United States Nuclear Regulatory Commission

Office of Public Affairs

Washington, DC 20555

Phone 301-415-8200 Fax 301-415-2234

Internet:opa@nrc.gov

No. 96-52 FOR IMMEDIATE RELEASE

(Friday, March 22, 1996)

NOTE TO EDITORS:

The Nuclear Regulatory Commission has received two attached

reports from its Advisory Committee on Reactor Safeguards (ACRS).

The reports, in the form of letters, provide comments on:

--Recent probabilistic risk assessments performed by

Brookhaven National Laboratory on fires and certain fire barrier

issues; and

--Use of individual plant examinations in the regulatory

process.

In addition, the NRC's executive director for operations

received two ACRS reports. They provide comments on:

--An NRC program assessing the adequacy of a computer code

for simulating the behavior of the Westinghouse Electric AP600

advanced pressurized water reactor design; and

--Resolution of generic safety issue 78, "Monitoring of

Fatigue Transient Limits for the Reactor Coolant System."

#

Attachments:

As stated
March 15, 1996

The Honorable Shirley Ann Jackson

Chairman

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Chairman Jackson:

SUBJECT: REVIEW OF RECENT FIRE PROBABILISTIC RISK ASSESSMENT

REPORTS BY BROOKHAVEN NATIONAL LABORATORY AND CERTAIN

FIRE BARRIER ISSUES

During the 429th meeting of the Advisory Committee on Reactor

Safeguards, March 7-9, 1996, we reviewed scoping fire probabilistic

risk assessments (PRAs) performed by Brookhaven National Laboratory

(BNL). We had the benefit of discussions with representatives of

the staff, BNL, and the National Institute of Standards and

Technology (NIST). Our Subcommittee on Fire Protection discussed

this matter during a meeting on February 29, 1996. We also had the

benefit of the documents referenced.

At your request, we reviewed both the PRA model that evaluated the

strategy of using self-induced station blackout (SISBO) to mitigate

the consequences of a fire in the control room or cable spreading

room and the PRA-based scoping analysis of degraded fire barriers.

We also discussed the development of alternate time-temperature

curves for qualification of fire barriers and the status of other

fire protection issues.

To comply with Appendix R requirements, eight units have procedures

that require initiating a station blackout (SBO) condition. An

additional fifteen units have procedures for dealing with fires in

critical areas that could result in an SBO. The PRA by BNL

evaluated the effects of different schemes for managing the

electrical systems in the plant when a fire in the control room has

required use of the alternate shutdown panel.

The study focused on the effectiveness of the procedures used to

mitigate the fire and did not address the probabilistic treatment

of fires. The scope of the study did not include a number of

issues that could affect the conclusions. For example, the BNL

study addressed neither the effects of fire and smoke on human

actions nor the possible damage to sensitive electronic control and

safety instrumentation. The study is weak in the areas of modeling

human actions for the manual shutdown and restart of electrical

equipment after an SBO condition. Because of the limitations of

the analysis and the failure to quantify uncertainties, no

substantive conclusions can be drawn from this scoping study. The
3

limitations of the analysis should be addressed in Phase 2 of this

study. A meaningful uncertainty analysis should also be performed.

In the analysis of degraded fire barriers, BNL developed coredamage frequencies for fire scenarios involving failures of fire

protection features such as cable tray fire barriers, automatic

detection and suppression systems, and fire barrier penetrations.

The PRA model did not examine degrees of fire barrier degradation.

The analysis was based on event tree/fault tree models. Although

this is a step in the right direction, the analysis does not use

the best available methods for modeling fire propagation, detection, and suppression. It does not model the fundamental competition between the time to damage and the time to detection/suppression. Most current fire PRAs have adopted the competing processes

model.

We also discussed the program proposed to the staff by NIST to

develop alternate time-temperature curves for nuclear power plant

fire barrier qualification. The program includes development of

models, ASTM E119-type full-scale furnace tests, and test methods

to simulate barrier response. We question the need for this

program. We have been told that alternate time-temperature curves

have been produced by the insurance industry. Furthermore, a large

number of fire models exist, some of which are being evaluated by

the Department of Energy. Although the need for new models is not

clear, more validation of these models with experimental data is

needed. Some data exist (NUREG/CR-6017). Comparisons with fire

model simulations show that the results are very sensitive to input

parameters that are not always well known.

