NUREG/CR-3385

BMI-2103

Measures of Risk Importance

And Their Applications

Prepared by W. E. Vesely, T. C. Davis, R. S. Denning, N. Saltos

Battelle Columbus Laboratories

Prepared for

U.S. Nuclear Regulatory

Commission

Reprinted: May 1986
NOTICE

This report was prepared as an aecount of work sponsored by an agency of the United States

Government. Neither the United States Government nor any agency thereof, or any of their

employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus,

product or process disclosed in this report, or represents that its use by such third party would

not infringe privately owned rights.

Availability of Reference Materials Cited in NRC Publications

Most documents cited in NRC rublications will be available from one of the following sources:

1. The NRC Public Document Room, 1717 H Street, N.W.

Washington, DC 20555

2. The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission,

Washington, DC 20555

3. The National Technical Information Service, Springfield, VA 22161

Although the listing that follows represents the majority of documents cited in NRC publications,

it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection

and Enforcement bulletins, circulars, information notices, inspection and investigation notices;

Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and

licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the NRC/GPO Sales

Program: formal NRC staff and contractor reports. NRC-sponsored conference proceedings, and

NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of

Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series

reports and technical reports prepared by other federal agencies and reports prepared by the Atomic

Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items,

such as books, journal and periodical articles, and transactions. Federal Register notices, federal and

state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference

proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of N RC draft reports are available free upon written request to the Division of Technical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, DC

20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process

are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available

there for reference use by the public. Codes and standards are usually copyrighted and may be

purchased from the originating organization or, if they are American National Standards, from the

American National Standards Institute, 1430 Broadway, New York, NY 10018.

GPO Printed copy price: -- $4.75
NUREGICR-3385 BMI-2103

RX

Measures of Risk Importance

And Their Applications

Manuscript Completed: March 1983

Date Published: July 1983

Prepared by

W. E. Vesely, T. C. Davis, R. S. Denning, N. Saltos

Battelle Columbus Laboratories

505 King Avenue

Columbus, Ohio 43201

Prepared for

Division of Risk Analysls

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555

NRC FIN B2386
ACKNOWLEDGEMENTS

The authors would like to express their appreciation to a number of

people who contributed to this document. Roger Blond, Ken Murphy, Gary

Burdick, and other members of the NRC staff provided guidance and suggestions

throughout the project. John Burnham, Russ Rhoads, Ray Galluchi, and Dennis

Strenge of Battelle's Pacific Northwest Laboratories supplied the consequence

factor information and also provided a thorough review of the draft document.

-Pete Cybulskis contributed his insights and suggestions regarding the

containment response and system behavior. Thanks also go to Lynn Carey,

Angie Galleger, Tina Payne, and Mike Pearson for their assistance in

preparation of this document.
TABLE OF CONTENTS

EXECUTIVE SUMMARY . . . . . . . . . . . . . . . . . . ....

PROJECT OVERVIEW. . . . . . . . . . . . . . . . . . . ....

1.0 INTRODUCTION . . . . . . . . . . . . . . . . . . .

2.0 DEFINITION OF RISK ACHIEVEMENT WORTH . . . . . . ....

3.0 DEFINITION OF RISK REDUCTION WORTH . . . . . . . ....

4.0 RELATIONSHIP TO OTHER IMPORTANCE MEASURES. . . . ....

5.0 PORTRAYALS AND UTILIZATIONS OF THE RISK WORTHS . ....

6.0 EXTENSIONS TO RISK IMPACT CURVES . . . . . . . . ....

7.0 RSSMAP RISK ESTIMATES. . . . . . . . . . . . . . .....

8.0 WORTHS OF FEATURES WITH REGARD TO CORE MELT FREQUENCY..

8.1 Sequoyah. . . . . . . . . . . . . . . . . . .. . .

8.2 Oconee. . .......... . ... . .

8.3 Calvert Cliffs. ........ ... .....

8.4 Grand Gulf. . . . . . . . . . . . . . . . . .. . .

8.5 Comparisons . . . . . . . . . . . . . . . . . .

8.6 Risk Impact Curves. . . . . . . . . . . . . ....

9.0 CONTAINMENT ANALYSIS. . . . . . . . . . . . . . ....

9.1 Risk Worths of RSSMAP Containments. . . . . ....

9.2 Effect of Containment Design. . .. . . . . ...

9.3 Effect of Containment Failure Pressure. . . ....

9.4 Definition of Containment Reliability Measures . .

* . . . . .

. . . . . .

. . . . . .

. . . . . .

. . . .. . .

. . . . . .

Page

i

ix

1

3

5

7

9

13

16

20

20

26

35

46

52

57

64

64

69

74

75

. . . . . .

* . . . . .

* . . . . .

. . . . . .

. . . . . .

REFERENCES. 0 0 0 * 0 0 0 9 0 0 * 0 . 0 0 0 a * • 0 . a at 0 a 0 0 0 . * 0 83

LIST OF FIGURES

Figure 1.

Figure 2.

Figure 3.

Figure 4.

Graphic Portrayal of Risk Worths. . . . . ...

Risk Impact Curve on a Ratio Scale.. . . . ...

Risk Impact Curve on an Interval Scale. . ...

Risk Worth Ratios for Sequoyah Safety Functions

Regard to Core Melt Frequency . . . . . . ...

. . . . . . .

. . . . . . .

10

14

15

21

. 0 .

With

. 0 0

. . . .

. . . .
LIST OF FIGURES

(CONTINUED)

Page

Figure 5.

Figure 6.

Figure 7.

Figure 8.

Figure 9.

F igure 10.

Figure 11.

Figure 12.

Figure 13.

Figure 14.

Figure 15.

Figure 16.

Figure 17.

Figure 18.

Figure 19.

Risk Worth Ratios for Sequoyah Safety Systems With

Regard to Core Melt Frequency . . . . . . . . . . . . ....

Risk Worth Ratios of Human Actions at Sequoyah With

Regard to Core Melt Frequency . . . . . . . . . . . . ....

Risk Worth Ratios for Oconee Safety Functions With

Regard to Core Melt Frequency . . . . . . . . . . . . ....

Risk Worth Ratios for Oconee Safety Systems With

Regard to Core Melt Frequency . . . . . . . . . . . . ....

Risk Worths of Important Human Actions at Oconee With

Regard to Core Melt Frequency . . . . . . . . . . . . ....

Risk Worth Ratios for the Subsystems of the Oconee

Low Pressure Service Water System . . . . . . . . . . ....

Risk Worth Ratios for Calvert Cliffs Safety Functions

With Regard to Core Melt Frequency . . . . . . . . . . ....

Risk Worth Ratios for Calvert Cliffs Safety Systems

With Regard to Core Melt Frequency . . . . . . . . . . ....

Risk Worths for Human Actions at Calvert Cliffs With

Regard to Core Melt Frequency . . . . . . . . . . . . ....

Risk Worth Ratios for Subsystems in the Auxiliary

Feedwater System at Calvert Cliffs . . . . . . . . . . ....

Risk Worth Ratios for Components of the Reactor

Protection System at Calvert Cliffs . . . . . . . . . ....

Risk Worth Ratios for Grand Gulf Safety Functions With

Regard to Core Melt Frequency . . . . . . . . . . . . ....

Risk Worth Ratios for Grand Gulf Safety Systems With

Regard to Core Melt Frequency . . . . . . . . . ... . ....

Risk Worth Ratios for Identified Human Actions

at Grand Gulf . . . . . . . . . . . . . . . . . . . . .. . .

Risk Impact Curve for Reactor Protection System at Grand

Gulf on a Ratio Scale with Core Melt Frequency as the

Risk Measure . . . . . . . . . . . . . . . . . . . . . . .. .

22

23

27

28

29

34

36

37

38

44

45

47

48

49

58
LIST OF FIGURES

(CONTINUED)

Page

Figure 20.

Figure 21.

Figure 22.

Figure 23.

Figure 24.

Figure 25.

Figure 26.

Risk Impact Curve for Auxiliary Feedwater System at

Calvert Cliffs on a Ratio Scale With Core Melt

Frequency as the Risk Measure . . . . . . . . . . . . . ...

General Cost Effectiveness Curve. . . . . . . . . . . ....

Cost Effectiveness Curve for Improvement to the Reactor

Protection System at Grand Gulf . . . . . . . . . . . ....

Cost Effectiveness Curve for Improvement to the Auxiliary

Feedwater System at Calvert Cliffs. . . . . . . . . . ....

Risk Worth Ratios of the Containments at the Four RSSMAP

Plants With Respect to Manrem . . . . . . . . . . . . ....

Risk Versus Mean Failure Pressure at Oconee With

a, = 20 psi . . . . . . . . . . . . . . . . . . . . . . . . . .

Risk Worth Ratios for Manrem at Oconee for Different

Assumed Mean Failure Pressures. . . . . . . . . . . . ....

59

61

62

63

66

76

78

LIST OF TABLES

Table 1. RSSMAP Plants. . . . . . . . . . . . . . . ....

Table 2. Consequence Factors for a Reference 1120 MWe Plant

Table 3. Risk Worths for Sequoyah Safety Functions With

Regard to Core Melt Frequency. . . . . . . . ...

Table 4. Risk Worths for Sequoyah Systems . . . . . . ...

Table 5. Risk Worths of Human Errors at Sequoyah With

Regard to Core Melt Frequency. . . . . . . . ...

Table 6. Risk Worths for Oconee Safety Functions With

Regard to Core Melt Frequency. . . . . . . . ...

Table 7. Risk Worths for Oconee Systems With Regard to

Core Melt Frequency. . . . . . . . . . . . . ...

Table 8. Risk Worths of Important Human Actions at Oconee

With Regard to Core Melt Frequency . . . . . ...

Table 9. Risk Worths for the Subsystems of the Oconee Low

Pressure Service.Water System. . . . . . . . ...

. . a . 0 .

16

19

24

24

25

30

30

31

33

. . . . . .

. . . . . .

. . . . . .

. . . . . .
LIST OF TABLES

(CONTINUED)

Page

Table 10.

Table 11.

Table 12.

Table 13.

Table 14.

Table 15.

Table 16.

Table .17.

Table 18.

Table 19.

Table 20.

Table 21.

Table 22.

Risk Worths for Calvert Cliffs Safety Functions With

Regard to Core Melt Frequency ..... ... ......... . 35

Risk Worths for Calvert Cliffs Safety Systems With

Regard to Core Melt Frequency...... . . . . . . . . . . . 39

Risk Worths for Calvert Cliffs Human Actions With

Regard to Core Melt Frequency. . . . . . . . . . . . . . . . . 39

Risk Worths for Subsystems in the Auxiliary Feedwater

System at Calvert Cliffs . . . . . . . . . . . . . . . . . . . 42

Risk Worths for Components in the Auxiliary Feedwater

System at Calvert Cliffs . . . . . . . . . . . . . . . . . . . 43

Risk Worths for Components of the Reactor Protection

System at Calvert Cliffs...... . . . . . . . . . . . . . 46

Risk Worths for Grand Gulf Safety Functions With

Regard to Core Melt Frequency...... . . . . . . . . . . . 46

Risk Worths for Grand Gulf Safety Systems With

Regard to Core Melt Frequency...... . . . . . . . . . . . 50

Risk Worths for Identified Human Actions at Grand Gulf

With Regard to Core Melt Frequency. ...... ......... 51

Core Melt Frequencies for the Four RSSMAP Plants ....... 53

Risk Worths for the Reactivity Control Function at the

Four RSSMAP Plants....... . . . . . . . . . . . . . . . . 53

Risk Worths for the Emergency Core Cooling Function

at the Four RSSMAP Plants. . . . . . . . . . . . . . . . . . . 54

Risk Worths for the Heat Removal Function at the

Four RSSMAP Plants......... . . . . . . . . . . . . . . . 55

Containment Risk Worths. . . . . . . . . . . . . . . . . . . . 65

Containment Analysis . . . . . . . . . . . . . . . . . . . . . 68

Total Source Release...... . . . . . . . . . . . . . . . 68

Containment Parameters . . . . . . . . . . . . . . . . . . . . 70

Risk for Different Containments on One Plant . . . . . .. 71

Table

Table

Table

Table

Table

23.

24.

25.

26.

27.
LIST OF TABLES

(CONTINUED)

Table 28.

Table 29.

Table 30.

Table 31.

Table 32.

Risk Worths for Different Containments on One Plant . . . . . . . . . . . . . . . . . . . . . . . . .

Risk Estimates as a Function of Mean Failure Pressure.

Risk Worths for Oconee as a Function of Mean

Failure Pressure . . . . . . . . . . . .... . . . .

Containment Reliability Measures for Acute Fatalities

for the RSSMAP Plants Assuming No Evaluation . . ...

Containment Reliability Measures for Manrem for the

RSSMAP Plants Assuming No Evacuation . . . . . . ...

* . .

. . .

72

75

77

81

82

EXECUTIVE SUMMARY

The objectives of this work are to evaluate the importance of the

containment and the different safety functions as assessed in probabilistic

risk analyses. To accomplish this objective, risk importance measures are

defined to evaluate a feature's importance in further reducing the risk and

its importance in maintaining the present risk level. One defined importance

measure, called the feature's risk reduction worth, is useful for prioritizing

feature improvements which can most reduce the risk. The other defined

importance, called the feature's risk achievement worth, is useful for prioritizing features which are most important in reliability assurance and maintenance activities.

Any type of feature can be evaluated for its risk reduction worth

and its risk achievement worth; safety functions, safety systems, components,

surveillance tests, human activities, mitigation functions, and containments

can all be quantified as to their worths. Evaluating the worth in a structured manner from general safety function worths to detailed component, test,

and human activity worths allows one to successively focus on the important

items. The worths also provide important information for cost-benefit and

value-impact analysis, as the report describes. The limitations, assumptions

and uncertainties of Probabilistic Risk Analysis should be considered when

making risk based decisions. Sensitivity analysis can be used to identify the

importance of assumptions and areas where more in-depth analysis is needed.

Since much of the information contained in the risk importance measures is

relative, much of the analyses can be made robust to risk analysis

uncertainties.

The defined risk worth measures are applied to the risk analyses

performed in the Reactor Safety Study Methodology Applications Program

(RSSMAP). Four plants were analyzed in RSSMAP: Oconee, Grand Gulf, Calvert

Cliffs, and Sequoyah, and the risk worths are applied to each of the plant's

risk analysis. Safety functions, safety systems, containment, and certain

components and human activities are specifically evaluated for their worths.

