Summary of Plant Results - Nuclear Regulatory …. Surry Plant Results Table 3.1 Summary of design...

PART I

Summary of Plant Results

3. SURRY PLANT RESULTS

3.1 Summary Design Information

The Surry Power Station is a two-unit site. Eachunit, designed by the Westinghouse Corporation,is a three-loop pressurized water reactor (PWR)rated at 2441 MWt (788 MWe) and is housed ina subatmospheric containment designed by Stoneand Webster Engineering Corporation. The bal-ance of plant systems were engineered and builtby Stone and Webster Engineering Corporation.Located on the James River near Williamsburg,Virginia, Surry 1 started commercial operation in1972. Some important system design features ofthe Surry plant are described in Table 3.1. A gen-eral plant schematic is provided in Figure 3.1.

This chapter provides a summary of the resultsobtained in the detailed risk analyses underlyingthis report (Refs. 3.1 and 3.2). A discussion ofperspectives with respect to these results is pro-vided in Chapters 8 through 12.

3.2 Core Damage Frequency Estimates

3.2.1 Summary of Core Damage FrequencyEstimates

The core damage frequency and risk analyses per-formed for this study considered accidents initi-ated by both internal and external events (Ref.3.1). The core damage frequency results obtainedfrom internal events are provided in graphicalform, displayed as a histogram, in Figure 3.2(Section 2.2.2 discusses histogram development).The core damage frequency results obtained fromboth internal and external events are provided intabular form in Table 3.2.

The Surry plant was previously analyzed in theReactor Safety Study (RSS) (Ref. 3.3). The RSScalculated a point estimate core damage fre-quency from internal events of 4.6E-5 per year.The present study calculated a total median coredamage frequency from internal events of 2.3E-5per year. For a detailed discussion of, and insightsinto, the comparison between this study and theRSS, see Chapter 8.

3.2.1.1 Internally Initiated AccidentSequences

A detailed description of accident sequences im-portant at the Surry plant is provided in Reference3.1. For this summary report, the accident se-

quences described in that report have beengrouped into five summary plant damage states.These are:

* Station blackout,* Large and small loss-of-coolant accidents

(LOCAs),* Anticipated transients without scram

(ATWS),* All other transients except station blackout

and ATWS, and* Interfacing-system LOCA and steam genera-

tor tube rupture.

The relative contributions of these groups to themean internal-event core damage frequency atSurry are shown in Figure 3.3. From Figure 3.3, itis seen that station blackout sequences are thelargest contributors to mean core damage fre-quency. It should be noted that the plant configu-ration was modeled as of March 1988 and thusdoes not reflect implementation of the stationblackout rule.

Within the general class of station blackout acci-dents, the more probable combinations of failuresleading to core damage are:

* Loss of onsite and offsite ac power and fail-ure of the auxiliary feedwater (AFW) system.All core heat removal is unavailable afterfailure of AFW. Station blackout results inthe unavailability of the high-pressure injec-tion system, the containment spray system,and the inside and outside containment sprayrecirculation systems. For station blackout atUnit 1 alone, it was assessed that one high-pressure injection (HPI) pump at Unit 2would not be sufficient to provide feed andbleed cooling through the crossconnect whileat the same time provide charging flow toUnit 2. Core damage was estimated to beginin approximately 1 hour if AFW and HPIflow had not been restored by that time.

* Loss of onsite and offsite ac power results inthe unavailability of the high-pressure injec-tion system, the containment spray system,the inside and outside containment sprayrecirculation systems, and the motor-drivenauxiliary feedwater pumps. While the loss ofall ac power does not affect instrumentationat the start of the station blackout, a long

3-1 NUREG-1 150

3. Surry Plant Results

Table 3.1 Summary of design features: Surry Unit 1.

1. Coolant Injection Systems a. High-pressure safety injection and recirculation system with2 trains and 3 pumps.

b. Low-pressure injection and recirculation system with 2trains and 2 pumps.

c. Charging system provides normal makeup flow with safetyinjection crosstie to Unit 2.

2. Steam Generator Heat Removal a. Power conversion system.Systems

b. Auxiliary feedwater system (AFWS) with 3 trains and 3pumps (2 MDPs, 1 TDP) * and crosstie to Unit 2 AFWS.

3. Reactivity Control Systems a. Control rods.

b. Chemical and volume control systems.

4. Key Support Systems a. dc power provided by 2-hour design basis station batteries.

b. Emergency ac power provided by 1 dedicated and 1 swingdiesel generator (both self-cooled).

c. Component cooling water provides cooling to RCP thermalbarriers.

d. Service water is gravity-fed system that provides heat re-moval from containment following an accident.

5. Containment Structure a. Subatmospheric (10 psia).

b. 1.8 million cubic feet.

c. 45 psig design pressure.

d. Reinforced concrete.

6. Containment Systems a. Spray injection initiated at 25 psia with 2 trains and2 pumps.

b. Inside spray recirculation initiated (with 2-minute time de-lay) at 25 psia with 2 trains and 2 pumps (both pumpsinside containment).

c. Outside spray recirculation initiated (with 5-minute timedelay) at 25 psia with 2 trains and 2 pumps (both pumpsoutside containment).

d. Inside and outside spray recirculation systems are the onlysources of containment heat removal after a LOCA.

*MDP - Motor-Driven Pump.TDP - Turbine-Driven Pump.

NUREG- 15 0 3-2

AF

AF

l to

Typ

ical

of

ea

ch

Col

d L

eg

Loo

p C

z 0 F

igur

e 3.

1 Su

rry

plan

t sc

hem

atic

.

C>

En


1.OE-03

1.OE-04

1.OE-05

Core Damage Frequency (per RY)

96th -

Mean -

Median - I

5th -

6th

1..OE-06Number of LHS samples

Figure 3.2 Internal core damage frequency results at Surry.*

Table 3.2 Summary of core damage frequency results: Surry.*

5% Median Mean 95%

6.8E-6 2.3E-5 4.OE-5 1.3E-4Internal Events

Station BlackoutShort TermLong Term

ATWS

Transient

LOCA

Interfacing LOCA

SGTR

External Events**

Seismic (LLNL)

Seismic (EPRI)

Fire

1.1E-76. 1E-7

3.2E-8

7.2E-8

1.2E-6

3.8E-1 1

1.2E-7

3.9E-7

3. OE-7

5.4E-7

1.7E-68.2E-6

4.2E-7

6.9E-7

3.8E-6

4.9E-8

7.4E-7

1.5E-5

6.1E-6

8.3E-6

5.4E-62.2E-5

1. 6E-6

2.OE-6

6.OE-6

1. 6E-6

1.8E-6

1.2E-4

2.5E-5

1.E-5

2.3E-59.5E-5

5.9E-6

6.OE-6

1.6E-5

5.3E-6

6.OE-6

4.4E-4

1.OE-4

3.8E-5

*As discussed in Reference 3.4, core damage frequencies below lB-S per reactoryear should be viewed with caution because of the remaining uncertainties inPRA (e.g., events not considered).

`"See "Externally Initiated Accident Sequences" in Section 3.2.1.2 for discussion.

NUREG-1150 3-4


Station Blackout

Bypass nt. Sys. LOCAISGTR)

LOCA

XrI-AwsTransient&

Total Mean Core Damage Frequency: 4.OE-6

Figure 3.3 Contributors to mean core damage frequency from internal events at Surry.

duration station blackout leads to battery de-pletion and subsequent loss of vital instru-mentation. Battery depletion was concludedto occur after approximately 4 hours. Theability to subsequently provide decay heat re-moval with the turbine-driven AFW pump islost because of the loss of all instrumentationand control power. Using information fromReference 3.5, approximately 3 hours be-yond the time of battery depletion was al-lowed for restoration of ac power before coreuncovery would occur.

Loss of onsite and offsite ac power, followedby a reactor coolant pump seal LOCA due toloss of all seal cooling. Station blackout alsoresults in the unavailability of the HPIsystem, as well as the auxiliary feedwatermotor-driven pumps, the containment spraysystem, and the inside and outside sprayrecirculation systems. Continued coolant lossthrough the failed seals, with unavailability ofthe HPI system, leads to core uncovery.

Within the general class of LOCAs, the moreprobable combinations of failures are:

* LOCA with an equivalent diameter of greaterthan 6 inches in the reactor coolant system(RCS) piping with failure of the low-pressureinjection or recirculation system. Recovery ofequipment is unlikely for the system failuresassessed to be most likely and, because thebreak size is sufficiently large, the time tocore uncovery is approximately 5 to 10 min-utes, leaving virtually no time for recoveryactions. All containment heat removal sys-tems are available. The dominant contribu-tors to failure of the low-pressure recirc-ulation function are the common-causefailure of the refueling water storage tank(RWST) isolation valves to close, common-cause failure of the pump suction valves toopen, common-cause failure of the dischargeisolation valves to the hot legs to open, ormiscalibration of the RWST level sensors.

* Intermediate-size LOCAs with an equivalentdiameter of between 2 and 6 inches in the

3-5 NUREG-1 150


RCS piping with failure of the low-pressureinjection or recirculation core cooling system.All containment heat removal systems areavailable, but the continued heatup andboiloff of primary coolant leads to core un-covery in 20 to 50 minutes. The dominantcontributors to low-pressure injection failureare common-cause failure of the low-pressureinjection (LPI) pumps to start or plugging ofthe normally open LPI injection valves.

* Small-size LOCAs with an equivalent diame-ter of between 1/2 and 2 inches in the RCSpiping with failure of the HPI system. Allcontainment heat removal systems are avail-able, but the continued heatup and boiloff ofprimary coolant leads to core uncovery in 1to 8 hours. The dominant contributors toHPI system failures are hardware failures ofthe check valves in the common suction anddischarge line of all three charging pumps orcommon-cause failure of the motor-operatedvalves in the HPI discharge line.

Within the general class of containment bypass ac-cidents, the more probable combinations of fail-ures are:

* An interfacing-system LOCA resulting from afailure of any one of the three pairs of checkvalves in series that are used to isolate thehigh-pressure RCS from the LPI system. Thefailure modes of interest for Event V are rup-ture of valve internals on both valves or fail-ure of one valve to close upon repressuriza-tion (e.g., during a return to power from coldshutdown) combined with rupture of theother valve. The resultant flow into the low-pressure system is assumed to result in failure(rupture) of the low-pressure piping or com-ponents outside the containment boundary.Although core inventory makeup by the high-pressure systems is initially available, inabilityto switch to recirculation would eventuallylead to core damage approximately 1 hourafter the initial failure. Because of the loca-tion of the postulated system failure (outsidecontainment), all containment mitigating sys-tems are bypassed.

* A steam generator tube rupture (SGTR) acci-dent initiated by the double-ended guillotinerupture of one steam generator (SG) tube.(Multiple tube ruptures may be possible butwere not considered in this analysis.) If theoperators fail to depressurize the reactor

coolant system in a timely manner (in about45 minutes), there is a high probability thatwater will be forced through the safety reliefvalves (SRVs) on the steam line from the af-fected SG. The probability that the SRVs willfail to reclose under these conditions is alsoestimated to be very high (near 1.0). Failureto close (gag the SRVs) by a local, manualaction results in a non-isolable path from theRCS to the environment. After the entirecontents of the refueling water storage tankare pumped through the broken SG tube, thecore uncovers. The onset of core degradationis thus not expected until about 10 hours af-ter the start of the accident.

3.2.1.2 Externally Initiated AccidentSequences

A detailed description of accident sequences initi-ated by external events important at the Surryplant is provided in Part 3 of Reference 3.1. Theaccident sequences described in that referencehave been divided into two main types for thisstudy. These are:

* Seismic, and

* Fire.

A scoping study has also been performed to assessthe potential effects of other externally initiatedaccidents (Ref. 3.1, Part 3). This analysis indi-cated that the following external-event sourcescould be excluded based on the low frequency ofthe initiating event:

* Air crashes,

* Hurricanes,

* Tornados,

* Internal flooding, and

* External flooding.

1. Seismic Accident Frequency Analysis

The relative contribution of classes of seismicallyand fire-initiated accidents to the total mean fre-quency of externally initiated core damage acci-dents is provided in Figure 3.4. As may be seen,seismically initiated loss of offsite power planttransients and transients that (through cooling sys-tem failures) lead to reactor coolant pump sealLOCAs are the most likely causes of externallycaused core damage accidents. For these two ac-cident initiators, the more probable combinationsof system failures are:

NUREG-1 150 3-6


TRANSIENTS LOSP (SEISMIC)

LOCA MALL

LLOCA RVR

STUCK OPEN PORVa (FIRE)TRANSIENT IND. RCP SEAL LOCA (SEISMIC)

Total Mean Core Damage Frequency: 1.3E-4

Figure 3.4 Contributors to mean core damage frequency from external events (LLNL hazard curve)at Surry.

* Transient-initiated accident sequences result-ing from loss of offsite power in conjunctionwith failures of the auxiliary feedwater systemand failure of the feed and bleed mode ofcore cooling. These result from either seismi-cally induced diesel generator failures (caus-ing station blackout and eventual battery de-pletion) or from seismically induced failureof the condensate storage tank in conjunc-tion with power-operated relief valve (PORV)failures.

* Loss of offsite power (LOSP) due to seismi-cally induced failure of ceramic insulators inthe switchyard, with simultaneous (seismic)failure of both high-pressure injection (HPI)and component cooling water (CCW) sys-tems (the redundant sources of seal cooling).Failures of HPI result from seismic failures ofthe refueling water storage tank or emer-gency diesel generator load panels, whileseismic failures of the diesels or the CCW

heat exchanger supports result in loss of theCCW system.

As discussed in Chapter 2, the seismic analysis inthis report made use of two sets of hazard curvesfrom Lawrence Livermore National Laboratory(LLNL) (Ref. 3.6) and the Electric Power Re-search Institute (EPRI) (Ref. 3.7). The above ac-cident sequences are dominant for both sets ofhazard curves. In addition, the differences be-tween the seismic risk estimates shown in Ta-ble 3.2 for the LLNL and the EPRI cases are dueentirely to the differences between the two sets ofhazard curves. That is, the system models, failurerates, and success logic were identical for both es-timates.

The seismic hazard associated with the curvesdeveloped by EPRI was significantly less than thatof the LLNL curves. Differences between thesecurves result primarily from differences betweenthe methodology and assumptions used to de-velop the hazard curves. In the LLNL program,considerable emphasis was placed on a wide rnge

3-7 NUREG-1 150


of uncertainty in the ground-motion attenu-ation models, while a relatively coarse set of seis-mic tectonic provinces was used in characterizingeach site. By contrast, in the EPRI programconsiderable emphasis was placed on a fine zona-tion for the tectonic provinces, and very little un-certainty in the ground-motion attenuation wasconsidered. In any case, it is the difference be-tween the two sets of hazard curves that causesthe differences between the numeric estimates inTable 3.2.

2. Fire Accident Frequency Analysis

The fire-initiated accident frequency analyses per-formed for this report considered the impact offires beginning in a variety of separate locationswithin the plant. Those locations found to be mostimportant were:

* Emergency switchgear room,

* Control room,

* Auxiliary building, and

* Cable vault and tunnel.

In the emergency switchgear room, a fire is as-sumed to fail either control or power cables forboth HPI and CCW, leading directly to a reactorcoolant pump seal LOCA. No additional randomfailures were required for this sequence to lead tocore damage. (Credit was given for operator re-covery by crossconnecting the Unit 2 HPI sys-tem.) The identical scenario arises as the result offires postulated in the auxiliary building and thecable vault and tunnel. Thus, fires in these threeareas both cause the initiating event (a sealLOCA) and fail the system required to mitigatethe scenario (i.e., HPI).

In the control room, a fire in a bench board wasdetermined to lead to spurious actuation of aPORV with smoke-induced abandonment of thecontrol room. A low probability of successful op-erator recovery actions from the remote shutdownpanel (RSP) was assessed since the PORV closurestatus is not displayed at the RSP. In addition, thePORV block valve controls in the RSP are notrouted independently of the control room benchboard and thus may not function.

The frequency of fire-initiated accident scenariosin other locations contributed less than 10 percentto the total fire-initiated core damage frequency.

3.2.2 Important Plant Characteristics (CoreDamage Frequency)

Characteristics of the Surry plant design and op-eration that have been found to be important inthe analysis of core damage frequency include:

1. Crossties Between Units

The Surry plant has numerous crossties be-tween similar systems at Units 1 and 2. Someof these were installed in order to complywith requirements of 10 CFR Part 50, Ap-pendix R (fire protection) (Ref. 3.8) or high-energy line-break threats, and some were in-stalled for operational reasons. Crossties existfor the auxiliary feedwater system, the charg-ing pump system, the charging pump coolingsystem, and the refueling water storage tanks.These crossties are subject to technical speci-fications, their potential use is included in theplant operating procedures, and they are re-viewed in operator training. The availabilityof such crossties was estimated to reduce theinternal-event core damage frequency by ap-proximately a factor of 3.

2. Diesel Generators

Surry is a two-unit site with three emergencydiesel generators (DGs), one of which is aswing diesel (which can be aligned to oneunit or the other), while many other PWRplants have dedicated diesels for each safety-grade power train (i.e., four DGs for a two-unit site). Each DG is self-cooled and sup-plied with a dedicated battery (independentof the batteries providing power to the vitaldc buses) for starting. The latter two factorseliminate potential common-cause failuremodes found important at other plants in thisstudy (e.g., Peach Bottom and Grand Gulf).The Surry site also has a gas turbine genera-tor. However, administrative procedures anddesign characteristics of support equipment(e.g., dc batteries and compressed air) pre-clude its use during a station blackout acci-dent.

3. Reactor Coolant Pump Seals

At Surry, there are two diverse and inde-pendent methods for providing reactor cool-ant pump seal cooling: the component cool-ing water system and the charging system(which has its own dedicated cooling sys-tem). The only common support systems forseal cooling are ac and dc power. As such,reactor coolant pump seal LOCAs have been

NUREG-1 150 3-8


found important only in station blackout se-quences. This is in contrast to some otherPWR plants that have a dependency betweencharging pumps and the component coolingwater system and thus greater potential forloss of seal cooling. Without cooling, theseals were expected to degrade or fail. Theprobability of seal failure upon loss of sealcooling was studied in detail by the expertpanel elicitation (Ref. 3.9). Reflecting this,the Surry analyses have found that stationblackout accident sequences with significantseal leakage are important contributors to thetotal frequency of core damage.

During loss of offsite power and station blackout,important actions required to be taken by the op-erating crew to prevent core damage include:

Align alternative source of condensate tocondensate storage tank

The primary source of condensate for theAFW system is a 100,000-gallon tank. This isnominally sufficient for the duration of moststation blackout events. But in the event thata steam generator becomes faulted, the in-creased AFW flow would require the provi-sion of additional condensate water. Thiswould involve manual local actions.

4. Battery Capacity * Isolate condenser water box

For the Surry plant, the station Class E bat-tery depletion time following station blackouthas been estimated to be 4 hours (Ref. 3.5).The inability to ensure availability for longertimes contributes significantly to the fre-quency of core damage resulting from stationblackout accident sequences. The batteriesare designed and tested for 2 hours. A4-hour battery depletion time is consideredrealistic because of the margin in the designand possible load shedding.

5. Capability for Feed and Bleed CoreCooling

In the Surry plant, the high-pressure injec-tion system and the power-operated reliefvalves have the capability to provide feed andbleed core cooling in the event of loss of thecooling function of the steam generators.This capability to provide core coolingthrough feed and bleed is estimated to resultin approximately a factor of 1.4 reduction incore damage frequency. Without the crosstiesof auxiliary feedwater to Unit 2, which en-hances overall reliability of the auxiliaryfeedwater system, the benefit of feed andbleed cooling would be much greater.

3.2.3 Important Operator Actions

The estimation of accident sequence and totalcore damage frequencies depends substantially onthe credit given to operating crews in performingactions before and during an accident. Failure toperform these actions correctly and reliably willhave a substantial impact on estimated core dam-age frequency. For the Surry plant, actions foundto be important are discussed below.

Surry has a somewhat unique gravity-fedservice water system that relies on the headdifference between the intake canal and thedischarge canal to provide flow through serv-ice water heat exchangers. The intake canalis normally supplied with water by the circu-lating water pumps. These pumps are notprovided with emergency power and are thusunavailable after a loss of offsite power. Thecondenser at each unit is provided with fourinlet and four outlet isolation valves. Theseisolation valves are provided with emergencypower. Each inlet isolation valve is providedwith a hand wheel, located in the turbinebuilding, in order to allow manual condenserisolation during station blackout to avoiddraining the canal.

* Cool down and depressurize the RCS

The Emergency Contingency Actions (ECAs)call for depressurization of the secondaryside of the steam generators during a stationblackout to provide cooldown and depressur-ization of the reactor coolant system. Thisaction is done through manual, local valvelineups.

During steam generator tube rupture, the most im-portant operator action is to cool down anddepressurize the RCS within approximately 45minutes after the event in order to prevent liftingthe relief valves on the damaged steam generator.Other possible recovery actions considered in thisaccident sequence include: provision of an alter-native source of steam generator feed flow in re-sponse to a loss of feed flow; crossconnect of HPIfrom Unit 2 or opening of alternative injectionpaths in response to failure of safety injectionflow; and isolation of a damaged, faulted steamgenerator.

3-9 NUREG-1150


During small-break and medium-break LOCA ac-cident sequences, two human actions are princi-pally important in response to loss of core coolantinjection or recirculation. These are:

* Cool down and depressurize the RCS

RCS cooldown and depressurization is theprocedure directed for all small-breakLOCAs. This event is important to reducethe pressure in the RCS and thus reduce theleak rate. Successful cooldown and depres-surization of the RCS will delay the need togo to recirculation cooling.

* Crossconnect high-pressure injection (HPI)

In the event that HPI pumps or water sourcesare unavailable at Unit 1, HPI flow can beprovided via a crosstie with the Unit 2 charg-ing system. This crosstie requires an operatorto locally open and/or close valves in thecharging pump area. It was estimated that thecrossconnect of HPI would require 15 to 20minutes. This and other timing considera-tions were such that the HPI crossconnectwas considered viable only for small and verysmall LOCAs.

3.2.4 Important Individual Events andUncertainties (Core DamageFrequency)

As discussed in Chapter 2, the process of develop-ing a probabilistic model of a nuclear power plantinvolves the combination of many individualevents (initiators, hardware failures, operator er-rors, etc.) into accident sequences and eventuallyinto an estimate of the total frequency of coredamage. After development, such a model canalso be used to assess the relative importance andcontribution of the individual events. The detailedstudies underlying this report have been analyzedusing several event importance measures. The re-sults of the analyses using two measures, "risk re-duction" and "uncertainty" importance, are sum-marized below.

* Risk (core damage frequency) reduction im-portance measure (internal events)

The risk-reduction importance measure isused to assess the change in core damage fre-quency as a result of setting the probability ofan individual event to zero. Using this meas-ure, the following individual events werefound to cause the greatest reduction in the

estimated core damage frequency if theirprobabilities were set to zero:

- Loss of offsite power initiating event.The core damage frequency would bereduced by approximately 61 percent.

- Failure of diesel generator number oneto start. The core damage frequencywould be reduced by approximately 25percent.

- Probability of not recovering ac electricpower between 3 and 7 hours after lossof offsite power. The core damage fre-quency would be reduced by approxi-mately 24 percent.

- Failure to recover diesel generators. Thecore damage frequency would bereduced by approximately 18 to 21 per-cent.

* Uncertainty importance measure (internalevents)

A second importance measure used to evalu-ate the core damage frequency results is theuncertainty importance measure. For thismeasure, the relative contribution of the un-certainty of groups of component failures andbasic events to the uncertainty in total coredamage frequency is calculated. Using thismeasure, the following event groups werefound to be most important:

- Probabilities of diesel generators failingto start when required;

- Probabilities of diesel generators failingto run for 6 hours;

- Frequency of loss of offsite power; and

- Frequency of interfacing-system LOCA.

It should be noted that many events each contrib-ute a small amount to the uncertainty in coredamage frequency; no single event dominates theuncertainty.

3.3 Containment Performance Analysis

3.3.1 Results of Containment PerformanceAnalysis

The Surry containment system uses a sub-atmospheric concept in which the containmentbuilding housing the reactor vessel, reactor cool-ant system, and secondary system's steam

NUREG-1 150 3-10


generator is maintained at 10 psia. The contain-ment building is a reinforced concrete structurewith a volume of 1.8 million cubic feet. Its designbasis pressure is 45 psig, whereas its mean failurepressure is estimated to be 126 psig. As previouslydiscussed in Chapter 2, the method used to esti-mate accident loads and containment structuralresponse for Surry made extensive use of expertjudgment to interpret and supplement the limiteddata available.

The potential for early Surry containment failureis of major interest in this risk analysis. The prin-cipal threats identified in the Surry risk analyses(Ref. 3.2) as potentially leading to early contain-ment failure are: (1) pressure loads, i.e., hydro-gen combustion and direct containment heatingdue to ejection of molten core material via therapid expulsion of hot steam and gases from thereactor coolant system; and (2) in-vessel steamexplosions leading to vessel failure with the vesselupper head being ejected and impacting the con-tainment building dome area (the so-called alpha-mode failure). Containment bypass (such as fail-ures of reactor coolant system isolation checkvalves in the emergency core cooling system orsteam generator tubes) is another serious threat tothe integrity of the containment system.

The results of the Surry containment analysis aresummarized in Figures 3.5 and 3.6. Figure 3.5displays information in which the conditionalprobabilities of seven containment-related acci-dent progression bins; e.g., VB, alpha, early CF,are presented for each of seven plant damagestates; e.g., loss of offsite power. This informationindicates that, on a plant damage state frequency-weighted average,' the conditional mean prob-ability from internally initiated accidents of:(1) early containment failure is about 0.01,(2) late containment failure (basemat melt-through or leakage) is about 0.06, (3) direct by-pass of the containment is about 0.12, and (4) nocontainment failure is 0.81. Figure 3.6 further dis-plays the conditional probability distribution ofearly containment failure for each plant damagestate to show the estimated range of uncertaintiesin these containment failure predictions. The im-portant conclusions to be drawn from the infor-mation in Figures 3.5 and 3.6 are: (1) the meanconditional probability of early containment fail-ure from internal events is low; i.e., less than0.01; (2) the principal containment release

*Each value in the column in Figure 3.5 labeled "All" isobtained by calculating the products of individual accidentprogression bin conditional probabilities for each plantdamage state and the ratio of the frequency of that plantdamage state to the total core damage frequency.

mechanism is bypass due to interfacing-systemLOCA; and (3) external initiating events such asfire and earthquakes produce higher early andlate containment failure probabilities.

The accident progression analyses performed forthis report are particularly noteworthy in that, forcore melt accidents at Surry, there is a high prob-ability that the reactor coolant system (RCS) willbe at relatively low pressures (less than 200 psi) atthe time of molten core penetration of the lowerreactor vessel head, thereby reducing the potentialfor direct containment heating (DCH). There areseveral reasons for concluding that the RCS willbe at low system pressure such as: stuck-openPORVs, operator depressurization, failed reactorcoolant pump seals, induced failures of RCS pip-ing due to high temperatures, and the relative"mix" of plant damage states (i.e., for the fre-quency of plant damage states initially at high ver-sus low RCS pressures). Accordingly, it has beenconcluded that the potential for early containmentfailure due to the phenomenon of DCH is less inthe risk analyses underlying this report relative toprevious studies (Ref. 3.10) on the basis of a com-bination of higher probabilities of low RCS pres-sures (discussed above), lower calculated pres-sures given direct containment heating, andgreater estimated strength of the Surry contain-ment building (Ref. 3.2). (See Section C.5 ofAppendix C for additional discussion of DCH andwhy its importance is now less.)