The staff summarized the progress of licensee actions to correct

deficiencies associated with Thermo-Lag fire barriers. The program

appears to be meeting its objectives.

Sincerely,

/s/

T. S. Kress

Chairman

References:

1. Brookhaven National Laboratory, Draft Technical Letter Report,

FIN L-2629, "Risk Evaluation of the Response of PWRs to Severe

Fires in Critical Locations," May 30, 1995 (Draft Predecisional)

2. Brookhaven National Laboratory, Technical Evaluation Report,

FIN L-1311, "A Risk-Based Approach for Evaluation of Fire
4

Mitigation Features in Nuclear Power Plants," November 21,

1995 (Draft Predecisional)

3. U. S. Nuclear Regulatory Commission, NUREG/CR-6017 and SAND93-

0528, "Fire Modeling of the Heiss Dampf Reaktor Containment,"

September 1995
March 8, 1996

The Honorable Shirley Ann Jackson

Chairman

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Chairman Jackson:

SUBJECT: USE OF INDIVIDUAL PLANT EXAMINATIONS IN THE REGULATORY

PROCESS

During the 428th and 429th meetings of the Advisory Committee on

Reactor Safeguards, February 8-10 and March 7-9, 1996, respectively, we discussed the Individual Plant Examination (IPE) review

process and findings with the NRC staff. Our Subcommittee on IPEs

also met with the staff and its contractors on January 26, 1996, to

review this matter. We also had the benefit of the documents

referenced. This report is in response to the December 27, 1995

Staff Requirements Memorandum (SRM).

In the SRM, the Commission requested "the ACRS views on the extent

to which the current spectrum of IPEs can be used in the regulatory

process." We interpret this request as referring to potential

regulatory uses of the IPEs that were not delineated in Generic

Letter 88-20, "Individual Plant Examination for Severe Accident

Vulnerabilities." This report includes comments on both the

Generic Letter goals and the Commission request.

Goals of Generic Letter 88-20

The purpose of the IPE program, as stated in Generic Letter 88-20,

was for each licensee:

(1) to develop an appreciation of severe accident

behavior

(2) to understand the most likely severe accident

sequences that could occur at its plant

(3) to gain a more quantitative understanding of the

overall probabilities of core damage and fission

product releases

(4) to reduce, if necessary, the overall probabilities

of core damage and fission product releases by

modifying, where appropriate, hardware and proce-
6

dures that would help prevent or mitigate severe

accidents.

We note that the IPEs were to be limited to the examination of

internal initiating events and internal floods with the reactor at

power and that individual and societal risks were not to be

estimated. Other programs deal with external events and shutdown

risk.

The IPE program has been successful at most utilities in meeting

goal (1) and, to a lesser extent, goals (2) and (3) of the Generic

Letter. Goal (4) of the Generic Letter also appears to have been

achieved. We were told that most licensees discovered weaknesses

and took corrective actions. In addition, this program has been

beneficial in educating a broader segment of the NRC staff about

the issues related to these goals.

We were told by the staff that all licensees submitted a Level-1

probabilistic risk assessment (PRA). Most licensees also submitted

a Level-2 PRA, although some addressed Level-2 phenomena in a

rudimentary manner. The methods and data sources used by different

licensees varied widely. In some cases, the choices appeared to be

arbitrary. Some licensees chose to include common-cause failures

only for major components, while others chose to ignore them

completely.

It is difficult to determine the extent to which the variability in

IPE results for similar classes of plants is due to actual plant

differences or to modeling assumptions. Although some of the

causes for this variability may be immediately apparent, others are

not. The latter include assumptions made about success criteria,

the assumed dependencies between operator actions, and the level of

decomposition in fault-tree analyses. (We note that the fault

trees were not requested as part of the IPE submittals.)

An example of a potentially significant impact of modeling

differences is the range of core-damage frequencies (CDFs) for BWR

3/4s that the staff has compiled. This range is from about 10-7 to

about 10-4 per reactor-year. Although the staff has stated that

such differences are primarily due to plant differences, this range

of results seems unrealistic given the similarity among BWR 3/4s.