A summary of the findings of the RSSMAP evaluations for the systems

at each of the four plants is presented on Figures 1, ii, iii, and iv which

are extracted from the body of the report. The figures show the risk

i
achievement ratios and the risk reduction ratios on the same graph with core

melt frequency as the risk measure. The risk achievement ratios are the

factor by which core melt frequency would increase if the system did not exist

or were not operable. The risk reduction worths are graphed below the

dividing line and indicate the maximum factor by which core melt frequency

could be reduced at the plant by improving the system. The human action

identified by RSSMAP which had the largest risk achievement worth is also

shown for each of the four plants.

The risk achievement worths identified the features which contribute

most to achieving the present risk level and toward which reliability assurance activities should be directed. What stands out most is the very high

worths of certain systems and the differences of feature worths among plants.

The high importance of support systems such as service water is highlighted by

the figures. The importance of certain front line systems such as the reactor

protection system is also emphasized by their large risk achievement worths.

As observed from the figures for most systems and human actions the

core melt frequency reduction potentials are small, less than a factor of 2.

A core melt frequency reduction potential of greater than a factor of 5 was

calculated for only one system at one plant (the auxiliary feed system at

Calvert Cliffs).

In general, the high risk achievement worths and relatively low risk

reduction worths indicate that attention should not be diverted from maintaining and assuring the present reliabilities when efforts are undertaken to

reduce risk.

From the importance evaluations performed, human actions as modeled

by RSSMAP are found to be near optimal. Improvement of the associated human

reliability would not reduce risk significantly whereas degraded human

performance could markedly increase risk.

The risk worth measures developed in this report were also applied

to the containments of each of the RSSMAP plants. The risk measures for the

containment worths were acute fatalities and dose rather than core melt

frequency.

The containment worth results are shown in Table i, which has been

extracted from the body of the report. The risk achievement ratios indicate

the containment presently reduces dose by a factor of about. 3 and reduces

ii
early fatalities by a factor of 10. The risk reduction ratios indicate that

acute fatalities could be reduced to essentially zero (giving a risk reduction

ratio of infinity) for those plants not having the V sequence (releases which

bypass containment). With the V sequence acute fatalities could at most be

reduced by a factor of .10. For those plants without V, manrem could be

reduced by a factor of 4I000 if containment were optimized; for plants with V,

a factor of "110 is the most that dose can be reduced.

In order to further investigate the importance of containment, one

of the plants was analyzed assuming different containment designs could be

placed on one system design. The risk worths were then calculated for each

containment design. The results showed the containment design could have an

order of magnitude or more importance to risk estimates. Additional sensitivity studies were performed and are described in the report.

iii
FIGURE i. RISK WORTH RATIOS FOR SEQUOYAH

SAFETY SYSTEMS WITH REGARD TO

CORE MELT FREQUENCY

103

102

wi

=

to 0

0 LU

5

10 c0

ww 

10 

0 80 

uw o_ 0L 4-

L . 0.z

-1 --- j

w w 

> wu > >U w >- -- -- -- -- -- -- -- -- - -- -- -- -- -- -- -- -- -- -

- Z - -z 

2u u 0 aU.2

10

iv
FIGURE ii. RISK WORTH RATIOS FOR OCONEE

SAFETY SYSTEMS WITH REGARD

TO CORE MELT FREQUENCY

I

I2

'U

2

'U

'U

U

10

'U

I.-

'U

to

2

(0

t;

qx

u0

Lu

Uc

2

uJ

(10

X-2

I I

2

0

Loc=

>- u

UC

saj

U)

cc>

2~ cc w c

-w

z

2

1 - -9 ~--- __ -~_____ , ~9~9 9- ~ V I

-. I

z

0

10
FIGURE iii. RISK WORTH RATIOS FOR CALVERT

CLIFFS SAFETY SYSTEMS WITH

REGARD TO CORE MELT FREQUENCY

103

102

10

I

z

0

wu

I8i

2

0

Fu

cc

vi
FIGURE iv. RISK WORTH RATIOS FOR GRAND GULF

SAFETY SYSTEMS WITH REGARD TO

CORE MELT FREQUENCY

z

w

'i

10

1

vii
TABLE i. CONTAINMENT RISK WORTHS

Risk Reduction Worth Risk Achievement Worth

Ratio Ratio

Acute Acute

Plant Manrem Fatalities Manrem Fatalities

Sequoyah with V 12.5 11.8 2.12 9.09

without V 1726. ( 2.21 9.93

Oconee with V 9.7 10.0 3.53 13.4

without V 888. 3.82 14.6

Calvert

Cliffs 1657. 2.40 8.69

Grand Gulf 2886. 1.34 10.6

viii
PROJECT OVERVIEW

This work is part of a project being conducted for the Division of

Risk Analysis (DRA) of the Nuclear Regulatory Commission (NRC). The objectives of the project are to evaluate the importances of containment, the

different safety functions, and other various contributers as assessed in

probabilistic risk analyses and to identify generic conclusions regarding the

importances. Effective display of the importances is an important part of

these objectives.

To address these objectives, measures of risk importance need to be

first identified and then they need to be evaluated for the different risk

analyses which have been performed. This report describes the risk importance

measures that were defined and were applied to the risk analyses which were

performed as part of the Reactor Safety Study Methodology Applications Program

(RSSMAP). The risk importance measures defined in this report measure the

importance of features not only with regard to risk reduction but also with

regard to reliability assurance, or risk maintenance.

The goal of this report is not to identify new mathematical formulas

for risk importance but to show how importance measures can be interpreted and

can be applied. When the defined risk importance measures are applied to the

RSSMAP analyses, specific features and systems stand out as being more important than others. The containment worth is quantified as a function of plant

and design parameters and critical variables are identified by the importance

evaluations. The risk importance measures and graphic displays as applied in

this report appear to be useful tools for assisting in prioritizing regulatory

and research activities.

The risk importance measures identified in this report constitute

only one class of measures that can be applied. Other risk importance

measures which can be applied include those which quantify the importance of

individual surveillance tests and maintenance activities, those which quantify

where wear-out effects will have the largest risk impact, and those which

prioritize contributions to uncertainty to show where data need to be

collected and models need be developed. These other importance measures

greatly increase the usefulness of probabilistic risk analysis and will be

identified and applied in future work.

ix

1

MEASURES OF RISK IMPORTANCE AND THEIR APPLICATION

1.0 INTRODUCTION

Two measures of risk importance are identified which are useful in

characterizing risk properties and in aiding decision making. The-two risk

measures are termed the "risk achievement worth" and the "risk reduction

worth". The risk achievement worth of a feature such as a safety system is

the worth of the feature in achieving the present level of risk. The risk

reduction worth of the feature is the worth of the feature in further reducing

the risk.

To maintain the present level of risk, the features having the highest risk achievement worths will be of most interest. The risk achievement

worths will thus be of special interest in reliability assurance programs and

inspection and enforcement activities. To reduce the risk, the features having the highest risk reduction worths will be of most interest. The risk

reduction worths will be of particular interest in plant upgrade programs and

backfitting activities. If it is desired to reduce the risk, it is important

not to divert attention from those features having high risk achievement worth

which contribute most to the present safety of the plant. The two risk worth

measures thus complement one another with regard to their characterization of

what is important to risk.

The following two sections, Sections 2.0 and 3.0, explicitly define

the risk achievement worth and the risk reduction worth; The relationships to

other defined risk importance measures are discussed in Section 4.0. Section

5.0 discusses graphic ways to portray the risk worths and discusses ways to

utilize the risk worths. Section 6.0 discusses extensions of the risk worth

definitions to obtain risk Impact curves useful for cost-benefit and value

impact analysis.

As specific applications, Sections 7.0, 8.0, and 9.0 utilize the

risk worth measures, along with sensitivity studies, to obtain insights about

the risk contributors as calculated in the Reactor Safety Methodology

Applications Program (RSSMAP).(1,2,3, 4 ) RSSMAP estimated the core melt
2

frequencies and release category frequencies from four different nuclear power

plants using simplified WASH-1400 techniques. Section 7.0 outlines the RSSMAP

approach, Section 8.0 evaluates the contributors to core melt frequency, and

Section 9.0 focuses on the impact of containment with regard to releases and

risks. In addition to providing insights about the risk contributors, the

evaluations also provide insights about the effects of RSSMAP models and

assumptions.
3

2.0 DEFINITION OF RISK ACHIEVEMENT WORTH

To measure the worth of a feature in achieving the

logical approach is to remove the feature and then determine

has increased. Thus, the risk achievement worth is formally

increase in risk if the feature were assumed not to be there

Depending on how the increase in risk is measured,

ment worth can either be defined as a ratio or an interval.

Rt = the increased risk level without feature i or

with feature i assumed failed,

present risk, a

how much the risk

defined to be the

or to be failed.

the risk achieveLet

(1)

and

R0 = the present risk level, (2)

where the risk can be any measure such as core melt frequency, expected dose,

etc. Then on a ratio scale the risk achievement worth Ai of feature i is

defined as:

Ai = Ri/Ro (3)

On an interval scale the risk achievement worth Ai is defined as:

Ai = Ri- R (4)

In calculating R+ with feature i removed, it is important to

consider other features which are also effectively removed because of interrelationships or dependencies with feature i. Whether the ratio or interval

definition is most pertinent will depend upon the particular utilization.

When risk achievement worths are calculated for a given plant In order to

prioritize the features then the ratio and interval definitions will generally

give the same rankings. When the features of different plants are compared or

when cost-benefit evaluations are performed, even for a single plant, then the
4

Intervaldefinition is generally more appropriate. If different risk measures

RO, such as core melt frequency and expected early fatalities, are used, then

different priorities can result and therefore it generally is useful to

examine various risk measures to obtain a more complete picture of a feature's

risk worth. Utilizations of risk achievement worths in decision making are

further discussed in Section 5.0.
5

3.0 DEFINITION OF RISK REDUCTION WORTH

To measure the worth of a feature in reducing the present risk, a

logical approach is to "optimize" the feature and then determine how much the

risk has been decreased. Thus, the risk reduction worth is formally defined

to be the decrease in risk if the feature were assumed to be optimized or were

assumed to be made perfectly reliable.

Again, depending on how the decrease in risk is measured, the risk

reduction worth can either be defined as a ratio or an interval. Let

R1 = the decreased risk level with the feature optimized

or assumed to be perfectly reliable, (5)

and again let RO be the present risk level. Then on a ratio scale, the risk

reduction worth Di of feature i (the letter "D" denotes decrease) is defined

as:

Di = Ro/R7 • (6)

On an interval scale the risk reduction worth D, is:

Di = RO- R7 . (7)

As defined in the above manner, the risk reduction worth, Di or Di, is always

greater than or equal to one or is always positive, respectively.

In calculating Rj with feature i optimized, other interrelated

features which are also effectively optimized should be included. Again,

whether the ratio or interval definition is used will depend upon the specific

application. For a given plant and for a given risk measure, the ratio and

interval will generally give the same ranking of the features. The risk

reduction worths of features will depend on the risk measure being examined.

As for the risk achievement worths, when the features of different plants are

compared or when cost-benefit analyses are performed, then the interval
6

definition is generally more appropriate. Utilizations of calculated risk

reduction worths are further discussed in Section 5.0.
7

4.0 RELATIONSHIP TO OTHER IMPORTANCE MEASURES

The risk achievement worth and risk reduction worth are included in

the broad class of importance measures defined by Engelbrecht-Wiggans and

Strip( 5 ). Certain of the importance measures were also utilized by K. G.

Murphy( 6 ) in his evaluation of significance of piping sections.

If the risk measure is defined to be the system unavailability or

unreliability then the more generally applied Birnbaum( 7 ) importance Ai of

component i can be defined as:

+ A,'- R+ - RT (8)

where R+ is the system availability with component i assumed failed and RT is

the system unavailability with the component assumed working. Barlow and

Proschan( 8 ) call A, the reliability importance of component i.

By adding and subtracting the nominal unavailability RO to the right

side-of Equation (8) it can be seen that

Ai = Ai +Di . (9)

Thus, the Birnbaum importance is the sum of the risk achievement and risk

reduction worth of component i on an interval scale. The risk achievement

worth and the risk reduction worth together are thus more informative than the

Birnbaum importance.

Another generally applied importance measure is the fractional

contribution of i to the risk, or the Fussell-Vesely( 9 ) measure of importance,

Ii, which can be expressed as:

RO - RT (10)

Ii = .,( RO
8

where the numerator represents the risk due to contributor i. Equation (10)

can be expressed as:

1

Di

or

Di-I

= Di 1- (12)

Di

Thus, the importance Ii is simply related to the risk reduction worth on a

ratio scale, Di. The risk reduction worth on a ratio scale, however, gives

only partial information about the risk importance of i; the interval measure

and the risk achievement worth give important additional information about the

importance of i.
9

5.0 PORTRAYALS AND UTILIZATIONS OF THE RISK WORTHS

In addition to tabulating and ranking the risk worths, graphs and

bar charts can be constructed to convey the information about the risk importance of the features. Figure 1 depicts one method of portraying both the

risk achievement worth and risk reduction worth of features on the same graph.

The graph can either portray worths on a ratio or interval scale and logarithmic scales can be used for the worths (y-axis) when large variations exist

in their values. Note in Figure 1 that the scale on the y-axis increases in

the downward direction for the risk reduction worth. This type of graph will

be used in the applications presented in Sections 7.0, 8.0, and 9.0.

Once the risk worths are determined, they can be used as one guide

to prioritize resources in a risk management program. The features having the

highest risk achievement worths are those features indicated as being among

those most important to the present safety and present risk level of the

plant. Reliability assurance programs and maintenance and surveillance of the

plant features can thereby be prioritized using the risk achievement worths of

the features as one guide. When the achievement worths are interpreted as

priorities (e.g., by normalizing by their sum) they are a relative result and

are robust to various risk analysis uncertainties. The utilization of relative risk results has been recommended by a variety of individuals and groups

including the Lewis Committee(IO), the TMI Committee(Ii), and various NRC

organizations.(12,13,14)

Once the risk reduction worths are determined, they too can be used

to help focus and prioritize activities aimed at reducing risk. These risk

reduction activities can focus modifications of plant operation or modifications of design to those features having high reduction worths. Care must be

taken when considering more than one change since the present risk level, RO,

would be affected by any change. For cost-benefit or value-impact evaluations, the costs of the changes need to be balanced against the risk reduction. Since the risk reduction worth gives the maximum risk reduction

possible for an improvement in the feature, the risk reduction worths can be
10

Risk Achievement

Worth

0

Risk Reduction

Worth

FIGURE 1. GRAPHIC PORTRAYAL OF RISK WORTHS
11

used to screen the modifications whose maximum risk reduction effects are

inherently small compared to costs. The next section describes evaluations

which are useful for cost-benefit analyses.