Additional discussions on containment perform-ance (for all studied plants) are-provided in Chap-ter 9.

3.3.2 Important Plant Characteristics(Containment Performance)

Characteristics of the Surry plant design and op-eration that are unique to the containment build-ing during core damage accidents include:

1. Subatmospheric Containment Operation

The Surry containment is maintained at asubatmospheric pressure (10 psia) during op-eration with a continual monitoring of thecontainment leakage. As a result, the likeli-hood of pre-existing leaks of significant size isnegligible.

2. Post-Accident Heat Removal System

The Surry containment does not have fancooler units that are qualified for post-acci-dent heat removal as do some other PWRplants. Containment (and core) heat removal

3-11 NUREG-1150

z c) T0

(A

1

SUM

MA

RY

AC

CID

ENT

PRO

GR

ESS

ION

BIN

GR

OU

P

SUM

MA

RY

PD

S G

RO

UP

(Mea

n C

ore

Dam

age

Fre

quen

cy)

…I-

----

----

----

-Int

erna

l In

itia

tors

…--

----

----

F

ire

Sei

smic

LOSP

A

TWS

Tra

nsi

ents

LO

CA

s B

ypas

s A

ll LL

NL

( 2.8

E-0

5)

( 1.

4E-0

6)

( 1

8E

-a6

) (

6.1E

-06)

(

3.4E

-06)

(

4.I

E-0

5)

( 1.

1E-0

5)

( 9

E-0

4)

VB

, al

ph

a,ea

rly

C

F

VB

> 2

00 p

si,

earl

y

CF

VB

, < 2

00 p

si,

earl

y

CF

VB

, B

MT

or

late

CL

Bypas

s

VB

, N

o C

F

No

VB

Key

: B

MT

= B

asem

at M

elt-

Thr

ough

CF

= C

onta

inm

ent

Fai

lure

CL

= C

on

tain

men

t L

eak

VB

= V

esse

l B

reac

h

Fig

ure

3.5

Con

diti

onal

pro

babi

lity

of

acci

dent

pr

ogre

ssio

n bi

ns a

t S

urry

.

LEO

I.E

-1

a) .tt1

.E-2

_C

D

7

*H

<~~~*

:: .t

i.E-S

I

4)

1- 0

1E

4..

0r 0

.E-5

.

95th

,

M_4

F95

thb.

fl21.

2M

= m

ean

m =

med

ian

th =

per

centi

leU

, -I

z Cl

(tI 0

…--

----

----

---

-…nt

erna

l In

itia

tors

…

PDS

Gro

up

LOSP

Cor

e D

amag

e M

leq.

2.

BE

-05

ATW

S T

ran

sien

ts

LOCA

s B

lypa

ss

All

1.4E

-06

1.8E

-06

6.1E

-06

3.4E

-06

4.1E

-05

Fir

e S

eism

ic

LLN

Ll.

lE-0

5

1.9

E-0

4c Z

i

Fig

ure

3.6

Con

diti

onal

pr

obab

ilit

y di

stri

buti

ons

for

earl

y co

ntai

nmen

t fa

ilur

e at

Sur

ry.


following an accident is provided by the con-tainment spray recirculation system, whereas,in some PWR plants, post-accident heat re-moval can also be provided by the residualheat removal system heat exchangers in theemergency core cooling system.

3. Reactor Cavity Design

The reactor cavity area is not connected di-rectly with the containment sump area. As aresult, if the containment spray systems failto operate during an accident, the reactorcavity will be relatively dry. The amount ofwater in the cavity can have a significant in-fluence on phenomena that can occur afterreactor vessel lower head failure, such asmagnitude of containment pressurizationfrom direct containment heating and post-vessel failure steam generation, the formationof coolable debris beds, and the retention ofradioactive material released during core-concrete interactions.

4. Containment Building Design

The containment volume and high failurepressure provide considerable capacity foraccommodation of severe accident pressureloads.

3.4 Source Term Analysis

3.4.1 Results of Source Term Analysis

In the Surry plant, the absolute frequency of anearly failure of the containment* due to the loadsproduced in a severe accident is small. Althoughthe absolute frequency of containment bypass isalso small, for internal accident initiators it isgreater than the absolute early failure frequency.Thus, bypass sequences are the more likely meansof obtaining a large release of radioactive mate-rial. Figure 3.7 illustrates the distribution ofsource terms associated with the accident progres-sion bin representing containment bypass. Therange of release fractions is quite large, primarilyas the result of the range of parameters providedby the experts. The magnitude of the release formany of the elemental groups is also large, indica-tive of a potentially serious accident. Typically,consequence analysis codes only predict theoccurrence of early fatalities in the surroundingpopulation when the release fractions of the vola-

*In this section, the absolute frequencies of early contain-ment failure aTe discussed (i.e., including the frequenciesof the plant damage states). This is in contrast to the pre-vious section, which discusses conditional failure prob-abilities (i.e., given that a plant damage state occurs).

tile groups (iodine, cesium, and tellurium) exceedapproximately 10 percent (Ref. 3.11). For the by-pass accident progression bin, the median valuefor the volatile radionuclides is approximately atthe 10 percent level whereas for the early contain-ment failure bin not shown, the releases are lower.The median values are somewhat smaller than 10percent, but the ranges extend to approximately30 percent.

In contrast to the large source term for the bypassbin, Figure 3.8 provides the range of source termspredicted for an accident progression bin involv-ing late failure of the containment. The fractionalrelease of radionuclides for this bin is several or-ders of magnitude smaller than for the bypass bin,except for iodine, which can be reevolved late inthe accident. It should be noted that, for many ofthe elemental groups, the mean of the distributionfalls above the 95th percentile value. For distribu-tions that occur over a range of many orders ofmagnitude, sampling from the extreme tail of thedistribution (at the high end) can dominate andcause this result.

Additional discussion on source term perspectivesis provided in Chapter 10.

3.4.2 Important Plant Characteristics(Source Term)

Plant design features that affect the mode andlikelihood of containment failure also influencethe magnitude of the source term. These featureswere described in the previous section. Plant fea-tures that have a more direct influence on thesource term are described in the following para-graphs.

1. Containment Spray SystemThe Surry plant has an injection spray systemthat uses the refueling water storage tank as awater source and a recirculation spray systemthat recirculates water from the containmentsump. Sprays are an effective means for re-moving airborne radioactive aerosols. For se-quences in which sprays operate throughoutthe accident, it is most likely that the con-tainment will not fail and the leakage to theenvironment will be minor. If the contain-ment does fail late in the accident followingextended spray operation, analyses indicatethat the release of aerosols will be extremelysmall. Even in a station blackout case withdelayed recovery of sprays, condensation ofsteam from the air, and a subsequent hydro-gen explosion that fails containment, SourceTerm Code Package (STCP) analyses indi-cate that spray operation results in substan-tially reduced source terms (Ref. 3.12).

NUREG-1 150 3-14

Rel

ease

Fr

actio

n1.

OE+

OO

1.O

E-0

1

1.O

E-0

2

1.O

E-

03

1.O

E- 0

4

1.O

E -0

5

T 1

Os%

-m

oan

mod

i1

as

In

MM

NG

I C

sz C

Te

Sr

Ru

La

Ba

Ce

Rad

ionu

clid

e G

roup

cO an

Figu

re 3

.7

Sour

ce t

erm

dis

trib

utio

ns

for

cont

ainm

ent

bypa

ss a

t Su

rry.

z Ca

Qd

Mo

Rel

ease

Fr

actio

n1< IC

jI1

.OE

.00

1.O

E-0

1

1.O

E-0

2

1.O

E-0

3

1.O

E-0

4

1.O

E-0

5

I I I

96%

_-

mea

n

med

ian

5%

Q

9~

NG

I C

sT

e S

r R

u L

a B

a C

e

Rad

ionu

clid

e G

roup

Fig

ure

3.8

Sou

rce

term

dis

trib

utio

ns

for

late

con

tain

men

t fa

ilur

e at

Sur

ry.


Sprays are not always effective in reducingthe source term, however. The risk-dominantcontainment bypass sequences are largely un-affected by operation of the spray systems.Early containment failure scenarios involvinghigh-pressure melt ejection have a compo-nent of the release that occurs almost simul-taneously with containment failure, for whichthe sprays would not be effective.

In addition to removing aerosols from the at-mosphere, containment sprays are an impor-tant source of water to the reactor cavity atSurry, which is otherwise dry. A coolable de-bris bed can be established in the cavity, pre-venting interactions between the hot core andconcrete. If a coolable debris bed is notformed, a pool of water overlaying the hotcore as it attacks concrete can effectivelymitigate the release of radioactive material tothe containment from this interaction.

2. Cavity Configuration

Water collecting on the floor of the Surrycontainment cannot flow into the reactorcavity. As a result, the cavity will be dry atthe time of vessel meltthrough unless thecontainment spray system has operated. Asdiscussed earlier, water in the cavity can havea substantial effect on mitigating or eliminat-ing the release of radioactive material fromthe molten core-concrete interaction.

3.5 Offsite Consequence Results

Figures 3.9 and 3.10 display the frequency distri-butions in the form of graphical plots of comple-mentary cumulative distribution functions(CCDFs) of four offsite consequence measures-early fatalities, latent cancer fatalities, and the50-mile and entire site region population expo-sures (in person-rems). The CCDFs in Figures 3.9and 3.10 include contributions from all sourceterms associated with reactor accidents caused bythe internal initiating events and fire, respectively.Four CCDFs, namely, the 5th percentile, 50thpercentile (median), 5th percentile, and themean CCDFs, are shown for each consequencemeasure.

Surry plant-specific and site-specific parameterswere used in the consequence analysis for theseCCDFs. The plant-specific parameters includedsource terms and their frequencies, the licensedthermal power (2441 MWt) of the reactor, andthe approximate physical dimensions of the powerplant building complex. The site-specific parame-

ters included exclusion area radius (520 meters),meteorological data for 1 full year collected at thesite meteorological tower, the site region popula-tion distribution based on the 1980 census data,topography (fraction of the area that is land-theremaining fraction is assumed to be water), landuse, agricultural practice and productivity, andother economic data for up to 1,000 miles fromthe Surry plant.

The consequence estimates displayed in these fig-ures have incorporated the benefits of the follow-ing protective measures: (1) evacuation of 99.5percent of the population within the 10-mileplume exposure pathway emergency planningzone (EPZ), (2) early relocation of the remainingpopulation only from the heavily contaminated ar-eas both within and outside the 10-mile EPZ, and(3) decontamination, temporary interdiction, orcondemnation of land, property, and foods con-taminated above acceptable levels.

The population density within the Surry 10-mileEPZ is about 230 persons per square mile. Theaverage delay time before evacuation (after awarning prior to radionuclide release) from the10-mile EPZ and average effective evacuationspeed used in the analyses were derived from in-formation contained in a utility-sponsored Surryevacuation time estimate study (Ref. 3.13) andthe NRC requirements for emergency planning.

The results displayed in Figures 3.9 and 3.10 arediscussed in Chapter 11.

3.6 Public Risk Estimates

3.6.1 Results of Public Risk Estimates

A detailed description of the results of the Surryrisk analysis is provided in Reference 3.2. For thissummary report, results are provided for the fol-lowing measures of public risk:

* Early fatality risk,

* Latent cancer fatality risk,

* Population dose within 50 miles of the site,

* Population dose within the entire site region,

* Individual early fatality risk in the populationwithin 1 mile of the Surry exclusion areaboundary, and

* Individual latent cancer fatality risk in thepopulation within 10 miles of the Surry site.

3-17 NUREG-1 150

z tri 0

a 0 0 U_ S,3

w:

.OE

-03

.OE-

07

l.OE-

O3

I 1.

OE-

04

IQO

E-O

5

t0

a .O

E-0

0

C: DI 1

.OE-

07ar

T CD

1.

OE-

08C t,

i.O

E-O

Q

0 UJ I

.oE-

3.

-

I ......

......

....

9

I

;---

----

I

I

I :Per

centi

le

%"

.--- 96th

E :-

Uta

h

I-

6011

%

%

--- a

th11

... ... ...

..

..

...

...I

t4 s

9 s.,a

t.oE

.OO

1.OE+

O1

1.O

E.0

2 tO

E.0

3

t.OE

-04

Early

Fata

litie

stO

E-0

5;*O

O

1.O

EO1

1OE

*02

tOE

.03

1.O

E-0

4 1.

OE

05

.OE

.06

Late

nt C

ance

r F

atal

ities

00

nrn

n _

sUt �

U

03 *

1.O

E-08

a O

E-0

6

CD

1.O

E-08

10 0D 1

CE

-09

XL

)

U

Mea

n

5tth

t.o

E -

04

----

--

> .

OE

-04

<° .O

E-O

S

.,6

0~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~

cr tO

E-0

7 v\

C, o

l.OE

-08

o

.O-9

--

-9t

hi

\

t lOE

0

-50

th

_ |_

i

\

1.OE

.00

tE.O

02

I.oE

404

t.OE.

O

l.OE

*08

Po

pu

latio

n D

ose

(p

ers

on

-re

m)

to -

Entir

e R

egio

n

*~~

~~

~

.IJZ

-

I. 0

1.O

Eo0

1.OE

.02

t.OE

.04

l.OE-

O

.OE.

OOP

opula

tion D

ose

(p

ers

on

-re

m)

to -

50

Mle

s

Not

e:

As

disc

usse

d in

Ref

eren

ce

3.4,

con

sequ

ence

s at

fre

quen

cies

est

imat

ed a

t or

bel

ow

1E-7

per

rea

ctor

yea

r sh

ould

be

view

ed w

ith c

auti

on b

ecau

se o

fth

e po

tent

ial

impa

ct o

f ev

ents

not

stu

died

in

the

risk

ana

lyse

s.

Fig

ure

3.9

Fre

quen

cy

dist

ribu

tion

s of

off

site

con

sequ

ence

m

easu

res

at S

urry

(i

nter

nal

init

iato

rs).

'L-

1.0E

-03

-0 0

1.0E

-04.

1O

.

6.O

E-0

64

B Cx i.

OE

-OC

0 =

1.

0E-0

7,>

1.

oE-o

8C

T'

0 o.0

E-0

8

Lo 1

.06

O-0

9

§i

tGE

-10

lOE

-OO

-tI

I

,D

1.0

E-0

3

L

1.0E

-04

0

1.0E

-05

(.) 8

l'OE

- 08

.0a °3

I.0

E-0

7u

i .O

E-0

8M 9D

1 I.

0E-0

70 0 "1

06

E 0

lOE

-01

.E0

2

t.oE-

03E

arly

Fat

aliti

es1.

0E-0

4 .o

E06

1OE

E00

.OE

01

toE

+02

tO

E+0

3 1.

E00

4 1.

0E05

1.

0EO

tLa

tent

Can

cer

Fat

aliti

es

I&A

-

0 ID >'

1.0E

-04

o il I.O

E-0

40 Q

.O

E-0

8

2 a 0

1.0E

-07

SG)X

1.0E

-OB

° t.O

E-0

80 D

C

x W

--

Bo5

th

z C QV

I. u

V -

s*J

1.O

E.0

0 1.

0E-0

2 1.

0.E

04

tOE.

00

tOE

-08

Pop

ulat

ion

Dos

e (p

erso

n-re

m)

o -5

0 M

iles

-t.-0

0 .O

E-0

2 .O

E.0

4 1.

06.0

8 I.

oE00

8P

opul

atlo

n D

ose

(per

son-

rem

) to

-E

ntire

Reg

ion

Not

e:

As

disc

usse

d in

Ref

eren

ce 3

.4,

cons

eque

nces

at

freq

uenc

ies

esti

mat

ed a

t .or

bel

ow 1

E-7

per

rea

ctor

yea

r sh

ould

be

view

ed w

ith

caut

ion

beca

use

of

rC

D

the

pote

ntia

l im

pact

of

even

ts n

ot s

tudi

ed

in t

he r

isk

anal

yses

. C

Fig

ure

3.10

F

requ

ency

dis

trib

utio

ns o

f of

fsite

con

sequ

ence

m

easu

res

at S

urry

(fi

re i

niti

ator

s).


The first four of the above measures are com-monly used measures in nuclear power plant riskstudies. The last two are those used to comparewith the NRC safety goals (Ref. 3.14).


The results of the risk studies using the abovemeasures are provided in Figures 3.11 through3.13 for internally initiated accidents. The figuresdisplay the variabilities in mean risks estimatedfrom the meteQrology-averaged conditional meanvalues of the consequence measures. For the firsttwo measures, the results of the first risk study ofSurry, the Reactor Safety Study (Ref. 3.3), arealso provided. As may be seen, both the early fa-tality risks and latent cancer fatality risks arelower than those of the Reactor Safety Study.The early fatality risk distribution, however, has alonger tail at the low end indicating a belief by theexperts that there is a finite probability that risksmay be orders of magnitude lower than those ofthe Reactor Safety.Study. The risks of populationdose within 50 miles of the plant site as well aswithin the entire site region are very low. Individ-ual early fatality and latent cancer fatality risks arewell below the NRC safety goals.

For the early and latent cancer fatality risk meas-ures, the Reactor Safety Study values lie in theupper portions of the present risk range. This isbecause of the current estimates of better contain-ment performance and source terms. The esti-mated probability of early containment failure inthis study is significantly lower than the ReactorSafety Study values. The source term ranges ofthe Reactor Safety Study are comparable with theupper portions of the present study. The mediancore damage frequencies of the two studies, how-ever, are about the same (2.3E-5 per reactor yearfor this study compared to 4.6E-5 per reactoryear for the Reactor Safety Study). A more de-tailed comparison between results is provided inChapters 12.

The risk results shown in Figure 3.11 have beenanalyzed to determine the relative contributions ofplant damage states and containment-related acci-dent progression bins to mean risk. The results ofthis analysis are provided in Figures 3.14 and3.15. As may be seen, the mean early and latentcancer fatality risks of the Surry plant are princi-pally due to accidents that bypass the containmentbuilding (interfacing-system LOCA (Event V) andsteam generator tube ruptures).

Details of these accident sequences are providedin Section 3.2.1.1. It should be noted from thesediscussions that for the steam generator tube rup-ture accident, if corrective or protective actionsare taken (e.g., alternative sources of water aremade available, emergency response is initiated*)before the refueling water storage tank water istotally depleted, i.e., within about a 10-hour pe-riod after start of the accident, risks from this ac-cident may be substantially reduced.


The Surry plant has been analyzed for two exter-nally initiated accidents: earthquakes and fire (seeSection 3.2.1.2). The fire risk analysis has beenperformed, including estimates of consequencesand risk, while the seismic analysis has been con-ducted up to the containment performance (asdiscussed in Chapter 2). Sensitivity analyses ofseismic risk at Surry are provided in Reference3.2.

Results of fire risk analysis (variabilities in meanrisks estimated from meteorology-averaged condi-tional mean values of the consequence measures)of Surry are shown in Figures 3.16 through 3.18for the early fatality, latent cancer fatality, popula-tion dose (within 50 miles of the site and withinthe entire site region), and individual early andlatent cancer fatality risks. As can be seen, therisks from fire are substantially lower than thosefrom internally initiated events.

Major contributors to early and latent cancer fa-tality risks are shown in Figure 3.19. (Note thatthere are no bypass initiating events in the fireplant damage state.) The most risk-important se-quence is a fire in the emergency switchgear roomthat leads to loss of ac power throughout the sta-tion. The principal risk-important accident pro-gression bin is early containment failure with thereactor coolant system at high pressure (>200psia) at vessel breach leading to direct contain-ment heating.

Additional discussion of risk perspectives (for allfive plants studied) is provided in Chapter 12.

3.6.2 Important Plant Characteristics (Risk)

The plant characteristics discussed in Section3.2.2 that were important in the analysis of coredamage frequency were primarily related to thestation blackout accident sequences and have notbeen found to be important in the risk analysis.

*See Chapter 11 for sensitivity of offsite consequences toalternative modes of emergency response.

NUREG-1150 3-20


1f (T 'a

M4-4

le

A-109

10'10

l1rI

>10I1

10 I

_ m

95iLh-. I5tII

Number of LHS Observations

Key: M meanm medianth - percentile

I i

N -

-4

:4

4

a) 101-

$4

9th 951f hm

M~.Il33 1. - 5th

6t"

10a

Number of LHS ObservatIons

Note: As discussed in Reference 3.4, estimated risks at or below 1E-7 per reactor year should be viewedwith caution because of the potential impact of events not studied in the risk analyses.

Figure 3.11 Early and latent cancer fatality risks at Surry (internal initiators).

3-21 NUREG-1 150


Jid'

::

0

00

a)

z90id 0

1,1O

ad

0)

0

2a)-4q

.4 )

0

9!5fh 3

5tb--.

5th


Key: M = meanm medianth = percentile

95h

it

Numbsr of LHS Obuxrvations


Figure 3.12 Population dose risks at Surry (internal initiators).

NUREG-1 150 3-22


In'

q).6

5 10-

E 10-'la

*c

i

I

Z

s.urety Goal

95h .

10<i.E-IC

-S

_h 10

IA o-"V

a ---

I


Key: M meanm = medianth = percentile

'i

I=

C

.Saety Goal

95th

5th

10-Number of LHS Observations

Note: As discussed in Reference 3.4, estimated risks at or below 1-7 per reactor year should be viewedwith caution because of the potential impact of events not studied in the risk analyses.

Figure 3.13 Individual early and latent cancer fatality risks at Surry (internal initiators).

3-23 NUREG-1150


SURRY EARLY FATALITY

MEAN 21-S/AY

SURRY LATENT CANCER FATALITY

MEAN * E*3RY

5 5'~~

Plant Damage States

1. 802. ATWO3. TRANSIENTS4. LOCAI. BYPASS

Figure 3.14 Major contributors (plant damage states) to mean early and latentcancer fatality risks at Surry (internal initiators).

SURRY EARLY FATALITY

MEAN * E-SJRY

SURRY LATENT CANCER FATALITY

MEAN * .RE-WARY

1

5 5

Accident Progression Bins

1. YB. Early CF. Alpha Mode2. VI, Early CF. RC$ Pressure 200 pala at VD3. VS. Early CF. RCS Pressure '200 pals at Vs4. YB, BUT and Late Look6. IypassS. V. No CF7. No VS

Figure 3.15 Major contributors (accident progression bins) to mean early and latentcancer fatality risks at Surry (internal initiators).

NUREG- 1150 3-24


I1

1O- m

10

?50-'-Ia

;R 10

-14

10

5-t95UL..

5Ui0.

10 .4


Key: M =m =th

meanmedianpercentile

In

U)-

1-0LI

15U)

~ ~ 'I:

IC4

5th

MLt.

M


Note: As discussed in Reference 3.4, estimated risks at or below E-7 per reactor year should be viewedwith caution because of the potential impact of events not studied in the risk analyses.

Figure 3.16 Early and latent cancer fatality risks at Surry (fire initiators).

3-25 NUREG-1150


0

0 id

0

0

0

Co

o -

Pi 10

.4j

to

:0

0

to

0

95ih

5 t

5th-.


Key: M meanm medianth = percentile

.n -

5th

4



Figure 3.17 Population dose risks at Surry (fire initiators).

NUREG-1 150 3-26


ifa-

ON

.42I4i

-

0

a

ro:

io-1

v

9-

95i1Lh -

-Isth10

~1o

c~ 101

.0

6 o1

-l

V

-"1 -1

11. E


Key: M = meanm = medianth - percentile

_rS- ---- - I

5th. 4

10 -- I



Figure 3.18 Individual early and latent cancer fatality risks at Surry (fire initiators).

3-27 NUREG-1150


SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY(FIRE) (FIRE)

MEAN 3E-8/RY MEAN 2.TE-4/RY

1

2~~~~~~~3

2 4

Accident Progression Bins1. VB, Early CF. Alpha Mode2. YB, Early CF, RCS Pressure 200 ple at VB3. VB, Early CF, RCS Preasure 200 pe at VB4. VS, BMT and Late Leak6. Bypass6. V. No CF7. No VB

Figure 3.19 Major contributors (accident progression bins) to mean early and latentcancer fatality risks at Surry (fire initiators).

That is, because of the high consequences of thecontainment bypass sequences and low frequencyof early containment failures, Event V and SGTRwere more important risk contributors in the Surryanalysis. The following general observations canbe made from the risk results:

* The Surry containment appears robust, witha low conditional probability of failure (earlyor late). This is responsible, to a large extent,for the low risk estimates for the Surry plant.(In comparison with other plants studied inthis report, risks for Surry are relatively high;but, in the absolute sense, these risks arevery low and are well below NRC safetygoals, as can be seen in Chapter 12.)

* Early fatality risk is dominated by bypass ac-cidents, primarily from an interfacing-systemLOCA. This accident leads to rapid coredamage; the radioactive release is assessed totake place before evacuation is complete.Steam generator tube rupture accident se-quences with stuck-open SRVs result in very

late core melt; evacuation is assessed to becomplete before the release is estimated tooccur.

* The configuration of low-pressure piping out-side the containment leads to a high prob-ability that the release from an interfacing-system LOCA would be partially scrubbed byoverlaying water. If the release were to takeplace without such scrubbing, the contribu-tion to early fatality risk would be higher.

* Depressurization of the reactor coolantsystem by deliberate or inadvertent meansplays an important role in the progression ofsevere accidents at Surry in that it decreasesthe probability of containment failure byhigh-pressure melt ejection and direct con-tainment heating.

* Risks from accidents initiated by fires aredominated by early containment failures andare estimated to be much lower than thosefrom internally initiated accidents.

NUREG-1150 3-28


REFERENCES FOR CHAPTER 3

3.1 R. C. Bertucio and J. A. Julius, "Analysis ofCore Damage Frequency: Surry Unit 1,"Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990.

3.2 R. J. Breeding et al., "Evaluation of SevereAccident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREGICR-4551, Vol.3, Revision 1, SAND86-1309, October1990.

3.3 USNRC, "Reactor Safety Study-An Assess-ment of Accident Risks in U.S. CommercialNuclear Power Plants," WASH-1400(NUREG-75/014), October 1975.

3.4 H. J. C. Kouts et al., "Special CommitteeReview of the Nuclear Regulatory Commis-sion's Severe Accident Risks Report(NUREG-1150)," NUREG-1420, August1990.

3.5 A. Kolaczkowski and A. Payne, "StationBlackout Accident Analyses," Sandia Na-tional Laboratories, NUREGICR-3226,SAND82-2450, May 1983.

3.6 D. L. Bernreuter et al., "Seismic HazardCharacterization of 69 Nuclear Power SitesEast of the Rocky Mountains," LawrenceLivermore National Laboratory, NUREG/CR-5250, Vols. 1-8, UCID-21517, January1989.

3.8 U.S. Code of Federal Regulations, Appen-dix R, "Fire Protection Program for NuclearPower Facilities Operating Prior to Janu-ary 1, 1979," to Part 50, "Domestic Licens-ing of Production and Utilization Facilities,"of Chapter I, Title 10, "Energy."

3.9 T. A. Wheeler et al., "Analysis of CoreDamage Frequency from Internal Events:Expert Judgment Elicitation," Sandia Na-tional Laboratories, NUREGICR-4550, Vol.2, SAND86-2084, April 1989.

3.10 USNRC, "Reactor Risk Reference Docu-ment," NUREG-1150, Vols. 1-3, Draft forComment, February 1987.

3.11 G. D. Kaiser, "The Implications of ReducedSource Terms for Ex-Plant ConsequenceModeling," Executive Conference on theRamifications of the Source Term (Charles-ton, SC), March 12, 1985.

