Perspectives and Uses - Nuclear Regulatory Commission · 8. Core Damage Frequency 1.OE-03 + C 0 R E D A M A G E F R E a U E N C Y 1.OE-04 1.OE-05 1.OE-06 1.OE-07 SURRY PEACH BOTTOM

PART III

Perspectives and Uses

8. PERSPECTIVES ON FREQUENCY OF CORE DAMAGE

8.1 Introduction

Chapters 3 through 7 have summarized the coredamage frequencies individually for the five plantsassessed in this study. Significant differencesamong the plants can be seen in the results, bothin terms of the core damage frequencies and theparticular events that contribute most to those fre-quencies. These differences are due to plant-spe-cific differences in the plant designs and opera-tional practices. Despite the plant-specific natureof the study, it is possible to obtain important per-spectives that may have implications for a largernumber of plants and also to describe the types ofplant-specific features that are likely to be impor-tant at other plants. This chapter provides some ofthese perspectives.

8.2 Summary of Results

As discussed in Chapter 2, the core damage fre-quency is not a value that can be calculated withabsolute certainty and thus is best characterizedby a probability distribution. It is therefore dis-cussed in this report in terms of the mean, me-dian, and various percentile values. The internal-event core damage frequencies are illustratedgraphically in Figure 8.1 (Refs. 8.1 through 8.5).The figure does not include the contributions ofexternal events, which are discussed in Section8.4.

In Figure 8.1 the lower and upper extremities ofthe bars represent the 5th and 95th percentiles ofthe distributions, with the mean and median ofeach distribution also shown. Thus, the bars in-clude the central 90 percent of the distributions (itshould be remembered that the distributions arenot uniform within these bars). These figures showthat the range between the 5th and 95th percen-tiles covers from one to two orders of magnitudefor the five plants. There is also significant overlapamong the distributions, as discussed below. Thereader should refer to References 8.1 through 8.5for detailed discussion of the distributions.

Figures 8.2 and 8.3 show the contributions of theprincipal types of accidents to the mean coredamage frequency for each plant. Figure 8.4 alsopresents this breakdown, but on a relative scale.These figures show that some types of accidents,such as station blackouts, contribute to the coredamage frequencies for all the plants; however,

there is substantial plant-to-plant variability amongimportant accident sequences.

Figures 8.5 through 8.8 provide the results of theexternal-event analyses, and Figures 8.9 through8.12 give the breakdown of these analyses accord-ing to the principal types of accident sequences.

8.3 Comparison with Reactor SafetyStudy

Figures 8.13 and 8.14 show the internal coredamage frequency distributions calculated in thispresent study for Surry and Peach Bottom alongwith distributions synthesized from the ReactorSafety Study (Ref. 8.6), which also analyzedSurry and Peach Bottom. The Reactor SafetyStudy presented results in terms of medians butnot means. It can be seen that the medians arelower in the present work, although observation ofthe overlap of the ranges shows that the change ismore significant for Peach Bottom than for Surry.

There are two important reasons for the differ-ences between the new figures and those of theReactor Safety Study. The first is the fact thatprobabilistic risk analyses (PRAs) are snapshots intime. In these cases, the snapshots are takenabout 15 years apart. Both plants have imple-mented hardware modifications and proceduralimprovements with the stated purpose of increas-ing safety, which drives core damage frequenciesdownward.

The second reason is that the state of the art inapplying probabilistic analysis in nuclear powerplant applications has advanced significantly sincethe Reactor Safety Study was performed. Compu-tational techniques are now more sophisticated,computing power has increased enormously, andconsequently the level of detail in modeling hasincreased. In some cases, these new methods havereduced or eliminated previous analytical conser-vatisms. However, new types of failures have alsobeen discovered. For example, the years of expe-rience with probabilistic analyses and plant opera-tion have uncovered the reactor coolant pumpseal failure scenario as well as intersystem depend-encies, common-mode failure mechanisms, andother items that were less well recognized at thetime of the Reactor Safety Study. Of course, thissame experience has also uncovered new ways inwhich recovery can be achieved during the courseof a possible core damage scenario (except for the

8-1 NUREG- 1150

8. Core Damage Frequency

1.OE-03

+

C0RE

DAMAGE

FREaUENCY

1.OE-04

1.OE-05

1.OE-06

1.OE-07SURRY PEACH

BOTTOMGRAND SEQUOYAH ZIONGULF

11 Mean £1 Median

Notes: As discussed in Reference 8.7, core damage frequencies below E-5 per reactor year shouldbe viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

"+" indicates recalculated Zion mean core damage frequency based on recent plant modifica-tions (see Section 7.2.1).

Figure 8.1 Internal core damage frequency ranges (5th to 95th percentiles).

NUREG-1150 8-2


1.OOOE- 06:

1.OOOE-06:

1.OOOE-07:

1.OOOE-08 LGrand GultPeach Bottom

M3 STATION BLAKOUT

M LOCA

M ATWS

_ TRANSIENT

Figure 8.2 BWR principal contributors to internal core damage frequencies.

1.OOOE-03

1 .OOOE- 04

t.OOON-06_ | | 13 | ;+

1.OOOE-05 : ~

1.OOOE-06 -_Surry Sequoyah Zion

= STATION BLKOUT = ATWS

_ TRANSIENT M INTF LOCA

L LOCA

SEAL LOCA

Notes: As discussed in Reference 8.7, core damage frequencies below 1E-5 per reactor year shouldbe viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

"+" indicates recalculated mean seal LOCA plant damage state frequency based on recentplant modifications (see Section 7.2.1).

Figure 8.3 PWR principal contributors to internal core damage frequencies.

8-3 NUREG-1150


SEQUOYAH SURRY

STATION BLACOUT

STM GEN TUBE RUPTATW9

. s TRANSIENTv ~~ T INTERF. SYS LOCA

STATION BLACKOUT

m ockM .. LOCA

INTERF. SYST. LOCA ATVXTo GEN. TUBE RUPT

TRANSIENT

ZION

LSTATIO BUKOUT

SW-NDSEALLO

PEACH BOTTOM GRAND GULF

I BLACKOUT

STATIONBLACKOUT

T RANSIENT

VLOCAATWS

ATWS

Figure 8.4 Principal contributors to internal core damage frequencies.

NUREG-1 150 8-4


pR0aAD

L

TyaNa

I

1.OE-08 1.OE-07 1.OE-06 1.OE-05 1.OE-04 1.OE-03CORE DAMAGE FREQUENCY

1.OE-02

SEISMIC, LIVERMORE -- SEISMIC. EPRI -FIRE

Figure 8.5 Surry external-event core damage frequency distributions.

pR0aAB

L

TV

NS

TV

1.OE-08 1.OE-07 1.OE-06 1.OE-05 1.OE-04 .OE-03CORE DAMAGE FREQUENCY

1.OE-02

---- SEISMIC, LIVERMORE --- SEISMIC, EPRI -FIRE

Note: As discussed in Reference 8.7, core damage frequencies below 1E-5 per reactor year shouldbe viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

Figure 8.6 Peach Bottom external-event core damage frequency distributions.

8-5 NUREG- 1150


1.OE-03

C0R

A 1.o1-04 HD

E 1.OE-05FRE

U° 1.OE-06C y

1.OE-07INTERNAL SEISMIC SEISMIC FIRE

LIVERMORE EPRI

B Mean -E Median

Figure 8.7 Surry internal- and external-event core damage frequency ranges.

1.OE2-03

CO 1.OE-04RE

AM 1.OE2-05A I

EF

R 1.OE -08E ~ ~ ~ ITRA EIMC SIMCFR

1.OE - 0LVEMOE PR

8Mean tiMedian

Note: As discussed in Reference 8.7, core damage frequencies below E-5 per reactor year shouldbe viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

Figure 8.8 Peach Bottom internal- and external-event core damage frequency ranges.

NUREG- 1150 88 -6


SURRY PEACH BOTTOM

TRANSIENT

LO LOCAVESSEL RUPT

MALL LOCA

TRANSIENTSEAL LOCA

RWT BLDGFAILURE

VESSEL RUPTURE

Figure 8.9 Principal contributors to seismic core damage frequencies.

SURRY PEACH BOTTOM

TRANSIENTSEAL LOCA,

LOSS OFOFFSITE PWRTUCK-OPEN

PORV

TRANSIENT

Figure 8.10 Principal contributors to fire core damage frequencies.

8-7 NUREG-1150


AUX BLDG = .

CONTROL ROOM

CABLE VAULT & TUNNEL .

EMER. SWITCHGEAR ....

0 10 20 30 40 SO 60 70X IE-7 PER YEAR

Figure 8.11 Surry mean fire core damage frequency by fire area.

EMER SWGEAR RM 2A

EMER SWGEAR RM 2B -

EMER SWGEAR RM 2C

EMER SWGEAR RM 2D

EMER SWGEAR RM 3A

EMER SWGEAR RM 3B

EMER SWGEAR RM 3C

EMER SWGEAR RM 3D

CONTROL ROOM

CABLE SPREADING ROOM

0 10 20 30 40 50 60 70X 1E-7 PER YEAR

Note: As discussed in Reference 8.7, core damage frequencies below 1E-5 per reactor year shouldbe viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered).

Figure 8.12 Peach Bottom mean fire core damage frequency by fire area.

NUREG- 1150 8-8


1.OE-03

C0R

0ANIA0E

FR

aU

NCy

1.OE-04

1.OE-06

1.OE-06THIS STUDY REACTOR SAFETY

STUDY

R Mean -0 Median

Figure 8.13 Comparison of Surry internal core damageStudy.

frequency with Reactor Safety

1.OE-03

CaRE

0AUAQa

FR'HaUHNCY

1.OE-04

1.OE-06

1.OE-06

11ft

1.OE-07THIS STUDY REACTOR SAFETY

STUDY

0- Mean E3 Median

Note: As discussed in Reference 8.7, core damage frequencies below E-5 per reactor year shouldbe viewed with caution because of the remaining uncertainties in PRA (e.g., events not con-sidered) .

Figure 8.14 Comparison of Peach Bottom internal core damage frequency with Reactor Safety Study.

8-9 NUREG-1150


recovery of ac power, the Reactor Safety Studydid not consider recovery actions). Thus, the neteffect of including these new techniques and ex-perience is plant specific and can shift core dam-age frequencies in either higher or lower direc-tions.

In the case of the Surry analysis, the ReactorSafety Study found the core damage frequency tobe dominated by loss-of-coolant accidents(LOCAs). For the present study, station blackoutaccidents are dominant, while the LOCA-inducedcore damage frequency is substantially reducedfrom that of the Reactor Safety Study, particularlyfor the small LOCA events. This occurred in spiteof a tenfold increase in the small LOCA initiatingevent frequency estimates, which was a result ofthe inclusion of reactor coolant pump seal fail-ures. One reason for the reduction lies in plantmodifications made since the Reactor SafetyStudy was completed. These modifications allowfor the crossconnection of the high-pressure safetyinjection systems, auxiliary feedwater systems, andrefueling water storage tanks between the twounits at the Surry site. These crossties provide areliable alternative for recovery of system failures.Thus, the plant modifications (the crossconnec-tions) have driven the core damage frequenciesdownward, but new PRA information (the highersmall LOCA frequency) has driven them upward.In this case, the net effect is an overall reductionin the core damage frequency for internal events.

In the case of Peach Bottom, the Reactor SafetyStudy found the core damage frequency to becomprised primarily of ATWS accident sequencesand of transients with long-term failure of decayheat removal. The present study concludes thatstation blackout scenarios are dominant. The pos-sibility of containment venting and allowing forsome probability of core cooling after containmentfailure has considerably reduced the significanceof the long-term loss of decay heat removal acci-dents. In addition, the plant has implementedsome ATWS improvements, although ATWSevents remain among the dominant accident se-quence types. Moreover, more modern neutronicand thermal-hydraulic simulations of the ATWSsequences have calculated lower core power levelsduring the event, allowing more opportunity formitigation such as through the use of low-pressureinjection systems. Thus, for Peach Bottom, bothadvances in PRA methodology and plant modifi-cations have contributed to a reduction in the esti-mated core damage frequency from internalevents.

In summary, there have been reductions in thecore damage frequencies for both plants since theReactor Safety Study. The reduction in core dam-age frequency for Peach Bottom is more signifi-cant than for Surry; however, there is still consid-erable overlap of the uncertainty ranges of the twostudies. The conclusion to be drawn is that thehardware and procedural changes made since theReactor Safety Study appear to have reduced thecore damage frequency at these two plants, evenwhen accounting for more accurate failure dataand reflecting new sequences not identified in theReactor Safety Study (e.g., the reactor coolantpump seal LOCA).

8.4 Perspectives

8.4.1 Internal-Event Core DamageProbability Distributions

The core damage frequencies produced by allPRAs inherently have large uncertainties. There-fore, comparisons of frequencies between PRAsor with absolute limits or goals are not simply amatter of comparing two numbers. It is more ap-propriate to observe how much of the probabilitydistribution lies below a given point, which trans-lates into a measure of the probability that thepoint has not been exceeded. For example, if themedian were exactly equal to the point in ques-tion, half of the distribution would lie above andhalf below the point, and there would be a 50 per-cent probability that the point had not been ex-ceeded.

Similarly, when comparing core damage frequen-cies calculated for two or more plants, it is notsufficient to simply compare the mean values ofthe probability distributions. Instead, one mustcompare the entire distribution. If one plant's dis-tribution were almost entirely below that of an-other, then there would be a high probability thatthe first plant had a lower core damage frequencythan the second. Seldom is this the case, however.Usually, the distributions have considerable over-lap, and the probability that one plant has ahigher or lower core damage frequency than an-other must be calculated. References 8.1 through8.5 contain more detailed information on the dis-tributions that would support such calculations.

Although the distributions are not compared indetail here, the overlap of such core damagefrequency distributions is clearly shown in Figure8.1. For example, one can have relatively highconfidence that the internal-event core damagefrequency for Grand Gulf is lower than that ofSequoyah or Surry. Conversely, it can readily beseen that the differences in core damage

NUREG-1 150 8-10


frequency between Surry and Sequoyah are notvery significant.

Interpretation of extremely low median or meancore damage frequencies (<lE-5) is somewhat dif-ficult. As discussed in Section 1.3 and in Refer-ence 8.7, there are limitations in the scope of thestudy that could lead to actual core damage fre-quencies higher than those estimated. In addition,the uncertainties in the sequences included in thestudy tend to become more important on a rela-tive scale as the frequency decreases. A very lowcore damage frequency is evident for Grand Gulfwith the median of the distribution in the range of1E-6 per reactor year. However, it is incompleteto simply state that the core damage frequency forthis plant is that low since the 95th percentile ex-ceeds 1E-5 per reactor year. Thus, although thecentral tendency of the calculation is very low,there is still a finite probability of a higher coredamage frequency, particularly when consideringthat the scope of the study does not include cer-tain types of accidents as discussed in Section 1.3.

8.4.2 Principal Contributors to Uncertaintyin Core Damage Frequency

In Section 8.4.3, analyses are discussed concern-ing some of the issues and events that contributeto the magnitude of the core damage frequency.Generally, for the accident frequency analysis, theissues that contribute most to the magnitude of thefrequency are also the issues that contribute mostto the estimated uncertainty. More detail con-cerning the contributions of various parameters tothe uncertainty in core damage frequency may befound in References 8.1 through 8.5. Perspectiveson the contributions of accident frequency issuesto the uncertainty in risk may be found in Chapter12.

8.4.3 Dominant Accident Sequence Types

The various accident sequences that contribute tothe total core damage frequency can be groupedby common factors into categories. Older PRAsgenerally did this in terms of the initiating event,e.g., transient, small LOCA, large LOCA. Currentpractice also uses categories, such as ATWS, sealLOCA, and station blackout. Generally, thesecategories are not equal contributors to the totalcore damage frequency. In practice, four or fivesequence categories, sometimes fewer, usuallycontribute almost all the core damage frequency.These will be referred to below as the dominantplant damage states (PDSs).

It should be noted that the selection of categoriesis not unique in a mathematical sense, but insteadis a convenient way to group the results. If thecore damage frequency is to be changed, changingsomething common to the dominant PDS willhave the most effect. Thus, if a particular planthad a relatively high core damage frequency and aparticular group of sequences were high, a valu-able insight into that plant's safety profile wouldbe obtained.

It should also be noted that the importance of thehighest frequency accident sequences should beconsidered in relationship to the total core dam-age frequency. The existence of a highly dominantaccident sequence or PDS does not of itself implythat a safety problem exists. For example, if aplant already had an extremely low estimated coredamage frequency, the existence of a single,dominant PDS would have little significance. Simi-larly, if a plant were modified such that the domi-nant PDS were eliminated entirely, the next high-est PDS would become the most dominant con-tributor.

Nevertheless, it is the study of the dominant PDSand the important failures that contribute to thosesequences that provides understanding of why thecore damage frequency is high or low relative toother plants and desired goals. This qualitative un-derstanding of the core damage frequency is nec-essary to make practical use of the PRA resultsand improve the plants, if necessary.

Given this background, the dominant PDSs forthe five studies are illustrated in Figures 8.2, 8.3,and 8.4. Additional discussion of these PDSs canbe found in Chapters 3 through 7. Several obser-vations on these PDSs and their effects on thecore damage frequency can be made, as discussedbelow.

Boiling Water Reactor versus PressurizedWater Reactor

It is evident from Figure 8.1 that the two particu-lar BWRs in this study have internal-event coredamage frequency distributions that are substan-tially lower than those of the three PWRs. While itwould be inappropriate to conclude that all BWRshave lower core damage frequencies than PWRs,it is useful to consider why the core damage fre-quencies are lower for these particular BWRs.

The LOCA sequences, often dominant in thePWR core damage frequencies, are minor con-tributors in the case of the BWRs. This is notsurprising in view of the fact that most BWRs havemany more systems than PWRs for injecting water

8-11 NUREG-1150


directly into the reactor coolant system to providemakeup. For BWRs, this includes two low-pressure emergency core cooling (ECC) systems(low-pressure coolant injection and low-pressurecore spray), each of which is multitrain; two high-pressure injection systems (reactor core isolationcooling and either high-pressure coolant injectionor high-pressure core spray); and usually severalother alternative injection systems, such as thecontrol rod drive hydraulic system, condensate,service water, firewater, etc. In contrast, PWRsgenerally have one high-pressure and one low-pressure ECC system (both multitrain), plus a setof accumulators. The PWR ECCS does have con-siderable redundancy, but not as much as that ofmost BWRs.

For many types of transient events, the above ar-guments also hold. BWRs tend to have more sys-tems that can provide decay heat removal thanPWRs. For transient events that lead to loss ofwater inventory due to stuck-open relief valves orprimary system leakage, BWRs have numeroussystems to provide makeup. ATWS events andstation blackout events, as discussed below, affectboth PWRs and BWRs.

BWRs have historically been considered moresubject than PWRs to ATWS events. This percep-tion was partly due to the fact that some ATWSevents in a BWR involve an insertion of positivereactivity. Except for the infrequent occurrence ofan unfavorable moderator temperature coeffi-cient, an ATWS event in a PWR is slower, allow-ing more time for mitigative action.

In spite of this historical perspective for ATWS, itis evident from Figures 8.2 and 8.3 that theATWS frequencies for the two BWRs are not dra-matically higher than for the PWRs. There areseveral reasons for this. First, plant procedures fordealing with ATWS events have been modifiedover the past several years, and operator trainingspecifically for these events has improved signifi-cantly. Second, the ability to model and analyzeATWS events has improved. More modernneutronic and thermal-hydraulic simulations ofthe ATWS sequences have calculated lower corepower levels during the event than predicted inthe past. Further, these calculations indicate thatlow-pressure injection systems can be used withoutresulting in significant power oscillations, thus al-lowing more opportunity for mitigation. Note thatfor both BWRs and PWRs the frequency of reac-tor protection system failure remains highly un-certain. Therefore, all comparisons concerningATWS should be made with caution.

Station blackout accidents contribute a high per-centage of the core damage frequency for theBWRs. However, when viewed on an absolutescale, station blackout has a higher frequency atthe PWRs than at the BWRs. To some extent thisis due to design differences between BWRs andPWRs leading to different susceptibilities. For ex-ample, in station blackout accidents, PWRs arepotentially vulnerable to reactor coolant pumpseal LOCAs following loss of seal cooling, leadingto loss of inventory with no method for providingmakeup. BWRs, on the other hand, have at leastone injection system that does not require acpower. While important, it would be incorrect toimply that the differences noted above are theonly considerations that drive the variations in thecore damage frequency. Probably more importantis the electric power system design at each plant,which is largely independent of the plant type.The station blackout frequency is low at PeachBottom because of the presence of four dieselsthat can be shared between units and a mainte-nance program that led to an order of magnitudereduction in the diesel generator failure rates.Grand Gulf has essentially three trains of emer-gency ac power for one unit, with one of the trainsbeing both diverse and independent from theother two. These characteristics of the electricpower system design tend to dominate any differ-ences in the reactor design. Therefore, a BWRwith a below average electric power system reli-ability could be expected to have a higher stationblackout-induced core damage frequency than aPWR with an above average electric power system.

For both BWRs and PWRs, the analyses indicatethat, along with electric power, other support sys-tems, such as service water, are quite important.Because these systems vary considerably amongplants, caution must be exercised when makingstatements about generic classes of plants, such asPWRs versus BWRs. Once significant plant-specific vulnerabilities are removed, support-system-driven sequences will probably dominatethe core damage frequency of both types ofplants. Both types of plants have sufficient redun-dancy and diversity so as to make multiple inde-pendent failures unlikely. Support system failuresintroduce dependencies among the systems andthus can become dominant.

Boiling Water Reactor Observations

As shown in Figure 8.1, the internal-event coredamage frequencies for Peach Bottom and GrandGulf are extremely low. Therefore, even thoughdominant plant damage states and contributing

NUREG-1 150 8-12


failure events can be identified, these items shouldnot be considered as safety problems for the twoplants. In fact, these dominating factors shouldnot be overemphasized because, for core damagefrequencies below 1E-5, it is possible that otherevents outside the scope of these internal-eventanalyses are the ones that actually dominate. Inthe cases of these two plants, the real perspectivescome not from understanding why particular se-quences dominate, but rather why all types of se-quences considered in the study have low fre-quencies for these plants.

Previously it was noted that LOCA sequences canbe expected to have low frequencies at BWRs be-cause of the numerous systems available to pro-vide coolant injection. While low for both plants,the frequency of LOCAs is higher for Peach Bot-tom than for Grand Gulf. This is primarily be-cause Grand Gulf is a BWR-6 design with a mo-tor-driven high-pressure core spray system, ratherthan a steam-driven high-pressure coolant injec-tion system as is Peach Bottom. Motor-driven sys-tems are typically more reliable than steam-drivensystems and, more importantly, can operate overthe entire range of pressures experienced in aLOCA sequence.

It is evident from Figures 8.2 and 8.4 that stationblackout plays a major role in the internal-eventcore damage frequencies for Peach Bottom andGrand Gulf. Each of these plants has features thattend to reduce the station blackout frequency,some of which would not be present at otherBWRs.

Grand Gulf, like all BWR-6 plants, is equippedwith an extra diesel generator dedicated to thehigh-pressure core spray system. While effectivelyproviding a third train of redundant emergency acpower for decay heat removal, the extra dieselalso provides diversity, based on a different dieseldesign and plant location relative to the other twodiesels. Because of the aspect of diversity, theanalysis neglected common-cause failures affect-ing all three diesel generators. The net effect is ahighly reliable emergency ac power capability. Inthose unlikely cases where all three diesel genera-tors fail, Grand Gulf relies on a steam-driven cool-ant injection system that can function until thestation batteries are depleted. At Grand Gulf thebatteries are sized to last for many hours prior todepletion so that there is a high probability of re-covering ac power prior to core damage. In addi-tion, there is a diesel-driven firewater systemavailable that can be used to provide coolantinjection in some sequences involving the loss ofac power.

Peach Bottom is an older model BWR that doesnot have a diverse diesel generator for the high-pressure core spray system. However, other fac-tors contribute to a low station blackout frequencyat Peach Bottom. Peach Bottom is a two-unit site,with four diesel generators available. Any one ofthe four diesels can provide sufficient capacity topower both units in the event of a loss of offsitepower, given that appropriate crossties or loadswapping between Units 2 and 3 are used. Thishigh level of redundancy is somewhat offset by aless redundant service water system that providescooling to the diesel generators. Subtleties in thedesign are such that if a certain combination ofdiesel generators fails, the service water systemwill fail, causing the other diesels to fail. In addi-tion, station dc power is needed to start the die-sels. (Some emergency diesel generator systems,such as those at Surry, have a separate dedicateddc power system just for starting purposes.) Inspite of these factors, the redundancy in thePeach Bottom emergency ac power system is con-siderable.

While there is redundancy in the ac power systemdesign at Peach Bottom, the most significant fac-tor in the low estimated station blackout fre-quency relates to the plant-specific data analysis.The plant-specific analysis determined that, be-cause of a high-quality maintenance program, thediesel generators at Peach Bottom had approxi-mately an order of magnitude greater reliabilitythan at an average plant. This factor directly influ-ences the frequency.

Finally, Peach Bottom, like Grand Gulf, has sta-tion batteries that are sized to last several hours inthe event that the diesel generators do fail. Withtwo steam-driven systems to provide coolant injec-tion and several hours to recover ac power priorto battery depletion, the station blackout fre-quency is further reduced.

Unlike most PWRs, the response of containmentis often a key in determining the core damage fre-quency for BWRs. For example, at Peach Bottom,there are a number of ways in which containmentconditions can affect coolant injection systems.High pressure in containment can lead to closureof primary system relief valves, thus failing low-pressure injection systems, and can also lead tofailure of steam-driven high-pressure injection sys-tems due to high turbine exhaust backpressure.High suppression pool temperatures can also leadto the failure of systems that are recirculatingwater from the suppression pool to the reactorcoolant system. If the containment ultimately fails,certain systems can fail because of the loss of net

8-13 NUREG-1 150


positive suction head in the suppression pool, andalso the reactor building is subjected to a harshsteam environment that can lead to failure ofequipment located there.

Despite the concerns described in the previousparagraph, the core damage frequency for PeachBottom is relatively low, compared to the PWRs,There are two major reasons for this. First, PeachBottom has the ability to vent the wetwell througha 6-inch diameter steel pipe, thus reducing thecontainment pressure without subjecting the reac-tor building to steam. While this vent cannot beused to mitigate ATWS and station blackout se-quences, it is valuable in reducing the frequencyof many other sequences. The second importantfeature at Peach Bottom is the presence of thecontrol rod drive system, which is not affected byeither high pressure in containment or contain-ment failure. Other plants of the BWR-4 designmay be more susceptible to containment-relatedproblems if they do not have similar features. Forexample, some plants have ducting, as opposed tohard piping available for venting. Venting throughductwork may lead to harsh steam environmentsand equipment failures in the reactor building.*

The Grand Gulf design is generally much less sus-ceptible to containment-related problems thanPeach Bottom. The containment design andequipment locations are such that containmentrupture will not result in discharge of steam intothe building containing the safety systems. Fur-ther, the high-pressure core spray system is de-signed to function with a saturated suppressionpool so that it is not affected by containment fail-ure. Finally, there are other systems that can pro-vide coolant injection using water sources otherthan the suppression pool. Thus, containment fail-ure is relatively benign as far as system operationis concerned, and there is no obvious need forcontainment venting.

Pressurized Water Reactor Observations

The three PWRs examined in this study reflectmuch more variety in terms of dominant plantdamage states than the BWRs. While the se-quence frequencies are generally low for most ofthe plant damage states, it is useful to understandwhy the variations among the plants occurred.

For LOCA sequences, the frequency is signifi-cantly lower at Surry than at the other two PWRs.A major portion of this difference is directly tied

*The staff is presently undertaking regulatory action torequire hard pipe vents in all BWR Mark I plants.

to the additional redundancy available in the in-jection systems. In addition to the normal high-pressure injection capability, Surry can crosstie tothe other unit at the site for an additional sourceof high-pressure injection. This reduces the coredamage frequency due to LOCAs and also certaingroups of transients involving stuck-open reliefvalves.

In addition, at Sequoyah there is a particularlynoteworthy emergency core cooling interactionwith containment engineered safety features inloss-of-coolant accidents. In this (ice condenser)containment design, the containment sprays areautomatically actuated at a very low pressure set-point, which would be exceeded for virtually allsmall LOCA events. This spray actuation, if notterminated by the operator can lead to a rapid de-pletion of the refueling water storage tank at Se-quoyah. Thus, an early need to switch torecirculation cooling may occur. Portions of thisswitchover process are manual at Sequoyah and,because of the timing and possible stressful condi-tions, leads to a significant human error probabil-ity. Thus, LOCA-type sequences are the dominantaccident sequence type at Sequoyah.

Station blackout-type sequences have relativelysimilar frequencies at all three PWRs. Station.blackout sequences can have very different char-acteristics at PWRs than at BWRs. One of themost important findings of the study is the impor-tance of reactor coolant pump seal failures. Dur-ing station blackout, all cooling to the seals is lostand there is a significant probability that they willultimately fail, leading to an induced LOCA andloss of inventory. Because PWRs do not have sys-tems capable of providing coolant makeup withoutac power, core damage will result if power is notrestored. The seal LOCA reduces the time avail-able to restore power and thus increases the sta-tion blackout-induced core damage frequency.New seals have been proposed for WestinghousePWRs and could reduce the core damage fre-quency if implemented, although they might alsoincrease the likelihood that any resulting accidentswould occur at high pressure, which has implica-tions for the accident progression analysis. (SeeSection C.14 of Appendix C for a more detaileddiscussion of reactor coolant seal performance.)

Apart from the generic reactor coolant pump sealquestion, station blackout frequencies at PWRsare determined by the plant-specific electricpower system design and the design of othersupport systems. Battery depletion times for thethree PWRs were projected to be shorter than forthe two BWRs. A particular characteristic of the

NUREG-1150 8-14


Surry plant is a gravity-fed service water systemwith a canal that may drain during station black-out, thus failing containment heat removal. Whenpower is restored, the canal must be refilled be-fore containment heat removal can be restored.

The dominant accident sequence type at Zion isnot a station blackout, but it has many similarcharacteristics. Component cooling water isneeded for operation of the charging pumps andhigh-pressure safety injection pumps at Zion. Lossof component cooling water (or loss of servicewater, which will also render component coolingwater inoperable) will result in loss of these high-pressure systems. This in turn leads to a loss ofreactor coolant pump seal injection. Simultane-ously, loss of component cooling water will alsoresult in loss of cooling to the thermal barrier heatexchangers for the reactor coolant pump seals.Thus, the reactor coolant pump seals will loseboth forms of cooling. As with station blackout,loss of component cooling water or service watercan both cause a small LOCA (by seal failure)and disable the systems needed to mitigate it. Theimportance of this scenario is increased further bythe fact that the component cooling water systemat Zion, although it uses redundant pumps andvalves, delivers its flow through a commonheader. The licensee for the Zion plant has madeprocedural changes and is also considering boththe use of new seal materials and the installationof modifications to the cooling water systems.These measures, which are discussed in more de-tail in Chapter 7, reduce the importance of thiscontributor.

ATWS frequencies are generally low at all three ofthe PWRs. This is due to the assessed reliability ofthe shutdown systems and the likelihood that onlyslow-acting, low-power-level events will result.

While of low frequency, it is worth noting thatinterfacing-system LOCA (V) and steam genera-tor tube rupture (SGTR) events do contribute sig-nificantly to risk for the PWRs. This is becausethey involve a direct path for fission products tobypass containment. There are large uncertaintiesin the analyses of these two accident types, butthese events can be important to risk even at fre-quencies that may be one or two orders of magni-tude lower than other sequence types.