Calculating Risk Worths in PRA's

Calculation of the risk worths as a standard part of a PRA is

straightforward. Most of the information needed to calculate the risk worths

is available from a PRA. The success requirements, the system and component

unavailabilities, the assumed human actions, the system dependencies, and the

containment response for each sequence are quantified when performing the. PRA.

The sequences are also classified into release categories according to containment response and mitigative system success. The RSSMAP PRA's did not

specifically evaluate consequences other than to calculate the sum of

sequences in each release category. Conversion of the release category frequencies to consequences required a consequence conversion factor.

For a component, the risk reduction worth is calculated by reevaluating the boolean equations substituting zero for the unavailability of that

component. The risk achievement worth for a component is calculated by substituting a value of unity for the component unavailability. For subsystems,

systems, functions, or human actions similar types of manipulations and

evaluations would be performed. For effective implementation, the risk worths

could be calculated according to a hierarchy where the risk worths for the

systems are'calculated first, then the systems are successively broken down

into subsystems, groups of components, and components.

Effect of Adding a System

In the case where a. decision maker is evaluating the effectiveness

of installing a new system to an existing plant, the risk worths can be used

as a guide to the decision-maker. A system that has not yet been installed,

has no risk achievement worth; however, a risk reduction worth can be estimated by evaluating the effect of the new system on the dominant sequences and
12

estimating its availability. The decreased risk level due to the added system

is then straightforwardly caltulated. If a new system were added to a plant,

the risk worths of the existing systems would in general also be affected.
13

6.0 EXTENSIONS TO RISK IMPACT CURVES

The risk achievement and risk reduction worths are somewhat gross

measures of the risk importance in that the feature is either removed (assumed

failed) or is assumed to be perfectly reliable in calculating the worths. As

extensions of these definitions, curves of the changes in risk versus the

change in the feature's failure probability or reliability can be constructed.

These curves are termed "risk impact curves" since they show the impact on

risk of changes in the feature's reliability. The risk impact curves can

depict ratios or intervals depending upon the scale used to measure risk

increases or decreases. The risk achievement worth and risk reduction worth

will be two points on the curves representing limiting conditions.

Figure 2 illustrates a risk impact curve on a ratio scale; the curve

depicts the risk as a function of the feature's failure probability. The risk

is measured as a ratio R/RO relative to the present risk RO. Similarly the

feature's failure probability P is measured as a ratio P/P0 relative to the

present value P0 . The risk achievement and risk reduction worths, on a ratio

scale, are associated with the two limiting points shown in the figure.

Figure 3 illustrates the risk impact on an interval scale. In this

case, the risk is measured as a difference R - R0 relative to the present

value and the feature's failure probability is similarly measured as the difference P - P0. The risk achievement and risk reduction worths, now on an

interval scale, are associated with the two limiting points in the figure.

The fisk impact curves for the features, particularly those on an

interval scale, are useful for cost-benefit or value-impact analyses. If a

set of curves is maintained as a "library", then proposed design or operation

modifications need only be evaluated with regard to their impact on the

feature's failure probability. The risk impact curves can then be used to

relate the impact on the feature's failure probability to the impact on risk.

The use of risk impact curves is made more attractive if a limited set of

curves can be used to describe plant behaviors and if simple, analytical equations can be fit to the actual curves.
14

R R

0

Risk Achievement Worth (Ai)

•m1

1.0

1 1

Risk Reduction Worth 1

P

1.0 V-0

FIGURE 2. RISK IMPACT CURVE ON A RATIO SCALE
15

R

Risk Achievement Worth (A.)

P - P0

-Risk Reduction Worth (-p.)

FIGURE 3. RISK IMPACT CURVE ON AN INTERVAL SCALE
16

7.0 RSSMAP RISK ESTIMATES

Sections 8.0 and 9.0 describe the application of the risk worth

measures using the results of PRA's performed for the Reactor Safety Study

Methodology Applications Program (RSSMAP) as a data base. This section

provides a brief outline of the results and limitations of RSSMAP and also

describes the method for estimating consequences based on RSSMAP results.

These consequence estimates were used in evaluating risk worth measures for

risk defined as probability times consequence. The RSSMAP program used the

techniques and insights of the Reactor Safety Study(15 ) to perform limited

risk analyses on four different plants. Plants with different reactor and

containment designs were analyzed in order to broaden the class of nuclear

power plants explicitly analysed in terms of risk. The important features of

the four plants analyzed are summarized in Table 1.

The results of the RSSMAP analyses consisted of a set of dominant

accident sequences which were assigned a failure probability for each associated containment failure mode. The sequences were then assigned to a release

category. These release categories were the same ones used in the Reactor

Safety Study (RSS) and were assigned based on analyses performed with the

MARCH and CORRAL codes.

TABLE 1. RSSMAP PLANTS

Power Level

Plant MWe Containment

Sequoyah #1 PWR 1148 Ice Condenser

Containment

Oconee #3 PWR 886 Large Dry High Pressure

Containment

Calvert Cliffs #2 PWR 850 Large Dry

High Pressure

Containment

Grand Gulf #1 BWR 1250 Mark III
17

The sequence frequencies were summed in each category to produce a frequency

of release in each category. The accident sequences were determined by event

tree methodology in combination with a survey and analysis technique to determine event probabilities. The system unavailabilities were quantified using

the RSS hardware and human error data base.

RSSMAP was a valuable program, however in utilizing RSSMAP's results

the associated limitations need to be recognized. The RSSMAP scope included

equipment failures and routine human failures but did not include external

events or fires. Also, the RSSMAP analyses were conducted using design

information provided in the Final Safety Analysis Reports (FSAR) and did not

necessarily reflect the as-built systems. The success/failure criteria used

in the RSSMAP analyses were based on the FSAR analyses and the plant technical

specifications which may indicate more conservative criteria and guidelines

than are actually required for system success. It should be mentioned that in

several cases changes to the plant designs and procedures made subsequent to

the RSSMAP analyses are not included in the RSSMAP results and therefore are

not included in these analyses. The RSSMAP analyses further used only point

estimates and did not explicitly estimate uncertainties.

RSSMAP's limitations imply that conclusions drawn from the results

need to be checked before any action is taken. Recognizing the limitations,

RSSMAP's results are a useful data base for drawing tentative conclusions on

the importance of features to core melt frequency and to risk. RSSMAP's

results will also serve to illustrate the information which is obtainable from

calculating the risk achievement worth and risk reduction worth for different

features.

The risk reduction worth and risk achievement worth defined in this

report can be calculated using various risk measures. The three risk measures

chosen were core melt frequency, expected dose within 50 miles, and expected

acute fatalities. These three measures provide a characterization of the

health risks. Other measures such as environmental degradation and economic

impact could be treated similarly if desired and may be of interest for costbenefit studies.

Using the approach in Andrews et al( 1 6 ), a consequence factor in

terms of manrem and acute fatalities was associated with each release category
18

defined in RSSMAP. The consequence factors used for each RSSMAP plant were

scaled linearly to the power level of the plant used in Reference 16 (1120

MWe). The consequence factors for the base plant are shown in Table 2. The

expected dose and expected acute fatalities are determined by summing the

product of the release category frequency and the appropriate consequence

factor.

The reader should recognize that the use of RSS release categories

is likely to lead to an over-estimate of the consequences of accident

sequences. Since the Reactor Safety Study, research has been directed at

obtaining a better understanding of retention mechanisms which would reduce

the quantity of fission products released from the plant in an accident. The

NRC is currently undertaking a study to revise the RSS release categories but

the results of that study were not yet available to the work that is the

subject of this report. Even though the consequences may be high, the

relative information obtained from the risk achievement and risk reduction

worths is still useful.
19

TABLE 2. CONSEQUENCE FACTORS FOR A REFERENCE 1120 MWe PLANTI

Category Man Rem Acute Fatalities

PWR

1 1.6 x 106 340.

2 1.4 x 106 69.

3 1.6 x 106 87.

4 7.9 x 105 14.

5 3.0 x 105 0.14

*6 4.3 x 104 0

7 6.8 102 0

BWR

1 1.6 x 106 91.

2 2.1 x 106 53.

3 1.5 x 106 8.

4 1.8 x 105 0

(1)The consequence factors were estimated using the CRAC 2 prograin assuming

the meteorological data from a typical midwest site (Braidwood). A

uniform population density of 100 persons per square mile was assumed with

an exclusion area of 1/2 mile. No evacuationaias considered. The units

of the consequence factors are expected dose within 50 miles per event and

expected number of early fatalities per event.
20

8.0 WORTHS OF FEATURES WITH REGARD TO CORE MELT FREQUENCY

The risk reduction and risk achievement worths were calculated for

the major safety functions and the safety systems in Sequoyah, Oconee, Calvert

Cliffs, and Grand Gulf. In addition, the worths of the human actions and

human errors identified in RSSMAP for the four plants are also calculated.

The risk worths are given here for core melt frequency. Use of the other risk

measures (expected manrem and expected early fatalities) gives similar results

with regard to the importance of features in a given plant. Examples of the

risk worths for these other risk measures are given in Appendix A.

The chapter is arranged as follows: Sections 8.1, 8.2, 8.3, and 8.4

present the risk worths for Sequoyah, Oconee, Calvert Cliffs, and Grand Gulf,

respectively. In each section tables and figures of the worths are given and

observations are made. Section 8.5 then compares the four plants with regard

to differences in the worths. Tables and figures are again given and observations are made about the differences. Section 8.6 presents example risk

benefit curves for a few important systems.

8.1 Sequoyah

The risk worths for the different safety functions are shown in

Table 3. The risk worth ratios are also displayed graphically in Figure 4.

The safety functions are broken down to a system level and the results for the

selected safety systems are presented in Table 4. Some of the other systems

such as the low pressure recirculation system and service water were not

analyzable due to the limitations of Sequoyah study. The risk worth ratios

for the RSSMAP identified systems are shown in Figure 5.

The Sequoyah study identified one human error that was a contributor

to the risk estimates. This was a common mode error which disabled the

emergency core cooling recirculation system (ECCR) and the containment sprays.

The risk worths for this error are shown in Table 5. The risk worth ratios

are shown in Figure 6.
21

FIGURE 4. RISK WORTH RATIOS FOR SEQUOYAH

SAFETY FUNCTIONS WITH REGARD TO

CORE MELT FREQUENCY

105

102

I

2

Mi

1.4

Iau

10

-1

0

8-

2u

m

0

w0

II a a I II I

2

0

w

10
22

FIGURE 5. RISK WORTH RATIOS FOR SEQUOYAH

SAFETY SYSTEMS WITH REGARD TO

CORE MELT FREQUENCY

103

102

4

2

us

wu

10

'U

I4

-o w

w

.8

4

2

0

I0

0f

cc

us

IIEI

2

W 0

8s

5

Zi

8U

Iii

zU

'ULEt

'Uw

0-

IA.

IU

&u

'U

'p

-J

4

'p

1 m m

F-v-v-U-p-p - m - - -. A2

0

us

10 L-
23

FIGURE 6. RISK WORTH RATIOS OF HUMAN ACTIONS

AT SEQUOYAH WITH REGARD TO CORE

103 -MELT FREQUENCY

102

2 10 ,n

w

01

00

10
24

TABLE 3. RISK WORTHS FOR SEQUOYAH SAFETY FUNCTIONS

WITH REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Function Interval Ratio Interval Ratio

Reactivity Control 2.5 x 10-6 1.1 7.1 x 10-2 1200

Provide Emergency Coolant 5.3 x 10-5 7.0 2.8 x 10-3 50

to Core

Transfer Heat From Coolant 3.0 x 10-6 1.1 7.0 x 10-2 2000

to Ultimate Heat Sink

(not including main power

conversion system)

TABLE 4. RISK WORTHS FOR SEQUOYAH SYSTEMS

Risk Reduction Risk Achievement

System Interval Ratio Interval Ratio

Auxiliary Feedwater 3.0 x 10-6 1.1 1.1 x 10-1 2000

Pressurizer Relief Valve 2.5 x 10-6 1.1 .2.5 x 10-4 5.3

(stuck open)

High Pressure Injection 2.8 x 10-7 1.0 2.5 x 10-4 5.3

Emergency Core Cooling 1.0 x 10-5 1.2 2.8 x 10-3 50

Injection

Emergency Core Cooling 3.8 x 10-5 3.1 2.8 x 10-3 50

Recirculation

Emergency Electric Power 7.6 x 10-7 1.0 7.0 x 10-4 14

Reactor Protection System 2.5 x 10-6 1.1 7.0 x 10-2 1200
25

TABLE 5. RISK WORTHS OF HUMAN ERRORS AT SEQUOYAH WITH

REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Human Action Interval Ratio Interval Ratio

Operator Leaves Drains 8.0 x 10-6 1.2 2.7 x 10-3 50

Between Upper and Lower

Containment Volume in

Closed Position

From the results of the Sequoyah analysis, the following observations can be made. At the functional level, the risk reduction worths for the

reactivity control and heat transfer to ultimate sink functions are quite low

indicating only a small (-10 percent) potential for risk reduction could be

achieved by further improving these systems. A risk reduction of approximately an order of magnitude, however, is possible by optimizing the emergency

coolant supply to the core.

The risk achievement ratio worths for the heat transfer function and

for reactivity control are about 3 orders of magnitude and are about 20 times

more important than the emergency coolant function. The ratio worth for the

emergency coolant function is however still significant, being about a factor

of 50. These risk worths indicate the reduction in core melt frequency which

occurs due to the presence of the existing safety functions.

With regard to risk reduction ratio worths at the system level the

largest value is a factor of 3 for the emergency core coolant recirculation

system (ECCR). All other system ratio worths are less than a factor of 2 and

in fact are very close to 1. All these values indicate marginal or insignificant improvement in core melt frequency with-system improvement.

