Text

NUREG/CR-7245 State-of-the-Art Reactor Consequence Analyses (Soarca) Project.
	ML17340B209
Person / Time
Site:	Sequoyah
Issue date:	11/30/2017
From:	Ghosh S T; Office of Nuclear Regulatory Research, Sandia
To:	; Advisory Committee on Reactor Safeguards
	Ghosh T
Shared Package
ML17340B178	List: ML17340B209;
References
	OEDO-17-00722 NUREG/CR-7245
	Download: ML17340B209 (668)
	v • d • e

State-of-the-Art Reactor Consequence Analyses (SOARCA) Project Sequoy ah Integrat ed Deterministic and Uncertainty Analyses M anuscript C ompleted: N ovember 201 7 Date Published: Prepared by

Severe Accident Analysis Department Sandia National Laboratories P.O. B ox 5800 MS-0848 Albuquerque, N M 87185-0748 S.Ti na Ghosh, NRC Project ManagerOffice of Nuclear Regulatory Research Sandia National Laboratories is a multimission laboratory managed and operated by National Technology and Engineering Solutions of Sandia, LLC., a wholly owned subsidiary of Honeywell International, Inc., for the U.S. Department of Energy's National Nuclear Security Administration under contact DE

-NA-0003525.

i ABSTRACT The U.S. Nuclear Regulatory Commission initiated the state

-of-the-art reactor consequence analyses (SOARCA) project to develop realistic estimates of the offsite radiological health consequences for potential severe reactor accidents. The SOARCA analysis of an ice condenser containment plant was performed because its relatively low design pressure and reliance on igniters makes it potentially susceptible to early containment failure from hydrogen combustion during a severe accident. The focus was on station blackout accident scenarios where all alternating current power is lost.

Accident progression calculations used the MELCOR computer code. For scenarios leading to an offsite release of radioactive material, SOARCA analyzed atmospheric dispersion, emergency response, and potential health consequences using the MELCOR Accident Consequence Code System (MACCS). The analysis included hundreds of MELCOR and MACCS simulations to account for uncertainty in important accident progression and offsite consequence input parameters. This analysis reinforces the results of past analyses of ice condenser containments showing that successful use of igniters is effective in averting early containment failure. Even for scenarios resulting in early containment failure, the calculated individual latent fatal cancer risks are very small.

ii iii TABLE OF CONTENTS Section Page LIST OF FIGURES

................................

................................................................

...................

vii LIST OF TABLES

................................................................................................

.....................

xxi EXECUTIVE

SUMMARY

................................

................................................................

........ xxv ABBREVIATIONS AND ACRONYMS

................................

......................................................

xlv 1. Introduction

................................................................................................

.................

1-1 1.1 Background

................................

................................................................

...... 1-1 1.2 General Sequoyah Plant and Site Information

................................

.................

1-4 1.3 Sequoyah SOARCA Scope

................................

..............................................

1-5 1.4 Approach for Uncertainty Considerations

................................

.........................

1-6 1.5 Outline of Report

................................

..............................................................

1-8 2. Accident Scenario Development

................................

..................................................

2-1 2.1 Background

................................

................................................................

...... 2-1 2.2 Scenario Selection

................................

...........................................................

2-1 Short-term Station Blackout (STSBO)

................................

..................

2-1 Long-term Station Blackout (LTSBO)

................................

...................

2-4 2.3 Mitigative Measures

................................

.........................................................

2-5 2.4 Scenarios Modeled in This Study

................................

..................................... 2-6 3. Sequoyah MELCOR Model

................................

.........................................................

3-1 3.1 Sequoyah MELCOR Model Description

................................

...........................

3-1 Reactor Core and Vessel

..................................................................... 3-4 Reactor Coolant System

..................................................................... 3-14 Secondary System

................................

.............................................

3-19 Emergency Core Cooling System

................................

.......................

3-19 In-vessel Natural Circulation Modeling

................................

...............

3-19 Containment

................................

.......................................................

3-20 Containment Leakage and Rupture

....................................................

3-24 Hydrogen Combustion

................................

........................................ 3-27 Turbine-Drive Auxiliary Feedwater System

................................

......... 3-30 Operator Actions

................................

................................................

3-32 Hydrogen Mitigative System

................................

...............................

3-33 Modeling Practices

................................

.............................................

3-34 iv 3.2 Selection of Uncertain MELCOR Parameters

................................

.................

3-39 3.3 Primary SV Stochastic Failure to Close (priSVcyles)

................................

...... 3-43 3.4 Primary SV Open Area Fraction (priSVfrac)

................................

...................

3-51 3.5 Secondary SV Stochastic Failure to Close and Open Area Fraction (secSVcycles and secSVfrac)

................................

........................................ 3-53 3.6 Effective Zircaloy Oxide and Uranium Oxide Eutectic Melting Temperature (Eu_Melt_T)

................................

..............................................

3-55 3.7 Hydrogen Ignition Criteria (Burn_Dir)

................................

.............................

3-57 3.8 Barrier Seal (Seal_Open_A and Seal_Fail_Dp)

.............................................

3-59 3.9 Ice Bed Lower Plenum Doors (Ajar)

................................

...............................

3-64 3.10 Dynamic Shape Factor (Shape_Fact)

............................................................

3-66 3.11 Containment Rupture Pressure (Rupture) ................................

......................

3-69 3.12 Oxidation Kinetics (Ox_Model)

................................

....................................... 3-69 3.13 Time in Cycle (Cycle)

................................

.....................................................

3-75 4. Accident Progression Analysis

................................

....................................................

4-1 4.1 Overall Response to Hydrogen Generation and Combustion

...........................

4-2 4.2 Summary of UA Results

................................

.................................................

4-11 4.3 Analysis of Select Realization s ................................

...................................... 4-14 Reference STSBO Realization

...........................................................

4-18 Global Hydrogen Behavior in Select Realizations

...............................

4-30 Comparative Discussions

................................................................... 4-49 4.4 STSBO Source Term Parameter Uncertainty Analysis

................................

... 4-67 Uncertainty Evaluations

................................

...................................... 4-67 Overview of Focused Pressurizer Safety Valve Study

........................

4-98 4.5 Summary of MELCOR Modeling Errors

................................

.......................

4-103 4.6 Hydrogen Igniter Benefit Analysis

................................

4-104 4.7 Reactor Coolant Pump Seal Leakage Sensitivity Analysis

...........................

4-110 4.8 LTSBO Accident Progression Analysis

................................

........................

4-129 LTSBO Accident Progression

...........................................................

4-133 LTSBO Radionuclide Behavior

.........................................................

4-145 LTSBO Accident Progression Sensitivity Calculations

......................

4-147 LTSBO Ignition Sensitivity Cases

................................

.....................

4-157 LTSBO RCP Seal Leakage Sensitivity Case

................................

.... 4-161 5. Sequoyah MACCS Model

................................

............................................................

5-1 5.1 Introduction

................................

................................................................

...... 5-1 5.2 Site Location and Surrounding Area

................................

. 5-3 v 5.3 Site Demographics and Economic Data

................................

...........................

5-7 5.4 Site Topography and Land Cover ................................

.................................... 5-8 5.5 Meteorological Data

................................

.........................................................

5-8 Selection of Representative Weather Data

................................

......... 5-10 Sequoyah Site Meteorological Features

.............................................

5-11 Weather Sampling

................................

..............................................

5-14 5.6 Atmospheric Transport and Dispersion

................................

..........................

5-15 Radiological Release Information

................................

.......................

5-16 Surface Roughness

............................................................................

5-16 Atmospheric Dispersion

................................

...................................... 5-17 Dry and Wet Deposition

................................

...................................... 5-17 5.7 Protective Action Parameters

................................

......................................... 5-18 Cohort Definitions

................................

...............................................

5-19 Emergency Response Timelines

................................

........................

5-24 Shielding from Radiation Exposures

................................

...................

5-26 Hotspot Relocation Time (TIMHOT) and Dose (DOSHOT)

.................

5-28 Normal Relocation Time (TIMNRM) and Dose (DOSNRM)

................

5-29 Intermediate and Long

-Term Phase s ................................

.................

5-29 5.8 Dosimetry and Health Effects

................................

......................................... 5-30 Exposure and Commitment Periods

................................

...................

5-31 Dose-Response Models

..................................................................... 5-31 5.9 Uncertain MACCS Input Parameters and Distributions

................................

.. 5-32 Wet Deposition Model (CWASH1)

................................

......................

5-37 Dry Deposition Velocities (VDEPOS)

................................

..................

5-39 Shielding Factors (GSHFAC and PROTIN) ................................

........ 5-43 Early Health Effects (EFFACA, EFFACB, EFFTHR)

...........................

5-51 Latent health effect parameters (DDREFA, CFRISK, Committed Inhalation Dose Coefficients)

................................

..............................

5-55 Dispersion (CYSIGA, CZSIGA)

................................

..........................

5-61 Weather Forecast (KEYFORCST)

................................

......................

5-65 Time-Based Crosswind Dispersion Coefficient (CYCOEF)

.................

5-66 Emergency Response (Evacuation and Relocation)

...........................

5-67 6. Offsite Consequence Analysis

................................

.....................................................

6-1 6.1 Introduction

................................

................................................................

...... 6-1 6.2 Uncertainty Analysis for the Unmitigated STSBO Scenario

..............................

6-2 LCF Risks for the Unmitigated STSBO Scenario

................................

.. 6-3 vi Results for Early Fatality Risks

.............................................................

6-8 6.3 Evaluation of Selected Realizations

................................................................

. 6-8 MACCS Results from Selected UA Realizations

................................

... 6-8 Deterministic Analysis of Individual Latent Cancer Fatality Risk

......... 6-14 6.4 Regression Analysis of Latent Cancer Fatality Risk

....................................... 6-25 6.5 Sensitivity Analyses

................................

.......................................................

6-31 Sensitivity Analysis One: Evaluation of Shelter

-in-Place Risk

.............

6-32 Sensitivity Analysis Two: Evaluation of Shielding Factor Risk

.............

6-34 Sensitivity Analysis Three: Evaluation of Weather Year Risk Impact

.. 6-42 Sensitivity Analysis Four: Alternate Approaches to Quantify Cancer Risk Results ................................

...............................................................

6-45 6.6 Summary ................................

................................................................

....... 6-48 7. Conclusions

................................

................................................................

.................

7-1 7.1 MELCOR Analysis

................................

...........................................................

7-2 STSBO Uncertainty Assessment Insights

................................

.............

7-2 STSBO Uncertainty Key Regression Results

....................................... 7-6 STSBO and LTSBO Sensitivity Insights

...............................................

7-6 Focused Pressurizer Safety Valve Study

................................

..............

7-8 7.2 MACCS Analysis

..............................................................................................

7-9 Uncertainty Insights

..............................................................................

7-9 Sensitivity Insights

................................

..............................................

7-10 7.3 Summary ................................

................................................................

....... 7-11 8. References

................................

................................................................

..................

8-1 Uncertainty Quantification and Propagation

................................

........................

A-1 Input Parameters for Consequence Analysis

................................

......................

B-1 Roadway Capacity Analysis

................................................................................

C-1 MELCOR Code Update and Model Revision Comparison

................................

... D-1 Appendix E Model Errors

................................

................................................................

....... E-1 Appendix F Glossary of UncertaInty Analysis Terms

................................

.............................

F-1 Appendix G MACCS STSBO UA Regression Information

................................

.....................

G-1 Appendix H MACCS Model Updates

................................

.....................................................

H-1 Appendix I Focused Pressurizer Safety Valve Study

................................

...............................

I-1 vii LIST OF FIGURES Figure Page Figure ES-1 Comparison of hydrogen production in current UA and draft UA MOC cases

. xxxiii Figure ES-2 Containment pressure response for the STSBO UA realizations

....................

xxxv Figure ES-3 Cesium (left) and iodine (right) environmental release fraction horsetails based on the STSBO UA realizations.

................................

......................................xxxvi Figure ES-4 Complimentary cumulative distribution functions of conditional individual LCF risk within five intervals (annuli) centered on Sequoyah

................................

........xxxix Figure 1-1 Typical Containment Volumes and Design Pressures

................................

...... 1-4 Figure 1-2 View of Sequoyah from the north to the south

................................

..................

1-5 Figure 1-3 Diagram of code information flow for uncertainty analysis

................................

1-8 Figure 3-1 MELCOR COR/CVH nodalization.

................................................................... 3-6 Figure 3-2 Upper RPV CVH/FL nodalization.

................................

.................................... 3-7 Figure 3-3 MELCOR radial nodalization of Sequoyah core.

................................

..............

3-9 Figure 3-4 Mapping of core power distribution to MELCOR COR rings.

............................

3-9 Figure 3-5 Axial distribution of decay power for Sequoyah MELCOR model.

..................

3-10 Figure 3-6 Sequoyah decay heat curves on logarithmic time scale.

................................

3-12 Figure 3-7 Sequoyah decay heat curves on severe accident time scale.

........................

3-12 Figure 3-8 Natural circulation flow patterns in a PWR.

................................

....................

3-15 Figure 3-9 Sequoyah reactor coolant system hydrodynamic nodalization.

......................

3-16 Figure 3-10 Sequoyah steam generator lumped Loop 2.

................................

...................

3-17 Figure 3-11 Pressurizer relief tank heat structure nodalization.

................................

......... 3-19 Figure 3-12 Containment nodalization. ..............................................................................

3-21 Figure 3-13 Sequoyah ice condenser nodalization.

................................

...........................

3-22 Figure 3-14 Three-dimensional finite element model of the Sequoyah containment.

......... 3-25 Figure 3-15 Flammability limits for hydrogen for Air

-H 2-H 2O systems.

...............................

3-29 Figure 3-16 Combustion of hydrogen and air mixtures near lean limits for upward propagation of the flame.

................................

................................................................

... 3-29 Figure 3-17 Turbine Driven Auxiliary Feed Water System Flow Diagram.

.........................

3-31 Figure 3-18 Depiction of the fuel rod degradation.

.............................................................

3-37 Figure 3-19 Parameter storyboard used to capture key information for each parameter investigated

................................

................................................................

.... 3-40 Figure 3-20 Cumulative probablities (per valve) of an FTC event on initial demand for the pressurizer SVs (priSVcycles) and the resulting distribution of FTC on initial demand.. ................................................................................................

........ 3-46 viii Figure 3-21 Cumulative probabilities (per valve) of an FTC event on subsequent demand for the pressurizer SVs (priSVcycles) and the resulting distributions of cycles

-to-failure on subsequent demand..

................................

..................................... 3-46 Figure 3-22 Cumulative probabilities (per valve) of a FTC event on initial demand for the pressurizer SVs (priSVcycles)..

...................................................................... 3-48 Figure 3-23 Cumulative distribution (per valve) of a FTC event on subsequent demands for the pressurizer SVs (priSVcycles)..

................................

3-48 Figure 3-24 Notional example illustrating a beta distribution on a failure probability and the family of distribution in trials until failure that results from the uncertain failure probablity.

................................

................................................................

...... 3-49 Figure 3-25 Cumulative probablity of all three primary SVs failing closed compared to a single SV failing open.

................................

..............................................................

3-50 Figure 3-26 The density function for SV open area fraction (priSVfrac) for each pressurizer SV. ................................

................................................................

.................

3-52 Figure 3-27 CDF for the pressurizer SV FTC open area fraction (priSVfrac).

....................

3-52 Figure 3-28 Pressurizer SV FTC open area fraction (priSVfrac) comparision between current UA and DRAFT UA.

................................

.......................................................

3-53 Figure 3-29 Process flow diagram for the secondary SV open area fraction and number of cycles until failure for the single SG loop.

................................

.......................

3-54 Figure 3-30 CDF of effective temperature of the eutectic reaction temperature.

................

3-57 Figure 3-31 Uncertainty distribution for ignition propagation direction.

..............................

3-58 Figure 3-32 Barrier seal section.

................................

.......................................................

3-59 Figure 3-33 Barrier seal failure area probability.

................................

3-60 Figure 3-34 Probability density of barrier seal failure versus differential pressure.

............

3-61 Figure 3-35 Cumulative probability of the barrier seal failure versus differential pressure.

3-62 Figure 3-36 Barrier seal pressure versus temperature failure criteria.

...............................

3-63 Figure 3-37 Example of a sampled seal failure at 40 psid.

................................

................

3-63 Figure 3-38 Fraction of LP doors held fully open.

................................

..............................

3-65 Figure 3-39 Ice chest lower door opening characteristics.

................................

.................

3-66 Figure 3-40 Dynamic shape factor compared to number of spheres within a chain.

..........

3-68 Figure 3-41 CDF of the dynamic shape factor.

................................

.. 3-68 Figure 3-42 CDF of the rupture parameter.

....................................................................... 3-69 Figure 3-43 Comparison of the hydrogen generation from steel oxidation in a realization with hot leg failure from high

-pressure and no pressurizer SV failure.

...................

3-71 Figure 3-44 Comparison of the core structures at the time of the accumulator discharge.

. 3-71 Figure 3-45 Urbanic and Heidrick Steam

-Zircaloy Oxidation Kinetics Rate Coefficient.

..... 3-73 Figure 3-46 Oxidation Rate Coefficient Correlations used for sampling.

............................

3-74 Figure 3-47 Probability assigned to each oxidation kinetics rate constant correlation.

....... 3-75 ix Figure 3-48 Sequoyah decay heat at specified times

........................................................

3-76 Figure 3-49 Sequoyah decay heat on a log

-log scale at specified times.

..........................

3-77 Figure 3-50 Activity levels for I

-131 and Cs

-137 with respect to time in cycle.

...................

3-78 Figure 3-51 Illustration of the time in cycle definitions, point values, and the proportion of realizations in each interval.

................................

...........................................

3-79 Figure 3-52 Percentage of realizations for the time in cycle intervals.

...............................

3-80 Figure 3-53 CDF for days into cycle at which the accident occurs.

................................

.... 3-80 Figure 4-1 Comparison of hydrogen production in current UA and draft UA MOC cases

... 4-3 Figure 4-2 Comparison of MOC early containment failures in current UA and draft UA

..... 4-5 Figure 4-3 Effect of SV open area fraction in current UA and draft UA

..............................

4-5 Figure 4-4 Effect of SV no FTC in current UA and draft UA

...............................................

4-6 Figure 4-5 Effect of oxidation kinetics in current UA and draft UA

................................

..... 4-7 Figure 4-6 Effect of decay heat on hydrogen combustion in current UA

............................

4-8 Figure 4-7 Comparison of current UA, draft UA, and focused SV study

............................

4-9 Figure 4-8 Rlz 554 Integral Hydrogen Flows and In

-Vessel Hydrogen Production

...........

4-10 Figure 4-9 Rlz 266 Integral Hydrogen Flows and In

-Vessel Hydrogen Production

...........

4-10 Figure 4-10 ...............................

4-13 Figure 4-11 ......................

4-13 Figure 4-12 Hydrogen accumulation in the containment dome

................................

..........

4-15 Figure 4-13 Horsetails of environmental cesium release

...................................................

4-16 Figure 4-14 Horsetails of environmental iodine release

................................

.....................

4-17 Figure 4-15 Horsetails of in

-vessel hydrogen production

...................................................

4-17 Figure 4-16 Horsetails of containment pressure response

................................

................

4-18 Figure 4-17 Reference calculation RCS pressure

................................

.............................

4-19 Figure 4-18 Reference calculation reactor core water level

...............................................

4-19 Figure 4-19 Reference calculation in

-vessel hydrogen production

................................

.... 4-20 Figure 4-20 Reference calculation steam generator pressure

................................

...........

4-20 Figure 4-21 Reference calculation steam generator water level

................................

........ 4-21 Figure 4-22 Reference calculation containment hydrogen concentration and burn energy ------------------------------..

4-22 Figure 4-23 Reference calculation containment steam concentration and burn energy

..... 4-22 Figure 4-24 Reference calculation containment oxygen concentration and burn energy

... 4-23 Figure 4-25 Reference calculation containment dome gas concentrations and burn energy ------------------------------..

4-23 Figure 4-26 Reference calculation containment burn energy and pressure

.......................

4-24 Figure 4-27 Reference calculation core debris to reactor cavity

................................

........ 4-25 x Figure 4-28 Reference calculation containment temperature

................................

............

4-25 Figure 4-29 Reference calculation ice melt

................................

....................................... 4-26 Figure 4-30 Reference calculation containment dome partial pressures

...........................

4-26 Figure 4-31 Reference calculation concrete ablation

................................

.........................

4-27 Figure 4-32 Reference calculation pressurizer aggregate SV cycles and open area fraction ------------------------------.

4-28 Figure 4-33 Reference calculation cesium distribution

................................

......................

4-28 Figure 4-34 Reference calculation iodine distribution

................................

........................

4-29 Figure 4-35 Reference calculation PRT and containment water level

................................

4-29 Figure 4-36 Reference calculation PRT temperature

................................

........................

4-30 Figure 4-37 Reference Case (Rlz 266): Source Hydrogen and Burn Behavior

..................

4-32 Figure 4-38 Reference Case (Rlz 266): Burn Location and Containment Pressure

...........

4-32 Figure 4-39 Realization 554 Early Failure: Source Hydrogen and Burn Behavior ..............

4-33 Figure 4-40 Realization 554 Early Failure: Burn Location and Containment Pressure

....... 4-34 Figure 4-41 Realization 307 Late Failure: Source Hydrogen and Burn Behavior

...............

4-35 Figure 4-42 Realization 307 Late Failure: Burn Location and Containment Pressure

........ 4-35 Figure 4-43 Realization 316: Low H2 Prz Venting: Source Hydrogen and Burn Behavior

. 4-37 Figure 4-44 Realization 316 Low H2 Pzr Venting: Burn Location & Containment Pressure -----------------------------..

4-37 Figure 4-45 Realization 316 Integral Oxygen Flows from Upper to Lower Containment

.... 4-38 Figure 4-46 Realization 370: High H2 Prz Venting: Source Hydrogen and Burn Behavior -----------------------------..

4-38 Figure 4-47 Realization 370 High H2 Pzr Venting: Burn Location & Containment Pressure -----------------------------..

4-39 Figure 4-48 Realization 318: High Total H2: Source Hydrogen and Burn Behavior

...........

4-39 Figure 4-49 Realization 318 High Total H2: Burn Location & Containment Pressure

........ 4-40 Figure 4-50 Realization 36: High Cs Release: Source Hydrogen and Burn Behavior

........ 4-40 Figure 4-51 Realization 36 High Cs Release: Burn Location & Containment Pressure

..... 4-41 Figure 4-52 Airborne CsI and Cs 2MoO 4 for Realization 36 ................................

................

4-41 Figure 4-53 Realization 432: Early RPV Breach: Source Hydrogen and Burn Behavior

.... 4-42 Figure 4-54 Realization 432: Early RPV Breach: Burn Location & Containment Pressure -----------------------------..

4-43 Figure 4-55 Realization 328: Late RPV Breach: Source Hydrogen and Burn Behavior

..... 4-44 Figure 4-56 Realization 328: Late RPV Breach: Burn Location & Containment Pressure

.. 4-44 Figure 4-57 Realization 562 No HL Rupture: Source Hydrogen and Burn Behavior

..........

4-45 Figure 4-58 Realization 562 No HL Rupture: Burn Location & Containment Pressure

...... 4-45 xi Figure 4-59 Realization 395: Early Cont Failure: Source Hydrogen and Burn Behavior

.... 4-46 Figure 4-60 Realization 395: Early Cont Failure: Burn Location & Containment Pressure -----------------------------..

4-46 Figure 4-61 Realization 128 Early Cont. Failure: Source Hydrogen and Burn Behavior

.... 4-47 Figure 4-62 Realization 128 Early Cont. Failure: Burn Location & Containment Pressure -----------------------------..

4-48 Figure 4-63 Containment rupture timing across the full set of UA realizations

...................

4-49 Figure 4-64 In-vessel hydrogen production across the full set of UA realizations

..............

4-50 Figure 4-65 Hydrogen vented from the RCS to containment through the PRT by the time of the first burn across the full set of UA realizations

................................

..........

4-50 Figure 4-66 Hydrogen in the containment dome by the time of the first burn across the full set of UA realizations

...........................................................................................

4-51 Figure 4-67 Realization 562 versus Realization 395 burn energy and containment dome pressure ................................................................................................

......... 4-54 Figure 4-68 Pressure difference between upper and lower containment during the first burn in Realization 395

................................

..............................................................

4-55 Figure 4-69 Hydrogen accounting in Realization 316 where no FTC of a pressurizer SV occurred and hot PRT gases ignited the first burn

................................

..........

4-56 Figure 4-70 Hydrogen accounting in Realization 370 where a FTC of a pressurizer SV occurred and hot PRT gases ignited the first burn

................................

..........

4-56 Figure 4-71 Realization 316 integral hydrogen flows and i n-vessel hydrogen production ----------------------------..

4-57 Figure 4-72 Realization 370 integral hydrogen flows and i n-vessel hydrogen production ----------------------------...

4-57 Figure 4-73 Realization 370 and Realization 395 burn energy and containment dome pressure ................................

................................................................

......... 4-58 Figure 4-74 Realization 370 lower containment (CV

-8) conditions with respect to a burn starting within it; as opposed to propagating to it

................................

............

4-59 Figure 4-75 Realization 554 reactor cavity (CV

-1) conditions with respect to a burn starting within it; as opposed to propagating to it

................................

........................

4-60 Figure 4-76 Realization 316 lower containment (CV

-9) conditions with respect to a burn starting within it; as opposed to propagating to it

................................

............

4-60 Figure 4-77 Comparison of lower ice compartment door behavior in Realizations 370, 554, and 316 ................................

................................................................

..........

4-62 Figure 4-78 Hydrogen accounting in Realization 554 where no FTC of a pressurizer SV occurred and the first burn occurred immediate to hot leg rupture

..................

4-63 Figure 4-79 Potential Ignition Sources in Realization 395

.................................................

4-63 Figure 4-80 Lower containment water level in the in Realization 395

................................

4-65 Figure 4-81 Hydrogen in the Containment Dome at First Burn Across the Full Set of UA Calculations

................................

................................................................

... 4-65 xii Figure 4-82 Realization 36 cesium distribution.

................................

. 4-66 Figure 4-83 Cesium release fractions for BOC (left), MOC (center), and EOC (right)

........ 4-70 Figure 4-84 Containment pressure colored by BOC, MOC, and EOC

...............................

4-71 Figure 4-85 CDF for the Cesium environmental release fraction

....................................... 4-72 Figure 4-86 Recursive partitioning tree for cesium environmental release fraction

............

4-74 Figure 4-87 Scatterplot of cesium environmental release fraction versus priSVcycles

...... 4-76 Figure 4-88 Scatterplot of cesium environmental release fraction versus time in cycle at reactor shutdown

...........................................................................................

4-77 Figure 4-89 Scatterplot of cesium environmental release fraction versus time of containment rupture ................................................................................................

...........

4-78 Figure 4-90 Scatterplot of Eu_Melt_T vs. priSVcycles with color contour for cesium release fraction ................................................................................................

...........

4-79 Figure 4-91 Iodine environmental release fractions for BOC, MOC, and EOC, respectively

.

4-80 Figure 4-92 CDFs for the iodine class environmental release fraction

...............................

4-81 Figure 4-93 Recursive partitioning tree for iodine environmental release fraction

..............

4-84 Figure 4-94 Scatterplot of iodine environmental release fraction vs. time in cycle at shutdown -----------------------------.

4-85 Figure 4-95 Scatterplot of iodine environmental release fraction versus SV_Frac

.............

4-86 Figure 4-96 Rupture pressure vs. priSVcycles with color contour of iodine environmental release fraction

................................

..............................................................

4-87 Figure 4-97 Iodine environmental release fraction vs. Eu_Melt_T on linear (left) and logarithmic (right) scales

................................

................................................

4-88 Figure 4-98 In-vessel hydrogen generation for BOC, MOC, and EOC

...............................

4-89 Figure 4-99 In-vessel hydrogen production for all successful cases

................................

.. 4-90 Figure 4-100 CDFs for in-vessel hydrogen

..........................................................................

4-91 Figure 4-101 CDFs for hydrogen production to 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months ................................

.....................

4-91 Figure 4-102 Recursive partitioning tree for hydrogen production

................................

....... 4-93 Figure 4-103 Scatterplot of in

-vessel hydrogen production vs. the aggregate primary SV cycles, colored by time in cycle

................................

...................................... 4-95 Figure 4-104 Scatterplot of in

-vessel hydrogen production vs. Eu_Melt_T with trend lines

.. 4-95 Figure 4-105 Scatterplot of in

-vessel hydrogen production vs. Eu_Melt_T with trend lines for BOC, MOC, and EOC simulations coded by oxidation model

........................

4-96 Figure 4-106 Scatterplot of in

-vessel hydrogen production vs. Ox_Model

...........................

4-98 Figure 4-107 Time to containment failure plotted against the containment rupture pressure -----------------------------

4-100 xiii Figure 4-108 Difference between peak containment pressure and sampled containment fragility plotted against maximum hydrogen reaching the dome around the time of burn initiation in the dome.

...........................................................................

4-101 Figure 4-109 Cesium release fraction (left) and iodine release fraction (right) versus time (yellow=BOC, blue=MOC, red=EOC).

................................

..........................

4-102 Figure 4-110 Cumulative cesium release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months plotted against the pressurizer safety valve open area.

................................

................................................

4-102 Figure 4-111 Cumulative iodine release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months plotted against the pressurizer safety valve open area.

................................

................................................

4-103 Figure 4-112 Comparison of the short

-term containment dome pressures in the STSBO igniter sensitivity study.

................................

...........................................................

4-106 Figure 4-113 Comparison of the dome hydrogen mass and mole fraction in the STSBO igniter sensitivity study.

................................

...........................................................

4-107 Figure 4-114 Comparison of the total and dome burn energy in the STSBO igniter sensitivity study. ................................

................................................................

...........

4-107 Figure 4-115 Comparison of the long

-term containment dome pressures in the STSBO Igniter sensitivity study.

................................

...........................................................

4-108 Figure 4-116 Comparison of the cesium and Iodine environmental releases in the STSBO igniter sensitivity study.

................................................................................

4-109 Figure 4-117 Comparison of the cesium and Iodine mass fractions in the primary system for the STSBO igniter sensitivity study.

................................

.............................

4-109 Figure 4-118 Comparison of the Pressurizer Pressures in the Rlz 21 RCP Sensitivity Study ------------------------------.

4-115 Figure 4-119 Comparison of the Containment Pressures in the Rlz 21 RCP Sensitivity Study ------------------------------.

4-115 Figure 4-120 Comparison of the Ice Melts in the Rlz 21 RCP Sensitivity Study

.................

4-116 Figure 4-121 Comparison of the RCS Water Mass in the Rlz 21 RCP Sensitivity Study

... 4-116 Figure 4-122 Comparison of the In

-vessel Hydrogen Generation in the Rlz 21 RCP Sensitivity Study ................................

................................................................

...........

4-117 Figure 4-123 Comparison of the RCP and PRT Hydrogen Leakages in the Rlz 21 RCP Sensitivity Study

................................

..........................................................

4-117 Figure 4-124 Comparison of the Iodine and Cesium Environmental Release in the Rlz 21 RCP Sensitivity Study

................................

..........................................................

4-11 8 Figure 4-125 Comparison of the Pressurizer Pressures in the Rlz 554 RCP Sensitivity Study ------------------------------.

4-118 Figure 4-126 Comparison of the Containment Pressures in the Rlz 554 RCP Sensitivity Study ------------------------------..

4-119 Figure 4-127 Comparison of the Ice Melt in the Rlz 554 RCP Sensitivity Study

................

4-119 Figure 4-128 Comparison of the RCS Water Mass in the Rlz 554 RCP Sensitivity Study ------------------------------.

4-120 xiv Figure 4-129 Comparison of the In

-vessel Hydrogen Generation in the Rlz 554 RCP Sensitivity Study ................................

................................................................

...........

4-120 Figure 4-130 Comparison of the RCP and PRT Hydrogen Leakages in the Rlz 554 RCP Sensitivity Study

..........................................................................................

4-121 Figure 4-131 Comparison of the Iodine and Cesium Environmental Release in the Rlz 554 RCP Sensitivity Study

..................................................................................

4-121 Figure 4-132 Comparison of the Iodine and Cesium In

-vessel Retention in the Rlz 554 RCP Sensitivity Study

..........................................................................................

4-122 Figure 4-133 Comparison of the various hot gas auto

-ignition source in the containment for Rlz 21 RCP seal leakage sensitivity study.

................................

.........................

4-127 Figure 4-134 Comparison of the potential hot gas auto

-ignition source in the containment for Rlz 554 RCP seal leakage sensitivity study.

................................

.................

4-128 Figure 4-135 Case LTSBO

-0 primary and secondary pressure history

..............................

4-136 Figure 4-136 Case LTSBO

-0 accumulator injection

..........................................................

4-136 Figure 4-137 Case LTSBO-0 secondary system water level and valve history

..................

4-138 Figure 4-138 Case LTSBO

-0 primary system water level history

................................

...... 4-138 Figure 4-139 Case LTSBO

-0 peak cladding, core and hot leg gas, and hot leg wall temperature history.

................................

.....................................................

4-140 Figure 4-140 Case LTSBO

-0 hot leg creep rupture failure index.

................................

...... 4-140 Figure 4-141 Case LTSBO

-0 decay heat and oxidation power.

................................

......... 4-141 Figure 4-142 Case LTSBO

-0 peak fuel and debris history.

................................

...............

4-141 Figure 4-143 Case LTSBO

-0 core structure at HL failure.

.................................................

4-142 Figure 4-144 Case LTSBO

-0 containment pressure history.

................................

.............

4-142 Figure 4-145 Case LTSBO

-0 ice melting history.

................................

..............................

4-143 Figure 4-146 Case LTSBO

-0 in-vessel hydrogen generation.

................................

...........

4-144 Figure 4-147 Case LTSBO

-0 containment water level and concrete ablation history.

....... 4-145 Figure 4-148 Case LTSBO

-0 Iodine fission product distribution history.

............................

4-146 Figure 4-149 Case LTSBO

-0 Cesium fission product distribution history.

.........................

4-146 Figure 4-150 LTSBO-0 through LTSBO

-5 reactor pressurizer pressure responses.

..........

4-149 Figure 4-151 LTSBO-0 through LTSBO

-5 reactor level responses.

................................

... 4-149 Figure 4-152 LTSBO-0 through LTSBO

-5 single steam generator pressure responses.

... 4-150 Figure 4-153 LTSBO-0 through LTSBO

-5 lumped triple steam generator pressure responses ----------------------------

. 4-150 Figure 4-154 LTSBO-0 through LTSBO

-5 single steam generator level responses.

..........

4-151 Figure 4-155 LTSBO-0 through LTSBO

-5 lumped triple steam generator level responses ----------------------------

. 4-151 Figure 4-156 LTSBO-0 through LTSBO

-5 accumulator injection responses.

.....................

4-152 xv Figure 4-157 LTSBO-0 through LTSBO

-5 in-vessel hydrogen production results.

.............

4-152 Figure 4-158 LTSBO-0 through LTSBO

-5 containment pressure responses.

....................

4-153 Figure 4-159 Comparison of LTSBO

-0 and LTSBO

-1 Iodine and Cesium in the PRT.

...... 4-154 Figure 4-160 Comparison of LTSBO

-0 and LTSBO

-1 PRT levels and gas temperatures.

. 4-155 Figure 4-161 Comparison of LTSBO

-4 and LTSBO

-4a pressurizer pressure responses.

.. 4-157 Figure 4-162 Comparison of LTSBO

-0 ignition sensitivity containment pressure responses ----------------------------

. 4-159 Figure 4-163 Comparison of LTSBO

-1 ignition sensitivity containment pressure responses ----------------------------

. 4-159 Figure 4-164 LTSBO-1a iodine fission product distribution.

................................

...............

4-160 Figure 4-165 LTSBO-1a cesium fission product distribution.

................................

.............

4-160 Figure 4-166 Comparison of the Pressurizer Pressures in the LTSBO

-1 RCP Sensitivity Study ------------------------------

. 4-163 Figure 4-167 Comparison of the Containment Pressures in the LTSBO

-1 RCP Sensitivity Study. ................................

................................................................

..........

4-163 Figure 4-168 Comparison of the Ice Melts in the LTSBO

-1 RCP Sensitivity Study.

...........

4-164 Figure 4-169 Comparison of the RCS Water Mass in the LTSBO

-1 RCP Sensitivity Study ------------------------------

. 4-164 Figure 4-170 Comparison of the In

-vessel Hydrogen Generation in the LTSBO

-1 RCP Sensitivity Study.

................................

..........................................................

4-165 Figure 4-171 Comparison of the RCP and PRT Hydrogen Leakages in the LTSBO

-1 RCP Sensitivity Study.

................................

..........................................................

4-165 Figure 5-1 Sequoyah Nuclear Power Plant site with 50

-mile radius

................................

... 5-4 Figure 5-2 Sequoyah 2 mile, 5 mile and 10 mile radial distances and EPZ sectors

...........

5-5 Figure 5-3 Sequoyah site boundary and aerial layout

................................

.......................

5-6 Figure 5-4 Monthly precipitation by year (inches)

................................

............................

5-11 Figure 5-5 2012 stability class frequency annually and by time of day

............................

5-13 Figure 5-6 Sequoyah combined wind rose plots for 2012 and 2008

- 2012 ....................

5-1 4 Figure 5-7 Wind speed bins for 2012

..............................................................................

5-14 Figure 5-8 Illustration of keyhole expansion from a wind shift

................................

..........

5-23 Figure 5-9 Sequoyah emergency response timeline and travel speeds

...........................

5-25 Figure 5-10 CDF of the linear coefficient in the MACCS wet deposition model, CWASH1 -----------------------------.

5-39 Figure 5-11 CDF of dry deposition velocities for mass median diameters representing MACCS aerosol bins

................................

......................................................

5-42 Figure 5-12 Cumulative distribution function of GSDE ................................

......................

5-44 Figure 5-13 GSHFAC cumulative distribution from Table 4.11 of Gregory, et al

................

5-45 xvi Figure 5-14 CDF of GSHFAC for evacuation accounting for uncertainty in GSDE

............

5-46 Figure 5-15 Cumulative distribution functions of GSHFAC (including GSDE) for sheltering, evacuation, and normal activity for all cohorts

................................................

5-47 Figure 5-16 CDFs of PROTIN and LPROTIN for normal activity, sheltering, and evacuation

..

5-50 Figure 5-17 CDFs of EFFACA for specified health effects

................................

.................

5-53 Figure 5-18 CDFs of EFFACB for specified health effects

................................

.................

5-54 Figure 5-19 CDFs of EFFTHR for specified health effects

................................

.................

5-55 Figure 5-20 CDFs of DDREFA for breast and other cancer types

................................

..... 5-56 Figure 5-21 CDF for CFRISK for each of the included organs

................................

...........

5-58 Figure 5-22 Cs-137 lifetime inhalation dose coefficient distributions for organs included in the consequence analysis

................................

....................................................

5-60 Figure 5-23 Pu-241 long-term inhalation dose coefficient distributions for organs included in the consequence analysis

................................

..............................................

5-61 Figure 5-24 CDFs of CYSIGA for individual stability classes

.............................................

5-64 Figure 5-25 CDFs of CZSIGA for each of the stability classes

................................

..........

5-65 Figure 5-26 CDF of KEYFORCST

................................

.....................................................

5-66 Figure 5-27 CDF of CYCOEF

................................

............................................................

5-67 Figure 5-28 CDF of DLTEVA for each cohort

................................

.................................... 5-72 Figure 5-29 CDFs of ESPEED for each cohort

.................................................................. 5-76 Figure 5-30 CDF of TIMHOT

................................

.............................................................

5-78 Figure 5-31 CDF of TIMNRM

................................

............................................................

5-79 Figure 5-32 CDF of DOSHOT

................................

...........................................................

5-80 Figure 5-33 CDF of DOSNRM

................................

...........................................................

5-81 Figure 6-1 Complimentary cumulative distribution functions of mean (over weather variability), individual LCF risk within five intervals (circles) centered on Sequoyah ................................................................................................

........ 6-4 Figure 6-2 Complimentary cumulative distribution functions of mean (over weather variability), individual LCF risk within five intervals (annuli) centered on Sequoyah -----------------------------..

6-5 Figure 6-3 Complimentary cumulative distribution functions of mean (over weather variability), individual LCF risk within five intervals (annuli) centered on Sequoyah plotted separately for cases with and without containment failure

....................

6-6 Figure 6-4 Complimentary cumulative distribution function of fraction of mean, individual LCF risk from the emergency phase for residents within five intervals (annuli) centered on Sequoyah

................................

.....................................................

6-7 Figure 6-5 Cesium release histories for the maximum cesium release fraction (Relalization

36) and maximum risk (Realization 554) realizations

...................

6-9 xvii Figure 6-6 Iodine release histories for the maximum cesium release fraction (Realization 36) and maximum risk (Realization 554) realizations

................................

...........

6-10 Figure 6-7 Complimentary cumulative distribution function of mean, individual LCF risk for the maximum

-cesium-release-fraction realization (Realization 36) within five concentric circle intervals centered on Sequoyah (probability represents weather variability)

................................

................................................................

...... 6-11 Figure 6-8 Complimentary cumulative distribution function of mean, individual LCF risk for the maximum

-cesium-release-fraction realization (Realization 36) within four annular area intervals centered on Sequoyah (probability represents weather variability)

................................

................................................................

...... 6-11 Figure 6-9 Complimentary cumulative distribution function of individual, LCF risk for the maximum-risk realization (Realization 554) within five concentric circle intervals centered on Sequoyah (probability represents weather variability)

.................

6-13 Figure 6-10 Complimentary cumulative distribution function of individual, LCF risk for the maximum-risk realization (Realization 554) within four annular area intervals centered on Sequoyah (probability represents weather variability)

.................

6-13 Figure 6-11 Cumulative environmental release fractions of cesium and iodine as a function of time for the STSBO reference case (Realization 266, Purple), the STSBO earliest release case (Realization 554, Blue), the STSBO with highest cesium release mass case (Realization 395, Red), and the STSBO with highest cesium release fraction (Realization 36, Green)

................................

..................................... 6-16 Figure 6-12 Conditional mean (over weather variability) individual LCF risk from the Sequoyah STSBO reference case (Realization 266) for residents within 0

-10, 10-20, and 0-50 mile intervals. The emergency

-phase contribution is indicated by the solid red and the long

-term contribution is indicated by the solid blue.

..... 6-17 Figure 6-13 Conditional, mean (over weather variability), individual, LNT, LCF risk per distance interval for Realization 266. The solid bar and hatched region represent the long-term- (including the intermediate phase) and emergency

-phase contributions, respectively, to the total risk.

................................

....................

6-18 Figure 6-14 Conditional mean (over weather variability) long

-term and emergency

-phase individual LNT, LCF risks for residents within 0

-10, 10-20, and 0-50 mile intervals of the plant

................................

................................................................

..... 6-20 Figure 6-15 Fraction of population remaining in EPZ and cesium (solid line) and iodine (dashed line) release fractions as a function of time for early containment failure Realization 554

................................

..............................................................

6-21 Figure 6-16 Fraction of population remaining in EPZ and iodine release fraction from early containment failure cases Realization 554 (solid line) and Realization 395 (dashed line) as a function of time

................................

. 6-22 Figure 6-17 Conditional mean (over weather variability) individual LNT LCF risk per distance interval for Realization 554. The solid bar and hatched region represent the long

-term and emergency phase contributions, respectively, to risk.

......................

6-23 Figure 6-18 Conditional mean (over weather variability) individual LNT LCF risk per distance interval for Realization 395. The solid bar and hatched region represent the long

-term and emergency phase contributions, respectively, to risk.

......................

6-24 xviii Figure 6-19 Conditional mean (over weather variability) individual LNT LCF risk per distance interval for Realization 36. The solid bar and hatched region represent the long

-term and emergency phase contributions, respectively, to risk.

......................

6-24 Figure 6-20 Scatter plot of mean, individual, LCF risk (conditional on the occurrence of a STSBO) within a 0

- to 50-mile interval versus the number of days of reactor operation from the beginning of a refueling cycle, Cycle

................................

6-28 Figure 6-21 Scatter plot of mean, individual, LCF risk (conditional on the occurrence of a STSBO) within a 0

- to 50-mile interval versus cancer fatality risk factor for residual cancers, CFRISK(8)

................................

..........................................

6-28 Figure 6-22 Scatter plot of mean, individual, LCF risk (conditional on the occurrence of a STSBO) within a 0

- to 50-mile interval versus containment rupture pressure, Rupture ................................

................................................................

..........

6-29 Figure 6-23 Scatter plot of mean, individual, LCF risk (conditional on the occurrence of a STSBO) within a 0

- to 50-mile interval versus cancer risk factor for lung cancer, CFRISK(4) ................................

................................................................

..... 6-30 Figure 6-24 Scatter plot of mean, individual, LCF risk (conditional on the occurrence of a STSBO) within a 0

- to 50-mile interval versus cancer risk factor for colon cancer, CFRISK(7) ................................

................................................................

..... 6-30 Figure 6-25 Scatter plot of mean, individual, LCF risk (conditional on the occurrence of a STSBO) within a 0

- to 50-mile interval versus normal relocation time, TIMNRM -----------------------------.

6-31 Figure 6-26 Conditional mean (over weather variability) individual LNT LCF risk for the emergency phase (hatched), and long

-term phase (Solid) for Realization 554 and the 12- and 48-hour shelter

-in-place sensitivities for the 0

- to 10-mile interval ------------------------------

. 6-32 Figure 6-27 Conditional mean (over weather variability) individual LNT LCF for the emergency phase (hatched), and long

-term Phase (solid) for the Realization 554 case (blue) and the 12

- and 48-hour shelter

-in-place scenarios when the 10-15 mile shadow cohort evacuates with an extended shelter

-in-place (red) and no shelter-in-place (purple) for the 0

- to 50-mile interval

................................

.... 6-34 Figure 6-28 Conditional mean (over weather variability) individual LNT LCF risk within the 0

- to 10-mile interval assuming degrees of degraded structures during an extended shelter-in-place for Realization 554

................................................................

6-37 Figure 6-29 Conditional mean (over weather variability) individual LNT LCF risk for sensitivities assuming 48

-hour shelter

-in-place and variation on shielding factors. The solid and hatched regions reflect the Long

-Term and Emergency Phase contribution to the risk. Red, purple, and green bars reflect nominal shielding parameters, a portion of the population in degraded structures, and those which reflect the entire population outside, respectively, with a 48

-hour shelter in place. Blue bars reflect nominal evacuation and shielding parameters.

....................

6-40 Figure 6-30 Fraction of population remaining in the EPZ (blue) and the iodine (solid) and cesium (dashed) release fraction for Realizations 146 (red) and 382 (purple) -----------------------------...

. 6-41 xix Figure 6-31 Conditional mean (over weather variability) individual LNT LCF risk. The solid bars reflect the long

-term contribution and the hatched bars reflect the emergency-phase ................................

..........................................................

6-43 Figure 6-32 Correlations between figures

-of-merit describing the yearly weather and output metrics ................................

................................................................

...........

6-44 Figure 6-33 Conditional mean (over weather variability) individual LCF risk as a function of risk quantification threshold for Realization 266

................................

.............

6-46 Figure 6-34 Conditional mean (over weather variability) individual LCF risk as a function of risk quantification threshold for Realization 554

.............................................

6-46 Figure 6-35 Conditional mean (over weather variability) individual LCF risk as a function of risk quantification threshold for Realization 395

.............................................

6-47 xx xxi LIST OF TABLES Table Page Table ES-1 Uncertain MELCOR parameters used in the unmitigated STSBO UA

.............

xxix Table ES-2 Uncertain MACCS parameter groups used in the unmitigated STSBO UA

....... xxx Table 3-1 Important Sequoyah Parameters

..................................................................... 3-4 Table 3-2 MELCOR rings,number of fuel assemblies, and relative power densities.

........ 3-8 Table 3-3 Prescribed BOC, MOC, and EOC characteristics for Sequoyah Cycle 14.

..... 3-11 Table 3-4 Lumped MELCOR RN

-class inventories.

................................

.......................

3-13 Table 3-5 Gaseous iodine inventories for BOC, MOC, and EOC of Sequoyah Cycle 14. ................................................................................................

........ 3-14 Table 3-6 Sequoyah ice condenser input parameters.

...................................................

3-23 Table 3-7 Best estimate of rupture pressures for the Sequoyah containment from various NRC-sponsored studies.

................................

................................................

3-25 Table 3-8 MELCOR sampled parameters.

................................

..................................... 3-41 Table 3-9 SV FTC data (from actual scram events) and associated epistemic uncertainty distributions for probability of occurrence on demand.

................................

... 3-45 Table 3-10 Notional example of a sample and corresponding MELCOR input.

................

3-50 Table 3-11 VERCORS test results for collapse temperature.

................................

...........

3-56 Table 3-12 Approximate time periods of cycle points.

................................

......................

3-76 Table 4-1 Select realization criteria and identification

................................

....................

4-14 Table 4-2 Sampled values of uncertain parameters in select realizations

......................

4-52 Table 4-3 Select figures of merit for realizations of interest

................................

............

4-53 Table 4-4 Regression table example

..............................................................................

4-68 Table 4-5 Post-calculated regression parameters

................................

..........................

4-68 Table 4-6 Summary of the number of realizations that were unsuccessful STSBO UA

.. 4-69 Table 4-7 Regression analysis summary of cesium environmental release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ................................

................................................................

......... 4-73 Table 4-8 Regression analysis of iodine environmental release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ...... 4-82 Table 4-9 Regression analysis of in

-vessel hydrogen production at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ................

4-92 Table 4-10 Summary of key uncertain parameters in igniter sensitivity study.

................

4-104 Table 4-11 Results of the STSBO igniter sensitivity study.

.............................................

4-105 Table 4-12 Summary of Key Uncertain Parameters in RCP Seal LOCA Sensitivity Study ................................................................................................

...........

4-111 Table 4-13 Results of the Realization 21 RCP LOCA Sensitivity Study

..........................

4-112 Table 4-14 Results of the Realization 554 RCP LOCA Sensitivity Study

........................

4-113 xxii Table 4-15 Comparison of the Timing and Location of Hot Gas Autoignition Sources in the Realization 21 RCP LOCA Sensitivity Study

................................

................

4-126 Table 4-16 Comparison of theTiming and Location of Hot Gas Autoignition Sources in the Realization 554 RCP LOCA Sensitivity Study

..............................................

4-127 Table 4-17 Description of the key parameters varied in the LTSBO calculations

............

4-130 Table 4-18 Description of the Uncertainty Parameter Distributions and the Reference Values used in the LTSBO Calculations

................................

.................................. 4-131 Table 4-19 Timing of key events for Case LTSBO

-0 ................................

......................

4-134 Table 4-20 Summary of key LTSBO case differences

................................

....................

4-147 Table 4-21 Results of the LTSBO calculations

................................

.................................. 148 Table 4-22 Summary of key LTSBO ignition sensitivity case differences

.......................

4-157 Table 4-23 Results of the LTSBO Calculations

................................

..............................

4-162 Table 5-1 Cumulative population and population density for selected distance intervals surrounding Sequoyah Unit 1

................................

...........................................

5-7 Table 5-2 Seasonal diurnal mixing heights for Tennessee (m)

................................

......... 5-9 Table 5-3 Meteorology data completion rates

................................

5-10 Table 5-4 Summary of precipitation by year (inches)

................................

.....................

5-10 Table 5-5 Summary of 2012 meteorological statistics

................................

....................

5-11 Table 5-6 Surface roughness within 30 miles of the Sequoyah site

................................

5-17 Table 5-7 Sequoyah evacuation cohorts

................................

........................................ 5-19 Table 5-8 Cohort evacuation type

..................................................................................

5-24 Table 5-9 Shielding and Protection Factors for Evacuating Cohorts

...............................

5-28 Table 5-10 Dose responses modeled

................................

..............................................

5-32 Table 5-11 Sequoyah MACCS model uncertain paramete rs ................................

............

5-34 Table 5-12 Uncertain MACCS parameters applied in the analysis

................................

... 5-35 Table 5-13 Dry deposition velocities

................................................................................

5-42 Table 5-14 Combined groundshine shielding factor (GSHFAC including GSDE)

.............

5-47 Table 5-15 Inhalation protection factors (PROTIN and LPROTIN) used for Sequoyah

..... 5-51 Table 5-16 Radionuclides treated as having uncertain inhalation dose coefficients.

........ 5-60 Table 5-17 Log-triangular values for dispersion parameter CYSIGA for each stability class ................................

................................................................

..............

5-63 Table 5-18 Log-triangular values for dispersion parameter CZSIGA for each stability class ................................

................................................................

..............

5-65 Table 5-19 MACCS uncertain parameters

- evacuation delay (DLTEVA).

.......................

5-72 Table 5-20 MACCS uncertain parameters

- evacuation speeds (ESPEED2)

..................

5-75 Table 5-21 MACCS correlated parameters

...................................................................... 5-82 xxiii Table 6-1 Mean individual LCF risk conditional on the STSBO accident occurring (per event) for five concentric circle intervals centered on Sequoyah

......................

6-3 Table 6-2 Mean individual LCF risk conditional on the STSBO accident occurring (per event) for four annular area intervals centered on Sequoyah

...........................

6-3 Table 6-3 Mean contribution of emergency phase to overall risk

................................

...... 6-7 Table 6-4 Fraction of STSBO realizations in which the emergency phase contributions to dose exceed those of the long term phase

.......................................................

6-7 Table 6-5 Integral release fractions for the maximum cesium release fraction (Realization

36) and maximum risk (Realization 554) realizations

..................

6-10 Table 6-6 Mean, individual LCF risks for the maximum-cesium-release-fraction realization (Realization 36), conditional on accident (per event) for the MACCS uncertainty analysis for five concentric circle intervals centered on Sequoyah (probability represents weather variability)

................................

....................................... 6-12 Table 6-7 Mean, individual LCF risks for the maximum-cesium-release-fraction realization (Realization 36), conditional on accident (per event) for the MACCS uncertainty analysis for four annular area intervals centered on Sequoyah (probability represents weather variability)

................................

....................................... 6-12 Table 6-8 Individual LCF risks for the maximum-risk realization (Realization 554), conditional on occurance of STSBO sequence (per event) for five circular areas centered on Sequoyah (statistic represents weather variability)

.....................

6-14 Table 6-9 Individual LCF risks for the maximum-risk realization (Realization 554), conditional on occurance of STSBO sequence (per event) for four intervals centered on Sequoyah (statistics represent weather variability)

.....................

6-14 Table 6-10 Source term releases for Sequoyah accident scenarios.

................................

6-15 Table 6-11 Summary of the mean (over weather variability) emergency, long

-term, and total individual conditional LNT latent cancer fatality risk for Realization 266

......... 6-17 Table 6-12 Summary of the conditional mean (over weather variability) emergency

-phase, long-term phase, and total individual LNT, LCF risks for residents within 0-10, 10-20, and 0-50 mile intervals of the plant

................................

.....................

6-19 Table 6-13 Mean, individual, LCF risk regression results within a 0

- t o 10-mile interval for all realizations based on LNT

................................

.............................................

6-26 Table 6-14 Mean, individual, LCF risk regression results within a 10

- to 20-mile interval for all realizations based on LNT

................................

.............................................

6-26 Table 6-15 Mean, individual, LCF risk regression results within a 0

- to 50-mile interval for all realizations based on LNT

................................

.............................................

6-26 Table 6-16 Conditional mean (over weather variability) individual LNT LCF risk for the emergeny phase, long

-term phase, and total risk within the 0

- to 10-mile interval ................................

................................................................

...........

6-32 Table 6-17 Conditional mean (over weather variability) individual early fatality risk for Realization 554 and the 12

- and 48-hour shelter

-in-place sensitivities.

..........

6-33 Table 6-18 Conditional, mean (over weather variability) individual LNT LCF risk for emergency, long

-term, and total risk for the 0

- to 50-mile interval for early 10

-15 mile shadow evacuation sensitivities

................................

..............................

6-33 xxiv Table 6-19 Sheltering shielding parameters for the cloudshine, inhalation, skin protection, and groundshine pathways reflecting differing degrees of degrade d structures

................................

................................................................

....... 6-35 Table 6-20 Summary of conditional mean (over weather variability) individual LNT LCF risk assuming degrees of degraded structures during an extended shelter in place within the 0

- to 10-mile interval

................................

....................................... 6-36 Table 6-21 Summary of conditional mean (over weather variability) individual early fatality risk assuming degrees of degraded structures during an extended shelter

-in-place ................................

................................................................

..............

6-38 Table 6-22 Selected source term scenarios with late containment releases.

....................

6-38 Table 6-23 Summary of conditional mean (over weather variability) individual LNT LCF risk for sensitivities assuming 48

-hour shelter in place and variations on shielding factors, reflecting degraded shielding structures, with late containment failure within 0- to 10-mile interval. Realization 554 is included for reference

...........

6-39 Table 6-24 Summary of Conditional mean (over weather variablity) individual LNT LCF risk using weather data for years 2008 through 2012

................................

...........

6-42 Table 6-25 Figures-of-Merit describing the weather data from the Sequoyah meteorological tower for years 2008 through 2012

................................

6-43 Table 6-26 Summary of correlations between figures of merit describing the yearly weather and output metrics

.........................................................................................

6-44 Table 6-27 Conditional mean (over weather variability) individual LNT LCF risk assuming alternative approaches to quantify cancer risk

................................

...............

6-45 Table 6-28 Summary of reduction in conditional mean (over weather variability) individual LNT LCF risk as a function of alternate cancer risk quantification methods normalized to the LNT method

................................

....................................... 6-47 xxv EXECUTIVE

SUMMARY

The state-of-the-art reactor consequence analyses (SOARCA) project addresses the consequences of rare but severe accidents at commercial U.S. reactors. By its nature SOARCA focuses on the consequence of accidents rather than on the many redundant safety systems, components, procedures, training, strategies, or the recently added backup mitigation equipment required following the Fukushima Daiichi nuclear power plant accident in Japan. Plant safety features and added mitigation capability drive down the likelihood of a severe accident but not necessarily the consequences. The study of the unmitigated consequences of a severe accident does not dismiss or under

-value those safety features, rather it sheds light on their importance by providing insights into the possible consequences they are intended to prevent.

All U.S. reactor designs rely on essentially leak

-tight containment structures as part of the defense-in-depth safety strategy to mitigate potential radiological effects of accidents at reactor facilities. For all but the rarest accidents, containment structures limit radioactive releases to relatively small leakage such that U.S. Nuclear Reactor Commission (NRC) radiological safety requirements are met.

Rare reactor accidents can involve reactor fuel melting, a failure of the reactor coolant system

, and challenges to the containment structure and its function as a barrier to the release of radioactive materials. The challenges to the containment function vary with containment designs, the specific scenario, and the associated accident progression phenomena posing that challenge. For this reason, the NRC has chosen to study challenging severe accident scenarios for a variety of containment design approaches. This report analyzes containment performance for an "ice condenser" containment design; a design in which the steam produced during a n accident is condensed by ice inside the containment thus suppressing the potential pressure increase within the containment structure so that its safety function can be effectively maintained.

Through the application of modern analysis tools and techniques, the SOARCA project has developed a body of knowledge regarding the realistic outcomes of potential severe reactor accidents. In the NRC's NUREG-1935, "State-of-the-Art Reactor Consequence Analyses (SOARCA) Report," SOARCA analyses of the Peach Bottom Atomic Power Station and Surry Power Station addressed two other containment approaches. Those pilot plant studies revealed insights into the accident progressio n and the offsite consequences of potential radioactive releases for important scenarios in a boiling water reactor (BWR) with a Mark I, pressure suppression containment design

, and a pressurized water reactor (PWR) with a large dry (subatmospheric) containment design, respectively

. This report addresses analys es of the loss of all onsite and offsite AC power (referred to as a station blackout or SBO) at the third SOARCA pilot plant, Sequoyah Nuclear Plant, expanding on the SOARCA body of knowledge for the next most prevalent containment design in the U.S., a PWR with an ice condenser containment. Compared to a PWR large dry containment, an ice condenser containment design has smaller volume and relies on steam condensation to produce a lower pressure. Since the presence of ice aids in steam condensation but has little effect on pressure demands associated with energy from a deflagration , hydrogen combustion has long been known to be a potential challenge to the ice condenser containment

s. The Sequoyah SOARCA analysis examines phenomenology and modeling unique to the ice xxvi condenser design including the behavior of hydrogen and the potential for early containment failure from an energetic hydrogen combustion.

Scope and Approach While the Peach Bottom and Surry SOARCA analyses in NUREG-1935 considered a variety of scenarios including short-term and long

-term SBOs, loss of vital AC power equipment for Peach Bottom, steam generator tube rupture (SGTR) and interfacing systems loss of cooling accidents (i.e., a high

-pressure system causing a connected lower

-pressure system to fail) for Surry, the Sequoyah SOARCA analysis focused specifically on short

-term SBO (STSBO) and long

-term SBO (LTSBO) scenarios only. These SBO scenarios involve an immediate loss of offsite and onsite AC power. In the STSBO variation, early failure of the turbine driven auxiliary feedwater (TDAFW) system (a backup heat removal system independent of AC power) is assumed and direct current (DC) (battery) power is also immediately unavailable; thus, the accident can progress to core damage within the "short term" (generally a few hours). In the LTSBO variation, DC power is assumed to be available until station batteries deplete and the TDAFW system is initially available; thus, absent any effective intervention, the accident would progress to core damage within the "long term" (generally beyond a day). These are important scenarios for all light

-water reactors in general, and for an ice condenser plant because of its reliance on AC-powered igniters for hydrogen control in the event that the accident progresses to core damage with associated hydrogen production

. The possibility of an SBO

-induced SGTR is not modeled in this analysis since the focus here is on containment structural performance, and the Surry SOARCA uncertainty analysis included a more detailed treatment of possible steam generator tube failures.

NRC and Sandia National Laboratories (SNL) staff used updated and benchmarke d standardized plant analysis risk (SPAR) models and available plant

-specific external events information to identify the SBO scenario variations for this analysis. SBO scenarios can be initiated by external events such as a fire, flood, or earthquake. The Sequoyah SOARCA analysis assumes that the SBO is initiated by a low probability severe seismic event because this is a challenging case in terms of timing, equipment failure, and evacuation of the areas around the plant. The contribution to core damage frequency for the LTSBO was estimated at one event per approximately 100,000 years of reactor operation (~1E

-5 per reactor operating year). The contribution to core damage frequency for the STSBO is estimated at one event per approximately 500,000 years of reactor operation (~2E

-6 per reactor operating year). No new work on estimating SBO frequencies was undertaken for this study. The estimated frequency information is provided only to help place this consequence study in context.

The Sequoyah SOARCA analyses were performed primarily with two computer codes, MELCOR for severe accident progression and the MELCOR Accident Consequence Code System (MACCS) for offsite radiological consequences, which are the same tools used in previous SOARCA efforts. During the analysis, improvements to the accident progression and consequence analysis computer models and tools were incorporated to provide the current state-of-the-art severe accident modeling practices. MELCOR models the following:

Thermal-hydraulic response in the reactor coolant system, reactor cavity (below the reactor vessel), containment, and confinement buildings (e.g., shield building

); Core heatup , degradation (including fuel cladding oxidation, hydrogen production, and fuel melting), and relocation

xxvii Core-concrete interaction in the cavity aftert lower reactor vessel head failure

Hydrogen production, transport, combustion, and mitigation; and Fission product transport and release to the environment.

MACCS models the following:

Atmospheric transport and deposition of radionuclides released to the environment; Emergency response and long

-term protective actions; Exposure pathways; Acute and long

-term doses to a set of tissues and organs; and Early and latent health effects for the affected population resulting from the doses

1. The Peach Bottom and Surry SOARCA studies (NUREG/CR-7110 Volume 1 and Volume 2, respectively) were comprised of deterministic analyses using point estimates for input parameter values, followed by uncertainty analyse s (Peach Bottom Uncertainty Analysis documented in NUREG/CR

-7155 and DRAFT Surry Uncertainty Analysis 2, respectively), which sampled distributions representing input uncertainty to generate multiple results to represent a range of potential outcomes.

T he Sequoyah SOARCA analysis integrate s probabilistic consideration of uncertainty into accident progression and offsite consequence analyses in parallel with deterministic calculations that are presented within this study.

Because this study had a particular focus on the potential for early containment failure, and ice condenser containment

-specific issues, an uncertainty analysis (UA) was included for the scenario with the greatest potential for early containment failure: the unmitigated STSBO 3 scenario.

This scenario was an evaluation of an unmitigated STSBO without hydrogen igniters, and without the presence of random ignition sources

4. The UA included three active ignition sources: 1) ignition from hot gases exiting the hot leg failure location, 2) ignition from hot gases exiting the pressurizer relief tank (PRT), and

3) the ex-vessel debris following the reactor pressure vessel (RPV) melt

-through. Key MELCOR (accident progression) and MACCS (offsite consequence) input parameters were selected from distributions that account for parameter uncertainty. The UA input parameter selections included 600 samples resulting in 567 successful MELCOR realizations (or 1 MACCS also models economic and societal consequences such as the population subject to protective actions, however, these were not used in the SOARCA project.

2 https://www.nrc.gov/docs/ML1522/ML15224A001.pdf 3 Because the unmitigated STSBO does not credit human actions, the UA does not address human actions.

4 An initial draft of the Sequoyah SOARCA analysis included two variations of the unmitigated STSBO

- with and without random ignition. The 'with' random ignition UA was not conducted for this final report. The reader is directed to Section 4 for further discussion and the DRAFT report of this effort: https://www.nrc.gov/docs/ML1609/ML16096A374.pdf.

xxviii outcomes). Each MELCOR source term w as coupled with a unique input parameter set for the 567 MACCS UA realizations

. These STSBO UA results were examined in detail using both quantitative and qualitative approaches.

Selected realizations from the UA were identified and examined to qualitatively evaluate characteristics important to accident progression and offsite consequences. Four regression techniques were used to identify input parameters contributing to key accident progression characteristics and public health impacts. Measures of the main (individual, independent) contribution of each uncertain parameter on the result metric and the conjoint influence 5 of the parameter on the result metric were determined. These two results were calculated as weighted averages of the overall contributions from the four regression techniques. In addition, a stability analysis was performed for the result metrics of interest (e.g., cesium and iodine release to the environment) using a bootstrapping method, to gain an understanding of the level of convergence in the statistical results.

The focus of this UA was on epistemic parameter uncertainty. NRC's guidance 6 on the treatment of uncertainties notes two other types of epistemic uncertainty; completeness uncertainty (i.e., missing scope) and model uncertainty (i.e., alternate conceptual models).

Completeness and model uncertainties were outside the scope of this UA. A systematic evaluation of model uncertainties could reveal additional important uncertainties that were not captured within the scope of this UA.

Although a systematic evaluation of model uncertainty was not within the scope of this UA

, separate sensitivity analyses were conducted to understand the variation in results arising from some alternat ive modeling approaches. For accident progression, sensitivity analyses were conducted to examine the effect of including hydrogen igniters and the effect of reactor coolant pump (RCP) seal leakage. For offsite consequence s, sensitivity analyses were conducted to examine the effect of delays in evacuation due to infrastructure damage, the reduced protection offered by degraded infrastructure caused by the seismic event, the effect of using a single weather year for the analysis, and the potential influence of the dose-response model on cancer risk. For the MELCOR accident progression analysis, insights from the SOARCA DRAFT Surry UA (see Footnote

2) were leveraged to identify a reduced set of parameters to include in the Sequoyah integrated UA. Because of the Sequoyah SOARCA analysis' focus on insights unique to the ice condenser containment and potential vulnerabilities to hydrogen challenges, ice condenser containment

-specific and hydrogen

-specific considerations added new parameters to the list. Table ES-1 lists the 13 MELCOR input parameters varied as part of the unmitigated STSBO UA accident progression.

5 Conjoint influence is the influence of two or more input parameters acting together, which may have synergistic effects that would not be determined by studying the influence of each parameter separately and individually.

6 See for example, NRC Regulatory Guide 1.174: https://www.nrc.gov/docs/ML1009/ML100910006.pdf

. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk

-Informed Decision making," contains some useful guidance on how to treat model uncertainties. While this guidance is geared toward risk-informed license applications, the general principles apply to any analysis.

xxix Table ES-1 Uncertain MELCOR parameter s used in the unmitigated STSBO UA Sequence Related Parameters Primary safety valve stochastic number of cycles until failure

-to-close Primary safety valve open area fraction after failure Secondary safety valve stochastic number of cycles until failure-to-close Secondary safety valve open area fraction after failure In-Vessel Accident Progression Melting temperature of the eutectic formed from fuel and zirconium oxides Oxidation kinetics m odel Ex-Vessel Accident Progression Lower flammability limit hydrogen ignition criterion for an ignition source in lower containment Containment rupture pressure Barrier seal open area Barrier seal failure pressure Ice chest door open fraction Particle dynamic s hape factor Time within the Fuel Cycle Time-in-cycle 7 For the offsite consequence analysis, parameters varied as part of the STSBO UA are shown in Table ES-2. These uncertain parameters are the same as those in the SOARCA DRAFT Surry UA (see Footnote

2) with two new parameters added

(1) a time-based crosswind dispersion coefficient and (2) a parameter related to weather

-forecasting

-time used in the keyhole evacuation model. One parameter that was made uncertain in the previous UAs, cloudshine shielding factor, was fixed as a point value in this analysis because cloudshine contributes very little to the overall risk.

The results are presented as conditional individual latent cancer fatality (LCF) risk and conditional individual early fatality (EF) risk and are statistically averaged (reported as the mean) over weather conditions. The Sequoyah MACCS model was developed assuming the large seismic initiating event that disrupts the Sequoyah plant systems also affects the evacuation routes. This Sequoyah SOARCA approach differs from earlier Peach Bottom and Surry SOARCA efforts with regard to the state of infrastructure assumed. In those analyses, impacts on evacuation road networks and infrastructure were considered in sensitivity analyses rather than as part of their respective UAs. Sequoyah roadway access and capacity are affected by the assumption that bridges within the 10-mile emergency planning zone (EPZ) are unusable. The infrastructure beyond the Sequoyah EPZ is assumed to be unaffected by the earthquake. It is difficult to consider all potential scenarios with respect to damage incurred within the EPZ from a large earthquake, such as the conditions of individual houses or buildings, the damage to roads in addition to bridges, the ability to evacuate or to shelter, etc. Therefore, the primary factors modeled in this study are t he 7 Three points in the fuel burn

-up cycle were sampled to represent beginning

-of-cycle (BOC), middle

-of-cycle (MOC), or end-of-cycle (EOC).

xxx evacuation speeds and delays due to the loss of roadways with bridges. Specifically, the loss of roadways to exit the EPZ is expected to result in delays to find alternate routes and in decreased evacuation speeds due to increased traffic congestion on a suboptimal road network. The evacuation delays and decreased travel speeds are evaluated to encompass other factors affecting the ability to evacuate.

Table ES-2 Uncertain MACCS parameter groups used in the unmitigated STSBO UA Epistemic Uncertainty Dispersion Crosswind Dispersion Linear Coefficient Vertical Dispersion Linear Coefficient Time-Based Crosswind Dispersion Coefficient Deposition Wet Deposition Coefficient Dry Deposition Velocities Emergency Response Keyhole Weather Forecast Evacuation Delay Evacuation Speed Hotspot Relocation Time Normal Relocation Time Hotspot Relocation Dose Normal Relocation Dose Shielding Factors Groundshine Shielding Factors Inhalation Protection Factors Early Health Effects Early Health Effects LD 50 Parameter Early Health Effects Exponential Parameter Early Health Effects Threshold Dose Latent Health Effects Dose and Dose Rate Effectiveness Factor Lifetime Cancer Fatality Risk Factors Long-Term Inhalation Dose Coefficients Aleatory Uncertainty Weather Because the Sequoyah SOARCA STSBO is postulated to be caused by a large earthquake, staff considered, after discussing with staff from the Tennessee Emergency Management Agency (TEMA), that offsite response organizations might direct an extended period of sheltering

-in-place before issuing an evacuation order, in order to allow time to survey the road network to confirm which routes would be safe for travel.

Therefore , sensitivity calculations were conducted for the Sequoyah STSBO to evaluate the impact of extended sheltering

-in-place on radiogical health risk, considering this possibility of a delayed evacuation order or the possibility that the road network is completely unusable. The shelter

-in-place sensitivity assumes that xxxi homes and buildings are habitable but considers that windows might be broken and that corresponding inhalation protection factors might be compromised.

For the LTSBO scenario, a suite of deterministic MELCOR analyses without hydrogen igniters was performed to assess the impact of uncertain parameters including battery duration, RCP seal leakage, hydrogen ignition criteria, and safety valve behavior. A sensitivity case of a mitigated LTSBO was also evaluated in which hydrogen igniters are modeled as operable.

Results and Insights MELCOR STSBO Uncertainty Assessment Insights A primary goal of the Sequoyah UA was to investigate the potential for an ice condenser containment to fail early from a hydrogen deflagration in a severe accident situation. The containment end

-state results are accordingly characterized into three general outcomes:

1. Late containment failure due to a slow pressurization of the containment from the core

-concrete interaction (CCI) and steam The most common outcome in the 567 Monte Carlo realizations

2. No containment failure within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months of the onset of the STSBO Almost exclusively beginning-of-cycle (BOC) realizations with lower decay heat power 3. Early containment failure due to combustion of hydrogen generated in

-vessel, following the first ignition Only four realizations with this outcome (see further discussion below).

The behavior of the safety valves is very important in affecting the accident progression; most notably in

-vessel hydrogen production and release to the containment, and the potential for early containment failure.

Safety Valve Failure Modeling

- Sparse Data and Lack of Established Expert Consensus While there is some operational data on safety valve failure

-to-close (i.e., main steam safety valves following scram events), the data is not under the exact conditions that the safety valves would experience in the STSBO scenario. Safety valve performance is clearly important in an STSBO, yet the basis for a more confident modeling of the uncertainties in safety valve behavior is currently lacking. The analysis here attempts to address the lack of applicable data (with respect to both failure rates and failure mechanisms) on safety valve failure

-to-close in one reasonable way that has been positively reviewed by experts outside the team

. However, currently there is no established expert consensus on the best way to model safety valve failure

-to-close. MELCOR Analysis The safety valve modeling was updated over the course of this project, because of its importance in affecting the accident progression. A draft version of this analysis was prepared using different assumptions for the primary safety valve (SV) failure attributes (see reference in Footnote 4). The very small number of early containment failures within this UA compared to this draft are due primarily to changes in the primary SV failure attributes. After the draft UA was completed, the SV failure attributes were changed based on discussions with nuclear valve testing personnel and closer examination of Licensee Event Reports.

In particular, the SV xxxii behavior was updated from the draft UA to reflect the following expert judgment s based on the additional information gathered:

If an SV is going to fail to close (FTC), then it will most likely do so on initial demand, If an SV functions per design on initial demand, then it will most likely function on all subsequent demands, If an SV experiences an FTC, then it will likely be in either a weeping (mostly closed) or mostly open position, An SV is very unlikely to fail to open when demanded to do so (i.e., fail fully closed), Passing hot liquid is not necessarily threatening to an SV but passing cold fluid is, and o Cold being relative to the valve's design conditions While there are differences between the main steam and reactor coolant system (RCS) SVs, it was judged defensible to apply the main steam SV operational data to both the main steam and RCS SVs too due to a lack of operational data for RCS SVs.

A comparative analysis was performed by comparing the timing to the first deflagration from the start of hydrogen generation (associated with overheating of the fuel in the reactor core) to the amount of hydrogen that is produced in

-vessel by the time of the first hydrogen burn. Figure ES-1 shows these results for th is (current) UA and the draft UA (demonstrating how variations in assumed SV performance influence both time to deflagration and hydrogen production in a correlated manner). There was low variability in the timing to the first combustion when the hot leg failure of the RCS occurs from relatively high temperature and pressure. In contrast, the realizations with delayed hot leg failure due to a RCS depressurization after a pressurizer SV FTC showed considerable variability in the timing to the first ignition. Both this UA and the draft UA exhibit the same general characteristics; the changes in the uncertainty parameter distributions between the two UAs only affects the distribution of these results and not the trends. Due to the RCS SV distribution differences, this UA shows little variability in the results for the timing to the first ignition whereas the draft UA includes more realizations with protracted timings to the first ignition. The amount of hydrogen produced in

-vessel is generally less when the pressurizer SV continues cycling until hot leg failure with the primary system at high pressure. For these high pressure cases, the heat from the core is more efficiently transferred from the vessel to the reactor coolant system piping. The combination of a high differential pressure across the hot leg to the containment, and the more effective heating at high pressure results in hot leg failure earlier in the core degradation progression. The first ignition source is the failure of the hot leg, which is associated with less in

-vessel hydrogen generation, and a lower amount of hydrogen transported to the containment. The early deflagration from the smaller amounts of hydrogen in the high pressure cases did not fail the containment. Furthermore, the subsequent deflagrations also did not challenge the containment integrity because they occurred closer to the lower flammability limit of hydrogen due to the presence of active ignition sources (e.g., hot gases from the primary system or ex

-vessel debris).

xxxiii Figure ES-1 Comparison of hydrogen production in current UA and draft UA MOC cases In contrast to the high pressure cases, the timing for the start of the hydrogen production is generally accelerated for the cases with system depressurization through SV FTC (especially realizations with an early SV FTC and a combined SV fractional open area over all valves greater than 0.3). The accumulation of creep damage to the hot leg and the heat transfer from the core to the hot leg are less efficient at low pressure. Furthermore, the early SV FTC scenarios may include partial Emergency Core Cooling System accumulator injections at low RCS pressure. The combined effects of these factors lead to a longer amount of time from the start of core damage to the first deflagration and a larger amount of in

-vessel hydroge n production. Finally, the higher rate of hydrogen discharge to the containment through the open SV and the corresponding lower retention in the vessel also significantly increases the amount of hydrogen in the containment at the time of the first deflagration. These cases generally had much more severe hydrogen burns that challenged the containment integrity. Realizations with a primary SV FTC and SV open area fraction greater than approximately 0.3 had early containment failure. The higher SV open area fraction led to an accident progression that allows more time for hydrogen to be produced in

-vessel and transported to the containment dome. In this UA, only four realizations resulted in early containment failure out of the small number of completed MELCOR realizations with the potential for an early containment failure (i.e., 23 realizations). The very small number of early containment failures within this UA compared to the draft UA are due primarily to the smaller likelihood of a pressurizer SV to experience an FTC xxxiv with a sufficiently large open area, which in turn is due to the updated distributions specified for SV FTC on demand and SV open area fraction upon FTC. Considerable uncertainty remains on the true distributions for these parameters since very little real

-world data is publicly available, as discussed in Section 3 of this report.

If containment does not rupture early (within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ), then the subsequent hydrogen burns are never energetic enough to rupture the steel containment vessel later in the sequence. The late burns (after 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ) are less energetic due to frequent burning of smaller quantities of combustible gases near the lower flammability limit (i.e., ignited by aerosols and hot gases from ex-vessel CCI). As the burns consume oxygen, the oxygen concentration in containment eventually decreases to the point where it is insufficient to support further burning. Although the deflagrations cease, the containment continues to pressurize and heat up from the ex

-vessel CCI non-condensable gas generation and the resulting vaporization of water from the melted ice. The pressurization is monotonic and most often pressurizes containment to rupture prior to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (end of simulation time). None of the BOC realizations overpressurized containment by 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Figure ES-2 shows the containment pressure response for the STBO UA realizations, color coded by time

-in-cycle. Note that the abrupt late depressurizations in the range of about 70 to 90 psia are associated with containment failure.

Generally, there is more hydrogen generated ex

-vessel through CCI than generated in

-vessel through zirconium and steel oxidation. Important with respect to hydrogen generated ex

-vessel is that this does not evolve until after the first deflagration. Consequently, ex

-vessel hydrogen production does not contribute to the magnitude of the first deflagration. The hydrogen generated ex

-vessel evolves in the presence of an ignition source, and therefore burns as it is being produced until such time that a sufficient oxygen concentration is no longer available to support burning. The burning contributes to the gradual containment heating and pressurization as does continued hydrogen and non

-condensable gas generation from CCI once all burning has ended. However, the ex

-vessel combustible gas production is not a determining factor in whether or not containment fails early.

Consistent with the insights described above and past studies (such as the draft Surry UA), regression analyses indicate that the most influential uncertain parameters on in

-vessel hydrogen production were the fuel cladding oxidation model, time

-in-cycle, aggregate primary SV cycles 8 (priSVcycles), and U

-Zr-O eutectic melt temperature.

8 Which was a surrogate for the importance of both the number of SV cycles (priSVcycles) and the failure area upon failure, if an SV experienced FTC. The FTC failure area was not included in the regressions due to the challenge of the majority of values being zero, since a primary SV didn't FTC.

xxxv Figure ES-2 Containment pressure response for the STSBO UA realizations For both cesium and iodine environmental release (Figure ES-3), regression analyses indicate the time-in-cycle is significant; Realization 266 (Rlz 266) is the reference realization because its results are close to the population medians for figures-of-merit. Releases vary from 'nearly zero' (at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) for BOC realizations, then increase in magnitude and occur earlier with increasing burnup for middle

-of-cycle (MOC) and then end-of-cycle (EOC) realizations. The aggregate number of primary SV cycles experienced (priSVcycles, due to SV FTC or RCS depressurization by other means) is also significant, and the results are consistent with deterministic analyses. The primary SV cycles parameter also has high interaction effects (identified from non

-linear regression techniques) for both the cesium and iodine environmental release. With regard to the magnitude of the environmental release, no other parameters were identified as having significant effects on cesium or iodine release to the environment. In terms of significant effects only in interaction with other parameters, the U

-Zr-O eutectic melt temperature was identified as significant for both cesium and iodine environmental releases, and the containment rupture pressure was identified as significant for only the iodine environmental release. Generally, cesium and iodine environmental releases are minimal until about 42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months into the simulation, and increase significantly from 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to the end of the simulation (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

xxxvi Figure ES-3 Cesium (left) and iodine (right) environmental release fraction horsetails based on the STSBO UA realizations.

MELCOR STSBO and LTSBO Sensitivity Analyses The hydrogen mitigation system (HMS) benefit analysis showed that igniters prevent the buildup and circulation of hydrogen to the dome of the containment prior to the first hydrogen burn. The igniters burned smaller quantities of hydrogen primarily in the lower containment to prevent large pressurizations from large burns, especially for the first burn. In the STSBO sequence, recovery of the HMS (i.e., igniters) by 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months was shown to shift an early containment failure to a late containment failure. All the LTSBO sensitivity cases experienced late containment failure. Consequently, the benefit of igniters had a less important effect for the range of conditions investigated.

The hydrogen ignition sensitivity study (similar to the STSBO individual realization analysis) showed that hot gas auto

-ignition from the hot leg and PRT mitigated the build

-up of hydrogen for cases with attributes that promoted an early containment failure. These ignition sources burned hydrogen earlier in the accident progression, which contributed to reducing (but not eliminating) the likelihood of an early containment failure.

The inclusion of increased RCP seal leakage 9 only had a small effect on a sensitivity calculation where the pressurizer SV did not fail and late containment failure occurred. The timing of the key events and the radiological source term to the environment were similar in the reference case and the RCP seal leakage sensitivity case. The amount of leakage from the RCP seal leakage is significantly smaller as compared to a stuck

-open pressurizer SV, which is needed to develop the conditions for an early containment failure.

The inclusion of increased RCP seal leakage had a more significant effect on the realization with the earliest containment rupture from the STSBO UA. However, and most importantly, both this reference case (Realization 554) and sensitivity case with RCP seal leakage resulted in an early containment failure and a relatively large radiological source term. Although the reference case had a hot leg failure and the sensitivity case did not, the in

-vessel hydrogen production

9 The increased RCP seal leakage sensitivity calculation simulated failure of the seal barrier, which results in a nominal leakage rate of 480 gpm per pump after 13 min. In contrast, the nominal RCP leakage rate in the other UA calculations was 21 gpm per pump.

xxxvii and the subsequent hydrogen release to the containment prior to the first hydrogen burn were comparable. The pressurizations from burn s following the first burn were also very similar.

A set of LTSBO calculations were defined to explore the plant response to variations in pressurizer and steam generator (SG) SV FTC and failure open area parameters, the TDAFW operation, battery life, availability of ignition sources, HMS recovery, and RCP seal leakage. All of the calculations showed the benefits of TDAFW to significantly extend the time taken to uncover the core and over

-pressurize the RPV to failure. LTSBO accident progression was similar to STSBO progression after TDAFW injection failed, but more protracted due to lower decay heat. There were no early containment failures due to hydrogen burns 10 and all cases were progressing slowly to containment over

-pressurization due to ongoing steam production and CCI at the end of the calculation (i.e., 72 hr). The inclusion of increased RCP seal leakage had a significant impact on the LTSBO accident progression. Due to the longer time for an LTSBO to progress to core damage, the impact of the RCP seal leakage was greater. The primary system response was substantially different due to the large water inventory loss through the RCP seal leakage prior to station battery (DC) depletion. Unlike the LTSBO calculations without seal failures, the primary system became thermally decoupled from the secondary system due to the high amount of coolant inventory loss through the RCP seals, which circumvented most combinations of the SV failures investigated in the STSBO UA. Nevertheless, the RCP seal leakage sensitivity case also progressed to late containment failure like the LTSBO cases without increased RCP seal leakage. MELCOR STSBO UA - Incomplete Code Simulations For the Sequoyah UA, the overall MELCOR success rate was about 95% (i.e., 567 successful simulations out of 600), but the success rate in the sample space that had potential for early containment failure was 64%

(i.e., 23 completed to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months out of 36 simulations). T he se 36 simulations had a fractionally open position of the failed safety valve greater than 0.3 (a necessary but not sufficient condition for early containment failure), but 13 simulations did not complete to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . However, 11 of the incomplete simulations had the first hydrogen burn and none resulted in early containment failure. This is important because if the containment survives the first burn, subsequent burns do not challenge the containment integrity.