Use of IPEs in the Regulatory Process

As discussed above, the quality and consistency of the IPEs vary

and the impact of assumptions and analytical models is difficult to

assess. On a case-by-case basis, however, additional and extended

use of these IPEs is possible. As specific regulatory issues

arise, the PRA Standard Review Plan now being developed by the
7

staff can serve as a template for judging the quality and acceptability of the individual plant PRA for the proposed application.

As the agency moves toward risk-informed regulation, there will be

an increasing need for full-scope PRAs that incorporate fire risk,

external events, other modes of operation, and site-specific

consequences. When requests for risk-informed regulatory action

arise, the NRC staff should make it clear that a relevant PRA

should be used.

To achieve these goals, especially consistency, some degree of

standardization will be required. Standardizing PRA models and

methods has been a controversial subject. Proponents argue that it

would create a basis for comparison of PRA results, while opponents

fear that it would inhibit methodological developments. We

recommend that IPEs be reviewed to identify acceptable and

unacceptable assumptions and/or models. Codification of assumptions and models ought not inhibit the continued development of PRA

methods. These activities would be a significant first step toward

addressing the Commission's statement in the SRM dated June 16,

1995, "that more meaningful plant-to-plant or scenario-to-scenario

comparisons based on risk could be achieved if PRAs were done on a

more standardized, replicable basis."

We believe that the NRC could make additional use of the present

IPEs (except those that the staff has found to use unacceptable

methods or models) for a limited number of applications (e.g.,

regulatory analyses and prioritization of generic issues).

The staff stated that the CDFs for several PWRs are greater than

10-4 per reactor-year. Several BWRs have CDFs that are very close

to 10-4 per reactor-year and the conditional containment failure

probabilities for BWR Mark I containments range from about 0.02 to

about 0.6. Although the PRAs have limitations as discussed above,

these numbers suggest that an investigation would be warranted to

reassess their validity and to verify that the very low numbers

reported by some other plants reflect actual plant differences.

Our conclusion is that the IPE program has met successfully the

objectives of Generic Letter 88-20. This program has developed a

risk awareness, both in the utilities and the NRC, that will

contribute significantly to efforts to establish a risk-informed

and performance-oriented regulatory system. The plant-specific
8

IPEs are an extremely valuable asset that should not be permitted

to languish unimproved and unused.

Sincerely,

/s/

T. S. Kress

Chairman

References:

1. Staff Requirements Memorandum dated June 16, 1995, from Andrew

L. Bates, Acting Secretary, NRC, to the File regarding Meeting

with ACRS on June 8, 1995

2. Staff Requirements Memorandum dated December 27, 1995, from

John C. Hoyle, Secretary, NRC, to John T. Larkins, ACRS

regarding Meeting with ACRS on December 8, 1995

3. Generic Letter 88-20, dated November 23, 1988, to All Licensees Holding Operating Licenses and Construction Permits for

Nuclear Power Reactor Facilities, Subject: Individual Plant

Examination for Severe Accident Vulnerabilities - 10 CFR

§50.54(f)
March 19, 1996

Mr. James M. Taylor

Executive Director for Operations

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Mr. Taylor

SUBJECT: NRC STAFF PROGRAM ON THE ADEQUACY ASSESSMENT OF THE

RELAP5/MOD3 CODE FOR SIMULATION OF AP600 PASSIVE

PLANT BEHAVIOR

During the 429th meeting of the Advisory Committee on Reactor

Safeguards, March 7-9, 1996, we reviewed the program being

conducted by the Office of Nuclear Regulatory Research (RES)

to assess the adequacy of the RELAP5/MOD3 code for simulating

the behavior of the Westinghouse AP600 passive plant design.

During this review, we had the benefit of discussions with

representatives and consultants of the NRC staff and the Idaho

National Engineering Laboratory (INEL). Our Subcommittee on

Thermal Hydraulic Phenomena held a meeting on this matter on

February 22-23, 1996. We also had the benefit of the referenced documents.

We have been asked to comment on the approach and methodology

for demonstrating the adequacy of the RELAP5/MOD3 code to

calculate AP600 passive plant behavior in support of the

design certification review. We believe that the overall

approach and methodology being employed by RES for this

assessment is acceptable. Most of the necessary elements are

in place. A substantial amount of work remains, however, and

we believe that the schedule for successful completion cannot

be met.