3.12 R. S. Denning et al., "Radionuclide ReleaseCalculations for Selected Severe AccidentScenarios-PWR, Subatmospheric Contain-ment Design," Battelle Columbus Division,NUREG/CR-4624, Vol. 3, BMI-2139, July1986.

3.13 P. R. C. Voorhees, "Surry Nuclear PowerStation Estimation of Evacuation Times,"prepared for Virginia Power Company,March 1981.

3.7 Seismicity Owners Group and Electric PowerResearch Institute, "Seismic Hazard Meth-odology for the Central and Eastern UnitedStates," EPRI NP-4726, July 1986.

3.14 USNRC, "Safety Goals for theNuclear Power Plants; PolicyFederal Register, Vol. 51,August 21, 1986.

Operation ofStatement,"p. 30028,

3-29 NUREG-1150

4. PEACH BOTTOM PLANT RESULTS


The Peach Bottom Atomic Power Station is aGeneral Electric boiling water reactor (BWR-4)unit of 1065 MWe capacity housed in a Mark Icontainment constructed by Bechtel Corporation.Peach Bottom Unit 2, analyzed in this study, be-gan commercial operation in July 1974 under theoperation of Philadelphia Electric Company(PECo). Some important system design featuresof the Peach Bottom plant are described in Table4.1. A general plant schematic is provided in Fig-ure 4.1.




The core damage frequency and risk analyses per-formed for this study considered accidents initi-ated by both internal and external events (Refs.4.1 and 4.2). The core damage frequency resultsobtained from internal events are displayed ingraphical form as a histogram in Figure 4.2 (Sec-tion 2.2.2 discusses histogram development). Thecore damage frequency results obtained from in-ternal and external events are provided in tabularform in Table 4.2.

The Peach Bottom plant was previously analyzedin the Reactor Safety Study (RSS) (Ref. 4.3). TheRSS calculated a total point estimate core damagefrequency from internal events of 2.6E-5 peryear. This study calculated a total median coredamage frequency from internal events of 1.9E-6per year with a corresponding mean value of4.5E-6. For a detailed discussion of, and insightsinto, the comparison between this study and theRSS, see Chapter 8.


A detailed description of accident sequences im-portant at the Peach Bottom plant is provided inReference 4.1. For this summary report, the acci-dent sequences described in that report have beengrouped into four summary plant damage states.These are:

* Station blackout,

* Anticipated transient without scram(ATWS),

* Loss-of-coolant accidents (LOCAs), and

* Transients other than station blackout andATWS.

The relative contributions of these groups to meaninternal-event core damage frequency at PeachBottom are shown in Figure 4.3. From Figure 4.3,it may be seen that station blackout sequences asa class are the largest contributor to mean coredamage frequency. It should be noted that theplant configuration (as analyzed for this study)does not reflect modifications that may be re-quired in response to the station blackout rule.


* Loss of onsite and offsite ac power results inthe loss of all core cooling systems (excepthigh-pressure coolant injection (HPCI) andreactor core isolation cooling (RCIC), bothof which are ac independent in the shortterm) and all containment heat removal sys-tems. HPCI or RCIC (or both) systems func-tion but ultimately fail at approximately 10hours because of battery depletion or otherlate failure modes (e.g., loss of room coolingeffects). Core damage results in approxi-mately 13 hours as a result of coolant boiloff.

* Loss of offsite power occurs followed by asubsequent failure of all onsite ac power. Thediesel generators fail to start because of fail-ure of all the vital batteries. Without ac anddc power, all core cooling systems (includingHPCI and RCIC) and all containment heatremoval systems fail. Core damage begins inapproximately 1 hour as a result of coolantboiloff.

* Loss of offsite power occurs followed by asubsequent failure of a safety relief valve toreclose. All onsite ac power fails because thediesel generators fail to start and run from avariety of faults. The loss of all ac power failsmost of the core cooling systems and all thecontainment heat removal systems. HPCIand RCIC (which are ac independent) areavailable and either or both initially function

4-1 NUREG-11so

4. Peach Bottom Plant Results

Table 4.1 Summary of design features: Peach Bottom Unit 2.

1. Coolant Injection Systems a. High-pressure coolant injection system provides coolant tothe reactor vessel during accidents in which system pressureremains high, with 1 train and 1 turbine-driven pump.

b. Reactor core isolation cooling system provides coolant tothe reactor vessel during accidents in which system pres-sure remains high, with I train and I turbine-driven pump.

c. Low-pressure core spray system provides coolant to thereactor vessel during accidents in which vessel pressure islow, with 2 trains and 4 motor-driven pumps.

d. Low-pressure coolant injection system provides coolant tothe reactor vessel during accidents in which vessel pressureis low, with 2 trains and 4 pumps.

e. High-pressure service water crosstie system provides cool-ant makeup source to the reactor vessel during accidents inwhich normal sources of emergency injection have failed(low RPV pressure), with 1 train and 4 pumps for crosstie.

f. Control rod drive system provides backup source of high-pressure injection, with 2 pumps/210 gpm (total)/1,100psia.

g. Automatic depressurization system for depressurizing thereactor vessel to a pressure at which the low-pressure in-jection systems can inject coolant to the reactor vessel: 5ADS relief valves/capacity 820,000 lb/hr. In addition, thereare 6 non-ADS relief valves.

2. Key Support Systems a. dc power with up to approximately 10-12-hour stationbatteries.

b. Emergency ac power from 4 diesel generators shared be-tween 2 units.

c. Emergency service water provides cooling water to safetysystems and components shared by 2 units.

3. Heat Removal Systems a. Residual heat removal/suppression pool cooling system toremove heat from the suppression pool during accidents,with 2 trains and 4 pumps.

b. Residual heat removal/shutdown cooling system to removedecay heat during accidents in which reactor vessel integ-rity is maintained and reactor at low pressure, with 2 trainsand 4 pumps.

c. Residual heat removal/containment spray system to sup-press pressure and remove decay heat in the containmentduring accidents, with 2 trains and 4 pumps.

4. Reactivity Control Systems a. Control rods.b. Standby liquid control system, with 2 parallel positive dis-

placement pumps rated at 43 gpm per pump, but each with86 gpm equivalent because of the use of enriched boron.

5. Containment Structure a. BWR Mark I.b. 0.32 million cubic feet.c. 56 psig design pressure.

6. Containment Systems a. Containment venting-drywell and wetwell vents used whensuppression pool cooling and containment sprays havefailed to reduce primary containment pressure.

NUREG- 115 0 4-2

CD

c 0 0 P. CD M r_

z TO (Ji 0>

LPCI

,'RE

LPCs

-vaV

*_

. .I

.-l

2C

*Typ

ical

ar

ran

gem

ent

(5 A

DS

SRV

s an

d

6 no

n-A

DS

SR

Vs)

Fig

ure

4.1

Pea

ch

Bot

tom

pla

nt

sche

mat

ic.


1.OE-04

1.OE-06

1.OE-06

1.OE-07

1 .OE-08

Gore Damage Frequency (per RY)

95th -

Mean -

Median -

5th _

Number of LHS samples

Note: As discussed in Reference 4.4, core damage frequencies below 1E-5 per reactor year should beviewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

Figure 4.2 Internal core damage frequency results at Peach Bottom.

Table 4.2 Summary of core damage frequency results: Peach Bottom.*

5% Median Mean 95%

Internal Events

Station Blackout

ATWS

LOCA

Transient

External Events**Seismic (LLNL)

Seismic (EPRI)

Fire

3.5E-7 1.9E-68.3E-8 6.2E-7

3. IE-8 4.4E-7

2.5E-9 4.4E-8

6.1E-10 1.9E-8

4.5E-62.2E-6

1.9E-6

2.6E-7

1.4E-7

1.3E-56.OE-6

6.6E-6

7.8E-7

4.7E-7

5.3E-8 4.4E-6

2.3E-8 7. E-7

1. 1E-6 1.2E-5

7.7E-5

3.1E-6

2.OE-5

2.7E-4

1. 3E-5

6.4E-5

*Note: As discussed in Reference 4.4, core damage frequencies below 1E-5 per reactoryear should be viewed with caution because of the remaining uncertainties in PRA(e.g., events not considered).

**See "Externally Initiated Accident Sequences" in Section 4.2.1.2 for discussion.

NUREG-1 150 4-4


Station Blackout

............ U;:. Transients

ATWS


Figure 4.3 Contributors to mean core damage frequency from internal events at Peach Bottom.

but ultimately fail at approximately 10 hoursbecause of battery depletion or other latefailure modes (e.g., loss of room cooling ef-fects). Core damage results in 10 to 13 hoursas a result of coolant boiloff.

HPCI fails to function because of randomfaults. The operator fails to depressurize afterHPCI failure and therefore the low-pressurecore cooling systems cannot inject. Coredamage occurs in approximately 15 minutes.

Within the general class of anticipated transientwithout scram accidents, the more probable com-binations of failures leading to core damage are:

* Transient (e.g., loss of feedwater) occurs fol-lowed by a failure to trip the reactor becauseof mechanical faults in the reactor protectionsystem (RPS) and closure of the main steamisolation valves (MSIVs). The standby liquidcontrol system (SLCS) does not function(primarily because of operator failure to ac-tuate), but the HPCI does start. However, in-creased suppression pool temperatures failthe HPCI. Low-pressure coolant injection(LPCI) is unavailable and all core cooling islost. Core damage occurs in approximately20 minutes to several hours, depending onthe time at which the LPCI fails because ofdifferent LPCI failure modes.

* Transient occurs followed by a failure toscram (mechanical faults in the RPS) andclosure of the MSIVs. SLCS is initiated but

Within the general class of LOCAs, the moreprobable combination of failures leading to coredamage is:

* A medium-size LOCA (i.e., break size of ap-proximately 0.004 to 0.1 ft2 ) occurs. HPCIworks initially but fails because of low steampressure. The low-pressure core cooling sys-tems fail to actuate primarily because of mis-calibration faults of the pressure sensors,which do not "permit" the injection valves toopen. All core cooling is lost and core dam-age occurs in approximately 1 to 2 hours fol-lowing the initiating event.


A detailed description of accident sequences initi-ated by external events important at the PeachBottom plant is provided in Part 3 of Reference4.1. The accident sequences described in that ref-erence have been grouped into two main types forthis study. These are:

4-5 NUREG-1 150


* Seismic, and

* Fire.

A scoping study has also been performed to assessthe potential effects of other externally initiatedaccidents (Ref. 4.1, Part 3). This analysis indi-cated that the following external-event sourcescould be excluded based on the low frequency ofthe initiating event:

* Aircraft crashes,

* Hurricanes,

* Tornados,

* Internal flooding, and

* External flooding.

1. Seismic Accident Frequency Analysis

The relative contribution of classes of seismicallyand fire-initiated accidents to the total mean fre-quency of externally initiated core damage acci-dents is provided in Figure 4.4. As may be seen,the dominant seismic scenarios are transient(38o) and LOCA sequences (27%) with the othercontributors being substantially less. For these twoseismic accident initiators, the more probablecombinations of system failures are:

* The transient sequence results from seismi-cally induced failure of ceramic insulators inthe switchyard causing loss of offsite power(LOSP) in conjunction with loss of onsite acpower. This latter results primarily from lossof the emergency service water (ESW) sys-tem (which provides the jacket cooling forthe emergency diesel generators) and/or di-rect failures of 4 kV buses or the diesel gen-erators themselves. The vast majority of fail-ures are seismically induced.

* The large LOCA sequence is initiated by pos-tulated seismically induced failures of thesupports on the recirculation pumps. Coredamage results from this initiator in conjunc-tion with seismically induced failures of thelow-pressure injection systems. The latter re-quires ac power, and the dominant sources offailure of onsite ac power are the ESW oremergency diesel generator seismic failures asdiscussed above.

As discussed in Chapter 2, the seismic analysis inthis report made use of two sets of hazard curvesfrom Lawrence Livermore National Laboratory(LLNL) (Ref. 4.5) and the Electric Power Re-search Institute (EPRI) (Ref. 4.6). The differ-

ences between the seismic core damage frequen-cies shown in Table 4.2 for the LLNL and theEPRI cases are due entirely to the differences be-tween the two sets of hazard curves. That is, thesystem models, failure rates, and success logicwere identical for both estimates.

The seismic hazard associated with the curves de-veloped by EPRI was significantly less than that ofthe LLNL curves. Differences between thesecurves result primarily from differences betweenthe methodology and assumptions used to developthe hazard curves. In the LLNL program, consid-erable emphasis was placed on a wide range ofuncertainty in the ground-motion attenuationmodels, while a relatively coarse set of seismic tec-tonic provinces was used in characterizing eachsite. By contrast, in the EPRI program consider-able emphasis was placed on a fine zonation forthe tectonic provinces, and very little uncertaintyin the ground-motion attenuation was considered.In any case, it is the difference between the twosets of hazard curves that causes the differencesbetween the numeric estimates in Table 4.2.

2. Fire Accident Frequency Analysis

The fire-initiated accident frequency analyses per-formed for this report considered the impact offires beginning in a variety of separate locationswithin the plant. Those locations found to be mostimportant were:

* Emergency switchgear rooms,

* Control room, and

* Cable-spreading room.

No other plant locations contributed more than1.OE-8 per year to the core damage frequency.

Fires in the cable-spreading room are assumed torequire manual plant trip and to fail the high-pressure injection and depressurization systems,namely: high pressure core injection (HPCI), re-actor core isolation cooling (RCIC), control roddrive (CRD), and automatic depressurization sys-tems (ADS). In each case, the failure occurs be-cause of fire damage to the control cables.

Fires in the emergency switchgear rooms failedoffsite power and in some instances portions ofthe emergency service water system, and coredamage occurs because of a station blackout se-quence involving additional random failures of theemergency service water system (which providesjacket cooling to the diesel generators).

NUREG-1 150 4-6


Finally, two fire scenarios were identified for thecontrol room, both of which involve manual planttrip and abandonment of the control room. Onescenario involved random failure of the RCIC sys-tem and a reasonable probability that the opera-tors fail to recover the plant using HPCI or ADSin conjunction with LPCI from the remote shut-down panel. The other scenario failed the RCICsystem because of a fire in its control cabinet but

allowed for recovery from the remote shutdownpanel.


Characteristics of the Peach Bottom plant designand operation that have been found to be impor-tant in the analysis of core damage frequency in-clude:

(SEISMIC)TRANSIENTS LOSP

LOCA (SEISMIC)

RWTB (SEISMtC)

RVR (SEISMIC)

LOSP (FIRE)

TRANSIENTS (FIRE)

OTHER (SEISMIC)

STATION BLACKOUT (FIRE)


Figure 4.4 Contributors to mean core damage frequeat Peach Bottom.

1. High-Pressure Service Water SystemCrosstie

The high-pressure service water (HPSW) sys-tem, if the reactor vessel has beendepressurized, can inject raw water to the re-actor vessel via the residual heat removal in-jection lines. Most components of HPSW arelocated outside the reactor building and thusare not affected by any potential severe reac-tor building environment that could causeother injection systems to fail in some acci-dents. Therefore, this system offers diversity,as well as redundancy, and affects many dif-

ncy from external events (LLNL hazard curve)

ferent types of sequences. The Peach Bottomoperators are trained to use this system andcan do so from the control room. An exten-sive cleanup program would, however, be re-quired after the system is initiated.

2. Redundancy and Diversity of WaterSupply Systems

At Peach Bottom, there are many redundantand diverse systems to provide water to thereactor vessel. They include:

4-7 NUREG-1150


High-pressure core injection (HPCI) with Ipump;

Reactor core isolation cooling (RCIC) with 1pump;

Control rod drive (CRD) with 2 pumps (bothpumps required);

Low-pressure core spray (LPCS) with 4pumps;

Low-pressure core injection (LPCI) with 4pumps;

Condensate with 3 pumps; and

High-pressure service water (HPSW) with 4pumps.

Because of this redundancy of systems,LOCAs and transients other than stationblackout and ATWS are small contributors tothe core damage frequency.

CRD, condensate, and HPSW pumps are lo-cated outside the reactor building (generallyaway from potentially severe environments)and represent excellent secondary high- andlow-pressure coolant systems if normal injec-tion systems fail. These systems are not avail-able during station blackout.

3. Redundancy and Diversity of HeatRemoval Systems

At Peach Bottom, there are several diversemeans for heat removal. These systems are:

Main steamlfeedwater system;Suppression pool cooling mode of residualheat removal (RHR);Shutdown cooling mode of RHR;Containment spray system mode of RHR;andContainment venting.This diversity has greatly reduced the impor-tance of transients with long-term loss of heatremoval.


Peach Bottom is a two-unit site with fouremergency diesels shared between the twounits. One diesel can supply the necessarypower for both units. DC power to start thediesels is supplied from vital dc station batter-ies. The four emergency diesels share a com-mon service water system that provides oilcooling, jacket, and air cooling. The PeachBottom emergency diesels historically have

had a failure-to-start probability that is muchbetter than the industry average, e.g., a fac-tor of -10 lower failure probability.

5. Battery Capacity

Philadelphia Electric Company (PECo) hasperformed analyses of the battery life basedon the current station blackout procedures.PECo estimates that the station batteries atPeach Bottom are capable of lasting at least12 hours in a station blackout. They have re-vised their station blackout procedure to in-clude load shedding in order to ensure alonger period of injection and accident moni-toring. The ability to ensure availability for12 hours reduces the frequency of core dam-age resulting from station blackout accidentsequences.

6. Emergency Service Water (ESW) System

The ESW system provides cooling water toselected equipment during a loss of offsitepower. The system has two full capacity self-cooled pumps whose suction is from the Con-owingo pond and a backup third pump with aseparate water source. Failure of the ESWsystem would quickly fail operating dieselgenerators and potentially fail the low-pressure core spray (LPCS) pumps and theRHR pumps. The HPCI pumps and RCICpumps would fail (in the long term) from aloss of their room cooling after a loss of theESW system.

It should be noted that there is an outstand-ing issue regarding the need for ESW that in-volves whether or not the LPCS/RHR pumpsactually require ESW cooling. PECo hasstated that these pumps are designed to oper-ate with working fluid temperatures ap-proaching 160'F without pump cooling. Thisimplies that in scenarios where the ESW sys-tem has been lost, these pumps could still op-erate; some RHR pumps would be placed inthe suppression pool cooling mode and there-fore keep the working fluid at less than1600F. It is felt that there is significant valid-ity to these arguments. However, because it isuncertain whether the suppression pool watercan be maintained below 160'F in some se-quences and whether PECo has properly ac-counted for pump heat addition to the sys-tem, the analysis summarized here assumesthese LPCS/RHR pumps will fail upon loss ofESW cooling.

NUREG-1 150 4-8


7. Automatic and Manual DepressurizationSystem

The automatic depressurization system(ADS) is designed to depressurize the reactorvessel to a pressure at which the low-pressureinjection systems can inject coolant. TheADS consists of five safety relief valves capa-ble of being manually opened. The operatormay manually initiate the ADS or maydepressurize the reactor vessel, using the sixadditional relief valves that are not con-nected to the ADS logic. The ADS valves arelocated inside the containment; however, theinstrument nitrogen and the dc power re-quired to operate the valves are suppliedfrom outside the containment.

8. Standby Liquid Control (SLC) System

The SLC system provides a backup methodthat is redundant but independent of thecontrol rods to establish and maintain the re-actor subcritical. The suction for the SLCsystem comes from a control tank that hassodium pentaborate in solution withdemineralized water. Most of the SLC systemis located in the reactor building outside thedrywell. Local access to the SLC systemcould be affected by containment failure orcontainment venting.

9. Venting Capability

The primary containment venting system atPeach Bottom is used to prevent containmentpressure limits from being exceeded. Thereare several vent paths:

* 2-inch torus vent to standby gas treat-ment (SBGT),

* 6-inch integrated leak rate test (ILRT)pipe from the torus,

If the reactor is at decay heat loads, ventingusing the 6-inch ILRT line or equivalent as aminimum is sufficient to lessen the contain-ment pressure. However, in an ATWS se-quence, three to four of the large 18-inchvent pathways need to be used in order toachieve the same effect. It is preferable touse a vent pathway from the torus rather thanfrom the drywell because of the scrubbing ofradioactive material coming through the sup-pression pool.

It is significant to note that the 6-inch ILRTline is a solid pipe rather than ductwork, sothat venting by means of this pipe does notcreate a severe environment within the reac-tor building; use of the 18-inch lines will re-sult in failure of the ductwork and severe en-vironments within the reactor building.

10. Location of Control Rod Drive (CRD)Pumps

The CRD pumps at Peach Bottom are not lo-cated in the reactor building (like mostplants) but are in the turbine building.Therefore, in a severe accident where severeenvironments are sometimes created, theCRD pumps are not subjected to these envi-ronments and can continue to operate.


The emergency operating procedures (EOPs) atPeach Bottom direct the operator to perform cer-tain actions depending on the plant conditions orsymptoms (e.g., reactor vessel level below top ofactive fuel). Different accident sequences canhave similar symptoms and therefore the same"recovery" actions. The operator actions thateither are important in reducing accident frequen-cies or are contributing to accident frequenciesare discussed and can apply to many different ac-cident sequences.

The quantification of these human failure eventswas based on an abbreviated version of theTHERP method (Ref. 4.7). These failure eventsinclude the following:

* Actuate core cooling

In an accident where feedwater is lost (whichincludes condensate), the reactor vesselwater level starts to decrease. When Level 2is reached, HPCI and RCIC should be auto-matically actuated. If Level 1 is reached, theautomatic depressurization system (ADS)should be actuated with automatic actuation

0

0

S

0

0

0

18-inch torus vent path,18-inch torus supply path,2-inch drywell vent to SBGT,Two 3-inch drywell sump drain lines,6-inch ILRT line from drywell,18-inch drywell vent path, and18-inch drywell supply path.

The types of sequences on which venting hasthe most effect are transients with long-termloss of decay heat removal. The chance ofsurvival of the containment is increased withventing; therefore, the core damage fre-quency from such sequences is reduced.

4-9 NUREG- 115 0


of the low-pressure core spray (LPCS) andlow-pressure coolant injection (LPCI). Ifthese systems fail to actuate, the operator canattempt to manually actuate them from thecontrol room. In addition, the operator canattempt to recover the power conversion sys-tem (PCS) (i.e., feedwater) or manually initi-ate control rod drive (CRD) (i.e., put CRDin its enhanced flow mode). If automaticdepressurization failure was one of the faults,the operator can manually depressurize sothat LPCS and LPCI can inject. Lastly, theoperator also has the option to align theHPSW to LPCI for another core cooling sys-tem.

* Establish containment heat removal

Besides core cooling, the operator must alsoestablish containment heat removal (CHR).Without CHR, the potential exists for operat-ing core cooling systems to fail. If an accidentoccurs, the EOPs direct the operator to initi-ate the suppression pool cooling mode of re-sidual heat removal (RHR) after the suppres-sion pool temperature reaches 95 0F. Theoperator closes the LPCI injection valves andthe heat exchanger bypass valves and opensthe suppression pool discharge valves. Healso ensures that the proper service water sys-tem train is operating. With suppression poolcooling (SPC) functioning, CHR is being per-formed. If system faults preclude the use ofSPC, the operator has other means to pro-vide CHR. He can actuate other modes ofRHR such as shutdown cooling or contain-ment spray; or the operator can vent the con-tainment to remove the heat.

* Restore service water

Many of the components/systems requirecooling water from the emergency servicewater (ESW) system in order to function. Ifthe ESW pumps fail, the operator can manu-ally start the emergency cooling water pump,which is a backup to the ESW pumps.

Specifically for station blackout, there are certainactions that can be performed by the operatingcrew:

* Recovering ac power

Station blackout is caused by the loss of all acpower, i.e., both offsite and onsite power.Restoring offsite power or repairing the dieselgenerators was included in the analysis. The

quantification of these human failure eventswas derived from historical data (i.e., actualtime required to perform these repairs) andnot by performing a human reliability analysison these events.

Transients where reactor trip does not occur (i.e.,ATWS) involve accident sequences where thephenomena are more complex. The operator ac-tions were evaluated in more detail (using theSLIM-MAUD* method performed by Brook-haven National Laboratory (Ref. 4.8)) than forthe regular transients. These actions include thefollowing:

* Manual scram

A transient. that demands the reactor to betripped occurs, but the reactor protectionsystem (RPS) fails from electrical faults. Theoperator can then manually trip the reactorby first rotating the collar on the properscram buttons and then depressing the but-tons, or he can put the reactor mode switchin the "shutdown" position.

* Insert rods manually

If the electrical faults fail both the RPS andthe manual trip, the operator can manuallyinsert the control rods one at a time.

* Actuate standby liquid control (SLC)

With the reactor not tripped, reactor powerremains high; the reactor core is not at decayheat levels. This can present problems sincethe CHR systems are only designed to decayheat removal capacity. However, the SLCsystem (manually activated) injects sodiumpentaborate that reduces reactor power todecay heat levels. The EOPs direct the op-erator to actuate SLC if the reactor power isabove 3 percent and before the suppressionpool temperature reaches 110'F. The opera-tor obtains the SLC keys (one per pump)and inserts the keys into the switches andturns only one to the "on" position.

* Inhibit automatic depressurization system(ADS)

In an ATWS condition, the operator is di-rected to inhibit the ADS if he has actuatedSLC. The operator must put both ADSswitches in the inhibit mode.

'SLIM.-MAUD is a computer algorithm for transformingman-man and man-machine information into probabilitystatements.

NUREG-1 150 4-10


0 Manually depressurize reactor

If the high-pressure coolant injection (HPCI)fails, inadequate high-pressure core coolingoccurs. Because the ADS was inhibited,when Level 1 is reached, ADS will not occurand the operator must manually depressurizeso that low-pressure core cooling can inject.


As discussed in Chapter 2, the process of develop-ing a probabilistic model of a nuclear power plantinvolves the combination of many individualevents (initiators, hardware failures, operator er-rors, etc.) into accident sequences and eventuallyinto an estimate of the total frequency of coredamage. After development, such a model canalso be used to assess the relative importance andcontribution of the individual events. The detailedstudies underlying this report have been analyzedusing several event importance measures. The re-sults of the analyses using two measures, "riskreduction" and "uncertainty" importance, aresummarized below.

* Risk (core. damage frequency) reduction im-portance measure (internal events)

The risk-reduction importance measure isused to assess the change in core damage fre-quency as a result of setting the probability ofan individual event to zero. Using this meas-ure, the following individual events werefound to cause the greatest reduction in coredamage frequency if their probabilities wereset to zero:

- Mechanical failure of the reactor pro-tection system. The core damage fre-quency would be reduced by approxi-mately 52 percent.

- Transient initiators with the power con-version system available. The core dam-age frequency would be reduced by ap-proximately 47 percent.


- Operator failure to restore the standbyliquid control system after testing. Thecore damage frequency would be re-duced by approximately 25 percent.

- Operator failure to initiate emergencyheat sink. The core damage frequencywould be reduced by approximately 17percent.

- Operator failure to actuate standby liq-uid control system. The core damagefrequency would be reduced by approxi-mately 16 percent.

- Operator miscalibrates reactor pressuresensors. The core damage frequencywould be reduced by approximately 12percent.

Note that the top risk-reduction events donot necessarily appear in the most frequentsequences since the latter sequences may re-sult from the cumulative influence of manylesser contributors.


A second importance measure used to evalu-ate the core damage frequency analysis re-sults is the uncertainty importance measure.For this measure, the relative contribution ofthe uncertainty of individual events to theuncertainty in total core damage frequency iscalculated. Using this measure, the followingevents were found to be most important:

- Mechanical failure of the reactor pro-tection system.

- Failure of the diesel generators to con-tinue to run once started.

- Loss of offsite power or transients withthe power conversion system available.

- Miscalibration of the reactor pressuresensors by the operator.

- Operator failure to restore the standby liq-uid control system after testing.



