Technical Analysis 

Approach Plan for 

Level 3 PRA Project 

Rev. 0b – Working Draft

October 2013 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

Wednesday, October 23, 2013 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

i 

TABLE OF CONTENTS 

1. Introduction .......................................................................................................................... 1-1

1.1 Background ................................................................................................................. 1-1

1.2 Objectives ................................................................................................................... 1-2

1.3 Scope ........................................................................................................................1-2

1.4 Assumptions and Limitations ...................................................................................... 1-4

1.5 Project Team Organization ............................................................................................ 1-5

2. Approach .............................................................................................................................. 2-1

2.1 Project Organization .................................................................................................... 2-1

2.2 Overall Approach ........................................................................................................ 2-3

2.2.1 Technical Approach Philosophy ....................................................... 2-4

2.2.2 Proposed Tools and Models ............................................................. 2-4

2.2.3 Key Challenges and Gaps in PRA Technology ................................ 2-5

2.2.3.1 Modeling of Site Risk ..................................................................... 2-6

2.2.3.2 Spent Fuel PRA Technology .......................................................... 2-6

2.2.3.3 Human Reliability Analysis ............................................................ 2-7

2.2.3.4 Additional Modeling Issues ........................................................... 2-7

2.3 Approach Summary .................................................................................................... 2-8

2.4 Quality Assurance ....................................................................................................... 2-8

3. Overall Technical Approach to a Full-Scope Site Level 3 PRA ............................................ 3-1

4. Technical Approach for Success Criteria Analysis ............................................................... 4-1

4.1 Assumptions and Limitations ...................................................................................... 4-1

4.2 Inputs ........................................................................................................................ 4-2

4.3 Analysis Steps ............................................................................................................. 4-4

4.4 Documentation ............................................................................................................ 4-6

4.5 Task Interfaces ............................................................................................................ 4-7

4.6 References .................................................................................................................. 4-8

5. Technical Approach for Systems Analysis ........................................................................... 5-1

5.1 Assumptions and Limitations ...................................................................................... 5-1

5.2 Inputs ........................................................................................................................ 5-1

5.3 Analysis Steps ............................................................................................................. 5-2

5.4 Documentation ............................................................................................................ 5-4

5.5 Task Interfaces ............................................................................................................ 5-5

5.6 References .................................................................................................................. 5-5
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

ii 

6. Technical Approach for Data Analysis ................................................................................. 6-1

6.1 Assumptions and Limitations ...................................................................................... 6-1

6.2 Inputs ........................................................................................................................ 6-1

6.3 Analysis Steps ............................................................................................................. 6-2

6.4 Documentation ............................................................................................................ 6-4

6.5 Task Interfaces ............................................................................................................ 6-4

6.6 References .................................................................................................................. 6-4

7. Technical Approach for Human Reliability Analysis ............................................................. 7-1

7.1 Assumptions and Limitations ...................................................................................... 7-2

7.2 Inputs ........................................................................................................................ 7-3

7.3 Analysis Steps ............................................................................................................. 7-5

7.4 Documentation .......................................................................................................... 7-14

7.5 Task Interfaces .......................................................................................................... 7-15

7.6 References ................................................................................................................ 7-16

8. Technical Approach for Structural Analysis ......................................................................... 8-1

8.1 Assumptions and Limitations ...................................................................................... 8-1

8.2 Inputs ........................................................................................................................ 8-2

8.3 Analysis Steps ............................................................................................................. 8-3

8.4 Documentation ............................................................................................................ 8-6

8.5 Task Interfaces ............................................................................................................ 8-7

8.6 References .................................................................................................................. 8-8

9. Technical Approach for Fragility Analysis ............................................................................ 9-1

9.1 Assumptions and Limitations ...................................................................................... 9-1

9.2 Inputs ........................................................................................................................ 9-3

9.3 Analysis Steps ............................................................................................................. 9-5

9.4 Documentation ............................................................................................................ 9-8

9.5 Task Interfaces ............................................................................................................ 9-9

9.6 References ................................................................................................................ 9-11

10. Technical Approach for Hazard Analysis ........................................................................... 10-1

10.1 Assumptions and Limitations .................................................................................... 10-1

10.2 Inputs ...................................................................................................................... 10-2

10.3 Analysis Steps ........................................................................................................... 10-2

10.4 Documentation .......................................................................................................... 10-3

10.5 Task Interfaces .......................................................................................................... 10-4

10.6 References ................................................................................................................ 10-5
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

iii 

11. Technical Approach for Uncertainty Analysis ..................................................................... 11-1

11.1 Introduction ............................................................................................................... 11-1

11.2 Assumptions and Limitations .................................................................................... 11-1

11.3 Inputs ...................................................................................................................... 11-1

11.4 Analysis Steps ........................................................................................................... 11-2

11.5 Products .................................................................................................................... 11-6

11.6 Task Interfaces .......................................................................................................... 11-6

11.7 References ................................................................................................................ 11-6

12. Technical Approach for Reactor, At-Power, Internal Hazards PRA ................................... 12-1

12.1 Task 1-1: Level 1 Reactor PRA, At-Power for Internal Hazards ............................... 12-1

12.1.1 Subtask 1-1.1: Level 1 PRA for At-Power and Internal Events ....... 12-1

12.1.1.1 Subtask 1-1.1a: Initiating Event Analysis ........................................ 12-1

12.1.1.2 Subtask 1-1.1b: Accident Sequence Analysis ................................ 12-4

12.1.1.3 Subtask 1-1.1c: Success Criteria .................................................... 12-7

12.1.1.4.Subtask 1-1.1d: Systems Analysis ................................................. 12-8

12.1.1.5 Human Reliability Analysis ........................................................... 12-11

12.1.1.6 Subtask 1-1.1f: Data Analysis ....................................................... 12-17

12.1.1.7 Subtask 1-1.1g: Quantification ...................................................... 12-21

12.1.1.8 Uncertainty Analysis ..................................................................... 12-24

12.1.2 Subtask 1-1.2: Level 1 Reactor PRA for At-Power and Internal Floods

 25

12.1.2.1 Assumptions and Limitations ........................................................ 12-25

12.1.2.2 Inputs ............................................................................................ 12-26

12.1.2.3 Analysis Steps .............................................................................. 12-26

12.1.2.4 Documentation .............................................................................. 12-29

12.1.2.5 Task Interfaces ............................................................................. 12-30

12.1.2.6 References ................................................................................... 12-31

12.1.3 Subtask 1-1.3: Level 1 Reactor PRA for At-Power, Internal Fires 12-31

12.1.3.1 Assumptions and Limitations ........................................................ 12-31

12.1.3.2 Inputs ............................................................................................ 12-32

12.1.3.3 Analysis Steps .............................................................................. 12-32

12.1.3.4 Documentation .............................................................................. 12-34

12.1.3.5 Task Interfaces ............................................................................. 12-34

12.1.3.6 References ................................................................................... 12-35

12.2 Task 1-2: Level 2 Reactor PRA, At-Power for Internal Hazards ............................. 12-35

12.2.1 Subtask 1-2.1: Level 1/2 PRA Interface – Accident Sequence 

Grouping ....................................................................................... 12-36
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

iv 

12.2.1.1 Assumptions and Limitations ........................................................ 12-36

12.2.1.2 Inputs ............................................................................................ 12-37

12.2.1.3 Analysis Steps .............................................................................. 12-37

12.2.1.4 Documentation .............................................................................. 12-40

12.2.1.5 Task Interfaces ............................................................................. 12-40

12.2.1.6 References ................................................................................... 12-41

12.2.2 Subtask 1-2.2: Containment Capacity Analysis ............................ 12-41

12.2.2.1 Assumptions and Limitations ........................................................ 12-41

12.2.2.2 Inputs ............................................................................................ 12-42

12.2.2.3 Analysis Steps .............................................................................. 12-42

12.2.2.4 Documentation .............................................................................. 12-43

12.2.2.5 Task Interfaces ............................................................................. 12-44

12.2.2.6 References ................................................................................... 12-44

12.2.3 Subtask 1-2.3: Severe Accident Progression Analysis ................. 12-44

12.2.3.1 Assumptions and Limitations ........................................................ 12-45

12.2.3.2 Inputs ............................................................................................ 12-45

12.2.3.3 Analysis Steps .............................................................................. 12-46

12.2.3.4 Documentation .............................................................................. 12-48

12.2.3.5 Task Interfaces ............................................................................. 12-49

12.2.3.6 References ................................................................................... 12-49

12.2.4 Subtask 1-2.4: Probabilistic Treatment of Accident Progression .. 12-50

12.2.4.1 Assumptions and Limitations ........................................................ 12-50

12.2.4.2 Inputs ............................................................................................ 12-50

12.2.4.3 Analysis Steps .............................................................................. 12-51

12.2.4.4 Documentation .............................................................................. 12-54

12.2.4.5 Task Interfaces ............................................................................. 12-55

12.2.4.6 References ................................................................................... 12-55

12.2.5 Subtask 1-2.5: Radiological Source Term Analysis ...................... 12-55

12.2.5.1 Assumptions and Limitations ........................................................ 12-56

12.2.5.2 Inputs ............................................................................................ 12-56

12.2.5.3 Analysis Steps .............................................................................. 12-56

12.2.5.4 Documentation .............................................................................. 12-57

12.2.5.5 Task Interfaces ............................................................................. 12-58

12.2.5.6 References ................................................................................... 12-58

12.2.6 Subtask 1-2.6: Evaluation and Presentation of Results ................ 12-58

12.2.6.1 Assumptions and Limitations ........................................................ 12-59
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

v 

12.2.6.2 Inputs ............................................................................................ 12-59

12.2.6.3 Analysis Steps .............................................................................. 12-59

12.2.6.4 Documentation .............................................................................. 12-59

12.2.6.5 Task Interfaces ............................................................................. 12-59

12.2.6.6 References ................................................................................... 12-60

12.2.7 Subtask 1-2.7: Level 2/3 PRA Interface ........................................ 12-60

12.2.7.1 Assumptions and Limitations ........................................................ 12-60

12.2.7.2 Inputs ............................................................................................ 12-60

12.2.7.3 Analysis Steps .............................................................................. 12-60

12.2.7.4 Documentation .............................................................................. 12-60

12.2.7.5 Task Interfaces ............................................................................. 12-61

12.2.7.6 References ................................................................................... 12-61

12.3 Task 1-3: Level 3 Reactor PRA, At-Power for Internal Hazards ............................. 12-61

12.3.1 Subtask 1-3.1: Transition from the Radionuclide Release to Level 3

 12-62

12.3.1.1 Assumptions and Limitations ........................................................ 12-62

12.3.1.2 Inputs ............................................................................................ 12-62

12.3.1.3 Analysis Steps .............................................................................. 12-63

12.3.1.4 Documentation .............................................................................. 12-64

12.3.1.5 Task Interfaces ............................................................................. 12-65

12.3.2 Subtask 1-3.2: Protective Action Parameters and Other Site Data .. 12-

65

12.3.2.1 Assumptions and Limitations ........................................................ 12-65

12.3.2.2 Inputs ............................................................................................ 12-66

12.3.2.3 Analysis Steps .............................................................................. 12-66

12.3.2.4 Documentation .............................................................................. 12-68

12.3.2.5 Task Interfaces ............................................................................. 12-69

12.3.3 Meteorological Data ...................................................................... 12-69

12.3.3.1 Assumptions and Limitations ........................................................ 12-69

12.3.3.2 Inputs ............................................................................................ 12-70

12.3.3.3 Analysis Steps .............................................................................. 12-70

12.3.3.4 Documentation .............................................................................. 12-71

12.3.3.5 Task Interfaces ............................................................................. 12-72

12.3.4 Subtask 1-3.4: Atmospheric Transport and Dispersion ................ 12-72

12.3.4.1 Assumptions and Limitations ........................................................ 12-72

12.3.4.2 Inputs ............................................................................................ 12-73

12.3.4.3 Analysis Steps .............................................................................. 12-73
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

vi 

12.3.4.4 Documentation .............................................................................. 12-74

12.3.4.5 Task Interfaces ............................................................................. 12-74

12.3.5 Subtask 1-3.5: Dosimetry ............................................................. 12-75

12.3.5.1 Assumptions and Limitations ........................................................ 12-75

12.3.5.2 Inputs ............................................................................................ 12-75

12.3.5.3 Analysis Steps .............................................................................. 12-76

12.3.5.4 Documentation .............................................................................. 12-76

12.3.5.5 Task Interfaces ............................................................................. 12-76

12.3.6 Subtask 1-3.6: Health Effects ....................................................... 12-76

12.3.6.1 Assumptions and Limitations ........................................................ 12-77

12.3.6.2 Inputs ............................................................................................ 12-77

12.3.6.3 Analysis Steps .............................................................................. 12-77

12.3.6.4 Documentation .............................................................................. 12-78

12.3.6.5 Task Interfaces ............................................................................. 12-78

12.3.7 Subtask 1-3.7: Economic Factors ................................................. 12-78

12.3.7.1 Assumptions and Limitations ........................................................ 12-79

12.3.7.2 Inputs ............................................................................................ 12-79

12.3.7.3 Analysis Steps .............................................................................. 12-79

12.3.7.4 Documentation .............................................................................. 12-80

12.3.7.5 Task Interfaces ............................................................................. 12-80

12.3.8 Subtask 1-3.8: Quantification and Reporting ................................ 12-80

12.3.8.1 Assumptions and Limitations ........................................................ 12-81

12.3.8.2 Inputs ............................................................................................ 12-81

12.3.8.3 Analysis Steps .............................................................................. 12-81

12.3.8.4 Documentation .............................................................................. 12-82

12.3.8.5 Task Interfaces ............................................................................. 12-82

12.3.9 Subtask 1-3.9: Risk Integration ..................................................... 12-82

12.3.10 Interfaces for Overall Task 1-3 ..................................................... 12-83

12.3.11 References ................................................................................... 12-83

13. Technical Approach for Reactor, At-Power for External and Other Hazards PRA ............. 13-1

13.1 Task 2-1: Level 1 Reactor PRA, At-Power for External and Other Hazards ............. 13-1

13.1.1 Subtask 2-1.2: Level 1 Reactor PRA for At-Power and Seismic Events 

 1

13.1.1.1 Assumptions and Limitations .......................................................... 13-1

13.1.1.2 Inputs .............................................................................................. 13-2

13.1.1.3 Analysis Steps ................................................................................ 13-2
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

vii 

13.1.1.4 Documentation ................................................................................ 13-5

13.1.1.5 Task Interfaces ............................................................................... 13-6

13.1.1.6 References ..................................................................................... 13-6

13.1.2 Subtask 2-1.2: Level 1 Reactor PRA for At-Power and High Winds . 13-

7

13.1.2.1 Assumptions and Limitations .......................................................... 13-8

13.1.2.2 Inputs .............................................................................................. 13-8

13.1.2.3 Analysis Steps ................................................................................ 13-9

13.1.2.4 Documentation .............................................................................. 13-10

13.1.2.5 Task Interfaces ............................................................................. 13-11

13.1.2.6 References ................................................................................... 13-12

13.1.3 Subtask 2-1.3: Level 1 Reactor PRA for At-Power and External Floods

 13-12

13.1.3.1 Assumptions and Limitations ........................................................ 13-13

13.1.3.2 Inputs ............................................................................................ 13-14

13.1.3.3 Analysis Steps .............................................................................. 13-14

13.1.3.4 Documentation .............................................................................. 13-16

13.1.3.5 Task Interfaces ............................................................................. 13-17

13.1.3.6 References ................................................................................... 13-17

13.1.4 Subtask 2-1.4: Level 1 Reactor PRA for At-Power and Other External 

Hazards ........................................................................................ 13-18

13.1.4.1 Assumptions and Limitations ........................................................ 13-18

13.1.4.2 Inputs ............................................................................................ 13-19

13.1.4.3 Analysis Steps .............................................................................. 13-19

13.1.4.4 Documentation .............................................................................. 13-22

13.1.4.5 Task Interfaces ............................................................................. 13-22

13.1.4.6 References ................................................................................... 13-23

13.2 Task 2-2: Level 2 Reactor PRA, At-Power for External Hazards ............................ 13-23

13.3 Task 2-3: Level 3 Reactor PRA, At-Power for External Hazards ........................... 13-25

14. Technical Approach for Reactor, Low Power and Shutdown, All Hazards PRA ................ 14-1

14.1 Task 3-1: Level 1 Reactor PRA, Low Power and Shutdown for All Hazards ............ 14-1

14.1.1 Subtask 3-1.1: Level 1 Reactor PRA for Low Power and Shutdown 

and Internal Events ......................................................................... 14-1

14.1.1.1 Assumptions and Limitations .......................................................... 14-1

14.1.1.2 Inputs .............................................................................................. 14-2

14.1.1.3 Analysis Steps ................................................................................ 14-3

14.1.1.4 Documentation ................................................................................ 14-9
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

viii 

14.1.1.5 Task Interfaces ............................................................................... 14-9

14.1.1.6 References ................................................................................... 14-10

14.1.2 Subtask 3-1.2: Level 1 Reactor PRA for Low Power and Shutdown 

and Internal Floods ....................................................................... 14-10

14.1.2.1 Assumptions and Limitations ........................................................ 14-10

14.1.2.2 Inputs ............................................................................................ 14-11

14.1.2.3 Analysis Steps .............................................................................. 14-11

14.1.2.4 Documentation .............................................................................. 14-13

14.1.2.5 Task Interfaces ............................................................................. 14-14

14.1.2.6 References ................................................................................... 14-14

14.1.3 Subtask 3-1.3: Level 1 Reactor PRA for Low Power and Shutdown 

and Internal Fires ............................................................................... 15

14.1.4 Subtask 3-1.4: Level 1 Reactor PRA for Low Power and Shutdown 

and Seismic Events, High Winds, and External Floods ..................... 15

14.1.5 Subtask 3-1.5: Level 1 Reactor PRA for Low Power and Shutdown 

and Other External Hazards ......................................................... 14-15

14.1.5.1 Assumptions and Limitations ........................................................ 14-16

14.1.5.2 Inputs ............................................................................................ 14-16

14.1.5.3 Analysis Steps .............................................................................. 14-17

14.1.4.4 Documentation .............................................................................. 14-20

14.1.5.5 Task Interfaces ............................................................................. 14-20

14.1.5.6 References ................................................................................... 14-21

14.2 Task 3-2: Level 2 Reactor PRA, Low Power and Shutdown for All Hazards .......... 14-21

14.3 Task 3-3: Level 3 Reactor PRA, Low Power and Shutdown for All Hazards .......... 14-23

15. Technical Approach for Spent Fuel Pool PRA ................................................................... 15-1

15.1 Task 4-1: Level 1/2 Spent Fuel Pool PRA ................................................................. 15-1

15.1.1 Subtask 4-1.1: Initiating Event Analysis .......................................... 15-2

15.1.1.1 Assumptions and Limitations .......................................................... 15-3

15.1.1.2 Inputs .............................................................................................. 15-3

15.1.1.3 Analysis Steps ................................................................................ 15-4

15.1.1.4 Documentation ................................................................................ 15-5

15.1.1.5 Task Interfaces ............................................................................... 15-6

15.1.1.6 References ..................................................................................... 15-6

15.1.2 Subtask 4-1.2: Structural Analysis .................................................. 15-6

15.1.2.1 Assumptions and Limitations .......................................................... 15-7

15.1.2.2 Inputs .............................................................................................. 15-7

15.1.2.3 Analysis Steps ................................................................................ 15-7
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

ix 

15.1.2.4 Documentation ................................................................................ 15-8

15.1.2.5 Task Interfaces ............................................................................... 15-8

15.1.2.6 References ..................................................................................... 15-9

15.1.3 Subtask 4-1.3: Accident Sequence Analysis .................................. 15-9

15.1.3.1 Assumptions and Limitations .......................................................... 15-9

15.1.3.2 Inputs .............................................................................................. 15-9

15.1.3.3 Analysis Steps .............................................................................. 15-10

15.1.3.4 Documentation .............................................................................. 15-11

15.1.3.5 Task Interfaces ............................................................................. 15-11

15.1.3.6 References ................................................................................... 15-11

15.1.4 Subtask 4-1.4: Systems Analysis ................................................. 15-12

15.1.4.1 Assumptions and Limitations ........................................................ 15-12

15.1.4.2 Inputs ............................................................................................ 15-12

15.1.4.3 Analysis Steps .............................................................................. 15-13

15.1.4.4 Documentation .............................................................................. 15-13

15.1.4.5 Task Interfaces ............................................................................. 15-14

15.1.4.6 References ................................................................................... 15-14

15.1.5 Subtask 4-1.5: Human Reliability Analysis ................................... 15-14

15.1.6 Subtask 4-1.6: Accident Progression and Success Criteria Analysis

 15-14

15.1.6.1 Assumptions and Limitations ........................................................ 15-14

15.1.6.2 Inputs ............................................................................................ 15-15

15.1.6.3 Analysis Steps .............................................................................. 15-15

15.1.6.4 Documentation .............................................................................. 15-16

15.1.6.5 Task Interfaces ............................................................................. 15-17

15.1.6.6 References ................................................................................... 15-17

15.1.7 Subtask 4-1.7: Quantification ........................................................ 15-17

15.1.7.1 Assumptions and Limitations ........................................................ 15-18

15.1.7.2 Inputs ............................................................................................ 15-18

15.1.7.3 Analysis Steps .............................................................................. 15-18

15.1.7.4 Documentation .............................................................................. 15-19

15.1.7.5 Task Interfaces ............................................................................. 15-19

15.1.7.6 References ................................................................................... 15-19

15.1.8 Subtask 4-1.8: Uncertainty Analysis ............................................. 15-19

15.1.8.1 Assumptions and Limitations ........................................................ 15-20

15.1.8.2 Inputs ............................................................................................ 15-20

15.1.8.3 Analysis Steps .............................................................................. 15-20
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

x 

15.1.8.4 Documentation .............................................................................. 15-20

15.1.8.5 Task Interfaces ............................................................................. 15-21

15.1.8.6 References ................................................................................... 15-21

15.2 Task 4-2: Level 3 Spent Fuel Pool PRA .................................................................. 15-21

16. Technical Approach for Dry Cask Storage PRA ................................................................ 16-1

16.1 Task 5-1: Dry Cask Storage PRA for Cask Damage (Release Frequency) .............. 16-1

16.1.1 Subtask 5-1.1: Dry Cask Description and Operational Phases ...... 16-3

16.1.1.1 Assumptions and Limitations .......................................................... 16-4

16.1.1.2 Inputs .............................................................................................. 16-4

16.1.1.3 Analysis Steps ................................................................................ 16-4

16.1.1.4 Documentation ................................................................................ 16-5

16.1.1.5 Task Interfaces ............................................................................... 16-5

16.1.2 Subtask 5-1.2: Initiating Event Analysis .......................................... 16-5

16.1.2.1 Assumptions and Limitations .......................................................... 16-5

16.1.2.2 Inputs .............................................................................................. 16-6

16.1.2.3 Analysis Steps ................................................................................ 16-6

16.1.2.4 Documentation ................................................................................ 16-8

16.1.2.5 Task Interfaces ............................................................................... 16-9

16.1.3 Subtask 5-1.3: Data Analysis .......................................................... 16-9

16.1.3.1 Assumptions and Limitations .......................................................... 16-9

16.1.3.2 Inputs ............................................................................................ 16-10

16.1.2.3 Analysis Steps .............................................................................. 16-10

16.1.3.4 Documentation .............................................................................. 16-11

16.1.3.5 Task Interfaces ............................................................................. 16-12

16.1.4 Subtask 5-1.4: Human Reliability Analysis ................................... 16-13

16.1.5 Subtask 5-1.5: Success Criteria (Structural and Thermal Analysis) . 16-

13

16.1.5.1 Assumptions and Limitations ........................................................ 16-13

16.1.5.2 Inputs ............................................................................................ 16-13

16.1.5.3 Analysis Steps .............................................................................. 16-14

16.1.5.4 Documentation .............................................................................. 16-15

16.1.5.5 Task Interfaces ............................................................................. 16-15

16.1.6 Subtask 5-1.6: Accident Sequence Analysis and Quantification .. 16-15

16.1.6.1 Assumptions and Limitations ........................................................ 16-16

16.1.6.2 Inputs ............................................................................................ 16-16

16.1.6.3 Analysis Steps .............................................................................. 16-16
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xi 

16.1.6.4 Documentation .............................................................................. 16-17

16.1.6.5 Task Interfaces ............................................................................. 16-18

16.1.7 Subtask 5-1.7: Uncertainty Analysis ............................................. 16-18

16.1.7.1 Assumptions and Limitations ........................................................ 16-18

16.1.7.2 Inputs ............................................................................................ 16-18

16.1.7.3 Analysis Steps .............................................................................. 16-18

16.1.7.4 Documentation .............................................................................. 16-19

16.1.7.5 Task Interfaces ............................................................................. 16-19

16.2 Task 5-2: Dry Cask Storage PRA for Health Effects (Consequence Analysis) ....... 16-19

16.2.1 Subtask 5-2.1: Radionuclide Release ........................................... 16-19

16.2.1.1 Assumptions and Limitations ........................................................ 16-19

16.2.1.2 Inputs ............................................................................................ 16-20

16.2.1.3 Analysis Steps .............................................................................. 16-20

16.2.1.4 Documentation .............................................................................. 16-21

16.2.1.5 Task Interfaces ............................................................................. 16-21

16.2.2 Subtask 5-2.2: Consequence Analysis ......................................... 16-22

16.3 References .............................................................................................................. 16-22

17 Technical Approach for Integrated Site Risk Analysis Task ............................................... 17-1

17.1 Assumptions and Limitations .................................................................................... 17-1

17.2 Inputs ...................................................................................................................... 17-2

17.3 Analysis Tasks .......................................................................................................... 17-2

17.5 Documentation ........................................................................................................ 17-20

17.6 Task Interfaces ........................................................................................................ 17-20

17.7 References .............................................................................................................. 17-21

18. QUALITY ASSURANCE .................................................................................................... 18-1

18.1 Established Methods, Tools and Data ...................................................................... 18-1

18.2 Qualified Personnel ................................................................................................... 18-1

18.3 PRA Model Configuration Control ............................................................................. 18-2

18.4 Technical Reviews .................................................................................................... 18-3

18.4.1 Technical Advisory Group ............................................................... 18-3

18.4.2 Internal Self-Assessment ................................................................ 18-5

18.4.3 External Peer Review ................................................................... 18-17

18.5 Documentation Control ........................................................................................... 18-19

18.5.1 Storing and Accessing Project Information ................................... 18-20

18.5.2 Upload of Information onto the SharePoint Site ........................... 18-20

18.5.3 Document Control of Licensee Information .................................. 18-21
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xii 

18.5.4 Documentation Backup ................................................................. 18-21

18.5.5 Use of External Storage Media ..................................................... 18-21

18.5.6 Individual Personal Working Files ................................................. 18-22

18.5.7 Use of Templates and Forms for Documentation ......................... 18-25

18.5.8 Site Visits ...................................................................................... 18-28

18.5.9 Documentation Control for NRC Contractors................................ 18-30

18.5.10 Non-Disclosure Agreement to Allow Access to Proprietary Information

 18-31

18.5.11 Project Documentation Markings .................................................. 18-31

18.5.12 Guidance for Addressing Potential Technical Issues ................... 18-32

18.5.13 Future Plant Modifications ............................................................ 18-37

18.5.14 Organization of the Various Types of Information on the SharePoint 

Site ................................................................................................ 18-37

18.6 Quality Assurance Program Implementation Audits ................................................ 18-38

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xiii 

List of Acronyms 

ACC Accumulator 

ACCW Auxiliary Component Cooling Water 

ACRS Advisory Committee on Reactor Safeguards 

ACW Auxiliary Component Cooling Water 

ADV Atmospheric Dump Valves (also called SG power operated relief valves) 

AFW Auxiliary Feed Water 

ALTAFW Alternate Auxiliary Feed Water (additional AFW Source) 

AMSAC ATWS Mitigating System Actuation Circuitry 

ANS American Nuclear Society 

AOP Abnormal Operating Procedure 

APET Accident Progression Event Tree 

ARP Alarm Response Procedure 

ARV Atmospheric Relief Valve 

ASME American Society of Mechanical Engineers 

ATWS Anticipated Transient Without Scram 

BE Basic Event 

BFIV Bypass Feed water isolation valve 

BFRV Bypass Feed water regulation valve 

BIT Boron Injection Tank 

BMT Basemat Melt-Through 

BOC Beginning of cycle 

BOP Balance of Plant 

BUS Electrical Bus 

BWR Boiling Water Reactor 

CA Computational Aid 

CAFTA Computer Aided Fault Tree Analysis 

CBO Controlled Bleed Off Isolation 

CCCG Common Cause Component Group 

CCDF Complementary Cumulative Distribution Function 

CCDP Conditional Core Damage Probability 

CCF Common Cause Failure 

CCFDB Common Cause Failure Data Base 

CCI Common Cause Initiator 

CCP Centrifugal Charging Pump 

CCU Containment Cooling Units 

CCW Closed Cooling Water 

CD Core Damage 

CDF Core Damage Frequency 

CDFM Conservative Deterministic Failure Margin 

CDP Core Damage Probability 

CET Core Exit Temperature 

CET Containment Event Tree 

CETC Core Exit Thermocouple 

CEUS Central and Eastern United States 

CHG Charging 

CHR Containment Heat Removal 

CHS Condenser Heat Sink 

CKV Check Valve 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xiv 

CLERP Conditional Large Early Release Probability 

CM Core Melt 

CMF Common Mode Failure 

CMF Core Melt Frequency 

CNI Constrained Non-Informative 

CRDM Control Rod Drive Mechanism 

CRM Configuration Risk Management 

CSLOCA Consequential small loss of coolant accident 

CSSB Consequential secondary side break 

CST Condensate Storage Tank 

CVC Chemical and Volume Control 

CVCS Chemical and Volume Control System 

CW Circulating Water 

CY Calendar Year 

DBA Design Basis Accident 

DBE Design Basis Earthquake 

DBE Design Basis Event 

DCF Dose Conversion Factor 

DCH Direct Containment Heating 

DCH Decay Heat Package (MELCOR) 

DCS Dry Cask Storage 

DCSO Dry Cask Storage Operations 

DDP Diesel Driven Pump 

DEP Depressurization 

DFC Diagnostic Flow Chart 

DGR Diesel Generator Recovery 

DIAG Diagnose 

EAB Exclusion Area Boundary 

EAL Emergency Action Level 

EBR Emergency Boration 

ECCS Emergency Core Cooling System 

EDG Emergency Diesel Generator 

EDMG Extensive Damage Mitigation Guideline 

EHC electro-hydraulic control 

EOC End of cycle 

EOC Error of Commission 

EOO Error of Omission 

EOP Emergency Operating Procedures 

EP Emergency Preparedness 

EPIX Equipment Performance Information Exchange database 

EPRI Electric Power Research Institute 

EPS Emergency Power System 

ESF Engineered Safety Features 

ET Event Tree 

EVSE Ex-Vessel Steam Explosion 

F&B Feed and Bleed (Bleed and Feed) 

FHB Fuel Handling Building 

FM Failure Mode 

FMEA Failure Modes and Effects Analysis 

FP Fire Protection 

FSAR Final Safety Analysis Report 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xv 

FT Fault Tree 

FTR Fails To Run 

FW Feed Water 

GSI Generic Safety Issue 

HCLPF High Confidence Low Probability Failure 

HEP Human Error Probability 

HFE Human Failure Event 

HLR Hot Leg Recirculation 

HLR High Level Requirement 

HMI Human Machine Interface 

HPCI High Pressure Coolant Injection 

HPI High Pressure Injection 

HPME High Pressure Melt Ejection 

HPR High Pressure Recirculation 

HRA Human Reliability Analysis 

ICE Inadvertent Criticality Event 

IE Initiating Event 

IEDB Initiating Events Database 

IEFT Initiating event fault tree 

IF Internal Flooding 

IM Importance Measure 

INEEL Idaho National Engineering and Environmental Laboratory 

INEL Idaho National Engineering Laboratory 

INJ Injection 

INL Idaho National Laboratory 

INPO Institute of Nuclear Power Operations 

IPE Individual Plant Examination 

IPEEE Individual Plant Examination of External Events 

ISFSI Independent Spent Fuel Storage Installation 

ISINJ Inadvertent Safety Injection 

ISLOCA Interfacing-Systems Loss-of-Coolant Accident 

ISRA Integrated Site Risk Analysis 

ISRS In-Structure Response Spectrum 

IVSE In-Vessel Steam Explosion 

LBE Licensing-Basis Event 

LER Licensee Event Report 

LERF Large Early Release Frequency 

LLNL Lawrence Livermore National Laboratory 

LLOCA Large Loss of Cooling Accident 

LOACCW Loss of auxiliary component cooling water 

LOC Loss of Coolant 

LOCA Loss of Coolant Accident 

LOCHS Loss of Condenser Heat Sink 

LODCA Loss of 125V dc Bus A 

LODCB Loss of 125V dc Bus B 

LOFW Loss of Feed water 

LOIA Loss of Instrument Air 

LOIAS Loss of Instrument Air 

LOMFW Loss of main feed water 

LONSCW Loss of Nuclear Service Water 

LONSW Loss of nuclear service water 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xvi 

LOOP Loss Of Offsite Power 

LOOPGR LOOP Grid Related 

LOOPPC LOOP Plant Centered 

LOOPSC LOOP Switchyard Centered 

LOOPWR LOOP Weather Related 

LOSC Loss of RCP Seal Cooling 

LOSINJ Loss of RCP Seal Injection 

LOSP loss of offsite power; loss of station power 

LOSP Loss of Offsite Power 

LPI Low Pressure Injection 

LPR Low Pressure Recirculation 

LPSD Low Power and Shut Down 

LRF Large Release Frequency 

LWR Light Water Reactor 

MAAP Modular Accident Analysis Program 

MAINT Maintenance 

MCCI Molten Core Concrete Interaction 

MCR Main Control Room 

MDAFP Motor-Driven Auxiliary Feedwater Pump 

MDAFW Motor-Driven Auxiliary Feed Water 

MDP Motor Driven Pump 

MELCOR NRC-Sponsored Severe Accident Computer Code 

MFRV Main Feed water regulation valve 

MFW Main Feed Water 

MGL Multiple Greek Letter 

MLOCA Medium Loss of Coolant Accident 

MOC Middle of cycle 

MOV Motor Operated Valve 

MSIV Main Steam Isolation Valve 

MSPI Mitigating Systems Performance Index 

MSSV Main Steam Safety Valves 

MST Main Steam Transient 

NCP Normal Charging Pump 

NDR Nuclear Design Report 

NEI Nuclear Energy Institute 

NPP Nuclear Power Plant 

NPSH Net Positive Suction Head 

NRC U.S. Nuclear Regulatory Commission 

NROED NRC Reactor Operating Experience Data 

NSCW Nuclear Service Water 

NSSS Nuclear Steam Supply System 

NSW Nuclear Service Water 

OBE Operating Basis Earthquake 

OCP Operating Cycle Phase 

OG Owners Group 

OPR Offsite Power recovery 

OTRAN Other Transients 

PCT Peak Clad Temperature 

PDS plant damage state 

PGA Peak Ground Acceleration 

PIF Performance Influencing Factor 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xvii 

PI-SGTR Pressure-Induced Steam Generator Tube Rupture 

PORV Power Operated Relief Valve 

PORVS Power Operated Relief Valve 

POS Plant Operating State 

PPR Primary Pressure Relief 

PRA Probabilistic Risk Assessment 

PRIB Plant information e-Book 

PRZ Pressurizer 

PSA Probabilistic Safety Assessment 

PSAM International Association for Probabilistic Safety Assessment and Management 

PSF Performance Shaping Factor 

PSHA Probabilistic Seismic Hazard Analysis 

PSV, PSVS Pressurizer Safety Valves 

PVC Primary Relief Valves Close 

PWR Pressurized-Water Reactor 

PWROG PWR Owners Group 

PZR Pressurizer 

QA Quality Assurance 

QHO Quantitative Health Objective 

RADS Reliability and Availability Data System 

RAW risk achievement worth 

RCP Reactor Coolant Pump 

RCPSC Reactor Coolant Pump Seal Cooling 

RCPSL Reactor Coolant Pump Seal 

RCPT Reactor Coolant Pump Tripped 

RCPTBCLG RCP Thermal Barrier Cooling 

RCRY Reactor Critical Year 

RCS Reactor Coolant System 

RCY Reactor Calendar Year 

REC Recovery 

RECIRC Recirculation 

RELAP Reactor Excursion and Leak Analysis Program 

RES Restore 

RG Regulatory Guide 

RHR Residual Heat Removal 

RIDM risk-informed decisionmaking 

RMWST Reactor Makeup Water Storage Tank 

ROP Reactor Oversight Process 

RPS Reactor Protection System 

RPT Piping Rupture 

RPV Reactor Pressure Vessel 

RPVRM Reactor Pressure Vessel Rupture 

RSD Rapid Secondary Depressurization 

RSP Remote Shutdown Panel 

RSUB reactor coolant sub cooling 

RTRIP Reactor Trip 

RWST Refueling Water Storage Tank 

RY Reactor Year 

SA Systems Analysis 

SACRG Severe Accident Control Room Guideline 

SAEG Severe Accident Exit Guideline 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xviii 

SAG Severe Accident Guideline (subpart of the SAMGs) 

SAMG Severe Accident Management Guideline 

SAPHIRE Systems Analysis Programs for Hands-on Integrated Reliability Evaluations 

SAR Safety Analysis Report 

SBO Station Black Out 

SCG Severe Challenge Guideline 

SCST Severe Challenge Status Tree 

SDC Shut Down Cooling 

SDP Significance Determination Process 

SDS Shutdown Seal Actuation 

SEL Seismic Equipment List 

SER Safety Evaluation Report 

SERF Small Early Release Frequency 

SFGCHG Safety Grade Charging 

SFP Spent Fuel Pool 

SGI Steam Generator Isolation 

SGTR Steam Generator Tube Rupture 

SINJ Safety Injection 

SIP Safety Injection Pump 

SLOCA Small Loss Of Coolant Accident 

SM Seismic Margin 

SNC Southern Nuclear Operating Company 

SOARCA State-of-the-Art Reactor Consequence Analyses 

SOKC State Of Knowledge Correlation 

SPAR Standardized Plant Analysis Risk 

SR supporting requirement 

SRA Senior Reactor Analyst 

SRT Seismic Review Team 

SRV Safety Relief Valves 

SS Shift Supervisor 

SSB Secondary Side Break 

SSBI Secondary side break upstream MSIVs/downstream MFIVs 

SSBO Secondary side break downstream MSIVs/upstream MFIVs 

SSC Secondary Side Cool down 

SSC Structures, Systems and Components 

SSCR Recovery of Secondary Cooling 

SSE Safe Shutdown Earthquake 

SSEL Safe Shutdown Equipment List 

SSHAC Senior Seismic Hazard Analysis Committee 

SSI Soil-Structure Interaction 

SSI Single Source Initiator 

SSU Reactor Oversight Process Safety System Unavailability data 

ST Source Term 

STA Shift Technical Advisor 

SVC Secondary Relief Valves Close 

SW Service Water 

SWS service water system 

TBV Turbine bypass valves 

TDAFW Turbine-Driven Auxiliary Feed Water Pump 

TDAFWP Turbine Driven Auxiliary Feed water pump 

TDP Turbine Driven pump 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b 

xix 

TECHSPEC Technical Specification 

TEMP Temperature 

TI-SGTR Thermally-induced Steam Generator Tube Rupture 

TPCCW Turbine Plant Closed Cooling Water 

TPCW Turbine Plant Cooling Water 

TRACE TRAC/RELAP5 Advanced Computational Engine 

TRANS Transient 

TSC Technical Support Center 

TSI Technical Specification 

TSI Termination of safety injection 

TTRIP Turbine Trip 

UET Unfavorable exposure time 

UHS Uniform Hazard Response Spectrum 

UW Utility Water 

VAC Volts Alternating Current 

VCT Volume Control Tank 

VDC Volts Direct Current 

VEGP Vogtle Electric Generating Plant 

WCAP Westinghouse Commercial Atomic Power 

WOG Westinghouse Owner Group 

XLOCA Reactor Pressure Vessel Rupture 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-1 

1. Introduction 

1.1 Background

In response to the Commission direction in the staff requirements memorandum (SRM) 

(Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) 

resulting from SECY-11-0089, “Options for Proceeding with Future Level 3 Probabilistic Risk 

Assessment (PRA) Activities” (ADAMS Accession No. ML11090A039), the staff is conducting a 

full-scope site Level 3 Probabilistic Risk Assessment (PRA). As described in SECY-11-0089, 

this project will meet the following objectives: 

• Develop a Level 3 PRA, generally based on current state-of-practice methods, tools, and 

data,1

 that (1) reflects technical advances since the last NRC-sponsored Level 3 PRAs 

(NUREG-11502

), which were completed over 20 years ago, and (2) addresses scope 

considerations that were not previously considered (e.g., low power/shutdown (LPSD), 

multi-unit risk, other radiological sources). 

• Extract new insights to enhance regulatory decisionmaking and to help focus limited 

U.S. Nuclear Regulatory Commission (NRC) resources on issues most directly related to 

the agency’s mission to protect public health and safety. 

• Enhance PRA staff capability and expertise, and improve documentation practices to 

make PRA information more accessible, retrievable, and understandable. 

• Demonstrate technical feasibility and evaluate the realistic cost of developing new 

Level 3 PRAs. 

The scope of the Level 3 PRA study includes all major site radiological sources,3

 all internal and 

external initiating event hazards typically considered in previous internal and external event 

PRAs,4

 and all modes of plant operation. This scope exceeds that of the NUREG-1150 studies 

in a number of areas. In particular, as described in SECY-11-0089, the NUREG-1150 studies 

did not include an assessment of accidents involving other radiological sources such as spent 

fuel pools, dry storage casks, and other units on site. Also, the NUREG-1150 studies only 

addressed at-power operation (though subsequent studies for two of the NUREG-1150 plants 

involved a limited analysis of low power and shutdown modes of operation) and only partially 

addressed external hazards. 

The current Level 3 PRA study will also incorporate advances made in PRA technology since 

the completion of the NUREG-1150 studies, as well as more recent changes in nuclear power 

plant operational performance and safety. 

 

1

 “State-of-practice” methods, tools, and data refer to those that are routinely used by the NRC and licensees or have acceptance in 

the PRA technical community. 

2

 NUREG-1150, “Severe Accident Risk: An Assessment for Five U.S. Nuclear Power Plants,” December 1990. 3

 Including all reactor cores, spent fuel pools, and dry storage casks on site, but excluding fresh nuclear fuel, 

radiological waste, and minor radiological sources (e.g., calibration devices). 4 Deliberate malevolent acts (e.g., terrorism and sabotage) are specifically excluded from the scope of the study.
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-2 

The staff intends to obtain a peer review of the study, consistent with the American Society of 

Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA standard.5

1.2 Objectives

The objective of this plan is to provide the guidance to be used in performing the full-scope site 

Level 3 PRA. Developing guidance to define and explain the approach to be used will provide a 

common understanding by the various analysts performing the study, and ensure greater 

consistency in the development of the PRA models. The guidance is consistent with current 

best practices, as defined in both national consensus standards and other regulatory and 

industry guidance documents. Moreover, this guidance can be used to establish the review 

criteria for ensuring the technical acceptability of the full-scope site Level 3 PRA model. 

1.3 Scope 

The scope of this guide covers all technical elements associated with the full-scope site Level 3 

PRA, as described in Section 1.1. There are a number of major components that comprise the 

scope of a PRA, as illustrated in Figure 1-1 and discussed below. 

• A PRA can be used to quantify the associated risk from a variety of sources at the plant 

site. These sources can include the reactor core (or cores), the spent fuel pool, and dry 

cask storage. For this PRA, all of these sources of risk are being evaluated. 

• A PRA can be used to quantify either the on-site or off-site consequences, or both. For 

this PRA, the primary focus is on the off-site consequences. 

• A PRA can be used to quantify the risk from the reactor while the reactor is at-power, in 

a low-power or shutdown condition, or for all operating states. For this PRA, the risk 

during all operating states is being evaluated. 

• A PRA can used to quantify the risk presented by challenges from (1) internal hazards, 

which include internal events, internal floods, and internal fires; (2) external hazards, 

which include seismic events, external floods, external fires, and high winds; or (3) other 

hazards, which can include transportation, aircraft, or others. For this PRA, all hazards 

are being evaluated. 

 

 

5

 ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power 

Plant Applications,” Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, 

February 2009. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-3 

Figure 1-1 Components Comprising a PRA 

• The PRA can quantify different levels of risk. The quantified risk can include the 

frequency of fuel damage (e.g., core damage for reactors), referred to as Level 1; the 

frequency of radionuclide releases to the environment and characterization of the 

radiological source terms, referred to as Level 2; or the estimation of various radiological 

health effects and economic consequence measures, referred to as Level 3. For this 

PRA, a Level 1, 2, and 3 analysis is being performed. 

As noted above, various risk metrics are being quantified. The set of risk metrics provided will 

depend on the state-of-practice of the MACCS2 code, which is used to compute the risk and is 

currently undergoing modification. A tentative list of risk metrics that will be provided includes 

the following: 

• Total early fatality risk 

• Total latent cancer fatality risk 

• Individual early fatality risk, as defined in the Quantitative Health Objectives (QHOs) 6

• Individual latent cancer fatality risk, as defined in the QHOs 

 

6

 51 FR 30028, “Safety Goals for the Operations of Nuclear Power Plants,” August 21, 1986. 

Reactor 

Core 

Spent Fuel 

Pool 

Dry Cask 

Storage 

Identify and select the 

potential source of risk 

to be analyzed 

At-Power Low Power Shutdown 

Identify and select the 

reactor operating 

states under which the 

risk occurs 

Identify and select the 

potential hazards that 

can challenge the site 

and cause the risk 

Internal events, 

internal floods, 

internal fires 

Seismic events, 

external floods, 

external fires, high 

winds

Transportation, 

aircraft, others 

Identify and select 

consequences to be 

considered 

Off-site 

Consequences 

On-site 

Consequences 

Identify and select the 

potential risk to be 

analyzed 

Level 1 

(fuel damage 

frequency) 

Level 2 

(radionuclide 

release frequency) 

Level 3 

(consequence 

analysis) 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-4 

• Population dose (person-rem) at various locations 

• Off-site economic costs 

• Individual early injury risk 

• Individual cancer incident risk 

• Land contamination 

In addition to the consequence measures identified above, reactor core damage frequency 

(CDF) and large early release frequency (LERF) will be computed in intermediate steps, since 

these measures (which are Commission-approved surrogate metrics for individual latent cancer 

fatality risk and early fatality risk, respectively) are consistent with current risk-informed 

regulatory programs and applications (e.g., the significance determination process used to 

support the reactor oversight process, and risk-informed license amendment submittals). 

In regard to the risk metric pertaining to off-site economic costs, as stated in SECY-11-0089, the 

staff previously considered developing additional safety goals based on the risk of land 

contamination and overall societal impact, but, based on the need at that time for up-to-date 

tools to better understand the extent of land contamination and societal impact, the staff 

recommended that this effort not be pursued.7

 However, due to the improvement in existing 

analytical tools (e.g., MACCS2),8

 it is currently envisioned that the Level 3 PRA study will 

estimate off-site economic costs from emergency response actions, and from intermediate- and 

long-term protective actions. 

Figure 1-1 and the above discussion illustrate the scope for a risk evaluation by different 

sources; however, the risk for this Level 3 PRA is being evaluated for the entire site. Therefore, 

the scope being evaluated for this study is an integration of all site risk contributors. 

1.4 Assumptions and Limitations

Some key limitations and assumptions for this PRA include the following: 

• The plant is operating within its regulatory requirements. 

• The design, construction, and operation of the plant are adequate and satisfy the plant’s 

established design, construction, and operation criteria. 

• Plant aging effects are not modeled; that is, constant equipment failure rates are 

assumed. 

The Level 3 PRA study is intended to be as complete and realistic as is practical; however, the 

scope and level of realism will be balanced against resource and schedule limitations. 

Therefore, not all aspects of the study will necessarily receive the same level of analytical rigor, 

which will be a function of their relative risk significance. In addition, examples of some PRA 

technical elements that will not be addressed in the current study, but which are good 

candidates for further research to advance the state-of-the-art, include: 

• Aqueous transport and dispersion of radioactive materials 

 

7

 SECY-00-0077, “Modifications to the Reactor Safety Goal Policy Statement,” March 30, 2000. 8

 SECY-12-0110, “Consideration of Economic Consequences within the U.S. Nuclear Regulatory Commission’s Regulatory 

Framework,” August 14, 2012. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-5 

• Effects of aging on structure, system, and component reliability 

• Consequential (linked) multiple initiating events for a single unit (e.g., seismically 

induced fires and floods) 

• Digital instrumentation and control, including software 

As indicated earlier, the staff intends to use the currently available suite of PRA standards (e.g., 

the ASME/ANS PRA standard) and other NRC and industry guidance documents to guide many 

of the technical aspects of this study. 

1.5 Project Team Organization 

The project organization is shown in Figures1-2 and 1-3a thru 1-3g. Figure 1-2 shows the 

overall organization, including both the administrative and technical functions of the project. 

Figure 1-3a thru 1-3g shows the breakdown of the technical functions of the project. In addition, 

it notes that the project is supported by multiple divisions. 

At the top is the Project Management Team, comprised of the cognizant RES Branch Chief 

(RES/DRA/PRAB), program manager, and principal technical advisor. The administrative 

functions reporting to the Project Management Team include: 

• The Technical Advisory Group (TAG) Chair – The TAG serves as a major element in 

reviewing the work and addressing technical challenges. 

• Peer Review Coordinator –independent peer reviews will be performed on the technical 

work during the project; this person will be responsible for orchestrating these peer 

reviews. 

• Project Coordinator/Contract Manager – this person provides the administrative support 

and coordinates the various contracts for the commercial and Department of Energy 

(DOE) laboratory contractors being used on the project. 

• Documentation Coordinator – This person handles all the documentation flow of the 

project (e.g., documentation between Southern Nuclear Operating Company [SNC] and 

NRC). 

• Communication Team Leader/TAG Coordinator – This person oversees all internal and 

external communications and serves as the liaison between the TAG and the project. 

• Report Coordinator – This person is responsible for developing the report structure on 

how the results and information of the PRA will be reported. 

The technical functions reporting to the Project Management Team are the various scope items 

of the full-scope PRA model structure. Each of these scope items has a technical lead who is 

responsible for development of that PRA model. These items include: 

• Reactor, at-power, internal hazards PRA model 

• Reactor, at-power, external hazards PRA model 

• Reactor, low power and shutdown, internal and external hazards PRA model 

• Reactor all modes, all hazards PRA model 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-6 

• Spent Fuel Pool PRA model 

• Dry Cask Storage PRA model 

• Integrated Site Risk PRA model 

The above items are further divided into their respective technical elements and functions, each 

of which has a technical lead. This division is shown in Figures 1-3a through 1-3g. 

 

Le

ve

l 2 

PR

Integ

rated

Site 

Rx atpowe

r, int. 

hazar

ds

Rx atpowe

r, ext. 

hazar

ds 

Rx 

LPSD, 

int./e

xt. 

hazar

d

Rx all 

mode

s, all 

hazar

ds

Rx 

Le

ve

l 1 

PR

Le

ve

l 3 

PR

A

Spent 

Fuel 

Pool 

PRA

Dry 

Cask 

Stora

ge

RES

/DR

A, 

RES

/DE, 

RES

/DS

A, 

NSI

R/D

PR

Pr

og

ra

m 

M

an Commu

nication 

Team 

Lead/TA

G 

C di

Project 

Coordin

ator/ 

Contract 

Manage

Princi

pal 

Tech

nical 

Advis

Peer 

Revie

w 

Coor

di

React

or 

Oper

ation

s 

Supp

Tech

nical 

Advis

ory 

Grou

Adva

nced 

Docu

ment

ation

Docu

ment

ation 

Coor

dinat

Repo

rt 

Coor

dinat

R

E

S/

D

R

A

PR

AB 

Ch

ief

Le

ve

l 3 

P

R

A 

M

an

ag

e

m

en

Fig

ure 

1-2 

Ov

era

ll 

Pro

ject 

Org

ani

zati

on 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-7 

 

Da

ta 

An

al

ysi sHum

an 

Re

l. 

An

al

ysi s

Syste

ms 

Analy

sis

Succe

ss 

Criter

ia 

(T/H 

Analy

sis)

** Unce

rtaint

y 

Analy

sis

Rx 

Level 

1 PRA 

 (atpowe

r)

Initia

ting 

Event 

Analy

sis

Accid

ent 

Sequ

ence 

Analy

sis

Quan

tificat

ionA

nalysi s

Fragil

ity 

Analy

sis

Hazar

d 

Analy

sis

Fragil

ity 

Analy

sis

Hazar

d 

Analy

sis

Fragil

ity 

Analy

sis

Hazar

d 

Analy

sis

Int 

Fld 

Plant 

Resp

onse 

Mod

el

Int 

Fire 

Plant 

Resp

onse 

Mod

el

Notes:

*The internal 

events model 

provides the 

basic model 

which is then 

modified for the 

other POSs and 

hazards; only 

those tasks 

unique from the 

internal events 

model are 

shown.

**These are subtasks that 

support virtually 

all the PRA 

hazards and are 

not repeated for 

each hazard.

Scree

ning 

Analy

sis

Da

m 

fai

lur

es

Fir

e 

Ta

sks

Se

is

mi

c*

Int

er

na

l 

Fir

es*

Ot

he

r 

Ha

za

rd

s*

Int

er

na

l 

Fl

oo

ds*

Ex

t. 

Fl

oo

ds 

& 

Hi

gh 

Wi

nd

s*

In

tern

al H

az

ardsE

xt

ern

al H

az

ards

Int

er

na

l 

Ev

en

ts

Fig

ure 

1-

3a 

Re

act

or 

Lev

el 1 

AtPo

we

r 

PR

A 

Fu

nct

ion

s 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-8 

 

Fig

ure 

1-

3b 

Re

act

or 

Lev

el 1 

LPS

D 

PR

A 

Fu

nct

ion

s 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-9 

 

Rx 

Level 

2 

PRA 

 (all 

mode

s/haz

ards)

Level 

1/Lev

el 2 

Interf

ace

Level 3 

PRA 

 (health 

and 

economi

c 

effects)

Plant 

Mod

el

(Data 

Gath

ering

)

Quan

tificat

ion

Analy

sis

Int

er

fa

ce

Da

ta 

An

al

ysi

s

H

u

m

an 

Re

l 

An

al

Succe

ss 

Criter

ia 

(T/H 

Analy

sis)

Str

uc

tu

ral 

An

al

ysi

s

Unce

rtaint

y 

Analy

sis

Unce

rtaint

y 

Analy

sis

Sever

e 

Accid

ent 

and 

Sourc

e 

Term 

Evalu

ation

Level 

2 

Logic 

Mod

eling

Rx 

Level 

2/Lev

el 3 

Interf

ace

Spent 

Fuel 

Pool 

Interf

ace

Dry 

Cask 

Stora

ge 

Interf

ace

Syste

ms 

Analy

sis

Fig

ure 

1-

3c 

Re

act

or 

Lev

el 2 

PR

A 

Fu

nct

ion

s 

Fig

ure 

1-

3d 

Re

act

or 

Lev

el 3 

PR

A 

Fu

nct

ion

s 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-10 

 

Initia

ting 

Event 

Analy

sis

Quan

tificat

ionA

nalysi

s

Initia

ting 

Event 

Analy

sis

Quan

tificat

ionA

nalysi

s

Da

ta 

An

al

ysi

s

H

u

m

an 

Re

l 

An

al

Succe

ss 

Criter

ia 

(T/H 

Analy

sis)

Str

uc

tu

ral 

An

al

ysi

s

Unce

rtaint

y 

Analy

sis

Da

ta 

An

al

ysi

s

H

u

m

an 

Re

l 

An

al

Succe

ss 

Criter

ia 

(T/H 

Analy

sis)

Str

uc

tu

ral 

An

al

ysi

s

Unce

rtaint

y 

Analy

sis

Sp

en

t 

Fu

el 

Po

ol 

PR

A

Dr

y 

Ca

sk 

St

or

ag

e 

PR

A

Accident 

Sequenc

e 

Progressi

on and 

Source 

Term 

Analysis

Accident 

Sequenc

e 

Progressi

on and 

Source 

Term 

Analysis

Syste

ms 

Analy

sis

Syste

ms 

Analy

sis

Fig

ure 

1-

3e 

Spe

nt 

Fue

l 

Po

ol 

PR

A 

Fu

nct

ion

s 

Fig

ure 

1-

3f 

Dry 

Cas

k 

Sto

rag

e 

PR

A 

Fu

nct

ion

s 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

1-11 

Integrated Risk 

 (all sources/ 

modes/hazards)

Human Rel 

Analysis

Uncertainty 

Analysis

Multi Unit 

Effect Analysis

Site PRA 

Integration

Figure 1-3g Integrated Site Risk PRA Functions 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-1 

2. Approach 

2.1 Project Organization

This project evaluates the risk from different sources, different hazards, and different reactor 

operating modes. Given the broad scope of this project, there are several options for how to 

develop the overall probabilistic risk assessment (PRA) model. For example: 

• The model can be developed by first developing the Level 1 part of the PRA model for all 

risk sources, plant operating states, and hazards, and then developing the Level 2 part, 

and then the Level 3 (see Figure 2-1). 

• The model can be developed by first developing a complete Level 1, 2, and 3 PRA for a 

specified risk source, plant operating state, and hazard, and then developing the Level 1, 

2, and 3 PRA for the remaining risk sources, plant operating states, and hazards (see 

Figure 2-2). 

In order to minimize the time needed to obtain Level 3 PRA risk results, the latter approach 

above is adopted for this project. As such, a complete Level 3 PRA model (i.e., a combined 

Level 1, Level 2, and Level 3 PRA model) is initially developed for the reactor, addressing 

internal hazards for at-power conditions (discussed in Section 12 of this report). Once this 

Level 3 PRA model is completed, it is then modified and expanded to address external hazards, 

(discussed in Section 13). The model is then modified and expanded to address low 

power/shutdown (LPSD) conditions (discussed in Section 14). In parallel and subsequent to 

developing the reactor PRA models, the complete Level 3 PRA models for the spent fuel pools 

and dry cask storage are developed (discussed in Sections 15 and 16, respectively). Finally, 

after completing the Level 3 PRA models for all of the risk sources, the PRA model for the 

integrated site risk is developed. While this approach results in the need to exercise the Level 2 

and Level 3 parts of the model more often, partial Level 3 insights and results are available 

earlier in the project, and lessons learned can be fed back into the development of the other 

scope pieces. 

Using the above approach, the project is organized into the following stages: 

Stage 1: Quantification of the reactor, at-power for internal hazards Level 3 PRA 

Stage 2: Quantification of the reactor, at-power for external and other hazards Level 3 

PRA 

Stage 3: Quantification of the reactor, low-power and shutdown for all hazards Level 3 

PRA 

Stage 4: Quantification of the reactor for all plant states and all hazards Level 3 PRA 

Stage 5: Quantification of the spent fuel pool Level 3 PRA 

Stage 6: Quantification of the dry cask storage Level 3 PRA 

Stage 7: Quantification of the site risk (i.e., integration of the Level 3 PRA for both 

reactors, the spent fuel pools, and dry cask storage) 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-2 

With this structure, Level 3 PRA risk results will be available at Stage 1, without having to 

wait for the completion of Stage 7. 

Figure 2-1 Risk Level Approach to Integrated Site PRA 

Figure 2-2 Scope Level Approach to Integrated Site PRA 

Spent Fuel 

Pool Level 

1-2,3PRA

Dry Cask 

Storage Level 

1-2,3PRA

Integrated 

Risk

(Section 

Reactor atpower, 

internal 

hazards Level 

1,2,3 PRA

Reactor atpower, external 

hazards Level 

1,2,3 PRA

Reactor 

LPSD, all 

hazards 

Level 1,2,3 

PRA

Reactor all 

modes, all 

hazards 

Spent Fuel 

Pool 

Level 3 

Dry Cask 

Storage 

Level 3 

Integrated 

Risk

Level 3 

Reactor atpower, 

internal 

hazards 

Reactor atpower, 

external 

hazards Level 

Reactor LPSD, 

all hazards 

Level 1 PRA

Reactor all 

modes, all 

hazards 

Level 1 

Reactor all 

modes, all 

hazards 

Level 2 

Reactor all 

modes, all 

hazards 

Level 3 

Spent Fuel 

Pool 

Level 1-2 

Dry Cask 

Storage 

Level 1-2 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-3 

2.2 Overall Approach

Performance of the full-scope site Level 3 PRA study involves an extensive number of technical 

tasks, and, consequently, the need to obtain or develop numerous models and substantial data. 

The level of effort to accomplish this work is a function of the amount of information and models 

already available at the U.S. Nuclear Regulatory Commission (NRC) for the volunteer site and 

the amount that is obtainable from the licensee. For example: 

• The staff has a Standardized Plant Analysis Risk (SPAR) model for internal events for all 

operating nuclear power plants. SPAR models are in-house PRA models that NRC staff 

use to support various risk-informed activities. Additional existing information, however, 

may include an expanded SPAR model that addresses internal fires, external hazards, 

and/or plant shutdown conditions. 

• A PRA developed by the licensee that covers internal events, internal flooding, and, 

possibly, external hazards. 

• A fire PRA developed by the licensee to support transition to NFPA 805. 

• A Severe Accident Mitigation Alternatives analysis as part of a license renewal 

application. 

• An updated seismic hazards analysis as part of a Combined License application, a 

complete or partial MELCOR input deck, and State-of-the-Art Reactor Consequence 

Analyses (SOARCA) project analyses. 

The Level 3 PRA project team will leverage the existing and available information on the 

volunteer site (i.e., Vogtle), in addition to related research efforts (e.g., SPAR external event 

modeling, NFPA 805 research, and generic issue evaluations), to enhance the efficiency of the 

study. The staff will inventory the NRC’s information on the volunteer site through consultation 

with the cognizant staff in the PRA organizations of all NRC Offices, as well as in Offices and 

Divisions responsible for related technical areas (e.g., seismic events, fire protection, and 

emergency preparedness) and the Office of Nuclear Reactor Regulation’s Division of Operating 

Reactor Licensing (NRR/DORL) plant project manager. 

Correspondingly, initial interactions with the volunteer licensee will focus on determining what 

relevant information is currently available at the site or at licensee offices. 

A technical advisory group (TAG) will be used for the Level 3 PRA project, and will consist of 

senior technical staff in the area of PRA, and in supporting technical areas (e.g., seismic hazard 

and plant response), as well as an experienced PRA representative from the Electric Power 

Research Institute (EPRI). The TAG will meet periodically to: (1) review progress in the 

development of the Level 3 PRA and (2) provide insight, advice, and guidance on the technical 

bases, tools, methods, models, and data for the project, as well as on interpretation of the study 

results and on responding to comments received from the external peer reviews of the study. 

This section describes, at a high level, the technical approach to be followed for the full-scope 

site Level 3 PRA study. A more detailed project plan will be developed after the team assesses 

the extent of information and models currently available for the volunteer site, and identifies the 

scope and nature of the technical work to complete the study. The following subsections 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-4 

address the technical approach philosophy, proposed tools and models, and key challenges 

and gaps in PRA technology. 

2.2.1 Technical Approach Philosophy

Consistent with the objectives of this project, the Level 3 PRA study will generally be based on 

current state-of-practice methods, tools, and data. As previously stated, “state-of-practice” 

methods, tools, and data refer to those that are routinely used by the NRC and by licensees 

and/or have acceptance in the PRA technical community, including regulatory acceptance. 

As discussed in SECY-11-0089, the staff performed a scoping study to support the planning and 

implementation of future Level 3 PRA activities. One of the objectives of the scoping study was 

to provide insight into the PRA technology to be used for various options for proceeding with 

future Level 3 PRA activities. To accomplish the objectives of the scoping study, several 

technical working groups, comprising staff from the NRC’s Office of Nuclear Regulatory 

Research (RES), Office of Nuclear Material Safety and Safeguards (NMSS), Office of New 

Reactors (NRO), Office of Nuclear Security and Incident Response (NSIR), and NRR were 

established to address specific Level 3 PRA technical elements that were viewed as particularly 

complex and challenging. 

The state-of-practice methods to be used will be determined by the leaders of each principal 

technical element of the study in consultation with project leadership, and will consider: 

• ASME/ANS PRA standards 

• Results of earlier scoping study (documented in SECY-11-0089) 

• Interactions with NRC experts in each technical area 

• Input from the TAG 

2.2.2 Proposed Tools and Models

The staff envisions the use of the following NRC tools and models in performing the Level 3 

PRA study: 

• Systems Analysis Programs for Hands-on Integrated Reliability Evaluation (SAPHIRE), 

Version 8 

• MELCOR Severe Accident Analysis Code 

• MELCOR Accident Consequence Code System, Version 2 (MACCS2) 

• Vogtle Units 1 and 2 SPAR model, Version 8.15 

SAPHIRE is the NRC’s standard software application for performing PRAs. SAPHIRE 8 has an 

increased capability for handling large, complex modes, and can be used to analyze both 

internal and external hazards and all plant operating states. 

MELCOR is a fully integrated, engineering-level computer code whose primary purpose is to 

model the progression of postulated accidents in both light water reactors and non-reactor 

systems, such as spent fuel pools and dry storage casks. The MELCOR code is routinely used 

to perform thermal-hydraulic analysis to determine system success criteria and accident 

sequence timing, and to inform severe accident progression analysis. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-5 

MACCS2 is a general-purpose tool used to evaluate the public health effects and economic 

costs of mitigation actions for severe accidents at diverse reactor and non-reactor facilities. The 

principal phenomena considered are atmospheric transport and deposition under time-variant 

meteorology, short- and long-term mitigation actions and exposure pathways, deterministic and 

stochastic health effects, and economic costs. 

The MELCOR and MACCS2 codes were used in performing the SOARCA project. The 

SOARCA project involved significant advances in the state-of-the-art accident progression and 

consequence modeling in MELCOR and MACCS2, respectively. The Level 3 PRA study will 

take advantage of the modeling advances that occurred as part of the SOARCA project, as well 

as other current and recent research related to these two codes. 

The consequence modeling for the Level 3 PRA study will include consideration of emergency 

preparedness (EP) response and population movement. To facilitate EP modeling, the 

WINMACCS code will be used as an interface with MACCS2. WINMACCS is also being 

upgraded based on experience with SOARCA. 

As mentioned previously, SPAR models are in-house PRA models that NRC staff use to support 

various risk-informed activities. The Level 1 PRA SPAR models address the likelihood of 

reactor core damage resulting from general transients (including anticipated transients without 

scram), transients induced by loss of a vital alternating current or direct current bus, transients 

induced by a loss of cooling (service) water, loss-of-coolant accidents, and loss of offsite power. 

The SPAR models use a standard set of event trees for each plant design class and 

standardized input data for initiating event frequencies, equipment performance, and human 

performance, although these input data may be modified, when necessary, to be more plantspecific. The system fault trees contained in SPAR models are generally not as detailed as 

those contained in Licensees’ PRA models. As part of the Level 3 PRA study, the set of Vogtle 

SPAR model event trees and fault trees will be expanded, as appropriate.9

 Besides the 

technical capabilities of these NRC tools, they offer several advantages: they are generally 

available, the staff is familiar with their use, and, if necessary, the staff has the ability to modify 

these tools. This latter advantage may be of particular importance in addressing such 

expanded scope items as multi-unit risk, spent fuel pools, and dry storage casks. One particular 

advantage to using a SPAR model as the starting point of the Level 3 PRA study is that the staff 

is familiar with these models and how to modify them, and can leverage the previous effort to 

develop the model for the volunteer site. 

2.2.3 Key Challenges and Gaps in PRA Technology

As discussed previously in the section on project assumptions and limitations (Section 1.4), 

there are a number of gaps in current PRA technology that will not be addressed in the current 

study, but which are good candidates for further research to advance the state-of-the-art. 

However, there are several other gaps in PRA technology and other challenges that will need to 

be addressed, to the extent practical, in the Level 3 PRA study. The greatest challenges for the 

Level 3 PRA study are posed by the current limits in the modeling of multi-unit site risk (as 

opposed to single-unit risk), in spent fuel PRA technology (i.e., for spent fuel pools and dry 

storage casks), and in human reliability analysis (HRA) for anything other than internal events 

and internal fires. These challenges are briefly discussed below. The general approach to 

 

9

 While the Level 3 PRA study will use the existing Vogtle SPAR model as the starting point for the Level 1 internal 

events analysis, the PRA developed as part of this study will be a separate and distinct model. The existing Vogtle 

SPAR model will continue to be used for risk-informed regulatory activities. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-6 

addressing these challenges for the Level 3 PRA study will rely primarily on existing research 

and the collective expertise of the TAG and contractors, as well as limited new research in a few 

specific technical areas (e.g., multi-unit risk). Specific research activities, either past or current, 

that are expected to contribute to the resolution of these challenges are identified in the 

following discussions. 

2.2.3.1 Modeling of Site Risk 

In order to evaluate the risk of the entire nuclear power plant (NPP) multi-unit site, the study 

needs to address all site radiological sources. Most PRAs developed to date do not explicitly 

consider multi-unit accidents in which initiating events lead to reactor core damage in multiple 

units at the same site. Current PRA models therefore do not appropriately identify and address 

dependencies between systems at multi-unit sites, particularly those with highly complex 

support system dependencies involving systems and subsystems that are shared by multiple 

units. Such dependencies are also not addressed, as they pertain to spent fuel pools and dry 

storage casks. 

To understand the contribution of these multi-unit and non-reactor effects to the overall site risk, 

PRA models need to be enhanced to address the following: 

• Initiating events common to multiple reactors and/or spent fuel pools and dry casks 

• Common or dependent equipment and operator actions between multiple reactors 

and/or spent fuel pools and dry casks 

• Shared stacks, ventilation systems, or other pathways for combustible gases 

• Effects of core damage, radiological release, and mitigation actions on operator 

response (including control room habitability) 

• Integrated models for all site radiological sources, including consideration of model endstates, risk metrics, and mission times 

• Integrated uncertainty analysis for overall site risk 

2.2.3.2 Spent Fuel PRA Technology 

Process areas not related to reactor core operations, but that can contribute to nuclear site 

accident risk, include those associated with on-site nuclear spent fuel handling and storage. 

Principal risk-related studies that have previously been performed in these areas include a study 

of the spent fuel pool accident risk at decommissioning nuclear power plants (NUREG-1738), 

the dry cask storage PRA (NUREG-1864), the Electric Power Research Institute (EPRI) PRA of 

bolted storage casks (EPRI TR-100969123), and the NMSS dry cask storage and transportation 

security assessments. 

Although tools exist to address the risk of accidents involving spent fuel pools and dry cask 

storage, they have not been broadly used. Substantial effort will likely be required to address 

some aspects of spent fuel PRA (e.g., modeling interaction between the spent fuel pool and the 

reactor during refueling). Additional work will also likely be required in the areas of success 

criteria determination, HRA, accident phenomena, and source term analysis. Some of these 

areas are expected to be addressed to some degree as part of the current RES spent fuel pool 

scoping study. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-7 

2.2.3.3 Human Reliability Analysis 

There are several state-of-practice HRA methods for addressing operator performance in 

Level 1 internal events PRA10 and internal fire PRA.11 RES is also currently developing an 

improved HRA approach in response to SRM-M061020,12 and aspects of this new approach will 

be used whenever available, consistent with the schedule for the Level 3 PRA project. 

However, state-of-practice methods do not currently exist for post-core damage and external 

hazards, or when the reactor is at low power or shut down. Therefore, these areas will require 

further investigation. Current NRC research into a single model for human reliability13 may be 

helpful, depending on the schedule for completing the research vis-à-vis the schedule for 

completing the Level 3 PRA study. 

2.2.3.4 Additional Modeling Issues 

There are several other technical elements of this study that may present a challenge, or that 

may not have a single consensus state of practice, which would require the team to choose, 

improve, or develop a specific approach. These include: 

• Level 2 and Level 3 PRA uncertainty analysis 

• Integration of support system initiating event models 

• Conditional steam generator tube rupture 

• Reactor coolant pump seal loss-of-coolant accident (LOCA) model 

• Common-cause failure (CCF) modeling and data 

• Complete electric cable raceway database 

• Seismic fragilities 

• Frequency of external flooding 

• Operational data for low power and shutdown plant operating states 

• Severe accident progression modeling 

• Mission time (for severe accident progression, consequence analysis, and non-reactor 

radiological sources) 

Current research and other activities are already addressing some of these aspects. For 

example, under a Memorandum of Understanding (MOU), RES and EPRI are currently 

developing an approach to integrate support system initiating event models into a PRA. Recent 

research has investigated the risk significance of steam generator tube rupture occurring 

subsequent to core damage. Those licensees choosing to comply with NFPA-805 need to 

compile electric cable raceway databases, and some licensees (e.g., Vogtle) that have not 

elected to follow NFPA-805 may still have compiled full or partial databases as part of other fire 

PRA or Appendix-R-related efforts. Severe accident progression modeling has been, or is 

being, addressed through a number of NRC research projects (e.g., SOARCA, the SPAR 

Integrated Capabilities Modeling project, and the Advanced Level 2 PRA project). The 

 

10 NUREG-1842, “Evaluation of Human Reliability Analysis Methods Against Good Practices,” U.S. Nuclear Regulatory Commission, 

Washington, D.C., September 2006. 

11 NUREG-1921/EPRI 1019196, “EPRI/NRC-RES Fire Human Reliability Analysis Guidelines,” Draft Document for Public Comment, 

U.S. Nuclear Regulatory Commission, Washington, D.C., July 2009. 

12 Response to SRM-M061020, “Meeting with the Advisory Committee on Reactor Safeguards, 2:30 p.m., Friday, October 20, 2006, 

Commissioners’ Conference Room, One White Flint North, Rockville, Maryland (Open to Public Attendance),” dated November 8, 

2006. 

13 SRM M061020, “Staff Requirements - Meeting with Advisory Committee on Reactor Safeguards,” dated November 8, 2006 

(ADAMS Accession No ML063120582). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

2-8 

SOARCA uncertainty analysis is also underway, and should help to inform the approach for 

integrating uncertainties into the Level 3 PRA study. 

2.3 Approach Summary

A detailed discussion of the approach (i.e., guidance) is provided in the following sections. For 

each “part” of the PRA, analytical tasks are identified. For each analytical task, the following 

information is provided: 

• The associated high-level objectives of each task and subtask, and technical steps 

• Each major assumption and limitation that bounds/defines the scope and level of detail 

of the task 

• The inputs needed for each individual task 

• The various technical steps to be performed for each individual task 

• The documentation requirements for each individual task 

• The various technical elements that interface with each technical element 

• A list of references that can and should be used in performing the work 

2.4 Quality Assurance

The objective of quality assurance is to ensure that both the technical approach (methods, tools, 

and data) is acceptable and that implementation (i.e., actual construction of the PRA model) 

was performed in an acceptable manner. The PRA model will be developed based on 

established methods, tools, and data, as documented in, for example, consensus standards and 

guidance documents. For each technical element, an approach will be established, as 

documented in the subsequent sections of this report. As described in Section 18, the work for 

each of the technical elements will be subjected to four different types of technical review: the 

TAG, project self-assessment, independent peer review, and the Advisory Committee on 

Reactor Safeguards. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

3-1 

3. Overall Technical Approach to a Full-Scope Site Level 3 PRA 

The overall technical approach to performing a full-scope site Level 3 probabilistic risk 

assessment (PRA) involves developing several risk source PRA models (i.e., reactor PRA 

models, spent fuel pool PRA models, and dry cask storage PRA model). Regardless of whether 

a PRA model is being developed for a reactor, spent fuel pool, or dry cask storage, or whether 

the risk level being evaluated is fuel damage, radionuclide releases, or health effects, the 

general process involves determining the events that initiate the potential accident sequences, 

understanding how the accidents can potentially progress, and quantifying the consequences of 

the accidents (as shown in Figure 3-1). 

 

Figure 3-1 Common Elements in Overall Technical Approach 

There are, however, specific and unique technical elements associated with accomplishing this 

general process. There are also specific technical elements that are common regardless of the 

Spent Fuel 

Pool PRA

(Section 15)

Dry Cask 

Storage PRA

(Section 16)

Reactor all 

modes, all 

hazards PRA

(Sections 12-14)

PRA Models for Various Risk Sources

Data 

Analysis

(Section 6)

Human Reliability 

Analysis

(Section 7)

Systems 

Analysis

(Section 5)

Success Criteria 

(T/H Analysis)

(Section 4)

Structural (Cont.) 

Analysis

(Section 8)

Uncertainty 

Analysis

(Section 11)

Common Supporting Technical Elements

Fragility 

Analysis

(Section 9)

Hazard 

Analysis

(Section 10)

Accident sequence 

development analysis

Quantification 

analysis

Initiating event 

analysis

General Process Technical Elements
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

3-2 

risk being evaluated. For example, human influence on the accident progression is an aspect of 

the PRA analysis, regardless of whether the accident is assessed under at-power or LPSD 

conditions, whether the onset of core damage or core melt is considered, etc. For each of these 

common supporting technical elements, there is a common method; however, there will be 

specific considerations when applying it to a specific part of the PRA model. Consequently, the 

plan discusses these technical elements individually, describing the general method, the 

general assumption, inputs, interfaces, etc. The specific considerations that apply to each 

specific application of the method in developing the various scope pieces of the PRA model are 

discussed in those sections of the plan. Common technical elements include the following: 

• Section 4 – Success criteria (thermal-hydraulic) analysis 

• Section 5 – Systems analysis 

• Section 6 – Data analysis 

• Section 7 – Human reliability analysis 

• Section 8 – Structural (containment) analysis 

• Section 9 – Fragility analysis 

• Section 10 – Hazard analysis 

• Section 11 – Uncertainty analysis 

The various scope pieces of the PRA model are discussed in the following sections: 

• Section 12 – Reactor, at-power, internal hazards Level 1,2,3 PRA 

• Section 13 – Reactor, at-power, external hazards Level 1,2,3 PRA 

• Section 14 – Reactor, at-power, LPSD, internal and external hazards, Level 1,2,3 PRA 

• Section 15 – Spent fuel pool Level 1-2,3 PRA 

• Section 16 – Dry cask storage Level 1-2,3 PRA 

• Section 17 – Integrated site risk PRA 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-1 

4. Technical Approach for Success Criteria Analysis 

Success criteria analysis is a supporting technical element in that it supports the development of 

the probabilistic risk assessment (PRA) models in several places. Whether as a technical 

element or as a technical step, success criteria analysis supports the following parts of a fully 

integrated site PRA: 

• Level 1 reactor at-power 

• Level 1 reactor low power/shutdown (LPSD) 

• Level 2 reactor at-power 

• Level 2 reactor LPSD 

• Level 1-2 spent fuel pool (SFP) 

• Level 1-2 dry cask storage (DCS) 

In supporting various parts of the PRA, this element uses a common method; however, it may 

be implemented differently, depending on the context of the part of the PRA model it is 

supporting. In this section, the approach described is the common method, and the 

implementation-specific aspects of the element are described in the part of the plan that it 

supports. 

The term success criteria analysis is generally used here to describe both the minimal 

equipment success criteria and the sequence timing for key operator actions. For instance, the 

success criteria for feed and bleed during a loss-of-feedwater event include not only the minimal 

number of emergency core cooling system (ECCS) pumps and power-operated relief valves 

(PORVs), but also the time by which the operators must have initiated the opening of the 

PORVs and ensured that the ECCS is injecting. 

The success criteria analysis, in general, consists of five interrelated steps: 

Step 1 – Establish Base Set of System Success Criteria 

Step 2 – Review Underlying Criteria Bases 

Step 3 – Identify Criteria with Insufficient Bases 

Step 4 – Perform Confirming Computational (Or Other) Analysis 

Step 5 – Establish Final Set of Criteria 

These steps are discussed in the following sections. 

4.1 Assumptions and Limitations

The following is a list of the general and common assumptions and limitations that define the 

scope and level of detail for this task. 

• Success criteria analysis will be limited to determining the system requirements and 

operator actions in accordance with the Emergency Operating Procedures (EOPs) and 

the Severe Accident Management Guidelines (SAMGs), in response to and during the 

sequence of an accident prior to fuel damage and shortly after the onset of fuel damage. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-2 

Other system- and component-specific success criteria (e.g., reactor coolant pump 

(RCP) seal cooling requirements) and operator actions that are not related to EOPs or 

SAMGs (e.g., time available for isolation of a flood source) are not included. 

• The initial set of success criteria will be based on existing information from the 

Licensee’s PRA for those parts that are within its scope. For those parts not covered by 

the Licensee’s PRA, information from other plants or from the results of applicable 

studies will be used. 

• For each of the above, only a limited number (tens, not ones and not hundreds) of plantspecific calculations will be necessary to refine the initial success criteria. The pedigrees 

of the initial set of success criteria are considered for selecting those that may require 

more refined analyses. MELCOR will be used for these analyses, with the potential for 

limited MAAP or TRACE analyses if necessary. 

• The MELCOR model being developed for extensive use in the Level 2 PRA will be 

sufficient—with minor modifications, as needed—to perform Level 1 success criteria 

analyses (this is more of a resource-sharing consideration than an actual technical 

concern). The MELCOR SFP model is being developed for extensive use in the SFP 

PRA14, and it also will be sufficient—with minor modifications, as needed—to perform 

Level 1 success criteria analyses. 

4.2 Inputs 

The design, operation, and engineering information required to perform the associated steps of 

the success criteria analysis are identified in Table 4-1. Procedures and emergency guidance 

(e.g., EOP/SAMG) are included under operation, whereas other supporting Licensing 

calculations fall under engineering. Some of the input information could also be gleaned from 

other PRA tasks or from the Licensee’s PRA models, thereby minimizing any duplication of 

effort. 