During the past few years, most WestinghousePWRs have developed procedures for using feedand bleed cooling and secondary system blow-down to cope with loss of all feedwater. Theseprocedures have led to substantial reductions inthe frequencies of transient sequences involving

the loss of main and auxiliary feedwater. Appro-priate credit for these actions was given in theseanalyses. However, there are plant-specific fea-tures that will affect the success rate of such ac-tions. For example, the loss of certain powersources (possibly only one bus) or other supportsystems can fail power-operated relief valves(PORVs) or atmospheric dump valves or theirblock valves at some plants, precluding the use offeed and bleed or secondary system blowdown.Plants with PORVs that tend to leak may operatefor significant periods of time with the blockvalves closed, thus making feed and bleed less re-liable. On the other hand, if certain power failuresare such that open block valves cannot be closed,then they cannot be used to mitigate stuck-openPORVs. Thus, both the system design and plantoperating practices can be important to the reli-ability assessment of actions such as feed andbleed cooling.

8.4.4 External Events

The frequency of core damage initiated by exter-nal events has been analyzed for two of the plantsin this study, Surry and Peach Bottom (Ref. 8.1(Part 3) and Ref. 8.2 (Part 3)). The analysis ex-amined a broad range of external events, e.g.,lightning, aircraft impact, tornados, and volcanicactivity (Ref. 8.8). Most of these events were as-sessed to be insignificant contributors by means ofbounding analyses. However, seismic events andfires were found to be potentially major contribu-tors and thus were analyzed in detail.

Figures 8.7 and 8.8 show the results of the coredamage frequency analysis for seismic- and fire-initiated accidents, as well as internally initiatedaccidents, for Surry and Peach Bottom, respec-tively. Examination of these figures shows that thecore damage frequency distributions of the exter-nal events are comparable to those of the internalevents. It is evident that the external events aresignificant in the total safety profile of theseplants.

Seismic Analysis Observations

The analysis of the seismically induced core dam-age frequency begins with the estimation of theseismic hazard, that is, the likelihood of exceed-ing different earthquake ground-motion levels atthe plant site. This is a difficult, highly judgmentalissue, with little data to provide verification of thevarious proposed geologic and seismologic models.

The sciences of geology and seismology have notyet produced a model or group of models uponwhich all experts agree. This study did not itself

8-15s NUREG-1 150


produce seismic hazard curves, but instead madeuse of seismic hazard curves for Peach Bottomand Surry that were part of an NRC-fundedLawrence Livermore National Laboratory projectthat resulted in seismic hazard curves for all nu-clear power plant sites east of the Rocky Moun-tains (Ref. 8.9).

In addition, the Electric Power Research Institute(EPRI) developed a separate set of models (Ref.8.10). For purposes of completeness and com-parison, the seismically induced core damage fre-quencies were also calculated based upon theEPRI methods. Both sets of results, which are pre-sented in Figures 8.5 through 8.8, were used inthis study. More detailed discussion of methodsused in the seismic analysis is provided in Appen-dix A; Section C. 11 of Appendix C provides moredetailed perspectives on the seismic issue as well.

As can be seen in Figures 8.5 and 8.6, the shapesof the seismically induced core damage probabilitydistributions are considerably different from thoseof the internally initiated and fire-initiated events.In particular, the 5th to 95th percentile range ismuch larger for the seismic events. In addition, ascan be seen in Figures 8.7 and 8.8, the wide dis-parity between the mean and the median and thelocation of the mean relatively high in the distri-bution indicate a wide distribution with a tail atthe high end but peaked much lower down. (Thisis a result of the uncertainty in the seismic hazardcurve.)

It can be clearly seen that the difference betweenthe mean and median is an important distinction.The mean is the parameter quoted most often, butthe bulk of the distribution is well below themean. Thus, although the mean is the "center ofgravity" of the distribution (when viewed on a lin-ear rather than logarithmic scale), it is not veryrepresentative of the distribution as a whole. In-stead, it is the lower values that are more prob-able. The higher values are estimated to have lowprobability, but, because of their great distancefrom the bulk of the distribution, the mean is"pulled up" to a relatively high value. In a casesuch as this, it is particularly evident that the en-tire distribution, not just a single parameter suchas the mean or the median, must be consideredwhen discussing the results of the analysis.

1. Surry Seismic Analysis

The core damage frequency probability distribu-tions, as calculated using the Livermore and EPRImethods, have a large degree of overlap, and thedifferences between the means and medians of

the two resulting distributions are not very mean-ingful because of the large widths of the two distri-butions.

The breakdown of the Surry seismic analysis intoprincipal contributors is reasonably similar to theresults of other seismic PRAs for other PWRs. Thetotal core damage frequency is dominated by lossof offsite power transients resulting from seismi-cally induced failures of the ceramic insulators inthe switchyard. This dominant contribution of ce-ramic insulator failures has been found in virtuallyall seismic PRAs to date.

A site-specific but significant contributor to thecore damage frequency at Surry is failure of theanchorage welds of the 4 kV buses. These busesplay a vital role in providing emergency ac electri-cal power since offsite power as well as emergencyonsite power passes through these buses. Althoughthese welded anchorages have more than ade-quate capacity at the safe shutdown earthquake(SSE) level, they do not have sufficient margin towithstand (with high reliability) earthquakes in therange of four times the SSE, which are contribut-ing to the overall seismic core damage frequencyresults.

Similarly, a substantial contribution is associatedwith failures of thediesel generators and associ-ated load center anchorage failures. These an-chorages also may not have sufficient capacity towithstand earthquakes at levels of four times theSSE.

Another area of generic interest is the contribu-tion due to vertical flat-bottomed storage tanks,e.g., refueling water storage tanks and condensatestorage tanks. Because of the nature of their con-figuration and field erection practices, such tankshave often been calculated to have relativelysmaller margin over the SSE than most compo-nents in commercial nuclear power plants. Giventhat all PWRs in the United States use the refuel-ing water storage tank as the primary source ofemergency injection water (and usually the solesource until the recirculation phase of ECCS be-gins), failure of the refueling water storage tankcan be expected to be a substantial contributor tothe seismically induced core damage frequency.

2. Peach Bottom Seismic Analysis

As can be seen in Figure 8.9, the dominant con-tributor in the seismic core damage frequencyanalysis is a transient sequence brought about byloss of offsite power. The loss of offsite power isdue to seismically induced failures of onsite acpower. Peach Bottom has four emergency diesel

NUREG- 150 8-16


generators, all shared between the two units, andfour station batteries per unit. Thus, there is ahigh degree of redundancy. However, all dieselsrequire cooling provided by the emergency servicewater system, and failure to provide this coolingwill result in failure of all four diesels.

There is a variety of seismically induced equip-ment failures that can fail the emergency servicewater system and result in a station blackout.These include failure of the emergency coolingtower, failures of the 4 kV buses (in the samemanner as was found at Surry), and failures of theemergency service water pumps or the emergencydiesel generators themselves. The various combi-nations of these failures result in a large numberof potential failure modes and give rise to a rela-tively high frequency of core damage based onstation blackout. None of these equipment failureprobabilities is substantially greater than would beimplied by the generic fragility data available.However, the high probability of exceedance oflarger earthquakes (as prescribed by the hazardcurves for this site) results in significant contribu-tions of these components to the seismic risk.

Fire Analysis Observations

The core damage likelihood due to a fire in anyparticular area of the plant depends upon the fre-quency of ignition of a fire in the area, theamount and nature of combustible material in thatarea, the nature and efficacy of the fire-suppres-sion systems in that area, and the importance ofthe equipment located in that area, as expressedin the potential of the loss of that equipment tocause a core damage accident sequence. Themethods used in the fire analysis are described inAppendix A and in Reference 8.7; Section C.12of Appendix C provides additional perspectives onthe fire analysis.

1. Surry Fire Analysis

Figure 8.10 shows the dominant contributors tocore damage frequency resulting from the Surryfire analysis. The dominant contributor is a tran-sient resulting in a reactor coolant pump sealLOCA, which can lead to core damage. The sce-nario consists of a fire in the emergencyswitchgear room that damages power or controlcables for the high-pressure injection and compo-nent cooling water pumps. No additional randomfailures are required for this scenario to lead tocore damage. It should be noted that credit wasgiven for existing fire-suppression systems and forrecovery by crossconnecting high-pressure injec-tion from the other unit. The importance of this

scenario is evident in Figure 8.11, which breaksdown the fire-induced core damage frequency bylocation in the plant. The most significant physicallocation is the emergency switchgear room. In thisroom, cable trays for the two redundant powertrains were run one on top of the other with ap-proximately 8 inches of vertical separation in anumber of plant areas, which gives rise to thecommon vulnerability of these two systems due tofire. In addition, the Halon fire-suppression sys-tem in this room is manually actuated.

The other principal contributor is a spuriously ac-tuated pressurizer PORV. In this scenario, fire-re-lated component damage in the control room in-cludes control power for a number of safety sys-tems. Full credit was given for independence ofthe remote shutdown panel from the control roomexcept in the case of PORV block valves; discus-sions with utility personnel indicated that controlpower for these valves was not independentlyrouted.

2. Peach Bottom Fire Analysis

Figure 8.10 shows the mechanisms by which fireleads to core damage in the Peach Bottom analy-sis. Station blackout accidents are the dominantcontributor, with substantial contributions alsocoming from fire-induced transients and losses ofoffsite power. The relative importance of the vari-ous physical locations is shown in Figure 8.12.

It is evident from Figure 8.12 that control roomfires are of considerable significance in the fireanalysis of this plant. Fires in the control roomwere divided into two scenarios, one for fires initi-ating in the reactor core isolation cooling (RCIC)system cabinet and one for all others. Credit wasgiven for automatic cycling of the RCIC systemunless the fire initiated within its control panel.Because of the cabinet configuration within thecontrol room, the fire was assumed not to spreadand damage any components outside the cabinetwhere the fire initiated. The analysis gave creditfor the possibility of quick extinguishing of the firewithin the applicable cabinet since the controlroom is continuously occupied. However, shouldthese efforts fail, even with high ventilation rates,these scenarios postulate forced abandonment ofthe control room due to smoke from the fire andsubsequent plant control from the remote shut-down panel.

The cable spreading room below the control roomis significant but not dominant in the fire analysis.The scenario of interest is a fire-induced transientcoupled with fire-related failures of the controlpower for the high-pressure coolant injection

8-17 NUREG-1150


system, the reactor core isolation cooling system,the automatic depressurization system, and thecontrol rod drive hydraulic system. The analysisgave credit to the automatic CO2 fire-suppressionsystem in this area.

The remaining physical areas of significance arethe emergency switchgear rooms. The fire-in-duced core damage frequency is dominated byfire damage to the emergency service water systemin conjunction with random failures coupled withfire-induced loss of offsite power. In all eightemergency switchgear rooms (four shared be-tween the two units), both trains of offsite powerare routed. It was noted that in each of these ar-eas there are breaker cubicles for the 4 kVswitchgear with a penetration at the top that hasmany small cables routed through it. These pene-trations were inadequately sealed, which would al-low a fire to spread to cabling that was directlyabove the switchgear room. This cabling was a suf-ficient fuel source for the fire to cause a rapid for-mation of a hot gas layer that would then lead to aloss of offsite power. Since both offsite power andthe emergency service water systems are lost, astation blackout would occur.

Perspectives: General Observations on FireAnalysis

Figures 8.7 and 8.8 clearly indicate that

fire-initiated core damage sequences are signifi-cant in the total probabilistic analysis of the twoplants analyzed. Moreover, these analyses alreadyinclude credit for the fire protection programs re-quired by Appendix R to 10 CFR Part 50.

Although the two plants are of completelydifferent design, with completely different fire-initiated core damage scenarios, the possibility offires in the emergency switchgear areas is impor-tant in both plants. The importance of the emer-gency switchgear room at Surry is particularly highbecause of the seal LOCA scenario. Further, theimportance of the control room at Surry is compa-rable to that of the control room at Peach Bottom.

This is not surprising in view of the potential forsimultaneous failure of several systems by fires inthese areas. Thus, in the past such areas havegenerally received particular attention in fire pro-tection programs. It should also be noted that thesignificance of various areas also depends uponthe scenario that leads to core damage. For exam-ple, the importance of the emergency switchgearroom at Surry could be altered (if desired) notonly by more fire protection programs but also bychanges in the probability of the reactor coolantpump seal failure.

NUREG-1 150 8-18


REFERENCES FOR CHAPTER 8

8.1 R. C. Bertucio and J. A. Julius, "Analysis ofCore Damage Frequency: Surry Unit 1,"Sandia National Laboratories, NUREG!CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990.

8.2 A. M. Kolaczkowski et al., "Analysis ofCore Damage Frequency: Peach BottomUnit 2," Sandia National Laboratories,NUREG/CR-4550, Vol. 4, Revision 1,SAND86-2084, August 1989.

8.3 R. C. Bertucio and S. R. Brown, "Analysisof Core Damage Frequency: Sequoyah Unit1," Sandia National Laboratories, NUREG/CR-4550, Vol. 5, Revision 1, SAND86-2084, April 1990.

8.4 M. T. Drouin et al., "Analysis of Core Dam-age Frequency: Grand Gulf Unit 1," SandiaNational Laboratories, NUREGICR-4550,Vol. 6, Revision 1, SAND86-2084, Septem-ber 1989.

8.5 M. B. Sattison and K. W. Hall, "Analysis ofCore Damage Frequency: Zion Unit ,"Idaho National Engineering Laboratory,NUREG/CR-4550, Vol. 7, Revision 1,EGG-2554, May 1990.

8.6 USNRC, "Reactor Safety Study-An Assess-ment of Accident Risks in U. S. CommercialNuclear Power Plants," WASH-1400(NUREG-75/014), October 1975.

8.7 H. J. C. Kouts et al., "Special CommitteeReview of the Nuclear Regulatory Commis-sion's Severe Accident Risks Report(NUREG-1150)," NUREG-1420, August1990.

8.8 M. P. Bohn and J. A. Lambright, "Proce-dures for the External Event Core DamageFrequency Analyses for NUREG-1150,"Sandia National Laboratories, NUREG/CR-4840, SAND88-3102, November 1990.

8.9 D. L. Bernreuter et al., "Seismic HazardCharacterization of 69 Nuclear Power SitesEast of the Rocky Mountains," LawrenceLivermore National Laboratory, NUREG/CR-5250, Vols. 1-8, UCID-21517, January1989.

8.10 Seismicity Owners Group and Electric PowerResearch Institute, "Seismic Hazard Meth-odology for the Central and Eastern UnitedStates," Electric Power Research Institute,EPRI NP-4726, July 1986.

8-19 NUREG- 1150

9. PERSPECTIVES ON ACCIDENT PROGRESSION ANDCONTAINMENT PERFORMANCE

9.1 Introduction

The consequences of severe reactor accidents de-pend greatly on containment safety features andcontainment performance in retaining radioactivematerial. The early failure of the containmentstructures at the Chernobyl power plant contrib-uted to the size of the environmental release ofradioactive material in that accident. In contrast,the radiological consequences of the Three MileIsland Unit 2 (TMI-2) accident were minor be-cause overall containment integrity was main-tained and bypass was small. Normally three barri-ers (the fuel rod cladding, the reactor coolantsystem pressure boundary, and the containmentpressure boundary) protect the public from the re-lease of radioactive material generated in nuclearfuel. In most core meltdown scenarios, the firsttwo barriers would be progressively breached, andthe containment boundary represents the finalbarrier to release of radioactivity to the environ-ment. Maintaining the integrity of the contain-ment can affect the source term by orders of mag-nitude. The NRC's 1986 reassessment of sourceterm issues reaffirmed that containment perform-ance "is a major factor affecting source terms"(Ref. 9.1).

In most severe accident sequences, the ability of acontainment boundary to maintain integrity isdetermined by two factors: (1) the magnitude ofthe loads, and (2) the response to those loads ofthe containment structure and the penetrationsthrough the containment boundary. Althoughthere is no universally accepted definition of con-tainment failure, it does not necessarily implygross structural failure. For risk purposes, contain-ment is considered to have failed to perform itsfunction when the leak rate of radionuclides tothe environment is substantial. Thus, failure couldoccur as the result of a structural failure of thecontainment, tearing of the containment liner, ora high rate of a leakage through a penetration.Finally, valves that are open during normal opera-tion may not close properly when the accident oc-curs. Failure of the containment isolation systemcan result in leakage of radioactive material to asecondary building or directly to the environment.

In some accidents, the containment building iscompletely bypassed. In interfacing-system loss-of-coolant accidents (LOCAs), check valves iso-lating low-pressure piping fail, and the piping con-

nected to the reactor coolant system fails outsidethe containment. The radionuclides can escape tosecondary buildings through the reactor coolantsystem piping without passing through the contain-ment. A similar bypass can occur in a core melt-down sequence initiated by the rupture of a steamgenerator tube in which release is through reliefvalves on the steam line from the failed steamgenerators.

Although the five plants analyzed in the presentstudy were selected to span the basic types of con-tainment design used in the United States, itcannot be assumed that the containmentperformance results obtained are characteristic ofa class of plants. The loads in an accidentsequence, the relative frequencies of specificaccident sequences, and the load level at whichthe containment fails can all be influenced bydesign details that vary among reactors within aclass of containments. (Additional discussion ofthe extrapolability of PRA results is provided inChapter 13.)


If the containment function is maintained in a se-vere accident, the radiological consequences willbe minor. If the containment function does fail,the timing of failure can be very important. Thelonger the containment remains intact relative tothe time of core melting and radionuclide releasefrom the reactor coolant system, the more time isavailable to remove radioactive material from thecontainment atmosphere by engineered safety fea-tures or natural deposition processes. Delay incontainment failure or containment bypass alsoprovides time for protective action, a very impor-tant consideration in the assessment of possibleearly health effects. Thus, in evaluating the per-formance of a containment, it is convenient toconsider no failure, late failure, bypass, and earlyfailure of containment as separate categories char-acterizing different degrees of severity. For thoseplants in which intentional venting is an option,this is also represented as a separate category.

Not all accident sequences that involve core dam-age would necessarily progress to vessel failure, asillustrated by the TMI-2 accident. The operatormay recover a critical system (such as by the re-turn of offsite power) or the state of the plant maychange (for example, the system pressure may fallto a point where low-pressure emergency coolant

9-1 NUREG-1150

9. Accident Progression

systems can be activated) allowing the core to berecovered and the accident to be terminated. Thelikelihood of containment failure in terminatedaccidents is typically less than in accidents involv-ing vessel failure, and the radiological conse-quences are usually very small.

9.2.1 Internal Events

The probability of early containment failure andvessel breach conditional on the indicated class ofsequence (and the mean frequency of the class) isillustrated in Figure 9.1 for three classes of acci-dent sequences in the pressurized water reactors(PWRs) analyzed in this study and in Figure 9.2for three classes of accident sequences in the boil-ing water reactors (BWRs) analyzed (Refs. 9.2through 9.6). Containment bypass scenarios arenot included in these figures, and the results arefor internally initiated accidents. For differentplant designs, the nature of the loads and the re-sponse of the containment are different, even forthe same accident class.

The predicted likelihoods of early containmentfailure in the Zion (large, dry design) plant andthe Surry (subatmospheric design) plant are quitesmall (mean value of about 1 percent). The prin-cipal mechanisms leading to these failures areloads resulting from high-pressure melt ejection inaccident sequences with high reactor coolant sys-tem (RCS) pressures (at time of vessel breach)and in-vessel steam explosions in sequences withlow RCS pressures at vessel breach. Both phe-nomena involve substantial uncertainties.

The principal reason that the probability of earlycontainment failure from loads at vessel breach isso small in the Surry and Zion analyses is that thereactor coolant system is not likely to be at highpressure when vessel meltthrough occurs. Some ofthe mechanisms that were found to be effective indepressurizing the vessel are hot leg or surge linefailure at elevated temperature, failure of a reac-tor coolant pump seal, or a stuck-open reliefvalve. If an extreme case at Surry is selected,which is a large core fraction ejected, a dry cavity,no sprays, a large hole in the vessel, and high re-actor coolant system pressure, the conditionalprobability of containment failure is approximately30 percent. However, this is a very unlikely case.For cases with small holes in the reactor vesseland a small or intermediate fraction of the coreejected, which are much more likely, the prob-ability of containment failure is a few percent orless.

For accident sequences at Surry and Zion inwhich core uncovery is initiated with the reactor

coolant system at high pressure, the probability ofoverheating and rupturing steam generator tubesafter the onset of core damage, with subsequentbypass of the containment, is of the same magni-tude as the probability of early containment fail-ure from high-pressure ejection of core debriswith direct containment heating. In Figure 9.1,the smaller spread in uncertainty in the downwarddirection for the Zion plant is due to the higherfrequency of containment isolation failure, whichestablishes a lower bound for the distribution.

The results for the Sequoyah plant indicate thatearly containment failure is somewhat more likelyfor ice condenser designs than for large, high-pressure containments. The mean likelihood ofearly failure is approximately 12 percent (8 per-cent includes vessel breach, 4 percent does not).Early containment failure is primarily the result ofloads at vessel failure. For scenarios in which thevessel is at high pressure at the time of vesselbreach, early failure results from overpressuriza-tion (including the pressure load from hydrogenburning) or from direct attack of the containmentby hot debris following failure of the seal table. Ifthe vessel is at low pressure at vessel breach, theprincipal failure mechanism is overpressurization.

The predicted probability of early failure ofthe Peach Bottom and Grand Gulf pressure-suppression containments is substantially higherthan for the PWR containment designs. ForGrand Gulf, the mean probability of early failureis approximately 50 percent while at Peach Bot-tom the mean probability of early failure is about56 percent.

In the Peach Bottom (Mark I design) plant, fail-ure is predicted to occur primarily in the drywellas a result of direct attack by molten core debris.Drywell rupture due to pedestal failure or rapidoverpressurization (more quickly than the watercolumns in the vent lines can be cleared) is alsoan important contributor to early containmentfailure. If failure occurs in the drywell, releases ofradionuclides from fuel after vessel failure will notpass through the suppression pool. Late failure ofcontainment is also most likely to occur in thedrywell but in the form of prolonged leakage pastthe drywell head.

At Grand Gulf, early containment failure instation blackout is dominated by hydrogen defla-grations. Hydrogen detonations are also smallcontributors to early failure. For short-term sta-tion blackouts (the dominant plant damage stategroups), the conditional probability of early

NUREG-1 150 9-2


Conditional Probability

9.SE- y-IT e yni1.OE-OI 2.SE-5 yr-I I_ .

1.QE-02 6 th

I.OE-03

1.OE-04Surry Zion Sequoyah

a. tation blackout

Conditional Probability1.OEOO

3.6E-5 yr-i _5th

I.O2-013iE-A Yr-i

1.oE-02 _i _ _ thO.IE-8 yr-i flmda

I.OE-03

I.OE-0 -

Surry Zion Sequoyah

b. Lose-of-coolant accidents

Conditional ProbabilityI.OEOO _

oath

2.SE-8 yr-iI.OE-0 ,.4E-5 Yr-i

modian

I.OE-02 _th

1.8E-8 yr-i

1.OE-04

I.OE-04LSurry Zion Sequoysh

c. Transients

Figure 9.1 Conditional probability of early containment failure for key plant damagestates (PWRs).

9-3 NUREG- 1150


Conditional Probabilityt OE-OO _H21t-i5 yr-I fl_ 4.0E- yrt1

tOE-Ot

median

t.OE-02 tth

1.OE-03

1.0E-04Peach Bottom Grand Quit

a. atation blaokout

Conditional Probability1.02400 ttE-C yr-I 1.1E-7 yr-I

1.05-01 Imedian

1.0E-02 _ th

t.OE-03

1.0E-04Peach ottom Grand Gulf

b. Anticipated transients without scram

Conditional ProbabilityIOOan-

I.OE-01

1.02-02

1.0E-03

t.OE-04

1 .E-7 yr-I 1t9E-8 yr-I _ 96th

median

8 th

Peach Bottom Grand Gult

c. Transients

Figure 9.2 Conditional probability of early containment failure for key plant damagestates (BWRs).

NUREG-1 150 9-4


containment failure is 50 percent. About half ofthe early containment failures occur before vesselbreach, and the other half occur at or shortly aftervessel breach. For the long-term station black-outs, the mean conditional probability of earlycontainment failure is 85 percent.

The probability of drywell failure at Grand Gulf issomewhat less than that of containment failureand occurs in approximately one-half the earlycontainment failures. Drywell failures before ves-sel breach result from rapid hydrogen deflag-rations in the wetwell. At the time of vesselbreach, however, drywell failures are primarilyfrom drywell pressurization loads at vessel breach(steam blowdown, direct containment heating, ex-vessel steam explosions, and hydrogen combus-tion). Failure of the drywell is more likely whenvessel breach occurs with the vessel at high pres-sure.

Intentional venting of the containment was con-sidered to prevent overpressurization failure of thecontainment for both Peach Bottom and GrandGulf. The mean probability of sequences in whichcontainment venting occurs and no containmentfailure occurs is approximately 10 percent forPeach Bottom station blackout sequences and 4percent for Grand Gulf. The values are small,mostly because of the high probability of early fail-ure mechanisms for which venting is ineffective.Furthermore, for the short-term station blackoutplant damage state that dominates the core meltfrequency at Grand Gulf, ac power is not availableinitially to permit venting.

Figure 9.3 illustrates the frequency of early failureor bypass of containment (the two types of failurewith the potential for a large release of radionu-clides) for internally initiated accidents in each ofthe five plants. (Peach Bottom scenarios in whichthe containment has been vented but subsequentearly containment failure has occurred are catego-rized as early containment failures.) Note that, ona basis of absolute frequency, early containmentfailure or bypass for the BWR designs analyzed issimilar to that of the PWRs because of the lowerpredicted frequency of core damage in the BWRs.

The relative probabilities of early containmentfailure, bypass, late failure, venting, and no con-tainment failure are illustrated in Figure 9.4 foreach of the plants. For the Surry plant, the likeli-hood of bypass, an interfacing-system LOCA, orsteam generator tube rupture is somewhat greaterthan that of early failure from severe accidentloads. In Figure 9.4, the capability of the Zion

plant to avoid a large early release of radioactivematerial appears to be particularly good becauseof the small fraction of failures that result in eitherearly failure or bypass.

It should be noted that the averaging of contain-ment failure mode probabilities for different plantdamage states can be misleading. To a large de-gree, the relative probability of bypass at Zion issubstantially smaller than at Surry because the fre-quency of plant damage states, other than the in-terfacing-system LOCA, is higher. On an absolutefrequency scale, as shown in Figure 9.3, the per-formances of the Surry and Zion containments insevere accidents are quite similar. In Sequoyah,the probability of early failure is somewhat largerthan for the other PWRs analyzed and on a fre-quency-weighted mean basis is essentially thesame as for bypass. The most likely outcome forthese plants is that the containment will not fail.

Using early containment failure or containmentbypass as a measure for comparison, the perform-ance of the two BWR containments analyzed doesnot appear as good as the performance of thePWR. containments. It is important to recognizethat early containment failure or bypass is a pre-requisite for a large release of radionuclides, butthat mitigative features within the plant can sub-stantially limit the release that occurs. This is par-ticularly true for the pressure-suppression contain-ment designs, where the suppression pool or icecondenser can retain radionuclides even if thecontainment has failed. (The BWR frequency ofbypass is assessed to be quite small. Therefore,only early failures (with the potential for someradionuclide scrubbing by the suppression pool)are important.) The frequency of release of differ-ent quantities of radionuclides is discussed inChapter 10.

9.2.2 External Events

Plant damage states that result from externalevents are quite similar to those that arise frominternally initiated accidents except that their rela-tive frequencies differ substantially. In addition,containment status may be affected by the initiat-ing event. Figure 9.5 illustrates the relative prob-abilities of early containment failure, bypass, latefailure, venting, and no failure (no vessel breachor vessel breach with no containment failure) forthe two plants for which external-event analyseswere performed. The results for internal initiators,fire, and seismic are compared in the figure. Theimportance of early containment failure relative tothe importance of bypass is reversed in the Surry

9-5 NUREG-1 150


Frequency of Early Failure or Bypass (yr )1.OE-04

1.OE-05

1.OE-06

j- 96thmeanmedian

6 th

Uft1 .OE-07

1.OE-08Surry Zion Sequoyah Peach Grand

Bottom Gulf

Figure 9.3 Frequency of early containment failure or bypass (all plants).

NUREG-1 150 9-6


Surry Zion

Late Failure

Bypass

EarlyFailure

Failure

Bypass

EarlyFailure

wwyNo Vessel Breac

orVessel Breach/No Containment Failure

No Vessel Breaor

Vessel Breach/No Containment Failure

Sequoyah

Late Failure

Bypass

EarlyFailure

No Vessel Breaor


Peach Bottom Grand Gulf

Early Failure Early Failure

VentLate Failure

No Vessel Breaccor


Late Failure

Vent

Vssel Breach

or


Figure 9.4 Relative probability of containment failure modes (internal events).

9-7 NUREG-1150


Surry - Internal Events

Late Failure

EarlyFailure

No Vessel Ue

or


Surry- Fire

I n_---..,~ Late Failure

Peach Bottom - Internal Events

Early Failure

Late Fail C .:: Vent

No Vessel Breor


Peach Bottom - Fire

Early Failure

EarlyFailure

No Vessel B r

orVessel Breach/No Containment Failure

Surry - Seismic

Late Failure

No Vessel rea

or

Vessel Breaeh/No Containment Failure

Ven t

Vessel BreachLate Failr


Peach Bottom - Seismic

bypassEarly

FailureEarly

FailureVent

LateFailure

Figure 9.5 Relative probability of containment failure modes (internal and external events,Surry and Peach Bottom).

NUREG-1150 9-8


external-event analysis compared to the internalanalysis. In the seismic analysis, the conditionalprobability of early failure is predicted to increasesignificantly (to approximately 8 percent). The in-creased failure likelihood is associated with sub-stantial motion of the reactor coolant system com-ponents in an earthquake and resulting damage tothe containment. In the fire analysis, there are noexternally initiated bypass accidents, the likeli-hood of bypass induced by overheating of steamgenerator tubes is assessed to be negligible, andthere is only a very slight increase in early contain-ment failure.

Perspectives on the differences between external-event and internal-event containment perform-ance for the Peach Bottom plant are similar tothose described for Surry. In the fire analysis,some increase in early containment failure is pre-dicted. In the fire sequences, there is a reducedpotential for the recovery of ac power, which re-sults in a reduced probability of injection recoveryand an increased likelihood of drywell shellmeltthrough.

In the BR seismic analysis, the probability ofcontainment survival in a severe accident is small;the increased likelihood of early containment fail-ure is the result of substantial motion of the reac-tor vessel and subsequent damage to the contain-ment during a major earthquake (well beyond theplant's design level) and a reduced recovery po-tential that increases the likelihood of contain-ment failure as described for the fire sequences.

9.2.3 Additional Summary Results

Based on the results of the five-plant risk analysessummarized in Chapters 3 through 7, and dis-cussed in detail in References 9.2 through 9.6, thefollowing perspectives on containment perform-ance in severe accidents can be drawn.

Zion and Surry Plants (Large, Dry andSubatmospheric Designs)

0 Large, dry and subatmospheric containmentdesigns appear to be quite robust in theirability to contain severe accident loads. Thisstudy shows a high likelihood of maintainingintegrity throughout the early phases of se-vere accidents in which the potential for alarge release of radionuclides is greatest. Theuncertainties in describing the magnitude ofsevere accident loads at vessel breach forpressurized scenarios and the likelihood of

depressurization prior to lower head failureare large, however.