In addition, the amount and timing of the hydrogen produced in

-vessel up to the first burn was similar to the 23 completed simulations

. The two simulations (out of the 13 simulations) that did not have the first burn were restarted by relaxing the code convergence criteria, as explained in Section 4.2 , and an early containment failure resulted in one of the two simulations

. Since early containment failure is an important metric in determining the environmental consequences of the accident scenario, the present results show that the overall conclusions are not significantly affected by the code success rate within the small sample space for a safety valve FTC with area fraction greater than 0.3.

In fact, the safety valve behavior is the dominant factor influencing hydrogen production and release to the containment, and the potential for early containment failure.

A safety valve focused study within the same sampling space with potential for early containment failure showed a similar MELCOR success rate (61%).

However, in this focused

10 One ignition sensitivity calculation that disabled a hot jet ignition source from the PRT resulted in an "early" containment failure due to a hydrogen burn at 24.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . The PRT generated a hot jet that would cause auto

-ignition of the surrounding hydrogen, but for this sensitivity case the PRT was not allowed to initiate at burn. The purpose of the sensitivity case was to illustrate the importance of this previously ignored ignition source.

xxxviii SV study, the amount and timing of the hydrogen availability prior to the first burn was similar between the completed and incomplete simulations

. Focused Pressurizer Safety Valve Study

- MELCOR Insights A focused pressurizer SV study was performed to better understand conditions leading to an early containment failure, and the resulting environmental radionuclide releases. The focused SV study included sampling of the same uncertain variables as the UA. However, the range of the number of primary SV cycles to failure, priSVcycles

, and SV open area fraction upon failure, priSVfrac , were limited to between 1 and 65 cycles and 0.3 and 1.0 open area fraction, respectively, to ensure they were sampled within the ranges supportive of a potential early containment failure. The remaining uncertain parameters were sampled with simple random sampling from the same distributions (and associated ranges) as the UA.

The focused SV study satisfied several important objectives. First, it explored the most important uncertain parameter attributes that contribute to early containment failure. Second, the UA realizations with these SV attributes experienced a large number of incomplete simulations that warranted further investigation. Consequently, there was some uncertainty in the relative occurrence of an early containment failure. Third, this study corrected the barrier seal failure pressure error (see Section 4 of report) to examine the impact of the barrier seal performance on a larger set of simulation

s. The percentage of the 361 successful realizations in the SV study where early containment failure occurred compares well with the overall UA. The focused SV study also shows the potential for early containment failure for a BOC core state, which was not observed in the overall UA. The effect of the barrier seal input error was shown to be insignificant.

MACCS Offsite Consequence Uncertainty Analysis Similar to the results from the Peach Bottom and Surry SOARCA UAs, the Sequoyah analyses show essentially zero individual EF risk and a low individual LCF risk for the affected population. Even for STSBO variations leading to early containment failure in which the release to the environment begins prior to the completion of the 10-mile EPZ evacuation, there is essentially zero individual EF risk (three out of 567 realizations had a non

-zero EF risk calculated and even those are small), and the individual LCF risk is low. Individual LCF risk calculations are generally dominated by long

-term exposure to small annual doses (assuming the linear

-no-threshold [LNT] dose response model

) below 2 rem in the first year after the accident and below 500 mrem per year in subsequent years corresponding to the habitability criteri a for populations exposed to residual contamination over a long period of time.

Using the LNT dose response model, the conditional individual LCF risks for the UA are bimodal and range from about 6E-04 to 2E-09 for the 0

-10 mile region and the individual LCF risks generally decrease with increasing distance from Sequoyah; see Figure ES-4. The bimodal nature of the complementary cumulative distribution function (CCDF) curves derives from the fact that the containment does not fail by 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (the end of the simulation) in 13% of the realizations and does fail before 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months in the remaining 87% of the realizations. The cases with no containment failure account for the upper left (very low risk) portion of the CCDF curves; the cases with containment failure account for the right (relatively higher risk) portion of the CCDF curves.

These risks are conditional on the occurrence of an STSBO. Contributions from the long-term phase risks dominate the emergency

-phase risks for the large majority of the realizations.

xxxix Figure ES-4 Complimentary cumulative distribution function s of conditional individual LCF risk within five intervals (annuli) centered on Sequoyah Regression analyses indicate that the time

-in-cycle when the accident occurs has the largest influence on consequences of all the uncertain inputs considered in the Sequoyah STSBO UA; this parameter affects fission product inventory and associated decay heat. Within the 10-mile EPZ, three MACCS parameter s and two additional MELCOR parameter are also assessed as important. The MACCS parameters are the cancer risk factors for the 'residual' and colon organs and the long-term groundshine shielding factor. The cancer fatality risk factor for the 'residual' organ 11 represents all of the cancer types not specifically treated in this version of MACCS. The MELCOR paramet er s are the aggregate primary (pressurizer)

SV cycles to failure and containment rupture pressure

. Two additional MACCS parameters are important at longer distances presented in the regression analysis

the cancer risk factor for lung cancer and normal relocation time.

Specific to the MELCOR parameter s, aggregate primary SV cycles to failure is significant with respect to uncertainty in individual LCF risk for the 0-10 and 10-20 mile ranges, but not for ranges beyond those. This parameter influences hydrogen buildup in containment and the potential for early containment failure, leading to early releases. Early release has the potential to affect evacuees within the EPZ and shadow evacuees from 10 to 15 miles because some of the evacuees can be directly affected by the plume. This parameter has a lesser influence on

11 MACCS uses eight cancer sites (organs), seven of which are specific (lung, red bone marrow, bone, breast, thyroid, liver, and colon) and the last of which (residual) represents the cancers not explicitly modeled and is based on the dose for the pancreas, which is used as a surrogate for other soft tissues.

xl the non-evacuating population who are assumed to remain in place at the start of release regardless of whether it is an early or late release.

Time-in-cycle is consistently significant at all distances and is driven by its strong influence on the magnitude of the source term. Consequences are more severe as this parameter increases, both because of its influence on release fractions as noted in the MELCOR result insights above, as well as due to the additional creation of cesium activity with increased time in the fuel burnup cycle. The differences are more profound between BOC (where containment doesn't fail in the overall UA) and MOC/EOC, and less profound between MOC and EOC. Containment rupture pressure is also significant nearer the plant, but not significant within the 30 to 40 and 40 to 50 mile ranges. The pressure at which containment ruptures is correlated negatively with consequences, which means consequences decrease as containment failure pressure increases. Lower containment failure pressure generally corresponds to earlier containment failure; a higher failure pressure translates to a delay in containment failure timing which benefits both evacuation as well as aerosol deposition effectiveness within the containment.

Specific to the MACCS parameters, the long

-term groundshine shielding factor is only indicated as significant in the 10 mile EPZ. This parameter is a factor in the equation for groundshin e dose, so risk increases with this factor. Groundshine is relatively more important within the EPZ because nearly all of the risk is from the intermediate and long

-term phases. The cancer risk factors have high significance with the colon and 'residual' organs consistently indicated as significant, though in differing orders at different radial distances; these are the two largest of the LCF risk factors and both appear as multipliers in terms of the equation for individual LCF risk. MACCS Offsite Consequence Sensitivity Analyses Sensitivity calculations were conducted for the Sequoyah STSBO to evaluate the impact of extended sheltering

-in-place prior to evacuation on radiological health risk.

These sensitivities, which assumed a 12

-hour and 48

-hour period of sheltering prior to evacuation, resulted in slightly larger individual LCF risk for the public compared to calculations with a prompt evacuation order (using the LNT dose response model

). If seismically

-impacted structures are assumed to be damaged resulting in reduced shielding factors, the advantage of a prompt evacuation order is even greater.

The individual EF risk also increases for calculations with extended sheltering

-in-place when structures are assumed to be degraded, but the individual EF risks remain very low even for this case.

Five years of meteorological data (2008

-2012) from the Sequoyah site were evaluated with respect to their impact on individual LCF risk. The year 2012 was selected for this study because it was judged to be the most representative of the site weather (i.e., the annual precipitation was consistent with the five

-year-average precipitation and it has the second highest data completion rate) of years 2008 to 2012. The sensitivity calculations showed that the mean individual LCF risk using 2012 weather are within a few percent of the mean individual LCF risk using the entire five year span of weather data. Also, the results of the selected year lie between the upper and lower bounds of the individual weather year results and are very close to the means at the distance intervals evaluated. These results give confidence that the selection of 2012 meteorological data does not significantly bias individual LCF risk calculations. Sensitivity calculations were conducted to evaluate the impact of the following four alternat iv e dose-response models for cancer risk beyond LNT:

xli 10 mrem per year threshold (demonstrates the contribution from extremely low doses), 310 mrem per year threshold (U.S. natural background average annual dose), 620 mrem per year threshold (U.S. natural background average annual dose plus annual dose from man

-made radiation sources), and Threshold based on the Health Physics Society's (HPS's) 20 04 position statement on radiation risk (includes both annual (5 rem) and lifetime (10 rem) thresholds).

With the non

-LNT dose-response approaches considered, only annual doses above the thresholds contribute to individual LCF risk. These calculations demonstrate that as the dose threshold increases, the corresponding individual LCF risk decrease s from ~5% (10 mrem per year threshold) to orders of magnitude (threshold based on HPS's 2004 position statement), which is expected. As part of the focused SV study, the health effects were calculated for each of the realizations that were extended to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This included 61 realizations that had progressed to an early containment failure, and 57 realizations that progressed to a late containment failure. The mean (over weather variability), conditional, individual LCF risk to the 0

-10 mile radial population assuming LNT for the late containment failure cases was 8E

-5, which was equal to one significant digit to the 0

-10 mile result from the overall STSBO UA. The mean, conditional, individual LCF risk assuming LNT for the early containment failure cases was 7E

-4, which was higher than the 95 th percentile from the overall STSBO UA (which was 2E

-4). Considering that the early containment failure cases represented only 4 out of 567 (less than one percent) of the STSBO UA realizations, the LCF risk results from the focused SV study are consistent with those of the overall STSBO UA.

Summary The Sequoyah SOARCA analyses provide valuable insights on potential accident progression and consequences for an unmitigated station blackout severe accident at the Sequoyah Nuclear Generating Station. An important focus of the analys es was investigating the susceptibility of the ice condenser containment to rupture from a hydrogen deflagration. The analyses suggest that rupturing of an ice condenser containment by a hydrogen deflagration, while possible, is unlikely. The analyses also suggest that in the severe accident scenario modeled, a safety valve on the primary side (pressurizer) of the reactor coolant system would need to fail to close for an ice condenser containment to rupture from a hydrogen deflagration. A containment rupture from a hydrogen deflagration would come early (i.e., within hours of the loss of all electrical power for an STSBO). Considerably more likely than an early containment rupture is a late rupture (i.e., days after the loss of all electrical power) due to gradual over

-pressurization from fission product decay incessantly driving steam production and core

-concrete interaction. The relative likelihood of different containment failure times in the modeled STSBO scenario is highly influenced by uncertainty in the primary safety valve failure

-to-close parameters, and considerable uncertainty remains in the distributions of these key safety valve parameters in the current state

-of-knowledge. Sensitivity calculations conducted as part of this study reinforce the results of past analyses (e.g., NUREG

-1150) of ice condenser containments showing that successful use of igniters (HMS) is effective in averting early containment failure.

xlii Even for scenarios resulting in early containment failure (radioactive release to the environment prior to completion of evacuation for the EPZ), resulting individual LCF risks are small and individual EF risks are essentially zero. The sensitivities which assumed an extended period of sheltering prior to evacuation resulted in slightly larger individual latent cancer fatality risk for the public compared to calculations with a prompt evacuation order, assuming the LNT dose response model.

If shelters are assumed to be damaged by the earthquake, the advantage of a prompt evacuation order is even greater.

The individual EF risk also increases for calculations with extended sheltering

-in-place when structures are assumed to be degraded, but the individual EF risks remain very low even for this case.

Sequoyah SOARCA insights, while specific to Sequoyah, can be used to obtain insights for other PWRs with ice condenser containments. However, additional work would be needed to assess the impact of differences in plant

-specific designs and site-specific characteristics.

The SOARCA analyses of the three pilot plants have been useful in many ways beyond their original objectives. The SOARCA project's results, insights, computer code models, and modeling best practices have supported NRC rulemaking, licensing, and oversight efforts as well as facilitated international cooperation and knowledge management. Additionally, the process of conducting such detailed analyses has developed staff expertise in a variety of important technical areas including severe accident progression, environmental source term s, atmospheric transport and dispersion, offsite consequence analysis, emergency preparedness and response, dosimetry, health effects, uncertainty analysis, and risk communication. The study also resulted in improvements in NRC analytical tools and associated severe accident analysis methodologies, including parametric uncertainty analysis. The improvement of tools, methodologies, and of staff technical expertise improves NRC's capabilities to carry out its mission to protect public health and safety, and the environment

.

xliii ACKNOWLEDGEMENTS The Sequoyah SOARCA project document is the result of the efforts of many NRC staff and the staff of its contractors, Sandia National Laboratories, and dycoda, LLC. The SOARCA co

-leads, S. Tina Ghosh, NRC, and Douglas M. Osborn, SNL, gratefully acknowledge the contributions from the following individuals in preparing this document:

Jonathan Barr U.S. Nuclear Regulatory Commission Keith Compton U.S. Nuclear Regulatory Commission Hossein Esmaili U.S. Nuclear Regulatory Commission Edward Fuller U.S. Nuclear Regulatory Commission Salman Haq U.S. Nuclear Regulatory Commission Donnie Harrison U.S. Nuclear Regulatory Commission Alfred Hathaway U.S. Nuclear Regulatory Commission James Hickey U.S. Nuclear Regulatory Commission Andy Hon U.S. Nuclear Regulatory Commission Imtiaz Madni U.S. Nuclear Regulatory Commission Trish Milligan U.S. Nuclear Regulatory Commission Allen Notafrancesco U.S. Nuclear Regulatory Commission Jose Pires U.S. Nuclear Regulatory Commission William Reckley U.S. Nuclear Regulatory Commission Ed Roach U.S. Nuclear Regulatory Commission Selim Sancaktar U.S. Nuclear Regulatory Commission Patricia A. Santiago U.S. Nuclear Regulatory Commission Galen Smith U.S. Nuclear Regulatory Commission Todd Smith U.S. Nuclear Regulatory Commission Nathan Bixler Sandia National Laboratories Dusty Brooks Sandia National Laboratories Jeffrey Cardoni Sandia National Laboratories Matthew Dennis Sandia National Laboratories Matthew Denman Sandia National Laboratories Christopher Faucett Sandia National Laboratories Aubrey Eckert

-Gallup Sandia National Laboratories Larry Humphries Sandia National Laboratories Randall Gauntt Sandia National Laboratories Patrick Mattie Sandia National Laboratories Kyle Ross Sandia National Laboratories John Reynolds Sandia National Laboratories

xliv Rodney Schmidt Sandia National Laboratories Fotini Walton Sandia National Laboratories Kenneth C. Wagner dycoda, LLC The SOARCA co

-leads would also like to thank the support provided by the staff of the Sequoyah Nuclear Plant, Tenne ssee Valley Authority, the State of Tennessee's Emergency Management Agency, and members of the NRC's Advisory Committee on Reactor Safeguards who provided comments on earlier draft s during May 2016 and June 2017 subcommittee meeting s.

xlv ABBREVIATIONS AND ACRONYMS ACRS Advisory Committee on Reactor Safeguards AFW auxiliary feedwater ANS American Nuclear Society atm atmosphere ARV atmospheric relief valve BEIR Biological Effects of Ionizing Radiation BWR boiling water reactor CCI core concrete interactions CCP centrifugal charging pump CCDF complementary cumulative distribution function CDF cumulative distribution function CFC containment fragility curve CMTR certified material property test reports CPI Consumer Price Index CPI-U-RS Consumer Price Index for urban consumers CST condensate storage tank CV control volume CVH control volume hydrodynamics CVCS chemical and volume control systems DCF dose conversion factor DDREF dose and dose rate effectiveness factor DF decontamination factor EAB exclusion area boundary EAL emergency action level EAS emergency alert syst em EF early fatality ECCS emergency core cooling systems ECST emergency condensate storage tank EDG emergency diesel generator ELAP extended loss of AC power EOP emergency operating procedure EPA Environmental Protection Agency EPRI Electric Power Research Institute EPZ emergency planning zone ETE evacuation time estimate FGR Federal Guidance Report FP flow path FSAR final safety analysis report FSI FLEX support instructions FTC failure to close FTO failure to open GE general emergency gpm gallons per minut e GSDE ground shine deposited energy GSI generic safety issue Gy gray HMS hydrogen mitigation system HPS Health Physics Society

xlvi HTC heat transfer coefficient IPE individual plant examination IPEEE Individual Plant Examination for External Events LCF latent cancer fatality LD 50 lethal dose to 50% of population LHS Latin hypercube sampling LET linear energy transfer LOOP loss of offsite power LNT linear no threshold LTSBO long-term station blackout LWR light water reactor m meter MACCS MELCOR Accident Consequence Code System MARS Multivariate Adaptive Regression Splines MD-AFW motor-driven auxiliary feedwater MOV motor operated valve mph miles per hour MSIV main steam isolation valve MSL main steam line MSS main steam system NRC Nuclear Regulatory Commission NTTF Near Term Task Force NWS National Weather Service ORO offsite response organization PAG protective action guideline PAR protective action recommendation PDF probability density function PGA peak ground acceleration PORV power operated relief val ve PRA probabilistic risk assessment PRT pressure relief tank PRY per reactor year PWR pressurized water reactor QHO quantitative health objective RCIC reactor core isolation cooling RCP reactor coolant pump RCS reactor coolant system RPV reactor pressure vessel SAE Site Area Emergency SBO station blackout scfh standard cubic feet per hour sec second SG steam generator SGTR steam generator tube rupture SME subject matter expert SNL Sandia National Laboratories SOARCA State-of-the-Art Reactor Consequence Analyses SPAR Standardized Plant Analysis Risk SPAR-AHZ SPAR All Hazards SRRC standardized rank regression coefficients SRS simple random sampling

xlvii SSC systems, structures, and components STSBO short-term station blackout SV safety valve TDAFW turbine driven auxiliary feedwater TTV trip throttle valve TVA Tennessee Valley Authority UA uncertainty analysis USBGR U.S. background yr year xlviii 1-1 1. INTRODUCTION This document describes the potential severe accident analyses performed for the Sequoyah Nuclear Plant (Sequoyah), the third pilot plant selected for the U.S. Nuclear Regulatory Commission's (NRC's) State

-of-the-Art Reactor Consequence Analyses (SOARCA) project. The detailed severe accident analyses used complex computer models, MELCOR and the MELCOR Accident Consequence Code System, (MACCS) to perform the calculations. Separate volumes of this report describe severe accident analyses performed for the Peach Bottom Atomic Power Station (NUREG/CR-7110, Volume 1) and the Surry Power Station (NUREG/CR

-7110, Volume 2). A summary report (NUREG

-1935) was published entitled "State

-of-the Art Reactor Consequence Analyses (SOARCA) Report," [3] which includes the formal SOARCA Peer Review Committee activities, comments, and resolutions.

1.1 Background

The evaluation of accident phenomena and offsite consequences for severe reactor accidents has been the subject of considerable research by NRC, the nuclear power industry, and the international nuclear energy research community. The NRC initiated the SOARCA project to develop a body of knowledge regarding realistic outcomes of potential severe nuclear reactor accidents, based on current severe accident phenomenological understanding, and state

-of-the-art modeling techniques and assumptions. The first two SOARCA pilot plants were the Peach Bottom Atomic Power Station (Peach Bottom) in Pennsylvania and the Surry Power Station (Surry) in Virginia. Peach Bottom is a General Electric boiling

-water reactor (BWR) design with a Mark I containment. Surry is a Westinghouse pressurized

-water reactor (PWR) design with a large, dry (subatmospheric) containment

[3]. The third pilot plant, Sequoyah, is a Westinghouse PWR with an ice condenser containment design and is the subject of this report. A systematic approach was implemented in SOARCA to calculate the potential consequences of the analyzed severe accident scenarios. The SOARCA project team decided it could learn more by rigorously and realistically analyzing a relatively small number of important accident scenarios instead of carrying out less detailed modeling of many scenarios. Therefore, the team selected a core damage frequency threshold to help select scenarios to analyze (i.e., greater than 1.0 E-7 per operating year for bypass accidents and greater than 1

.0 E-6 per operating year for non-bypass accidents). Accident progression calculations used the MELCOR computer code

[19]. For scenarios leading to an offsite release of radioactive material, SOARCA analyzed atmospheric dispersion, emergency response, and potential health consequences using the MELCOR Accident Consequence Code System (MACCS) computer code

[54]. The SOARCA analysis of Peach Bottom and Surry is documented in a series of NUREG reports published in 2012. NUREG-1935, "State

-of-the-Art Reactor Consequence Analyses (SOARCA) Report," provides a summary of the project's objectives, methods, results, and conclusions [3]. NUREG/CR-7110, "State

-of-the-Art Reactor Consequence Analyses Project," Volume 1, "Peach Bottom Integrated Analysis," and Volume 2, "Surry Integrated Analysis," provide additional technical details on the analyses conducted for each of the pilot plants [4][5]. This initial phase of the SOARCA project had additional objectives that related to evaluating the potential benefit of mitigation measures required by the NRC and codified in 10 CFR 50.54(hh), evaluating the potential level of conservatism in earlier NRC publications, and facilitating better public communication on the potential risks from severe accidents.

To meet these objectives, t he Peach Bottom and Surry SOARCA analyses evaluated plant improvements and changes that were not reflected in earlier NRC publications such as the 1982 NUREG/CR

-2239, "Technical Guidance for Siting Criteria Development" (also referred to as the 1982 Siting Study) [2], and 1-2 the 1990 NUREG

-1150, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants." The 2012 SOARCA reports included consideration of system improvements; improvements in training and emergency procedures; offsite emergency response; improvements codified in 10 CFR 50.54(hh)(2) [1]; and plant changes, such as power uprates and higher core burnup. To provide a perspective between SOARCA results and earlier potentially more conservative offsite consequence estimates, SOARCA results were compared to NUREG/CR

-2239. In addition, the staff developed an information brochure, NUREG/BR

-0359, "Modeling Potential Reactor Accident Consequences," to facilitate communication with stakeholders, including Federal, State, and local authorities; licensees; and the general public [6]. The staff also documented best modeling practices as applied in SOARCA for the MELCOR and MACCS codes in NUREG/CR

-7008 and NUREG/CR

-7009, respectively [7][8]. NRC staff completed an uncertainty analysis (UA) of the SOARCA unmitigated long-term station blackout (LTSBO) at Peach Bottom to develop insights into the overall sensitivity of SOARCA results to uncertainty in inputs; to identify the most influential input parameters for releases and consequences; and to demonstrate a UA methodology that could be used in future source term, consequence, and site Level 3 probabilistic risk assessment (PRA) studies.

Integrated analyses using about 40 independent MELCOR and MACCS parameter groups corroborate d the overall 2012 SOARCA results and conclusions for the selected accident scenario

[4]. The Peach Bottom UA is documented in NUREG/CR

-7155 [9]. Following the completion of the SOARCA analyses of the first two pilot plants, the NRC staff issued a memorandum to the Commission, SECY 0092 [10], recommending completion of SOARCA analyses of the third pilot plant, Sequoyah, a PWR with an ice condenser containment.

Th is analysis, as well as a UA of a SOARCA Surry scenario, was recommended to inform agency activities such as implementation of the Fukushima 12 Near Term Task Force (NTTF) Tier 3 recommendations related to hydrogen control and reliable hardened vents for containment designs other than BWR Mark I and Mark II

, and the site Level 3 PRA project for Vogtle. Both analyses were also recommended to expand on the body of knowledge on severe accident progression and consequences developed in the 2012 SOARCA pilot plant analyses.

The SOARCA analysis of an ice condenser plant was recommended because of its relatively low design pressure and reliance on hydrogen igniters makes it potentially susceptible to early failure from hydrogen combustion during a severe accident.

In December 2012, the Commission approved the staff's recommendations

[139], including analyzing an SBO at Sequoyah in a way that "complements and supports the post

-Fukushima activities including Tier 3 items." As discussed further in Section 1.3, the scope of this third SOARCA plant study was different and more limited compared to the first two because of its focus on SBO accidents only, and its focus on issues unique to the ice condenser containment. With ten operational units 13, the PWR ice condenser design is the third most prevalent design 12 On March 11, 2011, a 9.0

-magnitude earthquake struck Japan and was followed by a 45

-foot tsunami, resulting in extensive damage to the nuclear power reactors at the Fukushima Daiichi facility. The NRC has taken significant action to enhance the safety of reactors in the United States based on the lessons learned from this accident.

NRC has developed a webpage (http://www.nrc.gov/reactors/operating/ops

-experience/japan

-dashboard.html) to serve as a navigation hub to follow the NRC's progress in implementing the many different lessons

-learned activities.

13 There are 10 reactors at five sites with ice condenser containments: Catawba Units 1 & 2 in South Carolina, DC Cook Units 1 & 2 in Michigan, McGuire Units 1 & 2 in North Carolina, and Sequoyah Units 1 & 2 and Watts Bar Units 1 & 2 in Tennessee.

1-3 among the fleet of U.S. operating nuclear power reactors, after the PWR large dry containment and the BWR Mark I containment.

Figure 1-1 shows that the typical design pressure of a PWR ice condenser containment has the lowest design pressure among U.S. nuclear power plant containment types, around 12 psig (83 kPa), slightly below that of the BWR Mark III containment.

Ice condensers are pressure suppression containments and use ice to absorb heat in a severe accident.

Unlike the BWR Mark I and Mark II pressure suppression containments, ice condensers are not inerted with nitroge n. Therefore , they use alternating current (AC) powered ignition sources (igniters) that burn hydrogen in a gradual, controlled manner before it can rise to levels that could result in a highly energetic deflagration or detonation which could challenge the containment.

The susceptibility of ice condenser (and Mark III) containments to early failure from hydrogen combustion during a severe accident was analyzed in the NRC's generic safety issues (GSI) program as GSI

-189. The GSI

-189 technical assessment led staff to recommend the addition of a backup power supply for the igniters for plants with an ice condenser or Mark III containment.

Licensees of these plants committed to voluntarily develop and maintain the capability to provide backup power to the containment hydrogen igniters during severe accidents and certain security scenarios.

The staff accepted these commitments and verified acceptable implementation of the commitments as of January 2013 [11]. The ice condenser containment design was also analyzed in NUREG

-1150 in which the staff conducted a Level 3 PRA of five plants representing different design types

, and Peach Bottom, Surry, and Sequoyah were three of the five plants analyzed

[12]. The Sequoyah analysis was documented in greater detail in NUREG/CR

-4551, Volume 5 [13].

1-4 Figure 1-1 Typical Containment Volumes and Design Pressures [14] 1.2 General Sequoyah Plant and Site Information Sequoyah is located near Soddy

-Daisy in Hamilton County, Tennessee, about 18 mi (29 km) northeast of Chattanooga along the Tennessee River.

Sequoyah is owned and operated by Tennessee Valley Authority (TVA).

Sequoyah has two Westinghouse 4

-loop PWRs with ice condenser containments.

Units 1 and 2 received their operating license in 1980 and 1981, began commercial operation in 1981 and 1982, and received their renewed licenses in 2015 to operate until 2040 and 2041, respectively.

Both units are licensed at 3455 MW th and have operated at a 92% (Unit 1) and 89% (Unit 2) average annual capacity factor for years 2008

-2014 [15]. Spent fuel is kept at Sequoyah in a spent fuel pool and in dry cask storage.

An aerial view of Sequoyah is shown in Figure 1-2 looking from the north to the south.

1-5 Figure 1-2 View of Sequoyah from the north to the south 1.3 Sequoyah SOARCA Scope Similar to the Peach Bottom and Surry SOARCA analyses [4][5], the priority of the Sequoyah analysis is on detailed analytical modeling of select important severe accident scenarios. Like Peach Bottom and Surry, the scope is on single unit reactor accident scenarios postulated to be caused by seismic events. The Sequoyah analysis does not consider multi

-unit accidents, spent fuel pool or dry cask storage accidents, accidents during shutdown or low

-power modes, extreme seismic events that lead directly to gross containment failure with simultaneous reactor core damage, or accidents caused by malevolent acts

14. The Sequoyah SOARCA analysis is not a PRA, and it does not attempt to quantify the frequency of each modeled variation in the accidents analyzed. While the Peach Bottom and Surry SOARCA analyses [4][5] considered a variety of scenarios including station blackouts (SBOs), steam generator tube ruptures (SGTRs), and interfacing systems loss of cooling accidents (ISLOCAs), the Sequoyah SOARCA analysis focused specifically on short

-term SBO (STSBO) and long

-term SBO (LTSBO) scenarios only, as recommended in SECY 0092 [10]. The possibility of an SBO

-induced SGTR is not modeled. While the approximate likelihood of these accident scenarios modeled are discussed in Section 2.2, this study is a consequence analysis. Likelihood is only discussed for context, and no new work was performed on quantifying likelihood. These scenarios involve

14 The NRC's Site Level 3 PRA of Vogtle Units 3 & 4 includes within its scope multiunit accidents, spent fuel pool and dry cask accidents, and accidents during shutdown and low

-power modes. Information on the objectives and status of the Site Level 3 PRA is available on the NRC's website from the 2015 Regulatory Information Conference: http://www.nrc.gov/public

-involve/conference

-symposia/ric/past/2015/docs/abstracts/sessionabstract

-10.html 1-6 an immediate loss of offsite and onsite AC power. In the STSBO variation, early failure of the turbine driven auxiliary feedwater (TDAFW) system is assumed and direct current (DC) power is also immediately unavailable; thus, the accident can progress to core damage within the "short term". In the LTSBO variation, DC power is available until station batteries deplete and thus the accident can progress to core damage within the "long term". These are important scenarios for all light-water reactors, and for an ice condenser plant also because of its reliance on AC-powered igniters for hydrogen control.

1.4 Approach for Uncertainty Considerations The initial SOARCA studies were comprised of a deterministic base case analysis (documented in NUREG-1935 [3] and NUREG/CR

-7110 Volumes 1 and 2

[4][5]) for the Peach Bottom and Surry plants.

An integrated uncertainty analysis 15 for one of the Peach Bottom accident scenarios was begun before the conclusion of the initial SOARCA project, and subsequently completed and documented in NUREG/CR

-7155 [9]. A second draft uncertainty analysis for a Surry accident scenario, the unmitigated STSBO, was also subsequently completed and is documented as a draft report [16]. At the conclusion of the original SOARCA project

[3], one of the recommendations of the NRC's Advisory Committee on Reactor Safeguards (ACRS) was to conduct future deterministic studies and associated uncertainty analyses in parallel.

For the Sequoyah SOARCA analysis, an integrated uncertainty analysis (UA) was conducted as part of the study from the start. Because this study had a particular focus on the potential for early containment failure, and ice condenser containment

-specific issues, an uncertainty analysis was included for the scenario with more potential for early containment failure:

the unmitigated STSBO 16 scenario 17. In addition, separate supplemental sensitivity analyses were completed for issues not examined as part of the STSBO integrated UA. T he LTSBO scenario employed sensitivity analyses alone to examine potential variations in system response and results. For the MELCOR accident progression analysis, insights from the Surry SOARCA UA [16] were leveraged heavily to identify a reduced set of parameters to include in the Sequoyah integrated UA. Because of the Sequoyah SOARCA analysis' focus on insights unique to the ice condenser containment and potential vulnerabilities to hydrogen challenges, ice condenser containment

-specific and hydrogen

-specific considerations added new parameters to the list, resulting in the selection of 13 MELCOR parameters to vary in the integrated UA.

These parameters are further described in Section 3. For the MACCS offsite consequence analysis, parameters varied as part of the Sequoyah UA are the same as those in the Surry SOARCA UA [16], with the additions in Sequoyah of a time

-based 15 NUREG-1935 did not include a formal human reliability analysis within its scope. The Peach Bottom Uncertainty Analysis also did not include human actions within the scope of its integrated assessment. It did, however, document the results of a sensitivity analysis varying the timing of the two operator actions that are credited in the unmitigated LTSBO.

16 Because the unmitigated STSBO does not credit human actions, the UA does not address human actions.

17 An initial draft of the Sequoyah SOARCA analysis included two variations of the unmitigated STSBO

- with and without random ignition. The 'with' random ignition UA was not conducted for this final report. The reader is directed to Section 4 for further discussion and the DRAFT report of this effort [122].

1-7 crosswind dispersion coefficient and a parameter related to weather

-forecasting

-time used in the keyhole evacuation model. The selected parameter groups are further described in Section 5.9

. For a more complete discussion of the UA methodology used in this study, the reader is directed to Appendix A, "Uncertainty Quantification and Propagation," section which describes the probabilistic methodology.

The reader is also referred to the Appendix F , "Glossary of Uncertainty Analysis Terms

." The Sequoyah UA for the unmitigated STSBO employed a Monte Carlo approach as described in Appendix A of this report

. Uncertainty in chosen MELCOR and MACCS parameters was described by assigning distribution s of possible values.

The uncertainty in these input parameters was then propagated to results of interest using Monte Carlo simulation with simple random sampling in both the MELCOR uncertainty engine and WinMACCS, the Windows

-based user interface for MACCS

. The Monte Carlo results were post

-processed and analyzed using four regression techniques

- linear rank regression, quadratic regression, recursive partitioning, and multivariate adaptive regression splines (MARS) - as well as scatter plots

, and investigati on of interesting single realizations (the outcome of one vector of sampled input values of the

'n' successful Monte Carlo realizations).

The purpose of the regression analysis and scatter plots is to help explain the influence of uncertain inputs on the variation in analysis results, from the perspective of the total population of variations studied (in other words, the full set of successful Monte Carlo realizations). The single realization analyses are used to construct the phenomenological explanations for variations in system behavior (e.g., variations in containment failure time), and can be correlated to uncertainty in specific input parameters varied

. MELCOR, MelMACCS, and MACCS are the three primary codes used in this UA. These codes are continually enhanced, updated, and maintained as part of the NRC

's research program.

As improvements or fixes are implemented, the codes are updated.

The codes were designed for outputs from one code to become some of the inputs for the next code to support deterministic analyses. The codes have been integrated for use in analyzing uncertainty in the same manner implemented for the Peach Bottom UA [9] and Surry UA [16], as illustrated in Figure 1-3.

1-8 Figure 1-3 Diagram of code information flow for uncertainty analysis 1.5 Outline of Report Section 2 of this report describes the severe accident scenarios modeled, their estimated frequency, and the seismic event postulated to initiate them.

Section 3 describes the MELCOR model of Sequoyah used in the analyses and the approach used to develop it.

Section 3 als o discusses the MELCOR input parameters which are modeled using a distribution of values to account for epistemic uncertainty.

Section 4 describes the results of MELCOR accident progression calculations and the regression analysis used to provide insights into the uncertain input parameters of importance for MELCOR

. Section 5 describes the MACCS model of Sequoyah, the approach used to develop it, and the uncertain MACCS input parameters.

Section 6 describes the offsite consequence results in terms of individual early and latent cancer fatality risks along with the regression analysis used to assess the importance of MELCOR and MACCS uncertain input parameters on the results.

Section 7 provides a brief conclusion of the study's results and insights gained.

References are listed in Section 8. Appendix A contains a discussion on uncertainty quantification and propagation

. Appendix B provides the MACCS input parameters and radionuclide inventories used for this effort. Appendix C provides a discussion on the roadway capacity analysis used in the MACCS analysis. Appendix D discusses the MELCOR code and model updates that have affected the results since the DRAFT Sequoyah UA [122] was completed. Appendix E is the error log that provides modeling errors discovered after the UA runs were completed. Appendix F is the glossary of uncertainty analysis terms. For completeness, Appendix G provides all the MACCS 1-9 regression tables and scatter plots not used in the Section 6 discussions of consequence analysis results. Appendix H provides a comparative analysis between the MACCS model used for this effort and the MACCS model used in the DRAFT Sequoyah UA [122] effort. Finally, Appendix I is the detailed discussion of the focused safety valve study.

1-1 2-1 2. ACCIDENT SCENARIO DEVELOPMENT

2.1 Background

Ice condenser plants such as Sequoyah are unique because of low containment design pressure (12 psig for Sequoyah) and a relatively small volume containing a four loop PWR reactor coolant system (RCS) having a power rating of 3455 MW th, see Figure 1-1 for a comparison of containment types. A severe accident, such as a SBO, in such a plant can generate high concentrations of hydrogen which can potentially lead to early containment failure. The scope of this study is limited to SBO scenarios [10]. 2.2 Scenario Selection Information from the NRC's Standardized Plant Analysis Risk (SPAR) model for Sequoyah was used to assist the selection of SBO scenarios as candidates to be studied in this project. SBO events may arise from different hazards, such as seismic events, internal fire events, external flooding events, etc. Moreover, their occurrence frequencies are plant and site specific. Based on insights from available studies (i.e., References

[141] and [143]), high-pga (peak ground acceleration) seismic events (0.5 g pg a and above) are chosen as the representative initiators for the severe accident SBO scenarios to be analyzed in this study. SBO events stemming from other hazard categories would provide different event frequencies, recovery and mitigation opportunities. The two selected SBO scenario variations are (1) an early failure of the TDAFW system (STSBO) which includes loss of DC power systems and (2) a late failure of the TDAFW system (LTSBO) which includes the use of DC power systems prior to depletion of station batteries.

The initiating event for both accident scenarios in this study is a beyond design basis earthquake resulting in a loss of offsite power (LOOP) due to damaged transmission line s or switchyard components. The initiating event is similar to that in Surry and Peach Bottom SOARCA analyse s [4][5]. The emergency diesel generators (EDG s) also fail to start or the emergency AC power system becomes inoperable, and the event is classified as an SBO (i.e., loss of all onsite and offsite AC power

). In PWRs this can lead to loss of cooling water in the s team generators (SGs) and loss of water inventory in the RCS that covers and cools the core. Sections 2.2.1 and 2.2.2 define the STSBO and LTSBO accident scenarios, respectively. Section 2.3 discusses potential mitigation measures for the LTSBO scenario. Short-term Station Blackout (STSBO)

A seismically initiated STSBO has an estimated contribution 18 to the core damage frequen cy of approximately one in 500,000 years of reactor operation (2.0E

-6 per operating year)

19. For Sequoyah, STSBO scenarios include the auxiliary feedwater (AFW) system unavailable due to

18 This estimated core damage frequency contribution does not take into account the recent FLEX upgrades (see Section 2.3 for discussion) that can potentially avert core damage in the given scenario.

19 These numbers are based on TVA Seismic Hazard and screen report CNL 038 [143], and expert judgment. No new work was performed in this study to quantify the contribution to CDF. This discussion is included only to provide context of the likelihood of the scenarios studied in this consequence analysis.

2-2 a loss of DC power , failure of a TDAFW 20 system component

, or loss of the water supply due to the seismic initiating event

. A review of the survivability of systems, structures, and components (SSCs) of interest for the accident progression permits an assessment of the assumptions made in this analysis. In the STSBO, the AFW system is not credited, but the ice condenser, containment structure, and containment isolation system are modeled as surviving initially.

Ice Condenser

- Ice condensers are considered robust structures, typically having seismic capacities significantly above the design basis earthquake. The Sequoyah Individual Plant Examination for External Events (IPEEE) screened out the ice condenser with a high confidence in low probability of failure (HCLPF) value exceeding the review level earthquake criterion o f 0.3 g pga. Similar designs cite median capacities of the ice condenser at or above 2.0g (HCLPF above 0.7g) pga (e.g., see Reference [144], Section 4.4, page 11)

. A walkdown of the ice condenser for a plant with an ice condenser with the same design as the Sequoyah ice condenser confirms a large number of doors and an open internal structure that would provide redundancy to establish cooling and redundant pathway

s. Therefore, while the structure of the ice condenser could undergo some structural damage and some ice might drop for the seismic event, it was considered that the damage would not significantly prevent the ice condenser from performing its function. Containment structure and containment isolation system

- The IPEEE report for Sequoyah confirms that the steel containment structure has a high seismic capacity and there is high confidence that it would survive the seismic event. Fragility estimates of the isolation systems for another ice condenser plant with similar characteristics (e.g., see Reference [144], Section 4.4, page 11), assuming that the systems for that plant are adequate surrogates for the systems in the Sequoyah plant, indicates that there is high confidence that the isolation systems would survive the seismic event. As typical in PWRs, the Sequoyah containment isolation system relies on pneumatic and power actuations using automatic or manual signals and achieve isolation in multiple phases. A review of plant drawings and documents indicate that the containment isolation system, which is assumed to survive the seismic initiating event, will respond to Phase A isolation signal first. This will result in automatic closure of Phase A isolation valves. The operators are expected to ensure closure of RCP cooling water seal return and master valves in 30 minutes, as this action is suggested in PWR SAMGs. On high containment pressure 2.81 psig, which is Phase B isolation signal for Sequoyah, certain valves (e.g., the ERCW system), will not be closed and would be assigned a priority by plant staff for manual isolation, as needed. Furthermore, most the valves that are part of a complete containment isolation are actually connected to the secondary side of the reactor system needed for process flow and do not directly communicate with containment atmosphere or RCS, and several systems have check valves preventing flow out of the containment. Vent, purge and air return lines will automatically isolate except for allowable leakage. There are about a dozen valves which can be closed by operators if directed to do so within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months during STSBO scenario. Many of these valve are on closed

-

20 The authors note that TVA has upgraded and performed modifications to the TDAFW system to better cope with external events such as earthquakes. However, the NRC had not finished a review of these upgrades at the time of this report and thus a discussion of this new capability is not included.

2-3 loop systems in and out of containment. An assumption of this study is that containment is isolated for the two scenario considered.

The Hydrogen Mitigation System (HMS) can become operational if the 480 Volt AC bus and DC power is restored. The igniters can be turned on manually from control room and require operator action.

The following list shows the key events assumed at the plant for the STSBO scenario, with unavailability of the AFW system due to a beyond design basis earthquake. These define the boundary conditions for the unmitigated STSBO case used for the MELCOR analyses. LOOP initiating event, a beyond design basis earthquake, occurs

. The reactor protection system will automatically actuate upon a LOOP and terminate the fission power reaction

- reactor is tripped.

The EDG s, emergency onsite AC, will receive a start signal but will fail due to either random failures or the seismic event

. The reactor coolant pumps (RCP s) will coast down and stop within a few minutes and all other pumps normally running (e.g., chemical and volume control system (CVCS) charging pumps) stop due to loss of AC power.

Valves designed to fail

-close, close to isolate systems and the containment (e.g., Main Steam Isolation Valves (MSIVs)). Emergency AC power is not available due to SBO, therefore the motor-driven AFW (MD-AFW) pumps fail to start.

TDAFW is inoperable due to either random failures or the seismic event

. Fission product decay heat continues to heat the water in the reactor vessel.

The safety valves (SVs) on the secondary system initially cycle to remove decay heat remove decay heat from the primary system, which decreases the SG water inventory until empty

. Once the SG inventory is gone, the SVs on the primary cycle to control the pressure, which decreases the RCS water inventory

. The RCP seals start to leak initially at a nominal rate of 21 gpm per pump due to the failure of the pump seal cooling injection.

AC power recovery prior to core damage is unsuccessful (both offsite and onsite).

2-4 Long-term Station Blackout (LTSBO)

A seismically initiated LTSBO has an estimated contribution 21 to core damage frequency of one in approximately 100,000 years of reactor operation (1.0E

-5 per operating year).

22 The system availabilities following the seismic initiating event are the same as those noted for STSBO, with one exception

- the TDAFW is initially operable in the LTSBO due to the availabilit y of DC power and one of the AFW system water supplies discussed in Section 2.2.1. The ice condenser, containment structure, containment isolation system, and HMS are modeled as surviving initially, same as in the STSBO scenario. In addition, the AFW system is credited initially in the LTSBO and hence the survivability is reviewed.

Auxiliary Feedwater Systems

- The natural source s of water for the TDAFW are the two CST s, which were not designed and built as safety

-related structures. Using the seismic fragility derived by Nie [108] for similar steel CSTs designed for a safe-shutdown earthquake (SSE) similar to that used in the design of Sequoyah

, and the fragility function for a similar CST developed in NUREG/CR

-5720 [109], the HCLPF and median fragility for these tanks are estimated to be about 0.3g - 0.4g and 0.75g - 0.9g, respectively. This means that there is confidence that the CST tanks would survive a seismic event with a 0.4g pga, and a likelihood of about 50% that they would survive a seismic event with a 0.9g pga. The plant operator upgraded the auxiliary feedwater (AFW) system and the CST tanks to better cope with external events such as earthquakes but details of that upgrade were not yet reviewed by the NRC at the time of the Sequoyah SOARCA study. Review of those details or related additional information from the plant operator will permit confirmation or revision of this survivability review. The following list shows the key events assumed at the plant for LTSBO, due to a bey ond design basis earthquake. These define the boundary conditions for the unmitigated LTSBO case used for the MELCOR analyses. LOOP initiating event, a beyond design basis earthquake, occurs

. The reactor protection system will automatically actuate upon a LOOP and terminate the fission power reaction

- reactor is tripped.

The EDG s, emergency onsite AC, will receive a start signal but will fail due to either random failures or the seismic event

. The RCP s will coast down and stop within a few minutes and all other pumps normally running (e.g., CVCS charging pumps) stop due to loss of AC power.

Valves designed to fail

-close, close to isolate systems and the containment (e.g., MSIVs).

21 This estimated core damage frequency contribution does not take into account the recent FLEX upgrades (see Section 2.3 for discussion) that can potentially avert core damage in the given scenario

. 22 These numbers are based on TVA Seismic Hazard and screen report [143] and expert judgment. No new work was performed in this study to quantify the contribution to CDF. This discussion is included only to provide context of the likelihood of the scenarios studied in this consequence analysis.

2-5 The AFW system automatically receives a start signal. Emergency AC power is not available due to SBO, therefore MD

-AFW pumps fail to start. The DC-MOV steam supply valve automatically opens and starts TDAFW pump.

Fission product decay heat continues to heat the water in the reactor vessel.

Initially, the SVs on the primary and secondary system s cycle to control the pressure , which decreases the RCS water inventory and SG water inventory, respectively

. The RCP seals start to leak initially at a nominal rate of 21 gpm per pump due to the failure of the pump seal cooling injection

. The TDAFW pump will automatically maintain the water level in the steam generators, which will remove decay heat from the core using natural convection heat transfer and prevent core damage as long as AFW water inventory is available. The operators will simultaneously attempt to mitigate the accident by initiating steam generator cooling down, restoring AC power or aligning diesel

-driven portable pumps.

Manual DC deep load shedding and secondary depressurization is successful. The secondary depressurization stops at 160 psig to maintain adequate steam pressure for the TDAFW pump. DC batteries are exhausted after its nominal lifetime (nominally 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months with successful load shedding) and all attempts to restore AC power prior to core damage are unsuccessful (both offsite and onsite). The TDAFW injection stops if the turbine over speeds (i.e., a mechanical trip) or the SG overfills. LTSBO scenario variations examine both responses as well as successful operator control following the loss of DC power.

The atmospheric relief valve closes following the loss of DC power and the secondary SVs cycle to control pressure.

2.3 Mitigative Measures Sequoyah operators are expected to follow the emergency procedures, such as ECA-0.0 , "LOSS OF ALL AC POWER

" during a SBO event. For example, if the TDAFW system is inoperable due to failure of DC power, then the operators can start the system by manually opening the steam line valve s to start the pump and control it manually to avoid a STSBO. Recently added FLEX equipment provide many additional options for the operators to restore power, or add components like pumps, alternate sources of water, and piping connections to SGs or the RCS

[110]. Following confirmation of the LOOP and failure of the EDGs, which can take about 15 minutes, the declaration of extended loss of AC power (ELAP) is made typically with in one hour of the SBO. If cooling water level in a SG or RCS is not restored, then the peak core temperature can reach 1200

°F within two to three hours. Additionally, a technical support center becomes operational to start implementation of severe accident management guidelines (SAMGs) [140] and FLEX support instructions (FSIs) [110]. Using the plant

-specific SAMG s and FSI s, the recommended mitigating actions are identified for plant operators. If these actions are successful in time, then a RCS breach or containment failure can be prevented

, or containment failure can be delayed long enough to allow emergency evacuation plans to be implemented.

2-6 For this project, the SAMGs and recently developed FSI s were reviewed for mitigating actions. The actions identified in the FSI s and the supporting document including time duration for adding mitigating equipment, have been recently submitted by TVA in response to NRC Order EA-12-049 [142]. The containment igniters (HMS) are important to mitigate early containment failures. If these igniters have power, DC for instrumentation and control and AC for heating the igniter elements, prior to a significant accumulation of hydrogen in the containment, then early containment failure during a STSBO or LTSBO can be avoided, which allows more time to implement emergency protective actions. The generation of a significant amount of hydrogen can be prevented if operators can successfully complete mitigating actions, (i.e., maintaining the SG water level and maintaining the water level in the reactor above the top of active fuel.

) A "mitigated" scenario modeling FLEX implementation was not included in this study. For scenarios where FLEX equipment upgrades and FSIs are assumed to be successful in averting core damage, there would be no offsite health consequences to analyze.

2.4 Scenarios Modeled in This Study One variation of the unmitigated STSBO is analyzed in this study

without the presence of random ignition sources

23. An uncertainty analysis is performed for this unmitigated STSBO case. The only potential mitigation that is modeled for the STSBO scenario is a deterministic case crediting a successful power supply to the igniters. Section 4 discusses further details of these STSBO cases.

Multiple variations of the unmitigated LTSBO are analyzed deterministically in this study. In the unmitigated 24 LTSBO scenario, two emergency operating procedure (EOP)

-based operator actions are credited. First, the operators must complete load shedding to extend DC battery life to 8 hrs.25 Second, the operator s can use the steam generator atmospheric relief valves and with the TDAFW system for makeup water injection , perform feed and bleed steps that cool down the RCS and lower SG pressure to about 160 psig. This will allow accumulators to passively inject water into the RCS. These operator actions of cooling the RCS and adding water from accumulators further delay the failure of the RCS and potential containment failure. Except for the time delay, the unmitigated LTSBO accident progression is similar to the STSBO. Additional sensitivity cases are examined for the LTSBO scenario. Section 4 discusses further details of these LTSBO cases.

23 The 'with' random ignition UA was not conducted for this final report. The reader is directed to Section 4 for further discussion and the DRAFT report [122] of this effort.

24 "Unmitigated" here is used in the same way as the original SOARCA study [3], meaning SAMGs, FSI, and 10 CFR 50.54(hh)(2) measures are not credited, but EOPs are credited. 25 A sensitivity case is also included where the DC battery life is only 4 hrs.

3-1 3. SEQUOYAH MELCOR MODEL The Sequoyah MELCOR model is equally representative of the two functionally identical units at TVA's Sequoyah Nuclear Plant. Both Sequoyah units comprise a Westinghouse 4

-loop PWR in an ice-condenser containment with an operating power of 3,455 MW th. The Sequoyah MELCOR model is current with respect to the steam generator replacements accomplished at the plant circa 2012.

During multiple site visits, substantial information was obtained for updating the MELCOR model including detailed characteristics of replacement steam generators.

The model description below identifies the activities in building the Sequoyah MELCOR input deck.

3.1 Sequoyah MELCOR Model Description The baseline Sequoyah MELCOR model [68] was modified primarily in four areas. The first area was the reactor core where the representation was upgraded to be consistent with MELCOR Version 1.8.6 and then MELCOR Version 2.2. This upgrade included the following, most of which are discussed in further detail in Section 3.1.12: 1. Replacing the cylindrically

-walled flat

-bottomed geometry of the lower head with a hemispherical geometry

2. Adding core former and core baffle structures that bec ame fully integrated into core degradation modeling which includes treatment of debris in the bypass region between the core barrel and the core shroud; 3. Activating logic for simulating the formation of molten pools in the lower plenum and the core, crust formation, convection in molten pools, stratification of molten pools into metallic and oxide layers, and partitioning of radionuclides between stratified molten pools; 4. Making use of a revised reflood quench model that separately tracks the component quench front, quench temperature, and unquenched temperatures

5. Activating a control rod silver release model

6. Applying the CORSOR

-Booth fission product release model

and 7. Updating core degradation modeling practices

. The second area addressed numerous plant design features and safety systems while updating and converting the model from MELCOR Version 1.8.6 to MELCOR Version 2.2. Existing modeling was enhanced and new modeling was added to broaden the capabilities of the Sequoyah model in addressing a wide range of severe accident sequences. These enhancements included the following

1. Largely redefining the SG representations using data supplied by the plant (Section 3.1.2); 2. Revising containment overpressure failure modeling (Section 3.1.7);

3-2 3. Revising the operation of the pressurizer and secondary system pressure relief valves such that they fail open after a certain number of cycles (Section 3.1.12); 4. Revising containment floor areas to better predict flooding of the lower compartments (Section 3.1.6); 5. Accounting for heat loss from the reactor to the containment

6. Adding a TDAFW model with control logic representing automatic

, manual, and uncontrolled operation (Section 3.1.9); 7. Accounting for steam draw by the TDAFW , an over-speed trip, failure by flooding, and variable performance of the pump with changing speed (Section 3.1.9); 8. Accounting for nitrogen discharge from the accumulators as they empty

9. Updating core fission product inventory, decay heat, and axial and radial peaking factors (Section 3.1.1); 10. Adding detailed fission product tracking

11. Adding better representation of natural circulation in the hot legs and steam generators (Section 3.1.2); 12. Adding gaps around the inlet and exit doors of the ice condenser for better representation of leakage flows (Section 3.1.6); 13. Managing the ignition of hydrogen deflagrations with additional mechanistic considerations (Section 3.1.8); 14. Updating the ice condenser door modeling (including lower and upper plenum door, and the intermediate deck doors) based on the information provided in [17]; 15. Revising the characteristics of RCP seal leakage to be consistent with current best modeling practice as implemented in the Surry UA [16]; 16. Representing the rubberized fabric seal that completes the separation between lower and upper containment and uncertain failure of the seal from excessive pressure loading or overheating;

17. Considering hot gas vented from the PRT through a broken rupture disk to be a source of ignition for hydrogen deflagration in containment; and

18. Correcting the heat transfer association between the PRT and lower containment surrounding the tank such that partial submerging of the tank in ice melt pooled on the containment floor is recognized, and

19. Adding check

-valve function to ice chest drains.

3-3 The third area of enhancements was representation of operator and mitigative actions which are discussed further in Section 3.1.10. Logic was added to manage the following activities

1. The planned operator action at Sequoyah in the case of a LTSBO where the RCS will be cooled and depressurized by venting one of the four steam generators to 200 psig 2. Successful operator control of TDAFW following loss

-of-DC power (see Section 2.2.2) 3. Operator actions to restore power to the igniters by the time hydrogen is generated and released to the containment.

Lastly, modifications to the Surry model in support of the Surry UA [16] were made to the Sequoyah model, where appropriate, and some final items specific to Sequoyah were added or modified. The additions and modifications involved:

1. Adding multiple control volumes (both axially and radially) to better represent the ice chests, and inlet and outlet plenum compartments;

2. Adding detailed SG nodalization;

3. Adding and updating sensitivity coefficients per current Sandia National Laboratories (SNL) best practices

[7]; 4. Adopting the latest MELCOR CAV package default heat transfer modeling that better capture the heat transfer from core

-concrete debris to an overlying pool of water;

5. Adding changes to containment condensation per accepted historical work accomplished with the CONTAIN code [18]; 6. Limiting maximum time step size to 100 ms for the first 24 hr and to 250 ms thereafter;

7. Added likewise for main steam line (MSL) safety valves;

8. Implementing a variable melting temperature for the eutectic formed between UO 2 and ZrO 2 (and, correspondingly, a variable temperature at which oxidized fuel cladding is assumed to melt): and

9. Revising pump seal failure modeling to specify discrete leakage per Westinghouse Owners Group recommendations (a sensitivity study into differing leakage rates was accomplished).

Some of the corrections/enhancements cited above were made to the Sequoyah MELCOR model since the DRAFT UA [122] was accomplished. These are discussed in Appendix D complete with a description of the improvement associated with them.

Important aspects of the Sequoyah plants represented in the Sequoyah MELCOR model are presented in Table 3-1.

3-4 Table 3-1 Important Sequoyah Parameters Parameter Value Units Rated core power 3,455 MW th Number of fuel assemblies 193 - Fuel rod array size 17 x 17 - Fuel rods per assembly 264 - Fuel (UO 2) mass 102,130 kg Zircaloy mass as fuel cladding 23,127 kg RPV inner diameter 2.202 m RPV inner height 12.294 m Pressurizer PORV capacity 2 x 22.55 @ 16.20 kg/s @ M Pa(g) Pressurizer safety valve capacity 3 x 52.92 @ 17.13 kg/s @ M Pa(g) PRT volume 52.13 kL PRT initial inventory 25.60 kL PRT burst disk rupture pressure 6.90 bar(g) Reactor inlet/outlet temperature 289/325 °C RCS coolant flow 16,907 kg/s Nominal RCS pressure 15.41 M Pa(g) Number of steam generators 4 - Steam generator recirculation ratio*

11.2 - Steam generator heat transfer area 5,139 m 2 Secondary pressure 5.890 M Pa(g) MSIV leakage area 0.1 in 2/valve Steam generator secondary water mass 192,512 k g Steam generator secondary side volume 710 kL CST water volume 908.50 kL RWST inventory 1,341.49 kL TDAFW capacity 55.52 @ 6.932 L/s @ M Pa(g) Motor-driven AFW capacity 2 x 27.8 L/s Containment failure pressure 52 to 78**

psig Containment free volume 33,613 kL Containment operating pressure 0 bar(g) Containment operating temperature 30.0 upper 38.1 lower 1.9 ice °C Accumulator combined water volume 124.8 kL Accumulator pressure 4.302 M Pa(g) High head safety injection max flow 41.0 L/s Low head safety injection max flow 378.5 L/s Ice mass 1,165,760 kg

Ratio of riser flow to steam flow

- Median value of 67 psig Reactor Core and Vessel The MELCOR input model for the Sequoyah core and reactor pressure vessel are discussed in this section. This includes the COR package nodalization of the core and lower

-plenum regions, over which core degradation, material relocation, and radionuclide releases are resolved, and the corresponding hydrodynamic (namely in the CVH/FL/HS packages) representation that provides thermal

-hydraulic coupling to COR

-related phenomena. The upper regions of the 3-5 vessel are represented using control volumes, flow paths, and heat structures. This section also discusses the decay heat and radionuclide inventory inputs for the severe accident and consequence analyses.

Core and Vessel Nodalization The MELCOR COR and CVH nodalizations for the active fuel and lower plenum regions of the reactor vessel are shown in Figure 3-1. The active fuel region of the reactor core was represented with five concentric rings and 12 axial levels. An additional six levels were included to represent core lower support structure

, and a single level was included to represent the fuel assembly upper tie plate (for a COR nodalization comprised of a total 19 axial levels). In the core and lower plenum regions, single hydrodynamic control volumes were coupled to several axial core cells. The CVH and COR packages exchange information to evaluate the fluid thermal-hydraulics and core material responses, respectively.

Twenty control volumes are coupled to the fueled cells of the COR nodalization with four vertically stacked volumes associated with each of the five concentric rings. A parallel control volume represents the bypass region of the core. A single control volume represents the lower plenum and is coupled to the six lower axial levels of the COR nodalization as illustrated in Figure 3-1. The remaining control volumes in the RPV represent the upper plenum as illustrated in Figure 3-2. At each axial level of the core, coolant cross

-flow between outer ring of fuel assemblies and the bypass region (i.e., following failure of the core shroud) are accommodated by horizontal flow paths. Structures making up the RPV not accounted for in the COR nodalization were modeled with a collection of heat structures representing the RPV wall , thermal shield, core barrel and upper plenum internals.

The reactor operating power was specified to be at the rated conditions, 3,455 MW th. Radionuclide inventories and decay power s were defined for Sequoyah's 193 17x17 fuel assembles.

Representative radial and axial power shapes were applied and informed by plant operating data.

Further discussion of the decay power and lumped

-radionuclide inventory inputs for the MELCOR model, as well as nuclide inventories for source term input to MACCS, is provided in Section 3.1.1.2. The core support structures are modeled as distinct structures in the MELCOR COR package, and failure is calculated based on temperature and stress criteria, as specified in the MELCOR COR User's Guide and Reference Manual [19][20]. The core support and diffuser plates of a Westinghouse reactor are column

-supported, and the assemblies load the plates between the columns. These plates are modeled as grid supported plates per SNL MELCOR modeling best practice [7]. The lower core plate , is modeled as an edge

-supported plate. Self

-supporting column structures are located between the plates.

The lower head is modeled as a hemispherical carbon steel structure. A one

-dimensional model of the stress and strain distribution in the lower head was used to determine failure. Alternatively, the lower head can fail without stress when the melting temperature of steel is reached. When the failure criterion is met, there is a gross failure of the RPV lower head that rapidly discharges the lower plenum debris into containment

.

3-6 Figure 3-1 MELCOR COR/CVH nodalization

. 0.1445 m 1.1610 m 1.9481 m 2.2365 m 2.7595 m 2.8103 m 3.1151 m 3.4199 m 3.7247 m 4.0295 m 4.3343 m 4.6391 m 4.9439 m 5.2487 m 6.1631 m 6.4679 m 6.6377 m 108 208 308 408 508 109 209 309 409 509 110 210 310 410 510 111 211 311 411 511 112 212 312 412 512 113 213 313 413 513 114 214 314 414 514 115 215 315 415 515 116 216 316 416 516 107 207 307 407 507 105 205 305 405 505 103 203 303 403 503 102 202 302 603 101 201 301 402 502InstrumentThimble Tubes (MELCOR SS

-COLUMN)Lower Support Columns (MELCOR SS

-COLUMN)Upper Support Columns and Flow Mixer Plate (MELCOR SS

-PLATEG)Lower Core Plate (MELCOR SS

-PLATEG)Active Fuel and Control Rods (Core Shroud and Former in Ring 5)Westinghouse 4-Loop PWR with Ice Condenser ContainmentCore Nodalization R 1 = 0.4353 m R 2 = 0.9116 m R 3 = 1.2373 m R 4 = 1.4739 m R 6 = 2.202 mCore CellsLower Head NodalizationFlow Path Opens at Shroud FailureFlow Path Controlled by COR Blockage Model Legend 0.5160 mDZLH = 0.1397 m 104 204 304 404 504Lower Core Plate and InstrumentThimble Tubes (MELCOR SS

-PLATE)HLST = 1.9481 m 5.8583 m 5.5535 m 118 218 318 418 518 R 5 =1.8796 m 117 217 317 417 517 Un-fueled Plenum (MELCOR CL) and Control Rods (MELCOR NS)119 219 319 419 519 CV 320Lower Plenum C V 3 7 1 C V 3 8 1 C V 3 3 0 C V 3 7 2 C V 3 8 2 C V 3 7 3 C V 3 8 3 C V 3 7 4 C V 3 8 4 FL 370 FL 380 FL 334 FL 383 FL 112 FL 122 FL 132 FL 374 FL 384 CV 345 CV 355 CV 375 CV 385 FL 391 B y p a s s FL 434Westinghouse 4-Loop PWR withIce Condenser ContainmentCVH/FL Nodalization FL 433 FL 432 FL 431 C V 3 1 0 D o w n c o m e r FL 392 FL 382 FL 381 FL 372 FL 373 FL 360 CV 365 FL 340 FL 350 FL 390 FL 364 FL 354 FL 344 FL 324 FL 314 FL 304 FL 333 FL 323 FL 313 FL 303 FL 332 FL 322 FL 312 FL 302 FL 331 FL 321 FL 311 FL 301 C V 3 6 1 C V 3 5 1 C V 3 4 1 FL 343 FL 353 FL 363 FL 342 FL 352 FL 362 FL 371 FL 341 FL 351 FL 361 C V 3 4 2 C V 3 5 2 C V 3 6 2 C V 3 4 3 C V 3 5 3 C V 3 6 3 C V 3 4 4 C V 3 5 4 C V 3 6 4 3-7 Figure 3-2 Upper RPV CVH/FL nodalization

. CV 344 CV 390Upper PlenumWestinghouse 4-Loop PWRwith Ice Condenser ContainmentUpper RPV CVH

/FL Nodalization C V 3 1 0 D o w n c o m e r FL 394 FL 344 C V 3 4 7 C V 3 4 5 C V 3 8 7 C V 3 8 6 F L 3 8 6 FL 388 C V 3 8 5 C V 3 4 9 C o n t r o l R o d s C V 3 8 9 C o n t r o l R o d s FL 393 FL 385 FL 389 CV 384 FL 384 FL 348 F L 3 4 5 FL 349 CV 374 FL 374 C V 3 7 7 C V 3 7 5 C V 3 7 9 C o n t r o l R o d s FL 378 F L 3 7 5 FL 379 CV 364 FL 364 C V 3 6 7 C V 3 6 5 C V 3 6 9 C o n t r o l R o d s FL 368 F L 3 6 5 FL 369 CV 354 FL 354 C V 3 5 7 C V 3 5 5 C V 3 5 9 C o n t r o l R o d s FL 358 F L 3 5 5 FL 359 FL 306 FL 316 FL 326 FL 336 FL 337 FL 308 FL 318 FL 328 FL 338 3-8 The active core region is discretized into 60 nodes, which includes five axisymmetric rings and 12 axial levels. Above the active core there is one axial level to represent the upper core structures and the unfueled gas plenum at the top of the fuel rods. Below the core, 6 levels are used to represent the core support plate and lower plenum region. In total, 97 COR nodes are used to model the core and lower plenum of the reactor. This use of COR nodes permits spatially resolved calculations of heat transfer, oxidation reactions, and material relocation.

The fuel assemblies are allocated over the five active core rings. Table 3-2 and Figure 3-3 show the radial distribution of fuel assemblies.

This nodalization scheme captures the radial decay power distribution over the core which is important for MELCOR core heat-up and degradation calculations. Figure 3-4 depicts the mapping of core power distribution to the one

-dimensional COR rings in the Sequoyah MELCOR model as informed by proprietary plant operating data. As shown in Figure 3-4 , Ring 5 ha s relatively low power density compared to Rings 1-4 (see Table 3-2). The left inset in Figure 3-4 shows the relative decay power level for each fuel assembly where red assemblies signify above

-average relative power fraction, yellow denotes near-average power fraction, and blue denotes below average power (color contour scale is omitted to protect proprietary information). The center inset illustrates how this information is integrated into a 1D radial power distribution for the MELCOR model, which is given by the right inset picture in Figure 3-4. The axial decay power distribution for the Sequoyah MELCOR model, as shown by Figure 3-5, is also informed by proprietary plant operating information; the plant data is mapped onto the 12 active fuel levels used in the model. In this figure, axial power is normalized to the nodal average, and the ordinate is normalized to the active fuel height of the MELCOR model (about 3.66 m).

Table 3-2 MELCOR rings

,number of fuel assemblies, and relative power densities.

MELCOR Ring Number of Assemblies Relative power density 1 13 1.222 2 44 1.210 3 44 1.150 4 48 1.062 5 44 0.356 Total 193 3-9 Figure 3-3 MELCOR radial nodalization of Sequoyah core.

Figure 3-4 Mapping of core power distribution to MELCOR COR rings.

R P N M L K J H G F E D C B A15 5 5 5 5 5 5 514 5 5 4 4 4 4 4 4 4 5 513 5 4 4 4 3 3 3 3 3 4 4 4 512 5 4 3 3 3 2 2 2 3 3 3 4 511 5 4 4 3 3 2 2 2 2 2 3 3 4 4 510 5 4 3 3 2 2 2 1 2 2 2 3 3 4 5 9 5 4 3 2 2 2 1 1 1 2 2 2 3 4 5 8 5 4 3 2 2 1 1 1 1 1 2 2 3 4 5 7 5 4 3 2 2 2 1 1 1 2 2 2 3 4 5 6 5 4 3 3 2 2 2 1 2 2 2 3 3 4 5 5 5 4 4 3 3 2 2 2 2 2 3 3 4 4 5 4 5 4 3 3 3 2 2 2 3 3 3 4 5 3 5 4 4 4 3 3 3 3 3 4 4 4 5 2 5 5 4 4 4 4 4 4 4 5 5 1 5 5 5 5 5 5 50.30.40.50.60.70.80.91.01.11.21.31.4 0 1 2 3 4 5Relative power densityMELCOR COR ring numberNode sizes:ring 1:13 assembliesring 2: 44 assembliesring 3: 44 assembliesring 4: 48 assembliesring 5: 44 assemblies 12 11 10 9 8 7 6 5 11 10 9 8 7 6 5 4Ring 1Ring 2Ring 3Ring 4Ring 5 3-10 Figure 3-5 Axial distribution of decay power for Sequoyah MELCOR model.

Decay Heat and Radionuclide Inventory This section discusses the decay heat and radionuclide inventory inputs created for the MELCOR and MACCS models of Sequoyah. An overview of the methodology for generating these inputs is provided. Whole

-core decay heat curves are presented in this section, as are lumped RN-class inventories. Associated nuclide

-level inventories for MACCS may be found in Table B-11 of Appendix B

. Consistent decay heat and fission product inventories inputs for the MELCOR and MACCS models of Sequoyah were created using SCALE6 [120]. Radionuclide class inventories, class decay powers, and total core decay power information are derived for MELCOR, along with a corresponding nuclide

-level inventory for MelMACCS input. The methodologies used to generate the MELCOR and MACCS inputs for Sequoyah are consistent with code best-practices [7][8] and past severe accident research including NUREG

-1935 [3], previous SOARCA UA projects [9][16], and Fukushima research

[21]. The SCALE6 calculations make use of proprietary plant operating data from cycles 12

-14 at Sequoyah. Fuel assemblies in the Sequoyah core during cycle 14 include fresh fuel and previously irradiated fuel that is largely from cycles 12 and 13. The severe accident initiator and subsequent reactor shutdown are defined to occur during cycle 14. Cycle 14 is assumed to have an anticipated operating time of 550 days at full power. In order to examine a range of decay heat and inventory conditions in the severe accident and consequence analyses, the SCALE6 calculations are conducted for variable shutdown timing in the last operating cycle. This enables analysis of the influences of operating time and integral burnup during a cycle. For this purpose, reactor shutdown is specified to occur in the SCALE6 calculations at three distinct periods in cycle 14: near the beginning of cycle (BOC) at about 6 days, near middle of cycle (MOC) at 200 days, and near the end of cycle (EOC) at about 529 days. This information and the corresponding whole

-core burnups are listed in Table 3-3. MELCOR and MACCS analyses are conducted for each of these three conditions. The sampling distribution and justification for the timings of BOC, MOC, and EOC are described in Section 3.13. 0.00.10.20.30.40.50.60.70.80.91.00.30.40.50.60.70.80.9 11.11.21.3Normalized fuel heightPeaking factor 3-11 Table 3-3 Prescribed BOC, MOC, and EOC characteristics for Sequoyah Cycle 14.

Case Time of shutdown into Cycle 14 (days)

Whole-core burnup (GWd/t)26 BOC 6.25 18.2 MOC 200 25.6 EOC 528.75 38.3 The decay heat and radionuclide information for MELCOR and MACCS are derived using standalone ORIGEN

-S/ARP calculations that make use of data libraries derived from Sequoyah-specific lattice models and modern ENDF/B

-VII nuclear data

[120]. Cross section libraries for ORIGEN

-S/ARP are generated using the TRITON sequence in SCALE6

[120], and the data libraries represent the 17x17 fuel lattice used in Sequoyah. The resultant one

-group cross sections reflect problem

-specific, flux

-weighted values over the 17x17 fuel lattice. This information is generated as a function of burnup for interpolation by the ARP module.

Since burnup calculations are to be executed for each assembly and for a variety of burnup conditions, it is desirable to perform standalone ORIGEN

-S/ARP calculations in order to expedite CPU time and facilitate subsequent sensitivity studies. The decay heat and inventory inputs for MELCOR and MACCS are integral quantities (e.g. whole-core power, lumped radionuclide classes

, and whole-core nuclide inventories). Therefore, standalone depletion calculations with reasonably representative cross section libraries are sufficient for severe accident consequence simulations, especially when taking into account the many varied uncertainties associated with such simulations

. Figure 3-6 and Figure 3-7 depict the calculated decay heat curves for reactor shutdown at BOC, MOC, and EOC of Sequoyah Cycle 14. Figure 3-6 presents the three curves on a logarithmic time scale, and Figure 3-7 is on a linear scale out to 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months after. As shown in Figure 3-6 , decay heat immediately after shutdown is similar for the three cases, and it reflects the near

-constant steady state decay heat generated by a reactor that has been operating for an appreciable amount of time. This heat is generally 6

-7% of the recent operating power level. Shortly after shutdown, the decay heat is dominated by many short

-lived nuclides that quickly reach equilibrium/saturation concentrations due to short half

-life , and in some cases

, significant neutron absorption cross section. As burnup increases through the cycle, the near

-steady concentrations of these short lived nuclides are influenced by changes in production rate. Neutron spectrum evolves gradually with burnup, affecting flux

-weighted cross sections, and plutonium buildup changes the effective yields of fission products. Hence, the MOC decay power is actually slightly greater (1

-2%) than the EOC decay power for the first 100 s after shutdown. After 100 s, the EOC decay power exceeds MOC due to greater accumulation of longer-lived nuclides that build more monotonically with burnup.

26 Continuous operation at full power is assumed for simplicity and due to limited available plant information.

3-12 Figure 3-6 Sequoyah decay heat curves on logarithmic time scale.

Figure 3-7 Sequoyah decay heat curves on severe accident time scale.

T i m e (s)D e c a y p o w e r (M W)1 0 0 1 0 1 1 0 2 1 0 3 1 0 4 1 0 5 1 0 6 0 2 5 5 0 7 5 1 0 0 1 2 5 1 5 0 1 7 5 2 0 0 2 2 5 B O C M O C E O C T i m e (h r)D e c a y p o w e r (M W)0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 0 1 0 0 0 5 1 0 1 5 2 0 2 5 3 0 3 5 4 0 4 5 5 0 B O C M O C E O C 3-13 Lumped RN-class inventories for MELCOR input are listed for BOC, MOC, and EOC in Table 3-4. RN classes are predominately comprised of long

-lived and stable nuclides by mas s and build monotonically with burnup except for the uranium class. The uranium class is comprised only of radioactive uranium isotopes that largely deplete and decrease with burnup. There are many stable fission and decay products that are produced in the fuel (e.g., 133Cs). This stable nuclide mass is important to include in the overall class mass for the purposes of radionuclide transport, deposition, and aerosol mechanics. The relative mass increase progressing from BOC to EOC reflects the different associated burnups of each condition. For instance, the EOC inventory of noble gases is 2.1 times greater than the BOC inventory (600.07 kg / 284.02 kg), which is nearly equal to the ratio of the associated whole

-core burnups Table 3-4 Lumped MELCOR RN

-class inventories.

Class (representative)

BOC (kg) MOC (kg) EOC (kg) 1 Noble Gases (Xe) 284.02 402.33 600.07 2 Alkali Metals (Cs, as CsOH) 36.01 50.44 73.54 3 Alkaline Earths (Ba) 121.95 174.67 253.87 4 Halogens (I, as gaseous I2) 0.0102 0.0264 0.0910 5 Chalcogens (Te) 26.05 36.80 55.15 6 Platinoids (Ru) 176.70 250.99 398.21 7 Early Transition Elements (Mo) 169.36 234.46 347.94 8 Tetravalent (Ce) 713.60 993.72 1370.29 9 Trivalents (La) 388.72 545.31 819.76 10 Uranium (U) 87920.55 87074.45 85719.75 11 More Volatile Main Group (Cd) 4.82 6.60 11.10 12 Less Volatile Main Group (Sn) 5.17 7.34 11.91 16 Cesium iodide (CsI) 20.79 29.60 44.18 17 Cesium molybdate (Cs 2MoO 4) 155.17 217.39 316.94 Total cesium class mass 160.6 5 225.29 328.94 Total iodine class mass 10.1 7 14.4 8 21.67 Total molybdenum class mass 210.52 292.11 432.00 Speciation of key classes for cesium and iodine is informed by MELCOR best practices [7] and SOARCA Peach Bottom UA work [9], but the implementation here is adapted from methodology of the Surry UA [16]. An initial inventory of gaseous iodine, which is entirely in the fuel

-cladding gap, is assumed using the fractions listed in Table 3-5. These values are consistent with those implemented in the Surry UA [5]. The gaseous iodine is determined by applying the fractions in Table 3-5 for either BOC, MOC, or EOC to the appropriate total iodine class mass from Table 3-4. The remaining iodine class mass is allocated to the CsI combination class. Consistent with the NUREG

-1935 [3] and NUREG-1465 [121], 5% of all cesium class mass is initially in the fuel

-cladding gap, which includes cesium from CsI in the gap (5% of all CsI is also in the gap). Excluding the gap contribution from CsI, all cesium in the fuel

-cladding gap is treated as CsOH. After this speciation, NUREG

-1935 [3] allocated the remaining cesium to the Cs 2MoO 4 combination class. However, this work assumes only 80% of the remaining cesium mass after CsOH and CsI gap formation to be in Cs 2MoO 4 and 20% is CsOH in the fuel. This 3-14 approach is also informed by insights from the Surry UA [16]. Therefore, the masses for the alkali metals class in Table 3-4 include cesium class mass as CsOH both in the gap and in the fuel whereas in NUREG

-1935 [3] it only reflected gap CsOH. The cesium speciation is treated as constant with respect to burnup.

Table 3-5 Gaseous iodine inventories for BOC, MOC, and EOC of Sequoyah Cycle 14.

Case Portion of halogen class mass treated as gaseous iodine in gap (% of total inventory)

BOC 0.100 MOC 0.182 EOC 0.420 Reactor Coolant System The reactor coolant loops, including the steam generators (SGs), pressurizer, hot

-leg and cold-leg piping, and reactor coolant pumps (RCPs), are modeled. The SG model is based on the Westinghouse inverted U

-tube design. When the secondary side of these SGs is water

-filled, primary coolant system full

-loop natural circulation can sustain primary

-to-secondary system heat rejection following a loss of RCP power. However, once the secondary system boils dry, the pressurizer safety valves begin cycling, which discharges the water inventory from the primary system. The Sequoyah nodalization allows simulation of the counter

-current natural circulation flow patterns in the hot legs and the steam generator. These two types of circulation behavior are illustrated in Figure 3-8. The Sequoyah MELCOR model incorporates nodalization provisions to manage hot

-leg and steam generator counter

-current flow patterns (see Figure 3-10). Figure 3-9 shows the reactor coolant system CVH nodalization. Loop 2, the circulation loop containing the pressurizer, in the Sequoyah unit is modeled separately

. The remaining three loops are lumped together under the assumption that these loops behave similarly. Each cold leg is represented using four control volumes with two volumes on either side of the recirculation pump. The pressurizer and surge line are each modeled as one CV with the surge line connected to the single

-loop hot leg.

Heat structures represent the walls of the hot and cold leg piping. Figure 3-10 illustrates the SG control volume nodalization. The primary sides of the SGs are modeled using multiple volumes to represent the tube bundle and the inlet and outlet plena. The inlet plenum of each SG is represented using three volumes to simulate a range of mixing and countercurrent flow conditions. The outlet plenum of each SG is represented using a single volume.

3-15 Figure 3-8 Natural circulation flow patterns in a PWR

.

3-16 Figure 3-9 Sequoyah reactor coolant system hydrodynamic nodalization

.

3-17 Figure 3-10 Sequoyah steam generator lumped Loop 2.

Pressurizer Relief Tank The Sequoyah pressurizer relief tank (PRT) is designed to condense and retain steam from the pressurizer SVs and power operated relief valves (PORVs). The steam is directed to a sparger at the bottom of the PRT. The PRT is initially filled with 55,800 lbm of water. In a high-pressure unmitigated accident where the pressurizer valves open to relieve pressure, the PRT water will heat towards saturation and pressurize the PRT. The PRT rupture disk will open once the differential pressure exceeds across the disk exceeds 100 psi.

3-18 The MELCOR model includes the piping connections from the three safety valves and the two PORVs to the sparger in the PRT. The quenching and radionuclide capture features of the sparger are modeled using MELCOR's SPARC90 model [20]. The PRT is modeled using a single control volume with a rupture disk flow path for over

-pressure protection.

As a unique feature of the Sequoyah ice condenser containment, water from the ice melt during the accident progression will partially flood the outside of the PRT tank. The PRT wall was subdivided into three heat structures to model behavior associated with radionuclide revaporization and the changing water levels inside and outside of the PRT. A cross

-section of the PRT heat structure nodalization is shown in Figure 3-11. The bottom octant (45

-deg sector) of the tank is modeled as the floor. If the PRT dries out, then the previously water

-bound radionuclides will settle on the floor.

27 The section of the tank above the bottom octant to the tank mid

-line is modeled as a wall heat transfer and deposition surface. Airborne radionuclides can deposit on the wall by mechanisms other than gravitational settling (e.g., Brownian motion, thermophoresis, and diffusiophoresis).

The top portion of the tank is modeled with the third heat structure and is identified as a ceiling for radionuclide settling. Similar to a wall, there is no gravitational settling on a ceiling. After the ice completely melts, the lower containment water level is just below the mid

-line of the PRT. Consequently, the wall and ceiling heat structures accurately model the pool boundary conditions below and above the lower containment water level, respectively.

The three heat structures include convective heat transfer to the lower containment and adjacent fluid inside the PRT. MELCOR tracks the respective water levels inside and outside the PRT and applies the appropriate the atmospheric or pool convective heat transfer rates. The inside surfaces of the PRT heat structures also include radiative heat transfer to the gas in the PRT when not covered with water. The deposited aerosols are assumed to follow the wall temperature and airborne radionuclides follow the gas temperature.

Finally, all the decay heat from the radionuclides in the PRT is retained in the PRT. The radionuclide decay heat is deposited into the water (i.e., when present), the gas, and the structures using the default models.

These modeling enhancements address the SBO accident progression where the deposited radionuclides can heat up following PRT dryout, which makes them susceptible to revaporization. The steam load to the PRT will pressurize and open the rupture disk prior t o core damage. The rupture disk opens and quickly depressurizes the tank. However, most of the water remains in the tank. Subsequent releases of steam, hydrogen, and radionuclides during the core damage phase flow from pressurizer SV to the sparger and into the PRT. In realizations with an early stuck

-open SV, the decay heat from the radionuclides retained in the PRT will boil the remaining water away and deposit on the PRT floor.

27 During the station blackout accident progression, some accident progressions with stuck open SVs have significant transport of radionuclides during the core damage phase to the PRT. The decay heat from the radionuclides captured in the PRT can boil the remaining water away. The radionuclides will settle on the PRT floor if the water boils away.

3-19 Figure 3-11 Pressurizer relief tank heat structure nodalization

. Secondary System The nodalization is configured with the minimum number of CVs and flow paths needed to accomplish reasonably accurate conditions in the model at rated power and to support hot leg countercurrent natural circulation (see Figure 3-10). MSL SVs are represented with the lowest set-point valve on each MSL accounted for individually, and all other valves accounted for jointly. Stochastic (over

-cycling) failure of the lowest set

-point valves to reseat is modeled with failure in a specified position (sampled) imposed after a variable (sampled) number of cycles. Atmospheric relief valves are represented as are MSIVs. Turbine bypass is not represented (and is not needed for the subject calculations on account of being unavailable in a SBO). Leakage past the MSIVs to the environment was included (0.1 in 2 per MSIV). Emergency Core Cooling System A working model of the emergency core cooling system (ECCS) is included in the Sequoyah model but, with the exception of accumulator actuation, was not exercised in the SBO calculations. The accumulators are represented complete with nitrogen introduction to the cold legs upon their water inventory being exhausted.

Shutdown cooling is provided by turbine driven auxiliary feedwater system during an SBO, which is discussed further in Secti on 3.1.9. In-vessel Natural Circulation Modeling The Sequoyah model is configured the same as the Surry model [5] with respect to accommodating hot leg countercurrent natural circulation. Two natural circulation flow patterns which are modeled; (1) countercurrent hot leg flow

, and (2) loop natural circulation (see Figure 3-8). Natural circulation is important in severe accident sequences because circulating steam from the core to upper reactor internals, the hot leg, and the SGs; transfers heat away from the core, changes the core melt progression, and changes in

-vessel fission product distribution. More importantly, the resultant heating of the external piping could progress to a thermal stress (i.e., creep rupture) failure of the primary pressure boundary and a resulting depressurization prior to lower head failure. For example, a high

-pressure station blackout accident is not expected to result in full loop natural circulation flow (i.e., natural circulation Floor Wall Wall Ceiling 45° Containment water level after

3-20 pattern shown on the left-hand side of Figure 3-8) at the start of the core degradation phase of the accident because the loop seal is not cleared. Consequently, the prediction of the first two natural circulation flow patterns is most critical

[127]. The two natural circulation flow patterns have been studied experimentally in the 1/7 th scal e natural circulation test program by Westinghouse Corporation for the Electric Power Research Institute (EPRI)

[128][129], computationally using the FLUENT computational fluid dynamics computer program

[130][131], and with plant application analyses using SCDAP/RELAP5

[132]. The reader is referred to References

[127] through [131] for detailed discussions of natural circulation behavior.