 

14 Note that two different MELCOR SFP models may be developed: (1) a simplified model for use in success criteria and sequence 

timing determinations, and (2) a detailed model for accident progression and source term analysis. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-3 

Table 4-1. Needed Inputs for Success Criteria Analysis 

Input Description 

Design(1) • The number of trains and the capacity of each train 

modeled in the PRA 

• System actuation conditions for both automatic and 

manual actuations 

• Conditions and trip setting for the systems 

• Engineering parameters for each train to support 

MELCOR analyses (flows, pressures, discharge head, 

net positive suction head (NPSH), pump characteristics, 

coast down curve, actuation timing, environmental 

operating limits) 

• Spatial layout, sizing, materials, etc. 

• MAAP parameter file, and, if available, calculation notes 

Operational 

(Procedures) 

• EOP operator actions, operator cues, and time needed to 

perform the action 

• SAMG operator actions, priorities, and initiating 

conditions 

Maintenance • None 

Engineering(2) • A minimal equipment list from the Licensee’s PRA, safety 

analysis report (SAR) Chapter 15, or other references 

• Equipment qualifications and the potential for their 

survivability post-accident 

• Timing of key events associated with the evolution of an 

accident sequence that could require either an automatic 

action (e.g., auto switch over to recirculation due to low 

level in the refueling water storage tank (RWST)) or 

trigger an EOP action (e.g., refill the Condensate Storage 

Tank) 

• Descriptions of the operator actions during accident 

progression, the step in EOP in which they are called, 

and the timing associated with performing the actions 

• SAMG actions, time required to perform the actions, and 

supporting analysis 

MAAP runs, or other calculation tools that are used for 

success criteria determination and to confirm the time that 

the operators may have to perform an action, are generally 

necessary. 

Note (1) – Much of the above information can be found in the MAAP parameter file, or in the plant’s 

Technical Specifications. 

Note (2) – The Licensee’s PRA is included as a part of engineering input. Most of the information 

requested would be discussed as a part of the development of the event trees and the accident 

sequence delineation in the Licensee’s PRA. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-4 

4.3 Analysis Steps

The Success Criteria Analysis consists of five interrelated steps: 

Step 1 – Establish Base Set of System Success Criteria 

Step 2 – Review Underlying Criteria Bases 

Step 3 – Identify Criteria with Insufficient Bases 

Step 4 – Perform Confirming Computational (Or Other) Analysis 

Step 5 – Establish Final Set of Criteria 

Step 1 – Establishing Base Set of System Success Criteria 

The objectives of this step are (1) to provide a starting point for evaluating the adequacy of the 

existing information and (2) to provide a starting point for coordination with concurrent activities 

under the systems analysis and human reliability analysis technical elements. 

Using the Licensee’s model and the Vogtle Standardized Plant Analysis Risk (SPAR) model (for 

modes/hazards where a model exists), establish an initial set of system success criteria and 

sequence timing assumptions. For the remainder of the success criteria that are not available 

from the Licensee’s PRA model or the Vogtle SPAR model, utilize available information from 

other plants, SAR Chapter 15 analysis results, past studies on SFP, LPSD, and DCS, and 

engineering judgment to establish an initial set of system success criteria and sequence timing 

assumptions. The values and bases for these selections should be documented in a 

preliminary success criteria PRA system notebook. 

Step 2 – Reviewing Underlying Criteria Bases 

The objectives of this step are (1) to familiarize the analysts with the strengths and limitations of 

the initial criteria (both in terms of their actual values and their underlying pedigrees) and (2) to 

create a set of concerns with specific success criteria that warrant further investigation. This 

examination should consider (1) the strengths and limitations of the methods and tools used to 

arrive at specific success criteria (e.g., SAR Chapter 15 analysis, MAAP calculations, etc.); 

(2) whether the end-state definitions15 and core damage surrogates used are consistent with 

those used for this project; and (3) whether there are underlying conservatisms or nonconservatisms that could affect the use of the model’s results16. The following past studies and 

guidelines should be considered for this examination: 

• MAAP4 Applications Guide 

• MAAP4/RELAP5 comparison found in the safety evaluation report (SER) in Chapter 19 

for the U.S. Evolutionary Power Reactor (EPR) design certification 

 

15 The U.S. Nuclear Regulatory Commission’s (NRC’s) current understanding is that the licensee Level 1 end-state is in safe-stable 

condition at 24 hours, with analysis to 30 hours in some cases to ensure this, with the exception of steam generator tube rupture 

(SGTR) events, which consider a longer timeframe. 16 For instance, if results were driven by top cutsets that include failure of emergency diesel generators (EDGs) based on failure of 

support systems (e.g., Nuclear Service Water Cooling System), and if these failures were treated as failure-to-start instead of

failure-to-run, this might be worth further investigation in terms of the timing of core damage (if not the core damage frequency 

itself). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-5 

• NUREG-1738 and NUREG-1864 and other relevant studies by the Electric Power 

Research Institute (EPRI) on SFP and DCS 

• Experience from the Mitigating Systems Performance Index (MSPI) implementation 

effort and cross-comparison; comparison to success criteria in other 4-loop large, dry 

SPAR models 

• Comparison of the SPAR and licensee success criteria 

• NUREG-1953 and Draft Byron NUREG MELCOR analyses 

• EPRI TR-1023032 on Loss of Main Feedwater analysis 

• Other past NRC studies of relevance (e.g., NUREG/CR-4471, NUREG/CR-5072, and 

NUREG/CR-6365) 

• Industry studies documented in conference proceedings (e.g., 2005 PSA paper by 

Gabor et al./2009 ICONE paper by LaBarge et al.) 

Using the above sources, review the success criteria established in Step 1 and identify the 

subset of criteria that warrant further investigation. 

Step 3 – Identifying Criteria with Insufficient Bases 

The objective of this step is to identify those criteria that will need to be confirmed or revised 

because there is insufficient basis to directly adopt them. Using the results of Step 2, create a 

list of these criteria (or sequence timing assumptions), and describe what further analysis is 

needed to confirm or change each item. Reasons for concluding that a particular success 

criterion warrants further investigation could include: 

• The criterion has no codified basis, and is uncertain in light of other information. 

• The SPAR and Licensee PRA models disagree. 

• The criterion is not consistent with results from more recent studies (e.g., NUREG-1953, 

EPRI-TR-1023032). 

• Success criteria related to SAMG actions, and other success criteria requirements after 

the onset of fuel damage, that rely on modeling which is uncertain (e.g., MAAP4 

calculation involving significant uncovery of the core), and which is uncertain in light of 

other information. 

In addition to identified deficiencies, there may be cases where success criteria are viewed as 

adequate, but needing additional context for the human reliability analysis (HRA) or systems 

analysis. For instance, if the PRA were to model the manual start of auxiliary feedwater (AFW) 

following the failure of an auto-actuation system, the systems analysts would need to know the 

time available for manual start of AFW. Multiple success criteria may be needed in such cases, 

since an adequate time for a particular sequence may not necessarily be the same as for other 

sequences. 

The anticipated risk significance of the criterion may play some role in prioritizing the above 

judgments as well, based on results from the SPAR or Licensee model. Such considerations 

should be documented, since relative risk rankings will change as the model is further refined. 

This should also be done with some caution, since low-risk significance in the overall risk profile 

doesn’t mean that the criterion would have low risk-significance if the model were later used for 

an event or condition assessment. 

In some cases this may be MELCOR (or TRACE) analyses, while in others it may be hand 

calculations, expert judgment, or additional discussion with the licensee. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-6 

Step 4 – Performing Confirming Computational (Or Other) Analysis 

The objective of this step is to perform computational analysis using the MELCOR (or TRACE) 

code using a plant-specific input model, or perform other types of analyses, for the subset of 

criteria that need additional investigation. These analyses are generally expected to fall into the 

following categories: 

• MELCOR analysis 

• TRACE analysis 

• Hand calculations 

• Expert judgment 

• Additional discussion with the licensee 

It is reasonable to anticipate that MELCOR or TRACE analyses could uncover weaknesses in 

the models that require updating (i.e., iteration between input model modification and analysis). 

This common outcome from exercising the models has the effect of extending the amount of 

time needed for the analysis, and increasing the level-of-effort. 

Step 5 – Establishing Final Set of Criteria 

The objective of this step is to arrive at a final set of success criteria to be used in the integrated 

Level 3 PRA. The success criteria resulting from the previous step including their pedigrees will 

be discussed with PRA analysts. This is done to ensure that the PRA analysts agree that the 

pedigrees of the success criteria are commensurate with their perceived risk significance. The 

final set of success criteria and sequence timing assumptions will be fed in to the PRA 

Notebook and the PRA models. If feasible, documenting how the results of the model were 

affected by the change would be informative. 

4.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to its 

analysis steps and they are identified below in Table 4-2. These documents are considered to 

be sufficient for the following objectives: 

• Allow an independent analyst to understand how the analyses were performed. 

• Facilitate modifications as necessary to maintain an up-to-date PRA model. 

• Provide all the information needed for and any other potential peer reviews. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-7 

Table 4-2. Documentation Needs for Success Criteria Analysis 

• Initial set of success criteria 

o Description of the definition(s) of fuel damage used for reactor core, SFP, 

and DCS 

o Assumptions related to mission times and end-states (i.e., time-based versus 

safe, stable state) 

o Success criteria and sequence timing values for the equipment and operator 

actions by initiating event class that are required to achieve safe end states: 

o Bases for success criteria and sequence timing which include: 

- Plant specific best estimate calculations (Identify the codes or other 

methods) 

- Plant specific bounding calculations (identify sources) 

- Generic from similar plants (identify references used and the bases for 

similarity assumption) 

- Use of expert judgment (expert solicitation documentation) 

- Model uncertainty and related assumptions 

o Description of the codes/methods and any related limitations that may 

challenge its applicability in certain cases 

• The process and the basis for selecting the success criteria for performing 

refined analyses. 

• Refined analysis: For computational analyses, this should include a summary of 

results, as well as tabular and graphical code outputs (akin to NUREG-1953). For 

hand calculations, this should include a description of the method used and the 

results. For expert judgment/consultation or additional discussion with the 

licensee, this should include a description of the interaction(s), any follow-up 

analysis, and what conclusions were reached. 

• Final set of success criteria for PRA use 

4.5 Task Interfaces

The various technical steps of Success Criteria Analysis are dependent on other technical 

elements for information in order for the various steps to be completed. These interfaces are as 

follows: 

• Steps 1, 3, and 5 require information about what human failure events will be modeled in 

the analysis, which is a product of the Human Reliability Analysis. 

• Step 1 and Step 5 also require information about the construct of the Level 1 event trees 

which is a product of the Accident Sequence Analysis. 

• Step 1 and Step 5 also require information about the construct of the Level 1 fault trees 

which is a product of the Systems Analysis. 

• Step 4 requires the development of a MELCOR model, and it will interface with the Level 

2 PRA for the reactor, SFP, DCS, and LPSD. 

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

4-8 

• Step 1 and 5 results in the success criteria needed to define the logic of the fault trees 

which is information required by the Systems Analysis. 

• Steps 1 and 4 result in sequence timing information, which is of interest to the 

development of human error probabilities in the Human Reliability Analysis. 

4.6 References

• Level 1 Licensee PRA model, and supporting information (e.g., calculation records) 

• Level 1 Vogtle SPAR model 

• MAAP Applications Guide 

• MAAP4/RELAP5 Comparison found in “Safety Evaluation Report With Open Items for 

the U.S. EPR,” Chapter 19, Subsection 19.1.4.4.2.1, January 15, 2010. (ADAMS 

Accession No. ML090900119) 

• MSPI cross-comparison; bases documents, and other related documentation 

• Other 4-loop large, dry SPAR models 

• U.S. Nuclear Regulatory Commission, “Confirmatory Thermal-Hydraulic Analysis to 

Support Specific Success Criteria in the Standardized Plant Analysis Risk Models – 

Surry and Peach Bottom,” NUREG-1953, September 2011. 

• U.S. Nuclear Regulatory Commission, “Technical Study of Spent Fuel Pool Accident 

Risk at Decommissioning Nuclear Power Plants,” NUREG-1738, February 2001. 

• U.S. Nuclear Regulatory Commission, “A Pilot Probabilistic Risk Assessment of a Dry 

Cask Storage System At a Nuclear Power Plant,” NUREG-1864, March 2007. 

• Draft Byron NUREG MELCOR analyses 

• Draft NUREG/CR on success criteria figure-of-merit variability, AC recovery time, core 

damage surrogates and limited MAAP/MELCOR safety margin example comparison. 

• Electric Power Research Institute, “Technical Framework for Management of Safety 

Margins – Loss of Main Feedwater Pilot Application,” EPRI TR-1023032, November 

2011. 

• U.S. Nuclear Regulatory Commission, “Los Alamos Decay-Heat Removal Studies 

Summary Results and Conclusions,” LA-10637-MS / NUREG/CR-4471, 1986. 

• U.S. Nuclear Regulatory Commission, “Decay Heat Removal Using Feed-and-Bleed for 

US Pressurized Water Reactors,” NUREG/CR-5072, 1988. 

• U.S. Nuclear Regulatory Commission, “Steam Generator Tube Failures,” NUREG/CR6365, 1996. 

• Gabor, J and D. True, “Byron and Braidwood Feed and Bleed Analysis Using MAAP4 ,“ 

at the American Nuclear Society International Topical Meeting on Probabilistic Safety 

Analysis, September 11-15, 2005, San Francisco. 

• LaBarge, N.E. et al., “Comparison of Thermal Hydraulic Simulations of Beyond Design 

Basis Events Using the MAAP4 and CENTS Computer Codes,” at the 17th International 

Conference on Nuclear Engineering, July 12-16, 2009, Brussels. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

5-1 

5. Technical Approach for Systems Analysis 

Systems Analysis is a supporting technical element in that it supports the development of the 

PRA model in several places. In supporting various other elements in the PRA, this element 

uses a common method; however, it may be implemented differently dependent on the context 

of the technical element it is supporting. In this section, the approach described is the common 

method, the implementation specific aspects of the element are described in that part of the 

plan; that is, under each specific technical element. 

The objectives of the Systems Analysis are to identify and quantify the causes of failure for each 

plant system represented in the PRA, such that (1) system-level success criteria, mission times, 

time windows for operator actions, and assumptions provide the basis for the system logic 

models as reflected in the model, (2) human errors and operator actions that could influence the 

system unavailability or the system’s contribution to accident sequences are identified for 

development as part of the HRA element, (3) different initial system alignments are evaluated to 

the extent needed for calculation of CDF and Level 2 inputs, and (4) inter-system dependencies 

and intra-system dependencies including functional, human, phenomenological, and commoncause failures that could influence system unavailability or the system’s contribution to accident 

sequence frequencies are identified and accounted for. 

5.1 Assumptions and Limitations

The following are a list the general and common assumptions and limitations that define the 

scope and level of detail performed for this task. 

• Partial components performance is considered a component failure (e.g., partial opening 

of a valve). 

• Failure to run is only modeled for the defined mission time. 

• For a fluid system, a line is not considered to be a diversion path if it is equal to or 

smaller than 1/3 the size in diameter of the main path. 

• Only intra-system common cause is modeled, inter-system common cause is not 

modeled. 

• Others???? 

5.2 Inputs 

The design, maintenance, and operational information required in order to perform the 

associated steps of Systems Analysis are identified. The information needed to perform each 

step, at a minimum, is listed below in Table 5-1: 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

5-2 

Table 5-1. Inputs Needed for Systems Analysis 

Input Description(1) 

Design • The functional relationships among the SSCs including both 

functional and hardware dependencies. 

• The normal and emergency configurations of the SSCs. 

• The automatic and manual (human interface) aspects of 

equipment initiation, actuation, operation, as well as isolation and 

termination. 

• The SSC’s capabilities (flows, pressures, actuation timing, 

environmental operating limits). 

• Spatial layout, sizing, and accessibility information related to the 

credited SSCs. 

Operational • That information needed to reflect the actual operating 

procedures and practices used at the plant including when and 

how operators interface with plant equipment as well as how 

plant staff monitor equipment operation and status. 

• That information needed to reflect the operating history of the 

plant as well as any events involving significant human 

interaction. 

Maintenance • That information needed to reflect planned and typical unplanned 

tests and maintenance activities and their relationship to the 

status, timing, and duration of the availability of equipment. 

• Historical information related to the maintenance practices and 

experience at the plant. 

Engineering • The design margins in the capabilities of the SSCs. 

• Operating environmental limits of the equipment. 

• Expected thermal hydraulic plant response to different states of 

equipment (such as for establishing success criteria). 

Note 1 Much of the above information can be gathered and is confirmed via plant walkdown and personnel 

interviews. 

5.3 Analysis Steps

A PRA of the Vogtle plant has been performed for the reactor Level 1 and 2 for internal hazards 

for at-power conditions. For that part of the overal site PRA model, it will start with the existing 

Vogtle PRA model. The steps described below pertain to performed given no previous model 

exists. How these steps are accomplished given a previous model exists is discussed in that 

part of the site PRA model. 

Systems Analysis consists of three interrelated steps: 

Step 1 – System Familiarity 

Step 2 – System Components and Failure Modes 

Step 3 – System Logic Model 

These steps are described below; however, for more detailed guidance, see the ASME/ANS 

RA-Sa-2009 PRA standard. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

5-3 

Step 1 – System Familiarity 

The objective of this step is to develop a good understanding of the system operation, the 

operation of the system components, and the effects of component failure on system success. 

How the system operates under normal and abnormal conditions and its dependencies with 

other plant systems is necessary in order to build a logic model that depicts the various 

pathways for system functional failure. 

Sources of information are reviewed to identify the composition and configuration of the system. 

The requirements for system operation under both normal and abnormal (e.g., emergency) 

conditions are identified. Conditions (e.g., high room temperature) are identified for successful 

system performance. System dependencies are a major aspect of system familiarity. A system 

may fail to function because it is dependent on another system which has failed to function. 

Support system-to-support system and support system-to-frontline system dependencies are 

identified, along with a comprehensive set of explanatory notes that describe the functional 

relationship between systems and system trains is developed. 

The majority of system understanding can be derived from system notebooks, system operating 

instructions, normal and emergency operating procedures, piping and instrumentation diagrams, 

plant layout diagrams, etc. However, the documented information will not provide all the 

needed information (e.g., actual accessibility of a component) and there can be discrepancies 

between documented information and the actual design. Consequently, plant walkdowns are 

performed as part of the system familiarity. These walkdowns involve (1) tracing the system 

from its source to its end point, and (2) interviewing plant personnel on the operation and 

maintenance of the system. See Section 5.2 for a complete description on needed plant 

information. 

Step 2 – System Components and Failure Modes 

The objective of this step is to identify those component comprising the system which will be 

included in the system model and then to identify the potential failure modes for each 

component. The system will be comprised of components whose function is not needed under 

emergency conditions; that is, their failure will not prevent the system from functioning and can 

be screened from the system model. For those components not screened, identification of their 

failure modes is important in both constructing the system model, but understanding what data 

is necessary to reflect the component performance. 

Screening criteria are used to identify those system components or component failure modes 

that can be screened from the analysis and do not need to be included in the system model. 

Examples of criteria include: 

• Failure probability of component is two orders of magnitude lower than the highest 

failure probability of other components in the same system train. 

• Failure mode probability is less than 1% of the total failure probability of that component. 

• Components in a pathway that is not a flow diversion pathway. 

• Components whose function does not affect the emergency function of the system. 

Another “component” comprising the system is the human. The associated human events are 

identified along with their potential failures. These human failure events (HFEs) should include 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

5-4 

those that can cause the system or component to be unavailable when demanded and those 

expected during the operation of the system or component. (See Section 7 for additional detail). 

For each component, identify the potential failure modes. These could include random failures, 

human failure, or common cause failures. 

Step 3 – System Logic Model 

The objective of the step is to construct the logic model (i.e., fault tree) for each system to be 

included in the PRA model. In constructing the logic models, an undesired state of the system 

is specified, and the system is then analyzed in the context of its environment and operation to 

find all the credible ways in which the undesired state could occur. The logic model is a graphic 

representation of the various combinations of events that would result in the occurrence of the 

predefined undesired event. 

In constructing the system model, the system boundary and component boundaries are defined. 

The developed pathways are based on the success criteria developed in Section 4. The 

systems models are developed to a level of detail supported by available data in order to 

quantify the system failure probability and to include the identified system/component 

dependencies. System models are developed either to: 

• Quantify support system initiating events. 

• Quantify accident sequences. 

The logic models are based on the components and failure modes identified in Step 2. 

5.4 Documentation

The system functions and boundary, the associated success criteria, the modeled components 

and failure modes including human actions, and a description of modeled dependencies 

including support system and common cause failures, including the inputs, methods, and results 

are documented. The details of this documentation are identified below in Table 5-2. The 

documentation (along with the identified inputs, Section 5.2) should be sufficient such that it 

allows an independent analyst to understand how the analysis was performed and to reproduce 

the results. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

5-5 

Table 5-2. Documentation Needs for Systems Analysis 

• System function and operation under normal and emergency operations. 

• System model boundary. 

• System schematic illustrating all equipment and components necessary for 

system operation. 

• Information and calculations to support equipment operability considerations and 

assumptions. 

• Actual operational history indicating any past problems in the system operation. 

• System success criteria and relationship to accident sequence models. 

• Human actions necessary for operation of system. 

• Reference to system-related test and maintenance procedures. 

• System dependencies and shared component interface. 

• Component spatial information. 

• Assumptions or simplifications made in development of the system models. 

• The components and failure modes included in the model and justification for any 

exclusion of components and failure modes. 

• A description of the modularization process (if used). 

• Records of resolution of logic loops developed during fault tree linking (if used). 

• Results of the system model evaluations. 

• Results of sensitivity studies (if used). 

• The sources of the above information, (e.g., completed checklist from walkdowns, 

notes from discussions with plant personnel). 

• Basic events in the system fault trees so that they are traceable to modules and to 

cutsets. 

• The nomenclature used in the system models. 

5.5 Task Interfaces

The various technical steps of the Systems Analysis are dependent on other technical elements 

for information in order for the step to be completed. These interfaces are as follows: 

• Success Criteria: This element identifies the systems that are necessary to mitigate the 

effects of the initiating event and therefore will need to be included in the development of 

the PRA model. This element also establishes the high level logic of the system logic 

model. 

• Data Analysis: The component failure estimation or system initiating event frequencies 

used to quantify the systems models comes from the Data Analysis element. 

• Human Reliability Analysis: Human failure events are taken into account in the system 

models which also provide feedback to the HRA. 

5.6 References

• American Society of Mechanical Engineers, “Standard for Level 1/Large Early Release 

Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” ASME 

RA-Sa-2009, 2009. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

5-6 

• U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, “An Approach for 

Determining the Technical Adequacy of Probabilistic Risk Assessment Results for RiskInformed Activities,” Revision 2, March 2009. 

• U.S. Nuclear Regulatory Commission, “A Guide to the Performance of Probabilistic Risk 

Assessments for Nuclear Power Plants,” NUREG/CR-2300, January 1983. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

6-1 

6. Technical Approach for Data Analysis 

Data Analysis is a supporting technical element in that it supports the development of the PRA 

model in several places. In supporting various other elements in the PRA, this element uses a 

common method; however, it may be implemented differently dependent on the context of the 

technical element it is supporting. In this section, the approach described is the common 

method, the implementation specific aspects of the element are described in that part of the 

plan; that is, under each specific technical element. 

The objectives of the Data Analysis are to provide estimates of the parameters used to 

determine the probabilities of the basic events representing equipment failures and 

unavailabilities modeled in the PRA, such that: (1) parameters appropriately reflect that 

configuration and operation of the plant, (2) component or system unavailabilities due to 

maintenance or repair are accounted for, (3) uncertainties in the data are understood and 

appropriately accounted for. 

6.1 Assumptions and Limitations

The following are a list the general and common assumptions and limitations that define the 

scope and level of detail performed for this task. 

• The data for the Level 3 PRA of Vogtle will be a mixture of generic data and plant 

specific data. 

• Generic data will typically be used if the current plant PRA uses generic data or for data 

needs not currently analyzed in the plant PRA (e.g., dry cask storage). 

6.2 Inputs 

The inputs required in order to perform the associated steps of Data Analysis are identified 

below. This information should allow an independent analyst to reproduce the various results. 

The information needed to perform each step, at a minimum, is listed below in Table 6-1: 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

6-2 

Table 6-1. Inputs Needed for Data Analysis 

Input Description 

Systems Analysis 

• Identify from the Systems Analysis the basic events for which 

probabilities are required. 

• Establish definitions of SSC boundaries, failure modes, and 

success criteria in a manner consistent with corresponding 

basic event definitions in Systems Analysis for failure rates 

and common cause failure parameters. 

• Establish boundaries of unavailability events in a manner 

consistent with corresponding definitions in Systems 

Analysis. 

Probability Model • Use an appropriate probability model for each basic event. 

Generic Information • Obtain generic parameter estimates from recognized 

sources. 

Plant-Specific Information • Obtain plant-specific data from appropriate plant sources 

(e.g., operational and maintenance records). 

6.3 Analysis Steps

Data Analysis consists of three interrelated steps: 

Step 1 – Determine the most appropriate level, scope, hardware boundary, and 

specifications for data collection using the results of the Systems Analysis. 

Step 2 – Determine the data available for all component parameters to be estimated by 

aggregating the various sources of generic data. 

Step 3 – Identify the sources of plant-specific data to be reviewed, and interpreted for the 

parameters of interest. 

Step 4 – Evaluate the data using the appropriate probability model and evaluate/identify 

the sources of uncertainty. 

Step 1 – Determine the Most Appropriate Level, Scope, Hardware Boundary, and 

Specifications for Data Collection Using the Results of the Systems Analysis 

The objective of this step is to determine what basic event parameters need to be evaluated. 

The Systems Analysis performed for the various elements of the PRA will identify all of the 

parameters for which data (generic or plant-specific) will be needed to determine the 

appropriate failure rates, failure probabilities (including common-cause failures), test and 

maintenance unavailabilities, etc. Included in this step is the grouping of components (grouped 

by type and according to the valve) and according to the characteristics of their usage to the 

extent supported by data). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

6-3 

Step 2 – Determine the Data Available for all Component Parameters to be Estimated by 

Aggregating the Various sources of Generic Data 

The objective of this step is to evaluate the generic data sources for plant parameters that may 

be needed. 

Some examples of these generic sources of data are (as identified in the PRA standard): 

• Component failure rates and probabilities: NUREG/CR-4639, NUREG/CR-4550, 

NUREG-1715, NUREG/CR-6928. 

• Common cause failures: NUREG/CR-5497, NUREG/CR-6268. 

• NUREG/CR-6823 provided a listing of additional data sources. 

Step 3 – Identify the Sources of Plant-Specific Data to be Reviewed, and Interpreted for 

the Parameters of Interest

The objective of this step is to determine the plant-specific data available and evaluate its 

suitability for use in the PRA. 

Operational and maintenance records should review reported failures on plant components 

should be tabulated, including: the cause of failure, how the failure was detected, the plant's 

condition, the repair time, and the effects of the failure on the plant. To quantify the failure 

probability, the following information is also needed: the number of times the component is used 

or challenged, the number of similar components at the plant, the test and maintenance 

strategy, and the time period of the collected data. 

Step 4 – Evaluate the Data Using the Appropriate Probability Model and Evaluate/Identify 

Sources of Uncertainty

The objective of this step is to determine the appropriate probability model, calculate the 

applicable parameter, and determine/evaluate the sources of uncertainty. 

The appropriate probability model for each basic event should be used. Examples include: (1) 

binomial distributions for failure on demand, and (2) Poisson distributions for standby and 

operating failures. In addition, an appropriate CCF model shall be used, such as: (1) Alpha 

Factor Model, (2) Basic Parameter Model, (3) Multiple Greek Letter, (4) Binomial Failure Rate. 

Use of alternate models should be documented in detail. 

The sources of model uncertainty and related assumptions associated with the Data Analysis 

should be identified and documented. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

6-4 

6.4 Documentation

The system functions and boundary, the associated success criteria, the modeled components 

and failure modes including human actions, and a description of modeled dependencies 

including support system and common cause failures, including the inputs, methods, and results 

are documented. The details of this documentation are identified below in Table 6-2. The 

documentation (along with the identified inputs, Section 6.2) should be sufficient such that it 

allows an independent analyst to understand how the analysis was performed and to reproduce 

the results. 

Table 6-2. Documentation Needs for Data Analysis 

• System and component boundaries used to establish component failure 

probabilities. 

• Models used to evaluate each basic event probability. 

• Sources for generic parameter estimates. 

• Plant-specific sources of data. 

• Time periods for which plant-specific data were gathered. 

• Justification for exclusion of any data. 

• Basis for the estimates of common-cause failure probabilities, including 

justification for screening or mapping of generic and plant-specific data. 

• Rationale for any distributions used as priors for Bayesian updates, where 

applicable. 

• Parameter estimate including the characterization of uncertainty, as appropriate. 

6.5 Task Interfaces

The various technical steps of the Data Analysis are dependent on other technical elements for 

information in order for the step to be completed. These interfaces are as follows: 

• Systems Analysis: The component failure estimations or system initiating event 

frequencies used to quantify the systems models comes from the Data Analysis 

element. 

• Human Reliability Analysis: Some human failure events (e.g., LOOP recovery actions) 

may be based on data evaluated in the Data Analysis element. 

6.6 References

• American Society of Mechanical Engineers, “Standard for Level 1/Large Early Release 

Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” ASME 

RA-Sa-2009, 2009. 

• U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, “An Approach for 

Determining the Technical Adequacy of Probabilistic Risk Assessment Results for RiskInformed Activities,” Revision 2, March 2009. 

• U.S. Nuclear Regulatory Commission, “A Guide to the Performance of Probabilistic Risk 

Assessments for Nuclear Power Plants,” NUREG/CR-2300, January 1983. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-1 

7. Technical Approach for Human Reliability Analysis 

Human reliability analysis (HRA) is a supporting technical element in that it supports the 

development of the PRA model in several places. In supporting various other elements in the 

PRA, this element uses a common, general approach; however, it may be implemented 

differently dependent on the context of the technical element it is supporting. In this section, the 

general approach is described. Implementation-specific aspects of performing HRA are 

described in that part of the plan; that is, under each specific technical element. 

Human reliability analysis consists of nine interrelated steps: 

• Definition and interpretation of HRA/PRA issue 

• Definition of HRA/PRA scope 

• Qualitative analysis (i.e., information collection & interpretation, analysis to support 

quantification) 

• Identification and definition of human failure events (HFEs) 

• Quantification (both screening and detailed) 

• Recovery analysis 

• Dependency analysis 

• Uncertainty analysis 

• Documentation 

The above HRA steps are commonly referred to as an “HRA process.” The first two steps are 

performed at the beginning of the analysis. Steps 3-8 are iterative steps that are typically 

performed throughout the HRA/PRA study until final results have been achieved. HRA step #9 

also is performed throughout the analysis but cannot be finalized until other steps in the HRA 

process are complete. 

The HRA process steps given above are based on the following sources: 

• NUREG-1921, Joint EPRI/NRC-RES Fire HRA Guidelines 

• NUREG-1624, Rev. 1, A Technique for Human Event Analysis (ATHEANA) 

• NUREG-1880, ATHEANA User’s Guide 

Also, to the extent relevant, NRC’s HRA Good Practices report (NUREG-1792), NRC’s 

Evaluation of HRA Methods Against Good Practices (NUREG-1842), and other PRA guidance 

will be used. In addition, NRC/RES’ current HRA research activities to address SRM- M061020 

(i.e., the IDHEAS project) is adopting a similar set of steps for its process. Finally, the 

requirements for PRA quality identified in Regulatory Guide 1.200 and the ASME/ANS PRA 

Standard also will play an important role in how this HRA/PRA is to be performed. 

NUREG-1921 (Joint EPRI/NRC-RES Fire HRA Guidelines) provides detailed descriptions for 

most of the tasks above, representing the current state-of-practice in HRA. However, here are 

the high level objectives for each step (based on guidance provided in NUREG-1921 and 

NUREG-1880): 

Step 1 – Definition and interpretation of HRA/PRA issue

The objective of the first step is to develop a clear understanding of the issue to be addressed. 

For example, the issue may be to support an at-power, internal events, Level 1 PRA study. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-2 

Step 2 – Definition of HRA/PRA scope

The objective of the second step is to determine the scope of the HRA that will be performed to 

address the issue defined in Step 1. 

Step 3 – Qualitative analysis

The objective of the third step is (1) to understand the modeled PRA context for the HFE, (2) to 

understand the actual “as-built, as-operated” response of the operators and plant, and (3) to 

translate this information into factors, data, and elements used in the quantification of human 

error probabilities. 

Step 4 – Identification and definition of human failure events

The objective of the fourth step is (1) to identify operator actions required for the successful 

mitigation of relevant accident scenarios and (2) to define corresponding human failure events 

(HFEs) at the appropriate level of detail. 

Step 5 – Quantification

The objective of the fifth step is to assign or determine failure probabilities for HFEs included in 

the PRA model. 

Step 6 – Recovery analysis

The objective of the sixth step is to support PRA recovery analysis of dominant cut sets by 

identifying, defining, evaluating, and quantifying relevant HFEs to add to these cut sets. 

Step 7 – Dependency analysis

The objective of the seventh step is to ensure that dependencies among the HFEs in an 

accident sequence are identified and addressed. 

Step 8 – Uncertainty analysis

The objective of the eighth step is (1) to identify sources of HRA modeling uncertainty and (2) to 

address and/or reflect such uncertainties in a manner consistent with the rest of the PRA model. 

Step 9 – Documentation

The objective of the ninth step is to provide traceability of the HRA from the beginning to the end 

of the analysis. 

7.1 Assumptions and Limitations

Most of the assumptions relevant to HRA are typically defined as part of the larger PRA study. 

For this site-wide, Level 3 PRA study, assumptions for the HRA technical element are primarily 

associated with a specific PRA level, hazard, or plant operating mode. Consequently, most of 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-3 

the assumptions relevant to HRA will be documented under specific technical elements (e.g., atpower, internal events Level 1 PRA). 

However, there are a few general and common assumptions and limitations that define the 

scope and level of detail performed for HRA. The following are a list of such assumptions and 

limitations: 

• Any PRA performed by the utility for the Vogtle NPP that is planned to be used by the 

NRC study: 

o With few exceptions, is adequate for the needs of RES’ Level 3 PRA study with 

respect to scope and other study objectives. 

o Meets the ASME/ANS PRA standard requirements for Capability Category II. 

o Has been thoroughly reviewed by a qualified peer review panel. 

o Has few, if any, substantive peer review comments that need to be addressed in 

the RES Level 3 PRA study. 

o Requires no adjustment to success criteria or timing information (e.g., from 

thermal hydraulic calculations), resulting in, for example, event tree modifications 

or changes to HRA quantification results. 

o Includes only human failure events that are supported by formal procedures (or 

are skill-of-the-craft actions). 

o Is adequately documented such that HRA qualitative analysis is clear and 

quantification results are traceable. 

o Has addressed all key and relevant performance influencing factors for HRA. 

o Has included an HRA that was performed using methods and approaches 

suitable for the specific PRA. 

o Has included an HRA that was performed using HRA methods and approaches 

as they are intended to be used (or alternate approaches are justified). 

o Requires only a few “spot checks” of HRA quantification results to assure 

reasonableness. 

o Requires little or no rework of HRA qualitative and/or quantitative analysis for 

post-initiator human failure events (HFEs). 

o Requires no rework (and no substantive “spot-check” effort) for pre-initiator 

HFEs. 

• Procedures and other formal guidance that supports human failure events exist and are 

currently being used and trained upon. 

• Action locations, equipment, control panels and so forth exist, are currently being used 

and trained upon (or an acceptable alternative is available for HRA analyst review). 

7.2 Inputs 

The design, maintenance and operational information required in order to perform the 

associated steps of HRA are identified in 7-1. Because the various HRA steps are iterative and 

overlap, some of the minimum HRA information needs listed in Table 7-1 are also iterative. 

Finally, for the HRA efforts supporting PRA studies that are assumed to be principally review 

efforts with some minimal independent checks, inputs and information needs will be limited to 

that which allows the HRA analyst to follow the analysis and reproduce the results. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-4 

Table 7-1. Needed Inputs for Human Reliability Analysis 

Input Description

Step 1: Definition and interpretation of HRA/PRA issue 

PRA type (e.g., hazard, operational mode, etc.) Immediate need before 

any analysis can be 

done 

General understanding of human interactions required in PRA 

model 

Some initial ideas 

needed early on; can 

be developed along 

with analysis. 

Step 2: Definition of HRA/PRA scope

Scope, limitations, and requirements for PRA study, including 

likely initiators and end states. 

Immediate need before 

any analysis can be 

done. 

Step 3: Qualitative analysis

Inputs required for Step 4 See Step 4. 

Inputs required for Steps 5-8 See Steps 5-8. 

Step 4: Identification and definition of human failure events (HFEs)

For each PRA types, hazard, etc., initiating events and likely 

end states 

Immediate need before 

any analysis can be 

done. 

Initial event trees, success criteria, and system fault trees Early need before 

HFEs can be identified 

and defined. 

Plant conditions, timing calculations, etc. associated with 

accident sequences 

Early need before 

HFEs can be identified 

and defined. 

Relevant plant procedures and instrumentation, initial 

interviews of plant personnel, initial plant walkdowns 

Early need before 

HFEs can be identified 

and defined. 

Inputs to feasibility assessments, if needed Early need before 

HFEs can be identified 

and defined 

(particularly relevant for 

PRA hazards that 

involve operator 

actions outside the 

control room in 

response to a core melt 

or LERF accident 

sequence). 

Inputs from specialty disciplines (e.g., fire modeling, circuit 

analysis) 

Early need before HRA 

product can be 

delivered for certain 

PRA hazard-specific 

HFEs (e.g., errors of 

commission resulting 

from spurious 

indications)

Final inputs for of all of the above plus additional inputs to 

develop timing information (e.g., engineering calculations, 

JPMs) interviews with plant personnel, simulator observations, 

Needed before final 

products of identified 

and defined HFEs and 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-5 

Table 7-1. Needed Inputs for Human Reliability Analysis 

plant walk downs, as appropriate HRA quantification can 

be delivered. 

Final inputs from specialty disciplines. Needed before final 

products of identified 

and defined HFEs and 

HRA quantification can 

be delivered. 

Step 5: Quantification

All of previous inputs and results of HRA steps, plus additional 

inputs, as needed. 

Need as inputs to initial 

quantification/screening 

HRA. 

Final versions of all previous inputs and results of HRA steps, 

plus additional details or inputs, as needed.

Need as inputs to final 

quantification of HFEs.

Step 6: Recovery analysis

HFEs in dominant cut sets Need before nonrecovery HFEs can be 

identified and defined.

All the same inputs as for Steps 3-5 Needed before final 

products of nonrecovery identified and 

defined HFEs and HRA 

quantification can be 

delivered. 

Step 7: Dependency analysis

Results of all previous HRA steps and associated inputs from 

other PRA tasks, including cut sets. 

Need before potential 

dependencies between 

HFEs can be 

assessed. 

Inputs to HRA dependency assessment tools. Dependency assessed 

and definitions of HFEs 

adjusted; final 

quantifications 

adjusted. 

Step 8: Uncertainty analysis

Results of all other HRA steps and PRA inputs. Additional 

information collection (distributions or range of timing 

estimates) may be needed. 

Need before 

uncertainty sources 

can be identified and 

uncertainty distributions 

or error factors 

developed/assigned.

Step 9: Documentation

At end of analysis, all inputs See all other tasks

7.3 Analysis Steps

As noted above, HRA consists of nine (9) interrelated steps: 

Step 1 – Definition and interpretation of HRA/PRA issue 

Step 2 – Definition of HRA/PRA scope 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-6 

Step 3 – Qualitative analysis 

Step 4 – Identification and definition of human failure events (HFEs) 

Step 5 – Quantification (both screening and detailed) 

Step 6 – Recovery analysis 

Step 7 – Dependency analysis 

Step 8 – Uncertainty analysis 

Step 9 – Documentation 

The following table provides a list of items that need to be documented for each step of the 

HRA, depending on the PRA type or hazard, and the scope and limitations of the HRA/PRA: 

Table 7-2. Documentation Needs for HRA 

Step Description 

1 - Define & interpret 

issue 

Discussion of PRA issue and implications for HRA, especially 

what existing HRA methods and tools, or existing 

psychological knowledge base will be relevant to the issue 

2 - Define the 

HRA/PRA scope 

Discussion of the scope and limitations of the HRA/PRA, 

including any assumptions 

3 - Qualitative 

analysis 

All “raw” inputs and assessed information needed to support 

all other HRA steps 

4 - Identify & define 

HFE 

For each HFE: (a) basic event identifier, (b) basic event 

name, (c) guidance on placement of the HFE, (d) supporting 

information for feasibility assessments, (e) summary of PRA 

context, relevant procedures, cues, etc. 

5 - Quantification For initial quantification or screening, for each HFE, include: 

(a) relevant accident sequence(s), (b) other PRA context 

information, (c) initial feasibility assessment, (d) preliminary 

assessment of performance-influencing factors, (e) 

assumptions, (f) HRA quantification method used. 

For final quantification, for each HFE analyzed using detailed 

HRA methods, include: (a) relevant accident sequence(s), 

(b) other PRA context information, (c) additional contextual 

information (if needed), (d) initial feasibility assessment, (e) 

assessment of performance influencing factors, 

(f) assumptions, (g) HRA quantification method used, (h) 

discussion of how qualitative analysis is represented in HRA 

quantification method. 

6 - Recovery analysis Same as for Steps 3-5, 7, and 8 

7 - Dependency 

analysis 

(a) List of HFEs identified as having potential dependencies 

and associated accident sequence or cut sets, (b) qualitative 

assessment of potential dependencies, (c) quantitative 

results for the assessment of dependencies. 

8 - Uncertainty Depending on the scope and limitations of the HRA/PRA, for 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-7 

Table 7-2. Documentation Needs for HRA 

Step Description 

analysis each HFE: a list of uncertainty sources, uncertainty 

distributions or error factors, or other inputs to be determined 

by the overall PRA. 

9 - Documentation Any and all documentation that allows an independent HRA 

reviewer perform an independent analysis. 

In the paragraphs below, further discussion is provided on each HRA step. However, detailed 

discussions and guidance are not provided here as adequate and more comprehensive 

guidance is already provided in published references. 

Step 1 – Definition and interpretation of HRA/PRA issue 

As described in more detail by NUREG-1624, Rev. 1 and NUREG-1880, the purpose of this first 

step is to define the objectives of the analysis being undertaken (i.e., why is it being performed). 

For many past HRA applications, the issue has been to support an at-power, internal events, 

Level 1 PRA where the focus is principally on: 

• A fully-staffed control room with licensed operators, supervisors, STA, and so forth 

• Operator response to an initiating events using emergency operating procedures (EOPs) 

before core melt 

• Operator response in the control room with its design, layout, and controlled hazards 

• Operator response under the general assumption that control room indications are 

correct 

However, HRA can address other issues, either in support of a PRA or by itself. However, HRA 

applications for other issues may require a different focus for understanding human behavior, 

an assessment of different factors affecting human performance, different information collection 

approaches and limitations, and different HRA tools and methods. 

For example, in RES’s site-wide, Level 3 PRA effort, the following issues will be addressed that 

will require an alteration in how HRA is performed: 

• At-power, internal fires, internal flooding seismic events, high winds, and other hazards 

• Low power and shutdown operations (internal events, fires, etc.) 

• Level 2 PRA 

Furthermore, while many HRA/PRA studies have addressed nuclear power plant operations, 

other types of applications have been performed. In this site-wide, Level 3 PRA effort, such 

additional applications will include: 

• Spent fuel handling as part of a dry cask storage PRA 

• Spent fuel pool monitoring and maintenance 

• Multi-unit risk 

Other PRA types and hazards are within the overall scope of the RES site-wide, Level 3 PRA 

effort. However, at this time, HRA support is not envisioned to be needed for these efforts. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-8 

The results of this step will become the basis for the rest of the HRA analysis for a specific PRA 

type, hazard, etc. Later steps in the HRA will build on this beginning description of how HRA 

was performed for this particular PRA study. Ultimately, the HRA documentation will include a 

brief description of how the particular PRA study influenced how the HRA was performed and 

what was entailed in performing the HRA. 

The following is an illustrative, not comprehensive, list of different or new features (that are not 

wholly independent) of that will need to be addressed by HRA in support of PRA studies beyond 

at-power, internal events Level PRA: 

• Different actions (e.g., spent fuel handling operations that cannot lead to core damage). 

• Different performers (e.g., when actions outside the control room are required, field 

operators are perform these actions at the request of control room operators). 

• Different decision makers (e.g., for Level 2 PRA when Severe Accident Management 

Guidelines (SAMGs) and similar procedures are used, decision making is expected to be 

performed by the Technical Support Center personnel rather than control room 

operators). 

• Different procedures (e.g., fire response procedures or other procedures that have not 

been demonstrated, validated, training upon, or human-factored to the extent that EOPs 

have - resulting in different reliability in their implementation). 

• Different procedure implementation (e.g., multiple procedures may be in use or how a 

specific procedure is to used is different - for example, SAMGs are intended to be used 

differently than EOPs). 

• Different training and experience (e.g., some actions may have never been performed or 

never performed realistically, especially those associated with Level 2 or external 

hazards PRA and, in general, ex-control room actions). 

• Different staffing (i.e., for events that require activating a fire brigade and/or manual 

operator actions, the amount of staff and their responsibilities may be different than for 

at-power, internal events Level 1 PRA; events that effect the entire site also be has this 

concern when considering of multiple units). 

• Different performance environment (e.g., instead of the controlled environment of the 

main control room and its well-human factored interfaces, actions may need to be 

performed in locations where less well designed panels and equipment need to used 

and/or poor lighting, heat, smoke, radiation, and so forth can be important impacts on 

operator performance). 

Step 2 – Definition of HRA/PRA scope 

As stated in NUREG-1624, Rev. 1, “[t]his step limits the scope of the analysis by applying the 

issue defined in Step 1 and, if necessary for practical reasons, further limits the scope by setting 

priorities on the characteristics of the event sequences.” Also, the overall PRA study may 

establish these limitations. Further discussion is given in NUREG-1624, Rev. 1 and NUREG1880. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-9 

For the purposes of this HRA/PRA study, the overall site-wide Level 3 PRA study has specific 

goals that may limit the scope of the HRA/PRA. For example, this study intends to make 

substantial use of the utility’s existing at-power, internal event Level 1 PRA and at-power, fire 

Level 1 PRA, rather than developing all of its own analyses. Instead, reviews of the existing 

PRAs and spot-checks of results are expected to be bulk of the effort for at-power, internal 

events and fire HRA/PRAs. Also, if the objectives of this study can be satisfied without 

development of detailed, plant-specific information, certain existing information (e.g., timing 

information) may be used by the HRA/PRA. 

Step 3 – Qualitative analysis 

As described above, the objective of the third HRA step is (a) to understand the modeled PRA 

context for the HFE, (b) to understand the actual “as-built, as-operated” response of the 

operators and plant, and (c) to translate this information into factors, data, and elements used in 

the quantification of human error probabilities. 

NUREG-1921 states that “[q]ualitative analysis is an essential part of an HRA although not 

always explicitly identified as a separate step in the HRA process...A sound qualitative analysis 

allows the HRA to provide feedback to the plant on the factors contributing to the success of an 

operator action and those contributing factors to the failure of an operator action. Because the 

qualitative analysis provides a foundation for all steps in the HRA process, it is recommended 

that [guidance for performing it] be read early in the HRA process, and be revisited as needed 

throughout the HRA.” Further guidance on performing qualitative analysis can be found in 

NUREG-1624 Rev. 1. 

The specific activities supporting qualitative analysis for this study cannot be completely 

anticipated, especially when the HRA must address new features inherent to operational modes 

and PRA hazards that have not been addressed fully before. However, the guidance on 

qualitative analysis in NUREG-1921, especially, provides a level of prescription and formalism 

that can be used as a basis for this study. Overall, the qualitative analysis is expected to follow 

this general plan: 

• Collect and evaluate information with respect to required actions and decision making, 

performed, performance environment, performance aids, and so forth, especially if the 

HRA is in support of a PRA type other than at-power, internal event Level 1 PRA. The 

goal of these activities is to understand the operations and operators sufficiently to make 

informed choices on using existing HRA methods or behavior models, psychological 

literature or other tools to represent the actions and associated influencing factors. 

• Collect and evaluate information with respect to required actions and decision-making, 

performed, performance environment, performance aids, and so forth in order to support 

development human failure events to place in the PRA model. The large PRA study is 

expected to provide certain key contextual information (e.g., success criteria for relevant 

plant functions including the timing by which actions must be performed). 

• Collect and evaluate information with respect to actions to determine if they are 

“feasible” per definition in NUREG-1921. Feasibility initially may be evaluated with crude 

estimates for timing for a “go/no-go” determination. Later, as more information is 

collected by the HRA analyst and/or the larger PRA study, the feasibility assessment will 

be refined and re-checked. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-10 

• Ultimately, information will need to collected and developed as inputs to an existing HRA 

methods or other quantification approach. 

Further discussion of the inputs and outputs of HRA qualitative analysis, and their 

documentation, is provided in the discussions of the more traditional HRA products (e.g., 

identified and defined HFEs, HFE quantification) given below. In addition, certain NRC reports 

and other publications are expected to guide the HRA, especially the qualitative analysis, for 

specific plant operating modes or activities (e.g., reports relating to operator performance and 

HRA in low power and shutdown or in spent fuel handling). These references will be discussed 

in more detail as part of the relevant PRA task element. 

Step 4 – Identification and definition of human failure events (HFEs)

As stated in NUREG-1921, "[t]he objectives of this step are to identify operator (or other human) 

actions and associated guidance and cues (e.g., procedures and instrumentation) necessary for 

the successful mitigation of the relevant PRA scenario, and to define the human failure events 

(HFEs) at the appropriate level of detail to support qualitative analysis and quantification. 

The table provided in the Inputs section above summarizes the input needs for this step and 

expected outputs from the HRA task. Further details on how to perform this step are provided in 

NUREG-1921, supplemented as necessary by NUREG-1880 and NUREG-1624, Rev. 1 (e.g., to 

address new human activities not previously commonly addressed in HRA/PRA). 

Typically, two types of HFEs must be identified as part of a PRA: 

• Pre-initiator HFEs that typically represent failures to restore needed systems or 

equipment to the operable state following testing or maintenance activities. 

• Post-initiator HFEs that represent failures of operator actions needed for the successful 

mitigation of an accident sequence (e.g., operators fail to manually initiate high pressure 

injection [after automatic actuation failed], operators fail to initiate feed and bleed 

cooling). 

First, HFEs are identified by the associated operator actions that need to be represented as 

failed events in the PRA. Then, the HFE can be defined, typically including: 

• A short description of the HFE that will be used to label the basic event in the PRA 

• A basic event identifier for the HFE that is developed using whatever naming scheme or 

conventions have been established for the PRA 

• A more detailed description of the HFE that is developed through qualitative analysis 

and, ultimately, provides the necessary inputs to HRA quantification (e.g., differentiations 

in the timing of operator actions that have an impact on subsequent plant behavior and 

operator actions) 

The effort and activities required for the identification and definition of HFEs will vary with the 

type of PRA. For the more traditionally performed PRA types (e.g., at-power, internal events 

Level 1 PRA), the effort is usually aided by a list of previously defined and modeled HFEs that 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-11 

can be re-used with little modification. In such cases, HFEs may be initially identified and 

defined in other PRA tasks (e.g., accident sequence analysis, systems analysis). The HRA 

analyst must verify these HFEs are appropriately defined and placed in the PRA model. In 

addition, the HRA analyst is likely to identify and define additional HFEs as a result of the 

review of procedures, interviews with operational staff, plant walkdowns, and other information 

collection activities. 

For other PRA types, the HRA analyst and other PRA analysts will be working in parallel and 

starting “from scratch” to identify and define HFEs. From other PRA tasks, operator actions 

needed to mitigate the accident scenario will be identified. As for similar HFEs in the at-power, 

internal events Level 1 PRA, the HRA analyst will need to verify the appropriateness of 

associated HFEs. Similarly, the HRA analyst will identify and define additional HFEs as the 

result of information collection and interpretation activities (e.g., procedure reviews). For some 

PRA types (e.g., low power and shutdown, dry cask storage), these HFEs may include humaninduced initiating events as well as pre-initiators and post-initiators. 

There is limited guidance on the topic of new HFE identification and definition. The most recent 

and comprehensive guidance is provided in the first report on ATHEANA (NUREG-1624, Rev. 

1). This report provides a systematic process for HFE identification and definition, including 

written guidance and a series of tables (i.e., Table 9.6 through 9.8) that direct the HRA analyst 

(often in conjunction with other PRA tasks) in performing the following activities: 

• Identify whether a specific plant function is needed or undesired for the specific event 

tree or accident scenario. 

• Identify the system(s) or equipment that perform the function. 

• Identify the pre-initiator status of the system(s) or equipment. 

• Identify the functional failure modes of the system(s) or equipment. 

• Determine if errors of omission, errors of commission, or both error types are relevant to 

the PRA issue and accident scenario. 

• Identify possible operator actions for relevant functional failure modes of the system(s) 

or equipment that can be further developed into HFEs. 

Another important HRA activity for PRA types other than at-power, internal events Level 1 PRA 

is the demonstration of operator action feasibility. As discussed in Section 4.3.2 of NUREG1921, operator actions that are guided by emergency operating procedures (EOPs) in at-power, 

internal events (before core melt) can be assumed to be feasible because of the extensive 

industry efforts to verify and validate their feasibility through, for example, vendor testing and 

plant-specific demonstrations in actual or simulated events. However, operator actions that are 

taken in other plant operational modes, of different PRA hazards, and/or without the support of 

EOPs cannot be assumed to be feasible. Therefore, the HRA analyst must perform feasibility 

assessments for such operator actions. Although feasibility assessments are considered part of 

qualitative analysis (as is done in Section 4 of NUREG-1921), an initial “go/no-go” feasibility 

assessment must be performed during HFE identification and definition to determine if the HFE 

can be credited in the PRA model. Feasibility criteria identified in NUREG-1921 for fire PRA will 

used as a template or starting point in the development of similar criteria for other plant 

operational modes and PRA hazards. The feasibility criteria in NUREG-1921 that must be 

demonstrated or verified in order to credit an HFE in the PRA model are: 

• Sufficient time 

• Sufficient manpower 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-12 

• Available and sufficient cues for action 

• Procedural support and training experience 

• Accessible location for action performance 

• Available and accessible equipment and tools 

• Operable systems, equipment, or components 

Finally, HFE identification and definition might include specialized events, depending on the 

PRA type or issue. For example, the chapter in the ASME/ANS PRA Standard that addresses 

fire PRA requires that the HRA address errors of commission (EOCs) that might result from 

operators responding to spurious indications (due to fire-damaged cables) as if they are 

accurate indications. Section 3 of NUREG-1921 provides guidance on how to screen out 

possible EOCs to those required by the PRA Standard. Similar approaches may be required for 

other HFEs for yet-to-be-identified needs for PRA types and hazards within the scope of the 

site-wide, Level 3 PRA study. 

Step 5 – Quantification (both screening and detailed) 

As stated above, the objective of the fifth step is to assign or determine failure probabilities for 

HFEs included in the PRA model. In order to support initial quantification, the HRA task may 

provide screening values or other conservative failure probabilities. In addition, the HRA task 

may need to identify and describe certain assumptions in other to produce such initial failure 

probabilities without information from other PRA tasks that have not been completed (e.g., fire 

modeling, circuit analysis). 

In other to support final PRA quantification, the HRA analyst will need to be provided with the list 

of HFEs that appear in dominant cut sets. These HFEs will be analyzed using detailed HRA 

quantification methods, as appropriate. The table above illustrates the kinds of inputs that are 

required for detailed HRA quantification and the products of such quantification. 

For both initial and detailed HRA quantification, the HRA quantification tools should be 

identified, and the qualitative analysis inputs should be tied and justified to the way in which the 

quantification tool is used. As stated in NRC's Good Practices for Implementing Human 

Reliability Analysis report (NUREG-1792), the understanding of the operator actions and 

associated performance influences gained in performing the qualitative analysis should guide 

the analyst in selecting an HRA quantification method, as well as being used to develop inputs 

for the quantification tool. As noted in the discussion of qualitative analysis, there must be a 

significant effort devoted to understanding the operator actions (i.e., operational aspects of the 

PRA study). Such plant-specific operational understanding is critical to selecting the 

appropriate HRA quantification tool and developing appropriate inputs to the quantification 

method. 

For the purposes of this site-wide, Level 3 HRA/PRA study, existing HRA quantification methods 

will be used to the extent applicable. However, many of the PRA hazards, operating modes, 

and activities represent, for example, actions, consequences, decision-makers, action aids, and 

performance environments that are completely outside the intended use of existing HRA 

methods. Consequently, it is expected that other, as-yet undeveloped approaches will need to 

be used, to the extent that such development can be done within the scope and schedule of this 

site-wide, Level 3 HRA/PRA effort. Examples of tools and approaches that might be used are: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-13 

• Existing qualitative analyses of human performance in the relevant contexts (e.g., low 

power and shutdown, spent fuel handling) with some extension to a quantitative or semiquantitative HRA approach. 

• Existing HRA quantification approaches that are flexible or unbounded in the 

performance influencing factors that can be addressed, typically coupled with an expert 

elicitation approach for HRA quantification (e.g., SLIM-MAUD, ATHEANA). 

• Results of current HRA research activities (e.g., (i.e., the IDHEAS project that currently 

is addressing SRM- M061020). 

• Understanding gleaned from relevant psychological literature on human behavior 

(confined to that which is considered “professional,” “expert,” and other similar labels), 

especially for rare and serious situations (for example, works by James Reason, Gary 

Klein, Emily Roth, and David Woods are expected to be relevant and helpful). 

Step 6 – Recovery analysis 

Existing reports (e.g., NUREG-1921) already describe how HRA for recovery analysis is to be 

performed. Generally, the need for recovery events (both hardware and human) are identified 

by the accident sequence analyst after quantification (but not initial quantificaiton). The HRA 

analyst should define such human failure events following the same guidance as that relevant 

for Step 4 (Identification and Definition), including feasibility assessments, as appropriate or 

relevant. Similarly, HRA quantification should be performed as described under Step 5, with 

special attention to potential dependencies between recovery HFEs and other HFEs in the 

sequence, especially with respect to time available, staffing, additional cues, and other 

resources. 

Except for limitations imposed by the PRA scope, it is expected that recovery analysis will be 

performed the same way for all PRA types, hazards, etc. Any further discussion that is needed 

will be provided under each specific technical element. 

Step 7 – Dependency analysis 

Except for limitations imposed by the PRA scope, it is expected that the identification of sources 

of potential dependencies will be performed the general same way for all PRA types, hazards, 

and activities. In some cases, particular HRA methods have their own approach to dependency 

analysis but many applications use the approach presented in the THERP method. 

For some of the specific PRAs (e.g., fire Level 1 PRA), there are expected to be more HFEs 

represented in cut sets due to a higher number of manual operator actions. As a result, the 

dependency analysis for HRA can be more complicated than for at-power, internal events Level 

1 PRA). Further discussion of such differences is provided under specific technical element. 

NUREG-1921 provides some additional information, including how this step might involve more 

effort for PRA hazards that involve more operator actions. 

Step 8 – Uncertainty analysis 

Uncertainty analysis for the HRA task will be performed in manner consistent with other tasks 

performed for this overall site-wide, Level 3 PRA study. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-14 

Sources of uncertainty will be identified and inputs for quantification will be developed as 

required by the overall study. Table 6-2 of NUREG-1921 provides a list of potential sources of 

HRA uncertainty that are generally applicable (i.e., not fire-specific). Most existing HRA 

methods use error factors defined by the THERP HRA method. However, there are others 

(e.g., ATHEANA) which develop uncertainty distribution directly through their quantification 

processes. Except for limitations imposed by the PRA scope, it is expected that uncertainty 

analysis will be performed the same way for all PRA types, hazards, and activities. However, if 

differences needs to be identified, this discussion will be given under each specific technical 

element. 

Step 9 – Documentation 

In general, the HRA task will conform to the documentation requirements of the larger, site-wide 

Level 3 PRA study. Documentation will be provided such that another HRA analyst can follow 

and understand the assumptions, interpretation of information in to HRA quantification inputs, 

and HRA results. NUREG-1921, NUREG-1880, and NUREG-1624 provide some additional 

discussion. 

7.4 Documentation

The products produced as a result of the HRA task are identified below. These products (along 

with the identified inputs, Section 7.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products include both interim and final products, as well sub-products 

which may differ for different PRA hazards, operational modes, and so forth. 

The major products of the HRA task are: 

• Identified and defined PRA events that are associated with actions, decisions, and other 

human activities 

• Failure probabilities or other quantification results associated with human-related PRA 

events 

• Qualitative analysis that supports and justifies products #1 and #2 

• Documentation of all products above 

The first HRA product corresponds with the results of HRA step #4 and associated qualitative 

analysis performed in HRA step #3. This HRA product is developed early in the PRA study but 

is typically refined and revised throughout the analysis until final results have been achieved. 

However, as part of HRA steps #6 and #7 (recovery and dependency analysis), new humanrelated PRA basic events also will need to be developed and refined. 

This first HRA product includes a basic event name (using whatever conventions have been 

decided for the PRA study), a basic event description (which establishes the tie between human 

activity and the plant function, system, or component failure modeled in the accident sequence), 

and guidance from the HRA analyst on the placement of the basic event in the PRA model. 

Associated qualitative analysis results for HRA product #1 include: 

• Human actions, decisions, or other activities associated with the HRA events 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-15 

• Specific plant personnel who are responsible for the actions, decisions, or other activities 

represented in the event 

• PRA contextual elements (e.g., initiator, accident sequence, details on plant conditions, 

timing of plant conditions, success criteria for accident sequence, timing requirements 

for human activities, PRA end states for the accident sequence) 

• Feasibility assessments to justify crediting the event in the PRA (see NURG-1921) 

• Specific locations for human activities and the associated job aids, tools, environmental 

hazards, and so forth for those locations 

• Relevant procedure(s) and procedure steps 

• Relevant instrumentation or other cues for human activities 

• Communication and coordination requirements 

The second HRA product corresponds with the results of HRA steps #5 (quantification) and #8 

(uncertainty analysis), but also involves steps #6 and #7 (recovery and dependency analysis, 

respectively). Specifically, this HRA product includes failure probabilities, or other quantitative 

or semi-quantitative values, that are assigned to each human-related PRA basic event and 

uncertainty analysis results (e.g., failure probability distributions, error factors) required by the 

PRA study. These results need to be developed for basic events identified and defined in Step 

#4, or as part of recovery analysis (Step #6). Also, HRA quantification results will need to be 

refined or modified, as appropriate, to address potential dependencies between human-related 

basic events in cut sets. In all cases, the HRA quantification method or tool also must be 

identified. The associated qualitative analysis for HRA quantification includes all of the results 

listed above, but usually described, developed, and supported by more detailed information. 

7.5 Task Interfaces

HRA is a supporting task to almost all of PRA technical elements regardless of the plant 

operating mode, PRA hazard, or PRA type. However, the specific interfaces between the HRA 

task and other PRA tasks will vary depending on the scope of the PRA effort and its specific 

operator action modeling needs. The discussion below is general (rather than specific to a 

particular PRA type or hazard). 

The various technical steps of the HRA are dependent on other technical elements for 

information in order for the step to be completed. These interfaces are as follows: 

• Steps 1 and 2 (i.e., Definition and interpretation of HRA/PRA issue and Definition of 

HRA/PRA scope) require a description of the PRA issue to be addressed (e.g., which 

PRA hazard and end state consequences) and of the PRA scope, including 

assumptions. 

• Step 4 (i.e., Identification and definition of HFEs) requires inputs from various parts of 

the overall PRA, depending on the PRA type, hazard, and so forth. In particular, PRA 

event trees and fault trees are required inputs for the HRA analyst's review for 

appropriate HFE definition and placement in the PRA model. 

• Steps 3, 5, 6, and 7 (i.e., Qualitative Analysis, Quantification, Recovery analysis, and 

Dependency analysis) require details of the PRA scenario (e.g., success criteria - both 

timing and equipment requirements, timing of plant behavior) which is typically 

developed as a product of the accident sequence analysis technical element. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

7-16 

Various tasks from other technical elements are dependent on products from HRA. These 

interfaces are as follows: 

• Steps 4 and 6 (i.e., Identification and definition of HFEs and Recovery analysis) result in 

defined HFEs and guidance on their appropriate placement in the PRA model which is 

information required by the accident sequence and systems analysis technical elements. 

• Steps 5, 6, and 7 (i.e., Quantification, Recovery analysis, and Dependency analysis) 

result in the development of human error probabilities (HEPs) that are assigned to the 

HFEs in the PRA model, principally required by the accident sequence analysis, systems 

analysis, cut set review, and PRA quantification technical elements. 

• Step 8 (i.e., Uncertainty analysis ) results in error factors or other uncertainty and 

sensitivity analysis inputs associated with HFEs in the PRA, which is information 

required by the PRA quantification technical element. 

7.6 References

Here is an initial list of references that can and should be used in performing the work of the 

technical element: 

• USNRC and EPRI, EPRI/NRC-RES Fire Human Reliability Analysis Guidelines, 

NUREG-1921, July 2012. 

• USNRC, A Technique for Human Event Analysis (ATHEANA), NUREG-1624, Rev. 1. 

• USNRC, ATHEANA User's Guide, NUREG-1880, June 2007. 

• USNRC, Good Practices for Implementing Human Reliability Analysis (HRA), NUREG1792, April 2005 

• USNRC, Evaluation of HRA Methods Against Good Practices, NUREG-1842, 

September 2006. 

• Swain, A.D., and H.E. Guttmann, Handbook of Human Reliability Analysis with 

Emphasis on Nuclear Power Plant Applications (THERP), NUREG/CR-1278, 1983. 

• USNRC, An Approach for Determining the Technical Adequacy of Probabilistic Risk 

Assessment Results for Risk-Informed Activities, Regulatory Guide 1.200, Rev. 2, March 

2009. 

• ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008, Standard for Level 

1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power 

Plant Applications, The American Society of Mechanical Engineers, New York, NY, 

February 2009. 

• Embrey, D.C., P. Humpherys, E.A. Rosa, B. Kirwan, and K. Rea, SLIM-MAUD: An 

Approahc to Assessing Human Error Probabilities Using Structured Expert Judgment, 

NUREG/CR-3518, 1984. 

• Reason, J., Human Error, Cambridge University Press, New York, NY, 1990 

• Reason, J., Managing the Risks of Organizational Accidents, Ashgate Publishing 

Limited, 1997. 

• Reason, J., The Human Contribution - Unsafe Acts, Accidents, and Heroic Recoveries, 

Ashgate Publishing Limited, 2008. 

• U.S. Nuclear Reguatory Commission, Staff Requirements Memorandum - Meeting with 

Advisory Committee on Reactor Safeguards, SRM M061020, November 8, 2006. 

• Klein, G., Sources of Power - How People Make Decisions, MIT Press, 1998.
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-1 

8. Technical Approach for Structural Analysis 

Structural analysis is a supporting technical element in that it supports the development of the 

PRA model in several places. In supporting various other elements in the PRA, this element 

uses a common method. However, it is generally implemented differently depending on the 

context of the technical element that it is supporting. 

Typically, structural analyses support the calculation of demands in structures, systems and 

components (SSCs) as well as the assessment of damage states of SSCs for use in various 

technical elements of the PRA. As an example, dynamic structural analyses use ground 

motions derived in the seismic hazard analysis to calculate seismically-induced demands on 

SSCs for Level 1 reactor at-power PRA for seismic hazards. Dynamic or nonlinear structural 

analyses also quantify building loads and damage states of structures and components needed 

for the calculation of structural fragilities for use in Level 1 reactor at-power PRA for seismic 

hazards as well as damage states of spent fuel structures for use in the SFP PRA. In the case 

of Level 2 reactor at-power PRA for internal hazards, static and dynamic nonlinear structural 

analyses quantify containment damage states under either static or dynamic containment 

pressurization for subsequent use in the development of containment fragilities under internal 

pressurization. 

Clearly, the specific structural analysis techniques, level of detail, complexity of structural 

methods and accuracy of the structural analysis will differ markedly in its implementation for the 

various technical elements in the PRA and for different sub-elements of a given technical 

element. This section only provides those aspects of the technical approach that are common 

among all technical elements of the PRA. The section does not provide a breakdown of specific 

structural analysis approaches, techniques and approximations for each technical element of 

the PRA other than by the use of a few examples to illustrate specific steps of the approach. 

8.1 Assumptions and Limitations

The following is a list the general and common assumptions and limitations that define the 

scope and level of detail performed for this task. 

• The complexity and details of the structural analysis models can vary for the various 

technical elements that it supports and for different applications within a technical 

element depending on the acceptable uncertainties in the results in relation to the other 

uncertainties in the technical element or sub-element. 

• The complexity and details of the structural analysis models will depend, in part, on the 

number of statistical simulations that may need to be performed in order to estimate 

probabilities of various damage states and adequate demand statistics. 

• The complexity and details of the structural analysis models should be commensurate 

with the details, completeness and reliability of available as-built structural information. 

• As-built information on SSCs of interest, rather than information accounted for in the 

design, can and should be used in the structural analysis when available. 

• It is assumed that design and construction drawings with the relevant structural 

information will be available or will be provided by the licensee. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-2 

• To the extent possible the structural analysis uses actual statistical data on the material 

properties for the various structural materials use in the plant structures and, if sitespecific data is not available, generic information and information from other sites from 

other sources will be used with justification to estimate statistics of relevant structural 

material properties. 

• State-of-the-practice structural analysis methods will be used and adapted for the needs 

of each technical element. 

• Structural models and analysis already conducted by the licensee will be assessed, 

reviewed and relied upon to the maximum extent possible if deemed applicable and if 

available in a manner compatible with the schedule for the Level 3 PRA study. If resutls 

of analysis by the licensee, for example for the licensee’s own reactor at power PRA for 

seismic hazards, are not available in the time frame of the study, recourse to existing 

analyses results will be done with justification. 

8.2 Inputs 

This section addresses design, maintenance and operational information required to perform 

the associated steps in the Structural Analysis element. Table 8-1 is a list of the minimum 

information needed for the structural analysis task. 

Table 8-1. Needed Inputs for Structural Analysis 

Input Description(1) 

Design and 

as-built data 

• List of safety-related structures for which structural analyses will be 

performed. Examples of items to be included in this list are seismic 

Category I structures, structures housing mitigation (B5B) equipment, 

storage tanks, pipe runs between buildings, and water intake structures. 

The contents of the list vary depending on the PRA element of interest. For 

the structures and components in this list the following inputs are needed: 

• Overall plant layout, description of structures and design reports, in addition 

to the information in the Final Safety Analysis Report (FSAR). 

• Structural drawings with location and geometries of structural components 

to permit a complete understanding of load paths, response mechanisms 

leading to damage states, and construction of three-dimensional finite 

element models. 

• Reinforcement schedules for walls, slabs, beams and columns. Details of 

prestressing for the containment structures. 

• Steel detailing drawings for steel structures. 

• Drawings showing details of support structures, foundations and 

anchorages for storage tanks including field erected tanks. 

• Material specifications and nominal material properties for all structural 

materials of interest such as concrete strengths, steel reinforcement yield 

and ultimate stress, structural steel yield and ultimate stress. 

• Tests of material properties for all structural material properties of interest, 

including assessments of current material properties if made and available. 

• Foundation drawings with structural and geotechnical details. 

• Site soil conditions to include: geologic data on site; soil configurations (e.g. 

layering, horizontal variability, soil types and soil index properties); 

subsurface exploration information (e.g. boring information); and ground 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-3 

Table 8-1. Needed Inputs for Structural Analysis 

Input Description(1) 

water data. 

• Static and dynamic soil properties from in-situ field tests and laboratory 

data. Examples include dynamic bearing capacities, penetration 

resistances, densities, and friction angles.

Modeling 

and 

Analysis 

• Structural models and soil-structure-interaction models referred to in the 

FSAR and other studies such as the Individual Plant Examination (IPE) 

submittal. 

• Structural models and soil-structure interaction models being developed or 

already developed by the licensee for their current PRA studies. 

• Results of relevant structural analyses performed or being performed by the 

licensee. This includes results referred to in the FSAR, studies such as the 

IPE, and ongoing PRA studies.

Inputs from 

other 

elements 

• Identification and definition of structural damage parameters of interest. 

For the structures and components in the list of safety-related SSCs for a 

given PRA element, identify and define the damage states of interest and 

related damage indices that can be related to structural response results. 

This process includes agreement on approach for the calculation of those 

structural damage 

• Structural loads of interest. In the case of Level 1 reactor at-power PRA for 

seismic hazards this includes ground motion response spectra (GMRS) for 

the site, and sets of ground motion time-histories (in three-directions) for 

dynamic structural analyses including soil-structure interaction analysis. In 

the case of Level 2 reactor at-power PRA for internal hazards this includes 

static containment internal pressures and temperatures (with time) inside 

the containment, and dynamic loads (pressures) time-histories for events 

associated with burning of combustible gases. 

• For the PRA elements involving seismic hazard, strain levels imposed on 

the foundation soils as needed for soil-structure-interaction analyses, for 

each seismic bin.

(1) – Some of the above information would be confirmed or gathered though a plant visit or plant walkthru. An essential element 

of such plant visits should be meetings with plant and licensee structural and component analysts/engineers. The plant visit 

should also inform about as-built conditions that may not be available in design drawings or reports but might contribute to the 

actual capacity of structures and components. 

8.3 Analysis Steps

The common technical approach for structural analysis consists of the following interrelated 

steps: 

Step 1 – Define the structural response results needed 

Step 2 – Assess available information 

Step 3 – Define the structural modeling and analysis type 

Step 4 – Obtain and verify as-built structural data 

Step 5 – Development of structural analysis models and structural analysis simulations 

Step 6 – Documentation 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-4 

Step 1 – Define the structural response results needed 

The objective of this step is to define the structural response results of interest. Results of 

interest for Level 1 reactor at-power PRA for seismic hazards include (1) seismic demands for 

components and systems mounted at various locations in the plant’s structures and expressed 

in terms of in-structure response spectra (ISRS) and (2) structural response and damage, if any, 

for safety-related structures and components. For Level 2 reactor at-power PRA for internal 

hazards, examples of results of interest are estimates of leakage areas expressed in terms of 

the containment internal pressure. 

A clear definition of the structural response of interest will require interaction with the interfacing 

PRA elements. In the case of Level 1 reactor at-power PRA for seismic hazards, the ISRS 

would be used in conjunction with fragility functions for components and systems to estimate 

probabilities of failure for these components and systems for a given seismic bin. Interaction 

with the fragility analysis task is also needed to determine how these results should be 

expressed in terms of the ground motions at the site for a given seismic bin. Interaction is also 

needed to identify the ISRS statistics to be calculated for use in conjunction with the fragility 

data. This affects the number of structural simulations to be performed which in turns influence 

the level of detail that is feasible for the structural analysis models involved. 

Step 2 – Assess available information 

The objectives of this step for each technical element are: 

• To review the applicability and adequacy of the available structural information in relation 

to the structural results to be calculated. This part includes determining the availability of 

design and construction drawings and information on actual statistics of structural 

material properties. Included in this objective is assessing the existence and availability 

of structural analysis models and structural analyses already performed or being 

performed by the licensee. 

• To review and assess modeling and analyses already performed or being performed by 

the licensee and their applicability. Part of this assessment will address the availability, 

in relation to the schedule for the Level 3 PRA project, of these modeling and analyses. 

Results of this assessment and the timely availability of these results will affect the 

content of subsequent steps, namely steps 3 to 5, and may require the use of other 

existing analysis results or simplified approaches. 

• To assess inputs for the structural analysis in terms of the demands on structures to be 

provided by interfacing tasks. In the case of Level 1 reactor at-power PRA for seismic 

hazards this task will include an assessment of ground motion information that would be 

provided by the interfacing seismic hazard task. In the case of Level 2 reactor at-power 

PRA for internal hazards this task would include assessing pressure and temperature 

time-histories from the accident progression analysis as well as dynamic loads from 

combustible gases. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-5 

Step 3 – Define the structural modeling and analysis type 

The objectives of this step are: 

• To define the level of detail and complexity of the structural models. 

• To establish the level of accuracy required for the structural analyses. 

• To select the structural analysis codes to be used for the analysis (when needed). 

• To define the statistical simulation or sensitivity analysis approaches to be used in 

conjunction with the structural analysis. 

Given the type of results needed by the structural analysis and their use, this step will establish 

the level of complexity and detail of the models to be used, the accuracy of the structural 

analyses and the type of statistical simulations or sensitivity analyses that will need to be 

executed in order to provide the necessary information for the interfacing tasks. It also will 

establish the structural analysis codes to be used for the analysis. Products of this task will be 

specific to the technical element that the task is supporting. The task will take into consideration 

the quality and type of data available, the uncertainties of the structural analysis in relation to 

the uncertainties in the interfacing tasks, and the availability of resources and scheduling 

requirements in reaching its objectives. 

As an example, in the case of Level 1 reactor at-power PRA for seismic hazard detailed threedimensional shell finite element structural models of containment and auxiliary buildings may 

not be needed for the ISRS calculation. Instead, verified and validated simplified threedimensional finite element models called stick models may be used for the dynamic structural 

analyses for ISRS calculation and for related soil-structure interaction analysis. Soil-structureinteraction analysis, which is needed for this site, requires site-specific geotechnical data 

including the anticipated soil strains derived from the seismic hazard task as well as information 

on the design of the building foundations. 

For the Level 2 reactor at-power PRA for internal hazards, current practice uses threedimensional, nonlinear finite element models of the containment structure that include details of 

reinforcement, presetressing and liner as well as major containment openings to calculate liner 

strains from which to estimate leakage areas. Current practice also complements such models 

with simpler analytical modeling, for verification and other purposes, and with three-dimensional 

finite element models of major penetrations or hatches as needed. Depending on the potential 

for localized dynamic pressures from the burning of combustible gases three-dimensional finite 

element models of reactor cavities may be necessary. 

If structural models and analysis have already been performed or are being performed by the 

licensee, the work in the task may include the development of confirmatory models to verify the 

adequacy and suitability of the licensee’s models and results for the Level 3 PRA project. The 

approach for the structural analysis task is to rely on models and results produced by the 

licensee to the maximum possible extent, provided that the models and results have been 

reviewed and deemed adequate by the NRC staff. 

Step 4 – Obtain and verify as-built structural data 

The objective of this step is to obtain as-built structural analysis information for the plant 

structures and components. To the extent possible, as-built structural and current information 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-6 

instead of design information should be used in the structural analyses. As-built structural and 

current structural information includes: 

• Material properties, the models should use material properties as close as possible to 

the actual structural properties and, account for aging effects on increased concrete 

strength. 

• Structural elements that might not have been credited in design calculations and may 

not be present in design drawings but are present in the actual structures. An example 

would be steel shapes embedded in concrete that might have been part of the 

construction formwork. 

• Structural alterations made over time and consideration of change in material properties 

with time. 

• Current condition of structures, such as anchorages for liquid-storage tanks and heavy 

equipment, as observed in a walkthru of the facility. 

Step 5 – Development of structural analysis models and structural analysis simulations 

The objectives of this step are: 

• Development of structural models, which includes definition of appropriate loads, based 

on the results of Steps 1 to 4 above. 

• Conducting the structural analysis simulations as determined in Steps 1 to 4 above. 

• Post-process and collect the results of the structural analysis simulations in the manner 

necessary for the interfacing tasks. 

Step 6 – Documentation

The objective of this step is to aggregate the documentation, inputs, assumptions, modeling and 

analysis techniques chosen with the justification for their selection, and results for each step. 

This step also involves compiling and documenting the information for task and its steps in a 

manner consistent with the database for the Level 3 PRA project. 

8.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, (Section 8.2) should be sufficient for an independent analyst to understand 

how the analysis was performed and to reproduce the results. Consequently, the list of 

products includes both interim and final products. Table 8-2 provides the expected products. 

Table 8-2. Documentation Needs for Structural Analysis 

• List of damage indices to be calculated by the structural analysis for each PRA 

element. Description of the relationship (quantitative) between the damage indices 

and the damage states of interest for the PRA element. Approach and assumptions 

relating structural damage indices to quantities of interest (e.g. leakage rates) for the 

PRA element of interest. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-7 

Table 8-2. Documentation Needs for Structural Analysis 

• Description of the assumptions and method for the calculation of the damage indices 

using structural analysis. This includes a justification of the approach used in relation 

to the criteria described in Section 8.1. It also includes a description of the software 

used for the analysis, as applicable. 

• Description of the analysis models (actual input files used for the final runs will be part 

of the archived information). 

• Description of the main structural results with supporting data. This includes 

quantitative and graphical representations of the relevant structural response 

parameters. 

• Interfaces with other PRA elements - For each PRA element provide the response 

results of interest for the element. Typically, these results would be values of the 

damage indices to be used in conjunction with fragility calculations. 

• Provide the products in a manner suitable for incorporation in the database for the 

Level 3 PRA study. 

8.5 Task Interfaces

The technical elements that interface with task element are: 

• Level 1 reactor, at-power PRA for seismic hazards 

• Seismic hazard analysis 

• Fragility analysis 

• Level 2 reactor PRA, at-power for internal events 

• Quantification of spent fuel pool PRA 

• Quantification of the dry cask storage PRA 

Depending on the hazards and level of detail for other elements of the entire PRA, there may be 

interfaces between the structural analyses and these elements. These elements may include: 

• Level 1 reactor, low-power and shutdown for all hazards 

• Level 3 aspects that would involve evacuations that would be affected by infrastructure 

damage from seismic events 

Level 1 reactor, at-power PRA for seismic hazards: Structural analyses use seismic ground 

motions from the seismic hazard analysis to calculate seismic demands on safety-related SSCs 

mounted in various locations and structures in the nuclear power plant. These demands are 

then used in the Level 1 reactor, at-power PRA for seismic hazards in conjunction with fragility 

information to calculate probabilities of failure for those SSCs. For Level 1 reactor, at-power 

PRA for seismic hazards, structural analysis results are also used in conjunction with fragility 

information to calculate probabilities of failure for safety-related structures in the nuclear power 

plant for the various seismic bins. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-8 

Seismic hazard analysis: Dynamic structural analysis for Level 1 reactor, at-power PRA for 

seismic hazards requires as input ground motions for the site that are a result of the seismic 

hazard analysis and related site amplification analyses for the site. The seismic hazard task 

provides the load inputs for the structural analyses in terms of the ground motions at various 

depths and locations through the plant in a manner. Close coordination will ensure that the 

structural methods used are consistent with the manner in which ground motions at each one of 

these locations and depths can be provided by the structural analyses and still capture the 

uncertainties in their characterization. The seismic hazard analysis task includes seismic 

amplification studies that assess effects of local site conditions on the ground motion and also 

provide mechanical, strain-dependent properties for the foundation soils that are an input for 

dynamic soil-structure interaction analyses in the structural analysis task. 