* Containment bypass sequences (severe acci-dents initiated by steam generator tube rup-tures, tube ruptures induced by hot circulat-ing gases, or interfacing-system LOCAs)represent a substantial fraction of high-consequence accidents. The absolute fre-quency of these types of failure is small, how-ever.

* The potential exists for the arrest of coredegradation in a significant fraction of coredamage scenarios within the reactor vessel asthe result of recovery procedures (such as inthe TMI-2 accident). The likelihood of con-tainment failure is very small in these scenar-ios.

* A substantial likelihood exists that the con-tainment will remain intact even if the acci-dent progresses beyond the point of lowerhead failure.

* The likelihood of early containment failure inseismic events is higher than for internallyinitiated accidents.

Sequoyah Plant (Ice Condenser Design)

* The likelihood of early failure in a severe ac-cident for the Sequoyah plant is higher thanfor the large, dry and subatmospheric designsbut is less than for the BWRs analyzed. Earlyfailure is primarily associated with loads im-posed at the time of vessel breach (from anumber of mechanisms, including direct con-tainment heating and hydrogen combustion).

* Containment rupture from high overpressureloads at the time of vessel breach is likely toresult in significant damage to the contain-ment wall and effective bypass of the ice bed.

* Containment bypass is potentially an impor-tant contributor to the frequency of a largeearly release of radioactive material.

* The high likelihood of a deeply flooded reac-tor cavity plays an important role in mitigat-ing severe accident consequences at Se-quoyah. The deeply flooded cavity assists inreducing the loads at vessel breach, in pre-venting direct attack of molten fuel debris onthe containment wall, and in avoiding moltencore-concrete interactions.

9-9 NUREG-1150


* There is substantial potential for the arrest ofcore damage prior to vessel failure. There is,however, some likelihood of containmentfailure from hydrogen combustion events.

* A substantial likelihood exists for contain-ment integrity to be preserved throughout asevere accident, even if the accident pro-gresses beyond vessel breach.

Peach Bottom Plant (Mark I Design)

* The analyses indicate a substantial likelihoodfor early drywell failure in severe accidentscenarios, primarily as the result of directattack of the drywell shell by molten core de-bris.

* Considerable uncertainty exists regarding thelikelihood of failure of the drywell as the re-sult of direct attack by core debris. Althoughthis is the dominant failure mechanism in theanalyses, other loads on the drywell can leadto early drywell failure, such as rapid over-pressurization of the drywell. A sensitivitystudy was performed in which the drywellmeltthrough mechanism of failure was elimi-nated. The resulting reduction in mean earlycontainment failure probability was from0.56 to 0.2 (Ref. 9.3).

* The principal benefit of wetwell venting indi-cated by the study is in the reduction of thecore damage frequency. Although venting isnot effective in eliminating some early dry-well failure mechanisms, venting could elimi-nate other sequences that would result inoverpressure failure of the containment.

* There is substantial potential for the arrest ofcore damage prior to vessel failure. The like-lihood of containment failure in arrested sce-narios is small.

* The likelihood of early containment failure ishigher for fire and seismic events than inter-nally initiated accidents because of the de-creased likelihood of ac and dc recovery re-sulting in higher drywell shell meltthroughprobabilities.

Grand Gulf Plant (Mark III Design)

* Grand Gulf containment was predicted to failat or before vessel breach in a substantialfraction of severe accident sequences. Hy-

drogen deflagration is the principal mecha-nism for early containment failure.

* Failure of the integrity of the drywell is pre-dicted to accompany containment failure inapproximately one-half the sequences involv-ing early containment failure (resulting in by-pass of the suppression pool for radionuclidesreleased after vessel breach). Drywell failureis primarily the result of loads from rapidcombustion events prior to reactor vesselbreach and loads at vessel breach associatedwith overpressurization by direct containmentheating, ex-vessel steam explosions, and hy-drogen combustion in the wetwell region.Scrubbing of releases occurring before vesselbreach can still occur in sequences in whichthe drywell fails and the suppression pool iseventually bypassed.

* There is a large potential for the arrest ofcore damage prior to vessel failure. If largequantities of hydrogen are produced in theprocess of recovery, hydrogen combustioncould result in containment failure.

* Venting was not found to be particularly ef-fective in preventing containment failure foraccident scenarios involving core damage.Furthermore, venting was not as effective inreducing core damage frequency in GrandGulf as it was in Peach Bottom.


Prior to the time the Reactor Safety Study (RSS)(Ref. 9.7) analyses were undertaken, there hadbeen no relevant experimentation or modeling ofeither the loads produced in a severe accident orthe response of a containment to loads exceedingthe design basis. As a result, the characterizationof containment performance in the RSS is simplis-tic in comparison to the present study.

Containment Failure Modes

Figure 9.6 compares estimates for the presentstudy with those of the RSS for the cumulativefailure probability as a function of internal pres-sure for the Surry plant. The current study indi-cates that the Surry containment is substantiallystronger than did the RSS characterization. In theRSS analyses, failure was assumed to involve rup-ture of the containment with substantial leakage tothe environment. The current study subdividesfailure into different degrees of leakage. Failure atthe low-pressure end of the range would most

NUREG-1 150 9-10


1

0.8

0.6

0.4

0.2

0

Cumulative Failure Probability

0 20 40 60 80 100 120

Pressure (Psig)

140 160 180 200

Figure 9.6 Comparison of containment failure pressure with Reactor Safety Study (Surry).

Cumulative Failure ProbabilityI

0.8

0.6

0.4

0.2

00 20 40 60 80 100 120 140 160 180 200 220 240

Pressure (Psig)

Figure 9.7 Comparison of containment failure pressure with Reactor Safety Study (PeachBottom).

9-11 NUREG-1 150


likely be the result of limited leakage, such as fail-ure at a penetration rather than a substantial rup-ture of the containment wall. As the failure pres-sure increases, the likelihood of rupture versusleakage also increases. At pressures close to theultimate strength of the shell, the potential forgross rupture of the containment exists but wasfound to be unlikely.

Figure 9.7 compares the current study with RSSestimates for cumulative failure probability as afunction of pressure for the Peach Bottom plant(Mark I design). The curves are quite similar,with the current perspective being of a slightly lessstrong containment than the RSS representation.The curve presented from the current study is rep-resentative of a cool drywell (less than 500° F).Cumulative distributions were also developed inthe current study for higher drywell temperatures.At 1200° F the median failure pressure was as-sessed to be 45 psig as opposed to 150 psig at lowtemperatures.

Failure location in the Mark I design can be asimportant as failure time. In the RSS, the mostlikely failure location was assessed to be at the up-per portion of the toroidal suppression pool. Itwas assumed that, following containment failure,the pool would no longer be effective in scrubbingradioactive material. In the current analyses,other mechanisms of containment failure, such asdirect attack of the drywell wall by molten coredebris, were found to be more important thanoverpressure failure. The dominant location ofoverpressure failure is assessed to be the lifting ofthe drywell head by stretching the head bolts.Gases leaking past the head enter the refuelingbay where limited radionuclide retention is ex-pected rather than into the reactor building wheremore extensive retention could occur. (However,the leakage into the reactor building can also re-sult in severe environments that can cause equip-ment failure.) Another structural failure fromoverpressure identified as likely in this study is atthe bellows in the downcomer, which would resultin leakage from the wetwell vapor space to the re-actor building. Thus, although the estimated fail-ure pressures identified in this study and in theRSS are quite similar, the modes and locations offailure are quite different.

Comparison of Surry Results

Risk in the RSS is dominated by a few key se-quences for each plant. Containment performancein these sequences was a major aspect of their risksignificance. The three key sequences for Surry

were station blackout, an interfacing-systemLOCA, and the failure of an instrumentation linepenetrating the lower head. Figure 9.8 illustratesthe range of early failure probability for stationblackout in the current analyses and provides thepoint estimate from the RSS as a comparison. TheRSS estimate of early failure likelihood is substan-tially higher than the present analysis even thoughthe phenomenon of direct containment heatinghad not been identified at the time of the RSS. Inaddition to the lower assumed failure pressure ofthe containment, the RSS prediction of the rate ofcontainment pressurization was unrealisticallyhigh.

The current perspective on the behavior of theinterfacing-system LOCA in which the break oc-curs outside the containment resulting in bypass isessentially the same as in the RSS. The RSS didnot identify the potential for rupture of a steamgenerator tube as a potentially important initiatorof a severe accident.

The third important sequence in the RSS, involv-ing an instrumentation line rupture, is no longerconsidered a core meltdown sequence. In the RSSanalyses, if the containment spray injection pumpswere to fail, damage was assumed to occur to thespray recirculation pumps resulting in loss of con-tainment heat removal, containment failure, andconsequent loss of emergency coolant makeupwater to the vessel. More detailed analyses (Ref.9.8) indicate, however, that condensed steamwould provide sufficient water in the containmentsump to prevent damage to the recirculation spraypumps, avoiding conditions resulting in contain-ment failure and core meltdown.

Comparison of Peach Bottom Results

In the RSS analyses for the Peach Bottom plant,two sequences dominated the risk: a transientevent with loss of long-term heat removal from thesuppression pool and an anticipated transientwithout scram (ATWS). Loss of long-term heatremoval is an extended accident in which heatingof the suppression pool leads to overpressure fail-ure of the containment and consequent loss ofmakeup water to the vessel. With the proceduresnow available to vent the Peach Bottom contain-ment to outside the reactor building, the likeli-hood of loss of long-term heat removal leading tocore meltdown has been reduced to the pointwhere it is no longer a substantial contributor tocore damage frequency or risk.

In the RSS analyses, early containment failure wasconsidered a certainty in the ATWS sequence.

NUREG-1 150 9-12


Probability of Early Containment Failure1.0

0.8h

0.6 F

96thReactor Safe

* $ Study

Reactor S ety

Study

median_mean

oathGth

fl mean

ty

0.4

0.2

0.0Station Blackout

SurryATWS

Peach Bottomegend

[3- mean -E median0 95th % E Sth %

Figure 9.8 Comparison of containment performance results with Reactor Safety Study(Surry and Peach Bottom).

Figure 9. 8 indicates that early failure is stillconsidered quite likely for this sequence. Themechanisms resulting in failure and location offailure are different, however.

In summary, changes have occurred in predictingcontainment performance for the two plants ana-lyzed in the RSS. There have been substantial im-provements in the ability to model severe accidentphenomena and system behavior in severe acci-dents. For Surry, the high likelihood of maintain-ing containment integrity indicated in the presentstudy is the most significant difference in perspec-tive between the two studies.

9.4 Perspectives

9.4.1 State of Analysis Methods

The analysis of severe accident loads and contain-ment response involves substantial uncertainty be-cause of the complexity of core meltdown proc-esses. After a decade of research into severeaccident phenomena subsequent to the TMI-2 ac-cident, methods of analysis have been developedthat are capable of addressing nearly every aspectof containment loads, including hydrogen defla-

gration and detonation and core-concrete interac-tions. In some instances, such as direct attack ofthe Mark I containment shell by molten materialand direct containment heating, research is stillbeing pursued (Ref. 9.9). Although the residualuncertainties are in some instances great, themethods are adequate to support meaningfulLevel 2 PRA analyses.

The accident progression event tree analysis tech-niques developed for this study involve a very de-tailed consideration of threats to containment in-tegrity. A number of large computer analyses wererequired to support the quantification of eventprobabilities at each branch of the event tree. Theanalysis team for this study had the considerableadvantage of access to researchers involved in thedevelopment and application of computer codesused in the analysis of core melt progression,core-concrete attack, containment behavior,radionuclide release and transport, and hydrogencombustion.

Computer analyses cannot, in general, be used di-rectly and alone to calculate branching probabili-ties in the accident progression event tree. Sincethe greatest source of uncertainty is typicallyassociated with the modeling of severe accident

9-13 NUREG-1150


phenomena, the results of a single computer run(which uses a specific model) do not characterizethe branching uncertainty. It is therefore neces-sary to use sensitivity studies, uncertainty studies,and expert judgment to characterize the likeli-hood of alternative events that affect the course ofan accident. The effort undertaken in this study toelicit expert opinion was substantial. The expenseof the overall accident progression analysis tech-niques (expert elicitation and computer analysis tosupport event tree quantification) employed inthis study is currently a drawback to their wide-spread use. However, methods to apply the mod-els, the distributions, and the computer codes toother plants at a reasonable cost are under study.

9.4.2 Important Mechanisms That DefeatContainment Function During SevereAccidents

The challenges to containment integrity thatwould occur in a severe accident depend on thenature of the accident sequence, as well as thedesign of the plant. The various containment de-signs analyzed in this study responded differentlyto different severe accident challenges.

Containment Bypass and Isolation Failure

When an accident occurs, a number of valvesmust close to isolate the containment from the en-vironment. On the basis of absolute frequency,failure to isolate the containment was not found tobe a likely source of containment failure for anyof the plants analyzed. Primarily because of thelow frequency of early containment failure byother means, containment isolation failure is arelatively important contributor to early failure atZion. The subatmospheric containment andnitrogen-inerted Mark I containments are particu-larly reliable in this regard since it is highly likelythat leakage would be identified during operation.

Containment bypass is an important contributor tolarge early releases of radionuclides for the Surry(subatmospheric), Sequoyah (ice condenser), andZion (large, dry) containment designs. The princi-pal contributors are accidents initiated by interfac-ing-system LOCAs and by steam generator tuberuptures. The predicted frequency of these eventsis quite small, however, and their dominance ofrisk is the result of the relatively lower frequencyof other means to obtain large early releases.

Gas Combustion

Hydrogen and carbon monoxide are the two com-bustible gases potentially produced in large quanti-

ties in severe accidents. The principal source ofhydrogen is the reduction of steam by chemicalreaction of metals, particularly zirconium andiron. Carbon monoxide would only be producedin the later stages of an accident involving the at-tack of concrete by molten core debris. Becauseof the timing of carbon monoxide release, its pro-duction does not represent a threat of early failureto the containment but can contribute to delayedfailure.

Rapid gas combustion was not found to be a sub-stantial threat to containment for the Surry (sub-atmospheric), Zion (large, dry), or Peach Bottom(Mark I) containments. The Surry and Zion de-signs are sufficiently robust to survive deflagrations(rapid burning). At Surry and Zion, the likeli-hood of global detonations that could fail the con-tainment (by impulsive loads) was assessed to besmall. The contribution of hydrogen combustionto the pressure rise in the containment at the timeof vessel failure in the event of high-pressure meltejection of molten fuel was considered, but thelikelihood of early failure of containment was alsoassessed to be small.

Hydrogen combustion is not a threat to the MarkI design because it normally operates with a nitro-gen-inerted containment and thus has insufficientoxygen concentration to support combustion.

Hydrogen combustion was found to be a substan-tial threat to the integrity of the Sequoyah (icecondenser) and Grand Gulf (Mark III) designs. Avery small contribution, about 1 percent, to earlyfailure from hydrogen combustion prior to vesselbreach is predicted for the station blackout se-quences in Sequoyah. In arrested sequences, thecontainment failure probability is increased 5 per-cent because of ignition sources from the recoveryof ac power. Approximately 12 percent meanearly containment failure probability arises at thetime of vessel breach, largely as the result of hy-drogen combustion.

For the Grand Gulf plant, there is a substantiallikelihood of containment failure before vesselbreach in the short-term station blackout se-quence because of the unavailability of igniters. Atthe time of vessel breach, hydrogen combustionloads can again occur, which can fail the contain-ment (the percentages of containment failure be-fore and at vessel breach are similar). Two addi-tional reasons combine to make hydrogen eventsextremely important at Grand Gulf: (1) the BWRcore contains an extremely large amount of zirco-nium that is available for hydrogen production,and (2) the suppression pool is subcooled in the

NUREG-1150 9-14


short-term station blackout sequences resulting incondensation of the steam from the drywell or thevessel and leading to hydrogen-rich mixtures inthe containment that are readily ignited.

Loads at Vessel Failure

The increase in containment pressure that couldoccur at vessel failure represents an importantchallenge to containment for each of the five de-signs (see Appendix C). In the Zion (large, dry)and Surry (subatmospheric) designs, loads at ves-sel breach from high-pressure melt ejections(rapid transfer of heat from dispersed core debrisaccompanied by chemical reactions with unoxi-dized metals in the debris) represent a mechanismthat can result in containment loads high enoughto fail containment. The predicted likelihood offailure for these scenarios in the Surry and Ziondesigns was found to be small, in part becausemost high-pressure sequences were predicted todepressurize by one or more means prior to vesselfailure and because the overlap between the con-tainment load distribution and the containmentfailure distribution was small.

Although loads at vessel breach have been studiedmore extensively for PWR containments, theywere found to be an important contributor to earlycontainment failure in the Sequoyah (ice con-denser) and Peach Bottom (Mark I) plants and toearly drywell failure in Grand Gulf (Mark III). Inthe Sequoyah and Grand Gulf analyses, hydrogencombustion is also a principal contributor to earlycontainment failure from the loads at vesselbreach. At Grand Gulf, pedestal failure, due todynamic loads from ex-vessel steam explosions orsubcompartment pressure differential, can also re-sult in drywell failure at this stage of the accident.

Direct attack of the drywell shell is the dominantfailure mechanism at vessel breach in the PeachBottom plant. Overpressurization can also lead toleakage failure in the drywell by lifting the drywellhead or to failure in the wetwell.

Direct Attack by Molten Debris

Direct attack of the drywell wall by molten debrisin the Peach Bottom (Mark I) design has been thesubject of considerable controversy among severeaccident experts (see Section C.7 of AppendixC). Essentially half the experts whose opinionswere elicited believed that containment failurewould occur, and half believed that it would notoccur. The numerical aggregation of these diverseviews led to a mean likelihood of failure in the

present analysis of approximately 30 percent whenthe pedestal region is wet and 80 percent whenthe pedestal region is dry (Ref. 9.3).

Molten debris attack was also predicted to be athreat to the Sequoyah (ice condenser contain-ment) in high-pressure sequences in which moltendebris could be dispersed into the seal table room,which is outside the crane wall and adjacent to thesteel wall of the containment. The likelihood offailure was considerably less than for Peach Bot-tom, however.

Steam Explosions

When molten core material contacts water, thepotential exists for rapid transfer of heat, produc-tion of steam, and transfer of thermal energy tomechanical work. Considerable research has beenundertaken to determine the conditions underwhich steam explosions can occur and their ener-getics. At pressures near atmospheric, it is gener-ally concluded that steam explosions would belikely if molten core material drops into a pool ofwater. However, the energetics and coherence ofthe molten fuel-coolant interaction are very un-certain. At high steam pressure, steam explosionsare found to be more difficult to initiate.

Steam explosions represent a variety of potentialchallenges to the containment. If the interactionwere to occur in the reactor vessel at the timewhen molten core material slumps into the lowerplenum, the possibility exists of tearing loose theupper head of the vessel, which could impact andfail the containment (this has been called the "al-pha mode" of containment failure since the issu-ance of the RSS). The analyses in this study indi-cate that the potential for this type of event toresult in early containment failure is less than 1percent for each of the plants. For Surry andZion, steam explosions represent a significantfraction of the early failure probability, but onlybecause the overall likelihood of early failure issmall.

When molten core material drops into water out-side the vessel, the potential failure mechanismsare different. In the Grand Gulf plant, a shockwave could propagate through water and impactthe concrete structure that provides support to thereactor vessel. Substantial motion of the vesselcould then lead to the tearout of penetrationsthrough the drywell wall. Because of the shallowwater pool at Peach Bottom, dynamic loads fromsteam explosions do not represent a similarmechanism for failures.

9-15 NUREG-1150


In addition to potentially producing missiles andshock waves, steam explosions can also rapidlygenerate large quantities of steam and hydrogen.The steam produced from molten fuel-coolant in-teractions ex-vessel following vessel breach is animportant contributor to the static drywell over-pressure failure in the Grand Gulf and Peach Bot-tom plants.

Gradual Overpressurization

Figure 9.9 illustrates the assessed pressure capa-bility for the five plants analyzed. The ability of acontainment to withstand the production of gasesin a severe accident depends on the volume of thecontainment as well as its failure pressure. One ofthe principal sources of pressurization in a severeaccident is steam production. In each plant de-sign, however, engineered safety features are pre-sent to condense steam in the form of suppressionpools, ice beds, sprays, air coolers, or in some de-signs, combinations of these systems. Steam pres-surization is only a major contributor to the totalpressure if, in the scenario being analyzed, theheat removal system has become inoperative; e.g.,the spray system has failed, the suppression poolhas become saturated, br the ice has melted.

Large quantities of hydrogen are predicted to bereleased in severe accidents, both in-vessel duringthe melting phase and ex-vessel during core-concrete attack, debris bed quenching, or high-pressure melt ejection. If the hydrogen does notburn, it will contribute to the containment pres-sure. Carbon monoxide and carbon dioxide pro-duced during core-concrete attack also contributeto containment pressurization.

Because of its relatively small volume, the PeachBottom (Mark I) design is more vulnerable tooverpressurization failure by noncondensible gasgeneration. If the accident progression proceedsto vessel penetration and the molten core attacksthe concrete, it is unlikely that containment integ-rity can be maintained in the long term unlessother factors mitigate gas production.

Overheating

The effect of high temperature in the drywell oncontainment failure probability and mode wasconsidered in the Peach Bottom analysis. Al-though very high gas temperatures can beachieved as the result of hydrogen combustion inthe other plant designs, the structure temperaturesare not predicted to reach temperatures at whichthe strength of the structure would be substantiallyreduced or sealant materials would be degraded.

The Peach Bottom drywell, however, is relativelysmall. Substantial convective and radiative heattransfer from hot core debris could result in veryhigh drywell wall temperatures. Failure could re-sult from the combination of high pressure in thedrywell and decreased strength of the steel con-tainment wall. Overheating the drywell is only acontributor to scenarios in which the drywell sprayis inoperative. If the sprays are operational, thedrywell temperature will be much lower than forthe dry case.

Drywell heating in the Peach Bottom plant repre-sents a delayed containment failure mechanism.Since the likelihood of early failure by othermechanisms is high, drywell overtemperature fail-ure is not a substantial contributor to risk.

Loss of Vessel SupportIn the earlier section on steam explosions, amechanism was described for drywell failure inthe BWR designs in which structural failure of thereactor pedestal results in vessel motion (tippingor falling) and the tearout of piping penetrationsthrough the drywell wall. Quasistatic pressuriza-tion of the pedestal region can result in the samephenomenon. Erosion of the pedestal by moltencore attack of the concrete can also lead to thesame effect. In this event, however, considerabletime is required for the erosion to occur, and thefailure would be late and the importance to risk isdiminished. The likelihood of this mechanism offailure is generally small for the BWRs analyzed,in part because other mechanisms are likely to re-sult in failure earlier in the accident.

Basemat MeltthroughFor each of the five plants analyzed, some poten-tial exists for core debris to be quenched as a par-ticulate debris bed and cooled in the reactor cav-ity or pedestal region if a continuous source ofwater is available. A significant likelihood exists,however, that, even if a replenishable water sup-ply is available, molten core debris will attack theconcrete basemat. If the core-concrete interactiondoes occur, the presence or absence of an over-laying water pool is not expected to have mucheffect on the downward progression of the meltfront.

The depth of the basemat of the Peach Bottomcontainment, directly under the vessel, is so greatthat it is unlikely that the basemat would be pene-trated before the occurrence of other failuremodes. For the other plants, basemat penetrationis possible, but the projected consequences areminor in comparison with those of abovegroundfailures.

NUREG-1 150 9-16


Cumulative Failure Probability

0.8

0.6

0.4

0.2

00 60 100 150 200

Pressure (Psig)

250

Figure 9.9 Cumulative containment failure probability distribution(all plants).

for static pressurization

9.4.3 Major Sources of Uncertainty

The perspectives on the major sources of uncer-tainty described in this section come from foursources:

0 Regression analysis-based sensitivity analysesfor the mean values for risk. Simple linearregression models were used to represent thecomplex risk models, and adequate resultswere obtained. Better results would requiremore complex regression models. Insights forthis section are deduced from the risk regres-sion studies (regression analyses for condi-tional containment failure probabilities re-quired for more detailed accident progressioninsights were not performed). Results ofthese studies are presented in References 9.2through 9.6.

* Partial rank correlation analyses for the riskcomplementary cumulative distribution func-tions. Results of these studies are presentedin References 9.2 through 9.6.

* Sensitivity studies in which separate analyseswere performed with certain parameter val-

ues set to a specific value. Sensitivity studieswere performed on the Mark I drywell shellmeltthrough issue and the PWR RCS depres-surization scenarios. These studies were onlyperformed for the accident progressionanalysis; no source term or consequence in-sights are available.

* The subjective judgment of the analysts per-forming the plant-specific studies.

Importance of Accident Progression AnalysisVariables to Rank Regression Analyses forAnnual Risk

The majority of the variables important to therank regression analyses performed for Surry werethe initiating event frequencies of the containmentbypass events and the source term variables. Theonly accident progression event tree variable thatwas demonstrated to be important to the uncer-tainty in risk for internal events was the probabil-ity of vessel and containment breach by an in-vessel steam explosion; this variable wasmoderately important to the uncertainty in totalearly fatality risk (Ref. 9.2).

The regression analyses performed for Sequoyahshowed the containment failure pressure and

9-17 NUREG-1 150


loads at vessel breach to be accident progressionvariables somewhat important to the uncertaintyin both total early fatality risk and total latent can-cer fatality risk (Ref. 9.4).

The probability of drywell meltthrough was theonly accident progression variable that was at allimportant to uncertainty in the early fatality riskor the latent cancer fatality risk for the internalregression analysis for Peach Bottom (Ref. 9.3).

The amount of hydrogen produced in-vessel, theprobability of drywell failure following pedestalfailure, the pressure load in the drywell at vesselbreach, and the amount of hydrogen producedand released at and shortly after vessel breachwere accident progression variables that werefound to be important to the uncertainty in earlyfatality risk by the Grand Gulf regression analyses.The probability of drywell failure following pedes-tal failure and the pressure load in the drywell atvessel breach were found to be important to theuncertainty in latent cancer fatality risk (Ref.9.5).

The majority of variables important to the rankregression analyses performed for Zion were re-lated to failure or recovery of the componentcooling water (CCW) system and the source termvariables. The only accident progression eventtree variable that was demonstrated to be impor-tant to the uncertainty in risk was the probabilityof vessel and containment breach by an in-vesselsteam explosion. This result was also obtainedfrom the Surry regression analyses. The probabil-ity of a steam explosion failure was found to beimportant to the uncertainty in both early and la-tent health risk measures at Zion. The importanceof seal LOCA failure to risk uncertainty was ex-pected, given the large contribution of theseevents to the core damage frequency. Upgrades tothe Zion service water and CCW systems have thepotential to reduce the importance of these eventsas discussed in Appendix C (Section C.15) (Ref.9.6).

Direct Attack of Drywell Shell in PeachBottom

The divergence of opinion of the panel of contain-ment performance experts, in itself, is an indica-tor of the uncertainty in the associated phenom-ena. A sensitivity study was performed todetermine the impact on containment perform-ance of eliminating this failure mechanism. Themean early failure probability (averaged over allsequences) was reduced from 56 percent to 20percent (Ref. 9.3).

High-Pressure Melt Ejection and VesselDepressurization

For the Surry and Zion plants, early containmentfailure resulting from loads at vessel breach is as-sessed to have low probability, on the order of 1percent. Sensitivity studies were performed todetermine the dependence of this result on expertjudgments made about various reactor coolant sys-tem depressurization mechanisms prior to vesselbreach. A sensitivity study was performed forSurry (Ref. 9.2), which removed depressurizationby temperature-induced breaks. This study indi-cated that removal of only temperature-inducedfailures for depressurization does not result in asignificant increase in the likelihood of early con-tainment failure (from roughly 1 percent toroughly 2 percent). This probability study, there-fore, implies that other depressurization mecha-nisms, such as the failure of reactor coolant pumpseals and stuck-open relief valves, are also impor-tant. However, a sensitivity study was also per-formed for Zion (Ref. 9.6) in which all depress-urization mechanisms were removed. The resultof this study was a relatively small increase in thelikelihood of early containment failure. For acci-dents initiated by LOCAs (which dominate the es-timated core damage frequency), this change re-sulted in essentially no change in the conditionalprobability of early containment failure. Theprobability of early failure increased by a factor of5 for accidents initiated by transients (fromroughly 0.01 to 0.06) and by a factor of 2 for ac-cidents initiated by station blackout (from roughly0.03 to 0.06). The reason for the relatively smallimpact of removing all depressurization mecha-nisms on the probability of early containment fail-ure is that the Zion containment is expected towithstand high-pressure melt ejection loads (evenat the upper end of the uncertainty range) withvery high confidence (refer to Section C.5 of Ap-pendix C for a more detailed discussion). Also, atthese small probability levels, in-vessel steam ex-plosions contribute to the likelihood of early con-tainment failure. If the reactor coolant systempressure remains high, the likelihood of triggeringa steam explosion is decreased. Thus, the slightlyhigher probability of early containment failure re-sulting from high-pressure melt ejection loads willbe offset to some degree by the lower probabilityof containment failure from in-vessel steam explo-sions.

Uncertainties associated with high-pressure meltejection also affect the early containment failurelikelihood for the other three plants. The signifi-cance of this issue is greatest for the Sequoyahand Grand Gulf plants, which have lower over-pressure capacity and which are vulnerable to the

NUREG-1150 9-18


hydrogen produced in the oxidation of dispersedcore debris by steam.

Containment Failure by Steam Explosions

The production of missiles by in-vessel steam ex-plosions only appears as a significant contributorto early failure or bypass in the Zion analyses.The contribution of alpha-mode containment fail-ure is the result of the very low probability ofother modes of early failure or bypass and is itselfa low value. Quasistatic and shock loading froman ex-vessel steam explosion is indicated to be apotentially important contributor to drywell failurefor Grand Gulf. Ex-vessel steam explosions alsocontribute to quasistatic overpressurization failurein the Peach Bottom plant.

Core Melt Progression

Many of the uncertain phenomena that have thepotential to lead to early containment failure(e.g., high-pressure melt ejection, drywell shell at-

tack, steam explosions, and hydrogen generation)are sensitive to the details of core melt progres-sion, particularly the later stages of progression inwhich molten core material enters the lower headof the vessel. The mass of material potentiallyavailable for dispersal at head failure, the compo-sition of this material, the timing of head failure,and the mode of head failure have a substantialindirect impact on the likelihood of early contain-ment failure through their effects on early failuremechanisms.

Containment Bypass

The containment bypass sequences have been dis-cussed throughout this report as special scenarios(in which the containment function has failed)and will be briefly mentioned here. The contain-ment bypass initiating event frequencies, transmis-sion factors, and decontamination factors weredemonstrated to be the variables most importantto the uncertainty in all risk measures in both theSurry and Sequoyah rank regression analyses.

9-19 NUREG-1 150



9.1 M. Silberberg et al., "Reassessment of theTechnical Bases for Estimating SourceTerms," United States Nuclear RegulatoryCommission (USNRC) Report NUREG-0956, July 1986.

9.2 R. J. Breeding et al., "Evaluation of SevereAccident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREG/CR-4551, Vol.3, Revision 1, SAND86-1309, October1990.

9.3 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit2," Sandia National Laboratories, NUREG!CR-4551, Vol. 4, Draft Revision 1,SAND86-1309, to be published.*

9.4 J. J. Gregory et al., "Evaluation of SevereAccident Risks: Sequoyah Unit 1," SandiaNational Laboratories, NUREG/CR-4551,Vol. 5, Revision 1, SAND86-1309, Decem-ber 1990.

*Available in the NRC Public Document Room, 2120 LStreet NW., Washington, DC.

