issue in the zero-one manner, i.e., there were eight states for the RCP seals: seven failure states and one design leakage (no failure) state. In Lach observation, one of these states was assigned a probability of 1.0 and the other seven were assigned a probability of C 0. The relative frequency of each state in the entire sample corresponded to the aggregate distribution of the experts, e.g.,29 percent of the observations had the design leakage state with a probability of unity. The accident progression analysis samples RCP seal failure the same way for consistency except that there are only two states. The sample for the accident progression analysis consists of 200 observations, so 142 observations had the failure state selected and 58 had the no-failure state selected. Pressure Rise at Vessel Break Questions 39 and 40 determine the pressure rise at VB in the Surry APET. Two questions are required because of the number of cases to be considered. Vessel failure usually causes the pressure to rise in the containment, sometimes dramatically. A number of mechanisms may contribute to this pressure rise: vessel blowdown, steam generation by the expelled debris, hydrogen combustion, ex-vessel steam explo-sions, and direct containment heating (DCH). The expert panel convened to consider the containment loads at VB concluded that the contributions of each of these mechanisms were generally not separable. Thus, the distributions for pressure rise provided by the experts include the contributions from all the pressure rise mechanisms. RCS blowdown and DCH cause significant loads to the contamment only if the RCS pressure is 10 to 20 atmospheres or more above that of the containment at vessel breach. After some discussion with the panel, the following case structure for Surry was adopted: RCS Pressure Cavity Sprays I Case (psia) Water Operating 1 2000 to 2500 Full Yes la 2000 to 2500 Half Yes 1b 2000 to 2500 Dry No Ic 2000 to 2500 Full No 3 500 to 1000 Full Yes 3a 500 to 1000 Half Yes 3b 500 to 1000 Dry No 4 15 to 200 Half Yes The panel defined eight subcases by considering the following variations (nominal values in parentheses): Zr Oxidation-High (60 percent) and Low (25 percent), Melt Fraction Ejected-High (75 percent) and Low (33 percent), and Initial Hole Size-Large (2 m2) and Small (0.1 m2), As there were eight cases, eight subcases for each meant that each expert provided 64 distributions for pres ure rise at VB for Surry. Four members of the containment loads expert panel considered the pres-sure rise at Surry. They were: B-29 NUREG-1150 l
Appendix B Kenneth Bergeron, Sandia National Lab (ratories, Theodore Ginsberg, Brookhaven Natienal Laboratory, James Metcalf, Stone and Webster, and Alfred Torri, Pickard, Lowe, and Garrick. f Expert A approached the problem by using the available CONTAIN (Refs. B.13 and B.14), MAAP (Ref.' B.15), and Surtsey results (Refs. B.16 through B.19) to carefully assess pressure rise distributions for three base cases. His base cases were chosen to represent the most severe pressure rises for the three
-]
different RCS pressure levels analyzed and were Ib, 3b, and 4. The low Zr oxidation, large hole, and large fraction ejected subcase was used for each base case. For the middle portions of his base case distributions, Expert A placed the most reliance on the CON-TAIN resuhs as reported in NUREG/CR-496 (Ref. B.20) and some subsequent calculations (Refs. B.21 through B.23). He obtained the extreme values from energy balance calculations. Using a PC spreadsheet program, he then adjusted these base ;ases for the effects of hole size, the amount of core ejected, and - the fraction of Zr oxidized in-vesse' to get values for the other 61 subcases. Expert B also based hk "be , estimates" on CONTAIN calculations and on scaled experiments. The case for the 500 to 1,000 psia pressure range was taken as a base, and the cumulative distribution function l (CDF) for that case was modified to obtain the CDFs for other cases. Expert B concluded that the l presence of water in the cavity could either enhance or reduce the pressure, so the median for the wet cavity cases was kept the same as for the dry cavity cases, but the distribution was stretched at both ends. On the low. side, an overabundance of water snight reduce pressure by two bars. On the high side, calcula-tions indicate the possibility of increasing pressure by one bar. Expert B took his high extreme values from a one cell adiabatic equilibrium code he had written to analyze Zion and Surry. While calculating the low side of the distribution, he considered phenomena that might reduce pressure, such as larger drop diame-ter or faster trapping. Dependence on extent of Zr oxidation, VB area (hole size), and fraction of melt ejected was also consid-ered by Expert B. CONTAIN calculations (Refs. B.20 through B.23) have indicated that there is little dependence on previous Zr oxidation, probably due to oxidation starvation in the cavity. The effect.of greater hole area is to give higher pressure rises across the entire distribution because the gas would exit with higher velocity. The effect of fraction of core ejected was handled by scaling the base case ratio of final to initial pressure. Expert C used HMC calculations (Ref. B.24) Sandia CONTAIN calculations (Refs. B.20 through B.23), and MAAP calculations. He tabulated the cases described in the issue description and applied the code results that appeared to be the most applicable to each case. He was forced to modify the code results in many instances to account for differences between the initial conditions in the code calculations and the case under consideration. Expert C uM the HMC calculations for the several cases in which there was water in the cavity and considered the highed pressures calculated by HMC to be the upper bounds of his distributions. The pressure rise without direct heating formed his lower bound. Expert C relied on CONTAIN and MAAP results in cases in which the cavity was dry. CONTAIN calcula-tions with unconditional hydrogen burn and default burn were averaged and used for the upper part of his , distributions, while the MAAP results were tised for the lower part of his distributions. Although he l believed the CONTAIN crdculations to be consistently above the median, he considered the results quite [ credible. From CONTAIN sensitivity calculations, Expert C was able to estimate the effects of changes in initial conditions, and using these estimates he obtained distributions for the subcases for which no HMC, CONTAIN, or MAAP results were directly applicable. Expert D used CONTAIN results (Refs. B.20 through B.23) as the basis for his analysis because CON-TAIN is currently the only code that has a DCH model. For his base case, he took the high-pressure case with a large fraction of melt ejected (75 percent) and a small initial hole. No further definition of the base case was necessary because Expert D was of the op!nion that the effects of co-dispersed water should not NUREG-1150 B-30 1
1 i Appendix B be included and that the fraction of the Zr oxidized in-vessel was not particularly important. (CONTAIN ; runs in which the in-vessel oxidation was varied showed small differences in pressure rise.) To obtain his # distribution for this base case, he started from results of the 18-node Surry model with unconditional hydrogen btfrn (UCHB) as defined in References B.21 and B.22. Expert D adjusted these results to account for alternate particle sizes, an alternate tiapping model, and the effect of the thin steel in the containment on peak pressure. For the small hole cases Expert D adjusted the lONTAIN pressures upward somewhat since there is the possibility that more than one penetration may fail at or about the same time. For the cases with the sprays operating, he reduced the pressures about 1.5 to 2.5 bars below the pressures in the equivalent cases without the sprays operating. Expert D concluded that changing the particle size assumed in CONTAIN could only decrease the pressure rise. If the particle size assumed in the CONTAIN runs (1.0 mm) is increased, the pressure rise will decrease because the material in the center of the particle will not have reacted before the particle is quenched. If the particle size is decreased from that assumed in CONTAIN, there is a negligible effect since all the metal in the particle is already reacting. CONTAIN assumes that the core debris distributed throughout the containment during the blowdown phase of the DCH process is homogeneous. Expert D expects 1: 3 entrained material to be richer in oxides than a homogeneous mix-ture, which would decrease the pressure rise somewhat. He also pointed out that, when DCH occurs, only a very small portion of the hydrogen pre-existing in the containment or produced during the high-pressure melt ejection (HPME) can be expected to remain unburned ther the event is over. Results for all 64 subcases may be found in NUREG/CR-45,1, Volume 2, Part II (Ref. B.6). Statistical tests on the 64 subcases showed that many of them could be combined, that the differentiation made on ~ the fraction of Zr oxidized in-vessel could be dropped, and that all the subcases for the low-pressure case (case 4) could be consolidated. The result of the statistical analysis was that there were 13 distinct cases for Surry. However, the dividing point between high and low fraction ejected used by the expert panel on co itain-ment loads, 50 percent ejected, was very near the high end of the aggregate distribution given for fraction ' ejected by the in-vessel experts. As defined by the loads panel, the high-fraction-ejected subcase has the fraction ejected greater than 50 percent with a 75 percent nominal value and the low-fraction-ejected subcase has the fraction ejected less than 50 percent with a 33 percent nominal value. The aggregate distribution from the in-vessel panel for core fraction ejected has a maximum value of 60 percent, and the probability that the fraction ejected will exceed 50 percent is only about 11 percent. Not wishing to place 89 percent of the samples in the low-fraction-ejected subcase of the loads panel, and as the "high - low" division was more coarse than necessary, the core-fraction-ejected distribution of the in-vessel panel was divided into three ranges: 0 to 20 percent, 20 to 40 percent, and 40 to 60 percent. l The pressure rise distributions from the loads panel were then adjusted to provide pressure rises for these ) three ranges. For the 0 to 20 percent ejected range, the average of the low-fraction-ejected results and the case 4 results (RCS pressure < 200 psia) were used. As the low-fraction-ejected case had 33 percent (nominally) ejected, and case 4 had, in effect, no core ejected at high pressure, this appeared to be appropriate. For the 20 to 40 percent ejected range, the low-fraction-ejected results from the loads panel were be used directly since the nominal value used by the loads experts was 33 percent ejected. For the 40 to 60 ) percent ejected range, the loads low-fraction-ejected distributions and high-fraction-ejected distributions j were averaged. The average of the nominal fractions ejected is 54 percent, which is reasonably close to j the center of this range. This treatment of the distributions was discussed with, and approved by, a mem- ! ber of the Containment Loads Expert Panel. ; This expands the number of cases for Surry from 13 to 19. Plots of the aggregate c' distributions for these 19 cases are contained in Reference B.6. For the example being followed through Observation 4, the path through the APET went to case 11 of ] Question 39. This case has intermediate pressure in the RCS at VB, dry cavity, large hole, and high (40 to i B-31 NUREG-1150 1
Appendix B 60 percent) core fraction ejected at breach. This is case 3b of the loads panel. The statistical analysis found no significant differences between the expert's results for cases 1, la, and 3b. As explained above, the 40 to 60 percent ejected distribution is the mean'of the loads panel low-fraction-ejected aggregate distribution and high-fraction-ejected aggregate distribution. Figure B.8 shows the distributions of the four experts and the aggregate for case 3b, large hole, for both core fractions ejected. Also included in Figure B.8 is a plot showing the two aggregates for case 1/la/3b, large hole, and the aggregate for case 4, as received from the loads panel, and the three aggregate distributions derived therefrom for the three ranges of the in-vessel panel distribution for core fraction ejected. The distribution for 40 to 60 percent ejected , was used in the sampling process to obtain the value of 56.8 psig, the 34th percentile valt.e, used for l Question 39, case 11, in Obserygtion 4. Containment Failure Pressure The value for the containment failure pressure is determined in Question 42. The Surry containment is a cylinder with a hemispherical dome roof. Both the cylinder and the dome are constructed of reinforced concrete. The foundation is a reinforced concrete slab. The containment is lined with welded 0.25-inch plate steel. The containment is maintained below ambient atmospheric pressure, at about 10 psia, during operation. The design pressure is 45 psig. The free volume . . 4 bout 1,850,000 cm3. A section through this
- containment is shown in Figure B.9.
l A panel of structural experts was convened to determine the loads that would cause containment failure at Surry and the other plants. As the probability of a global detonation ir, the Surry containment was consid-ered to be quite small, only static loads were treated for Surry. Such leads would result from the pressure rise that accompanies VB or a deflagration. Typical pressure rise times would be on the order of a few 1 seconds, which is longer than the containment response time. Four members of the structural expert panel considered failure pressure and failure mode for the Surry containment. They were: Joseph Rashid, ANATECH Research Corp., Richard Toland, United Engineers and Constructors, Adolph Walser, Sargent and Lundy, and 1 J. Randall Weatherby, Sandia National Laboratories. They did not differentiate on the basis of failure location since any failure location except shear at the basemat-cylinder junction would result in a direct path to the outside. The reinforcing and concrete details in this junction area were such that three of the four experts ruled out failure in this location. (The fourth expert did not specify failure location explicitly.) The experts treating Surry did not perform any extensive new calculations. They reviewed the previous detailed calculations and the drawings of the containment, including reinforcing details, penetrations, and - hatches and airlocks. Their experience allowed them to judge how comprehensive the previous analyses l had been and, when these were conflicting results, which result was more likely to be correct. Expert A based his conclusions on previous analyses of the Indian Point containment (Ref. B.25), the Surry containment (Ref. B.26), and the drawings of the Surry containment structure. He considered four failure modes: hoop failure in the cylinder, hoop failure in the dome, shear failure at the cylinder-basemat junction, and penetration failure. Meridional failure in the dome will be similar to the hoop failure and was not considered explicitly. On the basis of the detailed drawings and some brief calculations, Expert A concluded that the cylinder-basemat junction was a very strong region and ruled out failure at this location. He looked briefly at the equipment hatch, personnel airlock, pipe penetrations, and electrical penetrations and concluded that they were sufficiently similar to those at Zion that failures at these locations were of relatively low prob-ability. At low and medium stress levels, with the liner taken into account, Expert A concluded that the NUREG-1150 , B-32
EEEEA Rt i
===== em hr ooav* 0 t o f
d 5 1 e re e eh t c ht e ) s wy l r eb E 2 0 o s al len ,0 (b ci oi-o e f 1 Ht c e hl ear is t rs gF R o f v r 0 r e ne ae Lr ,5 u wh o s o C / o' 3
,J s hn e
r se l sh 4 la i - m _ 0. P l gmP00 r%% % 0 is e 0 r S - - - LSo24 6 r i 0 0 5 7 0 5 5 2 g o, . . L. - - ggg00 0
- ea r
ue 1 o 0 0 o AAA 2 4 s s
===== =
e r
$]i LQ g%3E5 t
ooavm x 0 po e y 5 1 he t i Tr [a v u
)s yy.
a 0 o r ra r up C le o
,0 (b 1
Ss r e oh y H s f t r e g
, i R hd cn D r a 0 r e a e
, L c ,5 u br s
r s l e P e r s si e vy a m 0. P t b 0 a m ABC D R . 0 5 0 5 g ec l, PPP P.G 0 7 5 2 o, irh t b XXX XG 1 o 0 o o EEE EA et r , 3 === == _- u) s o a v* 0 h j- in s53E0 si es e 51 r p s de e r a t c je , ) s f o6 C E r o n0 o0 eno 0. 0( b it2 t a( loi , 1 e i c Ht c . s i le e gF r a y' i R t r e r 0 r e p ae Lr ,5 u x o s f et C s od e e r s g _ P l t r _ o. u se a o e L - - - Ri 0 5 0 5 g 0 7 5 2 g
, 8 1 o 0 0 g B
e r
=oO iUg%3E5 u
ig F yO zC$O
Appendix B
..o
- Containment Sprays l
J 200 ton Crane 3
. .': .. W Recirc. Spray 8 ,-
I.,'- l1' i i
.: .' ..; y ?<
Manipulator
..' Steam ,, ,
?.
Generator Crane ... ~ Pressurizer
..:.. .=
R ~ p
~
.v 1
,.. ~
,. ,yr,-
k Q,
, ' ,.,;.; .. . u y;.
.' .- ,., , >:s
.., ,], l
,l. , .
s.'. m..m
,.g . .
,l .o *
, . ,. 1L '. .-
6., <
- C ..*
g - ,
. l m, )
- q
_94 .
*Cl a..
o
- i. ...
.h. ?, -
, Reactor .,*' R. C. 't t,
;. .. n.,
. i.., .
g.. :, Pump
. .. , , _ , , , ... . .. - . - , > . ,....-._,<..,.a.... - r
. ,. , -.e
- o.
~.-
(,. ... gg
..- Accumulator
?*l. ..
y.., .
. Reactor ,
- N Cavity .**' . . .
5;*
.- ./ ,- .., , .: ' . . .
. . . . ... .. .. 1
.. s .. .....a . ,.. . . . .... . c .... . . .. .. ... . . ......
.. . . . 4.... ;'.. . .
'M.*: >. ; ( *:::.y. Y. .*: K:d . . . . . . ., . . .
..;...&u,;.
- W. 9;.Mc.'?.**.i:V.$:.?..fi.'.?.V5?,.'?:ll......
... ...... Q..n..c.;. .'..... *
- R) .'l Figure B.9 Simplified section of Surry containment.
NUREG-1150 B-34
Appendix D dome is stronger than the cylinder. However, the way the rebar was placed at the top of the dome led Expert A to question whether the dome would be stronger than the cylinder at high stress levels. For the cylinder, the hoop stress can adequately be calculated by hand. In this manner, Expert A con-cluded that general yield of the rebar would occur at 119 psig, which agrees with the Stone & Webster analysis (Ref. B.26). This is the lowest pressure for which Expert A would expect to find any chance of failure; at this pressure the cylinder wall has moved out 2 inches. Expert A then calculated that 2 percent hoop strain corresponded to 150 psig, including the effects of strain hardening of the rebar. At this level of strain. he concluded that liner tear is certain at discontinuities such as those around penetrations and stihener plates. Further, concrete cracking at 2 percent general strain will have removed much of the liner support. At 2 percent strain, the cylinder wall has moved out 16 inches. In summary, Expert A concluded that the containment would fail between 120 and 150 psig and that the probability density of failure was uniform in that range. His median value was 135 psig. Expert B based his analysis on the Stone & Webster study of the Surry containment (Ref. B.26), Judies of other plants such as Indian Point 2 and 3 (Ref. B.25), Seabrook (Ref. B.27), and the test of the 1/6-scale model at Sandia (Ref. B.28). Expert B's hoop membrane stress analysis showed that there would be general yielding of the shell and rebar at 120 psig, and that rebar that just met the minimum requirements would fail at 144 psig. If all the rebar were of average strength, the rebar would fail at 166 psig. Based on the reference analyses and this information, Expert B placed his mediaa failure pressure at 120 psig and his upper bound at 165 psig. He placed his lower bound at 70 psig. Tnis took into account the possibility of faulty rebar joints or liner tears due to stress concentrations around openings. 1 i Expert C based his conclusions on an analysis of the mid-section of the cylindrical portion of the contain-ment. His study of the drawings and the results of other analyses led him to conclude that this was the weakest portion of the containment. His conclusions about the leak failure mode and liner tear are largely based on the 1/6-scale model test at Sandia (Ref. B.28). Once a liner tear has developed, it is difficult to see how it could be kept fromsexpanding with a continued increase in pressure. Expert C concluded that failure was most likely in the 135 to 147 psig range, and he placed 70 percent of his probability there. He placed 10 percent of his probability below 135 psig to allow for his uncertainty about the actual rebar properties. Expert D's analysis led him to conclude that a leak was certain to develop by 130 psig. At this pressure the rebar has yielded considerably and reached a strain of about 1 percent. He would expect leaks to develop due to dislocation at discontinuities (Ref. B.29). There is no possibility of a leak developing at pressures below 75 psig. This value was obtained by hoop membrane stress analysis assuming that the liner is at its yield stress of 35,000 psi. If the liner and the hoop reinforcement are both at their respective yield stress, which is 55,000 psi for the reinforcement and 35,000 psi for the liner, the pressure would be 110 psig. Expert D took 110 psig to be his median value for leaks. He noted that the specified minimum yield strength is 55,000 psi for the reinforcement and 35,000 psi for the liner. Expert D took the lower threshold for rupture to be 140 psig, which was determined by a local effects analysis of the discontinuity at ths basemat-cylinder junction (Ref. B.30). He expected that a crack would open at this junction for a substantial portion of the circumference. Although the crack might be very small, it would be long enough to depressurize the containment in less than 2 hours. He concluded that rupture was certain when the main reinforcement reaches its specified minimum ultimate strength. For the Surry containment, Expert D considered catastrophic rupture to be impossible. Figure B.10 shows the distributions of the four experts and the aggregate distribution for total cumulative failure probability. Experts A and C concluded that there is little or no chance of failure by 120 psig, while B-35 NUREG-1150
1 Appendix B ISSUE 2 - SURRY STATIC FAILURE PRESSURE CUMULATIVE FAILURE PROBABILITIES I 1.0 - - - - - - - 0.9 - 5
.)
0.8 - / l. 0.7 - k = '5 0.6 - .8 e O-0.5 - E = 0 3 0.4 - E s U o,3_ o = EXP. A o = EXP. B a = EXP. C 0.2 - V = EXP. D e = AGGR. 0.0 : ? : ;: r: : .,: , , , 60.0 80.0 100.0 12 0.0 14 0.0 16 0.0 18 0.0 200.0 PRESSURE (psig) Figure B.10 Results of expert elicitation for static failure pressure of Surry containment. (The first four curves are the distributions of the four experts, and the fifth curve is the aggregate distribution.) NUREG-1150 B-36
Appendix B Expert D concluded that failure is almost certain by 120 psig. Th e aggregate distribution for the failure pressure of the Surry containment was formed by weighting equally the individual distributions of the four l st uctural experts who considered this issue. j F om the information provided by the experts, aggregate distributions were also obtained for the mode of containment failure. Because the containment did not fail in this example, the question of the mode of failure is not discussed here. The results of the experts' elicitation on the mode of failure may be found in Refuence B.6, and the method used to determine the mode of faihire in the APET is discussed in References B.1 and B.S. l For use in Question 42, a value for the containment failure pressure is obtained from the aggregate distribution by a random sampling process. The value for the failure pressure in Observation 4 is 148.4 psig. This is the 93rd percentile value. The mean and the median failure pressures are around 127 psig. B.3.4 Binning Results of APE'l l There are so many paths through the APET the they cannot all be considered individually in the source i term analysis. The results of evaluating the APET are therefore condensed into accident progression bins (APBs or just bins). The computer code, EVNTRE, that evaluates the APET places the paths through the tree in the bins as it evaluates them. At Surry, each bin is defined by 11 characteristics of the path taken through the event tree. (For the summary discussions contained in Volume 1 of NUREG-1150, these detailed bin definitions were collapsed into a smaller set.) The bin definition provides sufficient informa-tion 'for the algorithm used in the source term calculation. The binning method provides the link between the accident progression analysis and the source term analysis, which calculates the fission product re-lease. The computer input file that contains the binning instructions is referred to as the "binner." It is listed and discussed in detail in ' Reference B.1. A discussion of the binning process may be found in the methodol-ogy discussion in Reference B.5. In computer files, the bin is represented as an unbroken string of 11 letters. For presentation here, hyphens have been inserted every three characters to make the bin more readable. A given letter in a given position has a definite meaning. For example, the first characteristic primarily concerns the time of containment failure. If the first chart 't in the bin designator is a "C", containment failure before VB is indicated. For PDS Group 3, Observation 4 produced 22 bins. These resulted from all the paths that remained above the cutoff probability (1.0E-7). For example, the alpha-mode probability was so low in Observation 4 that all the alpha-mode paths were truncated and there ate no bins with alpha-mode failures of the contain-ment. The most probable bin (0.55) in Observation 4 is HDC-CFC-DBD-FA, which has no VB and no containment failure. It results from offsite ac power recovery before the core degradation process had gone too far. Bin GFA-CAC-ABA-DA results from the path followed through the tree in this example for Observation
- 4. It is the most likely (0.017) bin for Observation 4, which has both VB and containment failure.
Basemat meltthrough occurred a day or more after the start of the accident. Containment failure in this tirne period is indicated by the character "G" in the first position. The other ten characteristics are de-fined in a similar manner. For bin GFA-CAC-ABA-DA, each character in the bin designation has the following meaning: G - Containment failure in the final period F - Sprays only in the Late and Very Late periods A - Prompt CCI, dry cavity C - Intermediate pressure in the RCS at VB A - High-pressure melt ejection (HPME) occurred at VB C - No steam generator tube rupture B-37 NUREG-1150
Appendix B A - A large fraction of the core was available for CCI B - A high fraction of the Ze was oxidized in-vessel A - High amount of core in HPME D - Basemat meltthrough A - One effective hole in the RCS after VB The binning follows directly from the path through the APET with one exception. At Question 53, the amount of core in CCI was determined to be medium (Branch 2). The binning above shows that the fraction of the core involved in the CCI is large. The reason for this is that the computer code that performs the source term analysis, SURSOR, subtract' the amount of the core involved in HPME from the total passed to it. To avoid subtracting this amount twice, whenever HPME occurs, the amount of the core invch'ed in CCI is set to Large in the Unter. It is common to keep more information in the binner than that actually used in the source term code. The reason is so that the results of the accident progression analysis can be examined in more detail. By reducing the amount of information passed on to the source term analysis in a "rebinning" step, the amount of source term calculation time can be reduced. Thus, the APBs from an evaluation of the APET by EVNTRE are processed or rebinned by a small computer program, PSTEVNT (Ref. B.31) before the source term analysis. I , SURSOR does not distinguish between the various after-VB containment failure times. So PSTEVNT l combiner, the "Very Late" and " Final" containment fa"ure times. The result is that the indicator for l failure in the Final period is changed from a "O" in the 1st character to an "F" Bin characteristics 2 j through 9 and characteristic 11 are unchanged by the processing with PSTEVNT. The other change is in j the 10th character. SURSOR treats BMT in the same manner as it treats a leak in the final period, so { Leak, "C", and BMT, "D", are combined and appear as "C". SURSOR also determines whether a bypass i of the containment has occurred directly from character 1 ("A" or "B" for Event V) and from character I 6 ("C" for no SOTR), so Bypass, "E", and NoCF, "F", are combined as "D"'in the Rebinner. (At one time BMT was considered separately from finalleaks in SURSOR; the releases ofinert gases and organic iodine from BMT were lower than those from a late leak. It turned out to be very difficult to determine, with any certainty at all, just how much lower than the final leak releases the BMT releases should be. As the BMT releases were not expected to be substantial contributors to risk, in the interest of l simplicity, the BMT releases were conservatively assumed to be equivalent to the final leak rdeases.) ' ' Thus the "rebinned" bin equivalent to GFA-CAC-ABA-DA is FFA-CAC-A3A-CA. The meaning of each rebinned character is: F - Containment failure in the Very Late or Final period F - Sprays only in the Late and Very Late periods A - Prompt CCI, dry cavity C - Intermediate pressure in the RCS at VB l A - HPME occurred at VB C - No steam generator tube rupture A - A larEe fraction of the core was available for CCI B - A high fraction of the Zr was oxidized in-vessel A - High amount of core in HPME C - Leak ur basemat meltthrough A - One effective hole in the RCS after VB As mentioned in the inuoductitm to this section, for Observation 4 the conditional probability of bin FFA-CAC-ABA-CA is 0.017 (given that PDS Group 3 has occurred) and the absolute frequency is 8.1E-9/ reactor year. For Observation 4 PDS Group 3 is not the only group to produce this bin when the APET is evaluated. Group 1, slow SBO, also produces this bin. For Observation 4, the frequency of NUREG-1150 B-38
i Appendix B PDS Group 1 is 9.3E-6/ reactor year, and the conditional probability of APB FFA-CAC-ABA-CA is t 2.6E-3, so the absolute frequency is 2.4E-8/ reactor year. In the source term calculation, there is no point in calculating a source term twice for FFA-CAC-ABA-CA for Observation 4. Therefore, the bins resulting from the seven PDS groups for internal initiators are combined to produce a master bin list for each observation, in producing the master bin list, FFA-CAC-ABA-CA from Group 3 is combined with FFA-CAC-ABA-CA from Group 1; the total frequency for FFA-CAC-ABA-CA is 3.2E-8/ reactor year for Observation 4. II.4 Source Term Analysis The source term is the information passed to the next analysis so that the offsite consequences can be calculated for each group of accident progression bins. The source term for a given bin consists of the release fractions for the nine radionuclides groups for the early release and for the late release, and addi-tional information about the timing of the releases, the energy associated with the releases, and the height of the releases. The source term analysis is performed by a relatively small computer ccde: SURSOR. The aim of this code is not to calculate the behavior of the fission products from their chemical and physical properties and the flow and temperature conditions in the reactor and the containment. Instead, the purpose is to represent the results of the more detailed codes that do consider these quantities. The release fractions are calculated in SURSOR using a limited number of factors. Many of these factors were considered by a panel of experts. Collectively, they provided distributions for these factors, and the value used in any particular observation is determined by a samphng process. The sampling process used is Latin hypercube i sampling (LHS) (Ref. B.32); it is a satihad Monte Carlo method imd is more efficient than straightfor- ) ward Monte Carlo sampling. The sixty radionuclides (also referred to as isotopes or fission products) considered in the consequence calculation are not dealt with individually in the source term calculation. Some different elements behave similarly enough both chemically and physically in the release path that they can be considered together. The sixty isotopes are placed in nine radionuclides classes as shown in Table B.4. It is these r'ine classes that are treated individually in the source term analysis. A more complete discussion of the source term analysis, and of SURSOR in particular, may be found in Reference B.33. The methods on which SURSOR j is based are presented in Reference B.5, and the source term issues considered by the expert panels are described more fully in Part IV of Reference B.6. The example being followed has led to accident progress, ion bin FFA-CAC-ABA-CA for OM vation 4. The total absolute frequency for this APB is 3.2E-8/ reactor year, which comes from PDS Group 1 and PDS Group 3. The path followed to this point came through PDS Group 3, Fast SBO. Table B.4 Isotopes in each radionuclides release class. Release Class Isotopes included
- 1. Inert Gases Kr-85, Kr-85M, Kr-87, Kr-88, Xe-133, Xe-135
- 2. h> dine I-131,1-132,1-133,1-134,I-135
- 3. Cesium Rb-86, Cs-134, Cs-136, Cs-137
- 4. Tellurium Sb-127, Sb-129, Te-127, Te-127M, Te-129, Te-129M, Te-131, Te-132
- 5. Strontium Sr-89, Sr-90, Sr-91, Sr-92
- 6. Ruthenium Co-58, Co-60, Mo-99, Tc-99M, Ru-103, Ru-105, Ru-106, Rh-105
- 7. 12nthanum Y-90, Y-91, Y-92, Y-93, Zr-95, Zr-97, Nb-95, La-140, La-141,12-142, '
Pr-143, Nd-147, Am-241, Cm-242, Cm-244 S. Cerium Ce-141, Ce-143, Cc-144, Np-239, Pu-238, Pu-239, Pu-240, Pu-241
- 9. Barium Ba-139, Ba-140 B-39 NUREG-1150
Appendix B B.4.1 Equation for Release Fraction for Iodine in this example (,i a complete calculation, only the computation of the release fraction for iodine will be presented in detail. The releases of the other fission products are calculated in an analogous fashion. The total release is calculated in two parts as if the containment failed before, at, or a few tens of minutes after vessel breach. The early release occurs before, at, or within a few tens of minutes of vessel breach. The late release occurs more than a few tens of minutes, typically several hours, after vessel breach. In gen-eral, the early release is due to fission products that escape from the fuel while the core is stillin the RCS, i.e., before vessel breach, and is often referred to as the RCS release. The late release is largely due to fission products that esc:pe from the fuel during the CCI, i.e., after VB, and is referred to as the CCI release. For situatiors snere the containment fails many hours after vessel breach, the "early" release equation is still used, but the release is better termed the RCS release, and after both releases are calcu-lated in SURSOR. both releases are combined into the late release and the "early" release is set to zero. The " late" releaw includes not only fission products released from the core during CCI, but also material released from the fuel before VB which deposits in the RCS or the containment and then is revolatilized after VB. The early or RCS iodine release is calculated from the following equation: j l ST = [FCOR
- FVES
- FCONV / DFE] + DST.
And the late or CCI iodine release is calculated from: ! STL = [(1-FCOR)
- FPART
- FCCI
- FCONC / DFL) + FLATE + LATEL i
In these equations, some terms that pertain only to SGTRs have been omitted since bin FFA-CAC-ABA-CA has no SGTR. The meaning of the terms is as follows: ST = fraction of the core iodine in the RCS release to the environment; FCOR = fraction of the iodine in the core released to the vessel before VB; FVES = fraction of the iodine released to the vessel that is subsequently released to the containment; FCONV = fraction of the iodine in the containment from the RCS release that is released from the containment in the absence of any mitigating effects; DFE = decontamination factor for RCS releases (sprays, etc.); DST = fraction of core iodine released to the environment due to direct containment ac"'Mg at vessel breach; STL = fraction of the core iodine in the late release to the environment; FPART = fraction of the core that participates in the CCI: FCCI = fraction of the iodine from CCI released to the containment; FCONC = fraction of the iodine in the containment from the CCI release that is released from the : containment in the absence of any mitigating effects; DFL = decontamination factor for late releases (sprays, etc.); FLATE = fraction of core iodine remaining in the RCS that is revolatilized and released late in the accident; and LATE! = fraction of core iodine remaining in the containment that is converted to volatile forms and l released late in the accident. NUREG-1150 B-40
1 Appendix B Like ST and STL, DST, FLATE, and LATEI are expressed as fractions of the initial core inventory. DST, FLATE, and LATEI are not independent of the other factors in the equations given above. Com- j plete expressions for these three terms and an expanded discussion of them may be found in Reference j B.18. Some of these factors are determined directly by sampling from distributions provided by the expert panels. Others are derived from such values, and still others were determined internally. In Section B.4.2, each factor in the equation above will be discussed briefly, and the source of the value used for cach factor will be given. In Section B.4.3, three of the factors are discussed in more detail. For Observation 4, the following values were used in the equation for the RCS iodine release for bin FFA-CAC-ABA-CA: FCOR = 0.98 FCONV = 1.0E-6 DST = 0.0 FVES = 0.86 DFE = 34.0 resulting in ST = 2.5E-8. ST is a very small fraction of the original core inventory of iodine because the containment failure takes place many hours after VB and there is a long time for natural and engineered removal process to oper-ate. For Observation 4, the following values were used in the equation for the late o1 CCI iodine release for bin i FFA-CAC-ABA-CA: 1 I 1CCOR = 0.02 FCCI = 1.0 DFL = 82.2 LATEI = 0.0044 FPART = 0.57 FCONC = 1.2E-4 FLATE = 7.2E-9 ; resulting in STL = 0.0044 Containment tailure occurs a long time after most of the radionuclides have been released from the fuel during CCI, so there is a long period in which the aerosol removal processes operate. Thus, the CCI release of iodine in nonvolatile form is very small, and the totallate iodine release is almost all due to the late formation of vc!atile iodine in the containment. l B.4.2 Discussion on Source Term Factors As most of the parameters in the source term equations were determined by sampling from distributions provided by a panel of experts, Part VI of Reference B.6 is not cited for each of parameters. The parame-ters not determined by expert panels are discussed in References B.1, B.6, and B.33. The values for many of the parameters defined above are obtained from distributions when SURSOR is evaluated, most of which were provided by experts. They determined distributions for the nine radionu-clide release classes defined in Table B.4. Only the distributions for iodine (class 2) are discussed here, but distributions exist for the other eight classes as well (Ref B.6). These distributions are not necessarily B-41 NUREG-1150
Appendix B discrete. While the experts provided separate distributions for all nine classes for FCOR, for other factors, for example, they stated that classes 5 through 9 should be considered together as an aerosol class. Note that the distributions for the nine radionuclides classes are assumed to be completely correlated. That is, a single LHS number is obtained for each factor in the source term equation, and it applies to the distribu-
.tions for all nine radionuclides classes. For example, in Observation 4 the LHS number for FCOR is 0.828.
That means the 82.8th percentile value is chosen from the iodine distribution, the cesium distribution, the tellurium distribution, etc., for FCOR. l FCOR is tht; fraction of the fission products released from the core to the vessel before vessel failure. The value used in each observation is obtained c'.irectly from the experts' aggregate distribution. There are separate distributions for each fission product group (inert gases, iodine, cesium, etc.) for high and low Zr oxidation in-vessel. Each distribution takes the form of a curve that relates the values of FCOR to a cumulative probability. A value of FCOR is obtained in the following manner: the LHS program (Ref. B.32) selects a number between 0.0 and 1.0 that is the cumulative probability. Using this value, the value of FCOR is obtained from the experts' aggregate cumulative probability distribution. The LHS number in Observation 4 for FCOR is 0.828, and the corresponding FCOR value for iodine is 0.98. For Observation 4, then, almost all the iodine is released from the core to the vessel before breach. FCOR is discussed in more detail in Section B.4.3. FVES is the fraction of the fission products released to the vessel that is subsequently released to the containment before or at vessel failure. As for FCOR, the value used in each observation is obtained directly from the experts' aggregate distribution, and there are separate distributions for each fission prod-uct group. The LHS number from LHS in Observation 4 for FVES is 0.931. The corresponding value in the experts' aggregate distribution for FVES for iodine is 0.86. So, in this example, most of the iodine in the vessel before breach is released from the vessel to the containment. FCONV is the fraction of the fission products in the containment from the RCS release that is released from the containment in the absence of mitigating factors such as sprays. The expert panel provided distributions fo FCONV for four casts, each of which applies to all species except the noble Eases. These cases apply to containment failure at or before VB, or within a few hours of VB. (There is a fifth distribu- ' tion that applies to Event V.) None of these distributions is used in the path followed for this example since containment failure happens a day or more after the start of the accident. Because of the long time period for the engineered and natural removal processes to reduce the concentration of the fission prod-ucts in the containment atmosphere, the fraction of the fission products released before or at VB remain-l ing airborne at the time of containment failure is very small. This fraction was estimated internally to be 1.0E-6, and FCONV is set to that value for final period releases. (The value of 1.0E-6 is not important; any very small value would be satisfactory.) This value is used whether the release is due to above-ground failure or basemat meltthrough. FCONV is discussed in more detail in Section B.4.3. DFE is the decontamination factor for early releases. For APB FFA-CAC-ABA-CA, the containment sprays are the only mechanisms that contribute to DFE. The expert panel concluded that the distributions l used for the spray decontamination factors (DFs) were less important to determining offsite risk and the I uncertainty in risk than whether the sprays were operating and other factors, so the spray DF distributions l were determined intemally. There are two spray distributions that apply to the fission products released from the RCS before or at VB: the first applies when the containment f&ils before or at VB and the RCS is at high pressure at VB; and the second applies when the containment fails after VB or when the contain-ment fails at VB but the RCS is at low pressure. Each distribution applies to all species except the noble gases. The LHS number for the spray distribution for Observation 4 was 0.928. Using the distribution for late containment failure, a spray DF value of 3.4 is obtained. For failures of the containment in the final period, the value from the distribution is multiplied by 10 to account for the very long period that the j sprays have to wash particulate material out of the containment atmosphere. Thus DFE is increased from i 3.4 to 34 1 DST is the fission product release (in fraction of the original core inventory) from the fine core debris particles that are rapidly spread throughout the containment in a direct containment heating (DCH) event at VB. The experts provided distributions for the fractions of the fission products that are released from 1 NUREG-1150 B-42
1 4 Appendix B j l the portion of the core involved in DCH for VB at high pressure (1,000 to 2,500 psia) and for VB at ! i intermediate pressure (200 to 1,000 psia). There are separate distributions for each fission product group (inert gases, iodine, cesium, etc.). However, neither the high-pressure nor the low-pressure set of distribu-tions was used in calculating the source term for FFA-CAC-ABA-CA because the containment failure occurs so long after VB. It was internally estimated that the amount of fission products from DCH remain-ing in the atmosphere many hours after VB would be negligible, so DST is set to zero for this APB. q FPART is the fraction of the core that participates in the CCI. Bin FFA-CAC-ABA-CA has a "large" fraction, nominally 40 percent, of the core participating in HPME. As 5 percent of the core is estimated to remain in the vessel indefinitely, the fraction participating in DCH is 0.95 ' O.40 = 0.38. The fraction of the core available to participate in CCI is thus 0.95 - 0.38 = 0.57. FCCI is the fraction of the fission products present in the core material at the stan of CCI that are released to the containment during CCI. The experts provided distributions for four cases that depended upon the fraction of the Zr cxidized in vessel and the presence or absence of water over the core debris during CCI. There are separate distributions for each fission product group. For the path being followed in this example, bin FFA-CAC-ABA-CA indicates that a large fraction of the Zr was oxidized in-vessel before VB, and that the cavity was dry at the start of CCI. However, for iodine, the case is immaterial since all the iodine remaining in the core debris is released during CCI for any case and for every point on the distribution. Thus, FCCI is 1.0. FCONC is the fraction of the fission products released to the containment from the CCI that is released from the containment. The expert panel provided distributions for FCONC for five cases. There are separate distributions for each fission product group (inert gases, iodine, cesium, etc.). None of these cases applies directly to the situation for APB FFA-CAC-ABA-CA since this bin has containment failure in the final period (after 24 hours). Since containment failure occurs many hours after most of the fission products have been released from CCI, only a very small fraction of these fission products will still be in the containment atmosphere at the time of containment failure. This fraction was estimated internally to l' be on the order of 1.0E-4. The exact value is determined by using the FCONC distribution for case 3, rupture before the onset of CCI. The ratio of the LHS value from the distribution to the median value times 1.0E-4 is the value of FCONC used for final period containment failure. In Observation 4, the LHS number for determining FCONC is 0.777. The iodine value of FCONC for this point on the FCONC, case 3, for the CDP is 0.78, and for the median value of the distribution is 0.63. Thus, FCONC is set to 0.78/0.63
- 1.0E-4 = 1.2E-4. This value is used whether the release is due to above-ground failure or basemat meltthrough.
DFL is the decontamination factor for late releases. At Surry, DFL can be due to either the containment sprays or a pool of water over the core debris during CCI. Since the CCI began in a dry cavity, only the spray DF applies for bin FFA-CAC-ABA-CA. The procedure used to obtain the spray DF for the CCI release for final period CF is similar to that used to obtain the value for DFE (discussed above). There is only one distribution for the spray DF for the CCI release, and it applies to all species except the noble gases. The same LHS number (0.928) is used for all the spray distributions, giving a CCI spray DF value ] of 8.2. As for DFE, because the containment fails in the final period, the value from the distribution is multiplied by 10 to account for the very long time the sprays have to wash particulate material out of the containment atmosphere. Thus, DFL is 82. FLATE accounts for the release of iodine from the RCS late in the accident. Like DST, it is a fraction of g j the original core inventory. Iodine that had been deposited in the RCS before VB may revert to a volatile form after the vessel fails and make its way to the environment. This term considers only revolatilization ~ from the RCS; revolatilization from the containment is considered in the next term. The experts provided l distributions for the fraction of the radionuclides remaining in the RCS that are revolatilized. The amount remaining in the RCS is a function of FCOR, FVES, and other terms and is calculated in SURSOR (Ref. B.33). The experts concluded that whether there was effective natural circulation through the vessel was J important in determining the amount of revolatilization. Thus, there are two cases: one large hole in the RCS, and two large holes in the RCS. B-43 NUREG-1150 E .
Appendin B The experts provided separate distributions only for iodine, cesium, and tellurium. (Revolatilization is not possible for the inert gases as they would not deposit, and it is negligible for radionuclides classes 5 through 9.) For accident progression bin FFA-CAC-ABA-CA, the last qharacter indicates that there is only one effective hole in the RCS: the hole formed in the bottom head when the vessel failed. The other failure of the RCS pressure boundary is the RCP seals, and the path through them is considered too tortuous to allow effective natural circulation to develop. The LHS number for late revolatilization of Observation 4 is 0.412, and the corresponding value for iodine from the experts' distribution for iodine is 0.033. This number is applied to the fraction of the iodine remaining in the RCS, which is small, and then the FCONC value for tellurium is applied to that value to determine how much of the iodine that is revolatilized from the RCS escapes from the containment. (The Te value for FCONC is considered to be generally appropri-ate for revolatilized material since it, like Te, is slowly released over a long time period.) The resulting value for revolatilized iodine that escapes from the containment is very low, 7.2E-9. LATEI accounts for iodine in the containment that may assume a volatile form and be released late in the accident. The volatile forms are typically organic iodides such as methyl iodide, but are not limited to organic forms. The primary source of this iodine is the water in the reactor cavity and the containment sumps (which are separate at Surry). This term is added to the late release only for radionuclides class 2, : iodine. The experts provided only one distribution. The LHS number for late revolatilization in Observa-l tion 4 is 0.055, and the corresponding value for iodine from the experts' distribution is 0.0051. This l number is applied to the fraction of the iodine remaining in the containment. Based on the values of I FCOR, FVES, FCCI. and other factors, the fraction of the original core iodine still in the containment and available to assume a volatile form was determined to be 85 percent for Observation 4. Applying the release fraction obtained from the experts' distribution to this gives a late revolatilization iodine selease fraction of 0.0044. LATEI is discussed in more detail and the expression used to calculate it is given in Section B.4.3. While the totaliodine release is small compared to a case where the containment fails at VB or is bypassed from the start (such as Event V), the iodine release is very large compared to the other radionuclides classes except inert gases (see Section B.4.4). This relatively large release fraction for iodine is entirely due to the LATEI term. Even though the release point for basemat meltthrough is underground, no allowance is made for attenuation or decontamination of the late iodine release represented by the LATEI term. For the example considered, the very slow passage of the gases through wet soil with a low driving pressure would undoubtedly result in some reduction in the late iodine release. This reduction could be quite large. Although giving no credit for removalin the wet soilis conservative, it is unimportant for the sample as a whole. Other observations and other modes of containment failure dominate risk. For the mode of containment failure in this example, basemat meltthrough, however, the release of late organic iodine is a major contributor to risk, and the risk from this release may be overestimated by the neglect of iodine removal in the wet soil. Even with this conservative estimate of the late iodine release, the total iodine release and the risk therefrom are very small compared to the releases and risks from accidents and pathways in which the containment fails at or before vessel breach, or where the containment is bypassed. It could be argued that since BMT is so much more likely than early CF, overstating the BMT release results in a significant overestimate of the population dose and latent cancer fatality estimates. However, bypass accidents (V or SGTR) are twice as likely at Surry as nonbypass accidents that lead to BMT. As the iodine releases from the bypass accidents are more than an order of magnitude higher than BMT iodine releases, this argument is not valid. B.4.3 Quantification of Scurce Term Factors by Experts In this section, the quantification of three factors in the source term equation that were considered by the expert panelis presented in more detail. The eight issues considered by the source term expert panel are:
- 1. FCOR and FVES
- 2. Ice Condenser DF (not applicable to Surry)
- 3. FLATE NUREG-1150 B-44
Appendix B
- 4. FCCI
- 5. FCONV and FCONC
- 6. LATEI (not used for PWRs)
- 7. Reactor Building DF (not applicable to PWRs) l
- 8. DCH Releases (DST)
Three of these issues are not applicable to Surry. Of the eight factors in the iodine equation for Surry, only three can be discussed here because of space limitations. More extensive documentation of all the issues may be found in Part IV of Reference B.6. The source term factors chosen for discussion here are FCOR, FCONV, and 1 ATEI. The consideration for FVES is similar to that for FCOR, only there are more cases. The consideration for FCONC is similar to that for FCONV, except that the experts provided a distribu-tion for each fission product group for FCONC and they did not for FCONV. Of the remaining factors, LATEI made the largest contribution to the iodine example considered above. B.4. 3.1 FCOR FCOR is the fraction of the fission products released from the core to the vessel before vessel failure. Four members of the source term expert panel provided distributions for FCOR: Peter Bieniarz, Risk Management Associates, Robert Henry, Fauske and Associates, Inc., Thomas Kress, Oak Ridge National Laboratory, and Dana Powen, Sandia National Laboratories. Two of these four experts concluded that there were no significant differences between PWRs and BWRs as far as FCOR was concerned, and each provided one distribution that applied to both types of reactors. The other two experts provided separate PWR and BWR distributions and further subdivided this issue by providing different distributions for high Zr oxidation in-vessel and low Zr oxidation in-vessel. Expert A based his analysis for FCOR upon the experimental work done on the release of fission products from fuel (Refs. B.34 and B.35). He concluded that the results for cesium could be well represented by an equation similar to the diffusion equation and that the constants in the solution 'could be (enrmined from the data. He obtained release rates for the other fission products by considering their " relative volatili-ties." The resuhs of applying this method of calculating release rates appeared to him to agree reasonably well with experiments. Expert A then wrote a simple computer program to vary the temperature rise with time over a range of reasonable scenarios and keep track of the amount of each fission product released. Expert A provided FCOR distributions for both high and low Zr oxidation in-vessel for both types of reactors. Expert B based his conclusions for FCOR on a large nt;mber of MAAP (Ref. B.15) runs for various accident scenarios. He also relied on Reference B.36 and the evidence from TMI-2 (Refs. B.37 and - B.38). The MAAP results served as the basis for his conclusions, but he included uncertainty for phenom-ena not modeled in MAAP and phenomena that MAAP currently does not treat in sufficient detail. For example, Expert B thought that MAAP sometimes overestimated the releases of certain nuclide groups because the process of core collapse imposes physical limitations on other processes that MAAP does not ' consider adequately at this time. He also concluded that neither the reactor type nor the amount of Zr oxidation in core had a significant effect on FCOR, so he provided a single distribution for FCOR. Expert C reasoned that even if the dependency of the fission product release rates on temperature were much better known, the release rates, and thus FCOR, could not be much better predicted because the variations of the temperatures in ti.e core by time and location are so crudely known at this time, espe-cially after the onset of relocation. The extent of metal oxidation is also n significant uncertainty. l l B-45 NUREG-1150
Appendix B Relocation not only changes the surface-to-volume ratio, but it alters the hydrogen-steam ratio, which in turn affects the diffusion and transport rates of the fission products. Thus the current models, which largely depend upon Arrhenius-type equations, have definite limitations. For example, the STCP (Ref. B.39) tends to overpredict FCOR because it poorly treats the formation of eutectics and the gradual relocation of the. core. Expert C provided separate FCOR distributions for.high and low Zr oxidation in-vessel for both types of reactors. Expert D did not consider the amount of Zr oxidation in-vessel or the type of reactor to be important for L FCOR; he provided one distribution for FCOR. Expert D was of the opinion that all the noble or inert gases (Xe and Kr) would escape from the fuel. For tellurium, he concluded that the data were so ambigu-ous and conflicting that he could not support any particular distribution. He thus specified that a uniform distribution between zero and one be used. For the other seven radionuclides groups, he provided non-uniform distributions. His conclusions were based on a great deal of experimental work that he has per-formed or of which he had knowledge (Refs. B.40 and B.41). He made use of several small computer - programs to manipulate the experimental results to obtain release fractions for different pressures and ; temperatures. > The aggregate distributions for the two PWR cases are shown in Figurer, B.11 and B.12, as are the distri- ; butions of each of the four experts who considered this issue. The estimated fraction released depends j strongly on the volatility of the fission products, as might be expected. The differences between I and Cs ' are not great. The differences between the less volatile fission products Ba, Sr. Ru, La,' and Ce, are small.= Note that the differences between the high-Zr-oxidation case and the low-Zr-oxidation case are small compared to the differences between the experts. Furthermore, the differences between the radionuclides classes are often less than the differences between the experts for a given class. This is indicative of the uncertainty in the source term area. B.4.3.2 FCONV This issue concerns the fraction of radionuclides released to the containment atmosphere from the vessel before it fails or at failure that is subsequently releastd to the environment if the containment fails. FCONV may be defined by the equation: FCONV = mVout/mVin, where: mVin = mass (kg) of a radionuclides (or radionuclides class) released from the vessel to the contain-ment atmosphere at or before vessel breach (VB); and mVout = mass (kg) of a radionuclides (or radionuclides group) released from the vessel to the contain-ment atmosphere at or before VB that is subsequently released from containment. That is, FCONV is the fraction of mVin that is released to the environment when the containment fails. Three cases were defined for FCONV for the large, dry PWR cont inments:
- 1. Early containment failure, leak
- 2. Early containment failure, rupture
- 3. Late containment failure, rupture Early containment failure means at or before vessel breach, and " late" means at least 3.5 h and nominally 6 h after VB, A " leak" is a failure of the containment that results in leakage significantly larger than design leakage, but is small enough so that the containment does not depressurize in less than 2 h. The nominalleak is a hole with an area of 0.1 fta. A "supture" is a containment failure ' sufficient to depres-surize the containment in less than 2 h; the nominal hole size is 7 ftr. The releases from late leaks were deemed to be low enough that the value of FCONV for late leaks could be derived from these three cases without significantly affecting risk.
NUREG-ll50 B-46
ill) d 9x e di r ABCD
- l c o u 0 uf
}
PPPP. . . . n 1 ots XXXX ir di f EEEE a r e
==== eh ooav* nt i ,
o 5 nt o B ,0 el 0 hp t 1 h r c f oae 1p 0 l L en n 0 I j' sI
~ <
l 1 0 s e . 5 0 e Cj 5 i o 1 0 0 0
,0 vle os) s t t e .
a vn 1 eo r ni oit d i 0 c db u x r '
, l t 0 mei ztr O 1 oi s l
- - l i o 5 0 5 0 frdi T ,0 1 0 idx 0 15 doe r
- e ssa t Z 0 ai g e rer h )e t -
0
- 0 l
eZ r e g a g g y a - ' 0 ,1 0 t s r coe i b n 0 5 0 a uch t H )a i dr 1 0 0 0 L 5 deo s (o
, 1 ,0 rh p t s
i
- i s 0 nov f e r
c y 0 o inu 1 s t i - 0 s s oc
- b l i
t l 0 ii f th (o baC s l1 i : ct l 5 R. ,0 1 0 5 0 0 hf eai rf f n b 0 W P i t o P o r 3 0 t fho gh i e t c - nhd a e o a na e Fr v i00 . 2 it cn, s i t 0
,0 aes rht a e s l a
u 1 5 0 0 0 R u f
,wer C a e m 0
1 1 0 Rs p Olt ex le u Cs u e
- R C 0
Feh r r t 1 o ef R 3 ' l 0
, 1l 4 ' fho t 5 0 n s O I
,0 1 0
5 0 0 o sn iwo C ~ l 0 1 t oi a thu t F ' i c sb iei r l ert 0 uis t e 0 rigd
- ef 0 5 0 r 5 ps e 1
0 0 S 0 xih 0 eht f(r Te 3( 1 o.a sss l t pe _. 0 uuv s or I H I
]
l l t 0 e ru R gc e l l 5 0 5 0 X ,0 1 0 0 1 - 1 E e r 0 u 0 ig 0 5 F 0 1 0 0
?t 2c
. ih
- !1[lll ,
&12*
ss in h o ABCD . Ti (t l 0 1
....R PPPP G sb.u XXXXG pr i EEEEA uts oi
===== rd g
e ooav* eh o 5 dt icre B ,0 l 0 ua 1 ns oe iv dr 0 ' ; au r c n I i e r I 0 H I 1 nu i o 0 1 5 0 0 0 0 C e- 5 0 ionf et t hs a 1 ti r f r d oe i fh l t x , '
, (
i . 0 0 e st so O T e ,0 5 0 1
. l '
5 0
,1 t '
0 el vp 0 15 oh r
- t c ea Z - 0 re co n w )e t
0
- 0 ml I
o
'. ,1 y a - i 0
0 oe rs L b i n 0 1 5 0 a f s e 0 dv
)a dr i P 0
0 L
,0 5 e-sn
- s (o 1 _
ai - s 0 l ed i ee 2 c y 0 rzi s t i ; ' 0 ts d ).
- b l i
l i i i 0 cinx l u oi o (o baC s
- l
, J 1 5
R ,0 0 1 5 0 0 d osiu t n 0 3 W b r pri b - o o r 0 n Zrts P i t c P - : oei rd a e 0 iso e F r v 0
- 2 is ce f t s i t 0
,0 f ea oht ge a e s lu a 1 5
0 0 0 R u nf rg C a e m 0 1
,0 1 ioog t
c na ai o e u l
- e : frth ct R C 0 Rrfi
,a s
R , 5 0 m ' 3 ! 0 Owe Co vr O I
,0 1 5
0 0 0 Fl racu C F
- i 0 1
fo et nh nhi f 0 itowfe 0 t a lth s
- t 0 5 0 iuc r 5 i sd e
1 0 0 S ,0 le r n re a
> 0 t 1 1 e h s, pt t xs r 0
ewpe f o x oh e p i ' 0 4 s s l i ! 5 X e 0 5 0 l t ee
,0 1 O 0 urh sut e gf Rfio 2
1 _0 B 0 0 5 0 e r 1 0 0 u ig F z2m?5 g
Appendix B FCONV is defined to be the release fraction from containment excluding the effects of engineered safety features such as containment sprays. One expert, however, concluded that one of the principal removal mechanisms, aerosol agglomeration, depended upon the humidity of the atmosphere for case 1. While the humidity may depend on whether the sprays are operating, aerosol removal from the atmosphere by the sprays is considered separately. Five members of the source term panel considered FCONV: Andrzej Drozd, Stone and Webster, James Gieseke, Battelle Columbus Division, Thomas Kress, Oak Ridge National Laboratory, , Y. H. (Ben) Liu, University of Minnesota, and David Williams, Sandia National Laboratory. They all concluded that the inert gases would be completely released and that all the other radionuclides would behave as aerosols. Thus, their distributions for FCO'NV apply to fission product classes 2 through 9. Expert A obtained his estimates of the event timing and, thus, residence times from References B.42 and B.43. Expert A concluded that the most important factor in determining FCONV was the residence time of the aerosols in the containment; the longer the time between the formation of the aerosols and the failure of the containment, the smaller the release. Because of the opposing effects of the dynamic shape factor on coagulation and settling, the uncertainty in the dynamic shape factor has little effect on the fraction released. Expert A did not distinguish between the volatile fission products and the refractory groups because he concluded that a significant fraction of the volatiles are released from the fuel prior to VB and deposit on the surfaces of the reactor coolant system. The refractory fission products are released from the fuel at a slower rate and a significant fraction are released after VB and have a direct pathway to the containment. Thus both the volatile and nonvolatile species have similar reinse rates during the times of interest. He also stated that the aerosol concentration in the containment dropped dramatically in 1 to 2 h and did not change much after that. The atmospheric humidity has little effect; high humidity makes particles more compact. The compact particles settle out faster, but do not agglomerate as fast. ' l Expert B used NAUA (Ref. B.44) calculations done in conjunction with STCP calcu?ations (Refs. B.42, B.43, and B.45) as a basis for his results, obtaining values directly from NAUA computer output as well as from published reports. For practical considerations, only Xe, I, Cs, and Te were considered for FCONV, and these were deemed to be applicable to all the fission product groups. Other sources consulted by Expert B are the BNL uncertainty study (Ref. B,46), an Electric Power Research Institute (EPRI) calcula- , tion for Peach Bottom (Ref. B.47), the recent CONTAIN calculations (Refs. B.20 through B.23), the ' j MELCOR analysis of Peach Bottom (Ref. B.48), and other MELCOR calculations (Refs B.49 and B.50). Expert B intended his distributions to include uncertainties from:
- 1. Surface area (deposition area or compartment height)
- 2. Natural circulation l 3. Hygroscopic nature of aerosols (primarily I and Cs groups) l l 4. Particle shape factors (not a big effect)
- 5. H 2 burn
- 6. Residence time Expert C examined the available code calculations relevant to aerosol and fission product behavior in, and release from, the containment, in most cases, these calculations were performed with the STCP (Ref.
3-49 NUREG-1150 l I
Appendix B B.39) or CONTAIN (Ref B.14) codes. He developed base distributions for FCONV from the code re-suits, and then modified them for the effects of factors not considered by the codes. The scale factors applied to the base distributions took into account factors such as aerosol agglomeration, aerosol source strength, timing, shape factors, and containment volume. Finally, Expert C modified the resulting distributions if they were greatly different from his intuitive expec-tations. Expert D considered calculations performed in the GREST exercise (Ref. B.51), by Sandia with MEL-COR (Ref. B.48), and by the ANS (Ref. B.52). He concluded that the factors affecting the value of FCONV include: Aerosol Characteristics (shape factors, distribution, density); Residence time (size and time of containment failure); Whether the containment was open or divided into many compartments; The effective height of the containment; Thermodynamic state of the atmosphere (superheated or condensing); and Hygroscopic nature of the aerosols. Expert D noted that the ANS parametric study showed a decrease in aerosol concentration by a factor of 10 in 2 hours and that both the ANS parametric study and KfK DEMONA experirnents (Ref. B.53) showed that the existence of many compartments in the containment reduced the release by about a factor of 1.6. Expert D pointed out that the LACE experiments (Ref. B.54) show that if the hygroscopic effect is present, it can be dominant. A hydrogen burn, by decreasing the residence time and reducing the condensation in the atmosphere can increase the release fraction FCONV by a factor of two.
]
Expert E used an EPRl/FAI aerosol behavior algorithm (Ref. B.55) to perform an independent uncer-tainty analysis for this issue. He directly varied the aerosol source rates and the aerosol form factors (gamma and chi). To study the impact of the timing and mode of containment failure, he varied the containment failure time and leak rates, assuming choked flowthrough holes from 0.1 ft 2 to 7 ft 2. He also considered preexisting leakage, steam condensation onto walls, and the impact of pool flashing in his calculations. Expert E assumed that the aerosols were released directly from the reactor vessel and obtained his aerosol I form factors from the QUASAR (Ref. B.46) and QUEST (Ref. B.56) studies. He concluded that the timing and mode of containment failure is the major source of uncertainty. Because it affects agglomera-tion, the level of turbulence in containment is also an important uncertainty. The distributions of the five experts who considered this issue are shown in Figure B.13. Case 1 is divided into wet and dry subcases because one of the experts concluded that the release fraction depended on the humidity for this case. The differences between the wet and dry atmosphere subcases are small compared with the differences between the experts, so this distinction was dropped. The aggregate distributions are also shown on Figure B.13. The differences between the experts are large compared to the differences between cases 1 and 2. As explained in the discussion of FCONV in Section B.4.2, none of these four distributions was used for bin FFA-CAC-ABA-CA since the containment failure time was so late. B.4.3.3 LATEI The question of interest for this issue is how much of the iodine in the containment late in the accident assumes a volatile form (typically organic) and is released to the environment. This volatile iodine is assumed to be unaffected by all removal mechanisms (pool scrubbing, sprays, deposition, etc.). The NUREG-1150 B-50
Appendix B c v E
<cn O o w g 8 didddo %
Ubbbb ~W 11 il 11 ll Il 11 g o o s e 8# d 2,6 -0se o g1 0 v. g 4-
- o. . .!c %
s$' oEI
. s d
E 2a ~d R %0 s ts w 3k 3 SO
& No x- > Eg TE L S >Z R ' ~$ 2 E m OE 'o 8 .3I l o
N m '~ UP l .c - , i ac E i E3 IE 30
* ~y o
I- l 3 'd 0 2.c P Mo M' A,.
'5 ,o 's o l$
3 :o x o s .a I , , , z .o i
) to yc 0
s
$ $ b O o $ $ $ o O J o o o o - o o o o gt hE go Aill!9090Jd 8^!4c;nwn3 44111go qoad eAlloin w n3 "U
bvC Eb CO 1 Es C2
.se-o o UE 9 o Se
- i -
i i I b.. . .c,
. O N' R e 2'l R 85
-g g 2 d tE SE & SU x2 x cE T ' O> Z x E >Z SC [ +C fO T fO $y 3hC b O O SC l D . no
- in UE 3y .. D O
.D kJ MO - 11D XS U ~
w $% h jo o Eg 5 a '
;9 l no 9 V
-O i i 6 6 i 6
$c o
D o
- o o o - o o o m 9
Alli!9090Jd eAj}DjnWn3 djl((qDqOJd eAj{DlnWO3 Im a iE B-51 NUREG-1150
Appendix B release fraction determined in this issue applies to almost all the iodine released from the fuel and re-tained in the containment. The bulk of this iodine is expected to be in aqueous solution, so the issue was specifically framed as release from water pools. The late release of volatile iodine was deemed to be much more important for BWRs than for PWRs because the BWR design often results in most of the iodine released during core degradation being trans-ported to and retained in the suppression pool. Therefore, the panel of experts was asked only about BWRs directly. They were asked to consider the release of volatile iodine from a BWR suppression pool following containment failure and from water in the pedestal region beneath the reactor pressure vessel (RPV) pedestal during CCL For the release of volatile iodine from the suppression pool after the containment has failed, two cases were defined: (1) the pool remains subcooled, and (2) the poolis at the saturation temperature. In case 1, considerable surface evaporation is expected but no bulk boiling. In case 2, substantial flashing of the pool would accompany containment failure. For the release of volatile iodine from water that over"es the core debris in the RPV pedestal. there are also two cases: (1) the drywellis flooded at the time of VB and the entire CCI takes place beneath a pool at least a few feet deep; and (2) the RPV pedestal area contains sors water at the time of VB but most of , this water is boiled away during CCL I The results of the expert elicitation on this issue are contained in detailin Part IV of Reference B.6. They are not summcrized here because the source term calculation for Surry did not use the results of any of the BWR cases. The PWR situation is somewhat different since the bulk of the iodine is expected to be contained in sohtion in the sump water. The sump water does not play the same role in heat removal that I the suppression pool does in the BWR, and the sump water at Surry is separate from the water.in the J reactor cavity. Thus none of the bWR cases is directly applicable, although the subcooled suppression 1 pool case is the most applicable. Instead of using this BWR case, the distribution obtained specifically for ) PWRs in the draft report was used. This is discussed further in Part VI of Reference B.6. 1 The equation used to calculate the late release of iodine in volatile form is: LATEI = XLATE * [{FCOR
- FVES + (1 - FCOR) FPART
- FCCI) - ST - STL + FLATE]
where XLATE is the fraction of the iodine in the contai ament late in the accident that issumes a volatile form and is released to the environment. The other terrr i have been defmed above. The term in [ ] is the fraction of the faitial core inventory that is in the conts inment at late times. FCOR
- FVES is the RCS release to the containment, and ST is the RCS release from the containment. Similarly, (1 - FCOR)
- FPART
- FCCI is the CCI release to the containment, a id STL is the CCI release from the containment.