Fragility analysis: Fragility analysis for structures and various components and systems 

requires the use of structural analysis to calculate damage states for these SSCs given input 

ground motions for a given seismic bin. In addition, ISRS calculated using dynamic structural 

analyses are also used in conjunction with fragility information for components and systems to 

estimate probabilities of failure for these components for a given seismic bin. This dependency 

requires defining the fragility functions in a manner that is consistent with the demands provided 

by the structural analyses. 

Level 2 reactor PRA, at-power for internal events: Structural analysis calculates the 

performance of containment structures in terms of leakage areas under internal pressurization 

and temperature load histories from the accident progression analyses. Interfacing with this 

element also will include establishing a list of SSCs for which structural analysis will be 

necessary and provide the load types (static or dynamic) and their characterizations. Interfacing 

with this element and the fragility analysis element also will establish the type of structural 

response parameters of interest and the types of structural analysis modeling and analysis 

adequate for each SSC of interest. 

Quantification of spent fuel pool PRA: Structural analysis quantify damage states for spent 

fuel structure and other spent fuel cooling systems that are necessary to calculate the spent fuel 

performance and condition for, for example, a given seismic bin. Damage data needed for the 

quantification of the spent fuel pool PRA is used in Step 1 of the technical approach for the 

structural analysis element to define the scope of the structural analyses needed for the spent 

fuel pool PRA. 

Quantification of the dry cask storage PRA: Structural analysis results may also be needed 

to provide inputs to the dry cask storage PRA for accidental drops or drops that might be 

caused by seismic events. The degree to which structural analyses will be needed for this 

element will depend on the extent to which results from prior PRAs or from analyses already 

being produced by the licensee can be relied upon. Interfacing with this element will depend on 

the hazard that the element will consider (e.g. seismic hazards) and whether their assessment 

will require structural analyses. 

8.6 References

The following is a partial list of technical reports, technical articles, regulatory guides and 

standards that can and should be used in performing this task. The emphasis is on structural 

analysis approaches used in conjunction with risk assessments or with beyond-design-basis 

accidents. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-9 

• VEGP, “Final Safety Analysis Report (FSAR) - Vogtle Electric Generating Plant, 

Revision 15,” April, 2009. 

• VEGP, “Vogtle Electric Generating Plant Individual Plant Examination Submittal,” 

Georgia Power, December 23, 1992. (Volume 1 and Volume 2) (Also response to NRC 

Requests for Additional Information) 

• VEGP, “Vogtle Electric Generating Plant Unit 1 and Unit 2 Individual Plant Examination 

of External Events Submittal 0,” Georgia Power, November 1995 (Volume 1 and Volume 

2) (Also response to NRC Requests for Additional Information) 

• NRC, “Staff Evaluation Report of Individual Plant Examination of External Plant (IPEEE) 

Submittal on Vogtle Electric Generating Plant, Units 1 and 2,” Nuclear Regulatory 

Commission (NRC), December 2000. 

• NRC, “Staff Evaluation Report of Individual Plant Examination (IPE) Submittal on Vogtle 

Electric Generating Plant, Units 1 and 2,” Nuclear Regulatory Commission (NRC). 

• NRC, “An Approach for Determining the Technical Adequacy of Probabilistic Risk 

Assessment Results for Risk-Informed Activities,” RG 1.200, Revision 2, March 2009. 

• NRC, “Containment Structural Integrity Evaluation for Internal Pressure Loadings Above 

Design Basis Pressure,” Regulatory Guide 1.216, August, 2010. 

• Spencer, B.W., J.P. Petti, and D.M. Kunsman, 2006, “Risk-Informed Assessment of 

Degraded Containment Vessels,” NUREG/CR-6920, SAND2006-3772P, Sandia 

National Laboratories, Albuquerque, NM. 

• Smith, J.A., 2001, “Capacity of Prestressed Concrete Containment Vessels with 

Prestressing Loss.” SAND2001-1762, Sandia National Laboratories, Albuquerque, NM. 

• Cherry, J.L. and J.A. Smith, 2001, “Capacity of Steel and Concrete Containment Vessels 

with Corrosion Damage.” NUREG/CR-6706, SAND2000-1735, Sandia National 

Laboratories, Albuquerque, NM. 

• Tang, H.T., R.A. Dameron, and Y.R. Rashid, 1995, “Probabilistic Evaluation of Concrete 

Containment Capacity for Beyond Design Basis Internal Pressures,” Nuclear 

Engineering and Design, 157, 455-467. 

• Hessheimer, M.F., E.W. Klamerus, L.D. Lambert, G.S. Rightley, and R.A. Dameron, 

2003, “Overpressurization Test of a 1:4-Scale Prestressed Concrete Containment 

Vessel Model.” NUREG/CR-6810, SAND2003-0840P, Sandia National Laboratories, 

Albuquerque, NM. 

• Dameron, R. A., et al., “Posttest Analysis of the NUPEC/NRC 1:4 Scale Prestressed 

Concrete Containment Vessel Model,” NUREG/CR-6809, March, 2003. 

• EPRI, “Methodology for Developing Seismic Fragilities,” EPRI Report TR-103959, Palo 

Alto, CA, June 1994. 

• EPRI, “Nuclear Plant Seismic Margin R-1,” EPRI Report NP-6041, Palo Alto, CA, August 

1991. 

• EPRI, “Seismic Fragility Application Guide,” EPRI Report 1002988, Palo Alto, CA, 

December 2002. 

• EPRI, “A Method for Assessment of Nuclear Power Plant Seismic Margin,” EPRI Report 

6041, October, 1988. 

• EPRI, “Seismic Evaluation Guidance – Screening, Prioritization and Implementation 

Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 

2.1: Seismic,” EPRI Draft Report, August, 2012. 

• Bohn, M.P. et al., “Analysis of Core Damage Frequency: Surry Power Station Unit 1, 

External Events,” NUREG/CR-4550, Vol. 3, Rev. 1, Part 3, December, 1990. 

• Lambright, J.A. et al., “Analysis of Core Damage Frequency: Peach Bottom, Unit 2, 

External Events,” NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, December, 1990. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

8-10 

• NRC, “A Performance-Based Approach to Define the Site-Specific Earthquake Ground 

Motion,” Regulatory Guide 1.208, March 2007. 

• ASME/ANS, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk 

Assessment for Nuclear Power Plant Applications,” ASME/ANS RA-Sa-2009, New York, 

NY, 2009. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-1 

9. Technical Approach for Fragility Analysis 

Fragility analysis is a supporting technical element in that it supports the development of the 

PRA model in several places. In supporting various other elements in the PRA, this element 

uses a common method. However, it is generally implemented differently depending on the 

context of the technical element that it is supporting. 

Typically, fragility analyses support PRA elements by providing the means to calculate damage 

state probabilities for a structure, system or component (SSC) given a hazard input level. As an 

example, for Level 1 reactor at-power PRA for seismic hazards, the hazard parameter could be 

peak ground acceleration (PGA), peak ground motion spectral acceleration averaged over a 

frequency range, in-structure spectral accelerations or others. For the Level 2 reactor at-power 

PRA for internal hazards, the hazard parameter could be the containment internal pressure 

calculated for a given accident progression sequence with the containment damage states 

defined in terms of a set (bins) of leakage areas. In this section, the term fragility analysis refers 

to the process used to derive or obtain fragility functions or data for SSCs. This process can be 

accomplished using a variety of methods including analysis, testing, testing and analysis, and 

collection of existing plant specific or surrogate fragility data. The process also depends on the 

manner in which SSC damage states can be related to the hazard input level. 

Fragility analysis typically require structural analysis inputs to estimate damage states of 

structures and certain components for various values of hazard parameters or to calculate 

relationships between hazard parameters, e.g. a PGA, and the loads on components or 

structures. The fragility analysis task includes both structural fragility analysis and component 

(and system) fragility analysis for which somewhat different implementations may be used. 

Fragility analysis frequently separate the uncertainties included in the analysis into aleatory and 

epistemic uncertainties. This permits assessing the sensitivity of the results to reductions in 

epistemic uncertainties through the definition of a type of confidence levels associated with the 

calculated damage probabilities. The need, significance and usefulness of this separation of 

uncertainties would depend on implementation requirements for specific PRA elements. 

Clearly, the specific fragility analysis techniques, level of detail, complexity of the methods used 

and approximations involved will differ markedly in its implementation for the various technical 

elements in the PRA and for different sub-elements of a given technical element. This section 

only provides those aspects of the technical approach that are common among all technical 

elements of the PRA. The section does not provide a breakdown of specific approaches, 

techniques and approximations for each technical element of the PRA other than by the use of a 

few examples to illustrate specific steps of the common approach. 

If fragility analysis (which includes generation and collection of fragility data) has already been 

performed or is being performed by the licensee, the work in the task may include the 

development of confirmatory reviews to verify the adequacy and suitability of the licensee’s 

analysis and results. The approach for the fragility analysis task is to rely on models and results 

produced by the licensee to the maximum possible extent, provided that the models and results 

have been reviewed and deemed adequate by the NRC staff. 

9.1 Assumptions and Limitations

The following is a list the general and common assumptions and limitations that define the 

scope and level of detail performed for this task. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-2 

• The complexity and details of the fragility analysis models can vary for the various 

technical elements that it supports and for different applications within a technical 

element depending on the uncertainties in the inputs, and the acceptable uncertainties in 

the results in relation to the other uncertainties in the technical element or sub-element. 

• The fragility analysis methods will depend, at least for fragilities derived by analytical 

methods, on the number of statistical simulations that may need to be performed in order 

to estimate probabilities of various damage states and adequate demand statistics to be 

used in conjunction with their use. 

• The complexity and details of the fragility analysis models should be commensurate with 

the details, completeness and reliability of available as-built plant data. 

• As-built information on SSCs of interest, rather than information accounted for in the 

design, can and should be used in the fragility analysis whenever available. 

• Plant-specific fragility analysis and resulting data already produced by the licensee will 

be assessed, reviewed and relied upon to the maximum extent possible if deemed 

applicable and if available in a manner compatible with the schedule for the Level 3 PRA 

study. 

• To the extent possible, the fragility analysis uses actual statistical data on the material 

properties for the various structural materials use in the plant structures and, if plantspecific data is not available, generic information and information from other sites from 

other sources will be used with justification to estimate statistics of relevant structural 

material properties. 

• State-of-the-practice fragility analysis methods will be used and adapted for the needs of 

each technical element. 

• To the extent possible, seismic fragility evaluation should be based on Capability 

Category II requirements of Section 5-2.2 of Part 5 of the ASME/ANS standard as 

endorsed by Regulatory Guide 1.200. Exceptions to these requirements for each 

implementation would depend on the adequacy of the resulting approximations for the 

PRA element. Unavailability of data may prevent the use of these requirements for 

certain SSCs for specific implementations in which case the affected components will be 

identified in the documentation. 

• Separation of uncertainties into aleatory and epistemic will depend on implementation 

requirements for each technical element of the PRA and on the availability of sufficient 

information for such separation. To the extent possible, all uncertainties would be 

aggregated into a total uncertainty with exceptions made depending on the requirements 

of each element implementation. 

The task will consider three sources of fragility data as follows: 

• Plant-specific fragility developed for the study plant using analysis or testing data, which 

can be data developed or being developed by the licensee, or data produced by analysis 

for this study. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-3 

• Compilation of site-specific (but not for the study site) data derived from past PRA 

studies (or margin studies as applicable) including NRC or industry sponsored research 

projects. 

• Generic data mostly developed from qualifying testing data produced by components’ 

manufacturers, independent manufacturers and various government sponsored 

programs, e.g. Department of Defense (DoD programs). 

Plant-specific data for the study plant produced by the licensee will be assessed and reviewed 

to determine their adequacy and applicability for each element of the PRA. When plant specific 

fragility data (and related hazard levels) are not available, site-specific (but not for the study site) 

and generic data will be used with justification. This justification would involve determining the 

degree to which the generic data are applicable to the plant SSCs. 

Fragility functions can be derived by testing and analysis. Analytical methods will usually be 

used for building structures and other structures such as liquid storage tanks and their 

anchorages. The fragility of most components in the seismic equipment list (SEL) will likely be 

qualified by testing. In this case, review of fragility data, especially plant-specific data, will be 

informed by E.5 in Reference 17 (Electric Power Research Institute (EPRI) report 1002988, 

“Seismic Fragility Application Guide,” issued in 2002). 

In the case of Level 1 reactor at-power PRA for seismic hazards, fragility analysis will generally 

follow the guidance in Reference 19 (EPRI Draft Report, “Seismic Evaluation Guidance – 

Screening, Prioritization and Implementation Details (SPID) for the Resolution of Fukushima 

Near-Term Task Force Recommendation 2.1: Seismic,” August, 2012). In the case of SSCs 

qualified by analysis, that guidance recommends the use of the Conservative Design Failure 

Margin (CDFM) approach as the default fragility analysis approach. If the licensee already 

derived or is deriving fragility functions using a more rigorous approach, namely the separation 

of variables approach, that analysis will be reviewed and used if found adequate and if available 

in a timely manner. 

9.2 Inputs 

This section addresses design, maintenance and operational information required to perform 

the associated steps in the fragility analysis task. Table 9-1 is a list of the minimum information 

needed for the structural analysis task. 

Table 9-1. Needed Inputs for Fragility Analysis 

Input Description(1) 

Design and 

as-built data 

• List of safety-related structures for which fragility analysis will be done, e.g., 

a seismic equipment list (SEL) in the case of the Level 1 reactor at power 

PRA. Examples of items to be included in this list are seismic Category I 

structures, structures housing mitigation (B5B) equipment, storage tanks, 

pipe runs between buildings, and water intake structures. The contents of 

the list vary depending on the PRA element of interest. 

• For the structures (including foundations) and components in this list the 

inputs needed are those already listed for the structural analysis task 

(Section 8). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-4 

Table 9-1. Needed Inputs for Fragility Analysis 

Input Description(1) 

• Results of material properties testing for all structural material properties of 

interest, including assessments of current (e.g. concrete strength increase 

with time) material properties if made and available. 

• Foundation drawings with structural and geotechnical details. 

• Site soil conditions to include: geologic data on site; soil configurations (e.g. 

layering, horizontal variability, soil types and soil index properties); 

subsurface exploration information (e.g. boring information); and ground 

water data. 

• Static and dynamic soil properties from in-situ field tests and laboratory 

data. Examples include dynamic bearing capacities, penetration 

resistances, densities, and friction angles. 

• For Level 1 reactor at-power PRA for seismic hazards this would include 

geotechnical data needed to assess geotechnical damage states such as 

(1) seismic liquefaction and settlement of soils, (2) foundation sliding, (3) 

relative building movements, (4) underground piping, (5) intake structures, 

(6) intake tunnel, and (7) ultimate heat sink. 

• For the Level 3 reactor at-power PRA fragility data may need to be 

collected and expressed in a manner consistent with regional seismic 

hazard for infrastructure facilities that may impact evacuation. These would 

fragility data of the type used in regional seismic loss estimate programs 

(e.g. HAZUS) for bridges, roads, emergency command and control facilities 

and others. 

Modeling 

and 

Analysis 

• Methods used for the fragility analysis for each type of SSC. This includes 

the methods used for structures (e.g., CDFM or separation of variables 

(seismic hazards)), and the methods used for components, including 

components qualified by testing. 

• Type of approach to be used for each SSC: (1) plant specific, (2) site 

specific (but not for this plant), and (3) generic data. 

• For each SSC, collection of uncertainty information, preferably quantitative 

uncertainty information, to be included in the analysis for each SSCs and 

whether or not separation of uncertainties into aleatory and epistemic will 

be included in the fragility analysis. 

Inputs from 

other 

elements 

• Identification and definition of hazard parameter of interest and related 

structural or component damage indices for the structures and components 

in the SEL. This also includes identification of demands of interest, e.g. 

floor spectral accelerations in the case of seismic hazards. 

• Relevant structural analysis results namely demands and damage 

statistics. In the case of seismic hazards, this includes in-structure 

response spectra (ISRS) data, correlations of ISRS values, and value of 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-5 

Table 9-1. Needed Inputs for Fragility Analysis 

Input Description(1) 

damage state indices as well as the relation between all of the above and 

the hazard parameter of interest. In the case of Level 2 for internal hazards 

this includes liner strains or leakage areas for given internal pressure 

levels. 

• Results of relevant structural analyses performed or being performed by the 

licensee. This includes results referred to in the FSAR, studies such as the 

IPE, and ongoing PRA studies. 

• Loads of interest - As an example, in the case of Level 1 reactor at-power 

PRA for seismic hazards, this includes ground motion response spectra 

(GMRS) for the site, and sets of ground motion time-histories (in threedirections) for dynamic structural analyses including soil-structure 

interaction analysis. In the case of Level 2 reactor at-power PRA for 

internal hazards, this includes static containment internal pressures and 

temperatures (with time) inside the containment, and dynamic loads 

(pressures) time-histories for events associated with burning of combustible 

gases. 

• For the PRA elements involving seismic hazard, accelerations and strain 

levels imposed on the foundation soils as needed for soil-structureinteraction analyses, for each seismic bin. This includes seismic loads 

calculated in the seismic hazards task that would be used to assess 

fragilities for certain soil and geotechnical failure modes. 

(1) – Some of the above information would be confirmed or gathered though one or more plant visit or plant walkdown. An 

essential element of such plant visits should be meetings with plant and licensee structural and component analysts/engineers. 

The plant visits should also inform about as-built conditions that may not be available in design drawings or reports but might

contribute to the actual capacity of structures and components. This plant visit (or visits) should include component fragility 

analysts and structural fragility analysts. 

9.3 Analysis Steps

The common technical approach for structural analysis consists of the following interrelated 

steps: 

Step 1 – Selection of SSCs for which fragility analysis will be performed 

Step 2 – Define fragility damage states and related hazard input parameters 

Step 3 – Assess available information 

Step 4 – Define the analysis approach 

Step 5 – Obtain and gather input and fragility data 

Step 6 – Perform fragility analysis 

Step 7 – Documentation 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-6 

Step 1 – Selection of equipment for which fragility analysis will be performed

The objective of this step is to identify by interaction with the plant response analysts the SSCs 

for which in fragility analysis will be performed, e.g. the SEL for Level 1 at power PRA. This 

step would include an initial screening of SSCs based on their generically high capacities or lack 

of interactions with safety-related SSCs. This step is closely related to Step 5 (Obtain and 

gather input and fragility data) and would include a plant walkdown. 

Step 2 – Define damage states and related hazard input parameters 

The objective of this step is to define the damage states and related hazard input parameters. 

For Level 2 reactor at-power PRA for internal hazards, examples of results of damage states 

are sets (bins) of leakage areas and the related hazard parameter of interest would be the 

containment internal pressure. For Level 1 reactor at-power PRA for seismic hazards an 

example of a damage state is irrecoverable loss of function of a component expressed in terms 

of a test response spectrum (TRS) and the related hazard parameter could be a PGA. In this 

case, the relation between the ISRS (required response spectra at the component location) and 

the PGA at the SSC location may be necessary. 

A clear definition of the damage states, related hazard input parameter and methods to relate 

the damage state to the hazard input level is needed. Interaction with specific PRA elements 

will provide these definitions. This step also determines the level of approximations acceptable 

for each fragility function and the statistics of the related hazard input parameters. This includes 

a preliminary identification of which uncertainties will be included in the fragility analysis and if 

separation of uncertainties into aleatory and epistemic is required for the specific 

implementation. 

Step 3 – Assess available information 

The objectives of this step for each technical element are: 

• To review the applicability and adequacy of the available fragility data in relation to the 

requirements of the specific implementation. This part includes assessing the existence 

and availability of data or analysis already produced or being produced by the licensee. 

• To review and assess licensee data and analyses including plans for data gathering and 

fragility analysis for their current PRA effort. Part of this assessment will address the 

availability, in relation to the schedule for the Level 3 PRA project, of licensee’s data and 

analyses. Results of this assessment will affect the content of subsequent steps. 

• To assess inputs for the fragility analysis in terms of the demands on structures to be 

provided by interfacing tasks. In the case of Level 1 reactor at-power PRA for seismic 

hazards, this task will include an assessment of ISRS data statistics to be provided by 

the structural analysis task and its relation to the ground motion information provided by 

the interfacing seismic hazard task. In the case of Level 2 reactor at-power PRA for 

internal hazards, this task would include assessing statistics of containment leakage 

areas for varying internal pressure pressures to be provided by the structural analysis. 

• Develop a preliminary SSC list for each interfacing PRA element for which fragility 

analysis will be performed. In the case of Level 1 reactor at-power PRA, this is the SEL. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-7 

Section 8.2 of the technical approach for the structural analysis task provides additional 

information to be assessed in this step. 

Step 4 – Define the analysis approach 

The objectives of this step are: 

• To define, for each implementation and SSC, the fragility analysis approach. Included in 

this process is the selection of the source of fragility (Section 9.1) and its justification. 

• To establish acceptable approximation level requirements for the fragility analyses. 

• To define the statistical simulations or sensitivity analysis approaches to be used in 

conjunction with the structural analysis. 

Given the type of results needed and their level of approximation, this step will establish: 

• The level of complexity and detail of the models to be used 

• The level of approximations in the supporting analyses 

• The type of statistical simulations (and sampling techniques) or sensitivity analyses that 

will need to be executed to obtain the necessary fragility functions and confidence levels 

(if needed) 

It also will inform selection of the structural analysis codes to be used for the analysis. Products 

of this task will be specific to the technical element that the task is supporting. The task will take 

into consideration the quality and type of data available, the uncertainties involved in relation to 

uncertainties in the interfacing tasks, and the availability of resources and scheduling 

requirements in reaching its objectives. 

If fragility analysis (which includes generation and collection of fragility data) have already been 

performed or are being performed by the licensee, the work in the task would include review fo 

the licensee’s work to verify their adequacy for the Level 3 PRA project. The approach for the 

fragility analysis task is to rely on models and results produced by the licensee to the maximum 

possible extent, provided that the models and results have been reviewed and deemed 

adequate by the NRC staff. 

When plant specific fragility data (and related hazard levels) are not available, site-specific (but 

not for the study site) and generic data will be used with justification. This justification would 

involve determining the degree to which the generic data are applicable to the plant SSCs. 

Initial fragility estimates derived on these bases can be revised when the plant specific fragilities 

become available. 

Step 5 – Obtain and gather input and fragility data 

The objective of this step is to obtain as-built and operational information for the plant structures 

and components. To the extent possible, as-built structural and current information instead of 

design information should be used in the structural analyses. In addition to information already 

listed for the interfacing structural analysis task (Section 8), the information to be gathered 

includes: 

• Plant-specific fragility data. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-8 

• Site-specific (but not for this plant) fragility data. 

• Relevant generic fragility data (as needed). 

• Definition of a SSC list for which fragility analysis (including collection and review of 

fragility) will be performed. 

• Component and system locations. 

• Component qualification data as available. 

• Penetrations, pipe runs between buildings, anchorages to floors, masonry blocks near 

safety-related equipment, underground piping, intake structures and tunnel, soil 

formations at the site, intake tunnel, ultimate heat sink and others, to be obtained from 

plant layout and drawings as well as from plant visits or walkdowns. 

• Data for quantification of uncertainties for fragility analysis. As an example, for certain 

SSCs to be qualified by analysis this would include statistics on material properties 

which would be propagated through the fragility analysis (and supporting structural 

analyses). For other components guidance on uncertainty data to be collected is 

provide in the references listed at the end of this section, namely Reference 17. 

Step 6 – Perform fragility analysis 

The objectives of this step are: 

• Development of fragility analysis process (for each SSC and PRA implementation). 

• Execution of the fragility analysis process. 

• Collect of the end results in the manner necessary for the interfacing tasks. 

Step 7 – Documentation

The objective of this step is to aggregate the documentation, inputs, assumptions, modeling and 

analysis techniques chosen with the justification for their selection, and results for each step. 

This step also involves compiling and documenting the information for task and its steps in a 

manner consistent with the database for the Level 3 PRA project. 

9.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 9.2) should be sufficient for an independent analyst to understand 

how the analysis was performed and to reproduce the results. Consequently, the list of 

products includes both interim and final products. Table 9-2 provides the expected products. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-9 

Table 9-2. Documentation Needs for Structural Analysis 

• List of safety-related SSCs for which fragility analysis will be done, e.g. seismic 

equipment list (seismic hazards). 

• Damage states, damage indices and hazard input parameters for each SSC 

fragility of interest. 

• Description of the assumptions, and method for the fragility analysis for each SSC. 

This includes justification of the approach used in relation to the options described 

here and per the criteria for the selection of the acceptable approximations. This 

includes a description of the methods used to relate a SSC fragility to the hazard 

input parameter. This also includes justification for the choice of a given method 

and for the use of surrogate (generic or site-specific but not for this site) fragility 

data. 

• Description of the analysis models (actual input files used for the final runs will be 

part of the archived information). 

• Description of the uncertainties contributing to the total uncertainties in the fragility 

estimation (whether or not the uncertainties are separated into aleatory or 

epistemic uncertainties). This includes uncertainties in the methods used to relate 

the fragility to the hazard parameter input level. 

• Tables of component fragilities in terms of medians and coefficients of distribution 

for their assumed or derived probability distribution functions. 

• Detailed description of the interfaces with other PRA elements to include values of 

the damage indices to be used in conjunction with fragility calculations and 

justification of the consistency for the statistical descriptions used to represent 

related quantities from various PRA elements. 

• Provide the products in a manner suitable for incorporation in the database for the 

Level 3 PRA study. 

9.5 Task Interfaces

The technical elements that interface with task element are: 

• Level 1 reactor, at-power PRA for seismic hazards 

• Seismic hazard analysis 

• Structural analysis 

• Level 2 reactor PRA, at-power for internal events 

• Quantification of spent fuel pool PRA 

• Quantification of the dry cask storage PRA 

Depending on the hazards and level of detail for other elements of the entire PRA, there may be 

interfaces between the structural analyses and these elements. These elements may include: 

• Level 1 reactor, low-power and shutdown for all hazards 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-10 

• Level 3 aspects that would involve evacuations that would be affected by infrastructure 

damage from seismic events 

Level 1 reactor, at-power PRA for seismic hazards – Fragility analysis provide means to express 

SSC damage state probabilities in terms of a hazard input level. For this PRA element the 

hazard input is defined in terms of ground motion severity indices derived in the seismic hazard 

analysis task. The fragility analysis for this PRA element relies on the structural analysis task 

for the relation between the damage state and the seismic hazard input parameter (or 

parameters). As an example, the fragility of a component may be defined in terms of ISRS 

accelerations. The structural analysis provides the relation between the ISRS acceleration 

statistics and the ground motions indices defining the hazard input level. This interface requires 

consistency among the test response spectra to express the component fragility, the calculated 

demands in terms of ISRS statistics, and statistical characterization of the hazard parameter 

input level. In general, the fragility analysis should use median centered demands from the 

structural analysis. The fragility analysis also should take into account for the uncertainties in 

the relationship between the hazard input parameter and the ISRS accelerations. 

Seismic hazard analysis – Use of fragility data for Level 1 reactor, at-power PRA for seismic 

hazards requires as input seismic loads on structures (e.g. stresses) and ISRS accelerations 

derived from the structural analysis and seismic hazard tasks. Uncertainties in the relation 

between loads on structures (e.g. stresses) and components (ISRS) and hazard input 

parameters (e.g. PGA) need to be included in the fragility assessments. The large uncertainties 

in the seismic hazard input parameters and the level of this parameter also should be taken into 

account when defining acceptable approximation levels for the fragility analysis for the various 

SSCs. 

Structural analysis – In the case of seismic hazards, fragility analysis for structures and various 

components and systems requires the use of structural analysis to calculate damage states for 

these SSCs given input ground motions for a given seismic bin. In addition, ISRS calculated 

using dynamic structural analyses are also used in conjunction with fragility information for 

components and systems to estimate probabilities of failure for these components for a given 

seismic bin. This dependency requires defining the fragility functions in a manner that is 

consistent with the demands provided by the structural analyses and that accounts for the 

uncertainties in the calculation of these demands given the ground motions specified by the 

seismic hazard task. For Level 2 reactor at-power PRA, the structural analysis provides the 

damage states for the fragility analyses. Uncertainties in the calculation of those damage states 

need to be accounted for in the fragility analysis and characterized in a manner consistent with 

the assumptions in the fragility models. 

Level 2 reactor PRA, at-power for internal events – Fragility analysis calculates the probabilities 

of various leakage areas under internal pressurization and temperature load histories from the 

accident progression analyses. Interfacing with this element also will include establishing a list 

of SSCs for which structural analysis will be necessary and provide the load types (static or 

dynamic) and their characterizations. Interfacing with this element and the fragility analysis 

element also will establish the type of structural response parameters of interest and the types 

of structural analysis modeling and analysis adequate for each SSC of interest. Uncertainties in 

the definition of these loads also guide the selection of the level of approximations acceptable 

for the fragility analysis task. 

Quantification of spent fuel pool PRA – Fragility analysis would quantify damage states 

probabilities for the spent fuel structure and other spent fuel cooling systems that are necessary 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-11 

to calculate the spent fuel performance and condition for, as an example, a given seismic bin. 

Damage data needed for the quantification of the spent fuel pool PRA would be used in Step 1 

of the technical approach for the structural analysis element to set the fragility analysis scope for 

the spent fuel pool PRA. 

Quantification of the dry cask storage PRA – Fragility analysis results may be needed to provide 

inputs to the dry cask storage PRA for accidental drops or drops that might be caused by 

seismic events. The scope of the fragility analyses for this element will depend on the extent to 

which results from prior PRAs or from analyses already being produced by the licensee can be 

relied upon. Interfacing with this element will depend on the hazard that the element will 

consider (e.g. seismic hazards) and whether their assessment will require fragility analyses. 

9.6 References

The following is a partial list of technical reports, technical articles, regulatory guides and 

standards that can and should be used in performing this task. The emphasis is on fragility 

analysis methods and analytical modeling approaches used in conjunction with risk 

assessments or assessments for beyond-design-basis accidents. 

• VEGP, “Final Safety Analysis Report (FSAR) - Vogtle Electric Generating Plant, 

Revision 15,” April, 2009. 

• VEGP, “Vogtle Electric Generating Plant Individual Plant Examination Submittal,” 

Georgia Power, December 23, 1992. (Volume 1 and Volume 2) (Also response to NRC 

Requests for Additional Information). 

• VEGP, “Vogtle Electric Generating Plant Unit 1 and Unit 2 Individual Plant Examination 

of External Events Submittal 0,” Georgia Power, November 1995 (Volume 1 and Volume 

2) (Also response to NRC Requests for Additional Information). 

• NRC, “Staff Evaluation Report of Individual Plant Examination of External Plant (IPEEE) 

Submittal on Vogtle Electric Generating Plant, Units 1 and 2,” Nuclear Regulatory 

Commission (NRC), December 2000. 

• NRC, “Staff Evaluation Report of Individual Plant Examination (IPE) Submittal on Vogtle 

Electric Generating Plant, Units 1 and 2,” Nuclear Regulatory Commission (NRC). 

• NRC, “An Approach for Determining the Technical Adequacy of Probabilistic Risk 

Assessment Results for Risk-Informed Activities,” RG 1.200, Revision 2, March 2009. 

• NRC, “Containment Structural Integrity Evaluation for Internal Pressure Loadings Above 

Design Basis Pressure,” Regulatory Guide 1.216, August, 2010. 

• NRC, “Interim Staff Guidance on Implementation of a Probabilistic Risk AssessmentBased Seismic Margin Analysis for New Reactors,” ISG-DC/COL-020, March, 2010. 

• Spencer, B.W., J.P. Petti, and D.M. Kunsman, 2006, “Risk-Informed Assessment of 

Degraded Containment Vessels,” NUREG/CR-6920, SAND2006-3772P, Sandia 

National Laboratories, Albuquerque, NM. 

• Smith, J.A., 2001, “Capacity of Prestressed Concrete Containment Vessels with 

Prestressing Loss.” SAND2001-1762, Sandia National Laboratories, Albuquerque, NM. 

• Cherry, J.L. and J.A. Smith, 2001, “Capacity of Steel and Concrete Containment Vessels 

with Corrosion Damage.” NUREG/CR-6706, SAND2000-1735, Sandia National 

Laboratories, Albuquerque, NM. 

• Tang, H.T., R.A. Dameron, and Y.R. Rashid, 1995, “Probabilistic Evaluation of Concrete 

Containment Capacity for Beyond Design Basis Internal Pressures,” Nuclear 

Engineering and Design, 157, 455-467. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

9-12 

• Hessheimer, M.F., E.W. Klamerus, L.D. Lambert, G.S. Rightley, and R.A. Dameron, 

2003, “Overpressurization Test of a 1:4-Scale Prestressed Concrete Containment 

Vessel Model.” NUREG/CR-6810, SAND2003-0840P, Sandia National Laboratories, 

Albuquerque, NM. 

• Dameron, R. A., et al., “Posttest Analysis of the NUPEC/NRC 1:4 Scale Prestressed 

Concrete Containment Vessel Model,” NUREG/CR-6809, March, 2003. 

• EPRI, “Methodology for Developing Seismic Fragilities,” EPRI Report TR-103959, Palo 

Alto, CA, June 1994. 

• EPRI, “Nuclear Plant Seismic Margin R-1,” EPRI Report NP-6041, Palo Alto, CA, August 

1991. 

• EPRI, “Seismic Fragility Application Guide,” EPRI Report 1002988, Palo Alto, CA, 

December 2002. 

• EPRI, “A Method for Assessment of Nuclear Power Plant Seismic Margin,” EPRI Report 

6041, October, 1988. 

• EPRI, “Seismic Evaluation Guidance – Screening, Prioritization and Implementation 

Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 

2.1: Seismic,” EPRI Draft Report, August, 2012. 

• Bohn, M.P., et al., “Analysis of Core Damage Frequency: Surry Power Station Unit 1, 

External Events,” NUREG/CR-4550, Vol. 3, Rev. 1, Part 3, December, 1990. 

• Lambright, J.A. et al., “Analysis of Core Damage Frequency: Peach Bottom, Unit 2, 

External Events,” NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, December, 1990. 

• NRC, “A Performance-Based Approach to Define the Site-Specific Earthquake Ground 

Motion,” Regulatory Guide 1.208, March 2007. 

• ASME/ANS, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk 

Assessment for Nuclear Power Plant Applications,” ASME/ANS RA-Sa-2009, New York, 

NY, 2009. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

10-1 

10. Technical Approach for Hazard Analysis 

The development of the site-specific seismic hazard estimates is a supporting technical element 

in that it supports the development of the PRA model in several places. In supporting various 

other elements in the PRA, this element uses a common method; however, it may be 

implemented differently dependent on the context of the technical element it is supporting. The 

process used in the development of seismic hazard estimates will not differ for the case of Level 

1 or Level 2 PRA studies. For a Level 3 study some additional development may be required as 

described below. 

The development of seismic loads for use in the calculation of demands on, or in, structures, 

systems and components (SSCs) important to the PRA model consists of several interrelated 

steps. In a broad sense these steps involve the estimation of site-specific seismic hazard values 

for a representative range of structural frequencies and over a broad range of ground motion 

amplitudes. The overall objective of this element is to produce seismic hazard estimates at one 

or more locations (map coordinates and depths) that capture the uncertainties in the seismic 

source characterization, ground motion prediction, and site response models while preserving 

relative hazard levels (i.e., annual frequencies of exceedance). 

The general procedure that will be followed can be summarized as follows: develop seismic 

hazard estimates using the latest data and models for a reference rock site condition, then, 

based on a geotechnical characterization of the site, develop site-specific amplification functions 

and produce soil hazard curves. Interaction with PRA and structural analysis teams and with the 

Level 3 team involved with the emergency planning portion of the study will be required. 

Available information on site characteristics will utilized to the maximum extent practicable. The 

specific steps are outlined in Section 10.4 below. 

10.1 Assumptions and Limitations

The following are a list the general and common assumptions and limitations that define the 

scope and level of detail performed for this task. 

• The seismic source characterization and ground motion prediction steps will utilize the 

latest available regional models (NUREG-2115 and EPRI (2004, 2006), for example). 

• This discussion has assumed a site in the central and eastern U.S. will be used for this 

project. 

• This discussion has assumed that the facilities of interest are located on either soil or 

soft rock and site response calculations will be required. 

• All available information regarding site geotechnical and geophysical properties will be 

made available for the team. 

• The scope of the site response calculations will be determined by the level of information 

available for the facility chosen for the project. 

• This discussion has assumed that a relatively small number of locations and elevations 

for specification of ground motions and dynamic material properties will be required. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

10-2 

• This discussion has assumed that a summary of potential earthquake-related impacts to 

transportation infrastructure may need to be developed. It has not assumed that detailed 

structural analyses or fragility estimates of off-site transportation facilities will be 

developed as part this study. 

10.2 Inputs 

Table 10-1. Needed Inputs for Task 10 

Input Description 

Seismic source 

characterization and 

ground motion 

prediction models 

Step 3: Calculate seismic hazard curves for reference rock 

conditions 

Summary of locations 

where ground 

motions and dynamic 

material properties 

are required 

Step 4: Identify control points 

Geotechnical and 

geophysical data for 

subject facility 

Step 5: Calculate amplitude and frequency dependent site 

amplification functions 

Summary of 

requirements 

additional analyses 

for Level 3 study 

Step 8: Level 3 Interface 

10.3 Analysis Steps

The specific steps required in this task are outlined below. 

Step 1 – Interface with PRA and structural analysis teams. The objective of this step is to 

compile a list of potentially risk-significant SSCs and define the location and depth of 

embedment of these SSCs. This step will define the number and locations for which 

ground motion estimates are required. 

Step 2 – Compile available site specific information on the geological/geotechnical 

characteristics of the facility. The objective of this step is to assemble the relevant 

information that will be needed to characterize the site and develop base case shearwave velocity models and dynamic material property curves. 

Step 3 – Calculate rock seismic hazard. The objective of this task is to produce seismic 

hazard curves for the appropriate reference rock conditions. 

Step 4 – Identify control point(s) for the development of soil ground motion hazards. For 

sites with soil founded SSCs of interest, the objective of this task is to identify an 

appropriate elevation(s) for definition of seismic hazard curves. 

Step 5 – Develop frequency-dependent site amplification functions (median and 

logarithmic standard deviation) for an appropriate range of input ground motion 

amplitudes. The objective of this task is to produce an estimate of the median 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

10-3 

amplification (or de-amplification) of soil hazard relative to the rock input motions as well 

as an estimate of the variability about that median value. 

Step 6 – Develop hazard consistent seismic hazard curves at all elevations of interest. 

The objective of this step is to develop the final surface hazard curves, this step must 

incorporate the uncertainty in site amplification functions estimated in Step 5. 

Step 7 – Develop acceleration time histories and response spectra as needed for input 

to structural analyses. Based on the results of the site response analyses produce 

strain-compatible modulus and damping information if required for soil-structure 

interaction calculations. 

Step 8 – Interact with Level 3 team to define potential seismic impacts on transportation 

infrastructure and potential implications on evacuation and emergency planning. 

The following table provides a list of items that need to be documented for the steps described 

above: 

Table 10-2. Documentation Needs for Steps of Task 10 

Item Description 

Steps 1, 2, and 3 Summary of site characteristics and desired control point 

locations. Documentation should include basis for selected 

control points based on the assessment in Step 1. 

Step 4 Summary description and results of PSHA for rock site 

conditions. Documentation should include a discussion of 

seismic source characterization and ground motion prediction 

models used. Results should include fractile hazard values 

as well as mean. 

Step 5, 6, and 7 Summary of final hazard results. The documentation should 

include a discussion of data used, treatment of uncertainties 

as well as a summary of results. Results include soil hazard 

curves, strain-compatible material properties and 

acceleration time histories for structural analyses. 

Step 8 Summary of seismic impacts on off-site infrastructure (if 

required). 

10.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 10.3) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. Table 10-1 

provides, at a minimum, the expected products. 

Table 10-3. Expected Products for Subtask 10 

Product Description 

Locations (spatial 

and elevation) of 

important SSCs 

Step 1: Interface with PRA and structural analysis teams 

Summary of the 

Geotechnical 

Step 2: Compile geotechnical information (interim product) 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

10-4 

Table 10-3. Expected Products for Subtask 10 

Product Description 

characterization of 

the site 

Seismic hazard 

curves for reference 

rock site conditions 

(mean and fractiles) 

Step 3: Calculate rock seismic hazard (interim product) 

Identification of 

horizontal and 

vertical locations for 

final hazard outputs 

Step 4: Identification of control point(s) (final product) 

A set of frequency 

dependent 

amplification 

functions (median 

and logarithmic 

standard deviations), 

and strain compatible 

dynamic properties 

Step 5: Development of frequency-dependent amplification 

functions (final product) 

Seismic hazard 

curves for soil 

conditions at control 

point locations 

Step 6: Develop soil hazard curves (final product) 

Suite of acceleration 

time histories and 

response spectra 

Step 7: Develop acceleration time histories and response 

spectra (final product) 

Summary of potential 

seismic impacts on 

off-site infrastructure 

(transportation etc.) 

Step 8: Identify potential infrastructure impacts for Level 3 

assessment (interim product) 

10.5 Task Interfaces

The various technical steps of the seismic hazard technical element are dependent on, or 

interface with, other technical elements for information in order for the step to be completed. 

These interfaces are as follows: 

• Steps 1 and 4 require the identification of potentially risk-significant SSCs and define the 

location and depth of embedment of these SSCs and consequently the control point 

locations. This list will be developed through interaction with the PRA and structural 

analysis teams. 

• Step 2 requires compilation of information on the geological and geophysical 

characteristics of the site. This requires interface with the licensee(s) to develop a 

complete suite of the data necessary to develop an acceptable subsurface 

characterization of the site. 

• Step 7 will produce the final time histories and response spectra for use in the structural 

analyses. This step will require coordination and interface with the structural analysis 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

10-5 

and fragility teams to define the number of and appropriate loading levels for this 

products. 

• Step 8 requires interaction with the Level 3 team to define potential seismic impacts on 

transportation infrastructure and potential implications on evacuation and emergency 

planning. 

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• Step 6 produces soil hazard curves which are the products required in the final SPRA 

calculations. 

• Step 7 will produce acceleration time histories and response spectral shapes which are 

products required for the structural analysis and fragility calculations. 

• Step 8, if required, will produce a summary of potential earthquake impacts on local 

transportation infrastructure. This would be an input to any Level 3 emergency planning 

and/or evacuation assessment. 

10.6 References

The following is a partial list of technical reports, technical articles, regulatory guides and 

standards that can and should be used in performing this task. The emphasis is on developing 

seismic hazard estimates for sites that quantitatively incorporate the uncertainties inherent in 

these types of analyses. The process should provide clear and transparent linkage to the 

structural analysis and SPRA elements. 

• EPRI, “Seismic Evaluation Guidance – Screening, Prioritization and Implementation 

Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 

2.1: Seismic,” EPRI Draft Report, August, 2012. 

• U.S. Nuclear Regulatory Commission, “A Performance-Based Approach to Define the 

Site-Specific Earthquake Ground Motion,” Regulatory Guide 1.208, Washington, DC, 

March 2007. 

• U.S. Nuclear Regulatory Commission, “Recommendations for Probabilistic Seismic 

Hazard Analysis: Guidance on Uncertainty and Use of Experts,” NUREG/CR-6372, 

Washington, DC, 1997. 

• U.S. Nuclear Regulatory Commission, “Practical Implementation Guidelines for SSHAC 

Level 3 and 4 Hazard Studies,” NUREG-2117, Washington, DC, 2012. 

• ASME/ANS, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk 

Assessment for Nuclear Power Plant Applications,” ASME/ANS RA-Sa-2009, New York, 

NY, 2009. 

• McGuire, R. K., W. J. Silva, and C. Constantino, “Technical Basis for Revision of 

Regulatory Guidance on Design Ground Motions: Hazard and Risk-Consistent Ground 

Motion Spectra Guidelines,” NUREG/CR-6728, prepared for U.S. Nuclear Regulatory 

Commission, Office of Nuclear Regulatory Research, Division of Engineering 

Technology, 2001. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

11-1 

11. Technical Approach for Uncertainty Analysis 

11.1 Introduction

The Uncertainty Analysis consists of determining the variability of the results of the events 

modeled in Probabilistic Risk Assessment (PRA). The following list provides the major steps 

where this technical event is supporting. 

• Parameter Uncertainty relates to the uncertainty in the computation of the input 

parameter values used to quantify the probabilities of the events in the PRA logic model. 

Examples of such parameters are initiating event frequencies, component failure rates 

and probabilities, and human error probabilities. These uncertainties can be 

characterized by probability distributions that relate to the analysts’ degree of belief in 

the values of these parameters (which could be derived from simple statistical models or 

from more sophisticated models). 

• Model Uncertainty arises because different approaches may exist to represent certain 

aspects of plant response and none is clearly more correct than another. Uncertainty 

with regard to the PRA results is then introduced because uncertainty exists with regard 

to which model appropriately represents that aspect of the plant being modeled. In 

addition, a model may not be available to represent a particular aspect of the plant. 

Uncertainty with regard to the PRA results is again introduced because there is 

uncertainty with regard to a potentially significant contributor not being considered in the 

PRA. 

11.2 Assumptions and Limitations

• All assumptions addressed in all other subtask technical approaches are applicable to 

uncertainty analysis and they may be part of the inputs of uncertainty analysis. 

• All parameters (e.g., initiating event frequencies, human error probabilities, and common 

cause failure probabilities) will be estimated as a distribution in each related sub-task. If 

any parameter cannot be estimated as a distribution, a qualitative uncertainty analysis 

will be provided. 

• Only parameter uncertainty and model uncertainty are analyzed. Completeness 

uncertainty is not in the scope of the uncertainty analysis for this study. 

• The Monte Carlo Method will be applied to estimate the uncertainty propagation of 

parameter uncertainty. 

• Sensitivity test will be applied to evaluate the model uncertainty. 

• All limitations to evaluate each single parameter addressed in each related subtask are 

applicable to this uncertainty analysis. 

11.3 Inputs 

• Inputs for parameter uncertainty of basic event are same as inputs for each basic event 

addressed in its related subtask approach. For example, inputs for uncertainty of HEP 

are same as inputs for HEP and they are addressed in HRA subtask approach. 

• Parameter uncertainties of basic events and cutsets generated from quantification 

subtask are the inputs to evaluate the parameter uncertainty of risk metric. 

• Assumptions made in any subtask will be the inputs to evaluate the model uncertainty. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

11-2 

11.4 Analysis Steps

The Uncertainty Analysis consists of the following steps: 

• Parameter Uncertainty of Basic Event: 

There are three acceptable methods for characterizing the parameter uncertainty of the 

parameters of the basic events: (1) the frequentist method, (2) Bayesian updating, and 

(3) expert judgment. The three methods are briefly described below; however, only the 

Bayesian updating approach will be used for the significant basic events. 

o Frequentist Method -- Frequentist approach provides a point estimate (usually the 

maximum likelihood estimate) and provides confidence bounds at specified levels of 

confidence. This approach is used when a rough estimate of a parameter is all that is 

required. 

o Bayesian Updating -- Using a probability model (for example, exponential 

distribution) to calculate the probability of a basic event or frequency of an initiating. 

o Expert Judgment -- The expert judgment approach relies on the knowledge of 

experts in the specific technical field who arrive at “best estimates” of the distribution 

of the probability of a parameter or basic event. This approach is typically used 

when detailed analyses or evidence concerning the event represented by a basic 

event are very limited or unavailable. Such a situation is usual in studying rare 

events. Ideally, this approach provides a mathematical probability distribution with 

values of a central tendency of the distribution (viz., the mean) and of the dispersion 

of the distribution, such as the 5th and 95th percentiles. The distribution represents 

the expert or “best available” knowledge about the probability of the parameter or 

basic event. 

• Parameter Uncertainty of Risk Metric: 

Evaluating the risk metric and associated probability distribution includes five steps: 

(1) evaluate point-estimate of the PRA model, (2) enter parameter uncertainty data for 

basic events into the PRA code, (3) define epistemic correlation (EC) groups, 

(4) establish the significance of the EC, and (5) propagate parameter uncertainty in the 

PRA Model. Each of these steps is briefly described below, and Figure 11-1 illustrates 

the approach for obtaining the mean value and parameter uncertainty of a risk metric. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

11-3 

Figure 11-1 Approach for Obtaining the Mean Value and Parameter Uncertainty of a Risk 

Metric 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

11-4 

o Evaluate Point-estimate of the PRA Model -- A solution of the PRA model yields the 

cutsets of the logic model of the PRA. The PRA computer code then can generate a 

point estimate of the CDF or LERF by quantifying these cutsets. It employs the point 

estimates of the basic events to obtain the point estimate of the CDF or LERF. The 

point estimate of each basic event, including each initiating event, should equal the 

mean value. 

o Enter Parameter Uncertainty Data for Basic Events into PRA Code -- For each basic 

event in the PRA model, the information about the probability distribution of each of 

its parameters is entered into the PRA code. The distributions of the parameters of 

all basic events are used subsequently to propagate parameter uncertainty through 

the PRA model. 

o Define EC Groups -- When evaluating the PRA model to assess a risk metric, the 

correlation between the estimates of the parameters of some basic events of the 

model needs to be taken into account. The correlation occurs because, for basicevent models employing the same parameters, the state of knowledge about these 

parameters is the same. In other words, the events are not independent but are 

related to each other. If the EC is ignored, the metric’s mean value and uncertainty 

may be underestimated. 

The first step in accounting for the EC between basic events is identifying correlated 

events, and the outcome is the identification of several groups of correlated basic 

events. Each group contains basic events that are correlated with each other 

because the state-of-knowledge of the analysts about these events’ parameters is 

the same. Identifying correlated basic events principally involves determining what 

basic-event models share the same parameters. For example, for all components of 

a certain type in a nuclear power plant (NPP), if the failure rate for its failure mode is 

evaluated from the same data set, the basic events for these components are 

correlated. 

o Establish the Significance of the EC -- Each group of correlated basic events in the 

PRA model should be set up in a PRA computer code such that the particular code 

recognizes that the basic events are correlated. In this way, a single distribution is 

applicable to all the basic events in a correlated group. Then, when the code 

propagates the uncertainty, each sample from the distribution of a group of 

correlated basic events is used for all the basic events in the group. These values of 

the basic events subsequently are used in propagating parameter uncertainty 

through the PRA model to generate a value of the risk metric being evaluated. This 

evaluation process is repeated for all the samples evaluated by the code. 

o Propagate Parameter Uncertainty in the PRA Model -- Perform parametric 

uncertainty propagation on the PRA model using a Monte Carlo process or a similar 

method through the cutsets accounting for the state-of-knowledge correlation and 

report the results to establish the uncertainty bounds of 5% and 95% on the risk 

metric. 

• Model Uncertainty -- A source of model uncertainty is one that is related to an issue in 

which no consensus approach or model exists and where the choice of approach or 

model is known to have an effect on the PRA. The structured process of the approach 

for treatment of modeling uncertainty includes four steps: (1) identification - identify of 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

11-5 

sources of modeling uncertainty and related assumptions, (2) characterization - 

characterize sources of model uncertainty and related assumptions, (3) screening - 

qualitative screening of the sources of uncertainty and related assumptions, and (4) 

sensitivity test. 

o Identify of Sources of Modeling Uncertainty and Related Assumptions 

- Identify generic contributors to modeling uncertainty using the ASME/ANS 

PRA Standard as a structure. These generic candidates include those issues 

that have been earmarked as modeling uncertainty candidates based on the 

definitions provided in Appendix A. The objective is to identify those sources 

of uncertainty with the highest potential to significantly change the risk metric. 

- Evaluate the applicability of generic model uncertainties to the specific plant 

and PRA to provide the final generic list to be reviewed as part of the plantspecific determination of modeling uncertainties. 

- Examine plant-specific features/modeling approaches for additional 

uncertainties to identify if there are plant-specific treatments or PRA modeling 

that introduce uncertainties not included on the generic list. Add any plant 

specific sources of uncertainty or related assumptions to develop the plantspecific list. 

o Characterize Sources of Model Uncertainty and Related Assumptions 

- The part of the PRA model that is affected by the source of model uncertainty 

or related assumption needs to be identified. This characterization is 

necessary since not every part of the PRA is involved in every application of 

the model. The part of the PRA model affected can be the basic event level, 

in specific portions of the system logic structure, or in specific portions of the 

accident sequence modeling. 

- The lists of related assumptions or models are identified to properly 

characterize how the source of uncertainty is represented in the PRA model. 

- The impact on the PRA model provides a characterization of how the related 

assumptions or chosen models will affect the PRA model basic event values, 

system logic structure, or accident sequence modeling. 

- Identify conservative biases. This step provides a method to characterize the 

candidate modeling uncertainties. It is critical at this stage to ensure that the 

conservative bias in a particular candidate model does not unduly influence 

the overall PRA model. 

o Qualitative Screening of the Sources of Uncertainty and Related Assumptions 

- Apply consensus model. This step makes use of those areas of the PRA 

where extensive historical precedence is available to establish a model that 

has been accepted and yields PRA results that are considered reasonable 

and realistic. 

o Sensitivity Test 

- After the potential key source of uncertainty is identified, there is a need to 

establish a reasonable range of parameter values or set of alternative logic 

models for the sensitivity evaluation. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

11-6 

- For either type of change (logic model change or basic event value change), 

in some cases it may be appropriate to provide a bounding sensitivity case to 

demonstrate the worst possible risk metric associated with a source of 

uncertainty. When bounding impacts are not acceptable, however, then both 

increases and decreases in the risk metrics should be investigated, as 

appropriate. A reasonable range of variation is prescribed based on the most 

appropriate of the following alternatives: 

o Implementation of alternate model logic 

o Use of available probability distribution (if available) 5% and 95% bounds 

o Use of variations identified in the literature as reasonable 

o Use of judgment regarding the variations that could be expected, that is, 

the use of reasonable hypotheses 

o A factor of 2 to 10 change (in both directions, if appropriate) 

11.5 Products

The products produced as a result of the task are identified below. These products should be 

sufficient such that it allows an independent analyst to understand how the analysis was 

performed and to reproduce the results. Consequently, the list of products includes both interim 

and final products. Table 11-1 provides, at a minimum, the expected products. 

Table 11-1. Expected Products 

Product Description 

Interim Report 

Section 

Parameter uncertainty of basic event will be addressed in 

each related subtask report. For example, uncertainty of 

human error probability (HEP) will be addressed in HRA 

related report. 

Parameter uncertainty of risk metrics and model uncertainty will be addressed in the 

Final Report 

NUREG Integration of this section with other subtasks 

11.6 Task Interfaces

Initiating Events, Data Analysis, CCF, and HRA may strong affect the parameter uncertainty for 

basic events. Every subtask of this project may affect the modeling uncertainty. 

11.7 References

• Nuclear Regulatory Commission, Guidelines on the Treatment of Uncertainties 

Associated with PRAs in Risk-Informed Decision Making, NUREG-1855, Draft Report for 

Comment, November 2007. 

• Electric Power Research Institute, “Treatment of Parameter and Model Uncertainty for 

Probabilistic Risk Assessments,” EPRI TR 1016737, Palo Alto, CA, December 2008. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-1 

12. Technical Approach for Reactor, At-Power, Internal Hazards PRA 

The technical approach for the various analytical tasks of Task 1 (Quantification of the Reactor, 

At-power for Internal Hazards PRA) are described in this section. Task 1 is divided into 3 major 

tasks, as follows: 

• Task 1-1: Level 1 reactor, at-power for internal hazards PRA 

• Task 1-2: Level 2 reactor, at-power for internal hazards PRA 

• Task 1-3: Level 3 reactor, at-power for internal hazards PRA 

12.1 Task 1-1: Level 1 Reactor PRA, At-Power for Internal Hazards

This task is divided into three subtasks associated with each internal hazard, as follows: 

1. Subtask 1-1.1: Internal Events 

2. Subtask 1-1.2: Internal Floods 

3. Subtask 1-1.3: Internal Fires 

12.1.1 Subtask 1-1.1: Level 1 PRA for At-Power and Internal Events

This subtask comprises eight technical elements, as follows: 

• Subtask 1-1.1a: Initiating event analysis 

• Subtask 1-1.1b: Accident sequence analysis 

• Subtask 1-1.1c: Success criteria 

• Subtask 1-1.1d: Systems analysis 

• Subtask 1-1.1e: Human reliability analysis 

• Subtask 1-1.1f: Data Analysis 

• Subtask 1-1.1g: Quantification 

• Subtask 1-1.1h: Uncertainty analysis 

12.1.1.1 Subtask 1-1.1a: Initiating Event Analysis

The objectives of the Initiating Event Analysis are to identify and quantify events that could lead 

to core damage. In accordance with the PRA Standard, an Initiating Event Analysis should 

(1) identify and include events that challenge normal plant operation and that require successful 

mitigation to prevent core damage, (2) group initiating events according to the mitigation 

requirements to facilitate the efficient modeling of plant response, and (3) quantify the 

frequencies of the initiating event groups. Since the licensee’s PRA has already undergone a 

peer review against the PRA Standard, then a review of the peer review documentation along 

with a comparison of the PRA to the Vogtle SPAR model will provide the necessary information 

required for any modifications needed to complete the initiating event analysis for this project. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-2 

12.1.1.1.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The licensee PRA has undergone a peer review against the ASME/ANS PRA Standard 

for Internal Events. Therefore, the PRA can be reviewed to identify any missing initiating 

events in the Vogtle SPAR model. 

• Consequential and concurrent initiating events are outside the scope of the Level 1, 

Internal Events PRA. 

• The EPRI/NRC modeling of support systems initiating events (SSIEs) shall be used for 

applicable support systems. 

12.1.1.1.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of initiating event analysis are identified. This information (along with the 

identified products, Section 12.1.1.1.2) should allow an independent analyst to reproduce the 

various results. The information needed to perform each step, at a minimum, is listed below in 

Table 12.1-2: 

Table 12-1 Needed Inputs for Subtask 1-1.1a 

Input Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

Licensee PRA and Supporting 

Documentation 

Review applicable information on initiating events in the 

licensee PRA. 

Licensee PRA Peer Review 

Report 

Review peer review findings/conclusions on the Initiating 

Event Analysis technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on initiating events in the Vogtle 

SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

INL V6349 Task 1 Draft Report The report’s conclusions on initiating events shall be used 

to make any modifications to the Vogtle SPAR model. 

12.1.1.1.3 Analysis Steps

Initiating Event Analysis consists of two interrelated steps: 

1. Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

2. Revise the Vogtle SPAR Model 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-3 

Step 1 – Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

The objective of this step is to determine what elements of the licensee Initiating Event Analysis 

of their PRA (e.g., additional initiating events, initiating event frequencies, etc.) are needed to be 

included or revised in the Vogtle SPAR model. 

The licensee PRA, supporting documentation, and peer review report must be reviewed to 

understand the elements of the Initiating Event Analysis performed for the PRA. The review 

must also look for potential deficiencies (in accordance with the PRA Standard) with the 

licensee’s Initiating Event Analysis. The findings of this review then need to be compared to the 

Vogtle SPAR model’s Initiating Event Analysis. Required modifications in Initiating Event 

Analysis technical element for Vogtle SPAR model will be documented. 

The following table provides a list of items that need to be documented for this step: 

Table 12-2 Documentation Needs for Step 1 of Subtask 1.1-1.a 

Item Description 

Licensee PRA and 

Supporting Documentation 

Review applicable information on initiating events in the 

licensee PRA. 

Licensee PRA Peer 

Review Report 

Review peer review findings/conclusions on the Initiating Event 

Analysis technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on initiating events in the Vogtle 

SPAR model. 

Step 2 – Revise the Vogtle SPAR Model

The objective of this step is to revise the Vogtle SPAR model and documentation such that is 

meets the High-Level Requirements and Supporting Requirements (preferably Capability 

Category II or III) of the Initiating Event Analysis technical element of the PRA Standard. 

The conclusions from Step 1 will be documented in INL V6349 Task 1 Draft Report and will be 

used to guide the modifications involving initiating events in the Vogtle SPAR model. The SPAR 

model documentation will be updated accordingly and to allow for ease of a PRA Standard peer 

review. 

The following table provides a list of items that need to be documented for this step: 

Table 12-3 Documentation Needs for Step 2 of Subtask 1.1-1.a 

Item Description 

INL V6349 Task 1 Draft 

Report 

The report’s conclusions on initiating events shall be used to 

make any modifications to the Vogtle SPAR model. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-4 

12.1.1.1.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 12.1.1.1.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products includes both interim and final products. Table 12-4 provides, 

at a minimum, the expected products. 

Table 12-4 Expected Products for Subtask 1-1.1a 

Product Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

INL V6349 Task 1 Draft 

Report 

This report will include a description of the review of the 

licensee PRA and peer review document. The report will 

include a comparison of the Initiating Event Analysis between 

the licensee PRA and current Vogtle SPAR model. In addition, 

the report will include a write-up (in following with the PRA 

Standard) for the Initiating Event Analysis for the revised AtPower, Level 1, Internal Hazards SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

Revised SPAR Model The Vogtle SPAR will be revised according to the conclusions of 

INL Task 1 Draft Report. 

12.1.1.1.5 Task Interfaces

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

[To be completed] 

12.1.1.1.6 References

1. Licensee PRA and Supporting Documentation 

2. Licensee PRA Peer Review Report 

3. Vogtle SPAR Model with Documentation 

4. INL V6349 Task 1 Draft Report 

12.1.1.2 Subtask 1-1.1b: Accident Sequence Analysis

The objectives of the Accident Sequence Analysis are to ensure that the response of the plant’s 

systems and operators to an initiating event is reflected in the assessment of CDF and Level 2 

results, such that: (a) significant operator actions, mitigation systems, and phenomena that can 

alter sequences are appropriately included in the accident sequence model event tree structure 

and sequence definition, (b) plant-specific dependencies are reflected in the accident sequence 

structure (c) success criteria are available to support the individual function successes, mission 

times, and time windows for operator actions for each critical safety function modeled in the 

accident sequences, (d) end states are clearly defined to be core damage or successful 

mitigation with capability to support the Level 1 to Level 2 interface. Since the licensee’s PRA 

has already undergone a peer review against the PRA Standard, then a review of the peer 

review documentation along with a comparison of the PRA to the Vogtle SPAR model will 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-5 

provide the necessary information required for any modifications needed to enhance the SPAR 

model. 

12.1.1.2.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The licensee PRA has undergone a peer review against the ASME/ANS PRA Standard 

for Internal Events. Therefore, the PRA can be reviewed to identify any deficiencies in 

the Accident Sequence Analysis technical element Vogtle SPAR model. 

• Consequential and concurrent initiating events are outside the scope of the Level 1, 

Internal Events PRA. 

• The EPRI/NRC modeling of SSIEs shall be used for applicable support systems. 

12.1.1.2.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Accident Sequence Analysis are identified. This information (along with the 

identified products, Section 12.1.1.2.4) should allow an independent analyst to reproduce the 

various results. The information needed to perform each step, at a minimum, is listed below in 

Table 12-5. 

Table 12-5 Needed Inputs for Subtask 1-1.1b 

Input Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

Licensee PRA and Supporting 

Documentation 

Review applicable information on accident sequences in 

the licensee PRA. 

Licensee PRA Peer Review 

Report 

Review peer review findings/conclusions on the Accident 

Sequence Analysis technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on accident sequences in the 

Vogtle SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

INL V6349 Task 1 Draft Report The report’s conclusions on accident sequences shall be 

used to make any modifications to the Vogtle SPAR 

model. 

12.1.1.2.3 Analysis Steps

Accident Sequence Analysis consists of two interrelated steps: 

1. Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

2. Revise the Vogtle SPAR Model 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-6 

Step 1 – Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

The objective of this step is to determine what elements of the licensee Accident Sequence 

Analysis of their PRA are needed to be included or revised in the Vogtle SPAR model. 

The licensee PRA, supporting documentation, and peer review report must be reviewed to 

understand the elements of the Accident Sequence Analysis performed for the PRA. The 

review must also look for potential deficiencies (in accordance with the PRA Standard) with the 

licensee’s Accident Sequence Analysis. The findings of this review then need to be compared 

to the Vogtle SPAR model’s Accident Sequence Analysis. Required modifications in Accident 

Sequence technical element for Vogtle SPAR model will be documented. 

The following table provides a list of items that need to be documented for this step. 

Table 12-6 Documentation Needs for Step 1 of Subtask 1.1-1.b 

Item Description 

Licensee PRA and 

Supporting Documentation 

Review applicable information on accident sequences in the 

licensee PRA. 

Licensee PRA Peer 

Review Report 

Review peer review findings/conclusions on the Accident 

Sequence Analysis technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on accident sequences in the Vogtle 

SPAR model. 

Step 2 – Revise the Vogtle SPAR Model

The objective of this step is to revise the Vogtle SPAR model and documentation such that is 

meets the High-Level Requirements and Supporting Requirements (preferably Capability 

Category II or III) of the Accident Sequence Analysis technical element of the PRA Standard. 

The conclusions from Step 1 will be documented in INL V6349 Task 1 Draft Report and will be 

used to guide the modifications involving accident sequences in the Vogtle SPAR model. The 

SPAR model documentation will be updated accordingly and to allow for ease of a PRA 

Standard peer review. 

The following table provides a list of items that need to be documented for this step: 

Table 12-7 Documentation Needs for Step 2 of Subtask 1.1-1.b 

Item Description 

INL V6349 Task 1 Draft 

Report 

The report’s conclusions on accident sequences shall be used 

to make any modifications to the Vogtle SPAR model. 

12.1.1.2.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 12.1.1.2.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-7 

Consequently, the list of products includes both interim and final products. Table 12-8 provides, 

at a minimum, the expected products. 

Table 12-8 Expected Products for Subtask 1-1.1b 

Product Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

INL V6349 Task 1 Draft 

Report 

This report will include a description of the review of the 

licensee PRA and peer review document. The report will 

include a comparison of the Accident Sequence Analysis 

between the licensee PRA and current Vogtle SPAR model. In 

addition, the report will include a write-up (in following with the 

PRA Standard) for the Accident Sequence Analysis for the 

revised At-Power, Level 1, Internal Hazards SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

Revised SPAR Model The Vogtle SPAR will be revised according to the conclusions of 

INL Task 1 Draft Report. 

12.1.1.2.5 Task Interfaces

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

[To be completed] 

12.1.1.2.6 References

1. Licensee PRA and Supporting Documentation 

2. Licensee PRA Peer Review Report 

3. Vogtle SPAR Model with Documentation 

4. INL V6349 Task 1 Draft Report 

12.1.1.3 Subtask 1-1.1c: Success Criteria

The approach for determination of the success criteria for the reactor Level 1 internal events 

PRA, at power, is discussed in Section 4. Section 4 supports various parts of the PRA, since it 

uses a common approach, even though it may be implemented differently dependent on the 

context of the part of the PRA model it is supporting. 

The term success criteria analysis describes both the minimal equipment success criteria and 

the sequence timing for key operator actions. In general, both the licensee PRA and SPAR 

model cover this topic, and the MELCOR model and other methods discussed in Section 4 are 

particularly well-suited for performing analyses to develop the basis for success criteria. 

Of important note is the timing of the conduct of the Level 1 internal hazards PRA in comparison 

to the development of the MELCOR model. The two activities are necessarily being carried out 

in parallel, which means that any MELCOR analysis performed for the Level 1 internal hazards 

PRA will need to be confirmatory in nature. In other words, such analysis will be performed after 

the Level 1 internal hazards PRA has been developed, and will inform: (i) any future 

enhancements to the Level 1 PRA, and (ii) the Level 2 internal hazards PRA. As such, for the 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-8 

Level 1 internal hazards model being developed and finalized in Winter 2013, The Step 4 

(“Perform Confirming Computational (Or Other) Analysis”) of Section 4.3 will be abbreviated and 

based on off-the-shelf information. 

12.1.1.4. Subtask 1-1.1d: Systems Analysis

The objectives of the Systems Analysis are provided in Section 5. Since the plant’s Level 1, 

internal events PRA has undergone a peer review against the PRA Standard, it is expected that 

a review of the plant PRA information (e.g., systems notebooks), peer review documentation, 

and a comparison of the PRA to the Vogtle SPAR model will provide the necessary information 

required for any modifications needed to enhance the SPAR model. 

12.1.1.4.1 Assumptions and Limitations 

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The licensee PRA has undergone a peer review against the ASME/ANS PRA Standard 

for Internal Events. Therefore, the PRA can be reviewed to identify any deficiencies in 

the Systems Analysis technical element Vogtle SPAR model. 

• Consequential and concurrent initiating events are outside the scope of the Level 1, 

Internal Events PRA. 

• The EPRI/NRC modeling of SSIEs shall be used for applicable support systems. 

• Only inter-system common-cause failures are modeled; intra-system common-cause 

failures are not modeled. 

• Additional bullets based on licensee PRA assumptions/limitations in the Systems 

Analysis. [To be completed] 

12.1.1.4.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Systems Analysis are identified. This information (along with the identified 

products, Section 12.1.1.4.4) should allow an independent analyst to reproduce the various 

results. The information needed to perform each step, at a minimum, is listed below in 

Table 12-9. 

Table 12-9 Needed Inputs for Subtask 1-1.1d 

Input Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

Licensee PRA and Supporting 

Documentation 

Review applicable information (e.g., system notebooks) on 

plant systems in the licensee PRA. 

Licensee PRA Peer Review 

Report 

Review peer review findings/conclusions on the Systems 

Analysis technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on plant systems in the Vogtle 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-9 

Input Description 

SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

INL V6349 Task 1 Draft Report The report’s conclusions on the Systems Analysis shall be 

used to make any modifications to the Vogtle SPAR 

model. 

12.1.1.4.3 Analysis Steps

Systems Analysis consists of two interrelated steps: 

1. Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

2. Revise the Vogtle SPAR Model 

Step 1 – Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

The objective of this step is to determine what elements of the licensee Systems Analysis of 

their PRA are needed to be included or revised in the Vogtle SPAR model. 

The licensee PRA, supporting documentation, and peer review report must be reviewed to 

understand the elements of the Systems Analysis performed for the PRA. The review must also 

look for potential deficiencies (in accordance with the PRA Standard) with the licensee’s 

Systems Analysis. The findings of this review then need to be compared to the Vogtle SPAR 

model’s Systems Analysis. Required modifications in Systems Analysis technical element for 

Vogtle SPAR model will be documented. 

The following table provides a list of items that need to be documented for this step. 

Table 12-10 Documentation Needs for Step 1 of Subtask 1.1-1.d 

Item Description 

Licensee PRA and 

Supporting Documentation 

Review applicable information on plant systems in the licensee 

PRA. 

Licensee PRA Peer 

Review Report 

Review peer review findings/conclusions on the Systems 

Analysis technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on plant systems in the Vogtle SPAR 

model. 

Step 2 – Revise the Vogtle SPAR Model

The objective of this step is to revise the Vogtle SPAR model and documentation such that is 

meets the High-Level Requirements and Supporting Requirements (preferably Capability 

Category II or III) of the Systems Analysis technical element of the PRA Standard. 

The conclusions from Step 1 will be documented in INL V6349 Task 1 Draft Report and will be 

used to guide the modifications involving plant systems in the Vogtle SPAR model. The SPAR 

model documentation will be updated accordingly and to allow for ease of a PRA Standard peer 

review. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-10 

The following table provides a list of items that need to be documented for this step. 

Table 12-11 Documentation needs for Step 2 of Subtask 1.1-1.d 

Item Description 

INL V6349 Task 1 Draft 

Report 

The report’s conclusions on plant systems shall be used to 

make any modifications to the Vogtle SPAR model. 

12.1.1.4.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 12.1.1.4.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products includes both interim and final products. Table 12-12 

provides, at a minimum, the expected products. 

Table 12-12 Expected Products for Subtask 1-1.1d 

Product Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

INL V6349 Task 1 Draft 

Report 

This report will include a description of the review of the 

licensee PRA and peer review document. The report will 

include a comparison of the Systems Analysis between the 

licensee PRA and current Vogtle SPAR model. In addition, the 

report will include a write-up (in following with the PRA 

Standard) for the Systems Analysis for the revised At-Power, 

Level 1, Internal Hazards SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

Revised SPAR Model The Vogtle SPAR will be revised according to the conclusions of 

INL Task 1 Draft Report. 

12.1.1.4.5 Task Interfaces

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• Success Criteria: The Systems Analysis task identifies the systems that are necessary to 

mitigate the effects of the initiating event and therefore will need to be included in the 

development of the PRA model. This element also establishes the high level logic of the 

system logic model. 

• Data Analysis: The component failure estimation or system initiating event frequencies 

used to quantify the systems models comes from the Data Analysis element. 

• Human Reliability Analysis: Human failure events are taken into account in the system 

models which also provide feedback to the HRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-11 

12.1.1.4.6 References

1. Licensee PRA and Supporting Documentation 

2. Licensee PRA Peer Review Report 

3. Vogtle SPAR Model with Documentation 

4. INL V6349 Task 1 Draft Report 

5. ASME/ANS RA-Sa-2009 PRA standard 

6. RG 1.200, Revision 2 

12.1.1.5 Human Reliability Analysis

Human reliability analysis (HRA) is a supporting technical element in that it supports the 

development of the PRA model in several places. In supporting various other elements in the 

PRA, this element uses a common, general approach; however, it may be implemented 

differently dependent on the context of the technical element it is supporting. In this section, the 

general approach is described. Implementation-specific aspects of performing HRA are 

described in that part of the plan; that is, under each specific technical element. 

Human reliability analysis consists of nine interrelated steps: 

• Definition and interpretation of HRA/PRA issue 

• Definition of HRA/PRA scope 

• Qualitative analysis (i.e., information collection & interpretation, analysis to support 

quantification) 

• Identification and definition of human failure events (HFEs) 

• Quantification (both screening and detailed) 

• Recovery analysis 

• Dependency analysis 

• Uncertainty analysis 

• Documentation 

Section 7 provides a full description of the generic HRA technical approach. This section 

repeats only summary descriptions of the guidance given in Section 7. Also, any additional 

guidance, assumptions, or other information needed for the specific application of HRA for atpower, internal events Level 1 PRA will be provided in the subsections below. 

12.1.1.5.1 Assumptions and Limitations

Section 7 provides a list of generic assumptions and limitations that define the scope and level 

of detail relevant to HRA in support of PRA. 

There are no additional assumptions or limitations for HRA that are relevant to the at-power, 

internal events Level 1 PRA. However, because these generic assumptions or limitations are 

expected to be especially relevant to the HRA task in support of this type of PRA, they are 

repeated here: 

• Any PRA performed by the utility for the Vogtle NPP that is planned to be used by the 

NRC study: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-12 

o With few exceptions, is adequate for the needs of RES’ Level 3 PRA study with 

respect to scope and other study objectives. 

o Meets the ASME/ANS PRA standard requirements for Capability Category II. 

o Has been thoroughly reviewed by a qualified peer review panel. 

o Has few, if any, substantive peer review comments that need to be addressed in 

the RES Level 3 PRA study. 

o Requires no adjustment to success criteria or timing information (e.g., from 

thermal hydraulic calculations), resulting in, for example, event tree modifications 

or changes to HRA quantification results. 

o Includes only human failure events that are supported by formal procedures (or 

are skill-of-the-craft actions). 

o Is adequately documented such that HRA qualitative analysis is clear and 

quantification results are traceable. 

o Has addressed all key and relevant performance influencing factors for HRA. 

o Has included an HRA that was performed using methods and approaches 

suitable for the specific PRA. 

o Has included an HRA that was performed using HRA methods and approaches 

as they are intended to be used (or alternate approaches are justified). 

o Requires only a few “spot checks” of HRA quantification results to assure 

reasonableness. 

o Requires little or no re-work of HRA qualitative and/or quantitative analysis for 

post-initiator human failure events (HFEs). 

o Requires no re-work (and no substantive “spot-check” effort) for pre-initiator 

HFEs. 

• Procedures and other formal guidance that supports human failure events exist and are 

currently being used and trained upon. 

• Action locations, equipment, control panels and so forth exist, are currently being used 

and trained upon (or an acceptable alternative is available for HRA analyst review). 

12.1.1.5.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of HRA are identified. This information (along with the identified products, 

Section 12.1.1.5.4) should allow an independent analyst to reproduce the various results. 

Table 7-1 in Section 7 lists the minimum information for HRA, generically. Because the various 

HRA steps are iterative and overlap, some of these HRA information needs are also iterative. 

For the at-power, internal events Level 1 PRA study, the HRA effort is assumed to be principally 

a review effort with some minimal independent checks. Hence, inputs and information needs 

supporting this PRA effort are expected to be limited to that which allows the HRA analyst to 

follow the analysis and reproduce the results. 

12.1.1.5.3 Analysis Steps

As noted above, HRA consists of nine interrelated steps: 

1. Definition and interpretation of HRA/PRA issue 

2. Definition of HRA/PRA scope 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-13 

3. Qualitative analysis 

4. Identification and definition of human failure events (HFEs) 

5. Quantification (both screening and detailed) 

6. Recovery analysis 

7. Dependency analysis 

8. Uncertainty analysis 

9. Documentation 

Section 7 provides a complete, generic description of the above analysis steps and their 

documentation needs. Below, any unique aspects of performing these steps in support of the 

at-power, internal events Level 1 PRA are identified. 

Step 1 – Definition and interpretation of HRA/PRA issue 

As described in more detail by NUREG-1624, Rev. 1 and NUREG-1880, the purpose of this first 

step is to define the objectives of the analysis being undertaken (i.e., why is it being performed). 

For many past HRA applications, the issue has been to support an at-power, internal events, 

Level 1 PRA where the focus is principally on: 

• A fully-staffed control room with licensed operators, supervisors, STA, and so forth 

• Operator response to an initiating events using emergency operating procedures 

(EOPs) before core melt 

• Operator response in the control room with its design, layout, and controlled hazards 

• Operator response under the general assumption that control room indications are 

correct 

Consequently, existing HRA processes, approaches, and methods and their underlying 

understanding of operator behavior should match well with the objectives of the at-power, 

internal events Level 1 PRA study. 

Step 2 – Definition of HRA/PRA scope 

As stated in NUREG-1624, Rev. 1, “[t]his step limits the scope of the analysis by applying the 

issue defined in Step 1 and, if necessary for practical reasons, further limits the scope by setting 

priorities on the characteristics of the event sequences.” Also, the overall PRA study may 

establish these limitations. Further discussion is given in NUREG-1624, Rev. 1 and 

NUREG-1880. 

Ordinarily, this step would result in a traditionally performed HRA in support of the at-power, 

internal events Level 1 PRA. However, for this specific study, it is intended that the existing 

utility PRA study be used. Consequently, the scope of this overall study changes how the rest 

of the steps in the HRA process are to be performed. In particular, the aim of the succeeding 

steps is to review the existing HRA and its results for appropriateness for use in the overall NRC 

PRA study. 

Step 3 – Qualitative analysis 

As described above, the objective of the third HRA step is (1) to understand the modeled PRA 

context for the HFE, (2) to understand the actual “as-built, as operated” response of the 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-14 

operators and plant, and (3) to translate this information into factors, data, and elements used in 

the quantification of human error probabilities. 

In particular, Section 7 states that the guidance on qualitative analysis in NUREG-1921, 

especially, provides a level of prescription and formalism that can be used as a basis for this 

study. The general plan for performing qualitative analysis outlined in Section 7 is: 

• Collect and evaluate information with respect to required actions and decision-making, 

performed, performance environment, performance aids, and so forth, especially if the 

HRA is in support of a PRA type other than at-power, internal event Level 1 PRA. The 

goal of these activities is to understand the operations and operators sufficiently to make 

informed choices on using existing HRA methods or behavior models, psychological 

literature or other tools to represent the actions and associated influencing factors. 

• Collect and evaluate information with respect to required actions and decision-making, 

performed, performance environment, performance aids, and so forth in order to support 

development human failure events to place in the PRA model. The large PRA study is 

expected to provide certain key contextual information (e.g., success criteria for relevant 

plant functions including the timing by which actions must be performed). 

• Collect and evaluate information with respect to actions to determine if they are 

“feasible” per definition in NUREG-1921. Feasibility initially may be evaluated with crude 

estimates for timing for a “go/no-go” determination. Later, as more information is 

collected by the HRA analyst and/or the larger PRA study, the feasibility assessment will 

be refined and re-checked. This step is not expected to be relevant for the atpower, internal events Level 1 PRA.

• Ultimately, information will need to collected and developed as inputs to an existing HRA 

methods or other quantification approach. 

Although the HRA supporting the at-power, internal events Level 1 PRA for the NRC’s study is 

intended to be limited to review and verification of the utility's existing PRA, much of the HRA 

qualitative analysis tasks are expected to be performed. These tasks are necessary in order to 

determine the appropriateness of the qualitative analysis for the existing HRA/PRA and, 

therefore, the HRA quantification results produced with inputs from the qualitative analysis. 

Also, the general understanding of the plant, its operations, and operators, its procedures, and 

so forth that will be developed as part of the HRA for the at-power, internal events Level 1 PRA 

can be used as a basis for the other PRA efforts encompassed for the overall NRC Level 3 PRA 

study. Also, certain information, especially information on the time available and time required 

for operator actions, may be useful or applicable to any new HFEs that this HRA effort 

determines should be added and in other PRA types within the overall NRC study. 