More recently, NRC has continued improving natural circulation modeling as part of the steam generator tube integrity program

[133][134]. The natural circulation MELCOR modeling approach in the Sequoyah model incorporate s some of the modeling advances used by Fletcher with the SCDAP/RELAP5 severe accident analysis code

[133]. The complexities of time

-varying buoyant flows cannot be directly simulated using MELCOR. Consequently, additional flow paths are introduced to simulate natural circulation conditions measured in experiments and calculated using computational fluid dynamics codes. The red flow paths in Figure 3-10 show the additional flow paths in the hot legs and steam generators. As indicated in the legend, additional flow paths are activated during natural circulation conditions to achieve the desired flow patterns. In particular, valves and additional head/drag terms are applied to match the desired phenomena. During natural circulation conditions (i.e., single-phase gas flow into the hot leg and steam generator), the red flow paths are activated. However, if conditions change that would preclude the natural circulation flow pattern (e.g., flooding by the accumulators or an injection system, a creep rupture piping failure, operation of multiple relief valves, etc.), the control logic reactivates MELCOR's normal two-phase thermal

-hydraulic model with the base nodalization (i.e., the 'black' flow paths in Figure 3-10). Containment The containment in the Sequoyah model consists of CVs representing the upper dome, lower compartments, annulus, reactor cavity, ice condenser, and the SG and pressurizer cubicles. Bypass flow areas between upper and lower containment are accounted for

, including the refueling canal drain. Figure 3-12 illustrates the containment nodalization showing the ice condenser CVs immediately below the upper plenum and upper dome

.

3-21 Figure 3-12 Containment nodalization.

The containment nodalization was informed by previous studies (i.e., References [22], [48], and [68]). An important feature incorporated into current work is a refined two

-dimensional ice chest nodalization that is consistent with the previous, more detailed CONTAIN Direct Containment Heating (DCH) model [22] (see Figure 3-13). The lower plenum and ice chest regions are divided azimuthally into four sections with an additional axial subdivision of the ice chest into three levels. Above the ice baskets, intermediate deck doors connect the ice chest to the upper plenum region upper plenum doors connect the upper plenum control volumes to the upper containment. The upper plenum itself is divided azimuthally into two control volumes.

The two-3-22 dimensional nodalization more faithfully captures the potential gradients in heat and mass transfer as hot gases transport upward into the ice beds. The nodalization also allows natural circulation flows within the ice beds.

The ice condenser is an important accident mitigation feature for Sequoyah that limits containment pressurization by condensing steam. The bypass area is incorporated into the model via leakage pathways through the refueling drain and uncharacterized leakage paths based on plant information. In addition, the failure of the seal barrier is modeled with uncertainty parameters for failure pressure and the resulting failure area (see Section 3.8). The bypass leakage will reduce the effectiveness of the ice condenser.

Figure 3-13 Sequoyah ice condenser nodalization

. The lower plenum, intermediate deck, and upper plenum ice condenser doors' operations are modeled as presented in NUREG/CR-6427 [22] and are consistent with the early MELCOR modeling and calculations [48]. Due to differences in door design and orientation, each door set required unique modeling methods.

Each door set uses a flow path which operates from fully

-closed to fully

-open as a function of the forward differential pressure. If the forward differential pressure decreases, the represented door area fraction is permitted to decrease and is referred to as reversible. The intermediate deck and upper plenum door models apply a second flow path to model doors which may not return to their closed position once opened. For example, the intermediate deck doors, which use a horizontal

-fixed hinge, close under the force of gravity

. These doors may open beyond ninety degrees and may not return to a closed position even though the forward differential pressure decreases. This operation is referred to as irreversible and is modeled using a second flow path which maintains its maximum open fraction. The forward differential pressure range of the reversible flow path terminates at the start of the opening range of the 3-23 irreversible flow path. In Figure 3-13, flow paths 134, 136, 138, 139, 141, and 142 are reversible, and flow paths 234, 236, 238, 239, 241, and 242 are irreversible.

For the gas flow through the ice condenser, the lower plenum doors are modeled using both reversible and irrev ersible features.

In the event that the doors are fully

-opened, a fraction of the doors are modeled to remain fully

-open to represent hinge deformation. The fraction of the doors that are irrev ersibly damaged is a sampled variable as described in Section 3.9. Reversible and irreversible flow paths are used to represent the intermediate deck and upper plenum doors. Leakage through the doors is taken from NUREG/CR

-6427 [22] and is applied to the reversible door flow paths.

Within the ice chest, ice melting is modeled by activating the MELCOR degassing model [20]. The degassing model determines the associated mass generation in response to energy transfer to a heat structure. As energy is transferred to the ice heat structure, liquid water mass generation is determined and sourced to the control volume. Drain lines connecting the lower plenum to the lower compartment allow accumulated water due to ice melting, condensation, and film flow drainage to be drained from the ice condenser. Selected ice condenser parameters are provided in Table 3-6. Table 3-6 Sequoyah ice condenser input parameters.

Parameter Value Comments Ice mass 2.65x10 6 lb m (1.20x10 6 kg) Average ice mass from 12 measurements Ice baskets 1944 baskets 486 baskets per bank with four banks Initial ice temperature 19°F (-7.2°C) The sensible heat from the initial temperature to the melting temperature is included in the heat of fusion Effective density 584 kg/m 3 Effective density of the ice in the baskets is calculated from the total mass divided by the ice basket volume Surface area 6200 m 2 Plant data Additionally, the Sequoyah MELCOR model includes representations of containment spray and air-return fan operation, residual heat removal, and switchover to recirculation through the emergency sump. However, SBO scenarios do not employ these systems or actions.

The nodalization of the MELCOR Sequoyah containment model represents the physical compartmentalization of the containment, but does not support calculating any variation of hydrogen concentration within a compartment such as stratification

. A hydrogen rich plume introduced into an isolated and quiescent portion of the containment could stratify near the ceiling. For example, stratified layer behavior has been demonstrated in carefully controlled experiments were a low

-density gas is introduced into a quiescent chamber with isothermal conditions (e.g., see Reference [149]). There are several factors that promote strong mixing of hydrogen throughout the containment which would limit the degree of stratification. For example, the initial release of hydrogen to the containment comes from the PRT following opening of the rupture disk from 100 psig. The hydrogen and steam mixture is rapidly expelled at sonic speeds into the containment at an elevated temperature, which ensures strong mixing and condensation

-driven flow patterns in the 3-24 lower containment and ice chest. The subsequent release of hydrogen through the PRT following the initial depressurization occurs at very high temperature with steam, which continues to promote mixing, condensation

-driven flows, and strong circulation flows. The hot sources of steam and hydrogen interchange with the cool air in the ice chest. Similarly after the hot leg failure, steam and hydrogen exit the primary system at sonic speeds in an energetic flow pattern that quickly mixes throughout the containment.

The largest burns that challenge the containment integrity occur near the timing of maximum in

-vessel hydrogen production with hot gases exiting the hot leg failure or the PRT rupture disk opening. The rapid introduction of hot and combustible gases which is coincident with the ignition source is accompanied with strong convective forces that promote mixing. The well

-mixed control volume approach in MELCOR is expected to be an adequate representation of this phase of the accident. At the later phase of the accident following vessel failure, MELCOR also shows strong circulation patterns due to the non

-condensable gas generation and debris heat source in the reactor cavity. The hot gases circulate upward through the lower containment leakage pathways (e.g., the failed barrier seal) to the upper containment and then back through the ice chest to the lower containment. Consequently, the containment is predicted to be relatively well mixed until it becomes oxygen

-limited for combustion near the timing of complete ice melt (~12 hrs).

Containment Leakage and Rupture The Sequoyah containment is a free

-standing steel containment consisting of a cylinder topped by a hemispherical dome as shown with the finite element model in Figure 3-14. The internal radius of the cylinder is 57.5 feet and its height to the intersection with the dome (springline) is 115 feet. The thickness of the steel shell in the cylindrical portion varies along the height. This thickness is 1

-3/8 inches at the bottom and decreases to 1/2

-inch at the springline. The dome wall thickness also varies and ranges from 7/16

-inch at the springline to 15/16

-inch at the apex. The containment cylinder wall has a set of outside vertical stringers at a 4

-degree circumferential spacing that extend partially into the dome. This wall also has a set of outside horizontal circumferential stiffeners and platforms. The steel for the containment structure is A516 Grade 60 steel. The design internal pressure for use of the ASME Section III code was 10.8 psig.

Containment Rupture Pressure And Location Past NRC-sponsored research ([23][24][25][26][27]) extensively studied the capacity of the Sequoyah containment under internal pressurization associated with severe accident conditions. These studies used a variety of methods of analysis ranging from closed

-form analytical approaches that relate the internal pressure capacity to the global membrane hoop strain in the containment shell to studies involving detailed three dimensional models of the containment shell including models that account for strain concentrations near abrupt increases in the thickness of the containment shell to accommodate large containment openings and other penetrations.

Table 3-7 shows best estimates (shown in parentheses) and ranges of internal pressure capacities calculated for the Sequoyah containment in studies completed since the late 1980s and the estimated location of containment rupture. The studies indicate that containment rupture would start where the containment shell thickness abruptly increases around the larger containment opening in the ice condenser region of the containment.

3-25 Figure 3-14 Three-dimensional finite element model of the Sequoyah containment.

Table 3-7 Best estimate of rupture pressures for the Sequoyah containment from various NRC

-sponsored studies.

Reference Date Rupture Pressure (psig) Uncertainty Rang e (psig --- psig) Method of Analysis and Rupture Locations NUREG/CR-5405 [24] 1990 63 Finite element analysis Rupture location: where the containment shell thickness abruptly increases around the larger containment openings in the ice condenser region of the containment. NUREG/CR-6706 [26] 2001 68 62 ------- 74 Finite element analysis Rupture location: as above.

NUREG/CR-6920 [27] 2006 67 54 ------- 82 Finite element analysis Containment fragility provided lower and upper bounds corresponding to 0.05 and 0.95 probabilities of failure Rupture location: as above.

Ice Condenser RegionUpper FloorLower Floor 3-26 The rupture pressure capacities shown in Table 3-7 are for: Normal ambient temperatures [24] (results in the cited reference indicate that the ultimate pressure capacity is relatively insensitive to temperature with a reduction in pressure capacity of about 7 to 8 percent at about 300 °F).

Material properties based on certified material property test reports (CMTRs) for the Sequoyah containment.

Strain-based rupture criteria associated with membrane strains in the containment shell that account for strain concentrations near abrupt increases in the thickness of the containment shell.

Containment strains calculated using three dimensional finite element analysis of the containment building that model either a 90 degree segment of the containment [24] or a chosen segment subtending an angle of, approximately, 53 degrees.

Large penetrations are not included in the finite element models but increased plate thickness in the areas surrounding large openings is included in the models to account for strain concentrations near abrupt changes in plate thickness.

The values shown in Table 3-7 compare well to each other and also to the 65 psig mean of the aggregate distribution of failure pressures from an expert elicitation panel reported in NUREG/CR-4551 [25] and used for the NUREG

-1150 study [28]. A single, confirmatory, three

-dimensional finite element analysis of the Sequoyah containment was made using the three

-dimensional finite element model shown in Figure 3-14. This model includes the major containment penetrations and the increase in the containment shell plate thickness around these penetrations. This is an approximate model because not all information, for example the full extent of the thicker plates around the major penetrations, was available. However, the model permits a point estimate confirmation of the internal pressure ranges shown in Table 3-7 and the likely rupture location. This confirmatory assessment used a yield strength for the steel in the containment shell equal to the average value of the available CMTR data which is approximately equal to 47,800 psi. Analysis with this model shows that strains of the order of 3% are reached at an internal pressure of approximately 66 psig in the thinner containment shell plates where they join the upper part of the thicker steel plates that surround the equipment hatch. This is in the ice condenser region of the containment. Principal membrane strains in this region increase rapidly as the internal pressure increases above 66 psig and strains of the order of 2% to 3% become widespread in the thinner steel plates in the ice condenser region. These results are consistent with the best estimate and range of rupture pressures shown in Table 3-7. The best estimates and ranges of containment rupture pressure shown in Table 3-7, together with the results of the three

-dimensional finite element analysis

, permit an informed uncertainty range for the rupture pressure for use in the Sequoyah accident progression analysis as follows:

A mode of the uncertainty distribution for the rupture pressure equal to 67 psig Range of internal rupture pressure from 52 psig to 78 psig. This range is primarily based on the results reported in [27] and shown in the last line of Table 3-7.

3-27 On the basis of these values, the probability density function chosen for uncertainty analysis is a simple triangular probability density function with a lower bound of 52 psig, an upper bound of 78 psig and a mode of 67 psig.

Containment Nominal Leakage Estimates Nominal leakage from a Sequoyah primary containment is expected to be near or through penetrations into the annular space between the outside of the steel containment vessel and the inside of the surrounding concrete shield building. A flow path (FL99) is included in the MELCOR model between lower containment and the annular space to facilitate this leakage

. The path is defined as having a flow area of 2.518x10

-6 m 2 and a length of 0.029 m consistent with Sequoyah Modular Accident Analysis Program input.

Leakage from the annular space through the shield building boundary to the environment wa s simply assumed to be through a 100-fold greater area (= 2.518x10-4 m 2). Additional Comments For MELCOR Modeling An additional attribute of containment reflected in the MELCOR modeling is the possible failure of the fabric seals that form part of the barrier between upper and lower containment. The seals are located along the bottom of the concrete floor under the ice condenser, between the ends of the ice condenser and the refueling canal concrete structure, and along the vertical sides of the refueling canal structure.

The seals extend across the nominal 4 inch gap between the inside surface of the steel containment vessel and the concrete structure within the vessel. The seals are modeled to fail variably in the UA given a differential pressure between upper and lower containment and elevated structure temperatures as discussed further in Section 3.8 Surrounding the Sequoyah steel containment vessel is a concrete shield building. There is a 5 foot distance between the outside of the steel vessel and the inside of the concrete building. The annular space is represented in the MELCOR model as CV-801. There are two openings in the wall of the concrete shield building that are likely to become release pathways given an overpressure rupture of the steel containment vessel within

- a 2' x 7'-6" exhaust vent in the dome (FSAR, Amendment 20, p. 11.3

-7 & Concrete Dome Outline, Drawing 41N718

-1, R5) and a 4'-0.5" x 7'-4.75" doorway between the annular space and the auxiliary building (Watertight Doors Arrangement & Details Sheet 2, CCD No: 1,2

-44N286, R1

). The exhaust vent is 130 feet above grade

, and a release through it would lead directly to the environment. The doorway is below grade. Both the vent and door opening are represented in the MELCOR model.

Both openings are configured to open fully coincident with an overpressure rupture of the steel containment vessel (see flow paths 801 and 804 in Figure 3-12). The auxiliary building is not used in the MELCOR model

, and all releases are directly to the environment.

Hydrogen Combustion In a SBO that proceeds to severe core damage at an ice condenser plant, hydrogen generation and release to the containment can threaten the integrity of containment should a sufficient amount of the hydrogen burn at one time. Hydrogen threat mitigation at Sequoyah is based on the use of thermal igniters to induce periodic burns with relatively moderate energy addition rates. The igniters, however, require AC electrical power to function and would not be immediately available. So, one primary mitigative measure in a SBO is to restore power to igniters (see Section 3.1.11).

3-28 Hydrogen combustion has uncertainties in the ignition location, ignition timing, flammability limits, and combustion intensity. NUREG/CR

-7110 Volume 2 [5] calculations included combustion at 0.1 hydrogen mole fraction, the default limit for spontaneous ignition in MELCOR. In contrast, the Surry UA [16] assumed an ignition source was always available and allowed combustion to occur at the lean limit for hydrogen as identified by Kumar [29]. The Sequoyah UA was modified to only include an ignition source when there is a well

-defined ignition source (e.g., hot gases above the hydrogen auto

-ignition temperature exiting the RCS (i.e., the HL rupture or the PRT rupture disk opening) and hot debris in the reactor cavity.

Combustion requires an ignition source and a combustible concentration of gases. Similar to the Surry UA study [16], the determination of combustion gas concentrations is based on the work by Kumar [29] illustrated in Figure 3-15 and Figure 3-16. Kumar describes the experimental determination of the flammability limits of hydrogen/oxygen mixtures with various diluents with an active ignition source. The burn propagation direction has different thresholds for the lean limit on combustion. The lean upward propagation limit for hydrogen is 4% by volume percent. The lean-downward limit is considerably higher because of the opposing effect of buoyancy on flame propagation. Downward propagation does not occur until the hydrogen concentration is 9% Furthermore, the combustion efficiency is low at the lean thresholds for combustion. For example, the combustion efficiency is found near the lean limits of hydrogen, spanning from almost zero burn completeness at a 4% hydrogen concentration to 95% burn completeness at a 10% hydrogen concentration [29]. At the hydrogen rich condition, combustion is limited by the deficient reactant, which is oxygen. The experimental evidence shows at least 5% oxygen is required. Alternately, it can be expressed as:

H 2 (%) + Diluent (%) = 95% Equation 3-1 MELCOR dynamically tracks the hydrogen, oxygen, carbon-monoxide, and all the diluent (e.g., steam, nitrogen, and core

-concrete gases) concentrations in each control volume to identify thresholds for combustion.

The ice condenser is very effective at condensing steam and cooling the non

-condensable gases. While the impact of steam as a diluent is noted in Figure 3-15, the influence of the temperature is also incorporated using Kumar's experimental findings and deduced theoretical observations. Over the temperature range of the data, the lower limits of hydrogen flammability decreases by 0.5%

hydrogen/100°C for upward propagation and 1%

hydrogen/100°C for downward propagation. For rich limits, the oxygen concentration decreases by 0.5% oxygen/100°C. Hence, cooler temperatures require higher concentrations for combustion while higher temperatures can ignite at lower concentrations.

3-29 Figure 3-15 Flammability limits for hydrogen for Air

-H 2-H 2O systems [29]. Figure 3-16 Combustion of hydrogen and air mixtures near lean limits for upward propagation of the flame [29].

3-30 Identifiable Sources of Ignition A severe accident in a PWR leading to a breach in the RCS would present obvious sources of ignition for a hydrogen deflagration, such as hot gas flowing from a rupture in a hot leg nozzle or core debris relocated from the RPV to the containment floor. Hot gases venting from the RCS to containment through a ruptured burst disk on the PRT is another clear potential source of ignition. Given any of these developments in a MELCOR calculation, all of lower containment was taken to have an active ignition source, and if a combustible mixture of gasses existed, a burn initiated. A temperature greater than the auto

-ignition temperature of hydrogen (> 847 K) and a flow velocity exceeding 0.1 m/s were conditions required of the gas flowing from a hot leg rupture or PRT burst disk. RPV lower head failure was taken to be an indication of core debris having relocated to the containment floor.

Detonation and Burn Propagation As a practical consideration, MELCOR does not model detonation. However, a large deflagration has more than sufficient energy to over

-pressurize the containment (e.g., a deflagration from a 14% hydrogen concentration provides up to a 4X increase in pressur e [30]). Burn propagation to adjacent cells within this UA are governed by the standard MELCOR burn package model with default concentration limits. The default limits are nominally consistent with Kumar's research findings [29]. In particular, burns can propagate in the upward, horizontal, and downward directions with 4.1%, 6.5%, and 9% hydrogen concentrations, respectively. The adjacent volumes must also satisfy the minimum oxygen concentration (5%) and maximum steam concentration limits (55%).

Turbine-Drive Auxiliary Feedwater System The Turbine Driven Auxiliary Feed Water (TDAFW) system is available in the LTSBO and provides an alternate method to deliver feedwater to the steam generators when the motor

-driven feedwater pumps are unavailable (e.g., a station blackout). The normal source of feedwater is condensate storage tank. A possible backup source of water is the Essential Raw Cooling Water (ERCW) header. However, the transfer to the ERCW was not included in the LTSBO calculations.

28 The water from the TDAFW pump flows through four Level Control Valves (LCV) to corresponding four steam generators as shown in Figure 3-17. The LCVs are normally closed but fail open upon loss of air pressure. They are pneumatically operated and require DC power and auxiliary air pressure to be remotely controlled. Normally, the SG level is controlled by either fully opening or fully closing each LCV, as the system is not designed for throttling the flow rate using these LCVs. In the absence of DC power or plant auxiliary air pressure, the operator can locally open or close these valves using high pressure air bottles provided near the locations as backup actuation sources.

28 The LTSBO calculation matrix in Section 4.8.1 did not include a transfer to ERCW, which would have further delayed or prevented core damage. An objective of the present study was to characterize the source term from accident progressions with core damage within 72 hr. The ERCW is noted here as a viable action that plant operations could use to mitigate a LTSBO accident.

3-31 Figure 3-17 Turbine Driven Auxiliary Feed Water System Flow Diagram.

Sequoyah uses the TDAFW in a feed and bleed mode during a LTSBO accident to remove the decay heat from the reactor coolant system during accident conditions. The primary system water naturally circulates through U

-tubes in the steam generator and transfers heat to the feedwater in the secondary side of the SGs to produce steam. The steam is discharged into atmosphere outside the plant through either the main steam system atmospheric relief valves (ARVs) or the main steam system code SVs. Some of the steam produced in SG#1 or SG#4 is directed to the AFW turbine via FCV

-15 (Normally Open) or FCV

-16 (Normally closed) and the Trip and Throttle Valve (TTV) which is normally closed (see Figure 3-17). The TTV is a motor operated valve (MOV), which requires DC power to operate and fails as is upon loss of DC. The TTV has a mechanical trip (close) feature if the turbine speed is too high. Downstream from the TTV there is a governor valve, which controls the speed of TDAFW pump. The steam passing through TTV and governor valve provides power for the pump before it is dumped into the atmosphere.

To automatically start and maintain SG water level, the TDAFW system uses 125V DC and 120V AC for the DC

-MOV and flow controller to modulate the flow rate based on SG level or manual operations from control room. Shortly after a SBO, the TDAFW pump starts and within a few seconds speed up to about 4000 rpm. The design flow rate for TDAFW pump is 880 gpm or 220 gpm per generator, against the SG head of 2600 ft, using steam from SG #1 or #4 as SG SG SG SG FCV-16 N.C. FAIL AS IS FCV-15 N.O. FAIL AS IS LCV-175 N.C. F.O. LCV-174 N.C. F.O. LCV-173 N.C. F.O. LCV-172 N.C. F.O. X I-51 Trip & Throttle Valve DC-MOV N.C. FAIL AS IS F.C. on Hi Speed Trip SG#2 on RCS Pressurize line Sequoyah TD

-AFW System

[Ref: FSAR 10.4

-24, 2014-2016 Meetings TVA staff]

ERCW F.O. Failed Open N.C. Normally Close N.O. Normally Open FCV-17 FCV-18 Isolation Valves N.O.

3-32 shown on Figure 3-17.29 The steam turbine system requires a minimum of 120 psig to provide injection flow. The plant SAMGs direct the operators to keep the SG pressure at or above 160 psia to achieve the RCS cooldown. If the SG pressure drops lower, then the nitrogen from accumulators may enter the RCS. Only one SG is required to remove the decay heat after reactor trips; however, the operators will try to provide injection to all four steam generators to maintain a symmetric natural circulation flow pattern.

Upon loss of DC power, the 120 VAC is also lost. The TTV fails as is and the governor valve fully opens. This may lead to an over

-speed trip and closure of the TTV. All plant instrumentation is also lost following the loss of DC power. It is expected that control of the TDAFW without 120 VAC following the loss of DC power would be difficult. Consequently, the LTSBO calculation matrix (Section 4.8.1) considers possible outcomes of (1) an over-speed trip, (2) overfilling the SGs and flooding the TDAFW, and (3) successful local manual TTV control. Successful manual control (i.e., Option 3) is achieved by controlling the TDAFW pump speed using the hand

-wheel on TTV and by closing the individual LCVs to prevent over

-filling the SGs, using available air from high pressure air tanks.

The Sequoyah MELCOR model used for this analysis includes a simplified representation of the TDAFW turbine and pump. The TDAFW pump is modeled using the homologous pump component. A mechanistic calculation of the steam flow is performed based on the work and efficiency of the TDAFW pump at the specified speed and hydraulic conditions. The TDAFW performance and efficiency is determined using the homologous pump curves developed from the manufacturer supplied performance curves in the SQN TDAFW (FSAR, Figure 10.4.7

-6). A modeling simplification is used to directly specify the pump speed rather than evaluate the torque developed by the turbine. The LCV control valves can be closed on the single or triple loop on high level conditions, which is included in the LTSBO calculation matrix. The turbine will over-speed trip and close the TTV if not successfully controlled through an operator action following a loss of DC power. In the Sequoyah MELCOR model, this is assumed to occur concurrently with DC battery failure. The TDAFW will also fail if the CST water inventory is consumed or water enters the steam turbine.

30 Operator Actions In the case of a LTSBO, the planned operator action at Sequoyah is to cool the RCS at a rate of 100 °F/hr by venting the SGs through the atmospheric relief valve s (ARVs) to 200 psia. A loss of essential control air resulting from a loss of all AC power will require operator actions to open the ARVs. Steam Generators 1 and 4 have ARVs that are readily accessible via the 480 V Shutdown Board Room near the Main Control Room, while Steam Generators 2 and 3 have ARVs are located in a high heat stress area that are controlled with remote air bottles

. TVA estimated that the SG depressurization would begin at one hour after the onset of the SBO. The RCS cooldown operator action that is used in the LTSBO simulations required some modifications to accommodate limitations of the single and lump triple loop nodalization

. First, it

29 In the LTSBO simulations, the single loop provided all steam for the TDAFW.

30 Other responses (e.g., Fukushima Daiichi Unit 2 reactor isolation cooling system's turbopump ran unregulated, including water flow for ~68 hr or ERCW availability) that further delayed or prevent ed core damage are considered possible. However, an objective of the present study was to characterize the source term from accident progressions with core damage within 72 hr. Consequently, these possible scenarios that further extend the timing to core damage are noted here but not included in the LTSBO calculation matrix in Section 4.8.1.

3-33 is assumed that the steam supply for the TDAFW is taken from the single loop. As indicated in Figure 3-17, the steam supply for TDAFW is normally aligned to a single loop (i.e., Loop #1).

The single loop with the pressurizer in the MELCOR is used to represent the asymmetric effect of supplying 100% of the TDAFW steam supply flow. Although the single loop (i.e., Loop #1) includes the pressurizer, the impact of the pressurizer on the loop response was judged not significant because all pressurizer valves are closed during this phase of the accident.

A symmetric approach is used to model the ARV depressurization using all four steam generators. TVA indicates that Loops #1 and #4 have more easily accessible provisions for manual operation of the ARVs. Consequently, only two loops would be used to control the system depressurization, which is not possible within the MELCOR model due to the single and lumped nodalization. Since Loop #1 would typically include the effects of the TDAFW steam supply and ARV operation, it was desired to include the ARV operation on the single loop to capture both of these effects. Additionally, the ARVs on the triple loop were used to capture the net effect of a second ARV. However, the approach of modeling a second ARV on the triple loop inevitably impacts three steam generators (see Footnote 29). The compromises of the operator actions with the single and lumped loop nodalization were judged not to significantly impact the timing of subsequent severe accident progression. In the scenarios considered, the ARVs are closed and the TDAFW is unavailable and isolated during the severe accident phase of the accident. The steam generators dr y out hours before the start of core damage and are depressurizing due to leakage through the MSIVs. Although the ARVs on all four steam generators are used in the cooldown phase of the accident, there is sufficient capacity for one ARV on a single SG to perform this function because the cooldown rate is limited to <100°F/hr. Consequently, there is excess capacity to achieve the cooldown whether the ARVs on one, two, or four of the steam generators are used.

31 The system of four SGs is sufficiently coupled to depressurize similarly and the availability of the TDAFW compensates for any water loss from the ARV operation to minimize any asymmetric impact.

In addition, the following features were implemented to support the LTSBO scenario:

Manual control of the TDAFW as described in Section 3.1.9. Load shedding during the first 90 minutes after the onset of an LTSBO that extends station battery life to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months per Sequoyah post-Fukushima regulatory submittal. (A 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months DC battery sensitivity calculation with ineffective load shedding is also investigated).

An operator action to control TDAFW at 15 minutes. Timing from Surry SOARCA LTSBO is documented in the original SOARCA study published in 2012

[5]. Hydrogen Mitigative System Several sensitivity calculations were performed to demonstrate the potential benefits of using the Hydrogen Mitigation System (HMS); see Section 4.6 and 4.8.4 for results discussions. Since the HMS requires AC power for the igniters, it is not automatically available in either the STSBO or the LTSBO sequences. The STSBO and LTSBO sensitivity calculations examined the potential benefit of restoring the HMS prior to significant hydrogen release to the containment.

31 For example, the primary system cooldown only required 18% of the capacity of a single ARV.

3-3 4 The HMS, comprised of 68 individual igniters, is seismically supported and designed to mitigate sudden high pressure loads in the event of a hydrogen explosion (FSAR Section 6.2.5). The thermal igniters induce periodic small burns and prevent large hydrogen accumulations and large burns. The 68 igniters are arranged with consideration for hydrogen release and transport throughout the containment. When local hydrogen ignition criteria at the active igniters exceed the default igniter flammability limit (7%), the igniter may initiate a combustion event, typically a deflagration. Power is provided by Class 1E 480 V AC

-auxiliary and in the case of loss of offsite power, backed by emergency diesel generators. The HMS is energized manually from the main control room in accordance with emergency procedures following any accident which indicates inadequate core cooling. The igniters will remain inoperable during a SBO without additional backup AC power supply.

However, the operator can provide power to the 480 volt AC bus using a 225 kV generator, which is pre

-staged on the roof of auxiliary building. This AC bus also supply power to the DC battery chargers. The igniters can also be placed in operation by manual operator action if AC power is recovered.

The HMS system is modeled within the Sequoyah MELCOR model by designating which control volumes contain igniters, the availability of support power, and the atmospheric conditions which can support an HMS initiated deflagration. Igniters are specified in the MELCOR model to be consistent with the Sequoyah HMS system, which is all containment control volumes with the exception of the ice condenser lower plenum¸ the ice chest, and the reactor cavity. The MELCOR igniter model uses the following atmospheric conditions to trigger igniter

-initiated deflagrations:

H 2 > 7%, O 2 > 5%, and diluents < 55%.

Modeling Practices MELCOR includes capabilities to model two

-phase thermal

-hydraulics, core degradation, fission product release, transport, and deposition, and containment response.

NUREG-1935 [3] and the subsequent SOARCA UAs

[9][16] include operator actions and equipment performance issues as prescribed by the sequence definition and mitigative actions.

The MELCOR models are constructed using plant data, best practices, and the operator actions which are based on discussions with operators during site visits.

Pressurizer Safety Valves and PORVs Each of the three SVs on a Sequoyah pressurizer is represented separately in the MELCOR model. Their opening pressures are staggered. The valves are configured to fail to close according to an over-cycle criterion. The criterion, i.e., the number of cycles after which to fail a valve open, is sampled as an uncertain parameter. The position of a valve (i.e., open flow area fraction) following a failure to close (FTC) is also sampled; see Section 3.3 for further discussion.

The SVs and power operated relief valves (PORVs) vent to a control volume in the Sequoyah MELCOR model representing the Pressurizer Relief Tank (PRT). A flow path representing the 3-35 PRT rupture disks is included between the PRT control volume and one of the lower containment control volumes. The flow path is configured to open at a differential pressure of 100 psi. Secondary System Atmosphere Relief Valves and SVs Each of the four steam lines serving a Sequoyah unit has one ARV and five SVs. The pressure set points on the SVs are staggered to open at successively higher pressures. The representation of the Loop 2 main steam line in the MELCOR model has: A flow path representing the ARV

A flow path representing the lowest

-setpoint SV with over

-cycle failure included; and A flow path jointly representing the remaining four SVs with provisions to represent their varying opening and closing pressure set points.

The lumped representation of the Loops 1, 3, and 4 main steam lines in the model has:

A flow path jointly representing three ARVs; A flow path jointly representing the three lowest-setpoint SVs

A flow path jointly representing the remaining 12 SVs with provisions to represent their varying opening and closing pressure set points.

The Sequoyah ARVs require control air (and hence AC power) to operate automatically or to be operated remotely. The ARVs serving SG #1 and #4 are readily accessible and can be manually opened with reach rod operators. This is not the case with the ARVs serving SG #2 and #3. Access to these ARVs requires entry into a high heat stress area. These attributes of the ARVs are reflected in the control logic included in the Sequoyah MELCOR model to manage the operation of the valves.

Pump Seal L eakage Under normal operating conditions, cooling water is supplied to the RCP seals at a higher pressure than the primary.

As a result, the water keeps the RCP seals cool while preventing any primary coolant from flowing up the RCP shaft and contaminating areas outside the primary boundary. When a loss of AC power occurs, the RCP seal cooling system no longer supplies cooling water, and primary coolant begins leaking along the RCP shaft through the mechanical seals at a rate of 21 gpm at normal operating pressure.

RCP seal leakage was sized in the MELCOR model to 21 gpm per pump at rated reactor conditions for all UA scenarios. The seals are more susceptible to failure at high fluid temperatures and/or two

-phase flow. To investigate the dependency of the UA results on seal leakage rate, a sensitivity calculation was carried out 3-36 where leakage was increased to 182 gpm 13 minutes after the loss of seal cooling (see Section 4.7).32 Fuel Degradation A nd Relocation Treatment MELCOR includes several models to characterize the structural integrity of fuel rods under highly degraded conditions.

First, the failure of the cladding pressure boundary is based on a temperature criterion (i.e., 900°C), which results in the immediate release of the mobile fission products in the gap between fuel and cladding. The gap failure criterion is separately modeled for each radial ring of fuel assemblies in the core. Following gap failure, thermally driven radionuclide releases begin. As the fuel continues to heat, the hot Zircaloy cladding oxidizes, which is an exothermic process. The cladding oxidation reaction consumes oxygen and releases hydrogen from steam. The oxidation rate model was treated as an uncertain parameter and is further discussed in Section 3.12. The heat addition from the cladding oxidation can be much larger than the radionuclide decay heat and greatly increase the fuel heat

-up rate. A Zircaloy-oxide shell forms on the outside of the cladding that has a higher melting temperature than unoxidized Zircaloy inside the shell. As the cladding continues to heat, the unoxidized Zircaloy melts becoming highly reactive with the oxide shell and the UO 2 pellets. Still further heating weakens the oxide shell. MELCOR includes a molten Zircaloy breakout criterion once the cladding reaches specified temperature (i.e., 2400 K in the Sequoyah calculations). Molten Zircaloy breaches the oxide shell and candles down the outside of the fuel rod when the breakout temperature is reached; see Figure 3-18. The Zircaloy

-oxide shell and the UO 2 form a eutectic having a lower effective liquefaction (melting) temperature than either Zircaloy oxide or UO 2. The effective liquefaction temperature is treated as an uncertain parameter and further discussed in Section 3.6. Once the fuel cladding eutectic reaches the liquefaction temperature, the fuel rod collapses into a debris bed. If the fuel does not collapse due to reaching the liquefaction temperature (see Section 3.6) or the supporting core plate structure beneath fuel has not failed, then a parametric life

-time model for prolonged damage and weakening at sustained high temperatures becomes involved. The model acknowledges a thermal-mechanical weakening of the oxide shell as a function of time and temperature.

As the local cladding oxide temperature increase s from the MELCOR Zircaloy melting temperature of 2098 K towards a default of 2500 K, a thermal lifetime function accrues increasing damage from 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months to one hour before a local thermo-mechanical failure.

MELCOR includes multiple models for the degradation of fuel rods and formation and relocation of core debris. Since focus in the Sequoyah UA was primarily on containment response, the number of parameters influential to in

-vessel accident progression that were treated as uncertain in the Sequoyah UA was less than in the Surry UA [16]. While many aspects of core degradation have significant uncertainty, results in the Surry UA suggested that fuel

-zirconium oxide eutectic melting temperature is an uncertain in

-vessel accident progression parameter particularly important to how core degradation proceeds and to how much in

-vessel hydrogen production occurs. Consequently, it was treated as uncertain in the Sequoyah UA. Additionally, oxidation rate was treated as uncertain. MELCOR default treatments were utilized for cladding pressure boundary failure, molten Zircaloy breakout temperature, axial and radial debris relocation rates, etc.

32 It takes 12 minutes at full system pressure to flood the pump seal plenum with hot water from the primary system. The seals are more susceptible to failure once the high temperature fluid fills the seal plenum. The high temperature fluid from the primary system can flash to a two

-phase mixture as it leaks through the seals, which contributes to destabilizing the seals.

3-37 Figure 3-18 Depiction of the fuel rod degradation

. Lower Plenum Debris to Coolant Heat Transfer Following the fuel

-debris slump into the lower plenum, there is a potential for fuel-coolant interactions.

The lower plenum heat transfer settings were updated to reflect the approach adopted in the Surry UA [16]. Core Plate Failure The timing of core plate failure affects the relocation of the degraded core materials from the core region into the lower plenum.

The local thermal

-mechanical failure of the lower core plate, the flow mixer plate, and the lower support forging are calculated within MELCOR using the Roark engineering stress formulae

[20]. The yield stress is calculated based on the loading and local temperature.

Fission Product Release, Speciation, a nd Volatility Fission product release from fuel in the Sequoyah UA is by MELCOR default treatment dependent upon speciation. Since MELCOR generally does not manage changes in the 3-38 chemical form of fission products, speciation, e.g., the amount of cesium as CsOH, is constant in a MELCOR calculation and has to be initialized by the user. Fission product speciation in the Sequoyah UA is described in Section 3.1.1.2. The speciation of cesium was treated as invariant in the Sequoyah UA unlike in the Surry UA where the amounts of cesium as CsOH, CsI and Cs 2MoO 4 were treated as uncertain.

Iodine is a volatile fission product and can be released as an elemental gas or bound with cesium as CsI, an aerosol.

Because of its volatility, a portion of iodine transpo r ts to the fuel-cladding gap, leading to early releases when gap failure occurs.

Iodine has a relatively short half

-life (i.e. I-131 with an 8 day half-life) compared to other fission products and ca n dominate early health effects if release d to the environment before or during evacuation.

Cesium is volatile but readily binds with other elements to form an aerosol. Specifically, it is known to bind with iodine as CsI, molybdenum as Cs 2MoO 4, and water as CsOH. Because of its volatility, a portion of cesium transports to the fuel

-cladding gap during operation, leading to early releases upon the occurrence of gap failure. Cesium has a relatively long half

-life (i.e., ~30 years from the dominant isotope of Cs-137) compared to other high yield fission products and dominates late health effects.

The in-vessel cesium and iodine release from fuel is near 100 percent of its total inventory following severe fuel damage without recovery. Vessel Lower H ead Failure The failure of the lower head is specified to occur using a Larson

-Miller creep rupture correlation for carbon steel. A one

-dimensional mechanical model predicts the stress

-strain distribution through the lower head and treats stress redistribution from both thermal strain and material property degradation. The stress and strain equations are solved implicitly and iteratively to update the strain profile at each timestep. A lower head segment is assumed to fail when the total strain exceeds 18%. The results from the SNL Lower Head Failure experimental program [32] was used for the implementation of the MELCOR lower head creep failure modeling and material properties

. SOARCA and ACRS reviewers have commented that failure of instrument tube and other lower head penetrations (e.g., instrument tubes) should be considered in addition to gross lower head failure. For example, an analysis of the margin to failure of the TMI

-2 vessel suggests competing failure mechanisms of tube rupture, tube ejection, global vessel failure, and localized vessel failure [124]. Post-accident examinations of the TMI

-2 lower head from the Vessel Integrity Program (VIP) revealed that several of the instrument nozzles were severely ablated. Similarly, Reference

[125] describes detailed methodologies for estimating the likelihood of an earlier penetration failure that are currently not modeled in the MELCOR code. The numerical evaluation of penetration is dependent upon multi

-dimensional heat transfer, melt flow physics, the weld strength and geometry, and the composition and temperature of the debris adjacent to the lower head.

To assess the impact of this modeling limitation, the results of the unmitigated SBO sequences were reviewed. The UA results show the timing of containment failure has the largest impact on source term consequences. While the timing and mode of vessel failure impacts the start of core-concrete interactions, there is not a direct relationship between vessel failure and an early containment failure. Nearly all the UA simulations had a strong ignition source from the hot leg failure gas discharge prior to vessel failure. In a much smaller number of cases, the hot gases exiting the PRT was initial ignition source. When an early containment failure occurred, it 3-39 always occurred from auto

-ignition of the hydrogen from a hot gas jet. These events occurred prior to significant relocation of debris to the lower head and the boiling dry of the lower head water. There were a few realizations where the hot leg did not fail. The hot leg failure was only avoided with an early stuck

-open pressurizer SV with a large failure area. However, the decay heat from the subsequent discharge of radionuclides into the PRT generated high temperature conditions in the PRT. The exit gases from the PRT rose above the hydrogen autoignition temperature, which led to a hydrogen ignition source prior to creep rupture failure of the vessel lower head. If the vessel failure occurred earlier due to a penetration failure and it was the first ignition source (i.e., not simulated in the UA calculations), then it was not judged to be substantially different than a slightly later gross vessel failure. Without any form of mitigation, all the realizations resulted in a gross vessel failure. The most important impact for both situations is whether the ignition source caused an early containment failure. Sensitivity calculations that purposely delayed ignition prior to vessel failure increased the magnitude of the burn.

33 Consequently, the absence of an early penetration failure is deemed conservative for these cases. I t is acknowledged that MELCOR would benefit from improved modeling of the lower head penetrations. This is particularly important for mitigated accidents that include injection recovery after core damage. However, the impact of the penetration failure was judged to be less important to the magnitude of the source term than the criteria for hydrogen burns that cause an early containment failure for these unmitigated SBO accidents. In particular, the difference in timing between gross lower head failure and a penetration failure did not impact the availability of earlier ignition sources that caused early containment failure.

3.2 Selection of Uncertain MELCOR Parameters MELCOR requires the input of many parameter values to solve the equations and algorithms embedded in its constituent models. Many parameters are well-known input s, such as core inventory, material properties , or sizes and lengths of piping. There are also many parameters for which the values were established through comparison to experiments, or by subject matter experts (SMEs) and are assumed reasonable for the present application

. In development of the Peach Bottom UA [9] and Surry UA [16], a common set of phenomenological areas were investigated. The approach for Sequoyah began with the same set of phenomenological areas and reduced the investigation to limit the scope of the analysis as specified in SECY-12-0092 [10]. The MELCOR uncertain parameters were selected to cover the following issues of severe accident phenomenological areas:

Sequence, In-vessel accident progression, Ex-vessel accident progression, Containment behavior, and Aerosol transport and deposition.

Since Surry is also a PWR, the Surry UA [16] parameter list served as a logical starting point for developing the Sequoyah UA parameters. Thus, as a first step, those parameters that were not

33 The ignition sensitivity was performed by suppressing an early PRT ignition on realizations with and without hot leg failure. In both cases, the later burn was significantly more severe.

3-40 identified as having key importance in the Surry UA were eliminated after SMEs considered whether plant differences might raise their importance for Sequoyah. The main purpose of investigating Sequoyah is for the ice condenser design with a small containment; see Section 1.3 for further discussion on the Sequoyah UA scope. Therefore, parameters specific to the ice condenser design were added to research these aspects, notably the barrier seal and ice doors to represent the uncertainty within ice condenser design. Lastly, some parameters found to be important in the Surry UA, such as SGTR parameters, were not included in Sequoyah because the knowledge gained in the Surry UA was determined by SMEs to be sufficient to inform the analysis; therefore, these parameters were also removed to maintain a limited scope. The Sequoyah UA includes a series of MELCOR model sensitivity analyses.

Table 3-8 lists the distributions and bounds for the 13 MELCOR parameter s sampled in this analysis. The sampling approach for the parameters is described in the following sections (Section 3.3 through Section 3.13) along with the rationale for each distribution, and justification for the upper and lower bounds.

An objective established for each sampled parameter was to clearly identify the point of departure from a known technical basis, at which use of professional judgment begins. Through team discussions, identification of professional judgement was determined for the development of parameters.

To facilitate development of parameter justification and rationale, a storyboard process, consistent with the one used in the Surry UA [16] was implemented.

Figure 3-19 illustrates the form that was used to identify the parameter, responsible owner, technical justification for uncertainty, type of distribution, and rationale for the distribution.

The intent was to capture, in a concise format, specific information regarding each parameter from which the detailed technical basis could ultimately be developed.

Parameter Name:

Type of Distribution:

Technical justification for the uncertainties:

Rationale for type of distribution:

Were similar or related parameters considered and rejected.

Graphic: (plot of the distribution)

Figure 3-19 Parameter storyboard used to capture key information for each parameter investigated The storyboards were reviewed by SNL and NRC staff where analysts explained and defended each parameter. The team challenged the technical leads to explain the basis and defend the appropriateness of supporting data.

This approach often resulted in the need for additional research to support the rationale

.

3-41 Table 3-8 MELCOR sampled parameters.

Uncertain Parameter Distribution Type Distribution Parameters Lower Bound Upper Bound Comment Sequence Related Parameters Primary SV stochastic FTC (priSVcycles)

Beta 1 Negative Binomial : 16.5: 605.5 0 1 Beta-Binomial model used to sample cycles to failure incorporating uncertainty in failure probability.

0.5 : 223.51 Primary SV open area fraction (priSVfract)

Discrete Range Prob. - - Sampled independently for each primary SV

[0.0 1, 0.1] 0.5 (0.1, 0.3]

0.1 (0.3, 0.9]

0.1 (0.9, 1.0]

0.3 Secondary SV Stochastic FTC (secSVcycles)

Beta Negative Binomial : 16.5: 605.5 0 1 Identical to primary SV distributions. The secondary SVs are not modeled separately so a sample is taken for each valve (four total) and the minimum cycles to failure is used for the system.

0.5 : 223.5 1 Secondary SV open area fraction (secSVfrac)

Discrete Range Prob. - - [0.0 1, 0.1) 0.5 [0.1,0.3) 0.1 [0.0,0.9) 0.1 [0.9, 1.0]

0.3 In-Vessel Accident Progression Melting temperature of the eutectic formed of fuel and zirconium oxides (temperature at which oxidized fuel cladding is assumed to melt) (Eu_Melt_T)

Normal Mean: 2479 K K - - Derived from VERCORS test results [41]. Oxidation kinetics model (Ox_Model)

Discrete Bin Prob. UH (MELCOR default): 0.25 Leistikov-Schanz/ Prater-Courtright:

0.5 Cathcart-Pawel/UH 0.25 Ex-Vessel Accident Progression Lower Flammability Limit hydrogen ignition criteri on with an obvious ignition source in the lower containment (Burn_Dir). Reflects downward, upward, or horizontal propagation Discrete Bin Prob. - - 4% (Up) 0.33 6.5% (Horizontal) 0.33 9% (Down) 0.33 3-42 Uncertain Parameter Distribution Type Distribution Parameters Lower Bound Upper Bound Comment Containment Behavior Containment rupture pressure (Rupture) Triangle Mode: 67 psi g 52 psi g 78 psi g Pressure at which the containment ruptures, which results in a 3 ft 2 hole Barrier Seal Open Area (Seal_Open_A)

Discrete Bin Prob. - - Open area given seal failure. Units of ft

2. 0.58 0.034 0.73 0.005 2.07 0.015 3.27 0.024 3.45 0.026 3.50 0.026 6.70 0.149 7.28 0.054 9.62 0.071 10.89 0.081 12.02 0.089 18.64 0.276 20.38 0.151 Barrier Seal Failure Pressure (Seal_Fail_Dp)

Discrete Range Prob. 15 60 Units of psid (for failure pressure). There is also a dependence on the temperature as discussed in Section 3.8. [15,30) 0.3 [30, 45) 0.6 [45, 60] 0.1 Ice Chest Door Open Fraction (Ajar) Uniform 0.5 1.0 The fractional number of individual ice chest lower doors that will remain open due to hinge deformation after they fully open Aerosol Transport and Deposition Particle Dynamic Shape Factor (Shape_Fact)

Scaled Beta 2 1.0 5.0 Consistent with Surry UA [17]. Time In Cycle Time in Cycle (Cycle) Discrete Range (days) Prob. - - Probabilities defined as number of realizations in range divided by total number of realizations.

[0,62.5) 0.113 [62.5,337.5) 0.5 [337.5, 550]

0.386 1 The sampling scheme is more complicated than a simple Beta. The probability of failure conditional on demand is described by the given beta, and then the stochastic aspect is also modeled to arrive at a sampled number of cycles to failure.

2 A Beta distribution by definition has bounds of 0 and 1. Any Beta with other bounds can be referred to as a Scaled Beta.

3-43 3.3 Primary SV Stochastic Failure to Close (priSVcyles)

The Sequoyah modeling for primary safety valves was based on the Surry UA [16] approach which used information from the original Surry SOARCA analysis [5]. In the Surry SOARCA analysis [5], SV stochastic failure was modeled for the lowest

-set-point SV and only for an FTC (failure-to-close) failure mode. The SOARCA analysis took the mean probability of FTC per demand and then evaluated the mean value of the negative binomial distribution using that probability of FTC to determine the number of SV demands at which FTC occurred. The FTO (failure-to-open) failure mode was not evaluated. The approach assum ed that redundancy in the SVs would ensure an FTC state would be reached before an 'all

-valves' FTO end state occurred; see additional discussion at the end of this section. The Peach Bottom UA also assumed only the FTC SV failure mode [9]. The sampling conducted to support the Peach Bottom UA used a beta distribution for the FTC probability per demand and determined the cycles

-to-failure by taking the mean of the negative binomial distribution with that failure probability.

The Surry UA [16] expanded upon the Peach Bottom UA approach by sampling from both the FTC and FTO uncertainty distributions. This application was deemed unnecessary for the Sequoyah MELCOR model due to the relatively high probability of FTC events compared to FTO events. By using the mean of the negative binomial distribution rather than a random sample, the sampling methodology employed for Peach Bottom incorporated uncertainty in the failure probability for valves but not in the cycles

-to-failure given a failure probability. This approach was extended for the Surry UA and the Sequoyah UA both to include uncertainty in the cycles

-to-failure (by using a random sample from the negative binomial distribution instead of the mean) and to model a system of three SVs. The Sequoyah pressurizer has three SVs (see Figure 3-9) with differing set

-points. The set

-points serve automatic valve operation such that when pressure rises in the primary system to a set-point, the associated valve is designed to open and steam is released to the PRT. Once the system reduces to 96 percent of the set

-point, the valve is designed to reseat. This is considered one cycle of the SV. Every opening and closing of the SV has a failure probability associated with the state transition.

It is assumed that all three valves in the system are similar in construction and servicing such that all three valves should have the same probability of failure-to-close. The cycles

-to-failure of the valves are determined using this probability. T he uncertainty characterization of stochastic SV failure was informed by Table 20, Failure probabilities for PWR code safety valves (behavior after scrams), in NUREG/CR

-7037 [35]. Table 20 reports on SV operation subsequent to actual scram events. Information is included for both main steam system (MSS) and RCS valves. The assumption was made in this UA that the MSS data was most representative of valve failure during severe accident scenarios. NUREG/CR-7037 notes that the MSS and RCS SVs are similar. Inquiries to SV testers revealed that these valves are similar but not identical, in that there are some physical and maintenance differences. While there are differences between the MSS and RCS SVs, they are similar enough that in weighing the difference between the valves against the lack of operational data on the RCS SVs, it was judged a more defensible basis to rely on the MSS operational data for the RCS SVs too. Additionally, the RCS data only consists of four data points and a lack of instrumentation or reporting has potentially left additional successful valve cycle demands undocumented, thus causing an attribution bias; the four data points are insufficient to draw any conclusions about RCS valve failure. Furthermore, review of the Licensee Event Reports for the two failure

-to-close events on the RCS SVs indicate that the failure mechanism in one of those two events (noted as the passing of relatively cold water from a loop seal ahead of the valve) 3-44 does not exist at Sequoyah nor at the majority of operating PWRs in the US due to an EPRI evaluation of operating experience and issuance of recommendation in the mid

-1990s [146]. As a result, it was decided that the failure probability distribution for the RCS valves should be calculated using the MSS valve data. Recovered valve function, e.g., a previously stuck-open valve closing when pressure reduces, was not taken to be successful valve operation.

In reviewing the Licensee Event Reports for the recovered SV events, it was revealed that typically there were no subsequent cycling demands reported on a recovered valve, leaving no information on how a recovered valve would have behaved if continuing to cycle.

Only valve responses to actual scram events were considered, i.e., data from valve testing reported in NUREG/CR

-7037 was not considered. In the Main Steam System Code Safety Valves section of Table 20

[35], the value for all events reports zero failures to open and 15 failures to close in 769 demands considering all failures

, recovered and non

-recovered. Noteworthy with respect to these failure rates is that they are derived from actual events at US plants. NUREG/CR

-7037 (Table 22) reports on failure rates in SV testing but the rates differ markedly from the rates evidenced by actual plant events suggesting that aspects of the testing were inconsistent with actual conditions experienced by an installed valve. Further inquiries on valve testing and review of testing requirements show that the focus of testing is to demonstrate that the valves will unseat at design pressures to relieve pressure during an overpressure event. The testing does not fully stroke an SV at pressure like an actual demand would. In fact, no testing facility in the United States has the flow capacity to fully stroke a SV. As such, the testing data was not considered applicable for the purpose of this UA

. The data collection for NUREG/CR

-7037 ended in 2007. For this project, staff and contractors performed an additional operating experience search (using the same methodology as that was used for NUREG/CR

-7037) to capture additional events through March 2016. Most of the SV operating experience data comes from licensee event reports (LERs) to the NRC.

LER data reporting, as described in NUREG

-1022 [147] requires licensees to report valid emergency core cooling system signals or critical scrams, but does not explicitly require reporting of relief valve actuations or demands. NUREG

-1022 does, however, require reporting of SV failures thus leading to credible failure information. There were ~3,000 LERs in the initiating event database from calendar year 1987 to 2007.

Each of these initiating event LERs was reviewed in the preparation of NUREG/CR

-7037, and post

-2007 LERs for the update to this UA study, to determine whether valves were actuated and/or demanded (observed lift) and whether they failed. Many LERs describing the plant response to scram report the operation of SVs, but a significant portion of the LERs just use phrases like

, "All systems operated as expected." Hence for the number of demands, expert judgment must be used to interpret the information provided in the LERs, and may be undercounted.

A handful of the operating experience data came from review of SV failures reported in the proprietary EPIX database

.34 The numbers in Table 3-9 reflect updated data, which is further separated between initial demands and subsequent demands, compared to Table 20 in NUREG/CR

-7037 [35].

34 http://nrcoe.inl.gov/resultsdb/RADS/

3-45 Table 3-9 SV FTC data (from actual scram events) and associated epistemic uncertainty distributions for probability of occurrence on demand

[35]. Demand # Failures

Demands Distribution*

Initial 16 621 16.5605.5) Subsequent 0 223 0.5223.5) *Development of indicated distributions is described below. The data from actual scram events is typically only for failures in a single SV cycle, so there may be some limitation in extrapolating to repeated valve cycles during a severe accident, but this is the best data available. There is sufficient resolution in the data, however, to separate it into two groups. The first group consists of all of the initial demands and the number of valve failures on initial demand. There were no valves that failed after the initial demand, so the second group consists of the number of cases in which a subsequent demand occurred and the valve did not fail on subsequent demand. This separation of the data (Table 3-9) suggests two separate failure probability distributions: one for the probability of failure on the initial demand and another for the probability of failure on subsequent demands.

For the Sequoyah UA, a beta

-binomial distribution was used to model cycles until a FTC event, as was done in the Peach Bottom and Surry UAs. The sampling from this model was extended to include uncertainty in cycles

-to-failure. For FTC on the initial demand, the model consists of a beta distribution on the probability of a FTC event on initial demand and a binomial distribution on the cycles to failure. Similarly, for FTC on subsequent demand, the model consists of a beta distribution on the probability of an FTC event on subsequent demand and a negative binomial distribution on the subsequent cycles

-to-failure. Hence, both for failure on the initial demand and failure on the subsequent demand, the beta

-binomial model facilitates two stage sampling that incorporates both uncertainty in the probability of valve failure

-to-close-on-demand, and in the cycles-to-failure experienced by a valve given that probability of failure.

The beta distribution on the probability of FTC on initial demand is plotted in Figure 3-20a. For each realization, one sample of a FTC probability was taken from the distribution and used to generate a binomial distribution. The binomial distribution was sampled once for each valve. If the value sampled was 1, then the valve failed on initial demand, otherwise the valve did not fail on initial demand. This sampling process leads to the distribution of FTC on initial demand in in Figure 3-20 b.

3-46 Figure 3-20 Cumulative probablities (per valve) of an FTC event on initial demand for the pressurizer SVs (priSVcycles) and the resulting distribution of FTC on initial demand.35 For valves that did not fail on initial demand, the beta distribution for probability

-of-failure on subsequent demand is plotted in Figure 3-21(a) with the corresponding negative binomial distributions on cycles

-to-failure plotted in Figure 3-21(b). Each cycles

-to-failure distribution in Figure 3-21(b) is the negative binomial distribution that results from a single sample of a failure probability from Figure 3-21(a). The development of these distributions is described further below. Figure 3-21 Cumulative probabilities (per valve) of an FTC event on subsequent demand for the pressurizer SVs (priSVcycles) and the resulting distributions of cycles

-to-failure on subsequent demand

.35 35 The same beta distribution was sampled for the SG SVs (secSVcycles).

3-47 The beta-binomial distributions were derived to reflect the high level of uncertainty surrounding valve failure. To do this, the beta distributions were calculated by incorporating the data from Table 3-9 to refine a Jeffreys uninformed beta distribution

36. The Jeff reys uninformed beta distribution, defined as (0.5 0.5), is commonly used as a prior distribution in Bayesian analysis with limited data [34]. The mean of the Jeffreys prior can be interpreted as roughly half a failure per trial, representing the lack of knowledge about the probability

-of-failure. This methodology is preferable when the data is sparse because it allows sparse data to be used in informing a distribution without placing undue confidence on the data. For example, the point estimate based on the data in Table 3-9 for the probability

-of-failure on subsequent demand is 0. However, due to the limited quantity and applicability of the data to the circumstances experienced by valves in a STSBO scenario, it is not reasonable to assume that the probability

-of-failure is actually 0. Applying the data to a Jeffr eys prior provides a robust method for incorporating the data while including a level of uncertainty commensurate with the limitations of the data. For a data set that consists of FTC events out of demands, the updated distribution for FTC probability is (0.5+ , 0.5+). In particular, note that as increases, the effect of the initial 0.5 parameters is lessened; the uncertainty around the failure probability represented in the distribution decreases as a function of amount of available data. This formula was used to calculate the posterior beta distributions for all of the failure probabilities, pictured in Figure 3-20b and Figure 3-21 b. The probability

-of-failure on initial demand distribution for the pressurizer SVs and the steam generator SVs is plotted in Figure 3-22 with the initial Jeffreys prior to illustrate the development of the distributions. There is a clear shift in the mean value and decreased variance due to the incorporation of the data. Similarly, the probability

-of-failure on subsequent demand distribution for the primary SVs and the steam generator SVs is plotted in Figure 3-23 with the initial Jeffreys prior, again showing a shift in the mean due to incorporation of data, but maintaining a fairly high variance due to the smaller number of demands in the subsequent demand valve data set (Table 3-9). Probabilities from these beta distributions form families of negative binomial distributions for cycles-to-failure (one family for the initial demand and one family for subsequent demand). Thus, uncertainty in the probability

-of-failure is incorporated into the uncertainty in cycles

-to-failure. The beta distribution in Figure 3-21a represents the uncertainty in the failure probability, modified from a Jeffreys prior by including the data. Then each failure probability data point within that distribution gives rise to one of the negative binomial distributions seen in Figure 3-21b. Each individual negative binomial distribution characterizes the uncertainty in the cycles

-to-failure and the whole family characterizes the uncertainty due to uncertainty in the failure probability.

To illustrate this connection between the beta and binomial distribution, consider the notional example in Figure 3-24. Notice that the median probability

-of-failure in Figure 3-24a is approximately 0.01, implying that half of the time failure should occur by approximately 100 trials. This is reflected in the medians of the negative binomial distributions in Figure 3-24 b which are centered around 100 trials. The medians of the negative binomial distributions vary around 100 trials, rather than falling precisely at 100 trials, due to uncertainty in the failure probability.

36 http://www.nrc.gov/reading

-rm/doc-collections/nuregs/contract/cr6823/

3-48 Figure 3-22 Cumulative probabi lities (per valve) of a FTC event on initial demand for the pressurizer SVs (priSVcycles).

37 Figure 3-23 Cumulative distribution (per valve) of a FTC event on subsequent demands for the pressurizer SVs (priSVcycles)

.37 37 This distribution was also used for the SG SVs (secSVcycles).

3-49 Figure 3-24 Notional example illustrating a beta distribution on a failure probability and the family of distribution in trials until failure that results from the uncertain failure probablity.

To determine the cycles

-to-failure for this uncertainty input, the following t wo-stage sampling procedure was applied. First, for each realization, a probability of failure for the first cycle, , and a probability of failure for subsequent cycles, , were both sampled from their beta distributions (Figure 3-20(a) and Figure 3-21(a) respectively). The sampling was performed such that the draws from each distribution would be obtained from the same quantile. In other words, if corresponded to the 95 th percentile of its distribution, then corresponded to the 95 th percentile of its distribution. The rationale for this correlated sampling is that the same valves are under consideration, so a valve that has a high probability of failing on the first cycle due to its construction or service experience would also have a high probability of failing on subsequent cycles due to its construction or service experience.

Second, for each sampled probability

-of-failure, a cycles

-to-failure distribution was created using that probability (Figure 3-20(b) and Figure 3-21(b)). Because only applies to one cycle, the distribution for cycles

-to-failure on initial demand is a binomial distribution, (). For subsequent demands, the cycles

-to-failure distribution is a negative binomial, which models the number of trials until failure given a specific failure probability. The distribution for cycles

-to-failure on subsequent demand is (1 ,). Third, one random draw was taken from each of the cycles

-to-failure distributions for each valve. This means that each valve in the system has the same probability

-of-failure on the initial demand, but not necessarily the same outcome. Similarly, each valve in the system has the same probability

-of-failure on subsequent demands, but the actual number of cycles

-to-failure is different for each valve. The draw from the binomial distribution for initial demand failure is either 0.0 or 1.0. If it is 1.0, the valve fails on initial demand so cycles

-to-failure for that valve is assigned the value of 1.0. If it is 0.0, the valve does not fail on initial demand so cycles

-to-failure for that valve is assigned the value sampled from the subsequent cycles

-to-failure negative binomial distribution. A notional example of the sampled values and the corresponding MELCOR input is provided in Table 3-10. Note that the cycles

-to-failure for each individual valve are sampled separately but they are sampled from the same distribution. This reflects the stochastic nature of valve failure but accounts for the failure probability shared by all three valves in the system. In this notional example the first valve would fail on the 25 th cycle, the a) b)

3-50 second valve would fail on the initial demand, and the third valve would fail on the 124 th demand. The actual number of cycles experienced by the valves may be less, but not more, than the sampled value if the system depressurizes before the sampled number of cycles is reached. Table 3-10 Notional example of a sample and corresponding MELCOR input.

1 Initial Failure

[SV1 SV2 SV3]

Subsequent Cycles

-to-failure [SV1, SV3, SV3]

Sample 1 0.0407 0.0057 [0 , 1 , 0] [25 ,63 ,124] MELCOR Input 1

-- -- -- [25 , 1 ,124] This sampling scheme implements two types of uncertainty in the UA. First, the uncertainty in cycles-to-failure of the three valves within one realization is representative of the stochastic nature of valve failure (aleatory uncertainty), in that one cannot predict when a particular valve will fail even given a probability

-of-failure. Second, the uncertainty in cycles

-to-failure between different realizations is representative of the uncertainty induced by uncertainty in the probability

-of-failure, state

-of-knowledge or epistemic uncertainty stemming from not knowing the actual probability of failure

-on-demand. As noted above, the FTO mode was not included in this UA.

In the draft Surry UA [16], the FTO mode was included, but a FTO of all three primary SVs was not sampled in the 1003 realizations due to the low probability.

A separate sensitivity calculation was performed for all three primary SVs failing closed and discussed in Section 6.1.8.5 of the draft Surry UA [16]. In this UA, the system depressurizes by other means (i.e., hot leg failure) before the primary SVs could cycle ~90 times for BOC realizations, and even less, ~70 times for MOC and EOC realizations (see Section 4). Figure 3-25 shows the probability of one valve failing open versus the probability of all 3 valves failing closed, for the number of cycles up to 100.

Even at 100 cycles, by which point the SV behavior is moot for this effort, the probability that all three SVs would FTO is almost three orders of magnitude lower than the probability that at least one SV would FTC.

Based on this low probability, the FTO mode was not included in this UA.

Figure 3-25 Cumulative probablity of all three primary SVs failing closed compared to a single SV failing open.

3-51 3.4 Primary SV Open Area Fraction (pri SVfrac) The pressurizer SV FTC open area fraction is represented by the MELCOR uncertain variable priSVfrac. A piecewis e-uniform distribution is used to represent uncertainty with a lower bound of 0.01 and an upper bound of 1.0. The distribution assigns a higher probability to open area fractions on the interval [0.01, 0.1] and the interval [0.9, 1] than on the interval [0.1, 0.9]. This allows for some samples in which the open area fraction is between 0.1 and 0.9 but only infrequently, as SMEs deem open area fractions in this range to be unlikely, though possible.

Rationale for Distribution Small open area fractions that do not lead to depressurization and large open area fractions that causes rapid depressurization are judged the most likely events.

This suggests that the distribution on open area fraction should result in more sampling at the extremes of the interval than in the middle of the distribution. The lower end of the distribution with small open areas represents a leaking or weeping valve, something observed in failure events during operations

[reference conference paper "Estimating Safety Valve Stochastic Failure

-to-Close Probabilities for the Purpose of Nuclear Reactor Severe Accident Analysis," to be published in the forthcoming Proceedings of the 13 th ASME/NRC Pump and Valve Symposium]. The higher end with large open areas represents a valve that energetically opens fully and suffers a mechanical deformation of internal parts that prevents re

-closure. There are no substantiated failure mechanisms observed to result in the middle part of the distribution for open areas, and hence these open areas are judged less likely. However, given the sparse data on SV failures during actual operating events, the intermediate areas are still assigned a non

-zero probability. The lower end was truncated at 0.01; though small open area fractions are possible, by definition a valve cannot fail to close and also have an open area fraction of 0.0. The value of 0.01 was chosen so if all three valves fail to close and all three valves have small open area fractions, the combined open area fraction of all three valves will still fall within a realistic range for an FTC mode. A piecewise-uniform distribution between 0.

01 and 1.0 with four sub

-regions was selected to measure the potential effects of an FTC event on accident progression.

The sub-regions are the intervals of open area fraction from 0.1% to 10%, from 10% to 30%, from 30% to 90%, and from 90% to 100%. All of the open area fractions within a sub

-region have the same probability. However, the first and last sub

-regions are more likely to be sampled than the middle sub

-regions reflecting expert opinion that valves are likely to either weep/leak or to fail full open. The region 10% to 30% was assigned a slightly higher probability than the region 30% to 90% because for one of the 16 failure

-to-close events on which the SV failure probability is based, the event description indicated a ~20% flow area. The density function that illustrates the sub

-intervals is plotted in Figure 3-26. Th e cumulative distribution is shown in Figure 3-27. A comparison of (a) the density function and (b) cumulative distribution of priSVfrac for this effort (blue line) and the draft UA [122] (orange line) is presented in Figure 3-28.

3-52 Figure 3-26 The density function for SV open area fraction (priSVfrac) for each pressurizer SV

.38 Figure 3-27 CDF for the pressurizer SV FTC open area fraction (priSVfrac).39 38 This density function was also used for the SG SVs (secSVfrac).

39 This cumulative distribution was also used for the SG SVs (secSVfrac).

3-53 Figure 3-28 Pressurizer SV FTC open area fraction (priSVfrac) comparision between current UA and DRAFT UA.

3.5 Secondary SV Stochastic Failure to Close and Open Area Fraction (secSVcycles and secSVfrac)

The SG SV FTC cycles-to-failure and open area fraction are represented by the MELCOR variables secSVcycles and secSVfrac respectively

. The data and subsequent sampling distributions for stochastic FTC are taken from the MSS valve data in Table 3-9. The FTC open area fraction distribution used for the pressurizer SVs was also used for the SG SVs. Sampling was only conducted on the first SV of the single SG loop. All other SVs are treated as cycling as designed as the expected number of cycles

-to-failure for the MSS SV is greater than the number of cycles needed to remove steam from the secondary side of the SG. While the same distributions are used for the primary side and secondary side SVs, no correlations were assumed between these two sets of valves because the two locations use different types of valves and the valves are exposed to different environmental conditions. Conversely, the samples from the first and subsequent distributions on the number of cycles until valve failure and between the steam generators within a given realization are correlated (as described for the pressurizer SVs in the previous section) because the same class of valves are being analyzed.

Rationale for Distribution The process for sampling the secondary SV cycles until FTC and the associated open area fraction is shown in Figure 3-29; green boxes represent sampled valves that are inputs transferred into MELCOR. The inherent assumption of this process is that the SGs cycle in unison for the purpose of the sampling process and thus any SG could be the single SG loop. The only difference between the treatment of the pressurizer valves and the SG valves is the use of a single SG loop to model the four SGs. Thus, the sampling process is largely the same but adapted to correspond to this modeling difference. The sampling was performed in five steps as follows:

1. Sample the probability of FTC per demand for the initial and subsequent valve cycles.

3-54 2. For the initial cycle (Cycle 1), apply the sampled FTC per demand for the initial cycle to the negative binomial distribution, initialized at one cycle, and draw one sample for each of the lowest set point SG valves; one per loop for a total of four samples.

a. If all four valves predict the number of expected valve cycles to be above one, move on to Step 3.

b. If one of the four valves predict the number of expected valve cycles to be one, apply it to the single SG loop and move on to Step 5 (final step).

3. For subsequent cycling, apply the sampled probability of FTC per demand for the subsequent cycle to the negative binomial distribution, initialized at cycle two, and draw one sample for each of the lowest set point SG valves, one per loop for a total of four samples. 4. Take the minimum number of sampled cycles for the four steam generators and apply it to the single SG loop.

5. Draw one sample from the secSVfrac distribution and apply it to the single SG loop.

Figure 3-29 Process flow diagram for the secondary SV open area fraction and number of cycles until failure for the single SG loop.

SV1 FTC? SV 2 FTC? SV 3 FTC? SV 4 FTC? Cycle 1 If any SV FTC If no SV FTC # of Sub. Cycle # of Sub. Cycle # of Sub. Cycle # of Sub. Cycle Open Area Fraction Minimum # of Cycles Select the minimum number of cycles Calculate number of subsequent cycles Sample parameters for SV on Loop 1

3-55 3.6 Effective Zircaloy Oxide and Uranium Oxide Eutectic Melting Temperature (E u_Melt_T) This parameter represents the effective melting temperature of the eutectic formed between zirconium oxides and UO 2 40. Oxidized fuel rods are assumed to experience the formation of this eutectic in the Sequoyah MELCOR modeling. When oxidized fuel cladding heats to EU_melt_T, structural integrity is considered lost, i.e., fuel rod collapse is triggered. EU_melt_T is input to MELCOR as the melting temperatures of UO 2 and Zirconium dioxide and as the temperature at which fuel rods collapse. By including the effective melting temperature of the ZrO 2 and UO 2 materials as a sampled parameter, the general fuel failure behavior of a complex non

-equilibrium multi

-component system is represented by simplifying the process to one temperature which can cause melting and fuel collapse. EU_melt_T affects the overall in

-vessel melt progression and the amount of hydrogen generated that is released to the containment. The Sequoyah approach followed the approach used in the Surry UA [16]. The binary phase diagram for ZrO 2/UO 2 suggests the melting point for equilibrium conditions is approximately 2800 K for a 50/50 molar mixture; hence this was the historical MELCOR default value. Any liquefaction below this temperature accounts for the effect of molten Zircaloy metal or alpha-Zr(O) 'wetting' the oxide surfaces.

Observations of the Phebus

([36][37][38][39][40]) and VERCORS experiments

[41] suggest that irradiated fuel and oxidized cladding exhibit eutectic liquefaction at significantly lower temperatures; thus the MELCOR default was subsequently modified to 2500 K. Following significant local cladding oxidation, the effective liquefaction of ZrO 2 and UO 2 mixtures results in local rod collapse as molten material rather than as rubble or debris. The parameter treatment for this work attempts to approximate the combined uncertainties associated with burnup, eutectic composition, material properties, and non-equilibrium effects on ZrO 2/UO 2 eutectic reactions.

Fuel collapse associated with this parameter is a localized effect

. This means that MELCOR evaluates the cladding temperature independently for each COR cell and causes structural integrity in that specific cell to be lost when failure temperature (eutectic melting temperature) is reached. Fuel and ZrO 2 melting happens at the sampled eutectic melting temperature but melting isn't required for fuel collapse. Fuel collapse happens when oxidized cladding heats to the sampled eutectic melting temperature. When structural integrity in a COR cell is lost, the fuel rods in the COR cell and in all the COR cells above that cell in the same COR ring collapse to form debris.

T o adjust the effective melting temperature of fuel-Zirconium oxide eutectic as described, the user must modify:

1. Sensitivity Coefficient 1132(1), which defines the cladding temperature resulting in rod collapse without Zr

-metal cladding remaining, and

2. The melting temperatures of both UO 2 and ZrO 2 (MP_PRC records).

40 It is noted that the pure UO 2/ZrO 2 system has only a melting point, not a eutectic point. High burnup pins have complex intermetallic effects which are referred to as eutectic reactions in the VERCORS [41] experiments and the MELCOR Users Guide [19]. This nomenclature is maintained for this analysis.

3-56 Rationale for Distribution Six experimental data points for eutectic induced core collapse are readily available from the VERCORS experiments to help inform the uncertainty distribution

[41]. Table 3-11 shows the VERCORS test results along with the mean and standard deviation.

Table 3-11 VERCORS test results for collapse temperature.

Test Collapse Temperature (K)

T1 2525 HT1 2550 HT2 2400 HT3 2525 V_6 2525 RT6 2350 Mean 2479 Standard Deviation 83 In selecting this experimental data, observed core slump is projected to a eutectic reaction. This was strongly indicated by the test results but cannot be definitively confirmed due to a lack of instrumentation.

The selection of a specific distribution is complicated by the lack of detailed experimental data over ranges of severe accident conditions and reactor operation (e.g. high burnup). While the VERCOR S testing matrix does not provide randomly distributed evidence of eutectic formation temperatures, these tests do provide a range of temperatures over which eutectics were significant enough to cause core collapse.

A normal distri bution was fit to the data and was used to assess uncertainty in the average core collapse temperature for higher burnup fuel. The simple parameter treatment is not intended to rigorously quantify eutectic effects on severe accidents and core degradation; such treatment is impossible when the MELCOR eutectic model is not activated.

Rather, the proposed treatment roughly evaluates the influences that the physical state of the core debris has on core degradation kinetics and subsequent severe accident progression. A lower temperature for this parameter results in an increased generation of molten pools in the RPV during core disassembly.

Alternatively, a higher temperature for this parameter results in a decreased generation of molten pool formation for ZrO 2 and UO 2 debris. The relocation and cooling of molten pools after formation are treated by several other models and parametric inputs in MELCOR; hence the eutectic parameter only affects the initial creation of molten pools for ZrO 2 and UO 2 immediately upon rod collapse.

Even though the testing data was derived from independent, identical tests, a normal distribution was fitted to the VERCORS data in order to describe the general range of potential collapse temperatures from VERCORS given varying environmental conditions, and is seen in Figure 3-30. This normal distribution has a mean of 2479 K and a standard deviation of 83 K. The red star in Figure 3-30 is provided for information only and represents the 2800 K value used in SOARCA

[5]. Even left unbounded, the probability of sampling beyond these bounds is effectively de minimis , so the bounds should not affect the results of this work.

The technical basis for this distribution came from VERCORS experiments which used irradiated fuel. It is plausible that that a distribution shifted to higher potential values would be more appropriate for BOC. However, the application of this parameter is further complicated by 3-57 the actual Sequoyah fuel loading, which includes new and previously burned assemblies. The potential correlation to the time in cycle uncertainty parameter (see Section 3.13) was not modeled in this study due to a lack n of representative data

. Figure 3-30 CDF of effective temperature of the eutectic reaction temperature

. 3.7 Hydrogen Ignition Criteria (Burn_Dir)

The hydrogen ignition criteria considers ignition with a well

-defined source.

Ignition from a well

-defined source is modeled based on hot gases exiting the RCS hot leg failure location above the hydrogen auto

-ignition temperature, hot gases exiting the PRT above the hydrogen auto

-ignition temperature, or ex-vessel debris with vigorous concrete ablation. These three conditions are assumed to provide well

-defined ignition sources throughout the lower containment. For combustion to occur when an ignition source is present, the local gas concentration must satisfy the combustibility limits determined by the experimental research

[29]. However, the combustibility limits from this research were varied to represent uncertainty in the direction of propagation from the ignition source for upward, horizontal, and downward propagation.

In particular, the flammability, or propagation, limits are greatly influenced by the initial direction of propagation from the ignition source.

For example, the limits for hydrogen

-air mixtures for upward, horizontal, and downward initial propagation of the flame are 4

%, 6.5%, and 9% hydrogen, respectively, demonstrating the effect of buoyancy

[29]. Sampling is performed on upward, horizontal, and downward propagation direction from the ignition source.

Hence, combustion will occur in the lower containment when a well

-defined source is present and the combustible gas concentration is above the criteria for the sampled direction.

3-58 Rationale for Distribution Sources of ignition could be present throughout the compartmentalized containment such that the location(s) where hydrogen would ignite and the direction(s) the flame(s) would need to propagate would be uncertain and random.

The experimental information [29] relied upon in defining the sampling distribution for hydrogen lower flammability limits is limited to flame propagation in the primary directions of upward, horizontal, or downward. This suggests a uniform discrete distribution is applicable, since no information is available to suggest that any one direction is more likely than another. T hus , a uniform weighting of the three discrete initial propagation directions (and corresponding lower flammability limits for hydrogen of 4%, 6

.5%, and 9%) is appropriate. Figure 3-31 shows the discrete distribution with parameter each equally likely for each ignition source location and initial propagation direction.

This study only uses identifiable ignition sources (i.e., hot gases above the auto

-ignition temperature for hydrogen from the hot leg or PRT rupture disk opening, and the ex

-vessel debris in the reactor cavity). In determining this, there are two other factors that were considered. First, although the location of the source for the hot gases or ex

-vessel debris is identifiable, the location where ignition starts may be some distance from the origin of the source. For example, hot steam and hydrogen exiting the PRT or hot leg may travel to the floor or ceiling before there is enough mixing with oxygen to support combustion. Similarly, hot aerosols from the ex

-vessel CCI may travel beyond the floor or into other compartments before triggering an ignition.

Second, the ignition physics have uncertainty. It is dependent on local conditions, which are complex to resolve and have inherent uncertainties. Even the most sophisticated computational fluid dynamics simulation of the se processes would have significant uncertainties in predicting the local conditions and modeling where ignition occurs. Consequently, it was desired to survey a range of initial ignition concentrations to account for possible variabilities in the gas concentrations and the corresponding ignition physics uncertainties. This is especially important in the context of a well

-mixed control volume approach for the combustion physics.

Figure 3-31 Uncertainty distribution for ignition propagation direction

. 00.10.20.30.4UpwardHorizontalDownwardProbability Direction H 2-LFL Uncertainty Parameter Distribution (Propagation Direction) 3-59 3.8 Barrier Seal (Seal_Open_A and Seal_Fail_Dp)

The upper and lower compartments of Sequoyah's containment structure are separated by a divider barrier (see Figure 3-32). Under accident conditions, the divider barrier acts to limit the amount of hot gases, steam and vapor that can bypass the ice condenser.

The ice condenser is an important accident mitigation feature, preventing containment pressurization and failure by condensing steam.

It is important to consider potential ice condenser bypass flow paths, because any bypass flow will reduce the effectiveness of the ice condenser.

Figure 3-32 Barrier seal section

. The divider barrier is constructed of flexible, rubber coated fabric seals that extend across the gap between the inside surface of the steel containment vessel and the freestanding concrete structures that surround the reactor coolant system components. The seals consist of 12 vertical and 11 horizontal segments that are clamped to the containment vessel and the concrete structure with bolted steel bars. Each segment sealing surface is a minimum of 3.5 inches wide with lengths varying from 2.0 to 63.9 feet. In total, the barrier seal length is 463.7 ft with a total sealing area of 135.25 ft 2 (12.56 m 2). The seals are intended to maintain their integrity during operating or design basis accident conditions for a minimum of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months with total leakage of less than 0.4

% (0.5 ft 2). For comparison, it should be noted that the smallest segment (2.0 ft in length) seals have an area of 0.6 ft 2. As such, failure of the fabric seal in one or more segments during an accident could increase the effective bypass area of the divider.

The postulated failure of the fabric seal under pressurized conditions would likely begin with a localized failure of the seal. This could occur due to a weakness in the fabric or could occur from shear stress during the seismic event.

Possible weaknesses could be induced by clamping forces, clamping surface irregularities, localized fabric defects

, or strength reduction due to field splices. Once compromised, the failure could propagate along the length of the affected seal segment, thereby partially opening the associated segment seal area to bypass flow. The assumption that the entire seal area is opened for bypass upon seal segment failure is conservative because some fabric is likely to remain in place; however, no basis was identified to establish the amount of remaining fabric.

3-60 The sealing areas (ft

2) of the 23 segments are: 0.58 (8), 0.73, 2.07, 3.27, 3.45, 3.50, 6.70 (3), 7.28, 9.62, 10.89, 12.02, 18.64 (2), 20.38. The probability of local failure is assumed to be uniform along the entire length of the barrier seal. For example, given that a local failure occurs, the probability that the failure will occur within the segment having a sealing surface of 2.07 ft 2 is: Pfailure, 2.07 = 2.07 ft 2/135.25 ft 2, or 1.5% Equation 3-2 The resultant distribution using these assumptions is shown in Figure 3-33 , which indicates the probability of a specific break area.

Figure 3-33 Barrier seal failure area probability.

Next, the failure characteristics of the barrier seal were evaluated

. The barrier seal is made of high strength EPDM (ethylene, propylene, diene polymer) coated nylon fabric.

EPDM properties indicate a temperature dependence to the ultimate strength.

In particular, EPDM will soften at high temperature and then melt. The composite construction of EPDM and nylon complicates the strength evaluation.

The thermal

-mechanical failure characteristics were estimated to span from 60 psid at 120

°F (i.e., based on the maximum value cited in the TVA technical specificatio n criteria) to 30 psid at 350

°F (i.e., assumed by NRC and SNL staff)

. The seal barrier material was expected to retain high strength until reaching its' softening temperature and then degrade quickly at higher temperatures.

The TVA acceptance and surveillance procedure for the divider material was also reviewed when developing the failure characteristics for the barrier seal

. The surveillance procedure is developed to ensure the sample material specimens meets the required 15 psid LOCA 0.000.050.100.150.200.250.300.580.732.073.273.453.56.77.289.6210.8912.0218.6420.38ProbabilitySeal Break Area (ft

2) 3-61 environment simulation. The testing procedure included testing two coupons to 60 psid. If there are no failures, then the results are acceptable. If a failure occurs at 60 psid, then four coupons are tested to 30 psid. If there are no failures at 30 psid, then the results are acceptable. If a failure occurs at 30 psid, then five coupons will be sent to the manufacturer for LOCA environment simulation (radiation, humidity, temperature) with testing to 15 psid as described above. The results of the surveillance testing were not available.

Consequently, it was concluded that all samples must withstand LOCA conditions (i.e., maximum values of 15 psid for 30 min and 330

°F for 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months followed by 5 psid for 11.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and 200

°F for 11.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ).

However, it was less certain whether the material exceeded higher pressure conditions.

Due to the lack of better thermal

-mechanical performance data, the evaluation of the seal failure criteria is considered uncertain.

Two criteria were used to characterize barrier se al failure. First, a differential failure pressure uncertainty distribution is specified in Figure 3-34. The lower limit of the failure distribution is assigned to the LOCA technical specifications of 15 psid. The upper limit was assigned to 60 psid based on the maximum value from the TVA surveillance testing. The probability distribution is divided into three uniform regions with highest probability in the middle region of 30

-45 psid based on considerations of the low temperature strength from the surveillance testing criteria.

The probability for the low pressure region (15

-30 psid) recognizes the lower failure pressure at an elevated temperature LOCA temperature

. A failure in the 30-45 psid range was assigned to be twice as likely as in t he 15-30 psid range.

A 10% cumulative probability was assigned to the 45

-60 psid range to indicate less confidence of the barrier seal strength at very high differential pressures. The cumulative failure probability is shown in Figure 3-35. Figure 3-34 Probability density of barrier seal failure versus differential pressure.

3-62 Figure 3-35 Cumulative probability of the barrier seal failure versus differential pressure. Since the differential pressure uncertainty parameter did not consider thermal effects, a second criterion is included.

The barrier seal is specified to fail if it exceeds a linear estimation of the thermal-mechanical failure criteria (see Figure 3-36). If the differential pressure and temperature of the seal is greater than this criteria, then the seal will fail.

Softening (weakening) of the seal was assumed to occur between 330°F and 350°F based on melting temperatures between 350°F and 400°F reported for similar materials.

As an example, if the sampled failure pressure is 40 psid, then the seal will failure at 40 psid if the seal temperature is above 260°F (see Figure 3-37). If the barrier seal temperature is below 260°F, then the estimated thermal

-mechanical failure criteria will lower the failure pressure as indicated by the transition between the green and red regions above 260°F. A review of the barrier seal layout in the containment shows that large portions of the barrier seal are deeply recessed between interior structures and the containment wall, up to 70

-ft below the top of the ice compartments. Consequently, the heating of the seal from hydrogen burns is expected to a result in non

-uniform response on the length of the seal. The most significant thermal-mechanical challenge to the seal integrity occurred when a burn propagated into the dome. However, this work (Section

4) shows that even failure of the smallest segment is large enough to dissipate pressure differences between the lower and upper containment. The failure opening allowed strong natural circulation flows that were only secondarily impacted by the magnitude of the failure area. Consequently, while it is likely that sustained high temperatures could lead to more significant failures of the barrier seal, the available range of failure areas assessed the desired impact and consequences.