The FLATE iodine is not considered amenable to this elease mechanism because its residence time in the containment is short. Figure B.14 displays the four ggregate distributions obtained for late vola ile iodine release fraction, XLATE, for the BWR cases described above and the distribution for XLATE used for Surry. The range of release fractions used for Surry is the same as for the most applicable BWR case-subcooled suppres-sion pool. The details of the distribution used for Sutry are not particularly important as the risk is domi-nated by accident scenarios in which the path from the reactor vessel to the atmosphere is quite direct (Event V and SGTRs). As this volatile release of iodine occurs late in the accident, its contribution to early fatalities is negligi%1e. In the accidents that contribute the most to the latent cancer fatality risk, there is little iodine remaining in the containment at late times to be released by this mechanism. B.4.4 Releases for All Fission Products A release that commences a day or more after the onset of core damage or 10 h or more after VB would be expected to have very small releases, and such is observed to be the case here. The iodine release is dominated by volatile (mostly organic) species that form late in the accident. When the release is so late in the accident, there is only or.e release, and the distinction between an RCS or early release and a CCI or NUREG-1150 B-52
l i
)
App 9ndix B LAlE RELEASE OF IODINE IN VOLATILE FORM l t i i 1.0 ; 0.9 -
- 0. 8 -
0.7 - b a 5 0.6 - P
< a co o
a:: . o- 0.5 - D w o o Q a 0.4 - a 1 i ] D o 0.3 J ' o = Sbc. Pl j ' i n o = Sat. PI u a = Fid. Cv 0.2 ~ v = Wet Cv e = Surry 4 n 0.1 - I H J 0.0 ! L ~, , , , , , , , , } 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 l RELEASE FRACTION 1 l i l Figure B.14 Distributions for late release of iodine from containment in volatile form. (The first four curves are the aggregate distributions for BWRs: release from a subcooled pool, release frcm , l a saturated pool. release from a flooded cavity, and release from a wet cavity. The fifth : curve is the distribution used for Surry.) i B-53 NUREG-1150 j 1
Appendix B ' late release is not kept. The RCS release is put in the late release with the CCI release, and the.early release is set to zero. Thus, the complete early and late release fractions for bin FFA-CAC-ABA-CA are: Fission Early Late Total Products Release Release Release Xe,Kr 0.0 1.0 1.0 I 0.0 4.4E-3 4.4E-3 Cs, Rb - 0.0 8.6E-8 8.6E-8 Te, Sc, Sb 0.0 2.3E-7 2.3E-7 Ba 0.0 2.8E-7 2.8E-7 Sr 0.0 1.2E-9 1.2E-9 Ru, etc. 0.0 3.0E-8 3.0E-8 La, etc. 0.0 3.1E-8 3.1E-8 Ce, Np, Pu 0.0 2.0E-7 2.0E-7 l J SURSOR also provides the times and energies associated with the early and late releases, the release j elevation, and the time that a general emergency is declared. For bin FFA-CAC-ABA-CA, the times for 1 the early release are irrelevant. The other parameters are: TW = time warning is given = 6.1 h T2 = start of late release = 36 h j DT2 = duration of late renease = 6 h E2 = energy release rate = 3600 W ELEV = height of release = 10 m ( i If BMT releases had been calculated separately, the release height would have been zero. Since BMT and ; leak releases are treated together, a height more appropriate to a leak above ground is used. 1 i B.5 Partitioning of Source Terms The accident progression analysis and the source term analysis, each performed once for the 200 observa- i tions that constitute the sample, produced 18,591 source terms. This is far too many to be able to perform ) a consequence analysis for each, so a reduction step is performed before the consequence analysis. This step is called partitioning. Partitioning is performed for all the observations in the sample together. B.S.1 Introduction
]
Partitioning is a grouping of the source terms based on the radiological potential of each source term to cause adverse effects on humans. The factors used in partitioning are those most important for the magni-tucle of the risk: the release fractions for the early release, the release fractions for the late release, and the time between start of the evacuation in the surrounding region and the start of the first release. It is difficult to take each of ti:e nine radionuclides groups into account separately when grouping the source terms, so "effect weights" are determined for each release. These provide a means of considering all the fission products as if they were just one. The partitioning process consists of grouping the source terms together based on these effect weights. Each source term group is then further subdivided based on evacu-ation timing relative to the start of the release. For releases that have the possibility of causing early I fatalities as well as latent cancer fatalities, the grouping is two-dimensional and is based on the source NUREG-1150 B-54
Appendix L term's potential to cause both typ:s of fatalities. In this analysis for Surry, there were 6820 source terms with nonzero early fatality weights (EFWs) and nonzero chronic fatality weights (CFWs). For releases that have the possibility of causing only latent cancer fatalities, the grouping is one-dimensional; 11,771 source terms were of this nature. The partitioning process is carried out by a computer code-PARTITION (Ref. B.57). The process is an interactive one, with the user choosing the number of cells or divisions to be used, and selecting those grids that have so few points that they may be combined with a neighboring cell. B.S.2 Effects Weights The early fatality weight (EFW) of a source term is a measure of the radiological potential of a source term to cause early fatalities in the absence of any mitigating effects except relocation. The chronic fatality weight (CFW) of a source term is, similarly, a measure of the radiological potential of a source term to cause latent cancer fatalities. The calculation of the EFW has wo parts. First, the releases of the 59 radionuclides other than 1-131 are converted into equivalent amounts of I-131. Then the total release, expressed in an equivalent amount of I-131, is used to estimate the number of resultant early fatalities. The isotope conversion factor used to determine the equivalent amount of I-131 for each isotope is based on the bone marrow dose from the three pathways that give an acute dose: cloudshine, groundshine, and , inhalation. l The cloudshinc or immersion dose results from being surrounded by air containing radioactive molecules. The inhalation '. lose comes from breathing the contaminated air. Radioactive molecules are absorbed into the body from the air in the lungs. The groundshine dose comes from standing or walking on ground on which radioactive particles have been deposited. The cloudshine and groundshine doses are immediate, as ; the body receives beta or gamma radiation from radionuclei that decay outside the body. The inhalation dose is received some time later when the radionuclei absorbed from the air decay inside the body. , The conversion factor is computed from an equation that is presented and derived in Reference B.S. It ! depends upon the dose factor for each pathway, the shielding factor for each pathway, the breathing rate, and the deposition velocity. For each pathway and organ of the body, the dose factor is a constant that depends upon the type of radiation emitted by the isotope, the energy of that radiation, and, for the inhalation dose factor, the selective transport of the isotope to, and absorption in, the specific organ. For cloudshine, the dose factor relates the dose rate to the concentration in the air. For groundshine, the dose factor relates the dose rate to the concentration on the ground. For inhalation, the dose factor relates the dose rate to the amount of the isotope inhaled. The shielding factor accounts for the fact that some of the time the people will be indoors and will be partially shielded by the building. The deposition velocity measures the rate at which solid particles are deposited from the plume. Table B.5 lists the dose factors used in calculating the isotope conversion factors and the isotope conver- ! sion factor itself for 11 representative isotopes. Complete information about the calculation of effects l weights, with the values of the parameters used for all 60 isotopes, may be found in Reference B.S. The I groundshine dose factor is the factor for an exposure of 8 h; radioactive decay during this time is ac- , counted for in computing this factor. The applicable concentration is the concentration at the beginning of i the period. The inhalation dose factor used is the acute inhalation factor. The cloudshine and groundshine dose factors for Sr-90 are zero because it produces no gamma radiation. The groundshine dose factor for Kr-88 is zero because it is not deposited. Each isotope is converted into an equivalent amount of I-131 by the equation: l EQNA = CFA Ik STNA exp[ - Ak (TN + DTN/2)), where I B-55 NUREG-1150 ;
Appendirt B Table B.5 Partitioning parameters and results.
' Dose Factors Cloud. Ground. Inhal. (ELCFA +
shine shine ' ation EF CLCFk ) i (1E 15 (8 h) (Acute) Reactor Isotope /Ek Sv.m3/ (10 12 (10 8 Inventory Cony. (LCF/ j- Isotope Bq.s) Sv.m3/Bq) Sv/Bq) IIalf. Life (10E+18 Bq) Factor 10E+15 Bq) Co-60 99.6 50.3 0.40 : 5.3 yr 0.025 6.6 59.2 Kr-88 116.0 0.0 0.0004 2.8 h 2.9 2.0 0.0003 Sr-90 0.0 0.0 1.7 28 yr 0.19 4.3 118. Zr-95 29.2 0.17 0.28 66 da ' 5.5 2.5 2.1 Ru-106 8.1 4.6 0.087 369 da 1.0 0.71 5.2 Te-132 7.6 35.3 0.25 3.2 da 4.7 3.4 0.13 I-131 14.5 8.7 0.035 8.0 da 3.2 1.0 0.29 t Cs-137 22.2 12.6 0.56 30 yr 0.24 2.8 114.0 l Ba-140 7.1 7.3 0.47 13 da - 6.2 1.9 0.53 I.a-140 94.8 44.2 0.14 40 h 6.4 5.4 0.083 l Pu-239 0.0017 0.0014 2.4 24000 yr 0.0008 6.0 1565.0 i N= 1 for the early release and N = 2 for the late release, EONk= the equivalent amount of I-131 for isotope k for release N. CFk= the isotope conversion factor for isotope k, ik= the inventory of isotope k at the start of the accident, STNk= the release fraction of isotope k for release N. Ag = the decay constant for isotope k, TN = the time of the start of release N, and DTN = the duration of release N. Release fractions are determined in the source term calculation for nine radionuclides groups; cach isotope is assigned to one of these groups. The total I-131 equivalent release is then found from: EQ = Ik EQ14+Ik EQ2. k The relationship betvoen the size of the equivalent release and the number of early fatalities is nonlinear because of the threshold effect and is complicated by the variability of the weather r.nd the uneven distri-bution of the population around the site. The last factors are treated by using the weather-averaged, mean, or expected value for early fatalities as calculated by MACCS, using the actual site weather and-demographic data. The effects of release n agnitude were determined by making complete MACCS runs for I-131 releases of different sizes. The result is shown in Figure B.15. The MACCS calculations as-sumed an instantaneous release at ground level, with no evacuation or sheltering. No immediate mitigative NUREG-1150 B-56
Appendix B RELATIONSHIP BETY/EEN IODINE RELEASE and EARLY FATALITIES 10' _ 10'- 10'-
" i h
i b a: 10' = b ! ) l
~
10 = ! E 10-' , 10 1d 16 16' l-131 RELEASED (BO) l l Figure B.15 Relationship between 1-131 release and mean early fatalities used in determining early ei- ) fects weights for partitioning. B-57 NUREG-1150
Appendix B action was used because the purpose of the EFW is to measure the radiological potential for early fatali-ties. The relocation criteria normally used for MACCS were not changed, however. In summary, the procedure in calculating the EFW for a release is to compute the I-131 equivalent for each isotope for both the early and late release and then to total these values to obtain a total I-131 equivalent release. The curve relating the total equivalent release to mean early fatalities, Figure B.15, is then used to find the number of early fatalities, which is the early fatality weight, EFW. Releases with EQs less than 2E+18 Bq are Wgned an early fatality weight of zero. The method used to determino the chronic fatality weight is different. Because of the nearly linear rela-tionship between the amount of.in isotope released and the number of latent cancer fatalities, there is no need to convert the amount released for each isotope to an equivalent amount of a reference radionu-clide. Instead, MACCS was used to determine the relationship between the amount released and the mean number of latent cancer fatalities for each site using the weather and population data appropriate for that site. For each isotope, a MACCS run was made in which only that isotope was released. The entire inventory of the isotope in the reactor was released for the inert gases and 10 percent of the entire inventory for the other radioisotopes. The latent cancer fatalities due to the dose obtained in the first 7 days and those due to the chronic dose (received after the first 7 days) were obtained from the MACCS output. Since these fatalities are approximately linear with the amount released, the ratio of their total number to the amount released gives a reliable measure of such fatalities per unit release in the absence of any mitigating actions. This method is not applicable to early fatalities because of the threshold effect. The chronic fatality weight for each isotope is given by the equation CFWk =Ik (ST1 k + ST2k) (ELCFk + CLCFr)/Rk and the total chronic fatality weight is then CFW = Ik CISVk, where the summation is over all isotopes. Ik and STNk have been defined above, and: CFWk = the chronic fatality weight, in latent cancer fatalities, for a release of an amount Ik (ST1k ) + ST2k ) of isotope k; ELCFA = the number of latent cancer fatalities due to early exposure from a release of an amount Rk of isotope k; CLCFk - the number of latent cancer fatalities due to late exposure from a release of an amount Rk of isotope k; and Rk = the amount of isotope k released in the MACCS calculation used to determine ELCFkand I CLCF. k l The early exposure is that obtained in the first 7 days after the accident and the late exposure is the ! exposure obtained after the first 7 days. The distinction is made because slightly different methods of these two periods are used in MACCS. Table B.5 lists values of the ratio ELCFk + CLCFy/Rk for 11 ] l representative isotopes. A total of 60 radionuclides are used in the consequence calculation. A complete j listing of the conversion factors and CFWs for each may be found in Reference B.5. Table B.5 also lists the half-life of the isotopes, and the reactor inventory at the time the accident starts. The half-life, the inventory, the EF isotope conversion factor, and the specific CFW, together with a rough idea of the release fractions for each radionuclides group, can be used to assess roughly the impor-tance of the isotope to early and late offsite health effe-ets. The 11 isotopes listed are ali fairly important for at least one of the two consequence measures as this was one of the criteria for their selection ~. How-ever, Kr-88 is clearly of little importance for chronic fatalities because the half-life and the specific CFW NUREG-1150 B-58
Appzndix B CFW are low. Pu-239, on the other hand, can be seen to be of less importance than other isotopes for early fatalities because the inventory is very low and the isotope conversion factor is about the same size as that for more common fission products. The release fractions for Pu-239 also tend to be low. , l The early and chronic fatality weights described here are not used in calculating consequences; they are only used in partitioning the source terms into groups of similar source terms. An average source term for each subgroup is used to calculate the offsite consequences with MACCS. The process describe a in this section is applied to the source term for bin FFA-CAC-ABA-CA in Obser-vation 4; the result is EFW = 0.0 and CFW = 2.7. The EFW is zero for this bin because the release is so low. Evacuation is not taken into account in determining the EFW, so the fact that the evacuation is complete before the FFA-CAC-ABA-CA release starts has no effect on the EFW, although it may be very important in computing the actual consequences. B.5.3 Partitioning Process and Results The partitioning process divides the " space" defined by the logarithm of the effect weichts into a number of cells. For the source terms for which both EFW and CFW are nonzero, this produces a rectangular gr.id on a two-dimensional plot. For the source terms for which the EFW is zero, the " space" to be divided is one-dimensional; that is, partitioning involves defining cells based on CFW alone. In the Surry analysis, there are 11,771 source terms with EFW = 0.0. The source term for bin FFA-CAC-ABA-CA is one of these. For the 11,771 source terms with EFW = 0.0, the range of logio(CFW) is from -4.2 to 3.7. This range was divided into six groups or cells. The results of the initial division was: Group 1 2 3 4 5 6 l l l logio(CFW) -4.2 -2.9 -1.6 - 0. 2 + 1.1 +2.4 +3.7 Count 349 1553 2892 1599 2438 2940
% Weighted Freq. 7.9 33.2 49.3 2.5 4.9 2.1 The second line gives the values of logio(CFW) that divide the range into six cells or groups. The third line gives the number of source terms in each group, and the last line gives the percentage of the weighted frequency in that group. (The weighted frequency of a bin is Q absolute frequency of the bin, or the PDS frequency multiplied by the bin probability for the observation that applies.) The sixth group has slightly ,
more source terms in it than the third group, but the frequencies of the source terms in the sixth group are ! very low. Thus the percentage of the frequency in group 3 is 25 times as high as that in group 6. The i source term for bin FFA-CAC-ABA-CA has CFW = 2.7, and Jogio(2.7) = 0.43, so the source term for I bin FFA-CAC-ABA-CA goes into group 4. Group 4 includes all the source terms that have EFW = 0.0 and for which logio(CFW) lies between -0.2 and +1.1. Source terms are placed in this group if they meet these criteria no matter what PDS or APB they represent. Although the number of source terms in group 4 l is fairly high at 1,599, the frequency of these source terms on the whole is fairly low, and the fraction of the frequency in group 4 is only 2.5 percent. It is not worth making separate calculations for groups that have a small fraction of the weighted frequen-cies. Based on the information given in the table immediately above, it was decided that three CFW ! groups would be sufficient. Groups 1,4, and 6 were eliminated, and the source terms in those groups were { pooled with the neighboring groups. Groups 4 and 6 were pooled with groups 3 and 5 because fractions of the weighted frequencies in groups 4 and 6 were so low. The frequency of group 1 is higher than that of group 5, but the consequences of group 1 are very low, so the absorption of the source terms of group 1 into group 2 has a negligible effect on the risk. The final partitioning ic B-59 NUREG-1150 l
Appendix B Group 2 I 4 1 3 5 6 I logio(CFW) -4.2 -2.9 -1. 6 -0.2 +1.1 + 2. 4 +3.7 Count 0 1902 3223 0 6646 0
% Weighted Freq. 0 41.1 49.8 0 9.1 0 The logio(CFW) for bin FFA-CAC-ABA-CA is just above the center value for group 4, so it was placed in group 5. The average values of the release fractions and the release characteristics for group 5 at the end of partitioning include the source terms originally in grc,ups 4 and 6 that have been absorbed into group 5, not just the source terms originally in group 5.
Group 5 in the partitioning process for source terms with zero EF weight becomes source term 17 when the partitioning for source terms with nonzero EF weights are considered and empty groups are elimi-nated. The mean frequency of this group is 3.4E-6/ reactor year, and the conditional probability of this group, with respect to the source terms with EFW = 0.0, is 0.084. Each source term group is subdivided into three source term subgroups .(STGs) on the basis of evacuation timing: STG1 (early evacuation): Evacuation starts at least 30 minutes before the release begins. STG2 (synchronous evacuation): Evacuation starts between 30 minutes before and 1 hour after the release begins. STG3 (late evacuation): Evacuation starts 1 or more hours after the release begins. For source term 17, STG1 has 94 percent of the source terms, and STG2 has 6 percent of the source terms. There are no source terms in STG3. As would be expected from the very late release time for the l source term for bin FFA-CAC-ABA-CA for Observation 4, this source term goes to STG1. l Consequence calculations are not done for source term group 17 as a whole; they are done for the subgroups since the timing differs markedly between the subgroups. The mean source terms for each subgroup form the basis for each consequence calculation. The properties of subgroup 1 of source term 17 are given in Table B.6. This information is used by the computer code MACCS (Refs. B.58 and B.59) to calculate the offsite consequences. Although the source term for bin FFA-CAC-ABA-CA of Observation 4 had a zero early release, some of the other source terms placed in STG1 of source term 17 in the partitioning process had nonzero early releases; thus the mean early release fractions for STG1 are non-zero. The representation of the source term for FFA-CAC-ABA-CA by a source term with a nor>zero early release does introduce a slight distortion. However, the early release is small, and it occurs at 13.3 h, wFch is well after the time at which the warning to evacuate is given, 6.9 h. The small early release and the fact that the evacuation is completed before the release commences mean that there are no early fatalities from the early release for STG1. As the latent cancer fatalities and population dose do not depend on the release timing to any significant degree, the error introduced by the nonzero early release is negligible. The results of partitioning are contained in two files. One file contains all the source terms that MACCS will use to calculate consequences. STG1 of source term 17 is the 49th source term in this file and is referred to as SUR-49 for the consequence calculation. The second output file indicates the STG in which each bin of each observation was placed in the partitioning process. For bin FFA.CAC-ABA-CA of Observation 4, this was STG1 of source term 17, now known as SUR-49. B.6 Consequence Calculation The computer code MACCS (Refs. B.58 and B.59) is used to determine the consequences of a selease of fission products from the damaged reactor. Consequences are the offsite results of the accident expressed NUREG-1150 B-60
Appendix B Table B.6 Properties of source term 17 subgroup 1. Frequency Minimum Maximum Weighted Property Value Value - Mean Release Height - 10 10 10 Warning Time 2.2E4 4 3.6E+4 2.5E+4 Start Early Release 4.7E+4 5.1E+4 ' 4.8E+4 Duration Early Release 0.0 3.6E+3 3.3E+2 Energy Early Release 0.0 7.0E+8 9.2E+5 ERF Xe, Kr 0.0 1.0E O 1.4E-1 ERFI 0.0 1.5E-1 7.3E-3 ERF Cs, Rb 0.0 1.1E-1 5.4E-3 ERF Te, Sc Sb 0.0 2.9E-2 1.2E-3 ERF Ba 0.0 1.4 E-2 1.2E-4 ERF Sr 0.0 2.4E-3 2.3E-5 ERF Ru, etc. 0.0 1.1E-3 6.6E-6
%F La, etc. 0.0 - 5.2E-3 2.8E-5 ERF Ce, Np, Fo 0.0 1.4 E-2 1.4 E-4 Stnrt Late Release 4.7E+4 1.3E+5 1.1E+5 Duration Late Release 1.0E+1 2.2E+4 1.2E+4 Energy Late Release 0.0 7.0E+8 9.2E+5 LRF Xe, Kr 0.0 1.0E O 8.1E-1 LRFI 5.0E-6 1.3E-1 4.0E-2 LRF Cs, Rb 0.0 5 OE-2 3.9 E-4 LRF Te, Sc, Sb 3.4E-11 9.6E-2 2.7E-4 LRF Ba 6.3E-14 1.7E-2 4.9 E-5 LRF Sr 1.0E-18 1.4 E-3 2.7E-6 LRF Ru, etc. 5.2E-18 1.6E-3 4.2E-6 LRF La, etc. 5.2E-18 1.7E-3 6.5E-6 LRF Ce, Np, Pu 1.6E-13 1.4 E-2 4.2E-5 Neig: ERF means early release fraction, LRF means late release fraction, the . release height is in meters, the energy of the release is in watts, and all times are in seconds.
in societal terms, for example, number of early fatalities, or the risk of latent cancer fatality to the popula-tion within 10 miles of the plant. A separate MACCS calculation'is performed for the mean source term associated with each STG. B.6.1 Description of Consequence Calculation The consequence calculation is an extensive calculation. The inventory of fission products in the reactor at the time of the accident and the release fractions for each radionuclides class are used to calculate the amount released for each of the 60 isotopes considered by MACCS. Then, for a large number of weather situations, the transport and dispersion of these radionuclides in the air downstream from the plant is calculated. The amounts deposited on the ground are computed for each distance downwind. Doses are computed for a hypothetical human at each distance from immersion in the contaminated air, from breathing the contaminated air, from the exposure due to radioactive material deposited on the ground, and frem drinking water and eating food contaminated by deposited radioactive particles. The first three of these dose pathways result in immediate doses that can cause health effects within a few hours or days of the release. These are called acute effects. In addition to the three pathways that cause acute effects, B-61 NUREG-1150
Appendin B l' long-term exposure (up to 1 year) from contaminated ground and ingestion also contribute to latent cancer fatalities and other delayed effects. These are known as chroni: effects. Dores to an individual are converted to population doses using population data. Doses and health effects are calculated for nine I organs of the human body. { i The consequence calculation requires a large amount of supporting data. Files of weather data and demo- 1 graphic data specific to the plant region are required. Information is needed on %d use (crops grown or dairy use) and land value in the surrounding area. Dose factors are used to relae the dose to each organ 3 to the concentration of each of the isotopes as explained in Section B.S.2. j To assess the effects of different weather on the consequences, the complete transport, deposition, .and dose calculation is repeated over 1,000 times for each source term. For each of 16 wind directions, the i consequence calculation is performed for about 130 different weather situations. Weather data from the i specific plant being modeled are used. The wind direction determines the population over which the plume from the accident passes. The atmospheric stability is also important as it determines the amount of dispersion in the plume downwind from the plant. Deposition is much more rapid when it is raining than when it is not. Each weather sequence contains information about how the wind direction, stability, and precipitation change from hour to hour. The consequence calculation also computes the effects of the 1 evacuation of the population from the immediate area around the plant. More information on the conse-J quence calculation may be found in References B.58 and B.59. 1 B . 6. 2 Results of Consequence Calculation
)
l As discussed in Section B.S.3, the source term for bin FFA-CAC-ABA-CA for Observation 4 was in- l cluded in group SUR-49 in the partitioning process. The eight consequence measures used in the risk j computation, with the mean or expected values computed for partition group SUR-49, are: J Early Fatalities 0.0 I Early Injuries 4.2E-6 Latent Cancer Fatalities 1.1 E+2 Population Dose-50 miles 2.7E+5 person-rem Population Dose-region 6.9E+5 person-rem Economic Cost 1.8E+8 $ Individual Early Fatality Risk-1 mile 0.0 Individual Latent Cancer Fatality Risk-10 miles 7.6E-5 The distribution for latent cancer fatalities is shown in Figure B.16. Note that these consequences assume that the release SUR-49 occurred. The population doses are the effective dose equivalent whole body doses. The individual early fatality risk is the risk to an average individual within 1 mile of the site boundary. It is calculated using the actual population distribution within 1 mile of the site boundary. For SUR-49, there are no early fatalities and the early fatality risk within 1 mile is zero as well. This is due to the very small magnitude of the early release. As 0.5 percent of the population is assumed not to evacuate when told to do so, neither of these measures would be zero if the release were large enough to cause early fatalities. The individual latent cancer fatality risk is the risk to an average individual within 10 miles of the plant, excluding the food pathways. The low total release fractions for SUR-49 result in a low value for this risk measure also. After the MACCS calculations are completed, the results for each weather trial (wind direction and weather sequence) for each STG are used in constructing complementary cumulative distribution func-tions, as discussed below in Section B.7.3. Averages over the weather trials determine the expected T consequence values for cach STG. These are extracted and assembled into a matrix for use in determining distributions of expected values of risk. B.7 Computation of Risk The risk measures that form the final result of a PRA are formed by merging the results of all the preced-ing analyses. The next section introduces the concepts and terms. Mean risk is discussed in Section B.7.2, NUREG-ll50 B-62
Appendix B CANCER fA_ ES- SURRY . l i 10' _ 10': - 01 .2 i t I ~d I k o I I L- l I
$ 10F _ i o _ i o -
Y , y - I b I I , 1d - ~ 10 . . , , , 0.000 0.025 0.050 0.075 0.10 0 0.125 0.15 0 Probability Figure B.16 Distribution of latent cancer fatalities computed for STO SUR-49. N63 NUREG-1150
Appendix B and displays that show the variability in risk due to the weather and other variables are discussed in Section B.7.3. B.7.1 Introduction The final step in a complete risk calculation is putting together the results of all the steps described above i to produce a measure of risk. The accident progression analysis and the source term analysis were carried out on conditional bases. That is, the accident progression analysis was performed for each PDS group for - ; each observation without regard for the frequency of that PDS group. Similarly, for each observation in ' the sample, the source terms for each bin were calculated without taking the bin frequency into account. The partitioning process, however, used the absolute frequency of each source term in determining which groups of source terms could be combined into neighboring groups and in determining the mean values ; used to represent each STG. To accomplish this, for each observation, the absolute frequency of each ( PDS group was obtained from the accident frequency analysis, and the conditional probability of the bins l was obtained from the accident progression analysis. The consequence analysis was performed for each source term subgroup without regard for its absolute or relative frequency. Risk is generally displayed in three forms: mean risk, histograms of risk, and complementary cumulative distribution functions (CCDFs). For each sample member and for each consequence measure, the results are averaged over the weather conditions to obtain an expected value. If, for one consequence measure, the average of the 200 expected values is taken, the result is actually the mean value of the expected risk, or the mean value of the weather-averaged mean risk. It is usually referred to as just the mean risk. The mean values of expected risk do provide single numbers (for each consequence measure) that character-ize the risk. However, they provide no information about the variability or uncertainty in the risk. Histo-grams of expected risk display the variation in weather-averaged expected risk among the members of the sample. Mean risk is discussed in Section B.7.2 below. To display the variability in risk due to the weather, CCDFs are used. While a separate CCDF is formed for each observation, not all 200 are usually plotted at once. Instead, statistical measures of the sample of CCDFs are plotted. CCDFs are presented and explained in Section B.7.3. More detail on the calculation of risk may be found in Reference B.60. l B.7.2 Calculation and Display of Mean Risk As described in Section B.6, a separate consequence calculation is performed with MACCS for each source term subgroup, and the result was a large number of consequences. They are represented by Cn,ws. which is the value of consequence measure I for wind direction v, weather sequence w, and scurce term subgroup k. When a frequency-weighted average is formed over the wind direction and the weather se-quences, a set of expected consequence measures, Cjk, is formed. As there are 52 source term subgroups, 52 expected values are computed for each of the eight consequence measures. The expected risk for measure / and observation n can be expressed in terms of the results of the individ-ual analyses by: Risk /n = Eh1 I1Efin(IE k ) Pnh (IE3
- PDSj) Pn (PDSj
- APBj) Pn (APBj
- STGk ) Clk-where Riskin = expected risk for consequence measure I for observation n (consequences / reactor year);
f n (IE 3) = frequency (per reactor year) of initiating event h for observation n; Pn (IE h* PDS ) i= Probability that initiating event h leads to PDSj for observation n; Pn (PDSj- APBj) = probability that PDSj leads to APBj for observation n; Pn (APBj-+ STG k) = probability that APB) was partitioned into source term subgroup k for observation n;and NUREG-1150 B-64
Appendix B CJk = expected value of consequence measure 1 for source term subgroup k. All the terms in the equation change from observation to observation except C Jk . The distribution for initiating event frequency is part of the data used in the calculations performed in the accident frequency analysis.'The summation over all the different initiating events is performed in the accident frequency analysis, and the output of the accident frequency analysis is actually in (PDSj) = Zh fn (IEh) Pn (IEh -+ PDSj), the frequency for each PDS group for each observation. Pn (PDSj-+ APBj) is the result of the accident progression analysis and the evaluation of the accident progression event tree. It consists of a list of APBs for each PDS group, with a probability for each, for each observation. The APB probability is conditional on the occurrence of the PDS group. Pn (APBj-+ STGr) represents the combined result from the so'~ce term calculation and the partitioning process. For each observation, a source term is computed for each APB in that observation. The source terms for all 200 observations in the sample are placed in source term subgroups in the partitioning process. The outcome of the source term analysis and partitioning is the STO to which each APB in each observation is assigned and a mean source term for each STG. Pn (APBj -+ STGA ) is an element of the matrix that contains this information: the matrix element for given values of f and k is 1.0 if APBj was placed in STGk , and 0.0 otherwise. Risk in is the expected risk for each observation. What is reported as the mean risk for measure 1 is really . the expected or mean value of expected risk: Riskj = En RiskJ,/nLHs where nLus is the number of observations in the LHS (200 for Surry). That is, the expeacd or mean value of risk is the average of 200 values of weather-averaged expected risk. The distribution of the 200 values for the mean latent cancer fatality risk are displayed in the form of a histogram. Such a histogram for LCFs is shown in Figure B.17 for 99.5 percent evacuation. Tis pantiles are obtained by ordering the 200 observations by the value of the independent variable. The 5th anct 95th percentiles, the mean, and the median are shown. Not shown are the extreme values (Observation 123, 7.8E-5 LCFs/ reactor year and Observation 76, 7.5E-2 LCFs/ reactor year) since they are not mdbtive of the sample as a whole. The mean for Observation 4 is 5.0E-3 LCFs/ reactor year, which is near the 75th percentile and is well above the median. The equation for risk given above provides the means for determining the risk due to certain subsets or groups of events and the contribution of these subsets to mean risk. For example, say the contributions of the APBs were desired. The risk due to APBk or f observation n is: Riskin j = I Eh Elfn(IE k ) Pn(IEh h -+ PDSj) Pn(PDSj -* APBj) Pn(APBj-+ STG k ) C Jk . For each observation, the fractional contribution of APBj is: Risk/nj/Riskin. The risk and the fractional contributions for combinations of APBs can be determined in an analogous manner. B-65 NUREG-1150
--- _ _ _ _ _ _ _ _ _ - - i
Appendix B Internal - 99.5% Evac - 24 Apr 89 SURRY Risk (per Reactor-year) 10_:
- Latent Cancer Fhtality Risk
_ 95% : l
. 4 10-'- ,
[ MEAN ' r i
- i MEDIAN _ , l n
i I l 10-* , i
- i
. n ,
- I
- B I -
s% . l 10-' Figure B.17 Distribution of expected (weather-averaged) latent cancer fatality risk for Surry. NUREG-1150 B-66
App:ndix B For the sample as a whole, the mean risk from APBA is: (In Riskin]) / DLHS-Fractional contributions to mean risk for the entire sample can be determined in two ways. The expres-sion: [In (Risk in j/ Risk /n)) / DLHS, is termed the mean fractional contribution to risk for APBj. The expression [(In Riskinj) / nLHs] / Risk; is termed the fractional contribution to mean risk for APBj. Figure 3.14 of the main report shows the fractional contribution to mean risk for groups of APBs. Because the distributions for risk often have very - long tails and the mean is then determined by the few observations with the highest risk, the fractional contribution to mean risk and the mean fractional contribution to risk can be quite different. There is no consensus that one method of calculating the contribution to mean risk is preferable to the other. The summations in the expression for Riskin, and the computations necessary to obtain the statistical measures, are performed by a computer program named RISQUE. A description of this code may be found in an appendix to Reference B.S. B.7.3 Calculation and Display of CCDFs , As already indicated, the output from MACCS is a large number of consequences represented by C fywk, the magnitude of consequence measure I for wind direction v, weather sequence w, and source term subgroup k. When tha results for each weather trial (combination of wind direction and weather se-quence) are kept separate and the probability of each weather trialis taken into account, a complemen-tary cumulative distribution function (CCDF) may be obtained for each STO. Figure B.18 displays the latent cancer fatality CCDFs for STG SUR-49 and for all 52 STGs. The CCDF for a single STO displays the effects of the variability of the weather and relates the magnitude of the consequence to the probability that it will be exceeded. (The cumulative distribution function (CDF) displays the probability that a cer-- tain value will not be exceeded. The CCDF displays the probability that a certain value will be exceeded. CCDFs are usually shown for historical reasons.) The CCDFs in Figure B.18 have conditional probability , on the ordinate: each curve displays the latent cancer fatality results conditional on the occurrence of a l release. For example, the top plot in the figure displays the results of the consequence analysis conditional on the SUR-49 release. To understand how the CCDF for a single STG is formed, let the subscript u represent s combination of j wind direction and weather sequence; then C fpwg may be written Cl uk. Each combinatist. of wind direc- I tion and weather sequence is denoted a weather trial. C luk si now the value of consequence measure I for l weather trial u and source tena subgroup k. The CCDF for consequence measure I and STGk is formed ; from a set of results of the form: (Cluk, Pu) u = 1, 2, ...., n W T, f I where Pu = probability that weather trial u will occur, and ! 1 nWT = number of weather trials (about 2,500). ! The set (Cl uk, Pu) is ordered on the consequence measure (i.e., Cluk < Cf , u+1. k). The results of the consequence evaluation include both Cl uk and Pu. B-67 NUREG-1150
10 ' ' ' ' ~~' ' Appendix B 10 -
~
x C 3 C 10 - l i w w U x w u. O 10 - SOURCE TERM
$ SUBGROUP SUR-49 E
10 ' 10 ' ' ' ' ' ~~' ' 10 10 10 10 10 10*
- 10 '
10 10 X, CANCER FATALITIES 10 - s 10 -
.\
)
i x 0 3 o 10 - k [ , w I SUR-49' \ \ x 4' W u. O 10 - co O Cr Q. 10 - ALL SOURCE TERM SUBGROUPS 10 ' ' - ~~' ' ' 10 10 10 10'" 10 10 10*
- 10*
- 10
X, CANCER FATALITIES Figure B.18 CCDFs for latent cancer fatalities for STG SUR-49 and for all 52 STOs. NUREG-1150 B-68
Appendix B i
!i j
Since it is the complementary cumulative probability that is plotted in Figure B.18, this figure results from plotting the set (Cluk, 1-cpu) where cpu is the cumulative probability defined by:
)
i u cpu = I Pq. 9=1 Figure B.18 shows the probability of exceeding a given consequence. For instance, the top plot shows that, for SUR-49, the probability of exceeding 100 LCFs is about 0.10. The next step is to form the CCDF for each of the nms (200) observations that comprise the sample This is done by considering a large number of values on the abscissa in the lower plot in Figure B.18. Let X represent a value of a consequence measure; in this figure X would be a number of latent cancer fatalities. For each STGk , the ordinate (i.e., Y) of the point (X,Y) on the curve defined by (Cluk, 1 - cpu) G ves i the probability of er.ceeding X consequences. Let this probability be represented by Pye,(X). The next factor needed is fnk, the frequency of STGk for observation n. The equation for ink is analogous to the equation for Riskin fnk = I Ejf fn (PDSj) Pn (PDSj ~ APBj) Pn (APBj- STGk ), where all the terms have already been defined in Section B.7.2. So for one STGk , the contribution to the CCDF for observation n is the set of point 3 (X, Pxc,(X) fnkh l where the product Pxe,(X) fnk represents the frequency for observation n that STGk will result and that X will be exceeded. When all the STGk are considered, it may be seen that the set of points that defines the CCDF for observation n becomes (X, Ik[Pxcg(X)fnk}h _j where the summation is over all the source term subgroups. As there are 200 observations in the sample, 200 such CCDFs are calculated. The dashed lines on the plots in Figure B.19 are the CCDFs for Observa-tion 4 for EFs and LCFs. 6 While the CCDFs for all 200 observations for consequence measu e I could be placed on one plot, the j result is cluttered and hard to read. Instead, four statistical measures of the set of 200 curves are plotted. The four measures of the sample are the 5th percentile, the 95th percentile, the median, and the mean. They are shown on Figure B.19. These four curves do not represent specific observations. Instead, each point on these curves is a statistical measure of the sample at that value of the consequence. For example, consider the mean curve for latent cancer fatalities in Figure B.19. For 100 LCFs, there are 200 values of the exceedance frequency, one for each observation in the sample. As each observation is as likely as the next, these 200 values are summed and divided by 200 to detrmine the mean for 100 LCFs. This process is repeated for 105 LCFs,110 LCFs, and so on. In this way ths points that comprise the mean curve are obtained. The result does not coincide with any one of the 200 observations. The 5th and 95th percentiles are obtained in an analogous manner. Since the 200 values for a given LCF value are ordered, the 5th percentile value is the value of the 10th observation. The CCDF for each observation displays the effects of the variability of the weather, through the term Pu, as well as some variability due to the sampling process, through the term ink. The shape of the CCDF for a single observation depends upon the relative frequency of each STO in that observation, which in turn depends on all the sampled factors in the accident frequency analysis, the accident progression analysis, and the source term analysis. As the CCDFs for each STO are the same for all the observations in the sample, the differences among the CCDFs for the 200 observations are due to the different frequencies j for each STO in each observation. q B-69 NUREG-1150 i
10 . ... ... .. . .i .
.... . ..i.
SURRY { 10", INTERNAL EVENTS 1 Wi 99.5% EVACUATION
@ 16',
1 9 h 10, V 1 96 5 i D z i um 10, 1 "u jga, ,,, J - oss.4 , \ g . i o '. 5 10- '. 10~ .,, . . .. ... . . . 11 Id Id 11
.-11 EARLY FATAUTIES 'j 4
10'8 , , , , , , , , , . . .. , , ,..... . .. ,. . . . . . , 12 10, e ... - 1 & . 1 uriu o. y$ .......o u.................... ....._____ k 10, . 1 g ',- z
$ 10, .
N 8 1 E d 10-' '
, 1 SURRY INTERNAL EVENTS 5 10-' 99.5% EVACUATION 1
10~" . . , 11 Id, 18 18 16' id LATENT CANCER FATAUTIES Figure B.19 Computed curves showing four statistical measures of 200 CCDFs for Surry for early fatalities and latent cancer fatalities. (The CCDF for Observation 4 is also shown.) NUREG-1150 B-70
I I Appendix B The CCDF can be read in a number of ways. Consider the median curve for LCF in Figure B.19; it shows that the median frequency of exceeding one to ten LCFs is between 3E-6/ reactor year and 4E-6/ reactor year; the median frequency of exceeding 100 LCFs is about 2E-6/ reactor year; the median frequency of exceeding 1,000 LCFs is SE-7/ reactor year; and the median frequency of exceeding 10,000 LCFs is SE-9/ reactor year. The same interpretation is valid for the other measures of the sample of 200 CCDFs. Another way to read a CCDF is to consider one particular value of the consequence. Take 1.000 LCFs for example; in 95 percent of the observations, the frequency that 1,000 LCFs would be exceeded is less than 4E-6/ reactor year; while in half of the observations, the frequency that 1,000 LCFs would be exceeded is less than SE-7/ reactor year. Because of the wide range of the consequences, the CCDFs are plotted 'with a logarithmic scale on both ! axes. The distributions typically have long " tails" in both directions. For distributions like this, the mean .! value often reflects just a few high observations. Such is the case for the early fatalities in Figum B.19. Above about 150 EFs, the mean value of the sample exceeds the 95th percentile. This means that the mean in this ptsrtion of the plot is determined by fewer than 10 observations out of the 200 in the sample. B.8 Summary In this section, a specific accident at Surry has been followed all the way through a complete analysis, from the initiating event in the accident frequency analysis through to the offsite risk values computed by the consequence analysis. The example selected was a fast SBO accident; the sequence is denoted T1St-QS-L, and the PDS is TRRR-RSR. To determine the uncertainty in risk, a sample of 200 observa-tions was used for the Surry analysis. Observation 4 was followed in this example, and specific numbers for the important events and parameters for this observation were given above. This accident is initiated by the LOSP. The emergency DG dedicated to Unit 1 (DG 1) fails to start, and the swing DG (DG 3) also fails to start, so all ac power is lost, which is designated a station blackout. The j only means of heat removal from the reactor core in a blackout situation is the steam-turbine-driven 1 (STD) AFW train, which operates as designed initially. However, a secondary system safety relief valve fails to close, and the water lost out this valve fails the AFWS in about an hour. Offsite power is not restored by this time, and the plant staff fails to get one of the two DGs capable of supplying power to Unit l 1 to start. With the failure of the STD-AFW train, and no ac power to run the motor-driven AFW trains, there is no heat removal from the reactor. The reactor coolant system (RCS) heats up until the pressure j forces open the PORVs. Water (steam) loss through the PORVs continues, with the PORVs cycling open and closed, until enough water has been lost to reduce the liquid water level below the top of active fuel. j Without electric power, there is no way to replace the water lost from the RCS. After the water level has dropped some distance below the top of active fuel, the fuel above the water level heats up sufficiently to degrade. The accident frequency analysis determined the frequency of the initiating events, and the probabilities of the other failures that led to this state. The frequency of the initiating event for Observation 4 is 0.099/re-actor year, and the frequency of the cut set defined in Table B.1 is 3.4E-8/ reactor year. This cut set was placed with many others in sequence T1SI-OS-L, which has a frequency, for Observation 4, of 2.4E-7/ reactor year. Sequence TIS 1-QS-L was grouped with other fast station blackout sequences in l plant damage state TRRR-RSR, which has a frequency of 4.8E-7/ reactor year for Observation 4. As TRRR-RSR is the only PDS in PDS group 3, this is also the group frequency. The core melt process and the response of the containment were treated in the accident progression analysis. Although the most likely outcome for TRRR-RSR was termination of the accident without failure of either the reactor vessel or the containment due to the recovery of offsite power, the path followed through the APET took the branch in which power was not restored in time to avert vessel breach. The RCS was at the PORV setpoint pressure at the start of core degradation since there were no breaks in the system. However, the path through the event tree took the branch in which the RCP seals failed, and the i vessel fai!ed with the RCS at intermediate pressure. While high-pressure melt ejection and direct contain-ment heating accompanied the failure of the vessel, the pressure rise in the containment was insufficient to fail the containment. However, the core material attacked the concrete floor of the reactor cavity and the B-71 NUREG-1150 C____
Appendix B containmerit failed by basemat meltthrough many hours after the start of the accident. This path through the event-tree is designated accident progression bin FFA-CAC-ABA-CA. For the observation chosen. this bin is the most likely bin that has both VB and containment failure.(CF). For Observation 4, the evaluation of the APET for PDS group 3 resulted in a conditional probability of 0.017 for bin FFA-CAC-ABA-CA. Bin FFA-CAC-ABA-CA was also generated in evaluating the APET for PDS group 1. The absolute frequency of this bin for both PDS groups, for. Observation 4, is 3.2E-8/re-- actor year. Only a small portion of this frequency came from the cut set listed in Table B.1.' In the source term analysis, the release fractions, the timing of the release, and the energy and height of the release were determined for bin FFA-CAC-ADA-CA. These values define the source term. In the partitioning process, the source term for bin FFA-CAC-ABA-CA of Observation 4 was grouped with other similar releases into source term group.SUR-49. In the consequence analysis, the offsite' consequences of ' the mean source term for SUR-49 were computed. SUR-49 has such small release fractions th'at it causes no early fatalities. The total release caused (in this calculation) 113 latent cancer fatalities when' averaged . over all weather conditions. Finally, the results of the four constituent analyses were combined to determine risk. For the conse-quences averaged with respect to the weather variability, when all PDS groups and APDs are considered.- the contribution of Observation 4 was slightly below the median for early fatalities and near the mean - value im ! stent cancer fatalities. Although bin FFA-CAC-ABA-CA was the most likely bin in Observation 4 that had both vessel breach and containment failure, it was a relatively improbable bin in the entire sample, and its contribution to the risk measures was very small. The position of the CCDFs for Observa-tion 4 is shown in Figure B.19. I L
-l
-i NUREG-1150 B-72
Appendix B REFERENCES FOR APPENDIX B B.1 R. J. Breeding et al., " Evaluation of Severe Accident Risks: Surry Unit1 ," Sandia National Labo-ratories NUREG/CR-4551. Vol. 3, Draft Revision l' SAND 86-1309, to be published.*. T1.2 D. M. Ericson, Jr., (Ed.) et al., " Analysis of Core Damage Frequency: Methodology Guidelines," Sandia National Laboratories, NUREG/ crc 4550, Vol.1, Rev.1 SAND 86-2084, to be published.* B.3 R. C. Bertucio and J. . A. Julius, " Analysis of Core Damage Frequency: Surry Unit L1." Sandhi National Laboratories, NUREG/CR-4550, Vol. 3,.Rev.- 1, SAND 86-2084, to be published.* B.4 R. L. Iman and S. C. Hora, "Modeling Time to Recovery and Initiating Event Frequency for Loss of Offsite Power Incidents at Nuclear Power Plants," Sandia National Laboratories, NUREG/ CR-5032, SAND 87-2428, January 1988.' B.5 E. D. Gorham-Bergeron et al., " Evaluation of Severe Accident Risks: Methodology for the Acci-dent Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analyses," Sandia National Laboratories, NUREG/CR-4551, Vol.1, Draft Revision 1, SAND 86-1309, to be pub-lished.' B.6 F. T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major input Parame-ters," Sandia National Laboratories. NUREG/CR-4551, Vol. 2, Draft Revision 1 SAND 86-1309,
- i. to be published.*
B.7 J. M. Griesmeyer and L. N. Smith, "A Reference Manual for the Event Progression and Analysis Code (EVNTRE)," Sandia National Laboratories, NUREG/CR-5174, SAND 88-1607, to be pub-lished.* j B.8 T. A. Wheeler et al., " Analysis of Core Damage Frequency from Internal Events: Expert Judgment and Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol.' 2, SAND 86-2084, April 1989. 1 B.9 Steam Explosion Review Group (SERG), U.S. Nuclear Regulatory Commission (USNRC), "A Re- ' l view of the Current Understanding of the Potential for Containment Failure from In-Vessel Steam Explosions," NUREG-1116, June 1985. B.10 D. B. Rhodes et al. " Reactor Coolant Pump Shaft Seal Stability During Station Blackout," Idaho j National Engineering Laboratory, NUREG/CR-4821, EGG-2492, May 1987. B.11 C. A. Kittmer et al., " Reactor Coolant Pump Shaft Seal Behavior During Station Blackout," Idaho j National Engineering Laboratory NUREG/CR-4077, EGG-2365, April 1985. j l 3 l l B.12 C. H. Campen and W. D. Tauche, " Reactor Coolant Pump Seal Performance Following a Loss of All AC Power," Westinghouse Electric Corporation, Nuclear Energy Systems, WCAP-10542,1986. l B.13 K. D. Bergeron et al., " User's Manual for CONTAIN 1.0, A Computer Code for Severe Reactor Accident Containment Analysis," Sandia National Laboratories, NUREG/CR-4085, ; SAND 84-1204, July 1985. B.14 K. D. Bergeron et al., " User's Manual for CONTAIN 1.1, A Computer Code for Severe Reactor Accident Containment Analysis," Sandia National Laboratories, NUREG/CR-5026, SANDB7-2309, to be published.* ;
'Available at the USNRC Public Document Room, 2120 L Street NW., Washington, DC. , 4 B-73 NUREG-1150 f
I
. App:ndix B B.15 R. E. Henry et al., "MAAP, Modular Accident Analysis Program, Users' Manual," Developed by Fauske & Assoc., Inc., for the Atomic Industrial Forum's IDCOR Program, Undated.'
B.16 M. Pilch and W. W. Tarbell, " Preliminary Calculations of Direct Heating of a Containment Atmos-phere by Airborne Core Debris," Sandia National Laboratories, NUREO/CR-4455, SAND 85 2439, July 1986.
'B.17 W. W. Tarbell et al., "Results from the DCH-1 Experiment," Sandia National Laboratories, NUREG/CR-4871, SAND 86-2483 June 1987.
B.18 M. Pilch and W. W. Tarbell, "High Pressure Injection of Melt from a Reactor Pressure Vessel--The Discharge Phase," Sandia National Laboratories, NUREG/CR-4383, SAND 85-0012, September 1985. B.19 W. W. Tarbell et al., " Pressurized Melt Ejection into Scaled Reactor Cavities," Sandia National Laboratories, NUREG/CR-4512, SAND 86-0153, October 1986. B.20' D. C. Williams et al., " Containment Loads Due to Direct Containment Heating and Associated Hydrogen Behavior: Analysis and Calculations with the CONTAIN Code," Sandia National Labo-ratories, NUREG/CR-4896, SAND 87-0633, May 1987. B.21 D. C. Williams and D. L. Y. Louie, " Containment Analysis of Direct Containment Heating Events in the Surry Pbnt," Proceeding of the American Nuclear Society / European Nuclear Society Inter-national Meeting, Thermal-hydraulics Division (Washington, DC), October 31 - November 4, 1988. B.22 D. C. Williams, Sandia National Laboratories, letter to the NUREG-1150 Loads and Source Term Panels, "CONTAIN Calculations for DCH Scenarios in Sequoyah," dated April 6,1988.' B.23 D. C. Williams et al., " Integrated Phenomenological Analysis of Containment Response to c' vere Core Damage Accidents," Progress in Nuclear Energy, 19, 69, 1987. , I B.24 L. Pong et al., "Surry S2D Severe Accident Containment Loads Calculations Using HMC," Umver- i sity of Wisconsin (Madison), UWRSR-34, March 1986. B.25 United Engineers & Constructors, " Indian Point Units 2 and 3, Containment Capability Analysis," report prepared in support of the Indian Point Probabilistic Safety Study, March 1980. B.26 W. J. Pananos and C. F. Reeves, " Containment Integrity at Surry Nuclear Power Station," Stone & i Webster Engineering Corp., TP84-13,1984. ! B.27 United Engineers & Constructors, " Containment Ultimate Capacity of Seabrook Station Units 1 & ; 2 for Internal Pressure Loads," February 1983. l B.28 D. S. Horschel, Sandia National Laboratories, letter to J. F. Costello, USNRC, on the testing of a j reinforced concrete containment, dated August 2,1987. B.29 Y. R. Rashid et al., " State-of-the-Art Review of Concrete Containment Response to Severe- { Overpressurization," Transactions of the 9th SMIRT Cor(erence (Lausanne, Switzerland), ; August 17-21, 1987. ! B.30 R. A. Dameron et al., " Analytical Correlation and Post-Test Analysis of the Sandia 1:6-Scale l' Reinforced Concrete Containment Test," Fourth Workshop on Containment Integrity (Arlington, VA), June 14-17, 1988.
'Available at the USNRC Public Document Room, 2120 L Street NW., Washington, DC.
NUREG-1150 B-74
Appendix B B.31 S. J. Higgins, "A User's Manual for the Post Processing Program PSTEVNT," Sandia National Laboratories, NUREG/CR-5380, SAND 88-2988, to be published.' B.32 R. L. Iman and M. J. Shortencarier, "A FORTRAN 77 Program and User's Guide for the Genera-tion of Latin Hypercube and Random Samples for Use with Computer Models," Sandia National Laboratories, NUREG/CR-3624, SAND 83-2365, June 1984. B.3., H. N. Jow et al., "XSOR Codes User's Manual," Sandia National Laboratories, NUREG/CR-5360, SAND 89-0943, to be published.' B.34 R. A. Lorenz, J. L. Collins, and A. P. Malinauskus, Nuclear Technology, 46, 404 (1979). B.35 R. A. Lorenz. D. O. Hobson, and G. W. Parker, Nuclear Technology, 11, 502 (1971). B.36 USNRC, " Technical Bases for Estimating Fission Product Behavior During LWR Accidents," NUREG-0772, June 1981. B.37 E. L. Tolman et al., "TMI-2 Accident Scenario Update," Idaho National Engineering Laboratory. EGG-TMI-7489, December 1986. B.38 D. W. Akers and R. K. McCardell, " Fission Product Relocation and Behavior in the TMI-2 Reac-tor Vessel," Trans. Am. Nuclear. Soc., Vol. 57, pp. 418-19, Int. Conf. on Nuclear Fission: Fifty Years of Progress in Energy Security, and, Topical Meeting on TMI-2 Accident: Materials Behavior and Plant Recovery Technology, TANSAO 57, October 30 - November 4,1988. B.39 J. A. Gieseke et al., " Source Term Code Package: A User's Guide," Battelle Columbus Division. NUREG/CR-4587 BMI-2138, July 1986. B.40 M. D. Allen et al.. "ACRR Source Term Experiment: ST-1," Sandia National Laboratories, 1 NUREG/CR-5345, SAND 89-0308, to be published.' l B.41 R. A. Sallach " Vapor Pressure of Liquid CsOH," Sandia National Laboratories, Reactor Safety l Research Semiannual Report, January-June,1987, NUREGICR-5039, Vol.1., SAND 87-2411, January 1988. B.42 J. A. Gieseke et al., " Radionuclides Release under Specific LWR Accident Conditions," Battelle Columbus Laboratory, Vols. I-VI, BMI-2104, July 1983 - July 1984. B.43 R. S. Denning et al., " Radionuclides Release Calculations for Selected Severe Accident Scenarios," Battelle Columbus Division, NUREG/CR-4624, Vols.1-5, BMI-2139, July 1986. B.44 H. Bunz et al., "NAUA Mod 4," Kerforschungszentrum Karlsruhe. KfK-3554, West Germany, 1983. B.45 R. S. Denning et al., " Radionuclides Release Calculations for Selected Severe Accident Scenarios: Supp... nental Calculations," Battelle Columbus Division, NUREG/CR-4624, Vol. 6, BMI-2139, to be published.* B.46 M. Khatib-Rahbar et al., "On the Uncertainties in Core Melt Progression, Fission Product Release, and Pressurization Loads for a BWR with Mark 1 Containment," Brookhaven National Laboratory, Draft BNL Technical Report A-3286,1988. B.47 E. Fuller, Electric Power Research Institute, letter to D. C. Williams, Sandia National Laboratories, on the decontamination factor of the Peach Bottom reactor building and fission product release from corium during core-concrete interaction, dated March 14, 1988.
'Available at the USNRC Public Document Room. 2120 L Street NW., Washington, DC.
B-75 NUREG-1150
Appendix B B.48 S. E. Dingman et al., " Analysis of Peach Bottom Station Blackout with MELCOR," Proceedings of the 14th Water Reactor Safety frzformation Meeting (Gaithersburg, MD), NUREG/CP-0082, SAND 86-2129C, February 1987. B.49 R. M. Summers et al., "MELCOR In-Vessel Modeling," Proceedings of the 15th Water Reactor Safety information Meetir/g (Gaithersburg, MD), NUREG/CP-0091, February 1988. B.50 S. E. Dingman et al., "MELCOR Analyses for Accident Progression Issues," Sandia National Laboratories, NUREG/CR-5331, SAND 89-0072, to be published.* B.51 H. A. Morewitz et al., "Results of the GREST Code Comparison Exercise," Committee on the Safety of Nuclear Installations, Organization for Economic Co-operation and Development, Nuclear Energy Agency, Paris, France, CSNI Report 116, 1986. B.52 " Report of the Special Committee on Source Terms," American Nuclear Society, September 1984. B.53 W. Schock, " General Valuation of the Results of the DEMONA Program," presentation at the
,DEMONA Final Colloquium, Kernforschungszentrum Karlsruhe, West Germany, June 1987.
3 I B.54 P. Pasanen et al., " Behavior of Hygroscopic Aerosols: Test Results on Sedimentation in Tubes," Electric Power Research Institute, LACE TR-030,1987, B.55 " Evaluation of Empirical Aerosol Correlations," performed by Rockwell International Corp., pub-lished by Electric Power Research Institute, EPRI NP-4927,1985. B.56 R. J. Lipinski et al., " Uncertainty in Radionuclides Release Under Specific LWR Accident Condi-tions," Sandia National Laboratories, SAND 84-0410, Vols.1-4, Draft, February - December 1985. B.57 R. L. Iman et al., "A User's Guide for PARTITION: A Program for Defining the Source Term / Consequence Analysis Interfaces in the NUREG-1150 Probabilistic Risk Assessments," Sandia Na-tional Laboratories, NUREG/CR-5253, SAND 88-2940, to be published.' l B.58 D. I. Chanin et al., "MELCOR Accident Consequence Code System (MACCS); User's Guide,"
.l Sandia National Laboratories, NUREG/CR-4691 Vol. I, Draft, SAND 86-1562, to be published.' l B.59 L. R. Ritchie et al., "MELCOR Accident Consequence Code System (MACCS): MACCS Model Description," Sandia National Laboratories, NUREG/CR-4691, Vol. II, Draft, SAND 80-1562, to be published.'
B.60 J. C. Helton et al., " Incorporation of Consequence Analysis Results into the NUREG-1150 Proba-bilistic Risk Assessments," Sandia National Laboratories, NUREG/CR-5382, SAND 88-2695, to be published.'
*Available at the USNRC Public Document Room,2120 L Street NW., Washington, DC.
NUREG-1150 B-76
l Appendix C Issues Important to Quantification of Risk 4 l
CONTENTS C.1 Introduction . . . ...... . .. ... . ...................................... C-1 REFERENCES FOR SECTION C.1. .. ...... ........................... ........ C-3 C.2 Common-Cause and Dependent Failures . . . . . . . . . . ............................. C-4 C.2.1 Issue Definition . . ......... .. .. .. .. ... .. ....... ......... ... C-4 C.2.2 Technical Bases for Issue Quantification . ...................... ......... C-5 C.2.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . ........................ C-7 REFERENCES FOR SECTION C.2 . . . . . . . ........................ ................ C-8 C.3 Human Reliability Analysis . . . . ..................... ........................ C-10 C.3.1 Issue Definition . . . . .. ........... ................................. C-10 C.3.2 Technical Bases for Issue Quantification . . . . . ......... .................. C-11 C.3.3 Treatment in the PRA and Results . . . . . . . . . ............... ....... . C-11 RE FERENCES FOR S ECTION C.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....... C-12 C.4 Hydrogen Combustion Prior to Reactor Vessel Breach . . . . . . . . . . . . . . . . . . . . . . . . . . . C-13 C.4.1 Issue Definition . . . .................................................. C-13 C.4.2 Technical Bases for Issue Quantification . . . . . . . .......................... C-15 i C.4.3 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . ................... C-21 REFERENCES FOR SECTION C.4 . . .... .. .. ... ............... ..... .... .. C-29 C.5 PWR Containment Loads During High-Pressure Melt Ejection . . . . . .......... ..... C-30 ) C.5.1 Issue Definition . . . .................. ..... .......... ........ C-31 ! C.S.2 Technical Bases for Issue Quantification . ...... ........ ............... C-37 ; C.5.3 Treatment in PRA and Results . ... . .... .. ... . .. . .. ........ C-45' REFERENCES FOR SECTION C.5 . .. ..... ............................... ...... C-50
., 84 C.6 Mechanisms for PWR Reactor Vessel Depressurization Prior to Vessel Breach . . . . . . . . C-51 C.6.1 Issue Definition . . . ....... .... ....... ........................... C-51 ;
C.6.2 Technical Bases for Issue Quantification . .... ...... .................... C-52 C.6.3 Treatment in the PRA and Results ......... ...... ............ ...... C-56 REFERENCES FOR SECTION C.6 . . ..... .. . .... ... . ....................... C-59 1 C.7 Drywell Shell Meltthrough . .... .. .. . ............................. . C-60 C.7.1 Issue Definition . . . . ................................. .... . . . . . . . C-60 C.7.2 Technical Bases for Issue Quantification . . . . . . ..................... .. C-63 C.7.3 Treatment in PRA and Resuks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-66 REFERENCES FOR SECTION C.7 . . .... . ...... ....... ....... .. .... C-69 C.8 Containment Strength Under Static Pressure Loads . . . . . . . . . . . . . . . . . . . . . . - . . . C-70 C.8.1 Issue Definition . .. . ... .... . . ............................. C-70 C.8.2 Technical Bases for Issue Quantification . . . . . ... ... ..... ....... ..... C-71 l C.8.3 Treatment in PRA and Results . . . ... ..... ..... .............. ..... C-77 REFERENCES FOR SECTION C.8 . . . ... . ....... . .. .... .. . C-80 C.9 Containment Failure as a Result of Steam Explosions . ............ . . . ..... C C.? 1 Issue Definition . . .. .. .... ... ........ ... C-82 l - iii - NUREG-1150
C.9.2 Technical Bases for Issue Quantification . . . . . . . . . . . . . . . . . ........... .. C-85 C.9.3 Treatment in PRA and Results . . . ....... ... . . ...... . ..... . .. C-87 REFERENCES FOR S ECTION C.9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-90 C.10 Source Term Phenomena . . . . . . . . . . ..... ......... .. ... ....... . ... ... C-91 C.10.1 Issue Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ........... ... . C-91 C.10.2 Technical Bases for Issue Quantification . .................. .. ...... ... C-92 C.10.3 Treatment in PRA and Results . . . . ........... .. ..... . . . ......... C-92 REFERENCES FOR SECTION C.10 . . . .................. ...... ......... .. .. .. C-100 C.11 Analysis of Seismic Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-101 C.11.1 Issue Definition . . . . . ........ . ...... ............... ............ C-101 ! C.11.2 Treatment in PRA and Results . . . . . . . . . . . . . . . . . . . . . . . . . . . ....... C.112 l REFERENCES FOR S ECTION C.11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . ..... ... C--118 l l ! l I LIST OF FIGURES
]
l C.1.1 Example of NUREG-1150 " issue decomposition" ... ...... .... .. .... C-2 C.4.1 Cross-section of Sequoyah containment ...... . .. ..... . .. .. .. . C-17 C.4.2 Cross-sectior, of Grand Gulf containment . . . . . . .. .. . ... .. .... . .... C-18 C.4.3 Ignition frequency as a function of initial hydrogen concentration in the Grand Gulf containment building (outer containment-wetwell region for accident progressions in which the RPV is at high pressure) . . . . .... .......... .... ....... .. C-19 C.4.4 Ignition frequency for various regions of the Sequoyah containment-illustrated for
]
an assumed initial hydrogen concentration between 5.5 and 11 volume percent . . ... C-20 ; C.4.5 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and high initial steam concentrations) . . . .....