9.5 T. D. Brown et al., "Evaluation of SevereAccident Risks: Grand Gulf Unit 1," San-dia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1,SAND86-1309, to be published.*

9.6 C. K. Park et al., "Evaluation of SevereAccident Risks: Zion Unit 1," Brook-haven National Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.*

9.7 USNRC, "Reactor Safety Study-An Assess-ment of Accident Risks in U.S. CommercialNuclear Power Plants," WASH-1400(NUREG-75/014), October 1975.

9.8 R. S. Denning et al., "Radionuclide ReleaseCalculations for Selected Severe AccidentScenarios-PWR, Subatmospheric Contain-ment Design," Battelle Columbus Division,NUREG/CR-4624, Vol. 3, BMI-2139, July1986.

9.9 USNRC, "Revised Severe Accident Re-search Program Plan: Fiscal Year 1990-1992," NUREG-1365, August 1989.

NUREG-1150 9-20

10. PERSPECTIVES ON SEVERE ACCIDENT SOURCE TERMS

10.1 Introduction

Shortly after the accident at Three Mile Island,the NRC initiated a program to review the ade-quacy of the methods available for predicting themagnitude of source terms for severe reactor acci-dents. After considerable effort and extensivepeer review, the NRC published a report entitled"Reassessment of the Technical Bases for Estimat-ing Source Terms," NUREG-0956 (Ref. 10.1).The report recommended that a set of integratedcomputer codes, the Source Term Code Package(STCP) (Ref. 10.2), be used as the state-of-the-art methodology. for source term analysis providedthat uncertainties were considered. The STCPmethodology provided a starting point for sourceterm estimates in this study. In addition, the char-acterization of source term uncertainties was sup-ported by calculations with other system codessuch as MELCOR (Ref. 10.3) and MAAP (Ref.10.4), detailed special. purpose codes such asCONTAIN (Ref. 10.5), as well as small codeswritten for this project to examine specific sourceterm phenomena. Because it was impractical toperform an STCP calculation for each source termrequired and the STCP does not contain modelsfor all potentially important phenomena, simpli-fied methods of analysis were developed with ad-justable parameters that could be benchmarkedagainst the more detailed codes. Probability distri-butions, which had been developed from theelicitations of the source term panel of experts,were provided for many of the parameters in thesimplified computer codes. A large number ofsource term estimates were generated for eachplant by sampling from the probability distribu-tions in the simplified codes.

Source terms are typically characterized by thefractions of the core inventory of radionuclidesthat are released to the environment, as well asthe time and duration of the release, the size dis-tribution of the aerosols released, the elevation ofthe release, the warning time for evacuation, andthe energy released with the radioactive material.All these parameters are required for input to theMACCS (Ref. 10.6) consequence code. Althoughthe illustrations and comparisons of source termsin this chapter emphasize the magnitude of esti-mated release, it is important to recognize that theother characteristics of the source term notedabove, such as the timing of release, can also havean important effect on the ultimate consequences.

It is widely believed that the approximate treat-ment of source term phenomena in the ReactorSafety Study (RSS) (Ref. 10.7) analyses led to asubstantial overestimation of severe accident con-sequences and risk. The current risk analyses pro-vide a basis for understanding the differences thatexist in source terms calculated using the newmethods relative to those calculated using the RSSmethods and the impact of these differences onestimated risk.


Some examples of source terms (fractions of thecore inventory of groups of radionuclides releasedto the environment) were provided for accidentprogression bins for each of the analyzed plants inChapters 3 through 7. As expected, the magnitudeof the source term varies between different acci-dent progression bins depending on whether ornot containment fails, when it fails, and the effec-tiveness of engineered safety features (e.g., BWRsuppression pool) in mitigating the release. How-ever, within an accident progression bin, whichrepresents a specific set of accident progressionevents, the uncertainty in predicting severe acci-dent phenomena is great.

In Figure 10.1, the predicted frequency of radio-active releases is compared among the five plants.In this figure, the mean distribution is presented,allowing differences in plant behavior to be illus-trated. The y-coordinate in the figure representsthe predicted frequency with which a given magni-tude of release (the x-coordinate) would be ex-ceeded. The location of the exceedance curve isdetermined by the frequencies of accident se-quences in addition to the spectrum of possiblesource terms for those sequences.

It is not obvious in examining a radionuclidesource term what the potential health impactwould be to the public from a specified magnitudeof release. Based on the compilation of a numberof consequence analyses, however, one method(Ref. 10.8) has been developed that provides anapproximate relationship for the minimumfractions of radionuclides released that result inearly fatalities or early injuries. For the release ofiodine, for example, the thresholds for earlyfatalities and early injuries occur at release frac-tions of the core inventory of approximately 0.1and 0.01, respectively. Figure 10.1 does not indi-cate major differences in the exceedance curvesfor the five plant analyses. For the iodine group,

10-1 NUREG-1150

10. Severe Accident Source Terms

Frequency of R > R* (yr-I)

Iodine Group -Surry

I.O~~~~u04 _ __^^ ~~~~~~~~~~~~ Zion"_ Sequoyah

Pach Bottom

Grand Cult

LIDE-05 .:_4- ~f y= S _t

I.OE*OF_0Q7

I.OE-08 '

I.OE-09 I I I I H ill I I I I IIH [ I I I I H ill I I I I t1L.OE-05 I.OE-04 I.OE-03 I.OE-02 I.OE-01 1.0E+00

Release Fraction

Frequency of R > R* (yr-1)I.OE-OS0_ _

Cesium Group --~~~~~~~~~~~~~~~~~~~~~ -- Zlon

1.9E-04- Sequoyab

- Peach Bottom

l.OE-05 Grand Gulf

..50 -- t b o0 -

I.OE-07

I.OE-08

1.0E-05 I.OE-04 I.OE-03 I.OE-02 LE-0 1.OE+00

Release Fraction

Figure 10.1 Frequency of release for key radionuclide groups.

NUREG-1150 10-2


Frequency of R > R (yr-1)I.OE-03

Strontium Group -Srry'--- Zion

1.05-04lE .'. Sequoyah

Peach Bottom

1.E05 Grand Culf

.OE-0-

1.OE-07

l.OE-09

I.OE-05 I.OE-04 L.OE-03 l.OE-02 lOE-01 1.OE+0o

Release Fraction

Frequency of R > R* (yr-i)1 .OE-03_

Lanthanum Group - 2urr* - Son

I.OE-04Sequoyah

Peach Bottom

1.0E-05 *M Grand Gulf

I.OE-05

I.OE-09 I I III tell]IIII IlI III

.OE-05 I.OE-04 I.OE-03 lOE-02 I.OE-01 I.OE+00

Release Fraction

Figure 10.1 (Continued)

10-3 NUREG-1150


the frequency of exceeding a release fraction of0.1 ranges from 1E-6 to 5E-6 per reactor year forthe five plants. Similarly, for a release fraction of0.01, the exceedance curves range from 2E-6 to1E-5 per reactor year. The most outstanding fea-ture of these curves is their relative flatness over awide range of release fractions. For the iodine,cesium, and strontium groups, the curves decreaseonly slightly over the range of release fractionsfrom 1E-5 to E-1 and then fall rapidly from 0.1to 1. For the lanthanum group, the rapid decreasein the curve occurs at a release fraction that isapproximately a decade lower. As a result of theflatness of the exceedance curves, the frequencyof accidents with source terms that are marginallycapable of resulting in early fatalities is onlyslightly less than the frequency of accidents cover-ing a very broad spectrum of health consequencesup to the occurrence of fatalities. However, thefrequency of source terms with the potential formultiple early fatalities falls rapidly with increasedrelease.

Based on the results of the source term analysesfor the five plants, a number of general perspec-tives on severe accident source terms can bedrawn:

* The uncertainty in radionuclide source termsis large and represents a significant contribu-tion to the uncertainty in the absolute valueof risk. The relative significance of sourceterm uncertainties depends on the plantdamage state.

* Source terms for bypass sequences, such asaccidents initiated by steam generator tuberupture (SGTR), can be quite large, poten-tially comparable to the largest ReactorSafety Study source terms.

* Early containment failure by itself is not a re-liable indicator of the severity of severe acci-dent source terms. Substantial retention ofradionuclides is predicted to occur in manyof the early containment failure scenarios inthe BWR pressure-suppression designs, par-ticularly for the in-vessel period of releaseduring which radionuclides are transported tothe suppression pool. Containment spray sys-tem and ice condenser decontamination canalso substantially mitigate accident sourceterms.

* Flooding of reactor cavities or pedestals caneliminate the core-concrete release of radio-nuclides, if a coolable debris bed is formed,or can significantly attenuate the release from

the molten core-concrete interaction byscrubbing in the overlaying pool of water.


In the Reactor Safety Study (RSS) (Ref. 10.7),source terms were developed for nine releasecategories ("PWR1" to "PWR9") for the Surryplant and five release categories for the PeachBottom plant ("BWR1" to "BWR5"). The RSSrelease categories are directly analogous to the ac-cident progression bins in the current study in thatthey are characterized by aspects of accident pro-gression and containment performance that affectthe source term. For example, the PWR1 releasecategory represented early containment failure re-sulting from an in-vessel steam explosion withcontainment sprays inoperative. A point estimatefor release fractions (fraction of the core inven-tory of an elemental group released to the envi-ronment) for seven elemental groups (in the cur-rent study, the number of elemental groups hasbeen expanded to nine) was then used to repre-sent this type of release.

In the current study, source terms were developedfor a much larger number of accident progressionbins. A distribution of release fractions was alsoobtained for each of the elemental groups corre-sponding to the individual sample members of theuncertainty analysis.

In order to simplify the presentation in this report,the results of similar accident progression binshave been aggregated to a level that is comparableto that used in the RSS. Figure 10.2 provides acomparison of an important large release category(PWR2) from the RSS for Surry with a compara-ble aggregation of accident progression bins (earlycontainment failure, high reactor coolant systempressure) from the current study.* Also shown inFigure 10.2 is a low release category from theRSS (PWR7) with a comparable aggregation of ac-cident progression bins from the current study(late failure). No range is shown for the noble gasrelease for this study because no permanent reten-tion mechanisms were assumed to affect thesegases. The point estimates of the release ofradionuclides in the RSS early containment failurebin are more representative of the upper bounds

'Because of the aggregation of accident progression bins,some of the range of the source terms represents variationin accident progression as well as modeling uncertainty.The distribution was developed from all of the samplemembers within the aggregated bins without considera-tion of the relative frequencies of these bins.

NUREG-1150 10-4


I .OEOO

t.OE-O1

1.OE-02

1.OE-03

1.OE-04

I ^MrAni

Release Fraction

InL~~~~~~~~~~ma

A -- Median

6~~~~~~~6

A Rss

I V -U O

N6 I Cs Te Sr Ru La Ba

Elemental Group

a. Comparison with Bin PWR2

Release Fraction

Ce

1.OE-05 IN I1 11 VWNG I Cs Te Sr Ru La Ba Ce

Elemental Group

b. Comparison with Bin PWR7

Figure 10.2 Comparison of source terms with Reactor Safety Study (Surry).

10-5 NUREG-1150


of the range in the current study than the mean orthe median. For the late failure comparison, theresults for this study are somewhat higher thanthose obtained for the RSS. The difference is re-lated to the types of failures in the late failure bin.In the RSS, the PWR7 source terms were basedon a release associated with meltthrough of thebasemat in scenarios with containment sprays op-erable. The late failure bin in the current studyalso includes overpressure failure cases with a di-rect release from the plant to the atmosphere. Ofparticular significance is the nontrivial release ofiodine that is associated with late release mecha-nisms, which were not considered in the RSS.

Figure 10.3 compares release fractions for an ag-gregation of early drywell failure accident progres-sion bins from the current study with the BWR2and BWR3 release categories. In the currentstudy, a range of reactor building decontaminationfactors is considered depending on the mode ofdrywell failure and variations in thermal-hydraulicconditions in the building. The BWR2 releasefractions are at the upper bounds of the ranges inthe current study, and the BWR3 releases arenear the mean values.

The second example compares results for an isola-tion failure in the wetwell region from the RSS,release category BWR4, with the venting accidentprogression bin from the current study. The RSSresults are very similar to the mean release termsfor the venting bin, with the exception of the io-dine group, which is higher because of the laterelease mechanisms (reevolution from the sup-pression pool and the reactor. vessel) consideredin the current study.

Overall, the comparison indicates that the sourceterms in the RSS were in some instances higherand in other instances lower than those in the cur-rent study. For the early containment failure acci-dent progression bins that have the greatest im-pact on risk, however, the RSS source termsappear to be larger than the mean values of thecurrent study and are typically at the upper boundof the uncertainty range. *

10.4 Perspectives

10.4.1 State of Methods

The use of parametric source term methods, inwhich the parameters are fit to reproduce the re-

*Additional comparisons with the Reactor Safety Studymay be found in Reference 10.9.

sults of more mechanistic codes, was found to bea practical necessity in performing a PRA that in-cludes a complete treatment of phenomenologicaluncertainties. Research is in progress in some ofthe key areas of uncertainty that influence sourceterm results. In a number of cases, the STCP didnot have models that represent potentially impor-tant phenomena, such as revaporization from re-actor coolant system surfaces and reevolution ofiodine from water pools. Later codes, such asMELCOR (Ref. 10.3), which have at least rudi-mentary models for these processes, should pro-vide greater assurance of consistency in the analy-sis. These advanced codes may not, however,remove the need for parametric codes capable ofperforming a large number of analyses inexpen-sively.

Improvement in Understanding

Since the Reactor Safety Study (RSS), substantialimprovements have been made in understandingsevere accident processes and source term phe-nomena. A major shortcoming of the RSS was thelimited treatment of the uncertainties in severe ac-cident source terms. In the intervening years, par-ticularly subsequent to the Three Mile Island acci-dent, major experimental and code developmentefforts have broadly explored severe accident be-havior. In this study, care has been taken to dis-play the assessed uncertainties associated with theanalysis of accident source terms. Many of the se-vere accident issues that are now recognized asthe greatest sources of uncertainty were com-pletely unknown to the RSS analysts 15 years ago.

10.4.2 Important Design Features

In Chapter 9, performance of the containments ofthe five plants was described with respect to thetiming of the onset of containment failure and themagnitude of leakage to the environment. In par-ticular, the likelihood of early containment failurewas used as a measure of containment perform-ance. Environmental source terms are affected bymore than just the mode and timing of contain-ment failure, however. The following paragraphsdescribe the effect of different safety systems andplant features on the magnitude of source terms.

Suppression Pools

Suppression pools can be very effective in the re-moval of radionuclides in the form of aerosols or

NUREG- 150 10-6


I .OE+00

I.OE-01

I.OE-02

1.OE-03

1.OE-04

1.OE-05

1 .OE+00

1,OE-01

1.OE-02

1.OE-03

1.OE-04

1.OE-05

Release FractionA -

: T~~~~~~~~~~~~~~~~6

-- mdian

AA

A Ras

C s T e S r. . ... L a a CNG I Cs Te Sr Ru La Ba Ce

Elemental Group

a. Comparison with Bins BWR2 and BWR3

Release Fraction

NG I Cs Te Sr Ru La Ba Ce

Elemental Group

b. Comparison with Sin BWR4

Pigure 10.3 Comparison of source terms with Reactor Safety Study (Peach Bottom).

10-7 NUREG-1 150


soluble vapors. Some of the most importantradionuclides, such as isotopes of iodine, cesium,and tellurium, are primarily released from fuelduring the in-vessel release period. Because risk-dominant accident sequences in BWRs typicallyinvolve transient sequences rather than pipebreaks, the in-vessel release is directed to the sup-pression pool rather than being released to thedrywell. As a result, the in-vessel release is sub-jected to scrubbing in the suppression pool, evenif containment failure has already occurred. Forthe Peach Bottom plant, decontamination factorsused in this study for scrubbing the in-vessel com-ponent ranged from approximately 1.2 to 4000,with a median value of 80. Since the early releaseof volatile radioactive material is typically the ma-jor contributor to early health effects, the effect ofthe suppression pool in depressing this componentof the release is one of the reasons the likelihoodof early fatalities is so low for the BWR designsanalyzed.

Depending on the timing and location of contain-ment failure, the suppression pool may also be ef-fective in scrubbing the release occurring duringcore-concrete attack or reevolved from the reac-tor coolant system after vessel failure. In thePeach Bottom analyses, containment failure wasfound to be likely to occur in the drywell early inthe accident. Thus, in many scenarios the sup-pression pool was not effective in mitigating thedelayed release of radioactive material. Similarly,in the Grand Gulf design, drywell failure accom-panied containment failure in approximately one-half the early containment failure scenarios ana-lyzed. As a result, the suppression pool was foundto be ineffective in mitigating ex-vessel releases ina substantial fraction of the scenarios for bothBWR plants analyzed.

Although the decontamination factors for suppres-sion pools are typically large, radioactive iodinecaptured in the pool will not necessarily remainthere. Reevolution of iodine was found to be im-portant in accident scenarios in which the contain-ment has failed and the suppression pool is boil-ing.

Containment Sprays

If given adequate time, containment sprays canalso be effective in reducing airborne concentra-tions of radioactive aerosols and vapors. In theSurry (subatmospheric) and Zion (large, dry) de-signs, approximately 20 percent of core meltdownsequences were predicted to eventually result indelayed failure or basemat meltthrough. The ef-fect of sprays, in those scenarios in which they are

operational for an extended time, is to reduce theconcentration of radioactive aerosols airborne inthe containment to negligible levels in comparisonwith non-aerosol radionuclides (e.g., noble gases)with respect to potential radiological effects. Forshorter periods of operation, sprays would be lesseffective but can still have a substantial mitigativeeffect on the release.

The Sequoyah (ice condenser) design has con-tainment sprays for the purpose of condensingsteam that might bypass the ice bed, as well as foruse after the ice has melted. The effects of thesprays and ice beds in removing radioactive mate-rial are not completely independent since theyboth tend to remove larger aerosols preferentially.

In the Peach Bottom plant, drywell sprays can beoperated in sequences in which ac power is avail-able. Scrubbing of radioactive material releasedfrom fuel during core-concrete attack can be ac-complished by a water layer developed on thedrywell floor, as well as by the spray droplets.Containment spray operation in Grand Gulf ismost important for scenarios in which both thecontainment and drywell have failed. In the short-term station blackout plant damage state, powerrecovery that is too late to arrest core damage canstill be important for the operation of containmentsprays and the mitigation of the extended periodof ex-vessel release from fuel.

Ice Condenser

The ice beds in an ice condenser containment re-move radioactive material from the air by proc-esses that are very similar to those in the BWRpressure-suppression pools. The decontaminationfactor is very sensitive to the volume fraction ofsteam in the flowing gas, which in turn depends onwhether the air-return fans are operational. For atypical case with the air-return fans on, the magni-tude of the decontamination factors was assessedto be in the range from 1.2 to 20, with a medianvalue of 3. Thus, the effectiveness of the ice bedin mitigating the release of radioactive material islikely to be substantially less than for a BWR sup-pression pool.

Drywell-Wetwell Configuration

The Mark III design has the apparent advantage,relative to the Mark I and Mark II designs, of thewetwell boundary completely enclosing the dry-well, in effect providing a double barrier to radio-active material release. As long as the drywellremains intact, any release of radioactive materialfrom the fuel would be subject to decontaminationby the suppression pool. For this reason, failure

NUREG-1 150 10-8


of the Mark III containment is not as importantto severe accident risk as the potential forcontainment failure in combination with drywellfailure. Figures 6.5 and 6.6 illustrate the differ-ence in the environmental source terms for theearly containment failure bins with and withoutdrywell failure. With the drywell intact, the envi-ronmental source term is reduced to a level atwhich early fatalities would not be expected to oc-cur, even for early failure of the outer contain-ment. The potential advantages of the drywell-wetwell configuration were found to be limited inthis study by the significant probability of drywellfailure in an accident.

Cavity Flooding

The configuration of PWR reactor cavity or BWRpedestal regions affects the likelihood of water ac-cumulation and water depth below the reactorvessel. The Surry reactor cavity is not connectedby a flowpath to the containment floor. If thespray system is not operating, the cavity will be dryat vessel failure. In the Peach Bottom (Mark I)design, there is a maximum water depth of ap-proximately 2 feet on the pedestal and drywellfloor before water would overflow into thedowncomer. The other three designs investigatedhave substantially greater potential for water accu-mulation in the pedestal or cavity region. In theSequoyah design, the water depth could be asmuch as 40 feet.

If a coolable debris bed is formed in the cavity orpedestal and makeup water is continuouslysupplied, core-concrete release of radioactive ma-terial would be avoided. Even if moltencore-concrete interaction occurs, a continuousoverlaying pool of water can substantially reducethe release of radioactive material to the contain-ment.

Reactor Building/Auxiliary Building Retention

Radionuclide retention was evaluated for thePeach Bottom reactor building, but an evaluationwas not made for the portion of the reactor build-ing that surrounds the Grand Gulf containment,which was assessed to have little potential for re-tention. The range of decontamination factors foraerosols for the Peach Bottom reactor buildingsubsequent to drywell rupture was 1. I'to 80 with amedian value of 2.6. The location of drywell fail-ure affects the potential for reactor building de-contamination. Leakage past the drywell head tothe refueling building was assumed to result invery little decontamination. Failure of the drywellby meltthrough resulted in a release that was sub-

jected to a decontamination factor of 1.3 to 90with a median value of 4.

In the interfacing LOCA sequences in the PWRs,some retention of radionuclides was assumed inthe auxiliary building (in addition to water pooldecontamination for submerged releases). In theSequoyah analyses, retention was enhanced bythe actuation of the fire spray system.

Containment Venting

In the Peach Bottom (Mark I) and Grand Gulf(Mark III) designs, procedures have been imple-mented to intentionally vent the containment toavoid overpressure failure. By venting from thewetwell air space (in Peach Bottom) and from thecontainment (in Grand Gulf), assurance is pro-vided that, subsequent to core damage, the re-lease of radionuclides through the vent line willhave been subjected to decontamination by thesuppression pool.

As discussed in Chapter 8, containment venting tothe outside can substantially improve the likeli-hood of recovery from a loss of decay heat re-moval plant damage state and, as a result, reducethe frequency of severe accidents. The results ofthis study indicate, however, only limited benefitsin consequence mitigation for the existing proce-dures and hardware for venting. Uncertainties inthe decontamination factor for the suppressionpool and for the ex-vessel release and in thereevolution of iodine from the suppression poolare quite broad. As a result, the consequences ofa vented release are not necessarily minor. Fur-thermore, the effectiveness of venting in the twoplant designs is limited by the high likelihood ofmechanisms leading to early containment failure,which would result in bypass of the vent.

10.4.3 Important PhenomenologicalUncertainties

In order to identify the principal sources of uncer-tainties in the estimated risk, regression analyseswere performed for each of the plant types in thisstudy. In general, in these regression analyses, thedependent variable is risk expressed in terms ofconsequences per year (e.g., early fatalities peryear or latent cancer fatalities per year). For theSurry plant (Ref. 10.10), however, additional re-gression analyses were performed in which the de-pendent variable is the quantity of release per yearfor each of the radionuclide groups. These analy-ses are particularly useful in investigating how un-certainties in source term variables affect the re-leases of different radionuclides. Also determinedwere partial correlation coefficients that represent

10-9 NUREG-1150


the importance of uncertain variables as a func-tion of the magnitude of the environmental re-lease.

Relative Importance of Source TermVariables

The results of these regression analyses indicatethat uncertainties in source term variables are im-portant contributors to the uncertainties in riskbut are often not the largest contributors. Therelative contribution of uncertainties in sourceterm variables depends on the characteristics ofeach plant damage state as illustrated in the PeachBottom and Sequoyah regression analyses (Refs.10.11 and 10.12). In general, the five plant analy-ses indicate that the importance of the aggregateof variables that affect release frequencies (acci-dent frequency variables and accident progressionvariables) is similar to or greater than the impor-tance of the aggregate of variables that affectsource term magnitude.

Source term variables tend to have less impor-tance to the uncertainty in latent cancer fatality(or population dose) risk than to the risk of earlyfatalities. Because of the threshold nature of earlyfatalities, these risk results are particularly sensi-tive to pessimistic values of source term variables.

Importance of Source Term Variables toUncertainty in Environmental Release

Based on analyses performed for the Surry plant(Ref. 10.10), the importance of source term vari-ables is seen to be different for different groups ofradionuclides. The uncertainty in the release ofnoble gases is dominated by the uncertainty in ac-cident frequency variables. The relative uncertain-ties in release fractions for the noble gases and inretention mechanisms (only volumetric holdup isassumed) are small.

The character of the risk-dominant accident se-quences at Surry plays an important role in deter-mining the importance of the source term vari-ables for the other radionuclide groups. Thesteam generator tube rupture (SGTR) accidentand the interfacing-system LOCA sequences (therisk-dominant sequences) involve bypass routes inwhich radionuclides released from the core trans-port to the environment without being subjectedto containment deposition processes. As a result,steam generator retention and the release ofradionuclides from the fuel during in-vessel meltprogression are the largest contributors to uncer-tainty for the volatile radionuclides, iodine andcesium, and for the semivolatile radionuclides, tel-

lurium, barium, strontium, and ruthenium. Forthe involatile radionuclides, lanthanum and ce-rium, the release of radionuclides during core-concrete interactions is also an important con-tributor.

The Surry analyses also indicate that the uncer-tainties in source term variables tend to have rela-tively more importance for large releases. Forsmall releases of radionuclides, the uncertaintiesare dominated by the uncertainties associated withthe accident frequencies.

Plant-Specific Importance of Source TermVariables to Uncertainty in Risk

Consistent with the discussion in the previous sec-tion, the largest contributors to uncertainty inearly fatality risk for the Surry plant (Ref. 10.10)are the frequency of the interfacing-system LOCAsequence and two source term variables, retentionin the steam generator (in an SGTR accident) andrelease from the fuel during in-vessel melt pro-gression. For latent cancer fatality risk, the fre-quency of SGTR accidents becomes of higher im-portance and the frequency of interfacing-systemLOCAs of reduced importance. Steam generatorretention and in-vessel release of radionuclidesare of comparable importance to the accident fre-quency variables.

The Zion results (Ref. 10.13) are similar to thosefor Surry but reflect a reduced significance of theinterfacing-system LOCA sequence and an in-creased importance of steam explosions as a modeof early containment failure (this results from amuch lower frequency of interfacing-systemLOCA in Zion). Release of radionuclides fromfuel in-vessel, steam generator retention (in anSGTR accident), and containment retention ofmaterial released prior to vessel breach (as ap-plied in a steam explosion scenario) are the mostimportant source term contributors to the uncer-tainty in early fatality risk. For latent cancer fatal-ity risk, containment failure from a steam explo-sion is of reduced significance and, as a result,containment retention is not an important con-tributor to risk uncertainty.

For early fatality risk at Sequoyah (Ref. 10.12),the frequency of the interfacing-system LOCA isthe most important contributor to uncertainty.Containment failure by overpressurization is amore likely early failure mechanism for Sequoyahthan for the large, high-pressure containments atZion and Surry. As a result, accident progressionmechanisms such as pressure rise at vessel breachand containment failure pressure are also impor-tant contributors to risk uncertainty for the

NUREG-1150 10-1 0

10. Severe. Accident Source Terms

Sequoyah design. The most significant sourceterm variables are in-vessel retention fraction,containment retention fraction for the in-vesselrelease, and steam generator deposition (in anSGTR accident). For latent cancer fatality risk,the frequency of the SGTR accident is the mostimportant contributor to uncertainty; none of thesource term variables is significant.

Regression results were obtained for internal in-itiators, fire events, and seismic events for thePeach Bottom plant (Ref. 10.11). For early fatal-ity risk from internal initiators, release from fuelin-vessel, release during core-concrete interac-tions, and fractional release from containment ofthe core-concrete source terms are the most im-portant contributors to uncertainty. The contain-ment building decontamination factor, late releaseof iodine, reactor coolant system retention, andrevaporization also contribute at a level similar tothe contribution from the frequencies of the acci-

dent sequences. For fire initiators, the contribu-tions from the various source term variables aresimilar but slightly reduced consistent with greateruncertainty in the initiator frequency.

For latent cancer fatality risk at Peach Bottom,the important source term variables are the sameas for the early fatality risk but are relatively lessimportant than the contribution from uncertaintiesin the accident frequencies.

In the Grand Gulf analyses (Ref. 10.14), thesource term variables were indicated to be less im-portant than the accident sequence and accidentprogression variables. The most significant sourceterm variable was indicated to be the release frac-tion from containment following vessel failure.The decontamination factor for the suppressionpool, spray decontamination factor, in-vessel re-lease of radioactive material, and in-vessel reten-tion of radioactive material were also identified asmoderate contributors to the uncertainty in risk.

10-1 1 NUREG-1 150



10.1 M. Silberberg et al., "Reassessment of theTechnical Bases for Estimating SourceTerms," U.S. Nuclear Regulatory Commis-sion (USNRC) Report NUREG-0956, July1986.

10.2 J. A. Gieseke et al., "Source Term CodePackage, A User's Guide (Mod. 1)," Bat-telle Columbus Division, NUREGICR-4587, BMI-2138, July 1986.

10.3 R. M. Summers et al., "MELCOR In-Vessel Modeling," Proceedings of the Fif-teenth Water Reactor Safety InformationMeeting (Gaithersburg, MD), NUREG/CP-0091, February 1988.

10.4 Fauske and Associates, Inc., "MAAPModular Accident Analysis Program Us-er's Manual," Vols. I and II, IDCORTechnical Report 16.2-3, February 1987.

10.5 K. D. Bergeron et al., "User's Manual forCONTAIN 1.0, A Computer Code for Se-vere Reactor Accident ContainmentAnalysis," Sandia National Laboratories,NUREG/CR-4085, SAND84-1204, July1985.

10.6 D. I. Chanin, H. Jow, J. A. Rollstin et al.,"MELCOR Accident Consequence CodeSystem (MACCS)," Sandia NationalLaboratories, NUREG/CR-4691, Vols.1-3, SAND86-1562, February 1990.

10.7 USNRC, "Reactor Safety Study-An As-sessment of Accident Risks in U. S. Com-mercial Nuclear Power Plants,"WASH-1400 (NUREG-75/014), October1975.

quence Modeling," Executive Conferenceon the Ramifications of the Source Term(Charleston, SC), March 12, 1985.

10.9 L. LeSage et al., "Report of the SpecialCommittee on NUREG-1150, The NRC'sStudy of Severe Accident Risks," Ameri-can Nuclear Society, June 1990.

10.10 R. J. Breeding et al., "Evaluation of Se-vere Accident Risks: Surry Unit 1," SandiaNational Laboratories, NUREG/CR-4551,Vol. 3, Revision 1, SAND86-1309, Octo-ber 1990.

10.11 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit2, " Sandia National Laboratories,NUREG/CR-4551, Vol. 4, Draft Revision1, SAND86-1309, to be published.*

10.12 J. J. Gregory et al., "Evaluation of SevereAccident Risks: Sequoyah Unit 1," SandiaNational Laboratories, NUREG/CR-4551,Vol. 5, Revision 1, SAND86-1309, De-cember 1990.

10.13 C. K. Park et al., "Evaluation of SevereAccident Risks: Zion Unit 1," BrookhavenNational Laboratory, NUREG/CR-4551,Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.*

10.14 T. D. Brown et al., "Evaluation of SevereAccident Risks: Grand Gulf Unit 1," San-dia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1,SAND86-1309, to be published.'