0.00.10.20.30.40.50.60.70.80.91.015202530354045505560Cummulative Probability (-)Failure Pressure (psid) 3-63 Figure 3-36 Barrier seal pressure versus temperature failure criteria.

Figure 3-37 Example of a sampled seal failure at 40 psid.

100150200250300350400 0102030405060Temperature (°F)Failure Pressure (psid)FailureRegionSeal_Fail_Dp uncertainty parametersamples on the cold failure pressure of the barrier sealA deterministic (non

-sampled) thermal-mechanical failure criteria is also used for seal failure100150200250300350400 0102030405060Temperature (°F)Failure Pressure (psid)No FailureFailure 3-64 Rationale for Distribution Although the likelihood of localized seal failure is uniform over the length of the seal, it is less likely multiple segments would fail with bolting and direction changes in the seal.

Consequently, a discrete distribution for the local failure is judged appropriate. The failure of even the smallest segment will be large enough to dissipate pressure differences, thereby preventing another segment from failure due to over

-pressurization. Furthermore, the probability of failure for each segment is based on the area ratio. The larger seal areas have more material and more clamping, which contribut es to an increase in the occurrence of seal weaknesses. The distribution also takes into account that there are multiple segments with the same area which is why 0.58 ft 2 (eight segments) is more likely than 0.73 ft 2 (one segment), for example.

Due to an error in the sampled variable Seal_Fail_Dp (see Section 4.5), the UA calculations used a sampled failure pressure range that was an order of magnitude too low. Since the error included barrier seal failures to as low as 1.5 psid, the UA examined a much broader range of conditions than originally specified. Subsequent analyses to examine the impact of this error showed a low importance of the value of Seal_Fail_Dp on the important accident progression and source term metrics (see Appendix E.2.1). While pre

-existing failure in the barrier seal could allow more rapid distribution of hydrogen to the dome prior to the first burn, non

-compliance with the operating technical specification was considered beyond the scope of this study. 3.9 Ice Bed Lower Plenum Doors (Ajar) The ice chest lower plenum doors, if forcibly opened to where they would not fully reclose, would allow recirculation flows between the ice condenser and the lower containment and could affect conditions in the lower containment. NUREG/CR

-5586 [17] describes this situation including a discussion of the uncertainty associated with operation of the ice chest lower doors. The base calculations in NUREG/CR

-5586 assumed irreversible operation of the doors, i.e., th e doors were configured to open and close until they opened fully at which point they were held fully open. A sensitivity calculation was performed to investigate the influence of holding just half of the doors open. All doors held open was considered by SMEs to be the more realistic modeling. The Sequoyah UA considers the number of individual doors that would remain fully open as uncertain, but stipulates that at a minimum half of the doors would remain open. A uniform distribution with a range from 0.5 to 1.0 was used, i.e., from half to all the doors that opened fully were held open. Though it is physically possible for the fraction of lower plenum doors stuck open to range from fully closed (0.0) to fully open (1.0), the lower bound on this distribution was chosen to be 0.5 rather than 0.0 to acknowledge 1) the assertion in NUREG/CR-5586 that the doors would likely remain open after overcoming the small pressure differential to fully open them but 2) that there were understood uncertainties in the behavior of the doors expressed in the NUREG that necessitated sensitivity calculations with 50% of the doors behaving irreversibly. This is presented in Figure 3-38. Figure 3-39 shows the opening characteristics of the ice chest lower doors characterized in NUREG/CR

-5586 and adopted in this UA. For the scenarios model in this study the ice stored inside the baskets and basket support system is expected to survive the initiating seismic event. Significant dropping of ice from the baskets or failure of basket supports can block the ice condenser lower inlet doors. There are a large number of these inlet doors allowing steam to pass through the interconnected paths. Also the flow area between the baskets is relatively open. Therefore the uncertainty in ice behavior, such as an event of ice blocking the doors from fully opening or creating a local ice 3-65 dam between the baskets, is assumed to be covered in the uncertainty model of opening of the inlet doors and inlet flow path area.

Rationale for Dist ribution The sampled fraction of doors held open (see the distribution plotted in Figure 3-38) was applied to all the flow paths connecting the lower containment compartments (CVs 8 and 9) to the lower ice chest plenum volumes (CVs 14, 15, 16, and 17)

. These are Flow Paths 49, 50, 54, 55, and 57 in Figure 3-13. Each of these flow paths is representative of multiple ice condenser doors. Given a sampled fraction of 0.8, Flow Path 49 (with a full

-open area of 19.51 m

2) once opened fully for example, would be limited in reclosing to an area of 0.8 x 19.51 m 2 or 15.61 m

2. This means that effectively 80% of the doors represented by the flow path would thereby be held (stuck) fully open. The other 20% of the doors would effectively be allowed to continue opening/closing fully reversibly. That is, the flow path would be allowed to open to an area greater than 15.61 m 2 later in the calculation but never close to area less than 15.61 m 2. Figure 3-38 Fraction of LP doors held fully open.

3-66 Figure 3-39 Ice chest lower door opening characteristics.

In NUREG/CR

-5586 [17], TVA identified that the hinges on the lower doors are design to deform once fully open, preventing reclosure. Consequently, the distribution in the UA may overstate the uncertainty in the AJAR parameter. In post

-UA analysis of the results, the AJAR parameter was not a significant contributor to the accident progression and source term uncertainty (see Section 4.4). Furthermore, the difference between a 50% and 100% opening was not significant as either open area was very large and did not impede natural circulation.

41 Consequently, any impact of an alternate AJAR distribution on the UA analysis is expected to be small.

3.10 Dynamic Shape Factor (Shape_Fact) Dynamic shape factor is defined as the ratio of the actual resistance force of the non

-spherical particle to the resistance force of a sphere having the same volume and velocity

[45]. Dynamic shape factor is used to account for the growth of aerosol agglomerates in a linear or complex manner as opposed to growing as a perfect sphere.

The dynamic shape factor is sampled directly, (consistent with the Surry UA [16]). A value of 1.0 is a perfect sphere and it is the lower limit for the dynamic shape factor. This value is the default value in MELCOR.

41 The differential pressure required to fully open the lower doors and activate the AJAR fail open logic is only 46 Pa. The UA results showed differential pressure exceeding the 46 Pa following either the PRT rupture disk bursting or a hot leg creep rupture. The resultant stuck open area of the lower doors ranged from ~40 m 2 to 80 m 2. The difference in the flow resistance through the stuck

-open lower doors across the sampled range is relatively small compared to the internal axial and cross

-flow resistances within the ice chests.

00.20.40.60.8 1 0 10 20 30 40 50Area Fraction of Lower Plenum DoorsDelta P (Pa) 3-67 Rationale for Distribution The MAEROS model in MELCOR is used to determine the mass concentration evolution of aerosols in a spatially homogenous volume, as well as deposition on surfaces and injection/removal from volumes. One of the critical assumptions of this model is that non-spherical particle effects are adequately parameterized with the dynamic shape factor, the collision shape factor, and the effective material density. The importance of these parameters is demonstrated in several uncertainty analyses of the MAEROS aerosol model performed in support of the development of the MELCOR program [42][43]. To determine the uncertainty of this model, the uncertainty of the dynamic shape factor is addressed.

Kasper et al. [44] (Tables 9 and 10), experimentally measured values for the dynamic shape factor for linear chains with their long axis either parallel or perpendicular to the settling direction, as shown in Figure 3-40. As seen in the figure, the shape factor is reasonably linear with respect to the number of spheres.

This data supports an upper bound of 2.8, with a weighting toward values less than 2.0.

Compiled data from page 48 of Hinds [45] also supports a range of 1.0 to 2.04.

However, Brockmann, J. E., et al

[46], compiled data and models that yield a range of 1 to 10 for the dynamic shape factor.

The same report includes a correlation for loosely-packed spheres which calculates dynamic shape factors to be in the range of 1 to 5 for void volumes ranging from 26

% to 99%. Based on these sources, a range of 1 to 5 is the range used for this project.

Although the bounds of the distribution were informed by the experiments, these works cannot inform the shape of the distribution since they do not contain information on the normal shape of aerosols during a severe accident.

Kissane [47] compiled information on aerosols from a number of nuclear accident experiments, including the Phebus fission product tests.

The report concluded: Concerning particle shape, relatively compact particles without branching chain

-like structures appear to be typical in the RCS [47], although a visual inspection of post

-test deposition images did show slight evidence of aerosol chains.

Since a compact, spherical particle has a shape factor of 1.0, the distribution is weighted more heavily toward the lower end of the range (1.0).

Additionally, most references [44][45][47] support weighting more heavily in the 1.0 to 2.0 range.

Because of this weighting, a beta distribution is used (; ), and the CDF of the distribution is shown in Figure 3-41. shape to the CDF and yields about 75

% of samples between 1.0 and 2.0 while still allowing samples at physically possible values up to 5.0.

3-68 Figure 3-40 Dynamic shape factor compared to number of spheres within a chain

. Figure 3-41 CDF of the dynamic shape factor

. It should be noted in the MELCOR code that the aerosol dynamic and collision shape factors and density are set globally at the beginning of the run and cannot be updated as the acciden t progresses.

This means that the dynamic shape factor chosen from the uncertainty distribution cannot be changed during the accident progression.

3-69 3.11 Containment Rupture Pressure (Rupture) Section 3.1.7 provides details on the containment design and the rationale for the uncertainty distribution for the containment failure pressure. The uncertainty in the internal pressure that a free-standing steel containment vessel can withstand before rupturing is addressed through the parameter 'rupture.' NRC SMEs suggested that 67 psig be considered in the UA as the mean value for the magnitude of the pressure that the Sequoyah containment vessel can withstand, and a range between 52 psig and 78 psig be considered possible. Accordingly, a triangular distribution with a mode of 67 psig and lower and upper bounds of 52 psig and 78 psig, respectively, was prescribed

. Figure 3-42 shows the CDF of the rupture parameter for the given bounds of the triangle distribution.

Figure 3-42 CDF of the rupture parameter.

3.12 Oxidation Kinetics (Ox_Model)

The draft Sequoyah UA calculations [122] and more recent test calculations showed a high sensitivity of the early containment failure timing to the amount of hydrogen released to the containment prior to the first ignition. Whereas the amount of hydrogen released to the containment prior to ignition is strongly influenced by the pressurizer SV failure characteristics, i t was suspected that the uncertainty in the oxidation rate could also impact early containment failure. Based on the results of preliminary calculations using a pre

-release version MELCOR 2.2, four aspects of the oxidation modeling were considered for possible inclusion as 3-70 uncertainty variable(s).

42 The four aspects were: (1) the oxidation rate correlation used in the steam-Zircaloy parabolic kinetics model, (2) the oxidation rate correlation used in the steam

-steel parabolic kinetics model, (3) the fuel collapse modeling, and (4) the fuel quenching model. After review of the four aspects effecting oxidation, only the oxidation rate correlation used in the Zircaloy parabolic kinetics model was selected as an important uncertainty.

43 The impact of the steel oxidation correlation was dismissed for three reasons. First, the importance of steel oxidation is greatly diminished during the early phase of the accident due to the very small steel surface area and slower heating rate relative to the much larger surface area of the Zircaloy fuel cladding. Secondly, while steel oxidation can be an important late source of hydrogen, the importance to the amount of hydrogen released to the containment prior to first ignition source was less significant than Zircaloy oxidation in both timing and magnitude. Finally, default steam

-steel correlation by White in MELCOR [20] is consistent with other steam

-steel oxidation recommendations (e.g., used Bittel [111]). Consequently, the default steel oxidation kinetics in MELCOR was judged representative and less important relative to the other parameters.

The third and fourth parameters concerned aspects that indirectly affected oxidation. In the initial Sequoyah UA calculations, 43 large amounts of hydrogen were generated from steel oxidation following the accumulator discharge into the RCS at hot leg failure. The impact was most prominent in realizations with a rapid accumulator discharge following the hot leg failure at high RCS pressure (see Figure 3-43). MELCOR predicted the fuel was intact at the time of hot leg failure for this situation (see the left side of Figure 3-44). In the earlier MELCOR 2.1 Version 7317 calculation, 43 the steel structures were not quenched. A relatively large amount of hydrogen was generated as the accumulator water boiled away. The quenching model has recently been enhanced and limitations were removed that prevented or greatly limited heat transfer during the quench phase. The pre

-release version MELCOR 2.2 calculates steel cooling and quenching with limited steel oxidation. In contrast, the right side of Figure 3-44 shows a typical realization with a stuck

-open pressurizer SV area greater than 30% prior to hot leg failure. In these realizations, significant core degradation occurred prior to the accumulator discharge. The debris bed geometry was not supportive of rapid oxidation due to the low porosity of the debris bed. MELCOR predicted very little oxidation for this configuration (i.e., all MELCOR versions).

42 The scope of the Sequoyah UA was to emphasize containment response parameters for the ice condenser design.

The Sequoyah UA included parameters previously identified in the Surry UA [16] as important to hydrogen production. However, the results of the draft Sequoyah UA showed that the amount of hydrogen released to the containment prior to the first ignition source was the most significant factor effecting the timing of early versus late containment failure [122]. Furthermore, small differences in the released hydrogen (and the containment failure pressure) could lead to large differences in the containment failure timing. In anticipation of the uncertainty calculations, it was decided to include an uncertainty variable for oxidation kinetics.

43 New in this context is relative to a preliminary set of Sequoyah UA calculations performed in 2015. Following review of the original calculations by ACRS members at a May 2016 subcommittee meeting, new UA calculations were performed to address the comments from committee members. The oxidation kinetics parameter was added at this time. These calculations used an earlier version of MELCOR 2.1 (Revision 7317).

3-71 Figure 3-43 Comparison of the hydrogen generation from steel oxidation in a realization with hot leg failure from high-pressure and no pressurizer SV failur

e. Figure 3-44 Comparison of the core structures at the time of the accumulator discharge.

050100150200250 0 1 2 3 4 5 6 7 8Mass (kg)Time (hr)In-Vessel Hydrogen Generation from Stainless SteelRealization 225MELCOR 2.1 Version 7317MELCOR 2.2 Version 9321Original Rlz 225 following hot leg failure at high-pressure at the time of the accumulator discharge Original Rlz 133 following hot leg failure after stuck

-open pressurizer SV at the time of the accumulator discharge Intact Fuel Debris Bed 3-72 The consideration of the fuel configurations shown in Figure 3-44 as they related to the third and fourth parameters were discussed extensively between SNL and NRC staff, but were ultimately dismissed as uncertainty variables for the following reasons. First, the most important condition that led to early containment failure was a stuck

-open pressurizer SV that discharged the hydrogen from the RCS to the containment. In these realizations, the increased inventory loss resulted in fuel collapse and formation of a debris bed prior to the accumulator discharge (i.e., the right side of Figure 3-44). Since the debris configuration was not supportive of large hydrogen generation rates following the accumulator discharge, the third and fourth parameters would not significantly vary the results. Second, the potential for an accumulator discharge to shatter and collapse the core was discussed. However, this aspect of quenching was dismissed for many reasons including (a) an intact core at the time of the accumulator discharge is not supportive of early containment failure (i.e., the left side of Figure 3-44), (b) formation of a debris bed would likely decrease rather than increase oxidation, and (c) MELCOR does not include fuel quench

-shatter models. Consequently, investigating uncertainty in the quench modeling was not expected to reveal changes in the early hydrogen generation. Finally, the timing of core collapse is varied through uncertainty in the LOCA boundary conditions (i.e., through sampling of priSVcycles and priSVfrac) and effective fuel eutectic melting criteria (i.e., through sampling of EU_melt_T). The remaining uncertainty variable is steam

-Zircaloy oxidation kinetics. The draft Sequoyah UA [122] used the default Urbanic and Heidrick steam

-Zircaloy oxidation kinetics model in MELCOR [20]. It is a two temperature region oxidation model that uses parabolic kinetics with appropriate rate constant expressions for Zircaloy oxidation limited by gaseous diffusion considerations. The solid-state diffusion of oxygen through an oxide layer to unoxidized metal is represented by the parabolic rate equation:

()=() Equation 3-3 where W is the mass of metal oxidized per unit surface area and K(T) is a rate constant expressed as an exponential function of surface temperature

, T , [20]. The Urbanic and Heidrick model uses a low region temperature rate constant correlation through 1853 K and a separate high temperature correlation above 1873 K. The high temperature regime is characteristic of an open oxide structure that greatly increase the oxidation kinetics. The low and high temperature Urbanic and Heidrick steam

-Zircaloy oxidation rate coefficients are shown in Figure 3-45. The rate constant is interpolated between the low

- and high-temperature regions. As shown in the figure, the oxidation rate constant grows rapidly with temperature and especially increases after the transition to the high temperature region.

3-73 Figure 3-45 Urbanic and Heidrick Steam

-Zircaloy Oxidation Kinetics Rate Coefficient

. The Paul Scherrer Institut e (PSI) of Switzerland recently developed a new model for air and steam oxidation that were incorporated into MELCOR 2.1 [112]. While the most significant enhancements were for air oxidation, multiple steam oxidation correlations are included from we ll-referenced correlations including the default Urbanic and Heidrick model.

With respect to the other correlations included in the new PSI model, the Sokolov correlation was developed for VVER E110 cladding which includes niobium [115]. It was discarded as not being prototypical to PWR fuel. Similarly, a newer VVER E110 oxidation correlation by Grosse was not included because it is not prototypical to PWR fuel. Finally, two options are available in the PSI model that use the Leistikov and Schanz correlation. The Leistikov and Schanz correlation was developed based on data through 1600

°C and therefore not appropriate for the very high temperature range [114]. The option of Leistiko v-Schanz combined with Prater-Courtright was included because Prater-Courtright addresses the high temperature region. However, the PSI option of the Leistikov and Schanz that did not include a high

-temperature correlation was dismissed. After dismissing the VVER correlations and the Leistikov and Schanz without a high

-temperature correlation, the remaining correlations built into the MELCOR code are shown in Figure 3-46. 1.E-051.E-041.E-031.E-021.E-01130015001700190021002300k(T) [kg 2/m 4-s]Temperature (K)Urbanic and Heidrick Steam

-Zircaloy Oxidation Kinetics Rate Coefficient 3-74 Figure 3-46 Oxidation Rate Coefficient Correlations used for sampling. Rationale for Distribution While reviewing comparisons to experiments (e.g., [114][115][116]) and other computer code defaults (e.g., [117]), the Cathcart-Pawel correlation is often cited as providing best oxidation comparisons up to the high temperatures.

At high temperatures, the Prater-Courtright correlation is benchmarked against high temperature data from ORNL data [118]. For example, Reference [119] showed better predictions at temperatures above 1800 K using the Prater-Courtright correlation than the Urbanic and Heidrick correlation. However, it is noted that the differences of the three correlations below the transition at ~1900 K were smaller than above.

Three correlations commonly used in the literature were selected for the uncertainty analysis. The Urbanic

-Heidrich correlation is historical ly important due to its use in MELCOR analysis, including the previous Peach Bottom UA [9] and Surry UA [16]. The Cathcart

-Pawel correlation is identified for wide

-spread citations in the literature and for default code settings

[117]. The Leistikov-Schanz correlation is the only correlation in MELCOR that is coupled with the Prater-Courtright correlation [20]. All three correlations had similar values below the high

-temperature transition point near 1900 K. Two of the correlations used the rate constants from the Urbanic

-Heidrich correlation above 1900 K, which was significantly lower than the Prater

-Courtright correlation. To equally survey the two different high

-temperature rate constants, a 50%, 25%, and 25% distribution is used (see Figure 3-47). A 50% probability is assigned to the correlation that included the high

-temperature Prater-Courtright correlation and 25% each to the correlations with Urbanic-Heidrich high

-temperature correlation.

1.E-051.E-041.E-031.E-021.E-011.E+0012001500180021002400k(T) [kg 2/m 4-s]Temperature (K)Comparison of Steam Oxidation KineticsUrbanic-HeidrichCathcart-Pawel/Urbanic-HeidrickLeistikov-Schanz/Prater-Courtright 3-75 Figure 3-47 Probability assigned to each oxidation kinetics rate constant correlation.

3.13 Time in Cycle (Cycle) The time in cycle parameter was included to understand the extent to which the fuel burnup influenced simulation results. This was accomplished by including an uncertain parameter named CYCLE, which identifies the point during the fuel burnup cycle (beginning of cycle

- BOC, middle of cycle

- MOC, and end of cycle

- EOC) at which the accident occurs.

Three points within the cycle are taken as 'representative' times to constrain the problem

there are a host of potential uncertain data and inputs for standalone-burnup analyses such as nuclear data (cross sections, yields, decay data

, etc.) and operating characteristics (e.g., explicit accounting of 3D power distributions for every assembly including previous cycles, details of prior operating cycles, and detailed power history). This sampled parameter directly affects the MELCOR source term calculation through decay heat and affects the MACCS consequence analysis through the fission product inventory (see the change with burnup in Table 3-4). The inventories of shorter lived isotopes increase with burnup only until secular equilibrium is established; however, the inventories of longer lived isotopes, like Cs

-137 which grows monotonically throughout the cycle, can nearly double from BOC to EOC. Because the longer lived isotopes have an effect on LCF risk, especially in the long-term phase, this parameter is significant to the predicted results.

Table 3-12 shows the approximate time period of BOC, MOC, and EOC for the assumed 550 day cycle. As seen in Table 3-12, there are gaps between the points of interest within the fuel cycle which are not easily distinguishable. Figure 3-48 and Figure 3-49 show this graphically for the decay heat curves on severe accident time

-scale as a function of decay time (in hours or seconds) for variable operating time (in days) into the last day in cycl

e. Based on this analysis, BOC is qualitatively less than 60 days (much less heat than other curves after a 00.10.20.30.40.50.6Probability (-)Leistikov-Schanz/Prater-CourtrightUrbanic-HeidrichCathcart-Pawel/Urbanic-Heidrick 3-76 few hours); MOC is relatively similar to EOC but divergence is slowly growing with increasing decay time, and this looks to be 60+ days to ~300 days of operating time. Beyond this operating time (i.e. 400 to 550 days), the decay heat curves are essentially identical for severe accident time-frames. Table 3-12 Approximate time periods of cycle points

. Time in Cycle

Days of full power operation BOC 0+ to 60 MOC 100 to 300 EOC 400+

Operating times in

-between these are going to be closer to the next period (e.g. 61 days is closer to an MOC curve than a 1 day BOC curve)

Figure 3-48 Sequoyah decay heat at specified times BOC is a markedly lower decay heat a few hours after shutdown due to short recent irradiation time, which results in lower inventory of shorter

-lived nuclides that dominate decay heat a few hours after shutdown. The decay heat is essentially from the previously irradiated fuel assemblies; thus

, BOC has the lowest amount of long

-lived nuclides that are important for environmental consequences

. MOC is the approximate time of shutdown assumed for NUREG

-1935 [3]. MOC has larger decay heat than BOC excluding the time immediately at shutdown. Also, due to the increase in overall core burnup, MOC has a higher long

-lived radionuclide inventory than BOC.

T i m e (h r)D e c a y p o w e r (M W)0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 5 1 0 1 5 2 0 2 5 3 0 5 5 0 d 5 2 9 d 4 0 0 d 3 0 0 d 2 0 0 d 1 0 0 d 6 0 d 3 0 d 1 0 d 6 d 3-77 Figure 3-49 Sequoyah decay heat on a log

-log scale at specified times

. EOC is an examination of the highest realistic burnup condition of the core with the greatest long-term decay heat and inventory of long

-lived radionuclides. Immediately at shutdown EOC decay heat is similar to BOC and M OC, and is largely comparable to MOC for severe accident time-frames (inventories of radionuclides driving decay heat for one to four days). Nonetheless, the greater overall burnup of EOC still means greater accumulation of long

-lived radionuclides that will dominate decay power for longer decay time. Thus , from a decay heat perspective, MOC vs. EOC allows for t he examination of higher decay heat later within the accident scenario which could be important for RPV lower head response, ex

-vessel behavior, and long-term containment response.

Yet the motivation for differentiating between MOC and EOC is the long

-lived radionuclide inventory that affects the MACCS consequence analysis for LCF ris

k. From Figure 3-50 , the activity levels of the inventories for short

-lived isotopes increase with burnup only until secular equilibrium is established. However, from Figure 3-50, the activity levels of the inventories for long-lived isotopes grow monotonically throughout the cycle , and nearly double from BOC to EOC. T i m e (s)D e c a y p o w e r (M W)1 0 0 1 0 1 1 0 2 1 0 3 1 0 4 1 0 5 1 0 6 1 0 0 1 0 1 1 0 2 1 0 3 5 5 0 d 2 0 0 d 6 0 d 3 0 d 1 0 d 6 d 3-78 Figure 3-50 Activity levels for I

-131 and Cs

-137 with respect to time in cycle

. Rationale for Distribution The decay heat and radionuclide quantities vary continuously throughout the cycle, but generating a continuous set of consistent radionuclide information for use in MACCS is currently infeasible for studies intended to focus on severe accident uncertainties. Therefore, three representative reactor conditions were chosen to capture the 'baseline' or midpoint state of the core (MOC) and the 'tails' of the potential core conditions (BOC and EOC).

Additionally, each day of the 550

-day cycle period should be represented within the 600 realization sample space.

In a 550-day cycle, the CYCLE 44 parameter for the MOC range was chosen to be 200 days. Initially half of the sample space was associated with time in cycle set to 200 days and was consistent with decay heat times used in NUREG

-1935 [3]. Henc e the number of days considered MOC needed to be half of the 550

-day cycle (275 days), since half of the sample space was associated with that region. The remaining sample space wa s divided between the BOC and EOC so all realizations were independent and identically distributed in time. Hence, the MOC interval in time was determined to be between 62.5 days and 337.5 days in order to be both 275 days long and centered about 200 days. Correspondingly, BOC and EOC intervals

44 In the current effort to update the SOARCA Surry UA, additional radionuclide inventories and decay heat curves are being calculated for a total of 13 data points to better sample along the continuum of the fuel burnup cycle (e.g., day 0.5, 25, 50, 75, 100, 150, 200, 250, 300, 350, 400, 450, and 500 into the fuel cycle). Each day of the 550

-day fuel cycle will be assigned to one of these data points which most closely matches the radionuclide inventory and integral decay heat over the accident simulation time.

1000150020002500300035004000150200250300350400450 0 50100150200250300350400450500550 131I inventory (PBq) 137Cs inventory (PBq)Time into cycle (days)Cs-137 (left axis)I-131 (right axis) 3-79 were determined to be between 0+ days and 62.5 days and between 337.5 days and 550 days, respectively.

While the median was used for the time in cycle for MOC, it was desired to use extreme values for BOC and EOC to capture effects from near the limits (tails of the distribution) of the radionuclide inventory for environmental consequences and decay heat for later term severe accident phenomena (e.g., containment response). The BOC time in cycle was chosen as 10% the width of the BOC interval from the left limit of the interval (i.e., 6.25 days), and the EOC time in cycle was chosen as 10% the width of the EOC interval from the right endpoint (i.e., 528.75 days). To determine the fraction of the sample space associated with BOC and EOC, the widths of the intervals were divided by 550 days (the cycle length). The definitions of intervals, time in cycle used, and the number of realizations for each interval are illustrated in Figure 3-51. Figure 3-52 shows the percentage of the number of realizations for each interval.

The CDF for days into the cycle is plotted with the point estimates in Figure 3-53. Note that in implementation of this distribution the actual quantity of realizations in each interval was 69 (BOC), 300 (MOC), and 231 (EOC).

Figure 3-51 Illustration of the time in cycle definitions, point values, and the proportion of realizations in each interval.

BOC 69 RealizationsMOC 300 RealizationsEOC 231 Realizations 3-80 Figure 3-52 Percentage of realizations for the time in cycle intervals

. Figure 3-53 CDF for days into cycle at which the accident occurs.

4-1 4. ACCIDENT PROGRESSION ANALYSIS This section presents the accident sequence progression results of the study, with a detailed examination of hydrogen behavior of select cases, the statistical characterization of aggregate results and the predicted source term releases to the environment. The MELCOR Version 2.2 was used in the analysis to investigate the scenarios specified in Section 2 (i.e., the STSBO and LTSBO) using the model and uncertainty inputs described in Section

3. The severe accident progression in an ice condenser plant is expected to differ from that in a plant with a large dry containment due to the relatively small and freestanding steel construction of an ice condenser containment and the presence of pressure suppression ice baskets as compared to the spacious reinforced concrete design of a large dry containment.

A primary goal of the Sequoyah UA was to investigate the potential for an ice

-condenser containment to fail early from a hydrogen deflagration in a severe accident situation. The UA calculations resulted in three general outcomes:

1. Late containment failures are most common

a. After lower head failure and melting of the ice characterized by ex

-vessel phenomena such as CCI

2. No containment failure within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months of the onset of the STSBO, and

a. Most were BOC realizations

3. Early containment failure occurred rarely

a. After start of core damage characterized by hydrogen combustion due to in

-vessel hydrogen generation.

In considering the detailed results that follow, the parameters and phenomena especially important are:

Ignition sources are assumed to exist only in lower containment and are limited to:

o Hot gas/aerosols issuing from a hot leg breach, o Hot gas/aerosols issuing from the PRT

, or o Reactor core debris on the containment floor A deflagration ignited by hot gas issuing from the PRT comes early relative to one ignited at hot leg rupture or RPV lower head failure Ignition can be delayed or sped up by the sampled value of hydrogen LFL Oxygen depletion stops further deflagrations at some point Excessive steam can prohibit ignition at times Sampled containment rupture pressure is very important (i.e., containment pressure often approaches the rupture pressure but doesn't quite reach it)

4-2 Fission product decay is responsible for continuous heating of the containment, vaporizing ice melt, and causing non

-condensable gas generation through CCI leading to eventual containment failure 4.1 Overall Re sponse to Hydrogen Generation and Combustion This section presents a comparison of the current UA and the draft UA [122] results to better understand the overall system response involving the RCS and containment and the impact of in-vessel hydrogen generation and combustion in the containment. The behavior of the pressurizer SV both in terms of FTC and the open area fraction significantly affects the hydrogen production and transport to the containment by the time a hydrogen burns occurs, which in turn determines whether the containment fails early (near the time of core damage) or late (many hours after lower head failure). The general observations from both the current and the draft UA are: Consequences are strongly dependent upon early vs. late containment failure.

Early containment failure results from a hydrogen combustion while late containment failure results mainly from ex

-vessel phenomena (e.g., core concrete interaction

) Early containment failures occur only on the first hydrogen burn and subsequent burns do not challenge containment integrity

. Protracted SV cycling results in lower in-vessel hydrogen production by the time of first burn. PZR SV failure to close (with significant open area) results in greater hydrogen production and transport to the containment prior to the first burn, and necessary for early containment failure

. Figure 4-1 shows the results of the current UA and the draft UA for the time to first deflagration as a function of the in

-vessel hydrogen generation. The amount of hydrogen that is produced in

-vessel (the x

-axis) impacts how much hydrogen is available for transport to the containment at the time of hydrogen burn, which is an important metric for early containment failure. The timing to the first deflagration from the start of hydrogen generation (the y

-axis) is an indicator of the characteristic of the accident progression. As will be shown in the following comparisons, the low variability in the timing to the first combustion on the left

-hand portion of the curve is dominated by the timing to hot leg failure of the RCS from relatively high pressure. In contrast, the protracted timings to the first deflagration include results with delayed hot leg failure due to a RCS depressurization after a pressurizer SV FTC. Both the current UA and the draft UA exhibit the same general characteristics; the changes in the uncertainty parameter distributions between the two studies only affects the distribution and clustering of the points and not the trends. The current results are heavily clustered near the left

-hand side of Figure 4-1 whereas the draft UA includes more realizations that extend to the right

-hand side.

4-3 Figure 4-1 Comparison of hydrogen production in current UA and draft UA MOC cases Additionally, it is important to note the significant differences in the behavior of the SVs in the current and draft studies as shown in the bar charts in the upper left insert of Figure 4-1. In the current UA, the majority of the cases (89%) result in no FTC of the SVs and is more than 4 times more likely than in the draft UA.

The implication is that in the current UA, there are far fewer cases (4%) of SV FTC with an open area fraction greater than 0.3 compared to the draft UA (62%) as shown by the red color in the bar chart. The draft UA showed that this is a necessary (but not sufficient) condition for the potential of early containment failure (i.e., hydrogen that is produced in

-vessel moves more readily from the RCS to the containment through the PRT as the system is depressurized

). Therefore, far fewer early containment failure cases are expected in the current UA as compared to the draft UA. The colored arrow in the figure shows that the cases with FTC and area fraction greater 0.3 are associated with higher in-vessel hydrogen production and longer times until the first deflagration.

The amount of hydrogen produced in

-vessel is generally less when pressurizer SV is cycling through hot leg failure with the primary system at high pressure; see the clustering of the blue points to the left of Figure 4-1. For the high pressure cases, the heat from the core is more efficiently transferred from the vessel to the reactor coolant system piping. The combination of a high differential pressure across the hot leg to the containment and the more effective heating at high pressure results in the hot leg failure earlier in the core degradation progression (i.e., a shorter timing on the y

-axis of Figure 4-1). The first ignition source in these high pressure cases is the failure of the hot leg, which is associated with less in

-vessel hydrogen generation and a lower amount of hydrogen transported to the containment. The early deflagration from these 4-4 smaller amounts of hydrogen in the high pressure cases did not fail the containment. Furthermore, the subsequent deflagrations also did not challenge the containment integrity because they occur closer to the lower flam mability limit due to the presence of active ignition sources (e.g., after the hot leg failure or the lower head failure).

In contrast to the high pressure cases, in cases with the system depressurization through SV FTC (i.e., especially realizations with an early SV FTC and a fractional area >0.3) the timing for the start of the hydrogen production is generally accelerated. The accumulation of creep damage to the hot leg and the heat transfer from the core to the hot leg are less efficient at low pressure. Furthermore, the early SV FTC scenarios may include partial accumulator injections at low RCS pressure. The combined effects of the these factors lead to a longer amount of time from the start of core damage to the first deflagration and a larger amount of hydrogen production (i.e., the points on the right

-hand side of Figure 4-1). Finally, the higher rate of hydrogen discharge to the containment and lower retention in the vessel also significantly increases the amount of hydrogen in the containment at the time of the first deflagration. These cases generally had much more severe burns that challenged the containment integrity.

Figure 4-2 shows only the cases that lead to early containment failure. In both the current and the draft UA, only realizations with a SV FTC and area fraction greater than approximately 0.3 had early containment failure, and is shown in Figure 4-3 with overlapping regions for the draft UA (see the yellow and orange points in the ~200

-350 kg range). The higher SV open area fraction led to an accident progression that would allow more time for hydrogen to be produced and transported to the dome. In these cases, the core damage timing on the y

-axis is greater than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (and produc es hydrogen in excess of 300 kg) compared to less than an hour

, and less in-vessel hydrogen generation for the high pressure cases in Figure 4-1. In the current UA, a handful of cases with potential for early containment failure

two MOC cases led to failure. The very small number of early failures within the current UA compared to the draft UA is due primarily to the smaller likelihood of a pressurizer SV FTC (see Figure 4-1). The lower in

-vessel hydrogen generation observed with MELCOR Version 2.2 (current UA) as compared to MELCOR Version 2.1 (draft UA) for some situations seems comparatively less important especially since the difference develops after accumulator injection following hot leg failure and after the first deflagration, This is discussed further in Appendix D

. Figure 4-4 shows the effect of SV no FTC on the delay in hydrogen burn for a subset of the cases from Figure 4-1. In Figure 4-4 , the y-axis in the main figure is the difference in the time from core damage to first hydrogen deflagration and the insert is the time difference between core damage and hot leg failure. The outliers in the main figure (i.e., points with time difference of more than an hour) collapse when referenced to the hot leg failure (i.e., typically the timing of the first deflagration). For these outlier cases, the first hydrogen deflagration does not occur at the time of hot leg failure because hydrogen flammability criteria are not met.

The situation with the outlier realizations from the draft UA is somewhat more complicated because of differences in the code versions (see Appendix D) which is related to the low potential for quenching during the accumulator injection after hot leg failure. It is important to note that the behavior in both the current and the draft UA is very similar until the time of hot leg failure and is primarily a function of SV modeling rather than the MELCOR code version.

4-5 Figure 4-2 Comparison of MOC early containment failures in current UA and draft UA Figure 4-3 Effect of SV open area fraction in current UA and draft UA

4-6 Figure 4-4 Effect of SV no FTC in current UA and draft UA The effect of oxidation kinetic model is pronounced for the SV with no FTC. This is compared between the current and draft UA for MOC cases as shown in Figure 4-5. In the current UA, three oxidation models are used (see Section 3.12) as compared to only the Urbanic

-Heidrich (UH) in the draft UA. The Leistikov

-Schanz/Prater

-Courtright (LS/PC) model produces less hydrogen at low temperatures as compared to the other models (see Figure 3-46), which leads to a clustering of the green (LS/PC) points with lower hydrogen generation on the left

-hand side of the curve. The Catchart-Pawel/Urbanic

-Heidrick (CP/UH) and UH models had successively higher hydrogen oxidation rates at low to mid temperatures that led to successively higher hydrogen generation amounts prior to the first deflagration, respectively.

The differences in the UH model results between the current and the draft UA in Figure 4-5 are most likely attributable to the secondary side SV operation.

In the draft UA, the secondary SV cycled only 45 times before failing with an area fraction of 0.5, which led to an earlier steam generator dryout, and earlier time of core damage. The accelerated sequence of events in the draft UA results in generally higher hydrogen generation as compared to the current UA even though there are clear overlapping points (e.g., the current UA includes SV FTC on one steam generator as early as the first valve cycle). Both the draft and the current UAs also capture the decrease in the time to hot leg failure with increasing hydrogen production. The downward trend from 140 kg to 280 kg on Figure 4-5 corresponds to higher oxidation rates and a faster accident progression that accelerates the heating of the RCS pressure boundaries including the hot leg. This trend resulted in shorter timings from the start of hydrogen generation to the hot leg creep rupture and the first deflagration.

4-7 Figure 4-5 Effect of oxidation kinetics in current UA and draft UA The effect of the decay heat on hydrogen production is shown in Figure 4-6 for the current UA. While the MOC and EOC behave similarly due to slight variations in the decay heat, the lower decay heat power in the BOC and LTSBO realizations at the start of the hydrogen generation slowed the accident progression (see decay heat discussion in Section 3.13). The lower decay heat not only slowed the core heat up but also resulted in a more closely coupled heat up of the hot leg (e.g., see discussion with Figure 4-139 and Figure 4-140 in Section 4.8 for the LTSBO analysis). The combined impact of the lower decay heat and tighter coupling between the core thermal response and the hot leg temperature resulted in slightly more time to hot leg failure but with less in

-vessel hydrogen generation (i.e., left-hand side of Figure 4-6). A closer inspection of the results shows that the decay heat for LTSBO (i.e., MOC value) at the time of core damage is comparable to STSBO BOC cases. Figure 4-6 also shows all the BOC and LTSBO realizations with a pressurizer SV FTC and open area fraction > 0.3 on the right

-hand side of the figure. These BOC and LTSBO realizations overlap the range of results from early containment failure realizations in Figure 4-2. Some of these cases have in

-vessel hydrogen generation rates in excess of 400 kg prior to the first deflagration. Consequently, it seems likely that combinations of uncertain parameters exist fo r BOC and LTSBO scenarios that could lead to an early containment failure even though none were calculated.

4-8 Figure 4-6 Effect of decay heat on hydrogen combustion in current UA The results of the complimentary investigation into the key FTC sample space for pressurizer SVs in Appendix I are compared to the current UA and draft UA in Figure 4-7. In th e SV study (discussed in Section 4.4.2), the focus is on FTC with open area fraction greater than 0.3. These cases compare well with the draft UA and confirm the expectation of higher hydrogen generation and greater potential for early containment failure as discussed in Appendix I.

4-9 Figure 4-7 Comparison of current UA, draft UA, and focused SV stud y The fundamental difference between calculations that failed containment early and calculations that failed containment late is exemplified in Figure 4-8 and Figure 4-9. Figure 4-8 is for a calculation (Rlz 554) that failed a pressurizer SV open on the first cycle while Figure 4-9 is for a calculation (Rlz 266) that did not fail a pressurizer SV. Notice how much more hydrogen vented to containment (through the PRT) and migrated to the dome prior to the first burn in Realization 554 compared to Realization 266. The hydrogen venting behavior in Realization 554 produced a deflagration that ruptured containment

whereas the hydrogen venting behavior in Realization 266 did not. In Figure 4-9 , negative values for integral hydrogen flow (red curve) signifies reverse flow (i.e., flow is from the dome to the ice chest as flow patterns become more complicated after the hot leg failure

).45 45 Figure 4-9 shows integrated flowrate, and the ntegrated ice chest to containment dome flow becomes negative (i.e., from the dome to the ice chest) after the barrier seal fails. A natural circulation flow pattern is established where hot gases from lower containment flow up through the barrier seal failure opening and cool gases flow down through the failed

-open doors of the ice chest.

4-10 Figure 4-8 Rlz 554 Integral Hydrogen Flows and In-Vessel Hydrogen Production Figure 4-9 Rlz 266 Integral Hydrogen Flows and In

-Vessel Hydrogen Production

4-11 4.2 Summary of UA Results In the 600 total MELCOR UA calculations, 567 completed to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Of the completed calculations:

Four failed containment early on a sudden increase in pressure immediate to the first hydrogen deflagration, 492 failed containment between 36 hr and 72 hr after a gradual monotonic progression in pressure to rupture, and 71 did not fail containment by 72 hr

. o 65 of the calculations that did not fail containment by 72 hr had a BOC reactor core represented Additionally, in the 600 total MELCOR UA calculations, 85 had a pressurizer SV FTC. Of these:

36 had a fractionally open position of the failed valve greater than 0.3 (which is the necessary but not sufficient condition for early containment failure) o 13 of those failed to complete meaning that only 23 of the total 600 MELCOR UA calculations actually had potential to fail containment early o Two of the early containment failures cases were caused by hot gases issuing from the PRT, and the other two resulted from the hot leg failure.

There were very few early containment failures. When there was an early failure, the first hydrogen burn caused a sudden pressure increase that ruptured the steel containment vessel; subsequent burns do not challenge the containment integrity. In these cases hydrogen accumulation in containment, notably in the containment dome, was relatively pronounced at the time. The hydrogen accumulated as it was vented from the RCS through a stuck

-open pressurizer SV and the PRT ruptured disk during core degradation.

In most of the calculations the containment survived the first and any subsequent hydrogen deflagrations and resulted in late containment failure due to static overpressurization from accumulating steam and non

-condensable gases. Pressurizer SVs functioned per design in most of these calculations (i.e., there were infrequent FTC). Hydrogen accumulation in containment was most often relatively small at the time of the first deflagration, and subsequent deflagrations eventually were suppressed as the oxygen concentration fell below lower flammability limits due to depletion from previous burns. Fission product decay heat caused a gradual pressurization of the containment; vaporized ice melt (water) and non

-condensable gas generation through CCI.

Some calculations did not fail the containment by 72 hr. Containment survived all deflagrations in these calculations and pressurization proceeded slowly enough that 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months was an insufficient time for containment to rupture. Relatively low fission product decay power was the reason behind the slower pressurization. Containment heated slower, ice melt vaporized more slowly and non

-condensable gas generation proceeded at a lesser rate. The lower decay power was associated with BOC as opposed to a MOC or EOC.

4-12 For the Sequoyah UA, the overall success rate was about 95% (i.e., 567 successful simulations out of 600

), but the success rate in the sample space with potential for early containment failure was 64% (i.e., 23 completed to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months out of 36 simulations). These 36 simulations had a fractionally open position of the failed primary SV greater than 0.3 (a necessary but not sufficient condition for early containment failure), 13 simulations did not complete to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

46 However , 11 of these incomplete simulations ran beyond the first hydrogen deflagration

, and the amount and timing of the hydrogen produced in

-vessel was similar to the 23 completed simulations. The amount of hydrogen available prior to the first burn ultimately determines whether the containment fails early or late. None of these 11 simulations resulted in early containment failure.

An important consideration in performing the UA was to minimize influences that could detract from effects associated with sampled parameters. Accordingly, all calculations use the same time step limits and convergence criteria. Attempts to restart failed calculations would require adjusting these limits and/or criteria which could influence subsequent response and detract from effects associated with the sampled parameters. The concern of introducing unknown influences into restarted calculations was felt to outweigh the benefit of completing the failed calculations for the UA. Nevertheless, an attempt was made to restart the two simulations (out of the 13 simulations) that did not complete to the first deflagration. An adjustment was made to a single sensitivity coefficient to relax the convergence criteria for the code to ignore extremely small masses of debris. The restart of the two simulations resulted in an early containment failure in one of the two simulations. Figure 4-10 shows the amount of hydrogen produced in

-vessel by the time the first deflagration occurs for the 36 simulations that had the potential for early containment failure. It is evident that the trends for the complete and incomplete runs are similar. This is an important observation since the conclusions from the Sequoyah UA indicate that only the first hydrogen burn can result in early containment failure and none of the subsequent burns ha ve enough hydrogen to produce a burn to challenge the containment integrity. Figure 4-11 shows the excess peak containment pressure (above the containment fragility) following the first deflagration. Thus, an examination of the incomplete runs showed that the number of early containment failures is still very low.

Additionally, a SV focused study (Section 4.4.2) in the same sampling space with potential for early containment failure showed a similar success rate (61%).

However , in this focused SV study, the amount and timing of the hydrogen availability prior to the first burn was similar between the completed and incomplete simulations.

46 The cause of the incomplete simulations was traced to the formation of a very small volume of particulate debris calculated in a cell during a period of reflood.

The small heat capacity associated with this small mass results in unconverged temperatures calculated for the quenched and unquenched regions.

Such errors only occur as the quench front passes through a cell with a tiny component mass and only affects the calculated surface quench temperatures and does not affect the actual average component temperature (i.e., the state variable associated with the component energy).

The surface quench temperatures are used only in determining the rate of cooling of the component and has a minimal impact on the overall calculation due to the very small mass (near the discard mass) of the component. The heat capacity of the particulate debris is now monitored and the feedback from the calculated quench temperature is used to limit the temperature from the component.

4-13 Figure 4-10 Figure 4-11 4-14 Since early containment failure is an important metric in determining the environmental consequences of the accident scenario, the present results showed that the overall conclusions are not significantly affected by the code success rate within the small sample space of SV FTC with area fraction greater than 0.3. In fact, the uncertainties in SV behavior are expected to dominate the potential for early containment failure. The insights from this study were helpful to understand the phenomena important to hydrogen combustion as evidenced by the forensics analysis shown in Figure 4-1. 4.3 Analysis of Select Realizations Results of select realizations in the UA calculation set were investigated in detail to best identify phenomena driving the timing of containment rupture and the magnitudes of cesium releases to the environment. The criteria for selecting the realizations are presented in Table 4-1 along with the particular realizations found to satisfy them.

Of paramount importance to whether or not an early containment failure occurs is the amount of hydrogen that accumulates in the containment dome prior to the first deflagration (see Figure 4-12). Note in considering this result

, pressures develop in upper containment, as burns initiated in lower containment propagate, can be markedly higher than pressures developed in lower containment. In all the MELCOR calculations experiencing early containment failure, a combustion induced pressure spike developed in the containment dome that was significantly larger than what was developed in lower containment.

Table 4-1 Select realization criteria and identification Selection criterion Rlz The reference STSBO UA case 266 The case with earliest containment rupture 554 A case with containment remaining intact at 72 hr 307 A case with a FTC of a pressurizer SV on the first cycle 554 A case without a FTC of a pressurizer SV 307 The case with the least hydrogen vented to containment through the PRT 316 The case with the most hydrogen vented to containment through the PRT 370 The case with lowest in

-vessel hydrogen production 307 The case with highest in

-vessel hydrogen production 318 The case with the largest cesium release fraction to the environment 36 The case with the earliest RPV breach 432 The case with the latest RPV breach 328 A case without hot leg rupture 562 A case where hot gasses issuing from the PRT ignite the first hydrogen burn 370 One of the few cases that experienced early containment failure 395 Another case that experienced early containment failure 128 4-15 Figure 4-12 Hydrogen accumulation in the containment dome The sampled value of containment rupture pressure is an important uncertain factor as to whether or not the containment fails early. The containment pressured spiked high in many of the realizations in response to hydrogen deflagrations, but not high enough to reach the sampled containment rupture pressure.

Early ignition of hydrogen by hot gasses issuing from the PRT can preempt the accumulation of hydrogen in the containment dome such that a large deflagration, which otherwise would have failed containment, does not occur. There were realizations where such preemption occurred and there were realizations where hot gasses issuing from the PRT ignited a deflagration that ruptured containment.

Failure of the fabric seal and the failed area given a seal failure is a minor factor in determining whether or not containment fails early. This is because hydrogen burning in upper containment expands to all of containment a little more readily given a failed seal. This results in marginally lower pressures in upper containment.

The sampled value for hydrogen LFL was somewhat a factor in the MELCOR calculations with respect to whether or not containment failed early. This is presumably because lower values of LFL promoted earlier deflagrations where the hydrogen was burned before larger concentrations could accumulate that might otherwise have produced a failure.

If containment does not rupture from a deflagration early in a realization, hydrogen burns are never energetic enough to rupture the steel containment vessel as later burns are associated with smaller hydrogen concentrations. The burns consume oxygen, however, and this combined with ongoing vaporization of ice melt and non

-condensable gas generation from CCI reduces 4-16 oxygen concentration in containment to the point where it is insufficient to support further burning. Deflagrations cease but containment continues to pressurize as fission product decay heat incessantly drives vaporization of ice melt and non

-condensable gas generation. The pressurization is monotonic and most often pressurizes containment to rupture prior to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Notable exceptions to this are realizations having BOC representations of the Sequoyah reactor core. None of these realizations over pressurized containment by 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

A full discussion of the reference STSBO UA realization is first presented to form a basis for comparative discussions between select realizations. Realization 266 is the reference STSBO UA realization because its results are close to the population medians for fractional cesium environmental release (Figure 4-13), fractional iodine environmental release (Figure 4-14), in-vessel hydrogen production (Figure 4-15), and containment rupture time (Figure 4-16). In Figure 4-13 and Figure 4-14, the 5th percentile curves are below 1.0E

-5 and are not visible on the figures.

Figure 4-13 Horsetails of environmental cesium release

4-17 Figure 4-14 Horsetails of environmental iodine release Figure 4-15 Horsetails of in

-vessel hydrogen production

4-18 Figure 4-16 Horsetails of containment pressure response Reference STSBO Realization The reference STSBO UA calculation (Realization 266) exhibited median range in-vessel hydrogen production and cesium and iodine releases relative to the full set of UA calculations. The calculation had a fission product inventory representative of a middle

-of-cycle Sequoyah reactor core. No FTC of a pressurizer SV occurred. The triple

-loop hot leg ruptured. The first hydrogen deflagration occurred immediate to the hot leg rupture. The deflagration was relatively modest in severity posing no challenge to the steel containment vessel.

The containment gradually pressurized to failure due to ongoing vaporization of ice melt, non-condensable gas generation from CCI and steady heating of the containment atmosphere all resulting from continuous fission product decay heating. Figure 4-17 shows the RCS pressure. No FTC of a pressurizer SV occurred so the system remained pressurized until a rupture of the triple

-loop hot leg nozzle occurred.

Figure 4-18 shows reactor core water level as boiling and level loss occurs. The accumulators began injecting when the hot leg rupture occurred, resulting in a partial reflood of the core and leading to a second boildown phase

. In-vessel hydrogen production is shown in Figure 4-19 where the effect of the accumulator reflood on pausing hydrogen generation briefly can be seen.

Steam generator pressure and level are shown in Figure 4-20 and Figure 4-21 , respectively. No FTC of a steam generator SV occurred so the drying out of the steam generators occurred smoothly and so too did the depressurization of the steam generators as steam leaked passed the MSIVs once the steam generators were dry.

4-19 Figure 4-17 Reference calculation RCS pressure Figure 4-18 Reference calculation reactor core water level 4-20 Figure 4-19 Reference calculation in

-vessel hydrogen production Figure 4-20 Reference calculation steam generator pressure

4-21 Figure 4-21 Reference calculation steam generator water level Hydrogen concentration throughout containment and the integral energy released by burning are shown in Figure 4-22. In considering this figure

, realize that the sampled direction that a burn would need to propagate from the point of ignition in the reference realization was upwards, so a molar fraction of 0.04 or greater in lower containment was supportive of a burn.

Steam concentration throughout containment is shown in Figure 4-23. In considering this figure realize that steam molar fractions greater than ~0.55 prohibit burns from occurring. The rupture disk on the PRT broke slightly less than an hour into the calculation.

Oxygen concentration throughout containment is shown in Figure 4-24. Realize that a molar fraction of at least 0.05 is necessary for a burn to occur. Oxygen levels throughout containment became insufficient to support combustion at ~10.5 hr and remained so for the duration of the calculation.

Gas concentrations in the containment dome and the integral energy released by burning in the dome are shown in Figure 4-25. Evidenced in this figure is that there was only one burn in the dome. Containment burn energy and pressure are shown in Figure 4-26. Notice the monotonic increase in pressure that develops after burns end at ~10 hr. This is in response to ongoing vaporization of ice melt, non

-condensable gas generation from CCI and steady heating of the containment atmosphere all resulting from incessant fission product decay. Containment eventually over pressurizes to failure at ~58 hr.

4-22 Figure 4-22 Reference calculation containment hydrogen concentration and burn energy Figure 4-23 Reference calculation containment steam concentration and burn energy

4-23 Figure 4-24 Reference calculation containment oxygen concentration and burn energy Figure 4-25 Reference calculation containment dome gas concentrations and burn energy 4-24 Figure 4-26 Reference calculation containment burn energy and pressure Figure 4-27 shows the time history of core debris falling from the RPV to the containment floor. The containment temperature history is shown in Figure 4-28 where the large heat release from the CCI processes drive the cavity temperatures to exceed 2000K. The ice melt history is shown in Figure 4-29 where it can be seen that the ice beds are completely melted out by 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

. The containment temperature is controlled initially by the melting ice in the ice condenser, and a large mass of structure and concrete that act as a heat sink. During the later phase of accident progression after breach of reactor vessel, the concrete around reactor cavity start heating rapidly, resulting from CCI on the reactor cavity floor. The concrete wall and ceiling surrounding the reactor cavity can result in spalling at higher temperatures when CCI is in progress. However, the ceiling of the reactor cavity and the floors of lower containment are cooled by water draining from the ice condenser, a large mass of accumulating water, and the mass of concrete and support structures

, which continue s to act as a heat sink by slowly heating up. The upper containment and dome area remain s below the critical temperature of 400 F.

The containment leakage and rupture pressure is relatively insensitive up to 400 F (see Section 3.1.7). Shown in Figure 4-30 are gas partial pressures in the containment dome. Notice that while hydrogen, carbon monoxide and carbon dioxide produced from CCI each contribute to containment total pressure increase, steam generated from ice melt contributes most. Concrete ablation resulting from CCI is illustrated in Figure 4-31. Identified in this figure is that some 1.5 meters of concrete ablated by 72 hr and that ablation was continuing at th is time.

4-25 Figure 4-27 Reference calculation core debris to reactor cavity Figure 4-28 Reference calculation containment temperature

4-26 Figure 4-29 Reference calculation ice melt Figure 4-30 Reference calculation containment dome partial pressures

4-27 Figure 4-31 Reference calculation concrete ablation Pressurizer SV cycled 74 times as shown in Figure 4-32 with the valves left in a fully closed position at the time of hot leg failure (i.e., there was no FTC since the number of cycles was well below the sampled value of 110 cycles to failure for the first SV)

. The time history distribution of cesium and iodine throughout the RCS, containment

, and the amounts released to the environment are shown in Figure 4-33 and Figure 4-34, respectively. Most of the cesium and iodine are deposited stably in the RCS or containment by 12 hr as shown in Figure 4-33 and Figure 4-34. Very little is released to the environment.

Water level in the PRT and the depth of water on the containment floor are illustrated in Figure 4-35. The undulations seen around 3 hr are swells caused by pressurizer SV flows. The tank is partially submerged in the containment pool starting at 6 hr. As in other UA calculations, fission products vented through the pressurizer SVs as core damage proceeds are scrubbed in the tank's water pool. In many of the UA calculations, the heat generated by the fission products boiled away the pool leaving the products deposited along the bottom of the tank. The reference realization was not one of these calculations as most of the water initially in the tank remained 72 hr later and the scrubbed fission products remained dissolved/suspended in the pool.

Hot leg rupture came relatively early in this realization which limited fission product scrubbing in the PRT.

4-28 Figure 4-32 Reference calculation pressurizer aggregate SV cycles and open area fraction Figure 4-33 Reference calculation cesium distribution

4-29 Figure 4-34 Reference calculation iodine distribution Figure 4-35 Reference calculation PRT and containment water level

4-30 Temperatures in the PRT are shown in Figure 4-36. Atmospheric temperature and the inner and outer wall temperatures at the bottom of the tank are shown. With water always residing in the tank, temperatures don't escalate. In UA calculations where the PRT dried out, temperatures escalate but not to where volatilization of cesium and iodine compounds occur or damage to steel is threatened. Efficient condensate boiling on the bottom of the tank always remains the case.

Figure 4-36 Reference calculation PRT temperature Global Hydrogen Behavior in Select Realizations In these analyses, the in

-vessel hydrogen is generally on the order of 300 kg; the ex

-vessel hydrogen, which follows after lower head failure and initiation of CCI, is significantly larger as it continues to increase with the total hydrogen mass well above 1000 kg by 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The ex

-vessel CCI also generates very large amounts of carbon

-monoxide, which is also combustible. The most important factor to early containment failure is the release and distribution of the hydrogen generated in

-vessel prior to the first ignition source. The later burns after vessel failure are fueled by both in

-vessel and ex

-vessel hydrogen sources as well as carbon monoxide. If there is not a containment failure with the first burn, then smaller burns occur until the local oxygen concentration drops below 5% in the lower containment (i.e., the location of the ignition sources). This generally corresponds to a global oxygen of 2000 kg in the containment. The precise amount is dependent on the containment pressure, local temperatures, and uniformity of the oxygen throughout the containment.

This section highlights the global behavior of hydrogen in each of the case examples listed in Table 4-1. As will be seen in this and following sections, containment failure occurs either early 4-31 in rare cases due to a large hydrogen deflagration initiating in the lower compartments of the containment that propagate to the large dome volume, or more commonly, later in time due to slow over-pressurization caused by accumulating non

-condensable gases and steam. The following figures show the sources of generated hydrogen from the in

-vessel steam oxidation of Zr and steel core components and from the ex

-vessel CCI processes where steel rebar in the concrete (and any unoxidized metal in the debris) drives the hydrogen generation. Also shown is the accumulation of hydrogen in the containment dome, the quantity of hydrogen burned and the oxygen consumed globally. The hydrogen burns are further distinguished between those that take place in the dome and those that take place in the lower containment compartments.

The amount and melting of ice is important to mitigate the rise in temperature and pressure of containment during the accident initially, such as conditions during a design basis accident. However for the SBO scenario consider ed, initially the accident proceeds slowly due to steam release from pressurize r SVs. Yet during the accident progression, the ice is expected to melt in about 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and has little impact on early containment failure due to hydrogen deflagration which is influence d by hydrogen release and ignition sources. Delayed containment failure is influence by steam inerting the containment environment due to slow steaming, and a rise in inventory of CCI gases. For most cases of late containment failure, the rate of accumulation and the inventory of water from melted ice has little impact. Therefore investigating the uncertainty in heat transfer behavior of melting ice was not considered valuable.

The global hydrogen behavior for the reference case (Realization 266) is shown in Figure 4-37 through Figure 4-38. In the first figure, the total generated hydrogen from in

-vessel and ex

-vessel processes can be seen. The hydrogen burned and the oxygen consumed, also shown in the first figure illustrate the nature of the burn, either a sharp single burn, or a series of smaller, almost continuous burns. Figure 4-37 shows show that a burn initiates in the lower compartment at about 4.32 hours3.703704e-4 days 0.00889 hours 5.291005e-5 weeks 1.2176e-5 months that does not propagate to the dome region due to inadequate hydrogen. The early lower compartment burn only results in a small pressurization of the containment. Numerous small burns continue in the lower compartments gradually reducing the oxygen content. By 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , burns in the lower compartments have ceased until the ex

-vessel generated hydrogen commences. The ex

-vessel hydrogen source restarts the lower compartment burns, which steadily reduce the containment oxygen.

At 10.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , a small burn occurs in the dome region that further reduces the overall containment oxygen content, after which all burns cease globally. The resultant condition suppresses further burning because there is insufficient oxygen to support combustion. However, the hydrogen generation from CCI remains steady. The containment pressure increases gradually due to the accumulation of non-condensable gases and steam generation until the containment pressurizes above the failure pressure at 57 hours6.597222e-4 days 0.0158 hours 9.424603e-5 weeks 2.16885e-5 months . Notable from Figure 4-38 is that amount of hydrogen burned in the dome is <10 kg. As will be seen from subsequent figures, deflagrations that challenge the containment generally require greater than 150 kg of hydrogen burned in the dome.

4-32 Figure 4-37 Reference Case (Rlz 266): Source Hydrogen and Burn Behavior Figure 4-38 Reference Case (Rlz 266): Burn Location and Containment Pressure

4-33 Realization 5 54 is one of four cases where early containment failure was induced by a large burn initiating in the lower compartments and propagating to the dome. The hydrogen trends for this case are shown in Figure 4-39 and Figure 4-40. There is a large burn involving on the order of 200 kg of hydrogen in the dome and a little more than 100 kg in the lower compartments at 4.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months that fails the containment. This first large burn was not initiated until well after the in

-vessel hydrogen generation phase was complete, which may have been a factor in the magnitude of this burn that failed the containment. Additional burns do not occur until ex

-vessel hydrogen commences at about 8.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months with nearly continuous burns in the lower compartments and a few large burns in the dome. Notice from Figure 4-39 that the oxygen content of the containment recovers after the first burn due to air re

-entry into the containment through the failure location. After about 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , no further burns occur owing to diminishing oxygen levels in the containment.

Figure 4-39 Realization 554 Early Failure: Source Hydrogen and Burn Behavior 010002000300040005000600070008000900010000 0 100 200 300 400 500 600 700 800 9001000 0 3 6 9 12 15 18 21 24Oxygen Mass [kg]H2 Mass [kg]time [hr]In-Vessel H2Ex-Vessel H2H2 BurnedTotal H2 ProducedDome HydrogenOxygenRlz: 554 4-34 Figure 4-40 Realization 554 Early Failure: Burn Location and Containment Pressure Realization 307 is a case where the containment remains intact until after 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The hydrogen behavior for this case is shown in Figure 4-41 and Figure 4-42. The hydrogen builds up in the lower containment until the first burn at 7.47 hours5.439815e-4 days 0.0131 hours 7.771164e-5 weeks 1.78835e-5 months . Additional burns do not occur until ex-vessel hydrogen generation commences just before 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , where near continuous burns take place burning ex

-vessel hydrogen at essentially the rate it is produce d by CCI. Only one burn in the dome occurs at about 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months but does not threaten containment.

4-35 Figure 4-41 Realization 307 Late Failure: Source Hydrogen and Burn Behavior Figure 4-42 Realization 307 Late Failure: Burn Location and Containment Pressure

4-36 Realization 316 is a case with the lowest amount of hydrogen venting through the pressurizer relief tank. The hydrogen behavior for this case is shown in Figure 4-43 and Figure 4-44. Small burns occur in lower compartments in a continuous manner and hydrogen in the dome remains mostly well below 100 kg. No burns occurred in the containment dome. A significant fraction of the hydrogen generated from in

-vessel and ex

-vessel processes burns in this manner until the amount of oxygen can no longer support combustion at 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months . The hydrogen burns nearly continuously in the lower compartments and draws oxygen from the dome to the lower compartment through a recirculation pattern. The recirculation pattern prevents the accumulation of hydrogen in the dome while at the same time facilitating oxygen consumption in the lower compartments. The integral oxygen flows from lower to upper containment in Figure 4-45 illustrates the recirculation pattern. In this realization containment failure ultimately occurs after 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Realization 370 is a case with the greatest amount of hydrogen venting to containment via the pressure relief tank.

The hydrogen behavior for this case is shown in Figure 4-46 and Figure 4-47. The first burn is a large burn at about 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months in both the dome and in the lower compartments but not sufficient to rupture the containment. Following start of ex

-vessel hydrogen generation at about 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , continuous burns commence in the lower compartments and several additional burns occur in the dome. Containment failure occurs later just before 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months due to over

-pressurization.

Realization 318 is a case with the highest in

-vessel hydrogen production. The hydrogen behavior for this case is shown in Figure 4-48 and Figure 4-49. The burns initially start in lower compartments at 7.4 hrs with some small burns occurring in the dome after 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . After 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , ex-vessel hydrogen is burned at essentially the rate at which it is produced until about 14.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months when a single dome burn reduces the remaining oxygen such that further burns either in dome or lower compartment are precluded. In spite of high in

-vessel hydrogen generation, this case does not result in an early containment failure. The preemptive burning of hydrogen in the lower compartments precludes accumulation in the dome. Containment failure does not occur prior to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Realization 36 is the case with the highest Cs release fraction to the environment and is also a case that produced an early containment failure. The hydrogen behavior for this case is shown in Figure 4-50 and Figure 4-51. A large burn initiates in the lower compartment at 7.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and propagates to the upper compartment. 150 kg and 225 kg of hydrogen were burned in the lower and upper compartments, respectively. The resultant pressurization from the burn ruptured the containment. There are no more burns until after 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months when continuous burns start in the lower compartments and less frequent burns in the dome region. Since this case exhibited the largest Cs release fraction to the environment, it is interesting to see the airborne Cs for this case in Figure 4-52. This case showed significant airborne Cs at the time of containment rupture and a sustained airborne mass through 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months , which contributed to the large Cs release for this case.

4-37 Figure 4-43 Realization 316: Low H2 Prz Venting: Source Hydrogen and Burn Behavior Figure 4-44 Realization 316 Low H2 Pzr Venting: Burn Location & Containment Pressure

4-38 Figure 4-45 Realization 316 Integral Oxygen Flows from Upper to Lower Containment Figure 4-46 Realization 370: High H2 Prz Venting: Source Hydrogen and Burn Behavior

4-39 Figure 4-47 Realization 370 High H2 Pzr Venting: Burn Location & Containment Pressure Figure 4-48 Realization 318: High Total H2: Source Hydrogen and Burn Behavior

4-40 Figure 4-49 Realization 318 High Total H2: Burn Location & Containment Pressure Figure 4-50 Realization 36: High Cs Release: Source Hydrogen and Burn Behavior 1030507090110130150-500-250 0 250 500 750100012501500 0 12 24 36 48 60 72Pressure [psi]Mass [kg]time [hr]in vessel genex vessel genburned in domeburned outside domepressureRlz: 318 010002000300040005000600070008000900010000 0 100 200 300 400 500 600 700 800 9001000 0 6 12 18 24Oxygen Mass [kg]H2 Mass [kg]time [hr]In-Vesse H2Ex-Vessel H2Total H2 ProducedH2 BurnedDome HydrogenOxygenRlz: 036 4-41 Figure 4-51 Realization 36 High Cs Release: Burn Location & Containment Pressure Figure 4-52 Airborne CsI and Cs 2MoO 4 for Realization 36 4-42 Realization 432 is the case with the earliest RPV rupture timing. The hydrogen behavior for this case is shown in Figure 4-53 and Figure 4-54. A single large burn occurs in the dome and lower compartments at 5.3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months s following the vessel lower head failure that is potentially large enough to fail containment , but does not owing to a relatively high sampled containment failure pressure. After about 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , the ex-vessel generated hydrogen begins to burn fairly continuously until a small burn in the dome reduces the remaining hydrogen below a combustible amount.

Containment failure occurs due to static overpressure at about 80 psi at 59 hour6.828704e-4 days 0.0164 hours 9.755291e-5 weeks 2.24495e-5 months s. Figure 4-53 Realization 432: Early RPV Breach: Source Hydrogen and Burn Behavior

4-43 Figure 4-54 Realization 432: Early RPV Breach: Burn Location & Containment Pressure Realization 328 is a case with the latest RPV breach timing. The hydrogen behavior for this case is shown in Figure 4-55 and Figure 4-56. No burns occur until about 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months when a significant burn takes place both in the dome and in the lower compartments. The ex

-vessel hydrogen is burned relatively continuously until about 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months when oxygen decreases below a level to support further combustion.

Realization 562 is a case without any hot leg rupture. The hydrogen behavior for this case is shown in Figure 4-57 and Figure 4-58. The first burn is a large burn in the dome and in the lower compartments at 7.03 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . No additional burns occur until ex

-vessel hydrogen generation commences at about 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months s. Nearly continuous burning occurs in the lower compartment until the oxygen level decreases below the concentration to support further combustion at 13.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

Realization 395 is a case that experienced an early containment failure timing. The hydrogen behavior for this case is shown in Figure 4-59 and Figure 4-60. A single large burn that progresses from the lower compartment to the dome fails the containment at 7.75 hour8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months s. The burn consumed 208 kg burned in the dome and a little more than 100 kg in the lower compartment. This burn occurred more than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after in-vessel hydrogen generation was complete because of the lack of an ignition source in the containment. Consequently, there was sufficient time for the hydrogen to mix throughout the containment. A second large burn takes place at 10.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months in both the dome and in the lower compartments.

Very little of the combustible gas from CCI was burned due to the low oxygen concentration following the two large burns.

10 30 50 70 90110130150-500-250 0 250 500 750100012501500 0 12 24 36 48 60 72Pressure [psi]Mass [kg]time [hr]in vessel genex vessel genburned in domeburned outside domepressureRlz 432 4-44 Figure 4-55 Realization 328: Late RPV Breach: Source Hydrogen and Burn Behavior Figure 4-56 Realization 328: Late RPV Breach: Burn Location & Containment Pressure 10 30 50 70 90 110 130 150-500-250 0 250 500 750100012501500 0 12 24 36 48 60 72Pressure [psi]Mass [kg]time [hr]in vessel genex vessel genburned in domeburned outside domepressureRlz: 328 4-45 Figure 4-57 Realization 562 No HL Rupture: Source Hydrogen and Burn Behavior Figure 4-58 Realization 562 No HL Rupture: Burn Location & Containment Pressure 10 30 50 70 90110130150-500-250 0 250 500 750100012501500 0 12 24 36 48 60 72Pressure [psi]Mass [kg]time [hr]in vessel genex vessel genburned in domeburned outside domepressure 4-46 Figure 4-59 Realization 395: Early Cont Failure: Source Hydrogen and Burn Behavior Figure 4-60 Realization 395: Early Cont Failure: Burn Location & Containment Pressure 4-47 Finally, Realization 128 is another case that experienced early containment failure. The hydrogen behavior for this case is shown in Figure 4-61 a nd Figure 4-62. A large burn initiating in the lower compartments propagates to the dome producing a large containment over pressure that ruptures the containment at 4.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months consuming a large portion of the oxygen in the containment. There was almost 125 kg of hydrogen was involved in the initiating burn in the lower compartment. The lower compartment burn propagated to the dome where just under 24 5 kg of hydrogen was burned. The oxygen levels recover due to air ingress through the rupture but the hydrogen burns do not resume until start of the ex

-vessel hydrogen generation after 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The burns after the containment failure are confined to the lower compartments until after about 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months when successive burns take place additionally in the dome.

Figure 4-61 Realization 128 Early Cont. Failure: Source Hydrogen and Burn Behavior

4-48 Figure 4-62 Realization 128 Early Cont. Failure: Burn Location & Containment Pressure Some general findings from inspection of these realizations, which includes all early containment failure realizations are:

1. Greater than 375 kg of hydrogen needs to be generated in

-vessel of which at least 150 kg is transported to the upper containment before a burn initiated in the lower containment is propagated to the dome.

2. Early containment failures, which are rare in this study, always occur on a first burn which initiates in the lower compartments of the containment and propagates to the dome. Also common to these large burn cases (R554 and R128) that fail the containment is the fact that the burn initiation was delayed (for whatever reason) until the end of the in

-vessel hydrogen generation phase, thereby maximizing the total amount of hydrogen that might participate in a very large initial burn.

3. The burns consume oxygen, which when combined with ongoing vaporization of ice melt and non-condensable gas generation from CCI reduces oxygen concentration in containment to the point where it is insufficient to support further burning.

4. While ex-vessel hydrogen greatly exceeds the in

-vessel hydrogen, early containment failures are a result of the earlier in

-vessel generation. The absence of an ignition source until the first burn allows larger concentrations to develop on the first burn.

5. Hydrogen deflagrations resulting from the burning of ex

-vessel hydrogen tend to be small and sustained and consume hydrogen that might otherwise migrate to the upper dome.

4-49 6. These sustained lower compartment hydrogen burns also deplete the oxygen content of the dome and containment overall due to circulation between the dome and the lower compartments.

Section 4.3.3 presents a closer examination of the specific burn conditions in various containment volumes and compares and contrasts containment pressurization from otherwise similar sequences that differ in terms of factors such as valve seizure failures, fabric seal failure behavior and uncertainty in hydrogen flammability limits.

Comparative Discussions Paramount to the source term results of the UA are the containment rupture timings resulting in the MELCOR calculations. Figure 4-63 shows containment rupture time across the full set of realizations. There were four early (near the time of core damage) containment ruptures, and in this figure (and the next three figures) are colored red. Common to the occurrence of early ruptures was the amount of hydrogen produced in

-vessel by the oxidation of fuel cladding and steel and is seen in Figure 4-64. Another factor seems to be how much of the hydrogen produced in

-vessel subsequently vents to containment through the pressurizer SVs and out the PRT by the time of the first burn, and this dependence can be seen in Figure 4-65. Also apparently important is how much of the hydrogen which was vented to containment subsequently migrates to the containment dome by the time of the first burn

, as can be seen in Figure 4-66. Considering these figures, greater than 375 kg of hydrogen needs to be produced in-vessel, greater than 350 kg of this needs to vent to containment by the time of the first burn and more than 150 kg of hydrogen needs to migrate to the containment dome by the time of the first burn if an early rupture of the containment vessel is to occur. In no realization did a burn subsequent to the first burn result in containment rupture.

Figure 4-63 Containment rupture timing across the full set of UA realizations

4-50 Figure 4-64 In-vessel hydrogen production across the full set of UA realizations Figure 4-65 Hydrogen vented from the RCS to containment through the PRT by the time of the first burn across the full set of UA realizations

4-51 Figure 4-66 Hydrogen in the containment dome by the time of the first burn across the full set of UA realizations Table 4-2 presents the sampled values of uncertain parameters in the select realizations.

Table 4-3 presents key results from the realizations. Considering the hydrogen mass entries in Table 4-3 for Realization 554, the realization with the earliest containment rupture, enough hydrogen is produced in

-vessel, and, enough of this is vented to containment before an ignition source presents itself

, and finally, enough of this hydrogen migrates to the containment dome for the containment to rupture early from a first large burn. Considering the hydrogen

-related entries in Table 4-3 from realizations that didn't experience early containment rupture, the entries generally identify why. For example, Realization 318 did not vent enough hydrogen to containment prior to the first burn and Realization 370 did not have enough hydrogen accumulate in the containment dome before the first burn. There are two realizations with hydrogen-related Table 4-3 entries that do not explain why the realizations did not experience an early containment rupture. These are Realizations 432 and 562. Realization 432 had a strong pressurization of the containment dome commensurate with its relatively high hydrogen

-related entries, but not quite strong enough that the failure pressure sampled for the realization was reached (63.5 psig versus 66.8 psig for rupture pressure). Comparing Realizations 562 and 395 shows similar hydrogen

-related entries, but differing peak containment dome pressures. The energy release from hydrogen burning in the containment overall and in the containment dome alone are quite similar in these two realizations, as shown in Figure 4-67. The area of fabric seal that fails, however, is different (3.27 ft 2 versus 12.02 ft 2 in Realizations 395 and 562, respectively). Possibly the larger area in Realization 562 better relieves the hydrogen deflagration in the dome to the whole of containment resulting in a lower peak pressure in the dome. Note that pressures developed in upper containment, as burns initiated in lower containment propagate, can be markedly higher than pressures developed in lower containment. Such a difference occurs in Realization 395 as shown in Figure 4-68.

4-52 Table 4-2 Sampled values of uncertain parameters in select realizations Rlz Pressurizer SV cycles to FTC Pressurizer SV open area fraction given FTC Melting temper-ature of UO 2-ZrO 2 eutectic (K) Contain-ment rupture pres-sure (psig) H 2 LFL (%)1 Aerosol shape factor MSL SV cycles to FTC Oxidation model 2 Time in cycle Differential pressure that tears the fabric seal (psid)3 Fabric seal open area given tearing (ft 2) Fractional number of lower ice condenser doors jammed open SV-1 SV-2 SV-3 SV-1 SV-2 SV-3 36 37 73 136 0.93 0.96 0.06 2653.3 58.4 9.0 1.65 228277 UH MOC 38.25 10.89 0.75 266 110 27 691 0.03 0.02 0.98 2455.2 68.2 4.0 1.66 155 C-P/UH MOC 30.71 18.64 0.91 307 3369 145 543 0.93 0.45 0.94 2312.7 59.7 9.0 1.37 173 L-S/P-C BOC 19.28 3.27 0.94 316 65 49 56 0.01 0.11 0.95 2439.0 72.3 4.0 1.04 51 L-S/P-C BOC 24.38 20.38 0.89 318 6420 4233 287 0.29 0.03 0.97 2700.5 67.1 6.5 2.00 536 UH BOC 18.95 12.02 0.87 328 83 80 79 0.94 0.15 0.23 2350.7 65.6 4.0 2.07 124 UH BOC 43.84 18.64 0.55 370 64 624 46 0.94 0.06 0.03 2387.5 59.8 9.0 1.87 396 L-S/P-C EOC 20.77 18.64 0.53 395 36 1045 736 0.94 0.08 0.99 2546.1 64.4 9.0 1.37 9 C-P/UH EOC 54.06 3.27 0.71 432 35 613 474 0.64 0.08 1 2373.4 66.8 4.0 1.90 5 L-S/P-C EOC 28.29 18.64 0.57 554 1 68 68 0.77 0.07 0.96 2481.6 54.5 4.0 1.68 742 L-S/P-C EOC 51.84 3.27 0.77 562 39 204 173 0.92 0.01 0.2 2391.9 70.4 4.0 1.15 1 C-P/UH EOC 51.41 12.02 0.94 1 Where 4% is upward, 6

.5% is horizontal, and 9% is downward 2 Where L-S is Leistikov

-Schanz, P-C is Prater

-Courtright, UH is Urbanic and Heidrich, and C

-P is Cathcart

-Pawel. 3 Due to an input error, the differential pressures in the realization decks are a factor of ten lower than the values here. This is discussed further in Appendix E

.

4-53 Table 4-3 Select figures of merit for realizations of interest Rlz PRZR SV aggregate number of cycles PRZR SV ultimate combined open area fraction Time of RPV breach (hr) Time of 1 st burn (hr) Pressure developed in containment dome during 1st burn (psig) Time of containment rupture (hr)

In-vessel H 2 production (kg) H 2 vented to containment prior to 1 st burn (kg) H 2 in containment dome at the time of 1 st burn (kg) Fractional Iodine release by 72 hr Fractional Cesium release by 72 hr 36 37 0.93 8.79 7.37 65.6 7.38 416.48 401.55 237.65 0.107 0.036 266 74 No FTC 4.17 4.17 15.0 57.64 319.37 181.63 8.54 0.004 0.001 307 85 No FTC 6.33 7.47 5.2 > 72.00 224.62 87.99 19.22 0.000 0.000 316 75 0.01 5.88 6.89 3.5 > 72.00 447.16 52.16 20.77 0.000 0.000 318 84 No FTC 6.25 7.37 4.1 > 72.00 507.12 89.49 29.95 0.000 0.000 328 83 0.94 7.72 7.58 29.9 > 72.00 423.53 327.17 105.92 0.000 0.000 370 64 0.94 5.48 4.54 31.0 46.76 421.99 369.53 111.92 0.024 0.008 395 36 0.94 8.51 7.73 65.5 7.73 378.07 375.83 226.81 0.079 0.027 432 35 0.64 5.31 5.31 63.5 58.83 402.43 397.30 208.05 0.009 0.000 554 1 0.77 4.37 4.37 62.7 4.37 374.32 360.82 152.93 0.051 0.018 562 39 0.92 8.26 7.03 56.7 >72.00 391.57 378.03 216.39 0.000 0.000 4-54 Note that the containment vessel has been determined to be weakest where the cylindrical walls meet the dome and so rupture s of the vessel in the MELCOR calculations trigger on excessive pressure in upper containment as opposed to in lower containment

. Noteworthy with respect to Table 4-3 is that: "Time of 1 st burn" preceding "Time of RPV breach" is indicative of the first burn being ignited by hot gas issuing from the PRT

. "Time of first burn" following "Time of RPV breach" is indicative of conditions in lower containment not being supportive of a burn when the hot leg rupture occurred or the RPV lower head failed

whichever came first.

"H2 vented to containment prior to first burn" has contributions from:

o Hydrogen vented from the RCS to containment through the SVs to the PRT

, and out the PRT through a broken rupture disk, o Hydrogen leaking past the RCP seals, and o Hydrogen vented through a hot leg rupture.

Figure 4-67 Realization 562 versus Realization 395 burn energy and containment dome pressure 4-55 Figure 4-68 Pressure difference between upper and lower containment during the first burn in Realization 395 The uncertain parameter with the largest influence on how much hydrogen vents from the RCS to containment by the time of the first burn is the number of cycles to the failure of a pressurizer SV to reclose. Comparing Figure 4-69 and Figure 4-70 illustrates the strength of the influence. These figures show an accounting of hydrogen in Realizations 316 and 370. Realization 316, Figure 4-69, effectively experienced no FTC of a pressurizer SV

47. Realization 370, Figure 4-70 , experienced a FTC of the first pressurizer SV on its 64 th cycle. In Realization 316, most of the hydrogen produced in

-vessel was vented to containment after hot leg breach and after the first burn over the course of 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . Little hydrogen migrated to the containment dome by the time of the first burn. Contrast this with most of the hydrogen produced in

-vessel being vented to containment through the PRT before hot leg breach and prior to the first burn over the course of 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , in Realization 370, and considerable hydrogen migrating to the containment dome by the time of the first burn. Figure 4-71 and Figure 4-72 show key integral hydrogen flows in Realizations 316 and 370, respectively. Important in these figures is the earlier hot leg rupture shown for Realization 316 relative to the onset of fuel cladding oxidation. The rupture interrupted oxidation by spurring the accumulators to inject. The rupture came earlier because of system pressure remaining high as the pressurizer SVs functioned per design. Contrastingly in Realization 370, a pressurizer SV FTC depressurized the system delaying hot leg failure.

47 The calculation actually experienced a FTC of the first SV but at a small open fraction such that the second SV started cycling.

4-56 Figure 4-69 Hydrogen accounting in Realization 316 where no FTC of a pressurizer SV occurred and hot PRT gases ignited the first burn Figure 4-70 Hydrogen accounting in Realization 370 where a FTC of a pressurizer SV occurred and hot PRT gases ignited the first burn

4-57 Figure 4-71 Realization 316 integral hydrogen flows and i n-vessel hydrogen production Figure 4-72 Realization 370 integral hydrogen flows and in-vessel hydrogen production 4-58 Consideration of Realization 370 relative to Realization 395 exemplifies the importance of hydrogen distribution within containment with respect to whether containment rupture occurs early or late.

These two realizations exhibit very nearly the same total amount of hydrogen vented to containment by the time of the first burn, but quite differing amounts of hydrogen in the dome at that time. Figure 4-73 shows the variations in burn energy and pressures that develop between the realizations. Realization 395 with more hydrogen in the dome sees a rupture of the containment vessel at the first burn while Realization 370 does not.

Figure 4-73 Realization 370 and Realization 395 burn energy and containment dome pressure Realization 307 additionally exemplifies the importance of a pressurizer SV failing to close or not. An FTC did not occur in this realization. Characteristically, relatively little hydrogen vented to containment by the time of the first burn and so an early containment failure did not materialize. Realization 307 is a UA case with relatively low fission product decay heat reflective of a BOC state for the Sequoyah reactor core. As a result, given that a deflagration didn't fail containment early, the containment pressurized relatively slowly over the three days of the calculation (because of muted CCI), never over pressurizing the steel containment vessel to failure. Such slow pressurization was the case in all 69 of the UA realizations reflective of a BOC core state. Realization 307 had the least in

-vessel hydrogen of all the UA realizations. A relatively low sampled temperature for fuel collapse likely contributed much to this as lower collapse temperatures relate to fuel rods standing and oxidizing rapidly for less time.

Considerable differences exist in the UA calculations between the timing of the first burn relative to the timing of RPV breach. These differences can be seen in the set of select realizations 4-59 which include cases where the first burn preceded RPV breach, where it occurred immediate to breach, and where it came after the breach. Situations where a hot leg ruptured occurred and where one did not occur are represented in the select realizations. The factors that determine this relative timing of the first burn are illustrated in Figure 4-74 , Figure 4-75, and Figure 4-76 showing concentrations of combustible gasses (hydrogen and carbon monoxide), diluents (e.g. steam) and oxygen relative to concentrations supportive of a burn for Realizations 370, 554 and 316, respectively. Conditions in Figure 4-74 , Figure 4-75, and Figure 4-76 are supportive of a burn when all of traces are solid and not supportive of a burn when any trace is dashed. In Realizations 370, 554 and 316, the first burn occurred ~1 hr before hot leg rupture, immediately upon hot leg rupture, and ~1 hour after hot leg rupture, respectively. Figure 4-74 identifies that hot gasses issuing from the PRT ignited a burn prior to hot leg rupture in Realization 370. Figure 4-75 shows that lower containment was primed with enough hydrogen for a burn to ignite in Realization 554 when a hot leg ruptured; the hot leg rupture actually ignited a burn in the reactor cavity. It can be seen in Figure 4-76 that insufficient hydrogen existed in lower containment at the time of hot leg rupture in Realization 316 for a burn to ignite.