..... .. .... ...... ........... .. ...... C-22 C.4.6 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations anc: low initial steam concentrations) . .... . .......
.... .. ...... ........ . ..... .. .. C-23 C.4.7 Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (fast station blackout scenarios with various levels of in-vessel cladding oxidation). . . .. .. ...... . . . .. .. .... . C-24 C.4.8 Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (slow station blackout accidents with induced reactor coolant pump seal LOCA and various levels of in-vessel cladding oxidation) '. . . . C-25 C.4.9 Frequency of hydrogen detonations in Grand Gulf containment (probability of a detonation per combustion event-i.e., given ignition). H and L refer to high and low steam concentrations. respectively . . . ... .. . . . . ... C-26 NUREG-1150 - iv -
l C.4.10 Frequency of hydrogen detonations in Sequoyah ice condenser or upper plenum (probability of a detonation per combustion event) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-27 C.S.1 Cross-section of Surry Unit 1 containment . ......... 4 . . . . . . . . . . . . . . . . . . . . . . . C.32 C.5.2 Cross-section of Zion Unit 1 containment ..................................... C-33 C.S.3 Calculated containment peak pressure as a function of molten mass ejected (Ref. C.S.8). . . . . . . . .. .. ............................................... C-36 C.S.4 Example display of distributions for containment loads at vessel breach versus static failure pressure . . . . . ....... .......... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..... C-39 C.5.5 Surry containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity) . . . . . . . . . . . . . . . . . . . . . . . . . C-40 C.5.6 Surry containment loc S v vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry c'.vity) . . . . . . . . . . . . . . . . . . . . . . C-41 C.S.7 Suny containment load distributions generated by composite of individual experts for each of the cases shown in Figure C.5.5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-42 C.S.8 Zion containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity). . . . . . . . . . . . . . . . . . . . . ..... C-43 C.5.9 Zion containment loads at vessel breach: cases involving vessel breach at high pressure without containment sprays operating (dry cavity) . . . . . . . . . . . . . . . . . . . . . . . C-44 C 5.10 Sequoyah containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (wet cavity) and a substantial inventory of ice remaining. . . ............................ . . . . . . . . . . . .. .. C-46 C.5.11 Sequoyah containment loads at vessel breach; cases involving vessel breach at high I l pressure without containment sprays operating (dry cavity) and a substantialinventory of ice remaining. . .. .. . ............................................. C-47 C.5.12 Sequoyah containment loads at vessel breach; cases involving vessel breach at high pressure without contahment sprays operating.(dry cavity) and a negligibly small inventory of ice remaming. . . .......................................... C -48 i C.6.1 Aggregate distribution for frequency of temperature-induced hot leg failure (Surry, Zion, and Sequoyah) . . . . . . .. ...... ............... . . . . . . . . . . . . . . ...... C-54 C.6.2 Aggregate distributions for frequency of temperature-induced steam generator tube ruptur . . ... ....... . .............. . . . . . . . . . . . . . . . . . . . . . . . . . . .. . ...... C-55 C.7.1 Configuration of the Peach Bottom drywell shell/ floor-vertical cross-section. . . . . . . . . . C-61 C.7.2 Configuration of the Peach Bottom drywell shell/ floor-horizontal cross-section. ...... C-62 C.7.3 Aggregate cumulative conditional probability distributions for Peach Bottom drywell shell meltthrough. . . . .. . .. . ....... . . . . . . . . . . . . . . . . . . . . . . . . . . . ...... C-65
)
C.7.4 Cumulative probability distributions composite of individuals on expert panel for this ! issue. (Six panelists (6 curves) are shown for each of four cases.) . . . . . . . . . . . . . . . . C-67 ) C.8.1 Containment failure pressure ...... . ..... . . . . . . . . . . . . . . . . . . . . . . . ...... C-73 i i
-v- NUREG-1150 l I
I i u
C.9.1 Frequency of alpha-mode failure conditional upon core damage . . . . . . . . . . . . . . . . . . . C-89 C.10.1 In-vessel release distribution, PWR case with low cladding oxidation . . . . . . . . . . . . ... C-94 C.10.2 RCS transmission fraction, PWR case at system setpoint pressure . . . . . . . . . . . . . . . . . C-95 C.10.3 RCS transmission fraction, PWR case low system pressure. . . . . . . . . . . . . . . . . . . . . . . . . C-96 C.10.4 Revaporization release fraction for iodine, PWR case with two holes in the reactor coolant system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ... .. C-99 l C.11.1 Model of seismic hazard analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . ................. C-103 C.11.2 LLNL hazard curves for the Peach Bottom site . . . . . . . ........... ........... C-105 C.11.3 10.000-year return period uniform hazard spectra for the Peach Bottom site . ....... C-106 C.11.4 Example of logic-tree format used to represent uncertainty in hazard analysis input (EPRI program) . . . . . . . . . . . . . . . . .............................. C-107 C.11.5 EPRI hazard cun'es for Peach Bottom site. . . . . ....... .. .. ...... .......... C-108 C.11.6 Surry external events, core damage frequency ranges (5th and 95th precentiles) . . . . . . C-110 C.11.7 Peach Bottom external events, core damage frequency ranges (5th and 95th pre c e ntile s) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C- 1 1 1 C.11.8 Contribution from different earthquake ranges at Peach Bottom . . . .... .......... C-116 C.11.9 Mean plant level fragilities . ...................... .... .. .. ............. C-117 l l I 1 LIST OF TABLES C.2.1 Beta factor analysis for pumps-based on Fleming data. . . ........ .............. C-6 C.2.2 Beta factor analysis for valves-based on Fleming data. . . . . .......... ........ C-6 C.2.3 Beta factor models from EPRI-NP-39 67. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-7 C.2.4 Risk-reduction measures for selected common-cause events in the Surry a'nd Peach Bottom analysis. . ... .............................. .. ............ C-8 C.2.5 Results of sensitivity study in which common-cause failures were eliminated from fault trees. . . . . ....... ...................... ................... ... . C-8 C 3.1 Representative ranges of human error uncertair. des (taken from Grand Gulf a n a lysis) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . ..... C-11 C.3.2 Core damage frequencies with and without human errors. . . . . . . . . . . . . . . . . .... C-12 C.S.1 Mean conditional probability of containment failure for three PWRs. ............. C-49 NUREG-1150 - vi -
1 l I 1 I i i C.6.1 Surry reactor vessel pressure at the time of core uncovery and at vessel breach. . . . . . . C-57 l C 6.2 Surry reactor vessel pressure at the time of core uncovery and at vessel breach (sensitivity study without induced hot leg failure and steam generator tube ruptures) . . . C-57 C.6.3 Fraction of Surry slow blackon accident progressions that result in various modes of containment failure (mean values) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-58 C.6.4 Fraction of Sequoyah accident progressions that result in HPME and containment overpressure failure . . . . . ...................................... ......... C-58 C 7.1 Probability of drywell shell meltthrough (conditional on a core damage accident of various types) .... ............................. ................... .. C-68 C.8.1 Containment strength under static pressure loads: summar" information. . . . . . . . . . . . . C-79 C.10.1 APS reconimendations for source tet . research (Ref. C.10.3) . . . . . . . . . . . . . . . . . . . . C-91 C.10.2 Source term issues . . . . . . . . . . . . . . . . . . . . . . . . ......... ...... ............ C-93 C.11.1 Seismic core damage and release frequencies from published probabilistic risk assessments ....... .......... .. ...... .. .......................... C-102 C.11.2 Core damage frequencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-114 i C.11.3 Comparison of contributions of modeling uncertainty in response, fragility, and hazard curves to core damage frequency . . . . . . . . . . . . . . . . . . . . ......... .. C-114 1 C.11.4 Dominant sequences at Peach Bottom . . . . . . . . . . . . . . . . . . . . . . . . . . ............ C-115 j
- vii - NUREG-1150
;\
Appendix C C.1 Introduction It is well known that the methods of probabilistic risk assessment (PRA) have many kinds of uncertainties associated with them. To a varying extent, these uncertainties contribute to the imprecision in the esti-mates of risk to public health ar.d safety from nuclear reactor accidents. The NRC contractor work under-lying this report (Refs. C.1.1 through C.I.14) addresses many of these uncertainties and quantifies their impact on selected measures of risk. The method to incorporate uncertainties in the quantification of reactor risk involves identifying uncertainty " issues." In this context, an issue is a physical parameter, process, or event that cannot be characterized precisely but is potentially important to the frequency of core damage or to Fevere accident progression. Examples are operator error rates, hydrogen generation during core meltdown, and direct containment heating. The total number of issues that was considered in the present analyses is quite large. A complete descrip-tion of all issues is available in the contractor reports. This appendix summarizes the way in which a few important issues were treated in the five PRAs addressed in this report. In this context, "important" refers to subjective judgments made by the NRC staff and its contractors (based on results of the detailed analyses) that a particular issue has substantial influence on the quantification of risk. The objective of these descriptions is twofold: 1 1. To provide an answer to the following question: What aspects of the knowledge base supporting probabilistic risk assessment for -"iclear power reactors are the principal contributors to our inability to precisely calculate risk?
- 2. To describe how areas known from previous work to have substantial uncertainty were addressed in the analyses described in NUREG-1150.
It should be noted that issues contributing to the uncertainty in risk are not necessarily signi.ficant con-tributors to a particular estimate of reactor risk. For example, issues that are threshold in nature (e.g., those governing the outcome of an event that either occurs or does not occur) can be important contribu-tors at one end of the spectrum of risk estimates, yet be an insignificant contributor to risk estimates at the opposite end of the spectrum. Such issues may not even be a major contributor to the mean value of risk. It is important to identify these issues-particularly those that contribute to estimates of risk near the high end of the spectrum. Improvements in the precision with which reactor risk analysis can be performed may be achieved by focusing future research on topics that are major contributors to the uncertainty in risk. Confidence that a selected measure of reactor risk is below some value can be improved by focusing research on topics that contribute to estimates of risk near the upper end of the spectrum. Issues important to risk uncertainty are described in the following sections, which are organized in a l similar fashion. First, an issue is defined in the context of its application within the risk analyses in this study. Since most issues are relatively high-level representations of uncertainty (i.e., they represent a composite of several interrelated sources of uncertainty), the specific source (s) of uncertainty included , within each issue are delinme i as part of the definition. The process of characterizing the contributing factors to the uncertainty associatec' with an issue is termed " issue decomposition." An example of issue j decomposition is provided in Figure C.1.1, which considers the hypothetical issue of containment bypass. ; Underlying this hypothetical issue are a variety of more basic events and processes. Each of these may have an associated uncertainty. Quantification of the uncertainty associated with the main issue, therefore, involves the aggregation of uncertainties of several interrelated items. This process can become quite complicated and is not addressed in detail in this appendix. A summary of each issue's quantification and the technical basis that supports this quantification is provided. For greater detail regarding issue decom-position and quantification of individual contributors to uncertainty, the reader is referred to References C.1.1 througn C.1.7 for issues related to estimating core damage frequency and References C.1.8 through C.1.14 for issues related to accident progression and consequences. Finally, the manner in which an issue was incorporated in the PRA(s) is described. Results of statistical analyses and other indicators of an issue's importance to risk uncertainty are presented. C-1 NUREG-1150
Appendix C Containment Bypass 4 N b k 4 N Pre-Existing Induced Steam Generator Isolation Isolation Tube Rupture Failures Failures ! a 6 a 6 d ' Test and Initiating
- Trans,ents i - -
Maint. Errors Events Indication Water Result of - Failures Hammer Core Damage g Random Thermal-Hydraulic. Failures Aspects Operator Actions Figure C.1.1 Example of NUREG-1150 " issue decomposition." NUREG-1150 C-2
Appendix C 4 REFERENCES FOR SECTION C.1 C.1.1 D.M. Ericson, Jr., (Ed) et al., " Analysis of Core Damage Frequency: Methodology Guidelines," Sandia National Laboratories, NUREG/CR-4550, Vol. 1, Rev. 1, SAND 86-2084, to be published.* C.1.2 T.A. Wheeler et al., '" Analysis of Core Damage Frequency from Internal Events: Expert Judg-ment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2 SAND 86-2084, April 1989. C.1.3 R.C. Bertucio and J.A. Julius, " Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Rev.1, SAND 86-2084, to be published.' C.1.4 A.M. Kolaczkowski et al., " Analysis of Core Damage Frequency: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4550 Vol. 4, Rev.1, SAND 86-2084, to be published.* C.1.5 R.C. Bertucio and S.R. Brown, " Analysis of Core Damage Frequency: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 5, Rev.1, SAND 86-2084, to be published.* C.1.6 M.T. Drouin et al., " Analysis of Core Damage Frequency: Grand Gulf Unit 1," Sandia National ~ Laboratories, NUREG/CR-4550, Vol. 6. Rev.1, SAND 86-2084, to be published.* C.1.7 M.B. Sattison and K.W. Hall, " Analysis of Core Damage Frequency: Zion Unit 1," Idaho Na-tional Engineering Laboratory, NUREG/CR-4550. Vol. 7 Rev.1 EGG-2554, to be published.' C.1.8 E.D. Gorham-Bergeron et al., " Evaluation i Severe Accident Risks: Methodology for the Acci-dent Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analyses," San-dia National Laboratories, NUREG/CR-4551, Vol.1, Draft Revision 1, SAND 86-1309, to be published.* C.1.9 F.T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major Input Parame-ters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2. Draft Revision 1, SAND 86-1309, to be published
- C.1.10 R.J. Breeding et al., " Evaluation of Severe Accident Risks: Surry Unit 1," Sandia National Labo- l ratories, NUREG/CR-4551. Vol. 3, Draft Revision 1, SAND 86-1309, to be published.'
C.1.11 A.C. Payne, Jr., et al., " Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia i National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND 86-1309, to be published.' C.1.12 J.J. Gregory et al., "Evalution of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 5, Draft Revision 1, SAND 86-1309, to be published.' j C.1.13 T.D. Brown et al., " Evaluation of Severe Accident Risks: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1, SAND 86-1309, to be published.* C.1.14 C.K. Park et al., " Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National i Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.' l l
- Available in the NRC Public Document Room. 2120 L Street NW., Washington, DC.
C-3 NUREG-1150 ; l
--l
)
Appendi:t C C.2 Common-Cause and Dependent Failures Since the completion of the Reactor Safety Study over 10 years ago, more than 25 PRAs have been completed. These PRAs and other reliability analyses performed on nuclear power plant systems indicate that among the major contr;butors to the estimated total frequency of core damage are events that involve dependent failures. Dependent failures are failures that defeat the redundancy or diversity in engineered plant safety systems. In the absence of dependent failures, separate trains of a redundant system, or diverse methods of providing the same safety function, may be regarded as independent. However, actual operating experience indicates that not all components of redundant systems are free from dependent failures; simultaneous failure of similar independent components occur as a result of a common cause. Such failures occur infrequently, and their interdependence can be very subtle. As a result, dependent failure data are too sparse to accurately estimate common-cause failure rates for many types of compo- i nents. Also, dependent failure rnechanisms are often plant specific in nature, further limiting the availabil- ' ity of directly usable data. System analysts generally try to include explicit dependencies in the basic plant logic model (i.e., in the structure of the lault and event trees). Functional dependencies arising from the reliance of front-line systems on support systems, such as emergency coolant injection on service water or on electrical power, are examples of types of dependent failures that are usually modeled as an integral part of the fault and event tree structure. Interaction among various components within systems, such as common maintenance or test schedules, common control or instrumentation circuitry, and co-location within plant buildings (common operating environments), are often included as basic events on system fault trees. Even though the fault and event tree models include the major dependencies that have been identified, in some cases it is not possible to identify the specific mechanisms of common-cause failure from the available data bases (e.g., Licensee Event Reports-LERs). In other cases, where there can be many different types of common-cause failure, each with low probability, it is not practical to model each type separately. A relatively simple method is often used to account for the collective contribution of these residual common-cause failures to system or component failure rates. The method correlates the common-cause failure rate of multiple similar components to the failure rate of a single component of the same type. This method, known as the modified beta factor method (Ref. C.2.1), was applied in the system analyses for this study. Quantification of the beta factors (the common-cause failure rate correlation parameters) for important components is based on limited data and was treated as an uncertainty issue. C. 2.1 Issue Definition The scope of this issue is the group of common-cause failure rate correlation parameters used in this study, which are based on the data and model from Fleming et al. (Ref. C.2.2) and Atwood (Ref. C.2.3). The Fleming report is used as a basis for beta factors for common-cause faults invoking the failure of two out of two components. Quantification of higher order common-cause events, such as three of three or four of four, is based on an additional set of multipliers [i.e., those developed by Atwood (Ref. C.2.3)]. These multipliers are applied to the beta factors to calculate failure rates for higher order common-cause faults. The higher order multipliers are not treated specifically in this issue; but because the quantifiable estimates of higher order common-cause failures are functions of Fleming-based data factors, the treat-ment of the beta factors in this issue will also affect the higher order factors. The uncertainties associated with this issue center on the appropriateness, robustness, and interpretation of the Fleming data.A beta factor represents that fraction of component faults that could also result in faults for similar components in the same service. It is also the conditional probability of a component failure, given that a similar compo-nent has failed. Such failures are concurrent, or approximately so, and are not due to any other compo-nent fault. Mathematically, Fleming's data are manipulated to derive beta factors defined by E = A / (A+B), where A=Nu + W,N pe +1 B=N oi +WNi pi +1 NUREG-1150 C-4
l l l Appendix C l e N,c = number of actual component failures due to common cause. Npe = number of potential
- component failures due to common cause.
N,3 = number of actual independent failures. N pi = number of potential independent failures. W j, W =e weighing factors for considering potential failures as actual failures. Not all common-cause beta factors used in the present analyses are based on the Fleming report because either a more component-specific analysis existed elsewhere or the Fleming report did not analyze data for certain components. The beta factors not based on Fleming's work, are: e Batteries e Air-operated valves e Diesel generators e Standby liquid control pumps C.2.2 Technical Bases for Issue Quantification The results of the common-cause beta factor statistical analysis of the Fleming data are shown on Table C.2.1 for pumps and Table C.2.2 for valves. Using Fleming's model, 5th, 50th, and 95th binomial confi-dence intervals were calculated to measure the uncertainty in the data. The Fleming model weights the potential failures by a factor of 0.1 (i.e.,10 percent of potential failures evolve into actual failures). The importance of considering potential failures in quantifying common-cause beta factors was examined in a sensitivity study that examined two extreme cases. The first (denoted Ea) case assumed all potential failures become actual component failures (W,, Wi = 1.0); the second (denoted Ed) case assumed no contribution from potential failures (We , W, = 0.0). The impact of these assumptions on the median value of the common-cause beta factor for each of several components is indicated in Tables C.2.1 and C.2.2. The p, and so values are not always respectively higher and lower than the base case values. This is because the assumption to disregard or fully credit potential events also affects the denominator of the Fleming model, which includes terms for potential common-cause and independent failures. Expert judgment was elicited from two experienced system analysts regarding the uncertainty in beta factor estimates due to potential misclassification of available data: Alan Kolaczkowski-SC we Applications International Corp. Arthur Payne-Sandia National Laboratories Their consensus is that this uncertainty is adequately accounted for in current models. Their rationale is as follows:
- 1. Inclusion of Potential Failures in Data Base The p, and se factors on Tables C.2.1 and C.2.2 indicate that the inclusion of potential common-cause and independent failures in the data base does not represent a significant source of model uncertainty. The most significant impact of assuming that all potential events in the data are actual failures is an increase by a factor of 2.9 (service water system pump). There is almost no impact of dele 4ng all potential failures from the data base.
- 2. Classification of Independent Failures The beta factor model is highly sensitive to the number of independent failures. This number domi-nates the denominator of the beta factor equation. A factor of n increase in the number ofindepend-ent failures would result roughly in a factor of n decrease in the beta factor. A factor of n decrease in independent failures would have the inverse effect. It seems highly unlikely that the data classifica-tion could be so erroneous that enough independent failures could have been miscategorized to create significant error in the parameter estimates.
' Potential failures involve components that are capable of performing their functions, but exhibit a degraded performance or an incipient condition which, if not corrected, could lead to failure. C-5 NUREG-1150
-1 Appendix C
( 1 Table C.2.1 Beta factor analysis for pumps-based on Fleming data. Pumps Binomial Confidence Intervals Data
- j 5 50 95 N,c N pe N,3 N pi LPCI/LPCS/RHR S 0.10 0.15 0.25 7 4 40 27 pa 0.16 d 0.13 PWR Safety Injection p 0.15 0.21 0.26 15 4 59 18 ;
- p. 0.20 <
pd 0.21 PWR Aux. Feedwater p 0.036 0.056 0.093 9 6 107 11
- p. 0.079 pd 0.053 PWR Containment Spray p 0.047 0.11 0.25 2 2 25 7 pa 0.14 i Ed 0.11 J
Service Water / p 0.012 0.026 0.065 2 10 til 4 - Component sa 0.075 / Cooling Water Ed 0.026 p = Beta factor pa = Beta factor calculated by weighting all potential failures (Npe , Npi)at1.0. pd = Beta Factor calculated by weighting all potential failures from the model.
'See text for definition of terms.
Table C.2.2 Beta factor analysis for valves-based on Fleming data. l 1 Valves Binomial Confidence Intervals Data
- 5 50 95 N,c N pc N,i N pi Motor-Operated Valves s 0.08 0.09 0.11 72 43 778 64
- p. 0.12 d 0.08 Safety Relief Valves s 0.022 0.07 0.30 0 0 11 19 (PWR) p. 0.03 pd 0.0*
Relief Valves s 0.16 0.22 0.28 27 23 107 29
- p. 0.27 Od p = Beta factor
@a = Beta factor calculated by weighting all potential failures (N pe . Np j ) at 1.0.
d = Beta Factor calculated by weighting all potential failures from the model.
'See text for definition of terms.
NUREG-1150 C-6
' Appendix C
- 3. Classification of Common-Cause Failures A sensitivity analysis was performed to examine the impact of reclassifying common-cause data. In this analysis, Fleming's common-cause data were assumed to have been miscategorized by a factor of two (i.e., the observed failures were assumed to be common cause in nature twice as often or, alternatively, half as often as categorized by Fleming). The resulting range of beta factor values for these cases fell well within the uncertainty ranges of the current models (Ref. C.2.4). As a result, the experts whose judgments were elicited on this issue believe it unreasonable that the data could have been misinterpreted to such an extent that current models inadequately represent this uncertainty.
Because it is unlikely that significant misclassifications of events have occurred, the experts believe that the distributions for common-cause beta factors are peaked near the median and fall off rapidly from the median. Given the lack of information and historical insensitivities of the accident sequence analysis results to the actual distribution selected, the experts believe that the lognormal distributions indicated on Table C.2.3 adequately characterize the data and modeling uncertainties for this issue. C.2.3 Treatment in PRA and Results The beta factors described above were used in the quantification of the system fault trees for each plant. An indication of the importance of individual common-cause and dependent failures in the fault tree analysis for these plants is the decrement by which the total core damage frequency wo :ld be reduced if these failures were not to occur. This decrement -(known as the risk-reduction measure) a shown in Table C.2.4 for selected common-cause events in the Surry and Peach Bottom analyses. Note that several of the common-cause events shown in Table C.2.4 were not quantified using Fleming's data (e.g., diesel genera-tor failures). For these events, plant-specific information was used when available. A complete listing of the risk-reduction measures is provided in References C.2.5 through C.2.9. Table C.2.3 Beta factor models from EPRI.NP-3967. i Pumps Mean Factor Valves Mean Factor Low-Pressure Coolant Injection 0.15 3 Motor Operated 0.088 3 Low-Pressure Core Spray 0.15 3 Safety Relief (PWR) 0.07 3 Residual Heat Removal 0.15 3 Relief (BWR) 0.22 3 High-Presure Safety 0.21 3 PWR Aux. Feedwater 0.056 3 (Motor-driven) PWR Containment Spray 0.11 3 Service Water / Component 0.026 3 Cooling Water Systems , All distributions are assumed to be lognormal. The collective contribution of common-cause failures to the mean total core damage frequency was inves-tigated by performing a sensitivity study in which all beta factors were assigned a single (point estimate) value of 0.0 and the core damage frequency distribution was recalculated. The results of this analysis are summarized in Table C.2.5, which shows the extent to which the mean total core damage frequency for Surry, Sequoyah, Peach Bottom, and Grand Gulf are reduced when common-cause failures are eliminated. l l C-7 NUREG-1150 l .. .
~ Appendix C Table C.2.4 Risk-reduction measures for selected common-cause events in the Surry and Peach Bottom analysis.
Common Cause Event Mean Event Probability. Risk. Reduction Measure * - Surry (mean total core damage frequency = 4.01E-5) BETA-2MOV- 8 80E-2 2.72E-6 (failure of 2 motor-operated valves) BETA-3DG 1,80E-2 2.66E-6 (failure of 3 diesel generators) BETA-2DG 3.80E-2 2.25E-6 (failure of 2 diesel generators) BETA-LPI 1.50E-1 6.75E-7 (failure of multiple motor-driven pumps, low pressure injection) Peach Bottom (mean total core damage frequency = 4.50E-6). BETA-5 BAT 2.50E-3 1.97E-7 (failure of 5 station batteries) BETA-3AOVS 5.50E-2 9.75E-8 ; (failure of 3 air-operated valves) : BETA-4 DONS 1.30E-2 3.52E-8 (failure of 4 diesel generators) BETA-2SIPUMPS 2.10E-1 1.81E-8 I (failure of 2 safety injection pumps)
' Decrement by which the total core damage frequency would be reduced if this event were not to occur.
l 1 Table C.2.5 Results of sensitivity study in which common.cause failures were eliminated from fault trees. Base Case Sensitivity Study Percent ! Plant Analysis No Common.Cause Failures Reduction Surry 4.01E-5 3.08 E-5 23 : Sequoyah 5.72E-5 4.57E-5 20 Peach Bottom 4.50E-6 4.07E-6 10 Grand Gulf 4.05E-6 3.10E-6 .26 { REFERENCES FOR SECTION C.2 j C.2.1 Pickard, Lowe and Garrick, Inc., " Procedures for Treating Common Cause Failures in Safety and Reliability Studies. Procedural Framework and Examples," NUREG/CR-4780, Vol. 1, > EPRI-NP-5613, January 1988. i C.2.2 K.N. Fleming et al., " Classification and Analysis of Reactor Operation Experience involving De- I pendent Failures," Pickard, Lowe and Garrick, Inc., EPRI-NP-3967, June 1985. ! C.2.3 C.L. Atwood, " Common Cause Fault Rates for Pumps," EG&G Idaho, Inc., NUREG/CR-2098 EGG-EA--5289, February 1983. j C.2.4 T.A. Wheeler et al., " Analysis of Core Damage Frequency from Internal Events: Expert Judg-ment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, Part 2 of 2 " Project Staff," SAND 86-2084, April 1989. I NUREG-1150 C-8
Appendix C 4 l
\
C.2.5 R.C. Bertucio and J.A. Julius, " Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Rev.1, SAND 86-2084, to be published.* C.2.6 A.M. Kolaczkowski et al., " Analysis of Core Damage Frequency: Peach Bottom Unit 2." Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Rev.1, SAND 86-2084, to be published.* C.2.7 R.C. Bertucio and S.R. Brown, " Analysis of Core Damage Frequency: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4550 Vol. 5. Rev.1, SAND 86-2084, to be published.* C.2.8 M.T. Drouin et al., " Analysis of Core Damage Frequency: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 6, Rev.1. SAND 86-2084, to be published.* C.2.9 M.B. Sattison and K.W. Hall, " Analysis of Core Damage Frequency: Zion Unit 1," Idaho Na-tional Engineering Laboratory, NUREG/CR-4550, Vol. 7. Rev.1, EGO-2554, to be published.' 'Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC. l u , C-9 NUREG-1150
Appendix C C.3 Human Reliability Analysis Human performance has been found to be a dominant factor in major safety-related incidents at nuclear power plants, both in the United States and elsewhere. Examples include events such as those at Three Mile Island Unit 2, Davis-Besse, and Oyster Creek in the United States and at Chernobylin the U.S.S.R. In each of these, a complex interaction between humans and hardware led to a significant hazardous event and, in two cases, to offsite releases. Deficiencies in human performance occurred both before the initiation of the event, in areas such as maintenance, training, and planning, and in response to the event. One commonly used taxonomy of human error is to classify errors as slips, mistakes, and violatiom (Ref. C.3.1). Slips are errors where an intended action is not carried out, usually because of lapses in memory ! or lack of attention. Examples of slips include missing a step in a procedure or accidentally sekcting a wrong switch. Mistakes are actions performed in accordance with a plan that is inadequate for tha situ-ation. The plan may be inadequate because there is an error in diagnosing the type of event (e.g., "iook-alike" accidents) or because the type of event has not been considered in preparing the plan and is not part of the operators' experience and training; these mistakes are called " rule-based" and " knowledge-based" respectively. Violations are deliberate (but not necessarily blameworthy) deviations from practices thought necessary (by managers, designers, regulators, etc.) to maintain safety. Violations can be either routine (as in taking shortcuts) or exceptional (as in the case of Chernobyl). Exceptional violations may involve a wide range of local factors unique to each situation, but a common factor appears to be the existence of " double binds"-particular tasks or circumstances that make violations inevitable no matter how well-intentioned people may be. l Techniques have been developed for modeling some, but not all, of these types of human errors in PRAs. ) In particular, slips and rule-based mistakes are analyzed in the present analysis. Other types of errors have l not been addressed in this analysis, principally because no methods have been developed to provide < quantitative estimates of error rates for them. Those errors considered in this study, and the methods for modeling them, are discussed below. C.3.1 Issue Definition Human reliability was not enalyzed as a separate issue, per se, in these analyses; that is, the influence of alternative methods, models, or data were not evaluated. Rather, uncertainty distributions of the individ-ual failure probabilities were estimated using standard human reliability methods. These failure probabili-ties were incorporated in the accident sequence quantifications. In most cases, human errors were modeled as failures of people to take actions specified in procedures, including maintenance procedures, operating procedures, and emergency operating procedures. In a few cases, innovative actions were identified as ways to arrest sequences prior to the onset of core damage; failure probabilities for such actions were estimated. There were no evaluations of the consequences of mistakes, as in "if the operators mistook scenario A for scenario B, then they would ...." The kinds of human actions represented in the analyses included human errors before the onset of an accident and errors and recovery actions following the start of an accident. The pre-accident errors are mostly failures by test and maintenance personnel to restore components to operation following mainten-ance (hence, rendering a system unavailable) or miscalibration of multiple sensors, such as containment pressure or reactor level sensors (hence, failing automatic initiation signals at the correct setpoint). Other pre-accident errors are failures of operators to perform tests correctly, such as failing to restore the standby liquid control system after testing, resulting in its being unavailable in the event of a demand. Post-accident failures are almost entirely failures to initiate or control emergency core cooling systems (ECCS), control rods, the standby liquid control system, etc., or their critical support systems, following their failure to start or run automatically during an accident. Examples include recovering the operability of failed diesel generators and arranging crossconnections of service water systems between units following single-unit failures. In addition, a small number of actions must be performed manually during certain accidents to prevent core damage; these are not simply starting systems that failed to start automatically. NUREG-1150 C-10
Appendix C An example is the changeover from high-pressure injection to recirculation cooling following depletion of the refueling water storage tank (RWST) during loss-of-coolant accidents at some PWRs (e.g., Sequoyah). C.3.2 Technical Basca for Issue Quantification Quantitative estimates were made for the likelihoods of human errors using documented human reliability models. Failures in test and maintenance actions are almost entirely slips, as are errors by operators in misselecting controls or misreading indicators. This kind of error was quantified using a simplified version of the technique for human error rate prediction (THERP) (Ref. C.3.2). The original THERP method (Ref. C.3.3) was developed and applied in the Reactor Safety Study to model human errors that can be analyzed using a task analysis (a step-by-step decomposition of an activity into simple items, such as " read meter," " turn switch," etc.). The Tl!ERP documentation provided a data base and rules of application for this approach to human reliability analysis. In the simplified approach developed for this study, bound-ing values were initially assigned for overall tasks, such as " restore pump," without performing a task analysis. A nominal failure probability of 3E-2 was assigned for all pre-accident failures, with adjustments made for factors such as people performing independent checks and the use o.f written verification sheets. Each of these factors reduced the nominal value by a factor of 10. Hence the existence of three factors would reduce the failure probability from 3E-2 to 3E-5. The post-accident actions were categorized as to whether misdiagnosis of the plant state was considered credible. Misdiagnosis was not considered credible for manual scrams following failure of the automatic scram system, where operators are well trained and written procedures exist. Misdiagnosis would be a l rule-based mistake; it is where the operators fail to recognize the condition of the plant and respond with an inappropriate strategy. These misdiagnosis errors were quantified using a time-reliability correlation described in Reference C.3.2. A time-reliability correlation provides an estimate of failure probability based on a time available for operators to take action followmg the onset of an event; this is a commonly used type of technique for this type of error. Examples of this technique include the Operator Action Tree 1 (OAT) method (Ref. C.3.4) and the Human Cognitive Reliability (HCR) method (Ref. C.3.5). Post-acci-dent errors other than rule-based mistakes were slips and were evaluated using the same method as the pre-accident errors. These human reliability techniques provide single best estimate values with associated ranges of uncertain- j l ties. Table C.3.1 shows representative errors and associated uncertainty ranges used in the Grand Gulf accident sequence analysis. l Table C.3.1 Representative ranges of human error uncertainties (taken from Grand Gulf analysis). Error Uncertainty l Human Error Rate
- Range
- Common-mode miscalibration of instrument 2.5 E-5 10 Failure during isolation and repair of pump 3.0 E-5 16 Operator fails to initiate IcVel control (ATWS) 1.0 E-3 5
- Error rates and uncertainty ranges are expressed as the median and error factors of the distributions used in the sequence -
quantification. j C.3.3 Treatment in the PRA and Results In this analysis, as in most published PRAs, human errors are most commonly represented in the system ! fault trees (much like component failures within systems), in the event trees (representing procedural actions), and in the recovery analysis of accident sequence cut sets. Therefore many human errors are ; scattered throughout the system analysis models. 1 A small number of operator actions are represented in event trees. These are where a single action has a direct effect on the progression of an accident, as in the case of manual depressurizatian of a PWR to achieve " feed-and-bleed." Similarly, manual reactor trips are represented in ATWS-related event trees. C-11 NUREG-1150
Appendix C It is not possible to state what range of uncertainty in the core damage frequencies and other risk meas-ures results only from uncertainties in human reliability. However, analyses were performed to evaluate the sensitivity of core damage frequencies to human reliability values. These sensitivity studies were con-ducted by setting the human error probabilities for post-accident actions to zero and comparing the result-ing core damage frequencies to those for the base case analyses. Requantifying the core damage frequency with these human error probabilities equal to zero led to reductions in the range of 3.5 to 6.6-a signifi-cant potential reduction. These are summarized in Table C.3.2. The highest factor, 6.6 for Grand Gulf, resulted largely from eliminating all cutsets involving diesel failure, because zero human error implied perfect recovery of the failed cliesel. The core damage frequency for Grand Gulf is dominated by station blackout, and, hence, eliminating diesel failure results in a significant reduction in core damage fre-quency. It must be remembered that the calculated reduction in core damage frequency includes unrealis-tic equipment behavior as well as unrealistic human performance as a result of simplifying assumptions in the analysis. Specifically, " perfect" human repairs would be effective for only a subset of possible equip-ment failure modes. Recovery of diesel operability following major equipment damage within a short time is meaningless, regardless of the quality of the human performance. (To be more realistic, the analysis would require separating recoverable failure modes from unrecoverable failure modes and associating perfect recovery only with recoverable failure modes.) Table C.3.2 Core damage frequencies with and without human errors. Core Damage Frequency Factor of Plant Base Case No Errors Reduction Grand Gulf 4.1 E-6 6.2 E-7 6.6 Peach Bottom 4.5 E-6 9.5 E-7 4.8 Sequoyah 5.7 E-5 2.5 E-5 3.5 Surry 4.0 E-5 1.1 E-5 3.8 1 In a different sense, these calculated reductions in core damage frequency are an upper bound. During analyses such as this, recovery actions (human actions to terminate sequences prior to core damage) are identified only for sequences important to the total core damage frequency; this is done to simplify'the analysis and focus the analysts' efforts on the important factors in the analysis. Setting the human error probability to zero eliminates the initially dominant sequences that already include recovery actions, but j no reconsideration of recovery was evaluated for the remaining sequences that did not include recovery. It I is likely that recovery actions could be postulated in some of these sequences. Adding recovery actions to i these newly dominant sequences would yield further reductions in core damage frequencies. REFERENCES FOR SECTION C.3 C.3.1 J. Reason, Human Error, Cambridge University Press (UK), Draft, August 1988. C.3.2 A.D. Swain Ill, " Accident Sequence Evaluation Program Human Reliability Analysis Procedure," Sandia National Laboratories, NUREG/CR-4772, SAND 86-1996, February 1987 (with errata). C.3.3 A.D. Swain III and H.E. Guttmann, " Handbook of Human Reliability Analysis with Emphasis on . Nuclear Power Plant Applications," Sandia National Laboratories, NUREG/CR-1278 (Rev.1), ' SAND 80-0200, October 1983. C.3.4 R.E. Hall. J.R. Fragola, and J. Wreathall, " Post Event Human Decision Errors: Operator Action - , Tree / Time Reliability Correlation," Brookhaven National Laboratory, NUREG/CR-3010, .BNL-
'l NUREG-51601, March 1983.
)
C.3.5 G.W. Hannaman, A.J. Spurgin, and Y.D. Lukic, " Human Cognitive Reliability Model for PRA Analysis," Electric Power Research Institute, NUS-4531, December 1984. NUREG-1150 C-12
i Appendix C j 1
)
C 4 Hydrogen Combustion Prior to Reactor Vessel Breach , LWR fuel assemblies and core structures contain substantial quantities of metallic materials that oxidize when heated to sufficiently high temperatures (i.e., those calculated to accompany core meltdown acci-dents). Oxidation of these metals, principally Zircaloy and stainless steel, can liberate sufficient quantities of hydrogen to generate substantial containment loads if released to the containment building and allowed to accumulate and subsequently burn. It is estimated (Ref. C.4.1) that approximately 270-370 kg of hydrogen were generated and released to the containment during the accident at Three Mile Island Unit 2 (TMI-2). Combustion of this hydrogen during the TMI-2 accident resulted in a containment pressure spike of approximately 28 psig (peak pressure). Since the design pressure of the TMI-2 containment is approximately 60 psig, this pressure rise did not pose a serious threat to containment integrity. However, the pressure spike observed during the accident at TMI-2 provided much of the motivation for subse-quent changes in NRC regulations regarding containment hydrogen control (10 CFR 50.44). These changes involved hardware backfits for plants with pressure-suppression containments-BWR Mark I, II, and 111 and PWR ice condensers. The present analyses indicate that hydrogen combustion is a major contributor to the potential for early* failure of the Grand Gulf (BWR Mark 111) and Sequoyah (PWR ice condenser) containments. Both plants are equipped with a system of hydrogen igniters which, when operating, provide a distributed ignition source for hydrogen that would be released to the containment during a severe accid.ent. The intent of deliberate ignition is to allow hydrogen to burn at low concentrations (i.e., 4-6 v/o)," thereby generating relatively modest containment loads. This prevents hydrogen from accumulating and, if ignited at rela-tively high concentrations (greater than 8 v/o), generating static pressure or impulsive loads that could challenge containment integrity. The accident frequency analysis for Grand Gulf and Sequoyah indicates that accident sequences resulting in a loss of all offsite and onsite ac power are significant contributors to their mean total core damage frequency. Since the hydrogen igniters in both of these plants are ac-pow-ered, these accident sequences can be characterized by relatively high concentrations of hydrogen in the containment before vessel breach. Uncertainties associated with the distribution of hydrogen within the containment, the availability of igni-tion sources (when igniters are not operating), and the complex geometry of the Grand Gulf and Se-quoyah containment can generate a wide range of plausible containmes ads. These uncertainties can be I large even when the mass of hydrogen released to the containment is specified. For accident sequences during which igniters are not available (e.g., station blackout), combustion of hydrogen at high concentra-tions also raises the question of whether combustion takes place as a deflagration or detonation. In the forme , the speed of the traveling flame front is subsonic (relative to the unburned gas). The accompany-ing containment pressure response may be calculated using straightforward static thermodynamics. A l detonation, in contrast, involves a combustion wave that travels at supersonic speed (relative to the un-burned gas) and a dynamic response (shock wave) results. The type of combustion event that occurs can depend on many variables including hydrogen concentration at the time of ignition, combustible gas flow path and local geometry, and the composition of the containment atmosphere. In the present analysis, these uncertainties and parametric relationships were grouped together in a single uncertainty issue. This issue is described in the next section. The technical basis for generating the distri . bution of plausible containment loads due to hydrogen burns before vessel breach at Grand Gulf an-l Sequoyah is summarized in Section 2.4.2. C.4.1 Issue Definition Due to significant differences in containment configuration and other design features, this issue was posed in a slightly different way for each plant. However, in each case, the issue was posed to answer the l following two fundamental questions: ! I "Early" is defined as prior to or at the time of reactor vessel breach.
" Volume percent (or mole fraction).
C-13 NUREG-1150 l
Appendin C
- 1. What distributions characterize the uncertainty in the probability that hydrogen combustion will occur in the containment building prior to vessel breach?
- 2. Given that combustion occurs, what distributions characterize the uncertainty in the attendant peak static pressure and the maximum impulse loading (to the drywell wall for Grand Gulf and to the ice condenser walls for Sequoyah)?
The answers to these questions may depend on the accident scenario postulated. Therefore, a case struc-ture was established to distinguish the initial conditions associated with accident sequences found to be important contributors to a plant's estimated core damage frequency. The case structure also provides a convenient tool for applying the generated probability distributions to the Grand Gulf and Sequoyah PRAs (as described in Section C.4.3). i Containment loads due to hydrogen combustion in Grand Gulf represent e significant challenge to con-l tainment integrity only during station blackout accident sequences, during which the igniters 'are inoper-able. The case structure for Grand Gulf combustion loads, therefore, considers three variations of the station blackout accident sequence. These are summarized below: Steam Air- Containment Partial Partial - Sprays Operate Pressure Pressure ac Power After Power - Case (psia) (kPa) (psia) (kPa) Recovered? Recovery? 1 7 5 17 115 No No 2 7 50 17 115 Yes Yes
- 3 20 135- 18 120 Yes Yes
- Case 1 represents station blackout scenarios during which ac power is not recovered and a hydrogen burn is ignited spontaneously from a random ignition source. Cases 2 and 3 represent station blackout scenarios during which ac power is recovered prior to vessel breach; they differ from each other only in containment initial conditions. i Variations of station blackout are also the only accident scenarios in Sequoyah for which containment loads from hydrogen combustion represent a significant challenge to containment integrity. As in Grand Gulf, the ignition system is inoperable during these sequences; however, numerous " random" ignition sources are available in the Sequoyah containment. For example, sparks can be generated from move-ment of the intermediate deck doors in the ice condenser. The case structure for Sequoyah involves four ;
variations of station blackout accident sequences, each of which yields different thermodynamic initial conditions. These may be summarized as follows: Case 1: Station blackout; cycling power-operated relief valve (PORV) with the reactor pressure vessel at 2000-2500 psia. Case 2 Station blackout; loss of pump seal cooling induces failure (s) of one or more reactor coolant pump (RCP) seals, resulting in a relatively low leak rate. Case 3: Station blackout; loss of pump seal cooling induces failure (s) of one or more RCP seals, resulting in a relatively large leak rate. Case 4: Station blackout; high temperatures in the reactor vessel upper plenum induce a creep rupture failure of hot leg piping of sufficient size to rapidly depressurize the reactor vessel. For readers familiar with Reactor Safety Study (Ref. C.4.2) 1; nomenclature for labeling accident sequences, Case 1 is the classic TMLB' accident scenario. Case 2 represt nts accident scenarios similar sto S3B, Case 3 represents scenarios similar to SaB, and Case 4 represents scenarios similar to AB.
- Sprays are assumed to initiate approximately 90 seconds after Ignition.
NUREG-1150 C-14
Appendix C The following discussion of this issue only addresses the potential range of containment loads th-at may result from the combustion of hydrogen prior to reactor vessel breach for the Grand Gulf and Sequoyah plants. Containment response analyses for the other three plants addressed in the present work did con-sider hydrogen combustion in the evaluation of containment loads; however, the importance of early hydrogen combustion to the uncertainty in reactor risk for these plants is minor in comparison to that-observed in the Grand Gulf and Sequoyah analyses. Additionally, questions regarding safety concerns that may result from hydrogen combustion in the containment, such as equipment survivability, initiation of building fires, etc., are not part of this issue. C.4.2 Technical Bases for Issue Quantification The principal bases for quantifying the probability of hydrogen combustion during station blackout acci-dent scenarios and the accompanying containment loads are calculations performed with several computer codes. These include early calculations performed with the MARCH 2 code (Ref. C.4.3), more recent MARCH 3 analyses (Refs. C.4.4 and C.4.5), HECTR calculations of hydrogen burns in an ice condenser containment (Refs. C.4.6 and C.4.7), parametric analyses of Grand Gulf containment response to hydro-gen burns using MELCOR (Ref. C.4.8), and calculations performed in support of the IDCOR program (Ref. C.4.9). These calculations are supplemented by a large body of information, available in the open literature, which discusses the strengths and weaknesses of the models employed by these codes, the experimental evidence on which many of the models are based, and the sensitivity of calculated contain-ment loads to uncertain modeling parameters. The number of reports describing this information is too large to list here; however, a reasonably complete list is presented in References C.4.1 and C.4.10. 1 It is not uncommon for a relatively wide range of estimates of containment loads due to hydrogen combus-tion to be generated if several different analysts are asked to provide an estimate. Even for well-defined initial and boundary conditions (e.g., rate of release of a hydrogen / steam mixture to containment), the selection of different analytical tools and judgments regarding appropriate modeling parameters (e.g., j flame speed, burn completeness) inevitably results in significant differences in containment loads. Al-though the sensitivity of estimated containment loads to many important modeling parameters has been quantified in a fairly comprehensive fashion, an analyst's judgment is still required to select the combina-tion of parameters most appropriate to the particular problem being evaluated. To characterize the distribution of containment loads that reflects the current state of knowledge and uncertainties in hydrogen combustion modeling, this issue was presented to a panel of experienced severe accident analysts. For each plant, three analysts were asked to provide a distribution representing the probability that various mixtures of combustible gas, air, and diluents would ignite (in the absence of an operating igniter system) and a distribution for the attendant peak static pressure and/or maximum im-pulse. Participating in the Grand Gulf evaluations were: James Metcalf-Stone & Webster Engineering Corp., Louis Baker-Argonne National Laboratory, and Martin Sherman-Sandia National Laboratories. Participating in the Sequoyah evaluations were: Patricia Worthington-U.S. Nuclear Regulatory Commission, James Metcalf-Stone & Webster Engineering Corp., and
- Martin Sherman-Sandia National Laboratories.
The following discussion summarizes the collective judgment of the panels and selected individual assess-ments where significant differences in judgment were observed. Quantification of Ignition Frequency As indicated in the issue definition, there is some uncertainty regarding how and with what frequency a combustible mixture would ignite in the Grand Gulf or Sequoyah containment if the igniter system is inoperative. There is some evidence that the propensity for combustible mixtures to spontaneously ignite (because, for example, of the discharge of accumulated static charges) increases with increasing molar concentrations of combustible gas. The likelihood of spontaneous ignition of a given combustible gas concentration also increases with time. C-15 NUREG-1150
Appendix C An additional source of ignition during loss-of-ac-power accident scenarios in Sequoyah is the generation of sparks from movement of the intermediate and deck doors of the ice condenser. These doors, illus-trated in Figure C.4.1, are normally closed to isolate the ice compartment from warm regions of the containment. Under accident conditions, when steam or other primary coolant system effluents enter the bottom of the ice condenser, the doors open upward against their own weight. During severe accidents, gas flow rates through the ice condenser are not likely to be sufficiently high to hold all the doors open, and several doors may cycle open and shut as flow fluctuates. A comparable ignition source was not identified in the Grand Gulf containment building. Each panelist was asked to provide a distribution that represented his or her estimate for the probability that a given concentration of combustible gas would ignite in the absence of an operating ignition system. For the Sequoyah containment, separate distributions were elicited for the ice condenser (i.e., region below the intermediate deck doors), the ice condenser upper plenum (i.e., between the intermediate and top deck doors), and the containment upper compartment. Each of these regions are indicated in Figure C.4.1. Distributions were elicited only for the outer containment in Grand Gulf (illustrated in Fig. C.4.2). The composition of the gas mixture in the drywell region of the Grand Gulf containment will be noncombus-tible (i.e., absent of sufficient oxygen or hydrogen to support combustion) prior to vessel breach, thus precluding ignition. l The panel's aggregate distribution (arithmetic average of the panelists' clistributions) for Grand Gulf are l ; shown in Figure C.4.3. The frequency of ignition in Grand Gulf is strongly dependent on the initial ' concentration of hydrogen. The absence of a readily identifiable ignition source in Grand Gulf results in relatively low probabilities of ignition for !ow hydrogen concentrations. Ignition frequency in the Sequoyah containment (shown in Fig. C.4.4) is less sensitive to initial hydrogen concentration than to the region of containment being considered. The potential for sparks from ice condenser door movement results in generally higher probabilities of ignition in the ice condenser upper plenum than in other areas. Quantification of Containment Loads Due to Hydrogen Combustion As indicated in the issue definition, combustion loads are characterized for each of two possible events: deflagration and detonation. Loads accompanying a deflagration are characterized by a distribution for the attendant peak static pressure. Detonation loads are characterized by the maximum impulse (to the drywell wall for Grand Gulf and to the ice condenser walls for Sequoyah). The likelihood that a particular combustion event would result in a deflagration or detonation is described by a conditional probability distribution (i.e., given the occurrence of a combustion event, what is the probability that it takes the form of a detonation?). An aggregate distribution was generated for each permutation of cases (listed in Section C.4.1) and vari-ous ranges of plausible initial hydrogen and/or steam concentration. The ranges of initial conditions con-sidered were: Grand Gulf:
. Deflagration Loads:
<4%(H), 4-8%(H&L), 8-12%(H&L),12-16%(H&L),
e
>16%(H&L) e Conditional Probability of Detonation: 12-16%(H),16-20%(H&L), >20%(L)
Detonation Loads: >12%(H&L) Sequoyah:
. Deflagration Loads:
e Loads calculated in containment event tree' Conditional Probability of Detonation: 14-16%,16-21%, >21%
- Detonation Loads: >14%
Nomenclature: % refers to hydrogen mole fraction H refers to a "high" steam mole fraction (40-60%) L refers to a low" steam mole fraction (20-30%)
'I'ormula used to estimate peak static pressure is based on information provided by cxpert panelists. This formula is de-scribed in Reference C.4. ll.
NUREG-1150 C-16
i r Appendix C I i UPPAR PRESSURE
\
2 BOUNDARY COMPARTMENT W \
/. Y x
f I I ! I' UPPER PLENUM j g 3 l g 3 , g 3 'y>;y j INTERMEDIATE 2 {. - g gj / DECK DOORS S-
-w~ x , < _ . . _ .
c
-- ' 5 ...srj - ** y' 1 j ' ;i ICE
[! y , f
~~
h i
~
j ,- CONDENSER 2 o : ; -- -c b E i b $ 2 a a (
. ,.5 l 5 r f 5, o e
'G,i \[]n a 1 J
s ][~i.0 D' i - F )j j, !! , , , s _ F:
@L >
? /
e i i s . C, 4
~r~ -' . . . ,2 ii ~g[T x, '/ %
/ i O W:1S i k ' . .
s v Y
-'
- a 6 N LOWER k$:o0 f*
8 *,4 a
*b o.c _
CO M PART MENT , l iegg
! *"'" i e c?Ne&%'kb Figure C.4.1 Cross-section of Sequoyah containment.
C-17 NUREG-1150
i l i
. Appendix C
'1 J
. i.
1 i . . g ,. PoLAn enard
' ') {
. ' .U.
. Ni.. l
., . .. s ,
. -.~~
~~
OUTER I' ' [ . D i k . , ,I < CONTAINMENT
>i DRYWELL '.;
s; " . y-. . . . . . ' '
. 1 i .
N>r.
.i C- .W. , '
- ~
. . , *.*. *.
- i. -
j - f. .! . nEAW0n ,l gggggp .,.
.. y r/ WALL -
.)
.:. s *
.*. :: \,
.! *; d. '
)*Itt . 2:z;
, l ; HORIZONTAL
,'...v..,
7:
%. .V.,b.'. \ : *-m.
VENTS SUPPRESSION N '.; g ~,.. n *g -
- -: i '.*nsacion '.. :1 -- .;*
f ;.{. POOL
.$, ', g, .;f
; cA m
;, ,, , ,, g .,,
. ...e.. .
' . ,*:. .. . .. .... * . . . . . .. . ' . . . * .t.' . - .*. ...
- t.*,.. . . .
l l l l l i l Figure C.4.2 Cross-section of Grand Gulf containment. NUREG-1150 C-18
1 n i o t r t n e % c % n 6
- o 8 2
1 1 d c < % i 8 n n % < < e e 2 6 0 4 2 2 H 1
)> g g < H H >
Cj' e o L ru 2 2 2
, y H 4 8 1 H h
)
l i a
- Z O (
f t i n i 6 y i 0 c n e u q e r F n o i 4. ti 0i n g I f l i 2 u . 0 G ' d n a r G u L0 1 8 6 4 2 O 0 0 0 0 ProbabiI it Y 0f Not Exceed.'ng f pg zE$$ ll
>,3Rs rn n
i o t ra t n O 1 e c n o
) c
% n n e g
h 1 o o r a1 i t d y < a r e h y o H 2 t n m u o m l a u q e r n D i i t n
< c e e ' 8 i e5 n s l P
t 0 d d oc n n e
- S 5
( n d e r e e m-u s m e n n p n s a g e o p i n e g a a L or c U t e . n r o d c o- ) f f y I C. 1 C ( d h e g l 6 y t a r i t a
- mv^ ' 0 c n lu t
s i n e l i I u t n q g ' e e m r n F i t a n n o
.n- '
4 i o h c t a 0 i y o n u g q e i S
, e ht f
^ .
o s j,, ; ' nt on 2 ige e c s 0 r e s p r -
- u
. i oe r m au vl o
' .'C r v o
f 1 1 g' ,' y cd nn e a u - 3 3 6 4 2' t.0 0 q5 e 2 0 f r5 r 0 0 0 ne n i oe i t w nte Prob gb iII iY of Not Exceed.'ng I 4 4 C e r u _ ig F zCEaL. 0 nL
1 Appendix C l I Distributions for et h of the case / initial-condition permutations are not presented in this report. Selected { aggregate distributions are shown and discussed below to illustrate the range of values used in the PRA. The reader is encouraged to review Reference C.4.11 for complete documentation of individual panelist's , judgments as well as the panel aggregate for each case. Selected Distributions for Grand Gulf The range of estimated loads on the Grand Gulf containment generated by a hydrogen deflagration, initiating from various hydrogen concentrations, is shown in Figures C.4.5 and C.4.6. The former repre-sents accident progressions in which the concentration nf steam in containment at the time of ignition is relatively high, and the latter represents accident progressions with low initial steam concentrations. The distribution for the estimated strength of the containment pressure boundary and the wall separating the drywell from the outer containment is also indicated on these figures to illustrate the potential for struc-tural failure. The likelihood of coincident failure of the containment shell and drywell wall is discussed in Section C.4.3. Selected Distributions for Sequoyah The range of estimated loads on the Sequoyah containment generated by a hydrogen deflagration is shown in Figures C.4.7 and C.4.8. The former illustrates the range of loads generated during fast station blackout sequences, the latter illustrates the range of loads generated during slow blackout sequences with an intermediate-size break in the reactor coolant pump seals. In both figures, distributions for containment loads are shown for cases in which the quantity of hydrogen released to the containment corresponds to that generated from the oxidation of 20, 60, and 100 percent of the core Zircaloy inventory. To illustrate the potential for these loads to cause containment failure, the distribution for the estimated strength of the containment pressure boundary is also indicated on these figures. Quantification of Hydrogen Detonation Frequency Detonations can occur if hydrogen is allowed to accumulate to concentrations greater than 12-14 volume percent in the presence of an ignition source and a sufficient concentration of oxygen. The current analy-sis indicates that the possibility of developing such conditions in either Grand Gulf or Sequoyah is low but cannot be dismissed. Figures C.4.9 and C.4.10 show aggregate distributions for the frequency of hydrogen detonations in Grand Gulf and Sequoyah, respectively (each showing the dependence on initial hydrogen concentration). The frequencies shown in these figures are conditional on hydrogen concentrations ex-ceeding the values shown in the figure legends. The discontinuities in the distributions are a result of J averaging the distributions of experts with substantially different judgments regarding detonation fre-quency, some of whom believe the frequency distribution to have thresholds (i.e., frequency cannot be lower than x or higher than y). The conditions under which detc nations were considered in the two plants are quite different, however. In Grand Gulf, large quantities of hydrogen may accumulate in the outer containment (as a result of substan-tial in-vessel metal-wat< r reaction) and a global detonation may result. In the case of Sequoyah, a deflag-ration-to-detonation transition is a more likely means o? creating a hydrogen detonation. The configura-tion of the ice condenser (a vertically oriented enclosed compartment with obstacles in the flow path) can promote flame acceleration and initiate a detonation in upper portions of the ice bed or the upper plenum. C.4.3 Treatment in PRA and Results The probability siistributions for this issue were implemented in the Grand Gulf and Sequoyah accident progression event trees. These trees (one for each plant) provide a structured approach for evaluating the various ways in which a severe accident can progress, including important aspects of RCS thermal-hydrau-lic response, core melt behavior, and containment loads and performance. The accident progression event tree for each plant is a key element in the assessment of uncertainties in risk by accommodating the possibility that a particular accident sequence may proceed along any one of several alternative pathways (i.e., alternative combinations of events in the severe accident progression). The probability distributions (or sp it fractions) for individual and combinations of events within the tree provide the " rules" that deterr.ine the relative likelihood of various modes of containment failure. C-21 NUREG-1150
l 1 Appendix C i l I Legend for Loads: Initial Hydrogen Concentration I;i 3 0 4 < H2 < 8 % ^ 8 < H2 < 12 %
- 12 < H2 < 16% O- H2 > 16 % i i
i P l r ! { o 1 m . . .. - -- - I b '. ' .
. \ \ Casos with
\
'\ High Steam O \ Concentrations {
f 0.8 - \ l
\,
N . s 1 O M '
\ ' ?%
t 0.6 - : s.
'\s E <
)( C
'N=
i c \M s e o,4 - , 'g
., \y
'ig:l:P d
" ""^
..:i \
\ Probability of 1
N n Drywell wall s 00.2- Surviving Load-P
\ ,
Probability of \ O the Containment \'
\
a d 0 i i 8" IVI"0 'oad-P i
~. "xs i
p 0 0.2 0.4 0.6 0.8 1 Pressure Difference (kPa
- 1.0E-3)
Figure C.4.5 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and high initial steam concentrations). NUREG-1150 C-22
Appendix C Legend for Loads: Initial Hydrogen Concentration
^
O 4 < H2 < 8 % 8 < H2 < 12 %
- 12 < H2 < 16% + H2 > 16 %
P r ^ ^^^ ~ O 1 . r$ b '. '.'
\ \'
\ x,e O \
f 0.8 - - g y '
\
N g N' O \
\
g \x Cases with 0.6 - \ Low steam
\ Concentrations E
c+-o
\ ~' '
x 1 g. s C s e o,4 - f\\ \ y
/ ,ys
\
.gs 'N Prot 3 ability of I \
g DWipall Surviving Load-P 90.2_(H , Pr bability of x L the C'ontainment 4 0 SurviVingload-P "s,- I a i
,, ,., x, x 4 0
d i- 3 - i i p 0 0.2 0.4 0.6 0.8 1 j Pressure Difference (kPa
- 1.0E-3)
Figure C.4.6 Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and log initial steam concentrations). C-23 NUREG-1150
Appendix C
^ ^
1
" = .'t=
P r , M O ' 20% Zr' Oxid. o b i 0: 60% Zr Oxid. a b A 100% Zr Oxid. I 0.8 - i' Legend for Loads - 1 i O E
- i t \
Y- 1 O \ f 0.6 -
;< 'g N . l o
i
\
t O i
)
E .l P.r bability of containment x i Surviving Load-P c 0.4 -
\
l e \ e i
.\
d *. ! i i n \' 9 O - i t 0.2 - \., i O a '.' d ', -
'w P () ',,
O 'Oca' ' ' ' ' ' '
?- ' .