The risk achievement worths graphed in Figure 5 point out the importance of the reactor protection system and the auxiliary feedwater system in

achieving the present risk level. The core melt frequency would be more than

3 orders of magnitude higher if these systems were not functioning. The ECC

systems and the emergency power system (EPS) also have risk achievement
26

worths between 1' and 2 orders of magnitude for Sequoyah. The other two

systems that were analyzed had risk achievement worths of a factor of 5.

The systems which shut down the nuclear reactor (RPS) and remove the

decay heat (AFWS) are very important in preventing core melt, and this is

reflected by their high risk achievement values. The emergency core cooling

injection and recirculation systems are also shown to be important. This

reflects the relative importance of LOCA's in the predicted core melt frequency at Sequoyah. The systems which are called upon during transients (HPI

and PORV) have relatively low risk achievement worths reflecting the predicted

low importance of transients leading to core melt at Sequoyah. These results

in addition to prioritizing system worths, thus also reflect the models and

analyses utilized in RSSMAP.

For the human error analyzed, a small core melt frequency reduction

(-,20 percent) was possible whereas a significant risk achievement value of a

factor of 50 was calculated. The risk achievement ratio indicates that as

presently carried out, the human activity results in a factor of 50 reduction

in core melt frequency. This worth compares with the worths of 2000 and 1200

for the auxiliary feedwater system and the reactor protection system. The

high achievement worth and low reduction worth for the human error indicates

that the human activity is presently being performed with a near optimal

reliability as modeled by RSSMAP. The generally high achievement worths and

low reduction worths indicate that attention should be focused on maintaining

and assuring the present reliabilities as opposed to formulating retrofits to

upgrade them. (This does not say that new systems may not have significant

risk reduction effects, however.)

8.2 Oconee

The risk worths at the functional level for Oconee are shown in

Table 6. The risk worth ratios are also displayed graphically in Figure 7.

The results for specific systems are shown in Table 7 and Figure 8. The

Oconee study identified a number of human actions which were important to

risk. These have been evaluated and tabulated in Table 8. The risk worth

ratios for these human actions are shown in Figure 9.
27

FIGURE 7. RISK WORTH RATIOS FOR OCONEE

SAFETY FUNCTIONS WITH REGARD

TO CORE MELT FREQUENCY 104

103-

I-ol

102

Iz

w4
28

FIGURE 8. RISK WORTH RATIOS FOR OCONEE

SAFETY SYSTEMS WITH REGARD

104 TO CORE MELT FREQUENCY

102

-- W-

~102 w

w O

Uc >

z 0

00

I••8

>_ > _ 

10
29

FIGURE 9. RISK WORTHS OF IMPORTANT HUMAN

ACTIONS AT OCONEE WITH REGARD

TO CORE MELT FREQUENCY

4m) OPERATOR LEAVES LOW PRESSURE

PUMP TRAIN TEST VALVES IN

WRONG POSITION

lb) OPERATOR FAIL& TO OPEN SUMP

VALVES AT THE START OF

RECIRCULATION

40 OPERATOR FAIL$ TO ALIGN

SUCTION OF HPRS; TO

DISCHARGE OF LPRS

fll1 COMMON MOVE MISCALISRATION

OF INSTRUMENTS WHICH ACTUATE

HPIS

ht OPERATOR PAIL& TO START

THE HPis

(f) OPERATOR PAILS TO MANUALLY

START HIGH HEAD AUXILIARY

SERVICE WATER

102 --

2

wu

10 1-

a

4.

1

aI

- 1 

b

4 

c

t 

d

- i - IN

m - I - __ _

2

0

&U

cr.

I

10 L-
30

TABLE 6. RISK WORTHS FOR OCONEE SAFETY FUNCTIONS WITH

REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Function Interval Ratio Interval Ratio

Reactivity Control 7.8 x 10-6 1.1 .32 4100

Provide Emergency Coolant 4.3 x 10-5 2.5 3.4 x 10-3 48

to Core

Transfer Heat From Coolant 2.0 x 10-5 1.4 0.54 7500

to Ultimate Heat Sink (not

including normal power

conversion system)

TABLE 7. RISK WORTHS FOR OCONEE SYSTEMS WITH REGARD

TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

System Interval Ratio Interval Ratio

Auxiliary Feedwater 3.0 x 10-6 1.0 7.5 x 10-3 110

High Head Service Water 2.2 x 10-6 1.0 2.0 x 10-5 1.3

Pressurizer Relief Valve 1.8 x 10-5 1.3 3.3 x 10-4 5.6

(stuck open)

High Pressure Injection 1.4 x 10-5 1.2 3.4 x 10-3 48

Low Pressure Injection 8.8 x 10-6 1.1 5.0 x 10-4 7.0

Emergency Core Cooling 3.3 x 10-5 1.9 3.4 x 10-3 48

Recirculation

Low Pressure Service Water 1.5 x 10-5 1.3 0.54 7500

Electric Power (onsite) 2.2 x 10-6 1.0 4.4 x 10-3 62

Reactor Protection System 7.8 x 10-6 1.1 0.30 4100
31

TABLE 8. RISK WORTHS OF IMPORTANT HUMAN ACTIONS AT

OCONEE WITH REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Human Action Interval Ratio Interval Ratio

Operator Leaves Low Pressure 9.9 x 10-6 1.2 3.3 x 10- 3 47

Pump Train Test Valves in

Wrong Position

Operator Fails to Open Sump 9.6 x 10-6 1.2 3.2 x 10-3 45

Valves at the Start of

Recirculation

Operator Fails to Align 8.4 x 10-6 1.1 2.8 x 10- 3 40

Suction of HPRS to

Discharge of LPRS

Common Mode Miscalibration 9.0 x 10-8 1.0 2.7 x 10-3 40

of Instruments Which Actuate

HPIS

Operator Fails to Start 1.3 x 10-5 1.2 4.3 x 10-4 6.9

the HPIS

Operator Fails to Manually 2.2 x 10-6 1.0 1.9 x 10-5 1.3

Start High Head Auxiliary

Service Water

The following observations can be made regarding the Oconee results.

At the functional level the risk reduction potential is small for reactivity

control and heat transfer to the ultimate heat sink functions. The risk

reduction potential for the emergency coolant supply function is somewhat

larger but is still less than a factor of three.

The risk achievement worths are all considerably higher than the

.risk reduction worths. The ratio worths for the reactivity control and the

heat removal functions are between 3 and 4 orders of magnitude. The worth for

the emergency coolant supply function is about a factor of 50. These risk

achievement worths indicate the present degree of protection provided by the

different functions.
32

At the system level all the risk reduction worths are quite small,

the largest being a factor of 2 for the emergency core coolant recirculation

system. The risk achievement worths for Oconee safety system range over

almost 4 orders of magnitude. The low pressure service water system and the

reactor protection system stand out as being particularly important with risk

achievement ratios of 3 to 4 orders of magnitude. The auxiliary feedwater,

the emergency power supply, the high pressure injection, and the emergency

core cooling recirculation systems also have high risk achievement factors of

about 50 to 100 which are significant. The low pressure injection system and

the pressurizer relief valve have risk achievement factors of about 5 to 10.

The high head service water has a factor of only 1.3. The low pressure

service water system has a very high worth (7500) because the auxiliary

feedwater, the diesels, and all of the emergency coolant pumps depend on the

operation of the service water for component cooling. Failure of the low

pressure service water system lead to failure in the other systems in a short

time.

The high head service water, on the other hand, shows a low risk

achievement worth. This system is designed to be used as an alternative to

the auxiliary feedwater system in the case of loss of onsite and offsite

power. Since the onsite power at Oconee is predictmd to be very reliable,

this system is not expected to be needed frequently, consequently a low risk

achievement worth is calculated.

The risk worth of human actions shown in Table 8 and Figure 9 indicate low risk reduction worths. Further improvement in the assumed operator

performance of any particular action would not significantly reduce-risk estimates. The potential increases in risk attributed to degradation of present

predicted human reliability however can be quite significant.

If desired, the system can be divided into subsystems and/or further

divided into components. The risk worths can then be calculated for each subsystem or component. This gives useful information regarding the relative

importance of each subsystem or component. Inspection, testing, and maintenance efforts can be focused on the most important components based on the

results.
33

The results for one of the most important systems (low pressure

service water) at the subsystem level have been calculated as an example.

This system at Oconee consists of two redundant trains. One train is normally

operating while the other is in standby.

System failure requires the operating train to fail along with

failure to start and run the standby train. The system can be divided into

three subsystems: the operating train, the standby train, and the actuating

system for the standby train. The risk worths at the subsystem level are presented in Table 9 for each subsystem. The risk worth ratios are presented in

Figure 10. The potential risk reductions obtainable from making a subsystem

more reliable are small, about a factor of 1.2 or less. The risk achievement

factors are about 2 orders of magnitude for the operating train and 1 order of

magnitude for the standby train. The factor of 10 increase in risk can be

interpreted as the increase in risk level when one of the service water trains

is down, e.g. out for maintenance.

The generally high risk achievement ratios and low risk reduction

ratios again indicate that attention should be focused on reliability

assurance and risk maintenance activities with these activities in turn

focused on the areas of highest achievement worths.

TABLE 9. RISK WORTHS FOR THE SUBSYSTEMS OF THE OCONEE

LOW PRESSURE SERVICE WATER SYSTEM

Risk Reduction Risk Achievement

Subsystem Interval Ratio Interval Ratio

Normally Operating Service 1.5 x 10-5 1.3 1.0 x 10-2 120

Water Train

Standby Service Water Train 1.1 x 10-5 1.2 7.6 x 10-4 10

Actuating System for 3.8 x 10-6 1.1 7.6 x 10-4 10

Standby Train

Both Trains of Low Pressure 1.5 x 10-5 1.3 0.54 7500

Service Water
34

1o4 i- FIGURE 10. RISK WORTH RATIOS FOR THE SUBSYSTEMS

OF THE OCONEE LOW PRESSURE SERVICE

WATER SYSTEM

103 I1o2 ý-

'I

F2i

wj

10--

U) z

0

ca

z

0.-

0.

2--

44 I

C,

D2ý

co

40 I -'-'-1-v

2

0

ui

F.

10o
35

8.3 Calvert Cliffs

The results of the Calvert Cliffs analysis predicted a significantly

higher core melt frequency than at the other three RSSMAP plants. This was

primarily due to sequences involving failure of the emergency feedwater

systems and the assumed inability to establish a "feed and bleed" cooling mode

in time to prevent core melt.

The Calvert Cliffs analysis was based on an auxiliary feedwater

system that was scheduled to be upgraded. This upgrade was predicted to have

significant effects on the sequences which dominate risk at Calvert Cliffs. A

rough preliminary estimate of the upgrade reduces the predicted core melt frequency by a factor of 5 from 2 x 10-3 to 4 x 10-4 per reactor year. The calculations of the risk achievement worths and risk reduction worths did not

include the effects of the scheduled upgrade.

The risk worths at the functional level for Calvert Cliffs are shown

in Table 10. The risk worth ratios are displayed graphically in Figure 11.

The results at the system level are shown in Table 11 and Figure 12. The

Calvert Cliffs analysis identified a number of human actions which were

important to risk. These have been evaluated and tabulated in Table 12. The

risk worth ratios for these human actions are shown in Figure 13.

TABLE 10. RISK WORTHS FOR CALVERT CLIFFS SAFETY FUNCTIONS

WITH REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Function Interval Ratio Interval Ratio

Reactivity Control 6.0 x 10-5 1.0 3.0 1500

Provide Emergency Coolant 7.4 x 1D-5 1.0 3.3 x 10-3 2.6

to Core

Transfer Heat From Coolant 1.9 x 10-3 28 0.54 270

to Ultimate Heat Sink (not

including main power

conversion system)
36

1U• DFIGURE 11. RISK WORTH RATIOS FOR CALVERT

CLIFFS SAFETY FUNCTIONS WITH

REGARD TO CORE MELT FREQUENCY

io2

ta

I- 10 2 w

>

wW

z z

~ 0

IIcc

ul c.

102L
37

FIGURE 12. RISK WORTH RATIOS FOR CALVERT

CLIFFS SAFETY SYSTEMS WITH

REGARD TO CORE MELT FREQUENCY

F•-

t

k 10

V

kU4

I

l1o

102
38

FIGURE 13. RISK WORTHS FOR HUMAN ACTIONS AT

CALVERT CLIFFS WITH REGARD TO

CORE MELT FREQUENCY

103 I-

(6) OPERATOR MANUALLY

INITIATES THE AFW3

(bh RECOVERY ACTIONS

WHICH AFFECT THE AFWS

(a) OPERATOR CLOSES THE

SAFETY RELIEF BLOCK VALVE

102k

101- I.- 2

UJ

a ! Wb 

1 - .4

2

0

UJ

cc

w

10o
39

TABLE 11. RISK WORTHS FOR CALVERT CLIFFS SAFETY SYSTEMS

WITH REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

System Interval Ratio Interval Ratio

Auxiliary Feedwater 1.7 x 10-3 6.3 0.54 270

Pressurizer Relief Valve 6.7 x 10-5 1.0 8.4 x 10-4 1.4

High Pressure Injection 2.9 x 10-5 1.0 4.8 x 10-3 3.4

Low Pressure Injection 9.9 x 10-7 1.0 3.3 x 10-4 1.2

Emergency Core Cooling 4.5 x 10-5 1.0 4.9 x 10-3 3.4

Recirculation

Service Water 6.2 x 10-5 1.0 2.5 x 10-2 13

Emergency Power 1.7 x 10-4 1.1 0.2 100

Reactor Protection System 6.1 x 10-5 1.0 3.0 1500

TABLE 12. RISK WORTHS FOR CALVERT CLiFFS HUMAN ACTIONS

WITH REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Human Action Interval Ratio Interval Ratio

Operator Manually Initiates 5.4 x 10-4 1.4 0.54 270

the AFWS

Recovery Actions Which 4.8 x 10-5 1.0 1.2 x 10-3 1.6

Affect the AFWS

Operator Closes the 1.4 x 10-5 1.0 1.3 x 10-4 1.1

Safety Relief Valve

Block Valve
40

The following observations are made regarding the Calvert Cliffs

results. The risk reduction ratios for reactivity control and for the emergency coolant function are small. The risk reduction potential for the heat

removal function is quite large, about a factor of 30. The risk achievement

worth for the reactivity control is a factor of 1500 and the risk achievement

worth ratio for the heat removal function is a factor of almost 300. The

emergency coolant supply function has a smaller risk achievement worth, about

a factor of 3.