The Peach Bottom Mark I containment designconcept consists of a pressure-suppression con-tainment system that houses the reactor vessel,the reactor coolant recirculating loops, and otherbranch connections to the reactor coolant system.The containment design consists of a light-bulb-shaped drywell and a water-filled toroidal-shapedsuppression pool. Both the drywell and the sup-pression pool are freestanding steel shells with thedrywell region backed by a reinforced concretestructure. The containment system has a volume

4-11 NUREG-1 150


of 320,000 cubic feet and is designed to withstanda peak pressure of 56 psig resulting from a pri-mary system loss-of-coolant accident. The esti-mated mean failure pressure for Peach Bottom'scontainment system is 148 psig, which is very simi-lar to that for large PWR containment designs.However, its small free volume relative to othercontainment types significantly limits its capacityto accommodate noncondensible gases generatedin severe accident scenarios in addition to increas-ing its potential to come into contact with moltencore material. The complexity of the events oc-curring in severe accidents has made predictionsof when and where Peach Bottom's containmentwould fail heavily reliant on the use of expertjudgment to interpret and supplement the limiteddata available.

The potential for early containment failure (be-fore or within roughly 2 hours after reactor vesselbreach) is of principal concern in Peach Bottom'srisk analysis. For the Peach Bottom Mark I typeof containment, the principal mechanisms thatcan cause its early failure are (1) drywell shellmeltthrough due to its interaction with the moltencore material released from the breached reactorpressure vessel, (2) overpressure failure of thedrywell due to rapid direct containment heatingfollowing reactor vessel breach, and (3) stretchingof the drywell head bolts (due to internal pressuri-zation) causing a direct leakage path from the sys-tem. Possible overpressure failures due to hydro-gen combustion effects are of negligibleprobability for Peach Bottom since the contain-ment is inerted. In addition to the early modes ofcontainment failure, core damage sequences canalso result in late containment failure or no con-tainment failure at all.

The results of the Peach Bottom containmentanalysis are summarized in Figures 4.5 and 4.6.Figure 4.5 contains a display of information inwhich the conditional probabilities of 10 contain-ment-related accident progression bins; e.g., V.B-early WWF - >200, are presented for each of sixplant damage states, such as station blackout. Thisinformation indicates that, on a plant damagestate frequency-weighted average, * the mean con-ditional probability from internally initiated acci-dents of: (1) early wetwell failure is about 0.03,(2) early drywell failure is about 0.52, (3) latefailure of either the wetwell or drywell is about0.04, and (4) no containment failure is about

'Each value in the column in Figure 4.5 labeled "All" isobtained by summing the products of individual acci-dent progression bin conditional probabilities for eachplant damage state and the ratio of the frequency of thatplant damage state to the total core damage frequency.

0.27. Figure 4.6 further displays the conditionalprobability distribution of early containment fail-ure for each plant damage state, thereby providingthe estimated range of uncertainties in these con-tainment failure predictions. The important con-clusions that can be drawn from the informationin these two figures are: (1) there is a high meanprobability (i.e., 50%) that the Peach Bottomcontainment will fail early for the dominant plantdamage states; (2) early containment failures willprimarily occur in the drywell structure resulting ina bypass of the suppression pool's scrubbing ef-fects for radioactive material released after vesselbreach; and (3) the principal cause of earlydrywell failure is drywell shell meltthrough. Thedata further indicate that the early containmentfailure probability distributions for most plantdamage states are quite broad. Also presented inthese displays of containment failure informationis evidence that there is a high probability of earlycontainment failure during external events such asfire and earthquakes. Specifically, the seismicanalysis indicates that the conditional probabilityof early containment failure from all causes, i.e.,direct containment structural failure or relatedfailure from the effects of a core damage event,could be as high as 0.9.

Additional discussion on containment perform-ance (for all studied plants) is provided in Chapter9.


Characteristics of the Peach Bottom containmentdesign and operation that are important duringcore damage accidents include:

1. Containment InertingThe Peach Bottom containment is main-tained in an inerted state, i.e., nitrogenfilled. This inerted containment conditionsignificantly reduces the chance of hydrogencombustion in the containment, thereby re-moving a major threat to its failure. How-ever, hydrogen combustion in the reactorbuilding is a possibility for some severe acci-dent sequences.

2. Drywell SpraysThe Peach Bottom drywell contains a sprayheader that can be used to mitigate the ef-fects of the actions of molten core materialon the floor of the drywell. In particular, thespray system may provide sufficient water toprevent the molten core material from com-ing into contact with the drywell shell and po-tentially causing its failure.

NUREG-1 150 4-12

AC

CID

ENT

PRO

GR

ESSI

ON

BIN

PLA

NT

DA

MA

GE

STA

TE(M

ean

Cor

e D

amag

e F

equ

ency

)…

Inte

rnal

In

itiat

ors-

---

Fir

e I

Seis

mic

VB

> 2

00ps

i,ea

rly

WW

F

VB

< 20

0 ps

i,ea

rly

WW

F

V3

> 20

0 ps

i,ea

rly

DWF

VB

< 20

0 ps

i,ea

rly

DWF

VB,

lat

e W

WF

VB,

lat

e D

WF

VB,

CV

No

CF

No

VB

No

Cor

e D

amag

e

z ToM I- Lh

It 5 CD0 0 0 P,

VB

= V

esse

l B

reac

hW

WF

= W

etwell

Fai

lure

D

WF

Dry

wel

l F

ailu

reCV

C

on

tain

men

t V

enti

ngC

F =

Co

nta

inm

ent

Fai

lure

Figu

re 4

.5

Con

ditio

nal

prob

abili

ty o

f acc

iden

t pr

ogre

ssio

n bi

ns a

t Pe

ach

Bot

tom

.

z I 0nL

EO

a)

.-q 0

Q

°.

i .E

-1P.L

, d

_ U

co

1.-

3 0 0 El

0r PC CD

IC

l

…In

tern

al

Init

iato

rs--

----

-

PDS

Gro

up

LOSP

LO

CA

s A

TWS

Tra

nsi

ents

A

llC

ore

Dam

age

Mre

q.

2.A

E-0

6 1.

5E-0

7 1.

9E-0

6 1.

8E-0

7 4.3

E-0

6

Fir

eS

eism

ic

LLN

L7.

5E-0

52.

OE

-05

Fig

ure

4.6

Con

diti

onal

pro

babi

lity

dis

trib

utio

ns f

or e

arly

con

tain

men

t fa

ilur

e at

Pea

ch B

otto

m.




Failure of the drywell shell following vesselmeltthrough is a characteristic of the risk-dominant accident progression bins for the PeachBottom plant. Figure 4.7 illustrates the sourceterms for the early failure accident progression binin which the reactor coolant system is pressurized(> 200 psi) at the time of vessel failure. in com-parison with the bypass release that was illustratedfor Surry in Figure 3.7, the core fractions of thevolatile groups (iodine, cesium, and tellurium) re-leased to the environment are slightly reduced.For the majority of accident sequences in PeachBottom, the radionuclides released from fuel in-vessel must pass through the suppression poolwhere substantial decontamination is possible. Insequences where the drywell spray system is oper-able, the ex-vessel release will also be mitigated bythe spray or an overlaying pool of water. Both thein-vessel and ex-vessel releases will receive furtherattenuation in the reactor building before releaseto the environment. Even if the decontaminationfactor of some of these stages is small, the overalleffect is to make the likelihood of a very largerelease quite small.

The Peach Bottom plant has instituted emergencyoperating procedures to vent the containment inthe wetwell region to avoid failure by overpres-surization. Figure 4.8 shows the source terms forthe accident progression bin in which the contain-ment is vented and no subsequent failure of thecontainment occurs. The source terms for thevolatile radionuclide groups are less than those forthe early drywell failure bin discussed previously.In both cases, scrubbing of the in-vessel release bythe suppression pool has the principal mitigatinginfluence on the environmental release. The re-lease fractions for the less volatile groups aresmaller for the vented accident progression binbut only by approximately a factor of one-half.There are two reasons why the differences be-tween the environmental release of the ex-vesselspecies for the vented and drywell failure casesare not greater. The decontamination capability ofthe suppression pool for ex-vessel release, inwhich. the flow is through the downcomers, issomewhat less than for the in-vessel release, whichpasses through spargers on the safety relief lines.Thus, even though the ex-vessel release must passthrough the pool for the vented case, the decon-tamination factor may be small. The ex-vessel re-lease for the drywell failure accident progressionbin will at least be subjected to decontamination

in the reactor building and possibly to sprays andscrubbing by an overlaying water layer.

The range of uncertainty in the release for thebarium and strontium radionuclide groups is par-ticularly evident. The spread between the meanand median is two orders of magnitude. Althoughthe release is likely to be quite small, the meanvalue of the release is as high as the mean valuefor the tellurium release.



1. Reactor Building

The Peach Bottom containment is locatedwithin a reactor building. A release of radio-active material to the reactor building willundergo some degree of decontamination be-fore release to the environment. An impor-tant consideration in determining the magni-tude of building decontamination is whetherhydrogen combustion occurs in the buildingand whether combustion is sufficiently ener-getic to fail the building. The range of decon-tamination factors for the reactor buildingused in the study is from 1.1 to 10 with amedian value of 3 for typical accident condi-tions.

2. Pressure-Suppression Pool

The pressure-suppression pool is particularlyeffective in the reduction of the in-vessel re-lease component of the source terms forPeach Bottom. The range of decontamina-tion factors used is from 1.2 to 4000 with amedian of 80 for flow through the safety re-lief valve lines.

The submergence is less and bubble size islarger for flow through the downcomers thanfor the spargers through which the in-vesselrelease is most likely to enter the pool. As aresult, the decontamination factor for the ex-vessel release or any in-vessel release thatpasses through the drywell is smaller, rangingfrom approximately 1 to 90 with a median of10. Furthermore, the likelihood of failure ofthe drywell at the time of vessel meltthroughis predicted to be high. For scenarios involv-ing early drywell failure, the suppression poolwould be bypassed during the period of core-concrete interaction and radionuclide re-lease.

4-15 NUREG-1 150

z Ci :r M

Rel

ease

Fra

ctio

n1 .

OE+

OO

1.O

E-0

1

1.O

E-0

2

i.OE

-03

1.O

E-0

4

1.O

E-0

5

IT

~~~~

~~~~

~~~~

~~~9

5%

--man med

ian

5%

Id 0:r to 0 P in

NG

I C

sT

eS

r R

u La

B

a C

e

Rad

ionu

clid

e G

roup

Figu

re 4

.7

Sour

ce t

erm

dis

trib

utio

ns f

or e

arly

fai

lure

in

dryw

ell a

t Pea

ch B

otto

m.

Rele

ase

Frac

tion

1.O

E.0

0

1.O

E-0

1

1.O

E-0

2

1.O

E-0

3

1.O

E-0

4

1.0E

- 05

�LF�T

hm

ean

med

ian

6%

MM

Mi,~

~~~~

~~..

...

NG

I C

sz C 0 0d

Te

Sr

Ru

La

Ba

Ce

Rad

ionu

clid

e G

roup

w0 0 re.q

Figu

re 4

.8 S

ourc

e te

rm d

istr

ibut

ions

for

ven

ted

cont

ainm

ent

at P

each

Bot

tom

.


3. Venting

The Peach Bottom containment can bevented from the wetwell air space. By pre-venting containment failure, venting can po-tentially prevent some scenarios from becom-ing core damage accidents. In scenarios thatproceed to fuel melting, venting can lead tothe mitigation of the release of radioactivematerial to the environment by ensuring thatthe release passes through the suppressionpool. The effect of venting on core damagefrequency is described in Chapter 8. Figure4.8 illustrates the source term characteristicsfor the venting accident progression bins. Al-though the source terms are somewhat lessthan for the early drywell failure accidentprogression bin, the uncertainties in the re-lease fractions are quite broad. At the highend of the uncertainty range, it is possiblethat 40 percent of the core inventory of io-dine could be released to the environment.

The effectiveness of venting to mitigate se-vere accident release of radioactive materialis limited in the Peach Bottom analyses be-cause of the high likelihood of early drywellfailure, particularly as the result of direct at-tack of the shell by molten core debris. Ifdirect attack of the containment shell is de-termined not to lead to failure or if effectivemeans are found to preclude failure, the ef-fectiveness of venting could be greater. How-ever, considering the range of uncertaintiesin the source term analyses, the predictedconsequences of vented accident progressionbins are not necessarily minor.


Figures 4.9 and 4.10 display the frequency distri-butions in the form of graphical plots of the com-plementary cumulative distribution functions(CCDFs) of four offsite consequence measures-early fatalities, latent cancer fatalities, and the50-mile and entire site region population expo-sures (in person-rems). The CCDFs in Figures 4.9and 4.10 include contributions from all sourceterms associated with reactor accidents caused bythe internal initiating events and fire, respectively.Four CCDFs, namely, the 5th percentile, 50thpercentile (median), 95th percentile, and themean CCDFs, are shown for each consequencemeasure.

Peach Bottom plant-specific and site-specific pa-rameters were used in the consequence analysisfor these CCDFs. The plant-specific parameters

included source terms and their frequencies, thelicensed thermal power (3293 MWt) of the reac-tor, and the approximate physical dimensions ofthe power plant building complex. The site-spe-cific parameters included exclusion area radius(820 meters), meteorological data for 1 full yearcollected at the site meteorological tower, the siteregion population distribution based on the 1980census data, topography (fraction of the area thatis land-the remaining fraction is assumed to bewater), land use, agricultural practice and produc-tivity, and other economic data for up to 1,000miles from the Peach Bottom plant.

The consequence estimates displayed in these fig-ures have incorporated the benefits of the follow-ing protective measures: (1) evacuation of 99.5percent of the population within the 10-mileplume exposure pathway emergency planningzone (EPZ), (2) early relocation of the remainingpopulation only from the heavily contaminatedareas both within and outside the 10-mile EPZ,and (3) decontamination, temporary interdiction,or condemnation of land, property, and foodscontaminated above acceptable levels.

The population density within the Peach Bottom10-mile EPZ is about 90 persons per square mile.The average delay time before evacuation (after awarning prior to radionuclide release) from the10-mile EPZ and average effective evacuationspeed used in the analyses were derived from in-formation contained in a utility-sponsored PeachBottom evacuation time estimate study (Ref. 4.9)and the NRC requirements for emergency plan-ning.

The results displayed in Figures 4.9 and 4.10 arediscussed in Chapter 11.



A detailed description of the results of the PeachBottom risk is provided in Reference 4.2. For thissummary report, results are provided for the fol-lowing measures of public risk:

* Early fatality risk,* Latent cancer fatality risk,

a0

S

Population dose within 50 miles of the site,Population dose within the entire site region,Individual early fatality risk in the populationwithin 1 mile of the Peach Bottom exclusionarea boundary, and

* Individual latent cancer fatality risk in the popu-lation within 10 miles of the site.

NUREG-1 150 4-18

-1Z

.O

E-0

3 .1

.0E

- O

Pe

rce

nti

leZ

5 1.OE ̂04 *---

5th

I .O

E-0

4

c -

Mea

n

.Op-o

s

e.O

E-0

5

-1.O

E-o

8

0E

1,

I.O

E-0

7

I.O

E-0

7

e <

D

P

*ren

til"

1.O

E-0

8

, l.

OE

-08

--

Wh

tO

(U~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~t

1 .O

E-O

O

' 1.

OE

-O9

-60th

oV

\

o

--- btn

\\

w**

*.

OE

- 0

*.

O

OE..

.

1.O

EO

O

1.O

E+O

t.

OE

*02

1.O

E*0

3

1.O

E.0

4

.OE+

O5

I.O

E.O

O

.OE

*O1

1.O

E*0

2

1.O

E*0

3

.OE

O

1.O

E-0

5

.OE

-oe

Early F

ata

litie

s

Late

nt

Cancer

Fata

lities

0~

~~

~t .

oE

-03

^ .O

E -03

r t.

OE

-04

.E.

C.)

0~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

a-

1.o

E-0

5 .

-.

15..-

Cr

Or~

~~~~

~~~~

~~~~

'L

IL.

E Per

Cen

tilE

e 0

l.O

E-0

7

\.oE

-08

\

*

0 'I

(Dt

tL

~~Perc

entile

\ LP

tetls

\it*D 1

.0E

-08

-- eatnt

0

\

1.O

E-O

8 --

5t

h 0\

C

_~

- M

ean

: ,

en\1

I .O

E-O

-

60

th

a)

t.O

E-0

-

Bo

th

0

1 S'

5t

h

.6th

.

o

1.- .O

E- 10

,

i.o

E-

10z

l.OE400

1.O

E'0

2

IOE

-04

I.

OE

*00

1O

E.O

B

.OE

*o0

1.O

E.0

2 I.

OE

-04

1.

OE-

*0

t.o

E-0

8'

C~

Po

pu

lati

on

Do

se (

per

son

-rem

) to

-5

0 M

iles

Popula

tion D

ose

(p

erso

n-re

m)

o -E

nti

re R

egio

n

D

Not

e:

As

disc

usse

d in

Ref

eren

ce 4

.4,

estim

ated

ris

ks a

t or

bel

ow 1

E-7

per

rea

ctor

yea

r sh

ould

be

view

ed w

ith c

autio

nbe

caus

e of

the

pote

ntia

l im

pact

of

even

ts n

ot s

tudi

ed i

n th

e ris

k an

alys

es.

Figu

re 4

.9

Freq

uenc

y di

stri

butio

ns o

f of

fsite

con

sequ

ence

mea

sure

s at

Pea

ch B

otto

m (

inte

rnal

ini

tiato

rs).

z t

I.O

E-0

3

I.OE-

0Og

t.OE

- 10 1.01

10.o

i.O

E-0

1 1.

OE

.02

1.01

F.03

I

ng

.nA

I

=

0 C

05

Early F

ata

lltle

sw

avev; -

C

*I-O

B0

CD 0

1O

E-0

9

-601h

-. th

I.O

E-

10 IOE

*OO

1.

OE

. 02

I.OE

.04

tOE

.Oe

I.O

E.o

eP

OP

Ula

tion

C

)ose

(perS

on-r

em

) to

-0

M

iles

1 .O

E-0

3

I .O

E-

040 !

1.0

E-0

5

Z;

1.O

E-0

70 0

1 C

E-0

8to 0D a):

OE0

fir

._

I

---

Oth

l.O

F-

t. W.E

0

l O

l.O

EO

o0

E-

1;oE

0 .08

Po

pu

latio

n D

ose (

pors

on-r

om

) to

-E

ntire

R

eg

ion

Not

e:

As

disc

usse

d in

Ref

eren

ce 4

.4,

estim

ated

ris

ks a

t or

bel

ow 1

E-7

per

rea

ctor

yea

r sh

ould

be

view

ed w

ith c

autio

nbe

caus

e of

the

pote

ntia

l im

pact

of e

vent

s no

t st

udie

d in

the

risk

ana

lyse

s.

Figu

re 4

.10

Freq

uenc

y di

stri

butio

ns o

f off

site

con

sequ

ence

mea

sure

s at

Pea

ch B

otto

m (

fire

ini

tiato

rs).




The results of the risk studies using the abovemeasures are shown in Figures 4.11 through 4.13.The figures display the variabilities in mean risksestimated from the meteorology-averaged condi-tional mean values of the consequence measures.For the first two measures, the results of the firstrisk study of Peach Bottom, the Reactor SafetyStudy (Ref. 4.3), are also provided. As may beseen, the early fatality risk from Peach Bottom isestimated to be very low. Latent cancer fatalityrisks are lower than those of the Reactor SafetyStudy. The risks of population dose and individualearly fatality risk are also very low, and the indi-vidual latent cancer fatality risk is orders of mag-nitude lower than the NRC safety goals. Thesecomparisons are discussed in more detail in Chap-ter 12.

The risk results shown in Figure 4.11 have beenanalyzed to determine the relative contributions ofplant damage states and accident progression binsto mean risk. The results of this analysis are pro-vided in Figures 4.14 and 4.15. As can be seenfrom these figures, and from the supporting docu-ment (Ref. 4.2), the major contributors to bothearly and latent cancer fatality risks are from sta-tion blackout (SBO) and anticipated transientswithout scram (ATWS). The dominant accidentprogression bins are early containment failure anddrywell failure caused by drywell meltthrough andloads at vessel breach (due to direct containmentheating, steam blowdown, or quasistatic pressurefrom steam explosion).


As discussed in Section 4.2.1.2, the Peach Bot-tom plant has been analyzed for two externallyinitiated accidents: earthquakes and fire. The firerisk analysis has been performed through the esti-mates for consequences and risk measures,

whereas, as explained in Chapter 2, the seismicanalysis has been conducted up to containmentperformance. Sensitivity analyses of seismic risk atPeach Bottom are provided in Reference 4.2.

Results of fire risk analysis (variabilities in meanrisks estimated from the meteorology-averagedconditional mean values of the consequencemeasures) of Peach Bottom are shown in Figures4.16 through 4.18 for early fatality, latent cancerfatality, population dose (within 50 miles of thesite and within the entire site region), and individ-ual early and latent cancer fatality risks. Majorcontributions to early and latent cancer fatalityrisks are shown in Figure 4.19. As can be seen,early and latent cancer fatality risks for fire atPeach Bottom are dominated by early contain-ment failure and drywell failure caused by drywellmeltthrough and loads at vessel breach. Other riskmeasures are slightly higher than those for inter-nally initiated events but well below NRC safetygoals.


The risk from the internal events are driven bylong-term station blackout (SBO) and anticipatedtransients without scram (ATWS). The domi-nance of these two plant damage states can be at-tributed to both general BWR characteristics andplant-specific design. BWRs in general have moreredundant systems that can inject into the reactorvessel than PWRs and can readily go to low pres-sure and use their low-pressure injection systems.This means that the dominant plant damage stateswill be driven by events that fail a multitude ofsystems (i.e., reduce the redundancy throughsome common-mode or support system failure) orevents that only require a small number of systemsto fail in order to reach core damage. The stationblackout plant damage state satisfies the first ofthese requirements in that all systems ultimatelydepend upon ac power, and a loss of offsite poweris a relatively high probability event. The totalprobability of losing ac power long enough to in-duce core damage is relatively high, although stilllow for a plant with Peach Bottom's design. TheATWS scenario is driven by the small number ofsystems that are needed to fail and the high stressupon the operators in these sequences.

4-21 NUREG-1 150


1 -4

10

l-So

10

)10'

0 10

-r11

10 *;

10-


Key: M = meanm = medianth = percentile

RSS 95,

M. -I 5th

6th..


Note: As discussed in Reference 4.4, estimated risks at or below 1E-7 per reactor year should beviewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 4.11 Early and latent cancer fatality risks at Peach Bottom (internal initiators).

NUREG-1150 4-22


0

C:)

C)

a)

Is

~Id0

0

1-40

o

d

4.

P4 1OG

0

Ii.m

I

9'th

Sty,


Key: M - meanm = medianth percentile

95th,

M 4.

t"

~5IJ



Figure 4.12 Population dose risks at Peach Bottom (internal initiators).

4-23 NUREG-1 150


1-

Mt10-'0;R

t10-1la4

-1

*X 10-

�1 -- - - -

>,-Safety Goal

I

I

0I

LI

l-Is101

<IXE-12

.

&1i0

t) C)

1-4

0

t

10

I2



,..Safety Goal

5th.S



Figure 4.13 Individual early and latent cancer fatality risks at Peach Bottom (internal initiators).

NUREG-1 150 4-24


PEACH BOTTOMPEACH BOTTOM EARLY FATALITY LATENT CANCER FATALITY

MEAN * 2.0E-S/RY

2

VEAN * 4.SE-S/RY

1

4

14

3 A 3Plant Damage State1. LOCA2. 803. ATWS4. TRiANBIENTS

._

Figure 4.14 Major contributors (plant damage states) to mean early and latentcancer fatality risks at Peach Bottom (internal initiators).

PEACH BOTTOM EARLY FATALITY

MEAN * 2.6E-i/1Y

PEACH BOTTOMLATENT CANCER FATALITY

MEAN * 4.$E-SRY

1

766yj

44Accident Progression Bins

1. VSt ECF. WW Failure. V Pru>200 pal. at VSS. VS. ECF. WW Failure, V Proeaa200 pal& at VSS VS. ECF. DW Failure. V Preo.'200 pale at Vs4. V ECF. DW Failure, V Pream200 ple at VDS. VS. Late CF. WW FailureS. VD. Late CF. DW Failure7. Va. Vent8, Vs. No CF9. No Va

Figure 4.15 Major contributors (accident progression bins) to mean early andlatent cancer fatality risks at Peach Bottom (internal initiators).

4-25 NUREG-1 150


Irod 3

.'

0

-4-

.V

lo' :

10-

10'

lo1

lo' e

95th

Key: M =m =th=



10~I!

10"IN0I

4

0-45.0

4

0

9th .



Figure 4.16 Early and latent cancer fatality risks at Peach Bottom (fire initiators).

NUREG-1 150 4-26


4102

idE

M

0

0

0

oam

10

0a 4

a10°-

0

04oa}

° 10

.° 10~0

95th

fth.


Key: M - meanm - medianth - percentile

* I~~~~~~~~~~~~~~~~~~~~~

95tih

in.

5th .



Figure 4.17 Population dose risks at Peach Bottom (fire initiators).

4-27 NUREG-1150


In

V

0

-

10-"

C A '-13,

l-

10

5th,


Key: }1 = meanm = medianth = percentile

I

0

-4

4

0P,

0

.1

0

95thb

m.

5th ,


Note: As discussed in Reference 4.4, estimated risks at orbelow E-7 per reactor year should be viewedwith caution because of the potential impact of events not studied in the risk analyses.

Figure 4.18 Individual early and latent cancer fatality risks at Peach Bottom (fire initiators).

NUREG-1 150 4-28


PEACH BOTTOM EARLY FATALITY(FIRE)

MEAN * 3.SE-7/RY

PEACH BOTTOMLATENT CANCER FATALITY

(FIRE)

MEAN - 34E-2tRY

3 3[164

Accident Progression Bins

1. V8, ECF, WW Failure, V Pr esi200 pia at VS2. V, CF, WW Failure, V Proaa200 pi at VB3. VB, ECF, W Failure, V Pre*i*200 pla t VB4. V. ECF, DW Failure, V Preaec200 pla at VSS. B, Late CF, WW FailureS. V. Late CF, DW Failure7. V, VentS. VB, No CF9. No VS

Figure 4.19 Major contributors (accident progression bins) to mean early and latent cancerfatality risks at Peach Bottom (fire initiators).

4-29 NUREG-1 150



4.1 A. M. Kolaczkowski et al., "Analysis ofCore Damage Frequency: Peach BottomUnit 2," Sandia National Laboratories,NUREG/CR-4550, Vol. 4, Revision 1,SAND86-2084, August 1989.

4.2 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1,SAND86-1309, to be published.'

4.3 USNRC, "Reactor Safety Study-An Assess-ment of Accident Risks in U.S. CommercialNuclear Power Plants," WASH-1400(NUREG-75/014), October 1975.

4.4 H. J. C. Kouts et al., "Special CommitteeReview of the Nuclear Regulatory Commis-sion's Severe Accident Risks Report(NUREG- 1150)," NUREG-1420, August1990.

4.5 D. L. Bernreuter et al., "Seismic HazardCharacterization of 69 Nuclear Power SitesEast of the Rocky Mountains," LawrenceLivermore National Laboratory, NUREG/

*Available in the NRC Public Document Room, 2120 LStreet NW., Washington, DC.

CR-5250, Vols. 1-8, UCID-21517, January1989.

4.6 Seismicity Owners Group and Electric PowerResearch Institute, "Seismic Hazard Meth-odology for the Central and Eastern UnitedStates," EPRI NP-4726, July 1986.