Figure 4-74 Realization 370 lower containment (CV

-8) conditions with respect to a burn starting within it; as opposed to propagating to it

4-60 Figure 4-75 Realization 554 reactor cavity (CV

-1) conditions with respect to a burn starting within it; as opposed to propagating to it Figure 4-76 Realization 316 lower containment (CV

-9) conditions with respect to a burn starting within it; as opposed to propagating to it

4-61 It is interesting to note that the behavior of the lower ice compartment doors in these three contrasting realizations (Rlz 370, 554, and 316) show many similarities (see Figure 4-74 , Figure 4-75, and Figure 4-76). In particular, the doors initially opened in response to the PRT rupture disk bursting. In Realization 554, which experienced a stuck-open pressurizer SV on the first cycle, the lower ice compartment doors remain ed partially ajar while gases from the primary system flow ed out the PRT into containment. The high energy discharge from the early valve failure in this realization contributed to the earliest bursting of the PRT rupture disk. In Realizations 370 and 316, the lower doors cycled partially open in response to the pressurizer SV cycling following the PRT rupture disk bursting. The partial openings of the lower ice compartment doors vented gases from lower containment into the ice chest. Although Realization 370 ha d its first deflagration 4.54 hr prior to hot leg failure at 5.48 hr, the doors remain ed function al. The final important event in all three realizations was hot leg failure, which slam m ed the lower doors fully open and activate d the AJAR door deformation uncertainty modeling. Thereafter the doors remain ed stuck open according to the specified AJAR uncertainty variable (0.53, 0.77, and 0.87 in Rlzs 370, 554 and 316, respectively).

Of interest is the behavior of the lower ice compartment doors for these three contrasting realizations show many similarities but also some key differences as shown in Figure 4-77. Initially, the lower ice compartment doors in all three realizations (Rlz 370, 554, and 316) are partially open to model leakage as described in Section 3.1.6. The doors subsequently opened further in response to the PRT rupture disk opening. In Realization 554, which included a stuck-open pressurizer SV on the first cycle, the lower ice compartment doors remain partially open while the gases from the primary system flow through the PRT and into the containment. The high energy discharge from the early valve failure in Realization 554 also contributed to the earliest opening of the PRT rupture disk. In Realizations 370 and 316, the lower doors cycled partially open in response to the pressurizer SV cycling following the PRT rupture disk opening.

The partial openings of the lower ice compartment doors vented gases from the lower containment into ice chest.

Similar to Realization 554, a SV sticks open in Realization 370 at 3.7 hr that keeps the doors continuously open. Although Realization 370 has its first deflagration (4.54 hr) and prior to hot leg failure (5.48 hr), the doors remain functioning. The final important event in all three realizations is the hot leg failure, which slams the lower doors fully open and activates the AJAR door deformation uncertainty model. Thereafter the doors remain stuck open according to the specified AJAR uncertainty variable (0.53, 0.77, and 0.87, respectively).

AJAR was found to have a relatively low importance in the UA realizations because the doors function normally until hot leg failure (i.e., the most likely timing for the first deflagration). It is noted that the magnitude of AJAR has a small impact in simulations with attributes for early containment failure, where the magnitude of the AJAR open fraction when being pressurized from the dome can slightly affect the resultant peak pressure (i.e., similar to the impact of the seal barrier at the first large deflagration; see Section 4.4.2 for further discussion).

4-62 Figure 4-77 Comparison of lower ice compartment door behavior in Realizations 370, 554, and 316 The burn ignited by hot gasses issuing from the PRT in Realization 370 is very noteworthy because it preempted a steady accumulation of hydrogen in the containment dome. Without the interruption, the calculation may well hav e resulted in early containment failure. The interruption can be seen in Figure 4-70 which clearly contrasts Figure 4-69 for Realization 554 which did not experience such a preemptive burn. Note that first burn ignition by hot PRT gases did not generally keep early containment failures from occurring in the UA calculations. The first burns in select realizations, e.g., Realizations 36 and 395, were ignited by hot gasses issuing from the PRT but resulted in early containment failures.

Close examination of the potential ignition sources in Rlz 395 shows the impact of the PRT as an ignition source. The PRT rupture disk opens just after 2 hr but the exiting gas temperature is well below the ignition temperature of hydrogen (see Figure 4-79). Due to the early depressurization by stuck

-open pressurizer SV (0.94 area fraction after 36 cycles) prior to core damage and subsequent successive accumulator injections after primary system depressurization, the thermal

-mechanical creep at the hot leg nozzle remained below the failure criteria. Consequently, Rlz 395 did not experience a hot leg failure. As core degradation progressed towards vessel failure, the core plate failed and hot debris relocated into the lower plenum at 7.5 hr, which pressurized the primary system. The hot gases around the core debris are subsequently discharged to the PRT through the open stuck

-open pressurizer SV and into the containment through the open rupture disk. The remaining saturated water in the PRT does little cooling of the hot gases from the primary system and >1000 K gas was expelled to containment. The temperature of the gas flowing from the PRT exceeded the ignition temperature of hydrogen and the gas ignited a burn that propagated to the dome resulting in an early containment failure.

0.00.10.20.30.40.50.60.70.80.91.0 0 3 6 912CFs For AJARTime (hr)Rlz 370Rlz 554Rlz 316PRT rupture disk opensDoors fully open at the hot leg creeprupture failure and stick open per AJARConstant flow from stuck-open SV 4-63 Figure 4-78 Hydrogen accounting in Realization 554 where no FTC of a pressurizer SV occurred and the first burn occurred immediate to hot leg rupture Figure 4-79 Potential Ignition Sources in Realization 395 300400500600700800900100011001200 0 3 6 912Temperature (K)Time (hr)Auto-ignition SourcesAuto IgnitionSingle Loop RCP sealTriple Loop RCP sealPRT gasHL (Not Calculated) 4-64 Rlz 395 is representative of a very late failure of the RCS without hot leg failure. The PRT ignition source did not mitigate the resulting pressurization like Rlz 370. As seen in comparing the results of Realizations 370 and 395, the timing of hot gases exiting the PRT is variable due to uncertain factors affecting primary system gas flows to the PRT such as the degree of core damage as well as the conditions in the PRT (i.e., water depth and temperature). The next ignition source in Rlz 395 would be vessel lower head failure shortly after the debris relocation after the core plate failure at 7.5 hr, which likely would have had the same impact (i.e., a large burn leading to containment failure) but slightly delayed.

Even with the late timing of the vessel failure, the lower containment water level was still below the bottom of the PRT at the very late first ignition in Rlz 395 (see Figure 4-80). Consequently, the important role of the PRT ignition occurred prior to any potential cooling effects from the containment water.

48 However, any potential benefit of the lower containment water becomes negligible in realizations where radionuclide decay heat inside of the PRT evaporates all the water. As the PRT water level decreases due to evaporation, there is less cooling of the gases entering the PRT. Furthermore, following vessel lower head failure or hot leg failure, no more gases enter the PRT from the primary system. To summarize the potential for PRT ignition consider the following:

1. The magnitude of the decay heat of the radionuclides in the PRT, 2. The evaporation rate of the water in the PRT, 3. The timing, temperature, and flowrate of the gases to the PRT, 4. The timing of a hot leg (if any) or vessel failure, and

5. The cooling by the lower containment water factor into temperature of the gas exiting the PRT. The results of Rlz 395 suggest the gases exiting the PRT will decrease below the auto

-ignition temperature within hours after the lower containment pool rising above the bottom of the PRT. For a more complete discussion on ignition uncertainties, see Appendix D.4. The sampled value for hydrogen LFL was somewhat a factor in the MELCOR calculations with respect to whether or not containment failed early. This is presumably because lower values of LFL promoted earlier deflagrations where less time elapsed during which hydrogen concentrations in containment could build. Hydrogen concentrations in the containment dome at the time of the first burn were generally much lower for LFL of 4%, as can be observed by the much higher density of dots below 50kg for 4% vs. 6.5% or 9% LFL in Figure 4-81. However, in terms of the handful of extreme cases of 150 kg reaching the containment dome by the time of the first burn, the number of samples with LFL of 4% is slightly lower, but similar, to the number of samples with LFL of 6

.5% or 9%.

48 The results from Rlz 395 are typical of a very late ignition case without hot leg failure showing temperatures above the ignition temperature of hydrogen after the water level reached the bottom of the PRT (see Figure 4-79).

4-65 Figure 4-80 Lower containment water level in the in Realization 395 Figure 4-81 Hydrogen in the Containment Dome at First Burn Across the Full Set of UA Calculations 0.00.51.01.52.02.53.0 0 3 6 912Elevation (m)Time (hr)Lower Containment Pool LevelBottom of the PRTWater Level 4-66 If containment did not rupture early in a realization, hydrogen burns were never energetic enough to rupture the steel containment vessel. The burns consume oxygen, and at some point oxygen concentrations become insufficient to support further burning. This was the case in the reference realization after ~10.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months as discussed with respect to Figure 4-24. Deflagrations cease but the containment continues to pressurize as fission product decay heat drivi ng vaporization of ice melt water and by non-condensable gas generation through CCI. The decay heat also generally heats the containment atmosphere and the containment as a whole. The pressurization is monotonic and most often over pressurized containment to rupture prior to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months in the UA calculations.

Realization 328 had the latest RPV breach of all the UA realizations. Realization 432 had the earliest. The breach was a hot leg rupture in both realizations as opposed to a gross failure of the RPV lower head. Contrasting the course of these calculations, the lowest set

-point pressurizer SV simply failed earlier in Realization 432 venting RCS inventory to the containment to a greater extent. Consequently, core damage began earlier in this realization and hot leg failure was reached sooner.

Early containment rupture explains most of the larger cesium releases in the UA calculations. Realization 36 had the largest cesium release. Comparing the time history of cesium migration in this realization to that in the reference realization shows that there remained significant transportable cesium in the RCS and PRT when containment ruptured early at 7.38 hours4.398148e-4 days 0.0106 hours 6.283069e-5 weeks 1.4459e-5 months in Realization 36, while there did not when containment ruptured much later at 57.64 hours7.407407e-4 days 0.0178 hours 1.058201e-4 weeks 2.4352e-5 months in the reference calculation. Some of the transportable cesium in Realization 36 migrated through containment and out the breach in the containment vessel. Figure 4-82 and Figure 4-33 show the cesium migrations in Realizations 36 and 266, respectively.

Figure 4-82 Realization 36 cesium distribution.

4-67 4.4 STSBO Source Term Parameter Uncertainty Analysis A sample set of 600 realizations was analyzed for the STSBO scenario.

The STSBO UA considered no random ignition sources for all scenarios, and included three active ignition sources; (1) ignition from hot gases exiting the hot leg failure location, (2) ignition from hot gases exiting the PRT, and (3) the ex

-vessel debris following the reactor pressure vessel melt

-through. These active ignition sources would initiate a burn in the lower containment whenever the gas concentrations met combustible criteria.

An uncertainty analysis was conducted using the four regression techniques described in Appendix A. Additional insights as to the strength of the influence of parameter uncertainty variation in output of consideration are estimated using two additional summary variables:

The Main Contribution represents the influence of the uncertain input by itself and is estimated with in the stepwise regression and for the other three regression techniques, and The Conjoint Contribution effect of the uncertain input from its interaction with other variables, which is ignored by the stepwise regression as it is an additive regression, is estimated with for the other three regressions.

Section A.5 of Appendix A provides a detailed discussion of the ranking method employed. A quantitative ranking is only an indicator and should be supported by expert opinion based on the physics of the problem.

Uncertainty Evaluations Regression analyses were performed on the results of the Sequoyah MELCOR STSBO UA. Note that the uncertain parameters of pressurizer and MSL SV open area fraction (given FTC) were not included in the regressions. This is because open area fraction is only relevant given that a valve fails to close and because the influence of open fraction is generally captured by the aggregate valve cycles occurring in a MELCOR calculation which was included. If the open fraction of a valve given FTC is small, cycling moves up to the next valve and the effect of open fraction is captured by aggregate cycles. If open fraction is greater than some threshold value (~0.3), the system depressurizes, all valve cycling ends and again the effect of open fraction is captured by aggregate cycles.

Aggregate SV cycles occurring in the MELCOR calculations was included in the regressions in lieu of the sampled values of cycles to FTC for individual valves. This was done because it is the involvement of parallel valves as a system that is important to pressure response rather than the specific involvement of any particular valve.

Regression tables, se e Table 4-4 as an example, in the following sections provide summaries of the analysis.

In these tables, the parameters are listed first, followed by t he determinations from the four regression technique s used to create the results. The last two columns contain values of the main (individual, independent) contribution of the parameter on the result metric and the conjoint influence 49 of the parameter on the result metric. These are calculated as weighted averages of the overall contributions from the four regression techniques. Values of main contribution greater than 0.02 and conjoint contributions greater than 0.1 are considered

49 Conjoint influence is the influence of two or more input parameters acting together, which may have synergistic effects that would not be uncovered by studying the influence of each parameter separately and individually.

4-68 significant and are highlighted in yellow. The parameters in the first column of the tables are ordered by the values in the column labeled Main Contribution, thus the parameters appear in rank order.

Table 4-4 Regression table examp le For two of the input parameters

, it was more desirable to include a post-calculated parameter in the regression calculations that more meaningfully capture the translation of the sampled input to reactor system behavior. These two parameters were post

-calculated (see Table 4-5) for use in regressions, based on both the sampled input and actual behavior.

Table 4-5 Post-calculated regression parameters

Parameter Name Description Notes 1 priSVcycles Cycles actually experienced by the safety relief valve system Calculated as the sum of the cycles experienced by any of the valves that cycled, until they stopped cycling due to failure to close or because the system depressurized 2 secSVcycles Cycles actually experienced by the steam generator valve system Calculated as the sum of the cycles experienced by any of the valves that cycled, until they stopped cycling due to failure to close or because the system depressurized A high performance computing cluster was used to execute a Monte Carlo simulation with 600 MELCOR realizations, of which 567 were successful.

The 33 realizations that failed to complete were evaluated and grouped by failure type listed in Table 4-6. When failed sample sets yield MELCOR code errors, they are passed onto the MELCOR code development team for prioritization and correction in the next MELCOR code release. However, many realization failures are due to sample sets that require user interaction to adjust timesteps for assistance in code convergence to a solution. For such a large sample set (600 realizations), user intervention is not tractable.

4-69 Table 4-6 Summary of the number of realizations that were unsuccessful STSBO UA

Faile d Reason 2 Error in Subroutine CORMV2 29 Executive abort signal 1 Argument in M_Table.f90 1 Error in CONCNV An analysis was also completed to determine whether there is a correlation between failed runs and having the realization set in a particular area of the input space; see Section A.6 of Appendix A for further discussion. Such a situation would indicate that a particular value for one input (or combination of values for several inputs) would lead to failure, biasing the conclusion s that could be drawn by only analyzing the successful realizations

. The analysis indicated an increased likelihood of failure for realizations based on the value of the aggregate open area fraction of any primary SVs that failed to close (priSVfrac), largely due to conjoint influence. The regressions showing this relationship (Table A

-1) were weak, preventing a definitive conclusion regarding bias. The priSVfrac together with priSVcycles is known to strongly influence whether early containment failure is possible (see Figure 4-17 in the 2015 draft Sequoyah SOARCA report [122]). A further inspection of the small 2

-D sample space for priSVfrac and priSVcycles in which early containment failure is possible (priSVfrac > 0.35 and priSVcycles <

70) revealed a lower success rate in MELCOR realization completion (~6 4%) compared to the overall success rate (~95%). Hence the 2-parameter sample space of interest to potential early containment failure was further investigated in the form of a focused SV study discussed in Section 4.4.2. Cesium Release Fraction to Environment The cesium class is of first

-order importance for consequences and long

-term health effects. Emphasis is placed on determining which uncertain parameters drive higher releases, including identification of joint influences amongst several parameters. The environmental release fractions presented here reflect the cesium class mass released to the environment from all cesium-containing species (i.e., CsOH, CsI, and Cs 2MoO 4), where the released mass is normalized to the initial core inventory of all cesium class mass; see Appendix B for radionuclide information.

The following insights were identified by the regression and verified by examining associated scatterplots:

Environmental release fraction s increase for realizations where the primary SVs fail before 38 cycles corresponds to realizations that have the potential to exhibit early hydrogen induced containment failure, Environmental release fractions increase as time in cycle at shutdown increases, varying from 'nearly zero' for BOC realizations and then increasing in magnitude and decreasing in timing between MOC and EOC conditions. The difference is more pronounced between BOC and MOC realizations, but still evident between MOC and EOC realizations.

4-70 4.4.1.1.1 Cesium Release Figure 4-83 shows the release fractions for the successful realizations, as well as the 95 th percentiles.

The 5 th percentile curves are below 1.0E

-5 and are not visible on the figure. The calculated 5 th and 9 5 th percentiles are for all successful realizations (i.e., BOC, MOC, and EOC). BOC realizations exhibit 'near

-zero' releases, mostly due to its lower decay heat, as evident by the left inset picture in Figure 4-83. For comparison, the release fraction for Realization 266 (an MOC case) is depicted on each inset picture. Recall from Section 4.3.1, Realization 266 is the reference STSBO UA realization selected because its results are close to the population medians for fractional cesium environmental release, fractional iodine environmental release, in

-vessel hydrogen production, and containment rupture time

. Figure 4-83 Cesium release fractions for BOC (left), MOC (center), and EOC (right

) The cesium releases are strongly demarked by release timing. A few MOC and EOC realizations (two of each) produce early and relatively large releases. These cases have cesium release fractions of 0.01

-0.03 by 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months . The majority of MOC and EOC releases occur after 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months . These release fractions range from 1.0E

-5 to about 0.03. Early cesium releases are the result of sudden containment rupture following a hydrogen burn, whereas the late releases are due to gradual containment over

-pressurization. Containment partial pressures are generally dominated by steam, but ex

-vessel non

-condensable gases (H 2 and CO) generated after RPV lower head failure also contribute to the long

-term containment pressurization.

Long-term containment pressure response is a function of steam and non

-condensable gas generation, in addition to heating of the containment atmosphere. Energy sources including decay heat and chemical reaction energy (both in

-vessel and ex

-vessel). The EOC decay heat is slightly greater that the MOC decay heat and enhances the long

-term pressurization of the containment. Therefore, many EOC cases start releasing cesium about 5

-10 hours earlier than the MOC cases. The MOC and EOC environmental release fractions are relatively similar. While an overwhelming majority of MOC and EOC experienced containment failure, six MOC and three EOC realizations did not fail containment within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , and thus exhibit release behaviors consistent with BOC cases. As can be seen in Figure 4-83, a higher percentage of the EOC realizations have release fractions greater than the 95 th percentile and a much smaller percentage of EOC realizations have release fractions lower than Rlz 266 compared to the population of MOC realizations. There were 15 MOC realizations out of 284 and 15 EOC realizations out of 218 with release fractions greater than the 95 th percentile. This is partially 4-71 attributable to the higher decay heat among EOC realizations. However, the MOC calculations yield a few more cases with relatively large late-phase releases (0.01

-0.03), which may reflect the influences of the other uncertain parameters or the higher overall number of MOC realizations (284 successful realizations versus 218 successful EOC realizations). For example, the relatively low number of BOC samples results in only three BOC simulations that result in primary SV depressurization below 38 cycles where larger and earlier releases are expected. These influences are examined later in this section.

The BOC realizations produce zero releases primarily due to lower decay heat. As discussed in Section 3.1.1.2, the decay heat for BOC is 15

-40% lower than the MOC and EOC curves depending on the decay time, and the resulting containment pressure response for BOC is considerably different. As shown by Figure 4-84, the BOC realizations have a markedly slower containment pressurization. This divergence in containment pressure greatly minimizes radionuclide releases. There are several pressure peaks in the BOC pressure curves that denote hydrogen burns (similar to the MOC and EOC pressure traces); two of the 65 BOC realizations can be seen in Figure 4

-65 to have had early pressure peaks that exceeded the lower bound of the containment rupture pressure distribution (which ranged from 5 2 to 7 4 psi g), but these peaks did not reach the containment rupture pressure sampled in their respective realizations. 13 other MOC and EOC realizations had early pressure peaks that exceeded the lower bound of the containment rupture pressure distribution, of which four exceed the containment rupture pressure sampled in their respective realizations. The lower containment pressurization rate for BOC precludes long

-term containment rupture before 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . That said, the BOC realizations would have eventually ruptured containment if the simulations were extended well beyond 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; about 160 hours0.00185 days 0.0444 hours 2.645503e-4 weeks 6.088e-5 months if the containment pressurization rate for the BOC realizations remains the same.

Figure 4-84 Containment pressure colored by BOC, MOC, and EOC Figure 4-85 shows the cesium release fraction CDF for all successful realizations. The CDF is presented at several discrete times into the simulation. For instance, the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months curve represents the environmental release fractions at 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months into the simulation, and it indicates that about 85% of the realizations still have very small or near

-zero cesium releases at that time while the remaining 15% exhibit release fractions ranging from 1.0E

-4 to 1.0E-2. The CDF 4-72 curves for earlier simulation times (42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months and earlier) start with 1.0 probability and remains flat, which reflects that very few realizations have significant releases before 42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months . The constant probability for very low release fractions (less than 1.0E

-4) in the CDF curves after 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is the result of many realizations having essentially zero releases. After 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , about 13% of realizations

- many of which are the BOC cases

- exhibit no significant releases. The final CDF also reveals that over 95% of realizations have a release fraction less than 2.0E-3, and the maximum releases are near 0.03 for a few realizations.

Figure 4-85 CDF for the Cesium environmental release fraction 4.4.1.1.2 Regression Tables, Recursive Partitioning Trees, and Scatterplots Table 4-7 shows results for the regression analysis of the cesium environmental release fraction. It suggests that the number of primary SV cycles (priSVcycles) is the dominant parameter for all regression techniques. The number of primary SV cycles reflects the aggregate actual number of cycles performed by the three pressurizer SVs in the MELCOR calculations; determined using the sampled cycles to failure and primary pressure. The pressurizer SVs cycle one at a time due to different pressure setpoints. If the valve with lowest setpoint fails closed or with sufficiently small flow area, the next valve (with second

-lowest setpoint) may start cycling. Cycling of the pressurizer SVs terminates once the primary RCS depressurizes, which may be the consequence of a valve sticking open with sufficient area, creep rupture of an RCS component (e.g. hot leg piping), or after all three valves have failed due to excessive cycling. Recall that the number of cycles is included in the regressions but the open area fraction is not due to the large number of realizations in which open area fraction does not apply. The parameter for aggregate cycles has relatively strong individual and joint contributions to the overall variation in the cesium environmental release fraction. The other top 4-73 parameters are the time in cycle of reactor shutdown (Cycle), the rupture pressure of the containment (Rupture), and the effective liquefaction temperature of the UO 2-ZrO 2 system (Eu_Melt_T). The following discussion focuses on priSVcycles and the time in cycle of shutdown, since these parameters have combined contributions greater than 0.02, which is denoted by the yellow highlighting in the 'Main Contribution' column. The significant conjoint influence of Eu_Melt_T, particularly for the recursive partitioning technique, will also be discussed. Table 4-7 Regression analysis summary of cesium environmental release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months To explore these forecasts in more detail, the recursive partitioning tree (Appendix A) and scatterplots of the following parameters vs.

cesium environmental release fraction will be analyzed: The number of primary SV cycles, coded by time of shutdown (Figure 4-87), Time in cycle of shutdown (Figure 4-88), Time of containment rupture (Figure 4-89), and The number of primary SV cycles vs. effective liquefaction temperature of the UO 2-ZrO 2 system, coded by cesium release reaction (Figure 4-90). Figure 4-86 shows the tree generated by the recursive partitioning analysis of cesium environmental release fraction. Recursive partitioning is a decision tree algorithm, and the tree illustrates the detailed relationships between the parameters and the regressed variable. In particular, it allows for the specific identification of conjoint influences, which are more ambiguous to decipher in tabular form. In Figure 4-86, parameters are arranged in order of importance. The upper parameters in the tree (such as priSVcycles and Cycle) are more important indicators of overall variance. The lowest bifurcations in the tree denote parameters of lesser importance, and require much more scrutability in order to assess their significance. Overfitting of data generally increases further down into the recursive partitioning tree.

Each box (i.e. "node") in Figure 4-86 lists the average release fraction and the number of realizations (and the relative percentage of realizations) for the cohort of realizations that fall under its domain. For instance, the first box includes all 567 successfully realizations (100%), for which the overall average cesium environmental release fraction is 9.36E

-4. The color contour of each node denotes the magnitude of the regressed variable. In Figure 4-86, nodes with higher releases have a darker hue of blue. Below each box is a logical statement that defines the bifurcation for lower nodes. If the logical statement is true, the tree proceeds along 4-74 the left branch; if it is false, the tree proceeds along the right branch. The nodes are labeled with letters to facilitate the following discussion.

Figure 4-86 Recursive partitioning tree for cesium environmental release fraction The first bifurcation identified in Figure 4-86 is for the priSVcycles parameter, and this is labeled "Node A." The recursive partitioning tree estimates this bifurcation at 38 cycles. Proceeding to the right in the tree to Node C, it shows that 27 realizations with less than 38 primary SV cycles have high cesium releases. As previously discussed, a lower number of primary SV cycles reflects an accident progression where the primary RCS depressurized sooner due early SV failure (due to the sampled number of cycles). Notionally, enhanced in

-vessel oxidation plays a role in providing a driving force for radionuclide release, given the rapid generation of chemical energy and subsequent superheated gases. The tree supports this with the next bifurcation in Branch C (Eu_Melt_T < 2533 K). Realizations with higher liquefaction temperature for the UO 2-ZrO 2 system are associated with an increased cesium environmental release fraction. Higher liquefaction temperature allows the fuel rods to remain standing for a longer time, thereby enabling more oxidation of the Zircaloy cladding that consequently increases fuel temperatures and accelerates radionuclide releases from fuel. Lower liquefaction temperature results in earlier collapse of fuel assemblies, after which the core debris typically relocates to lower, cooler regions in the RPV, and this generally inhibits further oxidation reactions. Nodes F and G in the tree show that realizations with a sampled liquefaction temperature greater than 2533 K have, on average, about five times greater release fraction of cesium.

Three of the early containment failure cases due to hydrogen deflagration are contained in Node G and one is contained in D E F G H I J K L M B A C 4-75 Node F 50. The Eu_Melt_T parameter is only important in the recursive partitioning analysis for realizations that have less than 38 primary SV cycles. This conjoint influence is visually evident in the scatter plot of Eu_Melt_T (Figure 4-90). Thus, the tree provides unique insights into the conjoint influences between Eu_Melt_T and priSVcycles for certain conditions that are not evident in Table 4-7. Table 4-7 shows that Eu_Melt_T and priSVcycles have significant conjoint influences, but it does not show how they are related.

Figure 4-86 shows that the majority of realizations (540 or 95%) have more than 38 primary SV cycles, which proceeds down the tree to the left to Node B, and that these cases are associated with a lower cesium environmental release fraction. The bifurcation at Node B demonstrates the importance of the time in cycle parameter. Note that BOC, MOC, and EOC are defined to have operating times of about 6 days, 200 days, and 529 days, respectfully. Therefore, the logical statement "Cycle < 103" is true for all BOC cases and false for all MOC and EOC cases. The left-most node in the tree (Node D) contains all of the BOC realizations (there were 62 successful BOC calculations) that have essentially zero releases.

The MOC and EOC realizations that have more than 38 primary SV cycles comprise the bulk of the tree with 478 realizations (84%), which is given by Node E. These realizations have relatively smaller but nonzero and later release fractions of cesium, the average being 6.7E

-7 for this node. This node is another bifurcation between the number of primary SV cycles. Realizations with more than 65 cycles have generally lower cesium releases and proceed to the left (to Node H), while those with less than 65 cycles have higher cesium releases and proceed to the right (to Node I). This bifurcation is consistent with Node A; more primary SV cycles are associated with lower releases.

There are two more bifurcations in the tree

-one differentiating MOC vs. EOC (Node H) and one for the aerosol shape factor (Node I), but these do not appear to be as significant. These lead to Nodes J, K, L and M, which are the lowest in the tree and the least significant, as evident by the comparable release fractions for each node. For example, Node K has a 40% higher release fraction than Node J, and Nodes L and M only differ by a factor of about two. Nonetheless, Nodes J and K suggest that EOC realizations have slightly higher release fractions on average (the median Cs release fraction for the EOC population is 7E

-4 versus 5E

-4 for the MOC population). Note that these lowest nodes are dependent on the logical bifurcations in all preceding (upper) nodes. For example, the recursive partitioning analysis determined there is a bifurcation between the cesium releases for MOC and EOC (Nodes H leading to J and K), but only when the number of actual primary SV cycles exceeds 65 (Node E).

Rank regression and the recursive partitioning trees forecast that higher primary SV cycles are associated with lower releases, and this is supported by a scatter plot for the variable (Figure 4-87). In this figure, the release fractions for each realization are colored according to the time in cycle at shutdown (denoted by BOC, MOC, or EOC in Figure 4-87), which is the next

50 The rank regression, which is applied to the entire dataset and not only the subset of primary SV cycles below 38 cycles, forecasts an opposite trend for Eu_Melt_T. The rank regression Eu_Melt_T trend is fairly weak ( R 2 Contr.= 0.02) and is heavily impacted by long term primary SV cycling behavior which may dominate the regression results, as can be seen by the light colored data in Figure 4-86. As a result, differences between the two predicted trends are expected.

4-76 dominant parameter influencing cesium environmental releases

51. Realizations with higher cesium releases tend to undergo less than 38 total cycles of the primary SVs, particularly for MOC realizations. There is also a dense cluster of MOC and EOC realizations around 70

-75 aggregate SV cycles which corresponds to the greater than 65 SV cycle bin i n Figure 4-86. This clustering reflects the median number of SV cycles that can occur before the primary side depressurizes due to RCS creep rupture. Physically, fewer SV cycles reflect an accident progression where the primary RCS depressurized sooner due to a lower sampled value for priSVcycles. The MELCOR Sequoyah model tends to predict higher cesium environmental releases for cases that have earlier primary depressurization. Depressurization of the RCS primary during the STSBO entails the venting of hot combustible gases laden with radionuclides to the containment.

The BOC realizations all have essentially zero cesium releases, and these are depicted on Figure 4-87 to demonstrate that the BOC cases exhibit higher primary SV cycles. The lower decay heat associated with BOC results in delayed (or totally precluded) creep rupture, which typically occurs before 75 cycles in the MOC and EOC cases, thereby extending primary SV cycling.

Figure 4-87 Scatterplot of cesium environmental release fraction versus priSVcycles The "Main Contributor" column in Table 4-7, which is an average of the individual contribution measures from all four regression techniques weighted by their corresponding R 2 values, indicates that the time in cycle at shutdown (i.e., BOC, MOC, and EOC) is the second

-most important parameter for the cesium environmental release fraction according to the regression models. The MARS technique fits the greatest individual and conjoint contributions to this parameter. A scatterplot of cesium environmental release fraction vs. time in cycle at shutdown

51 The fitted trend for number of primary SV cycles until failure may account for time in cycle at shutdown related trends due to sampling induced collinearity in the data. High release fractions are expected for simulations with less than 38 primary SV cycles while only three BOC cases were sampled in this range of primary SV cycles. The BOC lower decay heat levels should not impact early SV failure behavior and should only impact the number of cycles before predicted hot leg rupture. As a result, the true impact of time in cycle may be higher and number of primary SV cycles until failure may be lower than the forecast trend.

Hot Leg Creep Rupture Stoc h a stic SV Failure 4-77 is provided by Figure 4-88, where the abscissa is the number of days since reactor startup in Cycle 14. Figure 4-88 shows that BOC realizations have 'nearly zero' cesium environmental releases, while MOC and EOC have releases ranging from 'nearly zero' to a few percent. The range of cesium release fraction is rather comparable between MOC and EOC. The maximum cesium environmental release fraction occurs for MOC realizations. However, the EOC realizations have a slightly higher median release fraction.

The general association of higher release fraction with greater decay heat in this analysis is intuitive. Given that successful shutdown is assumed at the beginning of the Sequoyah STSBO scenario, decay heat is the principal driver of the subsequent core uncovering, fuel overheating, and radionuclide release from fuel. This heat dominates integral energy generation throughout the accident and drives the overall containment pressure response. Higher decay heat for MOC and EOC accelerates and enhances the cesium releases to the environment, and this influence is most evident by examining the containment pressure response for BOC, MOC, and EOC. Figure 4-89 demonstrates that there is a clear relationship between the cesium environmental release fraction and the timing of containment rupture. Earlier containment rupture is associated with an enhanced cesium environmental release fraction, and EOC realizations generally exhibit containment rupture sooner than MOC realizations.

Figure 4-88 Scatterplot of cesium environmental release fraction versus time in cycle at reactor shutdown

4-78 Figure 4-89 Scatterplot of cesium environmental release fraction versus time of containment rupture Another significant parameter for the cesium environmental release fraction is the effective liquefaction temperature of the UO 2-ZrO 2 system (Eu_Melt_T). This parameter has lower individual contribution to cesium release compared to aggregate pressurizer SV cycles (priSVcycles) and the time in cycle at shutdown (Cycle), but it is identified as having substantial conjoint contributions with other parameters.

In particular, higher sampled values of Eu_Melt_T are associated with greater cesium environmental release fractions, as illustrated by Figure 4-90. However, this trend only exists for realizations with less than 70 aggregate cycles of the pressurizer SVs (priSVcycles). For realizations with more than 70 cycles, the cesium environmental release fraction is rather independent of Eu_Melt_T. This conjoint influence is investigated in greater detail by examining the recursive partitioning tree generated for the regression analysis, Figure 4-86. The recursive partitioning technique calculated the highest conjoint influence for Eu_Melt_T, and it is corroborated by the quadratic and MARS techniques. In particular, the two parameters with the highest conjoint influence according to all three relevant regression techniques are priSVcycles and Eu_Melt_T; Figure 4-86 shows that the conjoint influence from Eu_Melt_T is due primarily to its interaction with priSVcycles. Hydrogen Induced Containment Failure Long Term Containment Overpressurization

4-79 Figure 4-90 Scatterplot of Eu_Melt_T vs. priSVcycles with color contour for cesium release fraction Iodine Release Fraction to Environment The magnitude and timing of the iodine class environmental release fraction is important for characterizing the potential severity of early health effects.

One of the primary radionuclides in this class is I

-131, which has a half

-life of 8.02 days. Several other iodine nuclides with high activity (I

-130, I-132, I-133, I-134, and I

-135) also have short half

-lives and are important for early health effects. Iodine releases are particularly important if they occur prior or during the evacuation phase. Consequently, the following evaluations focus on identifying the parameters that drive large and early environmental releases of iodine. The release fractions in this section represent the iodine class mass released to the environment from all iodine

-containing species (i.e., gaseous I 2 and CsI), where the released mass is normalized to the initial core inventory of all iodine class mass. The initial iodine class mass is different for BOC, MOC, and EOC; see Appendix B for mass information. Thus, when comparing a lower EOC environmental release fraction to a slightly higher MOC environmental release fraction, it cannot be assumed that the corresponding mass of Iodine released is lower for EOC than for MOC.

The following insights were identified by the regression and verified by examining associated scatterplots:

Environmental release fraction s increase for realizations where the primary SVs fail before 38 cycles corresponds to realizations that have the potential to exhibit hydrogen deflagration induced early containment failure, Environmental release fractions increase as time in cycle at shutdown increases, varying from 'near zero' for BOC realizations and then increasing in magnitude and decrease in timing between MOC and EOC conditions. Hot Leg Creep Rupture Stoc h a stic SV Failure 4-80 Environmental releases that fail containment due to long term slow over

-pressurization cluster near the initial fraction of gaseous iodine release, suggesting that the rest of the iodine deposits out in the RCS (mainly the PRT) and containment.

4.4.1.2.1 Iodine Release Fraction Figure 4-91 shows the iodine release fractions for the successful realizations, as well as the 95 th percentiles.

The 5 th percentile curves are below 1.0E

-5 and are not visible on the figure. The percentiles were calculated over all successful realizations (i.e., BOC, MOC, and EOC). BOC realizations exhibit 'near

-zero' releases, mostly due to lower decay heat preventing containment overpressure conditions from being achieved, as evident by the left inset picture in Figure 4-91. For comparison, the release fraction for Realization 266 is depicted on each inset picture, which is an MOC case and the STSBO UA reference realization. This realization was chosen because the cesium and iodine environmental releases, in

-vessel hydrogen production, and containment rupture timing are close to the population medians; see Section 4.3.1 for a discussion on this reference realization.

Figure 4-91 Iodine environmental release fractions for BOC, MOC, and EOC, respectively Qualitatively, iodine environmental release fractions resemble the cesium environmental release fractions as the releases are strongly separated by timing. There exist two realizations with relatively large iodine release fractions before 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months , which are the result of early containment failure following hydrogen burns, while the majority of realizations with releases occur after 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months due to prolonged monotonic containment pressurization and eventual failure. Quantitatively, the iodine environmental release fractions are about five to ten times greater than the cesium environmental release fractions. This difference is most evident by comparing the CDFs for iodine (Figure 4-92) and cesium (Figure 4-85) environmental release fractions. The iodine class is predominately in the form of CsI, which is more volatile than Cs 2MoO 4. Most cesium class mass (over 70%) is assumed to be in the form of Cs 2MoO 4, while the CsI combination class only contains about 7% of all cesium class mass. Furthermore, a small amount of iodine class mass is initially assumed to be in the form of gaseous I 2 that resided in the fuel

-cladding gap. The amount of gaseous I 2 in the gap varies from 0.1% to 0.42% of the total iodine class inventory, depending on the core burnup (i.e. BOC, MOC, and EOC). This iodine species is particularly volatile and most of it reaches the environment after 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

4-81 The CDF for iodine environmental release fraction (Figure 4-92) is presented at several discrete times into the simulation. This figure reflects the iodine release fractions for all successful realizations. The CDF curve at 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months s indicates that about 85% of the realizations still have very small or

'near-zero' cesium releases at that time while the remaining 15% exhibit release fractions ranging from 1.0E-3 to 0.1, which include the realizations with early containment failure and several EOC realizations that have experienced prolonged monotonic containment over

-pressurization. The CDF curves for earlier simulation times start with an accumulative probability of 1.0 and remain flat, which reflects that very few realizations have significant releases before 42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months ; namely just the four MOC and EOC realizations with early containment failure. The constant probability for very low environmental release fractions (less than 1.0E-3) in the CDF curves after 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months denotes that many calculations, including all of the BOC cases (65 out of 567, about 11%), have 'essentially zero' releases. After 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , about 13% of all realizations exhibit no significant releases. The final CDF for iodine reveals that over 95% of realizations have an environmental release fraction less than 0.01, and the maximum environmental release fractions are near 0.1.

Figure 4-92 CDFs for the iodine class environmental release fraction Four MOC and EOC realizations (two of each) produce early and relatively large releases. These cases have iodine environmental release fractions of 0.05

-0.10 by 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months . The majority of MOC and EOC releases occur after 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months . These release fractions range from 0.001 to 0.09. Early iodine environmental releases are the result of sudden containment rupture following a hydrogen burn, whereas the late releases are due to gradual monotonic containment over

-pressurization. Containment partial pressures are generally dominated by steam, but ex

-vessel gases (H 2 and CO) generated after RPV lower head failure also contribute to the long

-term containment pressurization.

4-82 As discussed in Section 4.4.1.1, decay heat has a strong influence on long

-term containment pressure response and the beginning of late

-phase releases after 40 hours4.62963e-4 days 0.0111 hours 6.613757e-5 weeks 1.522e-5 months . Given that the EOC decay heat is slightly greater than the MOC decay heat, which enhances the long

-term pressurization of the containment, EOC realizations start releasing iodine to the environment about 5-10 hours before the MOC realizations. The MOC and EOC environmental releases fractions are relatively similar, especially when compared to the BOC releases that are 'nearly zero' owing to intact containment at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . There are more EOC realizations with iodine releases greater than the 95 th percentile, which is partially attributable to higher decay heat.

4.4.1.2.2 Regression Tables, Recursive Partitioning Trees, and Scatterplots Table 4-8 shows the results for regression analysis of the iodine environmental release fraction. The "Main Contributor" column in Table 4-8 suggests that the time in cycle at shutdown (Cycle) and the number of primary SV cycles (priSVcycles) are the most important individual parameters for iodine environmental release fraction. Similar to the cesium regression analysis, priSVcycles indicates the aggregate actual number of cycles performed by the three pressurizer SVs in the MELCOR calculations, not the raw sampled cycles to failure for the valves. Recall also that the open area fraction of failed valves was not included in the regression analysis but determines whether the system can depressurize due to valve fa ilure. The importance of the priSVcycles parameter reflects the influence of both the number of cycles experienced by the valve system and the open area fractions of failed valves. The quadratic regression and MARS techniques indicate the number of primary SV cycles as the greatest individual contributor to uncertainty in iodine environmental release, and it is deemed a significant contributor by all four techniques. The rank regression forecasts time in cycle at shutdown to be the most important variable followed by weak influences from the aggregate primary SV cycles and rupture pressure (Rupture) parameters. High conjoint influences, or parameters that are important when their impacts are comingled with other parameter's impacts, are indicated for the number of primary SV cycles, the containment rupture pressure, and the effective liquefaction temperature of the UO 2-ZrO 2 system (Eu_Melt_T).

Table 4-8 Regression analysis of iodine environmental release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months To explore these forecasts in more detail, the recursive partitioning tree and scatterplots of the iodine release environmental fraction vs. the following parameters will be analyz ed: Time in cycle at shutdown (Figure 4-94), The number of primary SV cycles, coded by time of shutdown (Figure 4-95),

4-83 The number of primary SV cycles versus the rupture pressure, coded by iodine environmental release fraction (Figure 4-96), and Effective liquefaction temperature of the UO 2-ZrO 2 system, coded by time of shutdown (Figure 4-97). Figure 4-93 shows the tree generated by the recursive partitioning analysis of iodine environmental release fraction. A basic process for interpretation of recursive partitioning trees is provided in Section 4.4.1.1. The first node for iodine environmental releases identified in Figure 4-93, and also the most dominate parameter for the recursive partitioning technique , is for the priSVcycles parameter (Node A in Figure 4-93). It corroborates the later examination of the scatterplot for iodine release fraction (Figure 4-95); realizations with less than 38 cycles exhibit a higher iodine environmental release fraction. As in the tree generated for cesium environmental release fraction, the iodine tree estimates the release bifurcation due to priSVcycles (Node A) at 38 cycles

52. Proceeding to the right in Figure 4-93 to Node C, 27 realizations with less than 38 aggregate primary SV cycles have high iodine environmental releases. The next bifurcation in Node C is for the containment rupture parameter, where the values listed in the tree denote the rupture pressure in psig, and this leads to Nodes F and G. Nodes G contains realizations with the greatest iodine environmental release fraction (average value of 0.04), including those with early containment rupture. Nodes F and G show that realizations with a sampled rupture pressure less than 66 psig have about five times greater (on average) environmental release fraction of iodine. Hence, the recursive partitioning technique supports the assertion that lower rupture pressure results in higher iodine environmental release, but only for realizations that have less than 38 aggregate primary SV cycles.

Figure 4-93 shows that the majority of realizations (540 or 95%) have more than 38 aggregate cycles of the primary SVs, which proceeds down the tree to the left to Node B, and that these cases are associated with a lower iodine environmental release fraction. The bifurcation at Node B re-establishes the importance of the time in cycle at shutdown parameter. BOC and MOC realizations proceed down the tree to the left and lead to Node D. The EOC realizations are determined to have higher average releases, and these are characterized under Node E. It is here that Eu_Melt_T is predicted to have significant conjoint influence with EOC realizations that have more than 38 aggregate primary SV cycles. Realizations under Node E that have a sampled value for Eu_Melt_T below 2352 K are determined to have lower iodine releases (Node J). A UO 2-ZO 2 liquefaction temperature greater than 2352 K leads to higher average releases of iodine (Node K). In both the iodine and cesium regression analyses, higher values of Eu_Melt_T are determined to increase environmental release fractions but only in conjunction with other parameters. The final bifurcation in this region of the tree is for priSVcycles (Node K leading to Nodes N and O), but this bifurcation does not appear to be very important. The average releases for Nodes N and O only differ by about 20%, and Node O contains few realizations. In general, the lower branches in the recursive partitioning tree tend to be less

52 This first split on the number of primary SV cycles likely contributes to the high S i and T i metrics in Table 4-8. From Figure 4-93, only 3 BOC simulations are sampled with the number of primary SV cycles in the lower range. It is possible that difference s between the rank regressions and the regression s with conjoint terms is that much of the BOC to MOC/EOC release impact is coincidently explained by the non

-linear shift in release fractions below 38 SV cycles where few BOC samples occur.

4-84 meaningful (over

-fitted or reflecting spurious correlations), especially when the average values of the regressed variable in the nodes are comparable.

Figure 4-93 Recursive partitioning tree for iodine environmental release fraction The BOC and MOC realizations that have more than 38 primary SV cycles comprise the bulk of the tree with 332 realizations (59%), which is given by Node D. The BOC realizations are separated further to the left in the tree to Node H. These all have an 'essentially zero' environmental release fraction of iodine. The MOC realizations are located under Node I with an average environmental release fraction of 0.004. A further bifurcation to Nodes L and M is predicted for the containment rupture pressure, but much like Nodes N versus Node O, this difference does not appear to be significant. Node L has a 0.003 average environmental release fraction, which is nearly equivalent to the 0.004 average environmental release fraction for Node M. A scatterplot of the iodine environmental release fraction versus time in cycle at shutdown (Cycle) is provided by Figure 4-94, where the abscissa is the number of days since reactor startup in Cycle 14. Figure 4-94 shows that BOC realizations have 'nearly zero' iodine environmental releases, while MOC and EOC have environmental releases ranging from 'near zero' to a few percent. The distinct difference in release fractions for BOC cases form a strong linear trend which contributes to the high relative importance of the time in cycle parameter for rank regression compared to the non

-linear regression techniques. MOC and EOC realizations exhibit comparable ranges of environmental release fractions. The realization with greatest iodine release fraction is an MOC case, and this is due in

-part to the greater number of MOC cases sampled. There were 284 (out of 300) successful MOC realizations and 218 (out of 231)

A B C D E G F H I J K L M N O 4-85 successful EOC realizations. However, the EOC realizations have a slightly higher median release fraction (7E-4 for EOC vs. 5E

-4 for MOC)

. The initial inventory of gaseous I 2 appears to be particularly important in influencing the effective minimum iodine environmental release fraction for the MOC and EOC cases that exhibit significant (>1.0E-3) releases. As shown by Figure 4-94, the main clustering of MOC realizations have a minimum iodine release fraction that is nearly equal to the initial fraction of gaseous I 2 for MOC (i.e., 1.82E-3 or just above 1.0E-3). Likewise, the main cluster of EOC realizations have a minimum environmental release fraction that is near its initial gaseous I 2 inventory of 4.2E-3. The positive rank regression trend identified in Table 4-8 signifies that the higher relative inventory of gaseous I 2 associated with EOC realizations results in a higher overall iodine environmental release fraction. EOC realizations have 2.3 times more 53 gaseous I 2 than MOC realizations (0.420% vs. 0.182%). The time in cycle at shutdown parameter has two strong impacts on iodine releases. It determines the decay heat that instigates the severe accident, and it defines the initial inventory of highly volatile gaseous I

2. Therefore, the time in cycle at shutdown (Cycle) is a larger contributor than priSVcycles for iodine environmental releases. In contrast, priSVcycles is the dominate parameter for cesium environmental releases. Figure 4-94 Scatterplot of iodine environmental release fraction vs. time in cycle at shutdown The iodine environmental release fraction for most realizations is low enough (less than 0.01, see Figure 4-92) for the initial fraction of gaseous I 2 to have a n impact on overall iodine release. The inventory of gaseous I 2 is a function of core burnup, which is characterized by the time in cycle at shutdown parameter (Cycle), and it ranges from 0.1% to 0.42% of the total iodine class inventory. This iodine species is assumed to initially reside in the fuel

-cladding gap, and it

53 Note, the initial gaseous I 2 inventory and the release fraction are both normalized to the total inventory of the iodine class, which is also a function of burnup (see Section 3.1.1.2).

4-86 undergoes complete release from fuel during core degradation. Due to its volatility, most of the gaseous I 2 escapes to the environment for the majority of MOC and EOC realizations. All BOC realizations, in addition to a few MOC and EOC realizations, do not release any appreciable gaseous I 2 to the environment.

Rank regression shows that higher primary SV cycles are associated with lower iodine releases, and this is supported by a scatter plot for the variable, see Figure 4-95. In this figure, the release fractions for each realization are colored according to the time in cycle at shutdown, which is the most dominant parameter influencing iodine environmental releases. Realizations with higher iodine environmental releases tend to undergo less than 40 cycles of the primary SV, particularly for MOC realizations. There is also a dense cluster of MOC and EOC realizations around 70-75 primary SV cycles. This clustering indicates the median number of SV cycles that can occur before the primary side depressurizes due to RCS creep rupture. Physically, less SV cycles represent an accident progression where the RCS depressurized sooner due to a lower sampled value for priSVcycles. MELCOR calculations for the Sequoyah STSBO generally predict higher iodine environmental releases for realizations that have earlier primary depressurization. Hot combustible gases and radionuclides are discharged to the containment once the RCS depressurizes. The materials first flow through the PRT if depressurization is the result of a SV sticking open. If hot leg creep rupture occurred instead, the gases and radionuclide flow directly to the containment from the RCS.

Figure 4-95 Scatterplot of iodine environmental release fraction versus SV_Frac The BOC realizations all have

'essentially zero

' iodine environmental releases, and these are depicted on Figure 4-95 to demonstrate that the BOC cases exhibit higher primary SV cycles. The lower decay heat associated with shutdown near BOC results in delayed (or totally precluded) creep rupture, thereby allowing the primary SVs to continue cycling.

Stocatic SV failure Hot Leg Creep Rupture 4-87 The final two significant parameters for iodine environmental release fraction listed in Table 4-8 are the containment rupture pressure (Rupture) and the effective liquefaction temperature of the UO 2-ZrO 2 system (Eu_Melt_T). These parameters have lower individual contributions to iodine release compared to Cycle and priSVcycles, but they are predicted to have substantial conjoint contributions with other parameters. Rupture appear s to have a significant conjoint influence with priSVcycles, as shown in Figure 4-96. For realizations with less than 70 primary aggregate SV cycles, there is an association of lower rupture pressure and higher iodine environmental release fraction. For realizations with more than 70 cycles, the iodine environmental release fraction is rather independent of the rupture pressure. This trend indicates that accident sequences with early blowdown of the primary RCS, in conjunction with lower rupture pressure of the containment, exhibit increased iodine environmental release fraction. The worst of such cases (with releases near 0.1) are realizations that have large hydrogen deflagrations in the containment after RCS depressurization, and a lower rupture pressure for containment exacerbat es the release of iodine to the environment.

Figure 4-96 Rupture pressure vs. priSVcycles with color contour of iodine environmental release fraction Eu_Melt_T is another parameter that has important conjoint contributions for iodine environmental release. Relatively high conjoint contributions are predicted by the quadratic and MARS techniques, see Table 4-8. Recursive partitioning also calculated a nonzero conjoint influence for Eu_Melt_T. A scatter plot of iodine environmental release fraction versus Eu_Melt_T is provided by Figure 4-97 on both linear and logarithmic scales. The conjoint influences for Eu_Melt_T are more complicated than those for containment rupture pressure and that can be identified by Figure 4-97. A higher sampled value for Eu_Melt_T results in a greater iodine environmental release fraction for EOC realizations that have more primary SV cycles (priSVcycles

> 38). An interpretation of this conjoint influence is provided in the Hot Leg Creep Rupture Stocatic SV failure

4-88 discussion of the recursive portioning tree , Figure 4-93 , generated for iodine environmental release. Figure 4-97 Iodine environmental release fraction vs. Eu_Melt_T on linear (left) and logarithmic (right) scales In-vessel Hydrogen Production In-vessel hydrogen is generated from rapid steam oxidation reactions with Zircaloy cladding and stainless structures. Zircaloy oxidation generally dominates the total in

-vessel hydrogen produced. These oxidation reactions create considerable heat and energy in a relatively short amount of time, thereby accelerating the degradation of the core. Furthermore, flammable hydrogen produced from the oxidation reactions may ignite in the containment, which could create a pressure peak that can cause early containment failure resulting early radionuclide environmental releases. Hence, the total in

-vessel hydrogen production is a key variable for the uncertainty analysis that indicates the amount of additional energy generated 54 in-vessel and the availability of flammable gases for early deflagrations in containment. For reference, complete oxidation of all Zircaloy in the core would produce about 1022 kg of hydrogen.

The following insights were identified by the regression and verified by examining associated scatterplots:

The number of primary SV cycles is indicated to be important for the amount of in

-vessel hydrogen produced. However, the primary recursive partitioning bifurcation point for hydrogen is more closely tied to the hot leg depressurization bifurcation (Node A in Figure 4-102) as opposed to early depressurization (Node A in Figure 4-86 and Figure 4-93) which was important for radionuclide environmental releases, Oxidation Model 2 (Leistikov-Schanz/Prater

-Courtright

) is forecast to produce 35

-40 kg less in-vessel hydrogen than oxidation Models 1 and 3.

54 In addition to decay heat that is continually generated by radionuclides.

4-89 BOC cases are forecast to enable a significant positive dependency on effective liquefaction temperature, likely because the hot leg remains intact longer for BOC cases.

4.4.1.3.1 In-vessel Hydrogen Production Figure 4-98 depicts horsetails of in

-vessel hydrogen production for successful BOC, MOC, and EOC realizations. The 5 th percentile and 95 th percentiles are calculated over all successful realizations. Figure 4-99 shows the same information combined on a single plot. The hydrogen generation for Realization 266 is shown on Figure 4-98 and Figure 4-99, which is an MOC case and the STSBO UA reference realization. This realization was chosen because the cesium and iodine environmental releases, in

-vessel hydrogen production, and rupture time are close to the population medians, see Section 4.3.1 for discussion on the reference realization.

Figure 4-98 and Figure 4-99 demonstrate that the total in

-vessel hydrogen production varies between 275 kg and 400 kg for the majority of realizations, especially for MOC and EOC cases. BOC realizations exhibit a wider range of hydrogen production, which is a trend also observed in the Surry UA [16]. The initial steps of the core degradation process (e.g. the size and location of first relocation events) can often have a strong impact on the subsequent in

-vessel accident progression, including the oxidation dynamics and hydrogen generation. The lower decay heat of BOC cases tends to prolong the initial stages of core degradation and delay the onset of rapid oxidation reactions, leading to increased variability in in

-vessel accident progression as other uncertain parameters are varied. This ultimately manifests as a wider spread in the integral hydrogen mass generated in

-vessel. Figure 4-98 In-vessel hydrogen generation for BOC, MOC, and EO C

4-90 Figure 4-99 In-vessel hydrogen production for all successful cases Figure 4-100 illustrates the cumulative probabilities for in-vessel hydrogen produced at selected time intervals through 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Figure 4-101 shows hydrogen CDFs by hour for the first 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months of simulation, and provides a focused evolution of hydrogen generation for early time periods. Figure 4-100 demonstrates that the CDF at 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months is essentially identical to the final CDF, since minimal in

-vessel hydrogen production occurs after 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . The CDFs show that rapid oxidation reactions initiate soon after 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . The CDF curves prior to 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months in Figure 4-101 start flat at zero (or nearly zero) hydrogen mass and near a cumulative probability of 1.0, which indicates that very few realizations have started the in

-vessel oxidation process. After 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , about 90% of realization have undergone rapid oxidation reactions. Almost all realizations generate considerable hydrogen after 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . Judging by the CDFs in Figure 4-101, in-vessel oxidation reactions occur over the course of 4 to 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months into the simulation for the majority of realizations. Despite the near zero releases associated with BOC, all realizations including BOC undergo gross core degradation and exhibit considerable in

-vessel hydrogen production. Minimum hydrogen production is around 220 kg, and maximum production is about 510 kg.

4-91 Figure 4-100 CDFs for in

-vessel hydrogen Figure 4-101 CDFs for hydrogen production to 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months 4-92 4.4.1.3.2 Regression Tables, Recursive Partitioning Trees, and Scatterplots The regression results for in-vessel hydrogen generation are presented in Table 4-9. Based on the weighted average of all techniques ("Main Contributor"

), the regressions suggest that the oxidation model (Ox_Model) and time in cycle at shutdown (Cycle) are the most important parameters for hydrogen production. Ox_Model is forecast to be the most impactful parameter by rank regression and recursive partitioning. The other techniques (quadratic and MARS) deem time in cycle at shutdown to be more influential. Similar to the regression analyses for radionuclide releases, priSVcycles and Eu_Melt_T are determined to be important parameters. However, Eu_Melt_T appears to have a more direct (individual) contribution to variation in hydrogen generation. A higher individual contribution by Eu_Melt_T for hydrogen production is intuitive given that these quantities are closely related. The effective ZrO 2-UO 2 liquefaction temperature is an input value of first

-order importance for core degradation (i.e. it largely determines the conditions for gross collapse of fuel bundles), and hydrogen production is a primary integral metric describing the in

-vessel accident progression. Radionuclide release are likewise influenced by the in

-vessel accident dynamics, as these processes tend to steer (at least initially) the subsequent overall accident progression, but releases are also strongly affected by many other phenomena; CCI and gas generation, RCS and containment hydrodynamics, deflagrations, and long

-term revaporization all have additional impacts on radionuclide environmental releases. The regression analyses for hydrogen generation corroborate the previous analyses for cesium and iodine environmental releases. Cycle and priSVcycles are consistently two of the most important parameters in the UA.

Table 4-9 Regression analysis of in-vessel hydrogen production at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months To explore these forecasts in more detail, the recursive partitioning tree (Figure 4-102) and scatterplots of the mass of in-vessel hydrogen production versus the following parameters will be analyzed:

The number of primary SV cycles, coded by time of shutdown (Figure 4-103), Effective liquefaction temperature of the UO 2-ZrO 2 system, coded by time of shutdown (Figure 4-104), Effective liquefaction temperature of the UO 2-ZrO 2 system for BOC simulations, coded by oxidation model (Figure 4-105), and 4-93 Oxidation model, coded by point density (Figure 4-106). Figure 4-102 Recursive partitioning tree for hydrogen production The recursive partitioning tree for hydrogen production is relatively complicated compared to the trees for radionuclide environmental release fractions. Therefore, only the major features will be described in how they relate to the four most important parameters (highlighted in yellow in Table 4-9). Figure 4-102 shows the tree generated by the recursive partitioning analysis of in

-vessel hydrogen. The first bifurcation at Node A is for priSVcycles, the second

-most important contributor in the recursive partitioning analysis, where realizations with less than 66 cycles proceed to the right in the tree to Node C and are generally associated with increased hydrogen production and no forecasted dependency on the oxidation model. Realizations with greater than 66 aggregate primary SV cycles are associated with less hydrogen production and proceed A B C E G F D I J H K 4-94 to the left in the tree (Node B). The tree indicates a clear deviation in hydrogen production between oxidation Model 2 (=308) and oxidation Model 1 (=343) and Model 3

(=349). The node at 66 cycles approximately corresponds to the mean number of aggregate primary SV cycles before the primary side depressurizes due to RCS creep rupture. Depressurization of primary results in the flashing of most or all of the liquid water remaining in the RPV and the blow down of hot gases to the PRT, which ultimately starves the oxidation process of steam and terminates the reaction. Temporary steam cooling of the core also occurs upon RCS depressurization. From these perspectives, the direct relationship between primary SV cycles and in-vessel hydrogen generation is physically intuitive. However, integral hydrogen generation is a rather complicated value that is sensitive to many inputs and uncertain parameters.

There also exist conditions where an inverse relationship between hydrogen generation and priSVcycles is sensible, i.e. realizations where fewer cycles are associated with increased hydrogen production. For instance, early primary SV failure (with the SV sticking partially open) when the RPV is still full of water can result in a situation of prolonged low pressure boiling and oxidation reactions. Early depressurization, while still flashing a portion of the primary water inventory, leaves behind a considerable water pool in the core and lower plenum regions. After the initial steam cooling from the depressurization, the fuel quickly heats up again (from continual decay heating) and in

-vessel boiling continues, thereby generating steam and sustaining a prolonged condition of Zircaloy oxidation at low pressure. Note that the rank regression actually indicates an inverse relationship (-0.18 in Table 4-9), but the incremental gain in the rank regression R 2 value from the aggregate primary SV cycles (i.e., 0.03 for R 2 cont.) indicates that this relationship only pertains to a small portion of the overall variance accounted for by the model. Recall also that the effect of the aggregate primary SV cycles depends also on the open area fraction of failed valves, which is not included in the regressions. The complicated relationship between hydrogen generation and priSVcycles is further demonstrated by the scatterplot provided in Figure 4-103. The timing of RCS depressurization via creep rupture, which terminates SV cycling, is evident around 70

-75 cycles for MOC and EOC realizations and around 85 cycles for BOC realizations.

Node C is another bifurcation of primary SV cycles, where realizations with more than 48 cycles proceeds to the left, Node F, and realizations with less than 48 cycles proceed to the right, Node G. Thus, Node F categorizes realizations where the number of primary SV cycles is priSVcycles

< 66), while Node G contains realizations with less than 48 cycles. Node G is associated with a greater amount of average hydrogen generation (381 kg versus 361 kg for Node F). Node G has a further bifurcation for Eu_Melt_T where realizations with lower ZrO 2-UO 2 liquefaction temperature (< 2533 K) are associated with less hydrogen generation, and higher temperature cases exhibit more hydrogen production. The UA generally predicts a direct relationship between Eu_Melt_T and the principal model outputs. This relationship is visually significant for hydrogen generation, as shown by Figure 4-104. Higher values of Eu_Melt_T allow fuel assemblies to remain standing longer, thus enabling more oxidation reactions and prolonged periods of high fuel temperature that drive radionuclide releases from fuel. In Figure 4-105, BOC realizations exhibit a particularly clear and positive trend, as denoted by the corresponding linear regressions through each set of data (i.e. the pink/fuchsia has the greatest slope). This trend may be caused by the lower decay heat and more gradual core degradation associated with BOC, which appears to enhance the influence of Eu_Melt_T.

4-95 Figure 4-103 Scatterplot of in

-vessel hydrogen production vs. the aggregate primary SV cycles, colored by time in cycle Figure 4-104 Scatterplot of in

-vessel hydrogen production vs. Eu_Melt_T with trend lines

4-96 Figure 4-105 Scatterplot of in

-vessel hydrogen production vs. Eu_Melt_T with trend lines for BOC, MOC, and EOC simulations coded by oxidation model The important influences of the oxidation model (Ox_Model) are resolved to the left in the tree under Node B. Realizations with Ox_Model = 3 (Urbanic Heidrick) fall under Node E and are generally associated with increased hydrogen production. Ox_Model = 1 (Catchart

-Pawel/Urbanic

-Heidrick), which falls under Node I, produces on average slightly less hydrogen than Ox_Model = 3 (Node E). Hydrogen production for Ox_Model = 2 (Leistikov

-Schanz/Prater

-Courtright) is under Node H and exhibits a lower average hydrogen production.

The bifurcation for Node H is for time in cycle at shutdown, and it suggests that MOC and EOC realizations result in slightly less 55 hydrogen production than BOC realizations due to the longer oxidation time before hot leg rupture for these low decay heat simulations. The bifurcation for Node I once again shows a directly proportional relationship between Eu_Melt_T and hydrogen generation. Realizations under Node I that have Eu_Melt_T less than 2430 K exhibit about 10% less hydrogen generation on average. Node H in the recursive partitioning tree (Figure 4-102) supports the association of BOC and increased hydrogen, but only for simulations where primary SV cycles is consistent with hot leg creep rupture (priSVcycles

66) and under oxidation M odel 2. Similarly, Node J suggests that EOC realizations have slightly more priSVcycles

< 80. The recursive partitioning tree in Figure 4-102 and the scatter plot in Figure 4-104 both imply dependencies to the selected oxidation model and time in cycle at shutdown. The BOC realizations exhibit a different partial derivative of in

-vessel hydrogen production with respect to eutectic melt temperature, as demonstrated by the slopes of the trend lines in Figure 4-104. The subfigures in Figure 4-105 show the BOC, MOC, and EOC eutectic melt data separately coded by oxidization model used. The plots in the middle (MOC) and right (EOC) exhibit very similar behavior between the three oxidization models. The plot on the left, however, illustrates a

55 As a reminder, this trend is forecast to only exist for realizations when both Ox_Model = 2 and with greater than or equal to 66 primary SV cycles, although there may not be enough data points below 66 primary SV cycles to resolve the trend with recursive partitioning.

4-97 different relationship between the trends with respect to the oxidation models. The overall trends shown in the recursive partitioning tree holds for the BOC data; Ox_Model = 3 produces more hydrogen than Ox_Model = 1 which produces more hydrogen than Ox_Model = 2. It is notable that the partial derivatives of hydrogen production with respect to eutectic temperature for each oxidation model appear to hold constant with the forecasted hydrogen produced moving up and down at a fixed value for BOC (i.e. the trend lines for the BOC data appear roughly parallel). One deviation between the BOC oxidation model trend and the MOC and EOC trends is that the BOC data forecasts a similar influence between Ox_Model = 2 and Ox_Model = 1 with Ox_Model = 3 leading to generally higher in

-vessel hydrogen production while the overall MOC and EOC data sets forecast a similar influence between Ox_Model = 3 and Ox_Model = 1 with Ox_Model = 2 leading to a different hydrogen production.

The partial derivatives with respect to eutectic melt temperature shown in Figure 4-105 are much stronger for the oxidation models in BOC than for any oxidation model in either MOC or EOC. This is likely caused by the comparatively longer time that the fuel remains intact between the onset of low level oxidation (just above about 1000K) and the initiation of the autocatalytic oxidation thermal runaway. This is because of the lower BOC decay heat that slowed the onset of the rapid autocatalytic cladding oxidation stage. The rapid oxidation transient associated with the autocatalytic reaction stage is relatively short in comparison and terminated by exceeding the Eutectic Melt Temperature when the fuel rod then collapses and the oxidation transient is effectively terminated. In contrast, the MOC and EOC cores likely pass through the low temperature oxidation range (above 1000K) and enter the autocatalytic stage comparative more quickly than the BOC case, and for this reason, less hydrogen is generated prior to the cladding oxidation runaway, producing the observed trends.

The associated scatter plot for the oxidation model and hydrogen generation is provided by Figure 4-106. This figure has a color scale indicating the relative density of points to better illustrate the concentration of hydrogen results for each Ox_Model value. The scatter plot with the color scale substantiates the notion that Ox_Model = 3 generally yields the greatest hydrogen production. Figure 4-106 also suggests that Ox_Model = 2 can yield more hydrogen than Ox_Model = 1, which is in agreement with the recursive partitioning analysis. The relative density of points for Ox_Model = 1 and Ox_Model = 2 reflects the dependency between time in cycle at shutdown and oxidation model; the amount of hydrogen produced when shutdown occurs during MOC or EOC can be greater than that produced during BOC if Ox_Model = 1.

4-98 Figure 4-106 Scatterplot of in

-vessel hydrogen production vs. Ox_Model Overview of Focused Pressurizer Safety Valve Study The UA results presented in Section 4.4.1 only included four realizations with an early containment failure. This was in sharp contrast to the draft UA results [122] that resulted in early containment failure for 25% of the realizations. As discussed in Section 4.1, the draft and current results otherwise correlate well with one another and the differences are primarily attributable to changes in the pressurizer SV failure distributions in the two studies. Using the results from Reference

[122] with many more early containment failures as a guide, a focused pressurizer SV study was performed to better understand conditions leading to an early containment failure. Reference

[122] cases showed that 99% of early containment failures occurred when the pressurizer SV experienced less than 65 cycles and failed with a total open area fraction in excess of 0.3. Consequently, a focused pressurizer SV study was performed limiting the range of the priSVcycles and priSVfrac to 1 to 65 cycles and 0.3 to 1.0, respectively. A more detailed description of the methodology and results is available in Appendix I

. The focused pressurizer SV study satisfied several important objectives. First, it explored the most important uncertain parameter attributes that contribute early containment failure. The early containment failure realizations are particularly important because they have larger and earlier releases. The full UA had relatively little sampling with the SV failure attributes for an early containment failure. Second, the realizations with these safety valve attributes also experienced a large number of code failures that warranted further investigation. There was 4-99 some uncertainty in the relative occurrence of an early containment failure. Third, the new study corrected the barrier seal failure pressure error (see Section 4.5). Consequently, the impact of the barrier seal performance on a larger set of calculations could be explored.

An additional 600 MELCOR calculations were performed for the focused study. These calculations simulated the first 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months for the STSBO. It was assumed that if a burn had initiated prior to 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months and the containment had not failed, then the calculation would proceed to a late containment failure due to non

-condensable gas generation from CCI. The sampled parameter distributions were specified in the same way as those used in the full UA as described in Section 3, except the number of cycles for pressurizer SV failure (i.e., priSVcycles) and the associated open area fraction (i.e., priSVfrac). The fabric seal failure differential pressure sampling input error discussed in Section 4.5 is corrected for these calculations.

361 of the 600 realizations were successful, which represents a success rate of approximately 60%. Approximately 17% of the successful realizations had a containment failure occurring in less than 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months . A comparison of the sampled uncertain parameters in the successful and unsuccessful calculations demonstrated the distributions for uncertain parameters are consistent with the original samples and there is no region that is significantly under

-sampled due to unsuccessful calculations. In particular, unsuccessful cases occurred throughout the sample space. The 17% early containment failure rate in this study compares well with the 17% failure rate in the full study (i.e., 4 early containment failures out of 23 realizations with the same attributes as the focused SV study). The focused SV study also shows the potential for early containment failure at the BOC, which was not calculated in the full UA.

A Spearman Rank Correlation was determined for the figures

-of-merit relative to the uncertain parameters. The rank correlation is used to gain further insights of the sensitivity of the input parameters on the results, similar to the method used in Reference [151]. The Spearman Correlation provides an indication if the parameter and result are mutually independent and if greater values of the parameter generally leads to a greater output results, and vice versa [152]. The figures

-of-merit examined were the time to containment failure, mass of hydrogen generated in

-vessel up to the first hydrogen burn, the mass of hydrogen passed through the PRT to the first hydrogen burn, and the mass of hydrogen reaching the dome at the time of first burn. The only overlapping correlation with the full UA was the total in

-vessel hydrogen generation. Both the full and focused SV study show agreement on the top three variables but in a different order. However, some differences are expected due to the limited scope of the valve parameters for this study. The regression results show the failure pressure (Rupture) as the most important factor effecting early containment failure timing. An examination of the results show that almost all the sampled rupture pressures leading to early containment failure were less than the mode of the failure pressure (see Figure 4-107). The number of pressurizer SV cycles (i.e., priSVcycles) is the next strongest correlation. An increase in the number pressurizer SV cycles leads to later containment failure, which is consistent with full UA results. The AJAR parameter was also identified as important but later judged to be incorrectly evaluated; this is discussed further in Appendix I.

4-100 Figure 4-107 Time to containment failure plotted against the containment rupture pressure. The regression of the amount of mass of hydrogen transported to the PRT showed the number of pressurizer SV cycles (i.e., priSVcycles), the time of the cycle (Cycle), and the oxidation model (Ox_Model) as the most important parameters, which was consistent with the total mass of hydrogen generated in

-vessel for the full UA. The regression for the amount of hydrogen transported to the dome showed the number of pressurizer SV cycles (i.e., priSVcycles), the eutectic melting temperature (EU_melt_T), and the oxidation model (Ox_Model) as the most important parameters. As mentioned above, the correlation for the lower ice compartment inlet doors open fraction (AJAR) is also identified as important but later judged incorrectly evaluated (see discussion in Appendix I

). As described in Section 4.5, an input error resulted in the sampled fabric seal failure differential pressure to be interpreted smaller than intended by a factor of 10. This error was corrected for this study. To examine the influence of this modeling difference on the results, the difference between the peak pressure in the dome during the first 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months and the sampled containment fragility was compared to the maximum hydrogen mass within the dome around the time the burn initiates in the dome. Figure 4-108 shows a linear trend between the maximum mass reaching the dome and how close the maximum pressure pulse in the first 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months comes to rupturing the containment. The results show that a majority of the results from the full UA do not come within 25 psig of the sampled fragility. The early rupture cases (i.e. those points greater than zero) trend are consistent between the full UA and this study, indicating the sampling input error had little impact on the results.

4-101 Figure 4-108 Difference between peak containment pressure and sampled containment fragility plotted against maximum hydrogen reaching the dome around the time of burn initiation in the dome.

Finally, this study provided better understanding of the source term from the realizations that included pressurizer SV failures. All the realizations with an early containment failure were rerun and the simulation time was extended to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In addition to the early containment failure realizations, 57 other randomly selected realizations were also extended to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The average cesium and iodine release fractions at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for successful realizations with early containment rupture are 0.022 and 0.063, respectively. The highest release fractions were 0.058 and 0.15 for cesium and iodine, respectively. The lowest releases were 0.01 and 0.025 for cesium and iodine, respectively. Neither of the maximum or minimum values were well represented in the four results from the full UA. However, the average values from the focused study confirm the four early containment failure results in the full UA. Although the early containment failure realizations from th is study have higher iodine and cesium releases than the late containment failure realizations, there is some overlap as shown in Figure 4-109. There was little overlap in the full U A where the early containment failure cesium and iodine were well above the 95 th percentile (i.e., only one late containment failure realization was above the lowest early containment cesium and iodine releases). In contrast, this study has many late failure realizations that overlap the early containment failure results. It is important to note that the available late containment failure results are limited to realizations with a pressurizer SV failure prior the hot leg failure. Consequently, it is only a partial description of the full spectrum of results considered in the full UA. This study does show that generally more severe results occur when the late containment failure has the se SV attributes.

4-102 Figure 4-109 Cesium release fraction (left) and iodine release fraction (right) versus time (yellow=BOC, blue=MOC, red=EOC).

The impact of the valve area on the magnitude of the iodine and cesium environmental releases were compared to the pressurizer SV failure area (see Figure 4-110 and Figure 4-111). However, the results do not show strong trend one way or another.

Figure 4-110 Cumulative cesium release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months plotted against the pressurizer safety valve open area.

4-103 Figure 4-111 Cumulative iodine release fraction at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months plotted against the pressurizer safety valve open area.

4.5 Summary of MELCOR Modeling Errors The STSBO UA MELCOR model from which the results in Section 4.3 and Section 4.4 are discussed had important two modeling errors discovered after the analysis. These errors are discussed in more detail in Appendix E. The first error concerned the uncertainty sampling of the barrier seal differential failure pressure (Seal_Fail_Dp). The second error concerned the hot leg creep rupture logic.

For the Seal_Fail_Dp uncertain parameter, all the corrected realizations from the STSBO UA generated the same containment failure state (i.e., early containment failure by hydrogen burn or a late over

-pressurization). The 18 corrected realizations were selected as the realizations most likely to cause an early containment failure. The timing of the seal failure and containment failure were in good agreement on most of the repeated calculations. The impact of the error on the early containment failure source term was seen to be very small, and has no impact on the late over-pressurization containment failure realizations.

The impact of the error in Seal_Fail_Dp sampling on late containment failure was also examined via sensitivity calculations. It was postulated that intended values of Seal_Fail_Dp could allow buildups of hydrogen in upper containment that results in large late hydrogen deflagrations. The reduced value of leakage between lower and upper containment with an intact barrier seal significantly reduced the magnitude of natural circulation. Consequently, the buildup of hydrogen in upper containment was very slow (i.e., over many hours). Regular burns in lower containment during this timeframe ensured that any propagation of a burn into upper containment would occur near the LFL for upward propagation. The sensitivity calculations illustrated that the resultant burn in upper containment at LFL would not challenge containment 4-104 integrity but would fail the barrier seal. Therefore, a corrected realization would not experience an early over

-pressure challenge to containment integrity.

For the hot leg creep rupture logic, impact on late containment failure cases was not evaluated but judged to have low importance. In a late containment failure, any small differences (i.e., minutes) in the hot leg rupture within the first few hours of the accident were expected to have a negligible impact on the containment source term over 50 hours5.787037e-4 days 0.0139 hours 8.267196e-5 weeks 1.9025e-5 months later. There is ample time for in-vessel accident progression to complete and radionuclide settling any released radionuclides. Most of the UA realizations progressed to a late containment failure and therefore the error is judged to have a low impact on the results.

Previous work shows the creep rupture index quickly rises orders of magnitude above the failure threshold as conditions within the accident sequence start to meet the creep rupture logic

[137]. Consequently, hot leg failure is expected unless the primary system is substantially depressurized, which was only experienced in a small number of the realizations. The impact of the creep rupture error was judged to slightly increase the likelihood of an early containment failure and slightly delay the timing. In Realization 554 (the realization with the earliest containment failure

- se e Table 4-1), the impact of the error on the source term was shown to be relatively minor.

The corrected STSBO UA model was used for the subsequent analyses which are discussed in Section 4.6 through Section 4.8. 4.6 Hydrogen Igniter Benefit Analysis An early containment failure realization was selected to investigate the impact of availability of the hydrogen mitigation system (HMS) igniters on the containment pressure response. Realization 554 was selected as the representative sequence. The key uncertain parameters in this realization included a low containment failure pressure and pressurizer SV failure attributes that have the potential to promote early containment failure (i.e., a large pressurizer SV failure area prior to hot leg failure). The key uncertainty parameters are summarized in Table 4-10. Table 4-10 Summary of key uncertain parameters in igniter sensitivity study.

Parameter Realization 554 Containment failure pressure 54.5 psig (69.2 psia)

Pressurizer SV1 FTC 1 cycle Pressurizer SV1 Failure Area 0.769 Single SG SV FTC 742 cycles Single SG SV Failure Area 0.0894 Time of cycle EOC Min H2 concentration 4% (upward)

Oxidation correlation Leistikov-Schanz/ Prater-Courtright Fuel melting temperature 2481.6 K Fabric seal failure pressure 51.84 psid Fabric seal failure area 0.304 m 2 Lower ice chest doors failure area 0.7687 4-105 The igniters were assumed to ignite hydrogen at a 7% concentration if there was adequate oxygen (>5%) and a steam concentration less than 55%. The igniters were located throughout the containment except for the ice compartment and the reactor cavity. In the sensitivity case, the hydrogen igniters were always available. However, as shown in Table 4-11, the igniter ignition criteria was not achieved until 3.02 hr. Consequently, the sensitivity case also represents recovery of the HMS by 3 hr. The early ignition sources were disabled in the igniter sensitivity case (i.e., auto

-ignition from the hot gases exiting the hot leg or the PRT and the hot ex-vessel debris in the reactor cavity). These ignition sources were not present until 4.37 hr in the base case, or more than 1.5 hr after the first burn from the igniters.

As evidenced by the timings in Table 4-11, the igniters changed the accident progression after 3 hr. The most important difference is the timing of the containment failures at 4.37 hr and 47.6 hr in the base case and sensitivity case, respectively. The impact of the igniters on other late-phase events (e.g., RPV failure) is the consequence of events after the first igniter burns and hot leg failure that altered the in

-vessel debris configuration and subsequent boil

-off rate of the injected accumulator water mass. In particular, the boil

-off of the in

-vessel water following the accumulator injection at hot leg failure was slower in the base case, which slightly (i.e., ~0.8 h ou r s) delayed the vessel lower head failure. These differences did not impact the conclusions on igniter effectiveness.

Table 4-11 Results of the STSBO igniter sensitivity study.

Parameter Rlz 554 Rlz 554 w/Igniters RCP leakage initially 21 gpm/pump 0.00 hr 0.00 hr Single SG SV sticks open n/a n/a Pressurizer SV sticks open (first cycle) 1.69 hr 1.69 hr PRT rupture disk opens 1.75 hr 1.75 hr Lower ice compartment doors fail open 1.75 hr 1.75 hr RPV level < TAF 2.13 hr 2.13 hr Start of cladding failure 2.65 hr 2.65 hr Accumulator starts injecting 3.03 hr 3.03 hr Core damage exceed 5%

3.31 hr 3.35 hr HL failure 4.37 hr 4.36 hr PRT becomes ignition source 4.37 hr Disabled First burn 4.37 hr 3.02 hr Barrier seal failure 4.37 hr 4.37 hr Noble gas release to environment >1%

4.37 hr 47.6 hr Elemental Iodine release to environment >1%

4.37 hr 47.6 hr Containment failure by hydrogen burn 4.37 hr n/a Accumulators empty 4.40 hr 4.39 hr Vessel lower head failure (VF) 8.51 hr 7.70 hr Total Iodine release to environment >1%

9.04 hr 47.8 hr Cesium release to environment >1%

24.0 hr 48.4 hr Containment failure by late over

-pressure n/a 47.6 hr In-vessel Hydrogen Production 374 kg 407 kg Figure 4-112 shows a comparison of the early containment pressure responses with and without igniters. The HMS powers igniters in all regions of the containment except the ice condenser and the reactor cavity. In the corresponding igniter sensitivity calculation, a burn in any control volume with an igniter is allowed to propagate to other regions including the ice chest or the reactor cavity if it satisfies the propagation criteria. Whereas the first burn in the base case 4-106 occurs at 4.37 hr that fails the containment, the earlier burns in the igniter sensitivity case prevented the buildup of hydrogen in the containment.

Figure 4-112 Comparison of the short-term containment dome pressures in the STSBO igniter sensitivity study.

A large buildup of hydrogen in the containment is necessary to produce a hydrogen burn sufficient to fail the containment. Figure 4-113 shows the containment dome hydrogen mass and mole fraction concentration. The igniters in the dome would trigger a burn if the hydrogen concentration reached 7%, which did not occur in the first 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In contrast, the base case had a 213 kg of hydrogen in the dome at the timing of the first burn, which corresponds to a concentration of 9%. The resultant energy of the first burn in the base case following hot leg failure was 40,890 MJ with 54% of the burn energy from the dome region (see Figure 4-114). In contrast, the total burn energy gradually rises from many smaller burns in the igniter sensitivity study prior to vessel failure at 7.7 hr. Furthermore, there are no burns in the dome until 4.3 hr and then only small burns dome until one larger burn at 10.7 hr.

The last burns occur at 9.6 hr and 10.7 hr in the base case and igniter sensitivity cases, respectively. Thereafter, the oxygen concentration drops below 5% and is inadequate support further combustion. The containment has already failed in the base case calculation. However, the continued gas production and heating from the ex

-vessel CCI causes a long

-term pressurization in the igniter sensitivity case that leads to a late containment failure at 48.6 hr (see Figure 4-115). 0 1 2 3 4 5 6 0 3 6 912Pressure (bar)Time (hr)Containment PressureContainment FailureBase Casew/IgnitersFirst igniter burn(3.02 hr)Max burn pressure(3.38 bar)Containment failure by hydrogen burn(4.37 hr) 4-107 Figure 4-113 Comparison of the dome hydrogen mass and mole fraction in the STSBO igniter sensitivity study.

Figure 4-114 Comparison of the total and dome burn energy in the STSBO igniter sensitivity study.

-0.25-0.20-0.15-0.10-0.050.000.050.100.15 050100150200250300350400 0 3 6 912Mole Fraction (-)Mass (kg)Time (hr)Containment Dome Gass Mass and Concentration (Mole Fraction)Base Case - Massw/Igniters - MassBase Case - Mole Frw/Igniters - Mole Fr 020000400006000080000100000120000140000 0244872Burn Ernergy (MJ)Time (hr)Dome and Total Hydrogen Burn EnergyOriginal - TotalOriginal - Domew/Ignitersw/Igniters - Dome 4-108 Figure 4-115 Comparison of the long

-term containment dome pressures in the STSBO Igniter sensitivity study.

The impact of the igniters on the source term has the obvious benefit of delaying the timing of the release. Figure 4-116 shows the iodine and cesium releases to the environment for the base and sensitivity cases. The containment failure timing differences delay the start of the environmental releases from 4.37 hr to 48.6 hr. However, the impact on the environmental releases is affected by variations in the accident progression physics. In Realization 554, the iodine release is slightly higher in the delayed release with igniters while cesium release is slightly lower. However, as shown previously in the UA calculations, there can be significant variations due to the magnitude and timing of events such as revaporization.

The sharp depressurization of primary system and the containment following the containment failure at 48.g hr in the igniter sensitivity case contributed to a more significant release of revaporized iodine from the hot primary system to the environment (see Figure 4-117). In contrast, the chemical species of cesium are less prong to revaporization. Consequently, the cesium environmental release in the igniter sensitivity case benefitted from the additional settling time to the late containment failure. In contrast, there are weaker motive forces to discharge the late revaporization releases in the base case with an early containment failure. However, these types of variations are highly dependent on the accident progressions. Consequently, while lower releases are generally expected with a late containment failure, various attributes of the accident progression can impact the magnitude of the release. Nevertheless, the most important result from the ignition sensitivity study is significant delay on the start of the environmental release, which allows time for emergency actions and evacuation.

0 1 2 3 4 5 6 0244872Pressure (bar)Time (hr)Containment PressureContainment FailureBase Casew/Igniters 4-109 Figure 4-116 Comparison of the cesium and Iodine environmental releases in the STSBO igniter sensitivity study.