However, to the extent possible, this HRA effort will be limited, using the larger at-power, 

internal events Level 1 PRA study as a guide. For example, as part of the accident sequence 

analysis review of event trees, the HRA effort will include review of relevant procedures and 

other information to assure that appropriate HFEs have been identified and defined (supporting 

Step 4). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-15 

Step 4 – Identification and definition of human failure events (HFEs) 

Section 7 provides the following quote from NUREG-1921: "[t]he objectives of this step are to 

identify operator (or other human) actions and associated guidance and cues (e.g., procedures 

and instrumentation) necessary for the successful mitigation of the relevant PRA scenario, and 

to define the human failure events (HFEs) at the appropriate level of detail to support qualitative 

analysis and quantification. 

For this HRA effort supporting NRC's at-power, internal events Level 1 PRA, "spot-check" 

reviews to determine that needed HFEs have been identified, and that HFEs in the existing 

utility PRA have been appropriately identified, defined, and placed in the PRA model. These 

spot checks will address both pre-initiator and post-initiator HFEs, but will be weighted more 

heavily on reviews of post-initiator HFEs. In addition, HFEs in risk-significant cut sets and 

traditionally risk-important accident sequences. 

Step 5 – Quantification (both screening and detailed) 

As discussed in Section 7, the objective of the fifth step is to assign or determine failure 

probabilities for HFEs included in the PRA model. It is expected that the existing utility PRA 

was developing using the EPRI HRA Approach that includes the following HRA quantification 

methods: 

• THERP (for execution failures) 

• Cause-Based Decision Tree (CBDT) Method (not time-driven) or human cognitive 

reliability/operator reliability experiment 

As in Step 4 above, for supporting NRC's at-power, internal events Level 1 PRA, this HRA effort 

is expected to consist of: 

• “Spot-check” of HFE quantification results, including: 

o Appropriate translation of qualitative analysis into inputs for HRA quantification 

methods 

o Appropriate HFE quantification method selection and use 

o “Sanity checks” of results (using the definition in NUREG-1792) 

• Re-quantification using alternate HRA quantification methods within the EPRI HRA 

Calculator for a limited number of risk-significant (or otherwise important) HFEs 

• Quantification of any HFEs that are newly identified in this HRA effort using an 

appropriate HRA quantification method 

Spot checks will address both pre-initiator and post-initiator HFEs, but will be weighted more 

heavily on reviews of post-initiator HFEs. In addition, HFEs in risk-significant cut sets and 

traditionally risk-important accident sequences. 

Step 6 – Recovery analysis 

As for previously discussed HRA tasks supporting the NRC's at-power, internal events Level 1 

PRA, spot checks of HRA results in the existing utility PRA will be performed, coupled with any 

needed re-analysis. The discussions above for the identification and definition, and HRA 

quantification also apply to this step. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-16 

Step 7 – Dependency analysis 

As for previously discussed HRA tasks supporting the NRC's at-power, internal events Level 1 

PRA, spot checks of the treatment of dependencies between HFEs in the existing utility PRA 

will be performed, coupled with any needed re-analysis. The discussions above for the 

identification and definition, HRA quantification, recovery analysis also apply to this step. 

In addition, the sources of dependency between HFEs identified in the existing utility's PRA will 

be reviewed for appropriateness, especially focusing on the influence of available time. 

Step 8 – Uncertainty analysis 

Due to the scope and limitations of the larger PRA effort for the at-power, internal events Level 

1 effort, the HRA effort is expected to be limited to: 1) assuring that the HRA uncertainty 

analysis for the existing utility is appropriate and 2) supplementing the existing uncertainty 

analysis with additional analysis and inputs (e.g., uncertainty sources), as appropriate and as 

needed by the larger PRA study. 

Step 9 – Documentation 

Due to the scope and limitations of the larger PRA effort for the at-power, internal events Level 

1 effort, the HRA effort is expected to be limited to: 1) assuring that the documentation 

developed for the existing utility HRA/PRA is adequate and 2) supplementing the existing 

documentation with additional information, as appropriate. 

12.1.1.5.4 Documentation

Section 7 generically describes the products produced as a result of the HRA task. All of the 

discussion in Section 7 is relevant for HRA in support of at-power, internal events Level 1 PRA. 

From Section 7, the major products of HRA are: 

• Identified and defined PRA events that are associated with actions, decisions, and other 

human activities 

• Failure probabilities or other quantification results associated with human-related PRA 

events 

• Qualitative analysis that supports and justifies products #1 and #2 

• Documentation of all products above 

12.1.1.5.5 Task Interfaces

HRA is a supporting task to almost all of PRA technical elements regardless of the plant 

operating mode, PRA hazard, or PRA type. The general discussion provided in Section 7 

applies to the HRA effort supporting the at-power, internal events Level 1 PRA. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-17 

12.1.1.5.6 References

The reference list from Section 7 is repeated below. In addition, two references associated with 

EPRI’s HRA Calculator have been added to the end of the list. 

1. USNRC and EPRI, “EPRI/NRC-RES Fire Human Reliability Analysis Guidelines,” 

NUREG-1921, July 2012. 

2. USNRC, “A Technique for Human Event Analysis (ATHEANA),” NUREG-1624, Rev. 1. 

3. USNRC, “ATHEANA User’s Guide,” NUREG-1880, June 2007. 

4. USNRC, “Good Practices for Implementing Human Reliability Analysis (HRA),” NUREG1792, April 2005. 

5. USNRC, “Evaluation of HRA Methods Against Good Practices,” NUREG-1842, 

September 2006. 

6. Swain, A.D. and H.E. Guttmann, “Handbook of Human Reliability Analysis with 

Emphasis on Nuclear Power Plant Applications (THERP)”, NUREG/CR-1278, 1983. 

7. USNRC, “An Approach for Determining the Technical Adequacy of Probabilistic Risk 

Assessment Results for Risk-Informed Activities,” Regulatory Guide 1.200, Rev. 2, 

March 2009. 

8. ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008, “Standard for Level 

1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power 

Plant Applications,” The American Society of Mechanical Engineers, New York, NY, 

February 2009. 

9. Embrey, D.C., P. Humpherys, E.A. Rosa, B. Kirwan, and K. Rea, “SLIM-MAUD: An 

Approach to Assessing Human Error Probabilities Using Structured Expert Judgment,” 

NUREG/CR-3518, 1984. 

10. Reason, J., Human Error, Cambridge University Press, New York, NY, 1990. 

11. Reason, J., “Managing the Risks of Organizational Accidents,” Ashgate Publishing 

Limited, 1997. 

12. Reason, J., “The Human Contribution - Unsafe Acts, Accidents, and Heroic Recoveries,” 

Ashgate Publishing Limited, 2008. 

13. U.S. Nuclear Regulatory Commission, “Staff Requirements Memorandum - Meeting with 

Advisory Committee on Reactor Safeguards,” SRM M061020, November 8, 2006. 

14. Klein, G., “Sources of Power - How People Make Decisions,” MIT Press, 1998. 

15. EPRI, “An Approach to the Analysis of Operator Actions in Probabilistic Risk 

Assessment,” EPRI TR-100259, Palo Alto, CA, 1992. 

16. EPRI, “Operator Reliability Experiments Using Nuclear Power Plant Simulators,” EPRI 

NP-6937, Palo Alto, CA, 1990. 

12.1.1.6 Subtask 1-1.1f: Data Analysis

The objectives of the Data Analysis are provided in Section 6. Since the licensee’s PRA has 

already undergone a peer review against the PRA Standard, then a review of the peer review 

documentation along with a comparison of the PRA to the Vogtle SPAR model will provide the 

necessary information required for any modifications needed to enhance the SPAR model. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-18 

12.1.1.6.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The licensee PRA has undergone a peer review against the ASME/ANS PRA Standard 

for Internal Events. Therefore, the PRA can be reviewed to identify any deficiencies in 

the Data Analysis technical element Vogtle SPAR model. 

• The EPRI/NRC modeling of SSIEs shall be used for applicable support systems. 

• Only inter-system CCF is modeled; intra-system CCF is not considered as part of this 

PRA. 

12.1.1.6.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Data Analysis are identified. This information (along with the identified 

products, Section 12.1.1.6.4) should allow an independent analyst to reproduce the various 

results. The information needed to perform each step, at a minimum, is listed below in 

Table 12-13. 

Table 12-13 Needed Inputs for Subtask 1-1.1f 

Input Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

Licensee PRA and Supporting 

Documentation 

Review applicable information on data used in the licensee 

PRA. 

Licensee PRA Peer Review 

Report 

Review peer review findings/conclusions on the Data 

Analysis technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on Data Analysis in the Vogtle 

SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

INL V6349 Task 1 Draft Report The report’s conclusions on Data Analysis shall be used to 

make any modifications to the Vogtle SPAR model. 

12.1.1.6.3 Analysis Steps

Data Analysis consists of two interrelated steps: 

1. Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

2. Revise the Vogtle SPAR Model 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-19 

Step 1 – Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

The objective of this step is to determine what elements of the licensee Data Analysis of their 

PRA are needed to be included or revised in the Vogtle SPAR model. 

The licensee PRA, supporting documentation, and peer review report must be reviewed to 

understand the elements of the Data Analysis performed for the PRA. The review must also 

look for potential deficiencies (in accordance with the PRA Standard) with the licensee’s Data 

Analysis. The findings of this review then need to be compared to the Vogtle SPAR model’s 

Data Analysis. Required modifications in Data Analysis technical element for Vogtle SPAR 

model will be documented. 

The following table provides a list of items that need to be documented for this step. 

Table 12-14 Documentation Needs for Step 1 of Subtask 1.1-1.f 

Item Description 

Licensee PRA and 

Supporting Documentation 

Review applicable information on data used in the licensee 

PRA. 

Licensee PRA Peer 

Review Report 

Review peer review findings/conclusions on the Data Analysis 

technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on Data Analysis in the Vogtle SPAR 

model. 

Step 2 – Revise the Vogtle SPAR Model

The objective of this step is to revise the Vogtle SPAR model and documentation such that is 

meets the High-Level Requirements and Supporting Requirements (preferably Capability 

Category II or III) of the Data Analysis technical element of the PRA Standard. 

The conclusions from Step 1 will be documented in INL V6349 Task 1 Draft Report and will be 

used to guide the modifications involving the data used in the Vogtle SPAR model. The SPAR 

model documentation will be updated accordingly and to allow for ease of a PRA Standard peer 

review. 

The following table provides a list of items that need to be documented for this step. 

Table 12-15 Documentation Needs for Step 2 of Subtask 1.1-1.f 

Item Description 

INL V6349 Task 1 Draft 

Report 

The report’s conclusions on Data Analysis shall be used to 

make any modifications to the Vogtle SPAR model. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-20 

12.1.1.6.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 12.1.1.6.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products includes both interim and final products. Table 12-16 

provides, at a minimum, the expected products. 

Table 12-16 Expected Products for Subtask 1-1.1f 

Product Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

INL V6349 Task 1 Draft 

Report 

This report will include a description of the review of the 

licensee PRA and peer review document. The report will 

include a comparison of the Data Analysis between the licensee 

PRA and current Vogtle SPAR model. In addition, the report will 

include a write-up (in following with the PRA Standard) for the 

Data Analysis for the revised At-Power, Level 1, Internal 

Hazards SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

Revised SPAR Model The Vogtle SPAR will be revised according to the conclusions of 

INL Task 1 Draft Report. 

12.1.1.6.5 Task Interfaces

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• Systems Analysis: The component failure estimations or system initiating event 

frequencies used to quantify the systems models comes from the Data Analysis 

element. 

• Human Reliability Analysis: Some human failure events (e.g., LOOP recovery actions) 

may be based on data evaluated in the Data Analysis element. 

12.1.1.6.6 References

1. Licensee PRA and Supporting Documentation 

2. Licensee PRA Peer Review Report 

3. Vogtle SPAR Model with Documentation 

4. INL V6349 Task 1 Draft Report 

5. ASME/ANS RA-Sa-2009 PRA standard 

6. RG 1.200, Revision 2 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-21 

12.1.1.7 Subtask 1-1.1g: Quantification

The objectives of the Quantification element are to provide an estimate of CDF based upon the 

plant-specific core damage scenarios, such that (1) the results reflect the design, operation, and 

maintenance of the plant, (2) significant contributors to CDF are identified such as initiating 

events, accident sequences, and basic events, (3) dependencies are accounted for, and 

(4) uncertainties are understood. Since the licensee’s PRA has already undergone a peer 

review against the PRA Standard, then a review of the peer review documentation along with a 

comparison of the PRA to the Vogtle SPAR model will provide the necessary information 

required for any modifications needed to enhance the SPAR model. 

12.1.1.7.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The licensee PRA has undergone a peer review against the ASME/ANS PRA Standard 

for Internal Events. Therefore, the PRA can be reviewed to identify any deficiencies in 

the Quantification technical element Vogtle SPAR model. 

• Consequential and concurrent initiating events are outside the scope of the Level 1, 

Internal Events PRA. 

• The EPRI/NRC modeling of SSIEs shall be used for applicable support systems. 

12.1.1.7.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Quantification are identified. This information (along with the identified 

products, Section 12.1.1.7.2) should allow an independent analyst to reproduce the various 

results. The information needed to perform each step, at a minimum, is listed below in 

Table 12-17. 

Table 12-17 Needed Inputs for Subtask 1-1.1f 

Input Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

Licensee PRA and Supporting 

Documentation 

Review applicable information on Quantification used in 

the licensee PRA. 

Licensee PRA Peer Review 

Report 

Review peer review findings/conclusions on the 

Quantification technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on Quantification in the Vogtle 

SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

INL V6349 Task 1 Draft Report The report’s conclusions on Quantification shall be used to 

make any modifications to the Vogtle SPAR model. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-22 

12.1.1.7.3 Analysis Steps

Quantification consists of two interrelated steps: 

1. Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

2. Revise the Vogtle SPAR Model 

Step 1 – Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

The objective of this step is to determine what elements of the licensee Quantification of their 

PRA are needed to be included or revised in the Vogtle SPAR model. 

The licensee PRA, supporting documentation, and peer review report must be reviewed to 

understand the elements of the Quantification performed for the PRA. The review must also 

look for potential deficiencies (in accordance with the PRA Standard) with the licensee’s 

Quantification. The findings of this review then need to be compared to the Vogtle SPAR 

model’s Quantification. Required modifications in Quantification technical element for Vogtle 

SPAR model will be documented. 

The following table provides a list of items that need to be documented for this step. 

Table 12-18 Documentation Needs for Step 1 of Subtask 1.1-1.f 

Item Description 

Licensee PRA and 

Supporting Documentation 

Review applicable information on Quantification used in the 

licensee PRA. 

Licensee PRA Peer 

Review Report 

Review peer review findings/conclusions on the Quantification 

technical element. 

Vogtle SPAR Model with 

Documentation 

Compare information from licensee PRA and peer review 

document with information on Quantification in the Vogtle SPAR 

model. 

Step 2 – Revise the Vogtle SPAR Model

The objective of this step is to revise the Vogtle SPAR model and documentation such that is 

meets the High-Level Requirements and Supporting Requirements (preferably Capability 

Category II or III) of the Quantification technical element of the PRA Standard. 

The conclusions from Step 1 will be documented in INL V6349 Task 1 Draft Report and will be 

used to guide the modifications involving the Quantification in the Vogtle SPAR model. The 

SPAR model documentation will be updated accordingly and to allow for ease of a PRA 

Standard peer review. 

The following table provides a list of items that need to be documented for this step. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-23 

Table 12-19 Documentation Needs for Step 2 of Subtask 1.1-1.f 

Item Description 

INL V6349 Task 1 Draft 

Report 

The report’s conclusions on Quantification shall be used to 

make any modifications to the Vogtle SPAR model. 

12.1.1.7.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 12.1.1.7.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products includes both interim and final products. Table 12-20 

provides, at a minimum, the expected products. 

Table 12-20 Expected Products for Subtask 1-1.1f 

Product Description 

Step 1: Review licensee PRA/Peer Review Documents and Compare with SPAR Model 

INL V6349 Task 1 Draft 

Report 

This report will include a description of the review of the 

licensee PRA and peer review document. The report will 

include a comparison of Quantification between the licensee 

PRA and current Vogtle SPAR model. In addition, the report will 

include a write-up (in following with the PRA Standard) for the 

Quantification for the revised At-Power, Level 1, Internal 

Hazards SPAR model. 

Step 2: Revise the Vogtle SPAR Model 

Revised SPAR Model The Vogtle SPAR will be revised according to the conclusions of 

INL Task 1 Draft Report. 

12.1.1.7.5 Task Interfaces

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

[To be completed] 

12.1.1.7.6 References

1. Licensee PRA and Supporting Documentation 

2. Licensee PRA Peer Review Report 

3. Vogtle SPAR Model with Documentation 

4. INL V6349 Task 1 Draft Report 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-24 

12.1.1.8 Uncertainty Analysis

12.1.1.8.1 Assumptions and Limitations

Uncertainty analysis is an integrated process including every element of PRA, such as initiating 

event, human reliability analysis, and data analysis. Thus, all assumptions and limitations 

addressed in all other subtask technical approaches are part of the inputs of uncertainty 

analysis. 

12.1.1.8.2 Inputs

• Inputs for parameter uncertainty of basic event are same as inputs for each basic event 

addressed in its related subtask approach. For example, inputs for uncertainty of HEP 

are same as inputs for HEP and they are addressed in HRA subtask approach. 

• Parameter uncertainties of basic events and cutsets generated from quantification 

subtask are the inputs to evaluate the parameter uncertainty of risk metric. 

• Assumptions made in any subtask will be the inputs to evaluate the model uncertainty. 

12.1.1.8.3 Analysis Steps

The uncertainty analysis steps are similar to those identified in Section 11 of this TAP (see 

Section 11). 

12.1.1.8.4 Documentation

The products produced as a result of the task are identified below. These products should be 

sufficient such that it allows an independent analyst to understand how the analysis was 

performed and to reproduce the results. Consequently, the list of products includes both interim 

and final products. Table 12-21 provides, at a minimum, the expected products. 

Table 12-21 Expected Products 

Product Description 

Interim Report 

Section 

Parameter uncertainty of basic event will be addressed in 

each related subtask report. For example, uncertainty of 

human error probability (HEP) will be addressed in HRA 

related report. 

Parameter uncertainty of risk metrics and model uncertainty will be addressed in the 

Final Report 

NUREG Integration of this section with other subtasks 

12.1.1.8.5 Task Interfaces

Initiating Events, Data Analysis, CCF, and HRA may strong affect the parameter uncertainty for 

basic events. Every subtask of this project may affect the modeling uncertainty. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-25 

12.1.1.8.6 References

1. U.S. Nuclear Regulatory Commission, “Guidelines on the Treatment of Uncertainties 

Associated with PRAs in Risk-Informed Decision Making,” NUREG-1855, Draft Report 

for Comment, November 2007. 

2. Electric Power Research Institute, “Treatment of Parameter and Model Uncertainty for 

Probabilistic Risk Assessments,” EPRI TR 1016737, Palo Alto, CA, December 2008. 

12.1.2 Subtask 1-1.2: Level 1 Reactor PRA for At-Power and Internal Floods

The Internal Flood Analysis consists of five interrelated steps: 

1. Review the Internal Flood Analysis 

2. Supplement the Internal Flood Analysis 

3. Define the internal flood scenarios 

4. Model the internal flood scenarios 

5. Document the analysis 

The objective of the first step is to review the Internal Flood Analysis information provided by the 

Vogtle plant staff for quality and completeness. The Internal Flood Analysis consists of the 

following technical elements: 

1. Internal Flood Plant Partitioning 

2. Internal Flood Source Identification and Characterization 

3. Internal Flood Scenarios 

4. Internal Flood-Induced Initiating Events 

5. Internal Flood Accident Sequences and Quantification 

The staff will review and assess each of the technical elements of the Vogtle Internal Flood 

PRA. The objective of the second step is to identify any areas of the analysis that are deficient 

and gather the supplemental information needed to perform a technically adequate PRA. The 

objective of the third step is to define the set of internal flood scenarios to be modeled in the 

Level 1, at-power SPAR model. The objective of the fourth step is to create the internal flood 

SPAR model. The objective of the fifth step is to summarize the information that has been 

reviewed and document the analysis. 

12.1.2.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The Vogtle site has performed a Level 1 PRA for at-power and internal floods. The 

Internal Flood Analysis, including all related technical elements, has been performed as 

part of this PRA. It is assumed that the Vogtle plant staff will provide sufficient 

documentation of the analysis. 

• It is assumed that the analysis performed for the Vogtle site PRA is technically 

adequate. If the analysis is found to be inadequate in some areas, then the staff will 

supplement the analysis as necessary. It is assumed that the supplemental analysis 

and information gathering performed by the staff will be minimal. If necessary, the staff 

may request additional information from the Vogtle plant staff. This may include 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-26 

additional documentation, drawings, plant walkdowns, and interviews with plant staff. If 

necessary, the staff may seek out additional references or input from subject matter 

experts, but this is not anticipated. 

• To complete work on Steps 3 and 4 (defining and modeling internal flood scenarios) it is 

assumed that a stable version of the Level 1 PRA for At-Power and Internal Events 

SPAR model will be available. The internal flood scenarios will be defined to be 

consistent with the internal events model assumptions and level of detail. The internal 

flood scenarios will also depend on parts (e.g., event trees, fault trees, and basic events) 

of the internal events model. Any changes to the internal events model may impact the 

internal flood scenarios. 

12.1.2.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Internal Flood Analysis are identified. This information (along with the 

identified products, Section 12.1.2.4) should allow an independent analyst to reproduce the 

various results. The information needed to perform each step, at a minimum, is listed below in 

Table 12-22. 

Table 12-22 Needed Inputs for Subtask 1-1.2 

Input Description 

Step 1: Review the Internal Flood Analysis 

Vogtle Internal Flood 

PRA documentation 

The complete documentation of the Vogtle Internal Flood 

PRA. This includes descriptions of the analyses for all 

Internal Flood PRA technical elements. This information is 

needed to begin work on this task. 

Vogtle Internal Flood 

PRA peer review or 

A report documenting the peer review or of the Vogtle 

Internal Flood PRA will assist the staff in establishing the 

technical adequacy of the model. 

Step 2: Supplement the Internal Flood Analysis 

Supplemental 

information 

Supplemental information will be requested as deemed 

necessary. This may include additional documentation, 

drawings, plant walkdowns, and interviews with plant staff, 

external references, and input from subject matter experts. 

12.1.2.3 Analysis Steps

Internal Flood Analysis consists of five interrelated steps: 

Step 1 – Review the Internal Flood Analysis 

The objectives of this step are: 

• To review the analysis done to support the Vogtle Internal Flood PRA. 

• To assess the technical adequacy of each Internal Flood PRA technical element. 

The staff will review the documentation for the Vogtle Internal Flood PRA. Each Internal Flood 

PRA technical element will be reviewed for technical adequacy and completeness. The staff will 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-27 

review available peer review and/or reports from the Vogtle plant staff. The staff will refer to 

Regulatory Guide 1.200 and Part 3 of the Level 1/LERF PRA Standard (ASME/ANS RA-Sa2009) for guidance on determining technical adequacy. For HRA specifically, the staff will refer 

to NUREG-1921, EPRI/NRC-RES Fire Human Reliability Analysis Guidelines, as it is 

anticipated that there will be some common human performance issues between fire and 

internal flooding events. 

The following table provides a list of items that need to be documented for this step. 

Table 12-23 Documentation Needs for Step 1 of Subtask 1-1.2 

Item Description 

Review of IFPP Summary of review of Internal Flood Plant Partitioning (IFPP) 

analysis

Review of IFSO Summary of review of Internal Flood Source Identification 

and Characterization (IFSO) analysis

Review of IFSN Summary of review of Internal Flood Scenarios (IFSN) 

analysis

Review of IFEV Summary of review of Internal Flood-Induced Initiating 

Events (IFEV) analysis

Review of IFQU Summary of review of Internal Flood Accident Sequences 

and Quantification (IFQU) analysis

Technical Adequacy 

Assessment 

The staff’s assessment of the Internal Flood Analysis 

technical adequacy and summary of review of peer review 

and/or reports

Step 2 – Supplement the Internal Flood Analysis

The objectives of this step are: 

• To identify any areas where the Internal Flood Analysis is inadequate. 

• To supplement the analysis with additional information to fill any gaps. 

After reviewing the information provided by Vogtle, the staff will identify any areas that require 

additional analysis. It is assumed that the analysis performed for the Vogtle site PRA is 

technically adequate. It is assumed that the supplemental analysis and information gathering 

performed by the staff will be minimal. If necessary, the staff may request additional information 

from the Vogtle plant staff. This may include additional documentation, drawings, plant 

walkdowns, and interviews with plant staff. If necessary, the staff may seek out additional 

references or input from subject matter experts, but this is not anticipated. 

The following table provides a list of items that need to be documented for this step. 

Table 12-24 Documentation Needs for Step 2 of Subtask 1-1.2 

Item Description

Supplemental 

Information 

Summary of the supplemental information that was gathered 

to support the Internal Flood Analysis.

Supplemental 

Technical Adequacy 

Assessment 

The technical adequacy of the supplemental information will 

be assessed to ensure all technical gaps have been 

addressed.
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-28 

Step 3 – Define the Internal Flood Scenarios

The objectives of this step are: 

• To define the set of internal flood scenarios to be modeled in the Level 1, at-power 

SPAR model. 

After reviewing the Vogtle site Internal Flood PRA, the staff will define the internal flood 

scenarios to be modeled in the SPAR model for this project. The most straightforward approach 

for defining the internal flood scenarios is to take the scenarios directly from the Vogtle site 

Internal Flood PRA. However, the staff will likely need to make adjustments to the scenarios to 

align with the SPAR modeling approach. The internal flood scenarios will need to be defined to 

be consistent with the SPAR internal events model assumptions and level of detail. Any 

adjustments that are made to the Vogtle internal flood scenarios will be justified and 

demonstrated to not significantly impact the model results. The INL staff will be consulted for 

input on the internal flood definitions, as they will be tasked with incorporating the scenarios into 

the SPAR model. The internal flood scenario definitions will be documented in sufficient detail 

to support INL’s work on incorporating the scenarios into the model. This will include, at a 

minimum: 

• Scenario event tree names and descriptions 

• Initiating event frequencies 

• Existing initiating event group that captures the flood impact 

• List of affected equipment and basic events to model the effects 

As appropriate, human failure events will be included and addressed as described generally in 

Section 7. 

The following table provides a list of items that need to be documented for this step. 

Table 12-25 Documentation Needs for Step 3 of Subtask 1-1.2 

Item Description 

Internal Flood 

Scenario Definitions 

Definition of the internal flood scenarios to be modeled in the 

SPAR model. 

Internal Flood 

Scenario Map from 

Vogtle Scenarios to 

SPAR Scenarios 

A table will be developed showing how the Vogtle internal 

flood scenarios are related to the scenarios to be modeled in 

the SPAR model. This will include descriptions of how the 

scenarios are directly modeled, grouped, subsumed, 

screened, etc. 

Step 4 – Model the Internal Flood Scenarios

The objectives of this step are: 

• To incorporate the set of internal flood scenarios into the Level 1, at-power, internal 

events SPAR model. 

The internal flood scenarios defined in Step 3 are to be incorporated into the Level 1, at-power, 

internal events SPAR model. This task will include creating the event trees, fault trees, linking 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-29 

and post-processing rules, and basic events that are needed to model the scenarios. The INL 

staff will perform this work and ensure that the internal flood scenarios are consistent with the 

general SPAR modeling approach. A stable version of the Level 1, at-power, internal events 

SPAR model must be available to complete this step. The internal flood scenarios will depend 

on parts (e.g., event trees, fault trees, and basic events) of the internal events model. Any 

changes to the internal events model may impact the internal flood scenarios. The staff will 

review the internal flood SPAR model and results. 

The following table provides a list of items that need to be documented for this step. 

Table 12-26 Documentation Needs for Step 4 of Subtask 1-1.2 

Item Description 

Additional Modeling 

Details 

The internal flood scenarios will be documented in Step 3, 

but there may be additional modeling details (e.g., linking and 

post-processing rules) that need to be captured after 

completing the model. 

Step 5 – Document the Internal Flood Analysis

The objectives of this step are: 

• To summarize the information that has been reviewed. 

• To document the modeling assumptions and analysis steps. 

• To report results and insights from the internal flood PRA. 

After completion of the internal flood SPAR model, the staff will document the work that has 

been performed. The documentation will include a summary of all the information that the staff 

reviewed and assessed, descriptions of the internal flood scenarios that have been incorporated 

into the model, and discussion of the results and insights from the model. The final 

documentation will incorporate all the information that was documented in the previous steps. 

The following table provides a list of items that need to be documented for this step. 

Table 12-27 Documentation Needs for Step 5 of Subtask 1-1.2 

Item Description 

Level 1 PRA for AtPower and Internal 

Floods Final Report 

The report will incorporate the work completed under the 

previous steps and summarize the results and insights from 

the internal flood PRA. 

12.1.2.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 15.1.2.1.3) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products include both interim and final products. Table 12-28 provides, 

at a minimum, the expected products. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-30 

Table 12-28 Expected Products for Subtask 1-1.2 

Product Description 

Steps 1 and 2: Review and supplemental analysis 

Summary of Vogtle 

Internal Flood 

Review 

The report will summarize the documentation provided by 

Vogtle and the staff’s assessment of those documents. If 

supplemental analysis is required, then the report will 

summarize what additional information was gathered and 

what steps were taken to address the gaps. 

Step 3: Define the internal flood scenarios 

Internal Flood 

Scenarios Report 

The report will summarize internal flood scenarios that are to 

be modeled in the SPAR models. 

Step 4: Model the internal flood scenarios 

Internal Flood SPAR 

Model 

The internal flood scenarios will be incorporated into the 

SPAR model. This will include all necessary event trees, fault 

trees, post-processing rules, etc. 

Step 5: Document the analysis 

Level 1 PRA for AtPower and Internal 

Floods Final Report 

The report will incorporate the work completed under the 

previous steps and summarize the results and insights from 

the internal flood PRA. 

12.1.2.5 Task Interfaces

The various technical steps of the Internal Flood Analysis are dependent on other technical 

elements for information in order for the step to be completed. These interfaces are as follows: 

• Step 3 requires at least a draft version of the internal events model which is a product of 

the Level 1 for At-Power and Internal Events Analysis. 

A draft version of the Level 1 for At-Power and Internal Events SPAR model is needed to 

determine appropriate definitions for internal flood scenarios. Any changes to the internal events 

model may impact the internal flood scenarios. It is assumed that much of the internal flood 

scenario definitions can be completed with a draft version of the model. 

• Step 4 requires a final version of the internal events model which is a product of the 

Level 1 for At-Power and Internal Events Analysis. 

A final version of the Level 1 for At-Power and Internal Events SPAR model is needed before 

the internal flood scenarios can be incorporated into the model. Any changes to the internal 

events model may impact the internal flood scenarios. In order to efficiently complete this task, 

the internal events models should be stable and complete before the internal flood scenarios 

are incorporated into the model. 

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• Step 4 results in the internal flood SPAR model which is information required by the 

Level 2 Reactor PRA, At-Power for Internal Floods. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-31 

The work on the Level 2 internal floods model will depend on having a completed Level 1 

internal floods model. 

12.1.2.6 References

A list of references that can and should be used in performing the work of the technical element 

is provided. 

1. Vogtle documentation for Level 1 PRA for At-Power and Internal Floods. 

2. EPRI Report No. 1021086 “Pipe Rupture Frequencies for Internal Flooding PRAs, 

Revision 2.” 

3. NUREG/CR-6928 “Industry-Average Performance for Components and Initiating Events 

at U.S. Commercial Nuclear Power Plants.” 

12.1.3 Subtask 1-1.3: Level 1 Reactor PRA for At-Power, Internal Fires

The internal fire analysis consists of the following four interrelated steps: 

1. Review the internal fire analysis 

2. Supplement the internal fire analysis, if necessary 

3. Define the internal fire scenarios 

4. Model and quantify the internal fire scenarios 

The objective of this task is to review the Vogtle internal fire analysis information as supplied to 

the NRC by SNC for quality and completeness, and supplement this model as necessary for the 

inclusion into the full-scope Level 3 site PRA. 

The internal fire analysis as discussed in Part 4 of the ASME/ANS PRA Standard consists of the 

following technical elements: 

1. Plant partitioning 

2. Equipment selection 

3. Cable selection and location 

4. Fire PRA plant response model 

5. Qualitative screening 

6. Fire PRA plant response model 

7. Fire scenario selection and analysis 

8. Ignition frequency 

9. Quantitative screening 

10. Circuit failures 

11. Post-fire human reliability analysis 

12. Fire risk quantification 

13. Uncertainty and sensitivity analysis 

12.1.3.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

for this task: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-32 

• The Vogtle site has a Level 1 reactor at-power internal fire PRA. It is assumed that, the 

internal fire analysis by SNC, including all related technical elements, has been 

performed with sufficient documentation. 

• It is assumed that the analysis performed for the Vogtle site PRA is technically 

adequate. If the analysis is found to be inadequate in some areas, then the staff will 

supplement the analysis as necessary. 

• It is assumed that the supplemental analysis and information gathering performed by the 

staff will be minimal. If necessary, the staff may request additional information from the 

Vogtle plant staff. This may include additional documentation, drawings, plant 

walkdowns, and interviews with plant staff. If necessary, the staff may seek out 

additional references or input from subject matter experts, if deemed necessary. 

• To complete work on Steps 3 and 4 (defining and modeling internal fire scenarios), it is 

assumed that a stable version of the Level 1 PRA for at-power internal events SPAR 

model will be available. The internal fire scenarios will be defined to be consistent with 

the internal events model assumptions and level of detail. The internal fire scenarios will 

also depend on many elements (i.e., event trees, fault trees and basic events) of the 

internal events PRA model. 

12.1.3.2 Inputs

The information required to perform the associated steps are identified in Table 12-30. This 

information is succinct and transparent in enabling an independent QA and peer review. 

Table 12-30 Required Inputs for Subtask 1-1.3 

Input Description 

Vogtle internal fire 

PRA documentation 

The complete documentation of the Vogtle internal fire PRA. 

This includes descriptions of the analyses for all internal fire 

PRA technical elements. 

Vogtle internal fire 

PRA peer review or 

self-assessment 

The peer review or self-assessment of the Vogtle internal fire 

PRA peer review documentation will assist the staff in 

establishing the technical adequacy of the fire PRA model. 

Supplemental 

information, if 

deemed necessary. 

If the staff’s review identifies gaps in the Vogtle fire PRA, 

supplemental information will be requested. This may include 

additional documentation, drawings, plant walkdowns, and 

interviews with plant staff, and external references. 

12.1.3.3 Analysis Steps

This section discusses the steps in implementing the fire PRA model for Vogtle: 

Step 1 – Review the Internal Fire Analysis 

The objectives of this step are to: 

• Review the analysis done to support the Vogtle internal fire PRA. 

• Assess the technical adequacy of each internal fire PRA technical element. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-33 

The staff will review the documentation for the Vogtle internal fire PRA. Each internal fire PRA 

technical element will be reviewed for technical adequacy and completeness. In addition, the 

staff will review the available peer review and/or self-assessment reports provided by SNC. The 

staff will refer to Regulatory Guide 1.200 and Part 4 of the Level 1/LERF PRA Standard 

(ASME/ANS RA-Sa-2009) for guidance on determining the technical adequacy of the Vogtle fire 

PRA model. For fire HRA specifically, the staff will refer to NUREG-1921, EPRI/NRC-RES Fire 

Human Reliability Analysis Guidelines. 

Step 2 – Supplement the Internal Fire Analysis

The objectives of this step are to: 

• Identify any areas of the internal fire analysis which is determined to be inadequate. 

• Supplement the analysis with additional information to fill any gaps. 

After reviewing the information provided by the SNC, the staff will identify any areas that require 

additional analysis. It is assumed that the analysis performed for the Vogtle site PRA is 

technically adequate, and minimal supplemental analysis and information gathering will be 

needed. If necessary, the staff may request additional information from the SNC. This may 

include additional documentation and drawings, and requests for plant walkdowns and 

interviews with plant staff. Furthermore, the staff may seek out additional references or input 

from subject matter experts, if deemed necessary. 

Step 3 – Define the Internal Fire Scenarios 

The objectives of this step are to define the set of internal fire scenarios to be incorporated into 

the Level 1, at-power PRA SPAR model. 

After reviewing the Vogtle site internal fire PRA, the staff will define the internal fire scenarios to 

be included in the SPAR model for this project. The most straightforward approach for defining 

the internal fire scenarios is to take the scenarios directly from the Vogtle site internal fire PRA. 

However, the staff will likely need to make adjustments to the scenarios consistent with the 

SPAR modeling approach. The internal fire scenarios will need to be defined to be consistent 

with the SPAR internal events model assumptions and level of detail. Any adjustments that are 

made to the Vogtle internal fire scenarios will be justified and demonstrated to not significantly 

impact the model results. The INL staff will be consulted for input on the internal fire definitions, 

as they will be tasked with incorporating the scenarios into the SPAR model. The internal fire 

scenario definitions will be documented in sufficient detail to support INL’s work on incorporating 

the scenarios into the model. This will include, at a minimum: 

• Scenario event tree names and descriptions 

• Initiating event frequencies 

• Existing initiating event groups that capture the fire impact 

• List of affected equipment and basic events to model the effects 

Step 4 – Model and Quantify the Internal Fire Scenarios

The objectives of this step are to incorporate the set of internal fire scenarios into the at-power 

Level 1 PRA for SPAR model and quantify the fire risk. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-34 

The internal fire scenarios defined in Step 3 are to be incorporated into the Level 1, at-power, 

internal events SPAR model. This task will include creating the event trees, fault trees, linking 

and post-processing rules, and basic events that are needed to model the scenarios. The INL 

staff will perform this work and ensure that the internal fire scenarios are consistent with the 

general SPAR modeling approach. The internal fire scenarios will depend on elements (i.e., 

event trees, fault trees, and basic events) of the internal events PRA model. Any changes to the 

internal events PRA model may impact the internal fire scenarios. The staff will review the 

internal fire SPAR model and results. 

12.1.3.4 Documentation

The documentation will include the staff review of the internal fire technical elements, the 

descriptions of the internal fire scenarios that have been incorporated into the model, and the 

discussions of the results and insights based on the model. Table 12-31 provides details of 

documentation needs. The documentation (along with the identified inputs described in Section 

12.1.3.2) are succinct and transparent in enabling an independent QA and peer review. 

Table 12-31 Subtask 1-1.3 Documentation 

Product Description 

Summary of Vogtle 

internal fire review 

Document the assessment of the internal fire analysis 

technical adequacy and a summary review of the external 

peer review and/or self-assessment reports. If supplemental 

analysis was required, then describe what additional 

information was gathered and what steps were taken to 

address the gaps. 

Internal fire scenarios 

report 

Document the selection of the internal fire scenarios that are 

to be incorporated into the Vogtle SPAR models. Include 

descriptions of how the scenarios are directly modeled, 

grouped, subsumed, screened, etc. 

Internal fire SPAR 

Model 

Document the incorporation of the fire scenarios into the 

SPAR model. This will include description of all necessary 

event trees, fault trees, post-processing rules, and other 

related changes. 

Level 1 PRA for atpower internal fire 

final report 

Document quantification of the internal fire PRA, including 

insights on major contributors along wit the any sensitivity 

and uncertainty analyses. 

12.1.3.5 Task Interfaces

The various technical steps of the internal fire analysis are dependent on other technical 

elements for information in order for the step to be completed. These interfaces are: 

• Steps 3 input, this step requires the internal events SPAR model which is a product of 

the Level 1 reactor, at-power, internal events PRA. 

• Step 4 results of the internal fire SPAR model, will become an input to the Level 2 

reactor at-power Internal fire PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-35 

12.1.3.6 References

1. Vogtle Documentation for Level 1 Reactor, At-Power Internal Fires PRA. 

2. NUREG/CR-6850-EPRI TR-1011989: “EPRI/ NRCRES Fire PRA Methodology for 

Nuclear Power Facilities,” September 2005. 

3. NUREG/CR-6928 “Industry-Average Performance for Components and Initiating Events 

at U.S. Commercial Nuclear Power Plants,” February 2007. 

4. Regulatory Guide 1.200, Revision 2, “An Approach for Determining the Technical 

Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” March 

2009. 

5. ASME/ANS PRA Standard, “Addenda to ASME/ANS RA-S-2008 Standard for Level 

1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power 

Plant Applications,” ASME/ANS RA-Sa-2009. 

12.2 Task 1-2: Level 2 Reactor PRA, At-Power for Internal Hazards

This task is divided into seven subtasks associated with each technical element of the analysis, 

as follows: 

1. Subtask 1-2.1: Level 1/2 PRA Interface – Accident Sequence Grouping 

2. Subtask 1-2.2: Containment Capacity Analysis 

3. Subtask 1-2.3: Severe Accident Progression Analysis 

4. Subtask 1-2.4: Probabilistic Treatment of Accident Progression 

5. Subtask 1-2.5: Radiological Source Term Analysis 

6. Subtask 1-2.6: Evaluation and Presentation of Results 

7. Subtask 1-2.7: Level 2/3 PRA Interface 

Some global assumptions, limitations, and other notes are covered in the following list: 

• Rough timelines associated with completing this work suggest disconnects with the 

overall project schedule that will need to be resolved. Specifically, schedules developed 

for the full and a reduced set of the identified tasks have completion dates of Winter 

2014 and Fall 2013. Similar disconnects currently exist with the overall resource 

requirements. The phrase, “Schedule/resource concerns may limit effort under this step.” 

is used in the task descriptions below to identify affected steps. 

• Internal events, flooding, and fire can be accommodated by the same Level 2 model. 

While arguably necessary to limit resource requirements, it’s not clear that this is 

feasible (e.g., different equipment to mitigate, different human failure events, etc.) 

• HRA tasks simply reference that portion of the report. 

• The current approach assumes that the two reactor units are identical. 

• This plan is intentionally vague right now about who will be doing the actual SAPHIRE 

modeling, awaiting other project developments. The effort for this may be underrepresented. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-36 

• Some of the modeling capabilities proposed (namely decomposition event trees, 

replacement of partition rules with linkage rules, and use of phases) have not been 

rigorously exercised in SAPHIRE8 to date. Their use in this project relies on other 

ongoing work that is scheduled for completion in December 2012. 

• The current plan does not include effort for the possibility of inadvertent criticality during 

core reflood, which is only of relevance for situations where the core is reflooded with 

unborated water following significant heatup of the fuel (to the point of melting poison 

material) but prior to core relocation. Rather, any specific simulations that lead to 

combinations of conditions where inadvertent criticality would be more likely to occur 

would be highlighted for potential future analysis. 

12.2.1 Subtask 1-2.1: Level 1/2 PRA Interface – Accident Sequence Grouping

The Level 1/2 PRA Interface consists of five interrelated steps: 

1. Development of extended Level 1 event trees 

2. Development of plant damage state binning 

3. Review the resulting plant damage states 

4. Iteration on the Level 1 PRA modeling as necessary 

5. Criteria for, and selection of, representative sequences 

The objective of the first step is to add additional containment systems to “the end” of the Level 

1 PRA sequences. The objective of the second step is to develop the plant damage states that 

will be used to merge the too-numerous number of Level 1 cutsets in to a manageable number 

of sequences that can be processed by the Level 2 PRA. The objective of the third step is to 

review the resulting plant damage states to ensure adequate transfer of information across the 

Level 1 / Level 2 interface, such that information important to the Level 2 analysis (e.g., initiator 

and support system dependencies, operator action dependencies) is transferred and that credit 

is not being given for equipment or operator actions that are not appropriate for that plant 

damage state (or visa versa). The objective of the fourth step is to re-visit and refine any Level 

1 modeling assumptions which adversely affected the plant damage state binning (e.g., lack of 

adequate distinction in different accident evolutions arising from failure-to-run of AFW for a 

particular sequence(s) where that largely affects the timing of core damage). The objective of 

the fifth step is to establish the criteria that will be used for the selection of representative 

sequences, and selecting those sequences for each plant damage state. 

12.2.1.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The Level 1/Level 2 interface will use plant damage state binning as a technique for 

keeping the modeling of the Level 2 PRA manageable. 

• The Level 1/Level 2 interface will be a single SAPHIRE model using linked event trees, 

meaning that top events in the accident progression event tree will have access to fault 

tree/event tree information from the Level 1 PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-37 

• The model will use linking rules and phases (SAPHIRE 8 capabilities), and will not utilize 

partitioning rules. 

• To the extent possible, the model will limit the number of plant damage states to less 

than 20. 

12.2.1.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Level 1/2 PRA interface are identified in Table 12-32. 

Table 12-32 Required Inputs for Subtask 1-2.1 

Input Description 

Licensee LERF/Level 

2 model 

This item is needed for steps throughout this and other 

technical elements. 

Containment system 

data 

Design and operational information sufficient to identify the 

containment systems of relevance for various sequences, 

and to develop fault trees quantifying system reliability (which 

may include components that were not required for the Level 

1 model). 

Discussions with 

licensee PRA staff 

12.2.1.3 Analysis Steps

The Level 1/2 PRA Interface consists of five interrelated steps: 

Step 1 – Development of extended Level 1 event trees 

This step functionally adds additional top events associated with containment systems onto the 

end of the Level 1 event tree. (While these will technically be top events in a distinct event tree, 

use of SAPHIRE’s transfer option functionally makes them part of the same tree.) These top 

events will define the initial availability of these systems at the time of core damage based on 

the support system information resident in the Level 1 PRA model. By doing this prior to plant 

damage state binning, this allows for consideration of containment system functionality prior to 

parsing cutsets into bins. Possible top events would include availability of containment heat 

removal prior to RWST depletion (via containment sprays or containment fan coolers, as 

applicable), containment heat removal following RWST depletion (via containment fan coolers), 

and containment sprays as a means of fission product scrubbing. Depending on what is 

appropriate for the extended event tree development, it is anticipated that the Level 2 human 

reliability analysis (HRA) will address failure or branching events that represent mitigative 

actions or decision-making by operators and staff in the technical support center. 

Step 2 – Development of plant damage state binning 

This step includes the development of a plant damage state binning bridge tree and 

corresponding SAPHIRE implementation. As an example of what types of events might be 

considered in the PDS tree, the current Surry “feasibility” Level 2 SPAR model has the following 

top events: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-38 

• Containment isolation status? 

• Containment bypass? 

• Type of accident? 

• If a transient, is it an SBO? 

• If an SBO, during which phase of the accident is AC power recovered? 

• If a transient, is there a consequential RCP seal LOCA or stuck-open relief valve? 

• Is secondary side heat removal available? 

• Is the RCS pressure at the time of core damage low, medium, or high? 

• Are containment sprays available? 

• Is containment heat removal available? 

• Is in-vessel injection available prior to RPV failure? 

Plant specific features that can affect the progression of severe accidents and containment 

response will need to be reviewed and added to the PDS attributes (e.g., containment fan 

coolers). 

Note that plant damage state binning while represented as an event tree, does not have 

probabilities associated with the pathways (i.e., it sorts cutsets into bins rather than adding 

additional conditional probabilities). This is the reason that containment systems appear again 

in the PDS tree. Also note that prior (SAPHIRE7) Level 2 models utilized partition rules for plant 

damage state binning. The intent here is to utilize SAPHIRE8’s capabilities to rely solely on 

linking rules for this process, analogous to what is being done under the SPAR Integrated 

Capabilities Model Project (Ma, 2012). 

Step 3 – Review the resulting plant damage states 

The binning of cutsets in to plant damage states represents the potential loss of information 

about sequence characteristics and dependencies. This project strives to use a semi-integrated 

Level 1/Level 2 model in order to minimize this effect. The present step will review the resulting 

plant damage state bins to ensure that information has not been unnecessarily lost. The draft 

Level 2 PRA standard provides examples of information that should be reviewed in the L1-A 

and L1-B supporting requirements. 

More specifically, the review will focus on ensuring all the plant and containment system 

dependencies have been adequately accounted for, and ensure that only pre-core damage 

recovery actions are considered as part of the Level 1 PRA model. Any post-core damage 

recovery actions that are to be considered will be identified and treated as part of the Level 2 

model development, where appropriate. 

The PDSs will also be reviewed to ensure that any probability/frequency cut-offs that may have 

been introduced as part of the Level 1 model do not eliminate potentially consequential 

sequences (note that this is unlikely to be an issue with regard to sequence truncation since 

contemporary SAPHIRE Level 1 models typically use truncation values of 10-9/year or lower) . 

Furthermore, the review will also focus on re-binning any PDSs that may have insignificant 

contributions to total core damage frequency with similar impact on plant and containment 

system response, with other similar PDSs. This will be done in order to reduce the number of 

PDSs that will need to be propagated into the level-2 model. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-39 

Finally, the uncertainties in the PDS frequencies will be reviewed for consistency with the 

Level 1 PRA results. 

Step 4 – Iteration on the Level 1 PRA modeling as necessary 

It is expected that there will be cases where the Level 1 PRA, owing to its original focus on the 

binary end-state of core damage or no core damage, will have made modeling simplifications 

that require refinement to promote realism in the Level 2 PRA. This refinement could involve 

(1) changes to the Level 1 PRA model, (2) consideration of the limitation in developing the 

Level 2 model event trees, or (3) post-processing of the Level 1 results prior to inclusion into the 

Level 2 PRA. Examples where this may be the case include: 

• Failure-to-run of auxiliary feedwater might need to be broken up into two categories 

representing different time-scales (even if AFW does not satisfy its Level 1 mission time, 

it can significantly delay the time of core damage if it operates). 

• Failure-to run of an emergency diesel generator, analogous to the item above. 

• Consideration of a cycling relief valve sticking open or sticking closed may need to be 

considered (e.g., some situations involving failure to secure ECCS or AFW can result in 

thousands of relief valve cycles). 

• For spontaneous steam generator tube ruptures, finer parsing may be needed if only a 

single event tree is used in the Level 1, to distinguish the different responses associated 

with small leak rates and large leak rates (which can have significant effects on the 

timing of operator actions). 

Schedule/resource concerns may limit effort under this step. 

Step 5 – Criteria for, and selection of, representative sequences 

The previous steps will take thousands to hundreds of thousands of cutsets and bin them in to a 

small group (ones to tens) of plant damage states. From each of these plant damage states, 

one (or a few) “representative” sequences will be selected for treatment in the Level 2 PRA. 

These sequences are surrogates for the numerous cutsets not explicitly carried forward in the 

accident progression analysis, and it is therefore important that they reflect the general 

characteristics of the numerous cutsets. 

It’s also important that they not overly bias (in either a conservative or non-conservative 

direction) the risk associated with the Level 1 cutsets. In fact, across the scope of a Level 2 PRA 

there is no such thing as a conservative or non-conservative selection (each attribute can cause 

one aspect of the results to be conservative (e.g., timing of release) while causing another 

aspect to be non-conservative (e.g., cumulative cesium environmental release magnitude). As 

such, there will be a focus in this step on being best-estimate (recognizing that this term has its 

share of ambiguity as well). 

The criteria that will be considered in the selection of representative sequences that will be used 

in performance of plant-specific MELCOR analyses that will form the basis for quantification of 

accident progression event tree, source terms, and their associated uncertainties include: 

• Frequency Dominance – sequences that have a significant contribution to core damage 

frequency, irrespective of their potential impact on containment response and 

radiological releases into the environment 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-40 

• Potential for Consequence Dominance – sequences, irrespective of their core damage 

frequency contribution, that can potentially result in a significant impact on containment 

response and/or radiological releases to the environment 

• Unique Accident Progression Behavior – sequences with potentially unique accident 

progression and radiological behavior. 

• Phenomenological Uncertainties – sequences that can impact the quantification of 

uncertainties in accident response and radiological release and transport characteristics. 

12.2.1.4 Documentation

Table 12-33 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.2.1.2) are succinct and transparent in enabling an 

independent quality assurance (QA) and peer review. 

Table 12-33 Documentation Needs for the Level 1/2 Interface – Subtask 1-2.1 

Product Description 

PRA Model Document the Level 1/2 interface, including, the PDS binning 

attributes, any frequency cut-off criterion, and identification of 

potential post-core damage recovery actions to be treated as 

part of the Level 2 model, PDS frequencies and associated 

uncertainties, and the technical basis for selection of PDSs 

for detailed analysis. 

PRA Documentation A section of the eventual model documentation describing 

the underlying basis for the event trees, developed in 

consideration of the requirements in HLR L1-C of the draft 

ANS Level 2 Standard (ANS, 2011). 

12.2.1.5 Task Interfaces

The various technical steps of the Level 1/2 PRA Interface are dependent on other technical 

elements for information in order for the step to be completed. These interfaces are as follows: 

• Step 1 and Step 4 require substantive completion of the Level 1 PRA model. 

• Step 5 results in the initial portion of the Level 2 PRA model, which is required by the 

Subtask 1-2.4, “Level 2 Probabilistic Treatment of Accident Progression,” and 

Subtask 1-2.5, “Radiological Source Term Analysis.” 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-41 

12.2.1.6 References

1. American Nuclear Society, Draft ANS 58.24 Standard Submitted for Ballot for Trial Use 

and Pilot Application, “Severe Accident Progression and Radiological Release (Level 2) 

PRA Methodology to Support Nuclear Installation Applications,” December 2011. 

2. Ma, Z. et al., “A New Approach to Quantify Level 2 SPAR Models in SAPHIRE 8,” to be 

presented at the American Nuclear Society Winter Conference, San Diego, November 

2012. 

12.2.2 Subtask 1-2.2: Containment Capacity Analysis

This subtask consists of four (4) interrelated steps: 

1. Assess preliminary failure modes and locations of interest 

2. Development of a finite element model of the containment 

3. Development of containment fragilities associated with severe accident conditions 

4. Structural responses to severe accident conditions in adjoining buildings 

The objective of the first step is to develop an initial state-of-knowledge about the containment’s 

more likely failure modes and locations, to guide development of a finite element model. The 

objective of the second step is to develop a finite element model of the containment structure 

which is adequate for assessing the containment’s capacity relative to over-pressure (long timescales and dynamic) and over-temperature conditions. The objective of the third step is to apply 

this model, to arrive at cumulative distribution functions that can be used in specifying failure 

likelihoods/characteristics for use in the accident progression event tree, and to be used in 

establishing the containment failure response within the MELCOR model. The objective of the 

fourth step is to use available information to establish failure characteristics of the auxiliary 

building, again for use in the MELCOR model and accident progression event tree. 

12.2.2.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• This technical element assumes that structural effects of any relevant SSCs caused by 

the initiating event (e.g., flooding-induced damage to support systems for containment 

fan coolers) will have already been captured by the Level 1 PRA (i.e., this technical 

element only looks at failures due to severe accident conditions). An example of where 

this assumption might break down is damage to the TSC, which the Level 1 PRA would 

likely not consider. 

• The finite element analysis will likely be conducted using the LS-DYNA computer code. 

• Note: Vogtle has a pre-stressed concrete containment, and this type of design can be 

more difficult to analyze. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-42 

12.2.2.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of the containment capacity analysis are identified in Table 12-34. This 

information is succinct and transparent in enabling an independent QA and peer review. 

Table 12-34 Required Inputs for Subtask 1-2.2 

Input Description 

Structural design 

information 

Detailed structural drawings of the containment and auxiliary 

building for creating the finite element model. 

Containment loading 

and capacity 

Discussions with licensee structural engineering staff on 

available structural engineering analyses. 

12.2.2.3 Analysis Steps

The containment capacity analysis consists of four interrelated steps: 

Step 1 – Assess preliminary failure modes and locations of interest 

The Vogtle Level 2/LERF PRA includes an associated fragility curve and failure location 

information for the containment. Vogtle-specific information, information for other plants, and 

experimental results obtained from NRC-sponsored containment testing at Sandia National 

Laboratories will be reviewed to develop the initial set of failure information. This information 

will be used to guide work under subsequent steps. The results of the most recent containment 

leak rate tests will be reviewed. 

Step 2 – Development of a finite element model of the containment 

A finite element model will be developed, likely using the LS-DYNA software. The model will be 

designed to support the analysis described in the following steps, and in consideration of the 

expected failure locations obtained in the previous step. The initial model will only contain the 

containment structure itself, for use in the over-pressure/over-temperature fragility analysis. 

The model may then be modified to include major internal structures for calculations to develop 

a separate dynamic loading fragility response characterization (e.g., for hydrogen combustion 

events). 

Schedule/resource concerns may limit effort under this step. 

Step 3 – Development of containment fragilities associated with severe accident 

conditions 

This analysis will produce the thresholds (in the form of fragility curves or other failure criteria) 

for static and dynamic failure of the containment, for use in the MELCOR model and accident 

progression event tree. Along with considerations of high temperature and high pressure, 

failure criteria are needed for dynamic events (most notably hydrogen combustion). Regulatory 

guidance associated with this type of analysis for concrete containments is provided in 

Regulatory Guide 1.136 (NRC, 2007) and Regulatory Guide 1.216 (NRC, 2010). While the 

latter is focused on meeting requirements for new light-water reactors, the discussion is still of 

relevance here. Additional recent and ongoing effort in this area has arisen from NRCsponsored work at Sandia National Labs, as well as ongoing collaboration between the NRC 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-43 

and the Atomic Energy Regulatory Board of India. A key issue is the state-of-practice in 

translating finite element model results (stresses, strains, and deformations) into functions 

describing containment leakage area (or rate) as a function of pressure. For dynamic effects, 

such as those arising from hydrogen combustion events, nonlinear dynamic explicit finite 

element analysis could be used (resources permitting). A key modeling challenge for the 

coupling of the dynamic loads with the structure capacity is accounting for the longer-term 

pressure asymptote after the initial peak pressure has decayed. 

Schedule/resource concerns may limit effort under this step. 

Step 4 – Structural responses to severe accident conditions in adjoining buildings 

Some accident progressions in the Level 2 PRA will likely involve severe accident conditions in 

adjoining structures (most notably the auxiliary building). This situation can result from 

containment failure (creating a path to the adjoining structure), and interfacing systems LOCA, 

or a steam generator tube rupture. Available plant-specific and generic information will be 

reviewed to assess the structural response of the adjoining structures to these conditions, such 

that likely leak pathways and their affect on the eventual environmental release (e.g., via 

additional building holdup of fission products) can be taken in to account. 

12.2.2.4 Documentation

Table 12-35 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.2.2.2) is succinct and transparent in enabling an 

independent QA and peer review. 

Table 12-35 Documentation Needs for the Containment Capacity Analysis – 

Subtask 1-2.2 

Product Description 

List of Failure Modes 

and Locations 

A list of those failure modes and locations that the finite 

element analysis model should be designed (in terms of 

mesh size, material properties, etc.) to mechanistically 

predict, along with references to the specific information 

sources that led to this list. 

Finite Element Model 

Documentation 

A section of the eventual project documentation describing 

the finite element model in sufficient detail to facilitate peer 

review. 

Finite Element 

Analysis 

Documentation 

Documentation of the finite element analysis, including the 

specific fragility curves that should be used in the MELCOR 

model and accident progression event tree. 

Auxiliary Building 

Fragility Analysis 

Documentation 

Documentation of auxiliary building fragility determination for 

over-temperature, quasi-static over-pressure, and dynamic 

over-pressure conditions, including the underlying information 

used to develop these fragilities. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-44 

12.2.2.5 Task Interfaces

The various technical steps of the Containment Capacity Analysis are dependent on other 

technical elements for information in order for the step to be completed. These interfaces are 

as follows: 

• Step 4 is dependent on verification from other aspects of the project that the auxiliary 

building is the only ex-containment structure that needs structural capacity analysis. 

• Steps 3 and 4 results in structural fragility information are required inputs to the 

Subtask 1-2.3, “Severe Accident Progression Analysis,” and Subtask 1-2.4, “Probabilistic 

Treatment of Accident Progression.” 

12.2.2.6 References

1. U.S. Nuclear Regulatory Commission, “Design Limits, Loading Combinations, Materials, 

Construction, and Testing of Concrete Containments,” Regulatory Guide 1.136, 

Washington, DC, March 2007. 

2. U.S. Nuclear Regulatory Commission, “Containment Structural Integrity Evaluation for 

Internal Pressure Loadings Above Design-Basis Pressure,” Regulatory Guide 1.216, 

Washington, DC, August 2010. 

12.2.3 Subtask 1-2.3: Severe Accident Progression Analysis

The severe accident progression analysis consists of six interrelated steps: 

1. SCALE analysis for decay heat and radionuclide inventory parameters 

2. Development of a plant-specific MELCOR model 

3. Accident progression modeling for the representative Level 2 sequences 

4. Phenomenological evaluations for split fraction assignment and logic model construction 

5. Evaluation of the impact of post-core damage recovery actions 

6. Evaluation of equipment survivability 

The objective of the first step is to develop the necessary information regarding fuel decay heat 

and radionuclide inventories (masses / activities of each major radioisotope) for use in the 

MELCOR model’s COR and RN packages (as well as the Level 3 MACCS2 model). The 

objective of the second step is to develop a plant-specific MELCOR model of the Vogtle Unit 1 

reactor coolant system, steam generators and steam lines, ECCS, containment and 

containment systems, SCRAM and engineered safety features actuation logic, and auxiliary 

building. The objective of the third step is to exercise this MELCOR model in performing 

accident progression analysis for the representative sequences associated with each plant 

damage state, for informing the development of the accident progression event tree and 

providing timelines for use by the HRA. The objective of the fourth step is to exercise this same 

MELCOR model, and other specialized separate effects tools (such as the TEXAS code for fuelcoolant interactions), for analyzing specific phenomena, to guide development of the Level 2 

logic model and split fractions. In addition, as part of this step, any unique, plant-specific 

phenomenological issues that merit evaluation during severe accidents will be identified. The 

objective of the fifth step is to identify and to assess the impact of any post-core damage 

recovery actions (e.g., EDMGs, SAMGs, etc.) not already considered in the earlier steps that 

merit consideration as part of the event progression analyses. The objective of the sixth step is 

to evaluate what equipment will be adversely affected by the conditions (temperature, pressure, 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-45 

humidity, radiation, energetic events) associated with the accident, on a sequence-specific 

basis. 

12.2.3.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• Some phenomena will be dispositioned (i.e., not mechanistically modeled and/or not 

considered in the logic model) based on qualitative assessments employing past studies 

or experimental programs and consideration of the Vogtle design. As an example, a 

qualitative investigation could conclude that the cavity depth for Vogtle is insufficiently 

deep and/or that containment flooding is insufficiently likely to be carried out prior to 

reactor pressure vessel head lower failure, such that energetic ex-vessel steam 

explosions do not warrant mechanistic modeling or consideration in the logic model. 

• Equipment survivability will utilize a screening approach, whereby equipment in areas 

where significant, adverse conditions are predicted will be considered failed and 

unavailable. Mis-interpretation of information from instrumentation which has failed will 

not be considered, except perhaps via sensitivity studies, under the assumption that 

insufficient information/knowledge will be available to predict how (high, within-rangevalue, low) the instrumentation will fail. 

12.2.3.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of the severe accident progression analysis are identified in Table 12-36. This 

information is succinct and transparent in enabling an independent QA and peer review. 

Table 12-36 Required Inputs for Subtask 1-2.3 

Input Description 

Fuel design and 

operating history 

information 

Detailed (likely to be proprietary) fuel design information and 

operating history in the current operating cycle, for use in the 

SCALE code system. 

Design and 

operational 

information 

Detailed SSC information (geometries, flow paths, 

component masses, system delivered flow rates, setpoints, 

etc.) for the primary side, secondary side, containment, and 

auxiliary building for creating the MELCOR model. 

Periodic discussion 

with plant 

engineering or 

operations staff 

Periodic phone calls (e.g., monthly) to confirm specific 

modeling assumptions associated with plant design or 

operation related to post-core damage behavior (e.g., 

confirming the details of containment hydrogen sampling 

post-accident are well-understood). 

I&C information Information related to the location environmental qualification 

of I&C called out in the SAMGs/EDMGs. 

Plant-specific 

SAMGs and EDMGs 

Also, any training materials / operational aids that will help to 

link the SAMGs/EDMGs with the specific plant 

parameters/criteria of relevance (e.g., SAMGs could refer to 

ongoing radioactive release above Emergency Plan General 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-46 

Input Description 

Emergency levels without sufficient detail to know what basis 

the TSC will use for this judgment). 

12.2.3.3 Analysis Steps

The Severe Accident Progression Analysis consists of six interrelated steps: 

Step 1 – SCALE analysis for decay heat and radionuclide inventory parameters 

The purpose of this task is to take detailed fuel design information and utilize the ORIGEN-ARP 

routine in SCALE (with supporting routines), in order to calculate the quantity and composition 

of various radionuclides in each assembly. The output of SCALE would take the form of 

assembly-by-assembly radionuclide inventories (for the 69 radionuclides considered in a 

standard MACCS2 input), as well as the associated specific energies (W/kg) given off by each 

assembly (decay heat). 

Step 2 – Development of a plant-specific MELCOR model 

This step will take the existing Byron Unit 1 Level 1 PRA MELCOR model, and translate that 

model to represent the as-designed, as-operated Vogtle Unit 1 reactor. This will include 

modification of system geometries, system flow rates, component masses, flow areas, setpoints, etc. using Vogtle-plant-specific information. Along with the routine modeling features 

that the model would have, additional focus will be placed on using diagnostic message (.dia, 

.out) and output streams (.ptf) to make available those plant parameters referenced by the 

SAMGs and EDMGs (e.g., containment pressure in a specified volume). 

Along with the containment (and other structure) failure information developed in the 

Containment Capacity Analysis technical element, the model will need to treat the potential 

failure of RCS components due to high temperatures, most notably (i) seizure of relief valves 

and (ii) induced piping or steam generator tube failures. For the former issue, research 

conducted as part of the SOARCA study will be leveraged. For the latter issue, the NRC and 

the nuclear industry have been conducting research on the relative failure of pressurizer surge 

line, hot leg nozzles, hot leg piping, and steam generator tubes during station blackout 

scenarios for Westinghouse designs for more than two decades. The current state-of-practice 

in modeling these scenarios will be utilized (i.e., detailed counter-current flow simulation 

informed by 1/7th scale experiments and computational fluid dynamics analyses, component-bycomponent Larson-Miller creep rupture indices, plant-specific material properties, and tube flaw 

distributions based on either generic or plant-specific information). 

Step 3 – Accident progression modeling for the representative Level 2 sequences 

The Vogtle MELCOR reactor model developed in the preceding step will be applied to predict 

the accident progression of the various representative sequences. In cases where operator 

actions, system availabilities, or phenomenological responses are expected to create important 

bifurcations in the accident evolution, new simulations will be manually spawned at the time of 

the key events. The analyses will also include sensitivity studies to help formulate the 

uncertainties in key severe accident progression issues, including any relevant boundary 

conditions for analyses to be performed by other computer codes or tools (e.g., combustible gas 

compositions for use in assessment of loads resulting from a hydrogen combustion event). In 

this manner, the results of these analyses are expected to inform: (i) the timing of key events, 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-47 

(ii) the downstream effect of key events on accident progression, and (iii) the general structure 

of the APET(s). 

Step 4 – Phenomenological evaluations for split fraction assignment and logic model 

construction 

The phenomenological evaluations for split fraction assignment and logic model construction will 

follow a process that is based on the appropriate representation of phenomenological 

uncertainties through development of subjective uncertainty distributions that are guided by 

performance of sensitivity calculations, use of relevant test data, and results of applicable 

published studies. The quantification of split fractions may be performed outside of the event 

tree structure using a stress-strength interference concept, and where appropriate, alternative 

quantifications may be utilized. In areas where previously published studies have demonstrated 

an appropriate representation of failure likelihoods, these results will be reviewed for 

applicability to Vogtle, and if appropriate, may be utilized directly (e.g., in-vessel steam 

explosions). Special attention will be focused to those issues that are perceived to have a 

significant impact on early containment failure or containment bypass (e.g., high pressure melt 

ejection-induced direct containment heating, hydrogen combustion, induced SGTRs, etc). For 

more details refer to Section 12.2.4. 

Schedule/resource concerns may limit effort under this step. More specifically, technical 

positions on phenomena (inclusion vs. exclusion; split fraction assignment) may be based on 

internal development and limited effort by the prime Level 2 PRA contractor. In addition, no 

funding would be available for consultation of external experts (e.g., Sandia, Argonne), beyond 

general support that may already be in place as part of the agency’s more routine severe 

accident research. 

Step 5 – Assessment of Post-Core Damage Recovery Actions 

The step will review applicable post-core damage recovery actions that are included as part of 

the EDMGs and SAMGs, for those not already intrinsic in the accident progression sequence 

development covered above, to determine if there are merits for their consideration as part of 

the event progression analyses. See Section 12.2.4 for more discussion on human reliability 

analysis. In some case, the post-core damage recovery actions may be treated as sensitivity 

issues. 

Step 6 – Evaluation of equipment survivability 

This step will take the results of preliminary MELCOR accident progression analyses 

(temperatures, pressures, occurrence of energetic events), a list of the key instrumentation 

needed by operators for executing the SAMGs and EDMGs (stemming from preliminary HRA 

work to identify procedure pathways), and SSCs credited in the logic model, and consider 

whether the instrumentation or SSCs would be affected by harsh environmental conditions. 

Information on the specific failure characteristics of most of this equipment is not expected to be 

available, and will need to be assessed based on a mix of the facility’s design basis for 

equipment qualification (namely compliance with 10 CFR 50.34(f)(2)), consideration of available 

information from past studies, and subjective judgment. What complicates this situation is that 

assuming failure of the equipment is often not conservative in some, or most, aspects (for 

instance, assuming containment sprays are inoperable isn’t conservative if those sprays would 

have been used and would have de-inerted containment during a point in the accident that 

would lead to a hydrogen combustion event). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-48 

Methodologies for treating equipment survivability in severe accidents will be reviewed, 

including those that are dated such as NUREG/CR-5444 (NRC, 1992) and those that are more 

contemporary such as the methodologies used by advanced LWR vendors in their Chapter 19 

design certification documents (e.g., U.S. EPR Design Certification Document (Areva, 2012)), 

with associated NRC Safety Evaluation Reports. There may also be an opportunity to leverage 

ongoing activities associated with a Japan Lessons Learned Tier 3 activity entitled, “Enhanced 

Reactor and Containment Instrumentation Withstanding Beyond-Design-Basis Conditions,” 

whose program plan can be found in Enclosure 3 of SECY-12-0095 (NRC, 2012). 

A closely related issue is the treatment of RCS components due to high temperatures, and this 

issue is discussed above in the step associated with development of a plant-specific MELCOR 

model. 

12.2.3.4 Documentation

Table 12-37 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.2.3.2) are succinct and transparent in enabling an 

independent QA and peer review. 

Table 12-37 Documentation Needs for the Severe Accident Progression Analysis – 

Subtask 1-2.3 

Product Description 

Radionuclide Inventory 

Characterization 

Documentation on the inputs used, the SCALE routines used and 

their respective modeling options (e.g., which ENDF cross-section 

library is used), and the outputs of interest, in a format that can be 

readily included in the Level 2 PRA model documentation. 

Generate a spreadsheet with the decay heat, isotopic masses, 

and isotopic activities in a format that can be used for MELCOR 

ring-by-ring and chemical class-by-chemical class inputs. 

MELCOR Model A QA’d and commented MELCOR 2.x model. 

MELCOR Model 

Shakedown Analysis 

A stand-alone report demonstrating shakedown of the MELCOR 

model for a handful of different accident types. 

MELCOR Model 

Calculation Notebook 

An accompanying calculation notebook documenting all aspects of 

the input model development. 

Calculation Records Documentation of calculations performed for the PDS 

representative sequences, including text description, tabular timing 

results, and graphical accident signatures for key parameters, akin 

to the documentation in NUREG-1935 and NUREG-1953. This 

documentation should be in a format that is suitable for inclusion 

(in part or in whole) in the Level 2 PRA documentation. 

Phenomenological 

Evaluations 

A White Paper providing background and modeling 

recommendations for each of the PWR-specific phenomena 

covered in Table 3.5-8 of the draft ANS Level 2 PRA Standard 

(ANS, 2011), and any additional phenomenological issues that are 

identified as part of the present study. 

Calculation Records Documentation for MELCOR or other code analyses performed to 

investigate specific phenomena and/or generate split fractions. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-49 

Table 12-37 Documentation Needs for the Severe Accident Progression Analysis – 

Subtask 1-2.3 

Product Description 

Post-Core Damage 

Recovery Actions 

Document all relevant post-core damage recovery actions, 

including the basis for human error probabilities (HEPs) used in 

the analyses, where applicable. Any conservative place-holder 

HEPs should also be identified and discussed. 

Characterization of 

Containment 

Environmental 

Conditions 

A report section describing the environmental conditions for the 

calculations performed in Step 3, in terms of pressure, 

temperature, humidity, amount of fission products deposited / 

volatilized, and energetic events, for each major spatial area in the 

model (where instrumentation is known to reside). 

Evaluation of 

Equipment Survivability 

An evaluation of the conditions described above on the I&C 

germane to post core-damage accident behavior (i.e., the I&C 

equipment called out in the SAMGs or EDMGs) with 

recommendations of what I&C should be considered failed, and at 

what point in the simulation it failed. 

12.2.3.5 Task Interfaces

The various technical steps of the severe accident progression analysis are dependent on other 

technical elements for information in order for the step to be completed. These interfaces are 

as follows: 

• Step 3 requires completion of the Level 1 PRA, as well as the Subtask 1-2.1, “Level 1/2 

Interface.” 

• Step 2 will produce a MELCOR model which will also be used for Level 1 PRA success 

criteria. 

• Steps 3 and 6 produce accident and failed I&C information necessary for the Human 

Reliability Analysis. 

• Step 5 requires iteration with the Human Reliability Analysis. 

• Steps 3 through 6 produce information needed for the Subtask 1-2.4. 

12.2.3.6 References

1. Areva, Final Safety Analysis Report Chapter 19, “Probabilistic Risk Assessment and 

Severe Accident Evaluation,” March 2012. 

2. U.S. Nuclear Regulatory Commission, “Instrumentation Availability During Severe 

Accidents for a Boiling Water Reactor with a Mark I Containment,” NUREG/CR-5444, 

February 1992. 

3. U.S. Nuclear Regulatory Commission, “Tier 3 Program Plans and 6-Month Status 

Update in Response to Lessons Learned from Japan’s March 11, 2011, Great Tohoku 

Earthquake and Subsequent Tsunami,” SECY-12-0095, July 13, 2012. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-50 

12.2.4 Subtask 1-2.4: Probabilistic Treatment of Accident Progression

This subtask consists of seven interrelated steps: 

1. Data analysis for components/systems not considered in the Level 1 PRA 

2. Construction of accident progression event trees 

3. Development of support trees 

4. Human reliability model development 

5. Human reliability analysis 

6. Level 2 model quantification 

7. Uncertainty characterization 

The objective of the first step is to develop reliability estimates for SSCs not considered in the 

Level 1 PRA (e.g., core-exit thermocouples, hydrogen sampling system, the Technical Support 

Center data system). The objective of the second step is to develop the set of accident 

progression event tree top events. The objective of the third step is to develop the support trees 

(e.g., fault trees, decomposition event trees) needed to support the APET top events. The 

objective of the fourth step is to modify the Level 1 at-power human reliability analysis model for 

use in Level 2 PRA (e.g., developing a Level 2 PRA analogy for human failure events). The 

objective of the fifth step is to exercise the human reliability analysis for the representative 

sequences from each PDS. The objective of the sixth step is quantification of the Level 2 PRA, 

including handling of large failure probabilities (and the associated issues they can cause during 

quantification). The objective of the seventh step is to identify sources of parameter and model 

uncertainty, characterize these sources via distribution assignment for basic events and split 

fractions, and use of sensitivity analyses to assess the effects of key sources of uncertainty. 

12.2.4.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• APETs will include relevant system availability (not considered earlier in the model), 

operator actions, and phenomenological top events. 

• Identification of human actions, the accident progression analysis, and construction of 

the APET will be necessarily iterative. The initial model will simply use placeholders for 

human error probabilities, until actual values are available. 

12.2.4.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of the Probabilistic Treatment of Accident Progression are identified in Table 

12-38. This information is succinct and transparent in enabling an independent QA and peer 

review. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-51 

Table 12-38 Required Inputs for Subtask 1-2.4 

Input Description 

Reliability Data on 

SSCs that are 

modeled in the Level 

2 PRA, but not 

included in the Level 

1 PRA. 

Any data for the identified subset of components that is not 

included in the Level 1 PRA, and may not be available to 

NRC via its own data collection efforts, which include LERs 

and EPIX. 

Input for the APET 

development 

Periodic phone calls (e.g., monthly) to confirm specific 

modeling assumptions associated with plant design or 

operation related to post-core damage behavior (e.g., 

confirming that the electrical dependency of a particular 

component or instrument channel is well-understood). 

Procedures on 

SAMG and EDMG 

Operator actions and timing for the post-core damage 

operator actions for HRA. 

Plant Operation and 

design 

Discussions with plant engineering or operations staff, to 

better understand the potential range of uncertainties and 

their effects, it is possible that interactions would be needed 

with the licensee to ask specific, detailed questions regarding 

plant operation and design. 

12.2.4.3 Analysis Steps

The Probabilistic Treatment of Accident Progression consists of seven (7) interrelated steps: 

Step 1 – Data analysis for components/systems not considered in the Level 1 PRA 

Some SSCs of relevance to the Level 2 PRA are also of relevance to the Level 1 PRA 

(e.g., containment fan coolers) and thereby should be covered by the data analysis for the 

Level 1 PRA. Some SSCs relevant to the Level 2 PRA (e.g., TSC unavailable due to 

maintenance) are covered by NRC reporting requirements, and thereby data-based failure rates 

could be developed. Yet other SSCs of relevance to the Level 2 PRA are not covered by NRC 

reporting requirements and will necessarily need to be based on assumptions or generic failure 

rates for similar SSCs. A determination will be made on a case-by-case basis as to which 

approach is appropriate for the given basic event or split fraction, informed in part by the 

expected significance of the item. 

Schedule/resource concerns may limit effort under this step. 

Step 2 – Construction of accident progression event trees 

Questions in the APET will be organized approximately in a chronological or causal order. In 

addition to any introductory questions needed to address specific information transfer concerns 

not covered by the integrated Level 1/Level 2 model, four main time frames may be 

distinguished in the set of questions/top events: 

• Very Early Time Frame: This period starts from the beginning of core damage and lasts 

up until (but not including) the time of vessel breach. Potentially important phenomena 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-52 

include hydrogen combustion; In-Vessel Steam Explosions (IVSEs); and temperatureinduced creep rupture of the hot leg (nozzles and/or piping), pressurizer surge line, or 

steam generator tubes. 

• Early Time Frame: This period includes the time of vessel breach as well as the time 

associated with the containment transient just after vessel breach (typically a duration of 

less than 30 minutes). Potentially important phenomena accompanying vessel breach 

include Direct Containment Heating (DCH), hydrogen combustion, vessel rocketing, and 

Ex-Vessel Steam Explosions (EVSEs). Some of these phenomena can be ruled out as 

potential causes for containment failure for Vogtle but can still affect the conditions 

inside containment during this period. 

• Intermediate Time Frame: This period begins at the end of vessel blowdown (i.e., the 

end of the Early Time Frame), and lasts for approximately 8 to 12 hours thereafter. The 

duration of this time frame is chosen such that it includes the majority of the ex-vessel 

core debris oxidation and fission product release. Potentially important phenomena in 

this time frame include ex-vessel steam explosions and combustion of hydrogen and/or 

carbon monoxide generated during MCCI. 

• Late Time Frame: This period extends from the end of the intermediate time frame until 

the end of the Level 2 PRA mission duration (e.g., 48 hours from the time of scram or 

accident initiation or until a stable configuration is achieved whichever is longer). The 

potentially important phenomena in this time frame include quasi-static pressurization of 

the containment due to MCCI and decay heat, revaporization of radionuclides from 

surfaces (only relevant to source term analysis), and possible Basemat Melt-Through 

(BMT) during MCCI. 

For each phase, the relevant system-related and phenomenological issues will be considered, 

including dependencies as applicable. 

Schedule/resource concerns may limit effort under this step. 

Step 3 – Development of support trees 

While some split fractions will be derived values (with no underlying logic model), the 

expectation is that many will have underlying support trees. Here, the term support tree is used 

to describe a range of possibilities, but most notably fault trees and decomposition event trees. 

SAPHIRE8 has the capability to model both of these types of trees as the underlying logic for a 

top event split fraction. In general, fault trees are expected to be used for system availabilities 

while decomposition event trees are expected to be used for phenomenological events. 

Schedule/resource concerns may limit effort under this step. 

Step 4 – Human reliability model development 

This topic is covered in Section 9. 

Step 5 – Human reliability analysis 

This topic is covered in Section 9. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-53 

Step 6 – Level 2 model quantification 

Quantification of the Level 2 model will be performed using SAPHIRE8’s general quantification 

techniques. Special care will need to be taken given the issues that arise with many 

quantification techniques when high failure rates are present. However, it is anticipated that 

these issues can be addressed using the same approach used in quantifying the seismic 

Level 1 PRA model (which may include direct solution for specified portions of the model, use of 

Binary Decision Diagrams, etc.) The quantification process will generally follow the analogies of 

the Level 1/LERF Standard’s Quantification (QU) requirements, which are in turn referenced in 

the draft Level 2 Standard’s Probabilistic Treatment (PT) requirements. 

Step 7 – Uncertainty characterization 

Level 1 PRA revolves around a Boolean-based logic model, relying heavily on data-based 

component failure probabilities and the use of success criteria to represent offline deterministic 

simulations. The Level 3 portion of a Level 3 PRA revolves around deterministic offsite 

consequence simulations, with probabilistic sampling to generate the needed conditional 

probability outputs. The Level 2 PRA is the transition point between these two technologies, 

and is a mix of logic modeling and deterministic simulation. This situation manifests differences 

in terms of capturing uncertainty between a fundamentally Boolean model and a fundamentally 

simulation-based model. A Boolean model makes it much more straight-forward (and less 

costly) to capture uncertainty, but is arguably poorly suited for quantifying accident progression 

modeling uncertainty (and this is the reason that contemporary Level 1 PRA models rely on 

consensus models or sensitivity analyses to consider uncertainty in the success criteria or other 

deterministic inputs (e.g., seal LOCA modeling)). 