At the system level all of the risk reduction worth ratios are small

except for the value for the auxiliary feedwater which is a factor of 6. It

is interesting to compare this value with the estimated factor of 5 improvement due to the auxiliary feedwater upgrade. On the interval scale the risk

reduction worths for the auxiliary feedwater system is quite high in comparison to the other systems and compared to the systems at other plants. The

interval risk reduction worths for the other systems are roughly comparable to

those at other plants. The interval measure is more useful for comparing

plants and making value impact decisions. The ratio measure is useful in

establishing the relative importance at a particular plant.

For the Calvert Cliffs systems, the risk achievement ratios show a

value of over 3 orders of magnitude for the reactor protection system, approximately 2 orders of magnitude for the auxiliary feedwater and the emergency

power systems, 1 order of magnitude for the service water system, and factors

of 3 or less for the high pressure injection, the low pressure injection, the

pressurizer relief system, and the emergency core coolant recirculation

system.

The human actions identified by RSSMAP as being important to risk

are shown in Table 12. The risk reduction potentials for the human activities

are all small, less than a factor of 2. The risk achievement worth for the

manual initiation of AFWS is also high since failure to perform the action

effectively disables the auxiliary feedwater system.

Because of the importance of the auxiliary feedwater system at

Calvert Cliffs, this system has been analyzed further. The system has been

divided into functional groups of components such as a pump and its valves and
41

piping. For this system, there are generally two subsystems, two feedwater

sources, two pumps, and two steam supplies. One of the two in each set must

function for successful system operation. The operator can be considered as a

subsystem necessary for system operation. The results at the subsystem level

are presented in Table 13. The ratios are shown in Figure 14. The risk

reduction ratios for any one of the subsystems are small, the largest being a

factor of 1.4. The risk achievement ratios for two of the subsystems, the

condensate tank and supply valves and the human action are about a factor of

300. This is because failure of either could incapacitate the whole system.

The risk achievement ratios for the other subsystems in the auxiliary feedwater system are about a factor of 10. Since the motor operated valves

require an electric power supply, two terms have been included in Table 13

which show the risk worths of the emergency power supply to the auxiliary

feedwater system valves. The risk achievement worths of these subsystems are

about a factor of 3.

The subsystems can be further divided to a component level. The

results of this analysis for the auxiliary feedwater system are shown in

Table 14. The maximum risk reduction worth for a single component'is about

1.3. Notice the risk achievement worths for any one component in a subsystem

are equal to that of the entire subsystem since failure of one component would

incapacitate the subsystem.

At Calvert Cliffs the system with the highest risk achievement worth

was the reactor protection system. A simplified model of this system consisting of four relays and eight circuit breakers was modeled in the RSSMAP

study. The risk achievement and risk reduction worths for a circuit breaker

and a relay are presented in Table 15 and shown in Figure 15. Each of the

other relays and circuit breakers would have the same values as the one shown.

Each individual component is seen to have negligible risk reduction worth but

risk achievement worths that are significant, about a factor of 5 increase on

a relatively high base level risk.
i I

In Ua

4.in8nq

ma C~ ol -t to co --4o

LI- >- a, f -4 .4 -4 - - -4 -4 - 4 -

co ~ C I ~In C I

In. N co N 0 4 I

-Im -~~ ~4 2. N N N N (

U~ N .. S- 9. sO 0. -4

ma C' 36 t

0. CC I- 1. C . w

CIS a, a, . 8 WZ %w C .L

10 ~ ~ * = ! =1- =%

.2t Lw C-l O a ~ , a, ra, a1,N m ~ Ln R - Ce cU EUt c A It w~ CA 1 (U 0 s -0 -I SNC L. W-

=- ". = .0 4o a. ;: flu .0 CL.- C I4 CN L

'U .0 1.- In6 L. 0. IA c IcAz
C

4a

A

C.

4J

"14-4. -~00 E ~ 0 0 E 400..4 3-600.4 .40.4

.4.4.4.4 .4.4.4

P.. QD 1%

9 

x4.4.4

.40.4

o.4.4.4

a. 19 3 u 4 cm

cu "r' cm

.6 6 ,

.4.4.4

00-40

% q"t qt"

m I .

.- 4 -4 -4e

000

kA .4.

KICK ,1e,

P. Ia' 4

Cu.4•

IN KW K "r C K KI0 CU4 Cu 1010636

.4.4.4.4.4.4.44

CK K KIK K

oI0000J

Cu u C Cu.4.4C

0000000

U! Cu Cu Cu 101043'll

Cut'4K4'4C

1611111

0000000v c

.4.464464.&6

IC ICC K I

4444CuCu4-Cu

MOOCOOCOW

43' w01043'

I'll I

0000 x

. -!.4.4

_0.z4.40

0•000

IN " c" IN

_; 

0-4-0-

4' 43' Cu

.4.4.4

.4

Cuj9. m 4 ..- etomI m1E~ 0 -4C1 " -4-s nCI C-) u w d" L tn m In .- u0 L .i L o =.. 4 1".r -fr%

020.

2.0 3 w 1.0

4343 43433 0 43434 a . v 3 o . Z3 a

.0 z0 z0 -P Z 03 AC -
44

104 FIGURE 14. RISK WORTH RATIOS FOR SUBSYSTEMS

IN THE AUXILIARY FEEDWATER SYSTEM

AT CALVERT CLIFFS

Al CONDENSATE STORAGE TANK. PIPING.

AND VALUES

31 TURBINE DRIVEN AUXILIARY FEED

103 PUMP #21. PIPING AND VALVES

€11 TURBINE DRIVEN AUXILIARY FEED

PUMP #22. PIPING AND VALVES

D1 STEAM GENERATOR #21, FEEDWATER

SUPPLY VALVES

EI STEAM GENERATOR #22. FEEDWATER

SUPPLY VALVES

FI STEAM SUPPLY TO TURBINE DRIVEN

102 -AUXILIARY FEED PUMPS #1

al STEAM SUPPLY TO TURBINE DRIVEN

AUXILIARY FEED PUMPS #2

D12 POWER SUPPLY TO MOTOR OPERATED

VALVES FROM DIESEL 12

021 POWER SUPPLY TO MOTOR OPERATED

VALVES FROM DIESEL 21

AFWSCM OPERATOR ACTION

.- 10 - z

w

Al AFW

"!"~~~~~1 ADD21E 1 1 B1 ,C

010
45

"- FIGURE 15. RISK WORTH RATIOS FOR COMPONENTS

OF THE REACTOR PROTECTION SYSTEM

AT CALVERT CLIFFS

104

1l)3

102

t

2 , 10

2

Lu

a:1- 2

0

w

ccjL
46

TABLE 15. RISK WORTHS FOR COMPONENTS OF THE REACTOR

PROTECTION SYSTEM AT CALVERT CLIFFS

Risk Reduction Risk Achievement

Component Interval Ratio Interval Ratio

Circuit Breaker (1 of 8) 9 x 10-6 1.0 9.0 x 10-3 5.5

Relay (1 of 4) 0 1.0 1.2 x 10-2 7.0

8.4 Grand Gulf

The risk worths for the safety functions at Grand Gulf are presented

in Table 16 and the ratios are displayed graphically in Figure 16. The risk

worths at the system level are presented in Table 17. The risk worth ratios

for the systems are shown in Figure 17. The important human actions identified in RSSMAP are presented in Table 18 and shown in Figure 18.

TABLE 16. RISK WORTHS FOR GRAND GULF SAFETY FUNCTIONS

WITH REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Function Interval Ratio Interval Ratio

Reactivity Control 5.4 x 10-6 1.2 7.0 2.0 x 10+5

Provide Emergency Coolant 2.3 x 10-6 1.1 .72 2.0 x 10+4

to Core

Transfer Heat to Ultimate 2.8 x 10-5 4.7 5.4 x 10-2 1500

Sink (not including main

power conversion)
47

FIGURE 16. RISK WORTH RATIOS FOR GRAND GULF

SAFETY FUNCTIONS WITH REGARD TO

105 - CORE MELT FREQUENCY

104

103-

102

0

0 ww 0 >-

00

p0

1 •-

10°
48

FIGURE 17. RISK WORTH RATIOS FOR GRAND GULF

SAFETY SYSTEMS WITH REGARD TO

CORE MELT FREQUENCY

z

UA

m 0~

am. t; 2m

4 W Us Wa. = .

a.W.

W !2

t

z2j

2

0

wJ

.10
49

FIGURE 18. RISK WORTH RATIOS FOR IDENTIFIED

HUMAN ACTIONS AT GRAND GULF

103

102

4

2

'U

'U

'U

U

10 (Ia

2

0

I

I

10
50

TABLE 17. RISK WORTHS FOR GRAND GULF SAFETY SYSTEMS WITH

REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

System Interval Ratio Interval Ratio

Failure of a Safety/Relief

Valve to Reseat

Supression Pool Makeup

System

AC Onsite Power

Standby Service Water

Low Pressure Coolant

Injection System

Residual Heat Removal

System

High Pressure Core Spray

Low Pressure Core Spray

Reactor Core Isolation

Cooling System

Reactor Protection System

Automatic Depressurization

System

6.1 x 10-6

4.3 x 1o-7

7.1

1.7

7.2

x 10-6

x 10-5

x 10-7

1.8 x10-5

1.2

1.0

1.2

1.9

1.0

2.0

1.0

1.0

1.1

1.2

1.0

5.5 x 10-5

6.8 x 10-3

6.1

5.4

7.9

x

x

x

10-3

10-2

10-4

2.5

190

170

1500

23

1500

4.4

7.6

2.2

2.0 x 105

14

5.4 x 10-2

1.1

5.2

4.2

x 10-6

x 10- 7

x 10-6

1.2

2.4

4.2

x 1-

x 10-4

x 10-5

5.4 x

7.3 x

10-6

10-7

7.0

4.8 x10-4

i
51

TABLE 18. RISK WORTHS FOR IDENTIFIED HUMAN ACTIONS AT GRAND GULF

WITH REGARD TO CORE MELT FREQUENCY

Risk Reduction Risk Achievement

Action Interval Ratio Interval Ratio

Operator Initiation of 7.3 x 10-7 1.0 4.8 x 10-4 14

Automatic Depressurization

System

Recovery 2.8 x 10-5 4.5 1.0 x 10-4 3.0

At the functional level for the Grand Gulf plant the maximum risk

reduction potential is a factor of 5 for the heat removal function. The other

functions have small risk reduction potential. The risk achievement worths

for the safety functions are all large, with reactivity control being an order

of magnitude more important than emergency cooling which in turn is an order

of magnitude more important than heat transfer.

The reactivity control function has a risk achievement ratio of 5

orders of magnitude. This value is extremely high primarily because at Grand

Gulf a failure to scram was assumed to lead directly to core melt. The

emergency coolant supply function has a risk achievement worth of 4 orders of

magnitude. This is also very high and is primarily due to the high incidence

of transient induced LOCAs predicted for the Grand Gulf RSSMAP study. The

risk achievement worth of the heat removal function is about 3 orders of

magnitude.

At the system level the residual heat removal system and the standby

service water system have risk reduction worths of about a f~ctor of 2. All

other systems have risk reduction worths less than 1.2. The risk achievement

worth for the reactor protection system is the highest with a ratio over 5

orders of magnitude. The residual heat removal system and the standby service

water system have risk achievement ratios of 1500. Both of these systems are

necessary for long term heat removal. The suppression pool makeup system and

the emergency power system have risk achievement ratios of about 200. The
52

rest of the system are designed to provide emergency cooling water to the core

and have risk achievement ratios that range from a factor of 2 to a factor of

20. Notice the risk achievement ratio for any one system is much lower than

for the emergency core cooling function because any one of several systems can

accomplish the functional requirements.

The Grand Gulf study identified two human actions that were

important to risk. The first involved initiation of the automatic depressurization system. The risk reduction worth for this action was small while the

risk achievement worth was a factor of about 10. The other action involved

maintenance actions to recover failed systems during the time when the supression pool is heated up. Based on the analysis done for RSSMAP, a risk reduction factor of 5 was possible if the maintenance teams could identify and

repair the systems every time and a factor of 3 increase in risk would occur

if the repair were done incorrectly.

8.5 Comparisons

This section briefly compares the results of the risk worth analyses

for the four RSSMAP plants. This comparison provides insights regarding the

features that are important and also points out areas where modeling assumptions may be important. A comparison of the base m~se risk level of core melt

frequency as calculated by RSSMAP for the four plants is shown on Table 19.

This table shows three of the plants have approximately equal core melt frequencies (to within a factor of two) whereas the Calvert Cliffs plant has a

core melt frequency of a factor of 25 higher than any other plant analyzed.

This indicates that interval values are useful for interplant comparisons of

feature worths since they take into account the different base (nominal) risk

levels whereas the ratio worths do not.
53

TABLE 19. CORE MELT FREQUENCIES OF THE FOUR RSSMAP PLANTS

Plant

Core Melt

Frequency

Calvert Cliffs 2.0 x 10-3

Oconee 8.2 x 10-5

Sequoyah 5.6 x 10-5

Grand Gulf 3.6 x 10-5

The risk worths of the safety functions for the four plants are

given in Tables 20, 21, and 22. All the worths are calculated with regard to

core melt frequency. Table 20 shows the risk worths for the reactivity control function at the four plants. On an interval basis Calvert Cliffs has the

highest risk reduction worth, which is about an order of magnitude higher than

the other plants.

TABLE 20. RISK WORTHS FOR THE REACTIVITY CONTROL

FUNCTION AT THE FOUR RSSMAP PLANTS

Risk Reduction Risk Achievement

Plant Interval Ratio Interval Ratio

Grand Gulf 5.4 x 10-6 1.2 7.0 2.0 x 105

Calvert Cliffs 6.0 x 10-5 1.0 3.0 1500

Oconee 7.8 x 10-6 1.1 .32 4100

Sequoyah 2.5 x 10-6 1.1 7.1 x 10-2 1200
54

The risk achievement worth of the reactivity control function has

different prioritizations across plants when interval values are used as compared to ratio values. When interval values are used, which account for the

different baseline core melt frequencies, the worth at Grand Gulf is about a

factor of 2 higher than that at Calvert Cliffs which, in turn, is about an

order of magnitude higher than the worth at Oconee. These across plant comparisons are useful as a guide to mandating modifications or in allocating

resources among different plants. They are also useful for identifying

patterns in the worths.