0 0.10.20.30.40.50.60.70.80.9 1 1.1 1.2 : Pressure (kPa x 1.0E-03) Figure C,4,7 Range of Sequoyah containment loads from hydrogen combustion in comparison with con - tainment pressure capacity (fast station blackout scenarios with various levels of in-vessel cladding oxidation). i NUREG-1150 C-24 i
Appendix C
^ ^
1
"=.=
P - 0 20% Zr Oxid. r 9, O 0 i SO% Zr Oxid. b a ^ 100% Zr Oxid. b i 0.8 - i,
\ '*8'"d' 'd*
I I 0 0 a
\
t \ y i
\
O \ f 0.6 - t, N \ O t O O A \ P,robabil!!y of Containment E i Surviving Load-P x : c 0.4 - i e \ e \ d i i \ n O O li i 9 9, t 0.2 -
\,
O a '.', d () - ' P O ,,
'^ ' " ' ' ' ' ' * '
0 O 0.10.20.30.40.50.60.70.80.9 1 1.1 1.2 Pressure (kPa x 1.0E-03) Figure C.4.8 Range of Sequoyah containment loads from hydrogen combustion in comparison with con-tainment pressure capacity (slow Flation blackout accidents with induced rea: tor coolant pump seal LOCA and various levels of in-vessel claddmg oxidation). C-25 NUREG-1150
Appendin C P r O I 1 .^2. no b Grand Gulf I I I 0.8 - t Y r- '~^^^^-_____U-J f N o t 0.4 - Legend: E "'""#""*"**"" X O 12 < H2 < 16 % (H) c 0.2 - e 2 g ^ .i 16 8 H2 < 20 % (L) e l d O H2 > 20 % (L) I O L- ' ! n i i i ! g 0 0.2 0.4 0.6 0.8 1 . I(D) Frequency of Detonation f(D) ! i j { Figure C.4.9 Frequency of hydrogen detonations in Grand Gulf containment (probability of a detonation per cornbustion event-l.e., given ignition). H and L refer to high and low stearn concentra-tions, respectively. NUREG-1150 C-26 i i I 1
.____________Q
Appsndix C i i { i I P r O e g
- 14 < H2 < 16 % -
16 < H2 < 21 %
! O.8 -
t -G- H2 > 21 % y o Legend: 0.6 initial hydrogen conooptration f N
$ 0.4 -
o :: E X c 0.2 - e i Sequoyah 1 n I OC C ' ' e ' ' l g 0 0.2 0.4 0.6 0.8 1 l Frequency of oetonetior. f<o) )
, <g3
\
l l i i l 1 Figure C.4.10 Frequency of hydrogen detonations in SequoyPL ice condenser or upper plenum (probability of a detonation per combustion event). ! C-27 NUREG-1150 l
Appendix C As mer tioned above, distributions for combustion loads were provided as input to the Grand Gulf acci-dent progression event tree directly from the results of expert panel elicitation. An algorithm was created within the Sequoyah tree to calculate combustion loads as a function of " upstream" conditions such as the mass of hydrogen released from the reactor vessel, the distribution of the hydrogen through the contain- .- ment, the compartment of the containment in which ignition.took place, and other variables accounted for in the tree (e.g., burn completeness, potential for flame propagation); For each pass through the event !- tree in the risk uncertainty analysis, the likelihood of containment failure (and drywell failure for Grand Gulf) was determined by comparing the sampled value of the combustion loads against the sampled value-of the containment pressure capacity. Station blackout dominates the estimated core damage frequency for Grand Gulf, therefore rendering the - igniters unavailable far most of the accident sequences important to risk. The attendant potential for hydrogen to accumulate and spontaneously ignite at relatively.high concentrations received particular attention in this analysis. Of particular interest was the potential for hydrogen burns to induce a breach of the containment pressure boundary and result in suppression pool bypass. This combination of events could occur if a hydrogen burn were of sufficient magnitude to fail the containment shell and the drywell wall. The outer containment (wetwell) pressure boundary is not an extremely strong structure in the BWR Mark Ill design (e.g., the Grand Gulf outer containment design pressure is 15 psig-103 kPa). As with all the pressure-suppression containment designs, heavy reliance is placed on the suppression pool to reduce thermodynamic loads on this structure. The structures forming the drywell, however, are much stronger (design pressure of 30 psid-207 kPa). The.present analysis considers the possibility of combustion-generated loads failing either or both structures. If the containment pressure boundary is breached, but the drywell remains intact, the pressure-suppression pool.is available throughout the accident to reduce - the magnitude of the fission product release to the environment. If, however, the loads accompanying a hydrogen burn (or some other event) are of sufficient magnitude to damage the drywell walls and allow for suppression pool bypass, the accompanying fission product release can be substantial. The contribution of hydrogen combustion to early containment loads in Grand Gulf is evident in the fraction of accident progressions with early containment failure caused by nydrogen burns. These are summarized below for each type of accident sequence that contributes greater than 1 percent of the mean total core damage frequency: Fractional Fraction Fraction of Early Contribution to Resulting in Containment Failures Type of Mean Total Core Early Containment Caused by 51ydrogen Burn Accident Damage Frequency Failure or Detonation - Short-term station blackout 0.94 0.46 0.96 Long-term station blacliout ') 0.02 0.86 0.44 ATWS 0.03 0.85 0.36 Transients 0.01 0.56 0.98
.. The vast majority of early containment failures for short-term station blackout (the dominant contributor to the Grand Gulf core damage frequency) are shown to be caused by loads generated by hydrogen i combustion.
A substantially smaller fraction of the accident progressions in Sequoyah are estimated to result in early- 1 containment failure from hydrogen burns. The fraction results in early containment failure for the two most important types of core dam 1e accidents in Sequoyah are summarized as follows: l
- NUREG-ll50 C-28 1
3
1 i f
- Appendix C Fractional Contribution Fraction Resulting in Type of to Mean Total Core . Early Containment Failure ,
Accident Damage Frequency from Hydrogen Burns LOCA 0.63' O.001 . Station blackout 0.25 0.05 . - The majority of cases in which hydrogen combustion produces a load sufficiently large to compromise containment integrity involves deflagration. (quasistatic) loads, not detonations (dynamic loads). REFERENCES FOR SECTION C,4 C.4.1 National Research Council, Technical Aspects of Hydrogen Control and Combustion in' Severe Light-Water Reactor Accidents, National Academy Press, Washington. D.C.,1987. U.S. Nuclear Regulatory Commission, " Reactor Safety Study-An Assessment of Accident Risks C.4.2 in U.S. Commercial Nuclear Power Plants," WASH-1400 (NUREG- 75/014), October 1975. C.4.3 J.A. Gieseke et al., " Radionuclides Release Under Specific LWR Accident Conditions," Battelle Columbus Laboratories, BMI-2104, Vols. III and IV, July 1984. C.4.4 R.S. Denning et al., " Radionuclides Release Calculations for Selected Severe' Accident' Scenarios," Battelle Columbus Laboratories, NUREG/CR-4624, BMI-2139, Vols. 2 and 4, July 1986. C.4.5 R.S. Denning et al., " Supplemental Radionuclides Release Calcuistions for Selected Severe Acci - dent Scenarios," Battelle Columbus Division, NUREG/CR-4624, Vol. 6. BMI-2139, to be pub-lished.* C.4.6 A.L. Camp et al., " MARCH-HECTR Analysis of Selected Accidents in an Ice-Condenser Con- ( tainment," Sandia National Laboratories, NUREG/CR-3912, SAND 83-0501,' January 1985. j C.4.7 S.E. Dingman et al., " Pressure-Temperature Response in an Ice Condenser Containment for Selected Accidents," Proceedings of the 13th Water Reactor Safety Research information Meeting (Gaithersburg, MD), NUREG/CP-0072, February 1986.- ;
~ C.4.8 S.E. Dingman et al., "MELCOR Analyses for Accident Progression Issues," Sandia National .
Laboratories, NUREG/CR-5331, SAND 89-0072, to be published.* ' C.4.9 Technology for Energy Corporation, " Integrated Containment Analysis," IDCOR Task 23.1, 1984.
' 'J C.4.10 A.L. Camp et al., " Light Water ' Reactor Hydrogen Manual," Sandia National Laboratories, !
NUREG/CR-2726, SAND 82-1137, September 1983. C.4.11 F.T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major input Parame- ) ters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Draft Revision 1. SAND 86-1309, to be published.* I
*Available in the NRC Public Document Room, 21201, Street NW., Washington, DC.
1 C-29 NUREG-1150 l u 1
Appendix C C.5 PWR Containment Loads During High-Pressure Melt Ejection During certain severe reactor accident,s, such as those initiated by station blackout or a small-break loss-of-coolant accident (LOCA), degradation of the reactor core can take place while the reactor coolant system remains pressurized. Left unmitigated, core materials will melt and relocate to lower regions of the reactor pressure vessel. Molten material will eventually accumulate on the inner radius of the vessel bot-tom head and attack lower head structures. If the bottom head of the reactor vessel is breached, core debris may be ejected into the containment under pressure.* The blowdown of reactor coolant system gases atomizes ejected molten material and transports the resulting particles through the containment atmosphere. The attendant exothermic oxidation of metal constituents of the molten particles and rapid transfer of sensible heat to the containment atmosphere is referred to as " direct containment heating." The pressure rise in containment induced by high-pressure melt ejection (HPME) can be large enough to challenge containment integrity. Since containment failure immediately following reactor vessel breach ! can lead to a relatively large environmental release of radionuclides (and proportionally high conse-quences), uncertainties in the magnitude of containment loads at vessel breach are important contributors to the uncertainty in reactor risk.
)
A significant rise in containment pressure can be produced by HPME in PWR (large dry, subatmospheric, and Ice condenser) containments and BWR (Mark I, II, and III) containments. These loads were, there-fore, considered in the analyses for each of the plants examined in this study. The magnitude of the pressure rise depends strongly on details of reactor cavity (PWR)/ pedestal (BWR) geometry and is, there-fore, highly plant-specific. For the two BWRs examined in the present study, containment loads attribut-able to high-pressure melt ejection were not found to be the dominant contributor to the likelihood of early containment failure. This is a result of several factors including the comparatively lower nominal reactor vessel pressure in BWRs, the capability of the suppression pool to attenuate, to some extent, the energy released from HPME, and (in Peach Bottom) the relatively high likelihood of other containment failure mechanisms (e.g., drywell shell meltthrough-refer to Section C.7), The discussion presented in the remainder of this section, therefore, focuses on PWR containment loads during HPME. The containment loads associated with HPME are generated by the addition of mass and energy to the J containment atmosphere from several sources:
- 1. Blowdown of reactor coolant system steam and hydrogen inventory into the containment.
- 2. Combustion of hydrogen released prior to and during HPME.
- 3. Interactions between molten core debris and water on the containment floor.
- 4. Direct containment heating.
Uncertainties in containment loads at vessel breach arise from the nonstochastic nature of some of these events (e.g., hydrogen burns), as well as a poor understanding of the phenomena governing others (e.g., direct containment heating). In the preliminary containment rcsponse analyses (i.e., published in the February 1987 draft for comment release of this report), eacf of these contributors to containment loads was treated individually. An estimate'of the total rise in _ ntainment pressure at vessel breach was generated by the superposition of pressure increments from each contributor. This approach was acknor. edged to compromise the synergistic aspects of the phenomena involved but was analytically convenient. Among the motivations for taking this approach was the desire to isolate the uncertainties associated with direct containment heating, a controversial and highly uncertain phenomenon that can have a significant impact on the estimation of risk.
'In roughly 70+ percent of the PWR accident scenarlos during which core degradation begins while the reactor pressure is at elevated pressures, an unisolatable breach in the primary system pressure boundary opens in hot leg piping, the pressurizer surge line, steam generator tubes, reactor coolant pump seals, or via a stuck-open power-operated relief valve. This break is sufficiently large to depressurize the reactor vessel prior to vessel breach. Containment loads during high-pressure melt ejection apply to the scenarios represented by the remaining 30 percent of the cases. The mechanisms for and likelihood of reactor vessel depressurization are treated as a separate uncertainty issue and are discussed in Section C.6.
NUREG-1150 C-30
Appendix C i i Although more experimental and analytical information regarcling direct containment heating has been generated for and incorporated into the final analyses for this study, substantial uncertainties persist and the phenomenon continues to generate controversy. The motivation for isolating direct containment heat-ing remains valid; however, the arguments in favor of treating containment response during this important stage of severe accident progression in a physically self-consistent menner prevailed. In the current analy-ses (presented in this document and NUREG/CR-4551 (Refs. C.S.1 through C.5.7)), containment pres-sure rise at vessel breach is treated as a single issue representing the combined uncertainties associated with the synergism of the four events listed above. As a result, the pressure increment attributable to an isolated phenomenon (e.g., directing containment heating) is not separable. C.S.1 Issue Definition This issue characterizes the uncertainties in containment loads that accompany reactor vessel breach. These uncertainties have been characterized over the entire range of possible initial reactor coolant system pressures. The largest loads (and, thus, the most significant challenges to containment integrity), however, are generated when the reactor vessel is breached while at elevated pressures. The following discussion will, therefore, focus on accident scenarior in which reactor vessel breach occurs at pressure between 500 psia (35 bar) and 2500 psia (170 bar). Further, pressure increments are characterized for three PWR containment designs-Surry Unit 1 (subatmospheric), Zion Unit 1 (large dry), and Sequoyah Unit 1 (ice condenser). Diagrams of the Surry and Zion containments are shown in Figures C 5.1 and C.5.2, respec-tively. A similar diagram of the Sequoyah containment was discussed in Section C.4 (refer to Fig. C.4.1). A rise in containment pressure may result from one or more of the four events listed earlier. The blow-down of steam and hot gases from the reactor coolant system into the containment can be calculated with reasonable precision. The pressure rise attributable to this event may be augmented by the steam produc-tion accompanying an interaction of core debns and water on the cavity floor, the generation of energy from hydrogen combustion, and energy addition from direct containment heating. Each of these potential contributors to containment loads at vessel breach is subject to physical limitations.
- Potential ex-vessel interactions between core debris and water is of concern only for accident scenar-ios during which water covers the reactor cavity floor prior to vessel breach. In general, this implies the successful operation of containment sprays or a LOCA or both, o Combustion of sufficient hydrogen to generate a substantial pressure rise is subject to physical re-quirements regarding minimum hy.'rogen concentrations, oxygen availability, and maximum inerting gas concentrations. Hydrogen concentrations in containment prior to vessel breach depend upon in-vessel core melt progression (primarily the fraction of the core Zircaloy oxidized before vessel breach, which was addressed as a separate issue) and the type of accident scenario being considered.
- Direct containment heating is a term that refers to a series of physio-chemical processes that have been postulated to accompany the ejection of molten core debris from a reactor vessel under high pressure. If a large fraction of the ejected molten core debris is dispersed into the containment as fine particles, a substantial portion of the debris' sensible heat can be transferred rapidly to the atmos- l l
phere. The containment pressure rise accompanying direct containment heating depends on reactor j cavity geometry, the mass of material dispersed by reactor vessel blowdown, and several other pa-rameters described later. The resulting pressure rise can be further supplemented by the release of chemical energy associated with the oxidation of metals in the particulate melt as they are transported through the containment atmos-phere. The total energy release, and thus the pressure rise, attributable to these phenomena depends on the fraction of the core (molten mass) participating in the process and the model used to represent the events that accompany reactor pressure vessel breach. Distinct cases are established to consider each plausible combination of debris characteristics and contain-ment initial conditions separately. The case structure accounts for uncertainties in selected severe accident events and phenomena that precede reactor vessel breach. Uncertainties associated with the containment j l 1 C-31 NUREG-1150 I l
Appendix C CONTAINMENT SPRAYS l 200 TON CRANE * .
% *.NMECIRC. SPRAY 'af 4 !
~
1[.
.* i < ; **
y F . MANIPULATOR [ I. '.
. STEAM OENERATOR CRANE * '/
, PRESSURIZER 5 *.. ' .
n .- (
,.g.'
2
;.m .. .w , . m a ? *
- r.
.l.
9
., C. , ,*. l' gi, ..
. .. .o g i'
. n ,..
e , , e g - Je r ,,* 1
..-.1 i '. . .< . .
4
,i
- g _ il a r .
/.
= r
, ..- f .;
e.*. REACTOR -* R. C. C, . PUMP
. tl= .e
, .g
. i. . -
. - . . .. ' ,e . .. . . . . . . , .
l ,. ;
= j.
lt- .'.", .
. ACCUMULATOR , t f
I REACTOR */ .i *
.., N ,. ./
. CAVITY *;; *o
, . . . . ...~...a
..x.,
.e
*=,.
? ,,.....
......,.....,...?"
* ,.,* ; .*. .s , . .. , . . .
I Figure C.S.1 Cross-section of Surry Unit I containment. . ; i 1 NUREG-1150 C-32 ! _..____.._..____..._.____.a
App:ndix C
- .*f*e jl*. CONTAINMENT >"e.
,. SPRAYS n'. .r. .
.e
. . e. .
y;l.
..t i .,
e
. e e
[I
+
t.
; ./.
n<
'. e
. e'
, POLAR CRANE -
P,
'h 5 ( 5 b
b o' b' ,' STEAM .* GENERATORS ,',
/ N D.
7j'E '3 ~ 'b'
- h. r. .
[*l5
. N'*/. ". ' t e . m.,
,. - ..'8,
*(
,, - t l'
''1 p'
.. ps .,
- 1. ;
; m
f 7.
,s
/ \ -
.'. . ' s t
8. A Q '
,4a p*.
J ) i . .. .. . . . i e
.t i
,., r: l ,.
c
- T n )
e, r. :., e. f.#,
.i.
?
i .
- e. w-
*. ....e
,s, . . '
% . ... r . ....:..: u..-.T
.' .r, . .-
T-o, '*. *e
'. . **.;' . .g.
.s.e ;j.. ,g*.. , . , *
. u.. *
. . , , , . . . . . . . .s. .. .. . ... .;,*.:r s . .. s='.4.+*..
'e . ..\ , , . .'. * . r
, -, , .. . , e.. .... .*.'..*.*...:
- e. . .e REACTOR VESSEL g
lN. CORE ' = INSTRUMENT TUNNEL ,h.o-[,. *- .I,;[;'. <.g i ' ..
' * *** '.. " .
- REACTOR CAVITY l
9 FT B ASEMAT l l l 1 t Figure C5.2 Cross-section of Zion Unit I containment. C-33 NUREG-1150
Appendix C loads generated by processes and events that occur after core debris leaves the reactor vessel are repre-sented by the distribution of plausible pressure increments assigned to each case. The specific parameters . and range of values used to define the case structure are: Parameters Defining Case Structure Values Considered
- 1. Reactor vessel pressure prior High, Medium, Low to vessel breach .p > 1000 psia 500 < p < 1000 psia p < 200 psia
- 2. The amount of unoxidized metal High, Low in the melt 60 percent of initial inventory 25 percent of initial inventory
- 3. Fraction of molten core High, Medium, Low debris ejected Approx. 50 percent of total Approx. 33 percent of total Approx.10 percent of total
- 4. Initial size of hole in the Large, Small reactor vessel lower head Approx. 2.0 sq-meters ,
when breached Approx. 0.1 sq-meters
- 5. The presence (or lack) of Full, Half-full, Dry .
water in the reactor cavity
- 6. Containment spray operation Yes: Operating j during HPME No: Not operating A distribution of values for the incremental rise in containment pressure was generated for each PWR l containment type analyzed (large dry, subatmospheric, and ice condenser) and for each combination of l parameter values in the case structure. The relative likelihood of the cases was not considered as part of this issue but was determined in the evaluation of the accident progression event tree. Section C.S.3 discusses application of the estimated pressure increments for each case in the risk uncertainty analysis.
A qualitative description of how the above parameters influence containment response follows. The tech-nical bases (experimental evidence, calculational results, or engineering judgment) for quantifying these influences are also indicated. Reactor Vessel Pressure - Reactor vessel pressure at the time of vessel breach characterizes the internal energy stored in reactor coolant system gases and provides the motive force for core debris dispersal. Higher initial pressures lead to larger pressure increments from reactor coolant system blowdown. Provided the initial reactor vessel pressure is sufficient to transport hot gases and reactive material (molten debris particles) to upper regions of the containment, the pressure rise attributable to direct containment heating is probably insensitive to ' the initial r'eactor vessel pressure. Attempts have been made to define a cutoff pressure (pressure below which substantial direct containment heating does not occur); however, the technical basis for a cutoff pressure is weak. In this assessment, direct containment heating is regarded as possible if the reactor vessel pressure at the time of vessel breach is greater than approximately 200 psia (14 bar). The likelihood of, and pressure rise associated with, hydrogen combustion and ex-vessel core-coolant interactions are largely insensitive to initial reactor vessel 7tessure. Unoxidized Metal Content in the Melt Among the important contributors to containment loads during high-pressure melt ejection is the energy release associated with the oxidation of unreacted metals (particularly Zircaloy) in the melt. The NOREG-1150 C-34
Appendix C fragmentation and dispersal of debris throughout the containment atmosphere can significantly enhance the rate of Zircaloy oxidation by exposing a large surface area of unreacted metal to the containment atmosphere. The conceptual picture of hot, unreacted metals being dispersed in air atmosphere might suggest a strong relationship between the total energy released and the mass of unoxidized metal being dispersed. However, CONTAIN calculations (Ref. C.5.8) suggest that containment loads are relatively insensitive to the extent of in-vessel Zircaloy oxidation (mass of Zircaloy consumed in-vessel and, there-fore, unavailable for oxidation during melt ejection). These calculations indicats only minor differences in containment pressurization when the unoxidized fraction of metalin the melt (dispersed at vessel breach) is increased from 50 to 70 percent of the initial inventory. It is not clear that a similar trend would be observed if the mass of dispersed metals were less than 50 percent of the initialinventory (i.e., if greater than 50 percent of the metal mass oxidized in-vessel or if a small fraction of the total mass of debris were to be ejected). Fraction of Molten Debris Ejected The amount of core material ejected from the vessel depends on the %ction of the core that has melted and collected at the bottom of the reactor vessel at the time of vessel breach. This is governeci 'sy the model used to represent in-vessel core melt progression (addressed in other uncertainty issues). Three nominal values were considered in this assessment (0.50, 0.33, and 0.10) to represent large (greater than 40 percent), medium (between 20 and 40 percent), and small (less than 20 percent) fractions of core melted and available for ejection, respectively. The results of parametric studies performed with the CON-TAIN computer code (Ref. C.5.8) indicate that the containment pressure increment at vessel breach increases substantially with increasing fraction of melt ejected. Illustrative results of these calculations are shown in Figure C.5.3, which presents the predicted peak pressure for variations of a station blackout accident scenario in which progressively greater fractions of the initial core mass were assumed to be ejected. In these calculations, all the melt ejected is assumed to participate in direct containment heating. Results of scaled high-pressure melt ejection experiments in the Surtsey facility (Refs. C.5.9 through C.5.13) indicate that not all ejected debris may participate, however. Initial Size of Ilole in Vessel When Breached Alternative conceptual models for in-vessel core melt progression suggest .luite different modes of reactor vessel breach. One model assumes that a localized thermal attack of the vessellower head results in the failure of one or more lower head penetrations. Such a model suggests an initial hole size in the neighbor-hood of 0.1 m2. Much larger hole sizes are conceivable, however, particularly if the reactor vessel lower head fails by creep rupture or when the hole is ablated. The primary parameter affected by the initial hole size is the rate at which vessel blowdown occurs (larger initial hole size implying more rapid blowdown and melt ejection). The CONTAIN parametric studies referenced above also examined this sensitivity by vary-ing the length of time required to blow down the reactor vessel. Substantially larger pressure rises were predicted when the blowdown period was shortened from 30 seconds to 10 seconds. Presence of Water in Reactor Cavity At least two scenarios are conceivable when water interrupts the pathway for debris dispersal following reactor vessei breach (as it would if the reactor cavity were filled with water). One scenario is that one or more steam explosions will occur after only a fraction of the debris has been injected into the cavity and that the cavity water will then be dispersed ahead of the bulk of the injected debris. Another possibility is that the relatively cold water will be co-dispersed with the debris, exiting the cavity region as small droplets intermixed with the transported debris, steam, and hydrogen. Experiments with water-filled cavities (Ref. C.5.13) have been inconclusive, in part because of the tendency of the experimental facilities to be destroyed by the debris-water interactions. Reality may involve some combination of these two scenarios. The scenario resulting in co-dispersed water has received considerable attention. Of principal interest is the nature of the interaction between the debris particles and water droplets. The water may continue to quench the debris, mitigating the effects of direct containment heating. However, the fate of the steam generated by this quenching is uncertain. It could simply increase the partial pressure of steam in the containment, thereby producing a moderate addition to containment loads, or it might act as a source of C-35 NUREG-1150
Appendix C I i
)
1 Peak Pressure (bar) 10 3 Sequoyah 8 - e surry E Ng N 6 - y.
- g
/
4 g/g/[ A station blackout (TMLB) accident scenario was simulated for both plants. Results are illustrative only and may 2 _ not correctly represent sc'enarlos in which alternative modeling assumptions are applied. Refer to NUREG/CR-4896 for detalls. 0 O 0.2 0.4 0.6 0.8 1 Fraction of Core Melt Ejected Figure C.5.3 Calculated containment peak pressure as a function of molten mass ejected (Ref. C.S.8). NUREG-1150 C-36
Appendix C oxygen for unquenched debris and substantially enhance the oxidation of metallic particles. This tradeoff was investigated in some detail in the CONTAIN sensitivity studies referenced above. The effects of
- .o-ciispersed water were shown to be quite sensitive to the timing and location of water addition, assump-tions regarding droplet-debris reaction kinetics, and the amount of water involved.
Containment Sprays and Ice Condenser The effect of containment sprays on conta.. ment loads from reactor vessel blowdown has been relatively well characterized by numerous containment response computer code calculations. In Surry, for example, it has been estimated (Ref. C.$.2) that the operation of containment sprays reduces the pressure rise at vessel breach by approximately 30 to 45 psi (2 to 3 bar). The impact of sprays on dispersed core debris is not well understood and was not explicitly examined in the CONTAIN sensitivity analyses (Ref. C.5.8). For some plants, however, early spray operation may ensure a substantial inventory of water in the reactor cavity. The uncertainties in estimating the effect of this water were described above. The presence of the i"e condenser in the Sequoyah containment introduces significant uncertainties in estimating HPME loads ror this plant. There are no experimental data regarding ice condense: perform-ance under conditions representative of those accompanying HPME. In the present study, quantitative assessments of core debris capture and pressure suppression during HPME is largely based on the subjec-tive judgment of experienced containment response analysts. Topics of particular concern include the potential for " channeling" (the preferential melting of a vertical column of ice, creating an early ice bypass pathway) and hydrogen detonations. The possibility of a rapid re! case of large quantities of hydro-gen following reactor vessel breach, accompanied by effective steam condensation as the ' steam / hydrogen mixture passes through the ice beds, can generate conditions that favor hydrogen detonations in the upper regions of the ice condenser. The dynamic loads generated from meh ev.nts are not explicitly included in this issue. The reader is referred to Secticn C.4 for more details on the treatment of hydrogen combustion phenomena in this containment design. C.5.2 Technical Bases for Issue Quantificatien This issue was presented to a panel of experienced severe eccident analysts. Six panelists addressed con-tainment loads for the three PWR plants:' Louis Baker-Argonne National Laboratory, Kenneth Bergeron-Sandia National Laboratories, Theodore Ginsberg-Brookhaven National Laboratory, James Metcalf-Stone & Webster Engineering Corp., Martin Plys-Fauske & Associates, Inc., and Alfred Torri-Pickard, Lowe & Garrick, Inc. Each panelist proviaed a distribution of values for containment pressure rise following reactor vessel breach for each of the cases outlined in Section C.5.1 These distributions characterize the panelist's judgment for the range of plausible containment loads for each case and the relative confidence (i.e., degree of belief) that particular values within that range are the " correct" ones for the conditions specified by the issue case structure. Panelists based their judgments on the current body of experimental evidence and analytical information, a sample of which was summarized above. - A summary of the expert panel's judgments is provided below. In most instances, aggregate distributions (arithmetic average among the panelists for a particular case) are presented to illustrate observable trends between cases. Examples of individual panelists' distributions are also shown to illustrate the variance of 1 opinion within the panel. Complete documentation of the elicitation of expert judgment from these ana- ; lysts is provided in P.eference C.S.2. An estimate of containment loads has little meaning if isolated from a corresponding estimate of static pressure capacity. Therefore, for each plant, the appropriate distribution for its static failure pressure k (discussed in detail in Section C.8) is shown on each plot of containment loads. An example display of
' A minimum of three panelists addressed each plant. In general each panelist was responsible for addressing the uncer-tainties in containment loads for two of the three PWR plants (Surry, Zion. or Sequoyah). If any analyst wished to pro-vide a judgment for more than two, he was free to do so.
C-37 NUREG-1150
i Appendix C containment loads verses a reference static failure pressure is shown in Figure C.S.4. The curve for con-tainment loads (base pressure plus the pressure increment accompanying reactor vessel breach) is shown as a cumulative distribution funr. tion (CDF). The static failure pressure is shown as a complementary cumulative distribution function (CCDF). The reason for this display format is to allow the reader to perform the following visual exercise: Select a value (0.5 in the example-the median of the distribution) for the probability that the con-tainment load at vessel breach is equal to or below some level. Read (horizontally) along the selected probability value, and determine the corresponding containment load (approximately 7 bar in the example). This means that the probability that the containment load at vessel breach is 7 bar or less is approximately 0.5. Next, read vertically upward to determine the point on the static failure pres-sure curve that intersects the same value of pressure, then left, back to the ordinate. This final value of probability (0.95 in the example) is the probability that the containment will survive the imposed j load (7 bar in the example). This format for displaying the containment performance information allows the reader to examine the relative likelihood of the containment surviving a particular load and the corresponding'g likelihood of that load being produced. In performing this exercise, it must be remembered that the distributions displayed in this manner apply only to the initial and boundary conditions specified by the case structure. Containment Load Distributions for Surry An important parameter in characterizing containment loads for high-pressure accident scenarios in Surry is the operation of containment sprays (or more specifically, the presence of water in the reactor cavity). Figures C.5.5 and C.S.6 show the estimated containmern loads for HPME cases with sprays operating and not operating, respectively, for vessel failure with the RCS at high pressure. In each figure, the four curves i for containment loads represent the aggregate (arithmetic average) distribution for the expert panel for each of four cases (identified in the legend). The variables that change among these cases are the initial size of the hole in the reactor vessel lower head at vessel breach and the fraction of molten debris ejected. (Each may take on high or low values as indicated in Section C.5.1. Curves are not given for cases with a
" medium" fraction of the core ejected.) The largest loads are generated when both parameters take on high values (with or without sprays operating). Significantly lower loads are likely for cases in which containment sprays operate.
The likelihood that the Surry containment would survive the median (50th percentile) loads is greater than approximately 90 percent for all cases in which the sprays operate or provided a small fraction of the core debris is ejected (with or without sprays). It shotild be noted that accident sequences for which l containment spreys are assumed to operate generally result in a cavity at least partially filled with water. The distributions shown in Figure C.S.5, therefore, assume a full cavity; those in Figure C.S.6, likewise, assume a dry cavig. For Surry, the variar ce in the estimated containment loads among panelists is comparable to the variance among cases. Figurc C.5.7 shows the distributions generated by each panelist for the four cases shown in Figure C.5.5. The range of median values for pressure rise among the panelists spans 30 to 60 psi (2 to 4 bar). This range increases to 120 psi (8 bar) at the distributions' upper bound. This trend is typical of virtually all the Surry cases. Containment Load Distributions for Zion Example distributions of containment loads at vessel breach in the Zion Unit 1 containment are shown in the Figures C.S.8 and C.S.9 (with and without containment sprays operating, respe;ctively). The boundary conditions represented by the cases illustrated in these figures are the same as those shown in Figures C.5.5 and C.5.6 for Surry. The Zion containment is shown to be able to withstand high-pressure melt ejection loads (even at the upper end of the uncertainty range) with very high confidence. NUREG-1150 C-38
Appendix C I 1 l l
.N l
C Pressure Load at ~~" Prob of Containment Vessel Breach Surviving Load-P l
===
1 tu C o,9 - 4 ' ,, u ? . m ! \ u 0.8 -
; i' I s>
a 0.7 - j I. t ; 8 i i y C.6 -
, i e l \
0.5 ; \- P - r i o 0.4 - i. b \ \ a b 0.3 - i 1 i i i 1 0.2 - i .
' i 6
t 0.1 -
\ ;
y - 1 r -
' ' ' ' ' *----'==
OC 0 2 4 6 8 10 12 14 Pressure (bar) . . l Figure C.S.4 Example display of distributions for containment loads at vessel breach versus static failure pressure. C-39 NUREG-1150
1
)
l l App ndix C ' HPME with sprays Surry: operating (cavity full) H ole Fraction Melt H olo Fraction Melt LOADS: size Ejected Size Elected "G" : Large Large "A" : Large Small "E" : Small Large "O- : Small Small Cumulative Probability --^ 1 ...o...e
..g . .. - g,.... .....ag..........u 0.9 - ' '
/
l l O.8 ,:: W h.
. .Y .
W 1 0.7 - ll l l
- l l l l .
O.6 - ll l l 0.5 - oo ?9 ll : : ll l l 0.4 - ll ll [l /l Probability of 0.3 - l ll Surviving Load-P 9' E'P 0.2 - l ll 1 : : 1 : : : 1 0.1 - h ,KE5 0 # ' ' ' '
~
- ' =
0 2 4 6 8 10 12 14 Pressure (bar) Figure C.S.5 Surry containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity). NUREG-1150 C-40
Appendix C Surry HPME without spraysoperatino (covity ory) Hole Fraction Melt H ole Fraction Melt LOADS: Size Elected 8lre Elected "O" : Large Large "A" : Large Small
- Small Large -G- : Small Small Cumu;ative Probability --
1 g .. ..... g. . . e ,... g a. . . . . . . . a9... ..... u
, , ,. ,a 0.9 -
/ ,- ,
- , a'
- 0.8 -
l Y$ ' W ' W 0.7 - ll j j l l l l l l l l 0.6 - ll l . l l l l 0.5 - oa 2 .o ll l l 0.4 - ll
.I l
/l / Probability of 0.3 -
ll .i l y g' ,g' Surviving Load-P 0.2 - ll l :' 0.1 - ll .! l si .50' 0
' #2'* ' ' ' ' ' --
0 2 4 6 8 10 12 14 Pressure (bar) Figure C.S.6 Surry containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity). C-41 NUREG-1150
Appendix C Cumulative Probability Cumuletive Probability 1 , , ju 1 , pi ,u
, _p.v.,...-p.
,p ..
, y p.
0.e - 5' ' l ,'< O.e - i : l ,. , l ,' l ll o.s - l l l ,' O.e - _ ll ,' l l d l ll d 0.1 - l l l- c.1 - l ll l l l ll . , l ll l o.e - l l l o.e - l ll l l l l l ll l c.e - ea o.e - r ese l l ll
, , ,, l l ll
,s o.4 -
l l ll o.4 - l lJ ll ll l l ll 0.8 - 'I ll Euren o.s - ? IlI **"n
/# HPME with opreye, l l HPME with spreys, ll,0,*l lares hele, ,
l,0' ll Lares hole, c.2 - f,
- l laree melt election o.2 - ; // l email mWt elmotion l' ll l" l 0.1 -
/ 3' o.1 - 1l l
.h ,h b o "E^* -
o "l ' ^a o a 4 e e to u $4 o a 4 e e to u 14 i Pressure (bor) Proesure (bor) 1 - I . O- Lead : Expert A
- Load : Expert B iH Lead : Expert C o Load : Expert D q
+ Pmb of Survivately !
Lead-P Cumulative Probability - Cumulative Probehility 1 ,
- g. * , , _ - i , ____i, 1
, g'g p.- <
0.0 - pf , ': a.e -
$ l' l ',
o.e - ll ll ' , 'l: on - l ll
. ll, ,<, '
llV l l 9 i 0.1 - l" l o.r - l l 1 ll l
., , l l
l o.e - l l o.e - l ll
,, f,
,,, . , ,, i 0.e -
id6 4 c.e - i dib .i ll l l
.,, l l: 1 i
o.4 - lll o.4 - l ll l Jl/ j / ." - ), o.a -
,II!! **" Y oa -
l',!! ' HPME with spreys, .l s gyr,p
,E,*f,/ amen hele. l Wl HPME with spreys, o.: -
, ,/ Leros mets eloosion o.a -
l ll l emen hee. lla
, ~ . lll l emen most e6eessen 0.1 -
l ," 3 ' o.1 - 2 l \ ; d d/ d'6 4 ( ..-- ' o r<n - 0 em- - .~~ o a 4 e e e u u o a 4 e # e a w Prosaure (bor) .=,oem aber) Figure C.S.7 Surry containment load distributions generated by composite of individual experts for each of the cases shown in Figure C.5.5. NUREG-1150 C-42
a 3 Appendix C HPME with sprays Zion: operatino (cavity ruii) Holo FracMon MeH H ole FracHon MeH LOADS 3 Bize Elected Size Elected "G" : Large Large "A" : Large Small "E" : Small Large "O- : Small Small Cumulative Probability - - - 1 g.~ ..g..w ll 0.9 - i: ll ll 0.8 -
.!.! ./ ./ 1 W ?? i 0.7 -
ll ll 1 i 0.6 - ll ll
- : \
1 0.5 -
@ ?: 9 l
0.4 - ll ll ll /l Probability of O.3 - ll ll ggg Surviving Load-P 0.2 - ll l ./ 0.1 - ll U 0 j$ ' ' ' ' ' ' '-- ' O 2 4 6 8 10 12 14 16 18 20 Pressure (bar) Figure C.5.8 Zion containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity). C-43 NUREG-1150
Appendk C , HPME without sprays Z. ion: operatino < cavity ory) LOADS: Hole Fraction Melt Hole Fraction Molt Size Elected Size Ejected l "G" : Large Large "A" : Large Small "E" : Small Large "G- : Small Small
)
Cumulative Probability I <
.. .. %M N ET 0.9 -
ll l : ll ll 0.8 - ll ll 0.7 - ll ll ll ll 0.6 - ll ll 0.5 -
@ 29 0.4 -
ll ll
!! l l Probability of ll 0.3 -
ll \ Surviving Load-P
%' 7' 9 0.2 - ll l,/
!! l' O.1 - ll i .:
6 $5 0 ' = ' O 2 4 6 8 10 12 14 16 18 20 Pressure (bar) Figure C.5.9 Zion containment loads at vessel breach: cases involving vessel breach at high pressure without containment sprays operating (dry cavity). NUREG-ll50 C-44
Appendix C The variance in the estimated containment loads (among panelists) for Zion is also very similar to that for Surry. The variance indicated in the individual distributions displayed in Figure C.5.7 (for Surry) is repre-sentative of that observed for Zion. Individual panelists' distributions for Zion are, therefore, not dis-played in this document; the reader is encouraged to review Reference C.5.2 for this information. Containment Load Distributions for Sequoyah The case structure for this plant includes an additional variable to account for uncertainties related to ice condenser performance (namely, the fraction of ice remaining at vessel breach). Distributions for Se-quoyah containment loads for the cases similar to those displayed previously for Surry and Zion are shown in Figures C.5.10 and C.S.11 (i.e., they represent the loads for high-pressure accident scenarios with and without containment sprays operating, respectively). Note that for cases with a wet reactor cavity,' the distributions for containment pressure rise were observed to be relatively inst e.ive to the assumed tize of the hole generated in the reactor vessel bottom head at vessel breach. Separate distributions are, :Lere-fore, not displayed in Figure C.S.10 for cases with different assumed hole size. At Sequoyah, there are accident progressions when the reactor cavity is deeply flooded * * (water level is well above the bottom of the reactor vessel, attaining a level as high as the hot legs). The expert judgment concerning this plausible situation is that pressure rise atteadant to HPME is substantially mitigated. Containment loads for the deeply flooded cases were assessed separately from the dry and wet cavity cases and, because the threat to containment integrity is minimal, they are not presented here. The reader is encouraged to consult Refer-ence C.S.2 for full details of the containment loads for the cases witu a deeply flooded cavity. In Figures C.5.10 and C.S.11, the load distributions represent accident situations in which a substantial fraction (greater than 50 percent) of the initial inventory of ice remains in the ice condenser at vessel breach. Such condition $ rney arise during small-break LOCAs or station blackout. Other accident scenar-ios, however, may result in substantial ice depletion prior to reactor vtesel breach (such as small-break , LOCAs with failure of ECCS in the recirculation mode). Representative distributions of containment loads l at vessel breach for these cases are shown in Figure C.S.12. The value of the ice condenser for containment pressure suppression is rudily apparent when comparing the distributions in Figure C.5.12 with those in Figures C.5.10 and C.5.11. The Sequoyah containment is considerably more likely to survive the static pressure loads generated at vessel breach if a substantial quantity of ice (i.e., greater than 10 percent of the initial inventory) remains in the ice condenser than when the ice inventory is depleted. The influence of containment spray operation on containment per-formance is noticeable, but far less dramatic. C.S.3 Treatment in PRA and Results The probability distributions for this issue were implemented in the PWR accident progression event trees. These trees (one for each plant) provide a structured approach for evaluating the various ways in which a severe accident can progress including important aspects of RCS thermal-hydraulic response, core melt behavior, and containment loads and performance. The accident progression event tree for each plant is a j key element in the assessment of uncertainties in risk;it considers the possibility that a particular accident sequence may proceed along any one of several alternative pathways (i.e., alternative combinations of events in the severe accident progression). The probability distributions for individual and combinations of events within the tree provide the " rules" that determine the relative likelihood of various modes of containment failure. ; As mentioned in the introduction to Section C.5, uncertainties in containment loads accompanying high-pressure melt ejection are not major contributors to the overall uncertainty in risk for any of the three PWRs examined in this study. There are two reasons for this. First, comparison of the range of potential
'For substantial quantities of water to accumulate on the containment floor and overflow into the Sequoyah cavity, the refueling water storage tank (RWST) inventory must dump onto the containment floor (e.g.. via containment sprays) and approximately 25 preent of the ice inventory must melt. " Deep flooding of the cavity occurs with approximately 50 percent melt of the ice inventory and transfer of the RWST inventory onto the containment floor.
C-45 NUREG-1150
Appendix C HPME with RWST dump (covity wet) Sequoyah: soe tentio, ic, rom ining. LOADS: (no sensitivity to RPV hole size)
-A" : Lg Frac Melt Ej "E" : Sm Frac Melt EJ Cumulative Probability 1 =s ,a y
- g. . ,, . . . .e O.9 -
l , l a 0.8 - i a' l 0.7 -
/ ./ l 1
l l l l 0.6 -
/ -
l l 0.5 - i 4
- : i 0.4 -
l l ; 1 l l i O.3 - l/ f Probability of 0.2 - l .i i l/ Surviving Load-P j ll 0.1 - .!.! 1 0 ' == ' ' ' ' 0 i 2 4 6 8 10 12 14 16 18 Pressure (bar) Figure C.S.10 Sequoyah containment loads at vessel breach: cases involving vessel breach at high pres-sure without containment sprays operating (. vet cavity) and a substantial inventory of ice remaming. NUREG-1150 C-46
Appendix C HPME without RWST dump 4 (covity dry) ' Sequoyah: Sut>.tonti.i ic rom.ining. Hole Frection Melt H ole Fraction Melt LOADS: Size Ejected Size Elected "G" : Large Large "A" : Large Small "E" : Small Large "O- : Small Small , Cumulative Probability 1 ,v gg,p g. . . . . . a9. . . . . . . . . . u O.9
- l ,.-
O.8 - ll a
@ ?.
, .S' W 0.7 -
ll l :l 0.6 - ll l
- , l 0,5 -
oo ?9 0.4 - ll l l ll l , l 0.3 - ll ll
,h Probability of 0.2 -
!! ll ll // Surviving Load-P 0.1 -
ll ll 6 ii 5" ' ' 0* O 2 4 6 8 10 12 14 16 18 Pressure (bar) Figure C.5.11 Sequoyah containment loads at vessel breach: cases involving vessel breach at high pres-3ure without containtnent sprays operating (dry cavity) and a substantial inventory of ice remaining. C-47 NUREG-1150
f Appendix C HPME without RWST dump (cavity dry) Sequoyah: uttie or no ice remaining. LOADS: (no sensitivity to RPV hole size) l
~A : Lg Frac Melt Ej -H : Sm Frac Melt EJ i
Cumulative Probability
== ,
1 x p p l 2' 6' 0.9 -
/
0.8 - l ,','
\
$. .?'
0.7 - l l
- i Probability of
/ f' O.6 -
l l Surviving Load-P / ,/ 0.5 - i 4 l l 0.4 - l l l l l l 0.3 - l /
$ ?
0.2 - ! i 1 l / 0.1 - .
- ,./
? b 0 ' ' ##' == ' ' ' '
O 2 4 6 8 10 12 14 16 18 Pressure (bar) Figure C.S.12 Sequoyah containment loads at vessel breach: cases involving vessel breach at high pres-sure without containment sprays operating (dry cavity) and a negligibly small inventory of ice remaining. NUREG-1150 C-48
Appendi:t C
+ loads against the estimated strength of the large, dry containments (Surry and Zion) indicates high confi-dence that these containments can accommodate the pressure increment accompanying high-pressure melt ejection. A similar conclusion cannot be supported for the Sequoyah containment without additional assurance that some of the containment safety features operate (e.g., a substantial inventory of ice re-mains at the time of vessel breach). Secondly, accident sequences that have traditionally been considered as "high-pressure" core meltdown accidents (e.g., a fast station blackout *) are estimated to result in a depressurized reactor vessel by the time of reactor vessel breach with a relatively high frequency. Depres-surization mechanisms considered in the present analysis include temperature-induced hot leg failure and steam generator tube ruptures, reactor coolant pump seal failures, and stuck-open power-operated relief valves (PORVs). These mechanisms are described in detail in Section C.6. The result of incorporating the potential for reactor vessel depressurization prior to vessel breach is a reduced frequency of high-pressure melt ejection and reduced containment loads at vessel breach. Another potential means of mitigating HPME loads at Sequoyah is deep flooding of the reactor cavity. However, deep flooding introduces a potential for an ex-vessel steam explosion. Challenges to containment integrity from ex-vessel steam ex-plosions are discussed in Section C.9.
As an illustration of the reduced frequency of high-pressure melt ejection and a resulting reduced fre-quency of early containment failure in the present analysis (from that estimated in the preliminary analy-ses-published in the February 1987 draft for comment release of this report), Table C.S.1 summarizes the relative likelihood of various modes of containment failure for each of the PWRs examined. The numbers shown in this table are frequency-weighted averages (i.e., they are the mean probability of con-tainment failure given core damage), it is important to note that the probability of no containment failure is significant, and the average probability of early containment is shown to be low for all three plants. Table C.5.1 Mean conditional probability of containment failure for three PWRs. Containment Failure Mode Surry Zion Sequoyah Early failure with reactor vessel at pressure > 200 psi 0.004 0.02 0.04 Early failure with reactor vessel at pressure < 200 psi 0.0 - 0.02 Late containment failure <0.01 - 0.04 Containment bypass 0.12 0.006 0.06 . Others (alpha,' basemat meltthrough) 0.06 0.22 0.18 No containment failure or arrested core damage 0.81 0.76 0.66 with no vessel breach
- Steam explosion-induced containment failure. The analyses supporting the quantification of this mode of containment failure are described in Section C.9.
l
- A fast station blackout involves the loss of electrical power and failure of steam-driven auxiliary icedwater, thus render-ing all decay heat removal systems unavailable.
l C-49 NUREG-1150
l Appendin C
]
REFERENCES FOR SECTION C.5 C.S.1 E.D. Gorham-Bergeron et al., " Evaluation of Severe Accident Risks: Methodology for the Acci-dent Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analyses," San-dia National Laboratories, NUREG/CR-4551, Vol.1, Draft Revision 1, SAND 86-1309, to be published.* C.5.2 F.T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major Input Parame-ters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Draft Revision 1, 1 SANDB6-1309, to be published.* -i
,v .
l C.S.3 R.J. Breeding et al., " Evaluation of Severe Accident Risks: Surry Unit 1,"_ Sandia National Labo-ratories, NUREG/CR-4551, Vol. 3, Draft Revision 1. SAND 86-1309, to be published.' C.S.4 A.C. Payne, Jr., et al., " Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4,' Draft Revision 1, SAND 86-1309, to be .] 1 published.* j C.S.5 l J.J. Gregory et al., " Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National l Laboratories, NUREG/CR-4551, Vol. 5, Draft Revision 1, SAND 86-1309, to be published.'
]
C.S.6 T.D. Brown et al., " Evaluation of Severe Accident Risks: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1, SAND 86-1309, to be published.* C.S.7 C.K. Park et al., " Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National ! Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.' C.5.8 D.C. Williams et al., " Containment Loads Due to Direct Containment Heating and Associated Hydrogen Behavior: Analysis and Calculations with the CONTAIN Code," Sandia National Labo-ratories, NUREG/CR-4896, SAND 87:-0633, May 1987, l C.S.9 M. Pilch and W. Tarbell, " Preliminary Calculations of Direct Heating of a Containment Atmos-l, phere by Airborne Core Debris," Sandia National Laboratories, NUREG/CR-4455, SAND 85-2439, July 1986. C.5.10 W. Tarbell et al., "Results from the DCH -1 Experiment," Sandia' National Laboratories, NUREG/CR-4871, SAND 86-2483 June 1987. C.5.11.M. Pilch et at, "High Pressure Mek $jection and Direct Containment Heating in Ice Condenser Containments," Proceedings of the International Topical Meeting on Operability of Nuclear Power Systems in Normal and Adverse Environments, ANS/ ENS (Albuquerque, NM), Septem-ber 29-October 3,1986, SAND 87-2141C. C.5.12 M. Pilch and W. Tarbell, "High Pressure Ejection of Melt from a Reactor Pressure Vessel," Sandia National Laboratories, NUREG/CR-4383, SAND 85-0012, September.1985. C.5.13 W. Tarbell et al., " Pressurized Melt Ejection into Scaled Reactor Cavities," Sandia National Laboratories, NUREG/CR-4512, SAND 86-0153, October 1986.
'Available in the NRC Pubna Document Room,2120 L Street NW., Washington, DC.
NUREG-1150 C-50
Appendin C
- C.6 Mechanisms for PWR Reactor Vessel Depressurization Prior to Vessel Breach The previous section addressed the range of thermodynamic loads to a PWR containment accompanying penetration of the reactor pressure vessellower head by molten core debris and subsequent ejection of material into the containment atmosphere. These loads can present a significant challenge to containment integrity if penetration of the reactor vessel occurs at suf ficiently high vessel pressure. For the three PWRs examined in this study, however, a substantial fraction of the severe accident progressions that started with the reactor vessel at high pressure depressurized before vessel breach. That is, many of the accident scenarios important to risk result in-by one means or another-a breach in the reactor coolant system (RCS) pressure boundary of sufficient size to reduce reactor vessel pressure below approximately 200 psi before reactor vessel lower head failure. An outcome of this result is that the uncertainties in high-pressure melt ejection loads are observed to have a relatively small impact on the overall uncertainties in reactor risk. This observation is a substantial change in results from those of preliminary analyses pub-lished in draft form in February 1987.
Unlike the BWRs examined in this study, the PWRs do not have a system specifically designed to manu-ally depressurize the reactor vessel. Feed and bleed operations can effect limited depressurization if the necessary systems are operable. Many of the accident sequences leading to core damage in the three PWRs examined irg this study, however, include combinations of failures that render feed-and-bleed op-erations unavailable. This section addresses the other means by which the reactor vessel pressure may be reduced to levels below which high-pressure melt ejection loads do not threaten containment integrity:
- Temperature-induced failure of steam generator tubes, e Temperature-induced failure of primary coolant hot leg piping or the pressurizer surge line, e Failure of reactor coolant pump seals, e Stuck-open power-operated relief valves (PORVs), and i
e Manual (operator) actions to depressurize the RCS. The estimated frequency of each of these events and their influence on reactor vessel pressure was incor-I porated in the accident progression analysis for the Surry, Sequoyah, and Zion plants. Manual depressuri-zation was found to be ineffective for most PWR accident sequences because of limitations in the appro-priate emergency procedures and the need for ac power to operate relief valves. This mechanism is, therefore, not discussed further. The manner in which the other hypothetical events were considered, the means of quantifying their likelihood, and illustrations of the impact they have on the results are discussed in the following sections. C.6.1 issue Definition ] The general issue is the frequency with which PWR severe accident progressions involve a breach in the RCS pressure boundary of sufficient size to reduce the reactor ves el pressure below approximately 200 psia. The mechanisms for depressurizing the reactor vessel that are considered in the present analysis are those listed in the introduction above. The first two mechanisms involve temperature-induced (i.e., creep i rupture) failures of RCS piping lIn both cases, the heat source for such failures is hot gases transported ] i from the core via natural circulation or exiting the RCS through the PORV. The natural circulation pattern may involve an entire RCS coolant loop if water in the loop seals has cleared. If the loop seals have not cleared, a countercurrent natural circulation flow pattern may be established within the hot leg piping, transporting superheated gases and radionuclides from the core region of the reactor vessel to the steam ! 1 generators. Effective cooling of the steam generator tubes is not available in many of the accident se-quences considered in this analysis because of depletion of secondary coolant inventory earlier in the accident. Decay heat from radionuclides deposited in the steam generator inlet plenum and inside the tubes may also contribute to local tube heating. In either case, natural circulation flow (if established) may i; l C-51 NUREG-1150 1
Appendix C be interrupted by the frequent cycling of the pressurizer PORV or by the accumulation (and stratification) of hydrogen in the reactor vessel upper plenum and hot legs. The specific parameter to be quantified is the frequency with which creep rupture of hot leg piping or steam generator tubes results from the transfer of heat from the core (via gas circulation) to RCS structures. The temperature-induced failures of interest j here are limited to those that occur before reactor vessel failure. [ Degradation and failure of reactor coolant pump seals may also result from overheating. In this case, j overheating results from the loss of seal cooling water flow or loss of heat removal from the seal cooling ! water system. A number of potential " seal states" have been identified in reactor coolant pump perform-ance studies, which result in a range of plausible leak rates from the reactor coolant system. The parar e- ! ters to be quantified are the frequency of pump seal LOCAs, the relative likelihood of various leak rates i that result from these failures, and the resulting value of reactor vessel pressure at the time of vessel ' breach. The fourth mechanism considered in this analysis, stuck-open PORV(s), may result following the repeated cycling (opening and reseating) of the PORVs during the course of an accident. Such events have been observed (with relatively low frequency) during transient events in which plant conditions never exceed design basis conditions. PORVs have also been tested for their reliability to close after repeated cycles at design basis conditions. This issue considers the effect of beyond design basis conditions on the frequency with which PORVs fail to riose after several cycles. l f C.6.2 Technical Bases for Issue Quantification Two of the four mechanisms, temperature-induced hot leg failure and steam generator tube ruptures, were presented to a panel of experienced severe accident analysts. Each panelist was asked to provide a prob-ability distribution representing their estimate of the frequency of each event. Their judgments were to be based on current information made available to each of the panelists and their own professional experi-ence. The panelists participating were: Vernon Denny-Scierce Applications International Corp., Robert Lutz-Westinghotee Electric Corp., and . Robert Wright-U.S. Nuclear Regulatory Commission. The individual distributions prepared by these panelists were then combined (i.e., an aggregate distribu-tion was generatd by averaging those of the three panelists) to develop a single distribution for application , in the PRA. The methods used to aggregate individual panelists
- distributions are described in Reference C.6.1.
The frequency of reactor coolant pump seal failures was addressed by an expert panel in support of the systems analyFis for the PWRs (Ref. C.6.2). This panel's judgments were adopted for use in the accident i progression event tree. Very limited data are available to support an assessment of the frequency of PORVs sticking open when subjected to severe accident conditions. A broad distribution was, therefore, , assigned to the frequency of stuck-open PORVs. A summary of the technical bases for quantifying the frequency of RCS depressurization for each of these four mechanisms is given below. Frequency of Ilot Leg Failure A case structure was established to consider a spectrum of plausible severe accident conditions for which the frequency of hot leg failures needed rsbe quantified. The case structure was formulated around accident sequences that represent a significant contribution to the total core damage frequency. The cases considered were: Case 1: A classic TMLB" scenario (station blackout). RCS pressure is maintained near 2500 psia by the continuous cycling of the PORV. The secondary side of the steam generator is at the steam relief
' Reactor Safety Study [ WASH-1400] nomenclature for accident sequence delineation. The alphabetical characters repre-sent compound failures of plant equipment leading to the loss of plant safety functions. The characters TMLIP represent a transient initiating -event, loss of decay heat removal, and loss of all electrical power.
NUREG-1150 C-52
App;ndix C valve setpoint pressure (approx.1000 psia) and is depleted of coolant inventory. Reactor coolant pump seal cooling is maintained at the nominal flow rate. Case 2: Station blackout sequence during which reactor pump coolant seals fail, yielding a leak rate equivalent to a 0.5-inch-diameter break in each coolant loop. The steam generator secondary coolant inventory is depleted and the auxiliary feedwater system is unavailable. Case 3: Same as Case 2 except the steam generators maintain an effective RCS heat sink with auxiliary feedwater operating 4 The technical bases used by the panelists for characterizing the frequency of temperature-induced hot leg failures for each case were dominated by calculations performed with various severe accident analysis computer codes and by several different organizations. Those cited by the panelists in their elicitation (Ref. C.6.1) included TRAC /MELPROG calculations of TMLB' scenarios in Surry (Ref. C.6.3), l
^
RELAF5/SCDAP calculations of similar accident scenarios (Ref. C.6.4), CORMLT/PSAAC calculations for Scrry and Zion (Refs. C.6.5 and C.6.6), and MAAP calculations performed in support of the Ringhals 3 FRA (Ref. C.6.7) and the Seabrook PSA (Refs. C.6.8 and C.6.9). Ringhals 3 is a three-loop plant with an NSSS similar to that of Surry; Seabrook is a four-loop plant with an NSSS similar to those of Sequoyah and Zion. Only two specific references were cited by the panelists regarding experimental data or other physical evidence of natural circulation and its effect on heating RCS structures. These were the natural circulation experiments sponsored by EPRI (Ref. C.6.10) and the results of post-accident examinations of the Three Mile Island Unit 2 core debris and RCS structures (Ref. C.6.11). Information from neither of these sources is believed to have significantly influenced the panelists
- judgment on this issue.
The aggregate distribution for the frequency of temperature-induced hot leg failures are shown in Figure C.6.1 for Cases 1 and 2 outlined above. The probability that Case 3 would result in an induced hot leg failure was judged to be essentially zero. The distributions shown in Figure C 6.1 are displayed in the form fI of a cumulative distribution function (CDF); that is, the curve displays the probability that the frequency of an induced hot leg failure is not greater than a particular value. The likelihood of an induced hot leg failure, given a station blackout accident dunng which the reactor vessel pressure remains high (i.e., no reactor coolant pump seal LOCAs, stuck-open PORVs, etc.), is shown to be relatively high; the median frequency is greater than 95 percent. In contrast, lower reactor vessel pressures in Case 2 (with an early pump seal LOCA) make an induced hot leg failure unlikely; there is an 83 percent chance that a hot leg failure will not occur. Frequency of Induced Steam Generator Tube Ruptures Essentially the same information (results of several computer code calculations) were used to characterize induced SCTR frequency. All three panelists agreed that the likelihood of an induced SGTR is quite low. The three panelists noted that temperature-induced tube ruptures are driven by the same phenomena that drive temperature-induced hot leg failure (natural circulation flow of hot gases from the reactor vessel); therefore, the frequency distributions are correlated. Two of the panelists believed that the frequency of SGTR is very small because of the assumption that the hot leg would fail first, and neither of their distribu-tions for frequency of induced-SGTR exceeded 2 value of 0.0005. The aggregate distribution (shown in Fig. C.6.2) is dominated by a single panelist, whose distribution was strongly influenced by consideration of pre-existing flaws in steam generator tubes, resulting in the assumption that SGTR might occur before hot leg failure. Frequency of Induced Reactor Coolant Pump Seal LOCAs The frequency of pump seal LOCAs of various sizes (corresponding to various pump seal states) was considered by a panel of experts as a systems analysis issue. Degradation mechanisms for reactor coolant pumps are highly plant- (or pump-) specific and can be quite complicated. Details of the analyses leading to the characterization of the various pump seal states and the corresponding spectrum of possible leak l C-53 NUREG-1150
, 1
)
F ( . e r _ l u _ i a O ,
- 8. F 0 .
_ L g e _ t _ o H h t ,
- 6. d i
0 e _ w c _ t t u u u d O o o) n k kA I c) cC f l aA aO o bC l b L . 4 y n O na l 0 c o L il io e -
- n t a ae t s a e t
t o u ( s s sn q P ( d e r 2 C 1
' - n ER Ea 2. F S S i O A A C C
[(. - - _' @O
-8 1 6 4 2 0 0 0 0 .
0 Probabi t y of Not Exceeding - F 2E8LE T
. v.
.. ts Appendix C 1
P r o b a b l 0.8 - [ I i t Y 0.6 - y Distribution applies to o Surry, Zion and Sequoyah o t 0.4 - E X C e " e d 0.2 - i n 9 u F n , , , , , , 0.02 0.04 0.06 0.08 0 0.1 0.12 0.14 Frequency of Induced SG Tube Rupture (F) Figure C.6.2 Aggregate distributions for frequency of temperature-induced steam generator tube rupture. C-55 NUREG-1150
- 3
- Appendix C d
l i ' rates are not provided here but are available in the contractor documentation of the expert panel elicita - ~
' tions (Ref. C.6.2). An indication of the potential importance of modeling pump seal LOCAs, however, .
can be found by examini., the accident progressions for which the reactor vessel pressure remains at or '
~
i ni,ar the system setpoint (e.g., station blackouts with no other breach in the RCS pressure boundary). In ; the Surry analysis, approximately 71 percent of these accident progressions result in a failure of the seals-in at least one reactor coolant pump. Of these,' roughly one-third are estimated to result in a large enough - leak rate to depressurize the reactor vessel to'less than approximately 200 psia prior to reactor vessel - breach; another third result in leak rates small enough to preclude any significant depressurization. In the . ) remaining one-third of the cases, the reactor vessel is at intermediate pressure (200-600 psia) at the time l of vessel 'oreach (Ref. C.6.12). Frequency of Stuck-Open PORVs This issue was also addressed in the " front-end" analysis as 1m uncertainty issue (Ref. C.6.2). The RCS conditions under which PORVs will cycle after the onset of ore damage, however, are expected to be significantly more severe than those for which the valves were designed and more severe than the condi-tions under which PORV performance has been tested. In lieu of specific analyses, test data, or operating experience, an estimate of frequency with which a PORV will stick open and an estimate for the resulting RCS pressure were generated as follows: The valve is expected to cycle between 10 to 50 times during core degradation and prior to vessel' breach. Extrapolation of the distributions for the frequency of PORV failure-to-close from the front-end elicitation indicates an overall failure rate (for 10 to 50 deman.Js) in the neighborhood of 0.1 to . 1.0, A uniform distribution from 0.0 to 1.0 was, therefore, used in the Surry and Sequoyah analyses. TRAC /MELPROO and Source T9rm Code Package (STCP) analyses were review'e d to characterize the rate at which a stuck-open PJRV could depressurize the reactor vessel (Ref. C.6.12). The results - of this review resuhed in an estimate that there is an 80 percent probability that the reactor vessel-pressure at the time of vessel breach will be less than 200 psla; 'in the remaining 20 percent of the cases, the vessel pressure will be at intermediate levels (200-600 psia). C 6.3 Treatment in PRA and Results The probability distributions for this issue were implemented in the PWR accident progression event trees. These trees (one for each plant) provide a structured approach for evaluating the various ways in which a severe accident can progress, iricluding important aspects of RCS thermal-hydraulic response, core melt R behavior, and containment loads and performance. The accident progression event tree for each plant is a key element in the assessment of uncertainties in risk; it considers the possibility that a particular accident j sequence may proceed along any one of several alternative pathways (i.e., alternative combinations of events in the severe accident progression). The probability distributions for individual and combinations of. events within the tree provide the " rules" that determine the relative likelihood of various modes of containment failure. l For the issue of reactor vessel depressurization, probability distributions for each of the mechanisms dis-cussed above were incorporated in the accident progression event tree to determine reactor vessel pres-sum prior to vessel breach. As indicated in Section C.5, the containment loads accompanying vessel, breach strongly depend on reactor vessel pressure. The load at vessel breach assigned to a particular accident progression, therefore, depends on the outcome of questions in the tree regarding reactor vessel depresmrization. Selected results from the accident progression event tree analysis are summarized below. The pressure history (as determined by the Surry accident progression event tree) for slow station black-out accident sequences
- is summarized in Table C.6.1. This table shows the fraction of slow blackout accident progressions for which the RCS pressure is at the PORV setpoint at high, intermediate, and low levels at the time the core uncovers and the time of reactor vessel breach.
" Slow station blackout accident sequences contribute more than one-half of the mean total core damage frequency for
- Earry. The results indicated for this group of accident sequences are not generally applicable to other Surry accident sequences or other pMnts.
NUREO-1150 C-56
Appendix C A substantial fraction of the slow blackout accident progressions that start out with the RCS pressure at the PORV setpoint pressure are depressurized by one (or more) of the mechanisms described in Reference C.6.1 and result in a low pressure by the time of vessel breach. A sensitivity study was performed to examine the effect of neglecting temperature-induced hot leg failure and steam Eenerator tube ruptures on the observed results. Table C.6.2 summarizes the results of this study (presented in an identical format as Table C.6.1). Table C.6.1 Surry reactor vessel pressure at the time of core uncovery and at vessel breach. Fraction of Slow Blackout Accident Progressions With Pressure P at the Time of: RCS Pressure Core Reactor (osia) Uncoverv Vessel Breach - 2500 0.54 0.06 1000--1400 0.13 0.10 200- 600 0.33 0.19
<200 0.0 0.65 Table C.6.2 Surry reactor vessel pressure at the time of core uncovery and at vessti breach (sensitivity , study without induced hot leg failure and steam gen *rator tube ruptures).