4.7 A. D. Swain III, "Accident Sequence Evalu-ation Program-Human Reliability AnalysisProcedure," Sandia National Laboratories,NUREG/CR-4772, SAND86-1996, Febru-ary 1987.

4.8 W. J. Luckas, Jr., "A Human ReliabilityAnalysis for the ATWS Accident Sequencewith MSIV Closure at the Peach BottomAtomic Power Station," Brookhaven Na-tional Laboratory, May 1986.

4.9 Philadelphia Electric Company, "EvacuationTime Estimates with the Plume ExposurePathway Emergency Planning Zone for thePeach Bottom Atomic Power Station," Rev.0, July 1982.

4.10 USNRC, "Safety Goals for the Operation ofNuclear Power Plants; Policy Statement,"Federal Register, Vol. 51, p. 30028, August21, 1986.

NUREG-1150 4-30

5. SEQUOYAH PLANT RESULTS


The Sequoyah Nuclear Power Plant is a two-unitsite. Each unit, designed by Westinghouse Corpo-ration, is a four-loop pressurized water reactor(PWR) rated at 1148 MWe and is housed in anice condenser containment. The balance of plantsystems were engineered and built by the utility,the Tennessee Valley Authority. Sequoyah 1started commercial operation in 1981. Some im-portant design features of the Sequoyah plant aredescribed in Table 5.1. A general plant schematicis provided in Figure 5.1.




The core damage frequency and risk analyses per-formed for this study considered accidents initi-ated only by internal events (Ref. 5.1); noexternal-event analyses were performed. The coredamage frequency results obtained are providedin tabular form in Table 5.2 and in graphicalform, displayed as a histogram, in Figure 5.2(Section 2.2.2 discusses histogram development).This study calculated a total median core damagefrequency from internal events of 3.7E-5 peryear.


Twenty-three individual accident sequences wereidentified as important to the core damage fre-quency estimates for Sequoyah. A detailed de-scription of these accident sequences is providedin Reference 5.1. For the purpose of discussionhere, the accident sequences have been groupedinto five summary plant damage states. These are:

* Station blackout,

* Loss-of-coolant accidents (LOCAs),

* Anticipated transients without scram(ATWS),

* Transients other than station blackout andATWS, and

* Interfacing-system LOCA and steam genera-tor tube rupture (bypass accidents).

The relative contributions of these groups to thetotal mean core damage frequency at Sequoyah isshown in Figure 5.3. It is seen that loss-of-coolantaccidents as a group are the largest contributors tocore damage frequency. Within the general classof loss-of-coolant accidents, the most probablecombinations of failures are:

* Intermediate (2" < D < 6"), small (1/2 < D <2"), and very small (D < 1/2") size LOCAsin the reactor coolant system piping followedby failure of high-pressure or low-pressureemergency coolant recirculation from thecontainment sump. Coolant recirculationfrom the containment sump can fail becauseof valve failures, pump failures, plugging ofdrains or strainers, or operator failure to cor-rectly reconfigure the emergency core coolingsystem (ECCS) equipment for the recircula-tion mode of operation.

Station blackout sequences as a group are the sec-ond largest contributor to core damage frequency.Within this group, the most probable combina-tions of failures are:

* Station blackout with failure of the auxiliaryfeedwater (AFW) system. Core uncovery iscaused by failure of the AFW system to pro-vide steam generator feed flow, thus causinggradual heatup and boiloff of reactor cool-ant. Station blackout also results in the un-availability of the high-pressure injection sys-tems for feed and bleed. The dominantcontributors to this sequence are the stationblackout followed by initial turbine-drivenAFW pump unavailability due to mechanicalfailure or maintenance outage, or failure ofthe operator to open air-operated valves afterdepletion of the instrument air supply.

* Station blackout with initial AFW operationthat fails at a later time because of batterydepletion or station blackout, with reactorcoolant pump (RCP) seal LOCA because ofloss of all RCP seal cooling. Station blackoutresults in a loss of seal injection flow to theRCPs and a loss of component cooling waterto the RCP thermal barriers. This conditionresults in vulnerability of the RCP seals to

5-1 NUREG-1 150

5. Sequoyah Plant Results

Table S.1 Summary of design features: Sequoyah Unit 1.

1. Coolant Injection System a. Charging system provides safety injection flow, emergencyboration, feed and bleed cooling, and normal seal injectionflow to the RCPs,* with 2 centrifugal pumps.

b. RHR system provides low-pressure emergency coolantinjection and recirculation following LOCA, with 2 trainsand 2 pumps.

c. Safety injection system provides high head safety injectionand feed and bleed cooling, with 2 trains and 2 pumps.

2. Steam GeneratorHeat Removal Systems a. Power conversion system.

b. Auxiliary feedwater system, with 3 trains and 3 pumps (2MDPs, 1 TDP).*

3. Reactivity Control Systems a. Control rods.

b. Chemical and volume control systems.

4. Key Support Systems a. dc power, with 2-hour station batteries.

b. Emergency ac power, with 2 diesel generators for eachunit, each diesel generator dedicated to a 6.9 kV emer-gency bus (these buses can be crosstied to each other viaa shutdown utility bus).

c. Component cooling water provides cooling water to RCP*thermal barriers and selected ECCS equipment, with 5pumps and 3 heat exchangers for both Units 1 and 2.

d. Service water system, with 8 self-cooled pumps for bothUnits 1 and 2.

5. Containment Structure a. Ice condenser.

b. 1.2 million cubic feet.

c. 10.8 psig design pressure.

6. Containment Systems a. Spray system provides containment pressure-suppressionduring the injection phase following a LOCA and alsoprovides containment heat removal during the recircula-tion phase following a LOCA.

b. System of igniters installed to burn hydrogen.

c. Air-return fans to circulate atmosphere through the icecondenser and keep containment atmosphere well mixed.

*MDP: Motor-Driven PumpTDP: Turbine-Driven PumpRCP: Reactor Coolant Pump

NUREG-1 150 5-2

(A I z tI 0'

U,

C TR

0

'Typ

ical

of

eac

h C

old

Leg

Loop

Figu

re 5

.1

Sequ

oyah

pla

nt s

chem

atic

.


Table 5.2 Summary of core damage frequency results: Sequoyah.*

5% Median Mean 95%

Internal Events

Station Blackout

Short TermLong Term

ATWSTransientLOCAInterfacing LOCASGTR

1.2E-5 3.7E-5 5.7E-5 1.8E-4

4.2E-7

1.OE-74.3E-82.5E-7

4.4E-61.5E-11

2.4E-8

3.8E-6 9.6E-61.4E-6 5.OE-6

5.3E-7 1.9E-61.1E-6 2.6E-61.8E-5 3.6E-5

2.OE-8 6.5E-7

4.1E-7 1.7E-6

3.6E-51.7E-57.SE-67.2E-61.2E-42. 1E-67.1E-6

*As discussed in Reference 5.3, core damage frequencies below 1E-5 per reactor year should beviewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

_ - - Core Damage Frequency (per RY)

1.OE-04

1.OE-05

1.OE-06

95th -

Mean

Median

5th -

Number of LHS samples

Note: As discussed in Reference 5.3, core damage frequencies below E-5 per reactoryear should be viewed with caution because of the remaining uncertainties in PRA(e.g., events not considered).

Figure 5.2 Internal core damage frequency results at Sequoyah.

NUREG-1 150 5-4


.N,.i.. Transients

Bypass

(nt. Sys. LOCA/SGTR)

ATWS Station Blackout

Total Mean Core Damage Frequency: .7E-5

Figure 5.3 Contributors to mean core damage frequency from internal events at Sequoyah.

failure. The failure to restore ac power andsafety injection flow following any seal LOCAleads to core uncovery. The time to core un-covery following onset of a seal LOCA is afunction of the leak rate and whether or notthe operator takes action to depressurize thereactor coolant system.

Within the general group of containment bypassaccidents, the more probable combinations of fail-ure are:

0 Steam generator tube rupture, followed byfailure to depressurize the reactor coolantsystem (RCS). Subsequent failure to depres-surize the RCS in the long term and thus limitRCS leakage leads to continued blowdownthrough the steam generator and eventualcore uncovery. An important event in this se-quence is the initial failure of the operator todepressurize within 45 minutes after the tuberupture. This leads to a relief valve demandin the secondary cooling system. The steam

generator safety valve will be demanded ifthe power-operated relief valve is blocked.Subsequent failure of the PORV or safetyvalve to reclose leads to direct loss of RCSinventory to the atmosphere. Failure of sub-sequent efforts to recover the sequence byRCS depressurization or closure of the PORVor safety valve leads to refueling water stor-age tank inventory depletion and eventualcore uncovery.

* Failure of RCS pressure isolation leading toLOCAs in systems interfacing with the reac-tor coolant system (by overpressurization oflow-pressure piping in the interfacing sys-tem). These sequences comprise 2 percent ofthe total core damage frequency but are im-portant contributors to risk because they cre-ate a direct release path to the environment.These accidents are of special interest be-cause they prevent ECCS operation in therecirculation mode and lead to containmentbypass.

5-5 NUREG-1150



Characteristics of the Sequoyah plant design andoperation that have been found to be important inthe analysis of core damage frequency include:

1. Electric Power Crossconnects BetweenUnits 1 and 2

The Sequoyah electric power system designincludes the capability to crosstie the 6.9 kVemergency buses at Unit 1 and Unit 2 andincludes the capability to energize dc batteryboards at Unit 1 from the batteries at Unit 2.These crossties help reduce the frequency ofstation blackout at Unit 1 and significantlyreduce the possibility of battery depletion asan important contributor for those stationblackouts that are postulated to occur. Thecrossties reduce the station blackout coredamage frequency by less than a factor of 2.As station blackout sequences only accountfor 20 percent of the total core damage fre-quency, the crossties reduce total core dam-age frequency by approximately 10 percent.

2. Transfer to Emergency Core Cooling andContainment Spray System RecirculationMode

The process for switching the emergency corecooling system and the containment spraysystem from the injection mode to the recir-culation mode at Sequoyah involves a seriesof operator actions that must be accom-plished in a relatively short time (20 min-utes) and are only partially automated.Therefore, operator action is required tomaintain core cooling when switching over tothe recirculation mode. Single operator er-rors during switchover from injection to recir-culation following a small LOCA can lead di-rectly to core uncovery. Recirculation failurecan also result from common-cause failuresaffecting the entire emergency core coolingsystem and containment spray system. Thesefailures include level sensor miscalibrationfor the refueling water storage tank and fail-ure to remove the upper containment com-partment drain plugs after refueling.

3. Loss of Coolant from Interfacing-SystemLOCA

Interfacing-system LOCA results from fail-ures of any one of the four pairs of series

check valves used to isolate the high-pressureRCS from the low-pressure injection system.The resultant flow into the low-pressure sys-tem is assumed to result in rupture of thelow-pressure piping or components outsidethe containment boundary. Although core in-ventory makeup by the high-pressure injec-tion system is initially available, the inabilityto switch to the recirculation mode wouldeventually lead to core damage. Because ofthe location of the postulated LOCA, all con-tainment safeguards are bypassed.

The failure scenarios of interest are thosethat produce a sudden large backleakagefrom the RCS that cannot be accommodatedby relief valves in the low-pressure systems.Interfacing-system LOCA could therefore oc-cur in two ways:

a. Random or dependent rupture of valveinternals on both valves. Rupture of theupstream valve would go undetected un-til rupture of the second valve occurred,and

b. Rupture of the downstream valve com-bined with the failure of the upstreamvalve to be closed on demand. This sce-nario has an extremely low probability atSequoyah because the check valve test-ing procedures require leak rate testingafter each valve use.

If an interfacing-system LOCA should occur,a potential recovery action was identified andconsidered in the analysis in which the op-erator may be able to isolate the interfacing-system LOCA by closing the appropriate low-pressure injection cold leg isolation valve.


Sequoyah is a two-unit site with four dieselgenerator units. Each diesel is dedicated to aparticular (6.9 kV) emergency bus at one ofthe units. Each diesel generator can only beconnected to its dedicated emergency bus.However, the 6.9 kV buses can be crosstiedto each other through the use of the shut-down utility bus, thus providing an indirectway to crosstie diesels and emergency buses.The diesel generators have dedicated batter-ies for starting and can be loaded on theemergency buses manually or with alternativepower supplies. Emergency ac power is there-fore not as susceptible to failures of the sta-tion batteries as at those plants where stationbatteries are used for diesel startup.

NUREG-1150 5-6


S. Containment Design

The ice condenser containment design is im-portant to estimates of core damage fre-quency because of the spray actuation set-points. The relatively low-pressure setpointsresult in spray actuation for a significant per-centage of small LOCAs. The operation ofthe sprays will deplete the refueling waterstorage tank (RWST) in approximately 20minutes, thus requiring fast operator inter-vention to switch over to recirculation mode.The reduced time available for operator ac-tion results in an increased human error ratefor recirculation alignment associated withthis time interval.


Several operator actions are very important inpreventing core uncovery. These actions arediscussed in this section with respect to the acci-dent sequence in which they occur.

* Switchover to ECCS recirculation in a smallLOCA

There are four major operator actions duringrecirculation switchover:

- Switchover of high-pressure emergencycore cooling system (ECCS) from injec-tion to recirculation.

- Isolation of ECCS suction from RWST.

- Switchover of containment spray system(CSS) from injection to recirculation,including isolation of suction from theRWST.

- Valving in component cooling water(CCW) to the residual heat removal(RHR) heat exchangers.

* Control of containment sprays during smallLOCAs

Virtually all small LOCAs will result in auto-matic containment spray actuation. If the op-erator does not control sprays early during asmall LOCA, the RWST level will decreaseand switchover to recirculation will be re-quired.

All actions are performed in the main controlroom at one location. The time for diagnosisis relatively short (20 minutes) for determin-

ing if the event is actually a LOCA and antici-pating whether high-pressure recirculation willbe needed when the low RWST level alarm isactuated.

* Feed and bleed cooling

For accident sequences in which main andauxiliary feedwater are unavailable, feed andbleed cooling can be used to remove decayheat from the core. The operator is in-structed to initiate feed and bleed cooling ifsteam generator levels drop below 25 per-cent. This point is reached approximately 30minutes after auxiliary feedwater (AFW) andmain feedwater become unavailable.

* Anticipated transients without scram(ATWS)

Five operator actions could potentially be re-quired during an ATWS sequence, depend-ing on the particular course of the sequence.These events are:

- Manual reactor trip.

- Trip turbine if not done automatically.

- Start AFW if not started automatically.

- Open block valve on power-operatedrelief valve (PORV) within 2 minutes ifPORV is isolated previous to initiatingevent.

- Emergency boration, if manual tripfailed.

Due to the fast-acting nature of an ATWS,all ATWS actions must be performed frommemory.

* Steam generator tube rupture

Steam generator tube rupture (SGTR) acci-dent sequences are considered to begin witha double-ended rupture of a single steamgenerator tube. Very shortly thereafter, asafety injection signal will occur on low RCSpressure. The immediate concern for the op-erator, after identifying the event as anSGTR, is to identify and isolate the rupturedsteam generator. There are three possible op-erator actions during an SGTR. These are:

- Cool down and depressurize the RCSvery shortly (45 minutes) after the

5-7 NUREG-1150


event in order to prevent lifting the reliefvalves on the affected steam generator;,

- Restore the main feedwater flow in theevent of a loss of auxiliary feed flow;and

- Isolate the steam generator that containsthe ruptured tube.

* Interfacing-system LOCA recovery action

The two RHR trains are physically isolatedfrom each other and are provided with sys-tem isolation capability. To recover from aninterfacing-system LOCA in the RHR systemand to continue core cooling, the break mustfirst be isolated and the reactor coolantsystem refilled. Since the RHR valves are notdesigned to close against the pressuredifferentials present during the blowdown,isolation of the affected loop and operationof the unaffected loop must be accomplishedfollowing blowdown. The RHR valves can beclosed from the control room. No credit forlocal action is given because of the steam en-vironment following the blowdown.


As discussed in Chapter 2, the process of develop-ing a probabilistic model of a nuclear power plantinvolves the combination of many individualevents (initiators, hardware failures, operator er-rors, etc.) into accident sequences and eventuallyinto an estimate of the total frequency of coredamage. After development, such a model canalso be used to assess the importance of the indi-vidual events. The detailed studies underlying thisreport have been analyzed using several event im-portance measures. The results of the analyses us-ing two measures, "risk reduction" and "uncer-tainty" importance, are summarized below.

* Risk (core damage frequency) reduction im-portance measure (internal events)

The risk-reduction importance measure isused to assess the change in core damage fre-quency as a result of setting the probability ofan individual event to zero. Using this meas-ure, the following individual events werefound to cause the greatest reduction in core

damage frequency if their probabilities wereset to zero:

- Very small LOCA initiating event. Thecore damage frequency will be reducedby approximately 38 percent.

- Operator fails to control sprays during asmall LOCA. The core damage fre-quency will be reduced by approxi-mately 37 percent.

- Loss of offsite power initiating event.The core damage frequency will be re-duced by approximately 21 percent.

- Operator failure to properly align high-pressure recirculation. The core damagefrequency will be reduced by approxi-mately 15 to 20 percent.

- Failure to recover diesel generatorswithin 1 hour. The core damage fre-quency will be reduced by approxi-mately 14 percent.

- Failure to recover ac power within 1hour. The core damage frequency willbe reduced by approximately 13 per-cent.

- Intermediate LOCA initiating events.The core damage frequency will be re-duced by approximately 12 percent.

- Small LOCA initiating events. The coredamage frequency will be reduced byapproximately 13 percent.


A second importance measure used to evalu-ate the core damage frequency analysis re-sults is the uncertainty importance measure.For this measure, the relative contribution ofthe uncertainty of individual events to theuncertainty in total core damage frequency iscalculated. Using this measure, the largestcontributors to uncertainty in the results arethe human error probabilities for failure toreconfigure the ECCS for high-pressure recir-culation. All other events contribute rela-tively little to the uncertainty in overall coredamage frequency.

NUREG-1 150 5-8




The Sequoyah primary containment consists of apressure-suppression containment system, i.e., icecondenser, which houses the reactor pressure ves-sel, reactor coolant system, and the steam genera-tors for the secondary side steam supply system.The containment system is comprised of a steelvessel surrounded by a concrete shield buildingenclosing an annular space. The internal contain-ment volume, which has a total capacity of 1.2million cubic feet, is divided into two major com-partments connected by the ice condenser system,with the reactor coolant system occupying thelower compartment. The ice condenser is essen-tially a cold storage ice-filled room 50 feet inheight, bounded on one side by the steel contain-ment wall. The design basis pressure forSequoyah's ice condenser containment is 10.8psig, whereas its estimated mean failure pressureis 65 psig. This low-pressure design combined withthe relatively small free volume made hydrogencontrol a design basis consideration, i.e.,recombiners, and also a major consideration withrespect to containment integrity for severe acci-dents, i.e., igniters and air-return fans. Similar toother containment design analyses for this study,the estimate of where and when Sequoyah's con-tainment will fail relied heavily on the use of ex-pert judgment to interpret and supplement thelimited data available (Ref. 5.4).

The potential for early containment failure hasbeen of considerable concern for Sequoyah sincethe steel containment has such a low design pres-sure. The principal mechanisms threatening thecontainment are hydrogen combustion effects,overpressurization due to direct containment heat-ing, failure of the wall by direct contact with mol-ten core material, and isolation failures.

The results of the Sequoyah containment analysisare summarized in Figures 5.4 and 5.5. Figure 5.4displays information in which the conditionalprobabilities of ten containment-related accidentprogression bins; e.g., VB-early CF (during CD),are presented for each of five plant damage states.This information indicates that, on a frequency-weighted average, * the mean conditional prob-ability from internal events of (1) early contain-

*Each value in the column in Figure 5.4 labeled "All" isobtained by calculating the products of individual acci-dent progression bin conditional probabilities for eachplant damage state and the ratio of the frequency of thatplant damage state to the total core damage frequency.

ment failure due to effects such as hydrogencombustion, direct containment heating, and wallcontact failure is 0.07, (2) late containment fail-ure due primarily to basemat meltthrough is 0.21,(3) containment bypass is 0.06, and (4) probabil-ity of no containment failure or no vessel breach is0.66. It should be noted, however, that the condi-tional probabilities of early containment failure forthe loss of offsite power (LOSP) plant damagestate are considerably higher than the averagedvalues, i.e., about 0.13 for LOSP sequences in-volving vessel breach and 0.17 when those LOSPsequences having no vessel breach are included.Figure 5.5 further develops the conditional prob-ability distribution of early containment failure foreach of the plant damage states, providing the es-timated range of uncertainties in the containmentfailure predictions. Overall conclusions that canbe drawn from this information are discussed inChapter 9. However, it should be noted that Se-quoyah's early containment failure probability de-pends heavily on the accuracy of our predictionsof core arrest probability, direct containmentheating, hydrogen combustion, and wall attack ef-fects.

Additional discussions on containment perform-ance (for all studied plants) are provided in Chap-ter 9.5.3.2 Important Plant Characteristics

(Containment Performance)

Characteristics of the Sequoyah design and opera-tion that are important to containment perform-ance include:

1. Pressure-Suppression Design

The Sequoyah ice condenser suppression de-sign can have a significant effect on certainaccident sequence risk results. For example,the availability of ice in the ice condensercan reduce the risk significantly from eventsinvolving steam or direct containment heatingthreats to the containment. In contrast, itsavailability during some station blackout se-quences can result in a potentially combusti-ble hydrogen concentration at the exit of theice bed. Further discussion of the ice con-denser pressure-suppression system relativeto other PWR dry containments is containedin Chapter 9.

2. Hydrogen Ignition System

The Sequoyah hydrogen ignition system willsignificantly reduce the threat to containmentfrom uncontrolled hydrogen combustion

5-9 NUREG-1 150

Q I

CA c zr

C

AC

CID

ENT

PRO

GR

ESS

ION

BIN

VB

, ea

rly

CF

(duri

ng C

D)

VB

. al

pha,

earl

y C

F (a

t V

B)

VB

> 2

00 p

si,

earl

y C

E (a

t V

B)

VB

< 2

00 p

si,

earl

y C

F (a

t V

B)

VB

, la

te C

F

VB

, B

MT

,ver

y l

ate

CF

Bypas

s

VB

, N

o C

F

No

VB

, ea

rly C

F(d

uri

ng C

D)

No

VB

LO

SP

A

TWS

(1.3

BE

-05)

(2

.07

E-0

6)

PLA

NT

DA

MA

GE

STA

TE(M

ean

Cor

e D

amag

e F

req

uen

cy)

Tra

nsi

ents

LO

CA

s B

yass

(2.3

2E

-06

) (3

.52E

-05)

(2.3

E

-06)

0.0

14

0.0

02

B0.064

B0.054 ] 0.1

53

0.0

65

10.0

01 D

0.2

00

0.0

38 D:

0.38

4

I. I 0.

134

D-1

0.

471

10.0

01

n 0.17

1

0.00

3 0

.00

5

10

.01

4

10.0

04

1D0.

039

10.0

06

H

0.13

7

10.0

05

0.00

2

10.0

02

0.03

1

0.01

4

10.0

01 D 0.260

11

0.3

01

10.0

02

0110

0367

0.0

05

1 0.0

02

80.0

35

1 0.

023

110.

038

L

0.17

1

B0.0

56

_ 0.

269

1 0.

011

F] 0.3

71

All

(5.5

8E

-05

)

g:

LIII

BM

T =

Bas

emat

Mel

tthro

ugh

CF

= C

onta

inm

ent

Fbil

ure

VB

= V

esse

l B

reach

CD

=

Core

Deg

rad

ati

on

Fig

ure

5.4

Con

diti

onal

pro

babi

lity

of

acci

dent

pro

gres

sion

bin

s at

Seq

uoya

h.

.EO

I E

-1

95th

,

Q0

°

O (aI.

OV

X

co

1.E

-2_-

1.E

-3-

1.E

-4-

M *.

5th.

.

IA

1. M

i-

5th

-,

M =

mean

m =

med

ian

th

per

centi

le

1.E

-5_

co >0 I< w :Z,

z tTI

0

PDS

Gro

upC

ore

Dam

age

Fre

q.LO

SP

ATW

S T

ran

sien

ts1.

4E-0

5 2.1

E-0

6

2.S

E-0

6LO

CA

s B

ypas

s A

ll3.5

E-0

5

2.4

E-0

6

5.6

E-0

5

Figu

re 5

.5

Con

ditio

nal

prob

abili

ty d

istr

ibut

ions

fo

r ea

rly

cont

ainm

ent

failu

re a

t Se

quoy

ah.


effects except for station blackout sequences.However, when power is recovered followinga station blackout, if the igniters are turnedon before the air-retum fans have diluted thehydrogen concentration at or above the icebeds, the ignition could trigger a detonationor deflagration that could fail containment.These blackout sequences, however, repre-sent a small fraction of the overall frequencyof core damage.

3. Lower Compartment Design

The design and construction of the seal tableis such that if the reactor coolant system is atan elevated pressure upon vessel breach, thecore debris is likely to get into the seal tableroom, which is directly in contact with thecontainment, and melt through the wall caus-ing a break of containment. The design ofthe reactor cavity, however, does have thepotential to cool the molten core debris andalso mitigate the effects of potential directcontainment heating events for those se-cuences where water is in the reactor cavity.



The absolute frequencies of early containmentfailure from severe accident loads and ofcontainment bypass are predicted to be similar forthe Sequoyah plant (Ref.. 5.2). Figure 5.6 illus-trates the release fractions for an early contain-ment failure accident progression bin. The meanvalues for the release of the volatile radionuclidegroups are approximately 10 percent, indicative ofan accident with the potential for causing early fa-talities. The in-vessel releases in these accidentscan be subject to decontamination by the ice bedor by containment sprays following release to thecontainment. The sprays require ac power andare, therefore, not available prior to power recov-ery in station blackout plant damage states. Thedecontamination factor of the ice bed is also af-fected by the unavailability of the recirculationfans during station blackout.

The location and mode of containment failure areparticularly important for early containment fail-ure accident progression bins. A substantial frac-tion of the early failures result in subsequentbypass of the ice bed. In particular, if the contain-ment ruptures as the result of a sudden, high-pressure load, such as from hydrogen deflagra-tion, the damage to the containment wall could beextensive and is likely to result in bypass.

In most accident sequences for Sequoyah, there issubstantial water in the cavity that can either pre-vent core-concrete attack, if a coolable debris bedis formed, or mitigate the release of radionuclidesduring core-concrete attack by scrubbing in theoverlaying water pool. As a result, a large releaseto the environment of the less volatile radionu-clides that are released from fuel during core-concrete attack is unlikely for the Sequoyah plant.

In the station blackout plant damage state, con-tainment failure can occur late in the accident asthe result of hydrogen combustion following power.recovery. Figure 5.7 illustrates the source termsfor a late containment failure accident progressionbin in which it is unlikely that water would beavailable to scrub the core-concrete releases. Inthis case, decontamination by the ice bed is im-portant in mitigating the environmental release.As discussed previously, for very wide ranges ofuncertainty covering many orders of magnitude,one or more high results can dominate the meansuch that it falls above the 95th percentile.


1. Ice Condenser

In addition to condensing steam, the ice bedscan trap radioactive aerosols and vapors in asevere accident. The extent of decontamina-tion is very sensitive to the volume fraction ofsteam in the flowing gas, which in turn de-pends on whether the air-return fans are op-erational. For a single pass through the icecondenser with high steam fraction, therange of decontamination factor used in thisstudy was from 1.3 to 35 with a median of 7for the in-vessel release and less than half aseffective for the core-concrete release. Forthe low steam fraction scenarios with a singlepass through the ice beds, the lower boundwas approximately 1.1, the upper bound 8,and the median 2. The values used for multi-ple passes through the ice bed when the con-tainment is intact and the air-return fans arerunning are only slightly larger, with a me-dian value of 3. Thus, the credit for ice bedretention is substantially less than the valuesused for the decontamination effectiveness ofsuppression pools in the BWRs.