Table 21 shows the risk worths~for the emergency core cooling function at the four plants. The risk reduction worths for the three PWRs

(Calvert Cliffs, Oconee, and Sequoyah) are approximately equal on an interval

scale. The risk reduction worth at Grand Gulf is about an order of magnitude

less. The difference in emergency core cooling reduction worths may be attributed to the fact that there are several systems which can provide core

cooling at Grand Gulf in the event of a loss of coolant. This redundancy of

systems provides a near optimum function, thus a low risk reduction worth.

TABLE 21. RISK WORTHS FOR THE EMERGENCY CORE COOLING

FUNCTION AT THE FOUR RSSMAP PLANTS

Risk Reduction Risk Achievement

Plant Interval Ratio Interval Ratio

Grand Gulf 2.3 x 10-6 1.1 .72 2.0 x 104

Calvert Cliffs 7.4 x 10-5 1.0 3.3 x 10-3 2.6

Oconee 4.3 x 10-5 2.5 3.4 x 10-3 48

Sequoyah 5.3 x 10-5 7.0 2.8 x 10-3 50

The risk achievement worth for the emergency core cooling function

is about the same, on an interval scale for all three PWRs. The worth at the

BWR (Grand Gulf) is approximately two orders of magnitude higher than for the
55

PWRs. This is due to the greater number of safety relief valves which could

fail at a BWR thereby requiring the coolant function. This also may reflect

some pessimistic modeling assumptions regarding the reliability of these

valves. If a higher reliability was used for these valves, a lower frequency

of transient induced LOCA's would be predicted resulting in a lower risk

achievement worth for this function at this plant.

Table 22 shows the risk worths for the heat removal function at the

four plants. On an interval scale, the risk reduction worth for Calvert

Cliffs stands out as being very high, approximately two orders of magnitude

higher than the other plants (before modifications to the auxiliary feedwater

system at Calvert Cliffs).

TABLE 22. RISK WORTHS FOR THE HEAT REMOVAL FUNCTION

AT THE FOUR RSSMAP PLANTS

Risk Reduction Risk Achievement

Plant Inverval Ratio Interval Ratio

Calvert Cliffs 1.9 x 10-3 28 .54 270

Oconee 2.0 x 10-5 1.4 .54 7500

Sequoyah 3.0 x 10-6 1.1 .11 2000

Grand Gulf 2.8 x 10-5 4.7 5.4 x 10-2 1500

The risk achievement worths for the heat removal function consider

only the standby heat removal systems such as the auxiliary feedwater and the

residual heat removal systems but do not consider the main power conversion

system or the suppression pool as being unavailable. The risk achievement

worths are equal for Calvert Cliffs and Oconee and are somewhat lower for

Sequoyah because of different modeling assumptions. The risk achievement

worth at the BWR (Grand Gulf) is the lowest because of the additional recovery

time afforded by the suppression pool's long heatup period.
56

At the system level the following observations are made when comparing the plants. Referring to the risk worths on Tables 4, 7, 11, and 17 it

is seen that the risk reduction worths for the systems at Calvert Cliffs are

generally higher than the systems at other plants. The auxiliary feedwater

and emergency power are two orders of magnitude higher while the service

water, pressure relief system and the reactor protection system are one order

of magnitude higher. The high pressure injection, low pressure injection, and

emergency core cooling recirculation systems have values that are comparable

to the other plants. For the other three plants (Oconee, Sequoyah, Grand

Gulf) the risk reduction worths are generally comparable. At all three of

these plants the systems providing long term cooling, the emergency core

cooling recirculation, and the residual heat removal systems have the highest

risk reduction worths.

The risk achievement worths for the four plants at the system level

have a wide range of values. The values for all plants are generally considerably higher than the risk reduction worths. For some systems there is

considerable variation in the risk achievement worths among different plants.

This reflects design differences in the plants but may also be due in part to

different modeling assumptions. For the auxiliary feedwater Calvert Cliffs

has the highest risk achievement worth. Because of the "feed and bleed"

cooling mode option at Oconee the risk achievement worth is an order of

magnitude lower.

The risk achievement worths for the core cooling systems such as the

high pressure injection, the low pressure injection, the emergency core cooling recirculation, the high pressure core spray, and the low pressure core

spray have comparable values at all the plants. The Oconee plant has the

highest risk achievement value for standby service water since the auxiliary

feedwater and the core cooling water will fail if this system is failed. The

Calvert Cliffs plant has the highest risk achievement value for emergency

power in part because the auxiliary feedwater at Calvert Cliffs depends on

electric power.

The human actions identified as being important to risk estimates

are generally quite different at each of the four plants, as can be seen on

Tables 5, 8, 12, and 18. The highest risk reduction worth was for operator

initiation of the auxiliary feedwater system at Calvert Cliffs. The risk
57

achievement worths for human actions are consistently higher than the risk

reduction worths. Operator initiation of the auxiliary feedwater also had the

highest risk achievement worth.

8.6 Risk Impact Curves

As discussed in Section 6.0, to complement the risk worths, risk

impact curves can be constructed. The construction of the risk impact curve

is straightforward for systems and components. The impact curves for the

reactor protection system at Grand Gulf and the auxiliary feedwater system at

Calvert Cliffs are shown in Figures 19 and 20, with core melt frequency as the

risk measure. These systems have the highest risk reduction worth and the

highest risk achievement worth, respectively, for core melt frequency.

The risk impact curve for the reactor protection system at Grand

Gulf (Figure 19) shows the relative failure probability of the system on the

x-axis. A log scale is used to display the wide range of values. The y-axis

also uses a log scale and displays the relative risk of core melt frequency as

a function of the failure probability.

Notice the risk reduction worth and the risk achievement worth are

seen on this curve as described in Section 6.0. At the far left side of the

curve the failure probability is near zero and the reciprocal of the risk

reduction worth is reached. As the relative failure probability is increased

to 1 the relative risk also increases to 1. The relative risk continues to

increase as the relative failure probability is increased until the failure

probability equals 1. At this level the risk achievement worth is reached and

the curve flattens out. The risk impact curve for the auxiliary feedwater

system at Calvert Cliffs (Figure 20) shows similar behavior.

Risk impact curves can be adopted to aid cost-benefit decision

making. For example, the interval change in expected core melt frequency can

be converted to a change in expected benefits using the results of the RSSMAP

consequence analysis and appropriate consequence conversion factors. If, for

example, a value of $1000/manrem is used as a measure of benefit, the change

in manrem can be readily converted to dollars. The curve of risk reduction

R - Ro in terms of dollars benefitted is then plotted versus the probability
R/Ro

105.

I04.

FIGURE 19. RISK IMPACT CURVE FOR REACTOR

PROTECTION SYSTEM AT GRAND GULF

ON A RATIO SCALE WITH CORE MELT

FREQUENCY AS THE RISK MEASURE

u1 c0

102_

10-4

1.0

Ii 10-1 I I I I I I I I.

10-2 10-1 1.0 10 102 103 107

P/Po
59

FIGURE 20. RISK IMPACT CURVE FOR AUXILIARY

FEEDWATER SYSTEM AT CALVERT CLIFFS

ON A RATIO SCALE WITH CORE MELT

FREQUENCY AS THE RISK MEASURE

RIRo

10,

I

10-1

10-2 10-1 1 10 102

PiPe
60

decrease P - P0 of the component or system. If the cost of the probability

decrease is more than the dollar benefit then the modification is not cost

effective. The region above the curve is thus the "not cost effective" region

and the region below the curve is the cost effective region. These regions

can then be used to aid decision making.

Figure 21 is a general illustration of a cost-effectiveness type

curve. In the figure, risk reduction Ro - R and failure probability reduction

are plotted. To evaluate a proposed modification to a system, for example,

the resulting impact on the system failure probability Po - P can be identified on the x-axis. If the cost of the modification is within the cost

effective region then the modification is indicated to be cost effective.

Otherwise it is not. Even with uncertainties these kinds of curves can give

useful information. For example, from Figure 21 it is seen that any modification having cost above Bmax is not cost effective regardless of the risk

reduction.

Figures 22 and 23 show the calculated cost effectiveness curves for

the two systems analyzed earlier in this section. The consequence factors for

manrem shown in Section 7 were used along with the conversion factor of $1000

per manrem.

For the reactor protection system at Grand Gulf, shown in Figure 22,

the maximum benefit is seen to be less than $12,000 per year. Costs above

this level translated to a total plant lifetime would not be cost effective.

Achieving the maximum benefit would require reducing the system failure probability to near zero, which may be impossible to accomplish. Smaller incremental improvements would have smaller benefits as indicated on the curve.

The auxiliary feedwater system at Calvert Cliffs had the highest

risk reduction worth of any system analyzed. This is reflected by the high

benefit values on the cost benefit curve shown in Figure 23. Benefits of

almost $2,000,000 per year are predicted by improving the present system. The

effect of the planned changes to the system described in the RSSMAP study are

approximately indicated on the curve by P1. About 90 percent of the potential

improvement is realized by these changes.
61

x

LL

'u

SMAX

FIGURE 21. GENERAL COST EFFECTIVENESS CURVE

NOT COST EFFECTIVE

COST EFFECTIVE

Pc-p
62

mE

x

ZL6

I.-

20

19

18

17

1i

15

14

13

12

11

.10

9

a

7

6

51

4

3

2

1

FIGURE 22. COST EFFECTIVENESS CURVE FOR

IMPROVEMENT TO THE REACTOR

PROTECTION SYSTEM AT GRAND

GULF

NOT COST EFFECTIVE

COST EFFECTIVE

0 I6 , I I I I a I I I

0 2 x 10"7 4 x 10-7 Bx 10-7 9 x 10- 7 I x lo16

Po-P

INTERVAL DECREASE IN FAILURE PROBABILITY
63

FIGURE 23. COST EFFECTIVENESS CURVE FOR

IMPROVEMENT TO THE AUXILIARY

FEEDWAfER SYSTEM AT CALVERT

CLI FFS

NOT COST EFFECTIVE

x

Ial w1

COST EFFECTIVE

0

Sx 10-4 lx 1(3 1.6 x W 3 2 x10-3 2.5 x10-3 1 3 x10-3

P1

Pe-P

INTERVAL DECREASE IN FAILURE PROBABILITY
64

9.0 CONTAINMENT ANALYSIS

In this section risk worth measures and sensitivity studies are

applied to the containment in order to investigate its risk importance. In

Section 9.1 the risk worths for the four RSSMAP plants are calculated. In

Section 9.2 the importance of containment design is investigated by assuming

different containments are placed on one plant and calculating the risk worths

for each containment design. Section 9.3 examines the importance of the

assumed mean failure pressure to risk estimates at one plant. Section 9.4

defines two measures of containment reliability and evaluates the RSSMAP

designs using these measures. For the risk worth evaluations, the risk measures calculated are expected manrem and expected acute fatalities. (Core

melt frequency is not a useful measure for calculating importances of

consequence mitigating features since it is assumed the containment has no

effect on core melt frequency.)

9.1 Risk Worths of RSSMAP Containments

The risk worth calculations involve determining the decreased risk

level with the containment assumed optimized and the risk level with no containment and comparing to the risk level predicte' by RSSMAP.

The containment worth ratios for the four plants are shown in Table

23. The risk achievement ratios indicate the containment presently reduces

dose by a factor of about 3 and reduces early fatalities by a factor of 10.

The risk reduction ratios indicate that acute fatalities could be reduced to

essentially zero (giving a risk reduction ratio of infinity) for those plants

not having the V sequence (releases which bypass containment). For the plants

where the V sequence is important, acute fatalities could at most be reduced

by a factor of N10. For those plants without V, manrem could be reduced by a

factor of 103 if containment were optimized; for plants with V, a factor of

"10 is the most that dose can be reduced. The risk worths of the four

containments are graphed on Figure 24 using manrem as the risk measure and

neglecting the V sequence.
TABLE 23. CONTAINMENT RISK WORTHS

Risk Reduction Worth Risk Achievement Worth

Interval Ratio Interval Ratio

Acute Acute Acute Acute Plant Manrem Fatalities Manrem Fatalities Manrem Fatalities Manrem Fatalities

Sequoyah with V 65.6 3.0 x 10-3 12.5 11.8 79.0 2.7 x 10-2 2.12 9.09 without V 65.6 3.0 x 10-3 1726. 0 79.0 2.7 x 10-2 2.21 9.93

Oconee with V 38.2 2.0 x 10-3 9.7 10.0 107.4 2.7 x 10-2 3.53 13.4

without V 38.2 2.0 x 10-3 888. 0 107.4 2.71x 10-2 3.82 14.6

Calvert Cliffs 1710. 9.3 x 10-2 1657. c 2388. 7.1 x 10-1 2.40 8.69

Grand Gulf 80.8 2.0 x 10-3 2886. G 27.6 1.9 x 10-2 1.34 10.6

0,
66

102

FIGURE 24.

f.-t

2

tLI

U,

RISK WORTH RATIOS OF THE

CONTAINMENTS AT THE FOUR

RSSMAP PLANTS WITH RESPECT

TO MANREM

101-

a. a a a.

z

0

10 1- U)

IL

U.

w

w

0

U

0

z

0

a

wj 4

0

102

103 1==

104
67

It is interesting to note that the ratio measures of risk worth are

independent of the core melt frequency while the interval values are a

functi on of the magnitude of the core melt frequency. The ratio worths thus

tend to isolate the effectiveness of containment whereas the interval worths

are useful for decisions involving the risk level or cost-benefit comparisons.

For the above evaluations, the decreased risk level with the containment optimized is calculated by assuming the containment is capable of

withstanding all threats to containment integrity, the containment never falls

to isolate, and the sprays always operate. Since these assumptions are equivalent to a PWR Category 7 release, the consequence factors for that category

are applied to the total core melt frequency to determine the risk level with

an optimized containment. The decreased risk levels calculated for the four

RSSMAP plants are shown in Table 24. These values represent the lower limit

of risk which could be obtained from an optimized or "lperfect" containment.

Other considerations may introduce limits to the containment's reliability

resulting in a somewhat higher risk.