Fraction of Slow Blackout Accident Progressions With Pressure P at the Time ef: RCS Pressure Core Reactor fosini Uncoverv Vessel Breach 2500 0.54 0.25 1000-1400 0.13 0.10 200- 600 0.33 0.19
<200 0.0 0.46 The results for pressure when the core uncovers are not affected by the change since temperature-induced hot leg failure and steam generator tube ruptures can only occur after the onset of core damage. The elimination of the possibility of these failures does affect the fraction of accident progressions involving reactor vessel breach at high pressure. The occurrence of high-pressure melt ejection is observed to j roughly double in frequency.
The increase in accident progressions resulting in vessel breach at high pressure is not observed to signifi-cantly affect the likelihood of early containment failure, however. Table C.6.3 shows the fraction of slow blackout accident progressions that result in various modes of containment failure (including no-failure) for the Surry base case analysis and for the sensitivity analysis in which induced hot leg failures and steam ; generator tube ruptures were eliminated. l The insignificant change in results is largely attributable to the strength of the Surry containment and its l ability to withstand loads as high as those estimated to accompany high-pressure melt ejection with a < relatively high probability (refer to Section C.5). Qualitatively similar results are observed for Sequoyah. Elimination of the potential for early reactor vessel depressurization by induced hot leg failure of steam generator tube rupture (via a sensitivity analysis) has a noticeable, but not dramatic, influence on the likelihood of high-pressure melt ejection. Table C.O.4 j i C-57 NUREG-1150 ) j i
Appendin C shows the fraction of Sequoyah accident progressions '(for two important types of core melt accidents) that results in high-pressure melt ejection
- for the base case analysis and the sensitivity analysis. In adjacent columns of this table are the fractions of the time that high-pressure melt ejection occttrs and results in -
~ containment failure by overpressurization.
Table C.6.3 Fraction of Surry slow blackout accident progressions that result in various modes of containment failure (mean values). Fraction of Slow Blackout Accident Progressions Resulting la Containment Failure Mode X . Containment Base Case- - Sensitivity. Fallura Mode Analvala Analvala Structural Rupture 0.01 0.01 Leak 'O.01 0.01 Basemat Meltthrough 0.07 0.06 Containment Bypass < 0.01 0.0 No Failure
- 0.91 0.92
' included in this category are accident progressions in which core damage is arrested in-vessel, thus preventing reactor vessel breach and containment failure. For Surry, these cases comprise approximately 60-65 percent of the "No Fall- -
ure" scenarios. I l Table C.6.4 Fraction of Sequoyah accident progressions that result in HPME and containment i overpressure failure. i Fraction Resulting in Fraction of Columns (A) . l HPME without Cases in which Containment - , a Flocded Cavity Overpressure Failure Occurs (A) (A) Type of Core Base Case Sensitivity Base Case Sensitivity Damage Accident Analysis Analysis ' ' Analysis . Analysis LOCA 0.11 0.11 0.16 0.16 Station Blackout 0.16 0.21, 0.20 0.21 As might be expected, no change is observed for the LOCA accident scenarios. Negligible changes are also observed for station blackout scenarios. 1
'The values shown only account for cases in which HPME occurs in a cavity that is not deeply flooded. Cases in which the cavity is deeply flooded do not usually generate loads sufficiently large to threaten containment integrity.
NUREG-1150 C-58
j Appendix C
.l l
1
. REFERENCES FOR SECTION C.6 :j C.6.1 F.T. liarper et al., " Evaluation of Severe Accident Risks: Quantification of Major input Parame--
ters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Draft Revision ' 1. SAND 86-1309, to be published.' j C.6.2 T.A. Wheeler et al., " Analysis of Core Damage Frequency from Internal Events: Expert Judg-ment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND 86-2084, April 1989. C.6.3 J.E. Kelly et al., "MELPROG PWR/ MOD 1 Analysis of a TMLB' Accident Sequence, Sandia National Laboratories, NUREO/CR-4742, SAND 86-2175, January 1987 C.6.4 P.D. Bayless " Natural Circulation During a Severe Accident: Surry Station Blackout," EG&O ~ Idaho, Inc., EOO-SSRE-7858,1987, C.6.5 V.E. Denny and B.R. Sehgal, "PWR Primary System Temperatures During Severe Accidents," ANS Transactions, 47, (317-319). C.6.6 B.R. Sehgal et al., " Effects of Natural Circulation Flows on PWR System Temperatures During Severe Accidents," 1985 National Heat Transfer Conference, (223-234),1985. C.6.7 R.J. Lutz, Jr., et al., "Ringhals Unit 3 Severe Accident ' Analyses to Support Development of Severe Accident Procedures," Wer.tinghouse Nuclear Technology , & Systems Division, WCAP-11607,1987. C.6.8 M.G. Plys et al., "Seabrook Steam Generator Integrity Ar.alysis," Fauske & Assoc., FAl/86-39, 1986. C.6.9 K.N. Fleming et al., " Risk Management Actions to Assure Containment Effectiveness at Seabrook Station," Pickard, Lowe and Garrick, PLG-0550,1987. C.6.10 W.A. Stewart et al., " Experiments on Natural Circulation Flow in a Scale Model PWR Reactor System During Postulated Degraded Core Accidents," Proceedings of Third International Topical Meeting on Reactor Thermal Hydraulics (Newport, RI), ANS, Vol 1, October 1985.' l C.6.11 American Nuclear Society, Transactions of the ANS/ ENS Topical Meeting on the TMI-2 Acci- ; dent (Washington, DC), October 30-November 4,1988. j 1 C.6.12 J.E. Kelly memorandum to R.J. Breeding, "RCS Pressure at Vessel Breach," Sandia National - Laboratories, dated January 27,1989 (with errata dated February 15, 1989). l j
'Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
I C-59 NUREG-1150 s
Appendix C l C.7 Drywell Shell Meltthrough The potential for early containment failure is an imponant contributor to the potential consequences of
~
severe accidents and, thus, to risk. In this context, "early" means before or immediately following the time at which molten core debris penetrates the lower head of the reactor vessel. A number of plausible mechanisms for early containment failure were identified in the Reactor Safety Study, many of which have ' since been determined to be cf extremely low probability and are currently considered to be negligible contributors to risk. More recent containment performance studies have identified a few mechanisms that . were not considered in the Reactor Safety Study and have been found to be important contributors to the l uncertainty in risk for some plants. An early failure mechanism that has received a great deal of attention is penetration of a BWR Mark I containment resulting from thermal attack of the steel containment shell by molten core debris.-The scenario for thi.e mode.of containment failure postulates that, as core debris exits the reactor pressure vessel and is dep3 sited on the floor within the reactor pedestal, it flows out of the pedestal region through an opeo doorway in the pedestal wall and onto the annular drywell floor. For the debris to contact the drywell shd!, h must flow across the drywell floor until it contacts the steel containment shell along the line ' where the shell is embedded in the drywell floor. Figures C.7.1 and C.7.2 show the relevant geometry of the Peach Bottom drywell in vertical and horizontal cross-sections, respectively. If hot debris contacts the drywell shell, two failure modes may occur; the combined effects of elevated containment pressure and : local heating of the steel shell may result in creep rupture, or, if hot enough, the debris may melt through the carbon steel shell. Both of these plausible modes are considered in this issue and are collectively t! referred to as "drywell shell meltthrough." C.7.1 Issue Definition This issue represents the ensemble of uncertainties associated with the conditional probability of drywell shell meltthrough. (Failure is conditional on core meltdown progressing to the point that core debris penetrates and is discharged from the lower head of the reactor pressure vessel.) ' This probability is known to depend on the condition of the core debris (physical state, composition, release rate from the reactor vessel, etc.) as it relocates to the reactor pedestal floor. Distinct cases are established to consider each plausible combination of debris conditions at vessel breach separately. The em structure accounts for uncertainties in severe accident events and phenomena that precede the potentii.. challenge to drywell integrity by drywell shell meltthrough. Uncertainties associated with the processes and events that occur after core debris leaves the reactor l vessel are represented by the probability distribution assigned to each case. The parameters considered in l the case structure are: Parameters Definine Case Structure Values Considered
- 1. Rate at which core debris flows out of Illgh: R >100 kg/sec the reactor vessel. Med: 50 kg/sec>R >100 kg/sec Low: 50 kg/sec>R
- 2. Reactor vessel pressure when core Ifigh: Near 1000 psia ,'.
debris first begins to exit the vessel. Low: < 200 psia
~
- 3. The amount of unoxidized metals in the melt. Iligh: 65 percent of initial inventory (representing range: 50-80 percent)
Low: 35 percent of initial inventory (representing range: 20-50 percent) 4 The amount of debris superheat (temperature above liigh: > 100K melting point of the debris). Low: < 100K NUREG-1150 C-60 l
Appendix C f BLOWOUT BLOWOUT PANELS PANELS REFUELING BAY
;;;;. ... .)*
g . .
. : .?.
ristrisaiisiti/iiiiiiiiiiii,/iii//in m, ;; . , . ,, , m;,:
.. ~;;
...;. . ::.; i.
...r a:
.. ..s. . .,
, r.e ..
- .\. . r. ... ..
CZ:= - >-
.: t/.;.
.L, ;'l . . ..
- ':, AEACTOR h..f. -
[*.'
; h, ;;f .; VESSEL p 3[.*
- ?. U.: s
'. .'.s'.
i
- ll*?. *
- i. *l.- ..
'.**.. :: DRYWELL
~~-
.' :s * ' ::.
'g y.'.:..: k.n a y3 @,a;: m ;...e .a.$..: O .' :.
*,b: .'
.n. . .. ' -
PIPE TUNNEL l ; ' $j;'h.' k.'.I.? HATCH l \ Ji .'. N & : . :: ;'. &~.e.., 9...
..,'e*
- s. -.-
~'o'; 't : '- '.,C /
r
- s). TORUS
, .'. .s', * *J Y
g .,.,. / r-
...,Y'..,.',...'..
''.E'-]s.
.. . ,:.5.:.*.'**:.'. .. 'l,*[ .}l*. {l_, f
! ?,
RCAv E AC, rrTOR y *
~ . ~ , * :W.'. . * .
. ' ..;y Q. ..
- '.l g *.s: , :p . ..:.' ...*y..:.
.'f, :' . * .. .
.s ..
w....d,..
. ;:.Y..;. N. ./' h. . ".EY: $..$...id. e.6..,3. ...%. . .. 'M.
, . .,.v..
. ... . t.
.:.m. ... ..,..e..,......
... SUPPRESSION t '.',: '.': b :. ';.r?:.'< * .;;<i...**. : : *'*:.:.s ' d . ::: *.:.; *e ',' SUPPRESSION *-.
D2.i'.:.g .'*..o .'. POOL M.f, r,', pool .'
.. ...c
- a. .
. . 7,
.'.a...
. f ,-.
'.;;i.+.d::;.:
.; :: o ~: ? :::e::.? i."a.:'. ?. i.'..; ...:;. .e p ...i.:
.......s..~..~
_o. :. :..a.'..
.z Figure C.7.1 Configuration of the Peach Bottom drywell shell/ floor-vertical cross-section.
C-61 NURFG-1150
Appendix C Crywell Steel Shell Concrete Drywell Structure 1 i Reactor Pedestal l
'\
l i
. l l l ;
i l Po:ssible Point of i i ! Debris /Shell l i i Contact i ! 3m I 3m Figure C.7.2 Configuration of the Peach Bottom drywell shell/ floor-horizontal cross-section. NUREG-1150 C-62
Appendix C
- 5. The presence (or lack of) water on the drywell floor Yes: Sufficient to overfill sumps before debris is expelled from the reactor vessel.' and replenishable No: No water on drywell floor To account for the possibility that any permutation of these parameters may be important. the conditional probability of containment failure is quantified for each of the 48 cases. For each case, the containment failure probability is allowed to vary with time (after reactor vessel failure).
The uncertainties con &cd in characterizing the failure probabilities for each case ine!.ide:
. Heat transfer characteristics of the debris on the concrete floor (e.g., thermal properties of melt and concrete, heat transfer coefficients for competing mechanisms, physical configuration of debris con-stituents, rate of internal heat generation).
l e Heat transfer characteristics of the melt / steel shell interface (e.g., anticipated configuration and com-position of debris in contact with steel, mechanism (s) for deterioration of shell thickness, properties of interfaces between debris and steel, and the steel shell and materials outside the shell).
- Debris transport characteristics when flowing across drywell floor (e.g., rheology of molten corium, drywell floor area covered by debris, barriers to flow-sump pits, pedestal wal!).
- Structural t%avior of the carbon steel drywell shell when in contact with molten material (e.g.,
formation of eutectics, alternative failure mechanisms). C.7.2 Technical Bases for Issue Quantification This issue was presented to a panel of six experienced severe accident analysts: David Bradley-Sandia National Laboratories, Michael Corradini-University of Wisconsin, George Greene-Brookhaven National Laboratory, Michael Hazzan-Stone & Webster Engineering Corp., Mujid Kazimi-Massachusetts Institute of Technology, and Raj Sehgal-Electric Power Research Institute. The panelists' individual judgments for the conditional probability of containment failure by drydl shell meltthrough formed the basis for quantifying this issue. Each of the panelists used the results of several published analyses in their deliberations. References C.7.1 through C.7.6 are among those identified by the panelists as having had an influence on their technical judgments. Leinplete documentation of the elicitation of expert judgment is provided in Reference C.7,7. A summary of the probability distributions that were generated by this process and a description of important areas of agreement and disagree. ment are presented below. l l Each panelist generated a conditional probability distribution for each of the 48 cases outlined above. However, as will be shown, the uncertainties associated with this issue (i.e., the divergence in quantitative judgment among the panelists) are quite large. Although collectively divergent, the panelists' judgments are individually self-consistent. As a result, the collective judgment of the panel for all cases can be reasonably characterized by a handful of aggregate probability distributions. To preserve the true charac-teristics of the panel's case-by-case judgments, however, the distributions for individual cases are retained in the analysis for Peach Bottom documented in Reference C.7.8 (refer to Section C.7.3). The aggregate distributions are quite useful for illustrating important similarities and differences in the panelists' rationale and are discussed later. Before discussing specific topics dominating uncertainty, it should be noted that there are some aspects of this issue on which the technical community appears to agree. The appropriate failure criterion for the
*This parameter inczudes the effects of spray operation.
C-63 NUREG-1150
Appendia C drywell steel shell is generally accepted as a shell temperature exceeding 1100-1300K. This range enve-lopes the uncertainties related to alternative mechanisms for failure of the drywell pressure boundary. At the lowr end of this range, breach of the drywell pressure boundary could occur by creep rupture, particularly at elevated containment pressures. Alternatively, localized penetration of the steel shell by molten debris might occur if the debris in contact with the shell is sufficiently hot. It is also generally agreed that the composition and temperature of the debris exiting the react ar pressure vessel are important properties to characterize when estimating the likelihood of hot debris reaching the drywell floor / wall interface. Specifying nese properties, however, is limited by large uncertaintio in core melt progression. These uncertainties have been treated parametrically (i.e., they eye addressed tinough the case structure outlined above).* Unfortunately, the harmony ends here. Most panelists expressed a strong allegiance to a specific technical rationale that, in many cases, was physically inconsistent with rationales expressed by other panelists. These dramatic differences in technical judgment reflect the polarized views on this issue that have devel-oped in recent years. Over the full spectrum of plausible severe accident conditions, roughly half the technical community (as represented by the expert pane') appears to believe with near certainty that the drywell shell will fail following many core meltdown accicents; the other half is equally certain that it will not fail. If drywell shell meltthrough does occur, the containment pressure boundary is most likely to be breached within the first hour following reactor vessel penetration. The variation of the conditional probability of drywell meltthrough among the 48 casos considered in this l issue is not very wide. The net probability (i.e., arithmetic average of all panelists) of drywell shell meltthrough is no smaller than 0.33 and no larger than 0.87. The lowest failure probabilities correspond to cases in which water is assumed to cover the drywell floor; the highest correspond to cases in which the drywell floor is dry, and debris flow rate, debris temperature (superheat), and debris unoxidized metal content are all at the high end of their range. An illustration of the overall result for this issue is shown in Figure C 7.3. As mentioned above, the probability distributions for the 48 cases examined as part of this issue can be aggregated into five classes without introducing substantial error. These are displayed in the figure. Two classes characterize all the cases with low or medium flow rates of debris from the reactor vessel The only single parameter signifi-cantly affecting the failure probability for these cases is the presence (or lack) of replenishable water on the drywell floor (all other parameters are observed to have a relnively minor influence on the probability of failure). Each of the remaining three classes represent "h!gh flow" cases; one represents cases with water covering the drywell floor, and two represent cases witlaut water on the drywell floor. Again, the presence (or lad) of water is the only single parameter significantly affecting the outcome. The values of other parameters (in certain combinations) influenced the panelists' judgment for these cases, however. The highest probability of drywell shell meltthrough is observed for cases in which two of the remaining three parameters take on values at the high end of their range (denoted 2/311 in the figure's legend). Lower values are observed when at least two of the three parameters take on low values (denoted 2/3L), A conclusion that might be drawn from Figure C.7.3 is that the probabidty of drywell shell meltthrough is lowered by ensuring the presence of water on the drywell floor. This poshion is supported by some, but not all, of the panelists. It is important to keep in mind that the values displayed in Figure C.7.3 are averages of individual experts' judgments. As such, they tend to mask the divergence of technical views on many of the topics important to quantifying this issue. In this appendix, we do not intend to elaborate on the details of technical rationales expressed by individual panelists. The reader is encouraged to study Reference C.7.7 to gain a more thorough understanding of the phenomena and modeling assumptions disputed within the technical community. The following example is provided, however, to illustrate the divergence of technical views and expirin why the average value of drywell shell meltthrough, displayed in Figure C.7.3, can be misleading.
- The relative likelihood of one case over another is treated as a separate issue.
NUREG-1150 C-64
1 i i Appendix C l l Cumulative Probability of Drywell Shell Melt-thru (Aggregation of Actual Cases) Cumulative Probability of Failure 1 0.9 - - v v v O.8 - : ': "' O.7 2' - l m 7 er T> l 0.6 " " " " < t i u a ] l 0.5 ^ - 1 0.4 p..4...4...........4...........................................q> 0.3
,.- Low & ?.k.d flow w/H2O
- = O Low & Med flow noH2O 0.2 f - O- Hi flow, w/H2O
)
Hi fl w, n H20, 2/3H l 0.1ri _ I Z Hi flow, noH20, 2/3L t
?
00 ' ' ' " ' ' ' " 1 0 1 2 3 4 5 6 7 8 9 10 Time Af ter Reactor Vsl Penetration (hr) Figure C.7.3 Aggregate cumulative conditional probability distributions for Peach Bottom drywell shell meltthrough. C-65 NUREG-1150
1 I Appendix C
]
Figure C.7.4 displays the probability distributions generated by each panelist for four specific cases. The case definition is noted in the legend on each plot. The upper two cases represent scenarios with low core debris flow rates. The case shown in the upper left represents a scenario in which the drywell floor is dry; i the case shown in the upper right represents a scenario in which suffici.ent water accumulates on the floor to overfill the drywe!! sump. The lower two plots depict the results for two of the high flow cases (both without water on the drywell floor). One (lower left) assumes a high fraction of unoxidized metals in the , melt, high debris temperatures, and low reactor pressure vessel pressure (i.e., class 2/3H in Fig. C.7.3). i The plot in the lower right corner differs only by the assumption of low debris superheat. 1 Two important observations should be noted. First, the individual panelists' judgments appear binary (i.e., taking on values very near zero or unity). The results for the majority of cases appear this way, with at I least one panelist providing a judgment at each end on the spectrum. Intermediate values were provided for relatived few cases, cuch as case C12 shown in the lower right corner of Figure C.7.4. This divergence of quantitative judgment explains why the values for the average probability appear constrained between 0.3 and 0.8. The average value for case A12 (upper left) is approximately 0.5 because three panelists provided values of 1 and three values of 0. In quantifying case A13 (upper right), one of the three - panelists who 'was certen failure would occur in case A12 felt that the addition of water would prevent molten debris from reacUng the rirywell wall and, thus, changed his judgment from 1 to O for case A13. The other two panelists believe that the debris would be largely unaffected by the presence of water on the floor and did not alter their quantitative judgment. The average failure probability, therefore, changed from 0.5 to 0.33. A similar, but less dramatic, effect is observed in cases C10 an-d C12 (lower two plots) z for which the average values changed from 0.87 to 0.68, respectively. The second observation is that despite an apparent consensus among panel members that the largest source of uncertainty for this issue is the initial conditions (i.e., state of core debris and drywell floor prior to reactor vessel penetration), dramatically different quantitative judgments were provided for the same 1 initial conditions. Moreover, most panelists were very confident that their judgment was correct for many j cases (i.e., a conditional probability of 1.0 or 0.0 was provided for several types of conditions). In review- ' ing the elicitation of the expert panelists, one difference ir rationale appears to have had a strong influ- , ence on their judgments. Some panelists believe that tio flow of corium across the drywell floor is hydrodynamically limited (i.e., governed by the theology and transport properties 02 the flowing core debris / concrete mixture). Others believe that the flow is thermodynamically limited (i.e., governed by the heat transfer characteristics of the mixture). C.7.3 Treatment in PRA and Results The probability distributions for this issue were implemented in the Peach Bottom accident progression event tree. This tree provides a structured approach for evaluating the various ways in which a severe accident can progress, including important aspects of RCS thermal-hydraulic response, core melt behav-for, and containment loads and performance. The accident progression event tree is a key element in the assessment of uncertainties in risk by accommodating the possibility that a particular accident sequence may proceed along any one of several alternative pathways (i.e., alternative combinations of events in the severe accident progression). The probability distributions (or split fractions) for individual and combina-tions of events within the tree provide the " rules" that determine the relative likelihood of various modes of containment failure. Drywell shell meltthrough is represented as an explicit event in the Peach Bottom accident progression event tree, and the probability assigned to it is dependent upon the path taken through the tree. For example, each path through the tree involves events that imply a particular combination of initial condi-tions for a potential challenge to drywell integrity. Values for each of the parameters defining the case structure outlined in the previous section are, therefore, established by the outcome of events occurring earlier in the tree. For example, one path may imply conditions of low reactor vessel pressure (perhaps caused by early actuation of the automatic depressurization system), high unoxidized metal content in the debris leaving the reactor vessel (from low in-vessel cladding oxidation), low debris temperature and low NUREG-1150 C-66
Appendix C 4 Cumulatie Probability of Failure Cumulella Probability of Failure 1
^
O '-
;) 1 O ;)
0.e - 0.s - l 0.a - Os - 0.7 - 0.7 , 0.8 - OA - Case Ata
~
Cees A18 I 0.8 i) 0.w - Low flow, Low WPV preneure. Lew flew, Low RPV pressure. 0.4 - - High % metallow superheet, 0.4 . > High % metal, low superheet. No water 4 Water on DW her 0.3 - 0.3 - 0.3 - 0.3 - 0.1 d 0.1 -
~
0 2b 0 1 O O ;) 1 1 0 t a a 4 s O s a a 4 a f Time Af ter Reactor Val Penettetton (br) Time Af ter Reector Val Penetrellen (hr) l J Cumulatin Probability of Failure Cumulette Probability of Failure 1 4M [ [ j) 1 '; I O 'J ;) 0.9 - 0.0 . . Case Cta 0.8 0.8 - High flow, Low RPV pressure, Case CIO HIBh % M8M W euperheet, 0.7 ' 0.y - No water High flow, Low RPV pressure. 0.3 - Hleh % metal, high superheet. 0.0 -
^
;)
No water 0.8 - ' - 0.8 - 0.4 ~ 0.4 - g g -
.y 0.3 0.8
- ) - -
0.a - 0.a - 0.1 ' O.1 - ' ' 0 : 0 :0 6 1 2 3 4 s 0 1 2 3 4 6 Time After Roeotor Val Penetration (hr) Time After Reactor Val Penetration (hr) Figure C.7.4 Cumulative probability distributions composite of individuals c_ expert panel for this issue. (Six panelists (6 curves) are shown for each of four cases.) C-67 NUREG-1150
Appendix C flow rates of debris leaving the reactor vessel (from a small hole size in the reactor vessel lower head), and, finally, no water on the drywell floor (failure of drywell sprays). For these co*nditions, the conditional probability of drywell shell meltthrough is represented by the distributions for case A12 (shown in Fig. C.7.4). The distributions generated by each of the panelists are given equal weight in the accident progression event tree analysis. This is accomplished by generating an aggregate distribution for each case in the case structure that represents the composite judgment of the expert panel. The aggregate distribution is gener-ated by averaging the distributions prepared by the panelists. This is equivalent to randomly sampling values from each panelist's distribution, but constraining the sampling process to ensure that each distribu-tion is sampled an equal number of times. Additionally, drywell shell meltthrough is treated as a non-stochastic event (i.e., it either occurs or it does not occur). Therefore, the conditional probabilities gener-ated by the expert panel are appropriately converted to event tree branch probabilities of I or 0. For example, if a conditional probability of failure equal to 0.3 is selected for a particular path in the event tece, a branch point probability of 1 would be assigned to that branch in 30 percent of the sample mem-bers. Likewise, a value of 0 would be assigned for the other 70 percent of the sample members. Recall that the method used to perform the statistical uncertainty analysis is one involving multiple passes through the accident progression event tree. The values of the branch point probabilities are allowed to change from one pass to the next, generating a distribution of possible accident outcomes. An indication of the importance of drywell shell meltthrough on the results of the Peach Bottom accident progression analysis is the mean probability that accident sequences contributing to the total core damage ; frequency are estimated to result in this mode of containment failure. Table C.7.1 shows the mean condi- l tional probability of drywell shell meltthrough for several important core damage accident groups. I Table C.7.1 Probability of drywell shell meltthrough (conditional on a core damage accident of various types). Type of Core Damage Mean Frequency
- of Mean Probability of Accident Accident Type Drywell Shell Meltthrough LOCAs 1.56 E-7 0.32 )
Transients 1.02E-7 0.32 Station blackout 2.09 E-6 0.44 ATWS 1.93 E-6 0.42
*These frequencies consider internally initiated events only.
Another indication of the importance of drywell shell meltthrough on the Peach Bottom results is the , decrease in the mean conditional probability of containment failure (i.e., given a core damage accident) l when shell mehthrough is assumed to be impossible. The mean probability of early containment failure (frequency-weighted for all accident sequences') for the base case analysis (i.e., with the drywell shell mehthrough probabilities outlined above) is 0.56. This value decreases to 0.20 if drywell shell meltthrough l is assigned a probability of 0. The remaining (20%) probability of early containment failure results from other containment failure mechanisms such as overpressure failure and ex-vessel steam explosions. The latter are described further in Section C.9. Drywell shell meltthrough is also an important contributor to each of the measures of risk for Peach Bottom. For example, Peach Bottom severe accident progressions (from all types of accident sequences) that result in drywell shell meltthrough contribute approximately 70 percent of the mean estimate for latent cancer fatality risk and 60 percent of the mean estimate for early fatality risk.
'These frequencies consider internally initiated events only.
NUREG-1150 C-68
i Appendix C REFERENCES FOR SECTION C.7 C.7.1 M.G. Piys, J.R. Gabor, and R.E. Henry, "Ex-vessel Source ' Term C atribution for a BWR Mark-1," International ANS/ ENS Topical Meeting on Thermal Reactor Sai *y (San Diego, CA), February 1986. C.7.2 L.S. Kao and M.S. Kazimi, " Thermal Hydraulics of Core / Concrete Interaction in Severe LWR Accidents," MIT Nuclear Engineering Dept., MITNE-276, June 1987. C.7.3 .S.A. Hodge, "BWRSAT Approach to Bottom Head Failure," Presentation to NUREG-1150 Re-
. view Group, November 1987.
C.7.4 D.A. Powers, " Erosion of Steel Structures by High Temperature Melts," Nuclear Science and Engineering, 88,1984. C.7.5 G.A. Greene, K.R. Perkins, and S.A. HoCge, " Mark I Containment Drywell, Impact of Core / Concrete Interactions on Containment Integrity and Failure of the Drywell Liner," Source Term Evaluation for Accident Conditions, paper IAEA-SM-281/36 IAEA, Vienna, Austria, October 26-November 1,1985.
~C.7.6 J.J. Weingardt and K.D. Bergeron, " TAC 2D Studies of Mark 1 Containment Drywall Shell Meltthrough," Sandia Na 'onal Laboratories, NUREG/CR-5126, SAND 88-1407, August 1988.
C.7.7 F.T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of ' Major input Parame-ters," Sandia National Laboratories, NUREG/CR-4551, Volc 2 Draft - Revision 1, SANDb6-1309 to be published.* C.7.8 A.C. Payne Jr., et al., " Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia Nation. ' Laboratories, NUREG/CR-4551. Vol. 4. Draft Revision 1. SAND 86-1309, to be publisheu.
'Available in the NRC Public Document Room,2120 L Street NW., Washington, DC.
C-69 NUREG-1150
Appendin C C.8 Containment Strength Under Static Pressure Loads Since the containment building of a wclear power plant constitutes the ultimate barrier between the in-plant environment and the outside atmosphere, its anticipated performance during a severe accident has a substantialimpact on the risk characteristics of the plant. Uncertainty regarding the capability of a containment to withstand the challenges associated with severe accidents can, therefore, be an important contributor to the uncertainty in risk. In the risk models of this study, determining containment performance involves assessing the probability that the containment would be breached under a range of hypothesized severe accident conditions. In addition to the likelihood of failure, other critical factors in the characterization of containment perform-ance are:
- Failure size: The larger the hole in the containment, the more rapid the escape of radioactive mate-rial in the containment atmosphere to the outside environment. This reduces the time available for radioactive material to deposit within the containment building and also reduces the opportunity for effective offsite emergency response.
- Location offailure: The retention of radioactive material by a breached containment building may be highly dependent upon the location of failure relative to containment systems designed to mitigate accident conditions. For example, in an ice condenser containment, failure of the containment in the lower compartment permits radioactive material to bypass the ice compartments while escaping to the l
outside environment. In contrast, containment failure in the upper compartment, provided the ice j condenser is not degraded, requires that radioactive material pass through the ice compartments l before escaping to the outside. In the latter case, retention of material by the ice would reduce the { radioactive release substantially. l Consideration of these elements of containment performance, in conjunction with assessment of the de-gree and the timing of potential challenges to the containment, provides the basis for determining the likelihood and the consequences of scenarios involving containment failure. C.8.1 issue Definition This issue addresses the response of each of the five containments to the potential pressure loads associ-ated with severe accident conditions. Other containment failure mechanisms, such as penetration by mis-sile, structural failure due to impulse loads (e.g., from hydrogen detonation), and meltthrough by molten material, are excluded from the scope of this issue. These are discussed elsewhere in Appendix C. The se. of plants evaluated in this study was selected to' encompass a broad spectrum of containment designs. Consequently, details of important severe accident conditions and modes of containment re-sponse differ substantially among the plants analyzed. For this reason, the issue of containment perform-ance is discussed largely on a plant-specific basis. However, it is possible to characterize broadly the range of qualitatively distinct pressure loads that may result from severe accident conditions. These are:
. Gradual pressure rises: Gradual pressurization of the containment building would result from the protracted generation of steam and noncondensible gases through the interaction of molten core material with the concrete floor beneath the reactor vessel. This pressurization process could last from several hours to several days, depending upon accident-specific factors such as the availability of water in the containment and the operability of engineered safety features. An additional mecha-nism for gradual pressurization in BWR pressure-suppression containments is the generation of steam from the suppression pool in the circumstance that pool heat removal capability is degraded. . Rapid pressure rises: The high-pressure expulsion of molten material from the vessel, the deflagra-tion of combustible gases, and the rapid generation cf steam through the interaction of molten fuel with water in the containment are phenumena that could lead to pressure rises in the containtnent NUREG-1150 C-70
1 Appendix C j i l over a period of a few seconds. Such pressure rises may be viewed as rapid in a thermophysical context; however, from a structural perspective, they are effectively static, it is essential, neverthe-less, to distinguish between gradual and rapid pressure rises in the characterization of containment performance, since the rate of pressure increase may have a significant influence upon determining j "ne ultimate mode of containment failure. This influence stems from the possibility of multiple containment failures or the development of one failure mode into another more severe mode. For example, where gradual containment pressuriza-tion results in containment breach by leakage, the pressure relief associated with the leak prevents further pressurization, and, thus, precludes more severe modes of containment failure. For rapid pressure rises, however, an induced leak would not preclude continued pressurization of the contain-ment and, therefore, a more severe failure of the containment building could ultimately result. Hence, while the distinction between gradual and rapid pressure rises will not influence the pressure at which failure first occurs, it may influence the ultimate severity of that failure. While the question of containment failure location is largely specific to the individual containment geome-tries, the approach to characterizing potential failure sizes is more generic. Three possible failure sizes were distinguished in this study: leak, rupture, and catastrophic rupture. Working quantitative definitions of each failure size were based on thermal-hydraulic evaluations of containment depressurization times.
- A leak was defined as a containment breach that would arrest a gradual pressure buildup, but would not result in containment depressurization in less than 2 hours. The typical leak size was evaluated for all plants to be of the order or 0.1 fir, ,
- A rupture was defined as a containment breach that would arrest a gradual pressure buildup and would depressurize the containment within 2 hours. For all plants, a rupture was evaluated to corre-spond to a hole size in excess of approximately 1.0 ft2.
- A catastrophic rupture was defined as the loss of a substantial portion of the containment boundary with possible disruption of the piping systems that penetrate or are attached to the containment wall.
A panel was assembled to address issues of structural response to severe accident loads. Its members were: i D. Clauss, Sandia National Laboratories C. Miller, City College of New York K. Mokhtarian, Chicago Bridge and Iron, Inc. J. Rashid, ANATECH W. Von Riesemann, Sandia National Laboratories S. Sen, Bechtel R. Toland, United Engineers and Constructors A. Walser, Sargent and Lundy J. Weatherby, Sandia National Laboratories j D. Wesley, IMPELL J The experts provided distributions that defined the probabdity of failure as a function of pressure and of the mode and location of failure. The distinction between rapid and gradual static pressurization cases in determining ultimate failure size was treated within the methodological framework of this study (see Section C.8.3). The experts only addressed initial failure sizes (i.e., they did not distinguish between the rapid and gradual pressurization cases). C.8.2 Technical Bases for Issue Quantification Detailed structural evaluations of various scopes exist for each of the containments assessed by the expert panel. These evaluations, supplemented by calculations performed by the experts in support of the elicita-tion process, provided the basis for quantification of this issue for each plant. J l i C-71 NUREG-1150
Appendix C Zion The Zion large, dry containment building, depicted in Section C.5, is a concrete cylinder with a shallow-l domed roof and a flat foundation slab. The thickness of the concrete is 3.5 feet in the walls,2.7 feet in i the dome, and 9 feet in the basemat. The containment wall and dome are prestressed by a system of tendons, with each tendon composed of 901/4-inch-diameter steel wires, while the foundation slab is reinforced with bonded, reinforcing steel. The entire structure is lined with a 1/4-inch welded steel plate attached to the concrete by means of an angle grid, stitch welded to the liner plate, and embedded in the concrete. The free volume of the containment is approximately 2.6 million cubic feet and its design internal pressure is 47 psig. The three experts who addressed the Zion containment performance issue had access to existing detailed structural calculations of containment response at Zion reported in References C.8.1 to C.8.3.
'wo potential failure locations were identified by the expert panel: in the midsection of the cylindrical wall and at the junction between the basemat and the wall. Based upon source term considerations, the distinc-tion between these failure locations was preserved in the risk analyses since failure in the cylindrical wall permits a direct release of radioactive material to the outside environment, while failure at the cylinder-basemat intersection occurs approximately 16 feet below ground level. Some degree of ex-containment
[ fission product decontamination prior to atmospheric release would, therefore, be anticipated in the latter i case. The me,chanism for failure in the midsection of the cylindrical wall was assessed to be yielding of the hoop tendons. To deve!op probability distributi ns over potential failure pressures, a range of failure criteria of 1 to 2 percent strain in the hoop tendons was assumed. The resulting probability of failure was in the pressure range of 130-140 psig. Leak was anticipated to be the predominant failure size for failure pres-sures up to 138 psig. For higher failure pressures, breach by rupture was assessed to be more likely. The possibility that failure would first occur at pressures up to 150 psig was also identified, in which case catastrophic rupture was assessed to be the most likely failure size. However, it was believed that for i gradual pressurization cases, the prior occurrence of a leak due to a tear in the liner would likely preclude i catastrophic faihire of the containment. Reference C.8.1 constituted the main analytical basis for evalu-ation of this failure location. The alternative containment breach location identified involved the cracking of concrete at the shear discontinuity between the cylinder wall and the basemat. Only one of the three experts assessed this failure mode to be credible based primarily on Reference C.8.2, Uncertainty in the failure pressure associ-ated with this location was broad. The bulk of probability was assigned to the failure pressure range of 110-180 psig. Failure by leak was assessed to be the most likely size of breach at the wall-basemat junc-tion, although containment rupture was identified as a possibility toward the upper end of the failure pressure range. Figure C.8.1 displays the range of failure pressures for the Zion containment at the 5th- 95th percentile levels. This range is 108-180 psig, which includes all failure sizes and locations. It is based on the distribu-tion that resulted from aggregation of the three expert-specific probability distributions. 1 Surry The Surry containment building, depicted in Section C.S. is comprised of a vertical right cylinder with a hemispherical roof and a flat foundation slab. It is constructed from reinforced concrete and lined with a 1/4-inch steel plate. The containment atmosphere is maintained during operation at below ambient pres-sure (at approximately 10 psia), the design internal pressure is 45 psig, and the containment free volume is 1.8 million cubic feet. Four experts addressed the issue of containment performance at Surry. The limited availability of struc-tural calculations for the Surry containment led the experts to rely partially upon detailed calculations performed for similar containments, such as Indian Point (Ref. C.8.1). NUREG-1150 C-72
11 1 1 Appendix C'- .
-i 4
e.. . . . .. see e. . . . . .
- : High temp. . :
_j j : .cosee ory,,ii . - 3-(,3 8: I- 8 44e e- : : :
.y --
. l- : : ;
g, : -. -- .: .. ies e. . .
- : (c) t .
. i .e e- . ,
I ! e e. .
= . .
4 es e.
-: (b): . .-
X l
- X :
- .'X se e- .
X i so o- . j X *X . e e. Zion Surry Sequoyah Poecti Bottom Ctand Culf (a) Drywell temperature = 8000F 95th percentile , (b) Drywell temperature = 12000F (c) Drywell preesure capacity - preseure differential sci ; + sell -.50th 6t h '- XDesign internal preeeure-l 1 l 1 Figure C.8.1 Containment failure pressure. C-73 NUREG-1150
Appendix C All failure locations identified for Surry provided direct pathways to the outside environment and the distinction between these locations was, therefore, unnecessary from a risk perspective. Yielding of one of the steel hoop bars that reinforce the vertical concrete wall was identified as a likely mode of failure by all the experts. The likely location of failure was assessed to be near the intersection of the wall with the dome. Evaluation of this failure location was based partially upon the analysis of Reference C.8.4. Leak-age due to the formation of a tear in the steel liner was also identified as the most likely failure mode in light of the results of the 1:6 scale model reinforced concrete containment test performed at Sandia National Laboratories (Ref. C.8.5). Other potential modes of containment breach identified were failure around pipe and electrical penetrations and failtire due to distortion of the hatch opening. However, no consensus existed regarding the credibility of these other modes. The probability distribution over potential failure pressures resulting from aggregating the distributions of each expert is summarized in Figure C.8.1. The 5th-95th percentile range of potential failure pressures extends from approximately 95 psig to 150 psig. Leakage was assessed as the most likely mode of failure for breaches occurring up to 140 psig, while ruptures were the most likely modes of breach for failure pressures in the 140-150 psig range. While higher failure pressures were judged unlikely, the dominant mode of failure beyond 155 psig was assessed to be catastrophic rupture. Sequoyah The Sequoyah ice condenser containment, depicted in Section C.4, is a freestanding steel structure con-sisting of a cylindrical wall, a hemispherical dome, and a bottom liner plate encased in concrete. The cylinder varies from 1-3/8-inch thickness (at the bottom) to 1/2 inch (at the dome junction); the dome varies from 7/16-inch thickness (at the cylinder junction) to 15/16 inch (at the apex); and the bottom liner plate is 1/4-inch thick. Vertical and horizontal stiffeners are provided on the outside of the shell. Three volumes comprise the inside of the containment shell: the lower compartment, the ice condenser, and the upper compartment. The reactor vessel and reactor coolant system are located in the lower compartment. The ice condenser consists of an annular volume that partially lines the containment wall (subtending an angle of 300 degrees at the center of the containment) and is comprised of a series of ice compartments located between an upper and a lower plenum. The ice condenser is lined with corrugated steel insulating panels designed to withstand an outside pressure of 19 psig. The role of the ice condenser is that of a passive heat sink intended to reduce steam pressures generated in design basis accident condi-tions. The only significant structure within the upper compartment is the polar crane. Since the containment is equipped with the ice condenser pressure-suppression system, it is designed to an internal pressure of only 10.8 psig, with a free volume of 1.2 million cubic feet. A concrete shield building surrounds the steel shell. However, it is not a significant barrier to fission product 7elease since its pressure capacity is substantially less than that of the shell. Structural assessment of the Sequoyah containment required certain severe accident considerations spe-cific to the ice condenser design. The location of containment failure relative to the position of the ice condenser and the aucturalintegrity of the ice condenser are crucial factors in determining the concomi-tant radiological release. If the route taken by radioactive aerosols to the outside environment involves passage through the ice, significant retention of radioactive material within ths containment would be expected. Failure of the containment in the lower compartment or significant disruption of the ice would involve bypass of the ice compartments. Since the ice condenser constitutes the only passageway from the reactor vessel to the upper compartment, failure in the latter will avoid ice condenser bypass. Ultimately, however, the effect of failure location upon the source term is determined by the availability of ice, which in turn is dependent upon the accident sequence under consideration. A further concomitant of the compartmentalized nature of the ice condenser containment is the possibility of localized accumulations of hydrcgen and the possibility of containment failure through hydrogen deflag-ration or detonation. While the issue of containment response to hydrogen deflagration was subsumed in NUREG-1150 C-74
Appendix C the case of rapid pressurization, the effects of hydrogen detonation and the associated dynamic loads were considered separately by the experts. Response of the Sequoyah containment to impulse loads is discussed in Section C.4. Three experts addressed the issue of containment response to pressure loads at Sequoyah based on the detailed analyses of References C.8.1 and C.8.6 and on supplemental hand calculations. Memb'ane r fail-ure in the cylindrical wall of the upper compartment via either rupture or catastrophic rupture was identi-fled as the most likely mode of containment failure. Failure criteria adopted involved a range of strain levels (2-10%) in the shell membrane. Since the ice condenser is attached to the cylindrical wall and subtends an angle of 300 degrees at the central containment axis, 5/6 of the ruptures in the wall of the vper compartment are expected to occur in the ice condenser. Catastrophic rupture of the wall, in l contrast, would always fail the ice condenser. One expert identified the possibility of failure in the lower compartment due to a crack in the weld at the point of embedment. Such a failure would result in ice condenser bypass. Based upon results of the 1:8 scale steel containment pressurization tests (Ref. C.8.7), two experts identified the possibility of contain-ment leakage due to ovalization of the equipment hatch flange. The equipment hatch, a door 20 feet in diameter, is located in the upper compartment, and its failure would not result in ice condenser bypass. Rupture or catastrophic rupture were assessed to be the most likely modes of failure in the Sequoyah containment. The only failure location associated with leakage involved ovalization of the hatch. While one expert predicted the occurrence of such a leak in the 65-70 psig range, a second expert believed that such a failure would not be likely to occur below 120 psig and that shell rupture would probably occur first. The third expert excluded this failure possibility completely. At the 5th-95th percentile levels, the range of failure pressures resulting from aggregating the individual expert distributions was'40-95 psig. For all potential failure pressures, the probability of ice condenser bypass exceeded the probability of no bypass by factors of between 5 and 10. This stems from the dominance of the catastrophic rupture failure modes at Sequoyah. Catastrophic rupture is assumed always to fail the ice condenser since the ice com-partments subtend most of the containment wall area. As discussed earlier, all failures in the lower com-partment bypass the ice. The probability distribution over potential failure pressures at Sequoyah is sum-marized in Figure C.8.1. Peach Bottom The Peach Bottom containment, depicted in Section C.7, is of the Mark I pressure-suppression type. The steel " light-bulb-shaped" drywell that contains the reactor vessel is a steel spherical shellintersected by a circular cylinder. The top of the cylinder is closed by a head bolted to the drywell. The pressure-suppres-sion chamber, or the wetwell, is a toroidal steel vessel located below and encircling the drywell. The wetwell and drywell are interconnected by eight circular vent pipes. The containment is enclosed by the reactor building, which also contains the refueling area, fuel storage facilities, and other auxiliary systems. In the event of primary system piping failure within the drywell, a mixture of drywell atmosphere and steam would be forced through the vents into the suppression pool resulting in steam condensation and , pressure reduction. The design internal pressure of the containment is 56 psig and the free volumes of the drywell and wetwell are 159,000 cubic feet and 119,000 cubic feet, respectively. From a source term perspective, the location of containment failure relative to the suppression pool and to structures external to the containment is important. Three experts evaluated containment performance at 4 Peach Sottom. Based on prior detailed analyses of Mark I designs (Refs. C.8.1 and C.8.8) and on calcu- l lations supporting the opinion elicitation process, several failure locations were considered credible: e Wetwell above the water line. In this case, the suppression pool would not be bypassed. e Wctwell below the water line. Consequent drainage of the wetwell would effectively result in pool bypass. C-75 NUREG-1150
l Appendix C e Drywell near the vent pipes. This would result in suppression pool bypass although some credit would be taken for fission product decontamination by the reactor building.
- Drywell head. In this case, the suppression pool would be bypassed although some credit would be taken for fission product decontamination in the refueling area. (
The relative likelihood of leak versus rupture was considered dependent on the failure location and the associated failure mechanisms. For example, one expert assessed the relative likelihood of a leak occur-ring in the wetwell below the water line to be low, since any leak at that location would develop rapidly into a rupture. The predicted failure mechanism was a crack in the hoop direction, which would rapidly l unzip, given the absence cf a mechanism to arrest the rupture. 1 Because of the small volume oi the Peach Bottom containment, the possible effect upon containment pressure capacity of the high drywed temperatures expected to occur in scenarios involving the attack of coructe beneath the vessel by molten coa debris was considered. Such temperatures could be as high as 800*F to 1200*F and might substantially reduce material strengths. One expert assumed, for example, that material strength in the drywell at the vent pipes would be reduced by between 25 percent and 90 percent and that gasket resiliency at the drywell head would be lost. Since wetwell temperatures were assessed to be at saturation, high drywell temperatures were determined to have little . impact upon the pressure capacity of the wetwell. , In low-temperature conditions, the range of possible failure pressures for the Peach Bottom containment was determined to be 120-174 psig. This reflects the 5th-95th percentile interval of the probability distri-bution resulting from aggregating the expert-specific distributions. Conditional upon containment failure in the lower part of this range, 50 percent of probability was associated with leakage at the drywell heed, while the remaining failure probability was dominated by wetwell leakage above the suppression pool. At i i the top edge of the failure pressure range, wetwell rupture above and below the suppression pool were ! I each assessed to account for 25 percent of the total failure probability, with catastrophic wetwell rupture accounting for a further 10 percent. Leakage in the drywell (principally at the head) accounted for ap-l proximately 25 percent of the conditional failure probability, with wetwell leakage accounting for the remaining 15 percent. Two high drywell temperatures cases were considered by the experts: 800'F and 1200*F. The 5th-95th percentile failure pressure ranges were assessed to be 75-150 psig and 6-67 psig, respectively. With the drywell at 800'F, failure at the lower edge of the pressure range was assessed to be dominated by leakage in the drywell, principally (90% of the probability) through degradation of the head gasket. Toward the higher end of the failure pressure range, wetwell leaks above the suppression pool accounted for 30 percent of the failure probability, drywellleakage for a further 40 percent, and rupture at the drywell head for 12 percent. In the highest drywell temperature regime, i.e.,1200*F, the reduction in material strengths was assessed to ensure failure in the drywell. At the lower boundary of the failure pressure range, leakage in the drywell (principally at the head) was assessed to account for 95 percent of the failure probability while, at the upper boundary of the failure pressure range, drywell ruptures (principally in the main body of the drywell) were assessed to be as likely as leaks. Egure C.8.1 summarizes the aggregated probability distributions over possible containment failure pressures at Peach Bottom. Grand Gulf
~
The Grand Gulf containment, depicted in Section C.4, is of the Mark Ill pressure-suppression type. It is constructed from reinforced concrete lined with a 1/4-inch welded steel plate. The circular foundation mat, the cylindrical wall. and the hemispherical dome are 9.5, 3.5, and 2.5 feet thick, respectively. The containment volume is divided into two main compartments: the drywell,'which is the central cylindrical volume of the cor.cainment and houses the reactor vessel; and the wetwell, which constitutes the outer annular volume and the dome. These compartments are connected at the base of the containment via an annular pool that provides a passive heat sink for steam in design basis accident conditions. The drywell NUREG-1150 C-76
Appendix C wall, composed of reinforced concrete, is 5 feet thick and lined with 1/4-inch steel plate. Since the Grand Gulf containment is equipped with pressure-suppression features, its nominal design internal pressure is only 15 psig. The drywell has a design internal pressure of 30 psid (i.e., the differential pressure across the drywell-wetwell boundary). The free volumes of the wetwell and the drywell are 1.4 million and 270,100 cubic feet, respectively. ' From a severe accident perspective, an important feature of the Mark III design is the relative configura-tion of the drywell, the suppression pool, and the wetwell. This configuration ensures that, provided the integrity of the drywell wall is not compromised, radioactive material released from the fuel would need to pass through the suppression pool to escape from the containment, if breached. This would result in significant radioactive material retention by the pool. In assessing performance of the Mark III, it is important, therefore, to determine the response to severe accident conditions not only of the outer con-tainment, but also of the drywell. Given the low-pressure capacity of the Grand Gulf containment relative to anticipated pressure loads, the study project team assessed minimal uncertainty to be associated with response of the Grand Gulf contain-ment to severe accident pressurization levels. To use expert resources most efficiently, therefore, the issue of static overpressurization at Grand Gulf was not taken to the expert panel on structural response issues. The required probability distributions were developed by a structural expert at Sandia National Laborato-ries, who had been a member of the original panei. Detailed structural evaluations of containment per-formance at Grand Gulf reported in Reference C.8.1 provided a basis for the expert's evaluation. The dominant failure location of the containment due to static overpressurization was assessed to be at the intersection of the cylinder wall and the dome. The lower bound of the Grand Gulf distribution over failure pressures was assessed to be approximately I twice the design internal pressure. The upper distribution bound was identified with the calculated ulti-mate material strength of the steel-reinforced concrete containment. A distribution between these bound-ing points was then developed. Pressure capacity distributions for the drywell were developed in a similar way. Based on the various potential failure locations in the drywell, the wall was assessed to be the weakest structure and therefore the most likely failure point. The expert determined that the failure criterion was, in terms of the pressure differential across the drywell, independent of the direction of the pressure gradient. At the 5th-95th percentile level, the range of potential failure pressures for the Grand Gulf containment and drywell were ; 38-72 psig and 50-120 psid, respectively. Figure C.8.1 summarizes the underlying probability distribu- ; tions. - C.8.3 Treatment in PRA and Results Within the accident progression event trees (APETs) developed in this study, the probability of contain-ment failure associated with each identified accident progression path was determined by comparing the I value of the containment load selected from its distribution to selected value of the load capability. As part l of the overall uncertainty analyses, Monte Carlo methods were used to randomly select values for contain-ment loads and load capacity from their distributions (Ref. C.8.9). Among the elements of each sample member were a containment failure pressure, with the corresponding failure size and failure location. For i some plants, more than one load and capacity pair may be selected to simultaneously represent alternative challenges to containment integrity. In the Peach Bottom analysis, for example, one combination would dictate the containment pressure capacity, the failure size, and the failure location corresponding to rapid pressure rises at vessel breach. Another combination would characterize containment response to gradual pressure rises. Each sample member also contained a series of pressure loads corresponding to load-generating events that occur over the time represented by the accident progression. For each accident progression, the loads and the load capacities in the sample member are compared in a time-ordered way. If the first load C-77 NUREG-1150
Appendix C I exceeds the corresponding pressure capacity, the containment is assumed to fail at that time (unless preceded by containment breach due to some other failure mechanism, such as impulse loading or ther-mal attack). The location and the size of the failure are specified in the sample member. A relative frequency of 1 (i.e., the split fraction) is then attached to the selected failure size and location conditional upon the prior path tr. ken through the containment event tree. If none of the loads exceeded the pressure capacity, then the containment is assumed to retain its integrity unless breached by some other mecha- ; nism. i Based upon the findings of the expert panel on structural response issues, the pressure at which a contain- i j ment first failed was modeled to be imiependent of the pressurization rate. However, the ultimate size and l location of failure was coupled to the pressurization rate in this study. Since the experts focused largely on the issue of the initial mode of containment failure, their distributions over failure size and location could not be used directly in the treatrient of rapid pressure rises. For example, if leak were the initial failure
- size resuhing from rapid pressurization, then, since a leak could not halt further pressurization, whether a ;
j more severe breach of the containment would occur subsequently was considered. I l l To generate probability distributions over ultimate failure modes in the case of rapid pressure rises, both l the containment failure pressure and the peak pressure load in any one sample member were considered for each case. If the failure pressure exceeded the peak pressure, failure was assumed not to occur. If, however, the peak pressure exceeded the failure pressure, then a probability distribution over potential failure modes was constructed, which accounted for the possibility that containment rupture or cata-strophic rupture could occur after a le:k developed and before the peak pressurization level was reached. Sampling from this distribution provided the ultimate failure size and location. l In the Grand Gulf analysis, drywell and containment performance were evaluated in similar ways. Struc-tural performance of the drywell became an issue for conditions in which a pressure differential is estab-lished across the drywell-wetwell boundary. This occurs in cases of rapid pressurization (e.g., hydrogen deflagration in the wetwell or loads from vessel breach) where the inertia of water in the suppression pool prevents immediate pressure equalization across the boundary. Within each sample member, the pressure differential for each accident progression was compared to the sarapled drywell pressure capacity. High correlauons were imposed in sampling from probability distributions over the drywell and the containment j pressure capacities, since the same basic uncertainties were involved in each. Table C.8.1 summarizes the failure pressure ranges and the likely modes of containment overpressure failure identified by the expert panel for each plant. The influence of the containment failure pressure on risk and uncertainty in risk for each plant is depend-ent ultimately on the predicted severe accident pressure loads and the relative likelihood of containment breach by other mechanisms such as thermal attack. Since scenarios involving failure or bypass of the , contair. ment at or before vessel breach were found to be the dominant contributors to offsite risk, the importance of overpressure failure modes to risk may be characterized in terms of their contribution to bypass and early containment failures. Similarly, the importance of uncertainty in the failure pressure can be evaluated in terms of the impact upon the conditional probability of early containment failure of varying the failure cressure within its range of uncertainty. These importance measures are discussed briefly for each plant. For direct comparison among plants, attention is confined tn internal initiating events. Early containment fah tre scenarios dominate all offsite risk measures at Zion. The robustness of the Zion containment ensures, hwever, that the mean frequency of early containment breach conditional on core damage is small (approximately 1%). Ten percent of early containment failures are due to overpressure, the remainder being associated with in-vessel steam explosions (see Section C 9) and preexisting contain-ment isolation failures, Variations in the failure pressure within its range of uncertainty result in a minimal change to the risk profile at Zion given the high strength of the containment relative to anticipated loads. NUREG-1150 C-78
Appendix C Similarly, the Surry containment' appears to be extremely robust. Its mean frequency of early failure conditi,onal on core damage is less than 1 percent. Accident scenarios involving bypass of the containment dominate all offsite risk measures while early containment failures contribute approximately one-quarter or less. Less than 60 percent,of early f3ilures are associated with containment overpressure. The remain-der result from in-vessel steam explosions. As for Zion, variation of the containment failure pressure within its reasonable range of uncertainty would be expected to result in minimal change in the risk profile at Surry because of the high strength of the containment. Table C.8.1 Containment strength under static pressure loads: summary information. Design Failure Containment Free Internal Pressure Volume Pressure Range (a) Dominant Failure Plant (Millions of Cubic Feet) (psig) (psig) Sizes / Locations 47 108-180 Leak / rupture in cylinder wall Zion 2.6 or basemat/ wall intersection 1.8 45 95-150 Leakhupture near dome / wall Surry intersection Sequoyah 1.2 11 40-95 Gross rupture of the contain-ment or rupture in the lower compartment Peach 0.16 (drywell) 56 120-174 Leak at drywell head or Bottom leak / rupture of wetwell 0.12 (wetwell) high temp case: (b) Leak at drywell head or in 75-150 wetwell above suppression pool high temp case: (c) Leak at drywell head or 6-67 rupture of drywell wall Grand 0.27 (drywell) 15 38-72 Leak / rupture near dome / wall Gulf 1.4 (wetwell) ir.tersection Drywell: 30(d) 50-120 (d) 5th-95th percentile range Drywell temperature at 800'F Drywell temperature at 1200*F d) Drywell/wetwell pressure differentialin psi At Sequoyah, approximately 73 percent of mean early fatality risk results from scenarios involving bypass of the containment; the remaining mean early fatality risk is due to early containment failures in loss of offsite power sequences. Early containment failures account for the remaining early fatality risk and for approximately one-half of the latent fatality risk. Containment overpressure accounts for approximately 90 percent of early failures, while direct contact of molten debris with the steel containment, impulse loads from hydrogen detonation, in-vessel steam explosions, preexisting isolation failures, and ex-vessel steam explosions constitute the remaining 10 percent. The mean frequency of containment' failure conditional on core damage is approximately 7 percent. Comparison of this value with the early failure frequency of the large, dry containments reflects the lower pressure capacity of the ice condenser design. The overlap between anticipated pressure loads and the range of containment failure pressures at Sequoyah leads to the conclusion that uncertainty in the overpressure criterion rnay have an impact on uncertainty in risk. Scenarios invdving early failure of the drywell dominate all offsite risk measures at Peach Bottom both because of the high mean conditional frequency of this mode of failure (approximately 50%) and because of the associated bypass of the suppression pool by radioactive material. The dominant mechanism for early drywell failure is attack of the drywell wall by molten debris on the cavity floor. The mean C-79 NUREG-1150
.1 Appendin C conditional frequency of early wetwell failure at Peach Bottom is approximately 3 percent. This is domi--
nated by overpressure failures. The contribution to risk of early wetwell failure is minor, however (ap-- proximately 1% for the mean estimate of early and latent fatality risk).-Consequently, uncertainty in the failure pressure level at Peach Bottom has minimal influence upon uncertainty in risk. 1 At Grand Gulf, overpressurization is the dominant mechanism for failure of the~ containment and for l failure of the drywell. Scenarios involving early failure of both the containment and the drywell are the i principal contributors to all offsite risk measures. The mean frequency of these scenarios conditional upon core damage is approximately 20 percent. Variation of the containment failure pressure within its esti-mated range of uncertairdy has a minimalimpact on the performance of the Grand Gulf containment, given its low structural strength relative to the anticipated pressure loads, principally from hydroSen deflag-ration. > Considerable overlap exists between the range of d*ywell failure pressures and the range of anticipated ' j pressure loads on the Grand Gulf drywell. The assumption that the drywell failure pressure lies toward the - lower end of its uncertainty range could, therefore, result in a significant increase in mean offsite risk. The assumption of a high drywell failure pressure would not be expected to decrease risk significantly, how- > ever, since additional mechanisms exist for early failure of the drywell wall. These mechanisms involve pedestal collapse at the time of vessel breach, due either to overpressure or an ex-vessel steam explosion ; l ' (see Section C.9), and subsequent failure of the drywell wall, due to damage incurred by penetrating pipes. In summary, containment failures due to overpressure are significant contributors to risk at al'1 plants except Peach Bottom. Uncertainty in structural failure pressure has the potential to significantly influence uncenainty in risk only for the Sequoyah containment and the Grand Gulf drywell. For other containment structures, there is limited overlap between the range of anticipated pressure loads and the uncertainty range of failure pressures. More details of the treatment of structural response issues in this study can be found in Reference C.8.10. ' REFERENCES FOR SECTION C.8 C.8.1 IDCOR Technical Report 10.1, " Containment Capability of Light Water Nuclear Power Plants," July 1983. l C.8.2 S. Sharma et al., " Ultimate Pressure Capacity of Reinforced and Prestressed Concrete Contain-ments," Brookhaven National Laboratory, NUREG/CR-4149, BNL-NUREG-51857, May 1985. C.8.3 T.A. Butler and L.E. Fugelso, " Response of the Zion and Indian Point Containment Buildings to Severe Accident Pressures," Los Alamos Scientific Laboratory, NUREO/CR-2569 LA-9301-MS, May 1982. C.8.4 W.J. Pananos and C.F. Reeves, " Containment Integrity at Surry Nuclear Power Station," Stone & Webster Engineering Corp., TP84-13,1984. C.8.5 R.A. Dameron et al., " Analytical Correlation and Post-Test Analysis of the Sandia 1:6-Scale Reinforced Concrete Containment Test," Fourth Workshop on Containment Integrity (Arlington, VA), June 14-17, 1988. C.8.6 D.A. Brinson and G.H. Graves, " Evaluation of Seals for Mechanical Penetrations of Containment Buildings," Sandia National Laboratories, NUREG/CR-5096, SAND 88-7016, Augat 1988. C.8.7 D.B. Clauss, " Comparison of Analytical Predictions and Experimental .Results for a 1:8 Scale Steel Containment Model Pressurized to Failure," Sandia National Laboratories, NUREG/ CR-4209, SAND 85-0679, September 1985. NUREG-1150 C-80
I Appendix C a I 1 C.8.8 K. Mokhtarian et al., " MARK I Containment Severe Accident Analysis for the MARK I Owners ( Group " CBI NA-CON, Inc., April 1987. C.8.9 E.D. Gorham-Bergeron et al., " Evaluation of Severe Accident Risks: Methodology for the Acci-dent Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analyses," San-dia National Laboratories, NUREG/CR-4551, Vol.1, Draft Revision 1, SAND 86-1309, to be published.* C.8.10 F. T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major input Parame-1, ters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Draft Revision SAND 86-1309, to be published.'
'Available in the NRC Putile Document Room, 2120 L Street NW., Washington, DC.
l r
* '3 C-81 NUREG-1150 i
l Appendix C
)
I l l C.9 Containment Failure as a Result of Stearn Explosions 1 A steam explosion is the result of rapid transfer of thermal energy from a hot liquid to water over a time scale of the order of milliseconds. Industrial experience has revealed that such explosions have the poten-tial to do significant damage. The possibility that certain severely degraded reactor core conditions, involving the flow of molten core j materialinto a pool of water in the lower plenum of the reactor vessel, could be conducive to the occur-rence of a stesa explosion was first assessed in the Reactor Safety Study, WASH-1400. The in-vessel steam explosion scenario may be of particular significance in determining the risk profile of a nuclear ) j power plant since, not only does this phenomenon allow the possibility of catastrophic pressure vessel j breach, but the concomitant generation of a missile consisting of the upper head of the vessel could lead j to failure of the containment building, An in-vessel steam explosion is a phenomenon, therefore, that ' could breach the last two barriers between fission products in the core and the ex-containment environ- l 2 ment vinually simultaneously, Containment failure resulting from an in vessel steam explosion was termed
" alpha-mode failure" in the Reactor Safety Study.