The Sequoyah reactor cavity will be floodedif there is sufficient water on the containmentfloor to overflow into the cavity. If the con-tents of the refueling water storage tank are

NUREG-1 150 5-12

1 .O

E+O

O

1.O

E-O

1

1.O

E-0

2

Rel

ease

Fra

ctio

n

95%

mea

n

med

ian

6%

up w

-1

1.O

E-0

3

1.O

E-0

4

1.O

E-0

5P

AM

---

--

--

...

NG

I C

sZI (-

I�d M O I

Te

Sr

Ru

La

Ba

Ce

Rad

ionu

clid

e G

roup

<A (n D 0 0c3e

Figu

re 5

.6

Sour

ce t

erm

dis

trib

utio

ns

for

earl

y co

ntai

nmen

t fa

ilure

at

Sequ

oyah

.

z Csz Mo

Rel

ease

Fra

ctio

n1.

OE

.O0

1.O

E-0

1

1.E

-02

1.O

E-0

3

1.O

E-0

4

1.O

E-0

5

ED

CD

0 r_

-m

ean

med

ian

5%

M2

M

NG

I C

sTe

S

r R

u La

B

a C

e

Rad

ionu

clid

e G

roup

Fig

ure

5.7

Sou

rce

term

dis

trib

utio

ns f

or l

ate

cont

ainm

ent

fail

ure

at S

equo

yah.


discharged into the containment (e.g., by thespray system) and there is substantial icemelting, the water level in the cavity can beas high as 40 feet, extending to the level ofthe reactor coolant system hot legs. A decon-tamination factor for the deep water pool wasused in the analyses, which ranged from ap-proximately 4 to 9,000 with a median valueof approximately 10 for the less volatileradionuclides released ex-vessel. If neithersource of water to the containment is avail-able, however, there will be no water in thecavity.

3. Spray System

The Sequoyah containment has a spray sys-tem in the upper compartment to condensesteam that bypasses the ice beds and for useafter the ice has melted. As in the Surryplant, the spray system has the potential todramatically reduce the airborne concentra-tion of radioactive material if the contain-ment remains intact for an extended periodof time.


Figure 5.8 displays the frequency distributions inthe form of graphical plots of the complementarycumulative distribution functions (CCDFs) of fouroffsite consequence measures-early fatalities, la-tent cancer fatalities, and the 50-mile and entiresite region population exposures (in person-rems).These CCDFs include contributions from allsource terms associated with reactor accidentscaused by internal initiating events. Four CCDFs,namely, the 5th percentile, 50th percentile (me-dian), 95th percentile, and the mean CCDFs, areshown for each consequence measure.

Sequoyah plant-specific and site-specific parame-ters were used in the consequence analysis forthese CCDFs. The plant-specific parameters in-cluded source terms and their frequencies, the li-censed thermal power (3423 MWt) of the reactor,and the appropriate physical dimensions of thepower plant building complex. The site-specificparameters included exclusion area radius (585meters), meteorological data for 1 full year col-lected at the site meteorological tower, the site re-gion population distribution based on the 1980census data, topography (fraction of the area thatis land-the remaining fraction is assumed to bewater), land use, agricultural practice and produc-tivity, and other economic data for up to 1,000miles from the Sequoyah plant.


The population density within the Sequoyah10-mile EPZ is about 120 persons per squaremile. The average delay time before evacuation(after a warning prior to radionuclide release)from the 10-mile EPZ and average effectiveevacuation speed used in the analyses were de-rived from information contained in a utility-sponsored Sequoyah evacuation time estimatestudy (Ref. 5.5) and the NRC requirements foremergency planning.

The results displayed in Figure 5.8 are discussedin Chapter 11.



A detailed description of the results of the Se-quoyah risk is provided in Reference 5.2. For thissummary report, results are provided for the fol-lowing measures of public risk:

* Early fatality risk,




* Individual early fatality risk in the populationwithin 1 mile of the Sequoyah boundary, and

* Individual latent cancer fatality risk in thepopulation within 10 miles of the Sequoyahsite.


The results of Sequoyah risk analysis using theabove measures are shown in Figures 5.9 through5.11. The figures display the variabilities in meanrisks estimated from the meteorology-averagedmean values of the consequence measures. The

5-15 NUREG-1 150

z Q 0

ZIn

to

1

,In iTo

1-x

1.

C D1.

a 0 C x1to

CD

0 x Lii

11

co0 0 0CO

c 0 ci a 0U-

*D

0U_

to CD

4C w

ce co 0 C 0 1- ce 0 0,

Early F

ata

litie

sLate

nt

Cancer

Fata

litie

s

1.O

E-0

31.

OE

-03

co 0 > .O

E-0

4

9 t.O

E-0

6T jD a

1.0E

-0O

-t.O

E-0

7

D

1.O

E-0

8'a 0

1.

0E-0

9

ul

OF

- n

;- --

----

- --

-.

.. ..

.

:-

mea

n^--

i-~~

-

-.

.,t

hs

a~

~~

~ \

:---

~~~\

\\\

.~

~~~ ~

__4

...

_

>~ 1.

OE

- 04

I * 1

.0E

-05

2 CD

t.OE

-08

0 D 1

.06-

06

0 :, 1.

0E-0

7

U- W

.06-

08C

:co 0 C

)'IJ

Mea

n

ooth

, -

,h

, .....

d

.....

.....

....

....

,.

S

............

._

_ -

--l-

.

...-

__

...-

O.6

E.00

1.

oE60

2 t.O

E-0

4 1o

E.0

60

1,.

0.0

8P

opula

tion D

ose

(pers

on-r

em

) to

-5

0 M

iles

1.0

6.0

0

tOE

-02

.OE

-04

CoE

0.

1o.4

08

Po

pu

latlo

n D

ose

(pers

on-r

em

) to

-E

ntir

e R

egio

n

Not

e:

As

disc

usse

d in

Ref

eren

ce

5.3,

est

imat

ed c

onse

quen

ces

at f

requ

enci

es

at o

r be

low

1E

-7 p

er r

eact

or y

ear

shou

ld b

e vi

ewed

beca

use

of t

he p

oten

tial

impa

ct o

f ev

ents

not

stu

died

in

the

risk

ana

lyse

s.w

ith c

autio

n

Figu

re

5.8

Freq

uenc

y di

stri

butio

ns o

f of

fsite

con

sequ

ence

mea

sure

s at

Seq

uoya

h (i

nter

nal

initi

ator

s).


-a

04)

101C4

,10

IN

g9ih.

10-a.

f:N

M -a10

14 13

-

a


Key: M =m =th =


95t-h .

&



Figure 5.9 Early and latent cancer fatality risks at Sequoyah (internal initiators).

5-17 NUREG-1 150


0o

05:

"-4

.4 1

'4 10

0

a,

010

10

41

10

0

0

00

951..h -

5t"



95Lh,

*1



Figure 5.10 Population dose risks at Sequoyah (internal initiators).

NUREG-1150 5-18


10F1

i-

10

10F

pa

'-4

10'

C

W10O

.- Safety Goal

95ih b

4


Key: M =m =th =


-. Safety Goal

95th ,

M .

5th.,


Note: As discussed in Reference 5.3, estimated risks at or below 1-7 per reactor year should be viewedwith caution because of the potential impact of events not studied in the risk analyses.

Figure 5.11 Individual early and latent cancer fatality risks at Sequoyah (internal initiators).

5-19 NUREG-1 150


early and latent cancer fatality risks, while quitelow in absolute value, are higher than those fromthe Surry plant analysis (see Chapter 3). Otherrisk measure estimates are slightly higher than theSurry estimates. The individual early fatality andlatent cancer fatality risks are well below the NRCsafety goals. Detailed comparisons of results areprovided in Chapter 12.

The risk results shown in Figure 5.9 have beenanalyzed to identify the relative contributions tomean risk of plant damage states and accidentprogression bins. These results are presented inFigures 5.12 and 5.13. As may be seen, the domi-nant contributor of early fatality risk is the bypassaccident group, and particularly the interfacing-system LOCA (the V sequence), whereas the larg-est contributions to the latent cancer fatality riskcame from the station blackout and bypass acci-dent groups. For early fatality risk, the dominantcontributor to risk is from accident sequenceswhere the containment is bypassed, whereas, forlatent cancer fatality risk, major accident progres-sion bin contributors are bypass accidents andearly containment failures. The accident progres-sion bin involving accidents with no vessel breachappears as a contributor to early and latent cancerfatality risks. This bin possesses risk potential be-cause of early containment failure due to hydro-gen events from loss of offsite power in which acpower is recovered and breach is arrested and alsofrom accidents involving steam generator tuberupture in which vessel breach is arrested.


Sequoyah risk analysis indicates that bypass se-quences dominate early fatality risk. Timing is akey factor in this sequence in relation to evacu-ation. The release characteristics also contributeto the large effect of early fatalities because of thelarge magnitude of unmitigated source terms andthe low energy of the first release. The low energyplume is not lofted over the evacuees but is heldlow to the ground after release. Another class ofaccidents that is important to early fatality risk isstation blackout. It is the early containment fail-ure (that is, failure of containment at and beforevessel breach) associated with this accident classthat contributes to early fatality risk.

An interfacing-system LOCA at Sequoyah will dis-charge into the auxiliary building where decon-tamination by automatically activated fire sprays islikely. Neither the probability of actuation nor thedecontamination factor has been well established.The effects of an interfacing-system LOCA couldeither be higher or lower than those that havebeen calculated in this study.

Approximately equal contributions to latent can-cer fatality risk come from station blackout andbypass. The bypass sequences contribute becauseof the large source terms and the bypass of anymitigating systems. The only other major contribu-tion to latent cancer fatality comes from theLOCA sequences, mainly due to containment fail-ures at vessel breach with high (> 200 psia) reac-tor coolant system pressure.

NUREGi-1150 5-20


SEQUOYAH EARLY FATALITY SEQUOYAH LATENT CANCER FATALITY-

MEAN * 2.4E-G/RY MEAN * 1.4E-2/RY

2

4

55Plant Damage States

I.t T

S. TRANSIENT*4. LOCA6. YPAS8

Figure 5.12 Major contributors (plant damage states) to mean early and latent cancerfatality risks at Sequoyah (internal initiators).

SEQUOYAf EARLY FATALITY SEQUOYAH LATENT CANCER FATALITY

MEAN 2.GE-81HY MEAN * t.4E-2RY

A

Accident Progression Bins 7t VB, CF o VD2. V. ECF. Alpho ModeS. V. ECF. CS Presurev20 po at VD4. VS. ECF. RCS Pteuuet2* pe t V06. V. Lt CFS. VS. DVT. Very Lat Lak7. NypaoCI V. No CPS. No VD

9

9

Figure 5.13 Major contributors (accident progression bins) to mean early and latentcancer fatality risks at Sequoyah (internal initiators).

5-21 51NUREG-1150



5.1 R. C. Bertucio and S. R. Brown, "Analysisof Core Damage Frequency: Sequoyah Unit1," Sandia National Laboratories, NUREG/CR-4550, Vol. 5, Revision 1, SAND86-2084, April 1990.

5.2 J. J. Gregory et al., "Evaluation of SevereAccident Risks: Sequoyah Unit 1," SandiaNational Laboratories, NUREG/CR-4551,Vol. 5, Revision 1, SAND86-1309, Decem-ber 1990.


5.4 T. A. Wheeler et al., "Analysis of CoreDamage Frequency from Internal Events:Expert Judgment Elicitation," Sandia Na-tional Laboratories, NUREG/CR-4550, Vol.2, SAND86-2084, April 1989.

5.5 Tennessee Department of Transportation,"Evacuation Time Estimates with the PlumeExposure Pathway Emergency PlanningZone," prepared for Sequoyah NuclearPlant, June 1987.

5.6 USNRC, "Safety Goals for the Operation ofNuclear Power Plants; Policy Statement,"Federal Register, Vol. 51, p. 30028,August 21, 1986.

NUREG-1 150 5-22

6. GRAND GULF PLANT RESULTS


The Grand Gulf Nuclear Station is a GeneralElectric boiling water reactor (BWR-6) unit of1250 MWe capacity housed in a Mark III con-tainment. Grand Gulf Unit 1, constructed by Be-chtel Corporation, began commercial operation inJuly 1985 and is operated by Entergy Operations.Some important design features of the Grand Gulfplant are described in Table 6.1. A general plantschematic is provided in Figure 6.1.




The core damage frequency and risk analyses per-formed for this study considered accidents initi-ated only by internal events (Ref. 6.1). The coredamage frequency results obtained are providedin tabular form in Table 6.2 and in graphicalform, displayed as a histogram, in Figure 6.2.(Section 2.2.2 discusses histogram development.)This study calculated a total median core damagefrequency from internal events of 1.2E-6 peryear.

The Grand Gulf plant was previously analyzed inthe Reactor Safety Study Methodology Applica-tions Program (RSSMAP) (Ref. 6.3). A point es-timate core damage frequency of 3.6E-5 from in-ternal events was calculated in that study. A pointestimate core damage frequency of 2.1E-6 wascalculated in this analysis for purposes of compari-son. A point estimate is calculated from the sumof all the cut-set frequencies, where each of thecut-set frequencies is the product of the point esti-mates (usually means) of the events in the cutsets.


A detailed description of accident sequences im-portant at the Grand Gulf plant is provided in Ref-erence 6.1. For this report, the accident se-quences described in that reference have been di-

vided into two summary plant damage states.These are:

* Station blackout, and

* Anticipated transients without scram(ATWS).

The relative contributions of these groups to meaninternal-event core damage frequency at GrandGulf are shown in Figure 6.3. It may be seen thatstation blackout accident sequences as a class arethe largest contributors to core damage frequency.It should be noted that the plant configuration asanalyzed does not reflect the implementation ofthe station blackout rule.


* Loss of offsite power occurs followed by thesuccessful cycling of the safety relief valves(SRVs). Onsite ac power fails because allthree diesel generators fail to start and run asa result of either hardware or common-causefaults. The loss of all ac power (i.e., stationblackout) results in the loss of all core coolingsystems (except for the reactor core isolationcooling (RCIC) system) and all containmentheat removal systems. The RCIC system,which is ac independent, independently failsto start and run. All core cooling is lost, andcore damage occurs in approximately hourafter offsite power is lost.

* Station blackout accident that is similar to theone described above except that one SRVfails to reclose and sticks open. Core damageoccurs in approximately 1 hour after offsitepower is lost.

In addition to these two short-term accident sce-narios, this study also considered long-term sta-tion blackout accidents. In these accidents, loss ofoffsite power occurs and all three diesel genera-tors fail to start or run. The safety relief valvescycle successfully and RCIC starts and maintainsproper coolant level within the reactor vessel.However, ac power is not restored in these long-term scenarios, and RCIC eventually fails becauseof high turbine exhaust pressure, battery deple-tion, or other long-term effects. Core damage oc-curs approximately 12 hours after offsite power islost.

6-1 NUREG-1 150

6. Grand Gulf Plant Results

Table 6.1 Summary of design features: Grand Gulf Unit 1.

1. Coolant Injection Systems a. High-pressure core spray (HPCS) system provides coolantto reactor vessel during accidents in which system pressureremains high or low, with 1 train and 1 MDP.*

b. Reactor core isolation cooling system provides coolant tothe reactor vessel during accidents in which system pres-sure remains high, with 1 train and 1 TDP. *

c. Low-pressure core spray system provides coolant to thereactor vessel during accidents in which vessel pressure islow, with 1 train and 1 MDP.*

d. Low-pressure coolant injection system provides coolant tothe reactor vessel during accidents in which vessel pressureis low, with 3 trains and 3 pumps.

e. Standby service water crosstie system provides coolantmakeup source to the reactor vessel during accidents inwhich normal sources of emergency injection have failed,with I train and pump (for crosstie).

f. Firewater system is used as a last resort source of low-pressure coolant injection to the reactor vessel, with 3trains, 1 MDP, * 2 diesel-driven pumps.

g. Control rod drive system provides backup source of high-pressure injection, with 2 pumps/238 gpm (total)/1103psia.

h. Automatic depressurization system (ADS) depressurizes thereactor vessel to a pressure at which the low-pressure in-jection systems can inject coolant to the reactor vessel,with 8 relief valves/capacity of 900,000 lb/hr. In addition,there are 12 non-ADS relief valves.

i. Condensate system used as a backup injection source.

2. Heat Removal Systems a. Residual heat removal/suppression pool cooling systemremoves decay heat from the suppression pool duringaccidents, with 2 trains and 2 pumps.

b. Residual heat removal/shutdown cooling system removesdecay heat during accidents in which reactor vessel integ-rity is maintained and reactor is at low pressure, with 2trains and 2 pumps.

c. Residual heat removal/containment spray system suppressespressure in the containment during accidents, with 2 trainsand 2 pumps.

3. Reactivity Control Systems a. Control rods.b. Standby liquid control system, with 2 parallel positive dis-

placement pumps rated at 43 gpm per pump.

*TDP -Turbine-Driven PumpMDP - Motor-Driven Pump

NUREG- 1150 6-2


Table 6.1 (Continued)

4. Key Support Systems a. dc power with 12-hour station batteries.b. Emergency ac power, with 2 diesel generators and third

diesel generator dedicated to HPCS but with crossties.

c. Suppression pool makeup system provides water from theupper containment pool to the suppression pool following aLOCA.

d. Standby service water provides cooling water to safety sys-tems and components.

5. Containment Structure a. BWR Mark III.b. 1.67 million cubic feet.c. 15 psig design pressure.

6. Containment Systems a. Containment venting is used when suppression pool coolingand containment sprays have failed to reduce primary con-tainment pressure.

b. Hydrogen igniter system prevents the buildup of largequantities of hydrogen inside the containment during acci-dent conditions.

Within the general class of ATWS accidents, themost probable combination of failures leading tocore damage is:

* Transient initiating event occurs followed by afailure to trip the reactor because of mechani-cal faults in the reactor protection system(RPS). The standby liquid control system(SLCS) is not actuated and the high-pressurecore spray (HPCS) system fails to start andrun because of random hardware faults. Thereactor is not depressurized and therefore thelow-pressure core cooling system cannot in-ject. All core cooling is lost; core damage oc-curs in approximately 20 to 30 minutes afterthe transient initiating event occurs.


Characteristics of the Grand Gulf plant design andoperation that have been found to be important inthe analysis of core damage frequency include:

1. Firewater System as Source of CoolantMakeup

The firewater system as a core coolant injec-tion system can be used as a backup (last re-

sort) source of low-pressure coolant injectionto the reactor vessel. The system has two die-sel-driven pumps, making it operational understation. blackout conditions as long as dcpower is available. The potential use of thissystem is estimated to reduce the total coredamage frequency by approximately a factorof 1.5.

The reason for the relatively small impact onthe total core damage frequency is twofold.The firewater system is a low-pressure system;the reactor pressure must be maintained be-low approximately 125 psia for firewater to beable to inject. If an accident occurs in whichcore cooling is immediately lost, the core be-comes uncovered in less time than that re-quired to align and activate the firewater sys-tem. If core cooling is provided and then lostin the long term (e.g., at approximatelygreater than 4 hours after the start of the acci-dent), firewater can provide sufficientmakeup to prevent core damage. However,the dominant sequences at Grand Gulf are ac-cidents where core cooling is lost immediately.

6-3 NUREG- 1150

z c) ~I UN

C>

Ax.

ldg.

R

oof

W 0 CD

(e Io

CSS

Dso

hrg

e V

lys

I4(O

ne

Tai

n Sh

own)

I >A

Iq

1-

Pu

p

*T

ypio

al

arr

an

gem

en

t

Figu

re 6

.1

Gra

nd G

ulf

plan

t sc

hem

atic

.


Table 6.2 Summary of core damage frequency results: Grand Gulf.*

5% Median Mean 95%

Internal Events 1.7E-7 1.2E-6 4.OE-6 1.2E-5

ATWS 8.5E-10 1.9E-8 1.1E-7 5.1E-7Station Blackout 1.3E-7 1.1E-6 3.9E-6 1.1E-5

*As discussed in Reference 6.4, core damage frequencies below IE-5 per reactor year should beviewed with caution because of the remaining uncertainties in PRA (e.g., events not considered).

Core1.OE-04 C

Damage Frequency (per RY)

1.OE-05

1.OE-06

1..OE-07

1.OE-08

95th -

MeanL-

Median -

5th -

Number of LG samples

Note: As discussed in Reference 6.4, core damage frequencies below E-5 per reac-tor year should be viewed with caution because of the remaining uncertaintiesin PRA (e.g., events not considered).

Figure 6.2 Internal core damage frequency results at Grand Gulf.

6-5 NUREG-1 150


Station Blackout

ATWS

Total Mean Core Damage Frequency: 4E-6

Figure 6.3 Contributors to mean core damage frequency from internal events at Grand Gulf.

2. High-Pressure Core Spray (HPCS) System

The HPCS system consists of a single trainwith motor-operated valves and a motor-driven pump and provides coolant to the reac-tor vessel during accidents in which pressure iseither high or low. The bearings and seals ofthe HPCS pump are cooled by the pumpedfluid. If the temperature of this water exceedsdesign limits, the potential exists for the HPCSpump to fail. The bearings are designed to op-erate for no more than 24 hours at a tempera-ture of 350'F. The peak temperatureachieved in any of the accidents analyzed isapproximately 3250F. Even if the seals wereto experience some leakage, the resultantHPCS room environment would not adverselyaffect the operability of the pump. The avail-ability of an HPCS system with such designcharacteristics is estimated to reduce the coredamage frequency by approximately a factorof 7. The HPCS is powered by a dedicateddiesel generator when required so that thissystem is truly an independent system.

3.. Capability of Pumps to Operate withSaturated Water

The emergency core cooling pumps that de-pend on the pressure-suppression pool as theirwater source during accident conditions havebeen designed to pump saturated water. Thus,if the pool becomes saturated because of con-tainment venting or containment failure, thecore cooling systems are not lost but can con-tinue to cool the reactor core.

4. Redundancy and Diversity of Water Sup-ply Systems

At Grand Gulf, there are many redundantand diverse systems to provide water to thereactor vessel. They include:

HPCS with 1 pump;

Reactor core isolation cooling (RCIC) with 1pump;

Control rod drive (CRD) with 2 pumps (bothare required for core cooling);

NUREG-1 150 6-6


Condensate with 3 pumps;

Low-pressure core spray (LPCS) with 1pump;

Low-pressure coolant injection (LPCJ) with 3pumps;

Standby service water (SSW) crosstie with 1pump; and

Firewater system with 3 pumps.

Because of the redundancy of systems forLOCAs and transients, core cooling loss as aresult of independent random failures is oflow probability. However, in a station black-out, except for RCIC and firewater, the corecooling systems are lost with a probability ofunity because they require ac power.

5. Redundancy and Diversity of HeatRemoval Systems

At Grand Gulf there are several diversemeans for heat removal. These systems are:

Main steam/feedwater system with 3 trains;

Suppression pool cooling mode of residualheat removal (RHR) with 2 trains;

Shutdown cooling mode of RHR with 2 trains;

Containment spray system mode of RHR with2 trains; and

Containment venting with 1 train.

Although the various modes of RHR havecommon equipment (e.g., pumps), there isstill enough redundancy and diversity that, fornon-station-blackout accidents, independentrandom failures again are small contributorsto the core damage frequency.

6. Automatic and Manual DepressurizationSystem

The automatic depressurization system (ADS)is designed to depressurize the reactor vesselto a pressure at which the low-pressure injec-tion systems can inject coolant to the reactorvessel. The ADS consists of eight safety reliefvalves capable of being manually opened. Theoperator may manually initiate the ADS ormay depressurize the reactor vessel, using the12 relief valves that are not connected to theADS logic. The ADS valves are located insidethe containment.


The emergency operating procedures (EOPs) atGrand Gulf direct the operator to perform certainactions depending on the plant conditions orsymptoms (e.g., reactor vessel level below the topof active fuel). Different accident sequences canhave similar symptoms and therefore the same"recovery" actions. Operator actions that are im-portant include the following:

* Actuate core cooling

In an accident where feedwater is lost (whichincludes condensate), the reactor water levelstarts to decrease. When Level 2 (-41.6inches) is reached, high-pressure core spray(HPCS) and reactor core isolation cooling(RCIC) should be automatically actuated. IfLevel 1 (-150.3 inches) is reached, the ADSshould occur with automatic actuation of thelow-pressure core spray (LPCS) and low-pressure coolant injection (LPCI). If the reac-tor level sensors are miscalibrated, these sys-tems will not automatically actuate. The op-erator has many other indications to deter-mine both the reactor water level and the factthat core coolant makeup is not occurring.Manual actuation of these systems is requiredif such failures occur in order to prevent coredamage.

* Establish containment heat removal

Besides core cooling, the operator must alsoestablish containment heat removal (CHR). Ifan accident occurs, the EOPs direct the op-erator to initiate the suppression pool coolingmode of RHR when the suppression tempera-ture reaches 950F. The operator closes theLPCI valves and the heat exchanger bypassvalves and opens the suppression pool dis-charge valves. He also ensures that the properservice water system train is operating. Withsuppression pool cooling (SPC) functioning,CHR is being performed. If system faults pre-clude the use of SPC, the operator has othermeans to provide CHR. He can actuate othermodes of RHR such as shutdown cooling orcontainment spray, or the operator can ventthe containment to remove the energy.

* Establish room cooling through natural circu-lation

The heating, ventilating, and air conditioning(HVAC) system provides room cooling sup-port to a variety of systems. If HVAC is lost,design limits can be exceeded and equipment

6-7 NUREG-1 150


(i.e., pumps) can fail. If these conditions oc-cur, the operator can open doors to certainrooms and establish a natural circulation/ven-tilation that prevents the room temperaturefrom exceeding the design limits of the equip-ment.

For station blackout accidents, there are certainactions that can be performed by the operatingcrew as follows:

* Crosstie division 1 or 2 loads to HPCS dieselgenerator

In a station blackout where the HPCS dieselgenerator is available, the operator canchoose to crosstie this diesel to one of theother divisions. The operator might choosethis option when (1) the HPCS system failsand core cooling is required, or (2) in thelong term (e.g., longer than 8 hours) contain-ment heat removal is required to prevent con-tainment failure. If the operator chooses tocrosstie, the operator must shed all the loadsfrom the HPCS diesel and then open andclose certain breakers. He can then load cer-tain systems from either division I or from di-vision 2.

* Align firewater

In an accident, particularly station blackout,where core cooling was initially available (forapproximately 4 hours) and then lost, thefirewater system can provide adequate corecooling. The operator must align the firewaterhoses to the proper injection lines (describedin the procedure) and then open the injectionvalves.

* Depressurize reactor via RCIC steam line

In a station blackout, the diesel generatorshave failed and only dc power is available (incertain sequences). If core cooling is beingprovided with firewater, then the reactormust remain at low pressure, which requiresthat at least one safety relief valve (SRV) mustremain open. For the SRV to remain open,dc power is required. However, without thediesel generator recharging the battery, thebattery will eventually deplete, the SRV willclose, and the reactor will repressurize, whichcauses the loss of the firewater. The operatorcan maintain the reactor pressure low byopening the valves on the RCIC steam line.This provides a vent path from the reactor tothe suppression pool.