Figure 4-117 Comparison of the cesium and Iodine mass fractions in the primary system for the STSBO igniter sensitivity stud

y. 0.00.10.20.30.40.5 0244872Fraction of Initial Inventory (-)Time (hr)Cesium and Iodine Environmental ReleaseBase Case - IodineBase Case - Csw/Igniters - Iodinew/Igniters - CsContainment over

-pressure failure(47.6 hr)Containment failure by hydrogen burn(4.37 hr)0.00.10.20.30.40.50.60.70.80.91.0 0244872Fraction of Initial Inventory (-)Time (hr)Cesium and Iodine RCS TotalBase Case - CsBase Case - Iodinew/Igniters - Csw/Igniters - IodineContainment over

-pressure failure(47.6 hr)Revaporized airborne massreleased during containment failure depressurizationContainment failure by hydrogen burn(4.37 hr) 4-110 4.7 Reactor Coolant Pump Seal Leakage Sensitivity Analysis In the Sequoyah UA calculations, the reactor coolant pump (RCP) seal leakage occurred at a nominal rate of 21 gpm per pump at full reactor pressure. The leakage rate subsequently changed in response to changes in primary system pressure, the primary system fluid subcooling at the RCP seal, and the primary system void fraction at the pump seal. The sensitivity analysis considered a seal failure that increased the nominal leakage to a small loss

-of-coolant-accident (SLOCA). The RCP seal SLOCA had a nominal leakage value of 182 gpm per RCP. The sensitivity study assumed that all four RCP seals failed at 13 minutes after the hot primary system fluid filled the seal cavity following the loss of seal cooling at the start of the accident. The initial flooding of the RCP seal cavity with hot RCS water has been identified as a potential failure mechanism for the seal components. NUREG

-1953 estimated that the nominal RCP leakage remains at 21 gpm with a 79% likelihood. The 182 gpm SLOCA has a ~20% likelihood [138]. The WOG also indicates the potential for additional RCP seal failures after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if the RCS remains at high pressure.

The impact of the RCP seal leakage was investigated in the Surry UA [16]. The Surry UA varied the RCP seal leakage according to the WOG guidelines. However, the RCP leakage was not found to have a significant impact on the source term metrics. Consequently, the RCP seal leakage was not included in the Sequoyah UA. Following the completion of the Sequoyah UA calculations, the containment failure results showed a high sensitivity to the early release of hydrogen to the containment prior to an ignition source. It was speculated that a RCP seal SLOCA could impact the hydrogen release to the containment. Consequently, sensitivity calculations were performed to investigate the impact of the RCP seal SLOCA on the accident progression and containment response.

Two realizations were selected to investigate the impact of RCP seal leakage on the accident progression and containment pressure response.

The two realizations considered accident specifications that promoted early and late containment failure. In particular, Realization 21 had pressurizer safety valve failure attributes that lead to late containment failure (i.e., a large sampled FTC value that resulted in no failure of the pressurizer SV).

Conversely, Realization 554 had pressurizer safety valve failure attributes that have the potential to promote an early containment failure (i.e., pressurizer SV failure on the first cycle with a relatively large SV failure area

). In the UA calculations, Realizations 21 and 554 resulted in late and early containment failures, respectively. Both realizations had a low sampled containment failure pressure. They both also had large SG SV FTC cycle values that ensured their normal operation through SG dryout.

These cases are at opposite ranges of the timing to depressurize the RCS prior to the first ignition source, which has been shown as an important attribute to promote larger early burns. The key uncertainty parameters used in the realizations are summarized in Table 4-12.

4-111 Table 4-12 Summary of Key Uncertain Parameters in RCP Seal LOCA Sensitivity Study Parameter Realization 21 Realization 554 Containment failure pressure 3.7576 bar (54.5 psig) 3.7576 bar (54.5 psig) Pressurizer SV1 FTC 3945 cycles 1 cycle Pressurizer SV1 Failure Area 0.03487 0.76 89 SG SV1 FTC 3556 cycles 742 cycle s Pressurizer SV1 Failure Area 0.0111 0.8941 Min H2 concentration 4% (upward) 4% (upward)

Oxidation correlation Leistikov-Schanz/ Prater-Courtright Leistikov-Schanz/ Prater-Courtright Fuel melting temperature 2561.2 K 2481.6 K Fabric seal failure pressure 2.637 bar (3 8.247 psid) 3.574 bar (51.84 psid) Fabric seal failure area 1.012 m 2 0.304 m 2 Lower ice chest doors failure area 0.9414 0.7687 The results of the base and sensitivity calculations with RCP seal SLOCAs for Realizations 21 and 554 are presented in Table 4-13 and Table 4-14, respectively. As described above, four 182 gpm seal SLOCAs are initiated at 13 minutes. As the most important conclusion, the sensitivity calculations with a RCP seal SLOCAs also showed a late and early containment failure in Realizations 21 and 554, respectively. The timing of the late containment failure in Rlz 21 was slightly delayed (35 min) with RCP seal SLOCAs. A comparison of the other timings also shows the responses of the two cases were relatively similar. The only notable difference was the timing of the 100% ice melt. However, the earlier ice melt timings to 1% and 50% were in very close agreement. Similar to other late containment failure realizations, the iodine and cesium environmental releases were very small. The in

-vessel hydrogen production was slightly higher in the RCP seal SLOCA sensitivity case.

4-112 Table 4-13 Results of the Realization 21 RCP LOCA Sensitivity Study 21 gpm 183 gpm Event Description Time (hh:mm) Time (hh:mm) Initiating event Station blackout

- loss of all onsite and offsite AC power 00:00 00:00 MSIVs close Reactor trip RCP seals initially leak at 21 gpm/pump 00:00 00:00 Increase RCP seal leakage to 183 gpm N/A 00:13 First SG SV opening 00:00+ 00:00+ First SG SV fails stuck open N/A N/A Steam Generators dry out 01:32 01:28 Pressurizer SV opens 01:43 01:59 PRT rupture disk opens 02:06 02:08 1% of the ice melted 02:08 02:09 Water level below top of active fuel 02:26 02:00 Pressurizer SV stuck open N/A N/A Half of ice condenser lower plenum doors stuck open 02:06 03:55 First fission product gap releases 03:00 03:05 Creep rupture failure of the hot leg nozzle in combined loop 04:11 03:55 1st hydrogen deflagration 04:11 03:55 Accumulators begin injecting 04:12 03:55 25% of ice melted 04:12 04:00 Accumulator empty 04:13 03:56 > 5% fuel damage 05:18 05:01 50% of the ice melted 05:26 05:56 > 90% fuel damage 05:56 05:48 Vessel lower head failure 07:27 07:05 Debris discharge to reactor cavity 07:27 07:05 100% of ice melted 12:29 15:04 Containment fabric seal torn 04:11 03:55 Containment failure 46:20 46:55 Selected MELCOR Results Debris mass ejected (100kg) 159 162 In-vessel hydrogen generated (kg) 318 343 Iodine release fraction at 72 hr 0.00386 0.00445 Cesium Release fraction at 72 hr 0.00037 0.00024 PRT discharge becomes an ignition source N/A N/A 4-113 Table 4-14 Results of the Realization 554 RCP LOCA Sensitivity Study 21 gpm 183 gpm Event Description Time (hh:mm) Time (hh:mm) Initiating event Station blackout

- loss of all onsite and offsite AC power 00:00 00:00 MSIVs close Reactor trip RCP seals initially leak at 21 gpm/pump 00:00 00:00 Increase RCP seal leakage to 182 gpm N/A 00:13 First SG SV opening 00:00+ 00:00+ First SG SV fails stuck open N/A N/A Steam Generators dry out 01:31 01:27 Pressurizer SV opens 01:41 01:57 Pressurizer SV stuck open (1 cycle) 01:41 01:57 PRT rupture disk opens 01:45 02:00 Half of ice condenser lower plenum doors stuck open 01:45 08:10 1% of the ice melted 01:51 02:01 Water level below top of active fuel 02:08 01:58 First fission product gap releases 02:39 02:25 Accumulators begin injecting 03:02 02:39 > 5% fuel damage 03:19 03:06 25% of ice melted 04:22 04:02 PRT discharge becomes an ignition source N/A 08:10 Creep rupture failure of the hot leg nozzle in combined loop 04:22 N/A 1st hydrogen deflagration 04:22 08:10 Containment fabric seal torn 04:22 08:10 Containment failure 04:22 08:10 Accumulator empty 04:24 08:23 50% of the ice melted 04:58 07:20 > 90% fuel damage 05:02 05:08 Vessel lower head failure 08:30 08:21 Debris discharge to reactor cavity 08:30 08:21 100% of ice melted 13:07 21:09 Selected MELCOR Results Debris mass ejected (100kg) 167 168 In-vessel hydrogen generated (kg) 374 352 Iodine release fraction at 72 hr 0.051 0.084 Cesium Release fraction at 72 hr 0.018 0.031 4-114 There were larger timing differences between the Rlz 554 base case and the RCP seal SLOCA sensitivity case. As stated above, both base and sensitivity cases had an early containment failure. However, the RCP seal SLOCAs delayed the containment failure by almost 4 hr. The timings in Table 4-14 show the start of core damage started slightly earlier in the RCP seal SLOCA sensitivity case (e.g., core water level at the top of the active fuel, the initial fission product release, and the 5% fuel damage metrics). As an important difference that will be discussed further later, the first ignition source in the base occurs from the hot leg failure whereas the first ignition source in the sensitivity case is from the hot jet exiting the PRT almost 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months later. Furthermore, the sensitivity case did not have a hot leg failure. The differences are not related to most of the metrics for the progression of the fuel degradation, which shows reasonably close timings for the 5% and 90% fuel degradation states. The other notable differences include the timing of the ice melt. Similar to other early containment failure realizations, the iodine and cesium environmental releases were relatively large. Although the start of the environmental release from the RCP seal SLOCA sensitivity case was delayed by 4 hr, the total environmental releases were ~70% higher. The in

-vessel hydrogen production was slightly lower in the RCP seal SLOCA sensitivity case.

Figure 4-118 through Figure 4-124 and Figure 4-125 through Figure 4-132 show comparisons of key results for Realizations 21 and 554, respectively. The response of Rlz 21 will be discussed first. The early impact of RCP seal SLOCAs on the pressurizer pressure is evident in Figure 4-118. The RCP seal SLOCAs initially depressurize the primary system below 9 MPa. The energy flow through the RCP seal SLOCAs is inadequate to maintain the primary system depressurization after the SGs dryout at 1.5 hr. Consequently, the primary system pressurizes until the SV opening. The pressurizer SV cycles 75 and 12 times in the base and sensitivity cases, respectively. The 75 th SV cycle in the base case correspond to the timing of the hot leg failure, which rapidly depressurizes the primary system. In contrast, after the energy release from 12 cycles of the pressurizer SV, the energy release from the SLOCAs is adequate to depressurize the primary system below the SV setpoint. Both the base and sensitivity calculations predict a hot leg failure from high primary system pressure following the heatup of the hot leg nozzle by the recirculating hot core for the core. The higher inventory loss in the sensitivity calculation and slightly earlier core heatup in the sensitivity case (see Figure 4-121) speeds up the timing to the hot leg failure relative to the base case.

The containment pressure responses (see Figure 4-119) look very similar due to the similar timings of the hot leg and vessel failures. The ice melt in the base case is initially higher because of the higher steam release into the containment via the additional SV cycles. In contrast, the sensitivity case had fewer pressurizer SV cycles and is leaking water through the SLOCAs that has a lower energy content for ice melting.

4-115 Figure 4-118 Comparison of the Pressurizer Pressures in the Rlz 21 RCP Sensitivity Study Figure 4-119 Comparison of the Containment Pressures in the Rlz 21 RCP Sensitivity Study 0 2 4 6 8101214161820 0 4 812Pressure (MPa)Time (hr)Pressurizer PressureBase CaseRCP seal SLOCA 0 1 2 3 4 5 6 0244872Pressure (bar)Time (hr)Containment PressureContainment FailureBase CaseRCP seal SLOCA 4-116 Figure 4-120 Comparison of the Ice Melts in the Rlz 21 RCP Sensitivity Study Figure 4-121 Comparison of the RCS Water Mass in the Rlz 21 RCP Sensitivity Study 0%10%20%30%40%50%60%70%80%90%100%0 6121824Ice Melt Fraction (%)Time (hr)Ice Melt Base CaseRCP seal SLOCA 050000100000150000200000250000 0 4 812Mass (kg)Time (hr)RCS Water MassBase CaseRCP seal SLOCA 4-117 Figure 4-122 Comparison of the In

-vessel Hydrogen Generation in the Rlz 21 RCP Sensitivity Study Figure 4-123 Comparison of the RCP and PRT Hydrogen Leakages in the Rlz 21 RCP Sensitivity Study 050100150200250300350400 0 4 812Mass (kg)Time (hr)In-Vessel Hydrogen GenerationBase CaseRCP seal SLOCA 0 51015202530354045 0 4 812Mass (kg)Time (hr)Hydrogen Release from the RCP Seal and PRTBase Case - RCPBase Case - PRTRCP seal SLOCA - RCPRCP seal SLOCA - PRT 4-118 Figure 4-124 Comparison of the Iodine and Cesium Environmental Release in the Rlz 21 RCP Sensitivity Study Figure 4-125 Comparison of the Pressurizer Pressures in the Rlz 554 RCP Sensitivity Study 0.0000.0020.0040.0060.0080.010 0244872Fraction of Initial Inventory (-)Time (hr)Cesium and Iodine Environmental ReleaseBase Case - IodineBase Case - CsRCP seal LOCA - IodineRCP seal SLOCA - Cs 0 2 4 6 8101214161820 0 4 812Pressure (MPa)Time (hr)Pressurizer PressureBase CaseRCP seal SLOCA 4-119 Figure 4-126 Comparison of the Containment Pressures in the Rlz 554 RCP Sensitivity Study Figure 4-127 Comparison of the Ice Melt in the Rlz 554 RCP Sensitivity Study 0 1 2 3 4 5 6 0244872Pressure (bar)Time (hr)Containment PressureContainment FailureBase CaseRCP seal SLOCA0%10%20%30%40%50%60%70%80%90%100%0 6121824Ice Melt Fraction (%)Time (hr)Ice Melt Base CaseRCP seal SLOCA 4-120 Figure 4-128 Comparison of the RCS Water Mass in the Rlz 554 RCP Sensitivity Study Figure 4-129 Comparison of the In

-vessel Hydrogen Generation in the Rlz 554 RCP Sensitivity Study 050000100000150000200000250000 0 4 812Mass (kg)Time (hr)RCS Water MassBase CaseRCP seal SLOCA 0100200300400500 0 4 812Mass (kg)Time (hr)In-Vessel Hydrogen GenerationBase CaseRCP seal SLOCA 4-121 Figure 4-130 Comparison of the RCP and PRT Hydrogen Leakages in the Rlz 554 RCP Sensitivity Study Figure 4-131 Comparison of the Iodine and Cesium Environmental Release in the Rlz 554 RCP Sensitivity Study 0100200300400500 0 4 812Mass (kg)Time (hr)Hydrogen Release from the RCP Seal and PRTBase Case - RCPBase Case - PRTRCP seal SLOCA - RCPRCP seal SLOCA - PRT0.000.050.100.150.200.25 0244872Fraction of Initial Inventory (-)Time (hr)Cesium and Iodine Environmental ReleaseBase Case - IodineBase Case - CsRCP seal LOCA - IodineRCP seal SLOCA - Cs 4-122 Figure 4-132 Comparison of the Iodine and Cesium In

-vessel Retention in the Rlz 554 RCP Sensitivity Study Figure 4-122 and Figure 4-123 compare the in

-vessel hydrogen generation and the hydrogen leakage through the RCP and PRT pathways, respectively. The in

-vessel hydrogen generation in the sensitivity case increases faster than the base case due to the additional inventory loss from the RCP seal SLOCAs. The accumulator dump into the primary system following the hot leg creep rupture failure temporarily interrupts the hydrogen production by cooling the core. Due to the system depressurization from the SLOCAs, the hot leg creep rupture (i.e., a lower differential pressure) is delayed in the sensitivity case, which allows the rapid oxidation phase to proceed for longer than the base case.56 Although the subsequent hydrogen generation phase after the hot leg failure is larger in the base case, it less energetic at low

-pressure. Consequently, the total in

-vessel hydrogen generation was slightly higher in the sensitivity case.

The total hydrogen released to the containment prior to the hot leg failure was small in both cases (i.e., a characteristic attribute of these boundary conditions that lead to a late containment failure). The original case only discharged 22 kg through the open PRT rupture disk and 1.3 kg through the RCP seals. In contrast, the sensitivity case stopped cycling on the pressurizer SV before the start of the hydrogen generation (i.e., 0 kg released through the PRT rupture disk). However, 41 kg of hydrogen were released through the RCP seal SLOCAs. Both amounts were a small portion of the total in

-vessel hydrogen generation prior to hot leg failure and inadequate to promote a large burn.

56 Although the hot leg failure and the interruption of the rapid oxidation phase occurs earlier in the sensitivity case, the start of the rapid hydrogen generation phase also started earlier. As shown by the very rapid hydrogen generation rate at this time, an extension of minutes can correspond to significantly more hydrogen generation (i.e., 261 kg in the sensitivity case versus 140 kg in the base case).

0.00.10.20.30.40.50.60.70.80.91.0 0244872Fraction of Initial Inventory (-)Time (hr)Cesium and Iodine in the Primary System and the PRTBase Case - IodineBase Case - CsRCP seal LOCA - IodineRCP seal SLOCA - Cs 4-123 Finally, Figure 4-124 shows the iodine and cesium environment release. As discussed previously, the environmental releases were typically small in the late containment failure realizations. There was relatively good agreement between the two cases. It was concluded that the RCP seal SLOCAs had a relatively small impact on the timing and releases for Rlz 21, which had attributes that promoted a late containment failure.

Similar to the Rlz 21 results, the early impact of the RCP seal SLOCAs in Rlz 554 on the pressurizer pressure is evident in Figure 4-125. The early primary system pressure responses are the same as Rlz

21. The RCP seal SLOCAs initially depressurize the primary system below 9 MPa. However, after the primary system pressurizes to the pressurizer SV opening, the stuck-open SV dominates the pressure response. The base case primary system pressure initially decreases to less than 13 MPa but stops after the pressurizer level swells and begins to discharge water through the SV. After a short pressurization to ~15 MPa, the primary system subsequently depressurizes after the SV flow transitions back to steam. The sensitivity case did not show the interruption in the depressurization due to the lower inventory in the pressurizer and additional release pathways through the RCP seal SLOCAs. Overall, the primary system depressurization timings were similar with the sensitivity case being slightly faster.

The difference in the timing of the hot leg failure (i.e., absence of a hot leg failure in the sensitivity case) occurs during the next phase of the accident. Following the initial primary system depressurization with the stuck

-open pressurizer SV (see Figure 4-125), the sensitivity case primary system pressure remains between 1.2 to 2 MPa until the late pressurization at 6.7 hr. There are only two successive accumulator injections between 2.6 hr and 6.7 hr in the sensitivity case that cool the core and slow the core degradation. The accumulator injections also happened in the base case. However, the accumulator injections in the base case were more continuous and less impactful relative to the larger discrete injections in the sensitivity case. The RCP seal SLOCAs promoted stronger depressurizations, which led to two larger accumulator injections. The larger injections of accumulator water vaporized in the core, which cooled the fuel and pressurized the primary system above the accumulator pressure. In contrast, the core degradation in the base case proceeded in a more continuous manner with less effective cooling by the accumulator injections until the core plate failed at 4.4 hr. The debris relocation into the lower plenum in the base case at 4.4 hr caused a rapid steam generation that pressurized the primary system to 4.35 MPa. The primary system pressurization increased the stress across the hot leg, which failed. The remaining injection from the accumulator in the base case did not occur until after the depressurization from the hot leg failure.

In contrast to the base case response, the hot leg did not fail in the sensitivity case. The discrete accumulator injections prevented core plate failure. The large accumulator discharge at 6.7 hr was due to the RCP seal SLOCA depressurizing the primary system below the accumulator pressure rather than following system depressurization after the hot leg failure as calculated in the base case. The third accumulator injection at 6.7 hr was much larger than the previous two injections. The vaporization of cold water in the hot core provided cooling to the hot leg that prevented a hot leg creep rupture failure

57. The core degradation proceeded to vessel failure without any hot leg failure. The first ignition source in the sensitivity case was the

57 There is subtle difference in the responses. The core relocation in the base case caused a significant pressurization, which caused hot leg failure without the benefit of any accumulator water injection. The accumulator injection did not occur until after the system depressurization following the hot leg failure. In contrast, the sensitivity case depressurized to another accumulator injection that cooled the hot leg during the subsequent pressurization.

4-124 hot gases exiting the PRT rupture disk opening at 8.2 hr, which caused the containment failure. In contrast, the earlier hot leg failure in the base case was first ignition source. The net result was a delay in the first ignition source to the containment by 3.8 hr. The containment pressure responses (see Figure 4-126) show the delay in the first ignition source. The large burn with the first ignition source failed the containment in both cases. The peak pressures were approximately the same and well above the containment failure pressure for this realization.

The containment ice melt shown in Figure 4-127 reflects the delayed timing of the vessel failure. The base case melt rate increases following the hot leg failure at 4.4 hr. The sensitivity case ice melt rate was steady until vessel failure at 8.4 hr. Figure 4-1 2 9 and Figure 4-130 compare the in

-vessel hydrogen generation and the hydrogen leakage through the RCP and PRT pathways, respectively. The in

-vessel hydrogen generation in the two cases are comparable. The stuck

-open pressurizer SV in both cases compensates for the lack of RCP seal SLOCAs in the base case. Consequently, the core uncovers and the degradation occurs with similar timings. As expected, the start of the in

-vessel hydrogen generation begins slightly earlier in the RCP seal SLOCA sensitivity case. Both cases show that the end of the rapid oxidation phase occurs following the collapse of the intact core into a debris bed. In contrast to the high and open surface area for an intact core that is ideal to support rapid oxidation, the low porosity of a debris bed inhibits interaction between the steam and the cladding. Following the formation of a debris bed in the core, the rapid oxidation phase ends. The high inventory loss out the stuck

-open pressurizer SV leads to the core collapse prior to hot leg failure, which ends the rapid oxidation phase.

In contrast to Rlz 554, the rapid oxidation of the intact core in Rlz 21 was only momentarily interrupted by the hot leg failure. Following the boiloff of the accumulator water, the intact core proceeds to a second rapid oxidation phase. Nevertheless, the total in

-vessel hydrogen generation was similar in all four base case and sensitivity calculations of Rlz 21 and 554. The key difference is the two rapid oxidation phases in Rlz 21 versus one in Rlz 554 prior to the core collapse. The core collapse terminates the rapid oxidation phase in both realizations.

The total hydrogen released to the containment prior to the first ignition source was significant in the Rlz 554 base and sensitivity cases (i.e., a characteristic attribute of these boundary conditions that promote early containment failure conditions). The original case discharged 350 kg through the open PRT rupture disk but only 4.3 kg through the RCP seals. In contrast, the sensitivity case was more balanced with 256 kg through the PRT and 89 kg through the RCP seal SLOCAs. Both amounts were the majority of the total in

-vessel hydrogen generation. The depressurized primary system due to the stuck

-open pressurizer SV and the RCP seal SLOCAs in the sensitivity case were very effective at venting the hydrogen from the primary system to the containment. The subsequent burn with the first ignition produced a peak pressure that failed the primary containment.

Finally, Figure 4-131 shows the iodine and cesium environment release. As discussed previously, the environmental releases in the sensitivity case were higher than the base case. The lack of a failed hot leg release pathway in the sensitivity case for the released in

-vessel fission products meant more fission products and their decay heat was retained in the vessel. Prior to and following vessel failure, there a significant revaporzation and release of the volatile fission products to the containment, which led to a higher release to the environment in the sensitivity case (see Figure 4-132). The iodine and cesium environmental releases were ~70%

4-125 higher due to the impact of the vessel revaporization and release to the containment. The higher in-vessel revaporization was primary result of the absence of the hot leg failure in the sensitivity case, which may or may not result from the RCP seal SLOCAs.

In summary, the RCP seal SLOCAs only had a small effect on Rlz 21, which had a hot leg failure from high primary system pressure and a late containment failure. The timing of the key events and the source term to the environment were similar in the base case and the RCP seal SLOCA sensitivity case. The inclusion of RCP seal SLOCAs in the UA could certainly combine with some combinations of the pressurizer SV failures to promote a greater depressurization of the primary system prior to hot leg failure. Consequently, the impact could increase the hydrogen release to the containment prior to the first ignition source. However, as demonstrated by the Rlz 554 boundary conditions, an early containment failure requires an early pressurizer SV failure with a large SV failure area to create conditions necessary for an early containment failure. The stuck

-open SV is the dominant release pathway of hydrogen to the containment prior to the first ignition source. The amount of leakage from the RCP seal SLOCA is significantly smaller as compared to the pressurizer SV. Consequently, it is judge d the inclusion of the RCP seal SLOCA would not significantly impact the predicted early containment failure rate (i.e., dominated by the pressurizer SV failure attributes).

The RCP seal SLOCAs had a more significant effect on Rlz 554, which already had attributes that promoted a large hydrogen burn following the first ignition source. However, and most importantly, both the base and sensitivity cases resulted in an early containment failure with a relatively large source term. Therefore, the inclusion of RCP seal SLOCA also did not lessen the severity of the initial hydrogen burn. The RCP seal SLOCA in the Rlz 554 sensitivity calculation delayed the early containment failure due to complex interactions between the accumulator injection and the core melt progression. Although the base case had a hot leg failure and the sensitivity case did not, the in

-vessel hydrogen production and the subsequent hydrogen release to the containment prior to the first ignition source were comparable. The pressurizations from the burn following the first ignition source were also very similar.

Realization 554 sensitivity shows the maximum of four RCP seal LOCAs shifted some of the hydrogen leakage from the pressurizer SV to the RCP seal LOCA. However, the total leakage from the SV and the RCP seals was approximately the same. Even for this extreme condition of four RCP seal LOCAs, the total leakage through the stuck

-open SV was nearly three times larger than the RCP seal leakage. Consequently, the magnitude of the hydrogen leakage through the RCP seals alone was an insufficient amount to challenge the containment integrity in a burn. The addition of RCP seal LOCAs is only expected to have a secondary impact on the conditions necessary for an early containment failure. Due to the complications arising in the accident progression (e.g., avoiding hot leg failure), a UA with variable RCP seal failures would be necessary to better quantify and understand the impacts of variable amounts of RCP seal LOCA on the probability of early containment failure, which was not included in this study.

From this limited set of sensitivity cases, it is concluded that more realizations with RCP seal SLOCAs would generate similar percentages of early containment failures. If the RCP seal SLOCAs preclude hot leg failure, then the source term can be higher. Finally, it should be noted that UA simulations without RCP seal SLOCAs also include results without hot leg failure. Consequently, the RCP seal SLOCAs do not introduce new results (i.e., no hot leg failure) that were not previously calculated.

The gas leaking from the RCP seals was not considered as an ignition source in this study. However, a hot gas auto

-ignition source would be expected to be more important with a RCP 4-126 seal LOCA due to the faster inventory loss the recirculation loop. The key results from the Realizations 21 and 554 RCP seal LOCA sensitivity calculations were examined and are presented in Table 4-15 and Table 4-16. The progression of events in Realization 21 showed that any hot gas auto

-ignition source form the RCP seal LOCA would not occur until after hot leg failure. The gases exiting the RCP seal in the base case for Realization 21 remained relatively cool, but showed a spike of hot gas at 6 hr 16 min following the vessel pressurization from debris relocation into the lower plenum (i.e., well after the hot leg failure). The gases exiting the RCP seal in the Realizati on 21 sensitivity calculation also remained below the auto

-ignition temperature prior to hot leg failure, although close at the time of hot leg failure (i.e., within 20

°C, see Figure 4-133). In contrast, the trends for the base case without RCP seal LOCAs indicated the gas exiting the RCP seal was well below the auto

-ignition temperature prior to the hot leg failure (i.e., ~200°C). Table 4-15 Comparison of the Timing and Location of Hot Gas Autoignition Sources in the Realization 21 RCP LOCA Sensitivity Study No RCP Seal LOCA With RCP Seal LOCA Event Description Time (hh:mm) Time (hh:mm) 1st hydrogen deflagration 04:11 03:55 Containment failure 46:20 46:55 Selected MELCOR Results HL gas discharge becomes an ignition source 04:11 03:55 PRT gas discharge becomes an ignition source N/A N/A RCP seal gas discharge becomes an ignition source 06:16 N/A 4-127 Table 4-16 Comparison of theTiming and Location of Hot Gas Autoignition Sources in the Realization 554 RCP LOCA Sensitivity Study No RCP Seal LOCA With RCP Seal LOCA Event Description Time (hh:mm) Time (hh:mm) First hydrogen deflagration 04:22 08:10 Containment failure 04:22 08:10 Selected MELCOR Results Hot leg gas discharge becomes an ignition source 04:11 N/A PRT gas discharge becomes an ignition source N/A 08:10 RCP seal gas discharge becomes an ignition source N/A 03:35 Hydrogen discharged to the containment at the first possible hot gas auto

-ignition ignition source 358 kg at 04:11 338 kg at 03:35 Hydrogen discharged to the containment at the burn causing the containment failure 358 kg at 04:11 349 kg at 08:10 Amount of hydrogen in the dome at the first possible hot gas auto-ignition ignition source 213 kg at 04:11 112 kg at 03:35 Amount of hydrogen in the dome at the burn causing the containment failure 213 kg at 04:11 213 kg at 08:10 Figure 4-133 Comparison of the various hot gas auto

-ignition source in the containment for Rlz 21 RCP seal leakage sensitivity study.

However, the accident progression for Realization 554 suggested the RCP seal LOCA could be an important ignition source. In the RCP seal LOCA sensitivity calculation, the hot gas 3005007009001100130015001700 0 3 6 9Temperature (K)Time (hr)Auto-ignition SourcesAuto IgnitionSingle Loop RCP sealTriple Loop RCP sealPRT gas HL 4-128 temperature exiting the RCP seals exceeded the auto ignition threshold at 3 hr 35 min (see Figure 4-134). The amount of hydrogen discharged to the containment from all sources was 338 kg at the time of the first ignition source. As indicated in Table 4-16, the amount of hydrogen in the containment was only 20 kg lower than the base case and 11 kg lower than the RCP sensitivity case when the first simulated burns caused an early containment failure. The last two lines of Table 4-16 show the amount of hydrogen in the upper containment at the time of the potential ignition source from the RCP seal versus the amount in the first simulated ignition source. Although there was a similar amount of hydrogen in the containment at 3 hr 35 min versus 8 hr 10 min, the amount of hydrogen in the upper dome was significantly different. Consequently, a burn at 3 hr 35 min that propagated into the dome (i.e., a 5.1% hydrogen concentration) would not likely generate a peak pressure that would fail the containment. Over the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the hydrogen dome mass and concentration slowly increased to 213 kg and 10%, respectively, which would cause a significantly larger burn.

Figure 4-134 Comparison of the potential hot gas auto

-ignition source in the containment for Rlz 554 RCP seal leakage sensitivity study.

In summary, the hot gases exiting the RCP seal could be an auto

-ignition ignition source. In the two cases examined with RCP seal LOCAs, the realization with attributes for late containment failure (Rlz 21) showed that the RCP seal LOCA was close to becoming a hot gas ignition source at the time of hot leg failure. In the case with attributes for early containment failure (Rlz 554), the RCP seal LOCA could be the first ignition source but perhaps prior to an adequate time for the hydrogen to collect in the containment dome. In the bases cases from both realizations without RCP seal LOCAs, the gas exiting the RCP seal was not likely to be the first ignition source. Since the UA results that did not include RCP seal LOCAs, the omission of this ignition source is not expected to significantly affect the results. Nevertheless, it is recommended that the gas exiting the RCP should be included as an ignition source in future UA studies, especially when RCP seal LOCAs are considered uncertain. 3004005006007008009001000110012001300 0 3 6 9Temperature (K)Time (hr)Auto-ignition SourcesAuto IgnitionSingle Loop RCP sealTriple Loop RCP sealPRT gasHL (no failure) 4-129 4.8 LTSBO Accident Progression Analysis Similar to the STSBO, the LTSBO is initiated by a seismic event. The key differences in the scenarios include the availability of the turbine

-driven auxiliary feedwater pump (TDAFW) and some early operator actions; see Section 3.1.9 for further discussion. A set of LTSBO sensitivity cases were defined to explore the plant response to variations in the pressurizer and SG safety valve (SV) FTC, SV failure area parameters, TDAFW operation, battery life, and ignition sources. Table 4-17 lists the attributes of the various cases. Unless otherwise noted, the LTSBO sensitivity cases use the median values from the STSBO uncertainty distributions. Both the median and mean values are listed in Table 4-18 for comparison. However, the median values were considered as the best representation of a reference value for the LTSBO sensitivity analysis. As noted the Table 4-17, the limiting values for the SG and pressurizer FTC and failure area fraction were also examined.

To facilitate comparisons of the various cases, the LTSBO

-0 results will be initially described in Section 4.8.1. LTSBO-0 uses the median values of the uncertain variables used in the STSBO UA. It also uses the most common response explored for the TDAFW, which includes an over

-speed trip following the loss of DC power. LTSBO

-0 did not result in containment failure nor a significant release to the environment within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This was due to the substantial benefit of the TDAFW to extend the containment failure timing; all but one of the sensitivity calculations progressed to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months without containment failure. Consequently, the LTSBO

-0 radionuclide distribution presented in Section 4.8.2 does not include a characterization of the environmental release. Following the discussion of LTSBO

-0, the remaining cases are described in Section 4.8.3 to illustrate the impact of variations on uncertain parameters. Section 4.8.4 examines the impact of removing an early containment ignition source and the potential benefit of recovering the Hydrogen Mitigation System (HMS) (i.e., igniters) prior to the release of hydrogen to the containment. The slow progression of events in the LTSBO allows considerable time for recovery of the HMS. Finally, Section 4.8.5 examines the results of a reactor coolant pump (RCP) seal failure on the accident progression.

4-130 Table 4-17 Description of the key parameters varied in the LTSBO calculations Name Battery Life Przr SV FTC Przr SV FTC Area Single SG SV FTC 4 Single SG SV FTC Area TD-AFW Failure Igniters LTSBO-0 8 hr 720 0.1 146 0.1 Over-speed at DC failure No LTSBO-0a No + no PRT ignition LTSBO-0b Yes + no PRT ignition LTSBO-1 8 hr 1 (lower bound) 1.0 (upper bound) 146 0.1 Over-speed at DC failure No LTSBO-1a No + no PRT ignition LTSBO-1b Yes + no PRT ignition LTSBO-2 8 hr 720 0.1 146 0.1 Run at rated until flooded after DC failure No LTSBO-3 8 hr 720 0.1 146 0.1 Run on decay heat curve until CST is empty No LTSBO-4 8 hr 720 0.1 1 (lower bound) 1.0 (upper bound) Over-speed at DC failure No LTSBO-4a (no ARVs) LTSBO-5 4 hr 720 0.1 146 0.1 Over-speed at DC failure No Notes: 1. Unless as noted in the table above, all calculations will use median values for the uncertainty variables.

2. Unless noted above, successful operator actions include; Active level control after 15 min Start RCS cooldown at 60 min (i.e., except LTSBO

-4a) Shift to decay heat TDAFW injection flowrate after 4 hr (i.e., MELCOR modeling simplification)

3. Unless noted above, unsuccessful operator actions include; Failure to control the TDAFW after the DC batteries are exhausted (i.e., except LTSBO

-3). 4. All secondary valve failures applied to the single loop; see Footnote 27 in Section 3.1.2.

4-131 Table 4-18 Description of the Uncertainty Parameter Distributions and the Reference Values used in the LTSBO Calculations Uncertain Parameter Distribution type Distribution Parameters Lower Bound Upper Bound LTSBO Reference Value Sequence Related Parameters Primary SV stochastic FTC (priSVcycles)

Binomial, Negative Binomial Integrated two

-step distribution for first cycle FTC + subsequent cycles FTC. 1 - Median is 720 UA mean is 1.607e+06 Secondary SV stochastic FTC (secSVcycles)

Negative Binomial Integrated two

-step distribution for first cycle FTC + subsequent cycles FTC. 1 - Median is 146 UA mean is 1.306e+05 Primary SV open area fraction (priSVfrac) 4 section piecewise probability Bin Prob. 0.01 1 Median is 0.1 UA mean is 0.4 0.0 - 0.1 50% 0.1 - 0.3 10% 0.3 - 0.9 10% 0.9 - 1.0 30% Secondary SV open area fraction (secSVfrac) 4 section piecewise probability Bin Prob. 0.01 1 Median is 0.1 UA mean is 0.4 0.0 - 0.1 50% 0.1 - 0.3 10% 0.3 - 0.9 10% 0.9 - 1.0 30% In-Vessel Accident Progression Time in the Cycle 3 section piecewise probability Bin Prob. - - Median is MOC UA mean is MOC BOC 11.5% MOC 50.0% EOC 38.5% Melting temperature of the zircaloy oxide and uranium oxide (EU_melt_T)

Normal UA mean: 2479 K

- - Median is 2479 K UA mean is 2481 k Oxidation Kinetics Correlation (Ox_Model)

Discrete Bin Prob. - - Median is Leistikov-Schanz/ Prater-Courtright UA mean is Leistikov-Schanz/ Prater-Courtright Urbanic-Heidrich 25% Cathcart-Pawel/ Urbanic-Heidrich 25% Leistikov-Schanz/ Prater-Courtright 50%

4-132 Uncertain Parameter Distribution type Distribution Parameters Lower Bound Upper Bound LTSBO Reference Value Ex-Vessel Accident Progression Lower Flammability Limit (LFL) hydrogen ignition criteria with an obvious ignition source in the lower containment (H 2 LFL). Set up for downward, upward, and horizontal.

(burn_dir)

Discrete Bin Prob. - - Median is Horizontal (6.5%) UA mean is Horizontal (6.5%) Upward (~4%) 0.33 Horizontal

(~6.5%) 0.33 Downward (~9%) 0.33 Containment Behavior Containment fragility curve (CFC) (rupture) Triangle Mode: 67 psi 52 psi 78 psi Median is 67 psi UA mean is 66 psi Barrier Seal Open Area (Seal_Open_A)

Discrete Bin Prob. 0.054 1.893 Median is 1.117 m 2 UA mean is 1.12 m 2 0.054 0.034 0.068 0.005 0.192 0.015 0.304 0.024 0.321 0.026 0.325 0.026 0.622 0.149 0.676 0.054 0.894 0.071 1.012 0.081 1.117 0.089 1.732 0.276 1.893 0.151 Barrier Seal Failure Pressure (Seal_Fail_Dp) 3-section piecewise probability Bin Prob. 15 60 UA Median is 35 psid UA mean is 34.7 psid 15-30 psid 30% 30-45 psid 60% 45-60 psid 10% Ice Condenser Doors Open Fraction Unitless (ajar)

Linear 0.5 1.0 Median is 0.75 UA mean is 0.75 Aerosol Transport and Deposition Dynamic Shape Factor Unitless (shape_factor)

Scaled Beta 2 1.0 5.0 Median is 1.5 UA mean is 1.68 4-133 LTSBO Accident Progression The accident scenario initiates with a complete loss of all onsite and offsite AC power, but the DC station batteries are available. Table 4-19 summarizes the sequence of events. The reactor successfully scrams, but all powered safety systems are unavailable except the TDAFW. Upon closure of the main steam isolation valves, the secondary system pressurizes, which opens the SG SVs to relieve pressure. The SVs open at ~6 seconds and cycle twice in the first minute. The SG SV median FTC is 146 cycles, so SVs remain operational after the initial transient. The SG starts to depressurize following the start of the TDAFW at one minute, which stops further SV cycling.

The 120 AC bus for the TDAFW is automatically powered by the DC batteries through a DC to AC inverter. All the valves needed for TDAFW injection are automatically aligned to an open position following the loss of AC power, including one of the two steam lines to the steam turbine (see Section 3.1.9). The emergency procedures direct the operator to immediately establish feedwater flow using TDAFW, which is done by controlling the trip throttle valve (TTV) from the TDAFW panel in the control room. TVA uses the TTV to control the steam flow to the TDAFW. The TTV is a motor

-operated valve that can be operated from the control room. The TDAFW is initially at minimum flow. Due to the sharp level shrinkage following the reactor trip, the operators initially increase to the TDAFW to rated flow, which is specified to occur at one minute.

4-134 Table 4-19 Timing of key events for Case LTSBO

-0 Event Description Time (hh:mm) Initiating event Station blackout

- loss of all onsite and offsite AC power 00:00 MSIVs close Reactor trip RCP seals initially leak at 21 gpm/pump 00:00 First SG SRV opening (~6 sec) 00:00+ TDAFW increased to rated flow 00:01 Operators control TDAFW to maintain level 00:15 Operators initiate controlled RCS cooldown of secondary at ~100 oF/hr 01:00 Accumulators begin injecting 02:11 SG cooldown stopped at 200 psig to maintain TDAFW flow 03:47 TDAFW control changed to decay heat mode (MELCOR modeling simplification) 04:00 DC Batteries Exhausted 08:00 SG ARVs reclose & TDAFW governor valve fully opens 08:00 TDAFW TTV closes on mechanical over

-speed trip (assumed to occur at 08:00) 08:00 1% of the ice melted 09:01 Triple SG SV s open 12:32 Single SG SV opens 12:44 Triple SG water inventory gone 18:42 Single SG water inventory gone 18:46 Pressurizer SV first opens 19:37 PRT rupture disk opens 19:53 Water level below top of active fuel 20:07 First fission product gap releases 23:43 Creep rupture failure of the HL nozzle in combined loop 24:40 Ice condenser lower plenum doors stick open (75% area) 24:41 Accumulator empty 24:42 1st hydrogen deflagration 26:07 Containment water level reaches bottom of the PRT (65% ice melt) 27:35 Initial core plate failure 27:45 Vessel lower head failure by creep rupture 30:50 Debris discharge to reactor cavity 30:50 Containment fabric seals fails due to high temperature 30:50 100% of the ice melted 35:20 Containment failure due to long

-term heating and over

-pressurization

>72:00 Selected MELCOR Results Debris mass ejected (1000 kg) 162 In-vessel hydrogen generated (kg) 353 Iodine release fraction at 72 hr 4.37E-7 Cesium release fraction at 72 hr 1.64E-7 4-135 The level control valves (LCVs) to the SGs fail to an open position upon the loss of AC power. However, LCVs are pneumatic valves that require the plant air (i.e., AC power) or a manual connection of the remote air bottles for individual operation. Consequently, the SG levels are controlled by adjusting the speed of the turbine via the TTV and manually closing LCVs as required to stop feedwater flow to individual generators. The manual control of the TTV is assumed to start at 15 minutes. The TDAFW control is expected to be somewhat challenging as evidenced in the MELCOR calculations. The TDAFW supplies water to the feedwater header, which flows into the SGs according to the pressure drop from the pump header to the individual SGs. The operators only use one SG as the steam supply for the TDAFW (i.e., requires a manual operator action to open a second valve), which will lower the pressure in this SG relative to the others. Consequently, the TDAFW injection fills the lowest pressure SG more quickly. The relative injection rate to the lowest pressure SG(s) increases further as the higher flow decreases boiling (i.e., by subcooling), which further increases the depressurization rate. Hence, there can be asymmetric filling of the SGs.

The TDAFW control logic used in the first 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ensures that the TDAFW header pressure is greater than the highest SG pressure and the feedwater flow is maintained to all 4 SGs. This logic was particularly important during the RCS cooldown. If a SG stopped receiving feedwater flow, then the boiling rate would increase, which slowed or stopped the depressurization. In actual practice, the system pressure of the affected SG could be adjusted by increasing the ARV flowrate. However, the logic simulating operator actions did not have this level of sophistication. The simulated operator control logic was specified to follow the decay heat curve after 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months as a modeling simplification. In the decay heat modeling mode, the TDAFW is regulated to match the decay heat power without explicit level control logic.

Between the start of TDAFW (1 min) and the start of the RCS cooldown (60 min), the SGs are refilled with cold feedwater, which cools the primary system. The RCS cooldown starts at 1 hr by opening the ARVs on the SGs (see Section 3.1.10 for a discussion on operator actions). The DC batteries power sufficient instrumentation to monitor the RCS cooldown (i.e., not greater than 100°F/hr).

The primary and secondary system pressure response is shown in Figure 4-135. In contrast to the STSBO, the start of the cold feedwater via the TDAFW stops the initial SG SV cycling. Then the RCS cooldown using the SG ARVs and TDAFW further depressurizes the primary and secondary systems after 1 hr. The SGs reach 1.38 MPa (200 psia) at 3.9 hr and the operators throttle the ARVs to limit any further depressurization. The primary system pressure is 2.13 MPa (~310 psia) at 3.9 hr and slowly decreases to 1.59 MPa (~230 psia) by 8 hr while the secondary pressure is held constant. The p r imary s y s tem depressurization ha s two benefits of reducing the inventory loss by the l eakage throu g h the RCP se als. First, the RCP seal leakage rate decreases with the decreasing primary system pressure. Second, the injection from the accumulators starts when the system pressure decreases below 4.4 MPa (~640 psia) at 2.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The accumulator injection continues intermittently until 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Approximately 23% of the water inventory is discharged into the RCS. The remainder of the accumulator inventory (77%) is discharged at 24.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months in response to the rapid primary system depressurization following the hot leg (HL) failure (see Figure 4-136). The difference in the single SG and the triple SG pressures prior to depress urization is due to drawing steam from the single SG to run the TDAFW turbine and the higher resulting feedwater flow rate to the single SG.

4-136 Figure 4-135 Case LTSBO

-0 primary and secondary pressure history 58 Figure 4-136 Case LTSBO

-0 accumulator injection

58 SG1 refers to the single SG and SG3 refers to the triple (lumped) SG. See Section 3.1.10 for a discussion of the approach used to model the operator actions within the limitations of the single and lumped loop nodalization.

050010001500200025003000 0 612182430Pressure (psi)Time (hr)Pressurizer PressurePressurizer SG 1 SG 3Start ofRCS cooldownDC failsTDAFW over

-revs and failsSG dryoutHL failure 0 5101520253035 0 612182430Injected (m 3/accumulator)Time (hr)Accumulator InjectionInitialwater inventoryHot Leg failure 4-137 When the station batteries exhausted at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , all instrumentation is lost.

59 Two key events occurred in the LTSBO

-0 case. First, the TDAFW governor valve opens fully following the loss of power. The steam flow to the turbine is expected to increase. If the turbine speed gets too high, a mechanical over

-speed trip will close the TTV, which stops all TDAFW flow. The TTV closure is assumed to occur at 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The second event is closure of the ARVs. The ARV response is less certain because the ARVs can be opened using hand cranks (SGs #1 and #4) or remote air bottles (SGs #2 and #3).

By 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , the operators would be cycling the valves between partially open and closed to maintain pressure. However, the operators will have no guidance on the system pressure without instrumentation. The termination of the feedwater flow decreases the SG water subcooling, which increases the steam production. Consequently, the SG will pressurize without further adjustments to the ARVs. As a simplifying assumption, the ARVs are closed after 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to maintain inventory, which starts a pressurization of the secondary system (see Figure 4-135). The single and lumped SG SVs start to cycle at 12.5 hr and 12.7 hr, respectively (Figure 4-137). The SG SV cycling controls the SG pressure rise but also vents away the remaining secondary system water inventory. All the water in the SGs is completely vented by 18.8 hr. The SVs cycled 93 and 89 times (well below the median SV FTC value of 720 cycles), respectively for the single and lumped SGs (Figure 4-137). Consequently, the SVs operated until all the SG water inventory was completely vented. Subsequently, the SGs slowly depressurized due to leakage through the main steam isolation valves (see Figure 4-137). Following the loss of heat removal from the SGs, the primary system pressurized to the pressurizer SV opening set point at 19.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The pressurizer SV began cycling, which vents steam from the primary system into the PRT in the containment. The water in the PRT was heated by the steam from the RCS. As the pressurizer SV cycling continued, the PRT pressurized until the rupture disk opened at 16 min after the start of the SV cycling. The RCS water level decreased to the top of the active fuel at 20.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (see Figure 4-138). The pressurizer SV continued cycling, which steadily removed water from the RCS and started an uncovery of the fuel (see Figure 4-138). The fuel cladding pressure boundary is predicted to fail when the fuel heats above 1173 K at 23.7 hr. The cladding failure allowed an immediate release of the mobile fission products in the fuel gas gap and the start of thermally

-driven radionuclide releases.

59 TVA has provisions to manually establish individual measurements with remote connections and portable power and/or use charts for guidance on flowrates versus time.

4-138 Figure 4-137 Case LTSBO

-0 secondary system water level and valve history Figure 4-138 Case LTSBO

-0 primary system water level history 0102030405060708090100 0 2 4 6 810121416 0 6121824SV Cycles (-)Level (m)Time (hr)Steam Generator Level and SV CyclesSG 1 levelSG 3 levelSG 1 SV #1 cyclesSG 3 SV #1 cycles 0 3 6 91215 012243648Level (m)Time (hr)RPV Collapsed LevelVessel TopTop Active FuelBottom Active FuelStart of FP ReleaseCollapsed LevelHL failure and Accumulator InjectionRCS cooldown 4-139 During the core uncovery, natural circulation patterns developed within the vessel and between the vessel and the SG. The natural circulation flow patterns transferred heat from the uncovered fuel to upper vessel structures, the HL, and the SG tubes (see Figure 4-139).60 The slow heat-up of core to 1250 K from 20 to 24.7 hr resulted in a relatively tight coupling between the peak fuel temperature and the hot leg structure. The heatup was driven by decay power because the fuel remained below temperatures where oxidation starts increasing (see Figure 4-141). The low and steadily decreasing decay power at the time of the core uncover in the LTSBO contributed nearly linear heating of the fuel and the surrounding structures.

The HL creep rupture index grew from 2% at 24 hr to failure (100%) at 24.7 hr as the HL temperature increased from 975 K to 1050 K (Figure 4-140) while cycling on the pressurizer SV at high pressure (P HL=16 MPa). The HL piping failed at 24.7 hr when the creep index reached 100%. The failure of the HL piping creates a large rupture that immediately depressurizes the primary system (see Figure 4-135). The core is reflooded (see Figure 4-138) when the remaining accumulator water (see Figure 4-137) injects into the RCS. The accumulator water cools the fuel (see Figure 4-142). The intact fuel structure at the time of accumulator discharge permitted an effective flooding and cooling of the fuel (see Figure 4-143).61 A second boiloff occurs with complete core degradation following the temporary cooling from the accumulator injection. A debris bed forms in the core which leads to the core plate failure in Ring 3 at 27.8 hr. The remaining peripheral regions of the core collapse by 28.1 hr (see Figure 4-142). The core debris relocates onto the lower plenum structures, which also degrade and fail. The remaining water in the lower plenum initially offers some cooling of the relocated debris but is completely boiled away by 29.3 hr. At low pressure due to the HL failure, the vessel lower head heats to melting conditions at the inside surface before the lower head fails due to through

-wall yielding at 30.8 hr. Subsequently, the debris relocates to the reactor cavity.

The containment pressure remains relatively low until the failure of the PRT rupture disk at 19.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months (see Figure 4-144). The containment pressure gradually increases as the coolant (and later hydrogen) is discharged from the vessel. The small containment pressurization following PRT rupture disk failure leads to the flow of the steam into the ice bed, which increases the ice melting rate (see Figure 4-145). The containment pressurization as a result of the HL failure at 24.7 hr caused the lower ice compartment doors to swing fully open. It is assumed that the hinges deform on 75% of the doors, which prevents their closure. Thereafter, a natural circulation developed between the lower containment and the ice compartment.

60 Failure of steam generator tubes is not modeled in this effort.

61 In other simulations that included a stuck

-open pressurizer SV prior to HL failure, the core was degraded and not effectively cooled. The stuck

-open pressurizer SV accelerated the core uncovery while delaying HL failure due to the decrease in differential pressure. Consequently, the core was degraded into a debris geometry at the time of the accumulator injection, see Section 4.8.3.

4-140 Figure 4-139 Case LTSBO

-0 peak cladding, core and hot leg gas, and hot leg wall temperature history.

Figure 4-140 Case LTSBO

-0 hot leg creep rupture failure index.

30050070090011001300202122232425Temperature (K)Time (hr)Maximum CL Temp.CVH-TVAP.500CVH-TVAP.600CVH-TVAP.386HS-TEMP.5000102HS-TEMP.5000202HS-TEMP.6000102HS-TEMP.6000202Hot leg (Carbon and SS) temperaturesPCTVessel exit and top of the hot legsAccumulator dump at HL creeprupture0%10%20%30%40%50%60%70%80%90%100%202122232425Creep Index (%)Time (hr)Hot Leg Creep Rupture Index 4-141 Figure 4-1 41 Case LTSBO

-0 decay heat and oxidation power.

Figure 4-142 Case LTSBO

-0 peak fuel and debris history.

0 5 10 15 20 25 30 35 40 45 50 20 21 22 23 24 25Power (MW)Time (hr)Decay Heat and Oxidation Powers Decay heat powerOxidation power 050010001500200025003000 012243648Temperature (K)Time (hr)Peak Cladding and Maximum Debris TemperatureCladdingMax DebrisStart of FP ReleaseHot Leg failureVessel Lower Head FailureHL failure and Accumulator InjectionPeriperal regions of the core collapse 4-142 Figure 4-143 Case LTSBO

-0 core structure at HL failure.

Figure 4-144 Case LTSBO

-0 containment pressure history. 0 1 2 3 4 5 6 7 0244872Pressure (bar)Time (hr)Containment PressureBest-estimate failure pressureFragility RangePRT rupture disk opensHL failure & barrier seal failureVessel failure 24 hr 40 min Complete core uncover prior to HL creep rupture failure 24 hr 42 min Core reflood following HL creep rupture failure

4-143 Figure 4-145 Case LTSBO

-0 ice melting history.

The response of the ice is shown in Figure 4-145. In the absence of containment cooling, the flow of gases through the lower plenum doors results in some melting of the ice (~3%) by the time the PRT rupture disk fails. The discharge of the coolant during the cycling of the pressurizer SV causes more melting of the ice until the HL fails (i.e., 23%). The melting rate of the ice increases after the HL failure as the gases circulate through the ice chest. 83% of the ice had melted at the time of the vessel lower head failure. The flow of hot gases from the cavity and the lower compartments melted the remaining ice by 35 hours4.050926e-4 days 0.00972 hours 5.787037e-5 weeks 1.33175e-5 months . There is only 38 kg of in

-vessel hydrogen production (see Figure 4-146) prior to the HL failure. Upon HL failure, most of the hydrogen inside the RCS is rapidly discharged to the containment. However, there was insufficient hydrogen in the containment following HL failure to satisfy the hydrogen burn criteria.

62 During the second in

-vessel fuel heatup following the accumulator discharge, more hydrogen is generated and the first burn occurs at 26.1 hr. Many small burns occurred until 38.1 hr when the oxygen concentration drops below 5% and is inadequate to support further burns.

62 Case LTSBO

-0 used a minimum hydrogen concentration of ~6.5% for combustion, but is still dependent on additional criteria such as temperature and local steam concentration.

0%10%20%30%40%50%60%70%80%90%100%012243648Fraction Melted (%)Time (hr)Ice MeltStart of FP ReleaseIce MeltPRT rupture disk opensHot Leg failureVessel failure 4-144 Figure 4-146 Case LTSBO

-0 in-vessel hydrogen generation.

The hot d ebris in the r eactor cavi t y started to ablate the concr ete soon after lower head failure as shown in Figure 4-147. The e x-vessel CCI continued f or the r emainder of the cal culation, which g e ne r ated combustible (H 2 and CO) and other non-combustible (i.e., CO 2) g ases. The combustible gases from CCI contributed to the continued burning in the containment through 38.1 hr until the containment was oxygen limited (<5%), 63 see Figure 4-144. The CCI had two effects that led to the long

-term pressurization of the containment. First, the CCI created non

-condensable gases that pressurized the containment. Second, the hot gases exiting the reactor cavity heated the containment atmosphere, which evaporated water from the pool in the lower containment. By 72 hr, the partial pressure of the steam and the carbon

-dioxide represented over 50% of total containment pressure of 3.89 bar (~56 psia).

The lower containment water level steadily rises as the ice melts (see Figure 4-147). The water level reaches the bottom of the PRT at 27.6 hr when 65% of the ice had melted. The maximum lower containment level is 2.7 m above the bottom of the lower containment floor.

64 The lower containment water remains outside of the reactor cavity because the lowest pathway is 4 m above the bottom of the floor (i.e., the cold leg penetrations through the reactor cavity wall). Soon after lower head failure and the discharge of the debris to the cavity, the debris temperature started to gradually decrease as a result of heat transfer to the concrete basemat and heat loss from the top of the debris bed. However, the debris remained above the concrete

63 The oxygen inerting below 5% is a combination of oxygen consumption during combustion and the pressurization of the containment by CCI gases.

64 The MELCOR nodalization specifies +0 m as bottom inside surface of the reactor vessel. The bottom of the lower containment is at 3.42 m and the bottom of the reactor cavity is

-4.8 m. 0100200300400500 012243648Mass Generated (kg)Time (hr)In-vessel Hydrogen GenerationHL failure and Accumulator Injection 4-145 ablation temperature through 72 hr. The ablation depth was slightly over 1 m by the end of the calculation.

Figure 4-147 Case LTSBO

-0 containment water level and concrete ablation history.

LTSBO Radionuclide Behavior Figure 4-148 and Figure 4-149 show the fission product distributions of the iodine and cesium r adionuclides that were r e le ased f rom the f uel, re spective l y. Appro ximately 95% of the iodine and 96% of cesium were r e le a s e d f rom the fu el during the in

-v essel degradation phase while the remaining amount w a s r e le a s e d e x-vessel during CCI. The fission product re l eases from t h e f uel started following the first f ailures of the fuel c ladding at 23.7 hr, or about 3.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the unco v e r y of the top of the fuel rods (see Figure 4-138). The in-vessel fission product rel ease pha s e continued until 32 hr or about 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after lower head failure when the debris relocation from the vessel to the cavity.

05001000150020002500-6-3 0 3 6 9 0244872 Ex-vessel Debris Temperature (K)Elevation (m)Time (hr)Containment Water Levels and Ex

-vessel Debris TemperatureLower ContainmentPRT BottomReactor CavityDebris Ablation depthElev of spill to cavityDebris temperatureAblation depthPRT rupture disk opensHot Leg failure Ex-vessel debris temperatureVesselfailureNo water in the reactor cavity 4-146 Figure 4-148 Case LTSBO

-0 Iodine fission product distribution history.

Figure 4-149 Case LTSBO

-0 Cesium fission product distribution history.

0.00.10.20.30.40.50.60.70.80.9 0244872Fraction of Initial Inventory (-)Time (hr)Iodine DistributionStart of FP ReleaseIn-VesselPRTContainment depositedContainment airborneEnvironmentNegligiblemass in PRT or environmentHot Leg failure Ex-vessel release followingvessel failure0.00.10.20.30.40.50.60.70.80.9 0244872Fraction of Initial Inventory (-)Time (hr)Cesium DistributionStart of FP ReleaseIn-VesselPRTContainment depositedContainment airborneEnvironmentNegligiblemass in PRT or environmentHot Leg failure Ex-vessel release followingvessel failure 4-147 There was very little fission product release prior to the HL failure. For example, only about 4.5% of the iodine and cesium inventory was released from the fuel at the time of the HL failure. A significant portion of the released iodine and cesium (~3%) was transported out the cycling pressurizer SV to the PRT. The remainder of the fission p ro duct rele a s es from the fu e l circulated thro u g h t he RCS. Following the HL failure, all the airborne fission products in the RCS were immediately discharged into the containment and all further discharges to the PRT stopped. During the second fuel heatup, after the accumulator discharge, the majority of the radionuclides were released from the fuel. As shown in Figure 4-148 and Figure 4-149, most of the iodine and cesium went out the HL failure to the containment where it settled. There was essentially no release to the environment because the containment was still intact at 72 hr (see Table 4-19). Any environmental release following a containment pressurization beyond 72 hr is also expected to be very low due to the significant amount of time for gravitational settling.

LTSBO Accident Progression Sensitivity Calculations This section presents the results of the LTSBO calculations. As described in Table 4-17 and summarized in Table 4-20, the various LTSBO cases changed the pressurizer and SG SV failure characteristics as well as the TDAFW availability after the DC power fails. The parameter variations were selected to explore their impact on the timings to core damage and containment failure. The timings of the key events, in

-vessel hydrogen production, and the maximum containment pressure are summarized in Table 4-21. All LTSBO cases presented in this section progressed through 72 hr without containment failure. Consequently, there are no environmental source term results. However, Section 4.8.4 includes an ignition sensitivity calculation on Case LTSBO

-1 that caused an early containment failure near the time of the vessel failure. The key results of the LTSBO accident progression calculations are compared in Figure 4-1 50 through Figure 4-158. Table 4-20 Summary of key LTSBO case differences Case Description LTSBO-0 All uncertain variables at the median value, TDAFW over-speeds upon the loss of DC power. LTSBO-1 Same as LTSBO

-0 but the pressurizer SV sticks fully open on 1st cycle LTSBO-2 Same as LTSBO

-0 but TDAFW runs at rated after the loss of DC power until SG is flooded.

LTSBO-3 Same as LTSBO

-0 but TDAFW runs until the CST is empty.

LTSBO-4 Same as LTSBO

-0 but a SV on the single SG sticks fully open on the first cycle LTSBO-5 Same as LTSBO

-0 but station batteries run out at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

4-148 Table 4-21 Results of the LTSBO calculations Parameter LTSBO-0 LTSBO-1 LTSBO-2 LTSBO-3 LTSBO-4 LTSBO-5 Single SG SV sticks open n/a n/a n/a n/a 6 sec n/a DC batteries fail 8.0 hr 8.0 hr 8.0 hr 8.0 hr 8.0 hr 4.0 hr TDAFW stops 8.0 hr (over-speeds) 8.0 hr (over-speeds) 10.3 hr (flooded) 27.8 hr (CST empty) 8.0 hr (over-speeds) 4.0 hr (over-speeds) PRT rupture disk opens 19.9 hr 19.6 hr 30.8 hr 39.4 hr 22.9 hr 15.6 hr RPV level < TAF 20.1 hr 19.7 hr 30.6 hr 39.2 hr 23.3 hr 16.1 hr Start of cladding failure 23.7 hr 20.4 hr 35.0 hr 44.7 hr 27.1 hr 19.7 hr Pressurizer SV sticks open n/a 19.6 hr n/a n/a n/a n/a PRT becomes ignition source n/a 22.8 hr n/a n/a n/a n/a HL failure 24.7 hr 24.4 hr 35.8 hr 45.3 hr 27.9 hr 20.3 hr Lower ice compartment doors fail open 24.7 hr 22.8 hr 35.8 hr 45.3 hr 27.9 hr 20.3 hr First burn 26.1 hr 22.8 hr 37.5 hr 46.9 hr 29.3 hr 21.6 hr Vessel lower head failure (VF) 30.8 hr 28.1 hr 41.9 hr 51.7 hr 33.8 hr 25.3 hr Barrier seal failure 30.8 hr (high temp)

A 22.8 hr (high temp)

A 40.3 hr (high temp)

A 51.9 hr (high temp)

A 37.3 hr (high temp)

A 23.9 hr (high temp)

A Containment failure n/a n/a n/a n/a n/a n/a Containment pressure at 72 hr 3.89 bar 3.66 bar 3.18 bar 2.53 bar 3.58 bar 4.60 bar Remaining CST inventory 45% (412 m

3) 45% (412 m

3) 13% (118 m

3) Empty 43% (394 m

3) 56% (502 m

3) In-vessel Hydrogen Production 353 kg 446 kg 342 kg 326 kg 294 kg 313 kg Hydrogen produced before the first burn 93 kg 390 kg 88 kg 88 kg 74 kg 74 kg A. The barrier seal failure occurred due to the temperature

-pressure criteria instead of sampled differential pressure failure criterion (i.e., Seal_Open_A, see Section 3.8). Both failure modes are monitored during the calculations.

4-149 Figure 4-150 LTSBO-0 through LTSBO

-5 reactor pressurizer pressure responses.

Figure 4-151 LTSBO-0 through LTSBO

-5 reactor level responses.

0 2 4 6 8101214161820 0244872Pressure (MPa)Time (hr)Pressurizer PressureLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5 0 2 4 6 8101214 0244872Level (ft)Time (hr)RPV Collapsed LevelLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5TAFBAFBottom of the Active FuelTop of the Active FuelInterface to the upper head 4-150 Figure 4-152 LTSBO-0 through LTSBO

-5 single steam generator pressure responses.

Figure 4-153 LTSBO-0 through LTSBO

-5 lumped triple steam generator pressure responses.

0 1 2 3 4 5 6 7 8 0244872Pressure (MPa)Time (hr)Single Steam Generator PressureLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5 0 1 2 3 4 5 6 7 8 0244872Pressure (MPa)Time (hr)Triple Steam Generator PressureLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5 4-151 Figure 4-154 LTSBO-0 through LTSBO

-5 single steam generator level responses.

Figure 4-155 LTSBO-0 through LTSBO

-5 lumped triple steam generator level responses.

0 2 4 6 8101214161820 012243648Level (m)Time (hr)Single Steam Generator LevelLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5Spillinto the main steam line, TDAFW failsCSTempty 0 2 4 6 8101214161820 012243648Level (ft)Time (hr)Triple Steam Generator LevelLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5Spillinto the main steam line, TDAFW failsCSTempty 4-152 Figure 4-156 LTSBO-0 through LTSBO

-5 accumulator injection responses.

Figure 4-157 LTSBO-0 through LTSBO

-5 in-vessel hydrogen production results.

0 5101520253035 012243648Injected (m 3)Time (hr)Accumulator InjectionCapacityLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5 050100150200250300350400450500 0244872Mass (kg)Time (hr)In-vessel Hydrogen ProductionLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5 4-153 Figure 4-158 LTSBO-0 through LTSBO

-5 containment pressure responses.

The response of LTSBO

-0, which was described in Section 4.8.1, is compared to the other LTSBO cases. In LTSBO

-1, the pressurizer SV fails on the 1 st opening. Since the first pressurizer SV opening does not occur until 19.6 hr, the early response is identical to LTSBO

-0. Initially there is a sharp depressurization of the primary system when the pressurizer SV sticks fully open (see Figure 4-1 50). After the accumulators start injecting at 21 h (see Figure 4-156), the primary system depressurization slows when accumulator water is vaporized in the hot core. The primary system pressure oscillates above 1 MPa (~145 psia) with periodic accumulator injections. Although the primary system is at low pressure, natural circulation of the hot gases eventually leads to the HL failure at 24.4 hr. In contrast, LTSBO

-0 pressurized to the SV opening setpoint at 17 MPa (~2465 psia) until HL failure at 24.7 hr, or at approximately the same timing as LTSBO

-1. The stuck

-open pressurizer SV valve in LTSBO

-1 did accelerate the start of fission product timing by 3.3 hr relative to LTSBO

-0. LTSBO-1 had the highest hydrogen generation of the five cases at 446 kg (see Figure 4-157). LTSBO-1 is the only case where the PRT became an ignition source for combustion in the containment (see Table 4-21). Unlike the other cases, the stuck

-open pressurizer SV vented hot gases to the PRT during the entire core degradation phase (i.e., L T SBO-1 is the only case with nearly complete volatile radionuclide release prior to HL failure). A significant portion of the fission products released from the fuel prior to the HL failure were transferred to PRT, see Figure 4-159. In contrast, only a small amount of the volatile fission products was released prior the HL failure in LTSBO

-0. In both cases, the hole in the HL was the fission product release pathway to the containment after HL failure. The larger amount of fission products released and captured in the PRT water in LTS BO-1 led to a boil

-off of the water. After the water was gone, the decay heat from the radionuclides caused the gas temperature to rise above the hydrogen auto-ignition temperature at 22.8 hr (see Figure 4-160), which was the first ignition source in 0 1 2 3 4 5 6 7 0244872Pressure (bar)Time (hr)Containment PressureFailure MaxFailure MedianFailure MinLTSBO0LTSBO1LTSBO2LTSBO3LTSBO4LTSBO5 4-154 LTSBO-1. The containment pressure rise from the hydrogen burn (3.88 bar - 56.3 psia) was larger than the other cases but insufficient to fail the containment (see Figure 4-158).65 Figure 4-159 Comparison of LTSBO

-0 and LTSBO

-1 Iodine and Cesium in the PRT.

65 The LTSBO calculations used the median containment failure pressure from the uncertainty distribution. The minimum and maximum failure pressures are also shown on Figure 4-158. None of the early pressurizations from hydrogen burns reached the minimum containment failure pressure from the uncertainty distribution.

0.00.10.20.30.40.50.60.70.80.91.0 0244872Fraction of Initial Inventory (-)Time (hr)Iodine and Cesium in the PRTLTSBO1 - I in the PRTLTSBO1 - Cs in the PRTLTSBO0 - I in the PRTLTSBO0 - Cs in the PRTLTSBO0 results 4-155 Figure 4-160 Comparison of LTSBO

-0 and LTSBO

-1 PRT levels and gas temperatures.

LTSBO-2 and LTSBO

-3 are examples of continued TDAFW injection after the loss of DC power. These two cases had timings to core damage of 11.3 hr and 21 hr after LTSBO

-0, respectively. Following the loss of DC power, the operators would attempt to maintain and control the TDAFW injection, and is expected to be challenging. All the other cases assumed the TDAFW fails following the loss of DC power. If the operators successfully controlled the TDAFW injection, then the LTSBO

-3 results show that start of core damage could be delayed until 44.7 hr. Furthermore, the ERCW could be aligned to further extend the injection time.

Without instrumentation following the loss of DC power, it is conceivable that the SGs could be flooded. LTSBO

-2 shows a possible response where the TDAFW runs without over

-speeding until water spills over into the main steam lines and into the steam line to the TDAFW. The TDAFW is assumed to fail once water starts flowing through the steam turbine. However, recent forensic analysis of Fukushima Daiichi Unit 2 accident suggests the reactor core isolation cooling (RCIC) steam turbine ran for ~68 hours with water entering the turbine [126]. Consequently, the TDAFW operation for LTSBO

-2 does not bound the maximum TDAFW operational time. Unlike the BWR RCIC system, which can operate in recirculation mode, the Sequoyah TDAFW injection is ultimately limited by the external water supply. LTSBO

-3 provides an example of the injection being limited by available water in the CST. LTSBO

-2 and LTSBO

-3 provide examples of scenario variations that could further extend the timing to an environmental radionuclide release.

LTSBO-4 simulated a stuck

-open SG SV on the first cycle, which occurred at 6 sec. This led to an immediate depressurization of the single SG (see Figure 4-152), which also depressurized the primary system (see Figure 4-1 50) and the other 3 SGs (see Figure 4-153). The fast primary system depressurization led to the earliest start of accumulator injection (see Figure 4-156). The 0250500750100012501500 0 1 2 3 0244872Gas Temperature (K)Water Level (m)Time (hr)PRT Water Level and Gas TemperatureLTSBO1 - PRT levelLTSBO0 - PRT levelLTSBO1 - PRT tempLTSBO0 - PRT tempAuto-ignition tempPRT has boiled dry in LTSBO1Exit gas temperature > auto

-ignition temperature in LTSBO1 only 4-156 TDAFW was controlled to maintain injection to triple SG (see Figure 4-155) in spite of the large pressure difference between the single SG with the stuck

-open SV (see Figure 4-152) and th e lumped triple SG (see Figure 4-153). However, most of the heat transfer from the primary system was into the single SG, which caused the system depressurization. Although the feedwater injection into the lumped triple SG provided subcooled water that supported the system depressurization, the SG water level rose above 14 m by 3.42 hr (see Figure 4-155). LTSBO-4 included operator actions to close the LCVs when the water level rises above 14

m. The LCVs to the three SGs were closed at 3.42 hr, which stopped injection into the lumped SG. TDAFW injection was maintained into the single SG until the loss of DC power at 8 hr when the turbine over

-sped and failed.

After the loss of DC power in LTSBO

-4, the single SG boiled dry and then fully depressurized due to the stuck

-open SV. The lumped triple SG remained at low pressure until the single SG boiled dry. Subsequently, the triple SG pressurized and began cycling on the SV until the inventory was boiled away. Although LTSBO

-4 had the fastest challenge to the system inventory loss (i.e., a stuck

-open SV at 6 sec), the TDAFW injection mitigated the inventory loss. The subsequent over

-filling of the lumped SG above 14 m translated into a 3.4 hr delay in fuel damage relative to LTSBO

-0. The logic developed for the LTSBO scenarios included an automatic ARV depressurization at 1 hr and operator actions to close LCVs as necessary to prevent overfilling. Both of these actions occurred in LTSBO

-4. In reviewing the results, it is fully expected that the operators would not open the ARVs if a SG SV had stuck open. A sensitivity case (LTSBO

-4a) was performed that did not include a RCS depressurization using the ARVs. However, there was only a small change in the primary system depressurization response during the cooldown (see Figure 4-161). The accumulator injection in LTSBO

-4a was 7.25 m 3/accumulator at 4 hr versus 9.04 m 3/accumulator in LTSBO

-4. However, the total injected amount was the same at 8 hr. Consequently, the timings to core damage were within a few minutes for the two cases. Although LTSBO

-4 includes an ARV depressurization, it also included operator actions to close the ARVs when the SG pressure decreased below 1.38 MPa (~200 psia), which was true in the single SG with the stuck

-open SV at the start of the RCS depressurization (i.e., 1 hr) and at 1.7 hr for the lumped triple SG.

LTSBO-5 examined the impact of a 4 hr DC battery life. The shorter battery life compressed the timings to key events relative to LTSBO

-0 as shown in Table 4-21. The impact on the timing to the fuel cladding failure was also 4 hr. LTSBO also had a low in

-vessel hydrogen generation (see Figure 4-157) and the smallest use of the CST water. Although the containment pressure was higher at 72 hr due to the accelerated events (see Figure 4-158), it was below the best

-estimate failure pressure. As expected, the start of the accumulator injection (Figure 4-156), the HL failure (Figure 4-1 50), and the hydrogen production (Figure 4-157) were also faster than the other cases.

4-157 Figure 4-161 Comparison of LTSBO

-4 and LTSBO

-4a pressurizer pressure responses.

LTSBO Ignition Sensitivity Cases The effect of igniters and the PRT as an ignition source on the containment performance is presented in this section. Table 4-22 summarizes the different ignition sensitivity cases. In the "b" sensitivity cases with igniters, the HMS is operating. The HMS powers igniters in all regions of the containment except the ice condenser and the reactor cavity. In the corresponding MELCOR simulations, a burn in any control volume with an igniter is allowed to propagate t o other regions including the ice chest or the reactor cavity if it satisfies the propagation criteria.

Table 4-22 Summary of key LTSBO ignition sensitivity case differences Case Description LTSBO-0 All uncertain variables at the median value, TDAFW over

-speeds upon the loss of DC power.

LTSBO-0a Same as LTSBO

-0 but no PRT ignition.

LTSBO-0b Same as LTSBO

-0 but igniters are available LTSBO-1 Same as LTSBO

-0 but the pressurizer SV sticks fully open on first cycle LTSBO-1a Same as LTSBO

-1 but no PRT ignition.

LTSBO-1b Same as LTSBO

-1 but igniters are available Figure 4-162 and Figure 4-163 compares the LTSBO

-0 and LTSBO

-1 containment pressure responses, respectively. These cases allowed the PRT to be an ignition source if hot gases exiting the PRT exceed the hydrogen auto

-ignition temperature. Similarly, all the calculations recognize the HL failure as an ignition source when the exiting gases are above the ignition temperature. Finally, all calculations recognize the ex

-vessel core debris as an ignition source.

0 3 6 91215 0 3 6 912Pressure (psi)Time (hr)Pressurizer PressureLTSBO4LTSBO4a 4-158 These are the only ignition sources that can initiate a burn. Preliminary Sequoyah UA calculations did not include the PRT as an ignition source and had more early containment failures [122]. The "a" designation sensitivity calculations (i.e., LTSBO-0a and LTSBO

-1a) disabled the PRT ignition, but allowed HL hot gas and the ex

-vessel core debris as ignition sources (i.e., the same as Reference [122]). The "b" designation sensitivity calculations (i.e., LTSBO-0b and LTSBO

-1b) disabled all the previously described ignition sources, but included recovery of the HMS (i.e., Sequoyah's installed hydrogen mitigation system or the igniters).

As an obvious fact after the calculations were finished, LTSBO

-0 and LTSBO

-0a gave identical results. Nevertheless, it reinforces what conditions lead to the PRT as a possible ignition source (i.e., a stuck

-open pressurizer SV with a smaller number of cycles to a FTC with a larger FTC flow area). As discussed in Section 4.8.1, there was relatively little fission product release from the fuel at the time of the HL failure in LTSBO

-0. Consequently, the amount of fission products in the PRT water was insufficient to boil the PRT dry (i.e., also see Figure 4-148 and Figure 4-149) and the PRT exit gas temperature remained below the hydrogen auto

-ignition temperature.

In contrast to the LTSBO

-0 results, a significant amount of fission products were captured in the PRT in LTSBO

-1 and the PRT was an ignition source (see timing in Table 4-21). When the PRT ignition source was disabled from consideration in the combustion logic, the hydrogen continued to build up in the containment for 1.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months longer until the HL failed and created a hot jet ignition source. The peak pressure from the delayed burn increased from 3.88 bar (~56 psia) in LTSBO-1 to 5.83 bar (~85 psia) in LTSBO

-1a, which ruptured the containment at 24.5 hr (see Figure 4-163). Figure 4-164 and Figure 4-165 show the iodine and cesium fission product distributions for LTSBO-1a, respectively. LTSBO

-1a was the only LTSBO case with containment failure and a release to the environment within 72 hr. Although the containment failure occurred at 24.5 hr, it is described within this document as an early containment failure with respect to the timing of first RCS failure (i.e., at or shortly following the time of the HL failure). In contrast, the other LTSBO cases were trending towards late containment failures due a slow monotonic over

-pressurization from CCI. Although the LTSBO

-1a containment failure comes during the in

-vessel fission product release, the magnitude of the release is moderated by the capture of radionuclides within the PRT water and in

-vessel deposition. At the time of containment failure, there is a relatively small amount of airborne iodine and cesium in the RCS or the containment. Consequently, there is not a large prompt release of radionuclides. However, a small portion of the in-vessel radionuclides subsequently revaporize and flow into the containment. The remaining iodine and cesium in the fuel is released ex

-vessel shortly after the debris relocates into the reactor cavity. These two sources of radionuclides (i.e., in

-vessel revaporization and the ex-vessel release) contribute to a long

-term release to the environment of 2.36% of the iodine inventory and 0.89% of the cesium inventory.

4-159 Figure 4-162 Comparison of LTSBO

-0 ignition sensitivity containment pressure responses.

Figure 4-163 Comparison of LTSBO

-1 ignition sensitivity containment pressure responses.

0 1 2 3 4 5 6 0244872Pressure (bar)Time (hr)Containment PressureFailureLTSBO0LTSBO0aLTSBO0bLTSBO0 & LTSBO0a have the same responseLTSBO0 first burn fromHL ignition 0 1 2 3 4 5 6 7 0244872Pressure (bar)Time (hr)Containment PressureFailureLTSBO1LTSBO1aLTSBO1bLTSBO1 first burn fromPRT ignitionLTSBO1a first burn fromHL ignitionLTSBO1b first burn fromignitersContainment over

-pressurefailure 4-160 Figure 4-164 LTSBO-1a iodine fission product distribution.

Figure 4-165 LTSBO-1a cesium fission product distribution.

0.00.20.40.60.81.0 0244872Fraction of Initial Inventory (-)Time (hr)Iodine DistributionHL & containment failsIn-VesselPRTContainment depositedContainment airborneEnvironmentEnvironmentrelease = 0.0236Vessellower head failure0.00.20.40.60.81.0 0244872Fraction of Initial Inventory (-)Time (hr)Cesium DistributionHL & containment failIn-VesselPRTContainment depositedContainment airborneEnvironmentEnvironmentrelease = 0.0089Vessellower head failure 4-161 The final two sensitivity cases examined the containment response with working igniters. The igniters were assumed to ignite hydrogen at a 7% concentration if there was adequate oxygen concentration (>5%) and a steam concentration less than 55%. The igniters were located throughout the containment expect for the ice compartment and the reactor cavity. As shown in Figure 4-162 and Figure 4-163, the igniters started burning the hydrogen in the containment earlier and more often than the reference or "a" cases. The igniters are very effective at limiting the build-up of hydrogen to prevent any large hydrogen burns as long as the containment is not oxygen limited (i.e., the igniters are not needed when the containment oxygen concentration decreases below 5%). The benefit in LTSBO

-0b was less significant because the accident progression did not allow a large hydrogen build

-up in the containment prior to the first ignition source. The median ignition criteria in LTSBO

-0 is approximately the same as the igniter ignition criteria. Consequently, the responses of LTSBO

-0 and LTSBO

-0b are very similar.

LTSBO RCP Seal Leakage Sensitivity Case A sensitivity calculation was performed to investigate the impact of a seal failure that forms a small loss

-of-coolant accident (SLOCA) through the reactor coolant pump (RCP) seal. The previous LTSBO calculations assumed that the RCP seal leakage occurred at a nominal rate of 21 gpm per pump at full reactor pressure. Similar to the STSBO RCP seal leakage sensitivity study, the RCP seal SLOCA had a nominal flowrate of 182 gpm per RCP at full reactor pressure. The sensitivity study assumed that all four RCP seals failed at 13 minutes after the hot primary system fluid filled the seal cavity following the loss of seal cooling at the start of the accident. The flooding of the RCP seal cavity with hot RCS water has been identified as a potential failure mechanism for the seal components. The Westinghouse Owners Group (WOG) estimated that the nominal RCP leakage remains at 21 gpm with a 79% likelihood. The 182 gpm SLOCA has a ~20% likelihood [138]. The WOG also indicates for the potential of additional RCP seal failures after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if the RCS remains at high pressure. However, since the LTSBO includes an operator action to depressurize the RCS at 1 hr, the subsequent seal failures are not applicable until the late pressurization after the DC battery failure and it was not considered in the LTSBO calculations.

LTSBO-1 was selected to investigate the impact of the RCP seal leakage rate on the accident progression and containment pressure response.

LTSBO-1 had pressurizer safety valve failure attributes that have the potential to promote an early containment failure (i.e., pressurizer SV failure on the first cycle with a 100% SV failure area

). In the base calculation, LTSBO

-1 did not have an early containment failure. However, LTSBO

-1 had the largest hydrogen burn and pressurization following the development of the first ignition source. LTSBO

-1 used the median containment failure pressure. However, the peak containment pressurization was below the minimum failure pressure from the uncertainty distribution. LTSBO

-1 had a large SG SV FTC cycle value that ensured their normal operation through SG dryout.

The key uncertainty parameters used in the LTS BO-1 realization are summarized in Table 4-17. The results of the base and sensitivity calculations with RCP seal SLOCAs are presented in Table 4-23. As described above, a 182 gpm seal SLOCA per loop is initiated at 13 minutes in the sensitivity calculation. As evidenced by the timings in the table, the RCP seal SLOCAs substantially changed the course of the accident. In particular, the primary system did not fully pressurize to the pressurizer SV setpoint following the loss of the DC batteries. The long

-term response more closely resembled a SLOCA accident rather than a station blackout transient. Due to the radical change in the accident progression, it is difficult to make meaningful comparisons about the accident progression. The highest level conclusions are that (1) both calculations released a large amount of hydrogen to the containment prior to the first ignition 4-162 source, (2) the containment pressurization from the first burn was insufficient to fail the containment in both calculations, and (3) both calculations are progressing to a late containment failure after 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The large variations in the system response will be shown in the comparison plots.

Table 4-23 Results of the LTSBO Calculations Parameter LTSBO-1 LTSBO-1_RCP RCP leakage initially 21 gpm/pump 0.0 hr 0.0 hr Single SG SV sticks open n/a n/a RCP leakage increases to 182 gpm/pump n/a 13 min DC batteries fail 8.0 hr 8.0 hr TDAFW stops 8.0 hr (over-speeds) 8.0 hr (over-speeds) PRT rupture disk opens 19.6 hr n/a RPV level < TAF 19.7 hr 10.8 hr Start of cladding failure 20.4 hr 14.0 hr Pressurizer SV sticks open 19.6 hr n/a PRT becomes ignition source 22.8 hr n/a HL failure 24.4 hr 15.7 hr Lower ice compartment doors fail open 22.8 hr 15.7 hr First burn 22.8 hr 15.7 hr Vessel lower head failure (VF) 28.1 hr 18.6 hr Barrier seal failure 22.8 hr (high temp) 15.7 hr (high temp)

Containment failure n/a n/a Containment pressure at 72 hr 3.66 bar 4.68 bar In-vessel Hydrogen Production 446 kg 574 kg Figure 4-166 through Figure 4-171 show comparisons of key results for base and RCP seal SLOCA sensitivity cases. The early impact of RCP seal SLOCAs on the pressurizer pressure is evident in Figure 4-166. The RCP seal SLOCAs initially depressurize the primary system below 9 MPa. However, both calculations include an operator action to depressurize the primary system at 1 hr. Consequently, the overall trends are similar through the DC battery failure at 8 hr. The ARVs are not available after 8 hr and the TDAFW also fails, which leads to a primary system pressurization. The base case primary system pressure returns to the secondary pressure while the SGs boil dry. Subsequently, the base case pressurizes to the pressurizer SV setpoint. The pressurizer SV opens once and fails to close as a sequence specification. The primary system depressurizes to the accumulator pressure until the hot leg fails at 24.4 hr.