It’s also important to recall that there are fundamentally two related but distinct types of 

uncertainty in the Level 2 PRA. The first is the uncertainty associated with the probabilistic 

model which manifests itself in the uncertainty in release frequencies (e.g., the frequency of 

release category 4 is 1·10-5/yr with a 5th and 95th percentile of 2·10-7/yr and 8·10-5/yr 

respectively). The second is the uncertainty in the deterministic simulations which manifests 

itself in the source term characteristics (e.g., the start of release for release category 4 is 8 

hours, with a 5th and 95th percentile of 11 hours and 5 hours respectively). To complicate 

matters, uncertainty associated with the deterministic simulation can be represented in the 

uncertainty in the probabilistic model (e.g., 10 closely-related simulations were run and a 

hydrogen deflagration occurred in 1, so the split fraction for hydrogen deflagration will be 0.1) 

and vice versa (the relief valve will be assumed to stick open after 70 cycles because that is the 

median of the probability density function for the valve’s failure probability). 

With the above in mind, there is no plan to formally propagate uncertainty through the Level 2 

analysis (beyond the plant damage state bins) for three reasons. First, the resources associated 

with ascribing meaningful uncertainty distributions to all sources of uncertainty in the Level 2 

PRA is prohibitive, given the resources available for conducting the work. Second, the 

correlation between dependent sources of phenomenological uncertainty (e.g., the effect of 

uncertainty in the size of an induced containment leak correlated to the uncertainty in the rate of 

de-inerting due to steam condensation) can be difficult to mathematically capture, more-so than 

the analogous state-of-knowledge correlation used prevalently in Level 1 PRA for assessing 

correlation effects on data-driven basic events. Finally, there is some debate amongst the 

technical community about the appropriateness of combining different types of uncertainty 

within the Level 2 PRA. This approach (identification and characterization, but not propagation) 

is consistent with Capability Category II of the current draft of the ANS Level 2 PRA Standard. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-54 

As such, the proposed approach will be to identify key sources of uncertainty (i.e., those 

sources whose effect on the results could be expected to change the analyses’ conclusions), 

and for these sources to characterize their effect via sensitivity analysis. Note that a workshop 

focusing on sources of PRA uncertainty took place in February 2012 (NRC, 2012), with a 

session focused on Level 2 PRA uncertainty. That group attempted to build off a list of LERF 

PRA uncertainties identified in Appendix A (Tables A-1 and A-4) of EPRI TR-1016737 (EPRI, 

2008). Both of these documents will be used for identifying sources of uncertainty in this 

project. 

Schedule/resource concerns may limit effort under this step. 

12.2.4.4 Documentation

Table 12-39 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.2.4.2) are succinct and transparent in enabling an 

independent QA and peer review. 

Table 12-39 Documentation needs for the Probabilistic Treatment of Accident 

Progression – Subtask 1-2.4 

Product Description 

List of additional SSCs 

Considered in the Level 

2 PRA 

A list of SSCs that require development of failure or availability 

estimates, beyond those considered in the Level 1 PRA or 

Level 1/2 PRA Interface technical element. 

Failure/availability 

probabilities 

A report section documenting data analysis or other methods 

(using operating experience when feasible) for estimating 

failure or availability probabilities and distributions, for relevant 

SSCs. 

APET Logic Model A SAPHIRE model containing the APETs, with transfers from 

the extended Level 1 event trees. 

A report section documenting the basis for the selection of top 

events for each APET. 

A SAPHIRE model containing the support trees, with linkages 

to the APET tops that they support. 

A report section documenting the basis for the construction of 

the various support trees. 

Human Reliability 

Analysis 

Document the human actions, and associated human error 

probabilities. 

Level 2 PRA Model and 

Quantification 

A SAPHIRE model containing the complete Level 2 PRA logic 

model. 

A report section documenting the method(s) of quantification 

and quantification modeling selections (e.g., truncation value). 

Identification and 

Characterization 

Parameter and Modeling 

A report section describing those aspects of the logic model 

and underlying deterministic models which have important 

parameter and modeling uncertainties. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-55 

Table 12-39 Documentation needs for the Probabilistic Treatment of Accident 

Progression – Subtask 1-2.4 

Product Description 

Uncertainties Characterization of the above uncertainties in terms of 

parameter distributions, split fraction intervals, or alternative 

modeling choices. 

Sensitivity Analyses Sensitivity analyses showing the effect on key figures-of-merit 

(e.g., large early release frequency, large release frequency) of 

the key sources of parameter and modeling uncertainty. 

12.2.4.5 Task Interfaces

The various technical steps of the probabilistic treatment of accident progression are dependent 

on other technical elements for information in order for the step to be completed. These 

interfaces are as follows: 

• Steps 2 and 3 require completion of the Level 1 PRA, as well as the Subtask 1-2.1, 

“Level 1/2 Interface.” 

• Step 7 results in release frequencies and APET end-states, both of which are needed by 

the Level 2/3 PRA Interface technical element. 

• The sensitivity analysis portion of Step 7 requires completion of the radiological source 

term results of the Level-2 PRA (Section 12.2.5) in order to use LERF and LRF as 

figures-of-merit. 

12.2.4.6 References

1. EPRI TR-1016737, “Treatment of Parameter and Modeling Uncertainty for Probabilistic 

Risk Assessments,” Electric Power Research Institute, December 2008. 

2. U.S. Nuclear Regulatory Commission, “2/29/2012 – 3/1/2012 Meeting Presentations: 

PRA Uncertainty Workshop,” Rockville, Maryland, March 2012, ML120680425. Note that 

an associated NUREG/CR is under development. 

12.2.5 Subtask 1-2.5: Radiological Source Term Analysis

The Radiological Source Term Analysis consists of three interrelated steps: 

1. Definition of the release category binning logic 

2. Development of source terms for the various release categories 

3. Consideration of uncertainties in the source term development 

The objective of the first step is to develop the logic (event tree or otherwise) that will be used 

for binning the APET end-states in to release categories for use in the Level 3 PRA. The 

objective of the second step is to take the MELCOR source terms that are a natural outcome of 

the PDS representative sequences analyses and sensitivity analyses, and specify which source 

term(s) (or what modified source term(s)) will be those associated with each release category. 

The objective of the third step is to re-visit the issue of uncertainty in the context of any 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-56 

important source term uncertainties that were not captured in the Probabilistic Treatment 

technical element (i.e., in the APET). 

12.2.5.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• For the internal hazards Level 2 PRA, there will be 10 – 20 release categories. 

• Metrics (namely large early release frequency) will be based on interim criteria, and the 

need to re-define these criteria will be re-evaluated once the Level 3 results are 

available. 

12.2.5.2 Inputs

The inputs to this subtask are the source term products from Subtask 1-2.3 and 1-2.4. 

12.2.5.3 Analysis Steps

The Radiological Source Term Analysis consists of three (3) interrelated steps: 

Step 1 – Definition of the release category binning logic 

As with the PDS binning, the release category binning steps represents another phase in the 

analysis where the explosion of sequences needs to be parsed back in to a manageable set of 

sequences. Criteria will be developed to accomplish this, likely using the warning time (the time 

between the declaration of a General Emergency and the time that a significant release of 

fission products to the environment occurs), the cumulative I-131 release fraction and the 

cumulative Cs-137 release fraction as discriminators. The target will be to develop a set of a 

couple of tens of release categories. 

Schedule/resource concerns may limit effort under this step. 

Step 2 – Development of source terms for the various release categories 

For each release category, a representative source term must be identified (akin to the 

representative sequence(s) for each PDS). Again, the intent will be to develop best-estimate 

source terms (i.e., no attempt to bias the source term selection to bound the offsite 

consequence results). 

These source terms will be developed using the results of plant-specific MELCOR calculations, 

to calculate the various steps in the release and transport of radionuclides from the fuel to the 

environment. The release factors that will be evaluated using the results of MELCOR 

calculations will include: 

• Release from fuel to the reactor coolant system 

• Retention inside the reactor coolant system 

• Revaporization fraction of the previously deposited radionuclides 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-57 

• Retention of fission products in water pools in the containment and or environment (e.g., 

water build-up over the location of break for ISLOCA scenarios, if applicable) 

• Release of remaining radionuclides during MCCI 

• Retention of MCCI releases by any overlying water pools 

• Retention of radionuclide inside containment 

• Retention of radionuclide inside the auxiliary building or other adjoining structure, if 

applicable 

• Retention of radionuclide on the secondary side of steam generators, for SGTR events 

These physical processes are covered by the physical models in the MELCOR code. 

To the extent possible, a specific MELCOR calculation will be performed to determine the 

source term for each major release category. It may be necessary for some release categories 

to be assigned a surrogate release based on results for an otherwise similar release category 

together with logical argument. In addition, post-calculation adjustment of source terms may be 

necessary in cases where MELCOR yields inconsistent results (e.g., lower releases from a 

calculation with MCCI vs. an otherwise identical calculation without MCCI). In these cases, clear 

logical arguments will be provided for assignment of all surrogate and adjusted source terms. 

Schedule/resource concerns may limit effort under this step. 

Step 3 – Consideration of uncertainties in the source term development 

This step is analogous to the final step under the probabilistic treatment technical element (i.e., 

Subtask 1-2.4), and will follow the same approach as is outlined in Step 7 under Subsection 

12.2.4.3, above. The quantification process will involve the development of subjective 

uncertainties associated with each release factor that are listed in Step 2..This process will be 

limited in scope, and it will attempt to use the results of plant-specific MELCOR sensitivity 

calculations, to describe the uncertainties in the source term predictions. Alternatively, the 

Level 2 PRA analysts will develop uncertainty distributions based on the available literature 

information. 

Schedule/resource concerns may limit effort under this step. 

12.2.5.4 Documentation

Table 12-40 provides the details of documentation needs. The documentation is succinct and 

transparent in enabling an independent QA and peer review. 

Table12-40 Documentation Needs for the Radiological Source Term Analysis – 

Subtask 1-2.5. 

Product Description 

Logic Model A SAPHIRE model containing the release category binning logic 

(in event tree, or other, format), with transfers from the APET endstates. 

A report section documenting the basis for the selection of the 

release category binning. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-58 

Table12-40 Documentation Needs for the Radiological Source Term Analysis – 

Subtask 1-2.5. 

Product Description 

Representative 

Source Terms 

A report section documenting the selection of representative 

source terms for each release category, based on results from the 

MELCOR accident progression analyses and sensitivity analyses. 

Identification and 

Characterization 

Parameter and 

Modeling 

Uncertainties 

A report section describing those aspects of the source-termspecific logic model and underlying deterministic models which 

have important parameter and modeling uncertainties, and are not 

adequately addressed in the Probabilistic Treatment technical 

element. 

Characterization of the above uncertainties in terms of parameter 

distributions, split fraction intervals, or alternative modeling 

choices. 

Sensitivity Analyses Sensitivity analyses showing the effect on key figures-of-merit 

(e.g., large early release frequency) of the key sources of 

parameter and modeling uncertainty. 

12.2.5.5 Task Interfaces

The various technical steps of the radiological source term analysis are dependent on other 

technical elements for information in order for the step to be completed. These interfaces are 

as follows: 

• Step 1 requires inputs from the MELCOR analyses covered under the Subtask 1-2.3. 

• Step 2 results in the uncertainties associated with radiological releases needed for the 

Level 3 risk analysis. It interfaces with Step 7 under Subsection 12.2.4.3. 

12.2.5.6 References

None. 

12.2.6 Subtask 1-2.6: Evaluation and Presentation of Results

The Evaluation and Presentation of Results consists of two (2) interrelated steps: 

1. Consolidation of the interim Level 2 PRA model documentation 

2. Consolidation of the final Level 2 PRA model documentation 

The objective of the first step is to develop the interim Level 2 PRA model documentation using 

the products developed under the previous technical elements in such a manner that portions of 

the report can be utilized for the final project report, and highlighting the limitations of the model. 

The objective of the second step is to finalize the above documentation, incorporating changes 

brought about by internal and external review. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-59 

12.2.6.1 Assumptions and Limitations

No assumptions or limitations are currently identified. 

12.2.6.2 Inputs

The inputs to this subtask are the products from Subtasks 1-2.1 through 1-2.5. 

12.2.6.3 Analysis Steps

The Evaluation and Presentation of Results consists of two interrelated steps: 

Step 1 – Consolidation of the interim Level 2 PRA model documentation 

As the name implies, this step documents the work performed in the preceding technical 

elements/tasks to arrive at a draft model and report that support review and refinement. This 

step will follow the documentation guidelines developed for the overall project. 

Step 2 – Consolidation of the final Level 2 PRA model documentation 

This step documents the work performed in the preceding technical elements/tasks to arrive at a 

final model and report that support use and refinement. This step will follow the documentation 

guidelines developed for the overall project. 

12.2.6.4 Documentation

Table 12-41 provides the details of documentation needs. The documentation is succinct and 

transparent in enabling an independent QA and peer review. 

Table 12-41 Documentation for Subtask 1-2.6 

Product Description 

Interim model report A report that consolidates the products developed under the 

previous technical elements and evaluates the model results, 

in such a manner that portions of the report can be utilized for 

the final project report, and highlighting the limitations of the 

model 

Final model report A final version of the above report which incorporates 

changes brought about by internal and external review. 

12.2.6.5 Task Interfaces

The various technical steps of the evaluation and presentation of results are dependent on other 

technical elements for information in order for the step to be completed. These interfaces are 

as follows: 

• Step 1 requires completion of all previous technical elements within the Level 2 PRA. 

• Overall project documentation is dependent upon completion of Steps 1 and 2. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-60 

12.2.6.6 References

None. 

12.2.7 Subtask 1-2.7: Level 2/3 PRA Interface

The Level 2/3 PRA Interface consolidates the release category information in a format 

conducive for use by the Level 3 PRA analysts. The objective of this subtask is to catalogue the 

characteristics of each release category (release frequency, time-dependent chemical classspecific release fractions, sequence information sufficient for establishing declaration of 

emergency action levels, release energy and elevation, and aerosol size distributions). 

12.2.7.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• Only atmospheric release information is considered in the Level 2 and Level 3 analysis. 

• For the at-power reactor analysis, release fractions are only needed on a chemicalclass-specific basis. 

12.2.7.2 Inputs

The inputs to this subtask are the products from Subtask 1-2.5. 

12.2.7.3 Analysis Steps

The Level 2/3 PRA Interface consists of one (1) step: 

Step 1 – Consolidation of the release category information in a format conducive for use 

by the Level 3 PRA analysts 

This step takes the information of relevance to the Level 3 PRA practitioners and consolidates in 

an easy-to-use manner. This includes the release categories in electronic format (for input to 

MELMACCS), information about the progression through the emergency action levels for each 

release category (which will have been a necessary development to support the release 

category binning), information about the event progression such as the occurrence of energetic 

events for each release category (to inform decisions about emergency response modeling), 

etc. This information will be used as inputs to the Level 3 PRA (i.e., consequence analysis) in 

Section 12.3 of the TAP. 

12.2.7.4 Documentation

Table 12-41 provides the details of documentation needs. The documentation is succinct and 

transparent in enabling an independent QA and peer review. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-61 

Table 12-41 Documentation for Subtask 1-2.7 

Product Description 

Level 2/3 PRA 

Interface Report 

Describes the set of information needed by the Level 3 PRA 

analysts, on a release category-specific basis. For each 

release category, this includes release frequency, timedependent chemical class-specific release fractions, 

sequence information sufficient for establishing declaration of 

emergency action levels, release energy and elevation, and 

aerosol size distributions. 

12.2.7.5 Task Interfaces

The subtask interfaces with Level 3 PRA, providing source term characteristics from each 

release category. 

12.2.7.6 References

None. 

12.3 Task 1-3: Level 3 Reactor PRA, At-Power for Internal Hazards

Level 3 PRA assesses the consequences of releases of radioactive materials on the 

surrounding population and environment. The Level 3 PRA task is divided into 9 subtasks 

associated with each technical element of the analysis. These include: 

1. Subtask 1-3.1 – Transition from the Radionuclide Release to Level 3 

2. Subtask 1-3.2 – Protective Action Parameters and Other Site Data 

3. Subtask 1-3.3 – Meteorological Data 

4. Subtask 1-3.4 – Atmospheric Transport and Dispersion 

5. Subtask 1-3.5 – Dosimetry 

6. Subtask 1-3.6 – Health Effects 

7. Subtask 1-3.7 – Economic Factors 

8. Subtask 1-3.8 – Quantification and Reporting 

9. Subtask 1-3.9 – Risk Integration 

The consequence analysis will primarily be based on the radioactive materials releases to the 

atmosphere. The analysis will be performed using the WinMACCS/MACCS217 computer code 

[1], which was specifically developed to evaluate off-site consequences from a hypothetical 

release of radioactive materials into the atmosphere. 

For each of these elements, the information that will be provided include the assumptions and 

limitations; input needs; analysis steps; task interfaces; and and quality assurance. The 

discussions herein focus on the Level 3 PRA for reactor at power for internal events. In 

addition, when a discussion is also common to other radioactive sources such as spent fuel pool 

(SFP) and dry cask storage (DCS), they will be parenthetically mentioned. 

 

17 WinMACCS is a window based code with a graphical user interface (GUI) for preparing various MACCS2 input parameters. 

MACCS2 is the central processing code for WinMACCS. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-62 

12.3.1 Subtask 1-3.1: Transition from the Radionuclide Release to Level 3

This subtask discusses the elements required for consequence analysis. The Level 2 PRA 

characterizes radionuclide releases to the environment resulting from each accident sequence 

that contributes to the total core damage frequency. In this section, the approach described is 

the implementation of the specific aspects of the element that is related to the consequence 

analysis for the reactor at power for internal events. This subtask consists of four steps namely: 

(1) development of inventory data, (2) implementation of source term data, (3) the development 

and radiological release bins, and (4) identification of the sources of model and parameter 

uncertainties. 

12.3.1.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of details 

of analyses that are performed: 

• Level 2 PRA generates radionuclide-specific release characteristics based on the results 

of the accident progression analyses, including the quantity and form; the timing and 

duration; and the energy and the height of each release. Radionuclide-specific 

considerations may enable capturing releases from fuel with a distribution of different 

burnup/power levels. 

• Reactor core radionuclide inventory is determined using an appropriate computer code 

(in this case the ORIGIN2 [2]/SCALE [3] computer code package). 

• The number of release categories will be limited to 30. 

12.3.1.2 Inputs

The design, maintenance, and operational information required to perform the associated steps 

are identified in Table 12-42. This information should be succinct and transparent to enable an 

independent quality assurance (QA) and peer review. 

Table 12-42 Needed Inputs for Subtask 1-3.1 

Input Description 

Fuel data This information includes reactor (SFP, and cask) fuel data 

with power levels, burnups, and enrichment information to 

generate radionuclide inventory (i.e., Curies [Becquerel]) of 

the fuel inside the reactor core (or SFP or DCS). Core 

radionuclide inventory (in terms of mass) is an input to the 

MELCOR code and it is used in the analysis of radionuclide 

release and transport performed for the Level 2 PRA accident 

progression and source term quantification. 

Core inventory data From previous step. 

Accident progression 

data 

This information includes time dependent release fractions 

for risk-dominant radionuclide groups, as well as other 

information such as plume density, flow rate, release energy, 

and release height. This information is available from Level 2 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-63 

Table 12-42 Needed Inputs for Subtask 1-3.1 

Input Description 

PRA. 

Multi-source release 

information 

The combinations of possible source terms to be considered 

in offsite consequence analysis 

Release category 

frequencies 

Release category or source term frequencies are needed for 

determination of severe accident risks. This information is 

available from Level 1/2 PRA. 

Accident progression 

and release 

characterization 

information 

Uncertainties in the processes specifically related to 

radionuclide source term characterization and associated 

frequencies. 

12.3.1.3 Analysis Steps

This subtask consists of four steps: 

1. Development of inventory data 

2. Implementation of source term data 

3. Development and binning of releases 

4. Identification of source of model and parameter uncertainty 

Step 1 – Development of Inventory Data 

The objective of this step is to determine the radionuclide inventory in the reactor core (SFP or 

DCS). This information is used along with the estimates of the release fractions that are 

provided from Level 2 PRA to determine the radionuclide-specific quantities that are released to 

the environment. The reactor core radionuclide inventory is determined based on the fuel 

enrichment and the expected burnup (power history) using a computer codes such as 

ORIGEN2 [2]/SCALE [3], which includes ORIGEN as one of its modules, for isotope generation 

and depletion during the reactor operating cycle. 

Step 2 – Implementation of Source Term Data 

The objective of this step is to prepare and implement the accident sequence/release category 

release characteristics, which include: 

• The chemical group characteristics (i.e. grouping of radionuclides) 

• The release magnitudes and profiles (i.e., the release fractions) 

• The plume segment characteristics 

• Radionuclide decay characteristics (i.e. pseudostable radionuclides) 

• The start time and duration of release 

• The energy of release 

• The height/location of release relative to the ground level 

• The size associated with the released aerosols 

• The frequency of release 

Much of this information is available from the outputs of the Level 2 PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-64 

Step 3 – Development and Binning of Releases 

The number of unique severe accident sequences represented in a Level 2 PRA can be 

exceedingly large. Comprehensive, probabilistic consideration of the numerous uncertainties in 

severe accident progression can easily expand a single accident sequence (or plant damage 

state) from the Level 1 PRA into a large number of alternative severe accident progressions. A 

radiological source term must be estimated for each of these Level 2 PRA accident progression 

end-states. Clearly, it is impractical to perform that many deterministic source term calculations. 

The objective of this step is to group/bin a finite number (as small as is practical while retaining 

the major consequence-distinguishing characteristics) of accident progression end-states (i.e., 

release categories or release bins which are the final results of the accident progression event 

trees) based on their common accident progression characteristics and their likely effects on 

emergency preparedness and consequence. This binning is expected to occur as part of the 

Level 2 analysis. After the source terms have been binned, representative source terms will be 

identified to represent the bins in offsite consequence calculations based on relative release 

frequency, release characteristics, and potentially other factors. 

Step 4 – Identification of Source of Model and Parameter Uncertainty 

The uncertainties related to the transition from the radionuclide release to Level 3 will be 

identified. The uncertainties in the source term will be evaluated as part of the Level 2 portion of 

the study. However, the level that these source term uncertainties can and will be considered in 

the offsite consequence calculations will be determined as part of this analysis step. 

12.3.1.4 Documentation

The process for radionuclide inventory calculation including assumptions and inputs should be 

documented. The documentation also includes the radiological releases (source terms) 

resulting from various severe accidents as analyzed in the Level 2 PRA, and their associated 

characteristics. Table 12-43 provides the details of documentation needs. The documentation 

(along with the identified inputs described in Section 12.3.1.2) should be succinct and 

transparent to enable an independent QA and peer review. 

Table 12-43 Documentation Needs for Subtask 1-3.1 

Products Description

Radionuclide 

inventory data 

Document the radionuclide inventory data with sufficient 

supporting documents including information on the 

assumptions on power operating cycle and core equilibrium 

burnup. Core inventory will become part of the input to the 

MACCS2 model.

Release category 

attributes and release 

(source term) 

characteristics 

Document the basis for attributes used to define the various 

release (source term) categories/bins and the associated 

characteristics of the selected representative source term for 

the category (e.g., quantity in the form of time dependent 

release fractions, time of release initiation, form of release, 

release height, release energy, etc.). This information will 

become part of the input to the MACCS2 model. 

Sources of model 

and parameter 

uncertainty for source 

term development 

The documentation of the transition of radionuclide release to 

Level 3 will be documented. Any offsite consequence 

analyses of the source term uncertainties as determined by 

the Level 2 analyses will also be documented. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-65 

12.3.1.5 Task Interfaces

The following lists the interfaces between this subtask and the other elements of the PRA: 

• Steps 2 and 3 require completion of the Level 2 accident progression analyses, and the 

resultant source term quantities and attributes. This information could include the multisource release information for the multi-unit considerations. 

12.3.2 Subtask 1-3.2: Protective Action Parameters and Other Site Data

This subtask discusses parameters that affect the modeling aspects of the offsite protective 

actions in response to a severe accident. Protective actions include emergency response 

during the accident as well as longer-term actions to protect the public from contaminated land 

and food. Previous studies have shown that protective actions can have a significant effect on 

both the dose received by individuals and costs associated with radiological impacts, such as 

from remediation of contaminated land. In order to properly model protective actions, it is also 

important to evaluate the population distribution surrounding a site, offsite property values, and 

other site-specific considerations. Therefore, this subtask considers (1) the modeling of 

emergency response, (2) the modeling of long-term protective actions, and (3) the site-specific 

parameters. Furthermore, the sources of model and parameter uncertainty are identified for 

quantification for each one of aforementioned steps. 

12.3.2.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and the level of 

details of analyses that are performed: 

• Emergency response planning and protective actions will include evacuation, sheltering, 

normal and hotspot relocation, land interdiction, and ingestion of potassium iodide (KI) 

pills, as appropriate. How to best model food/water interdiction in the analysis will be 

evaluated by the project team. The accidents are typically evaluated in accident phases. 

Whether the analysis will have an intermediate phase will also be evaluated by the 

project team. 

• Dose criteria for food/land interdiction and relocation will be based on EPA and FDA 

guidance. 

• The public will behave in an orderly fashion during and after the accident, and can be 

represented by cohorts. How to best consider those that fail to evacuate in the 

evacuation model and the consequence results will be evaluated by the project team. 

• Evacuation modeling will consider staged evacuations as determined by the actual 

decision process, and will use the Vogtle-specific evacuation time estimate (ETE). 

• A shadow evacuation for those that are not directed to evacuate, but are likely to 

evacuate anyways, will be evaluated. 

• Site-specific population data will be based on the available data from the latest version 

of SECPOP, and extrapolated forward to a target year, as appropriate. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-66 

• The dose criterion for decontamination after a severe accident is uncertain. No longterm land cleanup goal or level currently exists. The current state of practice is to model 

decontamination to the level of meeting the habitability (return) criterion applicable at the 

particular site. How best to consider decontamination will be decided by the project 

team. Land use data (land/water fraction, fraction of land devoted to farming, etc.) and 

land value data will be based on current information from the Bureau of Economic 

Analysis. This data is available for Vogtle site (i.e., from the recent combined license 

application for Vogtle 3 and 4 power plants under construction at the same site). 

12.3.2.2 Inputs

The information required to perform the associated steps are identified in Table 12-44. This 

information should be succinct and transparent to enable an independent QA and peer review. 

Table 12-44 Needed Inputs for Subtask 1-3.2 

Inputs Description 

Emergency 

planning 

Site-specific emergency planning documentation providing 

information on evacuation time estimate, emergency planning 

zone, emergency response phases, sheltering and normal 

activities from exposure to contaminated ground and cloud, 

ingestion of potassium iodide; criteria for hot-spot relocation; 

evacuation strategies and cohorts; etc. 

Long-term 

protective actions 

These include characteristics of interdiction, decontamination, 

and condemnation, such as dose criteria for land/food, 

decontamination factors, start and length of decontamination, 

etc. 

Site Demographic 

data 

Population distribution around the site 

Land use and 

economic data 

Land/water fraction and land use (i.e., farmland). 

Land value data based on information from bureau of 

economic analysis. 

Source of 

uncertainty 

Uncertainties on ETE, evacuation strategy, land use, and 

economic data parameters as well as the uncertainties in 

emergency response modeling (i.e., delay and evacuation 

timing). 

12.3.2.3 Analysis Steps

This subtask consists of four steps: 

1. Emergency response modeling 

2. Long-term protective action modeling 

3. Site-specific parameters 

4. Identification of source of model and parameter uncertainty 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-67 

Step 1 – Emergency Response Modeling 

Each nuclear power plant site is required to have in place, plans for emergencies to protect the 

public health and safety following potential accidents. The objective of emergency response 

modeling is to implement more realistic treatment of the site-specific emergency response 

plans. Emergency plans initiate response activities in accordance with the classification 

scheme based on emergency action levels. Preplanned actions are implemented at each 

classification level, including unusual events, alerts, site area emergencies, and general 

emergencies. Each site is required to have in-place an emergency plan implementation 

procedure that clearly identifies the timing of various action levels. These include an evacuation 

plan with detailed evacuation time estimates. The parameters that are modeled in MACCS2 

include evacuation strategy and the number of cohorts. A cohort is a population group that 

mobilizes or moves differently from other population groups. Evacuation order usually refers to 

individuals that reside within the emergency planning zone (about 10-mile radius of the site, 

depending on the site emergency plan procedure). A number of cohorts could be established to 

represent the members of the public who may evacuate early, evacuate late, or may refuse to 

evacuate, and those that evacuate from areas that are not under evacuation order (called a 

“shadow evacuation” cohort). How to best consider those that fail to evacuate in the evacuation 

model and the consequence results will be evaluated. Accident scenario attributes from Level 

1/2 PRA identify the various time parameters that affect the implementation of various 

evacuation strategies. Site evacuation routes are well defined in the Vogtle ETE report. The 

effective evacuation speed is based on the values determined in the site-specific evacuation 

time estimate report. Another factor considered is the time delay between the initiation of site 

emergency and the start of the evacuation or sheltering. Finally, hotspot and normal relocation, 

and KI ingestion will also be evaluated as part of emergency response. The specific details of 

the EP model for each modeling case may vary depending upon the nature of the accident 

being modeled. The details for each case will be developed in close coordination with 

experienced EP staff. 

Step 2 – Long-term Protective Action Modeling 

The objective of this step is to identify the long-term protective action parameters for input into 

the emergency plan. Long term protective actions include food/water and land interdiction, 

decontamination, condemnation. How to best model food/water interdiction in the analysis will 

be evaluated. Also, whether the analysis will have an intermediate phase will also be evaluated. 

Dose limit/criteria for land interdiction and relocation will be based on the EPA protective action 

guideline (EPA 400-R-92-001 [4]). 

One issue that will be evaluated is how best to model long-term decontamination. The current 

state of practice is to consider decontamination only if it will eventually allow for the return of 

land to habitability, and if it is economic to do so. However, a long-term cleanup policy for 

severe accidents does not currently exist, and such guidance is currently being established. 

Such guidance could likely allow for the cleanup goals to be developed locally after an accident, 

to account for a number of factors that include sociopolitical, technical, and economic 

considerations. Given that such a policy for long-term cleanup does not currently exist (and 

because a developed policy may not contain explicit cleanup goals), the project may use dose 

levels associated with habitability as the point in deciding when land is to be decontaminated, 

and will evaluate whether further decontamination could be expected. Using the dose level for 

habitability is consistent with previous studies. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-68 

The objective of decontamination is to reduce projected doses in a cost-effective manner. If the 

maximum decontamination level is insufficient to restore an area to immediate habitability, a 

period of temporary interdiction following the maximum decontamination level is considered in 

order to allow for dose reduction through radioactive decay and weathering. Currently, in 

MACCS2, if a property cannot be made habitable within 30 years or if the cost of reclaiming the 

habitability of a property exceeds the cost of condemnation, the property is considered to be 

condemned and permanently withdrawn from use. 

Step 3 – Site-Specific Parameters 

The objectives of this step are to prepare site-specific data on demography, land use, and 

economic data. The site specific-meteorological data is discussed in Subtask 1-3.3 below. The 

information required for each category is summarized below. 

Demography: Population distribution around the plant on a polar grid (MACCS2 accepts 16, 

32, 48 and 64 angular sectors) and user-specified annular radial sectors, usually a finer grid 

close to the plant and one that becomes progressively coarser at greater distances. The 

population information can be generated by the SECPOP code (NUREG/CR-6525, Rev 1 [6]), 

and this can be extrapolated forward to a target year as necessary. The latest version of 

SECPOP at this time is SECPOP2000, although the next version is expected soon and may be 

available. 

Land use: Fraction of the area in each spatial segment that is land, and fraction of land which 

is agricultural for major crops and their corresponding growing season. This information is 

available for the Vogtle site. The SECPOP2000 code also generates this data, but using the 

1997 county and state data. Alternatively, this information can be obtained from the U.S. 

Department of Agriculture, for the areas of interest. 

Economic data: Regional economic data on value of farmland, value of nonfarm property, 

annual farm sales, fraction of land devoted to farming, and fraction of farm sales resulting from 

dairy production. This information is available for the Vogtle site. The SECPOP code also 

generates this data. Similar to the demographic information, the latest SECPOP code available 

can be used and extrapolated forward to a target year as necessary. 

Step 4 – Identification of Source of Model and Parameter Uncertainty 

The sources of uncertainties related to protective actions will be identified. 

12.3.2.4 Documentation

The process used to develop the protective action parameters and the supporting engineering 

bases, including the assumptions, inputs, methods, and results are documented. The 

documentation also includes site-specific information on land use, economic data, and 

population distribution. Table 12-45 provides the details of documentation requirements. The 

planned documentation (along with the identified inputs described in Section 12.3.2.2) should be 

succinct and transparent to enable an independent QA and peer review. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-69 

Table 12-45 Documentation Needs for Subtask 1-3.2 

Products Description 

Emergency 

Response 

Document sources of information and assumption used for 

selection of parameters to model the emergency response. In 

addition, identify sources of model and parameter 

uncertainty. 

Long-term protective 

actions 

Document sources of information and assumption used for 

selection of parameters (e.g., dose criteria for land/food, 

decontamination factors, start and length of decontamination, 

etc..) to model the long-term protective actions in MACCS2. 

In addition, identify sources of model and parameter 

uncertainties. 

Site-specific 

MACCS2 site input 

file 

Documents assumptions and data sources used to prepare 

MACCS2 site data file. In addition, identify source of model 

and parameter uncertainties. 

12.3.2.5 Task Interfaces

The initiating event and accident progression from the Level 1 and 2 PRA will inform the models 

developed for emergency response. Also, the economic data prepared as part of the sitespecific parameters has a common interface with the Subtask 12.3.7, “Economic Factors.” 

12.3.3 Meteorological Data

The meteorological data are needed for a sufficient period of time (i.e., temporally 

representative) to enable determination of the frequency of occurrence of local conditions that 

affect atmospheric transport and dispersion. At least one year of hourly data on wind speed, 

wind direction, atmospheric stability class, precipitation rate, and height of the atmospheric 

inversion layer is required. The objective of this subtask is to ensure that appropriate and valid 

meteorological data are compiled for use as input to the consequence analysis model. This 

subtask consists of two steps: review of site meteorological data, and development of 

meteorological data input file for MACCS2 use. 

12.3.3.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of details 

of analyses that are performed: 

• Southern Nuclear will provide multiple years of weather data to NRC. The weather data 

chosen for the meteorological input file for MACCS2 will be based on data recovery 

(greater than 99 percent being desirable) and proximity to the target year for the project. 

Hourly data for a set period of time will be used for the site (8,760 data points for each 

year). This period of time that the weather data represents will be determined by the 

project team. 

• Meteorological data will include: temperature at two elevations, wind speed, wind 

direction, and precipitation. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-70 

• Missing data will be bridged over using hourly records before and after by employing, 

“Procedures for Substituting Values for Missing National Weather Service Meteorological 

Data for Use in Regulatory Air Quality Models,” dated July 7, 1992 [7], consistent with 

the method used in the State-of-the-Art Reactor Consequence Analysis (SOARCA) [8]. 

• Quality assurance will be performed using the methodology described in NUREG-0917, 

“Nuclear Regulatory Commission Staff Computer Programs for Use with Meteorological 

Data,” dated July 1982 [9], consistent with SOARCA. 

• Atmospheric stability categories will be classified using vertical temperature difference, 

consistent with SOARCA. 

• Weather data available from the Savannah River Site may be considered, for 

substitution of missing data, where appropriate. 

12.3.3.2 Inputs

The design, maintenance, and operational information required to perform the associated steps 

are identified in Table 12-46. This information should be succinct and transparent to enable an 

independent QA and peer review. 

Table 12-46 Needed Inputs for Subtask 1-3.3 

Input Description 

Meteorological data 

for multiple years 

from Southern 

Nuclear 

This information includes hourly data on wind speed, wind 

direction, atmospheric stability class, precipitation rate, and 

height of the atmospheric inversion layer. 

12.3.3.3 Analysis Steps

The objective of this subtask is to ensure that appropriate and valid meteorological data are 

compiled for use as input to the consequence analysis model. There are three interrelated 

steps: 

1. Review of the meteorological data 

2. Development of the metrological data input file for MACCS2 use 

3. Identification of source of model and parameter uncertainty 

Step 1 – Review of the meteorological data 

Meteorological data is a very important part of the consequence analysis. Therefore, a key 

objective is to ensure that a valid and representative set of meteorological data are used as 

input to atmospheric transport and dispersion (ATD) code that provides the basis for 

consequence analysis calculations. As part of the review, one needs to confirm that the 

selected meteorological data represents local /site weather data, has a continuous and 

complete hourly data for at least one year, and if any data are missing appropriate data 

recovery and substitution data have been applied. In addition, the data collection were based 

on a system of calibrations, maintenance activities, and instrument exposure that meet or 

exceed the requirements of the ANSI/ANS-3.11-2010 Standard for “Determining Meteorological 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-71 

Information at Nuclear Facilities,” [10] or its equivalent. Table 1 of ANSI/ANS-3.11-2010 

establishes accuracies for each parameter. 

Step 2 – Development of the meteorological data input file for MACCS2 use 

The objective of this subtask is to ensure that appropriate and valid meteorological data are 

compiled for use as input to the consequence analysis model. 

In general, site-specific weather data are produced for multiple years. The attributes will include 

temperatures at two locations (to determine the atmospheric stability class), wind speed, wind 

direction, and precipitation. Hourly weather data for a set period of time will be used, and this 

period of time will be determined. Typically in offsite consequence calculations, this is a 1-year 

period. The chosen weather data for the MACCS2 use will be based on the data recovery 

(greater than 99 percent is desirable). Missing data will be bridged over using hourly records 

before and after by employing an industry standard procedure, “Procedures for Substituting 

Values for Missing National Weather Service Meteorological Data for Use in Regulatory Air 

Quality Models” [7]. 

Step-3 – Identification of source of model and parameter uncertainty 

The sources of uncertainties related to the meteorological data will be identified. 

12.3.3.4 Documentation

The review process to ensure that a valid and representative set of meteorological data are 

used as input for consequence analysis is documented. The documentation at a minimum 

identifies the followings: 

• Source of data (including reasons for selection) 

• Quality assessment 

• Levels of sensors 

• Exposure of tower 

• Calibration records 

• Period of record 

• Percent data recovery 

• Extent of conformance with ANSI/ANS-3.11-2010 and Regulatory Guide 1.23, 

Revision 1 [11] 

Table 12-47 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.3.3.2) should be succinct and transparent to enable an 

independent QA and peer review. 

Table 12-47 Documentation Needs for Subtask 1-3.3 

Product Description 

Meteorological data review Document the review process including information on 

source of data and reason for their selection, quality of 

the data, calibration records, levels of sensors, percent 

data recovery, and extent of conformance with 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-72 

Table 12-47 Documentation Needs for Subtask 1-3.3 

Product Description 

ANSI/ANS-3.11-2010 and Regulatory Guide 1.23, 

Revision 1. Also identify source of parameter 

uncertainties. 

Vogtle-specific 

meteorological input file for 

MACCS2 user 

Document actions taken and assumptions made 

regarding any adjustments to the weather data, 

including the method for substituting the missing 

information. 

12.3.3.5 Task Interfaces

There is no interface between this subtask and other elements of the PRA. However, the 

product of this subtask serves as direct input to Subtask 1-3.4, “Atmospheric Transport and 

Dispersion.” 

12.3.4 Subtask 1-3.4: Atmospheric Transport and Dispersion

Simulation of the transport of airborne particles and gases in the ambient air requires the use of 

Atmospheric Transport and Deposition (ATD) models. The most commonly-used model used to 

characterize a “plume” of airborne material is referred to as the steady-state, straight-line, 

Gaussian model. MACCS2 uses a Gaussian plume segment model. This model calculates 

ground-level instantaneous and time-integrated airborne concentrations in the plume segment. 

The amount of particulate material deposited on the ground is calculated using a constant 

deposition velocity. Its results are a function of distance from the source, and precipitation rate. 

12.3.4.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of details 

of analyses that are performed: 

• The offsite consequences will focus on atmospheric releases, which is the current state 

of practice for severe accidents. 

• MACCS2’s straight-line Gaussian plume segment model with provisions for meander 

and surface roughness will be used to model atmospheric transport and dispersion. 

• Multi-phased releases that use hourly plume segments will account for temporal 

variations in meteorological conditions (such as wind direction) before a plume segment 

is released. After a plume segment is released, the plume segment does not change 

direction (i.e. straight-line), and therefore does not (or no longer) accounts for variations 

in wind direction, wind field, or topography. 

• The ATD model will treat plume rise resulting from the sensible heat content (i.e., 

buoyancy), initial plume size caused by building wake effects, release of up to 200 

plume segments, and dispersion under statistically representative meteorological 

conditions. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-73 

• Radionuclide concentrations will be modeled on a two-dimensional grid that includes 

population, land use, and other information in reasonably fine geographical areas to 

serve as input to the dose calculations. 

• For each simulated release, a suitable statistical sampling technique will be used to 

select the hourly weather data to use. 

• The period of weather data used will be determined by the meteorological data subtask. 

Past experience with the results of year-to-year weather variations indicates a 

consequence variance in health effect (cumulative dose) of about 20 percent, using one 

year of weather data versus another. 

• Site-specific physical plant characteristics (e.g., building dimensions, stack heights) will 

be used to determine height of releases and building wake. 

• Dry deposition velocities will be calculated depending on the physical characteristic of 

the radionuclides that are released. Multiple particle size groups will be modeled. 

• Wet deposition velocities will be calculated considering various precipitation intensities. 

• Resuspension of deposited radionuclides will be modeled. 

12.3.4.2 Inputs

The information required to perform the associated steps are identified in Table 12-48. This 

information should be succinct and transparent to enable an independent QA and peer review. 

Table 12-48 Needed Inputs for Subtask 1-3.4 

Input Description 

Accident release data This information includes the source term characteristics 

discussed in Subtask 12.3.1. 

Site-specific data This information includes site demographic, and calculation 

grids. The calculation grid is that used for determining 

population distributions and land use around the site. 

Meteorological data This information includes weather data and attributes 

discussed in Subtask 12.3.3. 

Dry and wet 

deposition velocities 

Characteristics of release in terms of particle size (for dry 

deposition) and precipitation rate (for wet deposition). 

12.3.4.3 Analysis Steps

The consequence analysis is performed using WinMACCS/MACC2 code. The ATD model in 

MACCS2 code is a straight-line Gaussian plume segment model with provisions for meander 

and surface roughness. This assumption is generally valid for flat terrain to a distance of a 

many kilometers from the point of release; however, it is subject to much larger uncertainties 

both in the immediate vicinity of the point of release (e.g., near the reactor building) and at long 

distances. However, using ensemble average results of many weather trials significantly 

reduces the model uncertainty at long distances. For instance, comparisons of MACCS2 to 

ADAPT/LODI, a state-of-the-art, three-dimensional advection dispersion code (NUREG/CR-
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-74 

6853 [12]), show the MACCS2-calculated results (i.e., ring-averaged values) ranged from a 

minimum of 0.64 to a maximum of 1.58 times the corresponding LODI results (i.e., ringaveraged) with higher ratios occurring at 16 km (10 miles) ring, and lower ratios for the 80 and 

160 km (50 and 100 mile) rings. Given that the differences in results are within a factor of 2, and 

the fact that MACCS2 is a fast running code, using ensemble average results is considered to 

be acceptable for Level 3 PRA analyses, and MACCS-calculated estimates of off-site 

consequences are expected to be well within the expected uncertainties even at distances 

beyond the 160 kilometers measured in the above comparison. 

The normal calculation mode for MACCS2 is to sample from hourly weather data for one year 

for ATD calculations. The selection of weather sequences for the ATD calculation is an input 

parameter. A simplest approach in weather sequence selection is to perform stratified random 

sampling of weather date considering all the hourly data. Contemporary computing techniques 

are now capable of running all hours separately. In this manner the very low probability “tails” of 

the distribution associated with the variation in the meteorological conditions can be determined 

for consideration in the analysis. Another approach is to create weather sequences based on a 

preset assumption on ranges of precipitation rates and perform bin sampling. This approach 

requires shorter computing time. The SOARCA project used the bin sampling approach. 

Using accident release data (radionuclide fractions, energy content, timing, location of release, 

etc.) and random samples of hourly meteorological data, the ATD module calculates transport of 

radionuclides including dry deposition, wet deposition, and resuspension, resulting in 

distributions of radionuclide concentrations on a two-dimensional grid that includes population, 

land use, and other information in reasonably fine geographical areas within a certain distance 

of the site to serve as input to the dose calculations. 

In addition to calculating the atmospheric transport of radionuclides, the uncertainties related to 

atmospheric transport and dispersion will also be identified. 

12.3.4.4 Documentation

Table 12-49 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.3.4.2) should be succinct and transparent to enable an 

independent QA and peer review. 

Table 12-49 Documentation Needs for Subtask 1-3.4 

Product Description 

Atmospheric transport and 

dispersion modeling 

Document the specific assumptions, parameters, and 

the ATD model that were used in the consequence 

analysis. Include discussions on calculation grid, time 

scale, meteorological sampling method, plant/site 

characteristics (e.g., release height, building 

dimensions), and wet and dry deposition velocities. In 

addition, identify the sources of parameter and model 

uncertainty. 

12.3.4.5 Task Interfaces

There is no interface between this subtask and other elements of the PRA. The product of this 

subtask serves as direct input to Subtask 1-3.5, “Dosimetry.” It requires input from 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-75 

Subtask 1-3.1, “Transition from the Radionuclide Release to Level 3,” and Subtask 1-3.3, 

“Meteorological Data.” 

12.3.5 Subtask 1-3.5: Dosimetry

Dosimetry involves computation of radiation doses received by individual receptors and 

population groups. Dose estimates are made for each accident using the spatial distribution of 

instantaneous and time-integrated airborne concentration, and deposited amounts of radioactive 

material calculated by the ATD model. Dosimetry computation is a main focus of the MACCS2 

code. MACCS2 accounts for both short-term (from exposure to plume passage and shortly 

after, on the order of days) and long-term (from indirect uptake of radioactivity over an extended 

period, on order of years) effects. 

The exposure pathways modeled in MACCS2 include internal and external pathways. Internal 

pathways consist of inhalation of radionuclides in the cloud and resuspended material deposited 

on the ground, and ingestion from deposited radionuclides that make their way into food and 

water. External pathways consist of direct exposure to radioactive material in the plume (i.e., 

cloudshine); and exposure to radioactive material deposited on the ground (i.e., groundshine). 

12.3.5.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of details 

of analyses that are performed: 

• MACCS2 code will be used (i.e., MACCS2 assumptions and limitations apply). 

• The team will use the dose conversion factors available in the most recent update 

released for Federal Guidance Report (FGR). An update to FGR-13 [13] may be 

available for the project, but it is not currently. 

• The shielding factors will be determined (if not available for the Vogtle site) based on the 

general conditions of structures in the area using a method similar to that used in 

NUREG/CR-4551, Vol. 2-Rev,1 Part 7 [5]. 

12.3.5.2 Inputs

The information required to perform the associated steps are identified in Table 12-50. This 

information is succinct and transparent in enabling an independent QA and peer review. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-76 

Table 12-50 Needed Inputs for Subtask 1-3.5

Input Description

Dose conversion 

factor (DCF) 

Dose conversion factors are typically chosen from the recent 

Federal Guidance Reports. The latest DCFs are in FGR 13.

Radiation 

protection factors 

While DCFs will calculate doses for health effects, separate 

parameters such as weighting factors will calculate doses for 

radiation protection.

Dose exposure 

pathway factors 

Breathing rates, attenuation factors, the resuspension factors 

are examples of information needed to determine the level of 

exposure to the public.

MACCS2 ATD 

output 

This information is internal to the MACCS2 code, and transfers 

automatically in the dosimetry computation.

Protective action 

parameters 

This information is discussed in Subtask 1-3.2. 

12.3.5.3 Analysis Steps

As stated above, the MACCS2 code will be used for dosimetry computations. The above inputs 

will be developed, as necessary. The code can consider all the relevant pathways, and how 

best to model the food/water pathway will be evaluated. The input requirements for this subtask 

are listed Section 12.3.5.2. Also, the sources of uncertainties related to dosimetry will be 

identified. 

12.3.5.4 Documentation

Table 12-51 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.3.5.2) should be succinct and transparent to enable an 

independent QA and peer review. 

Table 12-51 Documentation Needs for Subtask 12.3.5 

Product Description 

Dosimetry Document the specific assumptions and parameters, used. This 

includes: 

• Identification of exposure pathways considered and justification for 

any pathways excluded 

• Selection of DCFs and attenuation factors (e.g., shielding) 

• Identification of source of parameter and model uncertainty 

12.3.5.5 Task Interfaces

There is no interface between this subtask and other elements of the PRA. The products of this 

subtask serve as direct input to Subtask 1-3.6, “Health Effects.” It requires inputs on protective 

action parameters from Subtask 1-3.2 “Protective Action Parameters and Other Site data” and 

from Subtask 12.3.4 “Atmospheric Transport and Dispersion.” 

12.3.6 Subtask 1-3.6: Health Effects

The health effects from exposure to ionizing radiation are divided into two categories of early 

(i.e., prompt) and latent. The early health effects are caused by doses that exceed certain 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-77 

thresholds. They include both mortality and morbidity (i.e., fatalities and injuries) and usually 

occur within a short period of time (few days to weeks). The latent health effects may occur 

several years after exposure. MACCS2 considers both types of health effects and has had an 

established computational methodology consistent with standards and guidance by various 

international committees on radiation protection. 

12.3.6.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of details 

of analyses that are performed: 

• The availability of health effects models is limited to the capabilities incorporated into the 

MACCS2 code. 

• The assessment of health effects will include individual latent cancer fatality risk as well 

as individual early/prompt fatality risk. 

• The effect of low doses on health is uncertain. A linear, no threshold (LNT) dose 

response model will be used and other dose response models will be considered if time 

and resources permit. 

• The latest available risk factors will be used. Currently FGR-13 uses risk factors from 

BEIR V, although guidance for using risk factors from BEIR VII may become available 

soon. 

12.3.6.2 Inputs

The information required to perform the associated steps are identified in Table 12-52. This 

information should be succinct and transparent to enable an independent QA and peer review. 

Table 12-52 Needed Inputs for Subtask 1-3.6 

Input Description 

MACCS2 input for 

early fatality 

calculations 

List of target organs along with factors representing organ 

specific lethal dose (an organ dose that could lead to early 

fatality in 50 percent of exposed individuals, dose 

corresponding to 50 percent probability), dose response 

exponent, and dose threshold. 

MACCS2 input for 

early injury 

calculations 

Similar list of information as that for early fatality calculations, 

but related to early injuries. 

MACCS2 input for 

later cancer fatality 

Since latent cancer fatalities are associated with specific 

organs, information is needed for the lifetime risk factor for 

cancer injury and death. 

12.3.6.3 Analysis Steps

As stated earlier, the MACCS2 code will be used (i.e., the health effect models in MACCS2 are 

the basis for the analyses). The required inputs for determination of early fatalities/injuries and 

latent cancer fatalities may need to be developed and are listed in Section 12.6.3. The use of 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-78 

dose response models will need to be justified and the sources of uncertainties related to health 

effects will be identified. 

12.3.6.4 Documentation

Table 12-53 provides the details of documentation. The documentation (along with the 

identified inputs described in Section 12.3.6.2) are succinct and transparent in enabling an 

independent QA and peer review. 

Table 12-53 Documentation Needs for Subtask 1-3.6 

Product Description 

Health effect model, and 

input data (MACCS2) 

Document the specific assumptions and parameters 

used. This includes a discussion of the model if it is 

different from that in MACCS2, and identification of 

sources of data for the required input. Also identify the 

sources of parameter and modeling uncertainty. 

12.3.6.5 Task Interfaces

There is no interface between this subtask and other elements of the PRA. The product of this 

subtask serves as direct input to Subtask 1-3.8, “Quantification and Reporting.” It requires 

inputs from Subtasks 1-3.1 through 1-3.5. 

12.3.7 Subtask 1-3.7: Economic Factors

The economic factors may include the costs of various actions (i.e., evacuation, relocation, and 

decontamination) taken to protect the public from short-term and long-term exposure via 

different exposure pathways; the costs of health effects following exposure; and the secondary 

economic effects. The economic model in MACCS2 includes costs associated with various 

actions or modeling within six categories as follows: 

• Evacuation and relocation costs (e.g., a per diem cost associated with displaced 

individuals). The per-diem costs are associated with the population that is temporarily 

relocated. These costs are calculated by adding up the number of displaced people 

times the number of days they are displaced from their homes. 

• Moving expenses for people displaced (i.e., a onetime expense for moving people out of 

a contaminated region). There is a one-time moving expense for the population 

displaced from their homes because of decontamination, interdiction, or condemnation. 

The modeling can include loss of wages. 

• Decontamination costs (e.g., labor, materials, equipment, and disposal of contaminants). 

These are the costs associated with decontaminating property. These costs include 

labor and materials for performing the decontamination. They depend on the population 

and size of the area that needs to be decontaminated as well as the level of 

decontamination that needs to be performed. They can include the cost to dispose of 

contaminated material. The model estimates the costs only if decontamination is cost 

effective. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-79 

• Cost due to loss of land use of property (e.g., costs associated with lost return on 

investment and for depreciation of property that is not being maintained). These costs 

are associated with loss of use of property. These costs include an expected rate of 

return on property and depreciation caused by lack of routine maintenance during the 

period of interdiction, the time when the property cannot be used. 

• Disposal of contaminated food grown locally (e.g., crops, vegetables, milk, dairy 

products, and meat). 

• Cost of condemned lands (i.e., land that cannot be restored to usefulness or is not cost 

effect to do so). These are costs of condemning property that cannot be restored to 

meet the habitability criterion. 

12.3.7.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of details 

of analyses that are performed: 

• The economic consequences considered are limited to those calculated in the MACCS2 

code. (Economic consequences of health care related costs are not included currently in 

the MACCS2 code.) 

• Decontamination will be modeled as determined by the subtask on protective actions. 

12.3.7.2 Inputs

The information required to perform the associated steps are identified in Table 12-54. This 

information should be succinct and transparent to enable an independent QA and peer review. 

Table 12-54 Needed Inputs for Subtask 1-3.7 

Input Description 

Economic data and 

factors 

Regional economic data on value of farmland, value of 

nonfarm property, annual farm sales, fraction of land devoted 

to farming, and fraction of farm sales resulting from dairy 

production. (This is an input to Subtask 1-3.2.) 

Cost of living for the evacuated and relocated people during 

short- or long-term, unit costs for land decontamination, loss of 

usage of the property, relocation of people, habitability 

restoration for nonfarm properties, and milk and crop disposal. 

12.3.7.3 Analysis Steps

The objectives of this subtask are to (1) identify the cost parameters for use by MACCS2; (2) list 

the sources of data for cost parameters for land decontamination, evacuation, relocation, land, 

depreciation, and loss of use; (3) identify which cost parameters are important that require sitespecific data versus those that can use generic data; (4) provide justification for excluding any 

cost data; and (5) identify the sources of uncertainty related to economic costs. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-80 

The required list of cost factors is giving in Section 12.3.7.2. The main cost factor that is heavily 

dependent on the degree of contamination is land decontamination. 

12.3.7.4 Documentation

The processes used to develop the economic factors and the supporting engineering bases, 

including the assumption, inputs, methods, and results are documented. Table 12-55 provides 

the details of the documentation. The documentation (along with the identified inputs described 

in Section 12.3.7.2) should be succinct and transparent to enable an independent QA and peer 

review. 

Table 12-55 Documentation Needs for Subtask 1-3.7 

Product Description 

Economic factors, and 

input to MACCS2 code 

Document the specific assumptions, inputs, sources of 

data, and methods used to determine the required 

economic factors. These include definitions of economic 

factors, generic/site-specific data sources used, and 

any adjustments to time sensitive factors made. In 

addition, identify sources of parameter and model 

uncertainties. 

12.3.7.5 Task Interfaces

There is no interface between this subtask and other elements of the PRA. The products of this 

subtask serve as direct inputs to Subtask 1-3.8, “Quantification and Reporting.” 

12.3.8 Subtask 1-3.8: Quantification and Reporting

The quantification is performed using the information collected and developed in the previous 

subtasks using the MACCS2 code. The objectives of this task are to generate results in the 

form of the consequence metrics of interest, and to identify significant contributors to the 

calculated consequence measures/metrics. The consequence metrics of most interest to a 

Level 3 PRA focus on the impact to human health and economic costs. Some potential 

consequence metrics of interest include: 

• Total early fatality risk 

• Total latent cancer fatality risk 

• Individual early fatality risk defined in the early fatality Qualitative Health Objective 

(QHO), i.e., the risk of early fatality for the average individual within 1 mile from the plant 

• Individual latent cancer fatality risk defined in the latent cancer QHO (i.e., the risk of 

latent cancer fatality for the average individual within 10 miles of the plant) 

• Population dose (person-sievert) out to various distances from the plant 

• Individual early injury risk 

• Individual cancer incident risk 

• Land contamination (e.g., contaminated area that exceeds particular contamination 

levels) 

• Off-site economic costs 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-81 

12.3.8.1 Assumptions and Limitations

The following is a list of assumptions and limitations that define the scope and level of details of 

analyses that are performed: 

• The reported results will include consequence metrics as a function of distance. The 

distance (from the point of release) to which results should be reported will be evaluated 

by the project team. 

• The effect of low dose radiation (low doses and/or low dose rates) on latent cancer 

fatalities is uncertain. The range of health effects reported will depend on the dose 

response model(s) considered in the health effects subtask. 

• Potential uncertainties will create a range of results. How best to report potential 

uncertainties will be evaluated by the project team. 

• The reported consequence metrics will be determined by the project team. 

12.3.8.2 Inputs

The inputs to this subtask are the products from Subtasks 1-3.1 through 1-3.7. 

12.3.8.3 Analysis Steps

As stated above, the objectives of this task are to generate results in terms of the consequence 

metrics of interest, and to identify significant contributors to calculated consequence 

measures/metrics. This step in the quantification of a Level 3 PRA is the integration of results to 

compute individual measures of risk. The severe accident progression and the radionuclide 

source term analyses conducted in the Level 2 portion of the PRA, as well as the consequence 

analyses in the Level 3 portion of the PRA, are performed on a conditional basis. That is, the 

evaluations of severe accident progression, the resulting source terms, and accident 

consequences are carried-out without regard to the absolute or relative frequencies of the 

postulated accidents. The final computation of risk is the process by which each of these 

elements of the analyses are integrated into a self-consistent and statistically rigorous manner. 

The point-estimate (or mean) risk is a product of the mean accident frequency and its 

associated consequence, on a plant damage state, release category, and accident 

consequence basis. 

Mathematically, risk is defined as the following triplet: 

R [ f P(i d )] P(d s ) C (s c )

ids

c i =  ⋅ ⋅ ⋅ (12.3-1) 

where Rc is the risk per year of consequence measure c; fi is the frequency of initiating event “i”

(per year); P(i|d) is the conditional probability that initiating event “i” will lead to plant damage 

state “d”; P(d|s) is the conditional probability that plant damage state “d” will lead to source term 

(release) “s”; and C(s|c) is the expected value of the conditional consequence measure “c”,

given the occurrence of source term (release) “s.”
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-82 

The health effects caused by radiation exposure are subject to considerable uncertainties and 

the models used to relate dose and response should reflect and, to the extent possible, quantify 

these uncertainties. At the subtask level, sources of parameter and model uncertainties are 

identified. These uncertainties may be propagated by combining uncertainties in release 

category frequencies, the release (source term) quantities, dosimetry, health effects models, 

etc. by standard sampling method. This project will also use the insights gained from the 

uncertainty analysis performed in the SOARCA project [8, 14 and 15]. 

Because the results of this subtask are the MACCS2-calculated outputs, the output files are 

reviewed for any errors, warnings, and/or unexpected results (e.g., explain any Monte Carlo 

realizations that failed to execute fully), to confirm appropriate modeling and code execution. 

The significant contributors to the consequence/risk metrics of interests will be identified and 

reported. 

The reported consequence metrics will be evaluated by the project team, and will attempt to 

maximize openness, meaningfulness, and risk communication. Economic consequences of 

health-related costs (as well as other costs) in addition to those calculated by MACCS2 code 

may also be considered. 

Finally, the merits of distance truncation on the results (from the point of release) will also be 

evaluated, as well as how best to report potential uncertainties. 

12.3.8.4 Documentation

Table 12-56 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 12.3.8.2) should be succinct and transparent to enable an 

independent QA and peer review. 

Table 12-56 Documentation Needs for Subtask 1-3.8 

Product Description 

Quantification and 

Reporting 

Document the consequence quantification process 

including any applicable sensitivity and uncertainty 

analyses. Identify significant contributors to the 

calculated consequences and risk metrics of interest 

listed in Section 12.3.8, and report the consequence 

metrics of interest. 

12.3.8.5 Task Interfaces

This subtask interfaces with Level 2 PRA, requiring release categories frequencies for 

determining the desired risk metrics. 

12.3.9 Subtask 1-3.9: Risk Integration

This element of the on-going draft Level 3 PRA standard overlaps substantially with the Site 

Level 3 Project’s separate “Quantification of the Site Risk, Integration of the PRA” task, 

documented in Section 17, “Technical Approach for Integrated Site PRA.” This element is 

currently TBD. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-83 

12.3.10 Interfaces for Overall Task 1-3

In addition to the task interfaces identified for the individual subtasks in the previous sections, 

there are also some general interfaces for all of Task 1-3. These interfaces include 

Identification and preparation of input data for the release categories for all accident events, all 

hazards, and all sources, as detailed below. 

• Internal events at power: Include frequencies, source terms, and plume 

characterizations from fifteen or more MELCOR calculations. Work with the Level 2 

team to ensure completeness. 

• External hazards: Include frequencies, source terms, and plume characterizations from 

five or more MELCOR calculations, Work with the Level 2 team to ensure completeness. 

• Low Power and Shutdown: Include frequencies, source terms, and plume 

characterizations from five or more MELCOR calculations. Consider source terms with 

lower decay heat. Consider Zr oxidation in air for mid-loop release categories. Work 

with the Level 2 team to ensure completeness. 

• Spent Fuel Pools and dry casks: Include frequencies, source terms, and plume 

characterizations from five or more MELCOR calculations. Work with the Level 2 team to 

ensure completeness. 

12.3.11 References

1. K. McFadden et al., “WinMACCS, a MACCS2 Interface for Calculating Health and 

Economic Consequences from Accidental Release of Radioactive Materials into the 

Atmosphere User’s Guide and Reference Manual WinMACCS Version 3,” NUREG/CRXXXX, SAND2005-XXXX, July 2007. 

2. ORIGEN2. 

3. SCALE 6.1. 

4. “Manual of Protective Action Guides and Protective Actions for Nuclear Incidents,” U.S. 

Environmental Protection Agency, EPA-400-R-92-001, May 1992. 

5. J.I. Sprung et al., “Evaluation of Severe accident Risks: Quantification of Major Input 

Parameters, MACCS Input,” NUREG/CR-4551 Vol. 2, Re. 1 Part 7, December 1990. 

6. N.E. Bixler et al., “SECPOP2000: Sector Population, Land Fraction, and Economic 

Estimation Program,” NUREG/CR-6525, Rev. 1, August 2003. 

7. “Procedures for Substituting Values for Missing National Weather Service Meteorological 

Data for Use in Regulatory Air Quality Models,” dated July 7, 1992. 

8. “State-of-the-Art Reactor Consequence Analysis (SOARCA) Report,” NUREG-1935 

(Draft for Comment) January 2012. 

9. “Nuclear Regulatory Commission Staff Computer Programs for Use with Meteorological 

Data,” July 1982. 

10. ANSI/ANS-3.11-2010 Standard for “Determining Meteorological Information at Nuclear 

Facilities.” 

11. Regulatory Guide 1.23, Revision 1, “Meteorological Monitoring Programs for Nuclear 

Power Plants,” March 2007. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

12-84 

12. C.R. Molenkamp et al., “Comparison of Average Transport and Dispersion Among a 

Gaussian, a Two-Dimensional, and a Three-Dimensional Model,” NUREG/CR-6853, 

October 2004. 

13. Federal Guidance Report No. 13, “Cancer Risk Coefficients for Environmental Exposure 

to Radionuclides,” EPA 402-R-99-001, September 1999. 

14. N. Bixler et al., “Synthesis of Distributions Representing Important Non-Site-Specific 

Parameters in Off-Site Consequence Analysis,” Sandia National Laboratories, 

Albuquerque, NM, DRAFT NUREG/CR, publication expected by November 2012. 

15. Draft NUREG/CR on MACCS2 SOARCA Best Practices, once completed (expected late 

2012). 

16. D. Chanin et al., “Code Manual for MACCS2: User’s Guide,” NUREG/CR-6613, Vol. I, 

May 1998. 

17. H-N Jow et al., “MELCOR Accident Consequence Code System (MACCS): Model 

Description,” NUREG/CR-4691, Vol. II, February 1990. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-1 

13. Technical Approach for Reactor, At-Power for External and 

Other Hazards PRA 

13.1 Task 2-1: Level 1 Reactor PRA, At-Power for External and Other 

Hazards

13.1.1 Subtask 2-1.2: Level 1 Reactor PRA for At-Power and Seismic Events

The seismic PRA models seismic event scenarios for power operation and quantifies their 

contribution to core damage frequency (Level 1 analysis). The ASME/ANS PRA Standard 

Section 5-2 [1] describes the technical requirements for Level 1 reactor at-power seismic events 

PRA (SPRA). According to this standard, the major technical elements of a SPRA are: 

• Probabilistic seismic hazard analysis (PSHA) – The objective of the PSHA is to estimate 

the probability or frequency of exceeding different levels of vibratory ground motion. A 

new PSHA will be performed, to define the seismic bins which are modeled in the PRA. 

• Seismic fragility evaluation – In this element, site-specific and plant-specific seismic 

fragilities for SSCs that are modeled in the SPRA will be used to calculate basic event 

failure probabilities for seismic bins associated with these SSCs. 

• Seismic plant response analysis – In this element, for each seismic bin, event tree (ET) 

and fault tree (FT) models will be developed and placed into the plant SPAR model. 

Existing ET and FT models from the Level 1 internal events SPAR model will be used, 

where applicable. The CDF from seismic events will be quantified and significant CDF 

cutsets will be identified. 

13.1.1.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task: 

• SNC has initiated their plant-specific SPRA study; however, the study it is not expected 

to be completed for use in this project. There is a good likelihood that some or all 

seismic fragilities become available and can be used in this project. In the meantime, a 

representative or generic set of seismic fragilities will be used for revising the Vogtle 

internal events SPAR model. 

• The quantitative analysis and modeling is for Level 1 PRA of the seismic events for one 

unit. 

• The site-specific seismic hazard curves developed in the Early Site Permit study for 

Vogtle Units 3 and 4 could be used as a starting point for this project. However, SNC is 

currently developing new site-specific hazard curves for Unit 1 in response to the NRC 

letter 50.54(f), which are expected to be available in mid 2013. These updated curves 

should be used in the final Level 3 PRA Project. 

• It is assumed that documentation for plant systems are available to the NRC for use in 

the full scope site Level 3 PRA Project. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-2 

• The CDF sequences and their end-states will be defined in the same manner as those in 

the internal event CDF sequences so that the interface from Level 1 to Level 2 can be 

set up as part of the internal events SPAR model for use by the Level 2 task, if needed. 

13.1.1.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps 1, 2 and 3 are identified. The information needed to perform each step, at a 

minimum, is listed in Table 13-1. 

Table 13-1 Required Inputs for Subtask 2-1.1 

Input Description(1)

Design/Engineering • Site characteristization input for PSHA 

- Site geotechnical information 

• Design input for fragility analysis 

- SSC design and qualification criteria 

- Spatial layout, sizing, and accessibility information related to 

the credited SSCs. 

- Design and qualification analysis/test reports 

- Anchorage details for equipment 

- SSC structural response analysis results 

• Plant response analysis 

- Success criteria for SSCs 

- Level 1 Internal events SPAR model 

Operation • Plant response analysis 

- That information needed to reflect the actual operating 

procedures and practices used at the plant including when and 

how operators interface with plant equipment as well as how 

plant staff monitor equipment operation and status after an 

earthquake 

Maintenance None 

Note (1) – much of the above information can be gathered and is confirmed via plant walkdown and personnel interviews. 

13.1.1.3 Analysis Steps

Seismic analysis consists of three interrelated steps: 

1. Probabilistic seismic hazard analysis 

2. Seismic fragility evaluation 

3. Seismic plant response analysis 

These steps are described below; however, for more detailed guidance, refer to ASME/ANS 

RA-Sa-2009 PRA Standard. 

Step 1 – Probabilistic Seismic Hazard Analysis 

The objectives of PSHA are to generate two inputs to the SPRA, namely; a family of seismic 

hazard curves, and one or more ground motion response spectra. The hazard curves are used 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-3 

in the seismic quantification (Step 3), whereas the ground motion response spectra are used as 

an input to the seismic response calculations (including soil-structure interaction effects). The 

seismic response calculations are used in the development of seismic fragilities of SSCs (Step 

2). 

Seismic hazard is usually expressed in terms of the annual frequency of exceeding a specified 

value of ground motion parameter (e.g., peak ground acceleration) at the site. The different 

steps of seismic hazard analysis are: 

• Identification of the sources of earthquakes, such as faults and seismo-tectonic 

provinces. 

• Evaluation of the earthquake history of the region to assess the frequencies of 

occurrence of earthquakes of different magnitudes or epicentral intensities. 

• Development of attenuation relationships to estimate the intensity of earthquake-induced 

ground motion (e.g., PGA) at the site. 

• Integration of the above information to estimate the frequency of exceedance for 

selected ground motion parameters. 

The hazard estimate depends on uncertain estimates of attenuation, upper-bound magnitudes, 

and geometry of the postulated seismic sources. Such uncertainties are included in the hazard 

analysis by assigning probabilities to alternative hypotheses about these parameters. A 

probability distribution for the frequency of occurrence is thereby developed. The annual 

frequencies for exceeding specified values of PGA are displayed as a family of curves with 

different probabilities or with different fractiles. These are known as “seismic hazard curves.” A 

mean hazard curve is obtained as the weighted sum of the hazard curves; the weighting factor 

is the probability assigned to each hazard curve. The full family of seismic hazard curves could 

be used for uncertainty analysis in the SPRA. 

The technical requirements for performing the PSHA including documentation are given in the 

ASME/ANS PRA Standard Section 5-2.1 (HLR-SHA-J) and supporting references. 

The procedure for deriving ground motion response spectra at a specified elevation in the soil 

profile (the “control-point”) for a specific site using the rock PSHA results is described in RG 

1.208. 

For Vogtle Units 1 and 2, SNC is expected to conduct PSHA in response to NRC Letter 50.54(f); 

the results should be available in mid 2013. In the mean time, the seismic hazard curves and 

GMRS that have been developed for Early Site Permit of Vogtle Units 3 and 4 could be used as 

input to the SPAR SPRA model. 

Step 2 – Seismic Fragility Evaluation

Seismic fragility of a structure, system, or component (SSC) is the conditional probability of the 

failure at a given hazard input level. This input parameter could be peak ground acceleration 

(PGA), peak spectral acceleration, floor spectral acceleration, or others. Seismic fragilities are 

needed in a PRA to estimate the conditional probabilities of occurrence of initiating events (i.e., 

loss of emergency AC power, small LOCA, etc) and the conditional failure probabilities of 

different mitigating systems (e.g., auxiliary feedwater system). The fragility calculation typically 

uses a double lognormal model with three parameters, which are the median acceleration 

capacity (Am), the logarithmic standard deviation of the aleatory (randomness) uncertainty in 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-4 

capacity (βR), and the logarithmic standard deviation of the epistemic (modeling and data) 

uncertainty in the median capacity (βU). The aleatory and epistemic uncertainty can be 

combined into a composite variability. The fragility using a composite variability is referred to as 

the mean fragility. 

The ground acceleration capacity of an SSC is estimated using information on plant design 

bases, responses calculated at the design analysis stage, as-built dimensions, and material 

properties. Because there are many variables in the estimation of this ground acceleration 

capacity, seismic fragility is described by a family of fragility curves; a probability value is 

assigned to each curve to reflect the uncertainty in the capacity estimation. This family of 

fragility curves is characterized by three parameters: Am, βR and βU. When separation of the 

uncertainties into aleatory and epistemic is not justified on the basis of available data, fragility 

curves can be characterized in terms of the median and composite variability. 

Seismic fragilities of structures and equipment are calculated using many sources: plant-specific 

seismic design and qualification data, fragility test data, generic seismic qualification test data, 

and earthquake experience data. In a typical SPRA, more than 500 components (so called 

Seismic Equipment List –SEL) are identified as requiring evaluation. The starting point for 

constructing such an SEL is the internal events PRA model to which are added a number of 

SSCs with earthquake-specific issues such as including passive components and structures. 

Further some generically seismically rugged components such as check valves and manual 

valves are screened out from the internal event PRA model. The study site is a soil site for 

which site-specific soil failures such as soil liquefaction are considered in the development of 

the SEL. 

A plant walkdown is performed to screen out a large number of these SEL items based on their 

generically high seismic capacities and on lack of obvious seismic deficiencies (such as poor 

anchorage and inadequate lateral support) and spatial interactions (e.g., a nonseismically 

qualified component failing and falling on the SEL item). For the remaining components, 

seismic fragilities are calculated using one or more of the data sources. 

The supporting requirements for seismic fragility evaluation including documentation are given 

in the ASME/ANS PRA Standard Section 5-2.2. Currently, the utility has conducted the seismic 

walkdown of the SEL items on Vogtle Unit 1 using industry experts. The components are 

grouped into three bins: High, Medium and Low. The “High” capacity components could be 

screened out from the PRA model. The “Medium” and “Low” capacity components need plantspecific seismic fragilities. New seismic response analyses of the plant buildings are planned 

by the utility using the Ground Motion Response Spectra (GMRS) to be developed as part of 

PSHA (see Step 1 above). Therefore, the seismic fragility information specific to Vogtle will not 

be available for the Level 3 PRA project. In the meantime, a representative or generic set of 

seismic fragilities will have to be used to complete and exercise the Project SPAR SPRA model. 

This process also will involve approximate methods to account for differences in spectral 

shapes between the GMRS and response spectra used in the derivation of generic fragility data 

and potential effects of these differences on seismic loads on SSCs. Under the Contingency 

task, NRC (or contractor) seismic/structural experts should review the Vogtle walkdown report 

and assign generic seismic fragilities to SEL items that are in the “medium” and “low” capacity 

bins. The fragility input to Project SPAR SPRA model can be revised when the Vogtle-specific 

seismic fragilities become available. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-5 

Step 3 – Seismic Plant Response Analysis

The objective of seismic plant response analysis is to calculate the frequencies of core damage 

and large early release resulting from seismic events. This is done by combining the plant logic 

with component fragilities and seismic hazard estimates. Similar to the internal event PRA, 

event trees and fault trees are constructed to identify the accident sequences that may lead to 

core damage and large early release. Typically, the internal-events PRA model is used as the 

basis for developing the SPRA mode. Systems analysis for SPRA generally consists of both 

adding some earthquake-related basic events to the internal event PRA model and also 

“trimming” some aspects of that model that do apply for seismic model. It is important that the 

plant response analysis model all important failures, including both failures caused by the 

earthquake and non-seismic failures and human errors. To address human errors, human 

reliability analysis (HRA) will be performed as generally described in Section 7, supplemented 

by guidance for addressing operator manual actions (e.g., NUREG-1921), and extended to 

address human performance issues specific to seismic events. ASME/ANS PRA Standard 

Part 5 Section 5-2.3 gives the technical requirements for the seismic response analysis 

including quantification of CDF and LERF. 

The SNC has started on the SPRA of Vogtle Units 1 and 2. Since the SEL had been generated 

to guide the plant walkdown, it is expected that preliminary SPRA model in terms of event trees 

and fault trees could be available. Use of this SPRA model is more efficient than creating a 

model for SPAR using the internal event PRA model. 

13.1.1.4 Documentation

Document the seismic analysis including the PSHA, seismic fragility evaluation and seismic 

plant response. Table 13-2 provides details of documentation needs. The documentation 

(along with the identified inputs described in Section 13.1.1.2) are succinct and transparent in 

enabling an independent quality assurance (QA) and peer review. 

Table 13-2 Documentation Needs for Subtask 2-1.1 

Item Description 

PSHA Document the process used in the PSHA. This 

includes a description of: 

• The specific methods used for source characterization and 

ground motion characterization. 

• The scientific interpretations that are the basis for the inputs 

and results. 

• If an existing PSHA is used, adequate documentation to 

ensure the spirit of the requirements discussed in the 

ASME/ANS PRA Standard. 

• The specific methods and data used to develop the sitespecific soil response. 

In addition, identify the sources of model uncertainty and related 

assumptions associated with the PSHA. 

Fragility Analysis Document the process used in the seismic fragility analysis. This 

includes a description of: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-6 

Table 13-2 Documentation Needs for Subtask 2-1.1 

Item Description 

• The methodologies used to quantify the seismic fragilities of 

structures, or systems, or components, or a combination 

thereof, together with key assumptions. 

• The structure, or system, or component, or a combination 

thereof (SSC) fragility values that includes the method of 

seismic qualification, the dominant failure mode(s), the source 

of information, and the location of the component. 

• The fragility parameter values (i.e., median acceleration 

capacity [Am], aleatory [βR] and epistemic [βU] uncertainties) 

and their technical bases for each analyzed SSC. 

• The different elements of seismic-fragility analysis, such as: 

o the seismic response analysis 

o the screening steps (seismic equipment list) 

o the walkdown 

o the review of design documents 

o the identification of critical failure modes for each SSC 

o the calculation of fragility parameter values for each SSC 

modeled 

Plant Response 

Analysis 

Document the process used in the seismic plant response model 

analysis and quantification. This includes a description of: 

• The specific adaptations made in the internal events PRA 

model to produce the seismic-PRA model, and their bases. 

• The major outputs of a SPRA are similar to those for Level 1 

at power PRA, which at a minimum includes mean core 

damage frequency (CDF), mean large early release frequency 

(LERF), uncertainty distributions on CDF and LERF, results of 

sensitivity studies, and significant risk contributors. 

13.1.1.5 Task Interfaces

The various technical steps of at-power seismic events PRA are dependent on other technical 

elements for information in order for the step to be completed. The interface that is applicable 

to SPRA follows: 

1. Step 3 outputs (i.e., CDF sequences) are inputs to the Level 2 analysis. This step also 

requires the Level 1 at-power internal events PRA model, as input. 

13.1.1.6 References

1. ASME/ANSPRA Standard: Standard for Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS Ra-Sa2009. 

2. RG 1.208, “A Performance-Based Approach to Define the Site-Specific Earthquake 

Ground Motion,” March 2007. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-7 

3. Southern Nuclear Company, Vogtle Early Site Permit Application, Part 2- Site Safety 

Analysis Report, Revision 5, December 2008. 

4. Vogtle Electric Generating Plant Individual Plant Examination of External Events 

(IPEEE), Unit 1 and Unit 2, Volume 2, November 1, 1995. 

13.1.2 Subtask 2-1.2: Level 1 Reactor PRA for At-Power and High Winds

The Vogtle Units 1 and 2 plants have been designed for the Design Basis Tornado (DBT) with a 

maximum wind speed of 360 mph specified in the Regulatory Guide (RG) 1.76 [4], and the units 

are not exposed to the hurricane hazard, since they are not located on the coast. 

The current design basis tornado wind speed for Region I derived from a probabilistic tornado 

hazard analysis and having an exceedance probability of 1x10-7 per year is only 230 mph. The 

corresponding wind speed at the Vogtle site is 208 mph (Table 6-1 of NUREG/CR-4461 

Revision 2 [3]). This value is less than that specified in RG 1.76, and it is much less when 

compared to the DBT for Vogtle Units 1 and 2. Therefore, using the screening criteria in 

ASME/ANS PRA Standard Part 6, the high winds events were screened-out from the at-power 

PRA for Vogtle Units 1 and 2. Nevertheless, the present section addresses the elements of the 

Level 1 reactor, at power high winds PRA following the ASME/ANS PRA Standard Section 7-2 

[1]. 

The PRA for the high winds has been carried out for several U.S. nuclear power plants, and 

only in a few cases it involved detailed PRA modeling (e.g., Indian Point Unit 2, as part of the 

individual plant examination of external events [IPEEE]). Also, the hazard analysis carried out 

during the design stage provides a basis for the screening analyses and demonstrably 

conservative analyses using the approaches in Part 6 of the ASME/ANS PRA Standard. These 

approaches have usually shown that the contribution of high winds to CDF is insignificant. The 

collective experience with detailed high-winds PRA is limited, however. Because of this limited 

experience, it might be needed to improvise the approach to high-winds PRA analysis following 

the overall methodology requirements in Section 7-2 of the ASME/ANS PRA Standard. The 

technical requirements for high-winds PRA are similar, with adaptations, to those for seismic 

PRA. 

Based on the ASME/ANS PRA Standard Section 7-2 [1], the major elements of the high winds 

PRA are: 

• High wind hazard analysis (WHA) – This element involves the evaluation of the 

frequency of occurrence of different intensities of high winds based on a site-specific 

probabilistic evaluation reflecting recent available data and site-specific information. 

• High wind fragility evaluation – This element evaluates the fragilities of the structures, 

systems, or components as a function of the intensity of the high wind using plantspecific, SSC-specific information and an accepted engineering method for evaluating 

the postulated failure. 

• High wind plant response model – This element develops a plant response model that 

addresses the initiating events and other failures resulting from the effects of high wind 

that can lead to core damage or large early release. The model is usually based on the 

internal events, at-power PRA model that incorporates those aspects that are different, 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-8 

due to the effects of high wind, from the corresponding aspects of the at-power, internal 

events model. 