* Recovering ac power

Station blackout is caused by the loss of all acpower, both offsite and onsite power. Restor-ing offsite power or repairing the diesel gen-erators was included in the analysis. Thequantification of these human failure eventswas derived from historical data (i.e., actualtime required to perform these repairs) andnot by performing human reliability analysison these events.

Transients where reactor trip does not occur (i.e.,ATWS) involve accident sequences where thephenomena are more complex. The operator ac-tions were evaluated in more detail (Ref. 6.5)than for the regular transient-initiated accident.These actions include the following:

* Manual scram

A transient occurs that demands the reactorto be tripped, but the reactor protection sys-tem (RPS) fails because of electrical faults.The operator can then manually trip the reac-tor by first rotating the collar on proper scrambuttons and then depressing the buttons, orhe can put the reactor mode switch in the"shutdown" position.

* Insert rods manually

If the electrical faults fail both the RPS andthe manual trip, the operator can manually in-sert the control rods one a time.

* Actuate standby liquid control (SLC) system

With the reactor not tripped, reactor powerremains high; the reactor core is not at decayheat levels. This can present problems sincethe containment heat removal systems areonly designed to decay heat removal capacity.However, the SLC system (manually actu-ated) injects sodium pentaborate that reducesreactor power to decay heat levels. The EOPsdirect the operator to actuate SLC if the reac-tor power is above 4 percent and before thesuppression pool temperature reaches 1101F.The operator obtains the SLC keys (one perpump) from the shift supervisor's desk, insertsthe keys into the switches, and turns both tothe "on" position.

* Inhibit automatic depressurization system(ADS)

In an ATWS condition, the operator is di-rected to inhibit the ADS if he has actuated

NUREG-l 150 6-8


SLC. The operator must put both ADSswitches (key locked) in the inhibit mode.

* Manually depressurize reactor

If HPCS fails, inadequate high-pressure corecooling occurs. When Level 1 is reached,ADS will not occur because the ADS wasinhibited, and the operator must manuallydepressurize so that low-pressure core coolingcan inject. The operator can either press theADS button (which overrides the inhibit) ormanually open one SRV at a time.


As discussed in Chapter 2, the process of develop-ing a probabilistic model of a nuclear power plantinvolves the combination of many individualevents (initiators, hardware failures, operator er-rors, etc.) into accident sequences and eventuallyinto an estimate of the total frequency of coredamage. After development, such a model canalso be used to assess the importance of the indi-vidual events. The detailed studies underlying thisreport have been analyzed using several event im-portance measures. The results of the analyses us-ing two measures, "risk reduction" and "uncer-tainty" importance, are summarized below.

0 Risk (core damage frequency) reduction im-portance measure (internal events)

The risk-reduction importance measure isused to assess the change in core damage fre-quency as a result of setting the probability ofan individual event to zero. Using this meas-ure, the following individual events werefound to cause the greatest reduction in coredamage frequency if their probabilities wereset to zero.


- Failure to restore offsite power in 1hour. The core damage frequency wouldbe reduced by approximately 70 per-cent.

- Failure of the RCIC turbine-drivenpump to run. The core damage fre-quency would be reduced by approxi-mately 48 percent.

- Failure to repair hardware faults of die-sel generator in 1 hour. The core dam-age frequency would be reduced by ap-proximately 46 percent.

- Failure of a diesel generator to start.The core damage frequency would bereduced by approximately 23 to 32 per-cent, depending on the diesel generator.

- Common-cause failure of the vital bat-teries. The core damage frequencywould be reduced by approximately 20percent.

s Uncertainty importance measure (internalevents)

A second importance measure used to evalu-ate the core damage frequency analysis resultsis the uncertainty importance measure. Forthis measure, the relative contribution of theuncertainty of individual events to the uncer-tainty in total core damage frequency is calcu-lated. Using this measure, the following eventswere found to be most important:

- Loss of offsite power;

- Failure of the diesel generators to run,given start;

- Individual and common-cause failure ofthe diesel generators to start;

- Standby service water motor-operatedvalves (MOVs) fail to open; and

- High-pressure core spray and RCICMOVs fail to function.



The Grand Gulf pressure-suppression contain-ment design is of the Mark III type in which thereactor vessel, reactor coolant circulating loops,and other branch connections to the reactor cool-ant system are housed within the drywell struc-ture. The drywell structure in turn is completelycontained within an outer containment structurewith the two volumes communicating through thewater-filled vapor suppression pool. The outercontainment building is a steel-lined reinforcedconcrete structure with a volume of 1.67 millioncubic feet that is designed for a peak pressure of15 psig resulting from a reactor coolant system

6-9 NUREG-1150

6; Grand Gulf Plant Results

loss-of-coolant accident. For this same design ba-sis accident, the inner concrete drywell structureis designed for a peak pressure of 30 psig. Themean failure pressure for Grand Gulf's contain-ment structure has been estimated to be 55 psig.This estimated containment failure pressure forGrand Gulf is much lower than the Peach BottomMark I estimated failure pressure of 148 psig;however, Grand Gulf's free volume is severaltimes larger. The availability of Grand Gulf's largevolume removed the design basis need to inert thecontainment against failure from hydrogen com-bustion following design basis accidents; however,subsequent severe accident considerations afterthe TMI accident resulted in the installation ofhydrogen igniters. For the severe accident se-quences developed in this analysis, hydrogen com-bustion remains the major threat to Grand Gulf'scontainment integrity (in the station blackout ac-cidents dominating the frequency of core damage,igniters are not operable). Similar to other con-tainment design analyses, the estimate of whereand when Grand Gulf's containment system willfail relied heavily on the use of expert judgment tointerpret the limited data available.

The potential for early containment and/ordrywell failure for Grand Gulf as compared toPeach Bottom's Mark I suppression-type contain-ment involves significantly different considera-tions. Of particular significance with regard to thepotential for large radioactive releases from GrandGulf is the prediction of the combined probabili-ties of simultaneous early containment and drywellfailures, which in turn produce a direct radioac-tive release path to the environment. The resultsof these analyses for Grand Gulf are shown in Fig-ures 6.4 and 6.5. Figure 6.4 displays informationin which the eight conditional probabilities of con-tainment-related accident progression bins; e.g.,VB-early CF-no SPB, are presented for each offour plant damage states, e.g., ATWS. This infor-mation indicates that, on a- plant damage state fre-quency-weighted average* for internally initiatedevents, there are mean conditional probabilities of(1) 0.23 that the integrity of the drywell and theouter containment will be sufficiently affected thatsubstantial bypass of the suppression pool will oc-cur; (2) 0.24 for early containment failure with nobypass of the suppression pool pathway from thedrywell; (3) 0.12 for late containment failure withpool bypass; (4) 0.23 for late containment failure

'Each value in the column in Figure 6.4 labeled "All" is afrequency-weighted average obtained by summing theproducts of individual accident progression bin condi-tional probabilities for each plant damage state and theratio of the frequency of that plant damage state to thetotal core damage frequency.

but no pool bypass; and (5) 0.09 for no contain-ment failure.

Further examination of these data, broken downon the basis of the timing of reactor vessel breachand the nature of the containment threat, indi-cate: (1) prior to reactor vessel breach, hydrogencombustion and slow steam overpressurization ef-fects lead to frequency-weighted mean conditionalprobabilities of containment failure of 0.20 and0.05, respectively; (2) at reactor vessel breach,hydrogen combustion effects lead to a 0.24 condi-.tional mean probability of containment failure;(3) prior to reactor vessel breach, hydrogen com-bustion effects lead to 0.12 conditional meanprobability of drywell failure; (4) at reactor vesselbreach, steam explosion and direct containmentheating effects can lead to pedestal failures and a0.16 conditional mean probability of drywell fail-ure from both pedestal and overpressure effects;and (5) dynamic loads from hydrogen detonationshave a small effect on the structural integrity ofeither the containment or the drywell.

Figure 6.5 further displays plots of Grand Gulf'sconditional probability distribution for each plantdamage state, thereby providing the estimatedrange of uncertainties in the outer containmentfailure predictions. The important conclusionsthat can be drawn from the information are (1)there is a relatively high mean conditional prob-ability of early containment failure with a large by-pass of the suppression pool's scrubbing effects,i.e., 0.23; (2) there is a high mean probability ofearly containment failure, i.e., 0.48; and (3) theprincipal threat to the combined efficacy of theMark III containment and drywell is hydrogencombustion effects.

Additional discussions on containment perform-ance (for all studied plants) are provided in Chap-ter 9.


Characteristics of the Grand Gulf design and op-eration that are important during core damage ac-cidents include:

1. Drywell-Wetwell Configuration

With the reactor vessel located inside thedrywell, which in turn is completely sur-rounded by the outer containment building,there needs to be a combination of failures inboth structures to provide a direct releasepath to the environment that bypasses thesuppression pool, e.g., hydrogen combustion

NUREG-1 150 6-10


SUMMARYACCIDENTPROGRESSIONBIN GROUP

SUMMARY PDS GROUP(Mean Core Damage Frequency)

STSB LTSB ATWS(3.a5E-06) (1.04E-07) (1.12E-07)

Transients All(1.87E-08) (4.09E-06)

VB, early CF,early SPB. no CS

VB. early CF.early SPB. CS

VB, early CF,late SPB

VB, early CF,no SPB

VB, late CF

VB, venting

VB, No CF

No VB

0.166 0.292 0.006 j 0.011 0.158

0.031 0.017 ] 0.237 ] 0.202 0.049

0.006 0.005 0.003 0.003 0.007

] 0.182 5 3; [ 0.331 0.218

1 0.308 l 0.129 0.074 0.232 0.284

0.032 0.003 0.109 0,075 II0.038I0.053 0.003 A 0.036 0.092 0.050

n 0.201 j0.015 0.025 0.050 n0.180

CF = Containment FailureCS = Containment SpraysCV = Containment VentingSPB = Suppression Pool BypassVB = Vessel Breach

Figure 6.4 Conditional probability of accident progression bins at Grand Gulf.

impairing the function of both the drywell andcontainment.

2. Containment Volume

The Grand Gulf containment volume is muchlarger than that of a Mark I containment andas such can accommodate significant quanti-

ties of noncombustible gases before failureeven though its estimated failure pressure isless than half that of a Mark I containment.Its low design pressure, however, makes it sus-ceptible to failure from hydrogen combustioneffects in those cases where the igniters arenot working.

6-11 NUREG-1 150


-p

1.EO

w

.E-is 0

0.4

i.E-2.

95tb,,

5th,

M = meanm = medianth = percentile

-I

PDS GroupCore Damage Freq.

STSB LTSB ATWS Transients All3.9E-06 i.OE-07 I.JE-07 1.9E-08 4.1E-06

Figure 6.5 Conditional probability distributions for early containment failure at Grand Gulf.

3. Hydrogen Ignition System

The Grand Gulf containment hydrogen igni-tion system is capable of maintaining the con-centration of hydrogen from severe accidentsin manageable proportions for many severeaccidents. However, for station blackout acci-dent sequences, the igniter system is not oper-able. When power is restored, the ignition sys-tem will be initiated; potentially the contain-ment has high hydrogen concentrations. Somepotential then exists for a deflagration causingsimultaneous failures of both the containmentbuilding and the drywell structure.

4. Containment Spray System

The Grand Gulf containment spray system hasthe capability to condense steam and reducethe amount of radioactive material released tothe environment for specific accident se-quences. However, for some sequences, i.e.,loss of ac power, its eventual initiation uponpower recovery and that of the hydrogen igni-tion system could result in subsequent hydro-gen combustion that has some potential to failthe containment and drywell.

NUREG-1 150 6-12




A key difference between the Peach Bottom(Mark I) design and Grand Gulf (Mark III) de-sign is the wetwell/drywell configuration. If thedrywell remains intact in the accident and themode of containment failure does not result inloss of the suppression pool, leakage to the envi-ronment must pass through the pool and be sub-ject to decontamination.

Figures 6.6 and 6.7 illustrate the effect of drywellintegrity in mitigating the environmental release ofradionuclides for early containment failure. InFigure 6.6, both the drywell and the containmentfail early and sprays are not available. The medianrelease for the volatile radionuclides is approxi-mately 10 percent, indicative of a large release withthe potential for causing early fatalities. For the earlycontainment failure accident progression bin with thedrywell intact, as illustrated in Figure 6.7, the envi-ronmental source terms are reduced, since the flowof gases escaping the containment after vessel breachmust also pass through the suppression pool beforebeing released to the environment.

Additional discussion on source term perspectives(for all studied plants) is provided in Chapter 10.


1. Suppression Pool

The pressure-suppression pool at Grand Gulfprovides the potential for substantial mitiga-tion of the source terms in severe accidents.Since transient-initiated accidents represent alarge contribution to core damage frequency,the in-vessel release of radionuclides is almostalways subject to pool decontamination. Onlya fraction of such accident sequences (inwhich a vacuum breaker sticks open in asafety relief valve discharge line) releasesradionuclides directly to the drywell in thisphase of the accident. The pool decontamina-tion factors used for the Grand Gulf design forthe in-vessel release range from 1.1 to 4000,with a median of 60. For the ex-vessel releasecomponent, the pool is less effective. The de-contamination factors range from 1 to 90 witha median of 7.

2. Wetwell-Drywell Configuration

If the drywell remains intact in a severe acci-dent at Grand Gulf, the radionuclide release

would be forced to pass through the suppres-sion pool and the source term would be sub-stantially mitigated. However, the likelihoodof drywell failure is estimated to be quite sig-nificant, such that early failure with suppres-sion pool bypass occurs approximately one-quarter of the time if core melting and vesselbreach occur.

3. Pedestal Flooding

The pedestal region communicates with thedrywell region through drains in the drywellfloor. The amount of water in the pedestal re-gion depends on whether the upper waterpool has been dumped into the suppressionpool, on the quantity of condensate storagethat has been injected into the containment,and on the transient pressurization of the con-tainment building resulting from hydrogenburns. The effect of water in the pedestal iseither to result in debris coolability or to miti-gate the source term to containment of theradionuclides released during core-concreteinteraction. Water in the pedestal does, how-ever, also introduce some potential for asteam explosion that can damage the drywell.

4. Containment Sprays

Containment sprays can have a mitigating ef-fect on the release of radionuclides underconditions in which both the containment anddrywell have failed. In other accident scenar-ios in which the in-vessel and ex-vessel re-leases must pass through the suppression poolbefore reaching the outer containment region,sprays are not nearly as important. This is, inpart, because the source term has alreadybeen reduced and, in part, because the de-contamination factors for suppression poolsand containment sprays are not multiplicativesince they selectively remove similar-sizedaerosols.


Figure 6.8 displays the frequency distributions inthe form of graphical plots of the complementarycumulative distribution functions (CCDFs) of fouroffsite consequence measures-early fatalities, la-tent cancer fatalities, and the 50-mile and the en-tire site region population exposures (in person-reins). These CCDFs include contributions fromall source terms associated with reactor accidentscaused by internal initiating events. Four CCDFs,

6-13 NUREG-1150

z 0R

elea

se F

ract

ion

1.O

E.0

0

1.O

E-0

1

1.O

E -0

2

1.O

E-0

3

1.O

E- 0

4

1.O

E-0

5N

GI

Cs

Te

Sr

Ru

La

Ba

Ce

Rad

ionu

clid

e G

roup

Figu

re 6

.6

Sour

ce t

erm

dis

trib

utio

ns f

or e

arly

con

tain

men

t fa

ilure

with

dry

wel

l fa

iled

and

spra

ys u

nava

ilabl

e at

Gra

nd G

ulf.

Rele

ase

Frac

tion

1 .OE

+OO

1.O

E-O

1

I.O

E-0

2

1.O

E-0

3

1.O

E-0

4

norm

;..fx

F, N z Q.

2 N w a �d CD

M 5 M

z: 0'

I ,

Jo

--

NG

I

Cs

Te

Sr

Ru

La

Ba

Ce

Rad

ionu

clid

e G

roup

Figu

re 6

.7

Sour

ce t

erm

dis

trib

utio

ns f

or e

arly

con

tain

men

t fa

ilure

with

dry

wel

l in

tact

at

Gra

nd G

ulf.

z tz 0 '-I

AQD

i .o

E-0

3'

CD b

1.OE-

040 ?

1.O

E-0

5

-.O

e

0

I.O

E-0

70

-

tr 0 .O

E-O

B

0

i.O

E-0

9

'.,

0 LU

l.OE

- 10 I.O

EO

O

i.OE

-oi

ent

o

_ S

n

i ...

.

0 0 2 0 a o i 0 O Q U0

0 0 ui

F,

O0 -t

5,0 -PC

52 (b

.F

1.O

E.0

2 1.

OE

03E

arly

Fata

litie

s1.

OE

.04

I.O

E01

5

i.OF

-nl.

(a

0*

1.O

E-0

40 v 0

I.OE

-O

S

0-1

.E-0

8

I 2 C

tg.O

E-0

7

co 'U*

i .oe-

OB

0

i.oE

-og

0

0xU

i-_

__

- _-

- -

.- -- -

-'---

' --

._

0 0 m a ,U 0CD

u 0 'C LT

lOE

-09

6

01

I

I

1.O

E-t

o

1.O

E.O

O

lOE

-02

t.

OE

-04

.o

E.O

8.

1OE

.08

Popula

tio

n D

ose

(p

ers

on

-re

rml) to

-E

ntire

Regio

n

...;._

., ....

_

, ......

1.6O

EOO

1.

OE

.02

1OE

.04

1.O

E.O

5 1.

OE

.08

Po

pu

lati

on

Dose

(pe

rson

-mem

) to

-50 M

iles

Not

e:

As

disc

usse

d in

Ref

eren

ce

6.4,

est

imat

ed c

onse

quen

ces

at f

requ

enci

es a

t or

bel

ow 1

E-7

per

rea

ctor

yea

r sh

ould

be

view

ed w

ith c

autio

n be

caus

e of

the

pot

entia

l im

pact

of

even

ts n

ot s

tudi

ed i

n th

e ri

sk a

naly

ses.

Figu

re 6

.8

Freq

uenc

y di

stri

butio

ns

of o

ffsi

te c

onse

quen

ce

mea

sure

s at

Gra

nd G

ulf

(int

erna

l in

itiat

ors)

.


namely, the 5th percentile, 50th percentile (me-dian), 95th percentile, and the mean CCDFs, areshown for each consequence measure.

Grand Gulf plant-specific and site-specific pa-rameters were used in the consequence analyis forthese CCDFs. The plant-specific parameters in-cluded source terms and their frequencies, the li-censed thermal power (3833 MWt) of the reactor,and the approximate physical dimensions of thepower plant building complex. The site-specificparameters included exclusion area radius (696meters), meteorological data for 1 full year col-lected at the meteorological tower, the site regionpopulation distribution based on the 1980 censusdata, topography (fraction of the area that island-the remaining fraction is assumed to bewater), land use, agricultural practice and produc-tivity, and other economic data for up to 1,000miles from the Grand Gulf plant.


The population density within the Grand Gulf 10-mile EPZ is about 30 persons per square mile.The average delay time before evacuation (after awarning prior to radionuclide release) from the10-mile EPZ and average effective evacuationspeed used in the analyses were derived from in-formation contained in a utility-sponsored GrandGulf evacuation time estimate study (Ref. 6.6)and the NRC requirements for emergency plan-ning.




A detailed description of the results of the GrandGulf risk analysis is provided in Reference 6.2.For this summary report, results are provided forthe following measures of public risk:

0 Early fatality risk,




* Individual early fatality risk in the populationwithin 1 mile of the Grand Gulf exclusion areaboundary, and

* Individual latent cancer fatality risk in thepopulation within 10 miles of the Grand Gulfsite.


The results of the Grand Gulf risk studies usingthe above measures are shown in Figures 6.9through 6.11. The figures display the variabilitiesin mean risks estimated from meteorology-aver-aged conditional mean values of the consequencemeasures. In comparison to the risks from theother plants in this study, Grand Gulf has the low-est risk estimates. The results are much belowthose of the Reactor Safety Study (Ref. 6.8). Theindividual early and latent cancer fatality risks arefar below the NRC safety goals. Details of thecomparison of results are provided in Chapter 12.

The results in Figure 6.9 have been analyzed toidentify the relative contributions of accident se-quences and containment failure modes to meanrisk. These results are presented in Figures 6.12and 6.13. As may be seen, the mean early fatalityrisk at Grand Gulf is dominated by short-term sta-tion blackout sequences. The majority of early fa-tality risk is associated with the coincidence ofearly containment failure and early suppressionpool bypass.

The mean latent cancer fatality risk is also domi-nated by the short-term station blackout group.The major contributors to risk are from (1) earlycontainment and early suppression pool bypass,and (2) late containment failure.


As mentioned before, risk to the public from theoperation of the Grand Gulf plant is lower thanthe other four plants in this study. Some of theplant features that contribute to these low risk es-timates are described below.

* The very low early fatality risk at Grand Gulfis due to a combination of low core damage

6-17 NUREG-1 150


i rn

A I

95Utb -

t10-S

to'0V 10-

I~1O-I

W 6-1

to-t0a

Number of LIS Observations

Key: M =m th =


I'I-'

c)

C.)

0b.)Ia-

10 -~

-4F

10

-S4

95Uh4

Uh,

10 -a

Number of UIS Observations

Note: As discussed in Reference 6.4, estimated risks at or below E-7 per reactor year should beviewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 6.9 Early and latent cancer fatality risks at Grand Gulf (internal initiators).

NUREG-1150 6-18


ich

t4)id

C2

or& 10

1-20 10

c0

bo

D 0

0

soLid

r 10

10

95fth....

5th-.



95thb -.

5 t

5t,


Note: As discussed in Reference 6.4, estimated risks at or below E-7 per reactor year should beviewed with caution because of the potential impact of events not studied in the risk analyses.

Figure 6.10 Population dose risks at Grand Gulf (internal initiators).

6-19 NUREG-1 150


-b10

Qa:0

1 l,< 0

la


Key: M meanm medianth percentile

Irn s

I -S.0 10

1). 4M 10-7

.n 10~'

M10--)

, 10 I

U -'

.$afety Goal

95th..

M.

10 a



Figure 6.11 Individual early and latent cancer fatality risks at Grand Gulf (internal initiators).

NUREG-1150 6-20


GRAND GULFEARLY FATALITY

MEAN S.2E-9/RY

GRAND GULFLATENT CANCER FATALITY

MEAN 9.SE-4/RY

1

3

1

32 2

Plant Damage Statest. LONG TERM 802. SHORT TERM BO3. ATWS4. TRANSIENTS

Figure 6.12 Major contributors (plant damage states) to mean early and latentcancer fatality risks at Grand Gulf (internal initiators).

GRAND GULFEARLY FATALITY

MEAN * 8.2E-9/RY

GRAND GULFLATENT CANCER FATALITY

MEAN 9.5E-41RY

1

4

5,8/5

2 3.4

D

Accident Progression Bins1. VS. ECF. EARLY SP BYPASS, CONT. SPRAYS NOT AVAIL.2. V, ECF, EARLY SP BYPASS, CONT. SPRAYS AVAIL.3. VB. ECF. LATE SP BYPASS4. VD. ECF. NO SP BYPASSS. VS. LATE CFS. VB. VENT7. v. NO CFa. NO VB

Figure 6.13 Major contributors (accident progression bins) to mean early and latentcancer fatality risks at Grand Gulf (internal initiators).

6-21 NUREG-1 150


frequency, reduced source terms (as a resultof suppression pool scrubbing), and low popu-lation density around the plant. The latterleads to short evacuation delays and fastevacuation speeds. Timing is not as importantfor latent cancer fatalities.

* Although the Grand Gulf plant has relativelyhigh probability of early containment failure,caused mainly by hydrogen deflagration, theprobability of early drywell failure, which maylead to a large source term, is about half of

the probability of early containment failure.Furthermore, in most cases, in-vessel releasespass through the suppression pool.

* There is a high probability of having water inthe reactor cavity following vessel breach.Thus, there is a high probability that core de-bris would be coolable. Even when any core-concrete interaction may occur, it is generallyunder water, and, therefore, the resulting re-leases are scrubbed by overlaying water (if notby the suppression pool).

NUREG-1 150 6-22



6.1 M. T. Drouin et al., "Analysis of Core Dam-age Frequency: Grand Gulf Unit 1," SandiaNational Laboratories, NUREG/CR-4550,Vol. 6, Revision 1, SAND86-2084, Sep-tember 1989.

6.2 T. D. Brown et al., "Evaluation of SevereAccident Risks: Grand Gulf Unit 1," SandiaNational Laboratories, NUREG/CR-4551,Vol. 6, Draft Revision 1, SAND86-1309, tobe published.*

6.3 S. W. Hatch et al., "Reactor Safety StudyMethodology Applications Program: GrandGulf No. 1 BWR Power Plant," Sandia Na-tional Laboratories and Battelle ColumbusLaboratories, NUREG/CR-1659/4 of 4,SAND80-1897/4 of 4, November 1981.

6.4 H. J. C. Kouts et al., "Special CommitteeReview of the Nuclear Regulatory Commis-sion's Severe Accident Risks Report

'Available In the NRC Public Document Room, 2120 LStreet NW., Washington, DC.

(NUREG-1150)," NUREG-1420, August1990.

6.5 A. D. Swain III, "Accident Sequence Evalu-ation Program-Human Reliability AnalysisProcedure," Sandia National Laboratories,NUREG/CR-4772, SAND86-1996, Febru-ary 1987.

6.6 Mississippi Power & Light Company,"Evacuation Time Estimates for the GrandGulf Nuclear Station Plume Exposure Path-way Emergency Planning Zone," Revision 4,March 1986.

6.7 USNRC, "Safety Goals for the Operation ofNuclear Power Plants; Policy Statement,"Federal Register, Vol. 51, p. 30028, Au-gust 21, 1986.

6.8 USNRC, "Reactor Safety Study-An Assess-ment of Accident Risks in U.S CommercialNuclear Power Plants," WASH-1400(NUREG-75/014), October 1975.

6-23 NUREG-1150

7. ZION PLANT RESULTS


The Zion Nuclear Plant is a two-unit site. Eachunit is a four-loop Westinghouse nuclear steamsupply system rated at 1100 MWe and is housedin a large, prestressed concrete, steel-lined drycontainment. The balance of plant systems wereengineered by Sargent & Lundy. Located on theshore of Lake Michigan, about 40 miles north ofChicago, Illinois, Zion 1 started commercial op-eration in December 1973. Some important de-sign features of the Zion plant are described inTable 7.1. A general plant schematic is providedin Figure 7.1.

This chapter provides a summary of the resultsprovided in the risk analyses underlying this report(Refs. 7.1 and 7.2). A discussion of perspectiveswith respect to these results is provided in Chap-ters 8 through 12.


7.2.1 Summary of Core Damage FrequencyEstimates*

The core damage frequency and risk analyses per-formed for this study considered accidents initi-ated only by internal events (Ref. 7.1); no exter-nal-event analyses were performed. The coredamage frequency results obtained are providedin tabular form in Table 7.2. This study calculateda total median core damage frequency from inter-nal events of 2.4E-4 per year.

7.2.1.1 Zion Analysis Approach

The Zion plant was previously analyzed in theZion Probabilistic Safety Study (ZPSS), per-formed by the Commonwealth Edison Company,and in the review and evaluation of the ZPSS(Ref. 7.3), commonly called the Zion Review pre-pared by Sandia National Laboratories.

Since previous analyses of Zion already existed, itwas decided to perform an update of the previousanalyses rather than perform a completereanalysis. Therefore, this analysis of Zion repre-sents a limited rebaseline and extension of thedominant accident sequences from the ZPSS inlight of the Zion Review comments, although in-

'In general, the results and perspectives provided here donot reflect recent modifications to the Zion plant. Thebenefit of the changes is noted, however, in specificplaces in the text (and discussed in more detail in Section15 of Appendix C).

corporating some methods and issues (such ascommon-cause failure treatment, electric powerrecovery, and reactor coolant pump seal LOCAmodeling) used in the other four plant studies.