10.8 G. D. Kaiser, "The Implications of Re-duced Source Terms for Ex-Plant Conse-


NUREG-1150 10-12

11. PERSPECTIVES ON OFFSITE CONSEQUENCES

11.1 Introduction

Frequency distributions, in the form of comple-mentary cumulative distribution functions(CCDFs), of four selected offsite consequencemeasures of the atmospheric releases ofradionuclides in reactor accidents (with all sourceterms contributing) have been presented in Chap-ters 3 through 7 for the five plants* covered in thisstudy. For each consequence measure, the 5thpercentile, 50th percentile (median), 95th per-centile, and the mean CCDFs were shown. Thischapter provides some perspectives on the offsiteconsequence results for these plants.

Section 11.2 provides a discussion on the basis ofthe CCDFs. Section 11.3 discusses, summarizes,and compares the consequence results for the fiveplants displayed in the mean and the medianCCDFs. Section 11.4 compares the results fromthe mean and median CCDFs with those of theReactor Safety Study (Ref. 11.1). Sections 11.5and 11.6, respectively, provide discussions on po-tential sources of uncertainty in consequenceanalysis and on sensitivities of the mean CCDFs tothe assumptions on the offsite protective measuresto mitigate the consequences.

Some of the perspectives provided in this chapterrelate to the effectiveness of various methods ofoffsite emergency response. For these five plants,it appears that evacuation is the most effectiveemergency response for the risk-dominant acci-dent sequences. However, as discussed below, thecalculated effectiveness of a response is sensitiveto assumptions on the timing of warnings to peopleoffsite before radioactive release, the estimateddelay before evacuation and the effective speed ofevacuating populations, and the energy of the re-lease. In this chapter, the results of sensitivitystudies on some of these factors are discussed.The reader should not infer that these results sig-nal a modification to NRC's emergency responseguidance. Rather, they provide a glimpse of thetype of technical assessment that would be re-quired in NRC's reevaluation of emergency re-sponse.

11.2 Discussion of Consequence CCDFs

As discussed in the earlier chapters, a large num-ber of source terms, each with its own frequency,

*See Figures 3.9, 3.10; 4.9, 4.10; 5.8; 6.8; and 7.7, re-spectively, for Surry, Peach Bottom, Sequoyah, GrandGulf, and Zion.

were initially developed for each of the five plants.They spanned a wide spectrum of plant damagestates, phenomenological scenarios, and sourceterm uncertainties for each plant that led toradionuclide releases to the atmosphere. How-ever, for the purpose of the manageability of theoffsite consequence analysis, such large numbersof source terms for each plant were reduced to amuch smaller number (about 30 to 60) of repre-sentative source term groups.

Each source term group was treated as a singlesource term in the offsite consequence analysiscode, MACCS (Ref. 11.2). The MACCS analysesincorporated the mitigating effects of the offsiteprotective actions. The magnitudes of the selectedconsequence measures and their meteorology-based probabilities were calculated by MACCS foreach source term group and were used to generatethe meteorology-based CCDFs. These conditionalCCDFs of the consequence measures for all indi-vidual source term groups served as the basic dataset for further analysis. When the conditionalCCDFs of a consequence measure were weightedby the frequencies of the source term groups, the5th percentile, 50th percentile (median), 95thpercentile, and the mean values of the frequenciesat various magnitude levels of the consequencemeasure were obtained and displayed as CCDFsin Chapters 3 through 7.

Thus, in this procedure, both the frequencies ofthe source term groups and the probabilities of thesite meteorology (which in combination with thesource term groups lead to the various conse-quence magnitude levels) have been used in gen-erating the percentile and mean CCDFs. (Theconstruction of these CCDFs is discussed in Sec-tion A.9 of Appendix A.)

11.3 Discussion, Summary, andInterplant Comparison of OffsiteConsequence Results

The various percentile and the mean CCDFs ofthe consequence measures shown in Chapters 3through 7 display the uncertainties in the offsiteconsequences stemming from the in-plant uncer-tainties up to the source terms and their frequen-cies and the ex-plant uncertainties due to the vari-ability of the site meteorology. The 5th and 95thpercentile CCDFs provide a reasonable display ofthe bounds of the offsite consequences frequencydistributions for the five plants.

11-1 NUREG-1 150

11. Offsite Consequences

Tables 11.1 and 11.2 present the informationcontained in the mean and the median CCDFs intabular form. Entries in these tables are the ex-ceedance frequency levels of 10-5, 10-6, 10-7,10-8, and 10-9 per reactor year and the magni-tudes of the consequences that will be exceeded atthese frequencies for the five plants.

As stated in Chapters 3 through 7, the CCDFs ofthe consequence measures presented in thosechapters (and, therefore, the results shown in Ta-bles 11.1 and 11.2) incorporate the benefits ofevacuation of 99.5 percent of the populationwithin the 10-mile plume exposure pathway emer-gency planning zone (EPZ), early relocation ofthe remaining population from the heavily con-taminated areas both within and outside the10-mile EPZ, and other protective measures. De-tails of the assumptions on the protective meas-ures are presented in Table 11.3.

The results shown in Tables 11.1 and 11.2 for thefive plants are discussed below.

Early Fatality Magnitudes

The early fatality magnitudes (persons) at variousexceedance frequencies for a plant are driven bythe core damage frequency and the radionucliderelease parameters of the source term groups forthe plant; the site meteorology and the populationdistribution in the close-in site region; and the ef-fectiveness of the emergency response. These fac-tors are different for the five plants. Therefore,different values of early fatality magnitudes areshown for equal levels of exceedance frequencies.

Some of the plant/site features contributing to thedifferences between the early fatality CCDFs ofthe five plants are discussed below:

* Core damage frequencies for the internal in-itiators for Peach Bottom and Grand Gulf arelower than those for the other three plants.Therefore, the early fatality CCDFs for PeachBottom and Grand Gulf are associated withrelatively low exceedance frequencies.

* Quantities of radionuclides associated with theearly phase of the release* in the source term

'Virtually all source term groups developed for this studyhave two release phases-an early release phase and alater release phase. Early fatalities are essentially due tothe early release. This is because the wind direction maychange before the later release, so that the later releasewould not always add to the radiation dose of the samepeople who were affected by the early release, andevacuation or relocation would likely be completed beforethe later release would occur.

groups for Peach Bottom and Grand Gulf aretypically smaller than those for the other threeplants because of suppression pool scrubbing.This lowered the early fatality magnitudes forthese two plants.

* Several source term groups for Surry and Se-quoyah with large quantities of radionuclidesassociated with the early release phase arealso associated with large thermal energy inthis phase. This resulted in vertical rise of theplume in several meteorological scenarios, re-ducing the potential for large early fatalitymagnitudes.

* The time of warning before the start of theradionuclide release strongly influences theeffectiveness of the emergency response, par-ticularly the evacuation. The source termgroups for Peach Bottom and Grand Gulf withpotential for early fatalities, unless mitigatedby emergency response, are also associatedwith warning times that are well in advance ofthe release compared to those for the otherthree plants because the most important acci-dent sequences for the BWRs develop moreslowly than those for the PWRs of this study.In contrast, warning times are close to thestart of the release (about 40 minutes beforethe release) for the source term groups con-taining the fast-developing interfacing-systemLOCA accident sequences for Surry and Se-quoyah, which also have large quantities ofradionuclides in the release.

* The Zion site has the highest population den-sity within the 10-mile EPZ among the fiveplants (although about half of the area in thiszone for Zion is water). It is followed bySurry, Sequoyah, Peach Bottom, and GrandGulf.

* For Zion, Surry, and Sequoyah, relativelylong evacuation delay times after the warningsand slow effective evacuation speeds were cal-culated. For Peach Bottom and Grand Gulf,relatively short evacuation delay times andfast effective evacuation speeds were calcu-lated. Values of these parameters were basedon the utility-sponsored plant-specific studiesand the NRC requirements for emergencyplanning. The utility-sponsored evacuationtime estimate studies, however, were notevaluated in terms of how well they realisti-cally represent the sites.

In the MACCS calculations, early warnings beforethe radionuclide release and short evacuation

NUREG-1150 11-2

\ 0-

Tab

le

11.1

S

umm

arie

s of

mea

n a

nd

med

ian

C

CD

Fs

of o

ffsi

te co

nse

quen

ces-

fata

liti

es.

Exc

eeda

nce

Ear

ly

Fat

alit

ies

(per

sons

)a

Lat

ent

Can

cer

Fat

alit

ies

(per

sons

)aF

req

uen

cy(r

y-1)

1*

2*

3*

4*

5*

6*

7*

1*

2*

3*

4*

5*

6*

7*

10-5 In

t.b

0 0

0 0

0 -

0

0

6(1

)c

0

0

-

0 0

0 0

0 0

0 0

0 2(

1)

0 0

7(2)

1(

3)F

ire

0 0

--

--

-0

6(2)

-

--

O O

-

--

--

0

0o

1

0~

~~

~

00

10

-6 Int.

0

0 0

0 0

--

1(3)

1(

3)

4(3)

3(

2)

8(3)

-

0 0

0 0

0 0

0 4(

2)

2(2)

1(

3)

0

2(3)

5(

3)

5(3)

Fir

e 0

0

--

--

-1(

1)

8(3)

-

--

-

0 0

--

--

-7(0)

3(3)

10-7 In

t.

3(0)

0

5(1)

0

2(2)

-

-8(

3)

8(3)

9(

3)

1(3)

3(

4)

--

0 0

2(0)

0

2(0)

2(

2)

2(0)

4(

3)

3(3)

6(

3)

6(2)

1(

4)

2(4)

2(

4)F

ire

0 0

--

--

-4(

2)

2(4)

-

--

--

0 0

-2(

1)

1(4)

-

--

10

-8 Int.

4(1)

0

4(2)

0

3(3)

-

-2(

4)

2(4)

2(

4)

3(3)

8(

4)

--

0 0

5(1)

0

5(1)

1(

3)

3(2)

9(

3)

1(4)

1(

4)

2(3)

2(

4)

3(4)

3(

4)F

ire

0 1(

0)

--

--

-5(

3)

4(4)

-

--

--

0 0

--

--

6(1)

2(

4)

--

--

10-9 In

t. 1(

2)

1(0)

2(

3)

0 4(

3)

--

4(4)

4(

4)

2(4)

6(

3)

1(5)

-

-

8(0)

0

2(2)

0

8(2)

4(

3)

2(3)

2(

4)

2(4)

2(

4)

3(3)

4(

4)

4(4)

5(

4)F

ire

1(1)

3(

0)

.2(

4)

5(4)

-

--

--

0 0

--

--

-1(

3)

4 (4

) -

--

-

*Pla

nt N

ames

: 1

= S

urry

; 2

= Pe

ach

Bot

tom

; 3

= Se

quoy

ah

4 =

Gra

nd G

ulf;

5 =

Zio

n;

6 =

RSS

-PW

R;

7 =

RSS

-BW

Ra.

Fi

rst

line

of e

ntri

es c

orre

spon

ds t

o m

ean

CC

DF;

sec

ond

line

corr

espo

nds

to m

edia

n C

CD

F.b.

Int.

In

tein

al i

niti

atin

g ev

ents

c.

6(1)

6

X 1

0.1

= 60

I- 0 5) 0 D CD

z a 0 (3'

Tab

le 1

1.2

Sum

mar

ies

of m

ean

and

med

ian

CC

DFs

of

off

site

con

sequ

ence

s-po

pula

tion

ex

posu

res.

Exc

eeda

nce

50-M

ile

Reg

ion

Popula

tio

n E

xp

osu

re

(per

son-

rem

)a

Ent

ire

Sit

e R

egio

n P

op

ula

tio

n

Ex

po

sure

(p

erso

n-re

m)a

Fre

quen

cy(r

y-1 )

1*

2*

3*

4*

5*

1*

2*

3*

4*

5*

10-5 In

t.b

7(2)

c 0

1(5)

0

5(3)

2(

3)

0 4(

5)

0 9(

3)2(

2)

0 4(

4)

0 3(

3)

3(2)

0

1(5)

0

4(3)

Fir

e 5(

1)

1(6)

-

--

1(2)

3(

6)

--

-0

2(3)

-

--

3(3)

-

--

10 6

Int.

1(

6)

3(6)

3(

6)

2(5)

2(

7)

8(6)

7(

6)

2(7)

2(

6)

5(7)

6(5)

6(

5)

1(6)

1(

2)

3(6)

2(

6)

1(6)

7(

6)

2(2)

1(

7)F

ire

3(4)

1(

7)

--

-1(

5)

5(7)

-

--

2(4)

6(

6)

--

-6(

4)

2(7)

-

--

10-7 In

t.

8(6)

1(

7)

8(6)

6(

5)

8(7)

5(

7)

5(7)

6(

7)

9(6)

2(

8)5(

6)

6(6)

4(

6)

3(5)

3(

7)

2(7)

2(

7)

3(7)

3(

6)

7(7)

Fir

e 6(

5)

3(7)

-

--

2(6)

1(

8)

--

-1(

5)

1(7)

-

--

2(5)

7(

7)

--

-

10-8 In

t. 2(

7)

2(7)

2(

7)

1(6)

2(

8)

1(8)

1(

8)

9(7)

2(

7)

3(8)

9(6)

1(

7)

7(6)

6(

5)

7(7)

6(

7)

8(7)

6(

7)

9(6)

1(

8)F

ire

6(6)

5(

7)

--

-3(

7)

2(8)

-

--

5(5)

3(

7)

--

-6(

5)

1(8)

-

--

1O-~

~~~~

~~~~

~~~

10-9 In

t. 3(

7)

4(7)

4(

7)

2(6)

4(

8)

2(8)

2(

8)

1(8)

3(

7)

4(8)

1(7)

2(

7)

1(7)

1(

6)

1(8)

1(

8)

1(8)

1(

8)

2(7)

2(

8)F

ire

2(7)

6(

7)

--

-9(

7)

3(8)

-

-

1(6)

4(

7)

--

8 (6)

2(

8)

-

*Pla

nt N

ames

: 1=

Sur

ry;

2 =

Peac

h B

otto

m;

3 =

Seq

uoya

h 4

= G

rand

Gul

f;

5 =

Zio

na.

Fir

st l

ine

of e

ntri

es c

orre

spon

ds

to m

ean

CC

DF;

se

cond

lin

e co

rres

pond

s to

med

ian

CC

DF.

b.

Int.

= In

tern

al i

niti

atin

g ev

ents

c.

7(2)

=

7 X

102 =

70

0

t-' 0 CD D0 CD

'

.0 0 CD

'

Tab

le 1

1.3

Off

site

pro

tect

ive

mea

sure

s as

sum

ptio

ns.

1.

Em

erge

ncy

Res

pons

e A

ssum

ptio

ns

a.

With

in

10-m

ile p

lum

e ex

posu

re p

athw

ay e

mer

genc

y pl

anni

ng z

one

(EPZ

):

Eva

cuat

ion

of p

eopl

e af

ter

a de

lay*

fo

llow

ing

the

war

ning

giv

en b

y th

e re

acto

r op

erat

or o

n th

e im

min

ent

radi

onuc

lide

rele

ase.

Ave

rage

eva

cuat

ion

dela

y tim

es (

hr):

Su

rry

2.0,

Pea

ch B

otto

m 1

.5,

Sequ

oyah

2.3

, G

rand

Gul

f 1.

25,

Zio

n 2.

3.

Ave

rage

eff

ectiv

e ra

dial

eva

cuat

ion

spee

ds (

mile

/hr)

: Su

rry

4.0,

Pe

ach

Bot

tom

10.

7,

Sequ

oyah

3.1

, G

rand

Gul

f 8.

3, Z

ion

2.5.

b.

Out

side

of

10-

mile

EPZ

:

Ear

ly r

eloc

atio

n of

peo

ple:

w

ithin

12

hour

s/24

ho

urs

afte

r pl

ume

pass

age

from

are

as w

here

the

pro

ject

ed l

ifet

ime

effe

ctiv

e w

hole

body

dos

e eq

uiva

lent

(E

DE

), as

def

ined

in

ICR

P Pu

blic

atio

ns 2

6 an

d 30

, fr

om a

7-d

ay o

ccup

ancy

wou

ld e

xcee

d 50

rem

s/25

rei

ns.

Not

e:

The

se a

ssum

ptio

ns a

re a

lso

exte

nded

inw

ard

up t

o th

e pl

ant

site

bou

ndar

y fo

r th

e no

neva

cuat

ing

or n

onsh

elte

ring

peo

ple.

2.

Pro

tect

ive

Act

ion

Gui

des

(PA

Gs)

fo

r L

ong-

Ter

m C

ount

erm

easu

res

a.

FDA

"em

erge

ncy"

PA

G f

or d

irec

tly c

onta

min

ated

foo

ds a

nd a

nim

al f

eeds

-dos

e no

t to

exc

eed

5-re

m E

DE

and

15-

rem

thy

roid

(Ref

. 11

.3).

b.

EPA

's p

ropo

sed

PAG

s fo

r co

ntin

uatio

n of

liv

ing

in c

onta

min

ated

env

iron

men

t-do

se

not

to e

xcee

d:

* 2-

rem

ED

E i

n th

e fir

st y

ear

* 0.

5-re

m E

DE

in

the

seco

nd y

ear

0fr

om g

roun

dshi

ne a

nd i

nhal

atio

n of

res

uspe

nded

rad

ionu

clid

es.

Not

e:

EPA

's c

rite

ria

(Ref

. 11

.4)

are

appr

oxim

ated

in

MA

CC

S as

dos

e no

t to

exc

eed

4-re

m E

DE

in

5 ye

ars.

0

c.

In a

bsen

ce o

f an

y Fe

dera

l ag

ency

cri

teri

a fo

r in

gest

ion

dose

to

an i

ndiv

idua

l fr

om f

oods

gro

wn

on c

onta

min

ated

so

il vi

a ro

ot u

p-O

ta

kes,

M

AC

CS

assu

mes

a P

AG

of

0.5-

rem

ED

E a

nd 1

.5-r

em t

hyro

id f

or t

his

path

way

, w

hich

is

sim

ilar

to F

DA

's "

prev

entiv

e"

PAG

CD

for

dire

ctly

con

tam

inat

ed

food

and

ani

mal

fe

eds

(Ref

. 11

.3).

-~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~

~~~~

~~~~

~~~0

CD

o*T

ime

step

s in

volv

ed d

urin

g th

e de

lay

are:

(1

) no

tific

atio

n of

the

off

site

aut

hori

ties,

(2

) ev

alua

tion

and

deci

sion

by

the

auth

oriti

es,

(3)

publ

ic n

otif

icat

ion

advi

sing

eva

cu-

atio

n,

and

(4)

peop

le's

pre

para

tion

for

eva

cuat

ion.


delay times for Peach Bottom and Grand Gulf en-abled the evacuees to have a substantial head starton the plume. This, coupled with relatively fasteffective evacuation speeds, enabled the evacueesto almost always avoid the trailing radioactiveplumes. Thus, the relatively lower core damagefrequencies, lower magnitudes of source termgroups in the early phase of release, early warn-ings, lower population densities, lower evacuationdelays, and higher evacuation speeds made thePeach Bottom and Grand Gulf early fatalityCCDFs in Figures 4.9 and 6.8 lie in the low fre-quency and low magnitude regions, and early fa-tality magnitude entries in Table 11.1 small or nil.

Surry and Sequoyah fit between Peach Bottom!Grand Gulf and Zion. For Surry and Sequoyah,warnings close to release in the interfacing-systemLOCA accident sequences made evacuation lesseffective for these sequences. Also, evacuationwas less effective in the plume rise scenarios forthose source terms for which early release phaseswere associated with large quantities of radio-nuclides and large amounts of thermal energy (se-quences with early containment failure at vesselbreach). With the plume rise, the highest air andground radionuclide concentrations occur at somedistance farther from the reactor (instead of oc-curring close to the reactor without plume rise). Insuch cases, the late starting evacuees from theclose-in regions moving away from the reactor inthe downwind direction encounter higher concen-trations and receive higher doses.

Latent Cancer Fatality Magnitudes

The estimates of latent cancer fatality magnitudeat various exceedance frequencies include thebenefits of the protective measures discussedabove. Contributions from radiation doses downto very low levels have been included. If futureresearch concludes that it is appropriate to trun-cate the individual dose at a de minimis level, re-duced latent cancer fatality estimates would beobtained.

Variations of the latent cancer fatality magnitudefor the five plants at equal exceedance frequencylevels primarily arise because of differences in thesource term groups and their frequencies, site me-teorologies, and differences in the site demogra-phy, topography, land use, agricultural practiceand productivity, and distribution of fresh waterbodies up to 50 to 100 miles from the plants.

Emergency response in the close-in regions hasonly a limited beneficial impact on delayed cancer

fatality magnitude and does not contribute sub-stantially to the differences in the cancer fatalityCCDFs for the five plants. The long-term protec-tive measures, such as temporary interdiction,condemnation, and decontamination of land,property, and foods contaminated above accept-able levels are based on the same protective ac-tion guides (PAGs) for all plants. Further, the sitedifferences for the five plants are not large enoughbeyond the distances of 50 to 100 miles to con-tribute substantially to the differences in the latentcancer fatality CCDFs.

Population Exposure Magnitudes

Population exposure magnitudes (person-rem*) atvarious exceedance frequencies include the con-tributions from the early and chronic exposures.These magnitudes reflect the dose-saving actionsof the protective measures and, therefore, are theresidual magnitudes.

Variations of the population exposure magnitudesfor the five plants at equal exceedance frequencylevels were similar to those of the cancer fatalitymagnitudes discussed earlier.

The relative contributions of the exposure path-ways to the population dose for a given plant arehighly source term dependent. Examples of rela-tive contributions of early and chronic exposurepathways (see Chapter 2 and Appendix A) to themeteorology-averaged mean estimates of the50-mile and entire region population dose for se-lected source term groups for the five plants areshown in Table 11.4. For brevity of presentation,only four source term groups that are the top con-tributors to the risks of the population dose for thefive plants are selected. These source term groupsare designated only by their identification num-bers in Table 11.4. The chronic exposure pathwayis shown subdivided in terms of direct (ground-shine and inhalation of resuspended radionu-clides) and ingestion (food and drinking water)pathways.

For a qualitative understanding of the resultsshown in Table 11.4, it should be noted that:

* All radionuclides contribute to the early expo-sure pathway; all nonnoble gas radionuclidescontribute to the chronic direct exposurepathway; and only the radionuclides of io-dine, strontium, and cesium contribute to thechronic ingestion exposure pathway.

*Effective dose equivalent (EDE) (as defined in ICRPPublications 26 and 30) in the unit of rem is used in thedefinition of person-rem.

NUREG-1 150 11-6

Tab

le

11.4

Exposu

re p

athw

ays

rela

tive

co

ntr

ibuti

ons

(per

cent

) to

met

eoro

logy

-ave

rage

d co

ndit

ional

m

ean

esti

mat

esof

po

pu

lati

on

do

se f

or s

elec

ted

sour

ce t

erm

gro

ups.

I

Sou

rce

Ter

m G

roup

50

-Mil

e R

egio

n*

En

tire

Reg

ion*

Iden

tifi

cati

on

E

arly

C

hron

ic E

xposu

re

Ear

ly

Chr

onic

Ex

po

sure

Pla

nt

Nam

e N

um

ber

E

xposu

re

Dir

ect

Inge

stio

n E

xp

osu

re

Dir

ect

Inge

stio

n

Sur

ry

9 28

68

2

10

69

2033

51

41

3

14

74

1237

33

58

5

9 79

12

49

13

80

7 9

58

33

Pea

ch B

otto

m

28

28

66

2 15

77

7

34

42

47

5 24

68

5

37

38

52

5 20

72

6

40

23

70

3 10

81

8

Seq

uoya

h 32

49

36

8

11

68

2035

42

47

6

8 59

32

43

49

28

19

11

73

1544

59

29

9

12

75

13

Gra

nd G

ulf

19

24

62

12

17

46

4225

16

65

16

4

54

4128

10

72

16

3

41

5732

41

39

17

12

62

25

Zio

n 13

9 50

46

1

27

56

1617

5 .7

1 21

2

49

39

814

2 24

73

1

23

60

1513

6 44

49

2

12

67

20

'The

di

ffer

ence

bet

wee

n 10

0 pe

rcen

t an

d th

e su

m o

f th

e pa

thw

ay

cont

ribu

tions

is

the

rela

tive

popu

latio

n do

se t

o th

e de

cont

amin

atio

n w

orke

rs.

z tl 0

0 C, .1o 0 0 0(1)

CD

en


* Early exposure pathway population dose esti-mated is largely unmitigated, except for theevacuated and relocated people. In additionto cloudshine and cloud inhalation duringplume passage, it includes the groundshineand inhalation of resuspended radionuclidesfor a period of 7 days after the radionucliderelease.

* Chronic exposure pathway involves dose inte-gration from 7 days to all future times (i.e.,the sum total of the dose over time).

* In the MACCS analysis, the protective actionsto mitigate the chronic exposure pathways arelargely confined to the 50-mile region of thesite. Outside the 50-mile region, the mitigativeactions (based on the PAGs) are generally nottriggered in MACCS because of the relativelylow levels of contamination (however, some-times they are triggered depending on the me-teorology and the source term magnitudes).

* Protective actions are not assumed for wateringestion.

Except for Grand Gulf, Table 11.4 shows that inthe 50-mile region the early exposure pathwaypopulation dose and the chronic direct exposurepathway population dose are roughly similar; thechronic ingestion pathway makes smaller contri-butions. For the entire region, the chronic directexposure pathway has increased contributionsrelative to the early exposure pathway. This is be-cause at longer distances the early exposure path-way has weakened as a result of low air andground concentrations and the short (i.e., 7 days)integration time for ground exposure. Relativecontributions of the chronic ingestion exposurepathway are also higher for the entire region. Thisis because the chronic direct exposure is depend-ent on population size and the chronic ingestionexposure is dependent on farmland and waterbody surface area. An increase in the populationsize with distance from a plant generally occursless rapidly compared to the increase in the areawith distance.

For Grand Gulf, generally the contributions fromthe early exposure pathway are lower than thechronic direct exposure pathway in the 50-mileregion relative to the other four plants and aredue to the characteristics of the selected sourceterm groups. For the entire region, the relativecontributions of the early exposure pathway andchronic direct exposure pathway are similar to theother plants. However, the ingestion exposure

pathway has higher contributions both in the50-mile and entire region compared to the otherplants. This is because the Grand Gulf site regionhas a smaller population size and a larger area de-voted to farming than the other four sites of thisstudy.


The mean and the median CCDFs of two of theselected consequence measures, namely, early fa-talities and latent cancer fatalities, displayed inChapters 3 through 7 for the internal initiators ofthe reactor accidents and summarized in Table11.1, may be compared with the CCDFs displayedin the Reactor Safety Study (RSS). However, theRSS CCDFs are the results of superpositions ofthe meteorology-based conditional CCDFs for theRSS "release categories" after being weighted bythe median frequencies of the release categories.The CCDFs shown in Chapters 3 through 7 arecalculated in a different way from the RSSCCDFs. Thus, they are not strictly comparable.

The RSS CCDFs of early fatalities and latent can-cer fatalities are shown in the RSS Figures 5-3and 5-5, respectively. The magnitudes of delayedcancer fatalities shown in the RSS CCDFs are ac-tually the magnitudes of their projected uniformannual rates of occurrence over a 30-year period.Thus, these RSS rate magnitudes need to be mul-tiplied by a factor of 30 to derive their total mag-nitudes. After performing this step, the RSS re-sults have been entered in Table 11.1 forcomparison with the results of this study.

Table 11.1 shows that, for one or more early fa-tality magnitudes, the mean and median frequen-cies for the three PWRs of this study (Surry, Se-quoyah, and Zion) and the median frequency forthe RSS-PWR are similar and are less than 10-6per reactor year. However, Table 11.1 also showsthat these frequencies for the two BWRs of thisstudy (Peach Bottom and Grand Gulf) are signifi-cantly lower than that for the RSS-BWR. For oneor more early fatality magnitude, the median fre-quency is less than 10-6 per reactor year for theRSS-BWR; whereas, the mean and median fre-quencies are less than 10-8 per reactor year for-Peach Bottom and less than 10-9 per reactor yearfor Grand Gulf.

Further, the comparison of the early fatality mag-nitudes in the median exceedance frequency

IRSS "release categories" are analogous to the source termgroups in the present study but were developed by differ-ent procedures.

NUREG-1150 11-8


range of 10-9 to 10-7 per reactor year shows thatthe RSS estimates are significantly higher than theestimates for the five plants of this study.

Table 11.1 shows that for the one or more latentcancer fatality magnitudes, the mean and medianfrequencies of only one plant (Sequoyah) of thisstudy and the median frequencies for the RSS-PWR and RSS-BWR are similar and are less than10-4 per reactor year. However, these frequenciesfor the other four plants of this study are an orderof magnitude lower than that for the RSS; i.e.,less than 10-5 per reactor year.

The RSS estimates of latent cancer fatality magni-tudes for the median exceedance frequency rangeof 10-9 to 10-5 per reactor year are higher (insome instances significantly higher) than those forthe five plants of this study-except for Zion at themedian exceedance frequency of 10-9 per reactoryear where they are about equal.

There are several factors contributing to the dif-ferences in the frequency distributions of theoffsite consequences for this study and the RSS.Some of these factors are mentioned below:

* Accident sequence frequency differences.

* Source term characterization difference.Most of the source terms of this study havetwo releases-an early release and a later re-lease. Early fatalities from a source term aremostly the consequences of the early release.Cancer fatalities are the consequences of bothearly and later releases. On the other hand,the RSS source terms did not have such abreakdown in terms of early or later release.Therefore, the early fatalities from an RSSsource term were the consequences of the en-tire release, as were the latent cancer fatali-ties.

* Consequence analyses for this study are sitespecific, using data for the site features de-scribed in Chapters 3 through 7. The RSSconsequence analysis was generic; it usedcomposite offsite data by averaging over 68different sites.

* In the present study, evacuation to a distanceof 10 miles is assumed; whereas, in the RSS,evacuation to a distance of 25 miles was as-sumed.

* Health effect models of this study are differ-ent from those of the RSS.

* Protective action guide dose levels for control-ling the long-term exposure are different.

* There are other miscellaneous differences be-tween the accident consequence models andinput data used in this study and the RSS.

* Different procedures were used for construct-ing the CCDFs.

11.5 Uncertainties and Sensitivities

There are uncertainties in the CCDFs of theoffsite consequence measures. Some of these un-certainties are inherited from the uncertainties inthe source term group specifications and frequen-cies, However, even after disregarding the sourceterm group uncertainties, there are significant un-certainties in the CCDFs of the consequencemeasures due to uncertainties in the modeling ofatmospheric dispersion, deposition, and transportof the radionuclides; transfer of radionuclides inthe terrestrial exposure pathways; emergency re-sponse and long-term countermeasures;dosimetry, shielding, and health effects; and un-certainties in the input data for the model pa-rameters.

Because of time constraints, uncertainty analysesfor the offsite consequences, except for the uncer-tainties due to variability of the site meteorology,have not been performed for this report. They areplanned for future studies. For this study, onlybest estimate values of the parameters for repre-sentation of the natural processes have been usedin MACCS. An analysis of sensitivity of theCCDFs to the alternative protective measure as-sumptions is provided in the following section.

11.6 Sensitivity of ConsequenceMeasure CCDFs to ProtectiveMeasure Assumptions

Emergency response, such as evacuation, shelter-ing, and early relocation of people, has its greatestbeneficial impact on the early fatality frequencydistributions. The long-term protective measures,such as decontamination, temporary interdiction,and condemnation of contaminated land, prop-erty, and foods in accordance with various radio-logical protective action guides (PAGs), have theirlargest beneficial impact on the latent cancer fa-tality and population exposure frequency distribu-tions.