The sequence of events constituting the hypothesized alpha mode failure scenario is as follows: Because
)
of either failure of the reactor coolant system boundary or loss of the core heat removal function, the core , uncovers. The generation of fission product decay heat and the exothermic oxidation of fuel cladding j results in core degradation until liquefaction of the fuel occurs. The relocation of liquefied material to ! cooler locations near the lower core support plate results in freezmg of Se fuel and the consequent l formation of a crust. This c'ust,sapports the molten material that is formed. When the mass of molten i material reaches a criticalimit, the crust can no longer support it, and the material flows coherently into i any water remaining in the lower plenum of the vessel. A steam explosion occurs, generating an upward j moving slug of water and molten fuel, which lifts the upper head of the vessel. The reactor head then acts ! as a missile that perforates any structures above the vessel and, ultimately, penetrates the containment building. l l The risk impact of a steam explosion is not confined to the in-vessel phase of a severe accident. When water is present in the reactor cavity or pedestal region at the time of vessel failure, the contact of molten core debris with the water may result in a steam explosion. If the containment geometry is such that an ex-vessel water pool could contact the containment wall, or could contact structures that, if disrupted, would resuit in impairment of the containment function, then ex-vessel steam explosions can have poten-tially signihcant risk impact. It should be noted that an ex-vessel steam explosion may result not only in an impulse load, but also in a - quasistatic pressure load on containment structures. Indeed, in assessing pressure loads at vessel breach, the expert panel on containment loading issues accounted for the possibility of load contributions from ex-vessel steam explosions in the development of their probability distributions (see Section C.5). The current section, however, focuses upon challenges to containment structures associated uniquely with the dynamic loads resulting from ex-vesse) steam explosions. The consequences associated with in-vessel and ex-vessel steam explosions, as with other scenarios result-ing in early breach of the containment building, are potentially significant. Determining the risk posed by I steam explosion scenarios, however, demands not only an evaluation of the resultant consequences, but also an assessment of their probability of occurrence. Evaluation of this probability is the focus of the steam explosion issue. C.9.1 Issue Definition The range of accident scenarios addressed in the containment analyses of this study includes alpha-mode failure and containment breach due to an ex-vessel steam explosion. The current discussion focuses on the specific accident scenarios and plants for which the steam explosion phenomenon is of the greatest potential risk significance. 1 NUREG-1150 C-82
Appendix C C.9.1.1 In-Vessel Steam Explosions For in-vessel steam explosions, attention is confined to large, dry containment PWR reactor systems. While there currently exists no clear basis for the assumption that other reactor / containment types are less vulnerable to alpha-mode failure, different modes of containment breach were identified in this study as dominating at other plants. The alpha-mode probability distributions developed in the resolution of this issue were applied, however, to all the plants studied. The accident scenarios of particular concern relative to alpha-mode failure are those in which core degradation occurs at low reactor coolant system pressures, since experiments indicate that high ambient pressures tend to reduce the likelihood of, although not preclude, the triggering of a steam explosion (Ref. C.9.1). To quantify the accident progression models in these analyses, the in-vessel steam explosion issue was defined in terms of the probability, conditional upon core degradation at low ambient pressures, of the occurrence of alpha mode failure, While numerous small and intermediate scale simulant tests have provided substantial data, and related analytical models of steam explosion phenomena exist (Refs. C.9.2 and C.9,3), there is limited agreement within the technical community regarding the probable phenomena that govern the onset and the effects of an in vessel steam explcsion. Much of the uncertainty about steam explosion phenomenology is associ-ated with the applicability of small and intermediate scale test results (typically invoking a melt mass of less than 40 lb) to actual reactor scales and geometries (involving molten fuel masses of up to 280,000 lb in a PWR). Additionally, there is no consensus regarding the appropriateness of the various analytical models that have been used to evaluate the phenomena governing the alpha-mode scenario. The fundamental energetic condition for alpha-mode failure is that, of the thermal energy contained in the reactor fuel, the amount converted ultimately into the kinetic energy of an upward moving missile is sufficient to permit penetration of the containment building. The maximum total heat content of the fuel elements of a typical PWR is of the order of 105 megajoules (MJ). The energy required to fail the reactor vesselis of the order of 103 MJ, while energies sufficient to fail a large, dry containment building are also of the order of 103 MJ. Simple energy balance considerations, therefore, cannot provide a basis for excluding the alpha-mode failure scenario. Hence, the crucial questions surrounding the alpha-mode issui relate to the ultimate partition of energy, both with respect to its form (thermal, kinetic, strain, and gravitational) and with respect to the mechanical elements of the system in which it resides (molten debris, in-vessel water, reactor internals, containment building shield, and upward and downward moving mis-sites). The energy partition question can be addressed through decomposition of the alpha-mode failure scenario into several phases. The first phase involves the transfer of thermal energy from the molten fuel to water in the lower plenum of the reactor vessel. Subissues relating v. this phase are the availability of molten core debris and water for interaction over explosive time scales, the geometry of the debris (since this determines the efficiency of the thermalinteractions), and the existence of a steam explosion trigger. The second phase involves the generation of an upward moving slug (water, melt, and structural materials) within the vessel. Subissues relating to this phase are the fraction of thermal energy involved in the stearn explosion that is converted to kinetic energy, possible failure of the lower head of the vessel thereby relieving the in-vessel explosive pressures, and the distribution of kinetic enstgy between the upward moving slug and a downward moving slug. The third phase involves failure of the vessel upper head. Related subissues are the fraction of the initial energy of the slug that is dissipated as strain energy in the upper internal structural components of the vessel (e.g., upper core support plate, control rod drives) and, if the upper head of the vessel fails, the energy of the missile thereby generated. The fourth phase involves the impact of the missile upon the vessel shield, where the relevant issue is the associated degree of energy dissipation. The final phase involves failure of the containment building. The crucial issue here is, given the loss of kinetic energy by the missile associated with its ascension to the containment boundary, the capability of the missile to penetrate the containment. C-83 NUREG-1150
1 App:ndix C In 1984, a panel of experts was convened to summarize current understanding of steam explosion phe-nomena and to assess the likelihood of alpha-mode failure. The 13-member Steam Explosion Review Group (SERG) represented substantial cumulative experience in'the experimental investigation and the analytic modeling of severe accident phenomena. Findings of the panel were published in June 1985 (Ref. C.9.4); The mandate of the panel also included review and assessment of analytical work undertaken by Berman et al. (Ref. C.9.5), which addressed the likelihood of alpha-mode failure. To encapsulate the spectrum of expert views on the steam explosion issue, this study drew upon both the findings of SERG and the judgment provided by the p:l mary author of the work reviewed by SERG. The views of each ; participating expert were then weighted equally in arriving at the final characterization of uncertainty in the likelihood of alpha-mode failure. Prior to their use in this study, members of the SERG panel reviewed the probability distributions relating to alpha-mode failure that, based upon the earlier findings of SERG, had been developed at Sandia National Laboratories. Through consideration of the way in which their findings had been interpreted and of relevant information acquired since publication of the SERG report, the same panel members modified the distributions tentatively developed. These moc'.*fied distributions provided the basis for this study. C. 9.1. 2 Ex-Vessel Steam Explosions Each p' tvaluated in this study was screened for potential vulnerabilities to ex-vessel steam explosions. The con nment design assessed to display the most significant vulnerability was Grand Gulf. The scenar- I io of concern in the Mark Ill design is one in which a steam explosion impulse is delivered to the reactor pedestal through water on the drywell ficor. The likelihood of a deep water pool in the drywell at Grand Gulf is high during the course of a severe accident. A dominant mechanism for this is the expulsion of water from the suppression pool as a result of pressurization of the wetwell through hydrogen deflagration. Upon receiving the explosion impulse, the pedestal collapses, resulting in failure of the drywell wall due either to impact by the unsupported vessel or damage by the penetrating steam line and feedwater pipes. Loss of the drywell wall then permits bypass of the suppression pool by fission products in the event of preexisting or subsequent containment . failure. The potentially significant risk impact of drywell failure at Grand Gulf stems from the relatively high likelihood of containment overpressure either prior to or follow-ing vessel breach. The Zion and Surry containments were not assessed to have Anificant vulnerability to impuhe loads from ex-vessel steam explosions since water in the cavity would nct directly contact structures that are both vulnerable and essential to the containment function. Initial messment of the Peach Bottom and Se-quoyah containment designs identified potential vulnerability to ex-vessel steam explosions, associated principally with pedestal collapse (Peach Bottom) and seal table disruption or vessel dislocation (Se-quoyah). However, scoping shock wave hydrodynamics calculations and application of underwater im-pulse correlations (based on Ref. C.9.6) revealed minimal threat to these containments from ex-vessel steam explosions. Attention was focused therefore on the Grand Gulf containment. The ex-vessel steam explosion issue was couched in terms of three parameters: e The likelihood (conditional frequency) of an ex-vessel steam explosion occurring conditional upon the presence of water in the cavity at vessel breach. e The likelihood of pedestal failure conditional upon the occurrence of a steam explosion. e The likelihood of drywell failure due to collapse of the pedestal. Evaluation of these parameters was based upon impulse loading calculations performed at Sandia and upon the elicitation of judgments from the expert panel on structural issues (see Section C.8). NUREG-1150 C-84
Appendix C C.9.2 Technical Bases for Issue Quantification C.9. 2.1 In-Vessel Steam Dplosions The approach adopted by most of the experts in determining the probability of alpha-mode failure was decomposition of the scenario into a sequence of events and the assignment of a probability, or a range of probabilities, to each constituent event (Ref. C.9.4). These events constituted elements of the four phases of alpha-mode failure defined in the previous section. The product of event-level probabilities was then equated with the probability of alpha-mode failure. Other experts adopted variant approaches in which probabilistic judgment was exercised directly at the level of the compound-event alpha-mode failure, or in which probability distributions reflecting uncertainty in relevant physical parameters were propagated through deterministic models to determine the probability of alpha-mode faiiure. These latter approaches do not permit straightforward extraction of the probabilities associated with the primary-level events, and direct comparison of the event likelihoods assessed by all the experts is therefore difficult. The range of views in each phenomenological area are described here, and direct comparisons of expert-specific prob-abilities are made where possible. Initial conditions For the energy involved in a steam explosion to be commensurate with the energies associated with vessel and containment failure, sufficient amounts of molten material and water must be avai'able to participate. Additionally, a coherent pour of melt into the water is required to ensure maximal participation of the melt available over explosive time scales. While some experts assigned a low likelihood to the required initial conditions, based on the premise that the meltdown process would involve the incoherent dripping of molten materialinto the lower plenum, others assigned probabilities in the range of 0.75 to 1.0 for the occurrence of the required conditions. These higher probabilities were based generally upon identification of a scenario in which a crust of refrozen melt at the lower core support plate breaks suddenly, permitting the coherent release of molten material into the lower plenum. Substantial uncertainty was identified l regarding the process of the core degradation and fuel relocation. Molten corc/ water mixing The degree of interpenetration between the melt and water in the lower plenum determines the efficiency of thermalimeraction between the two media. Currently no widely accepted model of molten fuel / water < mixing under severe accident conditions ex6ts. While efficient mixing has been observed in several small l and intermediate scale tests (Ref. C.9.7), various experts argued that scaling effects prevent the conclu- 1 sion that efficient mixing would occur in full-scale reactor geometries. One analytical model involves a l process in which hydrodynamic instabilities break up the fuel jet as it pours into the lower plenum. Rapid steam production (although not at rapid as that associated with a steam explosion) then expels water from the mixing region, thereby severely limiting the potential for effective mixing. This process of jet fragmentation and fluidization as a result / hydrodynamic instabilities v.as not ac-cepted by all participating experts, however. A process in which a blanket of steam forms around the jet body, thus limiting access by water to the jet, was the basis for an alternative model. This model confines fragmentation of the melt to the leading edge of the jet, thereby reducing the potential for mixing. The initial mixing of melt and water as a condition for lasge-scale steam explcsions was questiened by some experts. It was observed that, even for an initial configuration involving minimal fragmentation of the melt, the occurrence of small steam explosions sufficient to disrupt the melt could create boundary conditions conducive to the onset of a larger explosion. While no model of the net effects of preliminary steam explosions t;pon in-vessel melt / water configurations exists, the observation of multiple steam explo-sions in small-scale tests prevents the exclusion of such scenarios from consideration. Where probabilities ; werc assigned specifically to the event of large-scale mixing conditional upon a coherent melt pour, they ranged from 10 2 to 0.3. C-85 NUREG-1150
Appendin C Explosion trigger While large-scale mixing of melt with water provides boundary conditions required for significant thermal interactions between the two media, the questien of whether that interaction takes the form of a steam explosion is dependent upon whether a trigger is present. The mechanism for triggering a steam explosion is poorly understood. One model involves the onset of oscillations in the steam film barrier isolating a molten fuel fragment from water. Where these oscillations permit direct contact of fuel with water, a trigger occurs. Experiments reveal that the existence of a trigger is extremely sensitive to initial conditions (Ref. C.9.1) and that triggering becomes less likely at high ambient pressures. For low reactor coolant l system pressure scenarios, those experts who provided a probability relating specifically to the occurrence of a trigger assessed it to be equal to unity. Explosion efficiency Fundamental, thermodynamic factors limit the efficiency with which the thermal energy involved in a ; steam explosion may be converted into kinetic energy. While this theoretical, maximum conversion ratio ' is in the range of 40-50 percent (based upon Hicks-Menzies conditions), the value appropriate for a reactor configuration depends upon the constraints provided by the internal vessel geometry. The experts ! agreed that conversion ratios of up to 15 percent are possible. 1 Slug formation and vessel head impact The primary mechanism for transmittal of the kinetic energy generated by the steam explosion to the upper head of the vesselis the formation of an upward-moving slug composed of molten fuel, water, and structural material. The resuhant impulse upon the upper head could also be supplemented by the trans-mittal of an impulse from the lower core support plate, through the core barrel, to the upper head flange. The possibility also exists that the pressures generated by the steam explosion could result in failure of the lower head, thereby venting explosive pressures in the vessel and reducing the energy delivered to the upper head. Much of the uncertainty associated with the likelihood of upper head failure relates to the distribution of material within the vessel. For example, uncertainty regarding the fraction of the molten fuel and water inventories above the trigger location was taken into account explicitly by some of the experts in determining the possible mass and composition of the upward-moving slug. Uncertainty was l identified also in estimating the fraction of the slug's kinetic energy dissipated as strains within the upper . ! internal components of the vessel. Expert-specific point-value probabilities assigned to the event of upper head failure and the generation of a missile capable of failing containment (conditional upon significant thermal energy conversion) ranged from 10 2 to 1, although one expert provided a probability range extending from 10 4 to 1. Vessel head failure and containment breach Following bolt failure at the upper head flanges, development of the alpha mode failure scenario involves impact of the dislocated vessel head against the missile barrier positioned above the vessel. The barrier is perforated, thus attenuating the energy of the missile. The missile continues to rise, expending kinetic energy to acquire gravitational potential energy, and ultimately impinges upon the containment wall. Some of the experte basedt their assessments of the likelihood of containment failure upon detailed . structural caletaations. Those experts who assigned probabilities to individual events within the alpha-mode scenario generally absorbed the structural uncertainties into their assessment of the probability of vessel head fail-ute by dciining such a failure as one that generates a missile capable of penetrating the containment. C. 9.L 2 Ex-Vessel Steam Explosions The scenario of concern at Urand Gulf is one in which molten debris is released from the breached vessel into a deep water pool (about 7 meters) on the drywell floor. A steam explosion is tnggered, which delivers an impulse load to the reactor pedestal. The pedestal cellapses leaving the reactor vessel unsup-po:tcd. The drywell wall then fails as a result of damage caused by the penetrating vessel piping or by NUREG-1150 C-86
1 Appendix C direct contact by the vessel. The accident progression models developed for this study decompose the ex-vessel steam explosion scenario ir'to three phases: (1) occurrence of the steam explosion, (2) subse-quent failure of the pedestal, and (3) subsequent failure of the drywell wall. Occurrence of steam explosion The parameter evaluated for this phase of the scenario is the fraction of occasions upon which a steam explosion would be triggered conditional upon the release of molten debris from the vessel to an underly-ing water pool. An estimate of 0.86 for this parameter was based upon intermediate-scale experimental results in which 86 percent of tests involving the release of molten thermite into water at la ambient pressures resulted in a significant steam explosion (Ref. C.9.7). i Failure of pedestal Assessment of the dynamic load capacity of the pedestal was based upon adaptation of information clic-ited from the expert panel on structural response issues regarding the strength ci ti;e drywell wall and upon supplementary information provided by a structural expert from Sandia, who had beer a member of the original panel. The expert aggregate probability distribution over potential fai ure impulse levels for the Grand Gulf drywell wall extends from 3.5 to 18 psi-s. Since the pedestal and the drywell wall at Grand Gulf are both composed of reinforced concrete of similar thickness, the dynamic load capacity of the pedestal was assumed to be comparable to that of the drywell wall. While the impulse capacity range for the drywell wall was based on the assumption of loads s.ssociated with hydrogen detonations, the similarity in impulse duration between steam c.plosion and gas detonation loads (typically milliseconds) was as-sessed to warrant adoption of the range, given its broadness. Supplementary evaluations of the pedestal impulse capacity by an internal Sandia expert on structural response issues confirmed the appropriateness of this range. Estimation of the impulse delivered to the pedestal conditional upon the occurrence of a steam explosion was based on the Similitude Equations (Ref. C.9.6). These equations, reflecting the correlation between underwater explosion size, distance from the explosion center, and impulse level, were adopted to deter-mine the relationship between the mass of debris participating in the steam explosion and the impulse to the pedestal. Calculations revealed that with less than 1 percent of the core participating in the explosion, the impulse to the pedestal would reach the lower edge (i.e., 3.5 psi-s) of the uncertainty range over pedestal failure loads. The upper edge of the range (18 psi-s), based upon shock wave hydrodynamics calculations, would be reached if 10 percent of the core participated in the explosion. It was noted that J release from the vessel of 10 percent of the core corresponds to the 90th percentile level of the aggregate distribution over core release levels at BWR vessel breach. It was concluded that, conditional upon the trigger of a steam explosion in the Grand Gulf drywell, failure of the pedestalis credible. To reflect maximal uncertainty regarding the fraction of ex-vessel steam explo-sions that would resu't in pedestal failure, a uniform probability distribution was assigned to the interval j between the fraction 0 and the fraction 1. Failure of drywell wall The final parameter associated with the ex-vessel steam explosion issue at Grand Gulf is the fraction of occasions that collapse of the pedestal results in failure of the drywell wall. This question was addressed by two members of the expert panel on structuralissues. Based upon their engineering judgment and support-ing hand ulculations, each expert provided a single point estimate of the required parameter. These two point estimam were averaged to generate a single estimate for input to the Grand Gulf risk model. This 1 average was 0.17. C.9.3 Treatment in PRA and Results C. 9. 3.1 In-Vessel Steam Explosions ! Of the 14 experts (13 in SERG and one additional expert as discussed in Section C.9.2) participating in the steam explosion evaluation process,12 provided probabilities for alpha-mode failure conditional upon j j 1 C-87 NUREG-1150
I Appendi:t C core damage in a PWR at low primary systum pressure. Two of these experts collaborated in the genera-tion of probabilities; thus their results reflected a single approach. Eleven independent sets of probabilities were ultimately provided. The extreme sensitivity of the onset of a steam explosion to prevailing physical boundary conditions (Ref. C.9.7) provides a strong basis for treating alpha-mode failure as a stochastic phenomenon. This means that, conditional upon a specified plant damage state, the associated range of possible physical conditions within the vessel results in the situation that alpha-mode failure would occur only on some fraction of I occasions. The probabilities assigned by the participating experts were therefore interpreted as estimates of the relative frequency of alpha-mode failure, i.e., as the fraction of severe accidents resulting in failure of the containment building due to an in-vessel steam explosion. In conformance with the approach to un-certainty characterization used in this study, probability distributions were constructed over these relative frequencies on an expert-specific basis. Aggregation over the expert distributions then provided the net representation of uncertainty regarding the frequency of alpha-mode failure. Construction of the expert-specific distributions was based upon identification of a best-estimate frequency j with the median of the distribution, identification of an upper estimate with the 95th percentile, and i identification of a lower estimate with the 5th percentile. Use of an entropy-maximization algorithm (Ref. ]' C.9.8) in conjunction with these distribution constraints ensured that uncertainty was appropriately pre-served in formulation of the expert-specific probability distributions. Details of this approach to utilization of probabilistic information were reviewed by each participating expert. Figure C.9.1 displays the cumulative probability levels that bound the expert-specific distributions. These bounds exclude two experts who assessed the likelihood of alpha-mode failure to be so low that they assigned zero probability to the scenario. This figure also displays the final, aggregate distribution based j upon the 11 expert-specific distributions (including the two experts who assigned zero probabilities). Note l that the aggregate distribution is not completely encapsulated by the bounding distributions because of the ! effect of the two experts who assigned zero probabilities. It can be seen that the median relative frequency of alpha-mode failure for the aggiegate distribution is approximately 4x10 5. That is, Aere is equal net' probability that less than, or more than, four in a 100,000 core damage scenarios occurrag at low ambient pressure will result in alpha-mode failure of the containment building. It can be seen also that the greatest median frequency proposed by any one expert was of the order of one in a 100, while the smallest finite median frequency was of the order of one in 100,000. Hence, while no consensus existed regarding details of the phenomenology of steam explosions, the conclusion that, at the median level, alpha-mode failure is unlikely was shared by each participating expert. In each plant study, the aggregate distribution displayed in Figure C.9.1 provided the basis for sampimg alternative values of the frequency of alpha-mode failure conditional upon core degradation at low pressure. The frequency of alpha-mode failure conditional upon core degradation at high reactor coolant system pressure was set at one order of magni-tude below the frequency associated with the low-pressure case in each sample member. This n flects the experimental observation that high ambient pressures tend to reduce the likelihood of a steam explosica trigger (Ref. C.9.1). Although the median relative frequency of the alpha-mode scenario is low, the high relative likelihood of core degradation at low reactor coolant system pressures in PWRs (see Section C.6) has the effect of highlighting the alpha-mode scenario as a mechanism for early failure of the containment, especially at Surry and Zion for which other early failure mechanisms are of low likelihood. At Surry, for example, while about half of the mean frequency of early containment failure conditional upon core damage is associated with the alpha > node scenario, this total mean frequency is less than 10 2. For the pressure-suppression containment types, the likelihood of alpha-mode failure is low relatiw to other containment failure mechanisms. C. 9. 3. 2 Ex-Vessel Steam Explosions The three parameters required to characterize the likelihood of drywell failure due to ex-vessel steam explosions at Grand Gulf are defined in Section C.9.2. Each of these was an input to the Grand Gulf NUREG-liSO C-88
l 1
-l Appendix' C . .]
?
'i l
(a)lneludes 2 esperts who assigned sero frequency (b)Escludes 'J vsperts wiio assigned sero frequency l l e ,I ,. **". e- , *,. l . l
./
- g l . .l 3 e- l l
l
- s
- 4 e'
Aggregate (a)
.E , .
li , 3 .. ,
/ . . . . . . . . . . . . . Bound upon u
l
./ expert-specifle cumulative I
, / probabilities (b)
/
. l e
~
n0' t0 ...* t0 ..l* 16 10 nw' s0' . s. ,d . Prequency i l i l i ( Figure C.9.1 Frequency of alpha-mode failure conditional upon core damage, j
-l I C-89 NUREG-1150 I
s
. . . .. . - . . . I
.. ...m. .
Appendia C accident progression event tree. Conditional upon vessel breach and wet cavity conditions, the fraction of ! occasions upon which the drywell fails as the result of an ex-vessel steam explosion was equated with the product of these three parameters. The fraction of steam explosions leading to pedestal failure was identi-fled as the most significant source of uncertainty because of uncertainty regarding the amount of molten material that would participate in the explosion. In the Monte Carlo uncertainty analysis, this parameter l was sampled from a uniform probability distribution over the interval of fractions 0 to 1. Based upon the j parameter values described in the Section C.9.2, it can be deduced that the mean fraction of occasions on j which failure of the vessel, in wet cavity conditions, results in breach of the drywell wall as a result of a i steam explosion is approximately 0.07. While Grand Gulf is the containment for which the threat posed by ex-vessel steam explosica is the most significant, the relative importance of this mechanism for drywell failure compared to others is small. Conditional upon core damage at Grand Gulf, less than 10 percen' of early drywell failures result from an ex vessel steam explosion. The dominant causes of drywell failure a/e associated with pressurization of the drywell atmosphere at the time of vessel breach. More details of the treatment of steam explosions in this study can be found in Reference C.9.9. REFERENCES FOR SECTION C.9 C.9.1 D.E. Mitchell, M.L. Corradini, and W.W. Tarbell, "Interm sdiate Scale Steam Explosion Phe-nomena: Experiments and Analysis," Sandia National Laboratories, NUREG/CR-2145, SAND 81-0124, October 1981. C.9.2 T.G. Theofanous et al., "An Assessment of Steam-Explosion-Induced Containment Failure," Nuclear Science and Engineering, 97, 259, 1987. C.9.3 M. Berman, "A Critique of Three Methodologies for Estimating the Probability of Containment Failure Due to Steam Explosions," Nuclear Science and Engineering, 96, 173, 1987. C.9.4 Steam Explosion Review Group, "A Review of the Current Understanding of the Potential for Containment Failure From In-Vessel Steam Explosions," USNRC Report NUREG-1116, June 1985. C.9.5 M. Berman et al., "An Uncertainty Stud /of PWR Steam Explosions," Sandia National Laborato-ries, NUREG/CR-3369, SAND 83-1438, July 1984. C.9.6 R.H. Cole, Underwater Explosions, Princeton University Press,1948. C.9.7 B.W. Marshall et al., "Recent Intermediate-Scale Experiments en Fuel-Coolant Interactions in an Open Geometry," Proceedings of the ANSIENS International Topical Meeting on Thermal Reac-for Safety (San Diego, CA), February 1986. C.9.8 S.D. Unwin, "IMPAGE. An Information Theory-Based Probability Assignment Generator. Brief Code Description and User's Guide," Brookhaven National Laboratory Technical Report A-3829, August 1987. C.9.9 F. T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major Input Parame-ters," Sandia National Labora*r.ies, NUREG/CR-4551, Vol. 2, Draft Revision 1, S AND86-1309, to be published.' 'Available in the NRC Public Document Room,2120 L Street NW., Washington, DC. NUREG-1150 C-90
Appendix C C.10 Source Term Phenomena The magnitude and timing of release of radioactive material from a nuclear reactor in a severe accident depend on a variety of thermal, hydraulic, and mechanical processes, as well as the chemistry and physics of fission product release and transport. Uncertainties in core melt progression, containment loads, and containment performance produce uncertainties in the release to the environment. In this study, however, each accident progression bin represents a particular state of melt progression and containment perform-ance. Thus, uncertainties associated with how and when the containment fails are reflected as uncertain-ties in the likelihoods of the accident progression bins rather than in the parameters that describe the release to the environment. This section addresses the phenomena that affect the magnitude of release of the elemental groups in an accident progression bin, not its likelihood. These phenomena relate directly to the chemistry and physics of fission product release and transport. Some uncertain aspects of core melt progression (e.g., the time-temperature history of the fuel as fission products are being released) are included irnplicitly in the assessment of uncertainties, however. C.10.1 Issue Definition Following the Three Mile Island accident, the Nuclear Pegulatory Commission (N'AC) established an Accident Source Term Program Office to evaluate the realism with which the analytictI methods available at that time could predict severe accident source terms. In 1981, the NUREG-0772 report, " Technical Bases for Estimating Fission Product Behavior During LWR Accidents" (Ref. C.10.1), reviewed tl:e state of the art and identified research needs in a number of areas. In response to these needs, the NRC ur.dertook a substantial effort to direct severe accident research toward development of improved meth-ods of analysis supported by a more comprehensive data base (Ref. C.10.2). In 1986, the NRC published the NUREG-0956 report, " Reassessment of the Technical Bases for Estimat-ing Source Terms" (Ref. C.10.3). One of the purposes of the present study was to develop a perspective on how changes in source term methodology, as represented in NUREG-0956, affect estimated risk to the public from severe accidents. In their review of NUREG-0956, the American Physical Society (APS) identified the principal areas of uncertainty in severe accident analysis and made recommendations for future research. The research needs that relate directly to the release and transport of radioactive materi-als are listed in Table C.10.1. Additional research has been performed in each of these areas subsequent $ to the APS review, and the results have been incorporated into the current study. l ( Table C.10.1 APS recommendations for source term research (Ref. C.10.3).
- 1. Vaporization of low volatility fission products
- 2. Release of refractory materials in core-concrete interaction i
- 3. Transport of radionuclides through reactor
- 4. Tellurium behavior ]
- 5. Release of volatile forms of iodine j
- 6. Generation mechanisms for aerosols
- 7. Effectiveness of suppression pools and ice beds
- 8. Growth and deposition of aerosols
- 9. Change of sequence by fission product heating
- 10. Intercomparison of aerosol codes
- 11. Aerosol deposition in pipes
- 12. Integrated severe accident code C-91 NUREG-1150 I
Appendix C 1 The simplified source term codes, XSOR,* which were developed to support the uncertainty analysis for this study, represent source term processes as integral parameters such as release fract'ans, decontamina-tion factors, and transmission factors. The chemistry and physics of these processes t.re contained in the mechanistic codes against which the XSOR par users are benchmarked. The same parametric represen-tation of source terms will be used in this section to discuss source term uncertauties:
- 1. Fraction of initial inventory of species released from the fuel prior to vessel breach,
- 2. Fraction of release from fuel that transports from the reactor vessel into the containment,
- 3. Fraction of initial core inventory released during core-concrete interaction,
- 4. Fraction of source term to the containment atmosphere that subsequently is released to the environ-ment, S. Decontamination factors for engineered safety features or water pools,
- 6. Fraction of species deposited in reactor coolant system that is subsequently revaporized, and
- 7. Fraction of iodine in suppression pools or water pools that is subsequently evolved.
C.10.2 Technical Bases for Issue Quantification The status of each of the major areas of severe accident uncertainty identified by the APS has been reviewed in Appendix J of draft NUREG-1150 (Ref. C.10.4). A." Review of Research on Uncertainties in Estimates of Source Terms from Severe Accidents in Nuclear Power Plants," NUREG/CR-4883 (Ref. C.10,5), was also undertaken by a panel of eminent scientists under the leadership of Dr. H. Kouts. These reports discuss areas of source term uncertainties qualitatively and identify needs for further research. ; In tra current study, it was necessary to develop a quantitative characterization of the uncertainties in source term phenomena. A panel of experts in source term phenomena was assembled to develop the uncertainty distributions for the most important phenomena. Table C.10.2 identifies the experts and lists the issues dicited. The bases on which the experts made their judgments differed. In each case, computer analyses and experimental data were available to the experts. In many instances, the experts performed their own calculations. Each e 3 pert provided documentation on the rationale supporting his elicitation. The variety of consideration:.- E expere u too broad to reproduce in this appendix for the source term issues. The ret. der is referred to Reference C.10.6 for a detailed discussion of the bases for the elicita-tions. C.10.3 Treatment in PRA and Results In-Vesrel Release Within the range of uncertainties, the experta were not able to distinguish between the magnitude of release for different accident sequences other than for different degrees of zirconium oxidation. Thus, distributions for only four cases were developed: PWR-high oxidation, PWR-low oxidation, BWR-high oxidation, and BWR-low oxidation. The results for the four cases are similar. Figure C.10.1 illustrates the distribution obtained for the PWR case with low zirconium oxidation. The uncertainty range" for the release of iodine and cesium is from approximately 10 percent to 100 percent of the initial core inventory, for tellurium from 1 percent to 90 percent, for barium and strontium from very small to 50 percent, and for the involatiles from very small to a few percent.
'A separate code was written for each of the plants: SURSOR SFOSOR, ZISOR. PBSOR and GGSOR.
"$th percentile and 95th percentile values are used to characterize the range.
NUREG-ll50 C-92
)
i i
- Appendix C l i
f Table C.10.2 Source term issues. Technical Experts P. P. Bienlarz, Risk Management Associates-A. Drozd, Stone & Webster Engineering Corp. J. A. Gieseke, Battelle'
- R. E. Henry, Fauske and Associates T. Kress, Oak Ridge National Laboratory-Y. H. Liu, University of Minnesota D. Powers, Sandia National Laboratories R. C. Vogel, Electric Power Research Institute D. C. Williams, Sandia National Laboratories Source Term Issues Elicited
- 1. In-vessel fission product release
- 2. Ice condenser DF-Sequoyah
- 3. Revotatilization (from RCS/RPV) after vessel breach
- 4. Core-concrete interaction (CCI) release
- 5. Release from containment
- 6. Late sources of iodine-Grand Gulf and Peach Bottom
- 7. Reactor building DF-Peach Bottom
- 8. Releases during direct containment heating In-Vessel Retention Four cases were considered for the PWRs: setpoint pressure (2500 psia), high pressure (1200-2000 psia), intermediate pressure (150-600 psia), and low pressure (50-200 psia). Three cases were consid-ered for the BWRs: fast (e.g., short-term station blackout), high pussure; fast, low pressure; and slow (e.g., long-term station blackout), high pressure. j In all cases 100 percent of the noble gases were assumed to escape from the reactor coolant system. For l the PWR, the estimated fractional releases at setpoint pressure are typically small, as illustrated in Figure 1 C.10.2. For all species the range is from 0.001 percent to 80 percent, with median fractional release of 9 i percent for iodine and 3 percent for the bulk of the other aerosols. As illustrated in Figure C.10.3, at low 1 pressure the range for fractional release is 12 percent to 99 percent for the iodine, with a median of 50 )
percent, and from 4 percent to 99 percent for the bulk of the other aerosols. The high and intermediate ] pressure ca:,es fall between the system setpoint case and low-pressure case. J The dis'ributions for the BWR cases are similar *o those described for the PWR cases. The distributions for the two high-pressure cases are similar to the distribution for the PWR setpuat pressure case in that the majority of the distribution indicates a small release, but at the upper end of the range the release is substantial (~80 percent). The distribution for the low-pressure case is similar to that of the PWR low-pressure case. j l i C-93 NUREG-1150 i
Appendix C LG - e.s-a2-t gj- 1 N a.a -
~
o = Xe,Kr e.4 - o = 1.Br {
* = CsJth i e = Te,Sb e.s - e = Sa
,, = Sr
* = Ru,ek:
a.: - e z L.o.ek: a a Co,ek: e.s - i eA As aiLe N.s d.e N,e 4,o f,g d,, y,, ,,,,, h Frution Figure C.10.1 In-vessel release distnbution, PWR case with low cladding oxidation. NUREG-1150 C-94
Appendix C
./ -_ '
- u. / :
u-u. I,,a s e u, , o
- X.,gr I
- u. === {
. = Cs.Rb -
. . i.
3- **8sb
. . s, i,
- u. !
.= . c.,.
tm e.c. 8-
".. A. e a. a. a. a. - s. a. a. .. :
nei r,.ceu 1 1 i Figure C.10.1. In-vessel release distribution, PWR case with low oxidation. 1 ir il u. u.
.3 I. u-i h u-
.s.
g.3 O a X.,Kr o a 1,Sr i i a s Ca.Rb u- . s T. a a Arosol 5b "u i. a. a. a. a. a. a. a. a. .a R.I.es. Froction l Figure C.10.2 RCS transmission fraction, PWR case at system setpoint pressure. C-95 NUREG-1150
F Appendix C W i , i U-I p 4.7 E u-o
.2:
4.4 - l' 33- o = Xeft o a t Br n s a cs,R6 e.2 - * = Te,Sb e=w t-t I a
- A. A. A. 4. A. 4.. A. 4 ; ..
Release Fraction Figure C.10.3 RCS transmission fraction, PWR case with low system pressure. NUREG-1150 C-96
Appendin C - Core-Concrete Release Distributions were obtained for 16 different cases. Zion, Sequoyah, and Surry were each treated sepa-rately. A common distribution was obtained for Peach Bottom and Grand Gulf because the same type of - concrete was used in the construction of the two plants. For each plant, four scenarios were considered for a wet or dry cavity and high or low zirconium oxidation. Release fractions for five tiemental groups were evaluated: tellurium, strontium, barium, lanthanum, and cerium. The uncertaina distributions obtained from the experts indicate broad ranges of uncertainty. The fractional release of telluri2m is likely to be quite large. Median values of the release fraction for the different cases are typically approximately 50 percent, and the upper bound release is approximately 90 percent. The lower bound release fractions vary from 2 percent to 10 percent. Barium and strontium are indicated to be substantially less volatile than tellurium, but at the upper end of the uncertainty range could also lead to substantial release. Median values for the release of these species vary from 2 percent to 5 percent for the different cases. The release fractions for the lanthanum and cerium groups are substan-tially smaller. Median values are typically less than 0.1 percent. Upper bound values are typically less than 10 percent of the inventory, except for the cerium group release in the BWR cases, which extends to 20 percent. Containment Release Fraction This factor is defined as the fraction of radioactive material released to the containment atmosphere that eventually leaks to the environment. Eighteen different distributions were developed associated with dif-ferent plant types, whether the release was from fuel in-vessel or ex-vessel, the timing of containment failure, the mode of containment failure, and in some cases whether the suppression pool was saturated. It is difficult to generalize the results because of the variety 'of containment conditions analyzed. In some early failure cases, however, the transmission fraction is quite high for the entire range of uncertainty. In an early containment failure case for the Sequoyah plant, in which the failure leads to bypass of the ice bed, the fractional release of radioactive material ranges from 25 percent to 90 percent of the material released from the reactor coolant system. Decontaminate.>n Factors for Engineered Safety Features Distributions .or decontamination factors (DFs) were developed for suppression pools, ice condensers, overlying w':er pools (for the core-concrete interaction release), containment sprays, and for the Peach Bottom reactor building. Only the ice condenser and Peach Bottom reactor building DFs were submitted to the panel of experts for quantification. The NUREG-1150 analysis staff developed the distributions for the other factors. i Although the range of uncertainty in the water pool DFs is large, water pools are sufficiently effective in ; decontamination that the resulting source terms are not dominant contributors to the plant risk. In com- I parison to the suppression pool DF, the ice condenser is not as effective in the removal of radioactive ; material, Four cases were considered by the experts: l Case 1: Air-return fans on, delayed containment failure, multiple passes through ice bed, no direct containment heating, low steam fraction. Case 2: Air-return fans on, early containment failure, single pass through ice bed, no direct containment - heating, low steam fraction. Case 3: Air-return fans off, single pass through ice bed, no direct containment heating, high steam ! fraction. Case 4: Direct containment heating, single pass through ice bed, high gas velocity, high steam fraction. C-97 NUREG-1150
Appendix C For a typical case, with multiple passes through the bed, low steam content, and without high-pressure melt ejection, the range of DF was from 1.2 to 20 with a median value of 3. Distributions were developed for six cases for the DF of the Peach Bottom reactor building. The variations in conditions were associated with combinations of the mode of drywell failure (rupture, shell meltthrough, or head seal . leakage) and whether the suppression pool was saturated. For the head seal leakage cases, the leak is into the refueling bay rather than into the reactor building and smaller DFs were assessed. For a typical case involving drywell rupture with the suppression prol subcooled, the range of DF is 1.1 to 10 with a median value of 3. Revolatilization from Reactor Coolant System Radioactive ma.terial deposited on surfaces within the BWR reactor vessel and PWR reactor coolant systern can be reevolved after vessel failure because of the self-heating of the radioactive material. For the PWRs, two cases were considered: one hole in the reactor coolant system or two holes in the reactor coolant system. The latter case offers the opportunity of a chimney effect and a greatly different environment. For the BWRs, two cases were also considered: high drywell temperatures or low drywell temperatures. Vari-ations to these cases were considered by some of the experts. Distributions were developed for three elemental groups: iodine, cesium, and tellurium. In all cases, the fractional release is greatest for the iodine and least for the tellurium. Figure C.10.4 illustrates the distribu-tion for the release of iodine for the PWR case with two holes in the reactor coolant system. The range fcr ; this case, which produced the greatest release, is from 0 percent to 70 percent, with a median release of j 20 percent. Median releases of iodine for the other cases varied from 3 percent to 10 percent. Cesium release fractions were comparable to the iodine values, but slightly reduced. The median release of tellu-rium was O percent in all cases, but the upper bound varied from 20 percent to 60 percent. This skewed distribution is indicative of a general belief by the experts that there will be little or no revaporization of tellurium, but recognizes that substantial revaporization cannot be ruled out. Late Release of Iodine This issue addresses the potential for the long-term release of iodine from suppression pools and reactor cavity water. Four cases were considered: a subcooled suppression pool, a saturated suppression pool, a flooded drywell, and a limited supply of water in the pedestal that mostly boils away. The release from the subcooled suppression pool is limited. The upper bound of the distribution is 10 percent and the median is 0.1 percent. Release from the saturated poolis somewhat greater. The median release is 0.5 percent and the upper bound release is 80 percent. The releases from the flooded cavity cases are substantially larger. For the case with a large volume of water, the range of release is from 10 percent to 90 percent, with a median of 50 percent. The limited water supply case has a range of 20 percent to 100 percent, with a median of 80 percent. Summary of Results By examining the ranges used to represent the source term factors (e.g., release from fuel in-vessel and fractional release from reactor coolant system). it is evident why the ranges of the environmental release fractions are large. To begin with, the source distributions for the release of radionuclides from fuel in-vessel and ex-vessel are very broad. Even radionuclides that are typically not considered to be volatile, such as barium and strontium, have ranges of uncertainty that extend as high as 50 percent for in-vessel release. Similarly, the decontamination factors that are applied to these rehase terms can vary over a range of three orders of magnitude. In some instances, the separation between the mean and the median of the source term distribution for the environmental release of a radionuclides can be as large as three orders of magnitude. These very bread distributions are the result of sampling from multiplicative factors, each of which has a wide distribution. No specific source term issues stand out as dominating the uncer-tainty because there are a number of contributors. NUREG-1150 C-98
Appendix C is , u.
.e- .
{ u. E u-u-
- u. a. w.un.
e . . c.m, e u- . am Te.5b Aerosol u.
" . , ., sa s . .. a. s .a ,
m rrocem Figure C.10.3. RCS transmission fraction, PWR case with low system pressure. t,
.J.
.9-
.4-y u~
l u- o a EXP. A o aEXP.B
. mEXP.C ea
.J.
. .EXP.D AvC.
I u-u .a u u u u u u u n
.a a.vaports.eu m reaenon Figure C.10.4 Revcporization release fraction for iodine, PWR case with two holes.
C-99 NUREG-1150
i Appendix C It is important to recognize that the origin of the uncertainties in the source term issues does not com-pletely arise from uncertain'les in the chemistry of fission product interactions or the physics of aerosol transport. Uncertainties in core melt progression, in thermal-hydraulic behavior within the reactor coolant system, and in thermal-hydraulic behavior within containment (and secondary buildings) also have a major effect on the uncertainties in calculated source terms. i REFERENCES FOR SECTION C.10 C.10.1 USNRC, " Technical Bases for Estimating Fission Product Behavior During LWR Accidents," NUREG-0772 June 1981. C.10.2 J.;T. Larkins and M. Cunningham, " Nuclear Power Plant Severe Accident Research Plan," NUREG-0900, January 1983. l-C.10.3 M. Silberberg et al., " Reassessment of the Technical Bases for Estimating Source Terms," NUREG-0956, July 1986. C.10.4 USNRC, " Reactor Risk Reference Document," NUREG-1150, Appendix J of Vol. 3, Draft for Comment February 1987. , y C.10.5 H. Kouts, " Review of Research on Uncertainties in Estimates of Source Terms from Severe { Accidents in Nuclear Power Plants," Brookhaven National Laboratory, NUREG/CR-.4883, BNL- l NUREG-52061, April 1987. C.10.6 F.T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major Input Parame-ters," NUREG/CR-4551, Vol 2, Draft Revision 1, SAND 86-1309, to be. published.' , I i l l' l
'Available 'a 15e NRC I%1ic Document Room, 2120 L Street NW., Washington, DC.
NUREG-1150 -C-100
Appendix C C.11 Analysis of Seismic Issues Since'the first attempt in the Reactor Safety Study in the mid-1970's to quantify seismic risk, some 25 plant-specific seismic PRAs have been completed. These later PRAs have shown that seismic events can be significant contributors both in terms of core damage frequency and the potential for releases of radio-active material. There are many reasons for these findings. The foremost reason is that like many other external events, a seismic event not only acts as an initiator but can also compromise mitigating systems because of its common-cause effects. Secondly, the large uncertainties associated with the rare (particu-larly for Central and Eastern United States sites) but large seismic events that are significant to risk analy-ses result in large uncertainties in the outcome of the risk study. Uncertainties in these risk measures also make seismic events significant contributors when risk indices, such as mean frequencies, are used as measures. Table C.11.1 (reproduced from Ref. C.11.1) shows results of some seismic PRAs, Prior to discussing the issue of the uncertainty in the seismic hazard and its impact on PRA results and interpreta-tion, a brief overview of the seismic risk analysis procedure and overview of scismic hazard methods are described in the following section. C.11.1 Issue Definition The elements of the seismic risk analysis procedure can be identified (Ref. C.11.2) as analyses of (1) the seismic hazard at the site, (2) the response of plant systems and structures, (3) component fragilities, (4) plant system and accident sequences, and (5) consequences. The results of these analyses are used as inputs in defining initiating events, in developing system event trees and fault trees, in quantifying accident sequences, and in modifying the accident progression event trees and consequence models to reflect the unique features of seismic events. There are uncertainties associated with each step nf the risk analysis procedure. However, a number of studies (Ref. C.11.3), including the seismic risk studies performed in connection with NUREG-1150 (Parts 3 of Refs. C.11.4 and C.11.5), have sho,vn that the uncertainties in the first element, the seismic hazard analysis, dominate the uncertainties u the overall results. As shown in Figure C.11.1, the major steps involved in performing the site-specific hazard analysis are as follows: e Identification of the sources of earthquakes, such as faults (F1, F2) and other seismotectonic sources (A1, A2, A3); e Evaluation of the earthquake history of the region to assess the frequencies of occurrence of earth-quakes of different magnitudes or epicentralintensities (recurrence) and determination of maximum magnitude; e Development of attenuation relationships (including random uncertainty) to estimate the intensity of ! earthquake-induced ground motion (e.g., peak ground acceleration) at the site (attenuation); and e I Integration of all the above information to generate the frequencies with which different values of the selected ground-motion parameter would be exceeded (seismic hazard). Because of the brevity of the historical record and lack of full understanding of earthquake processes and their effects in much of the United States, considerable uncertainties are associated with each of the above steps, resulting in the large uncertainties in the seismic hazard estimates. An accepted procedure for including the uncertainties of the parameters in the hanrd anaiysis is to pstulate a set of hypotheses (e.g., specific source configuration, specific value of slope parameters in recurrena relation). A probabil-ity value is assigned to each of these hypotheses, based on the analyst's expert judgmtat. A seismic hazard curve representing the annual frequency of exceeding a specified peak ground acceleration is generated from each hypothesis resulting in a family of different hazard curves, each representing probability of exceedance (see Fig. C.11.1(d)). Such a family of hazard curves has generally been used in the past PRA applications. C-101 NUREG-1150
Appendix C Table C.11.1 Seismic core damage and release frequencies from published probabilistic risk assessments. Seismic Seismic Core Damage Release % of Rank Dominant Frequency Frequency Total of Earthquake SSE (mean) (mean) Core Release Level Plant Type (g) per Year per Year Damage Sequence (g) Zion 1 & 2 PWR 0.17 5.6E-6 3 1 >0.35 Indian Point 2 PWR 0.15 1.4 E-4 1.4 E-4 30 1 >0.30 (rev. 4.8E-5) Indian Point 3 PWR 0.15 3.1 E-6 2.4E-6 1 8 >0.30 , (rev. 2.5E-5) Limerick BWR 0.15 4.0E-6 2.0E-7 -- 1 >0.35 Millstone 3 PWR 0.17 9.4 E-5 68 3 30.30 Seabrook PWR 0.25 2.9E-5 13 30 >0.30 Oconee 3 PWR 0.15 6.3E-5 6.0E-5 25 1 >0.15 Two major programs have been undertaken in the past few years to develop methods and data banks to estimate the seismic hazard at all locations of the United States cast of the Rocky Mountains. The first program conducted by the Lawrence Livermore National Laboratory (LLNL) under the auspices of the NRC is entitled the Seismic Hazar'd Characterization Project (Ref. C.11.6). The method used in the LLNL project embodies the four steps described above. In order to capture the uncertainties, both the random (physical) uncertainty and the modeling (knowledge) uncertainty, expert judgment was used to assess parameter values and models in the fields of seismicity modeling and ground-motion prediction modeling. To this end two panels were formed. The S-Panel was made up of experts on seismicity and ronation; experts on ground-motion prediction formed the G-Panel. The independence of the experts was promoted by encouraging them, if they so preferred, to use their own information and data bases. The method developed was not intended to lead to some kind of artificial consensus, but rather the display of the full range of judgments was to be retained. The judgments of the experts were elicited through a series of written questionnaires, feedback meetings, and feedback questionnaires. To propagate uncertainties in parameter values and models and develop a probability distribution of the hazard, an approach based on simulation was used. Using a Monte Carlo approach, each of the parame-ters was sampled a large number of times from its resnective probability distribution, which described its uncertainty. With each hazard curve resulting from a given simulation was associated a weight, or prob-ability of being the true hazard curve, which was calculated as the product of the probabilities or weights of each of the ranoom parameter values used in that simulation. For each pair of seismicity and ground-motion experts (respectively S-Expert end G-Expert) described earlier, a typical simulation was carried out as follows:
- Draw a map from the distribution of maps for this S-Expert, e For each one of the seismic sources in a sample map, draw a set of seismicity parameters from their respective distribution, i.e.:
A value for the a parameter of the recurrence law (see Fig. C.11.1(b)), A value for the b parameter of the recurrence law (b is allowed to have three levels of correla-tion with a, as specified by the S-Expert, Fig. C.11.1(b)), and NUREG-1150 C-102
Appendix C Al
.A2 A3
,z 109to N = a0 ~ D 0 ":
Reactor fd
+ -
-+
$ni F2 ',
F1 Magnitude, m3 Sources Recurrence (a) (b) increasing magnitude -
~'
! \
g! i :
$E* Dn E= l s
P: P2 g , Peak ground Distance, R l' acceleration Seismic harard Attenuation - ; l (c) (d)
'l 5
o i l Figure C.11.1 Model of seismic hazard analysis. C-103 .NUREG-1150
-__--_-___a_ .s .
i Appendix C The value of the upper magnitude (or intensity) cutoff;
- Draw a ground-motion model frcm the distribution of models; and e Draw a value for the random uncertainty parameter, which is associated with the selected ground i motion, for the appropriate Eastern U.S. region (Northeast, Southeast, North Central, or South Central).
The hazard was calculated for each of the seismic sources and combined for all sources. Each simulation gives a possible hazard curve. For each site, typically 2,750 curves (50 simulations for each of the possible combinations of 5 G-Experts and 11 S-Experts) were developed. Percentiles, usually the 15th, 50th, and 85th, were then used to describe the uncerta'nty in the hazard. Typical hazard curves are presented in Figure C.11.2 for the Peach Bottom site. In addition to the hazard curves for 69 nuclear plant sites east of the Rocky Mountains, the LLNL project also generated uniform hazard spectra for various return periods for each site. Uniform hazard spectra for 1 the Peach Bottom site are presented in Figure C.11.3. [ The second program was undertaken by the Electrical Power Research Institute (EPRI) (Ref. C.11.7) with j similar objectives to the LLNL program. While the LLNL and EPRI approaches have many similarities, that is, they rely upon expert judgment, there are significant differences in the manner in which the expert judgment was solicited and in the treatment of ground motions (Ref. C.11.8). EPRI's major effort was ! aimed at developing a structured approach to the dehneation and characterization of seismic sources. On the other hand, LLNL's approach has been that of the solicitation of expert judgment from individuals, among whom there was a moderate amount of interaction, while EPRI relied upon the use of expert teams, among whom there was a great deal of interaction through workshops and meetings devoted to j
- specialized seismological and tectonic topics. For example, instead of the 11 individuals, (primarily seis- 1 l mologists) upon whom LLNL relied for the seismic zoning input, EPRI used six teams, each of which spanned the disciplines of geology, seismology, and geophysics. After discussion and interaction, each team agreed upon a common input. In order to ensure uniformity in data assumptions, EPRI compiled a common geological, geophysical, and seismological data base. With respect to seismicity recurrence pa-rameters, a good deal of effort was expended in defining uniform statistical techniques for estimating these parameters. The teams had the option, based on these studies, of allowing variations within the seismic sources themselves. Instead of employing an expert panel for the ground motion, EPRI used three models to reflect uncertainties in the ground-motion estimates. EPRI felt that ground-motion model development is less subjective and fairly well defined and any needed evaluation could be done by its consultants (Ref.
C.11.9). In the EPRI approach, in contrast to the Monte Carlo approach used by the LLNL, uncertainties in seismic sources, seismicity parameters, maximum magnitude, and ground-motion models are propa-gated through and represented in a logic-tree format (Fig. C.11.4). Each level of the tree represents one source of uncertainty; each terminal node represents one " state of nature." Corresponding to each termi-nal node, there is a hazard curve. The probability associated with a terminal node (and with the corre-sponding hazard curve) is the product of the probabilities associated with all intermediate branches in the path from the root to the terminal node. Results for the Peach Bottom site from the EPRI program are shown in Figure C.11.5. The uniform hazard spectra obtained from the EPRI program, in general, exhibit similar characteristics to the LLNL results. According to Reference C.11.10, which compared preliminary results of both studies of nine test sites, the rnost significant differences in the results of the LLNL and EPRI studies that primarily affect the uncertainty distributions are (see also Ref. C.11.11): e A larger number of ground-motion models, encompassing a large range of opinions, are used in the ) LLNL project than in the EPRI study; and l
- The EPRI study has less uncertainty in the seismicity parameters, leading to lower uncertainty in the estimate of the hazard.
NUREG-1150 C-104
')
i Appendix C 1 E.U.S SEISMIC HAZARD CHARACTERIZATION LOWER MAGNITUDE OF INTEGRATION IS 5.0 PERCENTILES = 15. 50. AND 85.
-1 HAZARD CURVES USING ALL EXPERTS . .
10 . . . .
-2 -
10 2 5 5 -3 - g to - U 5 O O -4 - g to - w ci t- -s - g to - S a 2 n.
-6 -
10
-7 ' ' ' '
10 e e n a a
-g* n n ACCELERATION CWSEC"2 PEACH BOTTOM i
i 1 I Figure C.11.2 LLNi nazar d curves for the Peach Bottom site. C-105 NUREG-1150 l 1-
Appendix C E.U.S SEfSM&C HAZARD CHARACTER 12AT10N LOWER MAGNITUDE Of INTEGRATION IS 5.0 10000 -YEAR RETURN PERIOD CONSTANT PERCENTILE SPECTRA FOR . PERCENTILES = 15. 50. AND B5. 3 10 4 i a
- 2. i 10 -
I o
=
b 10 1 D U S V . 0
)
10 - l I t
-l to '
n n w mm << n w som << n cm Yo Io o
~
o PERIOD (SEC) PEACH BOTTOM Figure C.11.3 10000-year return period uniform hazard spectra for Peach Bottom site. NUREG-1150 C-106
1 Appendix C - 4 y 1 I S EIS MICIT Y GROUND gg g gg PARAMETERS M A x tuuu IJ O T IO N C A S E S: COMDils A f TON gg A g u s t up E S F U N CTIO f1S OF ACM SOURCES ..C.t.8
.. . 2M .- 2.. G.1 s /
,' s' s / s~
st t G2 . .c,I,, 8,2.,M,2,.,G,2,, G* Vy 3 y . . i Cous.C2 f ,'.
,- 's CI.52.W2.G3
.- = - -
e N, o .
,O.
c, ..- N. - 1 l l j i i Figure C.11.4 Example of logic-tree format used to represent uncertainty in hazard analysis input (EPRI program). C-107 NUREG-1150 i
_ _ - _ - _ _ _ _ _ _ _ - - - - _ - - - - _ - - - - - - - - - - - -~ Appendix C 10" : r s z
'E PEACH BOTTOM g 10-2 # --- = MEAN HAZARD e i m
O x cl. M 3 0~3 1m 3,.. E -3. h\. o :t i- \,'.s-3 t-. 10-0
\ \, \ s ,
3 _r ( . , , - - 5 A : - N,,
\, Ns s, 10-* -
s ',
'\
C, j
, , '\ ,
Z 10-' $ :
?s :
s N. . ,'-
< \ \ '
10-' ' ' ' O 225 450 675 900 ACCELERATION CM/SEC*"2 Figure C.11.5 EPRI hazard curves for Peach Bottom site. NUREG-1150 C-108
Appendix C Thus, there are now two sets of hazard curves available for use at sites east of the Rocky Mountains. Issues associated with the use of these two sets of hazard curves, associated uncertainties, and considera-tion of uniform hazard spectra in the PRA applications are discussed next. The primary issue in the seismic risk analysis is the large uncertainty associated with the computed results and use of these results in decisionmaking. The uncertainties, as discussed earlier, largely stem from uncertainties in hazard estimates. In addition to the issue of the uncertainty in hazard, publication of uniform hazard spectra also will have an impact on the PRA application. e Uncertainty in Hazard Estimates: As seen in Figure C.11.2, from the large spread between the 15th percentile and 65th percentile of the hazard calculations, it is evident that seismic hazard estimates are associated with substantial uncertainties. In terms of ground-motion parameters, the LLNL re-sults (Ref. C.11.12) indicate that, for a fixed annual probability of exceedance, the difference be-tween the 15th and 85th percentile curves corresponds to approximately a factor of four or larger in both peak ground acceleration (PGA) and spectrum-related ground-motion estimates. When the probability of exceedance at the 15th and 85th percentile levels are compared at a fixed PGA, large differences, ranging from a factor of 40 to 100, can be observed, depending upon the PGA level. Sensitivity studies have shown that the largest contribution to modeling uncertainty is caused by the uncertainties associated with the models relating ground motion to distance and magnitude. It should also be noted that the mean hazard, because it is sensitive to a highly skewed distribution, can lie above the 85th percentile of the hazard. Median hazards are not strongly affected by the extrcme values of the probability distributions. Sensitivity studies on the LLNL results indicate that individual expert judgment can, under certain conditions, dominate the hazard calculation. Specifically, if a site in question is 'a rock-based site where distant large earthquakes are the major contributors to the overall seismic hazard, the inclu-sion or exclusion of the input from one ground-motion expert (G-Expert 5) leads to significant differ-ences in the hazard. This effect is particularly evident at the 85th percentile and mean hazard esti-mates. The widely recognized difficulties in the estimation of the likelihood of rare events are compounded in the case of seismic hazard estimation by the lack of knowledge with respect to basic causes and future locations of earthquakes in the Eastera United States. This is clearly illustrated by the results of two independent studies, the LLNL and the EPRI studies. These studies represent the most com-prehensive efforts of their kind undertaken to date. Although attempts have been made (Ref. C.11.10) and studies are under way to understand and reduce the differences between the results of these studies, the methods of each of these studies should be viewed as valid. Because of the inherent uncertainties, results from both sets of hazard curves should be included in a risk study (Ref. C.11.12). Reducing the combined range of uncertainties to a single point estimate ignores the funda-mental message. Enveloping the uncertainty is also inappropriate in that the least well-defined aspects are the upper and lower bounds. Therefore, in NUREG-1150 studies, both sets of curves are used independently and results are presented side by side (Figs. C.11.6 and C.11.7). The use of these two sets of hazard curves and associated risk analysis results are discussed in Section C.11.2. e Uniform Hazard Spectra: As discussed earlier, the LLNL and EPRI studies have also provided esti-mates of uniform hazard spectra for each Eastern and Central United States site. As described in Section C.11.2, the NUREG-1150 studies used LLNL and EPRI hazard curves but did not use uniform hazard spectra. One of the major findings of both the LLNL and EPRI studies is that the estimated uniform hazard spectra for eastern earthquakes are higher at high frequencies and lower at low frequencies compared to standard broadband spectra (e.g., spectra given in Ref. C,11.13) based on recorded western earthquakes. The spectra used in the NUREG-1150 analyses were developed using primarily western records. Implications of the differences between these spectra on the risk analysis will be studied in detail in a later study but the inference for Surry is quite clear. For all structural frequencies of interest, the uniform hazard spectra are below the median spectra used in the analysis. This should result in smaller plant response for a given PGA. The overall effect, with all C-109 NUREG-1150
Appendix C 1.0E-03 -
;r-
~
O-
$ 1.OE-04 D .
~
~
g. s 1.OE-05 g
$ 5 ,
~
E - l 3 i C l 1,OE-06 g Y
} -
l - 1.0E-07 INTERNAL SEIBMIC SEISMIC FIRE LIVERMORE EPRI
& Mean O Median Figure C.11.6 Surry external events, core damage frequency ranges (5th and 95th precentiles).
NUREG-1150 - C-110
Appendix C t 1.OE-03 3 5
~
C o 1.OE-04 n g - 5 o - u 1.OE-05 A : I - n 1.0E-06 i s : 0 - a - E 1.0E-07 g Y i 1.OE-08 INTERNAL SEleMIC sEleWIC FIRE uvERMORE EPRI
@ Mean O Modlan Figure C.11.7 Peach Bottom external events, core damage fregt.ency ranges (5th and 95th percentiles).
C-111 ~
Appendin C else remaining the same, will be a reduction in the core damage frequency. For the Peach Bottom site, th'eimpact on the mean core damage and distribution is also not expected to be significant since, at the frequencies of important structures, both response spectra are similar. These issues will be addressed in additional staff studies. Additional issues associated with t'le use of uniform hazard spectra are related to partitioning of uncertainties among hazard curves, spectra, and fragility analy-sis. Both the PGA hazard curves and uniform spectra reflect uncertainty in the underlying seismclogi-cal parameters as well as randomness in the ground-motion estimates. In addition, peak-to-valley variability and random variability between horizontal components may also be included in these two estimates. Many times these uncertainties are included in the fragility analysis. Thus, clear under-standing of uncertainties is needed to avoid double counting or underestimation. C.11.2 Treatment in PRA and Results In tw NUP' '-1150 seismic analyses, both the LLNL and EPRI hazard estimates have been used. These estimatt . n in Figures C.11.2 and C.11.5, are given at selected confidence levels of 15 percent, 50 percen - i percent and mean curves (it is also possible to get results for 5 percent and 95 percent
.. confidence - a). In principle, one can use the entire set of 2,750 hazard curves that were generated for each site in the LLNL study. However, since the results are presented in the form of Figure C.11.2, one has to resort to fitting a distribution to the hazard uncertainty at any given PGA and then discretize the distribution into a chosen set of hazard values in order to obtain a discrete set of hazard curves. This approach was used in Reference C.11.14, which also used the LLNL input. In NUREG-1150, it was assumed that the seismic hazard could be approximated by a lognormal distribution that fit the calculated 50th percentile and mean. While the lognormal assumption is a good approximation, the actual distribu-tions vary. The differences can be seen by comparing the actual calculated hazard curves at a different percentile from the LLNL study with that determined from the lognormal fit. The EPRI hazard results can deviate more from a lognormal distribution. In the NUREG-1150 studies, the full lognormal distribution l was used in drawing samples for the Monte (Nrb analyses. Therefore, no discretization was necessary.