Our comments and recommendations relative to this review,

primarily based on oral presentations, are:

ˇ Since we last reviewed this program in 1994, significant

improvements have been made. The most significant has

been the increased emphasis on the code improvement

program. Other changes that have led to excellent

results include the involvement of outside technical

expertise, via the Thermal Hydraulic Expert Consultants

group and the direct involvement of RES technical

personnel in the research activities. Particularly

noteworthy accomplishments include the analysis of water

hammer, the treatment of flow oscillations observed in

the tests during injection from the In-containment
10

Refueling-Water Storage Tank and the evaluation and

explanation of strong thermal stratification in the ROSA

cold leg.

ˇ RES should perform a more robust and complete top-down

system scaling analysis for ROSA, SPES, and OSU. An

entire transient should be evaluated to quantify the

effects of various distortions in the three facilities

and to demonstrate that the experimental database is

sufficient to validate the code. Any additional distortions or anomalies identified should be added to the list

of distortions compiled by RES in late-1994, and that

remain to be addressed. The scaling effort should be

integrated with the Phenomena Identification and Ranking

Table.

ˇ The thermal stratification that was seen in ROSA tests

for a one-inch cold-leg break was initially identified as

a potentially important safety issue for the AP600. It

has now been shown to be just a manifestation of scale

distortion in the ROSA facility. This demonstrates the

need to identify and explain anomalous behavior.

ˇ The thermal stratification in the Core Makeup Tank (CMT)

observed in the tests needs to be studied. Its effects

on core inventory have to be understood because neither

RELAP5/MOD3 nor the Westinghouse computer codes can, at

present, reliably predict thermal stratification.

ˇ The screening study for water hammer in the AP600 design

addressed an important safety issue. The study allows an

analysis of the potential for such events and provides a

method for estimating the resulting loads in susceptible

areas. We recommend that this study be published soon as

a separate report.

ˇ The documentation provided for our review did not, by

itself, furnish an adequate basis upon which we could

logically endorse the process. The documentation

provided to the Thermal Hydraulic Phenomena Subcommittee

in advance of the February 22-23, 1996 meeting was

inconsistent and contained results declared incorrect by

RES during the meeting. Furthermore, the RELAP5/MOD3

Code Manual published in August 1995 was not provided to

us in time to support our review.

ˇ RELAP5 is still undergoing significant and rapid modifications. A calculation has not yet been performed with

a version of the code that contains all the planned

changes. Numerous calculations will need to be performed
11

to mature the code and validate it using data obtained

from various separate effects and integral facilities

tests.

Overall, the approach and methodology for qualifying RELAP5/MOD3 for AP600 simulation appear to be adequate. However, two

possible "show stoppers" remain: 1) simulation of the CMT

thermal stratification and 2) simulation of long-term cooling,

which is still an issue. Serious consideration should be

given to addressing these obstacles.
12

Dr. George Apostolakis did not participate in the Committee's

deliberations of this matter.

Sincerely,

/s/

T. S. Kress

Chairman

References:

1. Memorandum dated January 22, 1996 from M. W. Hodges,

Office of Nuclear Regulatory Research, NRC, to J.

Larkins, Advisory Committee on Reactor Safeguards, NRC,

transmitting:

- Volume 2 of 10 volumes of adequacy demonstration

reports, "Adequacy Assessment Overview"

- Idaho National Engineering Laboratory draft report

prepared for U.S. Nuclear Regulatory Commission,

"Adequacy Evaluation of RELAP5/MOD3 for Simulating

AP600 Small Break Loss-of-Coolant Accidents, Volume

2: Horizontal Integrated Analysis of the AP600 1-

Inch Diameter Cold Leg Break," November 1995, with

Appendices A-K (Proprietary)

2. Idaho National Engineering Laboratory, draft report

prepared for U.S. Nuclear Regulatory Commission, "TopDown Scaling Analysis Methodology for AP600 Integral