The RCP seal SLOCA sensitivity case also starts to pressurize after 8 hr. As the primary system pressure increases, the RCP seal SLOCA flowrate and energy release also increases. In addition, the primary system fluid inventory is substantially lower than the base case (see Figure 4-169), which degrades the heat transfer coupling to the secondary side. The combination of these effects led to a decoupling of the primary system from the secondary steam generators. The RCP seal SLOCAs depressurized the primary after ~13 hr. Unlike the base case, the pressurizer SV never opened. The fuel cladding started to fail at 14 hr and the hot leg failed at 15.7 hr. As shown in Figure 4-169, the inventory loss in the sensitivity case was already very severe relative to the base case when the batteries were lost at 8 hr.

4-163 Figure 4-166 Comparison of the Pressurizer Pressures in the LTSBO

-1 RCP Sensitivity Study. Figure 4-167 Comparison of the Containment Pressures in the LTSBO

-1 RCP Sensitivity Study. 0 2 4 6 8101214161820 0122436Pressure (MPa)Time (hr)Pressurizer PressureBase CaseRCP seal SLOCA 0 1 2 3 4 5 6 0244872Pressure (bar)Time (hr)Containment PressureContainment FailureBase CaseRCP seal SLOCA 4-164 Figure 4-168 Comparison of the Ice Melts in the LTSBO-1 RCP Sensitivity Study.

Figure 4-169 Comparison of the RCS Water Mass in the LTSBO

-1 RCP Sensitivity Study.

0%10%20%30%40%50%60%70%80%90%100%0 6121824Ice Melt Fraction (%)Time (hr)Ice Melt Base CaseRCP seal SLOCA 050000100000150000200000250000 0122436Mass (kg)Time (hr)RCS Water MassBase CaseRCP seal SLOCA 4-165 Figure 4-170 Comparison of the In

-vessel Hydrogen Generation in the LTSBO

-1 RCP Sensitivity Study.

Figure 4-171 Comparison of the RCP and PRT Hydrogen Leakages in the LTSBO

-1 RCP Sensitivity Study.

0100200300400500600700 0244872Mass (kg)Time (hr)In-Vessel Hydrogen GenerationBase CaseRCP seal SLOCA 0100200300400500 0122436Mass (kg)Time (hr)Hydrogen Release from the RCP Seal and PRTBase Case - RCPBase Case - PRTRCP seal SLOCA - RCPRCP seal SLOCA - PRT 4-166 The first ignition sources in the containment are at 22.8 hr and 15.7 hr in the base and sensitivity cases, respectively. The initial ignition source in the base case is the hot gases exiting the PRT. In the base case, a significant amount of the released fission products flowed into the PRT through the stuck

-open SV. The decay heat from the radionuclides boiled the PRT empty and heated the exiting gas above the hydrogen auto

-ignition temperature. In contrast, the pressurizer SV in the sensitivity case never opened; therefore, no steam or radionuclides went to the PRT. The first ignition source was the hot primary system gases exiting the hot leg after it failed.

The containment pressure responses (see Figure 4-167) reflect the variations in the first ignition source and the timing of the debris discharge into the containment from the vessel lower head failure. The peak containment pressures with the initial burn were 3.88 bar and 4.

02 bar in the base and sensitivity calculations, which were below the median (5.62 bar) and the minimum (4.58 bar) containment failure pressures from the uncertainty distribution. The ex

-vessel core concrete interactions (CCI) began at 28.1 hr and 18.6 hr, respectively in the base and sensitivity calculations. The non

-condensable gas generation and heating from the CCI causes the long

-term containment pressurization. The earlier pressurization of the sensitivity case reflects the timing difference of the start of the CCI. Both calculations were below the median containment failure pressure at 72 hr (i.e., 5.62 bar). Consequently, there was no containment failure within 72 hr. Figure 4-170 and Figure 4-171 compare the in

-vessel hydrogen generation and the hydrogen leakage through the RCP and PRT pathways, respectively. The in

-vessel hydrogen generation in the sensitivity case starts earlier and is 128 kg larger. The in

-vessel hydrogen generation was 497 kg at the time of the hot leg failure and accumulator discharge in the sensitivity case.

The center of the core had already collapsed but the peripheral assemblies were still intact. Approximately 70 kg of hydrogen was generated after the accumulator injection as peripheral assemblies degraded and collapsed. The base case in

-vessel hydrogen production started later and terminated shortly after the hot leg failure at 24.4 hr. The key differences in the base calculation were the lower primary system pressure, the higher rate of core uncovery, and the intermittent accumulator injections prior to the hot leg failure.

The total hydrogen released to the containment prior to the hot leg failure also reflected the substantial accident progression differences. The base case released 374 kg and 15 kg through the PRT and RCP seal pathways, respectively, prior to the first ignition source (i.e., hot gases exiting the PRT) at 22.8 hr. The sensitivity case released 320 kg through the RCP seal SLOCAs prior to the first ignition source (i.e., hot leg failure) at 15.7 hr. There was no hydrogen released to the PRT in the sensitivity case. Both amounts were sufficient to cause a very large burn but not sufficient to fail the containment.

In summary, the RCP seal SLOCAs changed the progression of the LTSBO to have the attributes of a SLOCA. The primary system response was substantially different due to the large inventory loss through the SLOCAs prior to DC battery failure. Unlike the LTSBO calculations, the primary system became thermally decoupled from the secondary system, which would disable most combinations of the SV failures investigated in the UA. A single system response is presented here for reference but further examination was identified as beyond the scope of the project.

5-1 5. SEQUOYAH MACCS MODEL This section presents the derivation and application of various site

-specific, MACCS model parameters as either point estimates or uncertainty distributions used for the uncertainty analysis. A complete list of the point estimate MACCS model inputs and inventories are found in Appendix B

. In this report, calculations and results are reported based on data for 2015, except for weather data which are from 2012. Selection of the year for weather data is described in Section 5.5. Site-specific MACCS input parameters for Sequoyah and its surrounding area include: population data , meteorological data, land cover information to determine surface roughness for atmospheric transport and dispersion, and p rotective action parameters, including evacuation routes and emergency response timelines.

The major elements of a MACCS offsite consequence analysis include source term definition, meteorological data, atmospheric transport, emergency response, and health physics models. A source term describes the quantities and types of radionuclides released into the atmosphere from a nuclear power plant along with the timing and related characteristics of the release. This information, along with onsite meteorological data, are used as input to calculate dispersion and deposition of the released radionuclides. Emergency response and protective actions are chosen to realistically model population exposures during the emergency phase. Doses can result from exposure to radionuclides via various exposure pathways (e.g., cloudshine, groundshine, inhalation, and deposition onto the skin). Health effects are modeled using several dose-response functions to estimate the effect of the doses to the public. Most of the reported risks are based on the linear, no

-threshold (LNT) model for cancer induction. The LNT model is selected as the basis for evaluation based on its widespread usage for applying radiation standards both domestically and internationally. The Peach Bottom and Surry UAs [9][16] considered several non

-LNT dose-response models as part of the uncertainty; here, non

-LNT models are considered as sensitivities but are not included in the UA.

In this section, certain input parameters have both a single deterministic value, used for reference and sensitivity calculations, and a distribution for uncertain parameters to specify degree of belief. In some cases, these uncertain parameters are correlated with other uncertain parameters to express dependencies. The process of assessing the uncertainty of consequences resulting from uncertain input parameters is referred to as an uncertainty analysis (UA) and is used here for the Sequoyah STSBO

66. To supplement the UA, sensitivity analyses were also performed to examine the effects of varying certain modeling assumptions.

5.1 Introduction

The Sequoyah Nuclear Plant SOARCA offsite consequence deterministic and uncertainty analysis uses MACCS to calculate potential doses and risk metrics for the population in the vicinity of Sequoyah. The MACCS consequence model Version 3.10.1.2, along with the

66 The 'with' random ignition UA was not conducted for this final report. The reader is directed to Section 4 for further discussion and the DRAFT report of this effort [122].

5-2 graphical user interface (GUI), WinMACCS Version 3.10.0 , was used in this analysis to calculate offsite doses and their effect on members of the public. MACCS and WinMACCS are developed at SNL under the direction of the NRC [54]. The codes have been used extensively in commercial nuclear reactor PRAs and in other regulatory applications to simulate the impacts of atmospheric releases of radiological materials to humans and on the surrounding environment.

Principal phenomena considered in MACCS include atmospheric transport using a straight

-line Gaussian plume segment model, short

-term and long

-term dose accumulation through several exposure pathways, including cloudshine, groundshine, inhalation, deposition onto skin, and food and water ingestion. The ingestion pathway was not treated in these analyses because uncontaminated food and water supplies are abundant within the United States; therefore, it is unlikely that the public would consume radioactively contaminated food or water. This assumption has been used throughout the SOARCA project [4][5][9][16]. Doses are estimated for each of the exposure pathways and risks are then estimated using several dose

-response model options, as discussed below.

Regarding the approximation of atmospheric transport and dispersion using a straight

-line Gaussian plume segment model, comparative analysis has demonstrated reasonable agreement with other atmospheric transport and dispersion codes using two

- and three-dimensional models when comparing values averaged over multiple weather trials spanning a year [84]. Accounting for uncertainty between the Gaussian plume segment and higher

-dimensional models is discussed with respect to plume dispersion parameters in Section 5.9.6. The risk metrics reported for this analysis are individual latent cancer fatality (LCF) and individual early fatality (EF) risks to residents within selected radial distance intervals centered on the reactor site.

The individual EFs are those fatalities expected to occur within a relatively short period from the time of exposure and the LCFs are those estimated to occur later in the life of exposed individuals as a result of early and chronic exposure to radiation. The individual risk metrics represent the average over each population modeled. That is, the risk values represent the predicted number of fatalities divided by the population.

In this context, LCF risks calculated are due to radiation from the accident only and do not consider background causes of cancer that exist for all populations.

Two types of risk results can be presented in a consequence assessment: scenario, frequency

-weighted risk or risk conditional on the occurrence of the scenario. The scenario, frequency

-weighted risk is the product of the core damage frequency for the accident scenario and the conditional risk for that scenario.

The scenario, frequency

-weighted risks are the likelihood s of LCFs or EFs for individual s living within specified radii of the plant per year of plant operation (i.e., LCF risk per reactor year (pry) or EF risk pry).

Conditional risks, alternatively, are the risks predicated on the accident occurring.

Conditional risks express the likelihood of a health effect assuming the accident occurs. To simplify presentation of results, a ll consequence results presented in Section 6 are risks conditional on the occurrence of a STSBO scenario.

This consequence analysis uses three phases that have the following user

-defined time periods:

early phase (also called emergency phase) of seven days, intermediate phase of one year, and long-term phase of 50 years

.

5-3 The remainder of this section describes the basis for selecting both the deterministic and the uncertain parameters.

5.2 Site Location and Surrounding Area Sequoyah is near the center of Hamilton County, Tennessee

, 18 miles northeast of Chattanooga, Tennessee, and 14 miles west

-northwest of Cleveland, Tennessee

. Sequoyah is a two-unit nuclear power plant site where reactors Unit 1 and Unit 2 are collocated, sharing a common turbine building. This analysis considers results and release pathways from Sequoyah Unit 1. Therefore, the radial grid used in the MACCS analysis is centered on the Unit 1 reactor containment building with latitude and longitude coordinates of 35° 13' 35.65" N and 85° 05' 28.17" W (UTM Coordinates: Zone 16, N 3,899,640.62 and E 673,718.2 4). The spatial grid is divided into 64 radial sectors with sector one centered on North and the sector index increasing in the clockwise direction. Twenty

-nine grid radii extend from the Unit 1 reactor building to various distances of interest, with a total of 29 radial distances.

Figu re 5-1 , Figure 5-2, and Figure 5-3 show the site in relation to the surrounding area in increasingly finer detail

[49]. Figu re 5-1 shows that Tennessee, Alabama, Georgia, and North Carolina are all within a 50

-mile radius of Sequoyah. To comply with NRC regulations, a preplanned strategy for protective actions during a nuclear power plant emergency is implemented in two emergency planning zones (EPZs) around each nuclear power plant. The first is the plume exposure pathway EPZ, which has a radius of about 10 miles from the reactor site. The second is the ingestion exposure pathway EPZ, which has a radius of 50 miles from the reactor site. For this analysis, subsequent references to the "EPZ" are referring to the 10-mile plume exposure pathway EPZ, although results out to 50 miles are presented. Figure 5-2 is a 10-mile radius map of the plant site showing the town of Soddy

-Daisy approximately five miles west of the plant.

An aerial photograph with site boundary and location descriptions is presented in Figure 5-3. For the offsite consequence analysis, some of the key distances include the 0.345

-mile exclusion area boundary (EAB), the 10

-mile EPZ, and the 50-mile ingestion exposure pathway zone. Even though the ingestion pathway is not included in this analysis, the ingestion exposure pathway zone represents the outermost boundary for which risks are presented.

5-4 Figu re 5-1 Sequoyah Nuclear Power Plant site with 50

-mile radius

[49]

5-5 Figure 5-2 Sequoyah 2 mile, 5 mile and 10 mile radial distances and EPZ sectors [49]

5-6 Figure 5-3 Sequoyah site boundary and aerial layout [49]

5-7 5.3 Site Demographics and Economic Data SecPop Version 4.3.0 was used to estimate population , economic, and land

-use data in the vicinity of Sequoyah

. SecPop accesses a set of databases to map pertinent data onto each grid element for anywhere within the contiguous United States (U.S.) [50]. SecPop uses population data from the 2010 Census; therefore, these data need to be adjusted to the project's target year, 2015. The project's target year was selected because it was the most recent year for which all needed data was available for the analysis. To calculate the adjustment factor, county level population data for all counties within 50 miles for 2010

-2014 were used to estimate an average annual growth rate [51]. This growth rate (0.412 percent per year) was then applied from 2010 forward to 2015, which resulted in a 50

-mile region population multiplier of 1.0208. Using this multiplier, the estimated 2015 population within 10 miles and 5 0 miles of the plant is projected to be 97,731 and 1,106,196 respectively.

Table 5-1 presents the radial interval population, cumulative population, and radial interval area-weighted population density at various distances from Sequoyah, adjusted to 2015. The population residing in the 10

-mile EPZ is about 98,000 and increases to about 280,000 within 15 miles due to its proximity to suburban Chattanooga. The population densities are calculated by dividing the radial interval population by the total area within that radial interval. The population density is highest within the 10

- to 15-mile interval, because that area includes a significant portion of Chattanooga. By comparison with the other SOARCA analyses, Peach Bottom [4] and Surry [5], the Sequoyah total cumulative 10

-mile EPZ population number is between Peach Bottom at the low end and Surry at the high end.

Table 5-1 Cumulative population and population density for selected distance intervals surrounding Sequoyah Unit 1 Distance (miles) Radial Interval Population (2015) Cumulative Population (2015) Interval Population Density (persons per square mi le) 0-1 236 236 75 1-2 2,418 2,654 257 2-5 24,427 27,081 370 5-10 70,650 97,731 300 10-15 182,548 280,278 465 15-20 202,733 483,011 369 20-30 210,758 693,770 134 30-40 214,990 908,760 97 40-50 197,435 1,106,196 69 SecPop uses economic data from a variety of databases for 2012 to estimate farmland wealth, farmland annual sales, the fraction of farm sales from dairy, and non-farmland wealth.

In this context, wealth refers to land values, including all improvements and infrastructure. In order to adjust the coun ty-level economic data available in SecPop for years beyond 2012, an economic multiplier is used. Using the same methodology as in Surry and Peach Bottom SOARCA analyses [4][5], the economic multiplier is based on the U.S. Consumer Price Index (CPI). For 5-8 this analysis, data were used from the U.S. Bureau of Labor Statistics Consumer Price Index for urban consumers (CPI

-U-RS). The CPI-U-RS is a modified value of the CPI

-U that excludes the more volatile pricing components of food and energy

[52]. To adjust the 2012 data to the project's target year, 2015, a ratio of the most recently available data of the CPI

-U-RS for 2014 (342.4) to the 2012 value (330.7) was used to extrapolate a n adjustment factor of 1.0535 for 2015. This factor is used to adjust 2012 farmland wealth, farmland annual sales, and non

-farmland wealth values to 2015 values. While economic losses are not reported in this study, these values do affect whether land can be restored to use and, thereby, affect doses to members of the population who may return to the restored land.

5.4 Site Topography and Land Cover Sequoyah is located on two peninsulas totaling 630 acres on the western shore of the Chickamauga Lake at Tennessee River mile marker 484.5.

The larger peninsula includes the power block and support facilities surrounded primarily by grass fields. The smaller peninsula includes the training center surrounded by evergreen and deciduous forests.

The major structures onsite include two reactor buildings, turbine building, auxiliary building, control building, service and office building, diesel generator building, intake pumping station, ERCW pumping station, and two natural draft cooling towers. The tallest structures onsite are the two cooling towers at approximately 459 f eet (140 m) high.

The Tennessee River bounds the site to the East and South. Private properties bound the northern and western portions of the site.

Several housing developments are located adjacent to the site EAB

. The Sequoyah site lies in the Tennessee River Valley which is oriented in a north-northeasterly to south-southwesterly direction.

The Sequoyah site river valley orientation exhibits significant influence on the wind direction near the plant, as discussed in the Section 5.5. Local topography is characterized by small ridges and valleys with a generally similar orientation

. The local terrain varies from flat to rolling hills with the ground cover primarily consisting of forested land. Recent GPS land-use data obtained from the U.S. Department of Agriculture (USDA) CropScape indicates a 30

-mile radius around the plant is 58 percent forest, 18 percent grass/pasture, 14 percent developed, 4 percent cropland, and 2.5 percent is covered by water [52]. On a larger scale, the Tennessee River Valley is adjacent to the Cumberland Plateau to the west and the Appalachian Mountains to the east.

5.5 Meteorological Data Weather bin sampling was chosen as the meteorological sampling option for this analysis; this option requires the user to supply one year of complete weather data. Data were obtained from three sources for analysis and selection of site

-specific, representative weather data: the TVA meteorological tower located onsite, the Environmental Protection Agency (EPA) SCRAM website 67 database of seasonal mixing layer height data, and the National Weather Service (NWS). Sequoyah onsite meteorological tower hourly weather data were obtained from TVA for years 2008 through 2012. The onsite data were compared with the NWS data collected from a nearby weather station to better understand how a particular year compared with long

-term regional trends. The MACCS meteorological data file created for the Sequoyah contains one year of weather data and long

-term, seasonal, mixing

-height data from the EPA.

67 https://www.epa.gov/scram/scram

-mixing-height-data for data analysis using EPA SCRAM data, winter is considered to start on January 1 st, not December 21 st.

5-9 TVA maintains a meteorological facility at Sequoyah consisting of a 91 meter (300 feet) tower instrumented at 1, 10, 46, and 91 meters above the ground. Data collected at the three upper locations include wind direction (degrees), wind speed (meters per second), and air temperature (degrees Fahrenheit). Dew point was calculated from data measured at 10 meters and solar radiation (Langley/minute) and rainfall (inches) data were measured at 1 meter. These data are compiled in hourly increments that represent averaged values of hour-long intervals for each hour of a 365

-day year (a total of 8760 observations

). Wind direction and speed are measured every 5 seconds and averaged over one-hour intervals.

The meteorological data required for the MACCS model include:

the time as sequential day and hour, the average hourly direction the wind is blowing toward (designated by compass sector), the average hourly wind speed (m/s), the atmospheric stability class, the precipitation rate (1/100th inch/hr), and winter, spring, summer, and autumn mixing heights for early morning and afternoon conditions. These correspond to the minimum and maximum daily mixing heights, but are averaged over a season of the year.

Table 5-2 presents the average diurnal mixing heights for each season. The seasonal mixing heights for early morning and afternoon conditions are calculated by averaging 90

-day blocks of data from the EPA SCRAM website. The Sequoyah mixing height data are based on EPA data from Nashville, Tennessee (the only station in Tennessee).

Table 5-2 Seasonal diurnal mixing heights for Tennessee (m) Time of Day Winter Spring Summer Fall Early Morning 580 520 420 490 Afternoon 1110 1790 1820 1000 EPA has published acceptable methods for synthesizing observed weather data to fill gaps from equipment failures. Missing data are estimated as follows:

1. To synthesize a single hour of missing data, averaging the hour prior with the hour subsequent to the missing hour was used.

2. For two sequential hours of missing data, the average of the two hours of data prior to and subsequent to the missing hour was used for each of the hours.

3. In very few instances, data from a station located at an adjacent height is used.

4. During the few extended time periods (more than a few hours) in which data were unavailable, substitution of a similar day from the adjacent time period is performed to maintain similar daylight and seasonal weather variables.

In accordance with NRC Regulatory Guide 1.23 [53], the meteorological data recovery rate should be above 90 percent (i.e., all parameters were measured in a given hour for at least 90 percent of the hours of the year

). Sequoyah 2008 to 2012 weather data recovery rate is well above the 90 percent threshold and is computed as two percentages shown in Table 5-3.

5-10 Percentage of hours in a year with at least partial weather data refers to the percentage of hourly meteorology data that were captured, that is, not lost due to equipment failure or other data retention issues. For instance, in 2008, 187 hourly data points were not logged out of 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months in a year; thus the weather data hours captured are 8573 out of 8760, or 97.8 percent. Within that 8573 hours0.0992 days 2.381 hours 0.0142 weeks 0.00326 months of recorded data, some of the hours are missing one or more data points for wind speed, temperature, etc. In 2008, 111 hours0.00128 days 0.0308 hours 1.835317e-4 weeks 4.22355e-5 months of the 8573 recorded hours were missing at least one data type. Thus, the percentage of the recorded data with complete weather data is 8462 out of 8573 recorded hours, or 98.7 percent. That means that complete data (all measurements) were recorded for 0.978 x 0.987 = 0.965 (96.5%) of t he hours for 2008.

Table 5-3 Meteorology data completion rates Year Percentage of hours recorded in a year with at least partial weather data Percentage of recorded hours with complete data 2008 97.8% 98.7% 2009 98.2% 98.9% 2010 97.4% 99.0% 2011 99.4% 99.7% 2012 98.9% 99.4% Selection of Representative Weather Data In general, the annual site meteorological data are remarkably consistent with respect to wind speed, wind direction, and stability class.

Table 5-4 lists the total precipitation measured onsite for each year. Figure 5-4 shows the Sequoyah site precipitation data as monthly precipitation for each year. The year 2012 is representative of the site weather because the annual precipitation was consistent with the five-year-average precipitation and it has the second highest data completion of years 2008 to 2012. A sensitivity analysis for the five years of weather data was performed to assess the variation in LCF risk over these weather years, 2008 to 2012, and the results are presented in Section 6.5.3. The conclusion is that the predicted risks are within 3.4% of the mean 2008

-2012 LNT LCF risk for the 0

-10 mile EPZ, and that the results for 2012 are in the middle of the range of LCF risk results for the other weather years.

Table 5-4 Summary of precipitation by year (inches)

Year Total 2008 39.7 2009 47.9 2010 25.5 2011 52.9 2012 39.3 Average 41.1 Standard Deviation 10.4 5-11 Figure 5-4 Monthly precipitation by year (inches)

Sequoyah Site Meteorological Features Table 5-5 summarizes the 2012 stability class, precipitation, and wind speed statistics derived from the hourly data. The site has very stable weather conditions compared with most other sites. Measurable precipitation was recorded for 528 hours0.00611 days 0.147 hours 8.730159e-4 weeks 2.00904e-4 months out of 8760 hours0.101 days 2.433 hours 0.0145 weeks 0.00333 months per year, which is about 6 percent of the year.

Table 5-5 Summary of 2012 meteorological statistics Category Metric Frequency Stability Class Unstable (%)

6.0% Neutral (%)

42.0% Stable (%)

52.0% Precipitation Total (in) 39.3 Nonzero hours 528 Percentage of year (%) 6.0% Wind Speed Average (m/s) 1.66 Atmospheric stability is categorized using Pasquill

-Gifford stability classes, where MACCS uses 1 through 7 to indicate Pasquill

-Gifford classes A through G [54] (MACCS treats classes F and 0 2 4 6 8 10 12JANFEBMARAPRMAYJUNJULAUGSEPOCTNOVDECPercipitation Amount (inches)Percipitation Month and Year 2008 2009 2010 2011 2012 AVG 5-12 G as a single class, but they are separated in the discussion below). Figure 5-5 presents the overall stability class probabilities for the year and probabilities by hour of day for 2012.

The hourly stability class occurrences are shown in Figure 5-5 as unstable (classes 1, 2, 3)

, 68 neutral (class 4)

, 69 and stable (classes 5, 6, 7) 70 in Figure 5-5. Generally, nighttime hours are the most stable. The mornings and evenings transition from stable to neutral stability. Mid-day hours have the highest proportion of unstable classes, although neutral conditions occur two to three times more frequently than unstable conditions. The dominant classes, 4 and 5, occur more than 75% of the time.

Figure 5-6 presents 16

-sector windrose data. The near

-surface wind pattern is dominantly north

-northeast and south

-southwest. At left, the representative weather year used in this analysis, 2012, is shown alone; at right, the windrose frequencies are shown for years 2008

-2012. These wind directions are very consistent from year to year and indicate a strong river valley pattern, which means the onsite wind is preferentially aligned with the Tennessee River valley at Lake Chickamauga. The wind direction data recorded at 46 meters and 91 meters exhibit the same pattern. This means almost one

-half of the time, wind originating at the site blows in the general direction of Chattanooga. Figure 5-7 shows binned 2012 wind speed data. Wind speeds between 1-5 meters per second were most frequently observed.

68 This corresponds to Pasquill

-Gifford stability classes A, B, and C.

69 This corresponds to Pasquill

-Gifford stability classes D.

70 This corresponds to Pasquill

-Gifford stability classes E, F, and G.

5-13 Figure 5-5 2012 stability class frequency annually and by time of day

5-14 Figure 5-6 Sequoyah combined wind rose plots for 2012 and 2008

- 2012 Figure 5-7 Wind speed bins for 2012 Weather Sampling The occurrence and exact timing of a future hypothetical release of radioactive materials from a severe nuclear power plant accident is by nature impossible to predict.

Furthermore, weather conditions at a specific time in the future cannot be known for more than a few days in advance; therefore, weather data must be treated statistically.

To do this, historical data are used to quantify the consequences of a future event, which assumes that future weather data will be statistically similar to historical data.

MACCS has several options for treatment of meteorological data, which include the ability to directly input weather data, or the ability to sample weather data from an external meteorological data file. Sampling options include a strategy that uses meteorological bins that 0%5%10%15%20%25%0.501.001.502.003.005.0010.0020.00>CALMCALM0.501.001.502.003.005.0010.0020.00FrequencyWind Speed Bins (m/s) 5-15 are partially defined by the user (weather binning), or a strategy in which the user chooses a number of samples to draw from each day of data in a weather file.

Weather binning is a type of importance sampling used to categorize similar weather data based on wind speed, stability class, and precipitation. This method is intended to efficiently sample all types of weather, and especially to ensure sampling of the types of weather that most influence risk, from the set of weather data. With regard to wind direction, the assumption is that sampling within each weather bin is sufficient to represent the wind rose for that bin, i.e., the likelihood of the wind blowing in each compass direction.

Because each plume segment travels in its own direction, as explained Section 5.6, this assumption should be satisfied.

The weather sampling strategy adopted for Sequoyah SOARCA uses the nonuniform weather-binning approach in MACCS

[8]. The weather binning strategy is the same one used in the Surry and Peach Bottom SOARCA analyses [4][5], which consists of 16 predefined bins for combinations of stability class and wind speed and 20 user

-defined bins for rain occurring before the plume travels 32 kilometers (20 miles)

[8]. The number of weather trials selected from each bin was the maximum of 12 trials and 10 percent of the number in the bin. Some bins contain fewer than 12 trials, and in those cases, all trials in the bin are used. This strategy result s in roughly 1,000 weather trials to represent the 8,760 hours0.0088 days 0.211 hours 0.00126 weeks 2.8918e-4 months of data in a 365

-day year. A sensitivity study conducted for the Peach Bottom UA showed that this sampling strategy matched the mean results that would have been obtained by choosing every hour in the weather file (8,760 samples) within 3 percent for health risks evaluated with the linear, no

-threshold (LNT) dose

-response assumption and within 12 percent for health risks evaluated with the non-LNT dose-response assumptions [9]. This comparison shows that the current weather binning approach, while reducing the required number of simulations, produces results that are acceptably close to the mean results that would be obtained by using all the hours of weather data. 5.6 Atmospheric Transport and Dispersion The transport and dispersion of radioactive materials is calculated in MACCS using a Gaussian plume segment model and the sampled site weather data. A plume segment is an integrated one-hour source term. MACCS allows for as many as 500 plume segments to be created through the MelMACCS preprocessor to represent the transient nature of the release. MelMACCS transforms the environmental release output information generated from MELCOR into a MACCS source term input file [8]. The atmospheric transport model combines the transient nature of the source term with transient nature of the weather data to create a weather trial. As the release evolves in time, the wind direction, wind speed, stability class, and precipitation rate change each hour. Once released, each individual plume segment is transported through the domain with its initial wind direction, but all other weather characteristics change hourly.

The model calculations consider the activities released , building wake effects, plume rise resulting from buoyancy, dispersion, dry and wet deposition, and the decay and ingrowth of up to 150 radionuclides over a maximum of six generations.

More detailed descriptions are provided in the sections below.

The model does not consider spatial variations in the wind field or topography

.

5-16 Radiological Release Information MelMACCS captures the characteristics of atmospheric releases generated by MELCOR [8]. The release features include:

timing and magnitude (expressed as release fraction) of radionuclide releases, physical characteristics, such as mass flow rate, mass density, sensible heat content, and plume release height, and aerosols size distribution for each isotope.

MelMACCS calculates radionuclide specific information for use with MACCS. Sequoyah Unit 1 core inventories were estimated using ORIGEN for beginning of cycle (BOC), middle of cycle (MOC), and end of cycle (EOC). These inventories are listed in Appendix B. In this study, MELCOR tracked radionuclides as nine groups (also called classes) of elements. The elements in each group are assumed to behave similarly within the reactor systems. It also accounts for the deposition and internal holdup of radionuclide groups within the reactor systems (i.e., the fractions of radionuclides that are released from fuel but not released into the environment). MelMACCS calculates release fractions and particle size information for each group, then subdivides each group into constituent radionuclides based on the reactor inventory and individual radionuclide decay and ingrowth.

The plume segments are divided into approximately one

-hour increments to align with the hourly weather data. In the Sequoyah SOARCA study, flow paths with release fractions less than 1.0E-5 of the total amount released for each of the nine groups were excluded as being insignificant.

Surface Roughness Surface roughness affects the atmospheric transport and dispersion of radioactive material because increased surface roughness enhances vertical mixing. It also increases deposition velocities for all aerosol sizes. The strategy to determine an appropriate site

-averaged surface roughness measure accounting for site topography and land cover around the Sequoyah site is discussed in this section.

The USDA CropScape database provides data for EPA land-use categories for any area in the continental U.S. Table 5-6 summarizes these land

-use data within 30 miles of the Sequoyah site and provides an estimated surface roughness corresponding to each land

-use category. Data for different ground covers, such as deciduous and coniferous forests or corn and soybeans, are combined and designated by a single land

-use category. A surface roughness value of 39 cm is the weighted

-average of surface roughness by land

-use category for the area within a 30

-mile radius of Sequoyah. This distance is considered sufficient to characterize the impact of surface roughness over the distance beyond which the plume can be considered well

-mixed between the ground and mixing layer height. Once the plume is well mixed within the mixing layer, vertical dispersion is no longer important.

5-17 Table 5-6 Surface r oughness within 30 miles of the Sequoyah site Type of Land Use Acreage Area Fraction Surface Roughness (cm) Open Water 44,553 2.5% 0.03 Barren 2,025 0.11% 1 Grass/Pasture 333,206 18% 3 Developed/Open Space and Developed/Low Intensity 148,153 1 2% 5 Shrubland 53,498 3% 5 Wetlands 5,478 0.31% 5 Crops, vegetables, fruit 11,088 4.1% 10 Forest 797,351 5 8% 60 Developed/Medium Intensity 22,222 1.2% 70 Developed/High Intensity 11,103 0.61% 350 Sum 1,806,113 100.00% -- Weighted-Average Surface Roughness 39 The effect of surface roughness on vertical dispersion is calculated as the MACCS parameter ZSCALE. Equation 5

-1 provides the factor used in the MACCS calculation to scale vertical dispersion to account for local surface roughness [54]. The value in the denominator of the equation, 3 cm, is the surface roughness at which much of the original data characterizing dispersion were measured.

=39 3 .= 1.67 Eq. 5-1 Atmospheric Dispersion Within MACCS, plume dispersion during downwind transport is modeled using a Gaussian plume segment model. As the plume segment moves away from the source, dispersion in the vertical and crosswind dimensions decrease the concentration of the radionuclides within the plume. The plume initially disperses in the vertical dimension but it eventually becomes well mixed between the ground surface and the top of the mixing layer; beyond that point further vertical dispersion does not modify local concentrations. However, cross

-wind dispersion continues to reduce local concentrations even at very long distances.

The Gaussian plume model uses two spatially dependent dispersion parameters, sigma

-y () and sigma-z (), to estimate atmospheric dispersion. These parameters can be specified in two ways in MACCS: as power

-law functions or with lookup tables. The dispersion parameters must be specified for each stability class. Sequoyah SOARCA uses the power law function option. The crosswind and vertical dispersion coefficients, and , are discussed in more detail in Section 5.9.6. Dry and Wet Deposition Deposition is the transfer of aerosol particles containing radionuclides from the atmospheric plume onto ground

-level surfaces (e.g., crops, lakes, grass, trees). As described in Section 5.5 , precipitation occurs during six percent of the hours at Sequoyah. Therefore, dry deposition is 5-18 the important mechanism most of the time. However, wet deposition is also important because, when precipitation occurs, it is very effective in depositing aerosols. Dry deposition depends on particle size, atmospheric turbulence, wind speed, surface roughness, and other factors. Wet deposition is primarily a function of the precipitation rate. It can create localized high concentrations of contamination called hotspots. Both wet and dry deposition are strongly influential parameters and are discussed further in Section 5.9.1 and Section 5.9.2, respectively.

5.7 Protective Action Parameters Protective actions can include evacuation, sheltering in place, relocation, and potassium iodide (KI) ingestion. For Sequoyah, the Tennessee Department of Health has a KI program, but does not pre-distribute KI to 10-mile plume exposure EPZ residents. KI is available for pickup by residents that live within 5 miles of the plant, and KI is planned to be available at mass

-care shelter s [49]. The population within 5 miles includes 28 percent of the total EPZ population, and it is assumed many of the residents do not have KI on hand at the time of an accident. There is a reduction in efficacy if KI is not ingested within the appropriate time period. Furthermore, the impact from dose to the thyroid is primarily an injury rather than a fatality, and risk of injuries not reported in the SOARCA results; as a result of these considerations, no KI ingestion was modeled. The other protective actions are discussed below.

The Sequoyah MACCS model was developed assuming the large seismic initiating event that disrupts the Sequoyah plant systems also affects the evacuation routes. This Sequoyah SOARCA approach differs from earlier Peach Bottom and Surry SOARCA documents [4][5] with regard to the state of infrastructure assumed. In those analyses, impacts on evacuation road networks and infrastructure were considered in sensitivity analyses rather than as part of their respective UAs [9][16]. Sequoyah roadway access and capacity are affected by the assumption that bridges in the EPZ are unusable. The infrastructure beyond the Sequoyah 10

-mile EPZ is assumed to be unaffected by the earthquake. It is difficult to consider all potential scenarios with respect to damages incurred within the EPZ from a large earthquake, such as the conditions of individual houses or buildings, the damage to roads in addition to bridges, the ability to evacuate or to shelter, etc. Therefore, the primary factors modeled in this study are the evacuation speeds and delays due to the loss of roadways with bridges. Specifically, the loss of roadways to exit the EPZ is expected to result in delays to find alternate routes and decreased evacuation speeds due to increased traffic congestion on a suboptimal road network. The evacuation delays and decreased travel speeds are evaluated to encompass other factors affecting the ability to evacuate. To further consider the possibility that the road network is completely unusable, a sensitivity analysis is performed for sheltering

-in-place instead of evacuation. The shelter

-in-place sensitivity assumes that homes and buildings are habitable but considers that windows might be broken and that corresponding inhalation protection factors might be compromised. The sensitivity analyses modeling assumptions and results are presented in Section 6.5 To account for the failure of bridges within the EPZ, a limited

-scope roadway capacity analysis was conducted for the Sequoyah 10

-mile EPZ and is described in Appendix C. The earthquake

-impacted EPZ roadways increase the times required for evacuees to exit the EPZ. The EPZ evacuation routes are dispersed such that addressing the infrastructure by quadrant provide s a reasonable basis for developing evacuation time estimates (ETEs). The roadway network was reviewed using satellite images to determine alternate routes to exit the EPZ.

5-19 Accessible routes were identified, and the capacities of these routes were calculated. Each licensee is required to provide a site

-specific ETE as required by 10 CFR 50, Appendix E, Section IV.4, using the most recently available decennial census data [123]. In 2013, TVA submitted its revised ETE study "Evacuation Time Estimates for Sequoyah Nuclear Power Plant Plume Exposure Pathway Emergency Planning Zone," which informs the technical basis for developing the Sequoyah SOARCA seismic scenario protective action parameters discussed in this section, including radial distances, population fractions, cohort definitions, and response timelines [56]. From the ETE study, the number of vehicles exiting different areas of the EPZ was identified

[56]. An estimate of the evacuation time was then developed using the number of vehicles, available evacuation routes, and roadway capacity at the available exit points of the EPZ. A description of the capacity analysis methodology, bridge locations, alternate routes, vehicles and results is discussed in Appendix C. The topography of the area was reviewed using United States Geological Survey mapping to identify low lying areas where the potential for roadway flooding exists, should the upstream Watts Bar dam fail as a result of the seismic event. Even with downed power lines, the Emergency Alert System (EAS) sirens are expected to activate because they have backup batteries. The EAS sirens notify the public that an emergency notification message will be distributed to EPZ residents via text alerts, TV, and radio. Cohort Definitions Modeling emergency response includes the timing of response actions related to protecting the public health and safety. MACCS treats protective action response activities at the cohort level. A cohort is defined as a segment of the population with specific response characteristics. Table 5-7 shows the Sequoyah cohorts used in this study and the percentage of the 10

-mile EPZ population represented by each cohort calculated using the scaled 2015 total population described previously in Section 5.3. Table 5-7 Sequoyah evacuation cohorts Cohort Distance Cohort Description Percentage of Radial Distance Population 1 10 to 15 miles Shadow (20% 10-15 mile population) 2 0 to 10 miles Schools 19.3 % 3 0 to 10 miles Special facilities (e.g. hospitals) 0.8 % 4 0 to 10 miles Transit dependent evacuees 1.5 % 5 0 to 10 miles Early general public evacuees 7.8 % 6 0 to 10 miles Middle general public evacuees 31.2 % 7 0 to 10 miles Late general public evacuees 31.2 % 8 0 to 10 miles Tail general public evacuees 7.8 % 9 0 to 10 miles Non-evacuating public 0.5 % Earlier SOARCA studies [3] were the first application of the newly increased number of allowable cohorts in MACCS (the capability to model up to 20 cohorts was developed explicitly to support SOARCA). At the time Surry and Peach Bottom SOARCA analyses [4][5] were performed, it was decided to somewhat limit (to six) the number of cohorts in order to maintain reasonable computer runtimes. Computer runtimes turned out not to be an issue and subsequent MACCS analyses have included a larger number of cohorts.

5-20 Nine cohorts were developed for Sequoyah SOARCA. Eight of these represent segments of the population residing within approximately ten miles of Sequoyah and one (Cohort 1) represents the shadow evacuees who reside within 10 to 15 miles of Sequoyah, just beyond the EPZ. The fraction of the population represented by each cohort was based on data from the ETE report [56]. Within the EPZ, about 78 percent of the population is included in the general public (Cohorts 5, 6, 7, and 8); the remaining 22 percent represents school, special

-facility, transit

-dependent, and non

-evacuating populations. The general population is sub

-divided into early, middle, late, and tail cohorts to realistically reflect a time

-based distribution of cohort responses. This time-based distribution is taken from the 2013 Sequoyah ETE [56] mobilization curve as the 10%, 50%, 90% (early, middle, and late) cumulative fraction of the population departed as a function of time for the permanent daytime resident population. The tail cohort, by convention, is assumed to be the last 10% of the population to evacuate, and it is assumed that the tail cohort begins their evacuation when 90% of the general population has evacuated. Mobilization times are used in this analysis to develop the cohort

-specific delay to shelter (DLTSHL) and delay to evacuate (DLTEVA) MACCS parameters, and mobilization time represents the time between the receipt of notification to evacuate and when individuals leave for evacuation. For example, the permanent resident mobilization time, also referred to as trip generation time, for an event during a normal working day may include the following elements, each of which will have a variety of durations [101]: notification of the public

- the period of time to notify the public, preparation to leave work or other activity

- the time between receipt of notification and when individuals actually leave the workplace or other location that is not their residence, travel to home

- the time it takes to reach home after leaving work or other activity, preparation to leave for the evacuation

- the time to pack and prepare the home prior to leaving, including event specific activities such as clearing debris or securing transportation, if appropriate.

The segmentation of the general population into separate cohorts was done previously in Peach Bottom SOARCA, although not precisely in the same manner as in this study. The Peach Bottom study included a public, combined schools and 0

- to 10-mile shadow, and tail general public cohorts. Two studies [86], [89] indicate that residents in the vicinity of a nuclear power plant evacuate in a timely manner; however, this is an area of modeling uncertainty, especially for an accident initiated by a seismic event. Therefore, key evacuation parameters are varied for all cohorts in the uncertainty analysis, as discussed in Section 5.9.9. The nine cohorts and population percentages as discussed in Table 5-7 are defined as follows:

Cohort 1: 10- to 15-mile shadow evacuees A shadow evacuee is someone who evacuates from an area that is outside the designated evacuation zone. In this analysis this cohort is comprised of evacuees residing beyond the EPZ, within the 10

- to 15- mile area. The population is assumed to leave shortly after the EPZ evacuation advisory is given. The size of the shadow evacuation can be influenced by communication during the emergency and may be influenced due to external events such as an earthquake. Shadow evacuations typically begin shortly after a general evacuation begins.

Twenty percent of the population from the 10- to 15-mile area, just beyond the EPZ, are assumed to shadow evacuate [57].

5-21 Cohort 2: 0- to 10-mile schools This cohort includes elementary, middle, and high

-school student populations within the EPZ. In discussions with the Tennessee Emergency Management Agency (TEMA) it was explained that schools and special facilities within the Sequoyah EPZ receive warning upon declaration of an alert notification, whereupon buses are dispatched and prestaged at schools in the case of escalation to a site area emergency (SAE) notification. Approximately 19 percent of residents within the EPZ are school

-aged children. Cohort 3: 0- to 10-mile special facilities The special facilities population includes residents of correctional and medical facilities, such as hospitals and nursing homes. The 2013 Sequoyah ETE study did not explicitly identify any correctional facilities for consideration as part of the special facilities cohort

[56]. In an emergency, special facilities are evacuated individually over a period of time. The time to evacuate these facilities is based upon available specialized transportation (e.g., ambulances) and the number of return trips needed. In this regard, the special facilities cohort within the EPZ behaves similarly to the transit

-dependent cohort described below. Both cohort 3 and cohort 4 (special facilities and transit

-dependent) are assumed to already be located and remain indoors from the onset of an emergency declaration for an extended period of time prior to evacuating. Special facilities represent about 0.8 percent of the Sequoyah EPZ population

[56]. As stated above, in discussions with TEMA it was explained that special facilities within the Sequoyah EPZ receive warning upon declaration of an alert notification, whereupon ambulances are dispatched and mobilized in the case of escalation to a site area emergency (SAE) notification.

Cohort 4: 0- to 10-mile transit

-dependent evacuees This cohort includes EPZ permanent residents who do not have access to a vehicle or are dependent upon help from outside the home to evacuate. This group depends upon public transportation to evacuate, which can create delays. Approximately 1.5 percent of residents within the EPZ are estimated to be transit dependent.

Cohort 5: 0- to 10-mile early general public evacuees Cohort 5 represents a portion of the general public that begins to evacuate prior to other cohorts. Based on the postulated earthquake and assumed damage to infrastructure within the EPZ (e.g., bridge failures, power outage, etc.), it is assumed that a portion of the EPZ population may disregard established evacuation protocols and respond to the first sirens at Site Area Emergency (SAE) rather than wait for EAS messages which direct an official evacuation order. However, this cohort enters the roadway network prior to congestion and therefore may traverse and evacuate the EPZ at a quicker rate than Cohorts 6 through 8. Approximately 7.8 percent of the total residents within the EPZ (10 percent of the general public, Cohorts 5, 6, 7, and 8)) were modeled as early general public evacuees.

Cohort 6: 0- to 10-mile middle general public evacuees This cohort includes EPZ residents who follow protective action orders and leave shortly after the GE sirens are sounded and the evacuation order is broadcast via EAS messages. Even with a power outage, most residents and facilities have tone alert radios, battery powered radios, or at least car radios where EAS messaging can be received. Thus, this group is assumed to receive the official evacuation order prior to departing, to be relatively prepared to evacuate at the time of the EAS message, and to 5-22 follow evacuation instructions. Approximately 31 percent of the total residents within the EPZ were modeled as middle general public evacuees (40 percent of the general public, Cohorts 5, 6, 7, and 8).

Cohort 7: 0- to 10-mile late general public evacuees This cohort includes EPZ residents who follow protective action orders and leave significantly after the GE sirens are sounded and the evacuation order is broadcast via EAS messages. For various reasons, the general public residents in Cohort 7 take longer to mobilize than those in Cohort 6. Cohort 7 is based on 90th

-percentile values in the ETE mobilization curve [56]. This group is assumed to receive the official evacuation order via EAS prior to departing and to follow instructions. Approximately 31 percent of the total residents within the EPZ are modeled as late general public evacuees (40 percent of the general public, Cohorts 5, 6, 7, and 8).

Cohort 8: 0- to 10-mile tail general public evacuees This cohort includes the last remaining members of the general public to evacuate from the 10-mile EPZ. The evacuation tail takes longer to evacuate for reasons such as shutting down farming or manufacturing operations, performing other time consuming actions prior to evacuating, or missing the initial notification. Approximately 7.8 percent of the total residents within the EPZ were modeled as late general public evacuees (10 percent of the general public, Cohorts 5, 6, 7, and 8) [89]. Cohort 9: 0- to 10-mile non-evacuating public This cohort includes evacuees who may refuse to evacuate and are modeled as though they continue performing normal activities. Approximately 0.5 percent of the population is considered to be non

-evacuating. This percentage of the population is consistent with our understanding of large

-scale evacuations, which is that a small percentage of the public refuses to evacuate regardless of the risk [86]. This Sequoyah SOARCA analysis differs from earlier Peach Bottom and Surry SOARCA analyses [4][5] because it implements a keyhole evacuation model representative of the expected protective action recommendation (PAR) and protective action decision (PAD). The PAR is a recommendation that is considered by offsite authorities when they make their PAD. This keyhole evacuation modeling feature was not available when the previous SOARCA analyses were performed and it is not applicable at Peach Bottom because the protocol in Pennsylvania is to evacuate the entire circular area. A keyhole evacuation is intended to reflect site-specific protective actions where the full EPZ is not evacuated, but instead a smaller region around the plant is evacuated together with downwind sectors. The keyhole model accounts for changing wind direction over the course of the release and expands the number of downwind sectors as wind shifts occur. If the wind shifts, based on hourly weather data, the evacuation is expanded to include additional sectors as illustrated in Figure 5-8. The model requires that an inner radial distance be defined as well as the number of compass sectors in the outer portion of the keyhole.

5-23 Figure 5-8 Illustration of keyhole expansion from a wind shift MACCS implements the keyhole model using radial distances and compass sectors as previously discussed; however, offsite protective actions are implemented using emergency response planning areas (ERPAs). These ERPAs are established by local authorities and align with geographical features or political boundaries. MACCS models the ERPAs simplistically as a circular area with an extended set of downwind compass sectors as illustrated in Figure 5-8. To determine the keyhole dimensions to be modeled (radius and number of compass sectors) the licensee PAR procedures and the 2013 FEMA After Action Report (AAR) for a full

-scale exercise were reviewed [57], [93]. The licensee PAR procedures include multiple keyhole descriptions, suggesting a keyhole is likely to be implemented. The FEMA AAR provides information on a PAD that was determined from a 2013 full-scale exercise [93]. The initial evacuation in the 2013 exercise included Sectors A

-1, B-1, C-1, and D-1, three of which extend beyond the 2

-mile radial distance. The initial evacuation in the PAD also included Sectors B and C, which extend to the 10

-mile EPZ boundary. Reviewing the potential keyhole options, all of which would include Sectors A

-1, B-1, C-1, D-1, plus downwind sectors, it was determined that modeling a 5

-mile radius

, together with 13 downwind sectors extending to 10 miles was appropriate

. The various cohorts were modeled using either keyhole or circular evacuation as shown below in Table 5

-8. A circular evacuation is used for those cohorts whose evacuation is not determined by the direction of the plume or instruction given from authorities. Cohorts 1 and 5 both independently initiate their evacuation, outside the direction of authorities. Cohort 2, Schools, start their evacuation prior to plume release, and therefore wouldn't be affected by plume direction.

.

5-24 Table 5-8 Cohort evacuation type Cohort Evacuation Type Cohort 1:

10-15 mile shadow evacuees Circular Cohort 2: 0

-10 mile schools Circular Cohort 3: 0

-10 mile special facilities Keyhole Cohort 4: 0

-10 mile transit dependent Keyhole Cohort 5: 0

-10 mile early general public Circular Cohort 6: 0-10 mile middle general public Keyhole Cohort 7: 0-10 mile late general public Keyhole Cohort 8: 0

-10 tail general public Keyhole Cohort 9: Non

-evacuees None Emergency Response Timelines Response timings, travel speeds, and durations of a particular response phase are developed to model and represent emergency response actions.

These account for communications from offsite response organizations (OROs), response by the public, and usability and congestion of the road network. Following notification of the public, MACCS models sheltering followed by evacuation. MACCS employs three evacuation subphases (early, middle, and late), for which travel speeds and durations are defined for each evacuating cohort

. The late subphase lasts until evacuation is complete

. Figure 5-9 illustrates the model implemented for t he Sequoyah emergency response timeline and travel speeds. The MACCS input parameters related to mobilization and evacuation route information were developed primarily from the ETE for Sequoyah [56]. The postulated initiating event for the accident is an earthquake of such magnitude that damage to infrastructure would be expected and evacuation is likely to be limited by lack of usability to the bridges within the EPZ. Figure 5-9 shows normal activity, sheltering, and early and middle subphases of evacuation for each cohort relative to accident initiation. It also shows the assumed times for declaration of SAE, SAE siren, declaration of GE, and GE siren (0.25, 0.75 , 2.0 and 2.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months after the initiating seismic event

, respectively). In the evacuation subphases, it lists the estimated average EPZ travel speeds in miles per hour. The cohort travel speeds are consistent at a particular time of the evacuation with the exception of Cohort 1, which travels outside the EPZ where congestion is expected to be significantly lower.

For the STSBO and LTSBO scenarios modeled in this analysis, it is assumed Sequoyah would declare a SAE in 15 minutes based on EALs being triggered at the plant, notify the state and OROs within 30 minutes, and the OROs could activate SAE siren and EAS within 45 minutes (0.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months ) of accident initiation

. Comparing Sequoyah emergency action levels (EALs) with results from a full

-participation plume exposure pathway EPZ exercise reported in a FEMA AAR [93], it was determined that a GE would likely be declared two hours after accident initiation for both the STSBO and LTSBO. OROs then make a PAD, activate sirens, and broadcast EAS message s. From the FEMA AAR for Sequoyah [93], the time from ORO receipt of the GE declaration to sounding of the GE sirens was 3 6 minutes which was increased to the next 15 minute increment (i.e., 45 minutes). This puts GE siren at 2.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months .

The occurrence of a large earthquake is assumed to cause the early general population (Cohort 5) to respond to the SAE siren rather than to wait for the GE siren and further EAS instructions. This cohort is assumed to prepare to evacuate based on having felt the earthquake, heard the SAE sirens, awareness of school evacuation orders, and possibly other 5-25 media broadcasts

. Although this is an early response, this cohort departs 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and exit s the 10-mile EPZ 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after accident initiation. The tail cohort, which is the latest population to evacuate, exits the EPZ 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months after accident initiation

. The modeling of each cohort is somewhat simplified in that all members of the cohort behave identically. For example, all members begin to shelter and begin to evacuate at the same times. Nonetheless, because a cohort is distributed over an area (the EPZ), and has a variety of evacuation routes to follow, the fraction of a cohort exiting the EPZ is a relatively smooth function of time. While the use of nine cohorts to represent the entire evacuating public is a simplification, it is considered adequately accurate for this application.

The timings and speeds associated with each cohort are uncertain, and depending on the release timing, can impact emergency

-phase doses. These parameters are discussed further in Section 5.9. The fractions of the public assigned to each of the cohorts are not included as uncertain parameters because of current limitations in the ability to sample these input parameters.

Figure 5-9 Sequoyah emergency response timeline and travel speeds MACCS models a delay to shelter (DLTSHL). This period is followed by a delay to evacuate (DLTEVA), which represents the time residents are afforded increased sheltering shielding while preparing to evacuate. These delays are specified for each cohort. The values used in this analysis are representative values that apply to the entire cohort population and derivation of these values for the point estimates used, as well as the uncertainty distributions, are discussed further in Section 5.9.9.1. DLTSHL represents a delay from the time of the start of the accident until a cohort begins to shelter. Shielding factors for normal activity are used during this period. Normal activity is intended to reflect activities conducted over the course of a typical week for the cohort population.

5-26 DLTEVA represents the length of the sheltering period from the time a cohort enters the shelter until the cohort begins to evacuate. This duration may reflect a delay to respond to the evacuation order, to wait for the return of commuters, to wait for public transportation, to shut down operations prior to leaving work, etc. Shielding factors for sheltering are used during this period.

The evacuation subphase durations are defined by DURBEG (duration of beginning subphase), and DURMID (duration of middle subphase). The late subphase is whatever additional time is needed for a cohort to complete the evacuation. Durations are assigned uniquely for each cohort and are adjusted based on the cohort specific attributes. The times are typically assigned such that DURBEG plus DURMID provides sufficient time for evacuees to exit the 10

-mile EPZ. The late subphase accounts for the additional time needed to reach the evacuation boundary, which is 50 miles from the site. MACCS allows one evacuation speed value for each cohort within each subphase; these are ESPEED1 (corresponding to DURBEG), ESPEED2 (corresponding to DURMID), and ESPEED3 (corresponding to the late subphase).

The weather can affect emergency response by reducing travel speeds

. An evacuation speed multiplier (ESPMUL) reduce s travel speed when precipitation occur s, as indicated in the meteorological data file.

The speed multiplier is chosen to be 0.85 based on the ETE [56], which reduces the values of ESPEED to 8 5 percent of the fair

-weather travel speed s whenever precipitation occurs in the weather data.

The meteorology data does not distinguish the type of precipitation; however, snow and ice represent less than 10 percent of the precipitation at Sequoyah.

Shielding from Radiation Exposures Shielding or protection factor s are unitless quantities that reduce radiation exposure and account for protection provided by an action or environmental condition. Shielding is specified in MACCS for cloudshine, inhalation, groundshine, and skin exposure pathways, and for three activity types

normal activity, sheltering, and evacuation

. A shielding factor of unity represents the limiting case of a person receiving the full exposure (i.e., standing outdoors and completely unprotected) and a shielding factor of zero represents the limiting case of complete shielding.

As show in Table 5-9, regular facilities represent normal residences of typical construction such as wood frame houses where most of the general public reside.

Schools and special facilities are larger, more robust buildings capable of blocking more radiation than regular facilities (i.e., lower shielding factors)

. Because the MACCS model assumes non

-evacuees (Cohort 9) are not sheltering or evacuating, they are assigned normal activity for all phases, and therefore, the cloudshine, inhalation, skin, or groundshine shielding factor for sheltering or evacuating does not apply to them. The shielding and protection factors presented in Table 5-9 are primarily based on expert elicitation data collected in NUREG/CR-6526 [81] and evaluated in Gregory et al. [2]. In the Gregory et al. [2] report, uncertainty distributions were derived for cloudshine, inhalation, and groundshine shielding factors for normal, sheltering and evacuation activities. The resulting point estimates in Table 5-9 are taken as the 50 th percentiles of uncertainty distributions (GSHFAC and PROTIN in particular are discussed in Section 5.9.3 because they were considered as part of the uncertainty analysis) for those dose pathways. The technical basis for the cloudshine, inhalation and skin, and groundshine dose pathway shielding factors is discussed in the following paragraphs.

Cloudshine protection represents the fraction of gamma radiation from a plume external to a structure that is able to penetrate the structure. It is assumed that roof structures of regular 5-27 facilities and schools afford similar shielding protection during plume passage; thus, the normal, sheltering and evacuation cloudshine shielding factors (CSFACT) are identical for regular and school facilities. Gregory et al. [2] recommends a uniform distribution for the cloudshine shielding factor and the point estimates listed in Table 5-9 are chosen as the midpoint of the normal, sheltering or evacuation uniform distribution. Because the special facilities population, such as hospital residents, remain indoors at all times, their normal activity shielding factor is also considered to be representative of sheltering. Therefore, their normal and sheltering activity shielding factors are identical to sheltering for regular facilities and schools.

Inhalation and skin protection represents the fraction of the external radioactive particulate matter that leaks into a structure and is able to be inhaled or deposited on the skin. As with the cloudshine shielding factor (CSFACT), the inhalation protection factor (PROTIN) and skin protection factor (SKPFAC) are assumed to be the same for regular facilities and schools. This is because it is assumed that heating, ventilation and air conditioning systems, along with building air permeability, as well as damage sustained to windows and doors during the earthquake, would be similar for both types of structures. Therefore, regular facilities and schools would have similar normal, sheltering, and evacuation PROTIN and SKPFAC factors. Again, as with CSFACT, the special facilities population remains indoors at all times, and as such, their normal activity shielding factor is considered to be representative of sheltering. The skin protection factor (SKPFAC) is assumed to be the same as PROTIN because it also is representative of the fraction of particulate matter than is available during each activity phase to be deposited onto the skin. Derivation of the uncertainty distributions for PROTIN activities and population facilities and subsequent 50 th percentile point estimates reflected in Table 5-9 are discussed in more detail in Section 5.9.3. Groundshine protection represents the fraction of radiation deposited on the ground that is blocked by buildings or terrain. As shown in Table 5-9, the groundshine shielding factor (GSHFAC) is specified to be the same for all cohorts for evacuation. For sheltering, however, the schools and special facilities cohorts GSHFAC is based on expert elicitation data on page C-23 of NUREG/CR

-6526 [136] that account for sheltering in "high shielding buildings." As before, the normal activity for special facilities is taken to be the same as for sheltering because this cohort is expected to remain inside the facility 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months a day. Gregory et al. [2] points out that there was one U.S. expert (Expert A) from the group of experts who provides a technical basis on page C

-7 of NUREG/CR

-6526 [136] for the fraction of time the average U.S. child spends in school during the year. The normal activity GSHFAC for the school cohort accounts for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months per day for 180 days per year spent inside a school building (about 0.125 of a calendar year) and the rest of the time spent similarly as the general public. GSHFAC for the general public in regular facilities is based purely on values published in Gregory et al. [2]. All of the 50 th percentile point estimates in Table 5-9 are derived as described further in Section 5.9.3 and include a modification for the groundshine deposited energy (GSDE) scaling factor

.

5-28 Table 5-9 Shielding and Protection Factors for Evacuating Cohorts Population Facility Type Cloudshine Shielding (CSFACT) Inhalation and Skin Protection (PROTIN and SKPFAC)

Groundshine Shielding (GSHFAC) Normal Activity Sheltering Evacuating Normal Activity Sheltering Evacuating Normal Activity Sheltering Evacuating Regular Facilities (Cohorts 1,4-9) 0.775 0.60 0.95 0.460 0.251 0.98 0.196 0.0946 0.359 Schools (Cohort 2) 0.775 0.60 0.95 0.460 0.251 0.98 0.173 0.00910 0.359 Special Facilities (Cohort 3) 0.60 0.60 0.95 0.251 0.251 0.98 0.00910 0.00910 0.359 Hotspot Relocation Time (TIMHOT) and Dose (DOSHOT)

The hotspot relocation time (TIMHOT) is the estimated time needed to relocate residents who do not evacuate from areas that exceed the hotspot dose threshold (DOSHOT). The specified time (36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months ) is from the time of plume arrival for each grid element

. Hots pot and normal relocation are determined in MACCS based on effective dose to an individual engaging in normal activity projected over a 4

-day period. For Sequoyah deterministic analyses (Section 6.3.2 and Sect io n 6.5), the dose limit that triggers hotspot relocation is chosen to be 5 rem in 4 days consistent with EPA PAGs. The exposure pathways used in the dose projection are cloudshine, groundshine, direct inhalation, and resuspension inhalation. Relocated individuals are removed from the problem for the remainder of the emergency phase and receive no further dose before the subsequent phases

. The EPA PAGs for evacuation are typically used to define the dose thresholds for which the public would be relocated.

In practice, w hen these thresholds are projected to be exceeded , OROs would be expected to relocate individuals from the affected areas. This is typically considered for residents beyond the 10-mile EPZ, but also applies to residents within the EPZ who may have refused to follow the initial evacuation orders (Cohort 9)

. It is assumed these individuals relocate when they understand a release has occurred and they are directly informed they are or soon will be located in a contaminated area. The hotspot and normal relocation time, TIMHOT and TIMNRM, account for all elements that contribute to the relocation timing. This includes time for OROs to define the affected areas, to develop messaging

, and to initiate the EAS to notify the public. This also includes time for the public to prepare to leave and travel out of the affected area. Each of these elements can be influenced by factors such as the size of the affected area, the number of affected residents, the location of residents when the warning is received, available resources to coordinate the relocation, clarity of information, weather, etc. Notification may be augmented by route alerting (which is identified in the offsite emergency plan), Reverse 911

, or other communication methods. MACCS implements this parameter by removing the entire affected population in a grid element at the time designated by TIMHOT after plume arrival. This user specified value was developed as an average time for relocation. In Section 5.9.9 , a distribution is developed to account for uncertainty in relocation timing

.

5-29 Normal Relocation Time (TIMNRM) and Dose (DOSNRM)

TIMNRM is the time to relocate residents from areas that exceed the normal dose threshold (DOSNRM). This user-specified time is relative to plume arrival.

For Sequoyah deterministic analyses, DOSNRM is a dose of 1 rem over a 4

-day projection period. The time (48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months ) include s the same elements described for TIMHOT.

In addition, time may be needed to complete the relocation of residents by the hotspot criteria as a priority

. MACCS implements this parameter by removing the entire affected population within a grid element at TIMNRM after plume arrival

. As with TIMHOT, an average time is developed by considering the various time elements. Both TIMHOT and TIMNRM relocation uncertainties are discussed in Section 5.9.9. Intermediate and Long

-Term Phase s The previous sections focus on protective actions that occur during the early phase, also referred to as the emergency phase. This phase covers the periods of release and emergency response and was chosen to be 7 days in this analysis. Early health effects can potentially occur during this phase if there are large environmental source terms. Unlike previous Surry and Peach Bottom SOARCA analyses [4][5], Sequoyah SOARCA considers an intermediate phase following the early phase.

Intermediate Phase The intermediate phase is modeled as one year, which begins at the end of the early phase. It spans the time period required for authorities to determine whether contaminated areas are suitable for habitation (i.e., based on the MACCS habitability criterion) and to prepare to decontaminate where needed. The duration of the intermediate phase depends on the magnitude of release and the size of contaminated areas that must be evaluated. The dose criteria for habitability during the intermediate phase is chosen to be 2 rem in one year, which is consistent with the EPA PAG [92]. Long-term Phase The long-term phase spans 50 years following the end of the intermediate phase to account for exposure accumulated from groundshine (mainly from longer

-lived gamma emitting radionuclides) and inhalation from the re

-suspension of contaminated soils. The food and water ingestion exposure pathway is not modeled because of the assumption that uncontaminated food and water are available. The dose criteria for habitability in the long

-term phase is selected as 500 millirem per year, which is also consistent with the EPA PAGs [92]. This analysis uses long

-term protective action parameters to reflect values from recent guidance on decontamination costs and times [95]. However, these parameters are not used to calculate economic consequences in this analysis, just as they were not used for that purpose in the Surry and Peach Bottom SOARCA analyses [4][5]. Nonetheless, these parameters affect decisions on whether contaminated areas can be restored to habitability and therefore they affect whether residents return to these areas and, thereby, the potential for further exposure.

Long-term protective action values for the dose projection period, dose limit, population relocation cost, along with all associated decontamination parameters are listed in Appendix B

. While SecPop enables grid

-element-specific values of farmland wealth and non

-farmland wealth, MACCS requires a single value of each for the entire region to determine whether decontamination would be cost-effective if needed to restore habitability. The non

-farmland 5-30 wealth parameter, VALWNF, escalated to 2015 was estimated to be $336,060 per person based on a population

-weighted average of all grid elements within 50 miles

. This value includes public and private property that would be unusable if a portion of the land was temporarily or permanently interdicted due to contamination. A similar process, using farmland area-weighted averages, was used to estimate an average value of the farmland wealth parameter, VALWF, for the region to be $11,916 per hectare. VALWF represents farmland property, including publicly and privately owned grazing lands, farm buildings, and machinery. Sequoyah SOARCA evaluates three levels of decontamination represented by dose reduction factors (DRFs) of 3, 5, and 15, whereas previous SOARCA analyses [4][5] used just two DRFs, 3 and 15. 5.8 Dosimetry and Health Effects The doses computed by MACCS use dose conversion factors. The radiological dose to an individual in a spatial grid element for a specific organ is the summation of the product of (1) the air concentration or ground deposition of a radionuclide, (2) the exposure duration for an exposure pathway, (3) the shielding factor for an exposure pathway, (4) the dose conversion factor for a radionuclide and pathway, and (5) the usage factor for an exposure pathway. This product is summed over the set of radionuclides and exposure pathways to estimate an equivalent dose to a specific organ or tissue. To estimate the likelihood of a specific cancer, an organ dose is multiplied by a cancer risk factor. Similarly, early health effects are estimated from an acute dose to an organ, but using a nonlinear function (i.e., a dose threshold). Further discussion of the model for early health effects and the associated input parameters is provided in Section 5.9.4. For the early phase, two kinds of doses are calculated: (1) acute doses used for calculating early fatalities and injuries and (2) lifetime dose commitment used for calculating cancers resulting from the early exposure. For the long

-term phase, only lifetime dose commitments are calculated because dose rates are expected to be well below the threshold for early health effects. The radionuclide concentrations used in the dose equations depend on the source term from the accident and the specific weather sampled. Shielding factors for the long

-term phase use the early phase normal activity values for the general public to represent the entire population.

The dose conversion factors (DCFs) used in this analysis are identical to those used in the Surry UA [16]. They are from Federal Guidance Report No. 13 (FGR

-13) [96], including dose rate values provided in supplemental files provided with FGR

-13 [94]. This allows both a consideration of the acute effects due to short

-term exposure, and the ability to consider annual doses, as well as 50

-yr committed doses. The dose conversion factor file set used in this analysis, "FGR13GyEquivDCF.INP

", together with its annual dose files, contains dose conversion factors for 825 radionuclides, 26 tissues or organs, effective dose, and four exposure pathways. MACCS allows a more limited set of organ dose quantities than are available in the DCF file. MACCS considers nine organs (including effective) for stochastic health effects and six organs for deterministic health effects from acute exposures. Because the effective organ is not used to estimate cancer risks, MACCS is currently limited to eight organs that can be used to assess cancer risks, which are the following:

leukemia, bone, breast, 5-31 lung, thyroid, liver, colon, and residual. This analysis uses these eight organs to assess seven specific cancer types and one residual cancer type, which represents all other cancer types not specifically modeled. To estimate residual cancers, the dose coefficients for the pancreas are used as a surrogate for dose to soft tissue, following recommendations in an Oak Ridge National Laboratory letter report [80]. The dosimetry calculation considers a usage factor for each exposure pathway. For cloudshine and groundshine, the value is one. For inhalation, the usage factor is a volumetric breathing rate. Consistent with past studies, this parameter is 2.66E

-4 m 3/s for all populations and time periods. This value was derived in NUREG/C R-4551, Vol. 2, Rev. 1, Part 7, for an adult man who sleeps 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months per day and engages in light activity when awake [79]. The ingestion exposure pathway is not included in the model for Sequoyah.

The effective dose (ICRP60ED) is used internally by MACCS for simulating protective action decisions based on dosimetric quantities computed according to a system of radiation protection (see Section 5.7). The tissue weighting factors used to calculate the dose conversion factor for effective dose are taken from ICRP

-60 and are identical to those used in the Peach Bottom and Surry UAs [9][16]. Exposure and Commitment Periods The exposure period for internal pathways, inhalation and ingestion, is the period of time when the inhalation or ingestion occurs; however, doses can continue over a person's entire lifetime following the exposure.

The period of time over which doses are received from an internal pathway is accounted for in the construction of dose coefficients by integrating the doses over a finite period representing a person's lifetime. This period is called a dose commitment period and is usually taken to be 50 years when calculating internal pathway dose coefficients for adults. The assumption is that the average person lives for an additional 50 years following the exposure. Most of the exposures during the long

-term phase are from groundshine; a smaller fraction is from inhalation of resuspended aerosols.

Since groundshine is an external pathway, doses received are concurrent with the exposure.

Dose-Response Models Analysis of different dose-response models that limit health effects from dose rates below specified thresholds are investigated to examine the influence of dose rate on estimated cancer risks. Table 5-10 compares five dose

-rate threshold levels considered in this analysis. The types of models are LNT, annual threshold, and combined annual and lifetime thresholds. Three dose

-response models were considered in previous Surry and Peach Bottom SOARCA analyses [4][5]. The dose

-response relationships can be described as follows:

The NRC accepts the LNT hypothesis as a model for estimating radiation risk and thus it is reported here consistent with previous Surry and Peach Bottom SOARCA analyses [4][5].

5-32 Annual threshold models truncate dose

-response below an average annual radiation dose to a US citizen of 620 millirem, including natural background radiation and the average medical exposure, or of 310 millirem from just natural background radiation. These thresholds are based on estimates from the National Council on Radiation Protection (NCRP) [94]. The highest truncation level used in this analysis is consistent with the Health Physics Society (HPS) position statement

, which states that a quantified risk should not be assigned to doses below 5 rem annually with a lifetime limit of 10 rem [98]. A 10 millirem annual dose truncation level was investigated in this analysis, but as determined for the other SOARCA analyses, it produced results that are only slightly lower than the LNT assumption [8]. Table 5-10 Dose responses modeled Model type LNT Annual Annual Annual HPS Annual threshold n/a 10 mrem/year 310 mrem/year 620 mrem/year 5 rem/year Lifetime threshold n/a n/a n/a n/a 10 rem The probability of a LCF is calculated separately for each cancer type related to a target organ and is based on the technical approach described in the National Academy of Sciences / National Research Council on Biological Effects of Ionizing Radiation (BEIR) V report

[99]. In 2009, the National Research Council released the BEIR VII report, which is the most up to date study of cancer induction from exposure to ionizing radiation [100]. However, because the dose coefficients used in the SOARCA studies are from FGR

-13, which was developed using risk factors from BEIR V, it was decided to use risk factors from BEIR V rather than BEIR VII in this study. A dose and dose

-rate effectiveness factor (DDREF) was applied to all doses in the late phase and to those doses in the early phase that were less than 20 rem (0.2 Sv) to an organ

. This factor, which reduces the health impact of dose, accounts for the fact that protracted doses are believed to be less effective in causing cancers than acute doses.

DDREF for all cancers

, except the breast

, was 2.0, and for the breast it was 1.0, as recommended in the BEIR V report

[99]. The cancer dose

-response factors originate from BEIR V, which recommends a linear dose-response model for all cancer types.

A complete list of cancer risk factors is provided in Appendix B. 5.9 Uncertain MACCS Input Parameters and Distributions There are potentially thousands of parameter values that could be varied in MACCS. However, the UA focuses on a smaller set of parameters that are judged to be uncertain and to have a strong to moderate impact on predicted consequences

. The figures of merit for MACCS are individual LCF risk and individual early fatality risk at specified distances. The Surry UA [16] included a complete review of MACCS parameters identified in Appendix D, "Glossary of Input File Variables," of NUREG/C R-6613, "Code Manual for MACCS2," [54]. The results of that review influenced the selection of the Sequoyah parameters. A review of the MACCS parameters in the Peach Bottom and Surry UA s [9][16] was conducted, and it was determined 5-33 that all parameters previously considered would be considered in this analysis. The following parameter sets were included in the analysis:

deposition, dispersion, shielding, early health effects, latent health effects, and emergency response. Both epistemic and aleatory uncertainty exists for many MACCS parameters, and the combined effect adds complexity when developing the distributions.

Furthermore, for some MACCS parameters, compromise values are necessary when a large number of different situations (e.g., weather trials and time of day) exist, but only one input valu e can be assigned to represent all of the weather trials

. The specified distributions are deemed to be the most appropriate to use for these situations. As a result, the epistemic uncertainty distributions for these parameters attempt to characterize the uncertainty of the most appropriate values.

Aleatory uncertainty in weather is treated in MACCS.

Weather conditions that would apply in the case of a potential accident at some time in the future cannot be known in advance.

MACCS accounts for weather variability by analyzing a statistically significant set of weather trials, and the modeled results are ensemble averages of weather that represent the full spectrum of meteorological conditions (see Section 5.5). This sampling strategy was chosen to represent the statistical variations of the weather and is consistent with MACCS best practices

[8]. Emergency response to a potential accident cannot be known in advance either, because it is dependent on source term magnitude, time of day, weather, and site specific characteristics

. The MACCS parameters varied in this analysis are listed in Table 5-11. The storyboard process described in Section 3.2 was also implemented for MACCS parameters.

Many of the uncertain MACCS parameters have both epistemic and aleatory contributions, and the combined effect adds complexity when developing the distributions.

The focus of this analysis is on epistemic uncertainty; however, some of the distributions developed for the uncertain inputs include aleatory uncertainty.

For example, some of the evacuation parameters also include the effects of weather, which is considered aleatory uncertainty.

While the effects of adverse weather on evacuation speed are partially accounted for through use of a single speed reduction factor, this may not address all weather conditions, and this leads to some uncertainty in the input parameters resulting from weather uncertainty.

No effort was taken to separate aleatory and epistemic uncertainties when they both contribute to individual parameters; instead, a simple approach is taken where weather is considered to be aleatory in nature, and all other uncertainties are considered to be epistemic in nature.

A total of 668 parameters are sampled for the MACCS portion of the UA.

Table 5-12 lists the distributions and bounds related to each group of parameter s. For many of these parameters, the sampling approach implements correlations between two or more of the parameters and is described in detail in this section.

5-34 Table 5-11 Sequoyah MACCS model uncertain parameters Epistemic Uncertainty Deposition Wet Deposition Coefficient (CWASH1)

Dry Deposition Velocities (VDEPOS)

Shielding Factors Groundshine Shielding Factors (GSHFAC)

Inhalation Protection Factors (PROTIN)

Early Health Effects Early Health Effects LD 50 Parameter (EFFACA)

Early Health Effects Exponential Parameter (EFFACB)

Early Health Effects Threshold Dose (EFFTHR)

Latent Health Effects Dose and Dose Rate Effectiveness Factor (DDREFA)

Lifetime Cancer Fatality Risk Factors (CFRISK)

Long-Term Inhalation Dose Coefficients Dispersion Crosswind Dispersion Linear Coefficient (CYSIGA)

Vertical Dispersion Linear Coefficient (CZSIGA)

Time-Based Crosswind Dispersion Coefficient (CYCOEF)

Emergency Response Keyhole Weather Forecast (KEYFORCST)

Evacuation Delay (DLTEVA)

Evacuation Speed (ESPEED)

Hotspot Relocation Time (TIMHOT)

Normal Relocation Time (TIMNRM)

Hotspot Relocation Dose (DOSHOT)

Normal Relocation Dose (DOSNRM)

Aleatory Uncertainty Weather Trials Several of the parameter distributions selected for this analysis are based on expert elicitation data captured in NUREG/CR

-7161, "Synthesis of Distributions Representing Important Non

-Site-Specific Parameters in Off Site Consequence Analysis

" [78]. The United States and the Commission of European Communities conducted a series of expert elicitations to obtain distributions for uncertain variables used in health consequence analyses related to an accidental release of nuclear material.

The distributions reflect degrees of belief for non

-site specific parameters that are uncertain and are likely to have significant or moderate influence on the results.

The methodology in NUREG/CR

-7161 [78] is based on a resampling of the expert values and on the assumption of equal weights of the expert opinions.

5-35 Table 5-12 Uncertain MACCS parameters applied in the analysis Uncertain Parameter Distribution type Mode Lower Bound Upper Bound Wet Deposition (CWASH1)

Log uniform N/A 1.60E-06 1.60E-04 Dry Deposition Velocities (VDEPOS, m/s) Triangular 1 5.04E-04 1.60E-04 1.60E-03 2 4.63E-04 1.46E-04 1.46E-03 3 6.06E-04 1.92E-04 1.92E-03 4 1.02E-03 3.23E-04 3.23E-03 5 2.00E-03 6.32E-04 6.32E-03 6 4.09E-03 1.29E-03 1.29E-02 7 7.89E-03 2.50E-03 2.50E-02 8 1.29E-02 4.09E-03 4.09E-02 9 1.60E-02 5.07E-03 5.07E-02 10 5.15E-02 1.63E-02 1.63E-01 Groundshine Shielding Factors (GSHFAC)* Continuous Linea r Inhalation Protection Factors (PROTIN)*

Uniform Early Health Effects LD50 Parameter (EFFACA)* Hematopoietic Continuous Linear Pulmonary Gastrointestinal Early Health Effects* Exponential Parameter (EFFACB) Hematopoietic Continuous Linear Pulmonary Gastrointestinal Early Health Effects Threshold Dose (EFFTHR)*

Hematopoietic Continuous Linear Pulmonary Gastrointestinal Dose and Dose Rate Effectiveness Factor (DDREFA)* Continuous Linear Lifetime Cancer Fatality Risk Factors (CFRISK)

Multiple organs Truncated Log normal Varies by organ Varies by organ Varies by organ Long-Term Inhalation Dose Coefficients Multiple organs and radionuclides Log normal Varies Varies Varies Crosswind Dispersion Linear Coefficient (CYSIGA, m)

A/B Continuous Log triangular 0.7507 0.3002 1.8768 C 0.4063 0.1625 1.0158 D 0.2779 0.1112 0.6948 E/F 0.2158 0.0863 0.5395 Keyhole Forecast (KEYFORCST, hr)

Uniform N/A 1.0 6.0 Time-Based Crosswind Dispersion Coefficient (CYCOEF)

Log-triangular 0.5 0.2 1.25 5-36 Uncertain Parameter Distribution type Mode Lower Bound Upper Bound Vertical Dispersion Linear Coefficient (CZSIGA, m)

A/B Continuous Log triangular 0.0361 0.0144 0.0903 C 0.2036 0.0814 0.509 D 0.2636 0.1054 0.659 E/F 0.2463 0.0985 0.6158 Evacuation Delay (DLTEVA, hr)

Cohort 1 Triangular 2.0 0.0 4.0 Cohort 2 5.0 1.0 10.0 Cohort 3 4.25 3.0 9.0 Cohort 4 7.5 5 15 Cohort 5 0.5 0 1.0 Cohort 6 2.0 0.25 4.0 Cohort 7 2.75 0.5 5.5 Cohort 8 6.5 1.0 13.0 Cohort 9 N/A N/A N/A Evacuation Speed (ESPEED, mph) Cohort 1 Triangular 20.0 10.0 30.0 Cohort 2 2.0 1.0 5.0 Cohort 3 2.0 1.0 5.0 Cohort 4 2.0 1.0 5.0 Cohort 5 2.0 1.0 5.0 Cohort 6 2.0 1.0 5.0 Cohort 7 2.0 1.0 5.0 Cohort 8 2.0 1.0 5.0 Cohort 9 N/A N/A N/A Hotspot Relocation Time (TIMHOT, hr)

Uniform N/A 24 48 Normal Relocation Time (TIMNRM, hr)

Uniform N/A 36 72 Hotspot Relocation Dose (DOSHOT, rem) Triangular 5 1 7.5 Normal Relocation Dose (DOSNRM, rem) Triangular 1 0.5 2 Weather Trials

- Aleatory Uncertainty N/A *Multiple values, refer to specific parameter section for discussion The MACCS parameters described below represent some of the ones that were considered but not included in the analysis.

Risk of Early Injury The original SOARCA studies did not report risk of early injury [8]. For consistency, this consequence metric was also not included in the Sequoyah SOARCA analysis. Thus, no parameters in this category were made uncertain.

5-37 Ingestion Pathway The ingestion pathway was not treated in the SOARCA analyses because uncontaminated food and water supplies are abundant within the United States, and it is unlikely that the public would eat radioactively contaminated food. Thus, no parameters in this category were made uncertain.

Habitability The habitability criteria is considered to be an important uncertain parameter, but was not included because a detailed sensitivity analysis was performed with the Peach Bottom UA

[9]. The habitability criterion is most important for LCF risks calculated using the LNT hypothesis. The Peach Bottom analysis showed, as expected, that when the dose truncation models are used, the LCF risks are orders of magnitude lower when the habitability criteria is set below the dose truncation level.

Non-Evacuees The fraction of the population that does not evacuate influences the overall risk to the public from a reactor accident. Investigating the uncertainty in the number of non

-evacuees would be reasonable and interesting. However, MACCS requires that population fractions add to unity but WinMACCS does not have the capability to reapportion the other population fractions when one of the population fractions is uncertain, so no attempt was made to account for this uncertainty.

Wet Deposition The wet deposition model parameters include CWASH1 and CWASH2, where the former is a linear coefficient and the latter is an exponential parameter

. In principle , both CWASH1 and CWASH2 are uncertain. However, the available data do not support a joint distribution in the two parameters. CWASH1 captures the effect of wet deposition sufficiently, so no attempt was made to include uncertainty in CWASH2. Cloudshine Shielding Factor The cloudshine shielding protection factor (CSFACT) was included in the Peach Bottom UA [9]. However, it appears that there may be an error in the reference from which the cloudshine distribution was taken.

Since cloudshine usually only contributes about one percent of the total doses to the public, the cloudshine shielding factors for each activity type (sheltering, evacuation, and normal activity) were represented by point values in the Sequoyah SOARCA analysis. Wet Deposition Model (CWASH1) CWASH1 is a linear factor in the expression for the wet deposition rate for aerosols. A log uniform distribution was chosen to represent uncertainty

, with a lower bound of 10

-6 and an upper bound of 10

-4. Under rainy conditions, wet deposition is very effective in depleting the plume. This process can produce concentrated deposits on the ground and create what is often referred to as a hotspot (i.e., an area of higher radioactivity than the surrounding areas) [85]. The uncertainty associated with CWASH1 is potentially important in reactor accident consequence calculations because increasing values for CWASH1 result in increased local concentrations of radionuclides deposited by rainfall events.

Such increased local radionuclide concentrations can have two opposing effects on radiation exposure and resulting health effects. First, high local radionuclide concentrations can increase acute individual exposure s and resulting early health effects. Second, high local radionuclide concentrations can increase the total fraction of a radionuclide release that is interdicted, and thus decrease long-term population exposure s and resulting latent health effects. This happens because the localized, high-concentration area created by the rain is likely to be interdicted, reducing the exposures to 5-38 the residents in the long term. As a result, populations at longer distances receive lower exposure levels because most of the plume has been washed out by the rain.

Rationale for Distribution The model used in MACCS for wet deposition of aerosols over a unit area for a time interval [

t i , t i+1] is given by Eq. 5-2. 2 1 dd()/()(), cCttCtcRCt Eq. 5-2 where t = time (units: s), C (t) = vertically integrated aerosol concentration in the plume at time t (units: Bq/m 2), 2 = fractional removal rate for aerosols (units: 1/s), R = rainfall rate (units: mm/hr), and C 1 (units: 1/s(mm/hr)

C 2) and C 2 (units: dimensionless) are constants used in the definition of . In the computational implementation of aerosol deposition in MACCS, the rainfall rate R changes hourly during a rainfall event and differs for each event; however, the same values for C 1 and C 2 are used for all rainfall events throughout a year. Although rainfall rate is taken into account in the definition of , it is well known that many additional properties of a rainfall event affect aerosol deposition, including (1) distribution of aerosol size, (2) chemical and physical properties of aerosols, (3) distribution of rain drop size, (4) different aerosol removal rates within clouds (i.e., rainout) and below clouds (i.e., washout), and (5) short-term temporal variations in rainfall rate that are lost in reported hourly rainfall rates

[69][70][71][72]. Given that MACCS uses fixed values for C 1 and C 2 for all rainfall events over the course of one year, the indicated range of properties that can affect aerosol deposition presents a challenge in defining uncertainty distributions for C 1 and C 2. Specifically, the values used for C 1 and C 2 in MACCS should compromise values to be used for a large number of different rainfall events , while being the most appropriate values to use for only a few of these events. As a result, the uncertainty distributions for C 1 and C 2 should characterize the uncertainty in the locations of the most appropriate values to use for C 1 and C 2, given that a single value for C 1 and a single value for C 2 are used for all rainfall events during a year.

So, care should be taken to avoid using distributions for C 1 and C 2 that are intended to characterize their variability over the range of individual rainfall events, as the use of such distributions may produce unrealistic results.

The results of the expert elicitations for the wet deposition of aerosols in Appendix A of [73] appear to be for aleatory uncertainty over individual rainfall events.