Sensitivity studies have been carried out for both Surry and Peach Bottom analyses to understand the impact of the lognormal assumption as well as to assess the potential effect of contributions from the tail of the assumed distribution. (See individual plant studies (Parts 3 of Refs. C.11.4 and C.11.5) for further discussions.) Since the distribution is derived by fitting it to the mean, there should be minimalimpact on the mean core damage frequency from W _ approximation. The necessity of the above approach of fitting a distribution to the uncertainty will also result in not simulating the real nature of hazard curves that may intersect each other. The correlation of hazard values at different accelerations arising out of the same source / ground-motion hypothesis model cannot also be consistently treated. The major contributions to the hazard cannot a priori be correlated with the size of the contributing earthquakes. For example, the study results (Ref. C.11.6) indicate that although some plant sites in the New England area exhibit relatively high seismic hazards, the contribution to the overall hazard from earthquakes with magnitudes of 6.5 or larger k ognificantly less than the contribution from these large earthquakes to plant sites near New Madrid, Missouri, or those near Charleston, South Caro-lina. Such a deaggregation of hazard curves and uniform hazard spectra can be extremely usefulin under-standing the relative contribution from large magnitude (potentially damaging) events versus low magni-tude (less damaging) events. It is very important to understand that PGAs have not been shown to be good indicators of the damage potential of an earthquake for ductile structures / components, since low magni-tude events can produce a large PGA but little damage (e.g., Ref. C.11.15). (This concern has been alleviated to some extent in the LLNL and EPRI studies by the use of a minimum magnitude of 5.0, the 1 magnitude below which damage to the engineered structures is considered unlikely.) To better character-- ize damage potential, information with respect to the frequency content of the motion and duration are vital. The fragility analysis used in the NUREG-1150 studies takes into account, to some extent, the earthquake magnitude effects by using the concept of an effective ductility (see Parts 3 of Refs. C.11.4 and C.11.5 for detailed dis ussions). However, detailed building / component response analysis (including nonlinear effects, if necessary) using magnitude-dependent spectral shapes can be used to remove further NUREG-1150 C-112
Appendix C conservatism, if any, included in the plant response / fragility analysis. Consequences of a building failure can also be evaluated more realistically. While such understanding of hazard curves will not necessarily result in less uncertainty or changes in core damage frequencies, perspectives into which magnitude earthquakes and characteristics of the associated ground motion ihat contribute to these frequencies can be extremely useful. Recovery actions, not usually considered acceptable in seismic PRAs, snay be feasible for the lesser magnitude events. In the additional staff studies, the deaggregation of the hazard curve into various magnitude ranges will be conridered to the extent possible. The seismic risk analysis method used in NUREG-1150 requires the toe of earthquake time histories to determine the vibratory raotion within the nucicar power plant. Peak ground accelerations frem the seis-r e hazard curves were used to anchor a set of real earthquake records (time histories) for each site. These scaled earthquake records were then used to perform a probabilistic response analysis. The seismic hazard studies, while not providing time histories, do, along with defining peak accelerations, define seis-mic hazard also in terms of uniform hazard spectra. They are bawd upon the limited data available from Eastern United States earthquakes and the most current models prepared by seismological experts in the field. They are different from the response spectra of the time histories that were used, which were derived f am Western United States earthquakes. The seismic hazard spectra based on eastern earth-quakes are higher at high frequencies and lower at low frequencies. Issues associated with the uniform hazard spectra and their use in the PRA application were discussed in Section C.11.1 '?ang with the possible impact on the resuhs of NUREG-1150 studies. This issue will be addressed in uditional staff studies as discussed above. After the establishment of the hazard curves and the spectra for use in the plant response calculations, the remaining steps of the seismic risk analysis (that-is, plant system and accident sequence analysis and quantification) are described in Appendix A to NUREG-1150 and in plant-specific external-event analy-ses (Parts 3 of Refs. C.11 A and C.11.5). Estimates of the core damage frequencies for the Surry and Peach Bottom plants are reproduced in Figures C.11.6 and C.11.7. Values of mean,5th,50th, and 95th percentile estimates are also given in Table C.11.2. Sensitivity studies conducted specifically for Surry and Peach Bottom in this program and other sensitivity studies have shown that the uncertainty in seismic hazard curves dominates the uncertainty in the seismic core damage frequency. Table C.11.3 shows results of sensitivity analysis performed for Peach Bottom to ascertain the relative contribution of the hazard curve, the seismic response, and the seismic fragility ! modeling uncertainties to the overall core damage frequency.* The base case mean, 95th percentile, and 50th percentile core damage frequencies are shown in the first column. The second column shows the corresponding values with the hazard curve fixed at its median , value (i.e., with no modeling uncertainty). This results in an error factor of 3.5 versus the error factor of ' 30.1 for the base case. Clearly, the hazard curve is contributing the vast majority of the uncertainty to the base case results. Note also that the mean core damage frequency is reduced by a factor of 6.1 when no hazard curve uncertainty is included. The third column sho;/s a case wherein all the fragility and response modeling uncertainties are simultaneously set to zero. The error factor Icr this case is 25.5, which shows that the reduction n responn and fragility uncertainties has little effect on the overall core damage uncer-tainty. For this case, the mean core damage frequency is reduced only by a factor of 1.9. Thus, the fragility and response uncertainties play little role in determining the mean core damage frequency. How-ever, conservatism associated with the fragilities (median values and uncertainties) and assumed conse-quences, given a failure of a certain component, may have significant impact on core damage frequencies if a single loss dominates the contribution. Dominant sequences and their contributions can also be af-fected by fragility / consequence assumptions.
' Note that the hazard curves used in this sensitivity anaiysis are not the same as ones used in the final calculation; tow-ever, the conclusions are the same. See Part 3 of Reference C.11.5 for the final results.
C-113 NUREG-1150
L
; Appendix C I
Li
. Table C.11.2 Core damage frequencies.
5th Medirn 95th Mean j i Surry LLNL_ ' 3.92E-7 1.48E-5 4.38E-4 1.16E-4 3.00E-7 6.12E-6
~
EPRI 1.03E-4 2.50E Fire 2.2E-6 E.32E-6 3.08E-5 1.13E -5. 1 Internal 6.80E-6 2.30E-5 1.30E-4 4.10E-5 Peach Bottom 'i LLNL 5.33E-8 4.41E-6 > 2.72E 7.66E EPRI 2.30E-8 7.07E 't ' 1.27E-( 3.09E-6 Fire 1.09E-6 1.16E-5 6.37E-5 1.96E-5 Internal 3.50E-7 1.90E-6 1.30E-5 4.50E-6 l
~
Table C.11.3 Comparison of contributions of modeling uncertainty in respor.se, fragility, and hazard' curves to core damage frequency. Bas [ Hazard ' E RU = ' ' Pcm Case SRU=* ERU=' hiean 155E-5 2.25E-6 8.13E-6 ' 95 % 5.78E-5 6.53E-6 3.50E-5 . 50% 1.92E-6 1. 87E-6 1.37E-6 l Pcm(95%) 30.1 3.5 25.5 Pcm(50%) E[Pcmbase case] 1.0 6.1 1.9 E[Pcm) These resuits show quite clearly that the uncertainty in the hazard curve is the dominant factor in both the mean value of core damage frequency and in the uncertainty of the core damage frequency. Further, as - discussed in the plarrt-specific analyses (Part 3 of Ref. C.11.5), it is the mean hazard curve that drives the mean estimate of core damage frequency. Again, this shows the dominant influence of the hazard curve uncertainty (which determines the mean hazard curve) in determining the mean core damage frequency. Sensitivity studies are also ccnducted in the plant-specific analyses to examine the importance of the basic seismic failure events to the estimates of mean core damage frequencies. These studies show that for a dominant component, if no failure is assumed, the percentage reduction in the. core damage frequency would be in the range of 40 percent. Note that given large uncertainties' associated with the seismic results, a change in the mean core damage frequency by'a factor of two or so may not be that significant. However, the fragility of the plant (conditional failure probability at a given PGA) may improve apprecia-bly. In Table C.11.4, dominant sequences and their contributions to the mean core damage frequency are
.lh:ted for the Peach Bottorn plant for both the LLNL and the EPRI hazard curves. Similar studies for the
.NUREG-1150 - C-114
Appendi:t O : Table C.11.4 Dominaat sequences at Peach Bottom. Total Mean Pcm = 7.66E-5 (LLNL),3.09E-6 (EPRI) Dominant Sequences LLNL EPRI T -33 i 3.69E-5 (48%) 1.61E-6 (52%) ALOCA-30 1.84E-5 (24%) 6.70E (21%) RVR-1 8.92E-6 (11%) 3.27E-7 (11%) S LOCA-70 i 6.67E-6 (9%) 1.85 E-7 (6%) RWT-1 2.76E-6 (4%) 1.75 E-7 (6%) SaLOCA-42 1.20E-6 (2%) 4.90E-8 (2%) By Sequence LLNL EPRI Transients (LOSP) 3.69E-5 (48%) 1.61 E-6 (52%) LOCAs 2.59 E -5 (34%) 9.04E-7 (29%) - Vessel Rupture 8.92E-6 (11%) 3.27E-7 (11%) RWT Bldg Failure 2.76E-6 (4%) 1.7.5 E-7 (6%) Surry plant are also discussed in the plant-specific studies. Observations discussed here are equally valid for both plants. As seen from this table, although the numerical values are quite different for each se-quence when the LLNL or the EPRI hazard curves are used, the order is the same and the relative contributions are slightly varied. This is not surprising since the two mean curves do not intersect each other or indicate drastically different characteristics, such as one being truncated at some acceleration. value. If this were the case, then one might expect ranking of sequences and elimination or addition of . some sequences. Since the order of dominant sequences remains the same for both the hazard curves, perspectives gained as to the dominant components are also robust. Perspectives as to dominant sequences and components could also be affected if the spectral shapes associated with the different hazard curves were quite dissimilar. However, the uniform hazard spectra from both the LLNL and EPRI studies seem to exhibit similar characteristics. For the Peach Bottom plant, Figure C.11.8 shows contributions from the different earthquake ranges to the mean core damage frequencies resulting from the use of both the LLNL and the EPRI hazard curves. For both the hazard curves, the majority of contributions is coming from an earthquake range between 0,45g to 0.75g consistent with the Peach Bottom mean plant fragility curve (Fig. C.11.9) for which roughly the 50 percent conditional core damage frequency occurs around 0.61 , Thus, there is a relative robustness as to which earthquake range contributes to the mean core damage kequencies. .Several long-term studies are planned to better understand some of the issues associated with the hazard definition; however, it is clear that results of seismic risk analysis will have large uncertainties associated with them. From examination of Table C.11.2, it is evident that conflicting conclusions can be obtained when point estimates are used as risk indices. For example, if the median estimates are used to determin? the relative knportance between the seismic initiators and the internal initiators, one will conclude that for the Surry analysis, with either the LLNL hazard or the EPRI hazard estimates, the contribution to the total core damage frequency is larger from the internal initiators than the seismic initiators. Conversely, if the means are used, one would conclude that, based on the use of the LLNL hazard curves, the contribu-tion from the seismic initiators is much larger than that from the internal initiators. Based on the results from the EPRI hazard curve, the conclusion would be that internal initiators contribute more than seismic initiators. These findings illustrate the confusion that can result if single estimates are used to characterize the risk. C-115 NUREG-1150
Appendix C 36;
% C EPfll HaanW Cerve 30 -
e oo 26 -
$l .
t l* 20 - tm i e oe 16 - ne t f or 10 - e me a 6 - n
. , l . i e > >
.226 .375 .626 .676 .826 .975 1.12 6 Peak ground acooierailon On 0) 30 --
j j g O LLNLHasaN C n a 26 -
$o t i
~'"~'
ra 20 -
~~
- b. d.
tm Ia 15 - oe ne t f 10 - or
.e me a 6 -
a n 0
.226 .876 .626 .676 .826 .876 1.126 Peak grour.J acceleration On G)
Figure C.11.8 Contribution fre n .different earthquake ranges at Peach Bottom. NUREG-1150 C-116
App 3ndix C' l
-l l
'l l
e 0.8 - ff O.6 -
- - 1
' =l 0.4 -
II \ t
. 0.2 -
l 0
" ~
e' l 0 0.2 OA 0.6 0.8 Nak ground acceleration (G) 1- 1.2 '.4 .' I ' Surry + Peach Bottom l l Figure C.11.9 Mean plant level fragilities, j j C-117 NUREG-1150 '
-z
, . 1
Appendix C t One clear conclusion is that the distribution of the seismic-induced core damage frequencies are more uncertain than the internal frequencies and their distribution overlaps with distribution from other initia-tors and cannot be ignored. In light of the large uncertainties, any decisionmaking should take into ac-count the full range of uncertainty as well as engineering insights and understanding obtained regarding the integrated plant response to a seismic event. Some of the robust findings, such as perspectives regard- ( ing dominant sequences and components, were discussed in the preceding paragraphs and can be used to 1 evaluate the need to further refine the analysis or enhance safety by improving the plant procedures or implementing cost-effective fixes. REFERENCES FOR SECTION C.11 C.11.1 P. G. Prassinos, " Evaluation of External Hazards to Nucleer Power Plants in the United SRtes-Seismic Hazard," Lawrence Livermore Nationa'. Laboratory, NUREG/CR-5042, Supplement 1 UCID-21223, April 1958. I l C.11.2 J. W. Hickman et al., 'PRA Procedures Guide. A Guide to the Performance of Probabilistic l l Risk Assessments for Nuclear Power Plaras," American Nuclear Society, NUREG/CR-2300, Vols.1 and 2, January 1983. 1 C.11.3 M. K. Ravinara et al., " Sensitivity Studies oi Seismic Risk Models,' Electric Power Research Institute (EPRI) EPRI NP-3562, June 1984. ; l C.11.4 R. C. Bertucio and J. A. Julins, " Analysis of Core Damage frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Rev.1, SAND 86-2084, to be published.' C.11.5 A. M. Kolaczkowski et al., " Analysis of Core Damage Frequency: Peach Bottom Unit 2," San-' dia National Laboratories, NUREG/CR-4550, Vol. 4, Rev.1, SAND 86-2084, to be published.' C.11.6 D. L. Bernreuter et al., " Seismic Hazard Characterization of 69 Nuclear Power Plant Sites East of the Rocky Mountains," Lawrence Livermore Nadonal Laboratory, NUREG/CR-5250, Vols. 1-8, UCID-21517 January 1989. C.11.7 Seismicity Owners Group (SOG) and EPh!, "Se'.smic Hazard Methodology for the Central and Eastern United States," EPRI NP-4726, July 1086. C.11.8 L. Reiter, " Current Trends in the Estimation and Application of Probabilistic Seismic Hazard in the United States," Proceedings of IAEA Specialis.'s Meeting on Earthquake Ground Motion (Moscow, USSR), March 24-28, 1986. C.11.9 Letter from L. Reiter, NRC, to R. A. Thomas, SOG, Review Comments on EPRI Ground Mo-tion Models for Eastern North America, dated August 3,1988 C.11.10 D. L. Bernreuter et al., " Seismic Hazard Characterization of the Eastern United States: Com-parative Evaluation of the LLNL and EPRI Studies," Lawrence Livermore National Laboratory, NUR7G/CR-4885, UCID-20696, May 1987. C.11.11 Letter from J. E. Richardson, NRC, to R. A. Thomas, SOG, Safety Evaluation Review of the l SOG/EPRI Topical Report Titled " Seismic Hazard Methodology for the Central and Eastern United States," EPRI NP-4726, dated September 20, 1988.
'Available in the NRC Public Document Room, 2nD L Street NW., Washirigton, DC.
NUREG-1150 C-118
I i App:ndix C l C.11.12 Memorandum from O. Bagchi, NBC, to L. Shao, NRC, Publication of NUREG/CR-5250 Titled
" Seismic Hazard Characterization of 69 Nuclear Power Plant Sites East of the Rocky Moun-tains," dated March 21, 1989. l C.11.13 U.S. Atomic Energy Commission, Regu'atory Guide 1.60, "Dwign Response Spectra for Nu- J clear Power Plants," Revision 1, December 1973.
C.11.14 P. G. Prassinos et al., " Seismic Failure and Cask Drop Analyses of the Spent Fuel Pools at Two l' Representative Nuclear Power Plants," Lawrence Livermore National Laboratory, NUREG/ CR-5176, UCID-21425 January 1989. C.11.15 J. W. Reed et al., " A Criterion for Determining Exceedance of the Operating Basis Earth-quake," EPRI NP-5930, July 1968. i l l l i l I l I 1 l l i
'Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
C-119 NUREG-1150
;I b
APPENDIX D RESPONSES TO COMMENTS ON DRAFT NUREG-1150 f
*f d
9 I N
- 6 6
y a i 1 1 CONTENTS Page INTRODUCTION . . . . . . . ... .. ......... . . .. .. .... . . . .. .......... D-1 D.1 Objectives and Scope . . . . . . . . . . . . . . . . . . . . ....... .. . ..... .. . .. .. D-4 D.1.1 Objectives . . . . . . . . ........ ...... .. . .. .. . ..... .. . . . . D-4 D.1.2 Scope .... . .. ..... .... .... .. ... ................... .. ..... D-5 D.2 Overall Methods . . . . .. ................. ........ ...... . ....... ..... D-6 D.2.1 Uncertainty Analysis . . .. .......... .. .. ........... . .. ..... . D-6 D.2.2 Expert Judgment . . . . .......... .. . ........ . ... .. ... .. . D-8 D.2.3 Quality Assurance, Consistency, and State of the Art . ............... .... D-9 D.2.4 Other Comments on Methods . . . . . . . .. . ........ . . .. . ...... D-11 D.3 Tracing and Documenting Calculations . ... . .. ... .. .. ..... .. D-12 D.3.1 Tracing Calculations . . . . ... ... ... ....................... ..... . D-12 D.3.2 Completeness of Documentation . . . . . . . .......... ......... .... ..... D-13 D.3.3 Display of Results ..... .. ........ . .. .. . .. . .. . ...... . D-13 D.4 Accident Frequency Analysis . . . . . . . . . . . . ... .. ....... ........ . .... . .. D-14 D.4.1 Logic , . .. ......... ..... . . ... .... .. .. ... ... ...... . D-14 D.4.2 Quantification . . . .... ..... ...... ... . .. .. .. ... .... D-15 D.5 Containment Loads and Structural Response . . . . . . ... .... . ... .. .... D-17 D.5.1 Accident Progression Event Tree: Logic . . . . . .. . ............ ...... ... D-17 D.5.2 Containment Loading Phenomena . . . . . . . . . . . ... .. ... .. ......... . D-18 D.S.3 Containment Structural Response . . . . . . ... . . . ... ... ......... . D-21 D.6 Source Terms and Consequences . . . . .. ........... ....... .... .... ... D-23 J d D.6.1 Methods ..... .. . .... ... . . .... . ..... ,. .. . -, . .... . D-23 1 D.6.2 Supporting Data Base and Modeling Assumptions D-25 D.6.3 Comparisons with Accident at Chernobyl . . . . . .
..... . ... D-29
)
D.7 Uses of NUREG-1150 as a Resource Document . .... ... . .... . ........... D-30 l l D.7.1 Uses . .. . . . ....... . . .... .. ... .. ..... .. ... .. D-30 D.7.2 Cost / Benefit Analysis . . D-31
)
D.7.3 Safety Goal Comparisons .. . ...... .. ... . ..... ...... D-31 ) D.7.3 Extrapolation of Results ... ... .. . . .. .... ............ . ... D-32 I i REFERENCES FOR APPEND 1X D . .. .. . .... .... . ......... .. D-33 i i, l l i
- iii - i
INTRODUCTION The previous draft of NUREG-1150, " Reactor Risk Reference Document," was issued as a draft report for public comment in February 1987. At that time, a notice was published in the Federal Register an-nouncing the availability of the report and requesting comment (Ref. D.1). Distribution was made to approximately 850 people or organizations in the United States and abroad. To assist readers of the document, a two-day seminar was held in April 1987 on the methods used in the risk analyses of draft NUREG-1150. A notice of this seminar was sent to all persons receiving the draft report and published in the Federal Register (Ref. D.2). The seminar took place in Rockville, Maryland, and was attended by 173 people from various organizations, including Federal agencies, State agencies, utilities, architect / engineering firms, and consulting firms. In response to the request for comments, the NRC staff received 55 letters from 45 authors totaling approximately 800 pages. The authors of these letters and their affiliations are listed in Table D.1. All letters received are available far inspection in the NRC Public Docurr.ent Room. In addition to these reviews and comments, draft NUREG-1150 was reviewed by three formal peer review committees. Two of these reviews were initiated by the NRC; the third review was initiated by the Ameri-can Nuclear Society. Also, as part of the normal review process within the NRC, the staff discussed the methods and results of draft NUREG-1150 with the Advisory Committee on Reactor Safeguards on sev-eral occasions (kef. D.3).
- 1. Review by Kouts Committee One of the major advances of the risk analyses discussed in draft NUREG-1150 was the performance of quantitative uncertainty analyses. The specific approach used to perform these uncertainty analyses was reviewed by a panel of five experts, chaired by Dr. Herbert Kouts of Brookhaven National Laboratory.
The members of this committee are listed in Table D.2. The committee performed its rcview from April to October of 1987. Its findings were published as Reference D.4 in December 1987.
- 2. Review by Kastenberg Committee The NRC invited Professor William Kastenberg, University of California, Los Angeles, to form and chair a l committee to peer review the entire breadth of risk analyses, as documented in draft NUREG-1150 and supporting contractor reports. Lawrence Livermore National Laboratory was funded by NRC to provide technical and administrative support. The members of the committee, listed in Table D.3, were selected l by Professor Kastenberg. The committee performed its review from June 1987 to March 1988, with its findings published as Reference D.5 in May 1988.
- 3. Review by American Nuclear Society The American Nuclear Society (ANS) chartered a special committee chaired by Dr. Leo LeSage of Ar-gonne National Laboratory to study and critique draft NUREG-1150. The members of this committee are listed in Table D.4. The committee started its work in the fall of 1987 and published its findings as Reference D.6 in April 1988.
- 4. Overview of Comments and Responses It is the nature of reviews of documents such as draft NUREG-1150 that extensive comments cre received and that most of the comments are critical. Before discussing the principal (negative) comments, it is worth describing the principal positive comments that were expressed in letters and committee reports:
e it is believed that the NUREG-1150 study is the first comprehensive treatment of both modeling and data uncertainty in risk. In prior PRAs, the accounting of uncertainty has been limited to data uncer-tainties. D-1 NUREG-1150
Appendix D Table D.1 Authors of public comment letters. Abe, K. Japan Atomic Energy Research Institute,' Japan Artigas, R. General Electric, San Jose, CA Booker, J. E. Gulf States Utilities Company, Si. Francisville, LA ~
- Boyer, V. S. Philadelphia Electric Company, PhiladQohia, PA Brons, J. C. New York Power Authority White Plains,'NY Butterfield, L. D. Commonwealth Edison, Chicago, IL Caisley, J. Organization for Economic Co-operative Development / Nuclear Energy Agency (OECD/NEA), Paris, France Campbell, R. M. Massachusetts Voice of Energy, Boston, MA ..
Chubb, Walston - Murrysville, PA - . I Cogne, F. Institut de Protection et de Surete Nucleaire, Commissariat a - L'Energie Atomique, France Colvin, J. F. Nuclear Management and Resources Council, Washington, DC Cullingford, M. International Atomic Energy Agency, Vienna, Austria -
, Edwards D. W. Yankee Atomic Electric Company, Framingham, MA l Gardner, R. Stone & Webster Engineering Corporation, Boston, MA 1 Gridley, R. L. Tennessee Valley Authority, Chattanooga,'TN Hayns, M. R. United Kingdom Atomic Energy Authority, Culcheth, United Kingdom Hiatt, S. L. Ohio Citizens for Respons.ble Energy, Inc., Mentor, OH Hintz, D. C. Wisconsin Public Service Corporation Green Bay, WI-Hobbins, R. R. Idaho Falls, ID Hockenbury, R. W. Rensselaer Polytechnic Institute, Troy, NY Hoegberg, L., et al. Swedish Nuclear Power Inspectorate, Sweden Janecek, R. F. BWR Owners' Group, Chicago, IL Khobare, S. K. Bhabha Atomic Research Centre, Bombay,' India i Kingsley, O. D., Jr. System Energy Resources, Inc., Jackson, MS '
Kowalski, S. J. Philadelphia Electric Company, Philadelphia, PA Kranzdorf, R. San Luis Obispo, CA Langley, J. R. Mark III Containment Hydrogen Control Owners' Group, . St. Francisville, LA Lash, T. R. Illinois Department of Nuclear Safety, Springfield, IL Levenson, Milton Bechtel Western Power Corporation, San Francisco, CA Lewis, M.1. Philadelphia, PA Liu, K. C. Atomic Energy Council, Taipei, Taiwan McNeill, C. A., Jr. Public Service Electric and Gas Company, Hancocks Bridge, NJ Myers, R. Clean Air Council, Philadelphia, PA Newton, R. A. Westinghouse Owners' Group, Pittsburgh, PA Reiman, L. Finnish Centre for Radiation and Nuclear Safety. Finland Sholly, S. & Harding, J. San Jose, CA Soda, K. Japan Atomic Energy Research Institute, Japan Spangenberg, F. A., III Illinois Power Company, Clinton, IL Speelman, J. E. Netherlands Energy Research Foundation, Netherlands Stewart, W. L. Virginia Electric and Power Company, Richmond, VA Taylor, J. Electric Power Research Institute, Palo Alto, CA Tucker, H. B. Duke Power Corporation, Charlotte, NC Vaughan, J. Department of Energy, Washington, DC Warman, E. A. Stone & Webster Engineering Corporation, Boston, MA Zaffiro, C. Energia Nucleare e delle Energie Alternative, Rome, Italy NUREG-1150 D-2
Appendix D Table D.2 Members of Kouts Committee. Herbert Kouts, Chairrnan Brookhaven National Laboratory Allen Cornell ' Stanford University Reginald Farmer Consultant, United Kingdom Steven Hanauer Consultant. Technical Analysis, Inc. Norman Rasmussen Massachusetts Institute of Technology - Table D 3 Members of Kastenberg Committee.
- William Kastenberg, Chairman University of California,' Los Angeles George Apostolakis ~ University of California, Los Angeles John Bickel ~ Northeast Utilities Roger Blond Science Applications ' International, Inc.
Simon Board Central Electricity Generating Board, United Kingdom Michael Epstein Fauske and Associates, Inc. Peter Hoffman National Nuclear Research Center, Federal Republic of Germany Frank King Ontario' Hydro Company, Canada Simon Ostrach Case Western University John Reed Jack R. Benjamin and Associates, Inc. Robert Ritzman Electric Power Research Institute John Stetkar Pickard, Lowe and Garrick, Inc. Theofanis Theofanous University of California, Santa Barbara Raymond Viskanta Purdue University I 1 Table D.4 Members of ANS Special Committee on Reactor Risk Reference Document. Lt 9 LeSage, Chairman Argonne National Laboratory Eaward Warman,Vice Chairman Stone and Webster Engineering Corporation Richard Anoba Carolina Power and Light Company Ronald Bayer Virginia Power Company R. Allan Brown Ontario Hydro, Canada James Carter til International Technology Corporation J. Peter Hosemann Paul Sherrer Institute, Switzerland W. Reed Johnson University of Virginia Walter Lowenstein Electric Power Research Institute Nicholas Tsoulianidis University of Missouri Willem Vinck Consultant, Belgium l e The methods developed during the study are desirable because uncertainty can be quantified, the , contribution of various sources of uncertainty can be determined, the net impact of hypothetical i design changes can be assessed, and important technical issues can be identified. ) e It is believed that the basic methods used to generate the risk distributions are sound. e It is believed that important advances made in seveie accident analysis since the last major risk study, the Reactor Safety Study (Ref. D.7) done in 1975, are reflected. j e The detailed tr.odels of events and phenomena that load a containment and the response of the f , containment structure using event trees place added emphasis on the importance of the containment j function. This seems desirable. D-3 NUREu-1150
.l
S ' Appendix D
- It is believed that a reasonable approach was used to represent the capacity of a containment with' technicalissues about the failure pressure, failure location, and failure size and including dependen-cies among the various phenomena.
e Engineering judgment was used when data were unavailable. Gaps in the understanding of severe . accident phenomena were represented with technical issues and used as a means of investigating , various hypotheses of severe accidents. This is believed to be acceptable and may be the only way to - i advance a risk assessment. i' e' Past risk assessments were reviewed to identify previously uncovered subtle interactions among com-ponents with formal investigations thereafter. This is a desirable practice because it takes advantage ; of ,revious work. H
.i Most of the critical comments on drsft NUREG-1150 were on four broad subjects. Some of them were attributable to technical deficiencies in the risk analyses while others were related to inadequate documen tation. The four major areas _of concern pertained to: (1) methods that were conridered to be inadequate ,
j for obtaining and using expert judgments; (2) information that was considered to be outdated; (3) calcula-
~
~
-l tions that were considered to be inscrutable; and (4) results that were considered.to be improperly pre-sented or displayed. These areas are discussed in Sections D.2.2, D.2.3, D.3.1, and D.3.3 below.
It should be noted that some comments addressed ' potential new and long-term research programs, espe - j l cially in the area of severe accident phenomenology. Such comments are not discussed here. In the following sections, the comments received on straft NUREG-1150 have been grouped into seven major topics: (1) objectives and scope; (2) overall methods; (3) tracing and documenting calculations; (4) accident frequency analysis; (5) containment loads and structural response; (6) source terms and consequences; and (7) regulatory uses of NUREG-1150. With the large number of comments received in each of these areas, it was not possible to list and respond to individual comments. As such, individual comments on similar subjects have been paraphrased and responses then made to these paraphrased q comments.
;i D.1 Objectives and Scope D.1.1 Objectives Comment: Clear objectives should be established and explained for NUREG-1150 and the report should be focused on those objectives.
Response
The objectives of NUREG-1150 have been reviewed and clarified in response to comments on the draft report. These objectives are outlined in Chapter 1 of this report; they are: e To provide a current assessment of the severe accident risks of five nuclear power plants of different design, which: Provides a snapshot of risks reflecting plant design and operational characteristics, related fail-ure data, and severe accident phenomenological information available as of March 1988; Updates the estimates of NRC's 1975 risk assessment, the. Reactor Safety Study;' Includes quantitative estimates of risk uncertainty in response to a principal criticism of the Reactor Safety Study; and Identifies plant-specific risk vulnerabilities for the five studied plants, supporting the develop-ment of the NRC's individual plant examination (IPE) process; e To summarize the perspectives gained in performing these risk analyses, with respect to: NUREG-1150 D-4
Appendix D Issues significant to severe accident frequencies, containment performance, and risks; Risk significant uncertainties that may merit further research; Comparisons with NRC's safety goals; and The potential benefits of a severe accident management program in reducing accident frequen-cies; and
+ To provide a set of PRA models and results that can support the ongoing prioritization of potential safety issues and related research.
Comment: The manner in which the results of NUREG-1150 are to be used in the regulatory process should be discussed.
Response
Since the publication of draft NUREG-1150, the NRC staff has developed an integration plan for regula-tory closure of severe accident issues (Ref. D.8). In this plan, the role of NUREG-1150 is dest. -ibed as one of the principal supporting resource documents to this regulatory closure process. Further die assion of the uses of NUREG-1150 is provided in Chapter 13 of NUREG-1150. D.1.2 Scope l Comment: The scope of NUREG-1150 is narrowly defined, making the risk study incomplete. Many l types of accident initiators are unaccounted for, including earthquakes, floods, and other external events; reactor coolant pump seal failure; steam generator tube ruptures; and instrument air losses. Other phases of plant operation need to be considered in addition to normal full power operation, including power ascension and descension; thutdown; and operation with Mark I containment buildings de-inerted. Acci-dents in spent fuel pools should be taken into account.
Response
The scope of the current version of NUREG-1150 has been expanded to reflect comments made on the draft report. An improved reactor coolant pump seal LOCA model has been developed, and steam gen-erator tube ruptures have been explicitly considered. As in the draft report, the effect of failures in supporting systems (ac and de power, instrument air, auxiliary cooling water systems) has been included in the system fault trees. In addition, external events have been included in the analyses for two of the plants (Surry and reach Bottom) to determine the core damage frequency and containment performance associ-ated with a range of external initiators. The NRC staff intends to evaluate the significance of external events at the remaining plants in a later study, currently scheduled for completion in FY 1990. With these changes, the staff believes that NUREG-1150 presents an adequate representation of the risk associated with the five plants analyzed, subject to the constraints established by the state of the art of probabilistic risk analysis. To confirm that the scope is appropriate, the NRC is initiating a separate study of the risk associated with low power and shutdown conditions for two of the plants studied in NUREG-1150. The results are ex-pected to be available in FY 1990. The risk associated with spent fuel pool accidents is being assessed separately in studies responding to NRC's Generic Issue 82, "Beyond Design Bases Accidents in Spent Fuel Pools." When completed, these will be examined to determine if further efforts are advisable. Because of the small fraction of time that the BWR Mark I containment is de-inerted during startup and the approach m shutdown conditions, compared to the length of the operating cycle, and the small fre-quency of accidents occurring in these times, the PRC does not intend to further study the risk implica-tions associated with de-inerting. Comment: NUREG-1150 should take credit for accident management strategies to reduce the likelihood of a core damage accident or to mitigate its consequences. D-5 NUREG-1150
Appendix D
Response
Both the draft and present versions of NUREG-1150 explicitly consider the effects of plant operational procedures to provide water and cooling to a reactor core to prevent its damage. Procedures for perform-ing such actions are obtained from the specific plant under study. These are reviewed to assess the prob-abilities of successful use in associated accident scenarios. These probabilities are then incorporated into the accident frequency analyses for that plant. The present version of NUREG-5150 also incorporates the effects of plant operational procedures on mitigating the consequence:: of core damage accidents. Procedures in place at the individual plants were used to assess the probability of successful operator action Comment: Accident sequences with frequencies below 1E-7 per year have not been considered. Events at 1E-8 or 1E-9 per year might be significant, either individually under particular conditions or cumula-tively when many such sequences are excluded.
Response
Given a set of initiating events, event tree / fault tree analysis like that performed for NUREG-1150 permits the examination of logical accident sequences. The trees were quantified by calculating each branch to its end; when a branch frequency fell below a cutoff frequency, it, and hence the accident sequences it represents, were excluded from the analysis. The cutoff frequency used in the present version of NUREG-1150 is 1E-8 per year for internally initiated events, which is sufficiently low to retain more than 95 percent of the accident sequences contributing to the core damage frequency. However, in several instances accident sequences with a frequency below these levels were explicitly included to ensure ade-quate representation of a wide spectrum of accidents. D.7 Overall Methods D. 2.1 Uncertainty Analysis l Comment: The treatment of uncertainty is questionable and inherently biased. The large uncertainty bamls and high risk estimates may result from the methods used; uncertainty in variables may have been combined without compensating to prevent many variables from realizing worst case values. Other meth-ods exist for quantifying uncertainty, such as the Optimistic / Central / Pessimistic (OCP) method and se'nsi-tivity studies.
Response
The Latin Hypercube Sampling (LHS) method used in NUREGr-1150 is a form of Monte Carlo sampling, an algorithm for sampling from individual parameter distributions and, based on the risk model, combin-ing these individual distributions into a single distribution. More generally, such sampling is known as mathematical experimentation and is used in other disciplines (Ref. D.9). This mathematical experimen-tation is used to propagate uncertainty through large mathematical functions that preclude propagating uncertainty analytically. The validity of the results is dependent upon the validity of the assumptions made about the distributions of the variables. The displays of risk may give the impression that the risk estimates are rigorous classical statistics but they must be taken in context, realizing the strengths and the weak-nesses of the methods used to compute the estimates and the underlying data base. LHS was favored over the OCP approach on the basis of theoretical grounds and the potential of each method. Probabilistic techniques constitute a theoretically sound and standard technique for combining uncertainties; the LHS framework contains a basis for implementing such a technique. In contrast, the OCP framework requires that a series of pessimistic or optimistic assumptions be combined without quanti-fying the likelihood that the combination of assumptions could arise. l The LHS algorithm for generating Monte Carlo samples is one that has undergone evtensive review in the open literature and is used both in the Uni.ted States and abroad. The estimators of LHS are unbiased when the variables are uncorrelated. Bias may occur when the variables are correlated, but this is a l characteristic of Monte Carlo sampling in general and not a characteristic of LHS. l l NUREG-1150 D-6
Appendix D Some specific aspects of the use of LHS in draft NUREG-1150 had the potential to introduce bias. In the ; draft report, the uncertainty in individual parameters was represented in a discrete manner. Because such use may cause bias, the discrete parameters were replaced with continuous parameters for the present . version of NUREG-1150. Because the methods used to obtain expert judgments and to formulate distri-butions based on the judgments can introduce bias, formal methods designed to minimize bias were used in the present risk analyses. This is discussed in greater detail in Section D.2.2. :. As noted in the Introduction, the treatment of uncertainty in draft NUREG-1150 was reviewed by a peer committee; their findings are published as Reference D.4 and all their major comments have been incor- > porated in the present analyses. Comment: The conclusion that the uncertainties have increased over a dozen years of research does not seem correct. NUREG-1150 does not portray the progress made in hardware modifications, operator , experience, and research since the publication of the Reactor Safety Study (Ref. D.7) in 1975. Further-more, the conclusions in draft NUREG-1150 are similar to those of the Reactor Safety Study, meaning that draft NUREG-1150 is inconsistent with almost every study published in the 1980's, all of which show a trend of lower estimates of risk. After a decade of severe accident research, it is unsettling to see risk results spread over several orders of magnitude.
Response
It is clear that the technical information base on the frequencies and consequences of severe reactor accidents is substantially better now than in 1975 when the Reactor Safety Study (Ref. D.7) provided its analysis of risk and the uncertainty in risk. In the Reactor Safety Study, the rigorous quantification of uncertainty was performed only for uricertain-ties in component failure rates. The overall uncertainties shown in consequences were developed by sub-jective judgments at a very coarse level. The peer review of the final version of the Reactor Safety Study, known as the " Lewis Report" (Ref. D.10), concluded that these uncertainty estimates were significantly underestimated. s The subjective uncertainty estimates developed and used in NUREG-1150 address uncertainties at a rigorous level and make extensive use of experimental and ca. ulated results developed since 1975. Both the level and the basis improve the realism of the uncertainty analysis. These improvements are a direct result of an improved knowledge base (including the effects of phenomena not known in 1975) that permit a more accurate treatment and characterization of unknown parameters and modeling of physical processes. The large uncertainties simply reflect the state of knowledge in the severe accident area. Comment: Uncertainty in offsite consequences was not factored into the risk estimates. This leads to misleading risk estimates. .
Response
With the exception of the variability of site meteorology, uncertainties in the consequence analysis have not been included in either the draft or present version of NUREG-1150 because of time constraints. The NRC staff recognizes that there are significant uncertainties in the consequence estimates due to uncer-tainties in modeling and in input data. Best estimate values of the model parameters for natural processes (plume behavior, deposition, etc.) have been used in Version 1.5 of the MACCS code (Ref. D.11) for the current NUREG-1150 analysis. While the lack of accounting of consequence uncertainties can have an influence on overall risk results, it does not prevent the development of important perspectives on plant design and operation.
~
Some of the key parameters in the uncertainty of offsite consequence analyses relate to post-accident protective actions (e.g., e'nern,ency response and long-term countermeasures). That is, offsite conse-quences can be affected by the effectiveness of emergency response of the local population and by the radioactive contamination levels above which crops and land are removed (condemned) from public use. The sensitivity of consequences and risks to the protective actions is discussed in Volume 1 of NUREG-1150 and in References D.12 through D.16. D-7 NUREG-1150
Appenaix D l In addition to the risk studies of the five plants discussed in this report, the NRC staff is supporting the risk analysis of the LaSalle plant, a BWR-5, Mark Il plant. It is planned that this risk analysis will include an i analysis of the uncertainties in offsite consequences and the effect on risk estimates. This work is sched- 1 uled for completion in mid-FY 1990. l D.2.2 Expert Judgment l Comment: The protocol for obtaining expert judgment is not rigorous and yielded judgments with un-I sound bases. Technical subject areas should be kept separate, and experts should work within those areas (i.e., within their field of expertise). Panels should be . aposed of experts from all portions of the nuclear industry. The experts should be given a less restricteo sole in selecting and identifying uncertainty i issues. Expert groups should interact to ensure that consistency is maintained throughout the analysis. l
Response
The protocol used to elicit and to aggregate expert judgment has been substantially improved for the l present version of NUREG-1150 and is discussed in Section 7 of Appendix A. Standard and rigorous techniques were used; among the developers and the reviewers of the protocol were experts in diverse j areas of uncertainty analysis and survey methods, including decision analysts, social psychologists, and statisticians from national laboratories, private companies, and universities. Seven groups of experts were established, each group working within a specific technical area. Each group included representatives from industry, academia, and the national laboratories. For the current version of NUREG-1150, the experts were allowed to add issues to or delete issues trom the list of issues presented to them. The context in which the issues entered the analyses was explained to l the experts. The experts were encouraged to modify the statements of the issues to improve technical l clarity and to define interdependencies among issues and between issues and other parameters in the analysis. The exchange of information between panels was effected primarily by the project analysis staff. The information exchanged concerned requirements for specific phenomenologicalinformation about an earlier phase of a postulated accident sequence that was needed to answer a question about a later phase of the accident. Comment: Expert judgments are requested for inappropriate portions of the nsk analyoes. When ade-quate data exist to define uncertainty, expert judgment should not be used as a substitute. When little or no data exist, experts should not be asked to guess at distributions; instead, the particular uncertainty variable should not be included in the uncertainty analysis. No attempt should be made to quantify techni-cal issues with expert judgments unless there is an adequate basis for that judgment.
Response
For the present version of NUREG-1150, expert judgments were not used when available data were adequate to provide the required information. In some cases, such data became available during expert panel meetings and issues were dropped from consideration by the panels. l While it is inappropriate to ask experts to simply guess at issue distributions, it is also inappropriate to exclude issues from consideration because of the scarcity of relevant data. Potentially important issues should be considered, even if the data are scarce and the basis for engineering judgment is very limited, l because it is often the paucity of data that renders an issue an important contributor to uncertainty. l . I In technical areas where significant data existed, expert judgment still played an importan4 role in ascer-taining the relevance of the data to a particular application in the risk analysis. As an example, large uncertainties inherent in the models of containment performance precluded an accurate prediction of the location of failure under specific accident loadings. Various calculations of containment response were sometimes found to be conflicting, even when similar analytical methods were used. In 1987, at the Sandia National Laboratories, a scale model of a concrete containment was tested under conditions simu-lating a slow pressurization from steam and noncondensible gas generation from a severe accident (Ref. D.17). Organizations from the United States and abroad tried to predict the failure location and pressure. Only one of these predictions was close to the test results. For the purposes of NUREG-1150, the NUREG-1150 D-8
Appendix D available data on both the experimental result and the reasons why calculated results differed were key to the assessment. Comment: When distributions were assigned to variables, often high weights were assigned to the ex-tremes of these distributions. This is unusual and should be justified. Integrated analyses based on models benchmarked against data would show that extremes could not be realized.
Response
Documentation of the rationale for uncertainty distribution development, including the results of relevant code calculations and experimental results, was an important step in the elicitation process used in this report. This documentation is provided as Reference D.18. If high weights were assigned to the extremes of the distributions, then the associated documentation should provide the rationale. Discrete distributions were replaced with continuous distributions to permit a better characterization of the uncertainties, par-ticularly in the tails of the distributions. D. 2. 3 Quality Assurance, Consistency, and State of the Art Comment: A thorough review of the draft NUREG-1150 study is needed. The study does not appear to have been checked for inconsistent and meaningless results because some of the results are questionable or contradict results reported elsewhere in the same documents. The computer codes used in the risk analyses should be properly validated, documented, and peer reviewed, which also appears not to have been done.
Response
The review of NUREG-1150 has been performed at two levels: an external level, including peer review and public comment on the draft report; and an internal review by the various organizations involved in the plant risk analyses. For the specific issues identified in this comment, internal review processes were l used to ensure consistency and validity. This internal review had the following elements: l e QA/QC Review of Principal Analysis Areas: For each major area of analysis performed for the present v: " of NUREG-1150 (accident frequency, containment performance and source terms, offsite consequen m), a OA team was established and the analyses were reviewed. This process for the accident frequeru analysis is documented in References D.19 through D.23. Approximately 25 percent of the resources "ere spent on reviewing the work. The method was initially reviewed by a Senior Consultant Group, ud then more detailed reviews were conducted by a Quality Control Team. These latter reviews occurred periodically over more than 2 years. In addition to the reviews that NRC and its contractors sponsored, the utilities involved have performed reviews and provided extensive comments that have been incorporated, as appropriate, into the analyses. This formal review process continued throughout the reanalysis effort The modeling of core melting phenomena, source terms, and consequences as well as the risk analysis in the current version of NUREG-1150 were subject to a quality assurance review that is discussed in Appendix A to .NUREG-1150. l Review of Computer Moucis: A large number of computer codes were used in the performance of the risk studies described in this report. A number of them have been reviewed or benchmarked in other contexts and will not be discussed in detail here. These include: Source Term Code Package (Ref. D.24); CONTAIN (Ref. D.25); MELCOR (Ref. D.26); and MELPROG (Ref. D.27). Other codes were, however, developed or first used for this study. For such codes, various types of quality assurance checks were specifically performed as part of the NUREG-1150 study. The LHS code was reviewed in 1984; a user's manual was written (Ref. D.28) and the code has been released to the National Energy Software Center at Argonne National Laboratory. LHS has been in use at Sandia National Laboratories for several years. Since the draft analyses, the EVNTRE and PSTEVNT codes (Ref. D.29) were subject to line-by-line scrutiny and a series of functional tests. User's manuals were written for these codes and the codes are being released to the National Energy Software Center. The XSOR codes were subject to a line-by-line review by project staff at the Sandia National Laboratories (SNL) and to an independent validation / verification study done at the Battelle Columbus Division and reported as Reference D.30. The PARTITION code (Ref. D.31) was subject to a functional D-9 NUREG-1150
Appendix D review by the project staff. Its user's manual will be published in 1989. The RISQUE code was functionally reviewed by the SNL staff and elsewhere (Ref. D.29); a list of this code is included as an appendix to Reference D.32. Benchmarking and verification of the current version of the MACCS code, Version 1.5, is now under way. A review has been performed of the chronic exposure pathway modeling (Ref. D.33). Cross-Plant Reviews: For the accident progression, source term, and consequence modeling, gen-eral consistency in phenomenological assumptions and the level of treatment of severe accident phe-nomena was achieved across the five-plant analyses. This was accomplished primarily through a series of informal interactions among plant analysts and review of the treatment of specific phenomenu by the project leader. For example, the Surry accident progression event tree (APET) was used as a base to build the Zion and Sequoyah APETs. The Grand Gulf and Peach Bottom analysts worked jchtly to adapt parts of the Grand Gulf APET to Peach Bottom. The treatment of hydrogen (impor-tant to the Sequoyah and Grand Gulf analyses) was derived jointly by the Sequoyah and Grand Gulf analysts. I e Utility Reviews: An important element of a risk study of a nuclear power plant is the assurance that ! the risk model is an accurate and up-to-date representation of that plant. For the four plants in this study for which an essentially new risk analysis was performed (Surry, Sequoyah, Peach Bottom, and Grand Gulf), contact with the appropriate utility was :naintained throughout the conduct of the study. i For the Zion plant, where the accident frequency analysis was a modification of an existing PRA (Ref. D.34), the analysts met with the utility to discuss plant design and operational changes that had occurred since the performance of that PRA. The present version of NUREG-1150 will undergo a multifaceted eview in the near future. This will be a critical review of all important aspects of the document through a formal peer review, university research, professional society discussions, and a public workshop. The emphasis in these forums will be on the responsiveness of the present version of NUREG-1150 to comments on the draft report as well as on how the technology for assessing risk can be improved. 1 I Comment: The analyses of draft NUREG-1150 are not state of the art. The most advanced theoretical ' and analytical techniques are not always used. Some data are even outdated while other data are ignored or are inappropriately applied.
Response
A discussion of the methods that were used in the current version of NUREG-1150 is provided in Appen-dix A. The broad diversity of experts who interpreted published data for the current analyses ensured that the data were up to date and correctly applied. These data reflect the design and operational status of the five plants as of March 1988. Comment: There must be a consistent and distinct use of terms such as randomness and uncertainty, frequency and probability. In the draft NUREG-1150 report, terminology is sometimes used loosely.
Response
The consistency of terminology used in the present version of NUREG-1150 has been improved. Comment: There is a general disregard for technical rigor in the draft NUREG-1150 risk analyses.
Response
It appears that such a general conclusion was reached based on specific deficiencies in the draft risk analyses, including the process for obtaining expert judgments, the apparent lack of quality assurance reviews, the use of unreviewed and undocumented computer codes, and the reliance on severe accident information from NRC contractors to a greater extent than on that from other sources. Each of these specific issues is discussed elsewhere in this appendix. The NRC staff and its contractors believe that the present version of NUREG-1150 is based on analyses with appropriate technical rigor. NUREG-1150 D-10
Appendix D D. 2. 4 Other Comments on Methods Comment: The NUREG-1150 results do not appear to be reproducible. It appears that the results seem dependent on the particular experts whose judgments were factored into the analyses. A different selec-tion of experts would make different judgments that would lead to different risk estimates. This pomt goes beyond just the subjective judgment of experts and extends into the analytical techniques. If another random number generator were to be used in the sampling scheme for generating uncertainty estimates, different uncertainty bands and hence risk estimates would result.
Response
The selection of experts will have an effect on the results of the risk analyses discussed in this report, as well as in any other circumstance where expert judgment is used. However, given the necessity of using expert judgment, the formal procedures used for the present version of NUREG-1150 offer the following advantages: the expert panels are established using experts from a wide spectrum of interests, minimizing the potentialimpact of any one group; the use of judgments is explicitly acknowledged; and the rationales underlying judgments are documented. With any analysis involving a Monte Carlo process, it is inevitable that the results will vary somewhat, depending on the details of the sampling algorithm and the way it is implemented. The variability associ-ated with the sampling process has been investigated as part of the analysis process and found to be small (Ref. D.32). As discussed in Chapter 2, the reader should recognize that the estimated mean values can vary by no more than a factor of two, depending on the Monte Carlo sample that is used. This variability can also impact the relative ; contribution of factors (e.g., plant damage state frequencies) to the mean, particularly when there are a small number of contributors. Comment: ine methods used to calculate risk are complex and subjective, which is in part because of the performance of uncertainty analysis. The risk-dominant issues should be quantitatively defined with de-tailed calculations or experimental evidence.
Response
The present version of NUREG-1150 has made extensive use of mechanistic computer code calculations and pertinent experimental results available from both NRC-sponsored research and that sponsored by the nuclear industry. However, the spectrum of accident conditions is wide, precluding mechanistic calcula-tions for all conditions. For potentially important uncertainty issues, such as containment loads at vessel breach, expert judgment was obtained fu a variety of generalized conditions such as vessel breach at high pressure, intermediate pressure, or low pressure, with a flooded reactor cavity or a dry reactor cavity. Typically, the experts could base their judgments on the results of mechanistic code calculations or experi-ments of only some of these conditions. Parametric codes were used to predict the source terms for a wide range of sequence variations. Comment: The practice of evaluating complex physical and chemical phenomena in nuclear reactor acci-dents is not well conceived. This evaluation should be done using such classical methods as scaling analy-sis, zeroth order estimates, and ideal model simulations.
Response
Subsequent to the accident at Three Mile Island on March 28, 1979, the NRC undertook a major re-search effort to develop an improved understanding of severe accident behavior (Ref. D.35). The focus of this effort has been the development and validation of computer codes that estimate the variety of com-plex processes that can occur in a severe accident. A two-tiered approach to code development has been followed. At one level, detailed mechanistic codes have been developed that analyze a specific aspect of severe accident behavior, such as the use of the CORCON code to analyze tre attack of concrete by hot core debris. The second levelinvolves the development of codes that treat all aspects of a severe accident but in less phenomenological detail. Both of NRC's codes of this type, the Source Term Code Package and MELCOR, were used in the source term estimation in this risk study. In the current version of this study, greater use was made of the detailed mechanistic codes than in the draft report. The general D-11 NUREG-1150
Appendix D approach to the development of the suite of NRC severe accident codes has been reviewed previously by a - number of peer committees and is responsive to the recommendations of the review by the Amcrican Physical Society (Ref. D.36). These codes are supported by a range of experiments to obtain fundamental data, separate effects, and integral confirmation. Comment: Various aspects of the draft risk studies lack consistency within each risk study and among the risk studies leading to an unevenness in the overall approach. The level of detail of modeling in each analysis varies, lacking in some portions and extremely detailed in others. A given technical issue is treated differently at different plants. The analysis of the Zion plant is less detailed than the analysis of the other plants.
Response
With the exception of the Zion accident frequency analysis, the NUREG-1150 methods have been ap-plied consistently for all five plants. Within a specific plant analysis, issues were treated at varying levels of detail, with additional consideration given to potentially more important issues. This is not an unusual practice in PRAs. Issues common to more than one plant were analyzed using the same methods for each plant. However, the resulting outcome (e.g., the impact on core damage frequency) can vary among plants because of plant design and operational differences. The Zion accident frequency analysis was indeed different from that performed for the other four plants. This difference is a result of the availability of a relatively recent PRA performed for the utility (Ref. D.34) and extensively reviewed by the NRC staff and its contractors (Ref. D.37). For the present version of NUREG-1150, this PRA (as reviewed) was updated to reflect plant design and operational characteris-tics as of March 1988. The accident frequency analysis methods in NUREG-1150 used for the Zion plant are discussed in Appendix A, Section A.2.2, to this report. Comment: Because many aspects of severe accidents cannot be quantified, assumptions are made about the aspects to account for them in the risk calculations. Too often such assumptions lack a firm basis. Furthermore, a given assumption varies from one plant to the next. The assumptions are made conserva-tively to ensure safety but in doing so make the risk estimates unrealistic. An example is the short battery life assumed in station blackout sequences.
Response
Efforts were made to make reasonable assumptions in all parts of both the previous draft and the present versions of the NUREG-1150 analyses; the bases for the assumptions have been thoroughly documented in the present version of NUREG-1150. In the analysis of Peach Bottom for draft NUREG-1150, the batteries were assumed to be depleted in 6 hours during a station blackout. The assumption was based on information from the Philadelphia Electric Company (PliCo), the utility operating that plant. After additional review by PECo and accounting for operator actions for load shedding, the assumption was changed for the present version of NUREG-1150 to 12 hours. The Grand Gulf analysis also assumed a 12-hour battery life. Comment: There is a tendency to overemphasize the numerical aspects of probabilistic risk assessment. While the quantitative aspects are important, it is also important as a structured and comprehensive framework for safety analyses.
Response
The intended uses of NUREG-1150 are discussed in detailin Chapter 13, "NUREG-1150 as a Resource Document." These uses do not focus on the bottom-line quar.'titative results but on the perspectives gained from the development and application of the complex lope models used to calculate the risk estimates. D.3 Tracing and Documenting Calculations D.3.1 Tracing Calculations Comment: The document is inscrutable. It is nearly impossible to follow the development of the results through the calculations. Intermediate results at key points in the calculations would have been useful in NUREG-1150 D-12
Appendix D understanding the risk estimates. Some conclusions are unsubstantiated and cannot be traced back to their supporting calculations. Although technicalissues are delineated, how they affect the results is not discernible.
Response
The present version of NUREG-1150 has' been extensively restructured, relative to the draft report, to improve its clarity. In particular, the report has been more explicitly described as a summary report, written for people not expert in PRA and, as appropriate, directing the reader to sections of the supporting contractor reports for additional detail. The risk calculations are very complicated, requiring extensive computer calculations to perform the analyses. Documentation of these analyses is fot'nd in supporting contractor reports; this documentation has been restructured to improve the traceability of the work and to expand the discussion of the underly-ing rationale. An example calculation has been developed for the reader seeking details of the risk analy-ses, with a description provided of both the individual steps of the risk analysis process and the products of the individual steps. The example calculation is provided in Appendix B. Comment: Because the sequences are grouped into plant damage states, there is difficulty in connecting what follows core damage with containment failure. This could lead to gaps in the development of specific scenarios and detract from those situations where accident management could be effective.
Response
PRAs such as those conducted in support of NUREG-1150 consider hundreds of thousands of distinct failure combinations leading to severe accident sequences. It is a practical necessity that grouping of these sequences be performed. Piant damage states have been used in many recent PRAs to accomplish such a grouping. D.3.2 Completeness of Documentation j Comment: NUREG-1150 represents a large amount of information but many topics are insufficiently discussed, such as descriptions of models, treatment of processes of a severe accident, underlying assump-tions, and uses of the risk estimates. The expert judgments and the methods used to obtain those judg-ments must be fully documented; each judgment should be attributed to the particular expert who gave it, together with the basis and the reasoning for the judgment.
Response
NUREG-1150 is a summary of large and complex risk studies of five nuclear power plants. All aspects of the study cannot be conveyed in such a summary report. The methods used, supporting rationale, and , results are discussed in detail in the set of supporting documents (Refs. Q.12 through D.16, D.19 through l D.23, D.32, D.38, and D.39). Other st:pporting information, such as on the principal accident analysis ! codes used in the study, are described in other available documents. l I As discussed in Section D.2.2, the process of obtaining and using expert judgments has been substantially improved for the present version of NUREG-1150. Extensive documentation of the bases for these judg-ments is a major aspect of the new elicitation process. This documentation is provided in References D.18 and D.39. D.3.3 Display of Results Comment: Traditional methods of displaying uncertainty, such as cumulative distribution functions, prob-s ability density distributions, best estimates, and central estimates should be provided. The presentation of ranges alone without mmns or other best estimates tends, as in draft NUREG-1150, to focus excessive attention on the extremes and obscures the advances made in nuclear safety since the Reactor Safety Study. I
Response
The present versian of NUREG-1150 uses traditional displays of uncertainty. These displays include prob- , ability density functions (approximated by histograms) with mean, median, and 5th and 95th percentile D-13 NUREG-1150.
Appendix D values'shown. Complementary cumulative distribution functions are used to convey results of source term and offsite consequence results. Other displays, such as bar charts and pie charts, are used to convey supplemental information. D.4 Accident Frequency Analysis D.4.1 Logic Comment: No thermal-hydraulic analyses were done to define what constitutes a successful operation of a given system. Instead, success and failure were defined from previous studies on other plants.
Response
Numerous thermal-hydraulic studies were available from which conclusions could be drawn relative to safety systems performance under a range of plant conditions. In addition, information was obtained from knowledgeable personnel at the plant sites to better understand system responses under abnormal condi-tions and some plant-specific thermal-hydraulic calculations (Refs. D.20 and D.22) using the MELCOR , (Ref. D.11) and the LTAS .(Ref. D.40) codes. The combination of general analyses and plant-specific information is believed to be adequate to define success criteria. Comment: Support systems and the activation and control of various systems by other systems were not taken into account in the accident frequency analysis.
Response
Support systems and their impact on emergency core cooling, containment safeguard systems, and other front-line systems were explicitly considered in both the draft and the present version of NUREG-1150. Detailed system-by-system analyses were performed to determine the potential impact of support systems. Those dependencies that were critical to the functioning of a system were then included in the models. Actuation and control dependencies between systems were taken into account, although a detailed study of each actuating and control device was not performed. Instead, these dependencies were represented with generic failure rates with significant uncertainty bounds. This approach is considered adequate be-cause such failures have not been found important in reviewing the results of other PRAs. Comment: Prior PRAs, from which much information was derived, were used even though many changes in plant hardware and operation have occurred since the PRAs were performed that are not reflected by these PRAs.
Response
Prior PRAs provided a basis from which to start the risk studies. Plant design and operationalinformation, obtained from the individual utilities, was obtained and used to perform the actual risk studies. Comment: The mathematical treatment of common-cause failure (CCF) is more consistent and detailed than in many previous studies. Nonetheless, the importance of CCF dictates that a more comprehensive and quantitative treatment of the factors affecting it be undertaken. The CCF modeling should be im-proved as several examples illustrate: For a station blackout, the notion of a CCF of the batteries is difficult to accept because the batteries are monitored, are in use, and are checked daily; for a loss of component cooling water (CCW), the CCF of the CCW pumps is difficult to accept because some pumps are normally operating while others are kept in a standby mode; the fuel supply to diesel generators is not mentioned as a potential CCF, etc. In PRAs, CCF must be modeled realistically.
Response
The NUREG-1150 study treated common-cause failure in as realistic a way as presently possible. The objective was to estimate risk using the best available information and tools given the limitations of avail-able data. NUREG-1150 D-14
Appendix D The analyses reported in the supporting documentation hr.d the following charac eristics with respect to CCF: e System interdependencies were modeled in the fault tree analysis and common-mode failures were included as appropriate. e Common-mode failures of pumps, valves, batteries, diesel generators, and other hardware were ex-plicitly considered.
- To the extent possible, the current analyses used plant-specific data. However, where the plant-spe-cific information was inadequate to generate new CCF models, such failures were treated with realis-tic generic models, including recent advances in the methods for creating such models.
- Common-cause failures induced by earthquakes were considered when two plants were analyzed; the external-event analysis examined other potential sources of common-mode failures such as fire.
Nevertheless, it is recognized that there are a number of things that are not done in these analyses. These excluded activities were: e Unique CCFs that might be postulated as a resuh of faulty construction or counterfeit parts are not modeled, except as they may appear in the common-cause failure data base.
- Detailed examination of the root causes for CCFs was not made.
- The CCF analysis inherently lacks reliable and identifiable data. Under these circumstances, it is often necessary to rely heavily upon engineering judgment, leading to the possibility for disagree-ments about the outcomes.
While present CCF models:are believed to be reasonable, it is also clear that improvements can be made. To this end, the NRC has ongoing programs for developing improved models for CCF analysis. Comment: Inappropriate application of models of human reliability focused on procedural errors and resulted in low human error contributions to core melt frequency.
Response
Human error contributed less to the core melt frequency than expected, but, in most cases, there are reasons for the lower values. These include:
. The low probabilities due to human errors were not necessarily a consequence of a simple analysis.
For example, low human error probabilities were produced for the BWR ATWS sequence using an extremely detailed human reliability analysis (Ref. D.41).
- Some small values reflect the availability (at the plant) and consideration (in the analysis) of symptom-based procedures. With such procedures, an operator responds to an accident treating conditions that are indicated on the control panel, such as ensuring that the reactor is tripped, the turbine is tripped, the vital electrical buses are energized, and so on. These conditions are treated without recognizing the sequence. The use of such procedures improves the performance of the operators and likewise reduces human error values.
- In some circumstances, low operator error values are the result of the combination of probabilities for several independent actions. When such circumstances occurred, additional checks were performed to ensure the reasonableness of the results obtained. In the current analyses, all combinations of human errors less than 1E-4 required additional analysis and justification; few of these cases occurred.
D.4,2 Quantification Comment: Generic failure data are used in the risk studies ye. each study is claimed to be plant specific. Furthermore, generic data are sometimes used even when plant-specific data are availab!e. D-15 NUREG-1150
Appendix D
Response
Plant-specific information has been obtained (where available) and used for key systems in each plant. s Where such information is inadequate for these key systems and for less important systems, generic data have been employed.' As a result there is a mix of information sources underlying the analysis. This 13 discussed in more detail in Section A.2.1 of Appendix A. Comment: Calculations by the industry indicate that it is important to thoroughly examine the probability that the automatic depressurization system (ADS) in boiling water reactors would not fail when it is as-sumed that de power falls.
Response
Analysis performed for the boiling water reactors indicated that the ADS is dependent upon de power in that both the logic for control and the valve power come from de sources. The logic system is failed if the primary de supply bus and the switching relay to the backup bus are lost. Two de buses would have to fail to lose all valve power. Given this dependency, the expected life of batteries in station blackout conditions was an important issue. In the analyses for draft NUREG-1150, effective battery life was estimated to be 6 l hours (in station blackout conditions) for the Peach Bottom plant. Based upon reviews and discussions j with the Philadelphia Electric Company and accounting for operator load shedding actions, this battery { life was extended to 12 hours for the present risk analysis. A 12-hour battery life was also calculated for the Grand Gulf analysis. Comment: Confidence limits on the success probabilities assigned to the fault trees appear to be derived from the high and low probabilities of operator action. This is not mathematically correct, and such limits should be viewed only as upper and lower bounds.