For two of the plants, the V sequence was determined to be important

to the present risk level. Since the containment is bypassed for this

sequence, the containment has no effect on the V sequence. The risk level,

therefore, cannot be reduced below this level no matter how effective the

containment. If the risk is to be further reduced, the frequency of the V

sequence must be reduced. To show the impact of the V sequence, the risk

worths have been calculated with and without the V sequence for the plants

where this sequence was considered important.

For the evaluation of the risk achievement worths, the increased

risk level from a failed containment or a containment that was not installed

was determined by assuming there was no containment. With no containment

there would be no fission product removal mechanisms such as sprays, filters,

or deposition on walls and floors. With this assumption, all of the fission

products released from the primary system are released directly to the

environment. If it is further assumed that there is no deposition within the

primary system, all of the fission products released from the fuel would be

released to the environment. The source assumed is shown in Table 25. The

source is equivalent to the WASH-1400 source release from the fuel. These
68

TABLE 24. CONTAINMENT ANALYSIS

Risk Without With Optimized

Base Case Containment Containment

Acute Acute Acute

Plant Man Rem Fatalities Man Rem Fatalities Man Rem Fatalities

OCONEE with V 42.5 2.2 x 10-3 150 0.0294 4.4 2.2 x 10-4

without V 38.2 2.0 x 10-3 146 0.0292 0.043 0.

SEQUOYAH with V 71.3 3.3 x 10-3 151 0.0300 5.7 2.8 x 10-4

without V 65.6 3.0 x 10-3 145 0.0298 0.038 0.

CALVERT CLIFFS 1710 0.093 4099 0.804 1.03 0.

GRAND GULF 80.8 2.0 x 10-3 108 0.0212 0.028 0.

TABLE 25. TOTAL SOURCE RELEASE

Fission Product

Group

Xe

I

Cs

Te

Ba

Ru

La

Fraction

Released

1.0

1.0

1.0

1.0

0.11

0,.08

0.013

Consequences for 1120 MWe PlantExpected Man Rem

Expected Early Fatalities

2.7 x 106

530
69

release fractions were input to the CRAC code to determine consequence factors

which are shown in Table 25. The expected risk with these assumptions for

each plant is shown in Table 24. The assumption of no deposition in the primary system causes the consequences to be overestimated. Ongoing analyses

indicates the retention factors within the primary system can be significant

for some isotopes under certain conditions. This reduction of the source term

due to this mechanism would lead to a lower environmental release and correspondingly lower health effects. A reduced source term would affect the base

case risk similarly. Future analyses should address this issue as results

become available.

9.2 Effect of Containment Design

To obtain further insights into the effectiveness of containment,

parametric studies were performed by placing different containments at a

plant. The Oconee plant was chosen as the base case system design on which

different containments were placed. The containment parameters are presented

in Table 26 for each of the containment designs considered. Some of the

important assumptions in the analysis are included in Table 26. The same type

of analyses could be applied to other plants and other containment designs.

The effectiveness of a containment design for a plant depends primarily on the

design of the containment (volume, failure pressure, sprays, etc.) and the

loadings imposed on the containment which are determined by the characteristics of the important accident sequences at that plant.

Also included on Table 26 are the conditional failure probabilities

that are calculated for each containment assuming that containment could be

placed on the Oconee plant. The conditional failure probability is defined as

the probability of gross containment failure given a core melt. This has been

calculated by suimming the products of the accident sequence frequency and the

containment failure probability for that sequence over all s-equences and

dividing the sum by the total core melt frequency.

The risks as measured by expected manrem and expected acute fatalities for different containments on Oconee are tabulated in Table 27. The

results are presented with-and without the V sequence to show the impact of

this scenario. The risk worths for- the various containments on- Oconee are

shown in Table 28.
70

TABLE 26. CONTAINMENT PARAMETERS

Nominal Conditional

Design Failure Failure

Plant Volume Pressure Pressure(1) Probability( 2 )

(ft3) (psia) (psia)

Oconee 1.91 x 106 74 133 + 20 .459

(Prestressed

Concrete)

Calvert Cliffs 2.0 x 106 65 135 + 10 .18

(Prestressed 135 ; 20 .30

Concrete)

Surry 1.8 x 106 60 100 + 15 .95

(Reinforced

Concrete)

Zion 2.72 x 106 62 148 + 4 .01

(Prestressed

Concrete)

(1)The nominal failure pressure and failure distribution in each case

was taken from a PRA analyses for that plant. For Oconee, Calvert

Cliffs, and Surry, the failure distribution was assumed to be

Gaussian with the mean equal to the nominal failure-pressure and the

standard deviation as given. For Oconee, the data was taken from

the RSSMAP report which assumed a nominal failure pressure of 2

times the design pressure (in psig) and a standard deviation of 20

psi. The Calvert Cliffs RSSMAP analyses assumed a nominal failure

pressure 2.5 times the design pressure (in psig) and a standard

deviation of 10 psi. The calculations for the Calvert Cliffs

analyses was carried out with two standard deviations to show the

effect of this assumption. The data for Surry was identical to the

containment ?nalyses in the Reactor Safety Study (100 + 15) psia.

The Zion PRA17) assumed a different set of assumptions. A greater

reliance on the containment to maintain functional integrity is

assumed, thus the high failure pressure. The standard deviation is

based on statistical variation in materials properties. Because of

the relatively large volume and high nominal failure pressure of

this design, overpressure failures were negligible risk

contributors.

(2)The conditional failure probability is defined as the probability

of gross containment failure (RSS Release Categories 1, 2, or 3)

given a core melt. All calculations assumed the Oconee system risk

profile.
71

TABLE 27. RISK FOR DIFFERENT CONTAINMENTS ON ONE PLANT 1

Containment Ri sk

Design Assumptions Man Rem Acute Fatalities

Oconee

Surry

Calvert

135 +

with V

without V

with V

without V

42.

38.

78.

74.

20.

16.

2.2 x

2.0 x

4.2 x

4.0 x

10-3

10-3

10-3

10-3

Cliffs

10 with V

without V

135 + 20 with V

without V

31.

27.

5.0

0.6

1.1 x10-3

9.0 x 10- 4

1.6 x1-3

1.4 x 10-3

2.4 x 10- 4

2.0 x10-5

Zion with V

without V

No Containment

with V

without V

"Perfect Containment"

with V

without V

0.

150.

146.

2.94 x

2.92 x

10-2

10-2

4.4

.04

2.2 x 10-4

0.

1 All values on this table are for the Oconee accident risk

indicated containment design assumptions.

profile with the
TABLE 28. RISK WORTHS FOR DIFFERENT CONTAINMENTS ON ONE PLANT

Risk Reduction Worth Risk Achievement Worths

Interval R atio Interval Ratio

Containment Acute Acute Acute Acute

Assumed Man Rem Fatalities Man Rem Fatalities Man Rem Fatalities Man Rem Fatalities

Oconee with .V 38 2.0 x 10-3 9.5 10 108 2.7 x 10-2 3.6 13

without V 38 2.0 x 10- 3 950 W 108 2.7 x 10-2 3.8 15

Surry with V 74 4.0 x 104 18 19 72 2.5 x 10-2 1.9 7.0

without V 74 4.0 x 10-3 1900 72 2.5 x 10-2 2.0 7.3

Calvert Cliffs

135 + 10 with V 16 9.0 x 10-4 4.5 5.0 130 2.9 x 10-2 7.5 27

without V 16 9.0 x 10-4 400 W 130 2.9 x 10-2 9.1 32

135 + 20 with V 27 1.4 x 10-3 7.0 7.3 123 2.8 x 10-2 4.8 18

without V 27 1.4 x 10-3 680 - 123 2.8 x 10-2 5.4 21

Zion with V 0.6 2.0 x 10-5 1.1 1.1 145 2.9 x 10-2 30 120

without V 0.6 2.0 x 1 0 - 5 15 W 145 2.9 x 10-2 240 1500

114
73

The results in Tables 27 and 28 show the importance of the containment design to risk estimates. The risk achievement ratios in Table 28 show

how the worth of containment varies with design. Excluding the Zion containment design the containment worths for early fatalities range from about a

factor of 10 to about a factor of 30. The worth for the Zion containment

design is a factor of 102 to 103 depending upon whether event V is assumed to

be deleted or not. For manrem protection, the ratio worths of containment

range from about a factor of 3 to about a factor of 10. The ratio worth of

the Zion design is a factor of u30 to "100 for manrem reduction, depending

upon the event V scenario. The risk achievement worths on an interval scale

are not very useful here since the high final risk masks the differences

(Rt - Ro =R).

The risk reduction ratios in Table 28 indicate the improvement

possible for the containment designs. The risk reduction ratios indicate that

the Zion design is near optimal, although hypothetically acute fatalities

could be reduced to zero without Sequence V (giving a risk reduction ratio

of w). Since the acute fatalities for the Zion containment are relatively

small, as measured by the risk reduction interval of 2 x 10-5, further reduction would not have the priority of the other containment designs. For the

containment designs other than Zion, the risk reduction ratios for early

fatalities range from a factor of 10 upwards. For manrem, the reduction

ratios are all about a factor of 10 with V and are all about a factor of 103

without V.

Considering the uncertainties in the analyses, the risk achievement

and risk reduction worths for all the containment designs except Zion are

about the same. The Zion design is worth about a factor of 10 more than the

other designs in reducing early fatalities and manrem. Event V reduces the

worth of containment by about a factor of 3 for manrem reduction. For early

fatalities, the effect of event V is larger as measured by the risk ratio

because of the possibility of achieving zero early fatalities if event V is

assumed to be deleted.
74

9.3 Effect of Containment Failure Pressure

While examining the effect of different containments, the risk was

found to be sensitive to the assumed failure pressure distribution. There is

considerable uncertainty associated with the failure pressure distribution.

For the Oconee analyses the nominal failure pressure was taken to be two times

the design pressure. The ultimate strength is estimated as approximately

three times the design pressure. The failure pressure distribution for Oconee

was assumed to be a Gaussian distribution with a mean of 133 psia and a

standard deviation of 20 psi. The importance of this assumption to risk estimates can be shown by recalculating the risk using different mean failure

pressure assumptions. Two of these assumed values (1 x Design pressure and

ultimate strength) were chosen to represent an upper and lower bound on

containment effectiveness at this plant. The 2 x Design pressure value represents the based case as assumed in the RSSMAP report. The 2.5 x Design

pressure represents greater confidence in the containment to maintain functional integrity under load and may represent more recent analyses.

At the 1 x Design pressure assumption, containment failure is a

virtual certainty given the predicted pressure history for the dominant

sequences at Oconee. This assumption represents a lower bound of containment

effectiveness since the "true" containment failure pressure cannot realistically be this low. The ultimate strength assumption (approximately 3 x

Design pressure) represents an upper bound of containment effectiveness. The

dominant sequences at Oconee (overpressure by hydrogen burning) have a very

low probability of failing containment at this assumed pressure. The dominant

risk contributors are steam explosions, leakage, and the V sequence.

At the 2 x Design pressure assumption, the probability of containment failure due to overpressure is significant (.2 to .5) for the dominant

sequences. At the 2.5 x Design pressure assumption, the probability of

failure due to overpressure is smaller but still significant (.01 to .07).

The same standard deviation about the mean (20 psi) was assumed for

all calculations. It should also be mentioned that the failure pressure and

the failure mode, and therefore the consequences, may not be independent.( 18 )
75

Table 29 shows the risk estimates for a variety of different assumptions on the containment failure pressure. The assumption of mean failure

pressure is seen to have over an order of magnitude importance considering the

V sequence and two orders of magnitude importance if the V sequence is discounted. The risk as measured by manrem is plotted in Figure 25. The risk

worths are presented in Table 30. The risk worths are displayed in Figure 26

for each of the assumed failure pressures with the V sequence discounted. The

risk reduction worth and risk achievement worths are seen to be strong

functions of the assumed mean failure pressure.

TABLE 29. RISK ESTIMATES AS A FUNCTION OF

MEAN FAILURE PRESSURE

Risk

Assumption Man Rem Acute Fatalities

1 x Design Pressure with V 89 7.0 x 10-3

without V 85 6.8 x 10-3

2 x Design Pressure with V 42 2.2.x 10-3

without V 38 2.0 x 10-3

2.5 x Design Pressure with V 11 5.9 x 10-4

without V 7 3.9 x 10-4

Ultimate Strength with V 5.0 2.4 x 10-4

without V .6 2.0 x 10-5

9.4 Definition of Containment Reliability Measures

Instead of utilizing risk worth measures, another way of evaluating

containment importance is tQ utilize containment reliability measures. Two

measures which can be used to characterize containment reliability are:

P = the probability of any individual dying given a

core melt (or source core damage) accident
76

FIGURE 25. RISK VS MEAN FAILURE PRESSURE AT OCONEE

WITHo 20 PSI

MANREM WITH V

--.. MANREM WITHOUT V

10 -

, ,

cc

zr 4

0.1

80 90 100 110 120 130 140 150 160 170 180 190 200 210

MEAN FAILURE PRESSURE (PSIA)
TABLE 30. RISK WORTHS FOR OCONEE AS A FUNCTION OF MEAN FAILURE PRESSURE

( a = 20 psi)

Risk Reduction Worth Risk Achievement Worth

Interval Ratio Interval Ratio

Acute Acute Acute Acute

Assumption Manrem Fatalities Manrem Fatalities Manrem Fatalities Manrem Fatalities

1 x Design Pressure

with V 85 6.8 x 10-3 20 32 61 2.2 x 10-2 1.7 4.2

without V 85 6.8 x 10-3 2100 0 61 2.2 x 10-2 1.7 4.3

2. x Design Pressure

with V 38 2.0 x 10-3 9.5 10 108 2.7 x 10-2 3.6 13

without V 38 2.0 x 10-3 950 108 2.7 x 10-2 3.8 15

2.5 x Design Pressure

with V 7 3.9 x 10-4. 2.5 2.7 139 2.9 x 10-2 14 50

without V 7 3.9 x 10-4 180 c 139 2.9 x 10-2 21 75

Ultimate Strength

with V .6 2.0 x 10-5 1.1 1.1 145 2.9 x 10-2 30 120

without V .6 2.0 x 10-5 15 c 145 2.9 x 10-2 240 1500
78

FIGURE 28. RISK WORTH RATIOS FOR

MANREM AT OCONEE FOR

DIFFERENT ASSUMED

MEAN FAILURE PRESSURES 102 i.

a2

w

ILI

0loI-I

40

1 I. W

2

0

0u

z

0

x

N

10

2

a

x

cm 2

ILl

03

w

am

102

103

lO4L
79

E = the expected number of individuals dying given

a core melt or source core damage accident

In the above definitions, the individual or individuals are the public, which

are protected by the containment. From the relationship between expectation

and probabilities it is known that E > P for all cases. Another measure of

containment reliability is the probability that more than X individuals are

killed where X is some large number. This measure focuses on the containment

protecting against large numbers of people dying when a major accident

occurred. If P and E are sufficiently small then the probability of killing

larger numbers of people will be small.