11.6.1 Sensitivity of Early Fatality CCDFs toEmergency Response

Four alternative emergency response modeswithin the 10-mile EPZ, as characterized in Table

11-9 NUREG-1 150

11. Offsite. Consequences

11.5, are assumed in order to show the sensitivityof-early fatality CCDFs to these response modes.

Table 11.6 summarizes the early fatality meanCCDFs in tabular form for Surry, Peach Bottom,Sequoyah, and Grand Gulf for two alternativeemergency response modes, and Zion for all fouralternative emergency response modes. Severalinferences are drawn later in this section regardingthe effectiveness of these alternative emergencyresponse modes for the five plants based on thesedata. However, more analysis is needed to supportthese inferences for emergency response and toprovide detailed insight into the underlying com-peting processes involved that diminish or en-hance the effectiveness of any emergency re-sponse mode.

In particular, the effectiveness of evacuation isvery site specific and source term specific. It islargely determined by two site parameters,namely, evacuation delay time and effectiveevacuation speed, and two source term parame-ters-warning time before release and energy asso-ciated with the release (which, during some mete-orological conditions, could cause the radioactiveplume to rise while being transported downwind).Therefore, it cannot be extrapolated across thesource terms for a plant or across the plants forsimilar source terms.

The CCDFs discussed here include contributionsfrom many source term groups. The effectivenessof any emergency response mode judged from thesensitivity of the early fatality mean CCDF for aplant is essentially the effectiveness for the domi-nant source terms in specific frequency intervalsincluded in the CCDF. With these caveats, the in-ferences based on the data shown in Table 11.6are as follows:

Zion

1. Evacuation from the 0-to-5 mile EPZ com-bined with sheltering in the 5-to-1O mile EPZis as effective as evacuation from the entire10-mile EPZ. Effectiveness of evacuation inclose-in regions of radius less than 5 milesand sheltering in the outer regions will beevaluated in future studies. (See Chap-ter 13.)

2. Sheltering, due to better shielding protectionindoors, is more effective than early reloca-tion from the state of normal activity. (SeeTables 11.3 and 11.5 for distinctions be-tween evacuation, early relocation, and shel-

tering modes of response assumed in thisstudy.)

Sequoyah

1 Evacuation is more effective than relocationfor eceedance frequencies higher than 10-8per readtor year.

2. in the low frequency region (i.e., 10-8 perreactor year or less), the early relocationmode is more effective than evacuation. This"crossover" of the early fatality mean CCDFsfor the two response modes is likely becauseof the dominance of the low frequency largesource terms that also have short warningtimes before release and/or high energy con-tents and calculated long evacuation delaytime and slow effective evacuation speed.Because of the short warning time before re-lease and a long delay between the warningand the start of evacuation, many evacueesbecome vulnerable to the radiation exposuresfrom the passing plume and contaminatedground rather than escape these exposures.Because of the plume-rise effect (for the hotplumes), the peak values of the air andground radionuclide concentrations occur atsome distance farther from the plant. In sucha case, the evacuees from close-in regionsmoving in the downwind direction move fromareas of lower concentrations to areas ofhigher concentrations and receive a higherdose. It should be noted that, while evacuat-ing, the people are out in the open and haveminimal shielding protection. For the abovesituations, the sheltering mode also wouldshow the same crossover effect.

However, the crossover effect showing thatrelocation or sheltering may be more effec-tive than evacuation may not be realistic be-cause of uncertainties in the consequenceanalysis.

Peach Bottom, Grand Gulf

The source terms and features of these two lowpopulation density sites make evacuation a veryeffective mode of offsite response.

SurryAlthough entries in Table 11.6 show that evacu-ation is more effective than relocation from thestate of normal activity, some low probabilityaccident sequences for Surry are similar to thoseof Sequoyah (short warning times of the interfac-ing-system LOCA accident sequences and large

NUREG-1150 11-10

Tab

le 1

1.5

Ass

umpt

ions

on

alt

erna

tive

em

erge

ncy

resp

onse

m

odes

with

in

10-m

ile p

lum

e ex

posu

re p

athw

ay E

PZ

for

sens

itiv

ity

anal

ysis

.

a.

Eva

cuat

ion

(see

Tab

le

11.3

).

b.

Ear

ly r

eloc

atio

n in

lie

u of

eva

cuat

ion

or s

helte

r:

Ext

ends

the

ass

umpt

ions

for

rel

ocat

ion

outs

ide

the

10-m

ile E

PZ (

see

Tab

le 1

1.3)

in

war

d up

to t

he p

lant

site

bou

ndar

y.

c.

Shel

teri

ng*

(get

ting

to a

nd r

emai

ning

ind

oors

) in

lie

u of

eva

cuat

ion,

fo

llow

ed b

y fa

st r

eloc

atio

n af

ter

plum

e pa

ssag

e.

d.

Eva

cuat

ion

for

the

inne

r 0-

5 m

ile r

egio

n an

d sh

elte

ring

* in

the

out

er 5

-10

mile

reg

ion

follo

wed

by

fast

rel

ocat

ion

afte

r pl

ume

pass

age.

*She

lteri

ng a

ssum

ptio

ns d

etai

ls:

Aft

er a

n in

itial

del

ay o

f 45

min

utes

fro

m t

he r

eact

or o

pera

tor's

war

ning

, pe

ople

get

ind

oors

and

rem

ain

indo

ors

and

are

relo

cate

d to

unc

onta

min

ated

are

as w

ithin

a m

axim

um o

f 24

hou

rs o

f re

mai

ning

ind

oors

. H

owev

er,

virtu

ally

all

sour

ce t

erm

s an

alyz

ed i

nth

is s

tudy

hav

e tw

o re

leas

e ph

ases

-an

earl

y (f

irst)

rele

ase

and

a la

ter

(sec

ond)

rel

ease

. If

ther

e is

a su

ffic

ient

tim

e ga

p (a

bout

4 h

ours

) be

twee

nth

e tw

o re

leas

e ph

ases

, th

en p

eopl

e fr

om i

ndoo

rs c

an b

e re

loca

ted

to u

ncon

tam

inat

ed

area

s du

ring

thi

s ga

p an

d av

oid

the

expo

sure

fro

m t

hese

cond

rel

ease

. W

ith t

his

pers

pect

ive,

tw

o ca

ses

of r

eloc

atio

n ea

rlie

r th

an 2

4 ho

urs

are

impl

emen

ted

in c

alcu

latio

ns a

s fo

llow

s:

* R

eloc

atio

n w

ithin

4

hour

s af

ter

term

inat

ion

of t

he i

nitia

l (t

he f

irst)

rele

ase,

if

the

seco

nd r

elea

se d

oes

not

occu

r w

ithin

thi

s 4

hour

s;ot

herw

ise,

* R

eloc

atio

n w

ithin

4

hour

s af

ter

term

inat

ion

of t

he s

econ

d re

leas

e (p

rovi

ded

this

rel

ocat

ion

time

is ea

rlie

r th

an

24 h

ours

of

ind

oor

occu

panc

y; o

ther

wis

e,

relo

catio

n is

at 2

4 ho

urs

of i

ndoo

r oc

cupa

ncy)

.

The

dos

e fo

r th

e ab

ove

extr

a 4-

hour

per

iod

is a

ssum

ed t

o ac

coun

t fo

r th

e do

se d

urin

g th

e pe

riod

of

wai

ting

for

the

plum

e to

lea

ve t

he a

rea

afte

r te

rmin

atio

n of

the

rel

ease

and

the

dos

e du

ring

peo

ple'

s tr

ansi

t to

.the

relo

catio

n ar

eas.

0

z~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~~

~Z

n 0

C

3~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~C

Do

CT

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~~~~

~(


Table 11.6 Sensitivity of mean CCDF of early fatalities to assumptions on offsite emergencyresponse.

Exceedance 10-mile EPZ Early Fatalities (persons)Frequency Emergency(ry-1) Response Mode* Surry Peach Bottom Sequoyah Grand Gulf Zion

10-5 a. Evacuation 0/0 0/0 0 0 0

b. Relocation 0/0 0/0 0 0 0c. Shelter At ** *t *t 0

d. Evac/Shelter * *2 * *I 0

10-6 a. Evacuation 0/0 0/0 0 0 0

b. Relocation 0/0 0/2(1) 6(0) 0 6(0)'c. Shelter 22 I* 2* *2 0

d. Evac/Shelter ** 2* 2* 2* 0

10-7 a. Evacuation 0/0 0/0 5(1) 0 2(2)b. Relocation 2(1)/0 1(1)11(2) 7(1) 2(0) 1(3)c. Shelter 2* ** ** 2* 7(2)d. Evac/Shelter ** * ** 2* 2(2)

10-8 a. Evacuation 4(1)/0 0/0 4(2) 0 3(3)b. Relocation 2(2)/0 7(1)13(2) 2(2) 2(1) 8(3)c. Shelter * *2 *2 2* 6(3)d. Evac/Shelter 2* * *2 2* 3(3)

10-9 a. Evacuation 1(2)/1(1) 0/0 2(3) 0 4(3)b. Relocation 9(2)/5(1) 2(2)/5(2) 6(2) 8(1) 2(4)

c. Shelter *2 *2 *2 22 9(3)d. Evac/Shelter *2 ** * * 4(3)

Note: Under each plant name, the first entry is for the internal initiators and the second entry is for fire.

*See Table 11.3 for assumptions.*No dataa. 6(0) = 6x100 = 6

thermal energy for the sequences with early con-tainment failure at vessel breach). Analyses of thesensitivity of early fatality CCDFs to sheltering, ora combination of evacuation and sheltering, havenot been performed for Surry (nor for Peach Bot-tom, Sequoyah, and Grand Gulf).

11.6.2 Sensitivity of Latent Cancer Fatalityand Population Exposure CCDFs toRadiological Protective Action Guide(PAG) Levels for Long-TermCountermeasures

The potential for latent cancer fatalities andpopulation exposure is assumed to exist down toany low level of radiation dose and, therefore,over the entire site region. Although both earlyand chronic exposure pathways contribute tothese consequence measures, only the chronicexposure pathways are expected to be mitigatedby the long-term countermeasures such asdecontamination, temporary interdiction, or con-demnation of contaminated land, property, andfoods based on guidance provided by responsibleFederal agencies in terms of PAGs. This impliesthat, if the radiation dose to an individual from a

NUREG- 1150 1 1-12


chronic exposure pathway would be projected toexceed the PAG (or intervention) level for thatpathway, countermeasures should be undertakento reduce the projected dose from the pathway sothat it does not exceed the PAG level. Therefore,the latent cancer fatalities and the population ex-posures stemming from the chronic exposurepathways are expected to be sensitive to the PAGvalues.

The chronic exposure pathways base case PAGsare shown in Table 11.3. The only alternativePAG used for this sensitivity analysis is the RSSPAG for the groundshine dose to an individual forcontinuing to live in the contaminated environ-ment. The RSS PAG adopted here is 25-rem EDEfrom groundshine and inhalation of resuspendedradionuclides (instead of the RSS 25-rem wholebody dose from groundshine only) in 30 years.This alternative is used to replace the base casePAG of 4-rem EDE in 5 years.

Summaries of the latent cancer fatality and popu-lation exposure mean CCDFs for both cases forthe five plants for the internal initiating events areshown in Table 11.7.

Table 11.7 shows that there is practically no dif-ference between the consequence magnitudes forthe five plants for the two PAGs for continuing tolive in the contaminated environment at the ex-ceedance frequency of 10-5 per reactor year. Thisis because the source terms with frequency 10-5per reactor year or higher have low release magni-tudes such that the resulting environmental con-taminations are below both the EPA and RSSPAG-based trigger levels for protective actions(i.e., no protective actions are needed).

At lower exceedance frequencies, source termswith larger release magnitudes contribute and thetwo PAGs reduce the consequences to differentextents. The RSS PAG is less restrictive than theEPA PAG. Thus, the long-term consequencemagnitudes with the RSS PAG are generallyhigher than those with the EPA PAG at equal ex-ceedance frequencies. However, the economicconsequences, discussed in the supporting con-tractor reports (Refs. 11.5 through 11.9), wouldshow just the opposite behavior, i.e., economicconsequences would be higher for the EPA PAGthan for the RSS PAG.

1 1-13 NUREG- 1150

z IT

able

11.

7 Se

nsit

ivit

y of

mea

n C

CD

Fs

of l

aten

t ca

nce

r fa

tali

ties

an

d p

opu

lati

on e

xpos

ure

s to

th

e P

AG

sfo

r liv

ing

in c

onta

min

ated

are

as-

inte

rnal

init

iati

ng

even

ts.

Exc

eed

ance

C

ance

r F

atal

itie

s (p

erso

ns)

50-M

ile

Pop

. E

xp.

(per

son-

rem

) E

nti

re R

egio

n P

op.

Exp

. (p

erso

n-re

m)

Fre

qu

ency

(ry-

1 ) 1*

2*

3*

4*

5*

1*

2*

3*

4*

5*

1*

2*

3*

4*

5*

10-5 EPA

+ 0

0 6(

1)a

0 0

7(2)

0

1(5)

0

5(3)

2(

3)

0 4(

5)

0 9(

3)R

SS+

0 0

6(1)

0

0 7(

2)

0 1(

5)

0 5(

3)

2(3)

0

4(5)

0

9(3)

106 EP

A

1(3)

1(

3)

4(3)

3(

2)

8(3)

1(

6)

3(6)

3(

6)

2(5)

2(

7)

8(6)

7(

6)

2(7)

2(

6)

5(7)

RSS

2(

3)

2(3)

5(

3)

3(2)

1(

4)

2(6)

4(

6)

5(6)

2(

5)

3(7)

1(

7)

1(7)

3(

7)

2(6)

8(

7)

10-7

.

EP

A

8(3)

8(

3)

9(3)

1(

3)

3(4)

8(

6)

1(7)

8(

6)

6(5)

8(

7)

5(7)

5(

7)

6(7)

9(

6)

2(8)

RSS

9(

3)

1(4)

1(

4)

2(3)

4(

4)

1(7)

2(

7)

1(7)

1(

6)

2(8)

6(

7)

7(7)

6(

7)

1(7)

2(

8)

10 8

EPA

2(4)

2(4)

. 2(4)

3(3)

8(4)

2(7)

2(7) .

2(7)

1(6)

2(

8)

1(8)

1(

8)

9(7)

2(7)

3(8)

RSS

2(4)

4(

4)

2(4)

4(

3)

1(5)

2(

7)

4(7)

2(

7)

2(6)

3(

8)

2(8)

2(

8)

1(8)

2(

7)

4(8)

10-9 EP

A

4(4)

4(

4)

2(4)

6(

3)

1(5)

3(

7)

4(7)

4(

7)

2(6)

4(

8)

2(8)

2(

8)

1(8)

3(

7)

4(8)

RSS

5(

4)

4(4)

3(

4)

6(3)

-

4(7)

6(

7)

4(7)

3(

6)

4(8)

3(

8)

5(8)

2(

8)

4(7)

4(

8)

* P

lant

Nam

es:

I =

Sur

ry;

2 =

Pea

ch B

otto

m;

3 =

Seq

uoya

h;

4 =

Gra

nd G

ulf;

5

= Z

ion

+ L

ong-

term

rel

ocat

ion

PAG

s:E

PA =

4-

rem

ED

E i

n 5

year

s fr

om g

roun

dshi

ne-a

n ap

prox

imat

ion

of E

PA-p

ropo

sed

long

-ter

m r

eloc

atio

n PA

GR

SS =

25

-rem

ED

E i

n 30

yea

rs f

rom

gro

unds

hine

-RS

S l

ong-

term

rel

ocat

ion

PAG

a. 6

(1)

= 6

X

101

= 60

O CD

)

0 Cl)

.0 (_ Cl)



11.1 U.S. Nuclear Regulatory Commis-sion,"Reactor Safety Study-An Assess-ment of Accident Risks in U.S. Commer-cial Nuclear Power Plants," WASH-1400(NUREG-75/014), October 1975.

11.2 D. I. Chanin, H. Jow, J. A. Rollstin et al.,"MELCOR Accident Consequence CodeSystem (MACCS)," Sandia National Labo-ratories, NUREG/CR-4691, Vols. 1-3,SAND86-1562, February 1990.

11.3 U.S. Department of Health and HumanServices/Food and Drug Administration,"Accidental Radioactive Contamination ofHuman Food and Animal Feeds; Recom-mendations for State and Local Agencies,"Federal Register, Vol. 47, No. 205, pp.47073-47083, October 22, 1982.

11.4 U.S. Environmental Protection Agency,"Manual of Protective Action Guides andProtective Actions for Nuclear Incidents,"Draft, 1989.

'Available in the NRC Public Document Room, 2120 LStreet NW., Washington, DC.

11.5 R. J. Breeding et al., "Evaluation of SevereAccident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREG/CR-4551,Vol. 3, Revision 1, SAND86-1309, Octo-ber 1990.

11.6 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit2, " Sandia National Laboratories,NUREG/CR-4551, Vol. 4, Draft Revision1, SAND86-1309, to be published.*


11.8 T. D. Brown et al., "Evaluation of SevereAccident Risks: Grand Gulf Unit 1," San-dia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1,SAND86-1309, to be published.*

11.9 C. K. Park et al., "Evaluation of SevereAccident Risks: Zion Unit 1," BrookhavenNational Laboratory, NUREG/CR-4551,Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.*

1 1-15 NUREG- 1150

12. PERSPECTIVES ON PUBLIC RISK

12.1 Introduction

One of the objectives of this study has been togain and summarize perspectives regarding risk topublic health from severe accidents at the fivestudied commercial nuclear power plants. In thischapter, risk measures for these plants are com-pared and perspectives drawn from these com-parisons.

As discussed in Chapter 2, the quantitative assess-ment of risk involves combining severe accidentsequence frequency data with corresponding con-tainment failure probabilities and offsite conse-quence effects. An important aspect of the riskestimates in this study is the explicit treatment ofuncertainties. The risk information discussed hereincludes estimates of the mean and the median ofthe distributions of the risk measures and the 5thpercentile and the 95th percentile vaiues. The riskresults obtained have been analyzed with respectto major contributing accident sequences, plant-specific design and operational features, and acci-dent phenomena that play important roles.

The assessments of plant risk that support the dis-cussions of this chapter are discussed in detail inReferences 12.1 through 12.7 and summarized inChapters 3 through 7 for the five individual plants.Appendix C to this report provides more detailedinformation on certain technical issues importantto the risk studies. This work was performed bySandia National Laboratories (on the Surry, Se-quoyah, Peach Bottom, and Grand Gulf plants)and Idaho National Engineering Laboratory andBrookhaven National Laboratory (on the Zionplant).


Estimates of risk presented in Chapters 3 through7 for the five plants studied are compared in thissection. Risk measures that are used for thesecomparisons are: early fatality, latent cancer fa-tality, average individual early fatality, and aver-age individual latent cancer fatality risks for inter-nally initiated and externally initiated (fire) events(additional risk measures are provided in Refs.12.3 through 12.7). For reasons discussed inChapter 1, seismic risk is not discussed here.

In order to display the variabilities in the notedrisk measures, the early fatality and latent cancer

fatality risk results of all five plants from internallyinitiated accidents are plotted together in Figure12.1. Individual early fatality and latent cancer fa-tality risks from internally initiated accidents arecompared with the NRC safety goals* (Ref. 12.8)in Figure 12.2. Similar risk results from externallyinitiated (fire) accidents for the Surry and PeachBottom plants are presented in Figures 12.3 and12.4. Estimates of the frequencies of a "large re-lease" of radioactive material (using a definitionof large as a release that results in one or moreearly fatalities) are presented in Figure 12.5.

Based on the results of the risk analyses for thefive plants, a number of general conclusions canbe drawn:

* The risks to the public from operation of thefive plants are, in general, lower than theReactor Safety Study (Ref. 12.10) estimatesfor two plants in 1975. Among the five plantsstudied, the two BWRs show lower risks thanthe three PWRs, principally because of themuch lower .core damage frequencies esti-mated for these two plants, as well as themitigative capabilities of the BWR suppres-sion pools during the early portions of severeaccidents.

* Individual early fatality and latent cancer fa-tality risks from internally initiated events forall of these five plants, and from fire-initiatedaccidents for Surry and Peach Bottom, arewell below the NRC safety goals.

* Fire-initiated accident sequences have rela-tively minor effects on the Surry plant riskcompared to the risks from internal eventsbut have a significant impact on Peach Bot-tom risk.

* The Surry and Zion plants benefit from theirstrong and large containments and thereforehave lower conditional early containmentfailure probabilities. The Peach Bottom andGrand Gulf have higher conditional prob-abilities of early failure, offsetting to somedegree the risk benefits of estimated lowercore damage frequencies for these plants.

'Throughout this report, discussion of and comparisonwith the NRC safety goals relates specifically and only tothe two quantitative health objectives identified in theCommission's policy statement (Ref. 12.8).

12-1 NUREG-1 150

12. Public Risk

Early fatality/ry1.OE-03

1.OE-04

1.OE-05

1.OE-06

1 .OE-07

1.OE-08

1.OE-09

1.OE-10

41 LiI

RSS PWR SURRY PEACH SEQUOYAH GRANDBOTTOM GULF

ZION RSS BWR

Latent cancer fatality/ry1 .OE+OO

1.OE-01

1.OE-02

1.OE-03

1 .OE-04RSS PWR URRY PEACH SEQUOYAH GRAND ZION RSS BWR

BOTTOM GULF

Notes: As discussed in Reference 12.9, estimated risks at or below 1E-7 should be viewed with caution becauseof the potential impact of events not studied in the risk analyses.

"+" indicates recalculated mean value based on recent modifications to the Zion plant (as discussed inSection C.15).

Figure 12.1 Comparison of early and latent cancer fatality risks at all plants (internal events).

NUREG-1150 12-2

12. Public Risk

Individual early fatality/ry1 .OE-0f

1.OE-07

1.OE-Of

1.OE-0

1.0E-1C

1.0E-1 1

1.OE-05

1 .OE-06

1.OE-07

1.OE-08

1 .OE-09

1.OE-10

F

:<z=- Safety GoalLegend

06%

nmoan

median

+

I

LiSURRY PEACH SEQUOYAH GRAND ZION

BOTTOM GULF

Individual latent cancer fatality/ry

_: Legend

- - Safety Goal 1-Mean

-1j%

SURRY P EACHBOTTOM

SEQUOYAH GRANDGULF

ZION

Notes: As discussed in Reference 12.9, estimated risks at or below IE-7 should be viewed withcaution because of the potential impact of events not studied in the risk analyses.

"+" indicates recalculated mean value based on recent modifications to the Zion plant (asdiscussed in Section C. 15).

Figure 12.2 Comparison of risk results at all plants with safety goals (internalevents) .

12-3 NUREG-1 150

12. Public Risk

Early fatality/ry1.OE-03

1 .OE-04

1.OE-05

1.OE-06

1 .OE-07

1.OE-08

1 .OE-09

1.0E-10

I1.0E+00 :

1.OE-01 :

1.0E - 02:

1.OE-03i

1.OE-04

Legend

SURRYSURRY

FIRE

Latent cancer fatality/ry

PEACH BOTTOMFIRE

Legend

I 95%

-- mean

medan- |

LII-~~~~ 5

SURRYFIRE

PEACH BOTTOMFIRE

Note: As discussed in Reference 12.9, estimated risks at or below 1E-7 should be viewed with caution because of thepotential impact of events not studied in the risk analyses.

Figure 12.3 Comparison of early and latent cancer fatality risks at Surry and Peach Bottom (fire-initiated accidents).

NUREG- 1150 12-4

12. Public Risk

IIndividual early fatality/ry1.OE-06

1.OE-07

1.OE-08

1.OE-09

1.OE-10

1.OE- 1

1.OE-05

1 .OE-06

1.OE-07

1 .OE -08

1 .CE-09

1.OE-10I

:<~=-Safety Goal Legend

-~~~~~ |--mnean |medianl

_ 0---

I~ ~ I

SURRY PEACH BOTTOMFIRE FIRE

Individual latent cancer fatality/ry

Legend

-<s=-Safety Goal I n I--mean

I m d t ne n

- 0

SURRYFIRE

PEACH BOTTOMFIRE

Note: As discussed in Reference 12.9, estimated risks at or below 1-7 should be viewed with caution because ofthe potential impact of events not studied in the risk analyses.

Figure 12.4 Comparison of risk results at Surry and Peach Bottom with safety goals (fire-initiated accidents).

12-5 NUREG-1150

12. Public Risk

I1Probability of a large release1 .OE-05

1.OE-06

1.OE -07

1.OE-08

1.OE-09

1.OE-10

1.OE-05

1.OE-06

1.OE-07

1.OE-08

I.OE-09

1.OE-10

* Laos* 141666 - Rele* thatsn reult In nd for oresfly at1i1ties.

+Legend

medis I

.

SURRY PEACHBOTTOM

SEQUOYAH GRANDGULF

ZION

Probability of a large release

SURRY - FIRE PEACH BOTTOM - FIRE

Notes: As discussed in Reference 12.9, estimated risks at or below 1E-7 should be viewed with cau-tion because of the potential impact of events not studied in the risk analyses.

"+" indicates recalculated mean value based on recent modifications to the Zion plant (as dis-cussed in Section C. 15).

Figure 12.5 Frequency of one or more early fatalities at all plants.

NUREG-1 150 12-6

12. Public Risk

* The principal challenges to containmentstructures vary considerably among the fiveplants studied. Hydrogen combustion is a sig-nificant threat to the Sequoyah and GrandGulf plants (in part because of the inop-erability of ignition systems in some key acci-dent sequences), while direct attack of thecontainment structure by molten core mate-rial is most important in the Peach Bottomplant. Few physical processes were identifiedthat could seriously challenge the Surry andZion containments.

* Emergency response parameters (warningtime, evacuation speed, etc.) appear to havea significant impact on early fatality risk butalmost no effect on latent cancer fatality risk.


Results of the present study (for internal initia-tors) are compared with the Surry and Peach Bot-tom results in the Reactor Safety Study (RSS) inFigure 12.1. In general, for the early fatality riskmeasure, the Surry risk estimates in this study arelower than the corresponding RSS PWR values.Similarly, the present Peach Bottom risk estimatesare lower than the RSS BWR estimates. For thelatent cancer fatality risk measure, the patterns inthe results are less clear; the RSS risk estimatesfor both of the plants lie in the upper portion ofthe risk estimates of this study.

Focusing on the major contributors to risk, it maybe seen that, in the RSS, the Surry risk was domi-nated by interfacing-system LOCA (the V se-quence), station blackout (TMLB'), and smallLOCA sequences, with hydrogen burning andoverpressure failures of containment. While theestimated risks of the interfacing-system LOCAaccident sequence are lower in the present studybecause of a lower estimated frequency, it is stillan important contributor to risk. Also important(because of their large source terms) are contain-ment bypass accidents initiated by steam genera-tor tube rupture, compounded by operator errors(which result in core damage) and subsequentstuck-open safety-relief valves on the secondaryside. Early overpressurization containment failureat Surry is much less probable.

In the Peach Bottom analysis of the RSS, risk wasdominated by transient-initiated- events with lossof heat removal (TW type of sequence) andATWS accidents with failure of containment prior

to vessel breach. Dominant containment failuremodes were from steam overpressurization. In thepresent study, risk is dominated by long-term sta-tion blackout and ATWS accident sequences. Thedominant containment failure mode is drywellmeltthrough.

The RSS did not perform an analysis of accidentsinitiated by fires. As such, comparisons of the pre-sent study's fire risk estimates with the RSS arenot possible.

Since the publication of the RSS in 1975, a vastamount of work has been done in all areas of riskanalysis, funded by government agencies and thenuclear industry. Major improvements have beenmade in the understanding of severe accidentphenomenology and approaches to quantificationof risk, many of which have been used in thisstudy. These efforts have helped in lowering theestimates of overall risk levels in the present studyto some extent by reducing the use of conservativeand bounding types of analyses. Equally impor-tant, some plants have made modifications toplant systems or procedures based on PRAs, les-sons learned from the Three Mile Island accident,etc., thus reducing risk. On the other hand, newissues have been raised and the possibility of newphenomena such as direct containment heatingand drywell meltthrough has been introduced,which added to the previous estimates of risk. Forissues that are not well understood, expert judg-merits were elicited that frequently showed diverseconclusions. The net effect of this improved un-derstanding is that total plant risk estimates arelower than the RSS estimates, but the distributionsof these risk measures are very broad.

12.4 Perspectives

As discussed above, plant-specific features con-tribute largely to the estimates of risks. In order tocompare the variables and characteristics of thethree PWR plants (Surry, Sequoyah, and Zion)and two BWR plants (Peach Bottom and GrandGulf) in this study, the dominant contributors toearly and latent cancer fatality risks for the PWRsand BWRs from internally initiated events areshown in Figures 12.6 through 12.10. Dominantcontributors to risk from fire-initiated accidentsfor Surry and Peach Bottom are compared in Fig-ure 12.9. Perspectives on risks for the five plantsfrom these comparisons, supplemented by infor-mation in the supporting contractor reports (Refs.12.1 through 12.7) are discussed below.

12-7 NUREG- 1150

12. Public Risk

SURRY EARLY FATALITY SURRY LATENT CANCER FATALITYMEAN * 2E-G/RY MEAN * .2E-31RY

6

Plant Damage States

1. So2. ATWSS. TBANtENIS4. LOCAe. BYPASS

SEQUOYAH EARLY FATALITY SEQUOYAH LATENT CANCER FATALITY

MEAN 2.SE-SIRY MEAN * 1.4E-2/RY

42 1

2

5

4

Plant Damage States

1. 8902. AWS3. TRANSIENTS4. LOCA0. BYPASS

5

ZION EARLY FATALITYMEAN * 1.IE-4/RY

ZION LATENT CANCER FATALITYMEAN * 2.4E-2/RY

1

4 \ 6

6

Plant Damage StatesIL 802. ATWS3. TRANSIENTS4. LOCA6. BYPASS

Figure 12.6 Contributions of plant damage states to mean early and latent cancerfatality risks for Surry, Sequoyah, and Zion (internal events).

NUREG-1 150 12-8

12. Public Risk

PEACH BOTTOM EARLY FATALITY

MEAN 2.OE-/RY

PEACH BOTTOMLATENT CANCER FATALITY

MEAN 4.6E-3/RY

3

1

Plant Damage States

1. LOCA2. 680S. ATWS4. TRANSIENT$

I1

31 4

3

GRAND GULFEARLY FATALITY

MEAN * 8.2E-R/RY

GRAND GULFLATENT CANCER FATALITY

MEAN * 9.6E-4/RY

1

3

1

2 2 3wPlant Damage States

1. LONG TERM OBO2. SHORT TERM 8BO3. ATWS4. TRANSIENTS

Figure 12.7 Contributions of plant damage states to mean early and latent cancerfatality risks for Peach Bottom and Grand Gulf (internal events).

12-9 NUREG-1 150

12. Public Risk

SURRY EARLY FATALITYMEAN 2E-f/AY

SURRY LATENT CANCER FATALITYMEAN 4.21-3RY

Accident Progression Bins

1. Ve, Early CF. Alpha Mod.2. VD, Early CF. nCS Prsasr. '200 pals at VD3. VD. Early CF. RCS Praauw 200 po at VS4. VB. BMT and Late Look6. BypassS. VB. No CF7. No VB

SEQUOYAH EARLY FATALITYUEAN 2BE-E/RY

SEQUOYAH LATENT CANCER FATALITYMEAN tAN-2/RY

0 ' X

Accident Progression Bins 71. Va. CF Before Va2. VS, ECF. Alpha Mod*. YE.B EF. RO Preaauro'200 ps at VS

4. VS. ECF. RG Pre.aura'200 pats at VS. VD, Late CFB. VS. BMT. Very Late LeakT. BypssS Va. No CF9. No VB

ZION EARLY FATALITYMEAN * 1.11-4/1Y

ZION LATENT CANCER FATALITYMEAN 2.4E-2/NtV

1

2

Accident Progression Bns. YPASS

2. EARLY CNT. FAILURE

Figure 12.8 Contributions of accident progression bins to mean early and latent cancerfatality risks for Surry, Sequoyah, and Zion (internal events).