Response
Operator actions were treated the same as all other events in the fault trees. That is, the failure probability of each action was assigned a mean value and a probability distribution. The combination of individual event probabilities was then performed using mathematical sampling techniques, ensuring the appropriate mathematical treatment. Comment: The analysis of a rupture of a steam generator tube is incorrect because the frequency of a credible tube rupture sequence is multiplied by the probability of auxiliary feedwater system fLiture, thus lowering the frequency of a legitimate core melt accident sequence by three to four orders of magnitude. There is no reason to believe a value of 9E-9/ reactor year when detailed plant-specific PRAs have consis-tently estimated the frequency in the range of 1.6E-6 to 1.0E-5/ reactor year.
Response
The analysis of steam generator tube rupture frequency and consequences has been substantially modified for the present version of NUREG-1150. Core damage frequencies obtained using the new analyses are consistent with the values cited above as results from other recent PRAs. Comment: The models of core degradation are unrealistic. Severe fuel damage is defined to cover all cases where fuel cladding is damaged, but cladding integrity is not a measure of fuel damage and results in an overestimate of risk when it is defined as such.
Response
The models that are used to predict fuel damage do not attempt to describe all the complex phenomena associated with severe core degradation in detail. The thermal-hydraulic modelin the Source Term Code Package (STCP) (Ref. D.24) uses simplified models and assumptior's for the treatment of some of the very complex steps in the core degradation process, such as fuel slumping into the lower plenum of a reactor vessel. However, the current version of NUREG-1150 did not rely heavily on the thermal-hydrau-lic model in the STCP for the estimation of the core meltdown process. The results of analysis with the MELCOR code (Ref. D.26), the MELPr.OG code (Ref. D.27), and the MAAP code (Ref. D.42) assisted NUREG-1150 D-16
Appendix D project analysts and other experts in estimating the magnitude of parameters directly associated with core melt progression, such as hydrogen production and the mode of reactor vessel failure. Although the MELCOR code and the MELPROG code predict some core meltdown processes in more detail than the ruodels in the STCP, the simplifications in the models of these codes must also be recognized. In the current version of NUREG-1150, core damage is defined as a significant core uncovery occurrence with reflooding of the core not imminently expected. The result is a prolonged uncovery of the core that leads to damaged fuel end an expected release of fission products from the fuel. The current version of NUREG-1150 treats the recovery of core with fuel damage ciiff rently from earlier probabilistic risk analyses. Under a broad range of conditions, given that a water supply is recovered prior to vessel failure, the likelihood of recovering a core and arresting an accident was evaluated. Based largely on the experience of the accident at Three Mile Island Unit 2, debris bed coolability analyses, and supple-mental calculations of head failure, the likelihood of arresting further con donage decreased as the fraction of the fuel relocated to the bottom head at the time of coolant recovery increased. D.5 Containment Loads and Structural Response D.5.1 Accident Progression Event Tree: Logic Comment: The large amount of detailin the accident progression event trees (APETs) gives the impres-sion that more is known about containment events and phenomena than is actually known. It is difficult to believe the resuhs of a complex tree that yields a tremendous number of pathways that are then aggre-gated into a dozen or so groups. Not only does a complex tree give a false impression but it limits any review of how the tree was constructed.
Response
The rationale for developing a detailed APET is to provide an explicit treatment of all phenomena that can have a significant irr. pact on the accident progression and the magnitude of the fission product source terms. Even if the existing capability to predict some of these phenomena is limited, it is importr.nt that the phenomena be recognized, at least for characterizing the uncertain'y a ue results. The size of an APET does not affect the clarity of the results. Pathways with similar characteristics can be grouped to form simpler event trees as has been wone to present results in the current version of the main report. A detailed review of the APETs is difficult but not impos'sible. In the current documentation, the APETs were sufficiently described. Reviews were perform 3d as described in Section D.2.3. Comment: Early containment failure calculations are based on flawed accident progression event trees. Pathways with a potential for pressure reduction in the reactor coolant s): ,m are neglected.
Response
In the draft analyses, the PWR event trees included several important depressurization mechanisms, namely, induced reactor coolant system hot leg failure, induced steam generator tube rupture, and reactor coolant pump seal failures. The BWR event trees took into account the operation of the automatic depres-surization systems. In the current analyses, the PWR event trees have been revised to include a possible tentor coolant primary system and/or ser mdary system depressurization by the operators and by power-operated relief valves (PORVs) sticking open. The combined effect of these depressurization mechanisms was found to be important in the present risk analysis. Comment: The risk reduction due to containment venting can be assessed only after a detailed study of ventirig procedures, relevant hardware, and plant response has been done. There is much disagreement as to the sc.4 ..sios leading up to venting, the manner in which to vent. the vent sire, re-isolating, and the effectiveness of venting. CoMainment venting should be included in the analyses only if procedures and equiptr.ent exist at the given plant. D-17 NUREG-1150
Appendix D Respdnse: The actions included in the NUREG-1150 analyses that could result in deliberate containment venting were those permitted by plant-specific operational procedures. Of the five plants studied, only two (Peach Bottom and Grand Gulf) had such procecures. For these two, the probability of successful venting was a function of the available procedures and hardware. For the Peach Bottom plant, it was found that venting with existing hardware and procedures was viable (had a high probability of success) for one type of accident, the long-term loss of decay heat removal. For other sequences, the probability of successful venting was of low probability, principally because of hardware limitations (Ref. I>.43). For the Grand Gulf plant, the situation is similar. For the long-term loss of decay heat rernoval sequences, the procedures exist and operators can vent from the control room. Credit was not given in the most fraquent accident sequences (i.e., station blackouts) because of unavailability of needed de power. D.S.2 Containment Loading Phenomena Commcat: Studies of severs accident phenomena are conflicting. Some studies predict global hydrogen burns while others conclude that global combustion cannot occur. Some studies show that hydrogen deto-nations can occur while others show that diffusive burning will occur. Some studies show early contain-ment failure while other studies show that an early failure can occur only as an interfacing-system loss-of-coolant accident. Some studies suggest that the steel shell of a containment can be breached when cca-tacted by molten core debris while other studies suggest that heat will be conducted aveay from the shell at a sufficient rete to prevent meltthrough. The conflicting studies give little confidence in the conclusions that are drawn from them.
Response
It is agreed that the present information base on severe reactor accident phenomenology is limited and that this base sometimes contains conflicting data. The state of this information base is one reason why the NRC staff chose to characterize individual phenomenological issues and the associated risk enalyses by probability distributions, rather than single-valued estimates and make use of expert judgment, as done in other analyses of poorly understood issues, to review and interpret the available information. Comment: NUREG-1150 states that for BWRs direct containment heating is not a prominent cause of containment failure becaur , the core support design will allow limited portions of the core to melt and fall into the lower vessel head, causing localized vessel failure before the bulk of the core accumulates in the lower head. This is assumed; no calculations or experiments are offer &d in support of this hypothesis.
Response
Many of the values used in the analyses found in draft NUREG-1150 were inadequately justified. The current analyses have been more thoroughly documented. Issues such as the loads on a containment bulding at the time of reactor vessel breach, including the effects of direct containment heating, were determined through expert interpretation of available calculations and experiments. Details of these analy-ses are discussed in References D.18 and D.39. Comment: There are large uncertainties associated with direct containr4ent headag (DCH). An industry group studied DCH and found it not to be a contributor to containment failure in the Sequoyah cavity design. Small-scale experiments indicate that 90 percent of the ejected melt will remain inside the cavity. It is thought that, in the PWR reactor coolant system (RCS), hot leg failure can occur prior to the bottom head failure, precluding direct containment heating because the RCS woukt be at low pressure at the time of vessel failure But other experimental studies donc at a national latetory indicate that DCH can occur. Analytical studies suggest that assuming depressurization by operators will not alleviate the problem since there are some accident scenarios in which depressurization cannot be achieved because of a lack of de power.
Response
Since draft NUREG-1150 was published in February 1987, the information base for quantifying impor-tant issues has been expanded. Among those that received considerable attention were contributors to NUREG-1150 D-18
Appendix D containment loads during high-pressure melt ejection (including direct containment heating) and the po-tential for depressurizing the reactor vessel (including RCS hot leg failure). However, the information base remains incomplete. In the present study, experts in severe accidents were asked to interpret the informa-tion base and to generate probability distributions required for risk analyses. The expeats who participated in this assessment and the information used to quantify containment loads at vessel breach are discussed in Sections C.5 and C.6 of Appendix C. Through expert judgment,it was concluded that the upper end of the range of potential containment loads accompanying high-pressure meh ejection reached high values (i.e., several times the containment design I pressures). A con;ainment analy:is indicated, with relatively high confidence, that the Surry and the Zion containment structures could accommodate all but the highest of these leads. A similar conclusion could be drawn for the Sequoyah containment only if certain containment safety features operate (e.g., a sub-stantialinventory of ice is in the ice condenser at the time of vessel breach). Regarding the RCS pressure at vessel breach, the current analyses indicate that in the majority of statibn blackout accident scenarios, at least one of several tnechanisms -(e.g., temperature induced hot leg failure, reacier coolant pump seal failures) will rede:e the pressure in the reactor coolant system to sufficiently low values to make high-pressure melt ejection unlikely. During other types of severe accident scenarios, manual actions, such as opening the pressurizer PORV, are likely to occur to similarly reduce the likelihood of high-pressure melt ejection. Comment: When the necessary conditions exist, steam explosions can occur in a reactor vessel as a result of a degraded core contacting water in the lower head, and the explosion can be sufficiently energetic to cause reactor coolant system and containment building failure. Because of large uncertainties in this tech-nical issue, it should be mathematically treated as a full issue in and of itself and not part of some other l issue. The treatment should be consistent with previous studies done by the NRC and the industry. l Response; The probability of steam explosions s'ifficient to fail the containment building was treated as a separate issue and a probability distribution developed for the present version of NUREG-1150. This distribution was developed by the NUREG-1150 project staff using, as an initial basis, the work of the Steam Explo-sion Review Group (Rel. D.44). This work was updated (incorporating the possible effect of new informa-tion) by polling the individual members of the review group. Comment: NUREG-1150 continues to carry the steam explosion issue along even though all but a few steam explosion researchers concluded that no issue remainn Considering this issue as a mechamsm for reactor vessel and containment failure is inconsistent with a previous study doae by the NRC (the Steam Explosion Review Group).
Response
As discussed in the previous response, the present NUREG-1150 analyses of the potential for contain-ment building failure by in-vessel steam explosions are based on the work of the Steam Explosion Review Group. Comment: In draft NUREG-1150, there is an accident sequer..e in which a containment failure leads to a failure of emergency core cooling, leading to core meltdown. This does not seem plausible.
Response
This type of accident sequence was first identified in the Reactor Safety Study (Ref. D.7) in 1975 as the S2C accident squence in the Surry plant and as the TW sequence in the Peach Bottom plant. Since that time, analyses have been performed that indicate that the S2C sequence would not result in core damage in the Surry plant. However, the TW sequence has been investigated in a number of boiling water reactor PRAs and found in some cases to have a not insignificant frequency. For the present study of the Peach Br* tom plant, this accident sequence made a small contribution to the core melt frequency, principally because the progressic of the accident was slow, permitting operator intervention to preclude core damage.
App ndix D ' Comment: The major contributors to Peach Bottom containment building failure appear to be the as-sumed overpressure failure in the wetwell above the water line, drywell head failure, or the assumed meltthrough of the <trywell shell. None of these failure modes are supported to the degree necessary to warrant the level of confidence in the central estimate. '
Response
Consideration of these failure modes in the present version of NUREG-1150 made use of a spectrurn of experimental and calculated data. Because these data were often conflicting, expert judgment was used to interpret the data and to develop the probability distributions needed for the risk studies. j The resuhs of the Peach Bottom rish analysis for the present version of NUREG-1150 indicate that meltthrough of the drywell shellis the principal cause of early containment failure in that plant. However, i high-presmre melt ejection remains a significant contributor to early containment failure. j
~
Comment: The prob' abilities of hydrogen detonation in the BWR Mark IH containment building and hydrogen combustion-induced fa5cre of the Sequoyah containment building are overestimated. A detona-tion requires a veiy nie,h cnr.curshn or a geometric configuration that will produce a sufficient flame acceleration. Data from over 40 tests in the Hydrogen Control owners' Group 1/4-Scale Test Facility and other test data support the notion of containment-wide mixing that precludes high local concentrations t.nd thus local detonations. Ths effects of diffusive combustion at the suppression pool surface controls the global hydrogen concentration from 4 to ii volume percent, precluding flame acceleration In a study of Segroyah by an industry group, ' calculations indicate that during a station blackout accb %t, natural circubtion in the containment will permit the recombination of combustible gases as the ga.es pass over hG "ebris in a & actor cavity, without placing severe loads on the containment. The large hydrogen loads that have beers calculated result from inadequate credit given to the recombination of combustible gases.
Response
Experts, listed in Section C.4, of Appendix C, were~ asked to interpret information on hydrogen combus-tion. Each expert was familiar with published data and enalyses regarding hydrogen combustion phenom-ena and their applicability to the distribution of hydrogen in a containment building, the ignition of hydro-gen, and the attendant loads. Using these data, they developed distributions characterizing their estimate of and uncertnaty in selected parameters, such as ignition frequency, probability of deflagration /detona-tion transition, and combustion loads. A summary of the probability distributions and their application in' the Grand Gulf and the Sequoyah risk analyses is provided in Section C.4 of Appendix C. Comment: The initiation of cor,tainment sprays in a BWR Mark III containment building should not lead to significant de-inerting. As the sprays cool the containment atmosphere, the reducing pressure will allow the suppression pool to liash as the saturation temperature is reached. The flashing will produce steam and at least partially re-inert the containment atmosphere. It is believed that a hydrogen burn after re-inerting is insufficiently energetic to cause containment building failure.
Response
The recovery of ac power allows both the containment sprays and the residual heat removal (RHR) system to operate. Eventually, the suppression pool will be cooled by the RHR system; this precludes flashing,. and, hence, the containment will de-inert. It is thought that in a containment previously inerted by steam, and after the recovery of both ac power and containment sp.ays, the severity of a hydrogen burn depends on the relative timing of ignition. Ignition well after recovery of ac power (when the containment atmos-phere is not inert) could result in a severe hydrogen burn. However, if ignition occurs soon after ac power recovery, a slow incomplete burn that dC not threaten the containment or the drywell could occur. Such incomplete burns are considered in the accident progression trees for Grand Gulf. The spray de-inerting scenario is not as important in the current analyses as it was in the analyses of the earlier draft of NUREG-1150. Previously, the core damage frequency was dominated by long-term station blackout scenarios when the containment atmosphere is inert at the time of reactor vessel breach. Cur-rently, it is dominated by short term station blackouts when the containment atmosphere is not inert at the time of vessel breach. NUREG-1150 D-20
Appendix D l Comment: The phenomena in core-concrete interactions are not well understood; the models used are only approximations that are inadequately validated. But even if detailed models could be formulated, it is unnecessary to be concerned with such details while neglecting to examine the location and the behavior of previously evolved fission products. Be,cause a molten core has lost nearly all its fission product gases, the core-concrete interaction is depleted of fission products.
Response
The major phenomena of a core-concrete interaction are reasonably well known and understood. Bascoi on experimental studies, models have been developed that adequately reptuent the phenomena (Refs. D.24 and D.45 through D.47). While a molten core has lost essentially all the volatile fission products by the time it has penetrated the reactor vessel aQ begun to interact with concrete, it will still retain a majority of the nonvolatile species. The subsequent evolution of these nonvolatile species can have a significant impact on the overall conse-quences. D.S.3 Containment Structural Response Comment: There is no universal definition of what constitutes a containment failure, including leak fail-ures and penetration failures.
Response
The accident progression event trees make a distinction between different failure locations and magni-tudes of leakage. The source terms for each accident progression bin account for the effects of these differences in leakage behavior. The issue of location and mode of failure is probably treated in greater detail in this study than in any previous PRA, making use of evailable calculations and experimental data on containment building responses to severe accident loads. Comment: Experimental data on the ultimate potential strength of containment buildings and their failure modes are lacking. This lack of data renders questionable the methods used in draft NUREG-1150 for i assigning probabilities and locations of failures. l
Response
The present data on the potential strength of containment structures under severe accident loadings and the potential modes of failure are limited. For the current analyses, the structural engineering experts who reviewed and interpreted the available information are listed in Section C.8 of Appendix C. , Except for the Grand Gulf plant, the experts addressed the response of the containment buildings studied ' in NUREG-1150 to a range of quasistatic pressure loads associated with severe accident conditions. Other containment failure mechaniens, such as penetration by a missile, structural failure due to impulse loads (e.g., hydrogen detonation for GN ; Gulf and Sequoyah), and meltthrough by molten material, were not ! addressed by structural experts directly but were addressed for some plants through other aspects of the j risk analysis. For example, drywell shell meltthrough in the Peach Bottom reactor (BWR Mark I contain-ment) was a'ddressed by a separate expert panel, The results of the experts' review and judgment are described in Appendix C of NUREG-1150. Briefly, the median failure pressure ranted from 50 and 65 psig for Grand Gulf and Sequoyah, respectively, to 125 and 130 psig for Surry and Zion, respectively. The uncertainty in these estimates spanned a range of approximately 50 to 70 psi, regardless of the absolute range of the design or failure pressure. For the two large, dry containments, Surry and Zion, the median failure pressure corresponds to approximately three times the containment design pressure. The median failure pressure of 65 psig for the ice condenser containment Sequoyah, was substantially lower than that for the large, dry containments; however, this ) value corresponds to more than six times the design pressure. For the two BWR containments,,the Mark I at Peach Bottom and the Mark III at Grand Gulf, the ultimate capacity of the containments was estimated to be 150 psig and 50 psig, respectively. This corresponds to approximately three times the respective D-21 NUREG-1150
Appendix D design pressures. The failure pressure of the Mark I contaimnent was judged to be extremely sensitive to the drywell atmospheric temperature. As described in Appendix C, Section C.8, the ultimate capacity of the Peach Bottom drywell shell niay decrease to levels at or below the containment design pressure if the drywell teroperature exceeds 1200'F. Comment: The Electric Power Research Institute .(EPRI) has been conducting experiments to confirm the , hypothesis that steel-lined concrete containments will develop smallleaks before experiencing gross failure l when subjected to high internal pressures. Industry computer programs have been modified to represent-l the behavior of steel liners and concrete. Codes have been developed that have been validated against experiments and can be used to analyze actual containments. This source of information should be used in NUREG-1150.
Response
j Results of the EPRI tests were discussed in the expert eliccation process and were used in quantifying the failure pressure and modes of the concrete containments. A participant in the EPRI program served on the containment performance panel of experts. Comment: In BWR analyses, secondary containments should be taken into account because there are divergent views on the capability of this structure to withstand a failure of the primary containment and to retain aerosols. 1
Response
In the current version of NUREG-1150, the decontamination factor (DF) of the reactor building was quantified through expert intcipretation of available data. The judgments on the 'DFs (for several release rates, steam concentrations, and flow patterns) were based on models of and calculations from mechanis-tic codes, pe- nally developed models, and experiments. A DF was not applied to the reactor building of the Grand Julf plant because the most likely failure location is at the top of the containment; the only structure between the anticipated failure location and the environment is a corrugated metal structure that is judged to fail immediately after containment failure. Comment: The Peach Bottom analysis was based on the concept of a freestanding structure. However, the failure pressure would be higher than considered in draft NUREG-1150 because the steel shell would get support from the concrete as it expands under presure loading.
Response
The performance of the Peach Bottom steel shell was reviewed by an expert panel of structural engineers. Data availsbie to the panel members iwluded an analysis by the Chicago Bridge and Iron Company on the structural capability of the Peach Bottom steel shell, explicitly including the effects of the concrete biologi-cal shield surroundir$ the shell. The results of the expert review are discussed in Section C.8 of Appen-dix C. Commer1: The assumption that the drywell shell fails as the molten core material contacts the shell is driven by expert judgment. The failure might be delayed or averted if the shell conducts heat away from the contact point rapidly.
Response
The potential for drywell shell failure by direct contact of molten core material has been analyzed by a number of organizations, including Brookhaven National Laboratory, Oak Ridge National Laboratory, Sandia National Laboratories, Massachusetts Institute of Technology, University of Wisconsin, Fauske & Associates, Inc., and the Electric Power Research Institute. The results of these analyses are conflicting. For the present version of NUREG-1150, the analyses were reviewed by experts listed in Section C.7 of Appendix C; their results are p7sented in the same section. NUREG-1150 D-22
i Appendix D D.6 Source Terrns and Consequences D.6.1 Mahods ] Comment: The NUREG-1150 study and the findings are inconsistent with past research trends, which have been toward more mechanistic codes resulting in smaller uncertainties. The computer codes used in NUREG-1150 are becoming less mechanistic and the uncertainties appear to be increasing.
Response
The NUREG-1150 study used a simplified approach for calculating radioactive releases because the large number of such estimates needed to express uncertainty could not all be made with the long-running and resource-intense codes such as the Source Term Code Package (STCP). Simple algorithms were used to make these calculations; the algorithms are collectively know as the XSOR codes. However, the bases for these algorithms were calculations with a set of more mechanistic codes, including the STCP (Ref. D.24), CONTAIN (Ref. D.25), MELCOR (Ref. D.26), and MELPROG (Ref. D.27). In ordei *o address the adequacy of the estimates provided by the parametric computer codes. comple-mentary calculations were performed with the STCP to benchmark the parametric analyses. In general, the parametric calculations were found to be in reasonable agreement with the calculations from the STCP. Discrepancies in the parametric calculations, relative to the STCP calculations and to expert judg-ment, could be explained. Details of these comparisons are reported in Reference D.30. Comment: The uncertainties in risk have not been properly quantified because the Source Term Code Package used in NUREG-1150 does not account for reevolution or resuspension of deposited fission products either in the reactor coolant system following vessel failure or in the containment. High tempera-tures would cause ruthenium, which is normally nonvolatile, to form oxides, which are volatile.
Response
The XSOR analyses it, both the draft and the present stuCes account for a number of processes such as j revaporization of material deposited on reactor coolant system surfaces and the volatilization of iodine from water pools late in the accident. The characterization of these processes was made in terms of probability distributions from expert elicitation. The bases for the expert judgments were provided by direct experimental evidence and analyses using mechanistic computer codes such as TRENDS (Ref. D.48), which predicts iodine transport in containment, and a revaporization model developed by the J Sandia National Laboratories for the SCDAP/RELAP code (Ref. D.49). The basis for the STCP analysis of the ruthenium release is the CORSOR model, which is a semiempirical model based on a number of reasonably prototypic experiments. The distribution of release estimates that was actually used in the risk study was obtained from a panel of source term experts. The range of release for the ruthenium group is quite broad. The thermodynamics of ruthenium are considered explicitly in the VANESA model in the STCP, which predicts core-concrete release. Vapor species considered by VANESA are Ru, RuO, RuO2, RuOa, and RuO4. Ruthenium oxidation was also considered in the devel-opment of source terms for direct containment heating and steam explosions. Comment: All research efforts in the past several years have been geared toward making the source term q estimates more mechanistic. The NUREG-1150 study goes against these trends by developing and using i simple algorithms to estimate source terms. The algorithms do not represent the same level of understand-ing of source terms as do the mechanistic codes, such as the Source Term Code Package (STCP). The algorithms are merely linear combinations of aggregated variables representing many factors determining source tenns, one of the most important of which, timing, is not included. At least the important source terms should be calculated with the STCP, not extrapolated with simple parametric codes. There is no justification for assuming that the variables are linearly related as wa3 done in the simplified parametric source term codes.
Response
With the inaoduction of quantitative uncertainty analyses in NUREG-1150, a large number of source term calculations became necessary. The number needed was far too many to be perfouned with a D-23 NUREG-1150
Appendix D mechanistic code. In addition, no one code contained the "best" models for all phenomena considered potentially important to the transport analyses. As a result, parametric computer codes were developed, based on the results of detailed calculations of accidents by a number of computer codes, including the Source Term Code Package (STCP) (Ref. D.24), the CONTAIN code (Ref. D.25), and other codes. While time is not a formal variable in the parametric codes, time dependency of fission product release is included, in that the releases are broken up into in-vessel and ex-vessel portions. Other factors include the timing of containment failure, the time periods over which the containment sprays operate, and the timing of concrete attack. Comment: The NRC must convince the public and the nuclear community that the Source Term Code Package (STCP) is reliable. The STCP imposes choices on model selection, and no attempt has been j made to determine if a different choice would give a significantly different outcome. The NRC should hold ! a workshop on the STCP and publish a description of the STCP. Because the STCP has not been exten-l sively used in the nuclear community, it is important to review the code; an international consensus may l be needed. 1
Response
The STCP has been extensively revie.<ed, as discussed in Reference D.24. In that study, ti,e NRC staff' assessed the technology for estimating source terms. The study was reviewed by the American Physical Society (reported as Ref. D.36). The STCP and the results obtained with it were an istegral part of a series of meetings between the NRC and an industry group (IDCOR) to exchange technical information. In addition, the STCP has also been the subject of validation and verification efforts by groups other than those involved in its development (Refs. D.50 and D.51). It has been used by numerous organizations in the United States and abroad and, through agreements with the NRC, researchers report their experience in using the code. The default model selections in the STCP are those that are believed to be most consistent with the understanding of aant phenomena and considering the limitations of the code, A different choice of models yields different results and, for this reason, choices other than default choices are discouraged. Because the modeling of particular scenarios may require use of alternative assumptions, the model choices are still available in the STCP. The input decks to operate the STCP were developed using the Final Safety Analysis Report of a plant, information from the plant owners, information from the reactor manufacturco, and information ob-tained during visits to plants. For any particular STCP calculation, the input data were verified. The NRC staff recognizes that the STCP has limitations, which are reported in Reference D.24. To com.- pensate for the limitation in the NUREG-1150 study, expert judgment was used. The judgment is based on the information available at the time of the calculations, such as experimental studies and analytical studies using the STCP and other codes. The judgments were factored into the risk estimates throu;h empirically based algorithms collectively known as the XSOR codes; the variables in these codes are more general and subjective than the variables found in the mechsaistic codes such as the STCP but semiquan-titatively account for phenomena for which rigorous models do not exist. Whenever possible, a mechanis-tic source term calculation benchmarks the XSOR estimates. A study that compares expert opinion, STCP calculations, and XSOR estimates is reported as Reference D.30. Comment: Natural (2rculation is a complex phenomenon. There is no evidence in NUREG-1150 to suggest that the complexity is appreciated or that it is adequately modeled.
Response
The effect of natural circulation in the zeactor coolant system on the potential for early failure and depres-surization prior to meltthrough of the vessel was an issue considered by one of the expert panels in the current version of NUREG-1150. The panel had access to the results of a number of analyses performed with industry and NRC computer codes, as well as experimental data (Ref. D.18). The likelihood of vessel NUREG-1150 D-24
e Appendix D meltdrough with the reactor coolant system at high pressure is low in the current an. ses, in part because of t'ais potential for early depressurization. The possibility of containment bypass res ilting from tempera- ) ture-induced failure of steam generator tubes is also rep esented in the current analyses. However, the likelihood of this bypass mechanism is assessed to be smail. Natural circulation patterns can also affect the progression of a core meltdown and the production'of hydrogen in a reactor vessel. This was taken into account in the current NUREG-1150 analyses; experts interpreted the results of analyses performed with NRC-sponsored codes and also with coc'es sponsored by the industry. D.6.2 Supporting Data Base and Modeling Assumptions Comment: Evidence suggests that cesium iodide is stable but in NUREG-1150 it is modeled otherwise. No data or cyperience suggest that iodine will revolatilize from a basic aqueous solution that would form because of We high percentage of cesium in fission product releases. Iodine remained in solution in the Three Mile Island plant for several years after the accident.
Response
Cesium iodide is not completely stable either in transport through the reactor coolant system or in solu-tion. The issue is how much of the more volatile form is produced. Recent experimental evidence and analysis indicate that the production of volatile forms in the reactor coolant system is smaller than charac-terized in the previous draft of NUREG-1150. The late release of iodine from the suppression pool is an issue that was addressed by an expert review panel for the current version of NUREG-1150. Results of TRENDS code analyses and direct experimental data were considered by the expert panel. The projected pH of the pool was an important consideration. The extent of reevolution obtained in the current study is not as great as in the draft report. For a subcooled suppression pool, the upper bound of the distribution used is 10 percent and the median value is 0.1 percent. For a saturated or boiling suppression pool, larger . l releases are predicted. l 1 Comment: Key issues that lead to high source terms, such as drywellliner meltthrough, core melt progres-sion, and late iodine release, should be subject to further experimental evaluation. Response: ; Significant research results have been obtained in each of these areas subsequent to the release of draft NUREG-1150. At the time this response is being written, the NRC is in the process of reorganizing and reprioritizing its Severe Accident Research Program, in part to account for insights generated in this study. It is anticipated that the highest priority for research over the next few years will be given to resolving issues associated with potential threats to containment integrity, such as drywell shell meltthrough, rather than to source term phenomenological issues, such as the late release of iodine from water pools. Comment: Severe Fuel Damage (SFD) scoping tests on decladded fuel collapse are inappropriate for validating the models of core melt phenomena because the conditions for the experiments and the condi-tions represented in the codes are different.
]
Response: 1 The performance of integral fuel damage experiments always involves substantial compromise in achieving prototypic severe accident conditions. A considerable effort has recently been initiated at the Brookhaven National Laboratory to provide a quantification of c: ale distortion and the effects associated with extrapo-lations, correlations, or models used beyond their data base to quantify code uncertainties. Comment: Steam generator tube rupture occurring as a result of a core damage accident was found to be ; an in portant contributor to the probability of containment bypass. This assumes that fission products get ; into the steam generator; detailed analyses indicate that fission products will deposit in the pressurizer and j pressurizer surge line, not in the steam generator. Industry studies suggest otherwise. D-25 NUREG-1150 ;
Appendix D
Response
It is not necessary for fission products to deposit in the steam generator to obtain overheating and failure of the tubes. The Westinghouse experiments on natural circulation indicate that the convective flow path can occur to the steam generators by means of stratified flow in the hot legs. Failure of steam generator tubes prior to hot leg or surge line failure is not considered likely. In part because steam generator tubes may be degraded, some likelihood of tube failure was assessed (by an expert panel) and is included in the analyses. Comment: Many assump'. ions are made in the modeling of core degradation phenomena, such as 50 percent of a core becoming molten before slumping occurs and a single well-defined melting point. These assumptions have a large effect on the predicted source terms. l Response: Thors are some simplifications in the core meltdown models in the Source Term Code Pachage (STCP), such as the use of a single temperature for fuel melting, which can affect the magnitude of the source term. Of greater significance is the lack of models in the STCP to predict some highly uncertain processes, such as revaporization of fission products from reactor coolant system surfaces after vessel failure. It is impo tant to understand the relationship among the STCP, the XSOR codes, the detailed niechanistic codes, and the use of expert judgment in treating uncertainties in this study. The STCP was only used as a i ' benehmark for the XSOR codes. It played a very small role in the quantification of the accident progres-sion event trees. Probability distributions for the most important uncertain parameters affecting the source ; terms were determined by expert panels, based in large part on the results of mechanistic code analyses ! and experimental results. The source term ranges obtained in this study are dominated by the treatment of these uncertain parameters, not by modeling approximations of core melt progression in the STCP. Comment: Debris cooling is assigned a low likelihood of occurrence in cases where models based on experiments would predict a coolable geometry, s
Response
In the present version, debris coolability was considered for conditions involving water and debris interac-tions both in-vessel and ex-vessel. Based in part on the experience from the accident at Three Mile Island on March 28, 1979, it was assumed that water recovery of a damaged core in-vessel could result in arresting core degradation. The likelihood of arrest was decreased as a function of the time into the accident. A windowof time for recovery was estimated that was determined by the amount of core debris estimated to be on the lowe- head of the vessel. For minimal core degradation, a high likelihood (0.9) of arrest is assumed if an emergency coolant supply is reestablished. Beyond a level of debris accumulation, the likehhood of arrest is assumed to be low (0.1). The likelihood of arrest decreases linearly over the j time interval. The likelihood of a coolable debris bed being established ex-vessel was assessed for a variety of different conditions that depended on whether the reactor vessel was at high or low pressure at the time of vessel failure, the size of the failure, the depth of the water in the reactor cavity, and the temperature of the oebris. For the different cases, the likelihood of the debris bed being coolable ranges from 20 to 90 I percent. Of course, a continuous water supply is a prerequisite to long-term coolability. Comment: Water in the lower head or water injected into the reactor vessel can have a significant effect on accident progression. The possibility that debris can become critical when flooded is never considered.
Response
l In the PWRs, emergency coolant water is borated. The likelihood of recriticality following flooding is considered small and was not represented in this study. In some SWR sequences, a period of time exists when the control blades may have melted and relocated while the fuel pellets are essentially in their normal configuration. Under these circumstances, reflooding could result in a critical condition. In the NUREG-1150 D-26 I
Appendix D
/
t present study, the likelihood of recriticality under these specific conditions was considered high but the possibility of an energetic excursion with the potential to fail the vessel was assessed to be small (Ref. D.18). Comment: In the Sequoyah analysis, it is recognized that water can boil away from debris in a reactor cavity leading to a core-concrete interaction after the ice is depleted and the containment has failed. The scenario does not seem correct because the steam should condense and replenish the debris bed with coolant.
Response
The analyses account for condensation in the containment and the replenishment of water in the reactor cavity. Dryout of the debris bed orh v: curs after containment failure and an extended period of steam loss from the containment. Comment: Data from the accident at Three Mile Island do not support the core melt and fission product release models.
Response
To the extent that TMI-2 data can be interpreted to evaluate the magnitude of fission product release and the extent of fuel damage during core uncovery, the TMI-2 data are consistent with the Source Term Code Package (STCP) analyses. Benchmark analysis with the STCP shows good agreement with the pres-sure history (.Ref. D.52). Examination of TMI-2 core debris indicates that 70 to 80 percent of the iodine and cesium had escaped the core debris, much of which had never been completely melted (Ref. D.53). These results are consistent with the STCP analyses. Because of the subsequent flooding of the TMI-2 vessel, the examination of the reactor coolant system samples was not able to provide information on the extent of radiunuclide deposition during the period of core uncovery and fission product release from the fuel. t .e l Comment: In the risk study, an assumption was made that 5 percent of a population surrounding a nuclear power plant will not evacuate during a severe accident. No basis for this assumption was given. Actual emergency events, both with and withou' emergency plans, should be used to develop a well-founded value. The assumption should take into account a failure in offsite emergency cesponse, such as . . may be caused by the failure of buildings, roads, and bridges during an earthquake. A realistic assumption must be used because it significantly affects the calculated consequences. Response: - The assumed 5 percent non-evacuation of the population within the 10-nile emergency planning zone (EPZ) of a reactor that was used in the calculations for draft NUREG-1150 is conservative. In the current study, the assumption was changed to 0.5 percent, based on the following rationale. The plants that were studied in NUREG-1150 have detailed and well-maintained emergency plans, which also have provisions for evacuating from special facilities within the EPZ. Because an evacuation is preplanned, it is expected to be nearly complete. The preplanned evacuation should be distinguished from unplanned and im-promptu evacuations prompted by transportation accidents involving toxic chemicals, accidents at chemi- - cal plants, or natural disasters. The specific value used (0.5 percent) was derived from an actual use of a nuclear ememency plan (for a nearby chemical accident). The current study includes displays of the offsite consequences and risk with assumptions on the alternative modes of emergency response within the EPZ, such as evacuation, early relocation, sheltering, and partial (i.e., 0 to 5 miles) evacuation / partial (i.e., 5 to 10 miles) sheltering. Sensitivity calculations of severe accident consequences during an earth-quake, assuming a degraded emergency response, are reported in the supplements of NUREG-1150 (Refs. D.12 and D.13). Comment: It is ur. reasonable to assume that, once an individual evacuates beyond 15 miles from a dam-aged reactor, no further dose is received. Response: , In the current consequence analysis, an individual is assumed to avoid further radiation exposures after reaching a radial distance of 20 miles from a reactor. People who evacuated from the 10-mile emergency 4 D-27 NUREG-1150
Appendix D planning zone (EPZ) of the Grand Gulf and Peach Bottom plants would need about 3 to 4 hours to travel to a distance of 20 miles from these reactors; people who evacuated from the 10-mile EPZ of the Surry, Sequoyah, and Zion plants would need about 7 to 11 hours to travel to a distance of 20 miles from those reactors. It seems reasonable to assume that by then the location of the radioactive plume and the area contaminated by it would have been known and people would have been advised on how to avoid it. Comment: The MACCS code should be thoroughly documented and benchmarked. A study should be done of how the MACCS code compares to other codes. The MACCS code should be thoroughly' verified and validated to ensure the validity and accuracy of the models, data, and assumptions.
Response
In late 1987 the NRC staff began an inhouse benchmarking activity on the version of the MACCS code (Version 1.4) used for draft NUREG-1150. This activity consisted of a comparison of MACCS 1.4 results { with the results from varic as research groups calculating consequences using their own consequence i codes. The research groups were members of the Organization for Economic Co-operation and Develop- I ment / Nuclear Energy Agency / Committee on Safety of Nuclear Installations (OECD/NEA/CSNI). The benchmarking activity revealed errors in MACCS 1.4 and these are reported in References D.54 and D.55. Upon finding the errors, the benchmarking of Version 1.4 was discontinued while corrections of the code and documentation of the code were made. Benchmarking of the current version of MACCS, Ver-sion 1.5, is now under way. An NRC reanrt of the benchmarking will be available in the summer of 1989 a5 Reference D.56. A comparative review has been performed at the Institute for Energy Technology, Norway, of the chronic exposure pathways modeled in MACCS 1.5 with other consequence codes used by the OECD member countries. The findings are repor:ed as Reference D.33. The Idaho National Engineering Laboratory (INEL) performed the cuality assurance and verification of MACCS 1.5. Sandia National Laboratories (SNL), the developers of the code, assisted INEL because the code had not been adequately documented. The quality assurance program was a line-by-line check of the ' Fortran coding and crosschecking with the model equations for consistency. Corrections of most of the errors identified in the Norwegian and INEL reviews were completed in MACCS 1.5 used in this version of NUREG-1150. The residual errors in the MACCS code appear to cause an error of about a factor of two in the latent cancer fatality.and population dose estimates; the errors in the code will be corrected before the code is made available to the public. The documentation (user's manual, model descriptions, and programmer's manual), the Norwegian review, and a report of the final crosschecking by INEL (Ret D.57) are expected to be completed in the summer of 1989. Comment: It seems to be surprising and erroneous that the bulk of the late fatalities associated with large radionuclides releases is derived from the long-term doses committed via food chain pathways of exposure at low levels of irrliviaual dose. It contradicts the results of earlier studies (such as the Reactor Safety Study (Ref. D.7), the German Risk study (Ref. D.58), and the Sizewell B calculations (Ref. D.59)), which concluded that the bulk of the late fatalities is associated with relatively high levels of h.dividual dose attributable to relatively short-term exposure following an accident. Substantial work is required to verify this important difference.
Response
Errors were found in the calculations of the radiological consequences from the food chain pathways of exposure. These errors were partly from errors in the input to the consequence analysis code. MACCS 1.4, and partly from incorrect modeling of the removal of cesium from the root zone. The incorrect modeling assumed little removal of cesium from the root zone because of irreversible binding of cesium to the soil or cesium percolating through the soil beyond the root zone. This caused the root uptake pathwaf ing':stion doses to be unreasonably large. NUREG-1150 D-28
Appendix D D.6.3 Comparisons with Accident at Chernobyl Comment: Offsite doses (versus distances) reported in NUREG-1150 for some of the source terms are too high and indicate a potential for causing prompt fatalities in the offsite population. In contrast, there were no prompt fatalities outside the plant in the Chernobyl accident.
Response
The potential of a large radioactive release to the atmosphere to resto in high doses and prompt fatalities in the public depends on the meteorological conditions during and immediately following the release and the energy content of the release. A large radioactive release during favorable meteorological conditions may not have the potential for causing prompt fatalities in the public. The opposite is possible if releases occurred during unfavorable meteorological conditions. In a PRA framework, many alternative meteorological conditions are used (based on actual site data), some of which are favorable and some of which are unfavorable so that the effect of virtually all meteorological scenarios can be represented. A release accompanied by a large quantity of thermal energy may result in the plume lifting off frcm the building wake and rising in the atmosphere while being transported by the wind, resulting in !ow offsite doses. This happened during the release from the Chernobyl accident and, therefore, there were no
- offsite prompt fatalities.
Comment: After the Chernobyl accident, it is difficult to justify a lack of accounting of doses beyond 50 miles in the risk calculations. i Response: In draft NUREG-1150, the radiological consequence calculations were limited to 500 miles from a dam-aged reactor. In the analysis for the present version of the repor L radioactive material (except for the noble gases) remaining in the plume at 500 miles from the plant was deposited on the ground between 500 miles and 1,000 miles from the reactor. The contribution of all pathways of exposure between 500 and 1,000 miles are also included in the estimates of the consequences. This ensures nearly 100 percent accounting of the released radionuclides in Qe consequence calculations. The impact of the small quanti-ties of noble gases leaving the 1,000-mile region is negligible. Comment: It should be made clear that varir.tions in the relocation / decontamination / interdiction dose criteria are included in the cost uncertainties.
Response
Uncertainties in the offsite consequence models and the values of the input parameters ta the conse-querve code were not treated in the previous analyses. In those analyses, the long-term relocation crite-rion of the Reactor Safety Study (Ref. D.7) of 25 rems in 30 years from groundshine was used. In the current analyses, the relocation criterion of 4 rems in 5 years from groundshine is used for base case calculations; this criterion is an approximation of the criterion currently proposed by the U.S. Environ-mental Protection Agency (Ref. D.60). The criterion found in the Reactor Safety Study is also used in the current calculations but only to show the sensitivity of the long-term health effects. Comment: More discussion is needed on the assumptions that have been made about relocation and time scales for the decontamination of property after the 7-day emergency phase ,vhen doses could still be high.
Response
In the current consequence calculations, decontamination of both land and buildings was assumed to reduce the levels of radioactive material by a factor of three or 15. A reduction by a factor of three was assumed to require 60 days of decontamination work; a reduction by a factor of 15 was assumed to require 120 days of decontamination work. The decontamination efforts were assumed to commence at D-29 NUREG-1150
Appendix D the end of the 7-day emergency phase. The affected people were assumed to be relocated during the decontamination period. D.7 Uses of NUREG-1150 as a Resource Document D.7.1 Uses Comment: The way that NUREG-1150 will be factored into the regulatory process is unclear.
Response
NUREG-1150 is not intended to represent a quantitative and systematic evaluation of regulations. How-ever, NUREG-1150 does provide a source of information that can support, at least in part, such an objective. The document provides an information base for analyzing plant-specific and generic safety issues. The NUREG-1150 models can be used for assessing the safety significance of operational occur-rences and as a basis for evaluating alternative design changes to improve safety. A discussion of the use of NUREG-1150 in the regulatory process is provided in Chapter 13 of NUREG-1150 and in Reference D.8. Comment: Risk assessment offers a logical framework to review regulations and examine safety issues. The decision to use risk assessment as a basis for regulatory decisionmaking is a major advancement in the regulation of nuclear power plants. But regulators need to be fully aware of the strengths and the weak-nesses of their tools and to be concerned with the degree of precision needed to ensure safety. Response: I NUREG-1150 is not intended to represent a quantitative and systematic evaluation of regulations. How-ever, NUREG-1150 does provide an information source that can support such an objective. The results in NUREG-1150 will be used with full recognition of the uncertainties involved and the strengths and the weakneces of the methods from which the results were derived (as described in Chapters 1 and 13). l Comment: The interpretation of expert judgments about containment response in terms of probabilities has a large effect on risk estimates. The NUREG-1150 study suggests that the major contributor to risk is early containment failure, but the large uncertainty precludes any regulatory decision on the need for risk reduction using, for example, venting strategies, refractory-lined cavities, and in-plant emergency proce-dures.
Response
There are necessarily large uncertainties associated with severe accident risks. These large uncertainties are due in part to a lack of understanding associated with many of the complex phenomena in severe accidents. The uncertainty in risk does not preclude its use in decisionmaking. Decisions must be made in spite of the uncertainties, but the unceru hties may change the type of decision being made. Comment: The application of NUREG-1150 should be discontinued until the risk estimates are im-proved.
Response
Draft NUREG-1150 has not been widely used as a basis for regulatory action during the comment period or while modifications were unc er way. However, the interim findings of the draft report and the methods developed were not completely ignored. Rather, items identified as being potentially important in the draft report were considered in developing the listing of items for consideration in the guidance provided for the Individual Plant Examination process. Similarly, the info;mation on containment performance provided one input into the NRC's Containment Performance Improvement study. The draft NUREG-1150 infor-mation provided a starting point fer the development of a more focused in-depth analysis of various issues. As discussed in Chapter 13, the future uses envisaged for NUREG-1150 do not rely heavily on the quanti-tative results obtained .for the five plants analyzed. NUREG-1150 D-30
1 1 I Appendix D I D.7.2 Cost / Benefit Analysis Comment: The models used in calculati. ; the cost of a severe accident lack many factors that should be taken into account. Many of the assumptions are questionable and unfounded. The models have not been benchmarked. Some interpretations and conclusions that were made in draft NUREG-1150 are question-able. The cost estimates need to be more thoroughly documented to understand and evaluate the calcula-tions. q
Response
The present version of NUREG-1150 provides a limited set of risk-reduction calculations, principally related to the potential benefits of accident management strategies in reducing core damage frequency. It does not assess the costs of these or other improvements. Such analyses are more properly considered in the context of specific regulatory actions. Comment: The averted cost (in terms of risk reduction) do not include secondary costs. The draft risk study recognizes that secondary costs may significantly increase the benefit of some safety options but no attempt was made to quantify this increase. The underestimate can be attributed to the following:
- 1. The cost of shutdowns of similar reactors on the same site and at other sites.
- 2. The possibility of $boratorium on nuclear power due to a severe accident.
- 3. The value of $1 million per averted acute fatality and $100,000 per latent fatality may be too low.
- 4. The values of the interdiction dose used in the calculations may be too high.
- 5. No allowance has been made for the decrease in long-term value of land and buildings that have been contaminated.
- 6. Decontamination costs used in the calculations may be based on decontamination of test sites in deserts instead of agricultural, residential, and commercial property.
- 7. The radiation releases are calculated out to 50 miles; a radius as much as 500 miles may be more {
appropriate. l
Response
The draft NUREG-1150 cost / benefit analyses reflected the conventional NRC methods for assessing costs j and benefits. Because cost / benefit analyses are more properly considered in the context of specific regula- ) tory activities, they are not provided in this version of NUREG-1150. l D.7.3 Safety Goal Cor.nparisons Comment: NUREG-1150 finds that the U.S. safety goals are met; this discourages further improvements in safety.
Response
]
As discussed in Chapter 13, this version of NUREG-1150 indicates that the five plants studied in NUREG-1150 are below the Commission's quantitative health objectives. The NRC staff disagrees that the findings of NUREG-1150 discourage further improvements in nuclear safety. Many improvements have been made at the five plants studied in NUREG-1150 since the draft report was first published in February 1987; some of the safety improvements arose from this study of various features of the five plants. The NRC staff believes that a comprehensive risk analysis on a plant enhances safety because it l presents an overall and comprehensive view of interactions among plant systems and operator actions. l Similarly, the variety of perspectives drawn in NUREG-1150, particularly in Chapters 8 and 12, provide information that other plants may consider as they perform Individual Plant Examinadons. I D-31 NUREG-1150 I
Appendia D l D.7.3 Extrapolation of Results Comment: It is unclear how NUREG-1150 will be used in conjunction with individual plant evaluations or plant-specific PRAs as a basis for regulatory decisionmaking.
Response
Perspectives gained from NUREG-1150, previous industry-sponsored PRAs, and analyses done by indus-try groups, such as IDCOR's analysis of four containment configurations, have been assembled into sev-eral NRC reports (Ref. D.61). These reports provide infonnation to the analysts performing Individual Piant Examinations (IPEs) concerning plant features and operator actions that are important to the evalu-ation of risk. Chapter 13 discusses how NUREG-1150 is used in the IPE; details of the IPE process are presented in Reference D.62. I I 1 NUREG-1150 D-32
I Appendix D l I REFERENCES FOR APPENDIX D D.1 U. S. Nuclear Regulatory Commission (USNRC), " Draft NUREG-115b for Public Comment: Issu-ance and Availability," Federal Register, Vol. 52, p. 7950, March 13,1987. D.2 USNRC, " Seminar on Methodology Used in NUREG-1150, ' Reactor Risk Reference Docu-ment'," Federal Register, Vol. 52, p. 8390,- March 17,1987. D.3 ACRS, "ACRS Comments on Draft NUREG-1150, ' Reactor Risk Refere ace Document'," letter from W. Kerr, Chairman, Advisory Committee on Reactor Safeguards, to L. W. Zech, Chairman,' USNRC, July 1987. ACRS, " Report on NUREG-1150, ' Reactor Risk Reference Document'," letter from W. Kerr, Chairman, Advisory Committee on Reactor Safeguards, to L.' W. Zech, Chairman, U.SNRC, August-16,1988. ACRS, "NUREG-1150: Resolution of ACRS Comments," letter from F. Remick, Chairman, Advisory Committee on Reactor Safeguards, ' to L. W. Zech, Chairman, USNRC, January 23, 1989, D.4 H. J. C. Kouts et al., " Methodology for Uncertainty Estimation in NUREG-11'50 (Draft)i Conclu-sions of a Review Panel," Brookhaven National Laboratory, 'NUREG/CR-5000, BNL- - NUREG-52119 December 1987. D.5 W. E. Kastenberg et al., " Findings of the Peer Review Panel on the Draft Reactor Risk Reference Document, NUREG-1150," Lawrence Livermore National Laboratory, NUREG/CR-5113, UCID-21346, May 1988. D.6 L. LeSap et al, " Initial Report of the Special Committee on Reactor Risk Reference Document (NUREG-1150)," American Nuclear Society, April 1988.* D.7 USNRC, " Reactor Safety Study-An Assessment of Accident Risks in U.S. Ccmmercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975. D.8 USNRC, " Integration Plan for Closure of Severe Accident Issues," SECY-88-14' , May 25,1988. , D.9 J. S. Evans et al., "On the Propagation of Error in Air Pollution Measuremer s," Environmental 'i' Monitoring and Assessment, Vol. 4, pp.139-53,1984. D.10 H. W. Lewis et al., " Risk Assessment Review Group Report to the U.S. Nuclear Regulatory Coto- ; mission," Ad Hoc Review Group, NUREG/CR-0400, September 1978. D.11 D. I. Chanin et al., "MELCOR Accident Consequence Code System (MACCS)," Sandia National 1 Laboratories, NUREG/CR-4691, Vols. I and II, SAND 86-1562, to be published.' 1 D.12 R. J Breeding et al., " Evaluation of Severe Accident Risks: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4551 Vol. 3, Draft Revision 1 SAND 86-1309, to be published
- D.13 A. C. Payne, Jr., et al., " Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia ]
National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND 86-1309, to be ; published. ' i D.14 J. J. Gregory et al., " Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551 Vol. 5, Draft Revision 1, SAND 86-1309, to be published.' -- D.15 T. D. Brown et al., " Evaluation of Severe Accident Risks: Grand Gv!f Unit 1," Sandia National ! Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1, SAND 86-1309, to be published.* - i Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
)
D-33 NUREG-1150
Appendix D D.16 C. K. Park et al., " Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.' D.17 D. Horschel, " Experimental Results From Pressure Testing a 1/6 Scale Nuclear Power Contain-ment," Sandia National Laboratories, NUREG/CR-5121, to be published.' D.18 F. T. Harper et al., " Evaluation of Severe Accident Risks: Quantification of Major Input Parame-ters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2 Draft Revision 1, SAND 86-1309, to be published.' D.19 R. C. Bertucio and J. A. Julius, " Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4350, Vol. 3, Rev.1, SAND 86-2084, to be published.* D.20 A. M. Kolaczkowski et al., " Analysis of Core Damage Frequency: Peach Bottom Urst 2," Sandia National Laboratories, NUREG/CR-4550, Vol. 4. Rev.1, SAND 86-2084, to be published.' D.21 R. C. Bertzio and S. R. Brown, " Analysis of Core Damage Frequency: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 5. Rev.1, SAND 86-2084, to be published.* D.22 M. T. Drouin et al., " Analysis of Core Damage Frequency: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 6, Rev.1, SAND 86-2084, to be published.' D.23 M. B. Sattison and K. W. Hall, " Analysis of Core Damage Frequency: Zion Unit 1," Idaho National Engineering Laboratory, NUREG/CR-4550, Vol. 7 Rev.1, EGG-2554, to be pub-lished.' D.24 M. Silberberg et al., " Reassessment of the Technical Bases for Estimating Source Terms," USNRC Report NUREG-0956, July 1986. D.25 K. D. Bergeron et al., " User's Manual for CONTAIN 1.0, A Computer Code for Severe Reactor i Accident Containmerat Analysis," Sandia National Laboratories, NUREG/CR-4085, ' SAND 84-1204, July 1985. D.26 R. M. Summers et al., "MELCOR In-Vessel Modeling," Proceedlags of the Fifteenth Water Reac-for Safety Iqfarmation Meeting (Gaithersburg, MD), NUREG/CP-0091, February 1988. D.27 5. S. Dosanjh (Ed.), *MELPROG-PWR/ MOD 1: A Two-Dimensional, Mechanistic Code for Analysis of Reactor Core Melt Progression and Vessel Attack Under Severe Accident Conditions," Sandia National Laboratories, NUREG/CR-5193, SAND 88-1824, May 1989. D.28 R. L. Iman and M. J. Shortencarier, "A Fortran 77 Program and User's Guide for the Generation of Latin Hypercube and Random Samples for Use with Computer Models," Sandia National Labo-ratories, NUREG/CR-3624 SAND 83-2365, June 1984. D.29 M. L. Corradini et al., "A Review of the Severe Accident Risk Reduction Program (SARRP) Containment Event Trees," University of Wisconsin, NUREG/CR-4569, May 1986. D.30 P. Cybulskis, " Assessment of the XSOR Codes," Battelle Columbus Division, NUREG/CR-5346 BMI-2171, to be published.' D.31 R. L. Iman et al., "A User's Guide for PARTITION: A Program for Defining the Source Term / Consequence Analysis Interfaces in the NUREG-1150 Probabilistic Risk Assessments," Sandia National Laboratories, NUREG/CR-5253, SAND 88-2940, to be published * 'Available in the NRC Public Document Room. 2no L Street NW., Washington, DC. NUREG-1150 D-34
1 4 I App:ndix D D.32 E. D. Gorham-Bergeron et al., " Evaluation of Severe Accident Risks: Methodology for the Acci- l dent Progression Source Term, Consequence, Risk Integration, and Uncertainty Analyses," San-dia National Laboratories, NUREG/CR-4551, Vol.1, Draft Revision 1, SAND 86-1309, to be published.* D.33 U. Tveten, " Review of the Chronic Exposure Pathway Models in MACCS and Several Other Well .Known Probabilistic Risk Assessment Models," Institute for Energy Technology, Norway. Prepared by Sandia National Laboratories, NUREG/CR-5337, SAND 89-7075, to be published.' D.34 Commonwealth Edison Company of Chicago, " Zion Probabilistic Safety Study," September 1981. D.35 USNRC, " Nuclear Power Plant Severe Accident Research Plan," (G. P. Marino, Ed.), NRC Re-port NUREG-0900, Revision 1 April 1986. D.36 R. Wilson et al., " Report to the APS of the Study Group on Radionuclides Release from Severe g Accidents at Nuclear Power Plants," Reviews of Modern Physics, Vol. 57, No. 3, Part II, July ' 1985. D.37 D. L. Berry et al., " Review an'd Evaluation of the Zion Probabilistic Safety Study: Plant Analysis," Saiidia National Laboratories, NUREG/,CR-3300, Vol.1, SAND 83-1118, May 1984. D.38 D. M. Ericsor, Jr., (Ed.) et al., " Analysis of Core Damage Frequency: Methodology Guidelines," Sandia National Laboratories, NUREG/CR-4550, Vol. 1. Rev. 1, SAND 86-2084, to be published.' i D.39 T. A. Wheeler et al., " Analysis of Core Damage Frequency from Internal Events: Expert Judg- ) ment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND 86-2084, April 1989. > D.40 R. M. Harrington and L. C. Fuller, "BWR-LTAS: A Boiling Water Reactor Long-Term Accident Simulation Code," Oak Ridge National Laboratory, NUREG/CR-3764, ORNL/TM-9163, Febru-ary 1985.
]
D.41 W. J. Luckas, Jr., "A Human Reliability Analysis for the ATWS Accident Sequence with MSIV ! Closure at the Peach Bottom Atomic Power Station," Brookhaven National Laboratory, May 1986.* D.42 Fauske and Associates, Inc., "MAAP Modular Accident Analysis Program User's Manual," Vols. I and II, IDCOR Technical Report 16.2-3, February 1987.* D.43 D. J. Hanson et al., " Containment Venting Analysis for the Peach Bottom Atomic Power Station," Battelle Columbus Laboratories, NUREG/CR-4696, EGG-24(4, February 1987. D.44 USNRC, "A Review of the Current Understanomg for the Potential for Containment Failure From In-Vessel Steam Bxplosions," NUREG-1116, June 1985. D.45 D. A. Powers et al., "VANESA: A Mechanistic Model of Radionuclides Release and Aerosol Generation During Core Debris Interactions with Concrete," Sandia National Laboratories. . NUREG/CR-4308, SAND 85-1370, July 1986. I D.46 F Muir et al., "CORCON-MOD 1: An Improved Model for Core / Concrete Interactions," Sandia National Laboratories, NUREG/CR-2142, SAND 80-2415, September 1981. l D.47 R. K. Cole, Jr., et al., "CORCON-MOD 2: A Computer Program for Analysis of Molten-Core Concrete Interactions," Sandia National Laboratories, NUREG/CR-3920, SAND 84-1246, Octo-ber 1984. l
'Available in the NRC Public Document Room,2120 L Street NW., Washington, DC.
D-35 NUREG-1150
Appendix D D.48 E. C. Beahm et al., " Calculations of Iodine Source Terms in Support of NUREG-0956," Oak Ridge National Laboratory, ORNL/NRC/LTR-86/17, Technical Letter Report, July 1986. D.49 G. A. Berna et al., "REL.AP5/SCDAP/ MODO Code Manual," EGG-RTH-7051, EG&G, Septem-ber 1985. D.50 T. S. Kress, " Review of the Status of Validation of the Computer Codes Used in the Severe Accident Source Term Reassessment Study (BMI-2104)," Oak Ridge National Laboratory, ORNL/TM-8842, April 1985. D.51 M. Khatib-Rahbar et al., " Independent Verification of Radionuclides Release Calculations for Se-lected Accident Scenarios," Brookhaven National Laboratory, NUREG/CR-4629, BNL-NUREG-51998, July 1986. D.52 R. O. Wooton, " MARCH Calculations Performed for the TMI-2 Analysis Exercise," submitted i for publication in Nuclear Technology for special issue on TMI,1989, to be published.' D.53 D. W. Akers et al., "TMI-2 Core Debris Grab Samples-Examination and Analysis, Part 1," Idaho National Engineering Laboratory, GEND-INF-075, p.110. September 1986. D.54 S. Acharya et al., " Benchmarking of the MACCS Code," Transactions of the American Nuclear Society (San Diego, California), Vol. 56, pp. 353-4, June 12-16,1988. D.55 S. Acharya et al., " Benchmarking of the MACCS Code," Proceedings of the Second Part of the Joint CEClOECD/NEA Workshop on Recent Advances in Reactor Accident Consequent Assess-ment (Rome, Italy), pp. 50-2, January 25-29, 1988. D.56 5. Acharya et al., " Benchmarking of the MACCS Code, USNRC Report NUREG-1364, to be published.* D.57 C. A. Dobbe, " Quality Assurance and Verification of the MACCS Code, Version 1.5," Idaho National Engineering Laboratory, NUREG/CR-5376, EG&G-2566, to be published.* D.58 The Federal Minister of Research and Technology, "The German Risk Study-Summary," Gesellschaft fur Reaktorsicherheit (Germany), August 15, 1979.* D.59 M. R. Hayes et al., "The Technical Basis of ' Spectral Source Terms' for Assessing Uncertainties in Fission Product Release During Accidents in PWRs with Special Reference to Sizewell-B," United Kingdom Atomic Energy Authority, SRD-R-256, November 19,82.* D.60 United States Environmental Protection Agency, " Manual of Protective Action Guides and Protec-tive Actions for Nuclear incidents," Office of Radiation Programs, Draft, to be published.' D.61 Brookhaven National Laboratory, " Assessment of Severe Accident Prevention and Mitigation Features," NUREG/CR-4920. Vcis.1-5, BNL-NUREG-52070, July 1988. D.62 NRC Letter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, " Individual Plant Examination for Severe Accident Vulnerabilities-10 CFR Section 50.54f," Generic Letter 88-20, dated November 23, 1988. ' Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC. NUREG-1150 D-36
U.S. NUCLE AR REGULATORY COMM!S$10N 1. ER gC FORM 335 PO_RT NRCM 11o2, und Adoendum Numbers,if any.) 32ouao2 BIBLIOGRAPHIC DATA SHEET NUREG-1150 ISee instructions on the reverse) l2. TITLE AND SUBTITLE i Severe Accident Risks: An Assessment for Five U.S* 3. DATE REPORT PUBLISHED Nuclear Power Plants oo. j u A. i Appendices __ June 1989 Second Draft for Peer Review 4 "N R R ANT NuMBE R @. AUTHOR (S) 6. TYPE OF REPORT Draft Technical
- 1. PE R lO0 COV E R E D rinclusswe ceress
(:1 PE R F ORMING ORG AN FZAT ION - N AM E AND ADDR ESS ter Nac. provoct Dwwon. Orroce or Regson, V.S. NucIw negalerort Commtwon, and mootme n& rem ir contractor provoce MM end mGiling addrF8Li Division of Systems Research Office of Nuclear RegulEtory Research U.S. Nuclear Regulatory Commission Washington, DC 20555
~ @. SPONSOR lNG ORG ANlZATlON ~ NAM E AND ADDR ESS tir Nnc. tree "some os above", sicontracror.provice atnc owIsoon orrse or Region. vs. Nucaw s.aguistory commiwon.
gnd mellung eddresLI Same as above.
- 10. SUPPLEME NTARY NOTES
- 11. ABSTRACT (200*oras or Am/
This document discusses the risks from severe accidents in five commercial nuclear power plants. Information is presented on the frequencies of core damage accidents from internally initiated accidents (and from externally initiated accidents for two 3 l plants), containment performance under severe accident loads, releases of radioactive j material and offsite consequences, and risk (the product of accident frequencies and ! consequences). This report is a second draft for' peer review,' modified to account for i comments on a February 1987 draft from the public and three formal peer reviews of that j draft. Following a peer review of this version, a final report will be issued. ] Volume 2 of this report provides more detailed discussion of the methods used in the risk analyses, additional discussion on specific technical issues important in the 1 analyses, and responses to comments received on the February 1987 draft. I B2, K E Y WORDS/DESC R:PTOR S (List words or pareses ther wm ewsr resweners In sacermg rne recorr.; Q Ay ARAbspH bl AMMENT l Severe accidents Unlimited ! Risk analysis tuecumn ua=canc~ PRA n~aari 1 Unclassified ! an , ne on, \ Unclassified ib. NUMBE R OF PAGE S l 16 PRICE SCFORM335 (2 89)
- U. S. COVE 44111E NT ##1hT 3 hG Of f lCE i198 9-241-599 :09133 I 1
UNITED STATES sPiciat rouais ctass aaTt NUCLEAR REGULATORY COMMISSION POSTAGE & FEE S PAID WASHINGTON, D.C. 20555 ""' PERMIT ho G.67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE,6300 4
~ }
.}}