Tests," January 1996

3. Letter report dated April 12, 1995, to James M. Taylor,

Executive Director for Operations, NRC, from T. S. Kress,

Chairman, Advisory Committee on Reactor Safeguards,

Subject: NRC Test and Analysis Program in Support of

AP600 Advanced Light Water Passive Plant Design Review

4. Letter dated May 8, 1995, from James M. Taylor, Executive

Director for Operations, NRC, to T. S. Kress, Chairman,

Advisory Committee on Reactor Safeguards, Subject: Staff

Response to ACRS Letter Dated April 12, 1995, on NRC Test

and Analysis Program in Support of AP600 Advanced Light

Water Passive Plant Design Reviews
March 14, 1996

Mr. James M. Taylor

Executive Director for Operations

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Mr. Taylor:

SUBJECT: RESOLUTION OF GENERIC SAFETY ISSUE 78, "MONITORING

OF FATIGUE TRANSIENT LIMITS FOR THE REACTOR COOLANT

SYSTEM"

During the 429th meeting of the Advisory Committee on Reactor

Safeguards, March 7-9, 1996, we completed our deliberations on

the resolution of the subject Generic Safety Issue that we

started during our 424th meeting, September 7-8, 1995. We had

the benefit of discussions with representatives of the NRC

staff and of the documents referenced.

This Generic Safety Issue was originally developed to determine whether licensees need to perform transient monitoring to

ensure compliance with requirements concerning fatigue

failure. The transient monitoring concern was subsumed in the

Fatigue Action Plan, which was reported as complete in SECY95-245, "Completion of the Fatigue Action Plan."

The current scope of the Generic Safety Issue is focused on

the evaluation of risk from fatigue failure. The staff

completed a study that demonstrated that the risk from fatigue

failure of the primary coolant pressure boundary components is

very small. The analyses used in the study were based on the

assumption that the probability of crack initiation by fatigue

in a component subject to cyclic loads and the probability of

crack propagation through the wall are independent. The

product of these probabilities was used to calculate the

change in core-damage frequency caused by fatigue failure of

a component.

The analyses, as presented to us by the staff to demonstrate

its conclusion, lacked sufficient detail to be convincing.

Additional discussions with the staff demonstrated that more

complete analyses using the PRAISE code have led to the same

conclusion. The PRAISE analyses of the failure probability of

primary system piping assumed that a distribution of cracks

existed in a component and calculated the probabilities of

crack propagation through the wall and failure. Parametric

studies using the PRAISE code showed that the calculated
James M. Taylor 14

probabilities of failure are small, even when very conservative loads and flaw-size distributions are assumed. The staff

provided a careful quantification of uncertainty of fatigue

crack initiation. We recommend such consideration of uncertainties in any future analyses regardless of the technical

approach adopted.

We believe that the staff's conclusion concerning the risk

significance of fatigue failure of reactor components is

correct. Thus, we agree that this Generic Safety Issue is

resolved.

Dr. Shack did not participate in the Committee's deliberations

regarding this matter.

Sincerely,

/s/

T. S. Kress

Chairman

References:

1. Memorandum dated August 18, 1995, from Charles Serpan,

Jr., NRC Office of Nuclear Regulatory Research, to John

T. Larkins, ACRS Executive Director, Subject: Proposed

Resolution of Generic Safety Issue 78, "Monitoring of

Fatigue Transient Limits for the Reactor Coolant System"

2. SECY-95-245 dated September 25, 1995, from James M.

Taylor, Executive Director for Operations, to the

Commissioners, Subject: Completion of the Fatigue Action

Plan

3. Memorandum dated October 27, 1995, from Jeff Keisler and

Omesh Chopra, Argonne National Laboratory, to Craig

Hrabal, NRC Office of Nuclear Regulatory Research,

Subject: Uncertainty Estimates for the Probability of

Fatigue Crack Initiation in Reactor Components, NUREG/CR6335, ANL-95/15

4. U. S. Nuclear Regulatory Commission, NUREG/CR-6237,

"Statistical Analysis of Fatigue Strain-Life Data for

Carbon and Low-Alloy Steels," August 1994

5. U. S. Nuclear Regulatory Commission, NUREG/CR-6335,

"Fatigue Strain-Life Behavior of Carbon and Low-Alloy

Steels, Austenitic Stainless Steels, and Alloy 600 in LWR

Environments," June 1995