NUREG-1 150 12-10

12. Public Risk

PEACH BOTTOM EARLY FATALITY

MEAN 2E-8/RY


MEAN 4.8E-3/RY

444

Accident Progression Bins1. VB, ECF, WW Failure. V Pressv200 pals at VB2. VB, ECF, WW Failure, V Pross4200 pls at VS3. VB, ECF. DW Failure, V Prewa200 pals at VS4. VS, ECF, DW Failure V Pross4200 pals at VS6. VB, Late CF, WW FailureI. VL, Late CF, DW Failure7. VS, Vent8. VB, No CF9. No VD

GRAND GULFEARLY FATALITY

MEAN * 82E-9/RY

GRAND GULFLATENT CANCER FATALITY

MEAN * 9.6E-4/RY

4

8~~~~~~~~8~~~~~~ 8

2 3 5Accident Progression Bins

1. B, ECF, EARLY SP BYPASS, CONT. SPRAYS NOT AVAIL.2. VB, ECi, EARLY SP BYPASS, CONT. SPRAYS AVAILS. VB ECF, LATE SP BYPASS4. VB ECF, NO SP BYPASS8. YB, LATE CF8.- VB, VENT7. VB, NO CF8. NO vY

Figure 12.9 Contributions of accident progression bins to mean early and latent cancer fatalityrisks for Peach Bottom and Grand Gulf (internal events).

12-1 1 NUREG-1150

12. Public Risk

SURRY EARLY FATALITY(FIRE)

MEAN * 3.8E-8/RY

SURRY LATENT CANCER FATALITY(FIRE)

MEAN 2.7E-4/RY

1

3

2 4

Accident Progression Bins1. VB, Early CF, Alpha Mode2. VB, Early CF. RCS Pressure 200 pala at VB3. YB. Early CF, RCS Pressure 200 pia at VB4. YB. BMT and Late Leak6. BypassB. VB, No CF7. No YB

PEACH BOTTOM EARLY FATALITY(FIRE)

MEAN * 3.6E-7/RY


(FIRE)

MEAN - 3.4E-2/RY

3 3164

Accident Progression Bins

1. YB, ECF, WW Failure, V Press>200 puia at VB2. VB, ECF, WW Failure, V Prewa'200 paia at VB3. YB, ECF, DW Failure, V Presa)200 psia at VB4. YB, ECF, DW Failure. V Pressc200 psia at VB6. YB, Late CF, WW Failure6. V8, Late CF, DW Failure7. VB. Vent8. VB, No CF0. No VB

Figure 12.10 Contributions of accident progression bins to mean early and latent cancer fatalityrisks for Surry and Peach Bottom (fire-initiated accidents).

NUREG-1 150 12-12

12. Public Risk

Accident Sequences Important to Risk

* Mean early fatality risks at Surry and Se-quoyah and latent cancer fatality risk atSurry are dominated by bypass accidents(Event V and steam generator tube ruptureaccidents). Sequoyah latent cancer risk isdominated equally by loss of offsite power se-quences and bypass accidents. The risk atZion is dominated by medium LOCA se-quences resulting from the failure of reactorcoolant pump seals, induced by failures ofthe component cooling water system (CCWS)or service water system. Zion has the featurethat CCWS (supported by the service watersystem) cools both the reactor coolant pumpseals and high-pressure injection pump oilcoolers, thus creating the potential for acommon-mode failure. (As discussed inChapter 7, steps have been taken by theplant licensee to address this dependency.)

* BWR risks are driven by events that fail amultitude of systems (i.e., reduce the redun-dancy through some common-mode or sup-port system failure) or events that require asmall number of systems to fail in order to getto core damage, such as ATWS sequences.The accidents important to both early fatalityand latent cancer fatality risk at Peach Bot-tom are station blackouts and ATWS; the ac-cident most important at Grand Gulf is sta-tion blackout.

* For the Peach Bottom plant, the estimatedrisks from accidents initiated by fires, whilelow, are greater than those from accidents in-itiated by internal events. Fire-initiated acci-dents are similar to station blackout accidentsin terms of systems failed and accident pro-gression. As such, the conditional probabilityof early containment failure is relatively high,principally due to the drywell shell melt-through failure mode (see Chapter 9 for ad-ditional discussion) (the conditional probabil-ity is somewhat higher because of the lowerprobability of ac power recovery). For theSurry plant, the fire risks are estimated to besmaller than those from internal events. Thisis because of two reasons: the frequency ofcore damage from fire initiators is lower; andfire-initiated accidents result in low condi-tional probabilities of early containment fail-ure. As noted above, the internal-event risksare dominated by containment bypass acci-dents.

Containment Failure Issues Important to Risk

* At Surry, containment bypass events(interfacing-system LOCAs and steam gen-erator tube ruptures) are assessed to be mostimportant to risk. Other containment failuremodes of less importance are: static failureat the containment spring line from loads atvessel breach (i.e., direct containment heat-ing loads, hydrogen burns, ex-vessel steamexplosion loads, and steam blowdown loads);or containment failure from in-vessel steamexplosions (the "alpha-mode" failure of theReactor Safety Study). These failure modeshave only a small probability of resulting inearly containment failure.

* At Zion, the conditional probability of earlycontainment failure is small, comparable tothat of Surry. Those containment failuremodes that contribute to this small failureprobability include alpha-mode failure, con-tainment isolation failure, and overpress-urization failure at vessel breach.

* In previous studies, the potential impact ofdirect containment heating loads was foundto be very important to risk. In this study, thepotential impact is less significant for theSurry and Zion plants. Reasons for this re-duced importance include:

- Temperature-induced and other depres-surization mechanisms that reduce theprobability of reactor vessel breach athigh reactor coolant system pressure,either eliminating direct containmentheating (DCH) or reducing the pressurerise at vessel breach. These depressuri-zation mechanisms are stuck-openpower-operated relief valves, reactorcoolant pump seal failures, accident-in-duced hot leg and. surge line failures,and deliberate opening of PORVs by op-erators; and

- The size and the strength of the Surrycontainment (the maximum DCH loadhas only a conditional probability of 0.3of failing the containment).

Additional discussion of the issue of directcontainment heating may be found in Section9.4.3 and Section C.5 of Appendix C.

* At Sequoyah, containment bypass events areassessed to be most important to mean earlyfatality risk. Another failure important to

12-13 NUREG-1 150

12. Public Risk

early fatality risk is early failure of contain-ment. In particular, the catastrophic rupturefailure mode dominates early containmentfailures, which occur as a result of pre-vessel-breach hydrogen events and failures at vesselbreach. The failures at vessel breach are theresult of a variety of load sources (individu-ally or in some combinations), including di-rect containment heating loads, hydrogenburns, direct contact of molten debris withthe steel containment, alpha-mode failures,or loads from ex-vessel steam explosions.The bypass mode of containment failure andearly containment failures dominate themean latent cancer risk at Sequoyah andcontribute about equally to this consequencemeasure.

* At Peach Bottom, drywell meltthrough is themost important mode of containment fail-ure. Other containment failure modes of im-portance are: drywell overpressure failure,static failure of the wetwell (above as well asbelow the level of the suppression pool), andstatic failure at the drywell head.

* At Grand Gulf, the risk is most affected bycontainment failures in which both the dry-well and the containment fail. As discussedin Chapter 9, roughly one-half the contain-ment failures analyzed in this study also re-sulted in drywell failure. The principal causesof the combined failures were hydrogen com-bustion in the containment atmosphere andloads at reactor vessel breach (direct contain-ment heating, ex-vessel steam explosions, orsteam blowdown from the reactor vessel).

Source Term and Offsite Consequence IssuesImportant to Risk

* BWR suppression pools provide a significantbenefit in severe accidents in that they effec-tively trap radioactive material (such as io-dine and cesium) released early in the acci-dent (before vessel breach) and, for somecontainment failure locations, after vesselbreach as well.

* Accidents that bypass the containment struc-ture compromise the many mitigative fea-tures of these structures and thus can havesignificant estimated radioactive releases. Asnoted above, such accidents dominated therisk for the Surry and Sequoyah plants.

* The design of the reactor cavity can signifi-cantly influence long-term releases of radio-

active material; if large amounts of water canenter the cavity (e.g., as at Sequoyah), re-leases during core-concrete interactions canbe significantly mitigated.

* Site parameters such as population densityand evacuation speeds can have a significanteffect on some risk measures (e.g., early fa-tality risk). Other risk measures, such as la-tent cancer fatality risk and individual earlyfatality risk, are less sensitive to such parame-ters. Latent cancer fatality risks are sensitiveto the assumed level of interdiction of landand crops. (These issues are discussed inmore detail below.)

Factors Important to Uncertainty in Risk

In order to identify the principal sources of uncer-tainties in the estimated risk, regression analyseshave been performed for each of the plants in thisstudy. A stepwise linear model is used, and, ingeneral, the dependent variable is a risk measure(e.g., early fatalities per year) although somestudy has been done on the Surry plant using fre-quencies of radionuclide releases (discussed inSection 10.4.3). The independent variables con-sisted of individual parameters and groups of cor-related parameters. Also, the analyses are gener-ally performed for the complete risk model,although in some cases analyses are performed onspecific plant damage states. The extent to whichthis model accounted for the overall uncertainty(the R-square value) varied considerably, fromroughly 30 percent in the analysis of latent cancerfatality risk in the Sequoyah plant to roughly 75percent in the analysis of early fatality risk in theSurry plant.

The results of the regression analyses indicate thefollowing:

* For Surry, the uncertainty in all risk meas-ures is dominated by the uncertainties in pa-rameters determining the frequencies of con-tainment bypass accidents (interfacing-systemLOCA and steam generator tube rupture(SGTR)) and the radioactive release magni-tudes of these accidents. More specifically,the most important parameters are the initiat-ing event frequencies for these bypass acci-dents, the fraction of the core radionuclideinventory released into the vessel, and thefraction of material in the vessel in an SGTR-initiated core damage accident that is re-leased to the environment. With the high riskimportance of bypass accidents, it is not sur-prising that uncertainties in bypass accidentparameters are important to risk uncertainty,

NUREG-t 150 12-14

12. Public Risk

while other parameters such as those relatingto source terms in containment, containmentstrength, etc., are not found to be important.

* For Zion, the regression analyses also indi-cated that accident frequency and sourceterm parameter uncertainties were most im-portant. More specifically, the most impor-tant parameters were the initiating event fre-quencies for loss of component cooling water(CCW)/service water (SW), the failure to re-cover CCW/SW, the fraction of the coreradionuclide inventory released into the ves-sel, the radionuclide containment transportfraction at vessel breach, and the fraction ofradionuclides released to the environmentthrough the steam generators. The impor-tance of the loss of CCW/SW frequencies isnot surprising, given the large contribution ofaccidents initiated by these events to the coredamage frequency. Also, those source termparameters that influence the release frac-tions for early containment failure and bypassevents are not surprisingly important to somerisk measures. The only accident progressionparameter that was demonstrated to be im-portant to the uncertainty in risk was theprobability of vessel and containment breachby an in-vessel steam explosion. This resultoccurs because the probability of early con-tainment failure from all other causes is ex-tremely low at Zion, so that (at these verylow probability levels) uncertainty in the in-vessel steam explosion failure mode becomesmore significant. The importance of thesteam explosion failure mode is also moresignificant because the accident progressionanalysis for Zion indicates that the reactorcoolant system (RCS) is not likely to be athigh pressure when vessel breach occurs.This means that loads at vessel breach fromdirect containment heating are likely to besmaller than would have been the case if RCSpressure were high. Also, at low RCS pres-sure, the probability of triggering an in-vesselsteam explosion is increased.

* For Sequoyah, the regression analysis for thecomplete risk model did not account for alarge fraction of the uncertainty. As such, re-gression analyses were performed for individ-ual plant damage states (PDSs). For the con-tainment bypass PDSs (which dominated themean risk at Sequoyah), the most importantuncertainties related to accident frequencyand source term issues. More specifically, forthe interfacing-system LOCA PDS, the most

important parameter uncertainties were thosefor the initiating event frequency, the prob-ability that releases will be scrubbed by firesprays in the vicinity of the break, and thedecontamination factor of the fire sprays.For the SGTR-initiated core damage acci-dent, the most important parameters are theinitiating event frequency, the fraction of thecore radionuclide inventory released into thevessel, and the fraction of material in the ves-sel that is released to the environment.

For the station blackout, LOCA, and tran-sient plant damage states, the uncertainty inearly fatality risk is accounted for by parame-ters from the accident frequency, accidentprogression, and source term analysis, withnone of these groups or any small set of pa-rameters dominating. In this circumstance,the parameters relating to the containmentfailure pressure, the fraction of the core par-ticipating in a high-pressure melt ejection,and the pressure rise at vessel breach for low-pressure accident sequences appeared assomewhat important for each of these plantdamage states (but, again, did not by them-selves or in combination dominate the uncer-tainty estimation).

* For Peach Bottom, the regression analysis forthe complete internal-event model indicatedthat the risk uncertainty is dominated by un-certainties in radioactive release uncertain-ties-more specifically, the dominating pa-rameters relating to the fraction of the coreradionuclide inventory released into the ves-sel before vessel breach, the fraction of theradionuclide inventory released during core-concrete interaction that is released fromcontainment, and the fraction of the radio-nuclide inventory remaining in the core ma-terial at the initiation of core-concrete inter-action that is released during that interaction.

The regression analysis on the fire risk modeldoes not show such a clear domination byany parameters. The early fatality risk uncer-tainty is dominated by radioactive releaseparameters (the fraction of core radionuclideinventory released to the vessel before vesselbreach, the fraction of radionuclide inven-tory remaining in the core material at theinitiation of core-concrete interaction that isreleased during that interaction, and the frac-tion of the radionuclide inventory releasedduring core-concrete interaction that isreleased from containment). The latent can-cer fatality risk uncertainty is dominated by

12-15 NUREG-1 150

12. Public Risk

accident frequency parameters (fire initiatingevent frequencies, diesel generator failure-to-run probability).

* For Grand Gulf, the uncertainty in earlyhealth effect parameters (early fatalities andindividual early fatalities within 1 mile) is notdominated by any small set of parameters.Rather, it is accounted for by a number ofparameters that determine the frequenciesand radioactive release magnitudes of thoseevents leading to early containment failure,such as the amount of hydrogen generatedduring the in-vessel portion of the accidentprogression, and the frequency of loss of off-site power. The uncertainties in the other riskmeasures are dominated by uncertainties inaccident frequency parameters (includingloss of offsite power frequency, diesel genera-tor failure-to-start probability, diesel genera-tor failure-to-run probability, and the prob-ability that the batteries fail to deliver powerwhen needed).

Impact of Emergency Response andProtective Action Guide Options

Sensitivity calculations were performed as a partof this study to assess the impacts of differentemergency response and protective action guideoptions on estimates of risks for the five plants.

Emergency Response Options

In order to study the effects of emergency re-sponse options under severe accident conditionson public risk, the plants were analyzed using thefollowing assumptions, and changes in the earlyfatality risk were calculated:

* Base Case: 99.5 percent evacuation from 0to 10 miles

* Option 1: 100 percent evacuation from 0to 10 miles

* Option 2: 0 percent evacuation with earlyrelocation from high contamination areas

* Option 3: 100 percent sheltering

* Option 4: 100 percent evacuation from 0to 5 miles and 100 percent sheltering from 5to 10 miles

The last two options are used in the Zion plantanalysis only. Results of the analyses are pre-sented in Figure 12.11.

As discussed in Section 11.3, radionuclide releasemagnitudes associated with the early phase of anaccident for Peach Bottom and Grand Gulf aretypically smaller than those for the other threeplants because of the mitigative effects of suppres-sion pool scrubbing. The source term groups forPeach Bottom and Grand Gulf were typicallyfound to have longer warning times than for thePWRs studied because the accident sequences de-veloped more slowly. Further, Peach Bottom andGrand Gulf have very low surrounding populationdensities, which leads to shorter evacuation delaysand higher evacuation speeds. The effect of allthese considerations is that, for Peach Bottom andGrand Gulf, evacuation is more effective in reduc-ing early fatality risk than for Surry, Sequoyah,and Zion.

For Surry and Sequoyah, the risk-dominant acci-dent is the interfacing-system LOCA (the V se-quence). This accident has a very short warningtime, and, consequently, evacuation actions arenot very effective. Also for Sequoyah, some high-consequence releases occur from containmentfailure at vessel breach; these releases are highlyenergetic and cause plume rise. This reduces earlyfatality risk, as is indicated in the case of Option 2for Sequoyah; however, this also reduces the ef-fectiveness of evacuation. Further details onemergency response options are provided inChapter 11.

Protective Action Options

In this study an interdiction criterion of 4 rems(effective dose equivalent (EDE)) in 5 years hasbeen used for groundshine and inhalation of re-suspended radionuclides. Sensitivity calculationshave been performed using the equivalent of theReactor Safety Study (RSS) criterion, i.e., 25-remEDE in 30 years. The impact of such an alterna-tive criterion on mean latent cancer fatality risk isshown in Figure 12.12. As may be seen, the RSScriterion is less restrictive than the criterion usedin this study, and the corresponding latent cancerfatalities using the RSS criterion are higher by 12percent (for Grand Gulf) to 47 percent (for PeachBottom).

NUREG- 1150 12-16

12. Public Risk

1.OE-03

1.OE-04

1.OE-05

1.OE-06

1,0E-07

1.OE-08

1 .OE-09

1.OE-10

Early fatality/ry

SURRY PEACH SEOUOYAH GRAND ZION 3BOTTOM B12 GULF B4

22

:B1

22

B

B LEGENDI )EAN

MEDIANCON TD.BELOW

Aj~~~I T

BASE CASE (B)

99.6% Evacuation from 0 to 10 miles

EMERGENCY RESPONSE OPTIONS (1 TO 4)

1. 100% Evacuation from 0 to 10 miles2. 0% Evacuation with early relocation from

high contamination areas3. 100% Sheltering4. 100% Evacuation from 0 to 5 miles, and

100% sheltering from 5 to 10 miles

Note: As discussed in Reference 12.9, estimated risks at or below E-7 should be viewed withcaution because of the potential impact of events not studied in the risk analyses.

Figure 12.11 Effects of emergency response assumptions on early fatality risks atall plants (internal events).

12-17 NUREG-1 150

12. Public Risk

MEAN LATENT CANCER FATALITY RISK/YR0.05

0.04 F

0.03 F

0.02 F

0.01

0 ,. .:t.:Z-wNSSSSSSS\^XS

SURRY SEQUOYAH PEACHBOTTOM

GRANDGULF

ZION

BASE CASE X RSS PAG

Figure 12.12 Effects of protective action assumptions on mean latent cancer fatal-ity risks at all plants (internal events).

NUREG-1 150 12-18

12. Public Risk


12.1 E. D. Gorham-Bergeron et al., "Evalu-ation of Severe Accident Risks: Method-ology for the Accident Progression,Source Term, Consequence, Risk Integra-tion, and Uncertainty Analyses," SandiaNational Laboratories, NUREG/CR-4551, Vol. 1, Draft Revision 1, SAND86-1309, to be published.*

12.2 F. T. Harper et al., "Evaluation of SevereAccident Risks: Quantification of MajorInput Parameters," Sandia National Lab-oratories, NUREG/CR-4551, Vol. 2,Revision 1, SAND86-1309, December1990.

12.3 R. J. Breeding et al., "Evaluation of Se-vere Accident Risks: Surry Unit 1," San-dia National Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, October 1990.

12.4 A. C. Payne, Jr., et al., "Evaluation ofSevere Accident Risks: Peach BottomUnit 2," Sandia National Laboratories,NUREG/CR-4551, Vol. 4, Draft Revision1, SAND86-1309, to be published.*

12.5 J. J. Gregory et al., "Evaluation of SevereAccident Risks: Sequoyah Unit 1," San-


dia National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, December 1990.

12.6 T. D. Brown et al., "Evaluation of SevereAccident Risks: Grand Gulf Unit 1,"Sandia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1,SAND86-1309, to be published. *


12.8 USNRC, "Safety Goals for the Operationof Nuclear Power Plants; Policy State-ment," Federal Register, Vol. 51, p.30028, August 21, 1986.

12.9 H. J. C. Kouts et al., "Special CommitteeReview of the Nuclear Regulatory Com-mission's Severe Accident Risks Report(NUREG-1150)," NUREG-1420, August1990.

12.10 USNRC, "Reactor Safety Study-An As-sessment of Accident Risks in U.S. Com-mercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.

12-19 NUREG- 1150

13. NUREG-1150 AS A RESOURCE DOCUMENT

13.1 Introduction

NUREG-1150 is one element of the NRC's pro-gram to address severe accident issues. The entireprogram was discussed in a staff documententitled "Integration Plan for Closure of SevereAccident Issues" (SECY-88-147) (Ref. 13.1).NUREG-1 150 is used to provide a snapshot of thestate of the art of probabilistic risk analysis (PRA)technology, incorporating improvements since theissuance of the Reactor Safety Study (Ref. 13.2).This chapter discusses the results ofNUREG-1150 (and its supporting contractorstudies, efs. 13.3 through 13.16) as a resourcedocument and examines the extent to which infor-mation provided in the document can be appliedin regulatory activities. This is accomplished byapplying NUREG-1150 results and principles toselected regulatory issues to illustrate how the in-formation and insights described in Chapters 3through 12 of this document can be used in theregulatory process. The discussion will concen-trate on technical issues although it is recognizedthat there are other issues (e.g., legal, procedural)that must be taken into account when makingregulatory decisions.

This report includes an examination of the severeaccident frequencies and risks and their associ-ated uncertainties for five licensed nuclear powerplants and uses the latest source term informationavailable from both the NRC and its contractorsand the nuclear industry. The information in thereport provides a valuable resource and insights tothe various elements of the severe accident inte-gration plan. The information provided and how itwill be used include the following:

* Probabilistic models of the spectrum of possi-ble accident sequences, containment events,and offsite consequences of severe accidentsfor use in:

- Development of guidance for the indi-vidual plant examinations of internallyand externally initiated accidents;

- Accident management strategies;

- Analysis of the need and appropriatemeans for improving containment per-formance under severe accident condi-tions;

- Characterization of the importance ofplant operational features and areas po-tentially requiring improvement;

- Analysis of alternative safety goal imple-mentation strategies; and

- Emergency preparedness and conse-quences.

* Data on the major contributing factors to riskand the uncertainty in risk for use in:

- Prioritization of research;

- Prioritization of generic issues; and

- Use of PRA in inspection.

In the following sections, these uses will be dis-cussed in greater detail, using examples based onthe risk analysis results discussed in previouschapters.

13.2 Probabilistic Models of AccidentSequences

NUREG-1150 identifies the dominant accidentsequences and plant features contributing signifi-cantly to risk at a given plant as well as the plantmodels used in the study. The plant models andresults underlying the report can be used to sup-port the development of staff guidance onlicensee-performed studies (individual plant ex-aminations, accident management studies) andstaff work in other areas related to severe acci-dents (e.g., improving containment performanceunder severe accident conditions). Such uses arediscussed in greater detail in the following sec-tions.

13.2.1 Guidance for Individual PlantExaminations

Plant-specific PRAs have yielded valuable per-spectives on unique plant vulnerabilities. TheNRC and the nuclear industry both have consider-able experience with plant-specific PRAs. This ex-perience, coupled with the interactions of NRCand the nuclear industry on severe accident is-sues, have resulted in the Commission's formulat-ing an integrated systematic approach to an ex-amination of each nuclear power plant nowoperating or under construction for possible sig-nificant risk contributions (sometimes called "out-liers") that might be plant specific and might be

13-1 NUREG-l1SO

13. Resource Document

missed without a systematic approach. In Novem-ber 1988, the NRC requested (by generic letter)that each licensed nuclear power plant perform anindividual plant examination (IPE) to identify anyplant-specific vulnerabilities to severe accidents(Ref. 13.17). The technical data generated in thecourse of preparing NUREG-1150 on severe acci-dent frequencies, risks, and important uncertain-ties were used in developing the analysis require-ments described in the IPE generic letter and thesupplemental guidance on the IPE external-eventanalysis (Ref. 13.18).* These studies will also aidthe staff in evaluating individual submittals, assess-ing the adequacy of the identification of plant-specific vulnerabilities by the licensee, and evalu-ating any associated potential plant modifications.

The extent to which NUREG-1 150 results are ap-plicable to different classes of reactors or to oper-ating U.S. light-water reactors as a group is illus-trated in Table 13.1. The generic insightspresented in NUREG-1150 are indicative of itemsthat may be applicable within a class of plants.This includes the identification of possible vul-nerabilities that may exist in plants of similar de-sign. These insights cannot be assumed to apply toa given plant without consideration of plant designand operational practices because of the designdifferences that exist in U.S. plants, particularlythose involving ancillary support systems (e.g., acpower, component cooling water) for the engi-neered safety features and differences in details ofcontainment design.

For some issues, the state of knowledge is verylimited, and it is not possible to identify plant-specific features that may influence the issue be-cause sensitivity analyses have not been per-formed. In other cases, the methodology isbroadly applicable, but the results are highly plantspecific. In spite of the plant-specific nature ofmany of the results, much can be learned fromone plant that can be applied to another. Exampletypes of generic applicability are presented in Ta-ble 13.1.

The NUREG-1150 methods refer not only to theanalytical techniques employed but the generalstructure and framework upon which the analyseswere conducted. These methods include the un-certainty analysis, expert elicitation methods, acci-dent progression event tree analysis, and sourceterm modeling. The general approaches adopted

In addition, NUREG-1150 provides extensive and de-tailed analyses of five nuclear power plants and thus of-fers licensees of those plants an opportunity to use thesestudies in developing their IPEs and submitting them onan expedited basis.

in these analysis procedures are not plant specificand are therefore adaptable to other plant analy-ses.

As noted above, plant-specific PRAs have yieldedvaluable perspectives on unique plant vul-nerabilities. These perspectives are, in general,not directly applicable to other plants, althoughthey provide useful information to the study ofplants of similar NSSS (nuclear steam supply sys-tem) and containment design. At the presenttime, the principal contributors to the likelihoodof a core damage accident at boiling.water reac-tors (BWRs) include sequences related to stationblackout or anticipated transients without scram(ATWS). Accident sequences making importantcontributions to the frequency of core damage ac-cidents at pressurized water reactors (PWRs) in-clude those initiated by a variety of electricalpower system disturbances (loss of a single ac bus,which initiates a transient; loss of offsite portionsof the equipment needed to respond to the tran-sient; loss of offsite power; and complete stationblackout), small loss-of-coolant accidents(LOCAs), loss of coolant support systems such asthe component cooling water system, ATWS, andinterfacing-system LOCAs or steam generatortube ruptures in which reactor coolant is releasedoutside the containment boundary. All have thepotential for being important at PWRs.

NUREG-1150 provides a wide spectrum ofphenomenological and operational data (much ofit of a very detailed nature). For example, infor-mation on hydrogen generation has been com-piled from experimental and calculational resultsas well as interpretations of these data by experts.This data base provides an important source ofinformation that may be used for NSSS contain-ment types similar to those studied here but issomewhat less applicable for different NSSS con-tainment types. The operational data base in-cludes component failure rates, maintenancetimes, and initiating-event frequency data. Muchof these data are generic in nature and thus appli-cable for selected classes of plants.

The analyses presented in Chapters 3 through 7,when combined with the information gained fromearlier PRA work sponsored by both NRC (e.g.,Ref. 13.19) and utilities, make it clear that thequantitative results (core damage frequencies andrisk results) calculated for internal and externalinitiators cannot be considered applicable to an-other plant, even if the plant has a similar NSSSdesign and the same architect-engineer was in-volved in the design of the balance of plant.

NUREG-1 150 13-2


Table 13.1 Utility of NUREG-1150 PRA process to other plant studies.

Applicability

Example Results Class of Plants Plant Population

1. Methods (e.g., uncertainty, elicitation, event tree/ high highfault tree)

2. General perspectives (e.g., principal contributors to medium lowcore damage frequency and risk)

3. Supporting data base on design features, operational high mediumcharacteristics, and phenomenology (e.g., hydrogengeneration in core damage accidents, operationaldata)

4. Quantitative results (e.g., core damage frequency, low lowcontainment performance, risk)

Site-specific requirements and differing utility re-quirements often lead to significant differences insupport system designs (e.g., ac power, dc power,service water) that can significantly influence theresponse of the plant to various potential acci-dent-initiating events. Further, different opera-tional practices, including maintenance activitiesand techniques for monitoring the operational re-liability of components or systems can have a sig-nificant influence on the likelihood or severity ofan accident.

13.2.2 Guidance for Accident ManagementStrategies

Certain preparatory and recovery measures can betaken by the plant operating and technical staffthat could prevent or significantly mitigate theconsequences of a severe accident. Broadly de-fined, such "accident management" includes themeasures taken by the plant staff to (1) preventcore damage, (2) terminate the progress of coredamage if it begins and retain the core within thereactor vessel, (3) maintain containment integrityas long as possible, and finally (4) minimize theconsequences of offsite releases. In addition, acci-dent management includes certain measures takenbefore the occurrence of an event (e.g., improvedtraining for severe accidents, hardware or proce-dure modifications) to facilitate implementation ofaccident management strategies. With all thesefactors taken together, accident management isviewed as an important means of achieving andmaintaining a low risk from severe accidents.

Under the staff program, accident managementprograms will be developed and implemented by

licensees. The NRC will focus on developing theregulatory framework under which the industryprograms will be developed and implemented, aswell as providing an independent assessment oflicensee-proposed accident management capa-bilities and strategies. NUREG-1150 has beenused by the NRC staff to support the developmentof the accident management program. NUREG-1150 methods provide a methodological frame-work that can be used to evaluate particularstrategies, and the current results provide some in-sights into the efficacy of strategies in place or thatmight be considered at the NUREG-1150 plants.Thus, the NUREG-1150 methods and results willsupport a staff review of licensee accident man-agement submittals.

PRA information has been used in the past to in-fluence accident management strategies; however,the methods used in NUREG-1150 can bringadded depth and breadth to the process, alongwith a detailed, explicit treatment of uncertainties.The integrated nature of the methods is particu-larly important, since actions taken during earlyparts of an accident can affect later accident pro-gression and offsite consequences. For example,an accident management strategy at a BWR mayinvolve opening a containment vent. This actioncan affect such things as the system response andcore damage frequency, the retention of radioac-tive material within the containment, and the tim-ing of radionuclide releases (which impacts evacu-ation strategies). It is possible that actions toreduce the core damage frequency can yieldaccident sequences of lower frequency but withmuch higher consequences. All these factors needto be considered in concert when developing

13-3 NUREG-1150


appropriate venting strategies. The treatment ofuncertainties is another key aspect of accidentmanagement. Generally, procedures are devel-oped based on "most likely" or "expected" out-comes. For severe accidents, the outcomes areparticularly uncertain. PRA models and results,such as those produced in the accident progres-sion event trees, can identify possible alternativeoutcomes for important accident sequences. Bymaking this information available to operators andresponse teams, unexpected events can be recog-nized when they occur, and a more flexible ap-proach to severe accidents can be developed. Therecent trend toward symptom-based, as opposedto event-based, procedures is consistent with thisneed for flexibility.