13.1.2.1 Assumptions and Limitations

The following are a list of the assumptions and limitations that define the scope and level of 

detail performed for this task: 

• The analysis may be qualitative, quantitative, or a combination of each, as the sitespecific hazard characteristics warrant it. 

• The level of detail of modeling and analysis will be in accordance with the potential 

impacts of the high winds risks. 

• It is assumed that documentation for plant systems are available to the full scope site 

Level 3 PRA Project. 

• The CDF sequences and their end-states will be defined in the same manner as those in 

the internal event CDF sequences so that the interface from Level 1 to Level 2 to be set 

up in the internal events SPAR model can be used by the Level 2 task, if needed. 

13.1.2.2 Inputs

The design, maintenance, and operational information required to perform the associated steps 

1, 2, and 3 are identified in Table 13-3. This table lists the minimum information required to 

perform each step. 

Table 13-3 Required Inputs for Subtask 2-1.1 

Input Description (1) 

Design/Engineering • Site characteristic input for WHA 

o Historical site and area wind data 

• Fragility analysis inputs 

o High Wind design criteria for SSCs 

o Spatial layout, sizing, and accessibility information 

related to the credited SSCs. 

o Design reports and calculations for buildings and yard 

equipment to withstand design basis tornado, hurricane 

and wind generated missiles 

• High wind plant response model 

o SSC success criteria 

o Level 1 internal events SPAR model 

Operation • High wind plant response model 

o That information needed to reflect the actual operating 

procedures and practices used at the plant including 

when and how operators interface with plant equipment 

as well as how plant staff monitor equipment operation 

and status after a high wind event 

Maintenance None 

Note (1) – Much of the above information can be gathered and is confirmed via plant walkdown and personnel 

interviews. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-9 

13.1.2.3 Analysis Steps

The high wind events analysis consists of the following three interrelated steps: 

1. High wind hazard analysis 

2. High wind fragility evaluation 

3. High wind plant response model 

These steps are described below; however, for more detailed guidance, see the ASME/ANS 

PRA Standard [1]. 

Step 1 – High Wind Hazard Analysis 

The objective of the high wind hazard analysis is to calculate the frequency of occurrence of 

high wind as a function of intensity (i.e., wind speed) on a site-specific basis. Depending on the 

site location, the wind types to be considered are: tornado, hurricane, extratropical wind storms 

and other straight wind phenomena. The output of the wind hazard analysis is a family of wind 

hazard curves; each curve showing the annual frequency of exceeding different wind speeds is 

assigned a subjective probability. 

The hazard from wind-generated missiles is also evaluated. A survey of the plant building and 

surroundings is done to assess the number, types, and locations of potential missiles. 

Step 2 – High Wind Fragility Evaluation 

The objective of the fragility analysis is to identify the SSCs that susceptible to the effects of 

high winds and to determine their plant-specific failure probabilities as a function of wind speed. 

Wind fragility is evaluated using the same general methodology as for the seismic fragilities. 

Typically, the entire family of fragility curves for an SSC corresponding to a particular failure 

mode is expressed in terms of the median wind-speed capacity (Vm), the logarithmic standard 

deviations βR and βU representing randomness in capacity and uncertainty in the median 

capacity, respectively. Such fragility parameters are estimated for the credible failure modes of 

the SSC. Failure of structures could be overall, such as failure of a shear wall or moment 

resisting frame, or local such as out-of-plane wall failure or pull out of metal siding. Typically, 

failure of a structure is assumed to fail all equipment housed within the structure. Tanks and 

other equipment located outdoors are exposed to the hazard from wind-borne missiles. 

Step 3 – High Wind Plant Response Model 

The objectives of the high wind plant response model are to: 

• Develop the model by modifying the at-power internal event PRA model to include the 

effects of the wind in terms of initiating events and their consequent failures. 

• Quantify this model to provide the conditional core damage probability (CCDP) and 

conditional large early release probability (CLERP) for each defined high wind plant 

damage state. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-10 

• Evaluate the unconditional CDF and LERF by integrating the CCDP/CLERP with the 

frequencies of the plant damage states obtained by combining the high wind hazard and 

high wind fragility. 

The above steps describe the elements of a detailed PRA that could be conducted for high 

winds. The most common method for developing the external hazard PRA systems model is to 

start with the internal events systems model (i.e., fault trees and event tress) and adapt it by 

adding and modifying events to represent the consequential failure causes. In this approach the 

resulting model is consistent with the internal events systems model regarding plant response 

and the cause-effect relationships of the failures. The analysis consists of developing event 

trees and fault trees in which the initiating event can be either the extreme wind effect itself or a 

transient or loss-of-coolant accident induced by the extreme winds. Other factors to be 

considered include non–wind-related unavailabilities or failures of equipment, operator errors, 

any warning time available to take mitigating steps (e.g., in the case of hurricanes), the 

possibility of recovery actions by operators and replacement by substitutes to accomplish the 

needed function, and the likelihood of common-cause failures. To address operator errors and 

operator non-recovery actions, human reliability analysis (HRA) will be performed as generally 

described in Section 7, supplemented by guidance for addressing operator manual actions (e.g., 

NUREG-1921), and extended to address human performance issues specific to high winds. 

Based on the modeling, accident sequences that lead to core damage or large early release are 

identified, and their conditional probabilities of occurrence are calculated. The frequency of core 

damage or large early release is obtained by a convolution over the relevant range of hazard 

intensities. 

13.1.2.4 Documentation

The analysis of high wind events including the high wind hazard analysis, high wind fragility 

evaluation, and high wind plant response model should be documented in accordance with the 

requirements set forth in the ASME/ANS PRA Standard Section 7-2. Table 13-4 provides 

details of documentation needs. The documentation (along with the identified inputs described 

in Section 13.1.2.2) are succinct and transparent in enabling an independent quality assurance 

(QA) and peer review. 

Table 13-4 Documentation Needs for Subtask 2-1.1 

Item Description 

High Wind Hazard 

Analysis 

DOCUMENT the process used to identify the wind hazards. 

This includes a description of: 

• The specific methods used for determining the highwind hazard curves. 

• The associated wind pressure, pressure distributions, 

missile and differential pressure effects. 

• The scientific interpretations that are the basis for the 

inputs and results. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-11 

Table 13-4 Documentation Needs for Subtask 2-1.1 

Item Description 

In addition, the sources of model uncertainty and related 

assumptions associated with the wind hazard analysis should 

be documented. 

High Wind Fragility 

Evaluation 

DOCUMENT the process used in the wind fragility analysis. 

This includes a description of: 

• The methodologies used to quantify the high-wind 

fragilities of structures, or systems, or components, or 

a combination thereof (SSCs), together with key 

assumptions. 

• A detailed list of SSC fragility values that includes the 

method of analysis, the dominant failure mode(s), the 

sources of information, and the location of each SSC. 

• The fragility parameter values (i.e., median windspeed capacity [Vm], aleatory [βR], and epistemic [βU] 

uncertainties) and their technical bases for each 

analyzed SSC. 

• The basis for the screening out of any generic highcapacity structures, or systems, or components, or a 

combination thereof (SSCs). 

High Wind Plant 

Response model 

DOCUMENT the process used in the wind plant response 

analysis and quantification. This includes a description of: 

• The specific adaptations made to the internal events 

PRA model to produce the high-wind PRA model, and 

their bases. 

• The final results of the PRA analysis in terms of core 

damage frequency and large early release frequency, 

as well as selected intermediate results including 

uncertainty distributions on CDF and LERF, results of 

sensitivity studies, and significant risk contributors. 

13.1.2.5 Task Interfaces

The various technical steps of at-power high wind events PRA are dependent on other technical 

elements for information in order for the step to be completed. The interface that is applicable to 

high winds PRA follows: 

• Step 3 outputs (i.e., CDF sequences) are inputs to the Level 2 PRA. This step also 

requires Level 1 at-power internal events PRA model, as input. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-12 

13.1.2.6 References

1. ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power Plant Applications,” February 2009. 

2. Southern Nuclear Company Vogtle Early Site Permit Application, Part 2 – Site Safety 

Analysis Report, Revision 5, December 2008. 

3. V. Ramsdell and G.L. Andrews, “Tornado Climatology of the Contiguous United States,” 

Battelle Pacific Northwest Laboratories and U.S. Nuclear Regulatory Commission 

NUREG/CR-4461, Revision 2, February 2007. 

4. RG. 1.76, “Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants,” 

Revision 1, March 2007. 

13.1.3 Subtask 2-1.3: Level 1 Reactor PRA for At-Power and External Floods

As shown in the IPEEE of Vogtle Units 1 and 2 and in the Early Site Permit Application for 

Vogtle Units 3 and 4, the design basis flood determined from a breach of upstream dams 

produces a flood elevation level of 178.10 feet (ft) mean sea level (MSL). This elevation is well 

below the site grade elevation of 220 ft MSL. Therefore, Vogtle is considered to be a “dry site” 

and no external flooding analysis has been performed by the licensee. Nevertheless, the 

present section addresses the elements of the Level 1 reactor, at power for external flooding 

PRA following the ASME/ANS PRA Standard Section 8-2 [1]. For the Level 3 PRA project, 

detailed quantitative risk analysis is not anticipated for external flooding, based on what is 

known about the site characteristics, and expected evaluation results in response to the 

Fukushima-related NRC request. 

External flooding evaluation has been carried out for U.S. nuclear power plants using mostly 

deterministic bounding analysis. Also, the hazard analyses carried out during the design stage 

provides a basis for the screening analyses and demonstrably conservative analyses using the 

approaches in Part 6 of the ASME/ANS PRA Standard. These approaches, based on a 

combination of using the recurrence intervals for the design-basis floods and analyzing the 

effectiveness of mitigation measures to prevent core damage, have led to the judgment that the 

contribution of external floods to CDF is small. The collective experience with PRA externalflooding analysis is limited, however. The technical requirements for external-flooding PRA 

including local precipitation are similar, with adaptations, to those for internal-flooding PRA and 

seismic PRA. 

The major elements of the external flood PRA are: 

• External flood hazard analysis 

This element involves the evaluation of the frequency of occurrence of different external 

flood severities based on a site-specific probabilistic evaluation reflecting recent 

available data and site-specific information. 

• External flood fragility analysis (involving analysis of flooding pathways and water levels) 

This element evaluates the susceptibility of plant structures, systems, or components as 

a function of the severity of the external flood using plant-specific, SSC-specific 

information and an accepted engineering method for evaluating the postulated failure. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-13 

• External flood plant response model and quantification 

This element develops a plant response model based on the internal events, at-power 

PRA model, that addresses the initiating events and other failures resulting from the 

effects of external flooding that can lead to core damage or large early release. 

For flooding hazard analysis, two new documents are being created by the nuclear utilities in 

response to the NRC 10 CFR 50.54(f) to be used to identify and evaluate external flooding 

scenarios. These documents are: 

• R2.3: Flood Protection Walkdowns Report (expected availability Dec 2012) 

• R2.1: Flood Hazard Reevaluation Report (expected availability April 2013) 

Recently, the NRC has issued a draft Interim Staff Guidance (JLD-ISG-2012-05) “Guidance for 

Performing the Integrated Assessment for Flooding,” for public comment [3]. This ISG 

describes the different aspects of external flood assessment (i.e., flood hazard, capability of 

passive and active barriers and reliability of emergency procedures) and provides several 

options for evaluation of flood mitigation capability (i.e., scenario based approach, margins-type 

evaluation and use of PRA). 

In the draft ISG (JLD-ISG-2012-05), it is stated “For most flood mechanisms, widely accepted 

and well-established methodologies are not available to assign initiating event frequencies to 

severe floods using probabilistic flood hazard assessment (Ref. 4). For this reason, the 

Integrated Assessment does not require the computation of initiating flood-hazard frequencies. 

It is not acceptable to use initiating event frequencies to screen out flood events in lieu of 

evaluation of flood protection features at the site. However, if desired and given appropriate 

justification, the use of flood event frequency is deemed acceptable for use as part of a PRA.” 

The draft ISG also provides an option for a margins-type evaluation of mitigation capability 

wherein the conditional core damage probability and conditional large early release probability 

are calculated for a selected flood scenario taking into account the passive barriers, active 

barriers and emergency procedures. 

13.1.3.1 Assumptions and Limitations

The list of assumptions and limitations that define the scope and level of detail performed for 

this task follows: 

• The analysis may be qualitative, quantitative, or a combination of each, as the sitespecific hazard characteristics warrant it. 

• The level of detail of modeling and analysis will be in accordance with the potential 

impacts of the expected external flood risks. 

• It is assumed that documentation for plant systems are available and can be used as 

reference if needed. 

• The CDF sequences and their end-states will be defined in the same manner as those in 

the internal event CDF sequences so that the interface from Level 1 to Level 2 to be set 

up in the internal events SPAR model can be used by the Level 2 task, if needed. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-14 

13.1.3.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of external flooding analysis are identified. The information needed to perform 

each step, at a minimum, is listed in Table 13-5. 

Table 13-5 Required Inputs for Subtask 2-1.3 

Input Description 

Design/Engineering • Site characteristic input for flood hazard analysis 

o Site maximum probable precipitation, probable 

maximum flood. 

o Locations and design criteria for upstream dams, if any. 

• Design input for external flood fragility evaluation 

o External flood design criteria. 

o Spatial layout, sizing, and accessibility information 

related to the credited SSCs. 

o Reports on external flood design of buildings and 

equipment, flood dikes and flood doors, if any. 

o Procedures for performing emergency measures (e.g., 

sand-bagging, pumping out water, etc). 

• Plant response model and quantification 

o Level 1 Internal events SPAR model. 

Operation • Plant response analysis 

o That information needed to reflect the actual operating 

procedures and practices used at the plant including 

when and how operators interface with plant equipment 

as well as how plant staff monitor equipment operation 

and status after an external flood. 

Maintenance None. 

13.1.3.3 Analysis Steps

The external flood analysis consists of three interrelated steps: 

1. External food hazard analysis 

2. External flood fragility evaluation 

3. External flood plant response model and quantification 

These steps are described below; however, for more detailed guidance, see the ASME/ANS 

PRA standard. 

Step 1 – External Flood Hazard Analysis 

The objective of the flood hazard analysis is to calculate the frequency of occurrence of external 

floods as a function of severity on a site-specific basis. Depending on the site location, the flood 

types to be considered are: extreme local precipitation, river flooding, ocean flooding, lake 

flooding, flooding induced by tsunami and flooding caused by the failure of a dam, levee or dike. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-15 

ASME/ANS PRA Standard Section 8-2 supporting requirement XFHA-B describes the 

documentation needs for the external flood hazard analysis. 

Step 2 – External Flood Fragility Evaluation 

The objective of the external flood fragility analysis is to identify the SSCs that susceptible to the 

effects of external floods and to determine their plant-specific failure probabilities as a function 

of external flood. Flood fragility could be evaluated using the same general methodology as for 

the seismic fragilities. Typically, the entire family of fragility curves for an SSC corresponding to 

a particular failure mode is expressed in terms of the median flood height capacity, Hm, and the 

logarithmic standard deviations, βR and βU, representing randomness in capacity and 

uncertainty in median capacity, respectively. Such fragility parameters are estimated for the 

credible failure modes of the SSC. 

 

Flood-caused failure of equipment is typically due to immersion, although in some instances, 

particularly applicable to structures, the failure may be due to flow-induced phenomena. Failure 

of structures could be overall, such as due to a foundation failure, or local, such as failure of a 

wall or barrier leading to leakage or major flooding through the wall or barrier. 

ASME/ANS PRA Standard Section 8-2 supporting requirement XFFR-B describes the 

documentation needs for the external flood fragility analysis. 

Step 3 – Flood Plant Response Model and Quantification 

The objectives of the flood plant response model and quantification are to: 

• Develop a flood plant response model by modifying the internal event at-power PRA 

model to include the effects of the external flood in terms of initiating events and failures 

caused. 

• Quantify this model to provide the conditional core damage probability (CCDP) and 

conditional large early release probability (CLERP) for each defined external flood plant 

damage state. 

• Evaluate the unconditional CDF and LERF by integrating the CCDP/CLERP with the 

frequencies of the plant damage states obtained by combining the external flood hazard 

and external flood fragility. 

The above steps describe the elements of a detailed PRA that could be conducted for external 

floods. Similar to seismic and high wind PRA, the external-flooding-PRA systems-analysis 

model is almost always based on the internal-events, at-power PRA systems model, to which 

are added basic failure events derived from the information developed in the flooding fragility 

analysis. The analysis consists of developing event trees and fault trees in which the initiating 

event can be either the extreme flood itself or a transient or loss-of-coolant accident induced by 

the extreme flood. Other factors to be considered include non–flooding-related unavailabilities or 

failures of equipment, operator errors, any warning time available to take mitigating steps, the 

possibility of recovery actions by operators and replacement by substitutes to accomplish the 

needed function — and the likelihood of common-cause failures. The clogging of intake 

structures and other flow paths by debris related to the flooding must also be considered, and a 

walkdown is important to ensure that this issue has been evaluated properly. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-16 

To address operator errors and operator non-recovery actions, human reliability analysis (HRA) 

will be performed as generally described in Section 7, supplemented by guidance for addressing 

operator manual actions (e.g., NUREG-1921), and extended to address human performance 

issues specific to external floods. 

One key consideration that differentiate the external flooding from high winds and seismic is that 

most large external floods occur only after significant warning time or extended duration that 

allows the plant operating staff to take appropriate steps to secure the plant and its key 

equipment. This warning time and the typical situation in which the plant grade is well above any 

credible flooding phenomena are the principal reasons why external-flooding risks are not often 

found to be important contributors to overall risks. And some plants like Vogtle can screen this 

event from further consideration. This time delay provides ample time to take credit for 

compensatory actions per plant’s planning and procedures. Based on the modeling, accident 

sequences that lead to core damage or large early release are identified, and their conditional 

probabilities of occurrence are calculated. The frequency of core damage or large early release 

is obtained by a convolution over the relevant range of hazard intensities. 

ASME/ANS PRA Standard Section 8-2 supporting requirement XFPR-B describes the 

documentation needs for the flood plant response analysis. 

13.1.3.4 Documentation

Document the external flood analysis including the external flood hazard analysis, external flood 

fragility evaluation and external flood plant response model and quantification. Table 13-6 

provides details of documentation needs. The documentation (along with the identified inputs 

described in Section 13.1.3.2) are succinct and transparent in enabling an independent quality 

assurance (QA) and peer review. 

Table 13-6 Documentation Needs for Subtask 2-1.3 

Product Description 

External Flood 

Hazard Analysis 

Document the process used to identify external flood 

hazards. This includes a description of the specific methods 

used for determining the external flooding hazard curves, 

including the scientific interpretations that are the basis for 

the inputs and results. 

In addition identify the sources of model uncertainty and 

related assumptions associated with the external flood 

hazard analysis. 

External Flood 

Fragility Analysis 

Document the process used in the external flood fragility 

analysis. This includes a description of: 

• Methodologies used to quantify the flooding-caused 

fragilities of SSCs, together with key assumptions. 

• The basis for the screening out of any SSCs for which 

the screening basis is other than the SSC being 

located where flooding does not occur. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-17 

Table 13-6 Documentation Needs for Subtask 2-1.3 

Product Description 

• SSC fragility values that includes the method of 

analysis, the dominant failure mode(s), the sources of 

information, and the location of each SSC. 

• Fragility parameter values (i.e., median flood height 

capacity, Hm, and the logarithmic standard deviations, 

βR and βU) and their technical bases for each 

analyzed SSC. 

External Flood Plant 

Response Model and 

Quantification 

Document the process used in the external flood plant 

response analysis and quantification. This includes a 

description of: 

• The specific adaptations made to the internal events 

PRA model to produce the external flooding-PRA 

model, and their bases. 

• The final results of the PRA analysis in terms of core 

damage frequency and large early release frequency, 

uncertainty analysis, as well as selected results on 

risk contributors. 

13.1.3.5 Task Interfaces

The various technical steps of external flood PRA are dependent on other technical elements for 

information in order for the step to be completed. The interface that is applicable to external 

flooding PRA follows: 

• Step 3 outputs (i.e., CDF sequences) are inputs to the Level 2 PRA model. This step 

also requires Level 1 at-power internal events PRA model, as input. 

13.1.3.6 References

1. ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power Plant Applications,” February 2009. 

2. Southern Nuclear Company Vogtle Early Site Permit Application, Part 2 – Site Safety 

Analysis Report, Revision 5, December 2008 

3. DRAFT Interim Staff Guidance JLD-ISG-2012-05, “Guidance for Performing the 

Integrated Assessment for Flooding,” Japan Lessons-Learned Project Directorate, 

September 20, 2012. (ADAMS Accession No. ML12235A319.) 

4. “Design-Basis Flood Estimation for Site Characterization at Nuclear Power Plants in the 

United States of America,” NUREG/CR-7046. November 2011. (ADAMS Accession No. 

ML11321A195.) 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-18 

13.1.4 Subtask 2-1.4: Level 1 Reactor PRA for At-Power and Other External 

Hazards

The Level 1 Reactor PRA analysis of other external hazards for at-power operation is to be 

performed to estimate the risk from site-specific external hazards other than seismic hazards. 

This risk will be characterized by calculating the plant CDF (Level 1 analysis), if possible; 

otherwise by a qualitative characterization will be performed. Parts 6 and 9 of the ASME/ANS 

Level 1/LERF PRA standard provide technical requirements related to the performance of this 

subtask. 

This analysis consists of the following three interrelated steps: 

• Review of plant specific external hazard data and licensing bases 

The objective of this step is to become familiar with and asses the existing licensee 

analyses with regard to other external hazards and the existing Level 1 PRA model for 

the subject plant site. 

• Screening analyses 

The objective of this step is to determine whether a particular external hazard can be 

eliminated from further consideration in the at-power, Level 1 reactor PRA model for 

internal and external hazards for the subject plant. This step consists of either 

qualitative or quantitative screening, or a combination of both. This analysis will conform 

to the ASME/ANS Level 1/LERF PRA standard technical elements for the screening of 

other external hazards (EXT). 

• Modeling of unscreened external hazards 

The objective of this step is to model any unscreened external hazards from the previous 

step into the existing SPAR Level 1 PRA model for the subject plant. This modeling will 

conform to the ASME/ANS Level 1/LERF PRA standard technical elements for other 

external hazards analysis (XHA), external hazards fragility analysis (XFR), and external 

hazard plant response modeling (XPR). 

13.1.4.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The analysis may be qualitative, quantitative, or a combination of each, as is warranted 

by the site-specific external hazard characteristics. It is assumed that the external 

hazards under consideration will consist of the external hazards listed in Appendix 6-A of 

the ASME/ANS RA-Sa-2009 PRA standard. 

• The level of detail of modeling and analysis will be in accordance with the limited 

resources allocated to this task. See below for resource estimates. 

• It is assumed that documentation for plant systems etc. have already been obtained 

from the licensee and are available and for review and use as reference. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-19 

• It is assumed that a carefully selected vendor who is competent and has experience in 

this area will be available; with previous experience for creating similar models with 

limited resources. 

• It is assumed that the at-power Level 1 reactor PRA for internal hazards has been 

completed or is nearly complete. 

13.1.4.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of the Level 1, at-power reactor PRA for other external hazards analysis are 

identified. This information (along with the identified products, Section 13.1.4.2) should allow an 

independent analyst to reproduce the various results. The information needed to perform each 

step, at a minimum, is listed below in Table 13-7. 

Table 13-7 Needed Inputs for Subtask 2-1.3 

Input Description

Step 1: Review of plant specific external hazard data and licensing bases 

Plant design information This input may consist of the subject plant FSAR, engineering 

drawings, Operating License, etc. This information will be 

needed to starting this step.

Licensee PRA information Licensee PRA documentation, peer review findings, , the 

licensee’s Level 1 at-power PRA model for other external 

hazards, etc.. This information will be needed prior to starting 

this step.

Step 2: Screening analysis 

Plant walkdowns Plant walkdowns may be performed after the screening analyses 

are complete, as needed, to assess the validity of the 

assumptions used in the qualitative and quantitative screening 

analyses. Depending on whether an external hazard is screened 

qualitatively or quantitatively, these walkdowns may include 

locations both inside buildings and around the site. Walkdowns 

may. 

Step 3: Modeling of unscreened external hazards

Plant walkdowns Plant walkdowns may be performed at an appropriate time 

during the modeling of unscreened external hazards, as needed, 

to assess the validity of the assumptions used in the external 

hazard analysis, fragility evaluation, and plant response model 

development. Depending on whether an external hazard is 

screened qualitatively or quantitatively, these walkdowns may 

include locations both inside buildings and around the site.

13.1.4.3 Analysis Steps

The Level 1, at-power reactor PRA for other external hazards analysis consists of three 

interrelated steps: 

1. Review of plant specific external hazard data and licensing bases 

2. Screening Analysis 

3. Modeling of unscreened external hazards 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-20 

Step 1 – Review of Plant Specific External Hazard Data and Licensing Bases 

The objective of this step is to become familiar with and asses the existing licensee analyses 

with regard to other external hazards and the existing Level 1 PRA model for the subject plant 

site. 

The review of the subject plant licensing bases and plant specific external hazard data is 

performed for general familiarization of the plant site and documenting all previous other 

external hazards analyses. This step includes reviewing licensee PRA documentation as well 

as for the identification of any significant changes since the operating license (OL) issuance 

relative to (1) military and industrial facilities within 5 miles of the site, (2) onsite storage or other 

activities involving hazardous materials, (3) transportation, or (4) developments that could affect 

the original design conditions. Documentation should include descriptions of significant 

changes at the subject plant site since the issuance of the OL as well as a list of those analyses 

already performed with regard to other external hazards. 

Table 13-8 Documentation Needs for Step 1 of Subtask 2-1.3 

Item Description 

Significant changes to OL 

since issuance 

For a given change to the OL, this documentation should provide 

a detailed description of the change and why the change was 

implemented. 

Step 2 – Screening Analysis

The objective of this step is to screen out those external hazards which cannot or do not 

significantly impact site risk and are therefore eligible to be excluded from further consideration 

in the PRA. 

The screening analysis starts with a review of the list of external hazards requiring consideration 

in Appendix 6-A of the ASME/ANS Level 1/LERF PRA standard. A progressive screening 

approach will be used wherein a qualitative screening is performed first followed by a 

quantitative screening to determine if any external hazards other than seismic hazards can be 

removed from further consideration. The basis for screening any external hazard may be 

confirmed through a walkdown of the plant and its surroundings, as needed. Any 

inconsistencies between the plant walkdowns and the screening analyses assumptions for a 

given external hazard should be incorporated and the screening analysis should be redone 

accordingly. 

Documentation of these analyses will be performed in a manner that facilitates PRA 

applications, upgrades, and peer review. The process used to screen each external hazard 

should be documented so as to describe the approach used for screening, the screening criteria 

used for each screened external hazard, and any engineering or other analyses performed to 

support a bounding or demonstrably conservative analysis for screening out an external hazard. 

Documentation should be consistent with the supporting requirements in the ASME/ANS Level 

1/LERF PRA standard. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-21 

Table 13-9 Documentation Needs for Step 2 of Subtask 2-1.3 

Item Description 

Qualitative Screening 

Analysis 

An initial qualitative screening is performed to determine if any of 

the external hazards from the Appendix 6-A list meet any one of 

the five screening criteria in supporting requirement EXT-B1 of 

the ASME/ANS Level 1/LERF PRA standard. A second 

preliminary screening is performed on the remaining external 

hazards to determine if the plant’s design basis for the event 

meets the NRC 1975 Standard Review Plan. Documentation 

should be consistent with HLR-EXT-E. 

Quantitative Screening 

Analysis 

A bounding or demonstrably conservative analysis is performed 

using defined quantitative screening criteria to demonstrate that 

an external hazard can be removed from further consideration, 

as per HLR-EXT-C in the ASME/ANS PRA Level 1/LERF 

standard. Documentation should be consistent with HLR-EXT-E. 

Confirmatory Plant 

Walkdown Findings 

Confirmatory plant walkdowns may be performed, as needed, to 

determine the validity of the assumptions used in a given 

screening analysis, as per HLR-EXT-D in the ASME/ANS Level 

1/LERF PRA standard. Documentation should be consistent 

with HLR-EXT-E. 

Step 3 – Modeling of Unscreened External Hazards

The objective of this step is to incorporate models for any unscreened external hazards into the 

Level 1 reactor PRA for at-power operation. 

In general, the following activities are performed for a given external hazard that was not 

screened out in Step 2: an external hazard analysis; an external hazard fragility evaluation; and 

development of an external hazard plant response model. The external hazard analysis 

involves the evaluation of the frequency of occurrence of different intensities of the external 

hazard based on a site-specific probabilistic evaluation reflecting recent available data and sitespecific information. The external hazard fragility evaluation involves the evaluation of the 

fragilities of the structures, systems, or components as a function of the intensity of the external 

hazard using plant-specific, SSC-specific information and an accepted engineering method for 

evaluating the postulated failure. The development of the external hazard plant response model 

involves the development of a plant response model that addresses the initiating events and 

other failures resulting from the effects of the external hazard that can lead to core damage or 

large early release. The model is based on the internal events, at-power PRA model to 

incorporate those aspects that are different—as a result of the external hazard’s effects—from 

the corresponding aspects of the at-power, internal events model. 

The specific analyses performed during this step will be directly dependent on the specific 

external hazards were not screened out from further consideration in Step 2. Table 13-10 

discusses the documentation needs for this step of the subtask. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-22 

Table 3-10 Documentation Needs for Step 3 of Subtask 2-1.3 

Item Description 

External Hazard Analysis The analysis and documentation of the external hazard analysis 

shall be consistent with the supporting requirements in the XHA 

technical element in the ASME/ANS Level 1/LERF PRA 

standard. 

External Hazard Fragility 

Evaluation 

The analysis and documentation of the external hazard fragility 

evaluation shall be consistent with the supporting requirements 

in the XFR technical element in the ASME/ANS Level 1/LERF 

PRA standard. 

External Hazard Plant 

Response Model 

The development and documentation of the external hazard 

plant response model shall be consistent with the supporting 

requirements in the XPR technical element in the ASME/ANS 

Level 1/LERF PRA standard. 

13.1.4.4 Documentation

The products produced as a result of the subtask are identified below. These products (along 

with the identified inputs, Section 13.1.4.3) should be sufficient such that it allows an 

independent analyst to understand how the analysis was performed and to reproduce the 

results. Consequently, the list of products should include both interim and final products. 

Table 13-11 provides, at a minimum, the expected products from this subtask. 

Table 3-11 Expected Products from Subtask 2-1.3 

Product Description 

Step 1: Review of plant specific external hazard data and licensing bases 

Site Documentation 

Review (Final product) 

The report summarizes the results of the site documentation 

review including a catalog of any changes to the operating license 

post-issuance and a general synopsis of the licensee’s analyses of 

other external hazards. 

Step 2: Screening analyses 

Screening Analysis 

Report (Final product) 

This report details the qualitative and quantitative screening 

analyses of external hazards listed in Appendix 6-A of the PRA 

standard and will be consistent with the supporting requirements in 

Part 6 of the ASME/ANS Level 1/LERF PRA standard. 

Step 3: Modeling of unscreened external hazards 

Other External Hazards, 

Fragility, and Plant 

Response Analysis 

Report (Final Product) 

This report details the analysis of the unscreened external 

hazards, the plant fragility analysis, and the plant response 

analysis. This report is to be consistent with the documentation 

supporting requirements of high level requirement XHA, XFR, and 

XPR, respectively, in Part 9 of the ASME/ANS Level 1/LERF PRA 

standard. 

13.1.4.5 Task Interfaces

The various technical steps of the at-power, Level 1 reactor PRA for other external hazards are 

dependent on other technical elements for information in order for the step to be completed. 

These interfaces are as follows: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-23 

• Step 3 requires that the at-power Level 1 reactor PRA model for internal hazards be 

nearly complete, if not fully complete. This is considered to be a significant interface. 

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• The completion of the at-power, Level 1 reactor PRA for internal and external hazards is 

dependent on the completion of this subtask 

13.1.4.6 References

1. ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power Plant Applications,” Addendum A to 

RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, 

February 2009. 

2. NUREG-1407, “Procedural and Submittal Guidance for the Individual Plant Examination 

of External Events (IPEEE) for Severe Accident Vulnerabilities,” U. S. Nuclear 

Regulatory Commission, Washington, DC, June 1991. 

3. NUREG-1855 Revision 1 Draft, “Guidance on the Treatment of Uncertainties Associated 

with PRAs in Risk-Informed Decisionmaking,” U. S. Nuclear Regulatory Commission, 

Washington, DC, May 2012. 

4. Interim Staff Guidance Document on Uncertainties that is currently under development. 

13.2 Task 2-2: Level 2 Reactor PRA, At-Power for External Hazards

The purpose of this section is to describe the relationship between the reactor Level 2 PRA atpower internal hazards and the reactor Level 2 PRA at-power external hazards. A detailed 

technical approach plan for the reactor Level 2 PRA at-power external hazards will be 

developed later. 

Assumptions: 

• All (applicable) assumptions for the at-power internal hazards Level 2 PRA apply here. 

• The inclusion of other hazards will not represent a step increase in the amount of effort 

in Level 2 space (i.e., other hazards are an add-on to the internal hazards model). 

• The finite element analysis will be able to use the GMRS constructed for the Level 1, in 

conjunction with a source/structure interaction assessment. 

Analysis Steps: 

The table below shows how the analysis steps from the internal hazards Level 2 PRA map to 

those of the external hazards Level 2 PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-24 

Table 13-12 Mapping of Level 2 Internal Hazards to External Hazards 

Technical 

Element 

(Subtask) 

Analysis Step External Hazards Analogy 

Level 1/2 

PRA 

Interface – 

Accident 

Sequence 

Grouping 

Step 1 – Development of extended Level 

1 event trees 

Extensions of any new event tress 

need to be developed, and others 

checked for continued applicability 

Step 2 – Development of plant damage 

state binning 

Any new PDS need to be developed, 

and others checked for continued 

applicability 

Step 3 – Review the resulting plant 

damage states to ensure dependencies 

and other information have been 

adequately transferred 

Analogous 

Step 4 – Iteration on the Level 1 PRA 

modeling as necessary 

Analogous 

Step 5 – Criteria for, and selection of, 

representative sequences 

Any new representative sequences 

need to be developed, and others 

checked for continued applicability 

Containment 

Capacity 

Analysis 

Step 1 – Assess preliminary failure 

modes and locations of interest 

N/A 

Step 2 – Development of a finite element 

model of the containment 

N/A 

Step 3 – Development of containment 

fragilities associated with severe accident 

conditions 

Application of model for developing 

containment fragilities from external 

hazards. 

Step 4 – Structural responses to severe 

accident conditions in adjoining buildings 

External hazard fragilities for the 

auxiliary building, and any other 

SSCs of relevance not covered by 

the Level 1 PRA fragility analysis. 

Soil liquefaction effects and 

seismically-induced containment 

penetration failures if not covered by 

the Level 1 PRA. 

Severe 

Accident 

Progression 

Analysis 

Step 1 – SCALE analysis for decay heat 

and radionuclide inventory parameters 

N/A (no new analysis needed) 

Step 2 – Development of a plant-specific 

MELCOR model 

N/A (no new analysis needed) 

Step 3 – Accident progression modeling 

for the representative Level 2 sequences 

to guide logic model development 

MELCOR analysis to address new, 

or revised, representative 

sequences/event tree modeling. 

Step 4 – Phenomenological evaluations 

for split fraction assignment and logic 

model construction 

MELCOR analysis to support 

changes to the Level 2 logic model 

(support trees/split fractions). 

Step 5 – Evaluation of the impact of postcore damage recovery actions MELCOR analysis to address new, 

or revised, sequences 

Step 6 – Evaluation of equipment 

survivability. 

Only addressing those SSCs of 

relevance not covered by Step 4 of 

the Containment Capacity Analysis 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

13-25 

Table 13-12 Mapping of Level 2 Internal Hazards to External Hazards 

or the Level 1 PRA fragility analysis. 

Probabilistic 

Treatment of 

Accident 

Progression 

and Source 

Terms 

Step 1 – Data analysis for 

components/systems not considered in 

the Level 1 PRA 

N/A (no new analysis needed) 

Step 2 – Construction of accident 

progression event trees 

Modification to existing APET(s) as 

necessary. 

Step 3 – Development of support trees Create any new (or make necessary 

modifications to existing) support 

trees. 

Step 4 – Human reliability model 

development 

Addressed in separate section. 

Step 5 – Human reliability analysis Addressed in separate section. 

Step 6 – Level 2 model quantification Analogous 

Step 7 – Uncertainty characterization. Analogous 

Radiological 

Source 

Term 

Analysis 

Step 1 – Definition of the release 

category binning logic 

Inspect to make sure existing binning 

logic holds. 

Step 2 – Development of source terms 

for the various release categories 

Analogous 

Step 3 – Consideration of uncertainties in 

the source term development 

Analogous 

Evaluation 

and 

Presentation 

of Results 

Step 1 – Consolidation of the interim 

Level 2 PRA model documentation 

Analogous 

Step 2 – Consolidation of the final Level 

2 PRA model documentation 

Analogous 

Level 2/3 

PRA 

Interface 

Step 1 – Consolidation of the release 

category information in a format 

conducive for use by the Level 3 PRA 

analysts 

Analogous 

13.3 Task 2-3: Level 3 Reactor PRA, At-Power for External Hazards

[TO BE COMPLETED] 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-1 

14. Technical Approach for Reactor, Low Power and Shutdown, All 

Hazards PRA 

14.1 Task 3-1: Level 1 Reactor PRA, Low Power and Shutdown for All 

Hazards

14.1.1 Subtask 3-1.1: Level 1 Reactor PRA for Low Power and Shutdown and 

Internal Events

The Level 1 reactor PRA for Low Power and Shutdown (LPSD) and Internal Events Analysis 

consists of nine interrelated steps: 

1. Plant Operating State Analysis 

2. Initiating Event Analysis 

3. Accident Sequence Analysis 

4. Success Criteria Analysis 

5. Systems Analysis 

6. Human Reliability Analysis 

7. Data Analysis 

8. Modeling and Quantification of LPSD Internal Event Scenarios 

9. Document the analysis 

The objectives of these steps are to: 

1. Determine which Plant Operating States (POSs) are to be modeled. 

2. Determine which initiating events are to be modeled and estimate initiating event 

frequencies. 

3. Identify significant operator actions, mitigating systems, and phenomena that can impact 

the accident sequences. 

4. Define success criteria for critical safety functions, supporting systems, structures, 

components, operator actions, and sequence end states. 

5. Identify and quantify the causes of failure for each plant system represented in the 

model. 

6. Ensure that the impacts of plant personnel actions are reflected in the assessment of 

risk for each POS. 

7. Provide estimates of the parameters used to determine probabilities of basic events in 

the model. 

8. Incorporate the LPSD accident scenarios into the SPAR model and quantify the results 

to estimate their contribution to core damage frequency. 

9. Document the LPSD model and results. 

14.1.1.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The Level 1 PRA model for Low Power, Shutdown and Internal Events will be limited to 

a select number of POSs and initiating event accident scenarios. In principle, each POS 

could be modeled in similar detail and scope to the at-power, internal events model. A 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-2 

model of this size would likely become unwieldy. Some practical scope limitations must 

be applied to the model while maintaining adequate characterization of the significant 

risk contributors for LPSD evolutions. It is assumed that the project manager and project 

technical advisors will agree to an appropriate scope for the LPSD model before 

significant work on the model begins. 

• To begin work on the LPSD model it is assumed that a stable version of the Level 1 PRA 

model for at-power and internal events will be available. The LPSD accident scenarios 

will depend on parts (e.g., event trees, fault trees, and basic events) of the at-power 

internal events model. Any changes to the internal events model may impact the LPSD 

accident scenarios. 

14.1.1.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Internal Flood Analysis are identified. This information (along with the 

identified products, Section 14.1.1.2) should allow an independent analyst to reproduce the 

various results. The information needed to perform each step, at a minimum, is listed below in 

Table 14-1. 

Table 14-1 Needed Inputs for Subtask 3-1.1 

Input Description 

Steps 1, 2, 7: Define LPSD Model Scope and Data Analysis 

Vogtle LPSD 

Operating 

Experience 

Plant specific operating experience will be used to determine 

the appropriate scope for the model (e.g., POSs, residence 

times, and initiating events). If plant specific operating 

experience is not available or insufficient, then the analysis 

will be supplemented by industry-wide operating experience 

and analysts’ judgment. 

Steps 3 – 6: Accident Sequence, Success Criteria, System, and Human Reliability 

Analyses 

LPSD Supporting 

Calculations and 

Data 

Plant specific calculations and data, which may include water 

volumes, pump curves, and thermal hydraulic analysis, will 

be used to support development of accident sequences, 

success criteria, and timing for operator actions. If supporting 

calculations and data are not available or insufficient, then 

the analysis will be supplemented by applicable 

calculations/data from other plants and analysts’ judgment. 

Steps 3 and 6: Accident Sequence Analysis and HRA 

Vogtle Procedures 

Applicable to LPSD 

Operations 

The operating procedures used by Vogtle plant staff to 

perform LPSD evolutions and respond to off-normal LPSD 

conditions will be used to develop accident sequences and 

evaluate operator actions. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-3 

14.1.1.3 Analysis Steps

Internal Flood Analysis consists of nine interrelated steps: 

Step 1 – Plant Operating State Analysis 

The objectives of this step are: 

• To review available plant specific LPSD operating experience. 

• To determine the poss to be modeled. 

• To define the poss in sufficient detail to support accident scenario development. 

The staff will review the Vogtle LPSD operating history to determine the appropriate POSs to 

include in the model. The staff will determine which LPSD evolutions are performed, POSs 

entered, residence times in those POSs, and plant configuration in those POSs. The staff will 

impose practical limitations on the size and scope of the model. The model may not include all 

LPSD evolutions and POSs that are identified for Vogtle. In addition to reviewing Vogtle LPSD 

operating history, the staff will consider industry-wide LPSD operating experience and analysts’ 

judgment to determine the POSs to be modeled. The staff will consult with experienced staff in 

NRR and NRO to make this determination. 

The following table provides a list of items that need to be documented for this step. 

Table 14-2 Documentation Needs for Step 1 of Subtask 3-1.1 

Item Description 

POS Analysis Summary of the POSs selected for the LPSD model 

Step 2 – Initiating Event Analysis

The objectives of this step are: 

• Determine which initiating events are to be modeled. 

• To estimate initiating event frequencies. 

The staff will review plant specific and industry operating experience to determine which 

initiating events should be modeled in the LPSD model. The staff has experience developing 

shutdown SPAR models and will refer to the “SPAR-SD Model Maker’s Guideline (MMG)” report 

for guidance in determining which initiating events to model. 

The initiating event frequencies will generally be taken from the following references: 

• NUREG/CR-6928, “Industry-Average Performance for Components and Initiating Events 

at U.S. Commercial Nuclear Power Plants.” 

• EPRI Technical Report 1003113, “An Analysis of Loss of Decay Heat Removal Trends 

and Initiating Event Frequencies (1989-2000).” 

The staff will review more recent LPSD operating experience to determine if updated 

frequencies are needed. The staff will consult the EPRI Technical Report 1021176 “An Analysis 

of Loss of Decay Heat Removal and Loss of Inventory Event Trends (1990-2009).” This report 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-4 

summarizes more recent occurrences of LPSD events, but it does not include estimates of 

initiating event frequencies. The staff may perform some limited data analysis to update 

initiating event frequencies to the extent that it is deemed necessary. 

The following table provides a list of items that need to be documented for this step. 

Table 14-3 Documentation Needs for Step 2 of Subtask 3-1.1 

Item Description 

LPSD Initiating Event 

Analysis 

Summary of the initiating events to be modeled and 

estimates of initiating event frequencies. 

Step 3 – Accident Sequence Analysis

The objectives of this step are: 

• To identify significant operator actions, mitigating systems, and phenomena that can 

impact the accident sequences. 

• To develop the accident scenarios that will be modeled in the lpsd spar model. 

After reviewing the Vogtle plant procedures, the staff will define the LPSD accident scenarios to 

be modeled in the SPAR model for this project. The staff will identify significant operator actions, 

mitigating systems, and phenomena that can impact the accident sequences. The staff has 

experience with developing shutdown accident scenarios for the existing SPAR shutdown 

models. A similar approach will be taken in developing this model. 

The following table provides a list of items that need to be documented for this step. 

Table 14-4 Documentation Needs for Step 3 of Subtask 3-1.1 

Item Description 

Accident Sequence 

Analysis 

Document the accident sequence analysis and define the 

accident scenarios to be included in the model. 

Step 4 – Success Criteria Analysis 

The objective of this step is: 

• To define success criteria for critical safety functions, supporting systems, structures, 

components, operator actions, and sequence end states. 

The staff will review the Vogtle plant procedures and any available supplemental information to 

determine the success criteria for critical safety functions, operator actions, and sequence end 

states. The supplemental information may include supporting calculations, plant data (e.g., 

water volumes, pump curves), interviews with Vogtle operations staff, and plant walkdowns. The 

LPSD supporting systems, structures and components (SSCs) are expected to be modeled as 

part of the Level 1, at-power model. It is assumed that the at-power success criteria for these 

supporting SSCs will be applicable to LPSD conditions. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-5 

Some areas that may require special consideration for LPSD conditions include: 

• Decay heat generation: If available, the analysis will use a plant specific shutdown power 

correlation for each modeled POS. If this information is not provided by Vogtle, then a 

generic decay heat correlation will be used. 

• Mission time: In general, a 24-hour mission time will be used. For some sequences a 

longer mission time may be required to reach a stable end state. In those cases where 

the definition of mission time can have a significant impact on the results, the staff will 

adjust the model to use a different mission time. 

• Core damage definition and plant parameters used to determine core damage: The 

typical core damage plant parameters used in at-power PRA are not necessarily 

applicable during shutdown conditions. The staff will determine an appropriate definition 

and associated plant parameters for the core damage end state at LPSD conditions. 

To develop the LPSD success criteria, the staff will primarily rely on plant specific information 

provided by Vogtle and other available generic studies that may be applicable. If necessary and 

resources are available, the staff may use in-house or contractor support to perform thermal 

hydraulic calculations to develop and verify LPSD success criteria. 

The following table provides a list of items that need to be documented for this step. 

Table 14-5 Documentation Needs for Step 4 of Subtask 3-1.1 

Item Description

Success Criteria 

Analysis 

Document the success criteria for critical safety functions, 

supporting systems, structures, components, operator 

actions, and sequence end states.

Step 5 – Systems Analysis

The objectives of this step are: 

• To identify and quantify the causes of failure for each plant system represented in the 

model. 

The LPSD model will generally use the systems models that were developed for the Level 1 atpower model. The staff will review the system models to ensure that they are sufficient for LPSD 

conditions. Some modifications to the system models may be necessary, but these 

modifications are expected to be minor. 

The following table provides a list of items that need to be documented for this step. 

Table 14-6 Documentation Needs for Step 5 of Subtask 3-1.1 

Item Description

Systems Analysis The documentation will identify the system models used in 

the LPSD model and any modifications to the modeling 

needed for LPSD conditions. The Level 1 at-power model 

documentation will provide the detailed systems analysis 

documentation.
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-6 

Step 6 – Human Reliability Analysis

The objectives of this step are: 

• To ensure that the impacts of plant personnel actions are reflected in the assessment of 

risk for each POS. 

For the most part, the scope and assumptions for the overall LPSD PRA address the first two 

steps in the human reliability analysis (HRA) process described in Section 7. To support the 

LPSD model, the remaining seven HRA process steps identified in Section 7 will be performed. 

1. Qualitative analysis (i.e., information collection & interpretation, analysis to support 

quantification) 

2. Identification and definition of human failure events (HFEs) 

3. Quantification (both screening and detailed) 

4. Recovery analysis 

5. Dependence analysis 

6. Uncertainty analysis 

7. Documentation 

The staff will review Vogtle procedures and supporting calculations and information to support 

the HRA. Also, to the extent relevant, NRC’s HRA Good Practices report (NUREG-1792), 

NRC’s Evaluation of HRA Methods Against Good Practices (NUREG-1842), and other PRA 

guidance will be used. 

Other resources that are expected to be used include: 

• previously performed HRA/PRA LPSD studies (e.g., NUREG-6144 and -6145), 

• HRA research on human performance issues relevant to LPSD (e.g., 

NUREG/CR-6093, NUREG/CR-6265), 

• guidance on performing qualitative analysis (e.g., NUREG-1921, NUREG-1624, 

Rev. 1, NUREG-1880), and 

• guidance on identifying and defining human failure events (HFEs) (e.g., 

NUREG-1921, NUREG-1624, Rev. 1). 

Per guidance provided in NUREG-1842, the HRA quantification method(s) will be selected by 

finding the best match between the results of HRA qualitative analysis and characteristics of 

existing quantification methods developed for detailed HRA (as defined by the ASME/ANS PRA 

Standard). However, it is expected that the HRA quantification needs for LPSD will require 

additional development or extension of existing HRA methods to address LPSD-specific 

considerations. These include: developing a cut-off value for multiple HFEs, addressing weak 

dependencies between HFEs, and treating long time windows for actions to occur. If necessary 

and resources are available, the staff may use in-house and/or contractor support to perform 

HRA and/or perform thermal hydraulic calculations to develop the time windows for human 

actions to occur. 

The following table provides a list of items that need to be documented for this step. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-7 

Table 14-7 Documentation Needs for Step 6 of Subtask 3-1.1 

Item Description 

Human Reliability 

Analysis 

The steps of the HRA process including the results of 

quantified HFEs will be documented. 

Step 7 – Data Analysis 

The objective of this step is: 

• To provide estimates of the parameters used to determine probabilities of basic events 

in the model. 

The LPSD model will generally use the data analysis that was developed for the Level 1 atpower model. The staff will review the data analysis to ensure that it is sufficient for LPSD 

conditions. Some areas that may require special consideration include: 

• Estimating failure probabilities for failures on demand: It is expected that failures on 

demand will be modeled for some LPSD initiating events (e.g., overdrain events). These 

will be addressed in the initiating event analysis. 

• Unavailability due to test or maintenance (T&M): 

o For most SSCs represented in the LPSD model, the at-power models (fault trees, 

basic events) will be used. Unless there is sufficient justification to use a different 

unavailability value, then the at-power T&M unavailabilities will be used. 

o For equipment that is critical to LPSD safety functions (e.g., residual heat removal 

pumps, emergency diesel generators) the T&M unavailability will be reviewed to 

determine if an alternate value is needed. Test and maintenance records provided by 

Vogtle will be used to support this determination 

o If plant specific Technical Specifications allow for certain critical equipment to be 

unavailable in a POS, then that equipment may be assumed to be unavailable for the 

entire duration of the POS. For example, If Technical Specifications requires only 

one of two residual heat removal (RHR) trains to be available during Mode 6 

Refueling, then one RHR train can be assumed to be unavailable for the entire 

duration of the POS. Assumptions about equipment availability will be documented 

as part of the POS analysis (Step 1). 

• Most at-power PRA models do not credit the recovery of RHR pumps. Due to their 

importance to safety functions during LPSD operations, recovery of RHR pumps may be 

credited in the LPSD model. The staff will need to develop RHR pump recovery curves 

to support this analysis. 

The following table provides a list of items that need to be documented for this step. 

Table 14-8 Documentation Needs for Step 7 of Subtask 3-1.1 

Item Description 

Data Analysis Most of the data analysis will be taken directly from the Level 

1, at-power model. The report will document any areas that 

require special consideration for LPSD conditions. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-8 

Step 8 – Modeling and Quantification of LPSD Internal Event Scenarios 

The objectives of this step are: 

• To incorporate the LPSD accident scenarios into the SPAR model. 

• To quantify the results to estimate their contribution to core damage frequency. 

The LPSD scenarios are to be incorporated into the Level 1, at-power, internal events model. 

This task will include creating the event trees, fault trees, linking and post-processing rules, and 

basic events that are needed to model the scenarios. The INL staff will perform this work and 

ensure that the LPSD scenarios are consistent with the general SPAR modeling approach. A 

stable version of the Level 1, at-power, internal events model must be available to complete this 

step. The LPSD scenarios will depend on parts (e.g., event trees, fault trees, and basic events) 

of the at-power model. Any changes to the at-power model may impact the LPSD scenarios. 

The staff will review the LPSD SPAR model and results. 

The following table provides a list of items that need to be documented for this step. 

Table 14-9 Documentation Needs for Step 8 of Subtask 3-1.1 

Item Description 

LPSD Modeling 

Details 

The report will document the LPSD modeling details (e.g., 

linking and post-processing rules) that need to be captured 

after completing the model. 

Step 9 – Document the LPSD Analysis

The objectives of this step are: 

• To summarize the information that has been reviewed. 

• To document the modeling assumptions and analysis steps. 

• To report results and insights from the internal flood PRA. 

After completion of the LPSD PRA model, the staff will document the work that has been 

performed. The documentation will include a summary of all the information that the staff 

reviewed and assessed. The final documentation will incorporate all the information that was 

documented in the previous steps. 

The following table provides a list of items that need to be documented for this step. 

Table 14-10 Documentation Needs for Step 9 of Subtask 3-1.1 

Item Description 

Level 1 PRA for Low 

Power Shutdown and 

Internal Events Final 

Report 

The report will incorporate the work completed under the 

previous steps, including technical bases for all assumptions 

and decisions, and summarize the results and insights from 

the LPSD PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-9 

14.1.1.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 14.1.1.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products include both interim and final products. Table 14-11 provides, 

at a minimum, the expected products. 

Table 14-11 Expected Products for Subtask 3-1.1 

Product Description 

Steps 1 – 7: Define Scope and LPSD Analysis 

Level 1 PRA for Low 

Power, Shutdown 

and Internal Events 

Interim Report 

The report will define the scope of the LPSD internal events 

model and document modeling assumptions. The LPSD 

internal event scenarios will be defined in sufficient detail to 

allow INL to create the model in step 8. 

Step 8: Modeling and quantification of LPSD internal event scenarios 

LPSD Internal Events 

SPAR Model 

The LPSD internal event scenarios will be incorporated into 

the SPAR model. This will include all necessary event trees, 

fault trees, post-processing rules, etc. 

Step 9: Document the analysis 

Level 1 PRA for Low 

Power, Shutdown 

and Internal Events 

Final Report 

The report will incorporate the work completed under the 

previous steps and summarize the results and insights from 

the LPSD PRA. 

14.1.1.5 Task Interfaces

The various technical steps of the Internal Flood Analysis are dependent on other technical 

elements for information in order for the step to be completed. These interfaces are as follows: 

• Step 8 requires a final version of the internal events, at-power model which is a product 

of the Level 1 for At-Power and Internal Events Analysis. 

A final version of the Level 1 for At-Power and Internal Events SPAR model is needed before 

the LPSD scenarios can be incorporated into the model. Any changes to the at-power model 

may impact the LPSD scenarios. In order to efficiently complete this task, the at-power model 

should be stable and complete before the LPSD scenarios are incorporated into the model. 

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• Step 4 results in the LPSD SPAR model, which is information required by the Level 2 

Reactor PRA, Low Power Shutdown for Internal Events. 

The work on the Level 2 LPSD model will depend on having a completed Level 1 LPSD model. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-10 

14.1.1.6 References

A list of references that can and should be used in performing the work of the technical element 

is provided. 

1. NRC staff report “SPAR-SD Model Maker’s Guideline (MMG),” Revision 2.2, ADAMS 

Accession Number ML092160242. 

2. Draft ANSI/ANS-58.22-2012, “American National Standard Low power and Shutdown 

PRA Methodology.” 

3. EPRI Technical Report 1003113, “An Analysis of Loss of Decay Heat Removal Trends 

and Initiating Event Frequencies (1989-2000).” 

4. EPRI Technical Report 1021176, “An Analysis of Loss of Decay Heat Removal and Loss 

of Inventory Event Trends (1990-2009).” 

5. EPRI Technical Report 1003465, “Low Power and Shutdown Risk Assessment 

Benchmarking Study.” 

6. NUREG-1449, “Shutdown and Low-Power Operation at Commercial Nuclear Power 

Plants in the United States.” 

7. NUREG/CR-6143, “Evaluation of Potential Severe Accidents During Low Power and 

Shutdown Operations at Grand Gulf, Unit 1.” 

8. NUREG/CR-6144, “Evaluation of Potential Severe Accidents During Low Power and 

Shutdown Operations at Surry, Unit 1.” 

9. NUREG/CR-6928, “Industry-Average Performance for Components and Initiating Events 

at U.S. Commercial Nuclear Power Plants.” 

14.1.2 Subtask 3-1.2: Level 1 Reactor PRA for Low Power and Shutdown and 

Internal Floods

The LPSD Internal Flood Analysis consists of four interrelated steps: 

• Review the internal flood analysis for at-power conditions 

• Define the LPSD internal flood scenarios 

• Model the LPSD internal flood scenarios 

• Document the analysis 

The objective of the first step is to review the Internal Flood Analysis information that was used 

to develop the at-power internal flood SPAR model for this project and identify the internal flood 

scenarios that are applicable to LPSD conditions. The objective of the second step is to define 

the set of internal flood scenarios to be modeled in the internal flood LPSD SPAR model. The 

objective of the third step is to create the internal flood LPSD SPAR model. The objective of the 

fourth step is to summarize the information that has been reviewed and document the analysis. 

14.1.2.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The Vogtle site has performed a Level 1 PRA for at-power and internal floods. It is 

assumed that all internal flood technical elements have been addressed as part of this 

study. The staff does not anticipate that any new internal flood scenarios will need to be 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-11 

introduced to address LPSD conditions. The existing internal flood scenarios will be 

adjusted to address the plant configurations, equipment unavailabilities, and other 

unique flood response conditions that are applicable during LPSD operations. 

• To begin work on Step1 it is assumed that stable versions of the Level 1 PRA for AtPower and Internal Floods and Level 1 PRA for Low Power Shutdown and Internal 

Events will be available. The LPSD internal flood scenarios will depend on parts (e.g., 

event trees, fault trees, and basic events) of the aforementioned model scenarios. 

14.1.2.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Internal Flood Analysis are identified. This information (along with the 

identified products, Section 14.1.2.4) should allow an independent analyst to reproduce the 

various results. The information needed to perform each step, at a minimum, is listed below in 

Table 14-12. 

Table 14-12 Needed Inputs for Subtask 3-1.2 

Input Description 

Step 1: Review the Internal Flood Analysis 

Vogtle Internal Flood 

PRA documentation 

The complete documentation of the Vogtle Internal Flood 

PRA. This includes descriptions of the analyses for all 

Internal Flood PRA technical elements and any supplemental 

information that was gathered to develop the at-power 

internal floods SPAR model. 

Level 1 PRA for AtPower and Internal 

Floods SPAR Model 

A complete Level 1 PRA for At-Power and Internal Floods 

SPAR model must be available to begin work on this task. 

Level 1 PRA for Low 

Power Shutdown and 

Internal Events 

SPAR Model 

A complete Level 1 PRA for Low Power Shutdown and 

Internal Events SPAR model must be available to begin work 

on this task. 

14.1.2.3 Analysis Steps

LPSD Internal Flood Analysis consists of four interrelated steps: 

Step 1 – Review the Internal Flood Analysis 

The objectives of this step are: 

• To review the analysis done to support the at-power internal flood SPAR model. 

• To identify the internal flood scenarios that are applicable to LPSD conditions. 

The staff will review the analysis that was completed to develop the at-power internal flood 

SPAR model for this project. The Vogtle staff has completed an at-power internal flood PRA and 

addressed all the associated technical elements. This completed work is expected to be 

sufficient to identify internal flood scenarios that are applicable to LPSD conditions. The staff will 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-12 

identify the scenarios that are applicable to the LPSD POSs that are modeled in the LPSD 

internal events SPAR model. 

The following table provides a list of items that need to be documented for this step. 

Table 14-13 Documentation needs for Step 1 of Subtask 3-1.2 

Item Description 

Review At-Power 

Internal Floods 

Analysis 

Summary of internal flood scenarios that are applicable to the 

modeled LPSD POSs. 

Step 2 – Define the LPSD Internal Flood Scenarios

The objectives of this step are: 

• To define the set of internal flood scenarios to be modeled in the Level 1, low power 

shutdown SPAR model. 

After reviewing the at-power internal flood scenarios, the staff will define the internal flood 

scenarios to be modeled in the LPSD model. The staff will give special consideration to the 

unique LPSD operating conditions that can impact the plant response to internal flood events. 

Conditions requiring special consideration may include: 

• Temporary impairment of flood doors/barriers. 

• Maintenance-induced floods. 

• Disabling of automatic plant response. 

• Equipment unavailabilities. 

Internal flood scenarios will include relevant human failure events, following the general 

guidance provided in Section 7 and supplemented by additional resources and HRA guidance 

documents (e.g., NUREG/CR-6093, NUREG/CR-6265, NUREG-1921). 

The following table provides a list of items that need to be documented for this step. 

Table 14-14 Documentation Needs for Step 2 of Subtask 3-1.2 

Item Description 

LPSD Internal Flood 

Scenario Definitions 

Definition of the LPSD internal flood scenarios to be modeled 

in the SPAR model. 

Step 3 – Model the LPSD Internal Flood Scenarios

The objectives of this step are: 

• To incorporate the set of internal flood scenarios into the low power shutdown internal 

events SPAR model. 

The internal flood scenarios defined in Step 2 are to be incorporated into the Level 1, low power 

shutdown internal events SPAR model. This task will include creating the event trees, fault 

trees, linking and post-processing rules, and basic events that are needed to model the 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-13 

scenarios. The INL staff will perform this work and ensure that the internal flood scenarios are 

consistent with the general SPAR modeling approach. Stable versions of the Level 1, at-power, 

internal floods model and the Level 1, low power shutdown internal events model must be 

available to complete this step. 

The following table provides a list of items that need to be documented for this step. 

Table 14-15 Documentation Needs for Step 3 of Subtask 3-1.2 

Item Description 

Additional Modeling 

Details 

The LPSD internal flood scenarios will be documented in 

Step 2, but there may be additional modeling details (e.g., 

linking and post-processing rules) that need to be captured 

after completing the model. 

Step 4 – Document the LPSD Internal Flood Analysis

The objectives of this step are: 

• To summarize the information that has been reviewed. 

• To document the modeling assumptions and analysis steps. 

• To report results and insights from the internal flood PRA. 

After completion of the LPSD internal flood SPAR model, the staff will document the work that 

has been performed. The documentation will include a summary of all the information that the 

staff reviewed and assessed, descriptions of the LPSD internal flood scenarios that have been 

incorporated into the model, and discussion of the results and insights from the model. The final 

documentation will incorporate all the information that was documented in the previous steps. 

The following table provides a list of items that need to be documented for this step. 

Table 14-16 Documentation Needs for Step 4 of Subtask 3-1.2 

Item Description 

Level 1 PRA for Low 

Power, Shutdown 

and Internal Floods 

Final Report 

The report will incorporate the work completed under the 

previous steps and summarize the results and insights from 

the LPSD internal flood PRA. 

14.1.2.4 Documentation

The products produced as a result of the task are identified below. These products (along with 

the identified inputs, Section 14.1.2.2) should be sufficient such that it allows an independent 

analyst to understand how the analysis was performed and to reproduce the results. 

Consequently, the list of products include both interim and final products. Table 14-17 provides, 

at a minimum, the expected products. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-14 

Table 14-17 Expected Products for Subtask 3-1.2 

Product Description 

Step 1 and 2: Review, identify and define LPSD internal flood scenarios 

LPSD Internal Flood 

Scenarios Report 

The report will summarize internal flood scenarios that are 

applicable to LPSD conditions and define the model 

characteristics that are to be incorporated into the SPAR 

model. 

Step 3: Model the internal flood scenarios 

LPSD Internal Flood 

SPAR Model 

The internal flood scenarios will be incorporated into the 

SPAR model. This will include all necessary event trees, fault 

trees, post-processing rules, etc. 

Step 4: Document the analysis 

Level 1 PRA for Low 

Power Shutdown and 

Internal Floods Final 

Report 

The report will incorporate the work completed under the 

previous steps and summarize the results and insights from 

the LPSD internal flood PRA. 

14.1.2.5 Task Interfaces

The various technical steps of the Internal Flood Analysis are dependent on other technical 

elements for information in order for the step to be completed. These interfaces are as follows: 

• Step 1 requires stable versions of the Level 1 PRA for At-Power and Internal Floods and 

Level 1 PRA for Low Power Shutdown and Internal Events. 

The LPSD internal flood scenarios will depend on parts (e.g., event trees, fault trees, and basic 

events) of the aforementioned model scenarios. 

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• Step 3 results in the LPSD internal flood SPAR model which is information required by 

the Level 2 Reactor PRA, Low Power, Shutdown for Internal Floods. 

The work on the Level 2 LPSD internal floods model will depend on having a completed Level 1 

LPSD internal floods model. 

14.1.2.6 References

A list of references that can and should be used in performing the work of the technical element 

is provided. 

1. Vogtle documentation for Level 1 PRA for At-Power and Internal Floods. 

2. EPRI Report No. 1021086 “Pipe Rupture Frequencies for Internal Flooding PRAs, 

Revision 2.” 

3. NUREG/CR-6928 “Industry-Average Performance for Components and Initiating Events 

at U.S. Commercial Nuclear Power Plants.” 

4. NRC staff report “SPAR-SD Model Maker’s Guideline (MMG),” Revision 2.2, ADAMS 

Accession Number ML092160242. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-15 

5. Draft ANSI/ANS-58.22-2012, “American National Standard Low power and Shutdown 

PRA Methodology.” 

6. EPRI Technical Report 1003113, “An Analysis of Loss of Decay Heat Removal Trends 

and Initiating Event Frequencies (1989-2000).” 

7. EPRI Technical Report 1021176, “An Analysis of Loss of Decay Heat Removal and Loss 

of Inventory Event Trends (1990-2009).” 

8. EPRI Technical Report 1003465, “Low Power and Shutdown Risk Assessment 

Benchmarking Study.” 

9. NUREG-1449, “Shutdown and Low-Power Operation at Commercial Nuclear Power 

Plants in the United States.” 

10. NUREG/CR-6143, “Evaluation of Potential Severe Accidents During Low Power and 

Shutdown Operations at Grand Gulf, Unit 1.” 

11. NUREG/CR-6144, “Evaluation of Potential Severe Accidents During Low Power and 

Shutdown Operations at Surry, Unit 1.” 

12. NUREG/CR-6928, “Industry-Average Performance for Components and Initiating Events 

at U.S. Commercial Nuclear Power Plants.” 

14.1.3 Subtask 3-1.3: Level 1 Reactor PRA for Low Power and Shutdown and 

Internal Fires

[TO BE COMPLETED]

14.1.4 Subtask 3-1.4: Level 1 Reactor PRA for Low Power and Shutdown and 

Seismic Events, High Winds, and External Floods

[TO BE COMPLETED]

14.1.5 Subtask 3-1.5: Level 1 Reactor PRA for Low Power and Shutdown and

Other External Hazards

The Level 1 Reactor PRA analysis of other external hazards for low power and shutdown 

modes of operation is to be performed to estimate the risk from site-specific external hazards 

other than seismic hazards. This risk will be characterized by calculating the plant CDF (Level 1 

analysis), if possible; otherwise by a qualitative characterization will be performed. Parts 6 and 9 

of the March 2012, draft ANSI/ANS Low Power and Shutdown (LPSD) PRA standard provide 

technical requirements related to the performance of this subtask which largely reference back 

to the analogous technical requirements in Parts 6 and 9 of the ASME/ANS Level 1/LERF PRA 

standard. 

This analysis consists of the following three interrelated steps. 

• Review of plant specific hazard data and licensing bases 

The objective of this step is to become familiar with and asses the existing licensee 

analyses of other external hazards and any existing LPSD PRA model for the subject 

plant site. 

• Screening analyses 

The objective of this step is to determine whether a particular external hazard can be 

eliminated from further consideration in the SPAR Level 1 PRA model for the subject 

plant. This step consists of either qualitative or quantitative screening, or a combination 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-16 

of both. This analysis will conform to the March 2012, ANSI/ANS LPSD PRA standard 

technical elements for the screening of other external hazards (LEXT). 

• Modeling of unscreened external hazards 

The objective of this step is to model any unscreened external hazards from the previous 

step into the existing SPAR Level 1 PRA model for the subject plant. This modeling will 

conform to the March 2012, ANSI/ANS LPSD PRA standard technical elements for other 

external hazards analysis (LXHA), external hazards fragility analysis (LXFR), and 

external hazard plant response modeling (LXPR). 

14.1.5.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The analysis may be qualitative, quantitative, or a combination of each, as is warranted 

by the site-specific hazard characteristics. It is assumed that the external hazards under 

consideration will consist of the external hazards listed in Appendix 6-A of the 

ASME/ANS RA-Sa-2009 PRA standard, as referenced in the March 2012, ANSI/ANS 

LPSD PRA standard. 

• The level of detail of modeling and analysis will be in accordance with the limited 

resources allocated to this task. See below for resource estimates. 

• It is assumed that documentation for plant systems etc. have already been obtained 

from the licensee and are available and for review and use as reference. 

• It is assumed that a carefully selected vendor who is competent and has experience in 

this area will be available; with previous experience for creating similar models with 

limited resources. 

• It is assumed that the low power and shutdown Level 1 reactor PRA for internal hazards 

has been completed or is nearly complete and that this subtask will be performed in 

parallel with the at-power Level 1 reactor PRA for other external hazards. 

14.1.5.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of the Level 1 low power and shutdown reactor PRA for other external hazards 

analysis are identified. This information (along with the identified products, Section 14.1.4.4) 

should allow an independent analyst to reproduce the various results. The information needed 

to perform each step, at a minimum, is listed below in Table 14-18. 

Table 14-18 Needed Inputs for Subtask 3-1.5 

Input Description 

Step 1: Review of plant specific external hazard data and licensing bases 

Plant design information This input may consist of the subject plant FSAR, engineering 

drawings, Operating License, etc. This information will be 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-17 

Table 14-18 Needed Inputs for Subtask 3-1.5 

Input Description 

needed to starting this step. 

Licensee PRA information Licensee PRA documentation, peer review findings, , the 

licensee’s Level 1 LPSD PRA model for other external hazards, if 

available, etc.. This information will be needed prior to starting 

this step. 

Step 2: Screening analysis 

Plant walkdowns Plant walkdowns may be performed after the screening analyses 

are complete, as needed, to assess the validity of the 

assumptions used in the qualitative and quantitative screening 

analyses. Depending on whether an external hazard is screened 

qualitatively or quantitatively, these walkdowns may include 

locations both inside buildings and around the site. Walkdowns 

may. 

Step 3: Modeling of unscreened external hazards 

Plant walkdowns Plant walkdowns may be performed at an appropriate time 

during the modeling of unscreened external hazards, as needed, 

to assess the validity of the assumptions used in the external 

hazard analysis, fragility evaluation, and plant response model 

development. Depending on whether an external hazard is 

screened qualitatively or quantitatively, these walkdowns may 

include locations both inside buildings and around the site. 

14.1.5.3 Analysis Steps

The Level 1, low power and shutdown reactor PRA for other external hazards analysis consists 

of three interrelated steps: 

1. Review of plant specific external hazard data and licensing bases 

2. Screening Analysis 

3. Modeling of unscreened external hazards 

Step 1 – Review of Plant Specific External Hazard Data and Licensing Bases 

The objective of this step is to become familiar with and asses the existing licensee analyses 

with regard to other external hazards and the existing Level 1 PRA model for the subject plant 

site. 

The review of the subject plant licensing bases and plant specific external hazard data is 

performed for general familiarization of the plant site and documenting all previous other 

external hazards analyses. This step includes reviewing licensee PRA documentation as well 

as for the identification of any significant changes since the operating license (OL) issuance 

relative to (1) military and industrial facilities within 5 miles of the site, (2) onsite storage or other 

activities involving hazardous materials, (3) transportation, or (4) developments that could affect 

the original design conditions. Documentation should include descriptions of significant 

changes at the subject plant site since the issuance of the OL as well as a list of those analyses 

already performed with regard to other external hazards. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-18 

Table 14-19 Documentation Needs for Step 1 of Subtask 3-1.5 

Item Description 

Significant changes to OL 

since issuance 

For a given change to the OL, this documentation should provide 

a detailed description of the change and why the change was 

implemented. 

Step 2 – Screening Analysis

The objective of this step is to screen out those external hazards which cannot or do not 

significantly impact site risk and are therefore eligible to be excluded from further consideration 

in the PRA. 

The screening analysis starts with a review of the list of external hazards requiring consideration 

in Appendix 6-A of the ASME/ANS Level 1/LERF PRA standard, as referenced in the March 

2012, draft ANSI/ANS LPSD PRA standard. A progressive screening approach will be used 

wherein a qualitative screening is performed first followed by a quantitative screening to 

determine if any external hazards other than seismic hazards can be removed from further 

consideration. The basis for screening any external hazard may be confirmed through a 

walkdown of the plant and its surroundings, as needed. Any inconsistencies between the plant 

walkdowns and the screening analyses assumptions for a given external hazard should be 

incorporated and the screening analysis should be redone accordingly. 

Documentation of these analyses will be performed in a manner that facilitates PRA 

applications, upgrades, and peer review. The process used to screen each external hazard 

should be documented so as to describe the approach used for screening, the screening criteria 

used for each screened external hazard, and any engineering or other analyses performed to 

support a bounding or demonstrably conservative analysis for screening out an external hazard. 

Documentation should be consistent with the supporting requirements in the March 2012, draft 

ANSI/ANS LPSD PRA standard. 

Table 14-20 Documentation Needs for Step 2 of Subtask 3-1.5 

Item Description 

Qualitative Screening 

Analysis 

An initial qualitative screening is performed to determine if any of 

the external hazards from the Appendix 6-A list meet any one of 

the five screening criteria in supporting requirement EXT-B1 of 

the ASME/ANS Level 1/LERF PRA standard, as referenced in 

the LEXT technical element in the March 2012, draft ANSI/ANS 

LPSD PRA standard. A second preliminary screening is 

performed on the remaining external hazards to determine if the 

plant’s design basis for the event meets the NRC 1975 Standard 

Review Plan. Documentation should be consistent with HLRLEXT-E of the March 2012, draft ANSI/ANS LPSD PRA 

standard. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-19 

Table 14-20 Documentation Needs for Step 2 of Subtask 3-1.5 

Item Description 

Quantitative Screening 

Analysis 

A bounding or demonstrably conservative analysis is performed 

using defined quantitative screening criteria to demonstrate that 

an external hazard can be removed from further consideration, 

as per HLR-EXT-C in the ASME/ANS PRA Level 1/LERF 

standard which is referenced in the LEXT technical element of 

the March 2012, draft ANSI/ANS LPSD PRA standard. 

Documentation should be consistent with HLR-LEXT-E of the 

March 2012, draft ANSI/ANS LPSD PRA standard. 

Confirmatory Plant 

Walkdown Findings 

Confirmatory plant walkdowns may be performed, as needed, to 

determine the validity of the assumptions used in a given 

screening analysis, as per HLR-EXT-D in the ASME/ANS Level 

1/LERF PRA standard which is referenced in the LEXT technical 

element of the March 2012, draft ANSI/ANS LPSD PRA 

standard. Documentation should be consistent with HLR-LEXTE of the March 2012, draft ANSI/ANS LPSD PRA standard. 

Step 3 – Modeling of Unscreened External Hazards

The objective of this step is to incorporate models for any unscreened external hazards into the 

Level 1 reactor PRA for low power and shutdown operation. 

In general, the following activities are performed for a given external hazard that was not 

screened out in Step 2: an external hazard analysis; an external hazard fragility evaluation; and 

development of an external hazard plant response model. The external hazard analysis 

involves the evaluation of the frequency of occurrence of different intensities of the external 

hazard based on a site-specific probabilistic evaluation reflecting recent available data and sitespecific information. The external hazard fragility evaluation involves the evaluation of the 

fragilities of the structures, systems, or components as a function of the intensity of the external 

hazard using plant-specific, SSC-specific information and an accepted engineering method for 

evaluating the postulated failure. The development of the external hazard plant response model 

involves the development of a plant response model that addresses the initiating events and 

other failures resulting from the effects of the external hazard that can lead to core damage or 

large early release. The model is based on the internal events, LPSD PRA model to incorporate 

those aspects that are different—as a result of the external hazard’s effects—from the 

corresponding aspects of the LPSD, internal events model. 

The specific analyses performed during this step will be directly dependent on the specific 

external hazards were not screened out from further consideration in Step 2. Table 14-21 

discusses the documentation needs for this step of the subtask. 

Table 14-21 Documentation Needs for Step 3 of Subtask 3-1.5 

Item Description 

External Hazard Analysis The analysis and documentation of the external hazard analysis 

shall be consistent with the supporting requirements in the 

LXHA technical element in the March 2012, draft ANSI/ANS 

LPSD PRA standard. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-20 

Table 14-21 Documentation Needs for Step 3 of Subtask 3-1.5 

Item Description 

External Hazard Fragility 

Evaluation 

The analysis and documentation of the external hazard fragility 

evaluation shall be consistent with the supporting requirements 

in the XFR technical element in the March 2012, draft 

ANSI/ANS LPSD PRA standard. 

External Hazard Plant 

Response Model 

The development and documentation of the external hazard 

plant response model shall be consistent with the supporting 

requirements in the XPR technical element in the March 2012, 

draft ANSI/ANS LPSD PRA standard. 

14.1.4.4 Documentation

The products produced as a result of the subtask are identified below. These products (along 

with the identified inputs, Section 14.1.5.2) should allow an independent analyst to understand 

how the analysis was performed and to reproduce the results. Consequently, the list of 

products includes both interim and final products. Table 14-22 provides, at a minimum, the 

expected products. 

Table 14-22 Expected Products for Subtask 3-1.5 

Product Description 

Step 1: Review of plant specific hazard data and licensing bases 

Site Documentation 

Review (Final Product) 

The report summarizes the results of the site documentation 

review including a catalog of any changes to the operating 

license post-issuance and a general synopsis of the licensee’s 

analyses of other external hazards. 

Step 2: Screening analyses 

Screening Analysis 

Report (Final product) 

This report details the qualitative and quantitative screening 

analyses of external hazards listed in Appendix 6-A of the 

ASME/ANS Level 1/LERF PRA standard and will be consistent 

with the supporting requirements in Part 6 of the March 2012, 

draft ANSI/ANS LPSD PRA standard. 

Step 3: Modeling of unscreened external hazards 

Other External Hazards , 

Fragility, and Plant 

Response Analysis 

Report (Final Product) 

This report details the analysis of the unscreened external 

hazards, the plant fragility analysis, and the plant response 

analysis. This report is to be consistent with the 

documentation supporting requirements of high level 

requirement LXHA, LXFR, and LXPR, respectively, in Part 9 of 

the March 2012, draft ANSI/ANS LPSD PRA standard. 

14.1.5.5 Task Interfaces

The various technical steps of the low power and shutdown, Level 1 reactor PRA for other 

external hazards are dependent on other technical elements for information in order for the step 

to be completed. These interfaces are as follows: 

• Step 3 requires that the at-power Level 1 reactor PRA model for internal hazards be 

nearly complete, if not fully complete. This is considered to be a significant interface. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-21 

Various tasks from other technical elements are dependent on products from this technical 

element. These interfaces are as follows: 

• The completion of the at-power, Level 1 reactor PRA for internal and external hazards is 

dependent on the completion of this subtask 

14.1.5.6 References

1. ANSI/ANS-58.22-2012 [Draft], “American National Standard Low Power and Shutdown 

PRA Methodology,” ANS, La Grange Park, IL, March 2012. 

2. ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power Plant Applications,” Addendum A to 

RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, 

February 2009. 

3. NUREG-1407, “Procedural and Submittal Guidance for the Individual Plant Examination 

of External Events (IPEEE) for Severe Accident Vulnerabilities,” U. S. Nuclear 

Regulatory Commission, Washington, DC, June 1991. 

4. NUREG-1855 Revision 1 Draft, “Guidance on the Treatment of Uncertainties Associated 

with PRAs in Risk-Informed Decisionmaking,” U. S. Nuclear Regulatory Commission, 

Washington, DC, May 2012. 

14.2 Task 3-2: Level 2 Reactor PRA, Low Power and Shutdown for All 

Hazards

The purpose of this section is to describe the relationship between the reactor Level 2 PRA atpower internal hazards and the reactor Level 2 PRA at-low-power and shutdown for internal and 

external hazards. A detailed technical approach plan for the reactor Level 2 PRA at-low-power 

and shutdown for internal and external hazards will be developed later. 

Assumptions: 

• All (applicable) assumptions for the at-power internal hazards Level 2 PRA apply here. 

• The inclusion of other modes will not represent a step increase in the amount of effort in 

Level 2 space (i.e., other modes are an add-on to the at-power internal hazards model). 

Analysis Steps: 

Table 14-23 below shows how the analysis steps from the at-power internal hazards Level 2 

PRA map to those of the at-low-power and shutdown for internal and external hazards Level 2 

PRA: 

Table 14-23 Level 2 Internal Hazards Map to Level 2 External Hazards 

Technical 

Element 

(Subtask) 

Analysis Step External Hazards Analogy 

Level 1/2 

PRA 

Interface – 

Accident 

Step 1 – Development of extended Level 

1 event trees 

Extension of new event tress need to 

be developed, and others checked 

for continued applicability 

Step 2 – Development of plant damage New PDS need to be developed, and 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-22 

Table 14-23 Level 2 Internal Hazards Map to Level 2 External Hazards 

Technical 

Element 

(Subtask) 

Analysis Step External Hazards Analogy 

Sequence 

Grouping 

state binning others checked for continued 

applicability 

Step 3 – Review the resulting plant 

damage states to ensure dependencies 

and other information have been 

adequately transferred 

Analogous 

Step 4 – Iteration on the Level 1 PRA 

modeling as necessary 

Analogous 

Step 5 – Criteria for, and selection of, 

representative sequences 

New representative sequences need 

to be developed, and others checked 

for continued applicability 

Containment 

Capacity 

Analysis 

Step 1 – Assess preliminary failure 

modes and locations of interest 

Perform containment isolation at 

shutdown analysis. 