The objective of this study was to perform ananalysis that updated the previous Zion analysesand cast the model in a manner more consistentwith the other accident frequency analyses. Themodels were not completely reconstructed in thesmall-event-tree, large-fault-tree modeling methodused in the study of the other NUREG-1150plants. Instead, the small-fault-tree, large-event-tree models from the original ZPSS were used asthe basis for the update. These models were thenrevised according to the comments from Refer-ence 7.3 and were enhanced to address risk issuesusing methods employed by the other plant stud-ies.

This study incorporated specific issues into thesystems and accident sequence models of theZPSS. These issues reflect both changes in theZion plant and general PRA assumptions thathave arisen since the ZPSS was performed. Newdominant accident sequences were determined by'modifying and requantifying the event tree modelsdeveloped for ZPSS. The major changes reflectthe need for component cooling water and servicewater for emergency core cooling equipment andreactor coolant pump seal integrity. The originalset of plant-specific data used in the ZPSS andZion Review was verified as still valid and wasused for this study. Additional discussion of theZion methods is provided in Appendix A.


A detailed description of accident sequences im-portant at the Zion plant is provided in Reference7.1. For this summary report, the accident se-quences described in that reference have beengrouped into six summary plant damage states.These are:

* Station blackout,

* Loss-of-coolant accident (LOCA),

* Component cooling water and service waterinduced reactor coolant pump seal LOCAs,

* Anticipated transients without scram(ATWS),

7-1 NUREG-1 150

7. Zion Plant Results

Table 7.1 Summary of design features: Zion Unit 1.

1. High-Pressure Injection a. Two centrifugal charging pumps.b. Two 1500-psig safety injection pumps.C. Charging pumps inject through boron injection tank.d. Provides seal injection flow.e. Requires component cooling water.

2. Low-Pressure Injection a. Two RHR pumps deliver flow when RCS is below about170 psig.

b. Heat exchangers downstream of pumps provide recircula-tion heat removal.

c. Recirculation mode takes suction on containment sumpand discharges to the RCS, HPI suction, and/or contain-ment spray pump suction.

d. Pumps and heat exchangers require component coolingwater.

3. Auxiliary Feedwater a. Two 50 percent motor-driven pumps and one 100percent turbine-driven pump.

b. Pumps take suction from own unit condensate storagetank (CST) but can be manually crosstied to the otherunit's CST.

4. Emergency Power System a. Each unit consists of three 4160 VAC class 1E buses,each feeding one 480 VAC class 1E bus and motorcontrol center.

b. For the two units there are diesel generators, withone being a swing diesel generator shared by both units.

c. Three trains of dc power are supplied from the invertersand 3 unit batteries.

5. Component Cooling Water a. Shared system between both units.b. Consists of 5 pumps, 3 heat exchangers, and

2 surge tanks.c. Cools RHR heat exchangers, RCP motors and thermal

barriers, RHR pumps, SI pumps, and charging pumps.d. One of 5 pumps can provide sufficient flow.

6. Service Water a. Shared system between both units.b. Consists of 6 pumps and 2 supply headers.c. Cools component cooling heat exchangers, containment

fan coolers, diesel generator coolers, auxiliary feedwaterpumps.

d. Two of 6 pumps can supply sufficient flow.

7. Containment Structure a Large, dry, prestressed concrete.b. 2.6 million cubic foot volume.c. 49 psig design pressure.

8. Containment Spray a. Two motor-driven pumps and 1 independent diesel-driven pump.

b. No train crossties.c. Water supplied by refueling water storage tank.

9. Containment Fan Coolers a. Five fan cooler units, a minimum of 3 needed forpost-accident heat removal.

b. Fan units shift to low speed on SI signal.c. Coolers require service water.

NUREG-1 150 7-2

z I- 0

N <D

:t3

c' cv

Figu

re 7

.1

Zio

n pl

ant

sche

mat

ic.


Table 7.2 Summary of core damage frequency results: Zion.

5% Median Mean 95%

Internal Events 1.1E-4 2.4E-4 3.4E-4* 8.4E-4

'See text (Section 7.2.1) for benefit of recent modifications.

* Interfacing-system LOCA and steam genera-tor tube rupture (SGTR), and

* Transients other than station blackout andATWS.

The relative contribution of the accident types tomean core damage frequency at Zion is shown inFigure 7.2. It is seen that the dominating con-tributors to the core damage frequency are theloss of component cooling water and loss of serv-ice water. The more probable combinations offailures are:

* Reactor coolant pump seals fail because ofthe loss of cooling and injection. Core dam-age occurs because of failure to recover theservice watertcomponent cooling water sys-tems in time to reestablish reactor coolantsystem inventory control. In cases with fail-ure of the service water system, containmentfan coolers are also failed.

* Reactor coolant pump seals fail because ofthe loss of cooling and injection. The coolingsystem is recovered in time to provide injec-tion from the refueling water storage tank(RWST). Recirculation cooling fails to con-tinue to provide long-term inventory control.

To address the issue of the importance of compo-nent cooling water system failures, Common-wealth Edison (the Zion licensee) committed in1989 to perform the following actions (Ref. 7.4):

* Provide an auxiliary water supply to eachcharging pump's oil cooler via either the serv-ice water system or fire protection system.Hoses, fittings, and tools will be maintainedlocally at each unit's charging pump area al-lowing for immediate hookup to existing tapson the oil coolers, if required. As an interimmeasure, a standing order in the controlroom will instruct operators as to how andwhen to hook up auxiliary water to the oilcoolers.

* Formal procedures, including a 10 CFR50.59 review addressing the loss of compo-

nent cooling water system scenario, will befully implemented within 60 days (of the dateof Ref. 7.4) to supersede the standing order.

* When new heat-resistant reactor coolantpump seal -rings are made available byWestinghouse, the existing -rings will bechanged when each pump is disassembled forroutine scheduled seal maintenance.

These actions provide a backup water source tothe Zion station charging pump oil coolers.

As of October 1990, Commonwealth Edison hadperformed some of the noted actions (Ref. 7.5).Sensitivity studies have been performed to assessthe benefit of the modifications made to date.These studies, discussed in more detail in SectionC. 15 of Appendix C, indicate that the Zion esti-mated mean core damage frequency has been re-duced from 3.4E-4 per year to approximately6E-5 per year.


Characteristics of the Zion plant design and op-eration that have been found to be important inthe analysis of the core damage frequency in-clude:

1. Shared Systems Between Units

The Zion nuclear station shares the servicewater and component cooling water (CCW)systems between the two units. Power is sup-plied to these systems from all five onsite die-sel generators.

2. Crossties Between Units

Crossties between units exist for the conden-sate storage tanks to provide water supply forthe auxiliary feedwater system. Crossties alsoexist between Unit 1 and Unit 2 ac powersystems, as well as between Unit 1 and Unit 2dc power systems.

NUREG-1 150 7-4


CCW-Induced Seal OCABypass

ATWSi TransientsStation Blackout

LOCA

SW-induced Seal LOCA


Note: See text (Section 7.2.1) for benefit of recent modifications.

Figure 7.2 Contributors to mean core damage frequency from internal events at Zion.


Zion is a two-unit site with five emergencydiesel generators. One diesel generator is aswing diesel that can be lined up to supplyeither unit. This differs from a number ofother two-unit sites that have only four dieselgenerators on site. The Zion diesel genera-tors are dependent on a common servicewater system for sustained operation.

4. Support System Dependencies

The component cooling water system suppliescooling water for the reactor coolant pumpthermal barriers and for the charging pumpsthat supply seal injection. Failure of the com-ponent cooling water system results in a ma-jor challenge to reactor coolant pump seal in-tegrity. In addition, failure of the componentcooling water support systems (service water

and ac power) also leads to loss of reactorcoolant pump seal integrity. In contrast,some other PWRs do not have a commondependency for both seal cooling and seal in-jection; therefore, at other PWRs, sealLOCAs are only important in station black-out cases. As indicated above, the licenseehas committed to and implemented plantchanges to reduce this dependency.

5. Battery Depletion Time

The battery depletion time following a com-plete loss of all ac power was estimated at 6hours, somewhat longer than that found atsome other plants. The additional time tendsto reduce the significance of the stationblackout sequences as contributors to thecore damage frequency.

7-5 75NUREG-1150


6. Reactor Coolant Pump Seal Performance

The inability of the reactor coolant pumpseals to survive loss of cooling and injectionwithout developing significant leakage domi-nates the core damage frequency. As notedabove, the licensee has committed to replac-ing present seals with a new model.


Several operator actions and recovery actions areimportant to the analysis of the core damage fre-quency. While the analysis included a wide rangeof operator actions from test and maintenance er-rors before an initiating event to recovery a:Ztionswell into an accident sequence, the following ac-tions surface as the most important:

* Successful switchover to recirculation

The operator must recognize that switchovershould be initiated, take action to open theproper set of motor-operated valves depend-ing on reactor coolant system conditions, andverify that recirculation flow is proper.

* Successful execution of feed and bleed cool-ing

The operator must recognize that secondarycooling is lost, establish sufficient injectionflow, open both power-operated relief valves(and their block valves, if necessary), andverify that adequate heat removal is takingplace.

* Recovery of the component cooling waterand service water systems

The operator must recognize that the failureof equipment or rising equipment operatingtemperatures are due to failure of the servicewater or component cooling water systems,determine the cause of system failure, andtake appropriate action to isolate ruptures,restart pumps, and provide alternative cool-ing paths as required by the situation.

* Actions to refill the RWST in the event ofrecirculation failure

This action requires that the operator recog-nize the failure of recirculation cooling in suf-ficient time that refill can begin before coredamage occurs. The operator must thencarry out the procedure for emergency refill

of the RWST. This action is not adequate forinventory control in the case of largerLOCAs because of the limitations of the re-filling equipment.

Switchover to recirculation cooling and initiationof feed and bleed cooling were included in theoriginal Zion Probabilistic Safety Study and havebeen given close scrutiny by the licensee. Eachone of these actions is present in the emergencyprocedures. Appropriate consideration of the pro-cedures, scenarios, timing, and training went intothe determination of the human error probabilitiesassociated with these actions. Because of the im-portance and uncertainty associated with severalof these actions, they were addressed in the sensi-tivity analyses. However, the refilling of the RWSTin the event of recirculation failure and recoveryof CCW and service water were not included inthe original Zion Probabilistic Safety Study. Ap-propriate consideration of the procedures, scenar-ios, timing, and training went into the determina-tion of the human error probabilities associatedwith these actions. Because of the importance anduncertainty associated with several of these ac-tions, they were addressed in the sensitivity analy-ses.



The Zion containment consists of a large, drycontainment building that houses the reactor pres-sure vessel, reactor coolant system piping, and thesecondary system's steam generators. The con-tainment building is a prestressed concrete struc-ture with a steel liner. This building has a volumeof 2.6 million cubic feet with a design pressure of49 psig and an estimated mean failure pressure of150 psia. The principal threats to containment in-tegrity from potential severe accident sequencesare steam explosions, overpressurization from di-rect containment heating effects, bypass events,and isolation failures. As previously discussed inChapter 2, the methods used to estimate loadsand containment structural response for Zionmade extensive use of expert judgment to inter-pret and supplement the limited data (Ref. 7.2).

The results of the Zion containment analysis aresummarized in Figures 7.3 and 7.4. Figure 7.3displays information in which the conditionalprobabilities of four accident progression bins,e.g., early containment failure, are presented foreach of five plant damage states, e.g., LOCA.This information indicates that, on a plant damage

NUREG-1150 7-6


ACCIDENTPROGRESSIONBIN

Early CF

Late CF

Bypass

No CF

PLANT DAMAGE STATE(Mean Core Damage Frequency)

SBO LOCAs Transients V & SGTR(9.34E-6) (3.14E-4) (1.36E-5) (2.59E-7)

All(3. 38E-4)

10.025 10.014 10.012 10.014

0.320 [10.250 U0.190 P0.240

I0.001 10.004 [ 3 10.007

Key: CF = Containment Failure

Figure 7.3 Conditional probability of accident progression bins at Zion.

7-7 NUREG-1150


lo-,

'-4)

r-4

en

0A.

0

-4co

0.C-

:t4Id

a)

.4)

a)

0 0-2

4)

00

0

1t-3

Plant Damage StatesCore Damage Freq.

SBO LOCAs Transients(9.34E-6) (3.14E-4) (1.36E-5)

All(3.38E-4)

Figure 7.4 Conditional probability distributions for early containment failure at Zion.

NUREG-1 150 7-8


state frequency-weighted average, * the mean con-ditional probabilities from internal events of (1)early containment failure from a combination ofin-vessel steam explosions, overpressurization,and containment isolation failures is 0.014, (2)late containment failure, mainly from basematmeltthrough is 0.24, (3) containment bypass frominterfacing-system LOCA and induced steam gen-erator tube rupture (SGTR) is 0.006, and (4)probability of no containment failure is 0.73. Fig-ure 7.4 further displays the conditional probabilitydistributions of early containment failure for theplant damage states, thereby providing the esti-mated range of uncertainties in these containmentfailure predictions. The principal conclusion to bedrawn from the information in Figures 7.3 and7.4 is that the probability of early containmentfailure for Zion is low, i.e., 1 to 2 percent.

Additional discussion on containment perform-ance is provided in Chapter 9.


Characteristics of the Zion design and operationthat are important to containment performanceinclude:

1. Containment Volume and Pressure Capa-bility

The combined magnitude of Zion's contain-ment volume and estimated failure pressureprovide considerable capability to withstandsevere accident threats.

2. Reactor Cavity Geometry

The Zion containment design arrangementhas a large cavity directly beneath the reactorpressure vessel that communicates to thelower containment by means of an instru-ment tunnel. Provided the contents of the re-fueling water storage tank have been injectedprior to vessel breach, this arrangementshould provide a mechanism for quenchingthe molten core for some severe accidents(although there remains some uncertaintieswith respect to the coolability of molten coredebris in such circumstances).

'Each value in the column in Figure 7.3 labeled "All" is afrequency-weighted average obtained by calculating theproducts of individual accident progression bin condi-tional probabilities for each plant damage state and theratio of the frequency of that plant damage state to thetotal core damage frequency.



The containment performance results for the Zion(large, dry containment) plant and the Surry (sub-atmospheric containment) plant are quite similar.The source terms for analogous accident progres-sion bins are also quite similar. Figure 7.5 illus-trates the source term for early containment fail-ure. As at Surry, the source terms for early failureare somewhat less than those for containment by-pass. Within the range of the uncertainty band,however, the source terms from early containmentfailure are potentially large enough to result insome early fatalities.

The most likely outcome of a severe accident atthe Zion plant is that the containment would notfail. Figure 7.6 illustrates the range of sourceterms for the no containment failure accident pro-gression bin. Other than for the noble gas and io-dine radionuclide groups, the entire range ofsource terms is below a release fraction of 10E-5.



1. Containment Spray System

The containment spray system at the Zionplant is not required to operate to providelong-term cooling to the containment, in con-trast to the Surry plant. Operation of thespray system is very effective, however, in re-ducing the airborne concentration of aero-sols. Other than the release of noble gasesand some iodine evolution, the release of ra-dioactive material to the atmosphere resultingfrom late containment leakage or basematmeltthrough in which sprays have operatedfor an extended time would be very small.The source terms for the late containmentfailure accident progression bin are slightlyhigher than, but similar to, those of the nocontainment failure bin illustrated in Figure7.6.


The Zion cavity is referred to as a wet cavity,in that the accumulation of a relatively smallamount of water on the containment floorwill lead to overflow into the cavity. As a re-sult, there is a substantial likelihood of elimi-nating by forming a coolable debris bed or

7-9 79NUREG-1 150

z 0 0d

Rel

ease

F

ract

ion

co OR

ED

1 .O

E+O

O95

%

1.O

E-O

1

1.O

E-0

2

mea

n

med

ian

.5%

-i3 0

1 .O

E-0

3

1.O

E-0

4

1.O

E-0

5N

GI

Cs

Te

Sr

Ru

La

Ba

Ce

Rad

ionu

clid

e G

roup

Figu

re 7

.5

Sour

ce t

erm

dis

trib

utio

ns f

or e

arly

con

tain

men

t fa

ilure

at

Zio

n.

1 .O

E+O

O

1.O

E-O

1

1.O

E-0

2

1.O

E-0

3

1.O

E-0

4

1.O

E-0

5

Rel

ease

Fra

ctio

n

Th

96%

mea

n

me

dia

n

6%

aN

...~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~z C tl L

A~

0>

NG

I C

s Te

S

r R

u La

B

a C

eR

adio

nucl

ide

Gro

upC

D

Figu

re 7

.6

Sour

ce t

erm

dis

trib

utio

ns f

or n

o co

ntai

nmen

t fa

ilure

at

Zio

n.


mitigating by the presence of an overlayingpool of water the release of radionuclidesfrom core-concrete interactions.


Figure 7.7 displays the frequency distributions inthe form of graphical plots of the complementarycumulative distribution functions (CCDFs) of fouroffsite consequence measures-early fatalities, la-tent cancer fatalities, and the 50-mile region andentire site region population exposures (in person-rems). These CCDFs include contributions fromall source terms associated with reactor accidentscaused by internal initiating events. Four CCDFs,namely, the 5th percentile, 50th percentile (me-dian), 95th percentile, and the mean CCDFs areshown for each consequence measure.

Zion plant-specific and site-specific parameterswere used in the consequence analysis for theseCCDFs. The plant-specific parameters includedsource terms and their frequencies, the licensedthermal power (3250 MWt) of the reactor, andthe approximate physical dimensions of the powerplant building complex. The site-specific parame-ters included exclusion area radius (400 meters),meteorological data for 1 full year collected at thesite meteorological tower, the site region popula-tion distribution based on the 1980 census data,topography (fraction of the area which is land-the remaining fraction is assumed to be water),land use, agricultural practice and productivity,and other economic data for up to 1,000 milesfrom the Zion plant.


The population density within the Zion 10-mileEPZ is about 1360 persons per square mile.About 45 percent of the 10-mile EPZ is water.The average delay time before evacuation (after awarning prior to radionuclide release) from the10-mile EPZ and average effective evacuationspeed used in the analyses were derived from in-formation contained in a utility-sponsored Zionevacuation time estimate study (Ref. 7.7) and in

an independent analysis by the Federal Emer-gency Management Agency (Ref. 7.8) and theNRC requirements for emergency planning.



7.6.1 Results of Public Risk Estimates*

A detailed description of the results of the Zionrisk analysis is provided in Reference 7.2. For thissummary report, results are. provided for the fol-lowing measures of public risk:

* Early fatality risk,* Latent cancer fatality risk,* Population dose within 50 miles of the site,* Population dose within the entire site region,* Individual early fatality risk in the population

within 1 mile of the Zion exclusion areaboundary, and

* Individual latent cancer fatality risk in thepopulation within 10 miles of the Zion site.

The first four of the above measures are com-monly used measures in nuclear plant risk studies.The last two are those used to compare with theNRC safety goals (Ref. 7.9).

The results of the Zion risk analyses are shown inFigures 7.8 through 7.10. The figures displayvariabilities in mean risks estimated from the me-teorology-based conditional mean values of theconsequence measures. The risk estimates areslightly higher than those of the other two PWRplants (Surry and Sequoyah) in this study. Indi-vidual early and latent cancer fatality risks are wellbelow the NRC safety goals. Detailed comparisonsof results are given in Chapter 12.

The risk results shown in Figure 7.8 have beenanalyzed to identify the principal contributors(accident sequences and containment failuremodes) to plant risk. These results are presentedin Figures 7.11 and 7.12. As may be seen, bothfor early and latent cancer fatality risks, the domi-nant plant damage state is loss-of-coolant-accident(LOCA) sequences, which have the highestrelative frequency and relatively high releasefractions. Zion plant risks are dominated by earlycontainment failure (alpha-mode failure, contain-ment isolation failure, and overpressurization

*As noted in Section 7.2, sensitivity studies have been per-formed to reflect recent modifications in the Zion plant.The impact on risk is displayed on the figures in this sec-tion. More detailed discussion on the sensitivity studiesmay be found in Section C.15 of Appendix C.

NUREG-1 150 7-12

C,1,

01. 1I

.a C

xI

,~1.

U.

01 0 wD

1.

1=

I.O

F-0

3

1 .O

E-04

E' 1

.OE

-05

-.O

E-0

00 C

: 3 1,0

E-0

7

1.06

-08

1,~ .O

E-0

0 dS I

.OE

- o

t.O

E.0

1 .0

E+

02

.E*03

oE60

4 1.

0E-0

5 1

.0E

.08

Late

nt

Cance

r F

ata

litie

sE

arly

Fata

litie

s

I-

1I .O

E-O

S..

..

0 12 CD Q.

1.0

6-0

6

0 C 4)

1.0

6-0

7

LA

.e)

1.0

E-0

8C

a)1,

OE

-09

0 Lu

--

-

P---

-

----

----

----

--

co I? 0 va 0 r_ 034

U 0 0L a) U

l.O

E-0

3

-_-

-

1.0

E-0

4

----

--

1.0

E-0

7

t.O

E-0

8

---

.OE

-O9

-60

1ht a

}* X\s

1.0E

- 10 1.E

0 0

1.01

0

2

*.O

E-0

4

tOE

-OR

l.O

E-0

8P

op

ula

tion

Do

se (

pe

rso

n-r

em

) to

-E

ntir

e R

eg

ion

*

Perc

en

tle

*

--

5th

: M

oan

I-

50th

*

-5th

__I

N a' :3 �d P ;II

z LA

CD

..

....

..

...

.I

, .

1.Q0_

- '

.OE

.OO

1.0

E02

1.O

E.0

4 1.

06O

.0

1.0E

-08

Popula

tion D

ose

(pers

on

-re

m)

to -5

0 M

iles

WW

Not

e:

As

disc

usse

d in

Ref

eren

ce

7.6,

est

imat

ed r

isks

at

or b

elow

E

-7 p

er r

eact

or y

ear

shou

ld b

e vi

ewed

with

cau

tion

beca

use

of t

hepo

tent

ial

impa

ct o

f ev

ents

not

stu

died

in

the

risk

ana

lyse

s.

Figu

re 7

.7

Freq

uenc

y di

stri

butio

ns o

f of

fsite

con

sequ

ence

mea

sure

s at

Zio

n (i

nter

nal

initi

ator

s).


I;..+

Number of LHS Obsrattons\,V

J; - ^ ~~~~~~~Key: M meanhim n,*dlan t

10I


.Notes As discussed in Reference 7.6, estimated risks at or below 1E-7 per reactor year should beviewed with caution because of the potential impact of events not studied in the risk analyses.

'Y' shows recalculated mean value based on plant modifications discussed in Section 7.2.1I.

- ~~Figure 7.8 Early and latent cancer fatality risks at Zion (internal initiators).

NUREG-1150 7-14

1004006 , 'WM ... -19 " M


uP

id'

to

id b

.

C

04

01S

t1i

I4

o 1

P210

a

95ih ..

.

-= O +

5th ,.


Key: M meanm - mediant - percentile

. _

M , +

5th.


Notes: As discussed in Reference 7.6, estimated risks at or below IE-7 per reactor year should beviewed with caution because of the potential impact of events not studied in the risk analyses.

"+"shows recalculated mean value based on plant modifications discussed in Section 7.2.1.

Figure 7.9 Population dose risks at Zion (internal initiators).

7-15 NUREG-1 150


10

1CF -

t6

10

I'll

10lo-l

V

. Safety Goal

M9

L ,+

5th.i

a


Key: Mm

- mean- median- percentile

C4)

104)

;g 10F,-'

M~ 10*-4-

S: 1,

.- ~Safety Goal

95h

~~~+

T ,5th , :1

.4


Notes: As discussed in Reference 7.6, estimated risks at or below 1E-7 per reactor year should beviewed with caution because of the potential impact of other health effects not studied in therisk analyses.

"+"shows recalculated mean value based on plant modifications discussed in Section 7.2.1.

Figure 7.10 Individual early and latent cancer fatality risks at Zion (internal initiators).

NUREG-1150 7-16


ZION EARLY FATALITYMEAN t.i-418Y

ZION LATENT CANCER FATALITYMEAN 2.4r-&/RY

31

4 6--w-w.....

5

Plant Damage Stateat 82o2. ATWSS. TRANSIENTS4. LOCA5. YPASS

Figure 7.11 Major contributors (plant damage states) to mean early and latent cancerfatality risks at Zion (internal initiators).

ZION EARLY FATALITYMEAN * tE-4VAY

ZION LATENT CANCER FATALITYMEAN * .4E-RIRY

1

2

Accident Progression Bins1. YPA82. EARLY CONT. FAILURE

Figure 7.12 Major contributors (accident progression bins) to mean earlyand latent cancer fatality risks at Zion (internal initiators).

7-17 NUREG-1 150


failure). This occurs because, although the condi-tional probability of early failure is low, other fail-ure modes have even lower probabilities.


* As discussed before, the dominant risk con-tributor for the Zion plant is early contain-ment failure. The accident progression binfor early containment failure contains severalfailure modes such as the alpha-mode, con-

tainment isolation, and overpressurizationfailures.

* The containment structure at Zion is robust,with a low probability of failure. This has ledto the low risk estimates from the Zion plant.(In comparison with other plants studied inthis report, risks from Zion are relativelyhigh; but, in the absolute sense, the risks arevery low and well below the NRC safetygoals.)

NUREG-1 150 7-18



7.1 M. B. Sattison and K. W. Hall, "Analysis ofCore Damage Frequency: Zion Unit 1,"Idaho National Engineering Laboratory,NUREG/CR-4550, Vol. 7, Revision 1,EGG-2554, May 1990.

7.2 C. K. Park et al., "Evaluation of Severe Ac-cident Risks: Zion Unit 1," Brookhaven Na-tional Laboratory, NUREGICR-4551, Vol.7, Draft Revision 1, BNL-NUREG-52029,to be published.*

7.3 D. L. Berry et al., "Review and Evaluation ofthe Zion Probabilistic Safety Study: PlantAnalysis," Sandia National Laboratories,NUREG/CR-3300, Vol. 1, SAND83-1118,May 1984.

7.4 Cordell Reed, Commonwealth Edison Co.(CECo), "Zion Station Units 1 and 2. Com-mitment to Provide a Backup Water Sourceto the Charging Oil Coolers," NRC DocketNos. 50-295 and 50-304, March 13, 1989.

*Available in the NRC Public Document Room, 2120 L StreetNW., Washington, DC.

7.5 R. A. Chrzanowski, CECo, "March 13, 1989Letter from Cordell Reed to T. E. Murley,"NRC, NRC Docket Nos. 50-295 and50-304, August 24, 1990.


7.7 Stone & Webster Engineering Corporation,"Preliminary Evacuation Time Study of the10-Mile Emergency Planning Zone at theZion Station," prepared for CommonwealthEdison Company, January 1980.

7.8 Federal Emergency Management Agency,"Dynamic Evacuation Analyses: Independ-ent Assessments of Evacuation Times fromthe Plume Exposure Pathway EmergencyPlanning Zones of Twelve Nuclear PowerStations," December 1980.

7.9 USNRC, "Safety Goals for the Operation ofNuclear Power Plants; Policy Statement,"Federal Register, Vol. 51, p. 30028, August21, 1986.

7-19 NUREG-1150

Summary of Plant Results - Nuclear Regulatory …. Surry Plant Results Table 3.1 Summary of design...

Documents

Transcript of Summary of Plant Results - Nuclear Regulatory …. Surry Plant Results Table 3.1 Summary of design...