The strategy adopted here to quantify the epistemic uncertainty associated with values for C 1 and C 2 chosen to represent a year of rainfall events is first to look at the results of a number of studies that obtained these values from data for real rainfall events or from computational models that incorporate effects that are difficult to quantify for observational data (e.g., [69] Tables 10 and 11; [70] Tables 7-11; [71] Table 3; [72] Equations (16) and (21); [74] Table 1; [75] Equations (1) and (2); [76] Figures 2 and 3; [77] Table 9). Next, choose a range of possible values for C 1 and C 2 that is representative of these observational data, while avoiding extreme values. The outcome of this effort is a range of [106, 104] for C 1 and a fixed value of 0.7 for C 2. A fixed value for C 2 is selected because, given a potential range of perhaps [0.6, 0.8] for C 2 , the effects of the much larger range for C 1 dominate the effects of the uncertainty associated with C 2. Given the absence of a reason to assign a particular distribution to the possible values for C 1 , a log-uniform distribution is selected for the range of

[106, 104] so that each order of 5-39 magnitude is assigned the same probability (i.e., 0.5). The CDF is presented in Figure 5-10. C 1 and C 2 in the above discussion correspond to CWASH1 and CWASH2 in the MACCS framework, respectively.

Dr. Hanna, one of the experts involved in the expert elicitation documented in NUREG/CR

-6244 [73], was asked to review the wet deposition parameter distribution. He offered a number of constructive comments, which have been incorporated into this document, and indicated that this distribution is appropriate for this application.

Figure 5-10 CDF of the linear coefficient in the MACCS wet deposition model, CWASH1 Dry Deposition Velocities (VDEPOS) Dry deposition velocities are established for each aerosol bin to represent the dependence of deposition velocity on particle size.

Because MELCOR predicts less than one percent of the released iodine to be in vapor form, vapors are not explicitly considered in this section. Noble gases are in vapor form but are treated as nondepositing.

A triangular distribution is used to represent uncertainty in each of ten MELCOR aerosol particle size bin s. Dry deposition is the sole deposition mechanism for about 94 percent of the hours of the year at Sequoyah.

Since the results in Section 6 show that long-term exposures usually contribute more than 50 percent of the overall exposure, deposition is important. Furthermore, the Peach Bottom UA [9] indicate s that dry deposition velocity is the most important parameter of all those considered for estimation of individual latent cancer risk.

Dry deposition involves a variety of mechanisms that cause aerosols to deposit, including gravitational settling, impaction onto surface irregularities (including buildings and other manmade structures

), and Brownian diffusion.

Dry deposition is a much slower process than 0.00.10.20.30.40.50.60.70.80.91.01.0E-061.0E-051.0E-04Cumulative ProbabilityCWASH1 ( 1/s/(mm/hr)

C2) 5-40 wet deposition but occurs all of the time; whereas, wet deposition occurs intermittently.

Larger values of dry deposition velocity result in larger long

-term doses at shorter distances and smaller doses at longer distances.

The converse is also true that smaller values of dry deposition velocity result in smaller lo ng-term doses at shorter distances and larger doses at longer distances.

Rationale for Distributions As a starting point, the distributions for dry deposition velocity are based on the expert elicitation data in NUREG/CR-6244 [73]. These expert data are evaluated in Revision 1 of NUREG/CR-7161, Section 3

[78]. The expert data show uncertainty ranges of nearly five orders of magnitude for small particles (0.1

µm) and about three orders of magnitude for large particles (10 µm). These ranges seem larger than should be expected for representative values that are to be applied to an entire year of weather trials. In reviewing the expert elicitation documents, it is likely that the experts interpreted the uncertainty to represent uncertainties in an individual weather instance rather than representative values for a large set of weather trials to represent one year of weather data.

In NUREG/CR

-4551, Vol. 2, Rev. 1, Part 7, (pp. 2

-18 to 2-20) [79], the authors describe the uncertainty in deposition velocity for NUREG

-1150 [12]. In that study, a single deposition velocity was used to characterize the entire range of aerosol sizes that would be released into the atmosphere during a reactor accident. The best estimate, based on empirical equations and physical models, was that deposition velocity is 0.3 cm/s and that the reasonable range of uncertainty is 0.03 to 3 cm/s, a range of a factor of 100. This range accounts for uncertainties in aerosol size, wind speed, surface roughness, and aerosol density. Of these uncertainties, aerosol size is explicitly accounted for in the current study, but uncertainty in the other three parameters should have an effect on the overall uncertainty in deposition velocity. Eliminating uncertainty from aerosol size should lead to an uncertainty range for a specific aerosol size that is less than two orders of magnitude, which is clearly narrower than the range provided in the expert elicitation study

[73]. Another parameter not discussed in the NUREG

-1150 documentation is dynamic shape factor, but this should have a relatively minor contribution to uncertainty in deposition velocity.

Estimation of the importance of wind speed, surface roughness, and aerosol density can be made from Eq. 5-3, which is a modified version of Equation 3.1 in NUREG/CR-7161 [78]. The coefficients a through f are updated 50 th percentile values based on Table 3

-1 from NUREG/CR-7161 [78]. For establishing a range of deposition velocities considering uncertainties in surface roughness and wind speed, the important parameters in the Eq. 5-3 are e and f, which are respectively 1.061 and 0.169 in Table 3.1 from NUREG/CR

-7161 [78]. By examining the meteorological data file for Sequoyah, a representative range for wind speed is 1 to 10 m/s, with 1.66 m/s being the annual mean wind speed.

From Eq. 5-3, this range in wind speed leads to about a factor of five in deposition velocity. For larger particles, a range of four in particle density corresponds to a range of about two in deposition velocity. For small er aerosols, particle density has almost no effect on deposition velocity and for that reason it is not included here. If a reasonable range of surface roughness is 10 cm to 60 cm (0.1 m to 0.6 m), the deposition velocities vary by about a factor of 1.5.

From this discussion, assuming that the influences of wind speed and surface roughness are independent, which is reasonable, then the uncertainty range in deposition velocity to account for these effects should be about a factor of 8, as explained below.

5-41 ()=+ln+ln+ln++ Eq. 5-3 Where = , () = , = ,/ = ,/ , , , , , =correlation coefficients The above discussion corresponds to the following equation, which is simply the difference in Eq. 5-3 evaluated at an upper bound and a lower bound set of values:

() ()=ln ()()=[() ()]+[() ()] =1.061(0.6 0.1)+0.169(10 1) Eq. 5-4 Where UB indicates an upper bound value LB indicates a lower bound value Solving Eq. 5-4 for the ratio of the upper bound to the lower bound value of deposition velocity produces a factor of about eight. This value is rounded up to a factor of 10 to account for variations in particle size and density within a bin.

An additional factor that can create uncertainties in particle size and density is the possible absorption of atmospheric mo isture by hygroscopic aer osols. The effect of hygroscopicity is not explicit ly modeled by MACCS, but can be reasonably treated by accounting for the equilibrium size that the hygroscopic particles would achieve for a given relative humidity. Most of the aerosols released in a reactor accident are not particularly hygroscopic, but both CsOH and CsI are highly hygroscopic. Aerosols containing these important species would tend to attract moisture from the air. In an extreme case, a hygroscopic aerosol might increase its mass by a factor of 2, which would increase its diameter by 21/3. For aerosols in the range from 1 to 10 m, this would increase the deposition velocity by about the same factor, 21/3. For smaller aerosols, the effect would be less and for aerosols significantly larger than 10 m, the deposition velocity would increase by a factor of 2 2/3. These large aerosols deposit quickly in any case and do not persist very far downwind. Thus, the relatively small effect of hygroscopicity on deposition velocity is much less than the range of uncertainty employed in this study. To construct distributions to be used in this study for each aerosol size, the 50 th percentile values from the expert elicitation [73] are used as the modes of a set of triangular distributions. These values were chosen because, although the distributions from the expert elicitation process are considered too wide, the median values from these distributions should represent best estimates from the group of experts. The lower and upper bounds of triangular distributions are chosen to be the mode divided and multiplied by the square root of 10, respectively. The 50 th percentile values from the expert elicitation (modes of the triangular distributions) are evaluated from Eq. 5-3 with choices of site-specific Sequoyah surface roughness to be 0.39 m and wind speed to be the mean wind speed, 1.66 m/s. Hydrodynamic particle diameter is 5-42 calculated from MELCOR descriptions for each aerosol bin and the values are shown in Table 5-13. The distribution parameters are tabulated in Table 5-13 and shown in Figure 5-11. Dr. Hanna, one of the experts involved in the expert elicitation documented in NUREG/CR

-6244 [73], was asked to review the dry deposition distributions. He offered a number of constructive comments but did not indicate that the bounds should be modified or that the distribution is inappropriate for this application.

Table 5-13 Dry deposition velocities Triangular Distributions Deposition Velocity (m/s)

Representative Aerosol Diameter (µm) Lower Bound Mode Upper Bound 0.15 1.60E-04 5.04E-04 1.60E-03 0.29 1.46E-04 4.63E-04 1.46E-03 0.53 1.92E-04 6.06E-04 1.92E-03 0.99 3.23E-04 1.02E-03 3.23E-03 1.8 6.32E-04 2.00E-03 6.32E-03 3.4 1.29E-03 4.09E-03 1.29E-02 6.4 2.50E-03 7.89E-03 2.50E-02 12 4.09E-03 1.29E-02 4.09E-02 22 5.07E-03 1.60E-02 5.07E-02 41 1.63E-02 5.15E-02 1.63E-01 Figure 5-11 CDF of dry deposition velocities for mass median diameters representing MACCS aerosol bins 00.10.20.30.40.50.60.70.80.9 11.0E-041.0E-031.0E-021.0E-011.0E+00Cumulative ProbabilityDry Deposition Velocity (m/s)0.150.290.530.991.83.46.4 12 22 41 5-43 VDEPOS is assumed to be perfectly rank

-order correlated across the aerosol sizes.

This prevents small aerosols from depositing faster than large aerosols, which would contradict our understanding of aerosol physics. (Generally speaking, larger aerosols deposit faster than smaller ones, but because of competing deposition mechanisms, deposition velocity is a minimum for particles with ~0.3

µm hydrodynamic diameter. Smaller particles than this size deposit faster because of diffusion. This behavior can be observed in Figure 5-11.) Rank-order correlation is the most commonly used method for correlating uncertain parameters because it is independent of the distributions used for the parameters

. Shielding Factors (GSHFAC and PROTIN)

As part of the overall SOARCA project, an updated technical basis and methodology for radiation dose and health risk estimation was established

[80]. This technical basis, including updated shielding factors

, as described below

, and other risk factors are discussed in this report. During the investigation of the cloudshine shielding factor, CSFACT, issues were identified regarding the source data, which was a Sandia document "Recommendations for MACCS2 Parameter Uncertainty Distributions," prepared by Heames, et al. in 2003

[145]. The internal Sandia report was an attempt to use data from expert elicitation to create distributions for MACCS parameters, and was based on an earlier Sandia letter report written by Gregory [2]. However, while the distributions in Gregory for inhalation and groundshine are identical to Heames, there is no distribution in Gregory [2] for cloudshine and no supporting discussion. Physically, cloudshine shielding and inhalation protection are quite different. Protection from cloudshine represents the fraction of gamma radiation from a plume external to a structure that is able to penetrate the structure; inhalation protection is the fraction of the external concentration that leaks into a structure and is able to be inhaled. Because physically the two distributions should not be identical and because there is no discussion in either source regarding the basis for a distribution for cloudshine shielding factor, a point value was used in this analysis. Since the cloudshine pathway is typically a small contributor to overall dose in MACCS analyses (on the order of one percent), using a set of point value s for the shielding factors (representing evacuation, normal activity, and sheltering) should have a minor effect on the estimated consequence uncertainties.

Groundshine Shielding Factors (GSHFAC and LGSHFAC

) The values of GSHFAC are important because the doses received from groundshine are directly proportional to these factors and groundshine is usually the most important of the long

-term dose pathways. Uncertainty exists in factors that affect GSHFAC, such as fraction of time spent indoor s, shielding values provided by houses and other buildings, and departures from the infinite flat plane assumptions. There are additional contributions to uncertainty in the energy deposited within a human organ for a specified incident radiation, which is represented by the groundshine deposited energy (GSDE) scaling factor.

GSDE is a dimensionless scaling factor used to account for the amount of ionizing radiation energy deposited within various human organs from external radiation emanating from the ground.

Uncertainties in energy deposition in individual organs stem from age, height, and weight variations of the exposed population and are incorporated into GSDE uncertainty; however, GSDE is not a specific MACCS input. So the uncertainty in GSDE is incorporated into the GSHFAC uncertainty distribution. The two mechanisms, shielding from structures and energy deposition into organs, are independent and so are treated as being uncorrelated.

5-44 Rationale for Distributions Continuous linear distributions (for normal activity, sheltering, and evacuation) for the combined GSHFAC and GSDE uncertainty are used in MACCS as an overall uncertainty for GSHFAC.

Regarding GSDE, to simplify the implementation of uncertainty in the energy deposited within a human organ for a specified incident radiation, Eckerman [80] recommends that a single triangular distribution be applied as a multiplicative factor for all radionuclides and for all organs. Eckerman [80] recommends a triangular distribution with a minimum of 0.5, a peak (mode) of 0.8, and a maximum of 1.5 that incorporates variations in ionizing radiation energy and human body variations associated with age, sex, height, and weight.

The triangular distribution (displayed as a CDF) used to represent uncertainty in the dose coefficients for GSDE is shown below in Figure 5-12. Figure 5-12 Cumulative distribution function of GSDE Furthermore, Eckerman [80] suggests that the uncertainties in organ

-specific groundshine dose conversion factors are highly correlated.

This allows an approach that combines the uncertainty in GSHFAC and the uncertainty in the dose coefficients (i.e., through the GSDE uncertainty distribution) into a single uncertainty factor, which can be implemented as an overall uncertainty in the GSHFAC input values used in MACCS. The uncertainties in the GSHFAC and the groundshine dose coefficients are treated as uncorrelated, since they are independent (i.e., the shielding from a building is independent of variations in the geometry of a human body)

. Gregory et al. [2] evaluated the expert data to derive distributions for groundshine from NUREG/C R-6526 [81]. In Gregory et al. [2], three types of activity, evacuation, normal, and sheltering, are evaluated for the groundshine dose pathway, resulting in three sets of shielding 00.20.40.60.8 10.50.70.91.11.31.5Cumulative ProbabilityGroundshine Deposited Energy Scaling Factor (GSDE) 5-45 factor distributions , as shown in Figure 5-13 [2]. These distributions are intended to be used for the general public, but are not appropriate for populations in large, institutional facilities, such as hospitals.

Figure 5-13 GSHFAC cumulative distribution from Table 4.11 of Gregory, et al. [2] Figure 5-14 shows an example of a combined uncertainty distribution in GSHFAC and GSDE for evacuation. The combined distribution is slightly broader than the one for GSHFAC alone, as would be expected considering the range of GSDE goes from 0.5 to 1.5. In fact, the upper end of the range for the combined distribution had to be truncated slightly because MACCS imposes an upper bound of unity for this input parameter.

GSHFAC is specified to be the same for all cohorts for evacuation. For sheltering however, the schools and special facility cohorts are assigned distributions for GSHFAC (convoluted with GSDE) based on expert elicitation data on page C

-23 of NUREG/CR

-6526 [136] that account for sheltering in "high shielding buildings." The distribution for normal activity for special facilities is taken to be the same as for sheltering because this cohort is expected to remain inside the facility 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months a day. Gregory et al. [2] points out that there was one U.S. expert (Expert A) from the group of experts, and that expert provides a technical basis on page C

-7 of NUREG/CR-6526 [136] for the fraction of time the average U.S. child spends in school during the year. The normal activity GSHFAC distribution for the school cohort (convoluted with GSDE) accounts for 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months per day for 180 days per year spent inside a school building (about 0.125 of a calendar year) and the rest of the time spent similarly as the general public. GSHFAC (convoluted with GSDE) for the general public is based purely on values published in Gregory et al. [2]. All of these distributions, as implemented in this UA, were modified to account for uncertainty in GSDE. More details about the distributions used for each cohort and for each activity type are presented below.

00.10.20.30.40.50.60.70.80.9 1 00.10.20.30.40.50.60.70.80.9 1Cumulative ProbabilityGroundshine Shielding Factor (GSHFAC)NormalShelteringEvacuation 5-46 Figure 5-14 CDF of GSHFAC for evacuation accounting for uncertainty in GSDE The distributions for normal activity and evacuation are uncorrelated, i.e., a rank correlation coefficient of 0.0.

The distributions for normal activity and sheltering are correlated with a rank correlation coefficient of 0.8 because both represent fractions of time spent indoors.

The distributions for sheltering and evacuation are taken to be uncorrelated.

The distributions for normal activity and long

-term groundshine shielding factors (LGSHFAC) are considered perfectly rank correlated.

No correlation is assumed between GSHFAC and inhalation protection factors (PROTIN).

Table 5-14 lists the groundshine shielding factor distribution parameters. A value of unity represents full groundshine for a person standing on an infinite flat plane surrounded by a uniform concentration; a value of zero represents complete shielding

. The continuous linear distribution values used represent a combination of uncertainty derived from shielding factors presented in Gregory, et al. [2] and uncertainty in GSDE.

Figure 5-15 shows the final GSHFAC continuous linear distributions used for the cohorts considered , and represent s both types of uncertainty discussed. The long-term shielding factor (LGSHFAC) is taken to be identical to the value for normal activity for the general public population cohorts during the emergency phase and both are shown with a red line in the figure

. 00.10.20.30.40.50.60.70.80.9 1 00.10.20.30.40.50.60.70.80.9 1Cumulative ProbabilityGSHFAC for EvacuationCombined GSHFAC & GSDEGSHFAC 5-47 Figure 5-15 Cumulative distribution functions of GSHFAC (including GSDE) for sheltering, evacuation, and normal activity for all cohorts Table 5-14 Combined groundshine shielding factor (GSHFAC including GSDE) Schools Cohort 2 Quantile Evacuation Normal Activity Sheltering 0.00 0.0457 0.0261 0.000338 0.01 0.1000 0.0476 0.000588 0.05 0.148 0.0683 0.000869 0.15 0.205 0.0961 0.00151 0.25 0.248 0.118 0.00253 0.50 0.359 0.173 0.00910 0.75 0.513 0.249 0.0326 0.85 0.606 0.297 0.0545 0.95 0.778 0.385 0.0953 0.99 0.967 0.489 0.140 1.00 1 0.716 0.221 Point Values 0.359 0.173 0.00910 0.000.100.200.300.400.500.600.700.800.901.000.00.20.40.60.81.0Cumulative ProbabilityGroundshine Shielding Factors (GSHFAC and LGSHFAC) Sheltering (Cohorts 2-3) and Normal (Cohort 3)Sheltering (Cohorts 1 and 4-9)Normal (Cohort 2)Normal (Cohorts 1 and 4-9) and LGSHFACEvacuation (Cohorts 1-9) 5-48 Special Facilities Cohort 3 Quantile Evacuation Normal Activity Sheltering 0.00 0.0457 0.000338 0.000338 0.01 0.1000 0.000588 0.000588 0.05 0.148 0.000869 0.000869 0.15 0.205 0.00151 0.00151 0.25 0.248 0.00253 0.00253 0.50 0.359 0.00910 0.00910 0.75 0.513 0.0326 0.0326 0.85 0.606 0.0545 0.0545 0.95 0.778 0.0953 0.0953 0.99 0.967 0.140 0.140 1.00 1 0.221 0.221 Point Values 0.359 0.00910 0.00910 General Population Cohorts 1 and 4-9 Quantile Evacuation Normal Activity Sheltering 0.00 0.0457 0.0298 0.00825 0.01 0.1000 0.0543 0.0179 0.05 0.148 0.0779 0.0281 0.15 0.205 0.110 0.0425 0.25 0.248 0.134 0.0559 0.50 0.359 0.196 0.0946 0.75 0.513 0.279 0.153 0.85 0.606 0.331 0.189 0.95 0.778 0.427 0.251 0.99 0.967 0.539 0.322 1.00 1 0.787 0.476 Point Values 0.359 0.196 0.0946 Inhalation Protection Factors (PROTIN and LPROTIN

) The inhalation dose protection factor is represented by PROTIN. Individual doses are reduced by the PROTIN inhalation protection factor based on the activity in which the population is engaged, such as sheltering, evacuating, or performing normal activities. The inhalation protection factors used in the MACCS calculation are important because the doses received from inhalation are directly proportional to these factors and inhalation is the dominant dose pathway during the emergency phase. The distributions used in this analysis are derived from NUREG/CR-6526 [81], which collected data from an expert elicitation panel on deposited 5-49 material and external doses.

The expert data indicates that there is a large range of uncertainty in current expert best estimates on the inhalation protection factor.

Rationale for Distributions Gregory et al. [2] evaluated the expert data in NUREG/CR

-6526 [81] to derive distributions for the inhalation protection factor. Three distributions were derived, one each for normal activity, sheltering, and evacuation. Only data from the one U.S. expert were used to determine the time spent in various structures (outdoors, vehicles, and low

-, medium-, and high

-shielded buildings). These times contributed to the calculation of normal activity because it is a weighted average of time spent indoors, commuting, inside various types of buildings, etc. The times were shifted towards outdoors in vehicles for evacuation and shifted towards highly shielded buildings for sheltering. To determine the final distributions from all the experts, the air concentration ratios (indoors/outdoors) were considered for both normally ventilated buildings and buildings with all windows closed.

In reviewing these distributions, it appears that the ranges of the distributions are too large, especially for sheltering and evacuation, with the protection factor for sheltering skewed toward too little protection and evacuation skewed toward too much protection. The experts seemed to be answering the question of what are the maximum and minimum protection factors possible for an individual

whereas , for this work, a representative value for an entire cohort of individuals is needed.

To verify that these judgments are correct, the distributions in Gregory et al. were compared with distributions for inhalation protection factor given in NUREG/CR

-4551 [79], which were prepared for NUREG

-1150 [12]. This source recommended a uniform distribution from 0.15 to 1.0 for normal activity, a uniform distribution from 0.1 to 0.4 for sheltering, and a constant value of 1.0 (no protection) for evacuation

[79]. The recommended distribution for normal activity is similar to the distribution in [2]; whereas, the distribution for sheltering has a significantly smaller range because it only allows for relatively high amounts of protection, indicating sheltering is in robust building structures. In practice sheltering may be enforced wherever people currently are (shelter in place), so the higher values in [2] are plausible for some individuals but not for an entire cohort. As a result, the decision was made to use the distributions for sheltering and normal activities from [2], except to truncate them at the 20 th and 80 th quantiles of each CDF to be representative of cohorts instead of a single member of a cohort. New CDFs were drawn, using the 20 th and 80 th quantile values as the upper and lower bound s while maintaining the 50 th quantile value and the shape of the distributions. The distributions are defined to be continuous linear as a CDF to reflect information from the expert elicitation. Figure 5-16 shows the distributions for inhalation protection factors used for Sequoyah.

An inhalation protection value for evacuation of 0.98, which is from NUREG/CR

-6953, Volume 1

[82], is still considered the best estimate. Expert judgment was used to create a uniform distribution from 0.9 to 1.0, which allows for a limited uncertainty investigation in PROTIN for evacuatio n , but doesn't include large amounts of protection as indicated in Gregory et al. that do not seem physically reasonable for an entire cohort.

The distribution for the long

-term inhalation protection factor is taken to be the same as the distribution for normal activity during the emergency phase. The protection factors for Cohort 1 , Cohort 2 , and Cohorts 4 to 9 were chosen to be identical for each activity type.

Even though two 5-50 of the cohorts, special facilities and schools, are assumed to be in more robust buildings for sheltering than ones used by the general public, they are assumed to have ventilation systems that are similar in terms of air exchange with the outside atmosphere, and so they are assumed to offer similar inhalation protection. The distributions for inhalation protection factor for Cohort 3 were chosen to be the same for normal activity and sheltering because this cohort is assumed to remain indoors around the clock. The distributions used in this analysis are shown in Figure 5-16. The distributions for normal activity and sheltering are correlated with a rank correlation coefficient of 0.75, based on the assumption that the majority of normal activity is indoors and similar to sheltering. Therefore, if sheltering is sampled with a lower value, normal activity should also have a lower value.

The distributions for normal activity for the general public and long-term inhalation protection factor are assumed to be perfectly rank correlated.

No correlations are assumed between PROTIN and GSHFAC for any of the three activity types, evacuation, normal activity, and sheltering. Table 5-15 lists the inhalation protection factor s (PROTIN) used in the Sequoyah analysis. Figure 5-16 CDFs of PROTIN and LPROTIN for normal activity, sheltering, and evacuation 00.10.20.30.40.50.60.70.80.9 1 00.20.40.60.8 1Cumulative ProbabilityInhalation Protection Factor (PROTIN)Normal (Cohorts 1-2 & 4-9) andLong Term (Cohorts 1-9)Normal (Cohort 3) and Sheltering(Cohorts 1-9)Evacuation (Cohorts 1-9) 5-51 Table 5-15 Inhalation protection factor s (PROTIN and LPROTIN) used for Sequoyah Special Facilities Cohort 3 Quantile Evacuation

Normal Activity Sheltering LPROTIN 0 0.900 0.098 0.098 0.336 0.5 N/A 0.251 0.251 0.460 1 1.000 0.699 0.699 0.896 Point Values 0.98 0.251 0.251 0.460 General Population and Schools Cohorts 1-2 and 4-9 Quantile Evacuation

Normal Activity Sheltering LPROTIN 0 0.900 0.336 0.098 0.336 0.5 N/A 0.460 0.251 0.460 1 1.000 0.896 0.699 0.896 Point Values 0.98 0.460 0.251 0.460 *Evacuation PROTIN distribution modeled as a uniform PDF between 0.9 and 1.0 Early Health Effects (EFFACA, EFFACB, EFFTHR)

When radioactive material is inhaled and retained in the respiratory system, an individual may continue to receive a radiation dose for long periods of time after the material was inhaled.

Depending on particle size and chemical form, clearance mechanisms may remove the material from the body or transport it from the respiratory system to other organs of the body.

The MACCS early health effects model accounts for dose protraction from radioactive material inhaled during the emergency phase and retained within the body and calculates an effective acute dose, i.e., a one

-day dose that would induce the same effects as the protracted dose [54]. External radiation is only received during the exposure period, so dose protraction is not an issue. The individual risk of an early fatality is modeled in MACCS using a three

-parameter hazard function, expressed by Eq. 5-5 for a specified target organ (i.e., red bone marrow, lungs, o r stomach) with an acute dose threshold.

The early health effects parameters represented in the equation include:

LD 50 parameter (EFFACA), Exponential parameter (EFFACB)

, also called shape factor, and Threshold dose (EFFTHR).

The Weibull function used to estimate early health effects contains the EFFACA parameter for the lethal dose to 50 percent of the population (LD 50), EFFACB as an exponential parameter that defines the steepness of the dose

-response function, and a threshold dose defined by EFFTHR, below which no acute health effects are estimated to occur.

=0.693 Eq. 5-5 5-52 Where H = hazard function for individual risk of an early fatality (unitless)

DOSE = effective acute dose (Gy) to a target organ. DOSE is set to zero when it is below the threshold, EFFTHR EFFACA = LD 50 (Gy) for a specific health effect EFFACB = exponential parameter in the hazard function (unitless)

The individual risk of a specific type of early health effect is expressed with the following equation: =1exp

( H) Eq. 5-6 All three of the parameters used to estimate individual risk of an early fatality in Eq. 5-5 and Eq. 5-5 are treated as uncertain.

Furthermore, there are three values for each of the parameters for the three organs for which early health effects are evaluated; red bone marrow, lungs, and stomach. A dose to each of the organs is associated with a specific type of early fatality, as follows: an acute dose to the red bone marrow is used to assess occurrences of hematopoietic syndrome, an acute dose to the lungs is used to assess occurrences of pulmonary syndrome, and an acute dose to the stomach is used to assess occurrences of gastro

-intestinal syndrome. When estimating early health effects, it is appropriate to use gray (Gy) as the unit of measure for doses. Doses measured in gray and Sieverts (Sv) are the same for low linear

-energy-transfer (LET) radiation (for gamma and beta radiation), but they are different for high LET radiation (alpha).

Doses in Sieverts are based on a standard radiation weighting factor for high LET radiation of 20; doses from high LET radiation in units of gray are based on either a value of unity or a nonstandard value for radiation weighting factor. In the case of latent health effects, a Sievert captures the biological effects of radiation in terms of the risk for cancer induction. In the case of early health effects, a nonstandard radiation weighting factor of 10 is used for acute doses. This difference is because high LET radiation has a different biological impact for early health effects than it does for latent health effects.

Early Health Effects LD 50 Parameter (EFFACA)

As explained above, the EFFACA parameter represents LD 50, the lethal dose to 50 percent of the population, in the hazard function for a target organ

[54]. EFFACA distribution s are based on expert elicitation data for four types of early health effects, hematopoietic syndrome, gastrointestinal syndrome, pulmonary syndrome, and pneumonitis [78]. The first three of these early health effects are potentially fatal and are included in this analysis

. Pneumonitis is nonfatal and is not reported here.

5-53 Rationale for Distributions The EFFACA distribution s for the three target organs considered are continuous linear CDFs. The basis for the EFFACA distribution s are uncertain characteristics associated with estimation of three types of early health effects, are taken directly from Bixler et al. [78], and are derived from expert elicitation values provided in NUREG/CR

-6545 [135]. The upper and lower bounds of each of the three distributions incorporate the entire range of the expert elicitation data [78]. The CDFs for EFFACA are shown in Figure 5-17. Based on the recommendation provided in Bixler et al. [78], EFFACA is perfectly correlated with the threshold parameter (EFFTHR) for the same health effect. Figure 5-17 CDFs of EFFACA for specified health effects Early Health Effects Exponential Parameter (EFFACB)

The EFFACB parameter represents the exponential or shape factor in the hazard function for each of the three target organs, red bone marrow, lungs, and stomach [54]. 00.20.40.60.8 1 0 8 16 24 32 40 48 56 64 72 80Cumulative ProbabilityEFFACA -Early Health Effects LD 50Parameter (Gy) Hematopoietic SyndromePulmonary SyndromeGastrointestinal Syndrome 5-54 Rationale for Distributions The EFFACB CDFs for the three target organs are continuous linear, and are based on linear interpolation between data points taken from Table 6

-1 of Bixler et al. [78]. The basis for the EFFACB distributions is NUREG/CR

-6545 [135]. The distributions and point values for EFFACB are shown on Figure 5-18. The upper and lower bounds of each of the three distributions incorporate the entire range of the expert elicitation data [78]. Figure 5-18 CDFs of EFFACB for specified health effects Early Health Effects Threshold Dose (EFFTHR)

The EFFTHR parameter represents the threshold dose associated with one of the target organs, red bone marrow, lungs, and stomach [54]. Rationale for Distributio ns The EFFTHR CDFs for the three target organs are continuous linear, and are based on linear interpolation between data points taken from Table 6

-1 of Bixler et al. [78] and are derived from NUREG/CR-6545 [135]. The parameter distributions and SOARCA values associated with these three potentially fatal early health effects for EFFTHR are shown on Figure 5-19. The upper and lower bounds of each of the three distributions incorporate the entire range of the expert elicitation data [78]. As recommended by Bixler et al. [78], EFFTHR is perfectly correlated with the LD 50 parameter (EFFACA) for the same health effect.

00.20.40.60.8 1 2 4 6 8 10 12 14 16 18 20 22 24Cumulative ProbabilityEFFACB -Early Health Effects Exponential Parameter (-) Hematopoietic SyndromePulmonary SyndromeGastrointestinal Syndrome 5-55 Figure 5-19 CDFs of EFFTHR for specified health effects Latent health effect parameters (DDREFA, CFRISK, Committed Inhalation Dose Coefficients)

Dose and Dose

-Rate Effectiveness Factor (DDREFA)

The dose and dose

-rate effectiveness factor (DDREFA) is a dimensionless dose- and organ-dependent reduction factor.

Epidemiological studies used in the development of radiation

-exposure risk models involved subjects who experienced high radiation doses delivered in a relatively short time period [80]. There is evidence that indicates that the biological response per unit dose at low dose rates may be overestimated if one extrapolates from observations made with high doses and dose rates [80]. The degree of overestimation is commonly expressed in terms of a dose and dose

-rate effectiveness factor.

DDREFA is used in MACCS to modify the organ-specific lifetime cancer fatality risk factors (CFRISKs) in order to distinguish between low and high dose exposures incurred during the early phase.

There is significant uncertainty in DDREFA because there is a large amount of scatter in dose

-response data at low doses.

Low dose is generally defined as 0.2 Gy (20 rad) or less and low dose rate is defined as 0.1 mGy/min (600 mrad/hr) or less [99]. MACCS only considers dose

, not dose rate

, in the implementation of DD REFA. In MACCS, doses received during the emergency phase are 00.20.40.60.8 1 0 4 8 12 16 20 24 28 32 36 40Cumulative ProbabilityEFFTHR -Early Health Effects Threshold Parameter (Gy) Hematopoietic SyndromePulmonary SyndromeGastrointestinal Syndrome 5-56 divided by DD REFA when the committed dose is less than 0.2 Sv. (MACCS does not estimate doses in units of Gy for the purpose of calculating latent health effects, so the dose threshold is implemented as dose measured in Sv to the target organ

.) Doses received during the long

-term phase are assumed to be controlled by the habitability criterion to be well below 0.2 Gy, so the risk factors are always divided by DDREFA in the calculation of latent health effects during this phase. Rationale for Distributions Age- and gender

-averaged cancer mortality risk uncertainties were developed by Eckerman for SOARCA [80]. Specifically, a PDF for breast cancer and one for all other types of cancers were developed. However, the PDFs provided in [80] did not integrate to unity; therefore, the PDF s had to be normalized.

The upper bound of DDREFA is 3.0 for breast and 8.0 for other cancers [80]. Eckerman recommended that high LET radiation be assigned a DDREFA of unity (1.0) with no uncertainty [80]; however, the distinction between low and high LET radiation to an organ cannot be distinguished within the MACCS framework; therefore, the PDFs suggested for low LET radiation are applied to all types of radiation.

To implement the uncertainty in DDREFA, a CDF was constructed as a continuous linear function, as shown in Figure 5-20. The value of DDREFA for each organ is independent of the other organs and so they are not correlated [80]. The DDREFA for each organ has a corresponding CFRISK parameter, and these parameters are also uncorrelated.

Figure 5-20 CDFs of DDREFA for breast and other cancer types 00.10.20.30.40.50.60.70.80.9 1 1 2 3 4 5 6 7 8Cumulative ProbabilityDDREFA (unitless)BreastOther 5-57 Lifetime Cancer Fatality Risk Factors (CFRISK)

Estimation of latent cancer fatality (LCF) risks are based on 50

-year lifetime dose commitment s to specified target organs. The implementation in MACCS uses values of CFRISK (risk/Sv) to estimate cancers for a set of cancer types, each associated with an organ, and total LCF risk is calculated by summing the risks for individual cancer types. The values of CFRISK are based on the technical approach described in the National Academy of Sciences / National Research Council Biological Effects of Ionizing Radiation (BEIR) V report

[99]. BEIR V risk models are the basis for FGR-13 [96]. Using BEIR V risk factors along with FGR

-13 dose coefficients in this study ensures that treatments of health effects doses are consistent

. The CFRISK point estimates shown below in Figure 5-21 are based on guidance from Eckerman [80], which are taken from FGR

-13 and have their origin in the BEIR V report.

The values in [80] have been adjusted from values specified for the low

-dose range to values applicable to the high

-dose range, as required by MACCS. The adjustment is simply to multiply each of the values of CFRISK by the value of DDREFA for the same organ.

Doses can occur during all phases of an accident, early, intermediate, and long

-term. Projected doses are the basis for decisions to relocate individuals during each of these phases.

When people are exposed to radiation, doses are used to estimate potential health effects. Return of the population falls within the scope of radiation protection and uses the standard dosimetric quantities of radiation protection, i.e., effective doses.

Estimating health effects is based on equivalent doses to specific organs and organ

-specific risk factors to estimate the number of excess cancer fatalities in a population, where excess cancer fatalities indicates the number over and above those resulting from background occurrences. Both the dose coefficients and risk factors are uncertain

. This section evaluates uncertainties in the cancer fatality risk factors and a subsequent section evaluates uncertainties in the dose coefficients.

Rationale for Distributions Truncated log

-normal distributions were selected for the cancer fatality risk factors based on guidance from Eckerman [80]. This includes estimates of the gender

- and age-averaged uncertainty in CFRISK for each of the organs used for latent health effects.

The distributions provided by Eckerman [80] indicate that cancer risk for leukemia has a very small uncertainty; risks for lung s, breast, colon, and residual (cancer sites not explicitly modeled, e.g., esophagus, stomach, skin, ovaries, bladder, and kidney s) cancers are moderately uncertain; and risk for thyroid, liver, and bone cancers have large uncertainties. Eckerman concludes this based on the premise that inconsistency in expert judgment is a valid measure of uncertainty in cancer fatality risk

. To implement the uncertainty in CFRISK, a CDF was developed for each of the organs as shown in Figure 5-21. Each log

-normal distribution is truncated at +/-3. This represents a truncation at quantile 0.001 and 0.999.

CFRISK for each organ is considered independent of the other organs and therefore the risk factors are not correlated [80].

5-58 Figure 5-21 CDF for CFRISK for each of the included organs Long-Term Inhalation Dose Coefficients The long-term inhalation dose coefficients are used to calculate the organ

-specific equivalent dose commitments and effective dose s (all in Sv) from the inhalation of 1 Bq of a radionuclide.

Uncertainties in inhalation dose coefficients were examined by Pawel et al. [83] to evaluate the uncertainties in the cancer risk coefficients of FGR

-13 [96]. Based on the Eckerman report developed for the SOARCA study [80], the assignment of uncertainty distributions to long-term inhalation dose coefficients for individual radionuclides is difficult because these values are the end products of complex calculations.

These calculations involve a collection of uncertain biokinetic and dosimetric coefficients and assumptions, which Pawel et al. [83] determined to be the largest uncertainty.

The LCF risk factors in MACCS are based on the technical approach described in BEIR V [99] in which long

-term inhalation dose coefficients are part of that approach.

The assessment of the uncertainty in dose is evaluated on the basis of sensitivity analyses in which various combinations of plausible biokinetic and dosimetric models are used to generate alternative dose coefficients, such as those discussed in Pawel et al. [83] and the Eckerman report [80].

5-59 Rationale for Distributions For the long

-term dose coefficients related to the inhalation pathway, Eckerman [80] recommends that the uncertainty distributions for the coefficients be treated as truncated log normal distributions with the geometric means and standard deviations for the 58 radionuclides listed in Table 5-16. For an individual radionuclide, the long

-term inhalation dose coefficients are treated as perfectly correlated for all of the organs except the lung.

The lung is inversely correlated (a correlation coefficient of

-1.0) with the dose coefficients of all of the other organs (red bone marrow, bone, breast, thyroid, liver, colon, and residual).

This means that only one independent input represents (in this case the long-term inhalation dose coefficient for the lungs) all organ

-specific long-term inhalation dose coefficient uncertainty.

The rationale for the correlations is that the inhaled radionuclides may spend more or less residence time in the lungs, depending on the chemical form of the radionuclide and its solubility, and subsequently after departing from the lung s, the radionuclide is carried through the blood stream to other systemic tissues.

Thus, the longer the time spent in the lungs, the greater the dose in the lungs and the less the dose to the other systemic tissues.

The shorter the time spent in the lungs, the smaller the dose to the lungs and the greater the dose to the other systemic tissues.

There are 69 radionuclides considered in the analysis.

Of those, only 58 radionuclides have nonzero dose coefficients for inhalation.

In this UA, these 58 radionuclides, listed in Table 5-16 , are assigned uncertain long

-term inhalation dose coefficients for each of the eight organs used in this analysis, which are lung, red bone marrow, bone surface, breast, thyroid, liver, colon, and residual. The residual dose coefficient (for the pancreas) is used as a surrogate for the collection of organs that are not specifically represented but are important for cancer induction.

Figure 5-22 and Figure 5-23 provide examples of the truncated log normal distributions for two radionuclides, Cs

-137 and Pu

-241, for the eight different organs included in this analysis. Uncertainties in the acute inhalation dose coefficients (used to estimate the early health effects discussed earlier) were considered to be less important and were not included as uncertain parameters in this analysis.

Peach Bottom and Surry SOARCA [4][5] did not include the ingestion dose pathway because uncontaminated food and water supplies are abundant within the United States, and it is unlikely that the public would eat radioactively contaminated food.

Therefore, Sequoyah SOARCA also does not consider the ingestion pathway in the analysis

. Uncertainties in groundshine dose coefficients are treated through uncertainties in the groundshine shielding factors, as explained above. Cloudshine uncertainty is not treated because it is a relatively unimportant dose pathway compared with groundshine and inhalation.

5-60 Table 5-16 Radionuclides treated as having uncertain inhalation dose coefficients.

Radionuclides Co-58 Y-90 Nb-97 Te-127 I-132 Ba-140 Pr-144 Cm-242 Co-60 Y-91 Mo-99 Te-127m I-133 La-140 Nd-147 Cm-244 Rb-86 Y-91m Tc-99m Te-129 I-134 La-141 Np-239 Rb-88 Y-92 Ru-103 Te-129m I-135 La-142 Pu-238 Sr-89 Y-93 Ru-105 Te-131 Cs-134 Ce-141 Pu-239 Sr-90 Zr-95 Ru-106 Te-131m Cs-136 Ce-143 Pu-240 Sr-91 Zr-97 Rh-103m Te-132 Cs-137 Ce-144 Pu-241 Sr-92 Nb-95 Rh-105 I-131 Ba-139 Pr-143 Am-241 Figure 5-22 Cs-137 lifetime inhalation dose coefficient distributions for organs included in the consequence analysis 00.10.20.30.40.50.60.70.80.9 11.0E-091.0E-081.0E-07Cumulative Probability Cs-137 Long-Term Inhalation Committed Absorbed Dose Coefficient (Gy/Bq)Red Bone MarrowBoneBreastLungThyroidLiverColonResidual 5-61 Figure 5-23 Pu-241 long-term inhalation dose coefficient distributions for organs included in the consequence analysis Dispersion (CYSIGA, CZSIGA)

Dispersion of a radioactive plume following a severe accident directly affects doses to members of the population and resulting health effects. Thus, the dispersion parameters used to estimate atmospheric dispersion are potentially important to the outcome of the calculation.

The coefficients used to calculate dispersion use the median values from an expert elicitation, but there is significant uncertainty in these parameters [78]. In terms of predicted health effects, these parameters tend to have a non

-linear effect when using the LNT hypothesis because more dispersion means lower doses to a larger population. Dispersion has an even greater influence on estimated health effects when truncation is used in the dose-response model because a smaller dose to an individual can reduce a nonzero risk to zero and, conversely, a larger dose can increase a zero risk to be nonzero.

Within MACCS, plume dispersion is calculated using the Gaussian plume model, shown in Eq. 5-7 for the simple case of an unbounded plume.

( , ,)= 2exp 1 2exp 1 2 Eq. 5-7 00.10.20.30.40.50.60.70.80.9 11.E-101.E-091.E-081.E-071.E-061.E-051.E-041.E-03Cumulative Probability Pu-241 Long-Term Inhalation Committed Absorbed Dose Coefficient (Gy/Bq)Red Bone MarrowBoneBreastLungThyroidLiverColonResidual 5-62 where (x,y,z) is the time-integrated air concentration at a downwind location (x,y,z), Q is the emitted activity , is the mean wind speed, h is the release height, and and are the standard deviations of the crosswind and vertical normal concentration distributions, respectively.

Q and h are different for each accident sequence, while , , and depend on weather. Uncertainty in is used to capture the uncertainty in crosswind dispersion. The function used to define is given in Eq. 5-8 , = Eq. 5-8 where x is the downwind distance and CYSIGA and CYSIGB are empirical constants chosen to fit observed results. A value for both of the constants must be entered for each of the six Pasquill

-Gifford stability classes (A

-F). In this work, it was beneficial to only sample one of the two constants to simplify the specification of uncertainty.

Bixler et al. [78] characterized the uncertainty as an uncertainty in CYSIGA and this characterization is used here.

Crosswind Dispersion Linear Coefficient (CYSIGA) The crosswind dispersion linear coefficient is represented by CYSIGA. The SOARCA best estimate values for CYSIGA were chosen to be the median of the results of an expert elicitation [78]. Distributions were fit to the expert data and these were roughly lognormal. The median o f the distributions is considered to be a reasonable best estimate value for this parameter; however, the distributions created from the elicitation are not used in this analysis. The expert data indicate about one order

-of-magnitude uncertainty within the 90-percent confidence interval and about two orders of magnitude at the 100

-percent confidence interval.

In retrospect, it appears that the experts considered the question:

What is the uncertainty in the dispersion at a specific point in time, i.e., for a specific weather instance. The appropriate question for this UA is rather: What is the uncertainty in dispersion that is representative of a year of weather data? The second question leads to a narrower distribution because a single set of dispersion parameters is selected to represent a whole year of weather variability in MACCS. This distinction is important when the primary results are means over weather variability. If an extreme value of a parameter could exist at a point in time but is highly unlikely to persist over a large collection of randomly chosen weather variations, then it should not be used in this study to characterize the mean over a year of weather variations. Distributions that express the values that a parameter could take at a specific weather instance should be used in conjunction with a single weather trial or possibly just a single hour from a weather trial, not with a set of weather trials that characterize a whole year of weather data. The sampling method used in this study (see Section 5.5.3) does not draw a set of epistemic parameters for each weather trial but rather for a whole year of weather trials, so this is an important consideratio n for a correct treatment of uncertainty.

There are a number of other sources for uncertainty of CYSIGA , and three parameterizations schemes available in the literature are given as examples in Section 5.7.1 of the MACCS User's Guide [54]. These values were compared to the best estimate values from expert elicitation. It was found that 2/3 of the values were within a factor of three of the best estimate value and were about evenly distributed as larger and smaller. These historic values from Vogt (1977),

5-63 Dobbins (1979), and Panitz (1989) [54] were used by multiple experts in constructing their distributions, showing they continue to be regarded as reasonable bases to estimate dispersion.

Additionally, NUREG/CR

-6853 [84] compared results from MACCS (a Gaussian plume code) with three other codes for transport and dispersion

, and found that the results from the four codes were within a factor of two for compass averaged concentrations and within a factor of three for sector specific concentrations. This factor can be considered to be an approximation of the uncertainty in transport and dispersion. As a first

-order approximation at short distances, the plume concentration is inversely proportional to the value of y multiplied by the value of z. (c.f., Eq. 5-7). Accounting for an uncertainty in concentration of a factor of three above and below the median corresponds to a range of uncertainty in CYSIGA of 0.578 to 1.73 times the median , assuming that both cross

-wind and vertical dispersion have the same ranges of uncertainty. If this range is considered to be the uncertainty at the 90

-percent confidence level, the entire range of uncertainty is reasonably chosen to be bounded by factors of 0.4 and 2.5 on the median value for CYSIGA. Rationale for Distributions The 50 th percentile of the distribution from the expert elicitation [78] is a reasonable choice for the best estimate value to use for CYSIGA. Expert elicitation results are based on a combined category for stability classes A and B and a combined category for stability classes E and F, yielding four distributions for stability classes A/B, C, D, and E/F. Based on the previous discussion, the bounds of the distribution s are set to be a factor of 2.5 higher and lower than the best estimate value for each stability class. All calculated values are shown in Table 5-17. In the Peach Bottom UA

[9], a piecewise log

-uniform distribution was used for CYSIGA because the expert elicitation data were approximately lognormal. Since the range of uncertainty was chosen to be different for this analysis, a simpler log

-triangular distribution was chosen. This choice is consistent with a most likely value at the center of the distribution and a likelihood that decreases as the bounds are approached. A log

-triangular distribution was used instead of a triangular distribution because it gives equal sampling weight on either side of the mode when using a multiplicative factor for the lower and upper bounds.

Table 5-17 Log-triangular values for dispersion parameter CYSIGA for each stability class Class Lower Bound Mode Upper Bound A/B .3002 .7507 1.8768 C .1625 .4063 1.0158 D .1112 .2779 0.6948 E/F .0863 .2158 0.5395 Values of CYSIGA are perfectly rank correlated across the stability classes. These values are also perfectly rank correlated with the values of C ZSIGA, the vertical dispersion parameters. This indicates that uncertainty in CYSIGA is largely caused by weather conditions that would influence both the crosswind and vertical dispersion in a similar fashion. It also ensures that the order between the stability classes is preserved. The CDFs for CYSIGA are presented in Figure 5-24.

5-64 Figure 5-24 CDFs of CYSIGA for individual stability classes Vertical Dispersion Linear Coefficient (CZSIGA) The Surry and Peach Bottom SOARCA best estimate values for C ZSIGA were also chosen to be the median results of an expert elicitation [78]. Distributions were fit to the expert data, which were again roughly lognormal. The median values are appropriate to be used as median value s in Sequoyah SOARCA. However, the distributions fo r C ZSIGA have the same issues as the distributions for C YSIGA, so a narrower distribution is developed and used in this work. The same approach described for C YSIGA leads to distribution bounds on C ZSIGA that are also a factor of 2.5 above and below the median value for each stability class.

Rationale for Distributions The 50 th percentile of the distribution from the expert elicitation [78] is a reasonable and defensible choice for the best estimate value for C ZSIGA. Based on the C YSIGA discussion, the bounds are set at a factor of 2.5 higher and lower than the best estimate value for each stability class. The distribution parameters are provided in Table 5-18. C ZSIGA distributions are perfectly rank correlated with each other and with values of C YSIGA. This indicates that uncertainty in C ZSIGA is largely caused by weather conditions that would affect both crosswind and vertical dispersion in the same way. It also ensures that the order between the stability classes is preserved. Figure 5-25 shows the CDFs of a log

-triangular distribution for each of the four SOARCA stability class groupings.

. 0.00.10.20.30.40.50.60.70.80.91.00.010.1 1 10Cumulative ProbabilityCYSIGA (m)Class A/BClass CClass DClass E/F 5-65 Table 5-18 Log-triangular values for dispersion parameter CZSIGA for each stability class Class Lower Bound Mode Upper Bound A/B .0144 .0361 .0903 C .0814 .2036 .509 D .1054 .2636 .659 E/F .0985 .2463 .6158 Figure 5-25 CDFs of CZSIGA for each of the stability classes Weather Forecast (KEYFORCST)

During an emergency response, protective action decisions for a keyhole evacuation require consideration of wind direction.

Because wind tends to shift over time, MACCS allow s the keyhole to be expanded to account for such wind shifts. It also allows the expansion to occur in advance of an actual wind shift to account for weather forecasting. A parameter in MACCS, KEYFORCST, defines the number of hours of weather forecasting to use in the model. A uniform distribution for KEYFORCST was chosen due to a lack of technical information on what an appropriate distribution would be for weather forecasting. The uniform PDF chosen has a lower bound of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and an upper bound of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

, and is shown in Figure 5-26 as a CDF. MACCS assumes perfect foreknowledge of wind direction for the number of hours defined by KEYFORCST; therefore, the upper bound of this parameter should not be too large since 0.00.10.20.30.40.50.60.70.80.91.00.010.1 1Cumulative ProbabilityCZSIGA (m)Class A/BClass CClass DClass E/F 5-66 weather forecasting is an imperfect science. An upper bound is considered reasonable for this application.

Figure 5-26 CDF of KEYFORCST Time-Based Crosswind Dispersion Coefficient (CYCOEF)

CYCOEF is the linear coefficient for the time

-based, crosswind dispersion model.

Hanna [107] recommends that plume dispersion beyond 30 kilometers (19 miles) be based on time, not on distance. The basis for the recommendation of 30 kilometers is that most measurements upon which dispersion tables are based have a limit of 30 kilometers or less. In the MACCS implementation of the time

-based crosswind dispersion model, this downwind distance, along with the linear coefficient, are used to define the switching point from distance

-based to time

-based dispersion. The recommended default value for the linear coefficient is 0.5 m/s [107]. Sequoyah is the first in the SOARCA series of analyses to use this parameter, so no distribution had been developed for Peach Bottom or Surry UAs [9][16]. This approach homogenizes variations due to stability class, so it is expected to give somewhat different, less variable, results than in the previous SOARCA UAs. However, any differences in results are not expected to change the relative importance of dispersion for the overall results. As implemented in this study for the switch from distance

-based to time

-based dispersion, CYCOEF only affects results beyond 30 kilometers (19 miles), so it affects 50 mile results but has no influence for results within 10 miles and little influence within 20 miles.

To be consistent with the short

-range uncertainty modeling of atmospheric dispersion, the linear parameter in the long

-range model was made uncertain and assigned a similar distribution to those used for the short

-range parameters. All of the dispersion parameters were fully 0.00.10.20.30.40.50.60.70.80.91.0 1 2 3 4 5 6Cumulative ProbabilityKEYFORCST (hours) 5-67 correlated to ensure smooth transitions with changes in stability class and a smooth transition between short

-range and long

-range dispersion modeling.

The approach used to develop a distribution for this parameter is the same as the one used to develop distributions for C YSIGA and C ZSIGA (see Section 5.9.6). Since 0.5 m/s is the recommended value, it is used as the geometric mean of a log-triangular distribution (PDF). The lower bound is chosen to be 0.5 / 2.5 = 0.2 and the upper bound of the distribution is chosen to be 0.5

2.5 = 1.25. The distribution is shown in Figure 5-27 as a CDF Figure 5-27 CDF of CYCOEF Emergency Response (Evacuation and Relocation)

The evacuation subphase durations

, DURBEG and DURMID, and the corresponding speed values ESPEED1, ESPEED2, and ESPEED3 (used for the time following DURMID) are defined in Section 5.7. In previous SOARCA UAs [9][16], two evacuation parameters, ESPEED2 and delay to evacuate (DLTEVA) were made uncertain to reflect uncertainties in the evacuation process, and this same approach is used in Sequoyah SOARCA. ESPEED2 is a logical choice because it is the evacuation speed for most of the time spent within the EPZ, where most of the traffic congestion from seismic damage occurs. Treating DLTEVA as uncertain accounts for uncertainty in the time when evacuation begins.

In addition to speed and delay, relocation parameters are sampled to reflect uncertainty in post

-evacuation activities.

Levels of deposition often vary , potentially resulting in areas with elevated 00.10.20.30.40.50.60.70.80.9 10.20.30.40.50.60.70.80.9 11.11.21.3Cumulative ProbabilityLinear coefficient for time

-based crosswind dispersion (m/s) 5-68 dose rates called hotspots

[85] that may warrant the expedited relocation of residents from affected areas.

Other contaminated areas may warrant relocation on a less urgent basis. MACCS implements relocation using hotspot and normal relocation parameters to represent these possible ORO actions, which would be determined based on dose projections using state, utility, and federal agency computer models and field measurements. In practice, this protective measure could be implemented as a post

-accident relocation or as an expanded evacuation , but the effect is essentially the same in either case. Evacuation Delay (DLTEVA)

The evacuation delay (DLTEVA) for each cohort is unique. Although there is high confidence in the alert and notification system used to warn the public, variation in evacuation response delays have been observed

. Wolshon et al. [89] found that delay is not uniform

, with most of the evacuees experiencing a smaller delay (e.g., 90 percent of the public evacuates in about 60 percent of the response time).

There are reasons for expecting delays in response to nuclear power plant emergencies to be limited. A study found that EPZ residents understand actions that may be expected during an emergency and are well prepared, with 20 percent of EPZ residents having

'go-bags' and being ready to leave promptly

[90]. The variation in public response makes this a good candidate for an uncertain parameter.

Information used to develop the DLTEVA distributions was obtained from the 2013 ETE report for Sequoyah [56]. Rationale for Distribution s A triangular distribution is used to represent DLTEVA uncertainty because the Sequoyah ETE supports the most likely response [56] and indicates that some people leaving early, some late, and most during the middle portion of the response.

Delays can increase due to a slow response to the evacuation order, a need to wait for the return of commuters, a need to wait for public transportation, a need to shut down operations prior to leaving work, etc.

On the other hand, members of the public with

'go-bags' may respond promptly.

MACCS moves cohorts as a group based on population fraction; therefore, representative values are used to represent an entire cohort response. However, because of the distribution of distances to reach the edge of the EPZ for different members of the population, and by using a reasonable set of cohorts to represent different members of the population, the evacuation timing curves in an ETE can be well represented with the MACCS evacuation model.

Cohort 1 represents the shadow evacuation in the 10

- to 15-mile region. The size of the shadow evacuation can be influenced by communication during the emergency and may also be influenced by the earthquake. The timing and content of messaging can cause the number of people in the shadow to increase or decrease and can cause residents to leave earlier or later in the event

, depending on the perceived risk. Shadow evacuations typically begin shortly after a general evacuation begins. Thus the delay parameters chosen for this cohort are similar to those for the middle general public cohort, Cohort 6, where 50% of the EPZ population has mobilized. This choice results in a mode of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for DLTEVA. The shadow evacuation is assumed to be triggered by alert notifications that occur within the EPZ at the GE siren. The 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months accounts for 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to go indoors and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months remaining there, the same as Cohort 6. A lower bound of 0.0 hours0 days 0 hours 0 weeks 0 months was selected for the triangular distribution for DLTEVA to reflect a possible sense of urgency caused by the earthquake and awareness of the SAE and GE sirens. An upper bound of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months was selected to reflect a lower sense of urgency by this cohort

. Cohort 2 represents the schools within the EPZ. Table 6-8 of the ETE report

[56] identifies average school bus mobilization time under normal conditions taking 115 minutes for most 5-69 schools and indicates that there are enough buses that school evacuations can be completed in one wave. Schools are notified directly by OROs upon SAE declaration, which occurs 0.7 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the initiating event (15 minutes for licensee to notify OROs of the SAE and 30 minutes for OROs to notify schools).

In this seismic scenario, conditions are not normal; thus, some additional assumptions are added for schools

, such as: One wave of evacuation would be conducted using additional busing resources available within Hamilton County and neighboring Chattanooga, TN

. High school students with vehicles are not dependent upon school busses. These students may not wait for bus arrival and may also transport friends.

Teachers necessary to support loading of buses would stay and evacuate with children on the buses.

Any remaining teachers would evacuate in their personal vehicles

, taking as many children as possible.

The earthquake is assumed to damage bridges and local communications may also be affected; thus, the time for bus drivers to be notified and travel to the bus depot to pick up their bus is assumed longer than under normal conditions. Under normal conditions, the average bus mobilization time is calculated as 1.92 hours0.00106 days 0.0256 hours 1.521164e-4 weeks 3.5006e-5 months from Table 6

-8 of the ETE [56]. Due to the seismic event, driving from the depot to the schools may also take longer than normal.

In order to capture the possibility of seismically

-impacted roads leading to and from bus depots, the bus mobilization time was doubled to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

A mode of 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months was selected for DLTEVA, which includes the initial 4-hour seismic mobilization time identified for buses, and an additional 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to load students on the busses at schools. The average bus loading time is calculated as 0.92 hours0.00106 days 0.0256 hours 1.521164e-4 weeks 3.5006e-5 months from Table 6

-8 in the ETE [56]. A lower bound on DLTEVA of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months was judged reasonable for the evacuation occurring at the beginning of school or in the afternoon at the end of school

, when buses are already mobilized and are at or near the school when the event occurs.

Furthermore, it is possible the earthquake would not significantly damage roadways.

The 1989 Loma Prieta, California earthquake caused extensive building damage; however, except for the collapse of a single link span of the double deck section of the San Francisco

-Oakland Bay Bridge, most bridges in the area of the San Francisco Bay survived the earthquake with relatively minor damage [91]. An upper bound of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months was established to account for a broader range of delays in school notification, communication with drivers, driver mobilization time to pick up the buses, roadway impediments on the way to the schools, etc.

Cohort 3 represents the special facilities, which would evacuate as resources are available.

Since there are a variety of special facilities, the departure time for this cohort represents an average of when the facilities might depart. Table 6-7 of the 2013 ETE report identifies about 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to mobilize the first wave of vehicles under normal conditions

[56]. The 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months begins after OROs have notified the facilities at SAE declaration, which occurs 0.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months after the initiating event.

The ETE study identifies an insufficient number of vehicles to complete the evacuation in a single wave, and shows a second wave beginning 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after notification.

Unlike the schools, it is not assumed that nurses or other staff would load residents into personal vehicles.

However, since the EPZ is close to the edge of Chattanooga, it is assumed that vehicles could be acquired such that a second wave would not be necessary. A mode of 4.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months for DLTEVA was selected for Cohort

3. This includes 0.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months to notification after 5-70 the initiating event, 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to mobilize as described in the ETE study

, an additional 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to acquire additional resources and to account for additional travel time to the facilities due to damaged infrastructure, and 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to load ambulances and other vehicles as noted in Table 6-7 of the 2013 ETE [56]. A lower bound of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months was selected to represent that there are some facilities with onsite transportation resources and three of the five facilities (80% of the special facility population) are within 2 miles of the EPZ boundary.

A factor of two was applied to the mode providing a rounded value of 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months for the upper bound. The factor of two was based on analyst judgment that additional time may be needed to acquire additional resources due to competing priorities or due to damaged infrastructure. Cohort 4 represents the 0

- to 10-mile transit

-dependent population. This cohort represents the homebound residents who are considered sheltered until they begin to evacuate.

Given the proximity of the EPZ to Chattanooga, TN, and the abundance of vehicular resources in Bradley and Hamilton Counties, it is assumed that sufficient resources can be mobilized but with somewhat longer times than buses for schools, Cohort 2. Therefore, a mode of 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months was selected for this cohort, which includes 2.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months to the GE siren, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to mobilize evacuation resources on seismically

-impacted roads, and 0.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months to load transit

-dependent persons. A lower bound of 3.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months was selected to represent conditions where there are potentially fewer transit

-dependent evacuees due to support from family and friends who assist with evacuation.

This lower bound approximates the 2013 ETE estimate of 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months to mobilize buses and 45 minutes to load transit

-dependent persons [56]. An upper bound of 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months (double the mode) was selected to represent fewer vehicular resources and a second wave of vehicles needing to travel through areas with damaged infrastructure.

Requiring a second wave of vehicles is indicated as a possibility in the 2013 ETE [56]. Cohort 5 represents the first group of the 0

- to 10-mile general public. This group is assumed to evacuate without being ordered to do so and it includes 10 percent of the total general public residing within the EPZ. This cohort is assumed to mobilize and evacuate based on hearing the SAE siren prior to the official evacuation order. This assumption is based on the occurrence of a large seismic event that would be felt by everyone within the EPZ.

EPZ residents generally understand actions that may be expected during an emergency and are well prepared, with 20 percent of EPZ residents having

'go-bags' and are ready to leave promptly. Studies with focus groups have identified that a fraction of EPZ residents had pre

-planned their actions in case of an emergency and were ready to leave promptly

[90]. Because of the large earthquake that is assumed to trigger the accident, it is assumed this cohort leaves after the SAE sirens instead of waiting for the GE sirens and corresponding evacuation order

. A DLTEVA mode of 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months was selected for the average mobilization time of the early evacuees.

This was selected considering sirens for the SAE are activated and residents take some time to prepare and pack prior to leaving.

A DLTEVA mode of 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , together with 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for DLTSHL, equates to the early evacuees departing at 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the initiating event, 0.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months after SAE siren. A lower bound of 0

.0 hours0 days 0 hours 0 weeks 0 months for DLTEVA was selected to reflect a sense of urgency influenced by the large earthquake and subsequent sounding of the SAE sirens.

An upper bound of 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months was used for this cohort because impediments, such as inability to open garage doors, need to shut off gas and electricity, etc., could delay residents as they are preparing to leave.

Cohort 6 represents the middle fraction of the 0- to 10-mile general public and represents 40 percent of the general public. The 2013 ETE report shows that 50 percent of the general population can depart in 1.08 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months [56]. Rounding up to 1.25 (quarter

-hour increments are considered to be sufficient fidelity for response actions) and doubling this delay to 2.5 to account for seismic mobilization delays and adding on the time of the GE siren, 2.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months , leads to a 5-71 departure for this cohort at 5.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after the initiating event. This is modeled using a 3.25 hour2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months delay to shelter (DLTSHL) and a DLTEVA mode of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Although there may be greater urgency due to the earthquake, there may also be impediments that slow the preparation activities. A lower bound of 0.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months for DLTEVA, which corresponds to 0.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months after the GE siren, is selected to represent urgent preparation due to the earthquake and fewer impediments that might slow departure. An upper bound of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months was selected to represent additional impediments

, such as inability to open garage doors, need to shut off gas and electricity, etc., that could delay residents as they are preparing to leave.

Cohort 7 represents the late fraction of the 0- to 10-mile general public and includes 40% of the general public. The 2013 ETE report shows tha t 90 percent of the general public can mobilize in 1.67 hours7.75463e-4 days 0.0186 hours 1.107804e-4 weeks 2.54935e-5 months [56]. Rounding up to 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months (quarter

-hour increments are considered to be sufficient fidelity for response actions) and doubling this delay to account for seismic mobilization delays and adding on the time of the GE siren, 2.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months , gives a departure time of 6.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after accident initiation for this cohort. This is modeled with a 3.5

-hour delay t o shelter (DLTSHL) and a DLTEVA mode of 2.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months . A lower bound of 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , 1.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after the GE siren, was selected to represent urgent preparation due to the earthquake and relatively few impediments to departure

. An upper bound of 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months was selected to represent additional impediments

, such as inability to open garage doors, need to shut off gas and electricity, etc., that could delay residents as they are preparing to leave.

Cohort 8 represents the evacuation tail (or slowest fraction) of the 0- to 10-mile general public. The 2013 Sequoyah ETE report

[56] shows that 90 percent of the general public complete s evacuation in about 3.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months , which is approximately the time the tail would begin to evacuate. Doubling this delay to account for seismic delays to mobilize and adding the time of the GE siren gives an evacuation time of 10.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after accident initiation. This is modeled with a 3.75

-hour delay to shelter (DLTSHL) and a DLTEVA mode of 6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

A lower bound of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is selected to reflect a reduction in delay because residents have a sense of urgency due to the earthquake.

An upper bound of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months is selected to reflect a range of delays that contribute to the tail, such as waiting for commuters, shutting down equipment, and the potential delays identified for the previous cohorts.

Cohort 9, the nonevacuating cohort, does not have an associated uncertainty distribution because the parameters discussed above do not apply to this cohort.

Table 5-19 provides a listing of the cohorts and the values used in the triangular distributions for delay to evacuate, DLTEVA

. The CDFs for these distributions are shown in Figure 5-28. Evacuation delays are sampled independently for each cohort.

The values for Cohort 4 through Cohort 8 were perfectly rank correlated to ensure that the intended ordering of the cohorts is preserved. For each cohort

, the timing of evacuation is sampled independently at each radial distance in the grid (a ring). These values are perfectly rank correlated so that the entire cohort begins to evacuate at approximately the same time.

5-72 Table 5-19 MACCS uncertain parameters

- evacuation delay (DLTEVA). Cohort Mode (hours) Bounds (hours) Cohort 1:

10-15 mile shadow evacuees 2.0 (7200 sec)

LB = 0.0 UB = 4.0 Cohort 2: 0

-10 mile schools 5.0 (18000 sec)

LB = 1.0 UB = 10.0 Cohort 3: 0

-10 mile special facilities 4.25 (15300 sec)

LB = 3.0 UB = 9.0 Cohort 4: 0

-10 mile transit dependent 7.5 (27000 sec)

LB = 5.0 UB = 15 Cohort 5: 0

-10 mile early general public (10%)

0.5 (1800 sec)

LB = 0.0 UB = 1.0 Cohort 6: 0

-10 mile middle general public (40%)

2.0 (7200 sec)

LB = 0.25 UB = 4.0 Cohort 7: 0-10 mile late general public (40%)

2.75 (9900 sec)

LB = 0.5 UB = 5.5 Cohort 8: 0

-10 tail general public (10%)

6.5 (23400 sec)

LB = 1.0 UB = 13.0 Cohort 9: Non

-evacuees N/A N/A Figure 5-28 CDF of DLTEVA for each cohort

5-73 Evacuation Speed (ESPEED

2) The ESPEED2 parameter represents the speed for each of the evacuating cohorts for the duration of the middle phase. Speeds are developed for the cohorts as a group and are dependent on traffic conditions at a particular time after the accident

. As cohorts enter the ro ad network, congestion builds and speeds slow down.

The approach to developing speeds begins with the ETE study

[56], which provides the time to evacuate 90% and 100% of the public and time to evacuate schools, special facilities, and the transit

-dependent public.

Thus, the estimated time s to evacuate 90% and 100% of the public are known for a variety of evacuation scenarios. The time to depart is also known from the ETE study [56]. The difference in departing and exiting the EPZ is the travel time.

Since the evacuation distances are known, the speeds are developed for each cohort. Similar to the delay times, the speeds are generally decreased to account for the seismic impact on the road network

. Following the NRC guidance on developing ETE studies

[57], the Sequoyah ETE report

[57] includes a roadway impact scenario, in which SR 58 was removed from the evacuation network and evacuees were rerouted to alternative locations outside the EPZ. SR 58 is the primary evacuation route on the eastern side of the EPZ

[49]. The ETE study provides an evacuation time for the roadway impact scenario of about 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for the 90

- and 1 00-percentile ETEs , respectively. As a point of reference for the assumed evacuation speeds in this analysis, the 2013 ETE [56] indicates that the non

-seismically impacted average evacuation travel speed for the full EPZ winter day normal weather scenario is 17.7 mph. Because the earthquake affects the entire EPZ, not just SR 58, a separate capacity analysis, provided in Appendix C, was performed to determine the evacuation speeds.

Rationale for Distribution s A triangular distribution was used to represent uncertainty because there is a reasonable degree of confidence that the mode developed from the capacity analysis is the most likely value. Speeds can vary by cohort depending on the evacuation routes selected by each cohort, the location of the cohort within the EPZ (e.g., schools may be near the edge of the EPZ), and the time the cohort enters the roadway.

After speeds were established for the roadways, adjustment factors were applied using the ESPGRD parameter to account for congestion and bottlenecks. ESPGRD is a MACCS parameter that allows evacuation speeds to be adjusted in each grid element to reflect bottlenecks and variations in roadways that cause traffic to slow down or speed up.

Cohort 1 represents the 10- to 15-mile shadow evacuation

, which is travelling on different portions of the road network than the EPZ population, thus the speeds are not directly related to evacuation speeds within the EPZ

. Although shadow evacuations occur in response to emergencies, the effect of the shadow evacuation on the EPZ evacuees is seldom significant [86]. A mode of 20 mph was judged reasonable since the shadow evacuees would avoid the congestion in the EPZ. An upper bound of 30 mph was judged reasonable to account for light traffic congestion and increased roadway capacity beyond the EPZ.

Furthermore, the infrastructure beyond the EPZ is not assumed to be damaged in this scenario, thus the roadways are assumed usable. A lower bound of 10 mph was selected to reflect the potential that power outages exist in the Chattanooga area causing traffic delays.

Cohort 2 represents schools within the EPZ. A speed of 2 mph was used for the mode because the long mobilization time for this cohort places the school buses on the roadway during the peak of the evacuation when congestion is greatest.

A lower bound of 1 mph was judged 5-74 reasonable to account for additional congestion and other impediments to the evacuation. An upper bound of 5 mph was judged reasonable based on the potential for less congestion if the evacuation was to occur in the morning or afternoon when buses can be rapidly mobilized. Bus availability near the schools before returning to one of three Hamilton County centralized bus depots would place them on the roadway network before significant congestion occurs.

Cohort 3 represents the special facilit ies within the EPZ. A mode of 2 mph was chosen and reflects facilities that evacuate independently, but on average, are likely to enter the roadway network while some congestion exists. A lower bound of 1 mph was selected to represent the potential for greater congestion and the need to travel f arther to find accessible exits from the EPZ. An upper bound of 5 mph was judged reasonable to represent evacuating later when roadways are less congested or very early for facilities with transportation resources onsite. Cohort 4 represents the 0

-10 mile transit dependent population.

The mobilization to evacuate this group takes time

, putting the evacuees on the roadway while other cohorts are also on the roadway. The mode is 2 mph which reflects the transit

-dependent population evacuating under congested conditions while the schools, general public, and tail are evacuating. A lower bound of 1 mph was selected to reflect the potential for greater congestion and the need to travel f arther to find accessible exits from the EPZ. An upper bound of 5 mph was selected to reflect the possibility that the evacuation is less impeded.

Cohort 5 represents the early general public, which enters the roadway network before they become congested

. Infrastructure damage is quickly encountered, as reflected by the slow speeds for this cohort. A mode of 2 mph was estimated based on the potential extent of infrastructure damage that cause s evacuees to alter their routes and find less obstructed pathways out of the EPZ. A lower bound of 1 mph was selected to reflect the potential for greater congestion and the need to travel farther to find accessible exits from the EPZ. An upper bound of 5 mph was selected to reflect the possibility that evacuation is less impeded.

Cohort 6 represents the EPZ middle general public evacuees who begin to evacuate soon after OROs declare an evacuation is needed. At this time in the event, schools, medical facilities, and the earl y evacuees have mobilized and congestion is already assumed to have occurred. A mode of 2 mph was estimated based on the evacuation times calculated in the capacity analysis (Appendix C). A lower bound of 1 mph was selected to reflect severe congestion.

An upper bound of 5 mph was selected to reflect the possibility that the evacuation is less impeded.

Cohort 7 represents the EPZ late general public evacuees who begin to evacuate after OROs declare an evacuation is needed but require more time to mobilize and prepare compared with Cohort 6. At this time in the event, schools, medical facilities, and the earl y evacuees have mobilized and congestion is already assumed to have built up. A mode of 2 mph was estimated based on the evacuation times calculated in the capacity analysis (Appendix C). A lower bound of 1 mph was selected to reflect severe congestion.

An upper bound of 5 mph was selected to reflect the possibility that the evacuation is less impeded.

Cohort 8 represents the evacuation tail for the EPZ public, which follows the first three groups of the general public evacuation.

The initial speed of the tail is the same as the general public because they enter the roadway immediately behind the general public. A mode of 2 mph was estimated.

The lower bound was set at 1 mph (the same as the lower bound for Cohort 6) to reflect severe congestion. The upper bound of 5 mph represents roadways have less congestion once the majority of vehicles have left the area. At the time this cohort is evacuating, 5-75 it is likely local news would broadcast the locations of bridge failures, reducing the time needed for the tail to find alternative routes.

Cohort 9 does not have an associated uncertainty distribution because it is the nonevacuating cohort. Therefore, there is no variability considered in the evacuation delay or speed.

Table 5-20 provides a listing of the cohorts and the values used in the triangular distribution. Cohort parameters are sampled from the distributions shown on Figure 5-29. Evacuation speeds are perfectly rank correlated between cohorts.

Table 5-20 MACCS uncertain parameters

- evacuation speeds (ESPEED2) Cohort Speed Mode (mph) Speed Bounds (mph) Cohort 1:

10-15 mile shadow evacuees 20.0 (8.9408 m/s)

LB = 10.0 UB = 30.0 Cohort 2: 0

-10 mile schools 2.0 (0.89408 m/s)

LB = 1.0 UB = 5.0 Cohort 3: 0

-10 mile special facilities 2.0 (0.89408 m/s)

LB = 1.0 UB = 5.0 Cohort 4: 0

-10 mile transit dependent 2.0 (0.89408 m/s)

LB = 1.0 UB = 5.0 Cohort 5: 0

-10 mile early general public (10%)

2.0 (0.89408 m/s)

LB = 1.0 UB = 5.0 Cohort 6: 0

-10 mile middle general public (40%)

2.0 (0.89408 m/s)

LB = 1.0 UB = 5.0 Cohort 7: 0-10 mile late general public (40%)

2.0 (0.89408 m/s)

LB = 1.0 UB = 5.0 Cohort 8: 0

-10 tail general public (10%)

2.0 (0.89408 m/s)

LB = 1.0 UB = 5.0 Cohort 9: Non

-evacuees N/A N/A 5-76 Figure 5-29 CDFs of ESPEED for each cohort Hotspot Relocation Time (TIMHOT)

A hotspot relocation time distribution was developed to account for a range of affected populations, seismic impact s, and other characteristics that influence relocation.

The timing of initial release for the Sequoyah STSBO is bimodal: there are a small number of sequences in which the containment fails early and releases are fairly significant; there are a large number of sequences in which the containment does not fail or fails late (e.g., 50 hours5.787037e-4 days 0.0139 hours 8.267196e-5 weeks 1.9025e-5 months after accident initiation) and releases are very small. The value of TIMHOT that would be estimated for these two sets of sequences is very different because the time delay is from plume arrival. When release begins around 50 hours5.787037e-4 days 0.0139 hours 8.267196e-5 weeks 1.9025e-5 months , there has already been ample time to evacuate the EPZ and, therefore, relocation should occur relatively quickly. When release begins early, e.g., 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after accident initiation, there could be significant delays to begin relocation because evacuation of the EPZ takes first priority. For this analysis, relocation timing is based on the early releases, not the late releases. The reasoning is that timing of relocation is much more critical for the early releases than for the late releases. The distributions derived in this section end up being conservative for late

-release sequences.

Rationale for Distribution A uniform distribution was used to represent uncertainty, because the potential influences in activity duration during the emergency make any value within the range defined in this section

5-77 about equally probable

. Few of the time

-contributing activities can be estimated with confidence prior to an event, such as the affected area, affected population, available transportation infrastructure, and need for traffic control.

It is assumed relocation is implemented after evacuation is complete, or nearly complete, to limit extra traffic in areas through which the evacuees are travelling.

This approach allows emergency responders who were supporting the evacuation to transition from evacuating to relocating residents.

The lower bound was developed based on an optimal relocation implemented after plume arrival.

Capabilities exist to project hotspot areas, and OROs could request the public make preparations to leave, prior to the release.

The final time element is traveling out of the affected area.

Assuming release begins at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (cf., Section 4.4) and evacuation is mostly complete at 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months (cf. Figure 5-9), a value of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for TIMHOT corresponds to relocation beginning concurrent with the completion of evacuation. However, the OROs would require some additional time to assess contamination levels and potential doses to the public outside of the EPZ. Finally, some amount of time is required for the public to respond to relocation instructions and to depart the area. Considering all of these additional delays, a range of values for TIMHOT of 24 to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is estimated. A midpoint value of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months is used for the reference and sensitivity analyses reported in Section

6. The upper bound represents conditions in which there is a delay in relocation, which could occur for many reasons. For example, OROs may decide to wait until the morning, rather than trying to mobilize families at night. Dow and Cutter [103] identified that the majority of hurricane evacuation trips begin during normal waking hours.

Fu and Wilmot [104] profiled a hurricane evacuation time of day pattern

, which showed people are least likely to evacuate at night, with an increasing likelihood during the morning and even greater likelihood during the afternoon.

Loss of communication, infrastructure damage, or OROs focused on activities within the EPZ or having other conflicting priorities could contribute to a longer delay. Because relocation is based on projected dose over a 4-day period following plume arrival , assessing the need to relocat e may not have the same priority as other urgent requirements.

It is also possible that response officials may choose to have the population shelter in place for a period of time.

An upper bound of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months after plume arrival was judged reasonable. The CDF for TIMHOT is presented in Figure 5-30.

5-78 Figure 5-30 CDF of TIMHOT Normal Relocation Time (TIMNRM)

The normal relocation time (TIMNRM) is the time to relocate residents from areas that exceed the normal dose threshold (DOSNRM). This user specified time is relative to plume arrival.

The time includes the elements described for TIMHOT.

In addition, time may be needed to allow clearance of residents relocated due to the hotspot criteria.

As with TIMHOT, a range of time s is developed by considering these influencing factors.

Rationale for Distribution A uniform distribution is used to represent uncertainty in TIMNRM because the potential influences in activity duration during the emergency make any value within the range defined in this section equally possible for the same reasons described with TIMHOT.

However, normal relocation has a lower dose threshold and may not be implemented with the same urgency as hotspot relocation. The lack of directly applicable data for this type of relocation also supports use of a uniform distribution.

Similar to TIMHOT, the lower bound is developed based on an optimal response where OROs relocate residents after plume arrival.

Notifications can be accomplished via EAS messaging, but route alerting would be necessary to notify the affected public and is estimated to take about 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to put in place. Traffic control would likely be established to support a relocation effort. A time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months was used in the reference and sensitivity analys e s. A lower bound of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months after plume arrival was judged reasonable.

These values, 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months for the lower limit and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for the reference case, are 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months later than the corresponding values for hotspot relocation. An upper bound of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , a factor of 2 above the lower bound, was judged reasonable.

0.00.10.20.30.40.50.60.70.80.91.0 24 26 28 30 32 34 36 38 40 42 44 46 48Cumulative ProbabilityHotspot Relocation Time (hr) 5-79 The upper bound represents conditions where OROs may be focused on activities within the EPZ or have other conflicting priorities that delay relocation activities.

Furthermore, OROs may delay relocation until daylight hours

. Because normal relocation is for populations that are projected to exceed a 1 rem dose over a four-day period, it may not have the same priority as other urgent requirements.

The CDF for TIMNRM is presented in Figure 5-31. TIMNRM is perfectly rank correlated with TIMHOT because MACCS requires TIMNRM be greater than (or equal to) TIMHOT. Furthermore, it is reasonable that delays for hotspot relocation would directly impact the timing of normal relocation.

Figure 5-31 CDF of TIMNRM Hotspot Relocation Dose (DOSHOT)

The hotspot relocation dose (DOSHOT) is a projected dose used to initiate hotspot relocation. If the total dose to individuals exceeds DOSHOT, those people are relocated (i.e., removed from the analysis) at a user specified hotspot relocation time (TIMHOT) in the early phase.

DOSHOT is often chosen to be the upper bound of the projected dose range provided in the EPA PAG Manual (Table 1 Planning Guidance and Protective Action Guides for Radiological Incidents)

[92]. This should not be confused with the EPA PAG Manual criteria for relocation specified for the intermediate phase.

Rationale for Distribution A triangular distribution is used to represent the uncertainty in DOSHOT because the mode is considered to be the most likely value (5 rem) based on the EPA PAGs

[92]. The range was 0.00.10.20.30.40.50.60.70.80.91.0 36 40 44 48 52 56 60 64 68 72Cumulative ProbabilityNormal Relocation Time (hr) 5-80 developed recognizing that ORO decisions are influenced by many factors that could result in a higher or lower value.

The EPA PAG Manual provides a range of 1 to 5 rem for implementing protective actions and explains that under normal conditions, evacuation should be implemented when residents are expected to receive 1 rem dose over a four-day projection period [92]. The upper bound for this distribution was increased 50 percent above the EPA PAG to 7.5 rem, based on analyst judgment. The lower bound was set at 1 rem, which is the mode of the normal relocation criteria (DOSNRM). The CDF is presented in Figure 5-32. Figure 5-32 CDF of DOSHOT Normal Relocation Dose (DOSNRM)

The normal relocation dose (DOSNRM) is a projected dose used to initiate normal relocation. If the total dose to individuals exceeds DOSNRM, those people are relocated (i.e., removed from the analysis) at a user specified normal relocation time (TIMNRM) during the early phase. DOSNRM is typically chosen to be the lower bound of the projected dose range provided in Table 1.1 of the EPA PAG Manual

[92]. Rationale for Distribution A triangular distribution is used because the mode (1 rem) is considered to be the most likely value based on EPA PAGs

[92]. It is assumed that OROs would attempt to meet the EPA PAG barring unforeseen circumstances. Based on analyst judgment, the upper bound for this distribution was chosen to be a factor of two greater than the mode , 2 rem. A lower bound of 0.5 rem was judged reasonable. A low threshold value causes the size of the affected area to 0.00.10.20.30.40.50.60.70.80.91.0 11.5 22.5 33.5 44.5 55.5 66.5 77.5Cumulative ProbabilityHotspot Relocation Dose (rem) 5-81 increase, which would increase the number of people requiring relocation. The number of people affected would likely influence ORO decisions on the value to implement

. The CDF is presented in Figure 5-33. DOSNRM is perfectly rank correlated with the hotspot relocation dose (DOSHOT) because MACCS requires DOSNRM to be less than DOSHOT.

Figure 5-33 CDF of DOSNRM Weather The offsite consequence values reported in Section 6 are the expected (mean) value of the probability distribution obtained from a large number of weather trials; unless otherwise stated

. The UA uses the same weather

-sampling strategy adopted for the earlier SOARCA work, as reported in the MACCS Best Practices document

[8], and also applied in the Peach Bottom UA

[9]. The sampling methodology is discussed further in Section 5.5.3 MACCS Correlated Parameters Many of the parameters in the analysis have correlations.

Some of these are perfectly rank ordered and others have rank correlation coefficients between

-1.0 and 1.0.

Unless specified in Table 5-21 below, parameters are not correlated.

0.00.10.20.30.40.50.60.70.80.91.00.50.75 11.251.51.75 2Cumulative ProbabilityNormal Relocation Dose (rem) 5-82 Table 5-21 MACCS correlated parameters Input Parameter Perfectly Rank

-Order Correlated with Comments PROTIN_6(2) LPROTIN Long-term is tied to normal activity for Cohort 6 GSHFAC_6(2) LGSHFAC Long-term is tied to normal activity for Cohort 6 TIMHOT TIMNRM TIMHOT is always less than TIMNRM DOSHOT DOSNRM TIMHOT is always greater than TIMNRM EFFTHR(1) EFFACA(1) Red bone marrow EFFTHR (2)

EFFACA (2)

Lungs EFFTHR (3)

EFFACA (3)

Stomach CYSIGA(1) CYSIGA(2-6) All weather conditions CYSIGA(1) CZSIGA(1-6) All weather conditions CYSIGA(1) CYCOEF All weather conditions DLTEVA(1)

DLTEVA(2-12) Evacuees are correlated for each evacuating cohort at all distances ESPEED(2)-2 ESPEED(2)-(3-8) Middle Phase of E SPEED for all Cohorts 2 to 8 VDEPOS(1) VDEPOS(2-10) All particle size bins Co-58_ICH(1) Co-58_ICH(2,4