Step 2 – Development of a finite element 

model of the containment 

N/A 

Step 3 – Development of containment 

fragilities associated with severe accident 

conditions 

N/A 

Step 4 – Application of engineering 

information to assess structural 

responses to severe accident conditions 

in the auxiliary building 

N/A 

Severe 

Accident 

Progression 

Analysis 

Step 1 – SCALE analysis for decay heat 

and radionuclide inventory parameters 

SCALE analysis for decay heat 

levels for various times following 

reactor shutdown. 

Step 2 – Development of a plant-specific 

MELCOR model 

Revise MELCOR model to address 

unique shutdown considerations 

(e.g., cold component volumes, 

different PORV operation, different 

leak paths, etc.) 

Step 3 – Accident progression modeling 

for the representative Level 2 sequences 

MELCOR analysis to address new, 

or revised, representative 

sequences/event tree modeling. 

Step 4 – Phenomenological evaluations 

for split fraction assignment and logic 

model construction 

MELCOR analysis to support 

changes to the Level 2 logic model 

(support trees/split fractions). 

Step 5 – Evaluation of the impact of postcore damage recovery actions MELCOR analysis to address new, 

or revised, sequences 

Step 6 – Evaluation of equipment 

survivability 

N/A (no new analysis needed) 

Probabilistic 

Treatment of 

Accident 

Progression 

and Source 

Terms 

Step 1 – Data analysis for 

components/systems not considered in 

the Level 1 PRA 

N/A (no new analysis needed) 

Step 2 – Construction of accident 

progression event trees 

Modification to existing APET(s) as 

necessary. 

Step 3 – Development of support trees Create any new (or make necessary 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-23 

Table 14-23 Level 2 Internal Hazards Map to Level 2 External Hazards 

Technical 

Element 

(Subtask) 

Analysis Step External Hazards Analogy 

modifications to existing) support 

trees. 

Step 4 – Human reliability model 

development 

Addressed in separate section. 

Step 5 – Human reliability analysis Addressed in separate section. 

Step 6 – Level 2 model quantification Analogous 

Step 7 – Uncertainty characterization. Analogous 

Radiological 

Source 

Term 

Analysis 

Step 1 – Definition of the release 

category binning logic 

Inspect to make sure existing binning 

logic holds. 

Step 2 – Development of source terms 

for the various release categories 

Analogous 

Step 3 – Consideration of uncertainties in 

the source term development 

Analogous 

Evaluation 

and 

Presentation 

of Results 

Step 1 – Consolidation of the interim 

Level 2 PRA model documentation 

Analogous 

Step 2 – Consolidation of the final Level 

2 PRA model documentation 

Analogous 

Level 2/3 

PRA 

Interface 

Step 1 – Consolidation of the release 

category information in a format 

conducive for use by the Level 3 PRA 

analysts 

Analogous 

14.3 Task 3-3: Level 3 Reactor PRA, Low Power and Shutdown for All 

Hazards

[TO BE COMPLETED] 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-1 

15. Technical Approach for Spent Fuel Pool PRA 

15.1 Task 4-1: Level 1/2 Spent Fuel Pool PRA

The Spent Fuel Pool (SFP) Level 1/2 PRA analysis (which includes quantification of release 

frequency and characterization of source terms) consists of eight interrelated subtasks. These 

subtasks along with their objectives are discussed below. 

• Subtask 4-1.1: Initiating event (IE) analysis – The objectives of this subtask are to 

compile generic IEs that have been identified in past studies and IEs that are unique to 

this site, and to develop their frequencies. Other objectives are to define a finite set of 

operating cycle phases (OCPs) by discretizing the phases between the refueling cycle, 

and focusing on hazards that are judged to have higher risk significance and greater 

likelihood to cause the selected IEs. 

• Subtask 4-1.2: Structural analysis – The objective of this subtask is to develop a finite 

element model for the SFP to enable the evaluation of impacts on the SFP resulting from 

structural challenges on the SFP such as seismic events, cask drops, aircraft crash, and 

missiles. 

• Subtask 4-1.3: Accident sequence analysis – The objective of this subtask is to develop 

Level 1 event trees capturing system performance and key operator actions through the 

point of anticipated fuel damage, followed by the development of Level 2 accident 

progression event trees, including the characterization of radionuclide releases to the 

environment. 

• Subtask 4-1.4: Systems analysis – The objective of this subtask is to develop models 

that can be used to estimate the failure probabilities for the SFP mitigation systems and 

associated strategies. 

• Subtask 4-1.5: Human reliability analysis – The objective of this subtask is to estimate 

the human error probabilities for evaluating the SFP accident frequencies. 

• Subtask 4-1.6: Accident progression and success criteria – The objective of this subtask 

is to delineate accident sequences, and to determine the minimum required equipment, 

their capacity, operator actions, and sequence timing associated with each mitigation 

strategy. In addition, it performs the required severe accident progression analyses to 

support the development and quantification of the accident progression event trees. This 

includes the evaluation and confirmation of the binning of accident sequences into 

appropriate radiological release bins for use in the Level 3 analysis, and the estimation 

of release characteristics (e.g. radionuclide source terms and associated 

characteristics). 

• Subtask 4-1.7: Quantification – The objective of this subtask is to integrate and quantify 

the results from the SFP PRA and to estimate the frequency of fuel damage, the 

frequency of release categories, the source terms associated with each release category 

and their associated characteristics. Another objective of this subtask is to provide 

sufficient information to the Level 3 PRA module to perform the final quantification of the 

various risk metrics. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-2 

• Subtask 4-1.8: Uncertainty analysis – The objective of this subtask is to characterize 

sources of uncertainties and quantify their impact on the risk measures estimated in 

Subtask 4-1.7. 

The technical approach for each of the subtasks is described in this section. These discussions 

rely on a number of past PRA studies since currently a standard for performance of a SFP PRA 

is not available. 

The scope and boundary of the SFP PRA are defined below. 

The demarcation point between the reactor and SFP PRAs will be the physical boundary 

between the containment and the fuel handling building (i.e., starting at the point where the fuel 

enters into the fuel transfer tube during refueling). The demarcation point between the SFP and 

dry cask storage portions is the regulatory boundary between 10 CFR 50, “Domestic Licensing 

of Production and Utilization Facilities,” activities and 10 CFR Part 72, “Licensing Requirements 

for the Independent Storage of Spent Nuclear Fuel, High-Level Radioactive Waste, and 

Reactor-Related Greater than Class C Waste,” activities (e.g., fuel movement within the pool 

belongs to the SFP PRA while fuel movement during cask loading belongs to the independent 

spent fuel storage installation (ISFSI) PRA). There could be special events outside the defined 

boundaries that have to be modeled in the SFP PRA. For instance a loss-of-coolant accident 

(LOCA) in the reactor during refueling and a cask drop event modeled in the ISFSI PRA are 

also potential initiating events for the SFP PRA. These situations will have to be addressed on a 

case-by-case basis. 

There are major differences between the Vogtle Unit 1 and Unit 2 spent fuel pools.18 Currently, 

the staff plans to study the Unit 2 SFP (because of its larger inventory of fuel), and to the extent 

possible, the Unit 1 SFP will be addressed via model duplication and modification. That said, 

the 2 SFPs are hydraulically connected at times, and may needed to be treated in concert for 

certain initiating events or operating cycle phases. 

The potential for inadvertent criticality due to geometry changes associated with a seismic 

event, or due to reflooding of the pool after rack materials have relocated, will not be explicitly 

addressed. Rather, any specific simulations that lead to combinations of conditions where 

inadvertent criticality would be more likely to occur would be highlighted for potential future 

analysis. The Office of Nuclear Reactor Regulation has ongoing work with the Center for 

Nuclear Waste Regulatory Applications which will help to corroborate or challenge this 

simplifying assumption. 

As with the reactor PRA, the SFP PRA does not cover postulated accidents related to security 

issues such as sabotage or acts of war. 

15.1.1 Subtask 4-1.1: Initiating Event Analysis

The Initiating Event Analysis consists of four steps: 

• Literature search and external hazard frequencies 

• Screening, grouping and hazard discretization 

 

18 While details of the current pool configurations are still being acquired, we currently understand that the Unit 2 SFP uses highdensity racks and has both a greater capacity and actual inventory than the Unit 1 SFP (which uses lower-density racks). We 

further understand that fuel from the Unit 1 SFP is routinely moved to the Unit 2 SFP after some cooling. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-3 

• Initiating event analysis 

• Operating cycle discretization 

The objective of the first step is to compile initiating events that have been identified in the past 

studies, identify any initiating events that are unique to this site, and to migrate and apply the 

external event frequencies from the reactor PRA. The second step aims to screen the events 

so that effort may be focused on the risk-significant events and to group/discretize the hazards 

(e.g., divide the seismic hazard into four seismic initiating event bins). The objective of the third 

step is to develop the initiating event frequencies resulting from both internal and external 

hazards by adjusting the frequencies estimated for the reactor PRA as necessary to cover the 

differences between SFPs and the reactors (e.g., a flooding initiating event frequency could be 

different due to differing elevations of key equipment.) The fourth step will discretize the reactor 

operating cycle in to a finite set of operating cycle phases (OCPs), akin to the plant operating 

states in the shutdown PRA. 

15.1.1.1 Assumptions and Limitations

• A representative operating cycle will be defined, based on recent plant-specific operating 

cycle characteristics. The operating cycle will be discretized into quasi-steady operating 

cycle phases (OCPs), akin to the plant operating states used in reactor shutdown 

analysis. It is expected that at least 2 OCPs during the outage period and at least 2 

during the post-outage period will be defined, to allow sufficient resolution of fuel 

handling operations and changes in decay heat. The actual number of OCPs to 

sufficiently cover the major risk contributors will be decided during the PRA evaluation. 

• Some hazards will likely screen out during the outage, and many will likely screen out 

during non-outage portions of the operating cycle (due to the lower heat loads and 

therefore longer accident progression timelines). 

• External hazards will be the same as those identified for the reactor PRA, unless there is 

reason to believe that a hazard screened out of the reactor PRA should be re-assessed 

for the SFP (e.g., aircraft crash). 

• Low-likelihood events that are fault-tree intensive but unlikely to be contributors to risk 

(e.g., loss of SFP cooling due to random failures of its support systems during a time 

with low pool decay heat) will be screened out. 

• Generic information (or information from other plants) will be utilized and documented for 

cases when plant-specific information is not available. For example, generic 

descriptions/procedures (or descriptions/procedures for another plant) for conduct of 

operations for cask loading, given the site does not have an ISFSI at this time, may be 

utilized. 

15.1.1.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of initiating event analysis are identified. The information needed to perform 

each step is listed in Table 15-1. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-4 

Table 15-1 Required Inputs for Subtask 4-1.1 

Input Description 

Design • Original structural design documents for the pool, the 

racks, the fuel transfer canal, and the fuel handling 

building. 

• Description of SFP cooling systems and the associated 

support systems. 

Operational 

(Procedures) 

• Configuration and loading procedures for SFP at each 

unit. 

• Conduct of operations descriptions/procedures for cask 

loading (if they exist, given the site does not have an 

ISFSI). 

• Enunciator response, off-normal, and special event 

procedures that are relevant for the SFP Refueling 

procedures. 

Maintenance • Maintenance and Technical Specifications associated 

with SFP systems and instrumentations. 

Engineering(1) • Treatment of internal and external hazards and their 

associated initiating events from the reactor PRA. 

• Any Safety analyses that can support SFP PRA tasks 

related to identification, screening, or binning of initiating 

events. 

Note (1) – Full or partial Licensee PRA analysis is included as a part of engineering input. 

15.1.1.3 Analysis Steps

Initiating Event Analysis consists of the following interrelated steps: 

• Literature search and external hazard frequencies. 

• Screening, grouping and hazard discretization. 

• Initiating event analysis. 

• Operating cycle discretization. 

The objective of the first step is to compile initiating events that have been identified in past 

studies, identify any initiating events that are unique to this site, and to migrate and apply the 

external event frequencies from the reactor PRA. The second step aims to screen the events so 

that the effort may be focused on the risk-significant events and to group/discretize the hazards 

(e.g., divide the seismic hazard in to a set of seismic initiating event bins). The objective of the 

third step is to develop the initiating event frequencies resulting from both internal and external 

hazards by adjusting the frequencies estimated for the reactor PRA as necessary in order to 

cover the differences between SFPs and the reactors (e.g., a flooding initiating event frequency 

could be different due to differing elevations of key equipment.) The fourth step will discretize 

the reactor operating cycle in to a finite set of operating cycle phases, akin to the plant operating 

states in the shutdown PRA. 

Step 1 – Literature Search and External Hazard Frequencies 

Significant research has been done related to the risks from spent fuel pools (e.g., NUREG1353 [1], NUREG-1738 [2], and NUREG/CR-6451 [3]). A literature review will serve to draw 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-5 

upon this information to identify potential hazards and to calculate their frequency. External 

hazard screening from the reactor PRA will be reviewed to identify if there are any external 

hazard groups that were screened out of the reactor PRA that should be included in the SFP 

PRA. 

Step 2 – Screening, Grouping and Hazard Discretization 

Many of the initiating events may be screened as not likely to be risk-significant based on a 

variety of criteria. When possible, the screening will follow the same process, and use the same 

criteria used for the reactor PRA. Additional SFP-specific screening criteria (e.g., boil off time) 

will be identified at a later time during the study. Events will be grouped to the extent possible 

such that the grouping preserves important details for the subsequent analysis. Other events, 

such as seismic events, may need to be separated into bins. Seismic binning will follow the 

same approach used for the reactor PRA. 

Step 3 – Initiating Event Analysis 

The SFP initiating event frequencies resulting from both internal and external hazards that are 

considered for the reactor PRA will be utilized and adjusted as necessary. Review of generic 

and plant-specific operating experience along with previous PRA studies will be performed to 

develop a list of initiating events that are not already addressed by the reactor PRA (e.g., SFP 

cooling, aircraft crash, etc.) and that are “screened-in.” Note that this step and the screening 

step are somewhat iterative. 

Step 4 – Operating Cycle Discretization 

The time since the last core offload has a significant impact on decay heat level, which in turn 

affects the boil-off duration and fuel behavior following uncovery. In addition, various plant 

activities result in changes in the number of assemblies that are in the SFP. This necessitates 

dividing the operating cycle so that calculations and logic modeling may be done using a single 

decay heat and assembly population for each phase. For reference, a recent plant-specific 

consequence analysis for a BWR (the NRC’s Spent Fuel Pool Scoping Study19) discretized a 

23-month operating cycle into five phases (two during the outage and three for the remainder of 

the operating cycle). 

15.1.1.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to 

various analysis steps and they are identified in Table 15-2. The documentation (along with the 

identified inputs described in Section 15.1.1.2) are succinct and transparent in enabling an 

independent quality assurance (QA) and peer review. 

 

19 This project was discussed during a public meeting of the Advisory Committee on Reactor Safeguards on April 12, 2012, e.g., 

see page 80 of 242 of http://pbadupws.nrc.gov/docs/ML1211/ML12115A094.pdf.
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-6 

Table 15-2 Documentation Needs for Initiating Event Analysis of Subtask 4-1.1 

Description 

• List of IEs will be compiled based on the results of the literature review and the review of 

the reactor screening analysis. 

• A table listing the initiating events as well as which events were screened and for what 

reason. 

• Development of initiating event frequencies for both internal and external hazards. 

• Description of the operating cycles and discussion of their technical bases. 

15.1.1.5 Task Interfaces

The interfaces for various technical steps of the Initiating Event Analysis subtask with other PRA 

tasks/steps are as follows: 

• Steps 2 and 3 require information from the reactor internal and external hazards PRA 

and the associated screening analysis. 

• The results of Steps 1 through 4 are required for other technical elements of the SFP 

PRA (e.g., quantification). 

15.1.1.6 References

1. NUREG-1353, “Regulatory Analysis for the Resolution of Generic Issue 82 Beyond 

Design Basis Accidents in Spent Fuel Pools,” April 1989. 

2. NUREG-1738, “Technical Study of Spent Fuel Pool Accident Risk at decommissioning 

Nuclear Power Plants,” February 2001. 

3. NUREG/CR-6451, “A Safety and regulatory Assessment of Generic BWR and PWR 

Permanently Shutdown Nuclear Power Plants,” August 1997. 

4. NUREG-1774, “A Survey of crane Operating Experience at U.S. Nuclear Power Plants 

from 1968 through 2002,” June 2003. 

15.1.2 Subtask 4-1.2: Structural Analysis

The Structural Analysis consists of the following steps: 

• Development of a finite element model. 

• Assessment of available information for the Vogtle plant and other plants of similar 

construction to identify the preliminary failure modes and locations of interest. 

• Performance of finite element analysis. 

• Perform structural assessments of other SSCs. 

The objective of the first step is to develop a finite element model for the SFP so that the effect 

of various hazards on the SFP such as seismic events and cask drops can be evaluated. The 

objective of the second step is to assess available information for the Vogtle plant and other 

plants of similar construction to identify the preliminary failure modes and locations of interest. 

The objective of the third step is to use the model to perform analyses to determine the effect of 

these events on the pool, and to serve as boundary conditions for the accident progression 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-7 

analysis. The objective of the fourth step is to perform structural assessments for other 

systems, components, and structures (SSCs) of interest (e.g., seismic effects on the fuel 

handling building, effects of missiles on the SFP liner, etc). 

15.1.2.1 Assumptions and Limitations

• To the extent possible, the fragilities for SSCs that are used in the reactor PRA and are 

also relevant to SFP PRA or accident mitigation, will be directly used. 

• To the extent possible, the hazard characterizations developed in the reactor PRA but 

applicable to the site will be directly used. 

15.1.2.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of structural analysis are identified. The information needed to perform the 

structural analysis step, at a minimum, is listed in Table 15-3. 

Table 15-3 Required Inputs for Subtask 4-1.2 

Input Description 

Design • Original structural design documents for the pools, the racks, the 

fuel transfer canal, and the fuel handling building 

• Detailed drawings of SFP penetrations, including geometry 

information such as cell to cell pitch and orifice sizes at the bottom 

of each cell 

Operational 

(Procedures) 

• None 

Maintenance • None 

Engineering(1) • Fuel handling building structural analysis as a part of seismic PRA 

when it becomes available. 

• Analysis and characterization of various hazards in the reactor 

PRA that are applicable to the site. 

• A description of other safety analyses or supporting PRA 

calculations that were performed along with their results. 

Note (1) – Supporting calculations performed by the Licensee for their PRA are included as a part of engineering input. 

15.1.2.3 Analysis Steps

The details of the structural analysis steps listed earlier are discussed below. 

Step 1 – Development of a Finite Element Model 

A finite element model will be developed to perform structural calculations for the SFP. This 

nonlinear finite element model may be developed in LSDYNA, and will include sufficient detail of 

the pool structures, transfer canals, and fuel handling building to predict the overall structural 

response. Separate effect models may be developed (1) to study the effects of a cask drop 

event, and (2) to predict detailed stress concentrations in areas where the global model predicts 

potential failure. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-8 

Step 2 – Assess Available Information for The Vogtle Plant and Other Plants of Similar 

Construction to Identify The Preliminary Failure Modes and Locations of Interest 

The Licensee’s models and analyses for structural evaluation of SFP and related systems will 

be reviewed and assessed in order to determine what additional analyses may have to be 

performed independently in support of the SFP PRA. In additional Licensee’s structural 

analysis in support of a seismic PRA will also be reviewed and assessed for their relevance to 

the SFP PRA. Coordination with the Licensee for timely access to these materials will play an 

important role in SFP PRA since the peer reviewed seismic PRA may not be available until June 

of 2014. 

Step 3 – Finite Element Analysis 

This analysis will include challenges to the integrity of the SFP, primarily from seismic events 

and cask drops. Specifically, the output will be whether and where a leak develops, as well as 

an estimate of the leak size. 

Step 4 – Other Structural Assessments 

Structural assessments will also be performed for the fuel (from seismic events and missiles), 

the fuel handling building (from all external hazards), hydrogen events, and structural effects 

from internal flooding. Phenomena such as soil liquefaction will be considered. These 

assessments will be based on past study results, engineering judgment, and/or analytical 

calculations. 

15.1.2.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to its 

analysis steps and they are identified in Table 15-4. The documentation (along with the 

identified inputs described in Section 15.1.2.2) are succinct and transparent in enabling an 

independent QA and peer review. 

Table 15-4 Documentation Needs for Structural Analysis – Subtask 4-1.2 

Description 

• A finite element model for the SFP along with supporting documentation. 

• Description of the case runs along with their results. 

• A distillation of the results in a form usable by the accident progression and 

success criteria analysis (e.g., effective leak rate as a function of water height, with 

associated location; pressure at which the fuel handling building is expected to 

structurally fail with associated location). 

15.1.2.5 Task Interfaces

The interfaces for various technical steps of the Structural Analysis subtask with other PRA 

tasks/steps are as follows: 

• Steps 1 and 3 in structural analysis are dependent on the Initiating Event Analysis of the 

SFP PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-9 

• Reactor seismic PRA supporting structural analysis can support SFP structural analysis. 

15.1.2.6 References

None. 

15.1.3 Subtask 4-1.3: Accident Sequence Analysis

The accident sequence analysis consists of the following two steps: 

• “Level 1” Event Trees 

• “Level 2” Event Trees 

The objective of the first step is to develop event trees capturing system performance, key 

uncertainties in structural boundary conditions, and key operator actions through the point of 

significant fuel uncovery (e.g., water level at the fuel mid-height) and anticipated fuel damage. 

The objective of the second step is to develop the SFP-equivalent of Level 2 PRA accident 

progression event trees, covering additional mitigative equipment performance, additional 

operator actions, and key phenomena in characterizing the various release categories/bins, 

their likelihoods, and associated attributes that can be used for risk quantification 

(Subtask 4-1.7). 

15.1.3.1 Assumptions and Limitations

The treatment of offsite recovery credit will be the same as in the reactor task. Longer duration 

offsite power recovery beyond those typically encountered during reactor PRA may be 

considered. 

15.1.3.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of accident sequence analysis are identified. The information needed to 

perform accident sequence analysis step, at a minimum, are listed in Table 15-5. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-10 

Table 15-5 Required Inputs for Subtask 4-1.3 

Input Description 

Design • Description of mitigation systems and strategies, and 

information from the site visit by SFP team early in the 

project 

Operational 

(Procedures) 

• Configuration and loading patterns for the SFP at each unit 

• Conduct of operations descriptions/procedures for cask 

loading (if they exist, given the site does not have an ISFSI) 

• Core monitoring reports and nuclear design reports for last 3 

cycles 

• Enunciator response, off-normal, and special event 

procedures that are relevant for the SFP Refueling 

procedures 

• EDMGs (same as Level 2 reactor PRA) 

• SAMGs if they have been modified by that point to include 

SFP considerations (would also be the same as the Level 2 

reactor PRA) 

Maintenance • None 

Engineering(1) • TracWorks® output 

• A description of other safety analyses or supporting PRA 

calculations that were performed along with their results. 

Note (1) Supporting calculations performed by the Licensee for their PRA is included as a part of engineering 

input. 

15.1.3.3 Analysis Steps

The details of the accident sequence analysis steps are discussed below. 

Step 1 – “Level 1” Event Trees 

Event trees covering sequences analogous to a reactor “Level 1” PRA. It is intended that an 

end state similar to “core damage” will be defined, likely with a set of conditions where fuel 

damage is anticipated (or even imminent), e.g., water level at 1⁄2 fuel height. Human actions for 

Level 1 event tree models are explicitly identified and described to facilitate the performance of 

the human reliability analysis task. 

Step 2 – Develop “Level 2” Event Trees 

The starting point for the Level 2 event trees is assumed to be the surrogate end-state condition 

for fuel damage defined in Level 1 event trees. Level 2 event trees cover system responses and 

operator actions including recovery actions taken in response to and after the surrogate 

condition of fuel damage has been reached. These human actions for Level 2 event tree models 

are explicitly identified and described to facilitate the performance of the human reliability 

analysis task. The quantification of the phenomenological processes associated with SFP 

accidents are performed using MELCOR, together with other supporting analyses to arrive at 

the required split fractions for the event tree model. This will also consider various 

dependencies and mitigation actions. Furthermore, it will be necessary to adapt, as necessary, 

the binning logic developed in the reactor Level 2 PRA in order to bin the SFP Level 2 event 

tree end-states in to a small number (i.e., less than a dozen) release categories. Note that 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-11 

binning from a recent consequence analysis (the aforementioned NRC SFP Scoping Study) 

found that binning on warning time was not necessary for that analysis (because all releases 

occurred after effective evacuation could be commenced), and rather, binned based on 3 bins 

each of iodine and cesium cumulative release magnitude. The Level 2 event trees utilize 

MELCOR results for accident progression to bin the accident sequences and provide estimates 

of the release fractions and timings. 

15.1.3.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to its 

analysis steps, and they are identified in Table 15-6. The documentation (along with the 

identified inputs described in Section 15.1.3.2) are succinct and transparent in enabling an 

independent QA and peer review. 

Table 15-6 Documentation Needs for Accident Sequence Analysis – Subtask 4-1.3 

Description 

• Individual “Level 1” and “Level 2” event tree notebooks each describing the 

models, the definition of event tree branches, treatment of human actions 

(e.g., for modeling and off-normal procedure actions and EDMG actions20), 

and recovery actions that will be developed on SAPHIRE8. 

• Compilation of the event tree end-states, accident sequence mission time, 

success criteria, and other assumptions for accident progression. 

• The technical basis for quantification of branch probabilities associated with 

the accident progression event tree model. 

15.1.3.5 Task Interfaces

The interfaces for various technical steps of the Accident Sequence Analysis subtask with other 

PRA tasks/steps are as follows: 

• Step 1 requires substantive completion of the Initiating Event Analysis and the Structural 

Analysis. 

• Steps 1 and 2 must be performed iteratively with the various steps of the Systems 

Analysis, Human Reliability Analysis, and the Accident Progression and Success Criteria 

Analysis. 

15.1.3.6 References

None. 

 

20 It is recognized that SFPs are not currently covered in the EOPs or SAMGs.
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-12 

15.1.4 Subtask 4-1.4: Systems Analysis 

The Systems Analysis consists of two steps: 

1. Data/probabilities for SFP-specific basic events 

2. Fault Tree analysis 

The objective of the first step is to compile the reliability data (e.g. failure probability, 

unavailability, CCF, etc.) for various basic events for the system fault trees with their associated 

uncertainties. The objective of the second step is to develop models that can be used to 

estimate the failure probabilities for the SFP mitigation systems and associated strategies. 

15.1.4.1 Assumptions and Limitations

• Plant specific data will be used to the extent available for system analysis. Special 

attention will be given to estimating the plant specific unavailability of systems and 

components resulting from the operational practices (configuration control and 

maintenance unavailability). 

• Failure probabilities and fragilities for SFP systems during various hazards are obtained 

from reactor PRA, generic studies (e.g., NUREG-1774 for crane failures [1]), and 

NRC/EPRI published generic sources for reliability data, common cause failures, and 

failure of passive components (e.g., pipes). 

• Low-likelihood events that are fault-tree intensive but unlikely to be contributors to risk 

(e.g., loss of SFP cooling due to support system failure without further complication) will 

be screened out. 

15.1.4.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of system s analysis are identified. The information needed to perform the 

systems analysis step, at a minimum, are listed in Table 15-7. 

Table 15-7 Required Inputs for Subtask 4-1.4 

Input Description 

Design • Description of mitigation systems and strategies, and 

information compiled from the site visit by SFP team 

early in the project 

Operational 

(Procedures) 

• Enunciator response, off-normal, and special event 

procedures that are relevant for the SFP Refueling 

procedures 

• EDMG systems and strategies (same as Level 2 

reactor PRA) 

• SAMGs; systems and strategies especially if they 

have been modified by that point to include SFP 

considerations (would also be same as Level 2 

reactor PRA) 

Maintenance • Maintenance and Technical Specifications including 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-13 

Table 15-7 Required Inputs for Subtask 4-1.4 

Input Description 

configuration control practices associated with SFP 

systems and instrumentations 

Engineering(1) • A description of other safety analyses or supporting 

PRA calculations that were performed along with 

their results 

• Any licensee-generated data for SFP-related 

component reliability 

Note (1) – Note (1) Supporting calculations performed by the Licensee for their PRA is included as 

a part of engineering input. 

15.1.4.3 Analysis Steps

This section discusses the details of the systems analysis steps. 

Step 1 – Data/Probabilities for SFP Specific Basic Events 

This task is performed similarly to those for the reactor PRA, as in Section 12.1.1.6, for data 

analysis. Basic event data for SFP-specific events will be developed, to include the use of any 

available data sources for same or similar equipment, arriving at basic event characteristics 

(mean probabilities, distributions, common-cause failure grouping). 

Step 2 – Fault Tree Analysis 

This task is performed following the guidance provided under the cross-cutting section PRA 

element on system analysis in Section 5. The failure probability of key safety systems will be 

modeled using fault trees. The level of detail (sub-component versus component versus trainlevel) may vary so that available resources are focused on risk-significant events. Human errors 

modeled in the fault tree are explicitly identified and described to facilitate the performance of 

the human reliability analysis task. 

15.1.4.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to its 

analysis steps and they are identified in Table 15-8. The documentation (along with the 

identified inputs described in Section 15.1.4.2) are succinct and transparent in enabling an 

independent QA and peer review. 

Table 15-8 Documentation Needs for System Analysis – Subtask 4-1.4 

Description 

• Individual system notebooks containing similar information to that discussed in 

Section 5 for the cross-cutting element for system analysis. 

• Compilation of all the reliability data and fragilities, and identification of their 

sources. 

• Description of all human errors identified in the fault trees. 

• A report documenting the systems analysis and the related SAPHIRE input and 

output. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-14 

15.1.4.5 Task Interfaces

The interfaces for various technical steps of the Systems Analysis subtask with other PRA 

tasks/steps are as follows: 

• Step 1 interfaces with reactor PRA tasks for reliability data and fragility information. 

• Step 2 must be performed iteratively with the Accident Sequence Analysis, Human 

Reliability Analysis, and Accident Progression and Success Criteria Analysis for SFP. 

15.1.4.6 References

1. NUREG-1774, “A Survey of Crane Operating Experience at U.S. Nuclear Power Plants 

from 1968 through 2002,” June 2003. 

15.1.5 Subtask 4-1.5: Human Reliability Analysis

Section 7 describes the human reliability analysis (HRA) task, in general. Because of the lack 

of previous HRAs for spent fuel pool, HRA guidance for other PRA types will be used and 

extended as appropriate. In particular, due to the treatment of operator actions outside the main 

control room, the staff are expected to use guidance provided in NUREG-1921, EPRI/NRC-RES 

Fire Human Reliability Analysis Guidelines. 

15.1.6 Subtask 4-1.6: Accident Progression and Success Criteria Analysis

The Accident Progression Analysis consists of four steps: 

1. SCALE analysis for decay heat and radionuclide inventories 

2. MELCOR model development 

3. MELCOR accident progression and success criteria analysis 

4. Equipment survivability 

The objective of the first step is to produce the decay heat levels and the radionuclide 

inventories (i.e., masses) used by MELCOR. The objective of the second and third steps is to 

develop the success criteria, effectiveness of the mitigation strategies, the associated timing for 

human actions, severe accident loads and conditions, and characterization of radiological 

releases to the environment. The objective of the fourth step is to address the performance of 

components in harsh environments (e.g., high temperatures, effects of a hydrogen combustion 

event). 

15.1.6.1 Assumptions and Limitations

• It is assumed that the lessons learned from the US-led OECD-NEA PWR spent fuel pool 

testing program (e.g., nodalization issues, oxidation behavior, radial radiative heat 

transfer, etc.) will have been incorporated into the relevant MELCOR physical models as 

appropriate, and that other lessons learned (e.g., hydraulic flow resistance coefficients) 

can be readily incorporated into the MELCOR input model. 

• It is assumed that the existing capabilities of MELCOR, once the above modifications 

are realized, will be sufficient for SFP PRA support. Some examples where this 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-15 

assumption may be challenged include (i) simultaneous modeling of the reactor and 

spent fuel pool during movement of fuel to the SFP, (ii) simultaneous release and 

transport of radionuclides from two sources (i.e., reactor and SFP) (if the atmosphere of 

containment and the refueling building are connected [e.g., following water boil-off with 

the refueling transfer canal open]), (iii) modeling of core concrete interaction for spent 

fuel pool accidents, and (iv) mixing and ignition criteria for combustible gases. 

15.1.6.2 Inputs

The design, engineering, maintenance, and operational information required in order to perform 

the associated steps of the SFP PRA analysis are identified. The information needed to 

perform the various subtasks is listed Table 15-9. 

Table 15-9 Required Inputs for Subtask 4-1.6 

Input Description 

Design(1) • Detailed drawings of SFP penetrations, including geometry 

information such as cell to cell pitch and orifice sizes at the 

bottom of each cell 

• Site visits by SFP team during the middle of the project to fill 

information gaps 

Operational 

(Procedures) 

• Configuration and loading procedures for SFP at each unit 

• Core monitoring reports and nuclear design reports for last 3 

cycles 

• Nuclear Design Reports (NDRs) for current and previous two 

operating cycles 

Maintenance • Maintenance and Technical Specifications associated with SFP 

systems and instrumentations 

Engineering(2) • TracWorks® output for the current SFP loading 

• Typical SFP temperatures during different portions of the 

operating cycle 

• Radionuclide inventory and decay heat estimates for SFP 

(SCALE) 

• A description of other safety analyses or supporting PRA 

calculations that were performed along with their results 

• Any licensee-generated data for SFP-related component 

reliability 

Note (1) – Much of the above information can also be found in the supporting modeling tools used by the licensee, 

e.g. TracWorks®

. 

Note (2) – Supporting calculations performed by the licensee for their PRA is included as a part of the engineering 

input. 

15.1.6.3 Analysis Steps

The details of the accident progression and success criteria steps are discussed below. 

Step 1 – SCALE Analysis for Decay Heat and Radionuclide Inventories 

The irradiation history and decay of each assembly in the pool will be explicitly modeled using 

the ORIGEN code (part of the SCALE code system). The SCALE analysis will produce the 

decay heat levels and radionuclide mass inventories that are used by MELCOR. The licensee’s 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-16 

input will be used (after a review) to the extent possible for cases where similar calculations had 

been performed by the licensee. The results from this step will allow the grouping of the 

assemblies into the multiple fuel “rings” (as guided by the results of the MELCOR analyses 

performed for other SFP studies) that will be used in the MELCOR model. 

Step 2 – MELCOR Model Development 

A simplified and detailed MELCOR model are needed to calculate the progression of events in 

the SFP, whether system and human responses taken can avoid or mitigate releases, and what 

the associated source terms for the Level 3 analysis are. The simplified model (using a 

volumetric heat generation rate to represent the fuel) will be used for producing success criteria 

for the “Level 1” portion of the analysis. This model will also be used to handle earlier stages of 

accident scenarios when the Unit 2 SFP is hydraulically connected to the Unit 2 reactor or the 

Unit 1 SFP. Input provided from the licensee will be used to develop the MELCOR input files. In 

some cases, alternative analytically-based calculations can be used to arrive at success criteria 

and timing information needed for the Level 1 PRA. 

Step 3 – MELCOR Calculations 

Simplified MELCOR runs will be performed with the main focus on developing the success 

criteria, effectiveness of the mitigation strategies, and the associated timing for human actions. 

More detailed MELCOR analysis will be performed to support the accident progression event 

tree quantification process, and to arrive at the magnitude and timing of the radionuclide 

releases and other relevant information for Level 3 PRA. 

Step 4 – Equipment Survivability 

In a SFP event, safety equipment may be challenged by humidity, hydrogen, heat, flooding, etc. 

The conditions under which this equipment is no longer able to fulfill its function will be 

assessed. 

15.1.6.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to its 

analysis steps and they are identified in Table 15-10. The documentation (along with the 

identified inputs described in Section 15.1.6.2) are succinct and transparent in enabling an 

independent QA and peer review. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-17 

Table 15-10 Documentation Needs for Accident Progression and Success Criteria 

Subtask 4-1.6 

Description 

• Results from SCALE calculations for decay heat and radionuclide inventory. 

• A simplified and detailed MELCOR model (including documentation) to analyze SFP 

events. 

• Documentation for a set of MELCOR calculations and their results, to form the basis of 

success criteria, event progression, and source terms. 

• Equipment survivability determination and related documentation of an analysis of the 

survivability of equipment under potential adverse conditions (e.g., high humidity) for SFP 

events. 

• A description of the SCALE and MELCOR results, as well as the equipment survivability 

analysis, to be included in the final report.

15.1.6.5 Task Interfaces

The interfaces for various technical steps of the Accident Progression and Success Criteria 

Analysis subtask with other PRA tasks/steps are as follows: 

• It interfaces with human reliability analysis by providing the timing available for operator 

actions and successful recovery actions. 

• It interfaces with system analysis subtask by providing the required information on 

success criteria. 

• It interfaces with accident sequences analysis by providing the information on the 

effectiveness of the various strategies and the mission time associated with achieving a 

successful end state. 

• It interfaces with the level 3 PRA by producing the fraction of the radionuclide inventories 

that will be releases, and the timing associated with plumes. 

15.1.6.6 References

None. 

15.1.7 Subtask 4-1.7: Quantification

The quantification subtask consists of the following two steps: 

1. Model integration 

2. Model quantification 

The objective of the first step is to integrate and examine for appropriateness the Level 1 

accident sequences for the surrogate criteria for fuel damage, and level 2 end states for the set 

of defined release categories. The objective of the second step is to quantify the occurrence 

frequency of the fuel damage and each of the release categories for each of the OCPs such that 

the dominant contributors can be identified. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-18 

15.1.7.1 Assumptions and Limitations

• The same quantification routine for the reactor PRA as implemented in SAPHIRE 8 is 

assumed adequate for performing this subtask. 

• The issue of quantifying large failure probabilities in the model will be dealt with in the 

same manner as in the reactor tasks. 

15.1.7.2 Inputs

No input is needed for this subtask when there is no licensee PRA conducted for the SFP (see 

Table 15-11). For cases when there is an independent licensee’s PRA, comparison of the 

results, identification of the major differences, and determination of reason behind the 

differences would become necessary. 

Table 15-11 Required Inputs for Subtask 4-1.7 

Input Description 

Design • None 

Operational (Procedures) • None 

Maintenance • None 

Engineering • A site visit during model quantification to review 

major assumptions and inputs. 

• Summary results and insights from the past 

studies. 

15.1.7.3 Analysis Steps

The quantification subtask consists of the following two interrelated steps: 

1. Model integration 

2. Model quantification 

Step 1 – Model Integration 

This step follows the ASME standard for reactor PRA. The fault trees, Level 1 event trees, and 

Level 2 accident progression trees are linked as a part of this subtask. In addition to common 

cause failures, all other dependencies such as those due to design (system dependencies), 

basic event probabilities/split fractions (correlations), human action dependencies, and 

dependencies caused by specific sequences of accidents are modeled and examined to make 

sure they accurately reflect the model assumptions. A sample of Level 1 accident sequence 

minimal cutsets and the associated Level 2 accident progression path sets are generated and 

examined to make sure they are consistent with the modeling assumptions. 

Step 2 – Model Quantification 

Quantify the event tree and fault tree models to produce importance measures, fuel damage 

frequency, and release category frequencies. This step follows the ASME standard for reactor 

PRA and will address issues such as selection of the truncation limit, treatment of large 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-19 

probabilities, estimation of mean values, and others. The results of quantification will also be 

examined based on their underlying assumptions and with comparison to results from previous 

studies. 

15.1.7.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to its 

analysis steps and they are identified below in Table 15-12. These documents considered to be 

sufficient for the following objectives: 

• Allow an independent analyst to understand how the analyses were performed. 

• Facilitate modifications as necessary to maintain an up-to-date PRA model. 

• Provide all the information needed for and any other potential peer reviews. 

Table 15-12 Documentation Needs for Quantification and Model Integration – Subtask 4-1.7 

Description 

• Compile dominant accident sequences for fuel damage, describe the accident 

progression, and provide the basis and the assumptions behind them. 

• Compile dominant accident sequences for the release categories, describe the 

accident progression, and provide the basis and the assumptions behind them. 

• Document the characterization of the release categories; release fractions for 

various radionuclide groups, timing of releases, occurrence frequency, and the 

plume characteristics for Level 3 analysis. 

• The PRA results of the model will be in the final report. These results will include 

importance measures, fuel damage frequency and release category frequency. 

• Compile the major difference and similarities between this study and previous 

studies. 

15.1.7.5 Task Interfaces

The interfaces for various technical steps of the quantification technical element are as follows: 

• Steps 1 and 2 require completion of all preceding steps within the SFP Level 1/2 PRA. 

15.1.7.6 References

None. 

15.1.8 Subtask 4-1.8: Uncertainty Analysis

Uncertainty consists of two steps: 

1. Identify sources of uncertainty 

2. Characterize sources of uncertainty 

The objective of the first step is to compile the sources of uncertainties and the assumptions 

made in each of the subtasks for the SFP PRA. The objective of the second step is to 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-20 

characterize sources of uncertainties and their impact on the risk values estimated in the 

quantification task. 

15.1.8.1 Assumptions and Limitations

• The uncertainties will be identified and characterized in the same manner and to the 

same extent as in the reactor PRA. 

15.1.8.2 Inputs

None anticipated at this time. 

15.1.8.3 Analysis Steps

Uncertainty analysis consists of the following two interrelated steps: 

1. Identify sources of uncertainty 

2. Characterize sources of uncertainty 

Step 1 – Identify Sources of Uncertainties 

Major sources of uncertainties and assumptions in each of the analysis step for all the subtasks 

in the SFP PRA will be identified. The description for each source of uncertainties or 

assumptions will be compiled along with possible means to address them (through propagation, 

sensitivity analysis, or expert judgment). 

Step 2 – Characterize Sources of Uncertainties 

To the extent possible, the various sources of logic model (sequence frequency) uncertainties 

will be propagated through the Level 1 event tree model, and possibly, the Level 2 model as 

well (depending on what the reactor tasks do). When the uncertainties cannot be quantitatively 

addressed, sensitivity analysis will be used to characterize them. Uncertainties in the 

deterministic models will be identified, and their effect will be addressed either qualitatively 

through expert judgment or via sensitivity analysis. 

15.1.8.4 Documentation

The documents generated and compiled from this cross-cutting PRA element correspond to its 

analysis steps and they are identified below in Table 15-13. The documentations are succinct 

and transparent in enabling an independent QA and peer review. 

Table 15-13 Documentation Needs for Uncertainty Analysis – Subtask 4-1.8 

Description 

• Compile sources of uncertainties from all elements of the SFP PRA and identify 

how they are accounted for in the PRA: quantitative uncertainty evaluation, 

sensitivity studies, expert judgment, or study assumptions. 

• Document the impact and importance of various uncertainty sources. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-21 

15.1.8.5 Task Interfaces

This task interfaces with all subtasks for identifying the sources of uncertainties. 

15.1.8.6 References

None. 

15.2 Task 4-2: Level 3 Spent Fuel Pool PRA

[TO BE COMPLETED] 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-1 

16. Technical Approach for Dry Cask Storage PRA 

This section describes the technical approach for the various analytical tasks of Task 5, 

Quantification of the Dry Cask Storage [DCS] PRA. Task 5 is divided into two parts: 

1. Task 5-1: Dry Cask Storage PRA for Cask Damage (Release Frequency) 

2. Task 5-2: Dry Cask Storage PRA for Health Effects (Consequence Analysis) 

Task 5-1 describes the technical elements to determine the frequencies associated with 

potential radiological releases. Task 5-2 describes technical elements to determine the 

consequences associated with the released radioactive material to the environment. 

Two previous analyses are significant sources of information for this task. 

1. EPRI’s DCS study, “Probabilistic Risk Assessment (PRA) of Bolted Storage Casks: 

Updated Quantification and Analysis,” Technical Report No. 1009691 published in 2004 

[1]. This study focused on the use of Transnuclear (TN) dry cask storage system 

(DCSS) in a PWR setting. 

2. The NRC’s DCS study, “A Pilot Probabilistic Risk Assessment of a Dry Cask Storage 

System at a Nuclear Power Plant,” NUREG-1864 published in 2007 [2]. This study 

focused on use of the Holtec International Storage and Transfer Operation Reinforced 

Module (HI-STORM) 100 DCSS in a BWR with Mark I setting. 

Two important subtleties need to be recognized about dry cask storage operations (DCSOs). 

First, the specific handling operations depend on the design of the dry cask storage system 

(DCSS). Some DCSS designs use a directly loaded, bolted-closure storage cask to provide 

confinement, shielding, and thermal protection. This storage cask can be placed directly on the 

independent spent fuel storage installation (ISFSI) pad; an example of this type of stand-alone 

bolted cask design is the Transnuclear (TN)-40 metal cask (Figure 16-1). Second, other DCSS 

designs use the canister as the confinement boundary and use a separate structure to provide 

shielding and thermal protection. In these DCSS designs, the loaded canister must be 

transferred by a transfer cask to the storage structure/container. An example for this type of 

design is the HI-STORM 100 storage cask shown in Figures 16-2 and 16-3. 

16.1 Task 5-1: Dry Cask Storage PRA for Cask Damage (Release 

Frequency)

This task is divided into the following seven subtasks, comprised of seven technical elements: 

1. Subtask 5-1.1: Dry cask description and operational phases 

2. Subtask 5-1.2: Initiating event analysis 

3. Subtask 5-1.3: Data analysis 

4. Subtask 5-1.4: Human reliability analysis 

5. Subtask 5-1.5: Success criteria (structural and thermal analysis) 

6. Subtask 5-1.6: Accident sequence analysis and quantification 

7. Subtask 5-1.7: Uncertainty analysis 

Figure 16-1 shows the interfaces for all subtasks in the DCS PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-2 

Figure 16-1 Series of Transnuclear (TN)-40 Casks at an Independent Spent Fuel Storage 

Installation 

Figure 16-2 Components of the Holtec International HI-STORM 100 Cask Storage System 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-3 

Figure 16-3 Holtec International HI-STORM 100 Cask Storage System with Multipurpose 

Canister (MPC) Partially Inserted and Diagram of Features 

Figure 16-4 Interfaces of Dry Cask Storage PRA 

16.1.1 Subtask 5-1.1: Dry Cask Description and Operational Phases

Initiati

ng

Data 

Analys

Accident 

Sequence

HRA

Uncertaint

y Analysis

Success Criteria 

(Structural and

Radionucl

ide

Consequenc

e Analysis

DCS Description 

and Operational 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-4 

The first step in performing DCS PRA is familiarization with the type and design of the DCS and 

its operational phases in loading and transferring the spent fuel from the spent fuel pool to the 

ISFSI storage pad. During this effort, the analysts become familiar with the specific design, 

procedures, and operational aspects of the DCS operation. As a result, the analysis will reflect 

the actual design and procedures in determining what could go wrong, how could it be 

prevented, and what the consequences would be. Vogtle has selected [XXXXXXXXXXXXXX] 

for storing the spent fuel. 

16.1.1.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• Vogtle will use [XXXXXXXX] for dry storage. 

16.1.1.2 Inputs

The design, maintenance and operational information required in order to perform the 

associated steps of Systems Analysis are identified in Table 16-1. 

Table 16-1 Required Inputs for Subtask 5-1.1 

Input Description 

Design • The design of the DCS, along with design characteristics as they 

relate to the required fuel decay heat and cooling time, cask 

transfer, cask storage, etc. 

Maintenance • Procedures for performing periodic inspections and maintenance 

Operational 

(procedures) 

• Procedures for fuel loading, cask rigging, cask drying, cask 

transport and cask installation 

Engineering • Plant layout 

• Cask movement flow path through fuel and auxiliary buildings, 

and the buildings structural strength in case of a cask drop 

• Potential drop heights, potential obstructions, etc. 

16.1.1.3 Analysis Steps

The objective of this subtask is to become familiar with the DCS and it operational requirements. 

This includes obtaining information related to the dry cask storage system, the processes used 

in loading, transferring and storing the dry cask, and other design details needed to identify what 

events could potentially affect the system. The cask system selected for storing Vogtle spent 

fuel is the [XXXXXXXX]. This cask system consists of three major components, including a 

[XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX]. The dry cask 

storage operation (DCSO) is generally divided into the three phases of handling/loading, 

transfer, and storage. During the handling/loading phase, spent fuel assemblies are placed into 

the [XXXXXXXXXXX]. [XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX], 

and transported to the independent spent fuel storage installation (ISFSI) storage pad. The 

various DCSO activities identify site-specific procedures and cask movement flow paths with 

potential heights at which the heavy load is being moved. This information will then be used in 

other subtasks. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-5 

16.1.1.4 Documentation

Document the DCS functions, applicable procedures and the cask movement path including 

human actions and potential cask height above the floor at each step of cask movement. 

Table 16-2 provides details of documentation needs. The documentation (along with the 

identified inputs described in Section 16.1.1.2) is succinct and transparent in enabling an 

independent quality assurance (QA) and peer review. 

Table 16-2 Subtask 5-1.1 Documentation 

Description 

• Cask design and loading process detail sufficient to identify initiating events and 

support subsequent analyses 

• Potential drop height at each step of cask movement 

• Human actions and potential dependencies 

16.1.1.5 Task Interfaces

The output of this subtask will become part of the input to Subtasks 5-1.2, “Initiating Event 

Analysis,” 5-1.4 “Human Reliability Analysis,” and 5-1.5 “Success Criteria: Structural and 

Thermal Hydraulic Analysis,” see Figure 16-4. 

16.1.2 Subtask 5-1.2: Initiating Event Analysis

The objective of initiating event analysis is to identify those events that can present a hazard to 

the cask and potentially result in a release of radionuclides to the environment. The initiating 

event analysis considers the range of potential hazards including those generated during DCSO 

as well as naturally occurring hazards (e.g., seismic). 

The Initiating event analysis consists of the following three interrelated steps: 

1. Literature Search 

2. Hazard Identification Process 

3. Screening and Grouping 

16.1.2.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• Internal and external hazards affecting the [XXXXXXXXXX] cask at the Vogtle site will 

be considered. 

• The scope of the study begins when fuel assemblies begin to be loaded into the cask 

and ends with the cask being stored at the ISFSI. 

• Other potential phases of cask operation such as unloading or transportation offsite will 

not be considered. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-6 

• The cask system is assumed to be fabricated as designed. Areas where flaws normally 

exist and can be well characterized, such as weld flaws, will be considered. 

• Aging and corrosion effects will not be considered except when caused by an error in the 

process of loading the cask. 

• Intentional sabotage is outside the scope of this study. 

16.1.2.2 Inputs

The information required to perform the associated steps are identified in Table 16-3. This 

information is succinct and transparent in enabling an independent QA and peer review. 

Table 16-3 Required Inputs for Subtask 5-1.2 

Input Description 

Initiating events from 

previous DCS PRA 

Previous DCS PRAs, such as EPRI TR- 1009691 [1] and 

NUREG–1864 [2], are reviewed to identify a list of generic 

initiating events

NRC NUREG and 

Regulatory issue 

summaries on load 

drops and crane 

failures 

Documents to provide incidents involving crane and load 

drops such as control of heavy load in NUREG–0612 [3], 

Generic Issue (GI) 186 “Potential Risk and Consequences of 

Heavy Load Drops in Nuclear Power Plants,” [4], and related 

regulatory issue summaries 

DCS final safety 

analysis and relevant 

procedures 

Information on the DCS design specifications, limitations, and 

associated procedures for the DCS operations and fuel 

movements 

16.1.2.3 Analysis Steps

Initiating event analysis consists of three interrelated steps: 

1. Literature Search 

2. Hazard Identification Process 

3. Screening and Grouping 

The process to identify initiating events is similar to that used in the internal at-power Level 1 

PRA. However, the goal here is to identify those hazards that affect the DCS instead of the 

reactor units. Nevertheless, similar discussions and guidelines as provided in the ASME/ANS 

RA-Sa-2009 PRA standard for internal events at-power are also applicable to DCS PRA. 

Step 1 – Literature Search 

The objective of literature search is to compile initiating events for dry casks that have been 

identified in the literature. Table 16-3 lists several sources of information. The DCSO related 

initiators are identified through a systematic evaluation of the entire dry cask storage process, 

from fuel handling events (e.g., during cask loading), the transport events (e.g., during cask 

transfer), and the on-site storage events (during cask storage and monitoring). The evaluation 

considers possible deviations from normal processing that might occur at each step of the 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-7 

DCSO activities. Causes of deviations include equipment failures, human errors, natural 

phenomena, and other applicable hazards. 

The most prevalent event in DCSO is a possibility of load drop during movement, due to 

equipment failure or human error. Reference [1] lists 31 possible initiating events for DCSO 

related activities and 36 events resulting from external hazards (e.g., seismic, high wind, flood, 

etc). Reference [2] lists a total of 51 events from all hazards and DCSO-related activities. 

Step 2 – Hazard Identification Process 

The objective of the step is to perform a formal hazard identification process such as a HAZOP 

or a Master Logic Diagram (MLD) to ensure that as many initiating events as possible have 

been identified. The MLD is in the form of fault tree. The MLD fault tree produces events or 

combination of events that could lead to initiation of release. The MLD fault tree considers 

events that could create conditions where the cask shielding or structural material 

characteristics are exceeded, leading to releases of radioactivity or increase in radiological 

consequences. Figure 16-5 shows a typical high level MLD fault tree for spent fuel cask 

operation [1]. 

Step 3 – Screening and Grouping 

The objective of the third step is to screen events that could not affect the cask system, and to 

group the events that have similar mitigation requirements, in order to simplify the subsequent 

analysis. Each identified initiating events needs to be characterized in terms of its effect on the 

[XXXX] or its storage cask. The screening of initiating events will be limited to those hazards 

that do not lead to failure of the [XXXX] or its cask, or are within the scope of analysis. For 

example, an operator error leading to a fuel assembly drop in the spent fuel pool is not 

considered an initiating event for the DCS PRA, because such an event will be considered as 

part of the spent fuel pool PRA. 

Following the screening process, the initiating events are grouped based on similar outcome, in 

mitigation and consequences. For example, cask loading with high burnup fuel, and cask 

loading with short-time decayed fuel, both of which results in a cask heat load conditions that 

could exceed the [XXXXX] design limit, can be grouped as a fuel loading error initiating event. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-8 

Figure 16-5 High-Level Master Logic Diagram for Phases and Cause 

16.1.2.4 Documentation

Document the sources of information reviewed, any additional DCS-specific models used, and 

the basis for screening and grouping of initiating events. Table 16-4 provides details of the 

documentation requirement. The documentation (along with the identified inputs described in 

Section 16.1.2.2) is succinct and transparent in enabling an independent QA and peer review. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-9 

Table 16-4 Subtask 5-1.2 Documentation 

Step Description 

Literature Search Document and summarize the sources of information that 

were reviewed to collect all possible initiating events. 

Hazard Identification 

Process 

Document the process used to ensure that all possible 

initiating events are identified. Discuss any specific methods, 

(e.g., MLD, HAZOP, etc.) used for determination of additional 

initiators based for the DCS systems and related operational 

phases (i.e., loading, transfer, and storage). 

Screening and 

Grouping 

Document the basis for screening-out initiating events, the 

basis for grouping and subsuming initiating events, and the 

dismissal of any observed initiating events, including any 

credit for recovery. Provide the final list of initiating events in 

a tabular format, with sufficient information to facilitate QA 

and/or peer review. 

16.1.2.5 Task Interfaces

The initiating event analysis subtask interfaces with Subtasks 5-1.3 through 5-1.5. It also 

interfaces with Subtask 5-1.1 for the review of the DCS and operational procedures. Figure 16-

4 provides a high-level interface between each subtask. 

16.1.3 Subtask 5-1.3: Data Analysis

Data analysis consists of determining the probability and frequency of occurrences of the 

various events modeled in the DCS PRA. These are identified in the initiating events analysis 

as well as those identified in the accident sequence analysis. The component failure 

probabilities and initiating event frequencies are determined using both generic and plantspecific information, if available. Data analysis consists of three interrelated steps namely, 

determining (1) the frequency of initiating events, (2) component reliability (or failure probability), 

and (3) common cause failure (CCF) probabilities. The first step quantifies the frequency of 

each group of initiating events identified in the initiating event analysis subtask (refer to Section 

16.1.2). The second step determines plant-specific estimates of the unavailability of specific 

equipment. The third step determines the final values to be used in the parametric models of 

common-cause failures. Additional guidance on parameter estimation is given in NUREG/CR6823 [5]. 

The process for data analysis is similar to that used in the Level 1 PRA for Internal at-power. 

However, the goal here is to identify those hazards that affect the DCS instead of the reactor. 

Nevertheless, similar discussions and guidelines as provided in the ASME/ANS RA-Sa-2009 

PRA standard for internal events at-power are also applicable to this subtask. 

16.1.3.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• Site-specific data will be used, if available 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-10 

• Generic data referenced in the previous studies and listed in Section 16.1.2 will be used 

when plant-specific data is not available 

16.1.3.2 Inputs

The information required to perform the associated steps are identified in Table 16-5. This 

information is succinct and transparent in enabling an independent QA and peer review. 

Table 16-5 Required Inputs for Subtask 5-1.3 

Input Description 

Generic and plantspecific data and 

specifications 

Generic and plant-specific data on load drop, crane failure, 

component failure, etc. 

Specifications on the following: 

• Crane specifications (failure data for specific model if 

available) 

• Refueling building structural specifications (also 

including seismic event frequencies) 

• Transporter specifications (failures if available: cask 

drop and tip-over and operator errors) 

• Cask design specifications ([XXXXXXXXXX] FSAR) 

• High Temperature Fire: Fire Zones and sources 

close to cask hauling route or ISFSI 

• Site-specific external hazards 

16.1.2.3 Analysis Steps

Data analysis consists of the following steps: 

1. Frequency of initiating events 

2. Component reliability 

3. Common cause failure probabilities 

Step 1 – Frequency of Initiating Events 

The objective of this step is to quantify the frequency of each group of initiating events identified 

in the initiating event analysis subtask (Section 16.1.2). It is desired that the frequencies be 

expressed in the form of uncertainty distributions and that the determination of the frequencies 

take advantage of all relevant evidence. The goal of this step is to develop a probabilistic 

description of the frequency of the initiating events of interest along with supporting 

documentation. 

The frequency of initiating events can be either based on generic data, or can be calculated 

using logic models (i.e., fault trees). For the DCSO related initiating events, such as cask 

handling and load drop, it is more appropriate to use a fault tree model to calculate the 

frequency of potential load drop per demand. It could be more accurate and provide more 

insight. The analysis must account for both the reliability of the lifting equipment (e.g., crane, 

yoke, etc.) and the reliability of workers to rig the transfer cask and operate the crane. A fault 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-11 

tree analysis of the crane equipment must be based on detailed design and operational 

information (i.e., lift heights, lift speeds, lift times, movements of the bridge, and movements of 

the trolley). The model should include human performance issues relevant to dry cask storage 

operations. Development of human reliability issues related to DCS is provided in NUREG/CR7016 [6], and is discussed further under Section 16.1.4. 

Step 2 – Component Reliability 

The objective of this step is to obtain plant-specific estimates of the unavailability of specific 

equipment used for DCS PRA quantification. The scope of this task is to develop the database 

needed for estimating the contributors to unavailability of the basic events modeled in DCS fault 

trees. It also includes development of component failure models, collection of generic and 

plant-specific component data, and estimation of the parameters of the component unavailability 

models. It is important that the component unavailability is expressed in the form of uncertainty 

distributions and that similar components be grouped in the same correlation class. 

The general process for this step is to (1) determine the most appropriate level, scope, 

hardware boundary, and specifications for data collection; (2) establish the current knowledge 

on the parameters to be estimated by aggregating the various sources of generic data and the 

experience of similar plants; (3) identify the sources of plant-specific data to be retrieved, 

reduced, reviewed, and interpreted for the parameters of interest and establish the plant-specific 

data summary; and (4) combine plant-specific and generic data when appropriate to estimate 

the required parameters and to reflect the associated uncertainties. 

Step 3 – Common Cause Failure Probabilities 

The objective of this task is to determine the final values to be used in the parametric models of 

common-cause failures (CCFs). This would involve addressing a variety of issues starting with 

the definition of what should be considered as CCFs, how they should be modeled in the 

context of system fault trees, and finally how they are to be estimated using generic and plantspecific data. The CCF modeling is performed in two phases. For the first phase, CCF 

probabilities are estimated based on the applicable industry-wide CCF events. Subsequently, 

the plant models should be quantified, and the major CCF contributors identified. For those CCF 

events which significantly contribute to plant risk, further analysis is needed to justify that the 

CCF estimates are appropriate. 

16.1.3.4 Documentation

The sources of data and methods used to determine initiating event frequencies, component 

reliability, and CCF are documented. Table 16-6 provides the details of documentation needs. 

The documentation (along with the identified inputs described in Section 16.1.3.2) is succinct 

and transparent in enabling an independent QA and peer review. 

Table 16-6 Subtask 5-1.3 Documentation 

Item Description 

Frequency of 

initiating events 

Document the specific methods (i.e., generic or logic model 

or both) used to determine the frequencies for each group of 

initiating event. Identify sources of data (i.e., generic, plantspecific, or both) used. In addition, include sources of 

parameter and modeling uncertainties. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-12 

Table 16-6 Subtask 5-1.3 Documentation 

Item Description 

Component reliability Document the sources of generic and plant-specific data and 

the component failure models used. Provide a summary of 

plant-specific failure events, a description of the statistical 

methods and software used in estimating failure parameters, 

and tables of both generic and plant-specific data that can be 

used to calculate the basic event probabilities used in the 

DCS PRA. Include any assumptions made in the analysis 

and identify sources of parameter and model uncertainties. 

Common cause 

failure probability 

Document the scope of CCF that was modeled including 

component types and grouping. It should identify the CCF 

parametric models that were used including the ways that it 

was incorporated in DCS fault trees. 

Identify plant-specific CCF rate including a description of 

approaches used in arriving at those estimates. These 

estimates would be utilized in the first phase analysis. 

Describe the risk significant CCFs identified through initial 

quantifications and the results of sensitivity and importance 

evaluation and used for the refined CCF estimates for the 

second phase analysis and final quantification. 

Identify the final set of CCF rates generated through the 

second phase analysis for use in the final quantification. 

16.1.3.5 Task Interfaces

The data analysis interfaces with the following subtasks (see Figure 16-4): 

• All steps require information from initiating event subtask. 

• The data analysis subtask provides input to human reliability analysis, accident 

sequence analysis, and success criteria subtasks. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-13 

16.1.4 Subtask 5-1.4: Human Reliability Analysis

Section 7 describes the human reliability analysis (HRA) task, in general. For dry cask PRA, in 

particular, substantial qualitative HRA work (for many operational phases) is provided in the 

following resources: 

• NUREG/CR-7016, Human Reliability Analysis-Informed Insights on Cask Drops, 

February 2012 

• NUREG/CR-7017, Preliminary, Qualitative Human Reliability Analysis for Spent Fuel 

Handling, February 2012 

Selection of an appropriate HRA quantification method will be based on the human performance 

issues identified in the HRA qualitative analysis, as recommended in NUREG-1842 (i.e., NRC’s 

Evaluation of HRA Methods Against Good Practices). 

16.1.5 Subtask 5-1.5: Success Criteria (Structural and Thermal Analysis)

The success criterion for dry storage is the prevention of any failure of the DCS confinement 

(i.e., breach of [XXXXXXX]). The failure of confinement can be a direct result of the initiating 

event such as a drop (modeled in the structural analysis) or result of a high temperature event 

such as a fire (modeled in the thermal analysis) that causes a breach of the containment 

boundary. Therefore, this subtask consists of the following two steps: 

• Structural analysis 

• Thermal analysis 

16.1.5.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• Site-specific data will be used if available. For the structural analysis this includes drop 

heights during cask movement (from loading to installation on the ISFSI pad), and 

external hazards (i.e., seismic, high winds, hurricanes, aircraft crash, and high 

temperature weather). For the thermal analysis this includes plant fire sources and fire 

zones, increased heat input due to misloading, external fires or explosions (adjacent 

facilities fires or explosions that could affect dry storage). 

• Generic data referenced in the previous studies in Section 16.1.2 will be used when 

plant specific data is not available. 

16.1.5.2 Inputs

The cask design features and specifications are required to perform structural and thermal 

analyses. Table 16-7 identifies the information to perform the associated steps. This 

information is succinct and transparent in enabling an independent QA and peer review. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-14 

Table 16-7 Required Inputs for Subtask 5-1.5 

Input Description 

Site-Specific Data 

and Specifications 

This data includes specifications on the following: 

• Cask Structural/Thermal Specifications – Information on the 

cask components and design specifications. This 

information is available in the cask FSAR and Reference 2. 

• ISFSI Specifications – Information on the physical 

properties of the storage pad (i.e., construction materials) 

to infer parameters needed in the analysis (e.g., friction 

factors) for cask tipover, due to a drop or an external 

hazard. 

• Plant Heavy Load Movement Path - This includes all drop 

heights. 

• Plant Fire Zones and Sources. 

• Transporter Specifications (including operation). 

16.1.5.3 Analysis Steps

This section describes the steps that were were identified earlier. 

Step 1 – Structural Analysis 

The objective of this step is to determine the level of stress/strain that could result from the 

identified initiating events leading to breach of [XXXXXXXXXXXXXXXXXXXXXXXXXX]. 

To evaluate the structural behavior of the transfer cask and storage cask for the postulated 

initiating events, simplified and conservative analyses can be used. The analysis methods may 

include hand calculations based on first principles, common analytical methods and industry 

recognized approaches (e.g., fragility analysis), and use of the differential equations of motion 

for which closed form solutions are obtained. When an analysis requires complex computer 

codes and large amounts of resources, existing calculations performed by cask manufacturer 

([XXXXXXXXXX]) and reviewed by NRC staff for cask certification can be used. Additional 

independent analysis can be performed using LS-DYNA computer code, a non-linear dynamic 

impact analyses code [7]. The loads and stresses calculated for the final list of initiating events 

are used to determine the probability of failure of the [XXXXXXXX], and the transfer cask. 

Structural analyses performed for the [XXXXXXXXXXXXXXXX] can be adapted for the 

determination of the [XXXXXX] and transfer cask failure for various drop heights, drop 

orientations (i.e., side drop, end drop, or corner drop), and other external loads. 

Step 2 – Thermal Analysis

The objective of this step is to determine the thermal loads that could results from the initiating 

events involving cask heat-up (i.e., fire or misloading). 

The information on the cask thermal analysis is available from the cask FSAR and the 

corresponding NRC safety evaluation report. For [XXXXXXXX], [XXXXXXXXX] has performed 

cask heat-up analyses during normal operation, blocked vent and fire. This analysis, 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-15 

[XXXXXXXXXXXXXXXXXXXXXXXXX], provides a heat-up model for the storage cask. The 

analysis concluded that [XXXXXXXXXXXXXXXXXXXX]. For events involving external fire, the 

effect of thermal load on the [XXXXXXXXX] and fuel is determined. The results of thermal 

analyses from a 3-hour fire concluded that even though there could be some fuel failure due to 

high temperature, the [XXXXX] is not expected to fail [XXXXXXX]. 

16.1.5.4 Documentation

The sources of data and methods used to determine cask structural and thermal responses to 

initiating events are documented. Table 16-8 provides the details of documentation needs. The 

documentation (along with the identified inputs described in Section 16.1.5.2) is succinct and 

transparent in enabling an independent QA and peer review. 

Table 16-8 Subtask 5-1.5 Documentation 

Item Description 

Structural analysis For each initiating event document the method used for 

determining the cask response and its effect on the [XXXXX] 

and fuel failure, as applicable. The discussions may include 

appropriate reference to the applicable analyses in 

[XXXXXXXXXX], as appropriate. Identify sources of 

parameter and model uncertainties. 

Thermal analysis For each initiating event document the method used for 

determining the cask response and its effect on the [XXXX] 

and fuel failure, as applicable. The discussion may include 

appropriate reference to the applicable analyses in 

[XXXXXXXXX], as appropriate. Identify sources of parameter 

and model uncertainties. 

16.1.5.5 Task Interfaces

This subtask interfaces with initiating event analysis, and cask description and operational 

phase subtasks. Figure 16-4 provides a high level Interface between each subtask. 

16.1.6 Subtask 5-1.6: Accident Sequence Analysis and Quantification

The accident sequence analysis consists of a logic structure to develop and quantify the 

sequence of events that result in radionuclide release. The accident sequence logic (i.e. fault 

trees) combines initiating events and the corresponding conditional cask failure probabilities 

from structural and thermal hydraulic analyses. The result of accident sequence analysis is a 

listing of accident sequences that result in radionuclide release (cask failure) and their 

associated occurrence frequencies. 

This subtask consists of the following three steps: 

1. Development of event sequence logical structure (i.e. event trees) 

2. Development of top event logic for integrating initiating events with basic events (i.e. 

fault trees) 

3. Generation and quantification of accident sequences 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-16 

The process for accident sequence analysis and quantification is similar to that used in the 

Level 1 PRA for internal hazards at-power. However, the goal here is to determine accident 

sequences that are generated during DCSOs. Nevertheless, similar discussions and guidelines 

as provided in the ASME/ANS RA-Sa-2009 PRA standard for internal events at-power are also 

applicable here. 

16.1.6.1 Assumptions and Limitations

The following are a list of assumptions and limitations that define the scope and level of detail 

performed for this task. 

• The end-state for this subtask is cask/[XXXXX] and fuel failure leading to release of 

radionuclides. 

16.1.6.2 Inputs

The required inputs include a list of final initiating event frequencies, human error probabilities 

and conditional cask failure probabilities. Table 16-9 identifies the information required to 

perform this subtask. This information is succinct and transparent in enabling an independent 

QA and peer review. 

Table 16-9 Required Inputs for Subtask 5-1.6. 

Input Description 

Final list of initiating events Information on initiating event frequencies, 

component reliability, human error probability and 

conditional cask confinement failure probabilities are 

needed for quantification of accident sequences. 

Initiating event frequency, 

component reliability and 

CCFs 

[XXXXXX] and cask failure 

probabilities 

Human error probabilities 

16.1.6.3 Analysis Steps

This section describes the steps that were were identified earlier. 

Step 1 – Development of Event Tree 

The objective of this step is to develop a logic model that captures the sequences of events that 

leads to cask failure and release of radionuclides. 

Cask confinement, in this case provided by the [XXXXX], is the main safety function for a dry 

storage cask. It provides critically control, pressure control, decay heat removal, as well 

confinement. Therefore, the success criterion for DCS is prevention of a breach of this 

confinement leading to radionuclide releases. The top events for the accident sequences 

consist of cask primary confinement as well as those features that impact the potential for, and 

magnitude of, the radionuclide releases. Those features include, spent fuel cladding, building 

integrity (if the accident occurs within the building), and recovery/mitigation actions (i.e., 

reducing the release to the environment through isolation and/or filtered release). Alternatively, 

one can assume that there are no mitigations, and building confinement does not exist, or is 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-17 

ineffective. Considerations have been given to both of these top events in the DCS PRA. 

Reference [2] considered both the building confinement and filtered release. Reference [1] 

used a simplified event tree as shown in Figure 16-6. 

Figure 16-6 Simplified Accident Sequence Event Tree 

Step 2 – Development of Top Events Logic Model 

The objective of this step is to develop a logic model that represents the top events for each 

group of initiating events. 

The logic model is developed for the top events in the event tree. The logic model (fault tree) 

combines initiating events, and the corresponding conditional cask failure probabilities from 

structural and thermal analyses. The structural integrity of the fuel cladding will be analyzed 

(References [1] and [2]) during structural or thermal events. 

Step 3 – Generation and Quantification of Accident Sequences 

The accident sequence cut-sets are generated from the logic model. Previous DCS PRAs 

indicate that the accident sequences are mostly dominated by human error resulting in a load 

drop. Human action dependencies are identified in Subtask 5-1.5, and reflected in the 

quantification of the initiating event frequencies. 

16.1.6.4 Documentation

The process to develop and quantify accident sequences is documented. Table 16-10 provides 

the details of documentation needs. The documentation (along with the identified inputs 

described in Section 16.1.6.2) is succinct and transparent in enabling an independent QA and 

peer review. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-18 

Table 16-10 Subtask 5-1.6 Documentation 

Item Description 

Accident sequence 

analysis and 

quantification 

Document the process used to develop accident sequences and 

treat dependencies in accident sequences, including the inputs, 

methods, and results. Include a discussion of the linkage 

between the modeled initiating events, success criteria 

(structural/thermal analysis), and the accident sequence model. 

Provide a description of the accident progression for each 

sequence or group of similar sequences. Identify the operator 

actions reflected in the sequence specific timing and 

dependencies that are identified in the HRA subtask for these 

actions. 

Document the results of the quantification including sensitivity 

analyses, the accident sequences and their contributing cutsets, 

the total cask damage frequency and the contributions from 

different initiating events, and records of the cutset review 

process. Identify the various computer codes used to perform 

the quantification. 

16.1.6.5 Task Interfaces

The subtask interfaces with the initiating events analysis, data analysis, human reliability, and 

success criteria subtasks for the required inputs. This subtask interfaces with the uncertainty 

analysis and consequence analysis (radionuclide release analysis). Figure 16-1 provides a high 

level Interface between each subtask. 

16.1.7 Subtask 5-1.7: Uncertainty Analysis

The uncertainty analysis consists of determining the variability of the results of the events 

modeled in the DCS PRA. The process for performing uncertainty analysis is similar to that 

provided in Section 11 of this report. Under each subtask the sources of parameter and model 

uncertainties are identified. The uncertainties are then propagated for each accident sequence, 

or group of sequences, using a Monte Carlo or a similar method. 

16.1.7.1 Assumptions and Limitations

Uncertainty analysis is an integrated process that includes the initiating events, human 

reliability, data analysis, and the associated structural/thermal response analysis. Therefore, all 

assumptions and limitations listed for the aforementioned analyses are applicable. 

16.1.7.2 Inputs

The inputs for the uncertainty analysis are the identified sources of parameter and model 

uncertainties in the previous subtasks. 

16.1.7.3 Analysis Steps

The uncertainty analysis steps are similar to those identified in Section 11 of this TAP (see 

Section 11). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-19 

16.1.7.4 Documentation

Table 16-11 provides the details of documentation needs. The documentation (along with the 

identified inputs described in Section 16.1.6.2) is succinct and transparent in enabling an 

independent QA and review. 

Table 16-11 Subtask 5-1.7 Documentation 

Item Description 

Uncertainty analysis Document the quantification process for uncertainty analysis, 

and provide the uncertainty distribution for the total cask failure 

frequency. 

16.1.7.5 Task Interfaces

The uncertainty analysis interfaces with accident sequence analysis and quantification subtask. 

Figure 16.4 provides a high level Interface between the various subtasks. 

16.2 Task 5-2: Dry Cask Storage PRA for Health Effects 

(Consequence Analysis)

This task is divided into two subtasks: 

1. Subtask 5-2.1 – Radionuclide release (source term) 

2. Subtask 5-2.2 – Consequence analysis 

16.2.1 Subtask 5-2.1: Radionuclide Release

This subtask estimates the release of radionuclides for each of the potential accident scenarios 

developed in the accident sequence analysis and quantification subtask. This subtask consists 

of three steps: 

1. Estimation of radionuclide inventory within the cask 

2. Estimation of the degree of fuel damage (from structural or thermal analysis) 

3. Estimation of the amount and characteristic of airborne material within the cask and into 

the environment 

16.2.1.1 Assumptions and Limitations

The radionuclide inventory within a cask is assumed to be based on the cask design fuel burnup 

and fuel decay time. This may be conservative for first batches of spent fuel movements to 

DCS. This is because the early batches will include old spent fuel with long decay times in the 

spent fuel pool. Eventually, the cask could be loaded with the design limit fuels. SCALE 

Computer code will be used if further analysis is needed for criticality safety or inventories. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-20 

16.2.1.2 Inputs

The radionuclide release inventory is required to perform DCS-related consequence analysis. 

Table 16-12 identifies the information to perform the associated steps. This information is 

succinct and transparent in enabling an independent QA and review. 

Table 16-12 Required Inputs for Subtask 5-2-1 

Input Description 

Cask radionuclide 

inventory 

Design inventory limit inside the cask based on the FSAR 

fuel design limits on heat load and burnup. 

Structural and 

thermal load 

responses 

Estimates of potential failure modes (pinhole, rupture, etc.) of 

the spent fuel from the structural and thermal analysis 

response. The structural integrity of the fuel cladding will be 

analyzed (References [1] and [2]) during structural or thermal 

events. 

Spent fuel gaseous 

and particulate 

release fractions 

Methods to estimate the release fractions from the spent fuel 

given the initiating event resulting impact load or a heat load. 

Sources of information include NUREG/CR-6672 [8], EPRI 

DCS PRA [1], NRC DCS PRA [2], SAND-90-2406 [9], and 

NUREG/CR–2125 [10]. 

16.2.1.3 Analysis Steps

A description of the three steps identified earlier follows. 

Step 1 – Estimation of Radionuclide Inventory within the Cask 

The objective of this step is to estimate the radionuclide inventory within a DCS. This data can 

be obtained by considering the cask design limit on spent fuel burnup and decay time and 

number of fuel assemblies within a cask. This assumption is conservative for the early batches 

of spent fuel movement, because the oldest fuel is expected to be moved first. Nevertheless, 

the cask can contain the design limit of short-time decayed fuels. 

Step 2 – Estimation of the Degree of Fuel Damage 

The objective of this task is to estimate what fraction of fuel rods could be damaged in an 

accident. The degree of fuel damage within a cask is a function of impact force and/or thermal 

loading experienced during an accident. Both the NRC and industry have performed a series of 

analysis to determine the risk of storing spent fuel in DCS [1, 2]. The various studies sponsored 

by the NRC have documented the estimates of potential fuel failure and radiological releases in 

a hypothetical transportation cask accident. Among these, the most applicable to this study are: 

NUREG/CR–4829, or Modal Study [11], structural and confinement evaluation, SAND-90-2406, 

known as the Sanders report [9], the reexamination of spent fuel shipment risk estimate, 

NUREG/CR-6672 [8], and a recently published draft NUREG/CR–2125 [10]. In all these 

studies, estimates of release fractions conditional on accident severity are provided. 

One notable observation from the Sanders study [9] is that failure probability of a fuel rod inside 

a cask resulting from a 9-meter drop onto an unyielding surface under various orientations to 

range between 6.0E-10 to 2.0E-4. The study used two fuel cladding material properties, 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-21 

material ductility and fracture toughness, to determine tearing from excessive strain and 

extension of a generated or pre-existing partial crack in the fuel rod cladding, respectively. The 

higher estimate is for a potential of causing a longitudinal slit in fuel rods with pre-existing, 

part-wall crack due to fuel-pellet clad interaction. The lower estimate is for a potential of 

causing pinhole fuel rod ruptures for rods with no pre-existing faults. 

Step 3 – Estimation of the Amount and Characteristic of Airborne Material within the 

Cask and to the Environment 

The objective of this step is to estimate the fraction of various gaseous and particulate 

radionuclides that could be released from the damaged fuel to into the cask and the 

environment. In accident conditions causing fuel rod cladding failure, depressurization of the 

fuel rod would cause gaseous (noble gases and volatile) fission products, and particulates (fuel 

fines) to be released within the cask. The release of gaseous materials and suspension of 

particulates depends, in a complex manner, on the physical properties of the material and its 

confinement and on the nature of stress (thermal and mechanical) impacting the system. As a 

consequence of this complexity, theoretical prediction of airborne release fraction (ARF) and 

respirable fraction (RF) would not be possible. Selection of values for these parameters instead 

would be based on review of experimental data on the spent fuel, magnitude of stresses acting 

on the spent fuel, and selection of the most applicable data for the expected conditions. 

Comprehensive reviews of data related to release of radioactive material are available in 

NUREG/CR-6410 [12], DOE-HDBK-3010 [13], SAND-90-2406 [9], and NUREG/CR-6672 [8]. 

Additional information on estimating spent fuel release fractions are provided in References [1] 

and [2]. 

16.2.1.4 Documentation

The process to develop radionuclide release inventory is documented. Table 16-13 provides 

the details of documentation needs. The documentation (along with the identified inputs 

described in Section 16.2.1.2) is succinct and transparent in enabling an independent QA and 

review. 

Table 16-13 Subtask 5-2.1 Documentation 

Item Description 

Radionuclide release to 

the environment 

Document the method used to estimate the radionuclide 

releases to the environment. Identify all information and 

sources of data used, including specific assumptions, and any 

computer models used. Provide the results in a tabular format 

indicating the material at risk, fuel damage ratio, cask 

retention factors, and gaseous and particulate release 

fractions inside the cask and to the environment. 

16.2.1.5 Task Interfaces

The radionuclide release analysis interfaces with subtask accident sequence analysis and 

quantification. Figure 16-4 provides a high level Interface between the subtasks. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

16-22 

16.2.2 Subtask 5-2.2: Consequence Analysis

The process for performing consequence analysis is similar to that provided in Section 12.3, 

“Task 1-3: Level 3 Reactor PRA, At-Power for Internal Hazards.” Subtasks 1-3.2 through 1-3.9 

in Section 12.3 are common to all consequence analysis sections of this report. The only 

variance to these sections is the additional review of road network availabilities after severe 

external event hazards such as seismic and external floods, the initiating events and accident 

progression affecting the emergency action levels for emergency response and the end state 

frequency weighting as an input to the overall consequence analysis. Discussions provided 

above under Subtask 5-2.1 supplement the analysis steps provided for Subtask 1-3.1 in 

Section 12.3. Therefore, no further discussions are provided. 

16.3 References

1. “Probabilistic Risk Assessment (PRA) of Bolted Storage Casks: Updated Quantification 

and Analysis,” EPRI Technical Report No. 1009691, December 2004. 

2. “A Pilot Probabilistic Risk Assessment of a Dry Cask Storage System at a Nuclear 

Power Plant,” NUREG-1864, March 2007. 