Instead of focusing on fatalities, the above two measures of containment reliability can also be redefined in terms of radiological releases:

P= the probability that no significant radiological

release occurs when a major accident occurs

E - the radiological release which is expected to

occur when a major accident occurs

To apply the above definitions, "significant radiological release"

would need to be translated to numerical values for explicitly defined isotopes. Explicit criteria would also need to be defined for categorizing an

accident sequence as a major accident or one causing source core damage.

For the RSSMAP evaluations, expected acute fatalities are calculated

by using factors for each release category. If fi is the release category

frequency and ai is the acute fatalities factor for that category, then the

expected acute fatalities A is simply

A = EtjaI

where the sum is over the release categories.

If acute fatalities are focused upon then the containment reliability measure E can be simply expressed in terms of A:
80

A

lyial

Thus E is the weighted average of the release category frequencies where each

release category is weighted by its acute fatality importance ai.

In a similar way, the expected manrem which is calculated for the

RSSMAP conclusions can be related to the containment reliability measure in

terms of expected release. The expected manrem M is calculated by

M = Efimi

where mi is the manrem factor for a release category i. If release is

expressed as manrem then the containment reliability measure in terms of

expected release E is simply related to M by

M

Efimi

Thus E is a weighted average of the release category frequencies where the

weight is now Mi which is the importance of the category in terms of manrem

release.

TABULATION OF CONTAINMENT RELIABILITY MEASURES FROM RSSMAP

Table 31 lists the acute reliability measure E for those cases

evaluated in the RSSMAP analyses. Table 32 lists the manrem reliability

measure for the RSSMAP cases. These values in Tables 31 and 32 are relatively high since no evacuation was assumed for the consequence evaluations.
81

This was purposely done to separate the effect of containment from the effect

of evacuation. The reliability measures tend to focus on the consequences.

As observed from the table, within about a factor of 2, the containment reliability measures for expected fatalities and expected manrem are all about the

same, about 50 expected acute fatalities and about 1 x 106 expected manrem per

core melt. These relatively high values indicate that the consequences of

core melts are not necessarily benign and that containment design improvements

and other improvements in mitigative measures could significantly reduce these

values.* The previous risk worth evaluations on containment gave risk

reduction ratios of at least 10 which, if initiated, would result in expected

acute fatalities being less than %5 and expected manrem being less than 'I105

with the no evacuation assumption.

TABLE 31. CONTAINMENT RELIABILITY MEASURES FOR ACUTE FATALITIES

FOR THE RSSMAP PLANTS ASSUMING NO EVACUATION

Plant A = Ifiai Efi E

Sequoyah 3.2 x 10-3 5.6 x 10-5 57

Oconee 2.6 x 10-3 8.2 x 10-5 32

Calvert Cliffs 1.2 x 10-1 2.0 x 10-3 60

Grand Gulf 2.0 x 10-3 3.6 x 10-5 56

*Because of RSSMAP's conservative modeling, the values in Tables 31 and 32

can be significantly higher than those calculated using more realistic

analyses. These conclusions are thus dependent on the RSSMAP results and

would need to be validated before any implementation is pursued. This

conclusion is also dependent on the source term assumptions which are

currently being reevaluated.
82

TABLE 32. CONTAINMENT RELIABILITY MEASURES FOR EXPECTED MANREM

FOR THE RSSMAP PLANTS ASSUMING NO EVACUATION

Plant M = Efjmi Efi E

Sequoyah 67 5.6 x 10-5 1.2 x 106

Oconee 48 8.2 x 10-5 5.9 x 105

Calvert Cliffs 2200 2.0 x 10-3 1.1 x 106

Grand Gulf 83 3.6 x 10-5 2.3 x 106
83

REFERENCES

(1) Carlson,

Program:

1981).

(2) Kolb, G.

Program:

1981).

0. D., et al., "Reactor Safety Study Methodology Applications

Sequoyah #1 PWR Power Plant", NUREG/CR-1659/1 of 4 (February

J., et al., "Reactor Safety Study Methodoloqy Applications

Oconee #3 PWR Power Plant", NUREG/CR-1659/2 of 4 (January

(3) Kolb, G. J., et al., "Reactor Safety Study Methodology Applications

Program: Calvert Cliffs #2 PWR Power Plant", NUREG/CR-1659/3 of 4 (to

be published).

(4) Hatch, S. W., Cybulskis, P., and Wooten,

Methodology Applications Program: Grand

NUREG/CR-1659/4 of 4 (October 1981).

(5) Engelbrecht-Wiggins, R., and Strip, D. R.

Reliability Measures to Each Other and t

NUREG/CR-1860 (January 1981).

R. 0., "Reactor Safety Study

Gulf #1 BWR Power Plant",

., On the Relation of Various

Same Theoretic Values,

(6) K. G. Morphy, NRC Letter of July 30, 1980 to R. M. Bernero.

(7) Birnbaum, Z. W., "On the Importance of Different Components in a

Multicomponent System" in Multivariate Analyses--II, ed P. R.

Kreshnaiah, Academic Press, New York, pp. 581-592 (1969).*

(8) Barlow, R. E.,

Life Testing: York (1975).

and Proschan, F., Statistical Theory of Reliability and

Probability Models, Holt, Rinehart and Winston, Inc., New

(9) Lambert, H. E., "Measures of Importance of Events", in Reliability and

Fault Tree Analyses, ed. R. E. Barlow, J. B. Fussell, and N. D.

Singpurwalla, SIAM Press, Philadelphia, pp. 77-100 (1975).

(10) Risk Assessment Review Group Report to the U.S. Nuclear Regulatory

Commission, NUREG/CR-0400 (September 1978).

(11) Three Mile Island, A Report to the Commissioners and to the Public, NRC

Special Inquiry Group (January 1980).

.(12) NRC Views and Analyses of the Recommendations of the President's

Commission on the Accident at Three Mile Island, NUREG-0632 (November

( 13979).

(13) TMI-2 Lessons Learned Task Force--Final Report, USNRC (1980).
84

(14) Murley, T. E., Ernst, M. L., and Thadani, A., "NRC Regulatory

Perspective on Reliability and Risk Assessment", A4S Proceesings on

Probabilistic Risk Assessment, Conference 81905, ppI.1077-1086 (1978).

(15) "Reactor Safety Study, An Assessment of Accident Risks in U.S.

Commercial Nuclear Power Plants", WASH-1400 (October 1975).

(16) Andrews, W. B., et al., "Guidelines For Nuclear Power Plant Safety Issue

Prioritization Information Development", PNL-4297 (May 1982).

(17) Commonwealth Edison, "Zion Probabilistic Safety Study", (1981).

(18) Cybulskis, P., "On the Definition of Containment Failure", International

Workshop on Containment Integrity, Washington D.C., June 7-9, 1982.
APPENDIX A

EXAMPLE RISK WORTHS FOR OTHER RISK MEASURES

A-i

TABLE A-1. RISK REDUCTION WORTHS FOR OCONEE SAFETY SYSTEMS

Risk Reduction Worth

Interval Ratio

Core Melt Acute Core Melt Acute

System Frequency Man Rem Fatalities Frequency Manrem Fatalities

Auxiliary

Feedwater

Pressurizer

Relief Valve

(Stuck Open)

High Pressure

Injection

Low Pressure

Injection

Emergency

Core Cooling

Recirculation

Service Water

Electric Power

(On-Site)

Reactor

Protection

System

High Head

Service Water

3.0 x 10-6

1.8 x10-5

1.4 x10-5

8.8 x 10-6

3.3 x 10-5

1.5 x 10-5

2.2 x 10-6

7.8 x 10-6

2.2 x 10-6

1.9 1.0 x 10-4

10 5.6 x 10-4

8.5 4.7 x 10-4

2.0 1.2 x 10-4

19 1.0 x 1o-3

12 6.4 x 10-4

1.8 9.6 x 10-5

4.8 2.6 x 1o-4

1.0

1.3

1.2

1.A

1.9

1.3

1.0

1.1

1.0

1.3

1.3

1.1

1.8

1.3

1.0

1.1

1.0

1.3

1.3

1.1

1.8

1.3

1.0

1.1

1.4 7.4 x 10-5 1.0 1.0 1.0
A-2

TABLE A-2. RISK ACHIEVEMENT WORTHS FOR OCONEE SAFETY SYSTEMS

Risk AchievementWorth

Interval Ratio

Core Melt Acute Core Melt Acute

System Frequency Man Rem Fatalities frequency Manrem Fatalities

Auxiliary

Feedwater

Pressurizer

Relief Valve

(Stuck Open)

High Pressure

Injection

Low Pressure

Injection

Emergency

Core Cooling

Recirculation

Service Water

7.5 x 10-3

3.3 x 10-4

3.4 x 10-3

5.0 x 10- 4

3.4 x 10-3

4700

200

2100

120

1900

.25 110 110 110

.011

.12

.0067

5.6 5.7 5.7

48 50 52

7.8 3.9 4.1

.11 48 35 37

.54 4.3 x 10-5 24 7500 7900 8100

Electric

Power

(On-Site) 4.4 x 1o-3 3500 .19 62 65 67

Reactor

Protection

System

High Head

Service Water

.30 1.9 x 105 10 4100 4400 4500

2.0 x 10-5 12 6.7 x 10-4 1.3 1.3 1.3
A.3

TABLE A-3. RISK REDUCTION WORTHS FOR HUMAN ACTIONS AT OCONEE

Risk Reduction Worth

Interval Ratio

Individual Core Melt Acute Core Melt Acute

Human Actions Frequency Man Rem Fatalities Frequency Manrem Fatalities

Operator Fails

to Start the

High Pressure

Injection

System

Failure of

Operator to

Align Suction

of HPRS to

Discharge of

LPRS

Operator

Leaves LP Pump

Train Test

Valves in

Wrong Position

Operator Fails

to Open Sump

Valves at the

Start of

Recirculation

Commnon Mode

Miscalibration

of Instruments

Which Actuate

HPIS

Operator Fails

to Manually

Start High

Head Auxiliary

Service Water

1.3 x 10-5

8.4 x 10-6

9.9 x 10-6

9.6 x 10-6

9.0 x 10-8

8.2

5.2

5.6

4.8

4.4 x 1o-4

2.8 x10-4

3.1 x10-4

2.8 x1-4

1.2

1.1

1.2

1.2

1.0

1.2

1.1

1.2

1.1

1.0

1.2

1.1

1.2

1.2

0.056 3.0 x 10-6 1.0

2.2 x 10-6 1.3 7.3 x 10-5 1.0 1.0 1.0
A-4

TABLE A-4. RISK ACHIEVEMENT WORTHS FOR HUMAN ACTIONS AT OCONEE

Risk Achievement Worth

Interval Ratio

Individual Core Melt Acute Core Melt Acute

Human Actions Frequency Man Rem Fatalities Frequency Manrem Fatalities

Operator Fails

to Start the

High Pressure

Injection

System

Failure of

Operator to

Align Suction

of HPRS to

Discharge of

LPRS

Operator

Leaves LP Pump

Train Test

Valves in

Wrong Position

Operator Fails

to Open Sump

Valves at the

Start of

Recirculation

Common Mode

Miscalibration

of Instruments

Which Actuate

HPIS

Operator Fails

to Manually

Start High

Head Auxiliary

Service Water

4.3 x 10-4

2.8 x10-3

3.3 x10-3

3.2 x 1o-3

2.8 x10-3

260

1700

1900

1600

1700

0.014

0.094

0.10

0.076

0.094

6.9

40

47

45

40

7.2

42

45

38

42

7.4

43

46

35

43

1.9 x 10-5 12 6.5 x 1o-4 1.3 1.3 1.3
NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMSER (Assigned by DOC) ,,,-81 s.NCERRGUAOYCMISO NUJREG/CR 3385

BIBLIOGRAPHIC DATA SHEET BMI 2103

4. TITLE AND SUBTITLE (Add Volume No., i(appropriate) 2. (Leave blank)

Measures of Risk Importance and Their Applications 3. RECIPIENTS ACCESSION NO.

7. AUTHOR(S) 5. DATE REPORT COMPLETED

W.E. Vesely, T.C. Davis, R.S. Denning, And N.Saltos MONTH 8YEAR March 1983

9. PERFORMING ORGANIZATION NAME AND MAILING ADDRESS (Include Zip Code) DATE REPORT ISSUED

Battelle Columbus Laboratories MONTH j YEAR

505 King Avenue July 1983

Columbus,Ohio 43201 6. (Leave blank)

B. (Leave blank)

12. SPONSORING ORGANIZATION NAME AND MAILING ADDRESS (Include Zip Code1

Division of Risk Analysis 10. PROJECT/TASK/WORK UNIT NO.

Office of Nuclear Regulatory Research 11. FINNO.

U. S. Nuclear Regulatory Commission B-2386

Washington,D.C. 20555

13. TYPE OF REPORT PERIOD COVERED [inclusive datest

15. SUPPLEMENTARY NOTES -14. eave olarnk)

16. ABSTRACT (200 words or less)

The objectives of this work are to evaluate the importance of the

containment and the different safety functions as assessed in probabilistic

risk -analyses. To accomplish this objective, risk importance measu-es are

defined to evaluate a feature's importance in further reducing the risk and

its, importance in maintaining the present risk.level. One defined importance

measure, called the feature's risk reduction worth, is useful for prioritizing

feature improverneits which can most reduce the risk. The other defined

i~r'rtarCe, called the feature's risk achievement worth, is useful for prioritizing feot',ies winich are most important in reliability assurance and main-

... tenance activities.

17. KEY WORDS AND DOCUMENT ANALYSIS 17a. DESCRIPTORS

17b. IDENTIFIERS/OPEN-ENDED TERMS

18. AVAILABILITY STATEMENT 19 SECURITY CLASS (This report) 21. NO. OF PAGES

Unlimited unrlag-gifiptd

22. PRICE

NRC FORM 335 411-81l


0

UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE, $300

/