To demonstrate the potential benefits of an acci-dent management program, some example calcu-lations were performed, as documented in Refer-ence 13.20. For this initial demonstration, thesecalculations were limited to the internal-event ac-cident sequence portion of the analysis. Further,the numerical results presented are "point esti-mates" of the core damage frequency as opposedto mean frequency estimates. Selected examplesfrom the initial analysis are presented below.

Effect of Firewater System at Grand Gulf

The first NUREG-1150 analysis of the GrandGulf plant (Ref. 13.21) did not credit use of thefirewater system for emergency coolant injectionbecause of the unavailability of operating proce-dures for its use in this mode and the difficultiesin physically configuring its operation. However,since that time, the licensee has made significantsystem and procedural modifications. As a result,the firewater system at Grand Gulf can now beused as a backup source of low-pressure coolantinjection to the reactor vessel. The system wouldbe used for long-term accident sequences, i.e.,where makeup water was provided by other injec-tion systems for several hours before their subse-quent failure. The firewater system primarily aidsthe plant during station blackout conditions and isconsidered a last resort effort.

An examination has been made of the benefit ofthese licensee modifications to the Grand Gulfplant. As shown in Figure 13.1, these analysesshowed that the total core damage frequency wasreduced from 4E-6 to 2E-6 per reactor year be-cause of these changes.

Effect of Feed and Bleed on Core DamageFrequency at Surry

The NUREG-1 150 analysis for Surry includes theuse of feed and bleed cooling for those sequencesin which all feedwater to the steam generators islost (thus causing their loss as heat removal sys-tems). Feed and bleed cooling restores heat re-moval from the core using high-pressure injection(HPI) to inject into the reactor vessel and thepower-operated relief valves (PORVs) on thepressurizer to release steam and regulate reactorcoolant system pressure.

An examination has been made to determine towhat extent feed and bleed cooling decreases coredamage frequency at Surry. The current Surrymodel includes two basic events representing fail-ure modes for feed and bleed cooling in the eventof a loss of all feedwater. These modes are: opera-tor failure to initiate high-pressure injection andoperator failure to properly operate the PORVs.In order to examine the impact of feed and bleedcooling, both basic events were assumed to alwaysoccur. As shown in Figure 13.1, the resulting totalcore damage frequency for Surry (if feed andbleed cooling were not available) then increasesby roughly a factor of 1.3. That is, the availabilityof the feed and bleed core cooling option in theSurry design and operation is estimated to reducecore damage frequency from 4E-5 to 3E-5 perreactor year.

Gas Turbine Generator Recovery Action atSurry

The present NUREG-1150 modeling and analysisof the Surry plant have not considered the bene-fits of using onsite gas turbine generators for re-covery in the event of station blackout accidents.Both a 25 MW and a 16 MW gas turbine genera-tor are available to provide emergency ac power tosafety-related and non-safety-related equipment.These generators were not included in the analysisbecause, as currently configured, they would notbe available to mitigate important accident se-quences.

An examination has been made of the effect oncore damage frequency at Surry of including thegas turbine generators as a means of recoveryfrom station blackout sequences. To give creditfor the addition of one generator for emergencyac power, it is assumed that Surry plant personnelhave the authority to start the gas turbines whenrequired and that 1 hour is required to start thegas turbines and energize the safety buses. In theanalysis, the gas turbines were assumed to beavailable 90 percent. of the time.

NUREG-1150 13-4


1.OOOE-03

1 .OOOE- 04

1.OOOE-05

1.OOOE-06

LegendPCV: Primary Containment VentingFWS: Firewater SystemF&B: Feed and BleedCC: Cross-ConnectsGTG: Gas Turbine Generator0: Base case point estimateX Sensitivity point estimate

CC

F&B

x GTO

PCV

FWS

_ E

Peach GrandBottom Gulf

Surry Surry Surry

Figure 13.1 Benefits of accident management strategies.

13-5 NUREG-1150


The use of the onsite gas turbine was estimated toreduce core damage frequency from 3E-5 to2E-5 per reactor year.

High-Pressure Injection and Auxiliary Feed-water Crossconnects at Surry

The Surry Unit 1 plant is configured to recoverfrom loss of either the high-pressure injection(HPI) system or the auxiliary feedwater (AFW)system by operator-initiated crossconnection tothe analogous system at Unit 2. While these ac-tions provide added redundancy to these systems,new failure modes (e.g., flow diversion pathways)that were included in the modeling process forSurry have been created. The alignment of theUnit 1 and Unit 2 HPI and AFW systems forcrossconnect injection is modeled as a recoveryaction.

Analysis of the importance of crossconnect injec-tion at Surry includes two parts. First, credit forcrosscornect injection was removed from all ap-plicable dominant sequences, which were then re-quantified. Second, sequences that were previ-ously screened out of the analysis were checked todetermine if they would become dominant in theabsence of crossconnect injection. As shown inFigure 13.1, the point estimate of the total coredamage frequency without crossconnects is E-4,compared to the value of 3E-5 for internally initi-ated events in the base case.

Primary Containment Venting at PeachBottom

The primary containment venting (PCV) system atPeach Bottom is used to prevent primary contain-ment overpressurization during accident se-quences in which all containment heat removal islost. Most sequences of this type involve failure ofthe residual heat removal systems. Because of theexistence of this venting capability, no such acci-dent sequences appeared as dominant in theNUREG-1150 analysis for Peach Bottom.

The effect of the PCV system on the core damagefrequency at Peach Bottom was determined by ex-amining the sequences screened out in theNUREG- 150 analysis that included the PCV sys-tem as an event (primarily the sequences involvingloss of containment heat removal). Credit for thePCV system was removed from these sequences,which were then summed and added to the cur-rent point estimate of the core damage frequency.As shown in Figure 13.1, this results in a pointestimate of the Peach Bottom core damage fre-

quency witho-u containment venting of 9E-6,about a factor of 2.6 increase over theNUREG-lSO value of 4E-6.

13.2.3 Improving Containment Performance

The NRC has performed an assessment of theneed to improve the capabilities of containmentstructures to withstand severe accidents (Ref.13.1). Staff efforts focused initially on BWRplants with a Mark I containment, followed by thereview of other containment types. This programwas intended to examine potential enhanced plantand containment capabilities and procedures withregard to severe accident mitigation. NUREG-1150 provided information that served to focus at-tention on areas where potential containment per-formance improvements might be realized.NUREG-1 150 as well as other recent risk studiesindicate that BWR Mark I risk is dominated bystation blackout and anticipated transient withoutscram (ATWS) accident sequences. NUREG-1150 further provided a model for and showedthe benefit of a hardened vent for Peach Bottom(discussed above and displayed in Figure 13.1).The staff is currently pursuing regulatory actionsto require hardened vents in all Mark I plants,using NUREG-1150 and other PRAs in the cost-benefit analysis.

The NUREG-1150 accident progression analysismodels were used by the staff and its contractorsin the evaluation of possible containment im-provements for the PWR ice condenser and BWRMark III designs. The result of the staff reviews ofthese designs (and all others except the Mark I)was that potential improvements would best bepursued as part of the individual plant examina-tion process (discussed in Section 13.2.1).

13.2.4 Determining Important PlantOperational Features

NUREG-1150 will provide a source of informa-tion for investigating the importance of opera-tional safety issues that may arise during day-to-day plant operations. The NUREG-1150 models,methods, and results have already been used toanalyze the importance of venting of the suppres-sion pool, the importance of keeping the PORVsand atmospheric dump valves unblocked, the im-portance of operational characteristics of the icecondenser containment design, the importance ofoperator recovery during an accident sequence,and the importance of crossties between systems.These operational and system characteristics, aswell as many others, are described in detail inChapters 3 through 7. For example, characteris-tics of the Surry plant design and operation that

NUREG-1150 13-6


have been found to be important include crosstiesbetween units, diesel generators, reactor coolantpump seals, battery capacity, capability for feedand bleed core cooling, subatmospheric contain-ment operation, post-accident heat removal sys-tem, and reactor cavity design.

13.2.5 Alternative Safety GoalImplementation Strategies

On August 21, 1986, the Commission published aPolicy Statement on Safety Goals for the Opera-tion of Nuclear Power Plants (Ref. 13.22). In thisstatement, the Commission established two quali-tative safety goals supported by two risk-basedquantitative objectives that deal with individualand societal risks posed by nuclear power plantoperation. The objective of the policy statementwas to establish goals that broadly define an ac-ceptable level of radiological risk that might beimposed on the public as a result of nuclear powerplant operation.

The Commission recognized that the safety goalscould provide a useful tool by which the adequacyof regulations or regulatory decisions regardingchanges to the regulations could be judged. Safetygoals could be of benefit also in the much moredifficult task of assessing whether existing plantsthat have been designed, constructed, and oper-.ated to comply with past and current regulationsconform adequately with the intent of the safetygoal policy.

The models and results of NUREG-1150 can beused in a number of ways in the NRC staff'sanalysis and implementation of safety goal policy.For example, the five plants studied for this reporthave been compared with the two quantitativehealth objectives, as shown in Figure 13.2 for in-ternal initiators. Figure 13.3 compares Surry andPeach Bottom with the quantitative health objec-tives for fire initiators. As may be seen, the pre-sent risk estimates for these five plants (consider-ing internally initiated accidents) and for theSurry and Peach Bottom plants (considering fireinitiators) fall beneath the quantitative health ob-jective risk goals. In addition, however, it may beseen that the risk estimates among the five plantsvary considerably. An analysis of the plant designand operational differences that cause this vari-ability can provide valuable information to thestaff in its consideration of the balance of the pre-sent set of regulations and the areas of regulationthat could most benefit from improvement.

The staff has reviewed the NUREG-1 150 resultsat a broad level to determine the causes of thevariability among plant risks shown in Figure 13.2.

A number of design, operational, and siting fac-tors are important to this measure of plant riskand determine the relative location of a specificplant's risk range in comparison with other plantsand with the safety goal. At a general level, coredamage frequency, containment and source termperformance, and surrounding population demo-graphics all can affect the risk range. Thus, usingthe Surry plant as an example, the combination ofa relatively low core damage frequency, relativelygood containment performance, and a low popu-lation density act to ensure with a high probabilitythat the risk is below the safety goal.

The NUREG-1150 results can also be used tosupport the analysis of alternative safety goal im-plementation approaches. One subject of discus-sion in the staff's work is the need for a supple-mental definition of containment performance insevere accidents using the probability of a largerelease as a measure. An acceptable frequency forsuch a release was defined as 1-6 per reactoryear. A potential definition of a large release isone that can cause one or more early fatalities.'The present NUREG-1 150 risk analyses havebeen evaluated to provide the frequency of such arelease, as shown in Figure 13.4. The mean largerelease probabilities are below 1E-6 per reactoryear. Further staff work in assessing alternativedefinitions is planned as part of the safety goalimplementation program, and it is expected thatNUREG-1150 methods and results will be used.

13.2.6 Effect of Emergency Preparedness onConsequence Estimates

NUREG-1150 provides information for develop-ing protective action strategies that could be fol-lowed near a nuclear power plant in case of asevere accident. In developing strategies, consid-eration must be given to several types of protectiveactions, such as sheltering, evacuation, and relo-cation and various combinations. These strategiesare influenced by the types of severe accidentsthat might occur at a nuclear power plant, theirfrequency of occurrence, and the radioactive re-lease expected to result from each accident typeas well as by the topography, weather, populationdensity, and other site-specific characteristics.

NUREG-1150 provides assessments of a broadspectrum of potential core damage accidents thatcould occur at a nuclear power plant. These as-sessments permit the evaluation of hypothetical

'The Commission has now indicated that this is not anappropriate definition and has asked the staff to reviewand propose an alternative definition.

13-7 NUREG-1 150


IIndividual early fatality/ry1.OE-06

1.OE-07

1.OE-08

1.OE-09

1.OE-10

1.OE- 1

1.OE-05

1.OE-06

1.0E-07

1 .OE-08

1.OE-09

1.0E-10

i

iI

I

-==<--Safety GoalLegend

9l%

S~afi

median 8

_71SURRY PEACH SEQUOYAH GRAND ZION

BOTTOM GULF

Individual latent cancer fatality/ryLegend

<- Safety Goalmean

madlian...f

SURRY PEACHBOTTOM

SEOUOYAH GRANDGULF

ZION

Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor yearshould be viewed with caution because of the potential impact of events not studied inthe risk analyses.

Figure 13.2 Comparison of individual early and latent cancer fatality risks at all plants(internal initiators).

NUREG-1 150 13-8


Individual early fatality/ry1.OE -08

1.OE-07

- - Safety GoalLegend

1.0E-08

1.0E-09

1.01E-10

1.OE-1 1

1.OE-05

1.OE-06

1.OE-07

SURRY PEACH BOTTOMFIRE FIRE

Individual latent cancer fatality/ryl~~~~~~~~ I

-sf===Safety Goal

Legend -

-mean

median- L

1.OE-08

11.OE-09

1.OE-104a1

SURRYFIRE

PEACH BOTTOMFIRE

Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year shouldbe viewed with caution because of the potential impact of events not studied in the riskanalyses.

Figure 13.3 Comparison of individual early and latent cancer fatality risks at Surry andPeach Bottom (fire initiators).

13-9 NUREG-1150


FProbability of a large release1.OE-05

l.OE -06

1.OE-07

1 .OE-08

1 .OE-09

1.01E-10

1.OE-05

1.OE-06

1.OE-07

1.OE-08

1.0E-09

1.OE-10

Large :*vsls - Release Ibtar result n one or moot

early 18atal91*es

Legend

-Mean

Median- 5

lY 5s||*

IT -

SURRY PEACHBOTTOM

SEQUOYAH GRANDGULF

ZION

SURRY - FIRE PEACH BOTTOM - FIRE

Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year shouldbe viewed with caution because of the potential impact of events not studied in the riskanalyses.

Figure 13.4 Frequency of one or more early fatalities.

NUREG-1 150 13-10


dose savings for a spectrum of accidents and pro-vide a means for evaluating potential reduction inearly severe health effects (injuries and fatalities)in the event of an accident by implementing emer-gency response strategies.

The most important considerations in establishingemergency preparedness strategies are the warningtimes before release to initiate the emergency re-sponse and magnitude of the release of the radio-active material to the environment. The warningtime and magnitude of radioactive release are inturn strongly influenced by the time and size ofcontainment failure or bypass. If the containmentfails early, the radioactive release is generallylarger and more difficult to predict than if thecontainment fails late.

To evaluate the effectiveness of various protectiveactions, the conditional probabilities of acute redbone marrow doses exceeding 200 reins and 50reins were calculated for several possible actions,using Zion plant source terms as examples. Doseswere calculated on the plume centerline for vari-ous distances from the plant. The actions evalu-ated are:

* Normal activity-assumed that no protectiveactions were taken during the release but as-sumed that people were relocated within 6hours of plume arrival.

* Home sheltering-sheltering in a single familyhome (see Table 11.5 for a definition ofsheltering). The penetration fractions forgroundshine and cloudshine were representa-tive of masonry houses without basements aswell as wood frame houses with basements.Indoor protection for inhalation of radio-nuclides was assumed. People were relocatedfrom the shelter mode within 6 hours ofplume arrival.

* Large building shelter-sheltering in a largebuilding, for example, an office building,hospital, apartment building, or school. In-door protection for inhalation of radionu-clides was assumed. People were relocatedfrom the shelter mode within 6 hours ofplume arrival.

* Evacuation-doses were calculated for peoplestarting to travel at the time of release, 1hour before start of release, and 1 hour afterstart of release. An evacuation speed of 2.5mph was assumed.

Figure 13.5 shows the conditional probabilities ofexceeding a 50-rem and a 200-rem red bone mar-

row dose for the various possible response modesassuming an early containment failure at Zionwith source term magnitudes varying from low tohigh. Figure 13.6 shows similar results for a latecontainment failure at Zion.

Use of the above assumptions indicates that if alarge release occurs (Fig. 13.5), there is a largeprobability of doses exceeding 200 rems within 1to 2 miles from the reactor. Sheltering does notsignificantly lower this probability. Thus, if a largerelease can occur, it is prudent to consider promptevacuation prior to the start of the release.

At 3 miles and beyond, it is possible to avoiddoses exceeding 200 rerns by sheltering in largebuildings even if a large release were to occur.Thus, people in large buildings such as hospitalswould not necessarily have to be immediatelyevacuated, but could shelter instead. Of course,further reductions in dose are possible by evacu-ation.

At 10 miles, no protective actions except reloca-tion would be necessary to avoid 200-rem doses.Sheltering in large buildings or evacuation prior torelease would probably keep doses below 50 reins.

13.3 Major Factors Contributing toRisk

NUREG-1150 results can be used to identifydominant plant risk contributors and associateduncertainties. A discussion of these dominant riskcontributors is found in Chapters 3 through 8 andChapter 12. This section focuses on the use inguiding research, generic issue resolution, and in-spection programs.

Because of its integrated nature, discussion ofuncertainties, and reliance on more realistic as-sessments, PRA-based information found inNUREG-1150 and its supporting documents canbe used to guide and focus a wide spectrum ofactivities designed to improve the state of knowl-edge regarding the safety of individual nuclearpower plants, as well as that of the nuclear indus-try as a whole. The resources of both the NRCand the industry are limited, and the applicationof PRA techniques and subsequent insights pro-vides an important tool to aid the decisionmakerin effectively allocating these resources.

The nature of the many decisions necessary to al-locate regulatory resources does not require greatprecision in PRA results. For example, in assign-ing priorities to research or efforts to resolve ge-neric safety issues, it is sufficient to use broad

13-1 1 NUREG-1150


Probability of Exceeding 50-Rem Acute Red Bone Marrow Dose1

0.8

0.6

0.4

0.2

0

1

0.8

0.6

0.4

0.2

Early Containment Falluret. C42tiNs Normal "tvivlyt. * a e0t h o tieora. Sheter In arge building

4. tat eveesatlos 1 efre. eleseIf . lt t t release

a. alert evasvtti I y ater geesae

4

4 *~~~~~~

1 mile 3 miles 5 miles 10 mil*

Distance from Reactor

Probability of Exceeding 200-Rem Acute Red Bone Marrow Dose

i

Early Containment Failure1. CD=tls=e cerea sIsily

4. CeEeeees1hr Isis,. rleseC. alerlft 1sVeeeat at relsaee. lert oasele ier I ,.. Wto. relosse

a~~~~~~~~~~~~~~~~

LI , . . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

I mile 3 mniles a miles 10 mile.

Distance from reactor

Figure 13.5 Relative effectiveness of emergency response actions assuming early contain-ment failure with high and low source terms.

NUREG-1 150 13-12


Probability of Exceeding 50-Rem Acute Red Bone Marrow Dose1 ,

Late Containment Failure1. Cotilt ora activity2 or*mnt WhitarS Shalter N tarp, building4. Start evetuatjom hr before relaseS. Start action at rltearS. Start evacuation I hr ate rse*0.8 -

0.6

0.4

0.2

0

1

0.8

0.6

0.4

0.2

0

I

2

1 mile 3 miles s miles 10 mileS

Distance from Reactor

Probability of Exceeding 200-Rem Acute Red Bone Marrow Dose

Late containment failuret. Cestintla frermal aetiity2. B ilk at sheldt uder

8. S rel af n t rse b u ild ing4 Start *esV0ation 1 hr bater releatsS. stalt 4VaGqatioh it I4leazs. Start evieatirn I hr *fte? eease

I _ .__

I mile 3 miles 6 miles

Distance from Reactor10 miles

Figure 13.6 Relative effectiveness of emergency response actions assuming late contain-ment failure with high and low source terms.

13-13 NUREG-1150


categories of risk impact (e.g., high, medium, andlow) (Ref. 13.24). In a similar manner, informa-tion from PRAs can be used to guide the alloca-tion of resources in inspection and enforcementprograms (see Section 13.3.3).

13.3.1 Reactor Research

As noted earlier, the nature of the decisions nec-essary to allocate resources does not require greatprecision in PRA results. In prioritizing researchefforts, it is sufficient to use broad categories ofrisk impact (e.g., high, medium, and low). Agiven issue can be evaluated in terms of the num-ber of plants affected, the risk impacts on eachplant, the effect of modifications in reducing therisk, and the effect of additional knowledge onimproving the prediction of plant risk or severecore damage frequency or on reducing or definingmore clearly the associated uncertainties. Thesegeneric measures of significance, combined ap-propriately with other information (e.g., cost ofresolving the issue) can be used to evaluate theissue under consideration.

13.3.2 Prioritization of Generic Issues

The NRC has been setting priorities for genericsafety issues for several years using PRA as oneinformational input (Ref. 13.25). In prioritizingefforts to resolve generic safety issues, it is suffi-cient to use broad categories of risk impact (e.g.,high, medium, and low) in which only order-of-magnitude variations are considered important.The reasoning is that a potential safety issue wouldnot be dismissed unless it were clearly of low risk.Thus, one or more completed PRA studies canoften be selected as surrogates for the purpose ofassigning such priorities, even though they clearlydo not fully represent the characteristics of someplants, provided the nature of the difference isreasonably understood and can be qualitativelyevaluated.

As with any priority-assignment method, the finalresults must be tempered with an engineeringevaluation of the reasonableness of the assign-ment, and the PRA-based analysis can serve asonly one ingredient of the overall decision.

One of the most important benefits of using PRAas an aid to assigning priorities is the documenta-tion of a comprehensive and disciplined analysisof the issue, which enhances debate on the meritsof specific aspects of the issue and reduces reli-ance on more subjective judgments. Clearly, someissues would be very difficult to quantify with rea-sonable accuracy, and the assignment of priorities

to these issues would have to be based largely onsubjective judgment.

PRA is being usefully applied to setting prioritiesfor generic safety issues and to evaluating new is-sues as they are identified. In this effort, each is-sue is assessed as to its nature, its probable coredamage frequency and public risk, and the cost ofone or more conceptual fixes that could resolvethe issue. A matrix is developed whereby each is-sue is characterized as of high, medium, or lowprobability, or whether the issue should be sum-marily dropped from further regulatory considera-tion. This matrix considers both the absolute mag-nitude of the core damage frequency or risk andthe value/impact ratio of conceptual fixes. Risk-reduction estimates are normally made using sur-rogate PWRs and BWRs, based on existing PRAs.

A principal benefit of PRA-based prioritization,compared to other methods for allocating re-sources to safety issues, is that important assump-tions made in quantifying the risk are displayedand uncertainties in the analyses are estimated. Aprincipal limitation is that some of the issues, suchas those dealing with human factors, are onlysubjectively quantified. Thus, the uncertaintiescan be large. However, on balance, PRA-basedprioritization has been found to be quite useful.Although uncertainties may be large, the processforces attention on these uncertainties to a muchhigher degree than if the quantification were notattempted. Also, the uncertainties are normallypart of the issues themselves and not just an arti-fact of the PRA analysis.

Since, as discussed above, the prioritization isdone on an approximate (order-of-magnitude)basis, the new information developed inNUREG-1150 is not expected to substantiallychange previously developed priority rankings.However, a sample of key issues will be re-examined to determine whether, based on the up-dated information in NUREG-1150, changes indominant accident sequences or performance ofmitigative systems could substantially affect theprevious rankings.

13.3.3 Use of PRA in Inspections

The importance to NRC of risk-based inspectiondata is exemplified by the following statement inNRC's 5-Year Plan: "Probabilistic risk assessmenttechniques will be applied to all phases of the in-spection program in order to insure that in-spection activities are prioritized and conducted inan integrated fashion." Within NRC, the RiskApplications Branch of the Office of Nuclear Re-actor Regulation has the responsibility of directly

NUREG-1150 13-14


providing risk-based information to the regionaloffices and resident inspectors. This ongoing ef-fort has resulted in the development of plant-specific, and in some cases generic, PRA perspec-tives that help to provide an optimization ofinspection resources and a prioritization of inspec-tion resources on the high-risk aspects of a plant.Using draft NUREG-1150 data, team inspectionprocedures based on plant-specific PRA informa-tion have been developed and implemented onsuch plants as Grand Gulf. Formalization of these

inspection activities can be found in a recently is-sued inspection module entitled "Risk FocusedOperation Readiness Inspection Procedures."This module focuses on how to use PRA perspec-tives and conduct a risk-based team inspectionbased on risk insights. The spectrum of reactorplant design types addressed in NUREG-1150provide a broad risk data base that in many in-stances can be used to assist in inspection-type de-cisions even for plants without a PRA.

13-15 NUREG-1150



13.1 U.S. Nuclear Regulatory Commission(USNRC), "Integration Plan for Closure ofSevere Accident Issues," SECY-88-147,May 25, 1988.

13.2 USNRC, "Reactor Safety Study-An As-sessment of Accident Risks in U.S. Com-mercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.

13.3 D. M. Ericson, Jr.,(Ed.) et al., "Analysisof Core Damage Frequency: InternalEvents Methodology," Sandia NationalLaboratories, NUREG/CR-4550, Vol. 1,Revision 1, SAND86-2084, January 1990.

13.4 T. A. Wheeler et al., "Analysis of CoreDamage Frequency from Internal Events:Expert Judgment Elicitation," Sandia Na-tional Laboratories, NUREG/CR-4550,Vol. 2, SAND86-2084, April 1989.

13.5 R. C. Bertucio and J. A. Julius, "Analysisof Core Damage Frequency: Surry Unit1," Sandia National Laboratories,NUREG/CR-4550, Vol. 3, Revision 1,SAND86-2084, April 1990.

13.6 A. M. Kolaczkowski et al., "Analysis ofCore Damage Frequency: Peach BottomUnit 2," Sandia National Laboratories,NUREG/CR-4550, Vol. 4, Revision 1,SAND86-2084, August 1989.

13.7 R. C. Bertucio and S. R. Brown, "Analysisof Core Damage Frequency: SequoyahUnit 1," Sandia National Laboratories,NUREG/CR-4550, Vol. 5, Revision 1,SAND86-2084, April 1990.

Consequence, Risk Integration, and Uncer-tainty Analyses," Sandia National Labora-tories, NUREG/CR-4551, Vol. 1, DraftRevision 1, SAND86-1309, to be pub-lished. *

13.11 F. T. Harper et al., "Evaluation of SevereAccident Risks: Quantification of MajorInput Parameters," Sandia National Labo-ratories, NUREG/CR-4551, Vol. 2, Revi-sion 1, SAND86-1309, December 1990.

13.12 R. J. Breeding et al., "Evaluation of SevereAccident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREG/CR-4551,Vol. 3, Revision 1, SAND86-1309, Octo-ber 1990.

13.13 A. C. Payne, Jr., et al., "Evaluation ofSevere Accident Risks: Peach BottomUnit 2," Sandia National Laboratories,NUREG/CR-4551, Vol. 4, Draft Revision1, SAND86-1309, to be published.*


13.15 T. D. Brown et al., "Evaluation of SevereAccident Risks: Grand Gulf Unit 1,"Sandia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1,SAND86-1309, to be published.*


13.17 USNRC, "Individual Plant Examination forSevere Accident Vulnerabilities-10 CFR§50.54(f)," Generic Letter 88-20, Novem-ber 23, 1988.

13.18 USNRC, "Procedural and Submittal Guid-ance for the Individual Plant Examinationof External Events (IPEEE) for Severe Ac-cident Vulnerabilities," NUREG-1407,Draft Report for Comment, July 1990.

'Available in the NRC Public Document Room, 2120 LStreet NW., Washington, DC.

13.8 M. T. Drouin et al., "Analysis of CoreDamage Frequency: Grand Gulf Unit 1,"Sandia National Laboratories, NUREG/CR-4550, Vol. 6, Revision 1, SAND86-2084, September 1989.

13.9 M. B. Sattison and K. W. Hall, "Analysisof Core Damage Frequency: Zion Unit 1,"Idaho National Engineering Laboratory,NUREG/CR-4550, Vol. 7, Revision 1,EGG-2554, May 1990.

13.10 E. D. Gorham-Bergeron et al., "Evaluationof Severe Accident Risks: Methodology forthe Accident Progression, Source Term,

NUREG-1150 13-16


13.19 USNRC, "Probabilistic Risk AssessmentReference Document," NUREG-1050,September 1984.

ment," Federal Register,30028, August 21, 1986.

Vol. 51, p.

13.20 A. L. Camp et al., "The Risk ManagementImplications of NUREG-1150 Methodsand Results," Sandia National Laborato-ries, NUREG/CR-5263, SAND88-3100,September 1989.

13.21 M. T. Drouin et al., "Analysis of CoreDamage Frequency from Internal Events:Grand Gulf, Unit 1," Sandia NationalLaboratories, NUREG/CR-4550, Vol. 6,SAND86-2084, April 1987.

13.22 USNRC, "Safety Goals for the Operationof Nuclear Power Plants; Policy State-

13.23 H. J. C. Kouts et al., "Special CommitteeReview of the Nuclear Regulatory Commis-sion's Severe Accident Risks Report(NUREG-1150)," NUREG-1420, August1990.

13.24 USNRC, "Categorization of Reactor SafetyIssues from a Risk Perspective," NUREG-1115, March 1985.

13.25 R. Emrit et al., "A Prioritization of GenericSafety Issues," USNRC Report NUREG-0933, July 1984.

13-17 NUREG-1150

NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER(2-89) (Assigned by NRC, Add Vol.,NRCM 1102, Supp., Rev., and Addendum Num-3201, 3202 BIBLIOGRAPHIC DATA SHEET bers, it any.)

(See instructions on the reverse) NUREG-1150Vol. 1

2. TITLE AND SUBTITLE_3. DATE REPORT PUBLISHED

Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants MONTH I YEAR

Final Summary Report December 19904. FIN OR GRANT NUMBER

5. AUTHOR(S) 6. TYPE OF REPORT

Final Technical

7. PERIOD COVERED (Inclusive Dates)

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, andmailing address; If contractor, provide name and mailing address.)

Division of Systems ResearchOffice of Nuclear Regulatory ResearchU.S. Nuclear Regulatory CommissionWashington, DC 20555

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (If NRC, type "Same as above"; If contractor, provide NRC Division, Office or Region,U.S. Nuclear Regulatory Commission, and mailing address.)

Same as 8. above.

10. SUPPLEMENTARY NOTES

11. ABSTRACT (200 words or less)

This report summarizes an assessment of the risks from severe accidents in five commercial nuclear power plants inthe United States. These risks are measured in a number of ways, including: the estimated frequencies of core dam-age accidents from internally initiated accidents, and externally initiated accidents for two of the plants; the perform-ance of containment structures under severe accident loadings; the potential magnitude of radionuclide releases andoffsite consequences of such accidents; and the overall risk (the product of accident frequencies and consequences).Supporting this summary report are a large number of reports written under contract to NRC which provide the de-tailed discussion of the methods used and results obtained in these risk studies.

Volume 1 of this report has three parts. Part I provides the background and objectives of the assessment and summa-rizes the methods used to perform the risk studies. Part II provides a summary of results obtained for each of the fiveplants studied. Part mH provides perspectives on the results and discusses the role of this work in the larger context ofthe NRC staff's work.

12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers In locating the report.) 13. AVAILABILITY STATEMENT

Unlimited14. SECURITY CLASSIFICATION

severe accidents (This Page)

risk analysis(Ts aeprobabilistic rsk analysis Unclassified

(This Report)

Unclassified15. NUMBER OF PAGES

16. PRICE

NRC FORM 335 (2-89)

THIS DOCUMENT WAS PRINTED USING RECYCLED PAPER.

Documents

Perspectives and Uses - Nuclear Regulatory Commission · 8. Core Damage Frequency 1.OE-03 + C 0 R E D A M A G E F R E a U E N C Y 1.OE-04 1.OE-05 1.OE-06 1.OE-07 SURRY PEACH BOTTOM