3. “Control of Heavy Loads at Nuclear Power Plants, Resolution of Generic Technical 

Activity A-36,” NUREG-0612, July 1980. 

4. Generic issue 186 “Potential Risk and Consequences of Heavy Load Drops in Nuclear 

Power Plants.” 

5. “Handbook of Parameter Estimation for Probabilistic Risk Assessment,” NUREG/CR6823, September 2003. 

6. “Human Reliability Analysis-Informed Insights on Cask Drops,” NUREG/CR-7016, 

February 2012. 

7. “LS-DYNA User’s Manual,” vols. 1 & 2, Version 960, 2001. 

8. “Reexamination of Spent Fuel Shipment Risk Estimates,” NUREG/CR-6672, March, 

2000. 

9. “A Method for Determining the Spent-Fuel Contribution to Transport Cask Containment 

Requirements,” SAND-90-2406, 1992. 

10. “Spent Fuel Transportation Risk Assessment,” NUREG-2125 (draft for comment), May 

2012. 

11. “Shipping Container Response to Severe Highway and Railway Accident Conditions,” 

NUREG/CR-4829, June 1987. 

12. “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” NUREG/CR-6410, March 

1998. 

13. “Airborne Release Fractions/Rates and Respirable Fractions for Nonreactor Nuclear 

Facilities,” DOE-HDBK-3010, October 1994. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-1 

17 Technical Approach for Integrated Site Risk Analysis Task 

The objective of the Integrated Site Risk Analysis (ISRA) task is to estimate the total site risk 

and to identify the important contributors to the total site risk. In this project, the phrase “total 

site risk” means the risk due to accidents that affect one or more of the radiological sources 

located at the site (the Unit 1 reactor, the Unit 2 reactor, the Unit 1 spent fuel pool, the Unit 2 

spent fuel pool, and the dry cask storage facility). Earlier project stages will estimate the risk 

and identify its contributors from accidents that only affect a single radiological source; as a 

result, the ISRA task will focus on the risk due to accidents that affect combinations of the onsite 

radiological sources. 

Consistent with the overall project objectives, the results of the ISRA task are expected to 

provide new insights to enhance regulatory decisionmaking and to help focus limited agency 

resources on issues most directly related to the agency’s mission to protect public health and 

safety. 

17.1 Assumptions and Limitations 

1. Multi-source accident sequences can be formed by combining sequences from the 

single-source PRA models. This assumption implies: 

a. The set of single-source initiating events and sequences is complete. As a 

result, no additional initiating events or single-source accident sequences need to 

be defined within the ISRA task. 

b. Site configurations can be formed by superimposing the operating configurations 

defined within each single-source PRA model, with adjustments as necessary to 

account for logically impossible combinations or combinations prohibited by 

Technical Specifications. 

c. Site radiological release states (RRSs) can be formed by combining the RRSs 

defined within the single-source PRA models, with adjustments as necessary to 

account for differences in release timing. 

2. The ISRA task will focus on identifying and analyzing risk-significant multi-source risk 

contributors. As a result: 

a. The ISRA task will emphasize analysis breadth (initially considering all possible 

multi-source accident sequences and consequences, and then using various 

screening and scoping approaches to identify and focus on risk-significant multisource sequences). In order to complete the ISRA task within the project’s 

schedule and budget constraints, simplified PRA logic structures will be used to 

limit the level of detail within a given multi-source accident sequence. 

b. The screening and scoping approaches used to focus on risk-significant multisource sequences need to consider both sequence frequency and sequence 

consequence. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-2 

c. For the purposes of screening and prioritization, the consequences of a multisource accident can be estimated by summing the consequences of each source 

that contributes to the multi-source accident. 

3. The ISRA task is a highly iterative effort, where intermediate results may be used to 

refine previously completed steps. The use of iteration is not unique to the ISRA task, 

but rather reflects the fact that PRA of single sources has always involved iteration 

among the various analysis steps. Moreover, in order to achieve the overall project 

schedule, the ISRA task will begin before the single-source PRAs have been finalized, 

thus introducing the possibility of rework within the ISRA task due to revisions in the 

single-source PRA models. The need to use iteration within the ISRA task must be 

carefully managed to ensure the dependencies are adequately included in the model 

and sufficient level of detail is included to produce useful insights. 

17.2 Inputs 

1. Single-source PRA models and their results, assumptions, limitations, and descriptions 

of analysis steps. 

2. Final Safety Analysis Report 

3. Site maps 

4. General arrangement drawings 

5. Process and instrumentation drawings (P&IDs) 

6. System descriptions 

7. Plant operating procedures (e.g., emergency operating procedures, severe accident 

management guidelines, emergency management guidelines, etc.) 

17.3 Analysis Tasks 

The Integrated Site Risk Analysis (ISRA) consists of 18 interrelated tasks: 

Overall Tasks 

Task 1 – Identify individual risk model insights 

Task 2 – Develop site risk model selection criteria and assumptions 

Level 1 PRA Tasks

Task 1-1 – Identify and prioritize initiating events and accident sequence combinations 

Task 1-2 – Identify different site configurations 

Task 1-3 – Identify dependencies and common causes 

Task 1-4 – Develop simplified event trees 

Task 1-5 – Develop simplified fault trees 

Task 1-6 – Quantify accident sequence event trees

Level 2 PRA Tasks

Task 2-1 – Identify dependencies and common causes 

Task 2-2 – Identify and prioritize site damage states 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-3 

Task 2-3 – Develop simplified release event trees 

Task 2-4 – Develop simplified fault trees 

Task 2-5 – Quantify release event trees 

Level 3 PRA Tasks

Task 3-1 – Identify dependencies and common causes 

Task 3-2 – Identify and prioritize radiological release states 

Task 3-3 – Select RRS and site configuration 

Task 3-4 – Develop simplified consequence model 

Task 3-5 – Quantify consequence model 

The relationship among these tasks is shown in Figures 17-1a, 17-1b, and 17-1c, and is further 

described below. 

Figure 17-1a. Integrated Site Risk Analysis Flowchart (Level 1 PRA). 

Task 1 – Identify Individual Risk Model Insights 

Identify insights from 

individual risk models

Develop criteria 

and assumptions 

to simplify site risk 

model

Identify and prioritize 

initiating events/accident

Identify dependencies (e.g., 

system, spatial, operator, 

timing) and common cause 

across and within source risk

Identify different 

site configurations

Select initiator and site 

configuration and develop 

simplified event tree

Develop 

simplified fault

Quantify event tree in stages 

to screen potential sequences

Refine event 

tree and/or fault 

tree model

Select next event 

and/or site 

configuration

Level 1 PRA site 

risk results

Task 1-1 Task 1-2

Task 1-3

Task 1

Task 2

Task 1-4

Task 1-5

Task 1-6 Task 1-6d

Task 1-6e

Success Criteria, Human Reliability 

Analysis (HRA), Data Analysis

Task 1-6a,b,c

Level 2 and Level 3 

PRA Tasks

L2 L3

L2 L3
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-4 

The objective of this task, which supports the entire ISRA effort, is to identify insights from each 

individual single-source risk model to assist in developing criteria and assumptions that will be 

used in building each part of the integrated site risk model. These criteria and assumptions will 

be used to help prioritize, screen and simplify the analysis so that the ISRA task identifies and 

focuses on risk-significant multi-source sequences. 

 

Figure 17-1b. Integrated Site Risk Analysis Flowchart (Level 2 PRA). 

The single-source PRA models and plant information sources will be reviewed to identify 

features that have the potential to affect the delineation of multi-source accident sequences. 

Specifically, the review of the single-source PRA models and plant information sources will 

identify: 

1. Shared support systems 

2. Systems that have cross-connects between the units 

3. Common locations (locations that house or provide access to equipment that support 

more than one source) 

Identify dependencies (e.g., system, spatial, operator, timing, phenomena) 

and common cause across and within source risk

Select SDS and site configuration and 

develop simplified release event tree (RET)

Develop simplified 

fault trees

Quantify RET in stages to screen 

potential sequences

Refine RET and/or 

fault tree model

Select next SDS and/or 

site configuration

Level 2 PRA site risk 

results

Task 2-1

Task 2-3

Task 2-4

Task 2-5d Task 2-5

Task 2-5e

Success Criteria, HRA, Data Analysis

Task 2-5a,b,c

Develop and prioritize site damage states (SDSs)

Task 2-2

L2

Level 1 PRA site risk 

results
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-5 

4. Credits (recovery actions) for the use of shared systems or cross-connects 

During the review of the results of the single-source PRA models, the following information will 

be collected about risk-significant single-source accident sequences: 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-6 

Figure 17-1c. Integrated Site Risk Analysis Flowchart (Level 3 PRA). 

1. The initiating event 

2. The plant operating state at the time of the initiator 

3. The specific accident sequence (including events that were successful during the 

sequence) 

4. The specific accident sequence timing (a chronology of the events that appear in a 

sequence) including (if appropriate), but not limited to: 

a. The time of battery depletion 

b. The time when water inventory sources deplete (e.g., when the switchover from 

ECCS injection to ECCS recirculation occurs) 

c. The time when operator actions need to be completed 

5. Events that appear within the sequence cut sets which are potentially dependent with 

other sources (e.g., common-cause failures, shared systems, operator actions) 

6. The sequence’s contribution to the single-source risk estimate (frequency and 

consequence) 

Identify dependencies (e.g., , operator, timing, evacuation) and 

common cause across and within source risk

Select RRS and site configuration

Quantify Selected 

Consequence Model

Select next RRS 

and/or site 

configuration

Level 3 PRA site 

risk results

Task 3-1

Task 3-3

Task 3-4

Task 3-5

Develop simplified consequence model (Review 

Emergency Response, Meteor Data, 

Atmospheric Transportation, Dosimetry, Health 

Effects, Economic Factors, HRA)

Develop and prioritize radiological release states (RRS)

Task 3-2

L3

Level 2 PRA site 

risk results

Task 3-5
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-7 

For the purposes of this review, a risk-significant sequence is one of the set of sequences, 

defined at the functional or systemic level that, when ranked, compose 95% of the risk, or that 

individually contribute more than ~1% to the risk. A variety of risk measures (e.g., individual 

early fatality risk, individual latent cancer fatality risk, population dose risk) will be used to help 

ensure that all risk-significant sequences are identified. 

Task 2 – Develop Site Risk Model Selection Criteria and Assumptions 

The objective of this task, which supports the entire ISRA effort, is to develop and apply 

screening and scoping approaches to the information collected in Task 1 in order to guide the 

development of the ISRA PRA logic models. Given the potentially large number of risksignificant single-source accident sequences that encompass all defined plant operating states, 

it is necessary to direct the ISRA’s attention toward those sequences which have the potential to 

become risk-significant multi-source accident sequences. The following screening and scoping 

strategies will be considered during this task: 

1. Screening on the likelihood of the specific site configuration 

Site configurations will be defined in Task 1-2. A site configuration specifies the initial 

and boundary conditions for each radiological source at the time when an initiating event 

occurs. For example, the Unit 1 reactor may be operating with its associated SFP in a 

nominal configuration, the Unit 2 reactor and its associated SFP may be in a refueling 

configuration, and the DCS facility may be in a nominal configuration when a seismic 

event occurs. Site configurations will be formed by superimposing the operating 

configurations defined within each single-source PRA model, with adjustments as 

necessary to account for logically impossible combinations or combinations prohibited by 

Technical Specifications. 

It may be acceptable to screening certain site configurations from further consideration if 

they have a low likelihood of occurrence. One specific objective of this task is to define 

what is meant by “a low likelihood of occurrence” of a site configuration. Screening on 

the likelihood of a site configuration may eliminate some configurations of particular 

interest (e.g., mid-loop operations) and, hence, will somewhat diminish the ability to 

provide multi-source risk insights. Therefore, the development and application of a 

screening strategy that considers the likelihood of a site configuration needs to balance 

the need to complete the ISRA task within the project’s schedule and budget constraints 

against the desire to provide useful multi-source risk insights. 

2. Screening on the partial multi-source sequence frequency 

A single-source sequence may cascade or propagate into other sources. With respect 

to the ISRA task: 

• A cascading sequence is an accident sequence which causes core damage or 

fuel damage in one source and, when combined with additional equipment 

failures or operator actions, also leads to core damage or fuel damage in another 

source. For example, a LOCA may occur in Unit 1 that is followed by a failure of 

ECCS, leading to core damage in Unit 1. In addition, the Unit 1 LOCA may also 

cause a LOOP in Unit 2 that progresses to SBO and core damage in Unit 2. 

• A propagating sequence is an accident sequence which does not cause core 

damage or fuel damage in one source (i.e., it is a success path in the event tree) 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-8 

but, when combined with additional equipment failures or operator actions, leads 

to core damage or fuel damage in another source. For example, a LOCA may 

occur in Unit 1 that is successfully mitigated by operation of the ECCS. 

However, the Unit 1 LOCA may also cause a LOOP in Unit 2 that progresses to 

SBO and core damage in Unit 2. 

It may be possible to screen some cascading or propagating sequences on low 

frequency by partially quantifying them and comparing the result to a specified truncation 

frequency. For example, consider a Unit 1 core-damage sequence that has a frequency 

of 1E-7/ry. If the probability of a consequential LOOP is 5E-3, then the partial multisource sequence frequency would be 5E-10/ry (this result is a partial sequence 

frequency because it does not include the failures in Unit 2 that must occur to cause 

core damage). If a multi-source truncation frequency of 1E-9 is established, then this 

partial multi-source sequence would be screened from further consideration. 

One specific objective of this task is to define acceptable multi-source truncation 

frequencies. It should be noted that truncation based on sequence frequency may occur 

at any stage of the ISRA (i.e., sequences may be screened using the fuel-damage 

frequency, the plant-damage-state frequency, or the release frequency). 

3. Screening on the partial multi-source sequence risk 

It may be possible to screen some cascading or propagating sequences on low risk by 

partially quantifying them and comparing the result to a specified truncation risk. For 

example, consider a Unit 1 core-damage sequence that has a frequency of 1E-6/ry. If 

the probability of a consequential LOOP is 5E-3, then the partial multi-source sequence 

frequency would be 5E-9/ry (= 1E-6/ry x 5E-3), which is above the 1E-9/ry truncation 

frequency used in the previous example. However, it is possible to approximate the 

consequences of the multi-source sequence by summing its individual contributors. For 

example, suppose that the conditional individual latent cancer fatality risk caused by the 

Unit 1 sequence is 1E-4 and that the conditional individual latent cancer fatality risk 

caused by the Unit 2 sequence is 5E-4. Then the approximate multi-source conditional 

individual latent cancer fatality risk would be 6E-4 (= 1E-4 + 5E-4), and the partial multisource individual latent cancer fatality risk would be 3E-12/ry (= 5E-9/ry x 6E-4). If a 

multi-source truncation risk of 1E-10 is established, then this partial multi-source 

sequence would be screened from further consideration. 

One specific objective of this task is to define an acceptable multi-source truncation risk 

for each consequence measure used in the project. The development and application of 

a screening strategy based on risk must consider the suite of risk metrics considered in 

the project. 

The set of screening and scoping strategies will be reviewed by the project team, specifically 

including the Technical Advisory Group (TAG). This review, to be conducted before embarking 

on wide-scale implementation of the strategies, will include examples of the results produced by 

each strategy so that an assessment of the efficacy and efficiency of each strategy can be 

made. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-9 

Task 1-1 – Identify and Prioritize Initiating Events and Accident Sequence Combinations 

The objective of this task is to identify and prioritize the possible combinations of single-source 

accident sequences that lead to core damage or fuel damage. Specifically, this task will apply 

the Task 2 screening criteria to the risk-significant single-source accident sequences identified 

in Task 1 in order to determine which single-source sequences should be combined, and the 

order in which they will be assessed. 

In principle, multi-source accident sequences can be formed by combining individual sequences 

from each of the single-source PRA models. This task will be implemented in an iterative 

manner, starting with the risk-significant single-source accident sequences identified in Task 1. 

Based on a review of the intermediate results obtained, the multi-source PRA model will be 

expanded to incorporate additional sequences. This approach has several advantages: 

• It maintains focus on determining risk-significant multi-source accident sequences 

• It allows for the lessons learned from previous multi-source sequence delineation and 

solution to be fed back into subsequent analyses 

• It allows the solution of multi-source accident sequences to be achieved within the 

limitations of existing PRA software 

The set of initiating events in each single-source PRA will be divided into two broad classes: 

1. Single-source initiators (SSIs): Initiators that occur in one source. SSIs generally 

include initiators caused by internal hazards such as internal events (e.g., loss of main 

feedwater, loss-of-offsite-power (LOOP) events21, and loss-of-coolant accidents), 

internal floods, and internal fires. SSIs may cause multi-unit accidents due to cross-unit 

dependencies such as shared support systems, spatial interactions (e.g., flood 

propagation pathways), common-cause failures, or operator actions. 

2. Common-cause initiators (CCIs): Initiators that simultaneously challenges all of the units 

at a multi-unit site. CCIs include initiators caused by external hazards (e.g., 

earthquakes, external floods, and severe weather). 

The distinction between SSIs and CCIs is important when delineating multi-source accident 

sequences. As discussed in Task 2, a single-source sequence may cascade or propagate into 

other sources depending on the site configuration (to be defined in Task 1-2) and the nature of 

the dependencies among the sources (to be identified in Task 1-3). For example, consider the 

situation where both reactors are at-power, and the SFPs and DCS system are in a nominal 

configuration. A LOCA in the Unit 1 reactor (the SSI) may cause a consequential loss-of-offsite 

power (CLOOP) in Unit 1 and/or Unit 2. As a result, the CLOOP may initiate accident 

sequences in the Unit 2 reactor, the Unit 1 SFP, and/or the Unit 2 SFP. 

In order to identify and prioritize cascading sequences, the single-source SSI-initiated accident 

sequences will be ranked-ordered (high-to-low) according to their sequence frequencies. 

 

21 Table 6-4 in NUREG/CR-6890 provides the conditional probability that all plants at a multi-unit site experience a 

LOOP given a LOOP at one of the plants at the site. The mean values for each LOOP category are 6% for plantcentered LOOPs, 21% for switchyard-centered LOOPs, 82% for grid-related LOOPs, and 69% for weather-related 

LOOPs. It is appropriate to classify LOOP events as SSIs since these conditional probabilities are not identically 

100%. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-10 

Starting with the most likely sequence, each sequence will be reviewed to determine its 

potential to initiate an accident sequence in the remaining sources. The combination of events 

and circumstances that must occur to initiate a cascading sequence will be documented. This 

task will be iterative with Task 1-2 (the identification of site configurations), Task 1-3 (the 

identification of dependencies), the development of accident sequence logic models (event 

trees in Task 1-4 and fault trees in Task 1-5), and Task 1-6 (logic model quantification). 

In order to identify and prioritize propagating sequences, the single-source SSIs will be rank 

ordered (high-to-low) according to their occurrence frequencies. Starting with the most likely 

SSI, each SSI will be reviewed to determine its potential to initiate an accident sequence in the 

remaining sources. The combination of events and circumstances that must occur to initiate a 

propagating sequence will be documented. This task will be iterative with Task 1-2 (the 

identification of site configurations), Task 1-3 (the identification of dependencies), the 

development of accident sequence logic models (event trees in Task 1-4 and fault trees in 

Task 1-5), and Task 1-6 (logic model quantification). 

The list of CCIs will be prioritized according to their occurrence frequencies. Note that, by 

definition, there is no need to consider how they can initiate accident sequences in multiple 

sources. 

Task 1-2 – Identify Different Site Configurations 

The objectives of this task are to define site configurations and to estimate their likelihoods. 

As previously discussed under Task 2, a site configuration specifies the initial and boundary 

conditions for each radiological source at the time when an initiating event occurs. Site 

configurations will be formed by superimposing the operating configurations defined within each 

single-source PRA model, with adjustments as necessary to account for logically impossible 

combinations or combinations prohibited by Technical Specifications. 

For example, the reactor PRAs (including the at-power PRA and the shutdown and low-power 

PRA) will define a set of plant operating states (e.g., at-power, cooldown, refueling, and startup). 

In a similar manner, the SFP will define a set of operating cycle phases (e.g., nominal, outage 

entry, refueling, post-refueling, and cask loading). The DCS PRA will have an analogous set of 

operating cycle phases (e.g., nominal and cask loading). A complete set of site configurations 

could be developed by selecting a specific plant operating state for each reactor, a specific 

operating cycle phase for each SFP, and a specific operating cycle phase for the DCS. Some 

of these combinations will be logically impossible and, therefore, can be eliminated. For 

example, it is not possible for a reactor to be at-power while its associated SFP is in a refueling 

configuration. 

In addition, it may be possible to use symmetry to further reduce the set of site configurations 

that need to be considered in the ISRA task. For example, a site configuration where Unit 1 is 

operating and Unit 2 is in refueling is logically equivalent to a site configuration where Unit 1 is 

in a refueling configuration and Unit 2 is operating. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-11 

Task 1-3 – Identify Dependencies and Common Causes 

The objective of this task is to identify dependencies among the radiological sources that are 

potentially important to the assessment of multi-source risk. Examples of dependencies 

include: 

• Shared systems or systems that have cross-connects between the units 

o For example, the Unit 1 AC power system supports the Unit 1 reactor and the 

Unit 1 SFP 

o For example, Units 1 and 2 are electrically interconnected through the site 

switchyard 

• Common locations (locations that contain equipment which supports two or more 

radiological sources) 

o For example, Units 1 and 2 share a common control room 

• Multiple operator actions (including the potential for resource constraints, lack of training 

or guidance on addressing multi-source sequences, and command-and-control issues) 

• Situations where accessibility or habitability may be impaired due to the accident 

sequence (e.g., high temperature work environment, high radiation levels) 

• Common-cause failures 

This task reviews plant information and the single-source PRA models in order to identify and 

understand the dependencies that have been modeled. This effort is a necessary prelude to the 

delineation of multi-source accidents sequences. Failure to account for multi-source 

dependencies will result in underestimating the frequency of the multi-source accident 

sequences. At the same time, PRA results are typically driven by dependencies; therefore, 

knowledge of the potential multi-source dependencies can be used to simplify the multi-source 

logic models so that they may be solved within a reasonable time. 

The results of the review performed during this task will be documented in a set of dependency 

matrices. Regardless of the exact format of these dependency matrices, they must: 

• Accurately reflect the identified dependencies 

• Provide the ability to identify and understand dependencies that span multiple 

radiological sources (e.g., shared support systems between a reactor and its associated 

spent fuel pool) 

• Provide traceability to reference documentation 

Task 1-4 – Develop Simplified Event Trees 

The objective of this task is to develop a set of simplified event trees that delineate multi-unit 

accident sequences. The reasons for using simplified event trees include (a) achieving a model 

solution in a reasonable time period, and (b) focusing attention on identifying and analyzing risksignificant multi-source risk contributors. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-12 

As shown in Figure 17.2, the simplified event trees initiated by CCIs will be developed by 

beginning with the single-source events trees for the Unit 1 reactor. The sequences in these 

event trees that result in core damage will be linked to the single-source event trees for the Unit 

1 SFP. Continuing the process, the fuel-damage endstates will be linked to the Unit 2 reactor 

event trees, to the Unit 2 SFP, and finally to the DCS event trees. This order is preferred since 

there are dependencies between the Unit 1 reactor and SFP trees (electric power, service 

water, operator actions) and between the Unit 2 reactor and SFP trees. Since the event trees 

will be progressively quantified, applying the screening and scoping strategies developed in 

Figure 17-2. Development of Event Tree Logic for Common-Cause Initiators. 

CCI Unit 1 

reactor

Unit 1 

SFP

FD

CD

FD

apply screening and 

scoping strategies

CCI Unit 1 

reactor

Unit 1 

SFP

FD

CD

FD

apply screening and 

scoping strategies

Step 1

Unit 2 

reactor

CD

CD

CD

CD

Step 2

unscreened sequences

unscreened 

sequences continue 

to Unit 2 SFP and DCS
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-13 

Task 2, this approach helps to ensure that dependencies are properly captured and assessed 

before sequences are screened. 

Simplified event trees for SSIs will be developed in a similar manner, as shown in Figure 17-3. 

Note that it is necessary to include initiating event logic for the “downstream” radiological 

sources in order to determine which accident sequences propagate or cascade. 

Figure 17-3. Development of Event Tree Logic for Single-Source Initiators. 

A variety of techniques will be used to simplify the multi-source events trees, such as: 

1. Removal of duplicate event tree headings. 

2. Restructuring the logic to expedite the solution process. 

3. Linking only those partial multi-source sequences that have not been screened out. 

It is anticipated that the development of simplified event trees will be an iterative process, based 

on the insights obtained from initial logic model solution as further discussed in Task 1-6d 

below. 

Task 1-5 – Develop Simplified Fault Trees 

The objective of this task is to develop simplified fault trees based on the detailed fault trees 

developed during the single-source PRAs. The reasons for using simplified fault trees include 

SSI Unit 1 reactor No initiator in 

Unit 1 SFP

FD

CD

FD

apply screening and 

scoping strategies

Unit 1 SFP

unscreened sequence 

continue to Unit 2 

reactor, Unit 2 SFP, 

and DCS

Unit 1 SFP 

initiator occurs

Unit 1 SFP 

initiator occurs
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-14 

(a) achieving a model solution in a reasonable time period, and (b) focusing attention on 

identifying and analyzing risk-significant multi-source risk contributors. 

A variety of techniques will be using to simplify the detailed single-source fault tree models, 

such as: 

1. Identifying independent subtrees which can be collapsed into “supercomponents” that 

consist of basic events which are independent of other basic events in the models,as 

shown in Figure 17-4. 

2. Restructuring fault trees to expedite their solution (e.g., moving events that appear on 

both sides of an AND gate upwards in the logic). 

Figure 17-4. Fault Tree Logic Simplification. 

Dependencies among the various sources (e.g., shared support systems, cross-unit commoncause failures) will be incorporated into the fault trees as appropriate, according to the 

information developed in Task 1-3. 

It is anticipated that the development of simplified fault trees will be an iterative process, based 

on the insights obtained from initial logic model solution as further discussed in Task 1-6d 

below. 

Task 1-6 – Quantify Accident Sequence Event Trees 

The objective of this task is to quantify the multi-source accident sequence models developed in 

Tasks 1-4 (multi-source accident sequence event trees) and 1-5 (supporting fault trees). 

Multi-source accident sequence events trees will be quantified on an individual basis, according 

to the prioritized lists of SSIs and CCIs developed in Task 1-1. The phrase “individual basis” 

means that each event tree will be quantified separately as opposed to simultaneously solving 

all event trees in a single quantification run (as is typically done during a single-source PRA). 

The reason for using an individual basis is to obtain solutions in a reasonable timeframe, 

thereby enabling their timely review and incorporating model corrections back into the 

quantification process. (It is anticipated that the ISRA task will produce a large set of multisource logic models which will require substantial computer solution time. Quantifying the entire 

set of models at one time is not an efficient use of the available project analysts.) 

System fails 

to function

Independent random 

failures

Dependent 

failures 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-15 

During the solution of each multi-source event tree, the screening and scoping strategies 

developed in Task 2 will be used to focus on identifying and analyzing risk-significant multisource risk contributors. 

There are five supporting and interrelated subtasks for multi-source logic model solution, as 

described below. 

Task 1-6a – Success Criteria

Since the multi-source accident sequence models will be based on the single-source PRA 

models, they will reflect the success criteria used to develop those models. However, review of 

the solution of the multi-source accident sequence models may call into question some of these 

underlying success criteria. In addition, there may be a need to conduct additional success 

criteria calculations in order to obtain information about the timing or sequencing of events in the 

multi-source accident sequence models. 

Task 1-6b – Supporting Human Reliability Analysis

It is expected that dependent operator actions within each single-source PRA model will have 

been addressed during their separate analysis (Sections 12-16). The purpose of this subtask is 

to confirm that these dependencies have been retained in the simplified event trees and fault 

trees, and to analyze the possible combinations of operator actions that appear in the solution of 

the multi-source sequence models for possible dependencies. Of specific concern to the ISRA 

task is the identification of: 

1. The need for multiple concurrent operator actions at multiple sources, which may 

overburden the available personnel resources at the site 

2. Situations where site accessibility or habitability may be impaired due to the accident 

sequence (e.g., high temperature work environment, high radiation levels) 

It is anticipated that some of the human failure events (HFEs) defined in the single-source PRA 

models may not be appropriately defined when the multi-source accident sequence context is 

considered. A review of the multi-source accident sequence minimal cut sets, considering the 

information gathered in Task 1, will be used to determine if the existing HFEs need to be 

modified or if new HFEs need to be created. 

Task 1-6c – Supporting Data Analysis

Additional data needed to support the quantification of multi-source accident sequences will be 

developed during this subtask (e.g., the probability of CLOOP). 

Task 1-6d – Refine Event Tree and Fault Tree Models

It is anticipated that the multi-source accident sequence event trees and supporting fault trees 

will require revision, based on the results of the initial quantification efforts. In addition to 

correcting errors, logic model revisions may be needed to properly account for dependent 

operator actions, to accommodate sequence solution within the limitations of the SAPHIRE 

software, or to expand the simplified logic in order to achieve an appropriate level of detail in the 

analysis. The results of the simplified models developed in Tasks 1-4 and 1-5 will be compared 

to the more detailed single-source PRA results to ensure that the ISRA models have not been 

overly simplified to the point where important dependencies or risk contributors have been 

omitted. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-16 

Task 1-6e – Select Next Event and/or Site Configuration

Using the prioritized lists of SSIs and CCIs developed in Task 1-1, along with the lessons 

learned during the quantification of previous event trees, the subtask will determine the order of 

event tree quantification. 

Task 2-1 – Identify Dependencies and Common Causes 

The objective of this task is to identify dependencies among the radiological sources that are 

potentially important to the assessment of multi-source risk. Task 1-3 will generally identify 

dependencies that are important to the ISRA task as a whole and specifically to the 

development of the multi-source Level 1 PRA logic models. In contrast, this task will focus on 

identifying dependencies that are specific to development of the multi-source Level 2 PRA logic 

models. 

Analogous to Task 1-3, this task reviews plant information and the single-source PRA models in 

order to identify and understand the dependencies that have been modeled. This effort is a 

necessary prelude to the delineation of multi-source accidents sequences. Failure to account 

for multi-source dependencies will result in underestimating the frequency of the multi-source 

accident sequences. At the same time, PRA results are typically driven by dependencies; 

therefore, knowledge of the potential multi-source dependencies can be used to simplify the 

multi-source logic models so that they may be solved within a reasonable time. As in Task 1-3, 

the results of the review performed during this task will be documented in a set of dependency 

matrices. 

Task 2-2 – Identify and Prioritize Site Damage States 

The objective of this task is to identify and prioritize site damage states (SDSs). 

The reason for defining SDSs is to coalesce the results of the ISRA Level 1 PRA into a 

manageable set of accident scenarios that summarize the various core damage and fuel 

damage sequences. The SDSs will form the basis for developing the multi-source release 

event trees (RETs), which will developed in Task 2-3. In contrast to the single-source Level 2 

PRAs, the ISRA will not link each multi-source Level 1 sequence to the multi-source RETs 

because such an approach ignores the insights gained from applying the Level 1 screening and 

scoping approach, and also is likely to generate very large logic structures which cannot be 

readily solved using current PRA software. 

SDSs will be developed by combining the lists of attributes defined for each of the single-source 

damage states22. Bridging logic (either a bridge event tree or a set of Boolean rules) derived 

from the single-source RETs may be developed to assist in defining multi-source SDSs. The 

occurrence frequency of each SDS will be determining by summing the individual multi-source 

sequence frequencies that contribute to the SDS. 

 

22 For reactors, the single-source damage state is typically called a “plant damage state (PDS).” The more generic 

phrase “single-source damage state” includes both PDSs related to the reactors and their equivalents for spent fuel. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-17 

The screening and scoping strategies developed in Task 2 will be applied to prioritize the SDSs. 

Specifically, the SDSs will be rank ordered (high-to-low) according to their occurrence 

frequencies. A second rank ordering based on estimated risk (developed from consideration of 

the insights gained through review of the single-source PRA results, as developed in Task 1) 

will be developed. The final prioritization of multi-state SDSs will be made on a subjective basis, 

considering the two rank-ordered lists and incorporating the lessons learned as the multi-source 

Level 2 PRA is developed and quantified. 

Task 2-3 – Develop Simplified Release Event Trees 

The objective of this task is to develop a set of RETs that delineate multi-unit release 

sequences. The reasons for using simplified event trees include (a) achieving a model solution 

in a reasonable time period, and (b) focusing attention on identifying and analyzing risksignificant multi-source risk contributors. 

For each of the SDSs defined in Task 2-2, a simplified RET will be developed by beginning with 

the RET for the Unit 1 reactor23. The sequences in this RET that result in offsite release will be 

linked to the single-source RET for the Unit 1 SFP. Continuing the process, the fuel-damage 

releases will be linked to the Unit 2 reactor event trees, to the Unit 2 SFP, and finally to the DCS 

event trees. This order is preferred since there are dependencies between the Unit 1 reactor 

and SFP trees (electric power, service water, operator actions) and between the Unit 2 reactor 

and SFP trees. Since the RETs will be progressively quantified, applying the screening and 

scoping strategies developed in Task 2, this approach helps to ensure that dependencies are 

properly captured and assessed before sequences are screened. 

It may also be possible to develop a single multi-source RET that applies to a group of SDSs. 

This approach has the advantage that it promotes self-consistence within the analysis, which 

needs to be balanced against the additional complexity that it entails. 

A variety of techniques will be used to simplify the multi-source RETs, as discussed under 

Task 1-4. It is anticipated that the development of simplified RETs will be an iterative process, 

based on the insights obtained from initial logic model solution as previously discussed in 

Task 1-6d. 

Task 2-4 – Develop Simplified Fault Trees 

The objective of this task is to develop simplified fault trees based on the detailed fault trees 

developed during the single-source PRAs. The reasons for using simplified fault trees include 

(a) achieving a model solution in a reasonable time period, and (b) focusing attention on 

identifying and analyzing risk-significant multi-source risk contributors. 

A variety of techniques will be using to simplify the detailed single-source fault tree models, as 

discussed under Task 1-5. Dependencies among the various sources (e.g., shared support 

systems, cross-unit common-cause failures) will be incorporated into the fault trees as 

appropriate, according to the information developed in Task 2-1. It is anticipated that the 

development of simplified fault trees will be an iterative process, based on the insights obtained 

from initial logic model solution as previously discussed in Task 1-6d. 

Task 2-5 – Quantify Release Event Trees 

 

23 For reactors, the release event tree is typically called a “containment event tree (CET).” The more generic phrase 

“release event tree” includes the reactor CETs and their equivalents for spent fuel. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-18 

The objective of this task is to quantify the multi-source accident sequence models developed in 

Tasks 2-3 (multi-source release event trees) and 2-4 (supporting fault trees). 

Multi-source release event trees will be quantified on an individual basis, according to the 

prioritized list of SDSs developed in Task 2-2. The phrase “individual basis” means that each 

event tree will be quantified separately as opposed to simultaneously solving all event trees in a 

single quantification run (as is typically done during a single-source PRA). The reason for using 

an individual basis is to obtain solutions in a reasonable timeframe, thereby enabling their timely 

review and incorporating model corrections back into the quantification process. (It is 

anticipated that the ISRA task will produce a large set of multi-source logic models which will 

require substantial computer solution time. Quantifying the entire set of models at one time is 

not an efficient use of the available project analysts.) 

During the solution of each multi-source event tree, the screening and scoping strategies 

developed in Task 2 will be used to focus on identifying and analyzing risk-significant multisource risk contributors. 

There are five supporting and interrelated subtasks for multi-source logic model solution, as 

listed below. 

Task 2-5a – Success criteria 

Task 2-5b – Supporting human reliability analysis 

Task 2-5c – Supporting data analysis 

Task 2-5d – Refine event tree and fault tree models 

Task 2-5e – Select next event and/or site configuration 

These tasks are analogous to Tasks 1-6a thru 1-6e (described previously). 

Task 3-1 – Identify Dependencies and Common Causes 

The objective of this task is to identify dependencies and common causes that affect the 

development of the multi-source consequence models. 

In general, multi-source radiological release states (RRSs) can be developed by superimposing 

the single-source RRSs that participate in a given release sequence, recognizing that a multisource release sequence needs to be characterized by multiple plume segments. However, it 

must be recognized that superimposing the single-source RRSs may ignore important 

dependencies pertaining to release sequence timing (e.g., when does evacuation of the 

surrounding site actually begin?). A chronology for each multi-source RRS will be developed to 

help ensure that timing dependencies are taken into account and to provide input to the 

MACCS2 analysis (Task 3-4). 

Task 3-2 – Identify And Prioritize Radiological Release States 

The objective of this task is to identify and prioritize RRSs by utilizing the RRSs defined in the 

single-source PRA and making adjustments as needed to ensure that each multi-source RRS is 

self-consistent. 

As discussed under Task 3-1, multi-source RRSs can be developed by superimposing the 

single-source RRSs that participate in a given release sequence, recognizing that a multi-
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-19 

source release sequence needs to be characterized by multiple plume segments. In MACCS2, 

the plume segments that comprise a release can be separated by a time gap, can directly follow 

the preceding segment, or they can overlap. Different release heights, heat contents, release 

durations, and initial values for the plume dimension (σy and σz) may be assigned to each 

plume. Only one particle size distribution may be assigned to each chemical element group. 

When defining multi-source RRSs, it will be necessary to adjust some of the protective action 

parameters (in particular, those parameters that define the emergency evacuation) used in the 

single-source RRSs that comprise the multi-source RRS. It is assumed that evacuation will be 

triggered by the earliest release, regardless of which source is causing the release. 

Given the potentially large number of single-source accident sequences that encompass all 

defined plant operating states, it is necessary to direct the ISRA’s attention toward those 

sequences which have the potential to become risk-significant multi-source accident sequences. 

The following screening and prioritization strategies will be considered during this task: 

1. Rank-ordering (high-to-low) the possible multi-source release sequences according to 

their frequencies, and then focusing on the most likely sequences. 

2. Rank-ordering (high-to-low) the consequences of the single-source release sequences 

in order to predict which multi-source RRSs will have the highest consequences. A 

separate ranking needs to be made for each consequence measure addressed in the 

project. 

3. Considering the combination of RRS frequency and predicted consequences in order to 

focus attention on those RRSs that are anticipated to be significant risk contributors. 

Task 3-3 – Select RRS and Site Configuration 

The objective of this task is to implement the screening and prioritization strategies developed in 

Task 3-2 in order to select specific multi-source RRSs for subsequent analysis. It is anticipated 

that the initial prioritization scheme may be adjusted as the project proceeds in order to 

incorporate the lessons learned from previous multi-source consequence calculations. 

Task 3-4 – Develop Simplified Consequence Model 

The objective of this task is to develop the MACCS2 input deck needed to estimate the 

consequences of the multi-source RRSs selected in Task 3-3. The guidance in TAAP 

Section 12.3 will be used for the following areas: 

1. Protective action parameters and other site data (Subtask 1-3.2) 

2. Meteorological data (Subtask 1-3.3) 

3. Atmospheric transport and dispersion (Subtask 1.3-4) 

4. Dosimetry (Subtask 1.3-5) 

5. Health effects (Subtask 1-3.6) 

6. Economic factors (Subtask 1.3-7) 

Task 3-5 – Quantify Consequence Model 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-20 

The objective of this task is to quantify the consequence models developed in the previous 

steps, generating the results in the form of the consequence metrics of interest and identifying 

significant contributors to the calculated consequence measures/metrics. Guidance in TAAP 

Section 12.3, Subtask 1-3.8 (Quantification and Reporting) will be used. 

The consequences of multi-source release sequences, as calculated using MACCS2, will be 

compared to the screening estimates of consequences (made by summing the consequences of 

the individual sources that contribute to the multi-source sequences) to confirm the adequacy of 

the risk screening approach used in Task 2. 

17.5 Documentation 

The products of the ISRA task are identified below. These products (along with the identified 

inputs, Section 17.2) and the documentation requirements provided in Section 18 should be 

sufficient for an independent analyst to understand how the analysis was performed and to 

reproduce the results. Table 17-1 provides the expected products. 

Table 17-1. Integrated Site Risk Assessment Products. 

ISRA Task Description 

Task 1 Single-Source Level 1 PRA Insights 

Tasks 1 and 3-1 Single-Source Level 2/3 PRA Insights 

Task 2 Scoping and Screening Strategies 

Task 1-1 Prioritized List of Level 1 PRA Multi-Source Sequences 

Task 1-2 Site Configurations 

Tasks 1-3 and 2-1 System Dependencies Matrices 

Tasks 1-3 and 2-1 List of Common Locations 

Tasks 1-3 and 2-1 List of Multiple Operator Actions 

Tasks 1-3 and 2-1 List of Common-Cause Failures 

Task 1-4 Simplified Level 1 ISRA Event Trees 

Tasks 1-5 and 2-4 Simplified ISRA Fault Trees 

Task 1-6 Level 1 ISRA Results 

Tasks 1-6a and 2-5a ISRA Supporting Success Criteria Analysis 

Tasks 1-6b and 2-5b ISRA Supporting Human Reliability Analysis 

Tasks 1-6c and 2-5c ISRA Supporting Data Analysis 

Task 2-2 Prioritized List of Multi-Source Plant Damage States 

Task 2-3 Simplified ISRA Release Event Trees 

Task 2-5 Level 2 ISRA Results 

Task 3-2 Prioritized List of Multi-Source Radiological Release States 

Task 3-4 ISRA Consequence Models 

Task 3-5 Level 3 ISRA Results 

17.6 Task Interfaces 

The ISRA task interfaces with every project task, as shown in Figure 17-5. Thick black lines 

show the flow of information among the ISRA task (iteration loops are not shown to promote 

clarity). Development of information and models in the single-source PRAs are shown with thin 

black lines. Primary interfaces between the ISRA task and the single-source PRA tasks are 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-21 

shown with thick colored lines. Specifically, thick light blue lines show the flow of risk insights 

that will be used in Task 1 to assist in developing criteria and assumptions that will be used in 

building each part of the integrated site risk model. Thick red, green, and dark blue lines show 

the flow of single-source logic models (reactor at-power internal hazards PRA – Section 12, 

reactor at-power external hazard PRA – Section 13, reactor shutdown and low-power all 

hazards PRA – Section 14, spent fuel pool PRA – Section 15, and the dry cask storage PRA – 

Section 16) into the ISRA (Tasks 1-1 to 1-6, Tasks 2-1 to 2-5, and Tasks 3-1 to 3-5). Dashed 

black lines show the interface with tasks that support the project as a whole (success criteria – 

Section 4, systems analysis – Section 5, data analysis – Section 6, human reliability analysis – 

Section 7, structural analysis – Section 8, fragility analysis – Section 9, hazard analysis – 

Section 10, and uncertainty analysis – Section 11). Finally, quality assurance (Section 18) is 

shown as an overarching task that applies to the entire project. 

It is essential that development of the single-source PRAs be coordinated with the ISRA 

development effort to ensure that the individual pieces can be coherently integrated. 

Figure 17-5 illustrates this need (indicated by the use of double arrowheads). The review of the 

single-source PRA models and plant information sources and the compilation of risk insights 

(Task 1) will provide a detailed understanding of the single-source PRA models. The singlesource PRA models will not be directly integrated (linked together) to form the multi-source PRA 

models; rather, they provide the “raw material” used to develop the simplified ISRA PRA models 

(developed in Tasks 1-4, 1-5, 2-3, and 2-4). However, it is important to maintain functional and 

logical consistency between the more detailed single-source PRA models and the simplified 

ISRA PRA models. The following approaches will be used to achieve this end: 

1. Frequent and substantive Task Leader meetings. 

2. One-on-one meetings with other Task Leaders. 

3. Documentation of modeling issues as specified in Section 18 (Quality Assurance), and 

prompt resolution of these issues. 

4. Comparison of results to the single-source PRA results as the IRSA is progressively 

developed. 

17.7 References 

1. D. Chanin, et al., “Code Manual for MACCS2: User’s Guide,” NUREG/CR-6613, Vols. 1 

and 2, May 1998. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

17-22 

Figure 17-5. Task Interfaces and Information Flow.

Success 

Criteria

Section 4

Systems 

Analysis

Section 5

Data

Analysis

Section 6

Human 

Reliability

Section 7

Hazard 

Analysis

Section 10

Fragility 

Analysis

Section 9

Structural 

Analysis

Section 8

Uncertainty 

Analysis

Section 11

Spent Fuel Pool 

PRA

Section 15

Dry Cask Storage 

PRA

Section 16

Level 1

Tasks 1-1 to 1-6

Level 2

Tasks 2-1 to 2-5

Level 3

Tasks 3-1 to 3-5

Risk Insights

Task 1

Selection Criteria

Task 2

Reactor

At-Power

External Hazards 

PRA

Section 13

Reactor

At-Power

Internal Hazards 

PRA

Section 12

Reactor

LP&SD

All Hazards

PRA

Section 14

Level 1

Level 2

Level 3

All Hazards Supporting Tasks

External Hazards

Supporting Tasks

Integrated Site Risk Assessment

Section 17

Quality 

Assurance

Section 18

Level 1

Level 2

Level 3

Level 1

Level 2

Level 3
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-1 

18. QUALITY ASSURANCE 

Quality assurance (QA) is a key factor in any analysis to ensure and demonstrate the technical 

acceptability of the analysis and probabilistic risk assessment (PRA) model fidelity. The 

objective of QA is to ensure that both the technical approach (methods, tools, data) is 

appropriate, and that implementation of the technical approach is appropriately performed. To 

achieve this objective, QA involves the following six major elements: 

• Use of established methods, tools and data 

• Qualified personnel 

• PRA model configuration control 

• Technical review of the methods, tools, data, and developed models 

• Documentation control 

• Quality assurance program implementation audits 

18.1 Established Methods, Tools and Data 

The PRA model will generally be based on state-of-practice methods, tools (e.g., computer 

codes) and data, that is, those that have been established and accepted (including verification 

and validation where applicable) in the risk community (i.e., NRC and industry). Examples of 

sources include: 

Consensus standards 

• Internal and external guidance documents 

• Accepted generic SSC performance data (where plant specific data is not available) 

• Validated codes 

For each technical task24, the method, tools and data being used will be documented along with 

the basis for their acceptability (e.g., NRC endorsement). This documentation is identified in 

each technical task in Sections 4 through 17 of this report and described in Section 18.5. 

18.2 Qualified Personnel 

Qualified individuals are needed to perform the work. Their qualifications depend on whether 

the analyst is (1) a performer or (2) a reviewer. 

A performer is an individual who develops some aspect of the PRA model. Their role, either as 

a team leader, a task leader, or an analyst will need to have some level of expertise. Certainly, 

an analyst can develop the qualifications with on the job training; however, the task and team 

leaders need to be more experienced personnel who bring actual experience in the area they 

are leading. If an analyst has little to no experience, their work will be closely supervised and 

monitored by their task leader. PRA consensus standards and Regulatory Guide (RG) 1.20025

do not prescribe qualifications for the team performing the actual work. Moreover, one of the 

major objectives of the Level 3 PRA project is to train inexperienced staff in how to construct a 

PRA model. 

 

24 Technical tasks are the technical steps that will be performed to accomplish the technical element. 

25 Regulatory Guide1.200, “An Approach For Determining The Technical Adequacy Of Probabilistic Risk Assessment 

Results For Risk-Informed Activities,” Revision 1, U.S. Nuclear Regulatory Commission, Washington, DC, January 

2007. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-2 

A reviewer is an individual who has some role in reviewing the actual work and making 

judgments with regard to its technical acceptability. In this regard, these individuals must have 

a certain level of expertise and on the job training is not acceptable. Both RG 1.200 and the 

PRA standards provides peer review personnel qualifications. These requirements should be 

met unless otherwise justified. 

18.3 PRA Model Configuration Control 

Ensuring that the analysts are using the same information and same models and that the 

reviews are being performed on the most recent model and documentation is important in 

ensuring the fidelity of the PRA model. Developing a PRA model involves numerous tasks 

being performed by many different analysts. It is, therefore, essential that the information 

collected and the models developed for this project be controlled so that all of the analysts use 

the same information and models. The control of the developed models is discussed in this 

section. The control of information is discussed in Section 18.5. 

The Idaho National Laboratory (INL) will host and maintain the SAPHIRE-based models 

developed as part of the Level 3 PRA project. INL will provide the necessary technical 

management and oversight to ensure efforts by INL or NRC staff (including work performed by 

other NRC contractors and provided to INL by the NRC) to create, revise or otherwise modify 

the Level 3 PRA project models are coordinated and the models are properly integrated. These 

model enhancements may include the creation, addition, revision or other modification of a lowpower/shutdown model, all-hazards model (e.g., fire, external flooding, seismic, etc.), Level 2 

PRA model, multi-unit model, spent fuel pool model, or other extended model applicable to the 

construct of the overall Level 3 PRA project model. 

To the extent practicable, the methodology, quality, and philosophy used to develop the current 

set of Standardized Plant Analysis Risk (SPAR) models for the 104 operating commercial 

nuclear power plants will be used to develop the external event model, low-power/shutdown 

model, extended Level 1 PRA model, and Level 2 PRA model for the Level 3 PRA project. This 

includes model construct, event nomenclature, assumptions, preferred technical positions, and 

other key aspects of the existing models to allow NRC staff the ease of use of the models. 

INL will identify a single point of contact to act as the Level 3 PRA project model coordinator 

(“Coordinator”). The Coordinator will maintain a log and track all permanent revisions to the 

model including the reason for the revision, assumptions, deviations from preferred technical 

positions, and any other information deemed important to understanding the model or the 

revision to the model. The Coordinator will ensure that the appropriate model revision is being 

used and that the effort results in a properly integrated model. The Coordinator will also 

coordinate INL model integration activities. Version control software, suitable to this task and 

with sufficient documentation capabilities, may be used by INL, subject to approval by the NRC 

staff. 

When multiple revisions to the enhanced Vogtle model are planned by INL or NRC staff, INL will 

coordinate the activities of the different modelers. This is to ensure that the model developers 

use the appropriate model version(s) and that the final product does not include models that 

were constructed based on an obsolete model version. 

INL will also perform quality control (QC) and quality assurance (QA) reviews of the new or 

revised models. This is to ensure that the model represents the as built, as operated plant to 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-3 

the extent practicable. The same quality assurance criteria and processes used for the existing 

SPAR models shall be used to review the Level 3 PRA project models. This includes (as 

appropriate) satisfying the criteria and processes in the Standardized Plant Analysis Risk 

(SPAR) Model Quality Assurance Plan,

26 the latest approved INL QC/QA processes, applicable 

sections of Volume 3 of the RASP Handbook,

27 RG 1.200, and other applicable guidance.28

18.4 Technical Reviews 

In ensuring technical acceptability, different types of review will be performed. These include: 

• review by a Technical Advisory Group 

• internal self-assessment 

• external peer review 

• review by the Advisory Committee on Reactor Safeguards 

Each of these reviews has different objectives and scope which are described below. 

18.4.1 Technical Advisory Group 

The objective of the Technical Advisory Group (TAG), as specified in the TAG charter,29 is to: 

(1) review progress in the development of the Level 3 PRA, and (2) provide insight, advice, and 

guidance on (a) the technical bases, tools, methods, models, and data for the project, (b) the 

interpretation of the results of the various PRA models and the overall PRA model, (c) the 

resolution to the self-assessment, and (d) the response to comments received from the external 

peer reviews of the study. In this role, the TAG will serve as an ongoing review team that will 

provide review and feedback as the project progresses. 

As stated earlier, the approach used for the Level 3 PRA project will be based on plant 

information and established methods, tools and data. Where the plant information or the 

methods, tools or data do not exist to develop certain aspects of the PRA model, other sources 

such as expert opinion will be used. The TAG will play a key role in addressing the acceptability 

of such proposed approaches. Furthermore, it is expected that the TAG will play a fundamental 

role in resolving technical or programmatic issues that may arise. 

In its review responsibility, the TAG will review the TAAP to provide feedback on the approach 

being used to perform the work. Moreover, the TAG will review the results of the project team 

self-assessments to provide an independent assessment of the work performed. 

The TAG will consist of senior technical staff in the area of PRA, and in supporting technical 

areas (e.g., seismic hazard and plant response), as well as an experienced PRA representative 

 

26 “Standardized Plant Analysis Risk (SPAR) Model Quality Assurance Plan,” Revision 0, U.S. Nuclear Regulatory 

Commission, Washington, DC, September 2006 (not publicly available). 

27 “Risk Assessment of Operational Events Handbook, Volume 3 – SPAR Model Reviews,” Revision 1, U.S. Nuclear 

Regulatory Commission, Washington, DC, September 2007 (not publicly available). 

28 For example: American Nuclear Society, “American National Standard External-Events PRA Methodology,” 

ANSI/ANS-58.21-2003, December 2003.

29 Charter for the Technical Advisory Group on the Full-Scope Site Level 3 Probabilistic Risk Assessment Project, 

ADAMS Accession Number ML120410123 (not publicly available). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-4 

from the Electric Power Research Institute and from industry. RES/DRA staff will chair and 

coordinate the TAG, which will meet periodically. The TAG Chairman will be responsible for 

leading and moderating the TAG meetings, and will serve as the TAG spokesperson, as 

necessary, in briefings to NRC and project management. The TAG Coordinator, in consultation 

with the Level 3 PRA Project Program Manager and the TAG Chairman, will develop and 

disseminate the agenda for each TAG meeting. The TAG Coordinator will also be responsible 

for organizing and recording the minutes of the TAG meetings and maintaining an electronic 

repository to provide reports, publications, and other technical information as background for all 

TAG meetings. 

Table 18-1 provides a template for the TAG review documentation. This template (or a similar 

documentation format) is to be used to document the results of the TAG reviews performed for 

the Level 3 PRA project. 

Table 18-1 TAG Review Documentation Template 

SR Finding Level of Significance 

and Basis 

Recommended 

Resolution 

Implemented Resolution 

Reviewer: Responsible Analyst: 

Risk Source: Hazard: [e.g., internal events] Level: [1, 2 or 3] 

Technical Element: Date: 

 

 

● High Significance -- An issue needing resolution to ensure the technical adequacy of the PRA, the capability 

of the PRA, or the robustness of the PRA update process. 

● Medium Significance -- An issue whose resolution is needed to maintain maximum flexibility in PRA 

applications and consistency with Industry practices (as endorsed by the NRC) or simply to enhance the 

PRA’s technical capability as time and resources permit. It is unlikely that the technical adequacy of the PRA 

is impacted. 

● Low Significance -- An issue that does not impact the technical adequacy of the PRA. 

Describe the 

finding, what is 

the issue, why it 

is a concern; 

explanation 

needs to clearly 

explain the 

concern and the 

basis for the 

concern. 

Describe the 

recommendation 

to resolve the 

concern; the 

explanation 

needs to be 

sufficiently 

detailed so that 

the analyst 

understands 

what needs to be 

revised in the 

PRA to resolve 

the concern. 

Analyst 

describes the 

response to the 

finding and 

recommendation, 

describing how it 

was resolved; the 

explanation 

should not be 

just an “accept,” 

but an 

explanation of 

exactly how it 

was resolved 

(e.g., how the 

PRA model was 

revised). 

The level of 

significance of 

the concern 

should be listed 

including the 

basis for level of 

significance 

assessed; see 

below for 

explanation of 

significance. 

List the applicable supporting requirement (SR) 

using the standard index number; if an SR is not 

applicable, then use the technical element 2 to 4 

digit abbreviation (xxxx) and the finding numbered 

sequentially (yy) with an “T” (i.e., xxxx-yy-T). If 

criteria were developed and used, then reference 

the criterion number (see Table 18-2). 

Reactor, Spent Fuel Pool, Dry Cask Storage, Integrated Risk 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-5 

18.4.2 Internal Self-Assessment 

The objective of the internal self-assessment is to further ensure the technical acceptability of 

the work as the PRA model is being developed. The PRA model will be developed based on 

established and accepted methods, tools, and data as documented in, for example, consensus 

standards and guidance documents. For each technical element, a review of the work is 

performed using the process described below. 

The full-scope site Level 3 PRA model consists of models developed by the SNC for Vogtle 

Units 1 and 2, and those developed internally by the NRC. Parts of the Vogtle PRA model have 

received an industry peer review, using the ASME/ANS Level 1 PRA Standard.30 The selfassessment process will take advantage of the industry peer review. Figure 18-1 provides the 

process for self-assessment. This process involves 9 steps as discussed below. 

Figure 18-1 Process Used for Self-Assessment 

 

30 ASME/ANS RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power 

Plant Applications,” Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, 

February 2009. 

PRA model (technical task) 

acceptable 

Perform a 

complete selfassessment 

No

No

No

No 

Yes 

Yes 

Yes

Was the scope of the 

peer review adequate?

Was an independent 

industry peer review 

performed? 

Step 1: Step 2: 

Step 3: 

Step 4: Step 5: 

Step 6: 

Step 7: 

Yes 

Step 8: 

Focus self-assessment on 

missing scope and where 

did not meet RG 1.200 

Were the peer review 

findings adequately 

addressed or not 

significant? 

Did the process used for the 

peer review meet RG 

Revise PRA model 

(technical task) 

accordingly 

Document the resolution of the 

findings and the self assessment 

TAG reviews results of selfassessment; address comments 

and document the resolution 

Step 9: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-6 

Generally the self-assessment is performed by the technical element leader, responsible 

analyst, or may be performed by an internal NRC “team.” If the work is performed by a 

contractor, the self-assessment is performed by an NRC team (with contractor support). The 

purpose of using an NRC team instead of the contractor to perform the self-assessment is for 

the NRC to have ownership of the work; that is, to understand the details of constructing the 

model. 

In Step 1, the self-assessment reviewer (or team) determines whether an independent industry 

peer review was performed. This decision will determine the scope of the self-assessment; that 

is, the analyst is determining whether the self-assessment can take advantage of the 

independent peer review performed on the Vogtle PRA. If an independent peer review was not 

performed, then the reviewer needs to perform a complete self-assessment (Step 2). If an 

independent peer review was performed, then the adequacy of the peer review needs to be 

assessed (Step 3). 

In Step 2, the self-assessment is performed using the guidance in RG 1.200. As such, the selfassessment: 

• Uses a set of desired PRA characteristics and attributes as the basis for review 

• Uses a minimum list of review topics to ensure coverage, consistency, and uniformity 

• Reviews PRA methods 

• Reviews application of methods 

• Reviews assumptions and assesses their validity and appropriateness 

• Determines if the PRA represents as-built and as-operated plant 

• Reviews results of each PRA technical element for reasonableness 

• Reviews PRA maintenance and update process 

• Reviews PRA modification attributable to use of different model, techniques, or tools 

• Reviews against modifications to the standard, if there is a standard 

In evaluating the above, if a standard exists, then the requirements in the standard are used as 

the basis for the self-assessment in determining whether, for example, the desired attributes 

and characteristics provided in RG 1.200, Section 1 are met. If a PRA standard does not exist 

for a particular hazard or technical element, then criteria are developed to perform the selfassessment. These criteria are detailed enough to judge the technical acceptability of the work. 

They should be of consistent detail as in the standard for hazards or technical elements 

addressed by a standard. These criteria are documented using Table 18-2 (or a similar 

documentation format). Once the self-assessment (Step 2) is complete, the reviewer should go 

to Step 8 to document the results. 

Table 18-2 Self-Assessment and Peer Review Criteria Where Standards Do Not Exist 

Criteria 

# 

Criteria 

Source of Risk: Hazard: 

PRA Level: Technical Element: 

 

In numbering the criteria, use the technical element 2-4 digit abbreviation (xxxx) 

and the criteria numbered sequentially (yy) with a “C” (i.e., xxxx-yy-C). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-7 

In Step 3, the reviewer identifies whether the scope of the peer review was adequate. If it is 

determined that the scope is inadequate then the reviewer should perform a self-assessment of 

the missing scope items (Step 5). If the scope of the peer review was adequate, then it needs 

to be determined if the peer review itself was adequate (Step 4). 

In Step 4, the self-assessment reviewer determines if the industry peer review process meets 

the staff position in RG 1.200. To make this determination, the reviewer should: 

● Review the findings for reasonableness 

● Perform spot checks using the guidance in RG 1.200. For example, one of the 

guidelines is “the peer review determines whether the methods were applied correctly.” 

In Step 5, the reviewer performs a focused self-assessment; that is, the reviewer evaluates the 

findings determined not to be reasonable. This focused self-assessment will follow the same 

process for a full self-assessment (Step 2). In addition, if it was determined from the spot 

checks that the guidance in RG 1.200 was not met, then the reviewer should perform a more 

thorough self-assessment against RG 1.200. 

In Step 6, the reviewer determines if the findings from the peer review were addressed and if 

they appropriately addressed the issue. If the peer review findings were adequately addressed 

or were not adequately addressed but determined not to be significant to the PRA, then the 

reviewer goes to Step 8 to document the self-assessment. If the peer review findings are 

determined to not be adequately addressed and are significant to the PRA, then the reviewer 

needs to revise the PRA model to correct the issue (Step 7). 

Significance can be determined both qualitatively and quantitatively, as follows: 

Qualitative – 

• The finding can result in changing the basic structure of the PRA model (e.g., success 

criteria such that the accident sequence progression is changed, different initiating 

events and/or frequencies, different human events and/or frequencies, different 

equipment failure probabilities). 

Quantitative – 

• Significant accident sequences are impacted. A significant sequence is one of the set of 

sequences, defined at the functional or systemic level that, when ranked, compose 95% 

of the core damage frequency (CDF) or the large early release frequency/large release 

frequency (LERF/LRF), or that individually contribute more than ~1% to the CDF or 

LERF/LRF. 

• Significant basic event/contributors are impacted. Significant basic events (i.e., 

equipment unavailabilities and human failure events) are those that have a FussellVesely31 importance greater than 0.005 or a risk-achievement worth greater than 2. 

 

31 Risk Reduction Worth: “The decrease in risk if a plant feature (e.g., system or component) were assumed to be optimized or were 

assumed to be made perfectly reliable. Depending on how the decrease in risk is measured, the risk reduction worth can either be 

defined as a ratio or an interval.” Risk Achievement Worth: The increase in risk if a plant feature (e.g., system or component) was 

assumed to be failed or was assumed to be always unavailable. Depending on how the increase in risk is measured, the risk 

achievement worth can either be defined as a ratio or an interval. Sometimes risk achievement worth is referred to as “risk 

increase.” Fussell-Vesely: For a specified basic event, Fussell-Vesely importance is the relative contribution of a basic event to the 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-8 

In Step 7, the reviewer revises the PRA model to resolve the inadequacy. After the PRA is 

revised, the reviewer goes to Step 8 to document the self-assessment. 

In Step 8, the reviewer documents the self-assessment using Tables 18-3 and 18-4 (or a similar 

documentation format). Table 18-3 can be generated using the ePSA Risk and Reliability 

software. This program populates some of the fields in the table automatically based on the 

ASME/ANS Level 1 PRA standard. For those parts of the PRA not covered by this standard, 

the ePSA software cannot be used, and the analyst will have to create the table using the 

template and the criteria developed and documented in Table 18-2. The purpose of Table 18-4 

is to provide a high level summary of the conclusions of the self-assessment. 

After Step 8, the initial self-assessment is complete. 

Table 18-3 Self-Assessment Documentation Template 

Section Finding 

ID 

Level Cat II 

Requirement 

SelfAssessment Finding Comment Resolution 

 

 

H High Significance -- An issue needing resolution to ensure the technical adequacy of the PRA, the capability 

of the PRA, or the robustness of the PRA update process. 

M Medium Significance -- An issue whose resolution is needed to maintain maximum flexibility in PRA 

applications and consistency with Industry practices (as endorsed by the NRC) or simply to enhance the 

PRA’s technical capability as time and resources permit. It is unlikely that the technical adequacy of the PRA 

is impacted. 

L Low Significance -- An issue that does not impact the technical adequacy of the PRA. 

 calculated risk. This relative or fractional contribution is obtained by determining the reduction of setting the probability of the basic 

event to zero. Birnbaum Importance: “An indication of the sensitivity of the accident sequence frequency to a particular basic 

event.” 

Describe the assessment, describe what was done, whether a concern was found or not. Describe the concern, 

why it is a concern; explanation needs to clearly explain the concern and the basis for the concern. If no 

concern is found, describe the basis for why it is believed the requirement (or criterion) was met. Describe the 

proposed fix to resolve the concern; the explanation needs to be sufficiently detailed so that it is understood 

what needs to be revised in the PRA to resolve the concern.

The level of significance of the concern should be listed including the basis for 

level of significance assessed; see below for explanation of significance. 

The supporting requirement for Capability Category II from the 

ASME/ANS Level 1 PRA standard is generated automatically if 

using the ePSA software; however, if this standard does not apply, 

the template is used and the defined criteria are entered manually 

f T bl 18 2

As a result of the self-assessment, if a 

concern is found, i.e., a “finding,” then 

a “Y” is marked; if there is no finding, 

then an “N” is marked. 

Analyst describes the response to the finding and the proposed fix, describing how 

it was resolved; the explanation should not be just an “accept,” but an explanation 

of exactly how it was resolved (e.g., how the PRA model was revised). 

Any additional explanations that 

are relevant to the selfassessment are discussed. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-9 

Table 18-4 Overall Results of Self-Assessment Process 

# Criteria Conclusion 

Reviewer: Responsible Analyst: 

Risk Source: Hazard: Level: 

Technical Element: Date: 

Vogtle Industry Peer Review 

1 Was an independent peer review 

performed on the Vogtle PRA? 

2 Was the scope of the peer review 

adequate? 

3 Did the peer review meet the staff 

position defined in Regulatory Guide 

1.200 for an acceptable peer review? 

4 Were the peer review findings 

adequately addressed in the PRA? 

General Conclusions 

5 Is the identified list of information 

needed to accomplish the task 

reasonably complete? 

6 Does the plant information 

appropriately represent the as-built 

and as-operated plant? 

7 Was the plant information used in an 

acceptable manner? 

8 Are the assumptions for each task 

identified? 

9 Are the assumptions for each task 

adequately justified (appropriate)? 

10 Do the results (both interim and final) 

appear reasonable given the design, 

operation and historical performance 

of the plant? 

Specific Conclusions 

In Step 9, the TAG reviews the results of the self-assessment. The TAG uses Tables 18-3 and 

18-4 in their review process. A completed self-assessment table for each technical element will 

be provided to the TAG with space for the TAG to document and track their comments. The 

analyst then addresses the comments of the TAG and revises the PRA model as appropriate, 

and documents the resolution of the TAG comments. At this point, the self-assessment is 

complete. 

The elements of the Level 1 PRA that require complete or focused review can be assessed 

using the guidance in RG 1.200 supported by the requirements provided in the ASME/ANS PRA 

Standard. For those aspects of the PRA models that do not have a final consensus standard, 

but do have a standard that is being developed, they will be reviewed using the high level 

requirements stipulated in the latest draft of the specific standards. This process will be used 

for the self-assessment review of the Level 2, Level 3, and low power and shutdown PRA. The 

PRA models for which a standard does not exist or is not being developed (i.e., dry cask 

Describe the conclusion and the basis for the 

conclusion; may refer to self-assessment table.. 

Describe unique or specific conclusions, if any, 

and the basis for the conclusion.
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-10 

storage [DCS], spent fuel pool [SFP]), elements of these models that have similar bases as 

compared to those of the Level 1 PRA (e.g., initiating event analysis, data analysis, human 

reliability analysis, accident sequence analysis, consequence analysis, source term 

determination, quantification/uncertainty analysis, etc.) can be reviewed using the requirements 

for the similar technical areas in the Level 1 through Level 3 PRA standards bearing in mind the 

differences in the requirements related to reactor versus those for the DCS/SFP. 

 

For example, the initiating event analysis for a SFP PRA uses similar techniques and processes 

as those used for a Level 1 reactor PRA. The high level requirements for the reactor PRA 

model can be used for the SFP PRA model (the specifics of SFP are presented in parenthesis) 

as indicated below: 

HLR-IE-A – The initiating event analysis shall provide a reasonably complete identification of 

initiating events. 

HLR-IE-B – The initiating event analysis shall group the initiating events so that events in the 

same group have similar mitigation requirements to facilitate an efficient but 

realistic estimation of CDF (fuel damage frequency) 

HLR-IE-C – The initiating event analysis shall estimate the annual frequency of each initiating 

event or initiating event group 

Individual supporting requirements can be tailored for use in SFP PRA self-assessment. The 

only item that needs special attention is the assignment of capability categories for each 

supporting requirement. It is recognized that a PRA may not satisfy each technical requirement 

to the same degree (i.e., capability category as used in the ASME/ANS Level 1 PRA Standard), 

that is, the capability category achieved for the different technical requirements may vary. This 

variation can range from (1) the minimum needed to meet the attributes and characteristics 

(e.g., high level requirements in the ASME/ANS Level 1 PRA Standard) for each technical 

element, to (2) the minimum needed to meet the current good practices for each technical 

element, to (3) the minimum required to meet the state-of-the-art for each technical element. 

Furthermore, which capability category is needed to be met for each technical requirement is 

dependent on the specific application. In general, the staff anticipates that current good practice, 

i.e., Capability Category II of the ASME/ANS Level 1 PRA Standard, is the level of detail that is 

adequate for the majority of applications. However, for some applications, Capability Category I 

may be sufficient for some requirements, whereas for other applications it may be necessary to 

achieve Capability Category III for specific requirements. For the SFP PRA, capability 

categories similar to those used in the ASME/ANS Level 1 PRA standard will be used. 

Table 18-5 provides an example self-assessment process for the SFP PRA. In the absence of 

any standard, the technical elements of the SFP PRA defined in Section 15 of the this report are 

compared to the similar elements of the Level 1 reactor at-power internal events PRA discussed 

in the ASME/ANS Standard. Tables 18-5 and 18-6 identify both the high level requirements and 

the supporting requirements that are common and applicable for the self-assessment review of 

the SFP PRA. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-11 

Table 18-5 Example: Mapping of the Technical Elements High Level 

Requirements (HLR) of SFP PRA and At-Power Level 1 PRA

Task 

# 

At-Power Level 1 PRA Technical 

Elements (HLR) SFP PRA Technical Elements 

1 IE Analysis IE Analysis 

• Identification 

• Grouping 

• Analysis 

• Identification32

• Grouping 

• Analysis 

• Operating Cycle Discretization 33

2 Accident Sequence Analysis Accident Sequence Analysis

• CDF Accident Scenario Description 

• Treatment of Dependencies 

• Fuel Uncovery Accident Scenario 

Description 

• Treatment of Dependencies 

3 Systems Analysis Systems Analysis

• Treatment of Causes for System failure 

• Treatment of CCF 

• Treatment of Dependencies 

• Treatment of Causes for System Failure 

• Treatment of CCF 

• Treatment of Dependencies 

4 Success Criteria Structural Analysis

• Defining Overall SSC and Human 

Action Success Criteria 

• Using Thermal/Hydraulic, Structural and 

other supporting Engineering Bases to 

Drive SC 

• Defining Overall SSC and Human Action 

Success Criteria 

• Using Thermal/Hydraulic, Structural and 

other supporting Engineering Bases to Drive 

SC 

• Identification of FP failure modes and 

locations 

• SFP Structural Integrity Analysis 

• SSCs Structural Integrity Analysis 

5 Data Analysis Data Analysis 

6 Human Reliability Analysis Human Reliability Analysis 

• Identifying routines of activities 

• Screening of activities 

• Defining HFEs 

• Assessing HFE Probability 

• Identifying Operator Accident Response 

• Defining Response HFEs 

• Assessing Response HFE Probability 

• Modeling Recovery Actions 

• Identifying routines of activities 

• Screening of activities 

• Defining HFEs 

• Assessing HFE Probability 

• Identifying Operator Accident Response 

• Defining Response HFEs 

• Assessing Response HFE Probability 

• Modeling Recovery Actions 

7 Quantification Quantification

 

32 Includes hazard and low-likelihood event screening. 

33 Discretizing the reactor operating cycle into a finite set of operating cycle phases (OCPs) can be considered to be 

akin to the plant operating states considered in a low power and shutdown PRA, with respect to the amount of 

decay heat that needs to be considered. This process determines the time available to respond to an accident, 

before fuel damage occurs. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-12 

Table 18-6 Applicability of Supporting Requirements of the At-Power Level 1 PRA to 

the SFP PRA 

Technical 

Element HLR 

Supporting 

Requirement 

Applies 

(Y/N) Comment 

1 IE-A IE-A1 Y Except instead of core damage (CD) it 

considers fuel damage (FD) 

IE-A2 Y Except the IE categories reduce to fuel 

uncovery and loss of power 

IE-A3 Y 

IE-A4 Y 

IE-A5 Y 

IE-A6 Y 

IE-A7 Y

IE-B IE-B1 Y 

IE-B2 Y

IE-B3 Y 

Note: The timing and the effect on the 

operability and performance of operators 

and relevant mitigating systems is one 

criterion to consider. The operating cycle 

discretization influences this timing factor.

IE-B4 Y 

IE-B5 N

IE-C IE-C1 Y 

IE-C2 Y 

IE-C3 Y 

IE-C4 Y 

IE-C5 Y 

IE-C6 Y Screening the low-frequency events 

IE-C7 Y 

IE-C8 Y 

IE-C9 Y 

IE-C10 Y 

IE-C11 Y 

IE-C12 Y 

IE-C13 Y 

IE-C14 N 

2 AS-A AS-A1 Y 

AS-A2 Y 

Except that instead of preventing core 

damage, fuel damage should be 

considered 

AS-A3 Y 

AS-A4 Y 

AS-A5 Y 

AS-A6 Y

AS-A7 Y 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-13 

Table 18-6 Applicability of Supporting Requirements of the At-Power Level 1 PRA to 

the SFP PRA 

Technical 

Element HLR 

Supporting 

Requirement 

Applies 

(Y/N) Comment 

AS-A8 Y 

Except that instead of the core damage 

end state, the fuel damage end state 

should be considered 

AS-A9 Y 

AS-A10 Y 

AS-A11 Y 

AS-B AS-B1 Y 

AS-B2 Y Except for examples 

AS-B3 Y 

AS-B4 Y 

AS-B5 Y 

AS-B6 Y 

AS-B7 Y Except examples (b) and (c) 

3 SC-A SC-A1 N Applies to fuel damage 

SC-A2 Y Modifies the parameters and SCs to be 

used in determining the fuel damage

SC-A3 Y 

SC-A4 Y If applicable

SC-A5 Y 

SC-A6 Y 

SC-B SC-B1 Y 

SC-B2 Y 

SC-B3 Y 

SC-B4 Y Except for fuel damage 

SC-B5 Y 

4 SY-A SY-A1 Y 

SY-A2 Y 

SY-A3 Y

SY-A4 Y 

SY-A5 Y Except for fuel damage 

SY-A6 Y 

SY-A7 Y 

SY-A8 Y 

SY-A9 Y 

SY-A10 Y 

SY-A11 Y 

SY-A12 Y 

SY-A13 Y 

SY-A14 Y 

SY-A15 Y 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-14 

Table 18-6 Applicability of Supporting Requirements of the At-Power Level 1 PRA to 

the SFP PRA 

Technical 

Element HLR 

Supporting 

Requirement 

Applies 

(Y/N) Comment 

SY-A16 Y 

SY-A17 Y

SY-A18 Y 

SY-A19 Y

SY-A20 Y 

SY-A21 Y

SY-A22 Y 

SY-A23 Y 

SY-A24 Y 

SY-B SY-B1 Y 

SY-B2 Y 

SY-B3 Y 

SY-B4 Y 

SY-B5 Y 

SY-B6 Y 

SY-B7 Y 

SY-B8 Y 

SY-B9 Y 

SY-B10 Y 

SY-B11 Y 

SY-B12 Y

SY-B13 Y 

SY-B14 Y

SY-B15 Y 

5 HR-A HR-A1 Y 

HR-A2 Y 

HR-A3 Y 

HR-B HR-B1 Y 

HR-B2 Y 

HR-C HR-C1 Y 

HR-C2 Y 

HR-C3 Y 

HR-D HR-D1 Y

HR-D2 Y 

HR-D3 Y

HR-D4 Y 

HR-D5 Y

HR-D6 Y 

HR-D7 Y 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-15 

Table 18-6 Applicability of Supporting Requirements of the At-Power Level 1 PRA to 

the SFP PRA 

Technical 

Element HLR 

Supporting 

Requirement 

Applies 

(Y/N) Comment 

HR-E HR-E1 Y 

HR-E2 Y Except for preventing or mitigating fuel 

damage 

HR-E3 Y 

HR-E4 Y 

HR-F HR-F1 Y 

HR-F2 Y 

HR-G HR-G1 Y 

HR-G2 Y

HR-G3 Y 

HR-G4 Y

HR-G5 Y 

HR-G6 Y 

HR-G7 Y 

HR-G8 Y 

HR-H HR-H1 Y 

HR-H2 Y 

HR-H3 Y 

6 DA-A DA-A1 Y 

DA-A2 Y 

DA-A3 Y

DA-A4 Y 

DA-B DA-B1 Y

DA-B2 Y 

DA-C DA-C1 Y

DA-C2 Y 

DA-C3 Y 

DA-C4 Y 

DA-C5 Y 

DA-C6 Y 

DA-C7 Y 

DA-C8 Y 

DA-C9 Y 

DA-C10 Y 

DA-C11 Y 

DA-C12 Y 

DA-C13 Y 

DA-C14 Y 

DA-C15 Y 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-16 

Table 18-6 Applicability of Supporting Requirements of the At-Power Level 1 PRA to 

the SFP PRA 

Technical 

Element HLR 

Supporting 

Requirement 

Applies 

(Y/N) Comment 

DA-C16 Y 

DA-D DA-D1 Y

DA-D2 Y 

DA-D3 Y

DA-D4 Y 

DA-D5 Y

DA-D6 Y 

DA-D7 Y 

DA-D8 Y 

7 QU-A QU-A1 Y 

QU-A2 Y Except for fuel damage frequency 

QU-A3 Y Except for fuel damage frequency 

QU-A4 Y Except for fuel damage frequency 

QU-A5 Y

QU-B QU-B1 Y 

QU-B2 Y

QU-B3 Y The example applies to fuel damage 

frequency 

QU-B4 Y 

QU-B5 Y 

QU-B6 Y Except for fuel damage frequency

QU-B7 Y 

QU-B8 Y

QU-B9 Y 

QU-B10 Y

QU-C QU-C1 Y 

QU-C2 Y 

QU-C3 Y 

QU-D QU-D1 Y 

QU-D2 Y 

QU-D3 Y 

QU-D4 Y 

QU-D5 Y 

QU-D6 Y Except for fuel damage frequency 

QU-D7 Y 

QU-E QU-E1 Y 

QU-E2 Y 

QU-E3 Y Except for fuel damage frequency 

QU-E4 Y 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-17 

18.4.3 External Peer Review 

The objective of the external peer review is to provide an independent review of the technical 

acceptability of the developed PRA model and its results. 

In order to allow peer review findings to be addressed in a timely manner, external peer reviews 

will be conducted at various points throughout the performance of the Level 3 PRA project. This 

approach, as opposed to performing one large, comprehensive external peer review at the end 

of the project, will minimize the extent of potential re-work. 

Where PRA standards (either “final” or “draft for trial use”) are available, they will provide the 

basis for the peer review. The reviews will be performed consistent with the process described 

in RG 1.20034 and supplemented with associated interim staff guidance (i.e., for screening 

external events and for treatment of uncertainties). If a standard is in “draft for trial use” stage, 

the peer review part of the standard will be reviewed and additional guidance will be developed, 

if needed, to make it acceptable to the staff. The process and scope of the peer review will be 

documented prior to each peer review and provided to the peer review team. Table 18-7 

provides a suggested format for documenting the peer review findings (it is the same as the 

TAG review documentation template previously provided as Table 18-1). 

It is initially envisioned that external peer reviews will be performed at the following points in the 

project timeline: 

• Upon completion of the reactor Level 1 PRA analysis for internal events and internal floods 

for at-power conditions, one unit 

• Upon completion of the reactor Level 1 PRA analysis for internal fires and external hazards 

for at-power conditions, and for internal and external hazards for low power and shutdown 

conditions, one unit 

• Upon completion of the reactor Level 2 PRA analysis for internal and external hazards for all 

operating modes, one unit 

• Upon completion of the reactor Level 3 PRA analysis for internal and external hazards for all 

operating modes, one unit 

• Upon completion of the Level 1, 2, and 3 PRA analysis for spent fuel pools and dry cask 

storage 

• Upon completion of the Level 3 PRA analysis of integrated site risk 

 

 34Regulatory Guide 1.200, Rev. 2, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment 

Results for Risk-Informed Activities,” March 2009. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-18 

Table 18-7 External Peer Review Documentation Template 

SR Finding Level of Significance 

and Basis 

Recommended 

Resolution 

Implemented Resolution 

Reviewer: Responsible Analyst: 

Risk Source: Hazard: [e.g., internal events] Level: [1, 2 or 3] 

Technical Element: Date: 

 

 

● High Significance -- An issue needing resolution to ensure the technical adequacy of the PRA, the capability 

of the PRA, or the robustness of the PRA update process. 

● Medium Significance -- An issue whose resolution is needed to maintain maximum flexibility in PRA 

applications and consistency with Industry practices (as endorsed by the NRC) or simply to enhance the 

PRA’s technical capability as time and resources permit. It is unlikely that the technical adequacy of the PRA 

is impacted. 

● Low Significance -- An issue that does not impact the technical adequacy of the PRA. 

The external peer review teams will be comprised of individuals who are independent from the 

project. It is envisioned that the external peer reviews will be performed by industry (e.g., the 

PWR Owners’ Group, consultants, University staff), supplemented by NRC staff, in particular, 

Regional senior reactor analysts (SRAs). The results of the external peer reviews will be 

documented using Table 18-7 and will be provided to the Level 3 Program Manager and to the 

Document Controller. The Program Manager will provide the external peer review findings to 

each Task Leader who will review and document how each finding will be resolved. 

18.4.4 Advisory Committee on Reactor Safeguards 

The objective of the Advisory Committee on Reactor Safeguards (ACRS) review for the Level 3 

PRA project is to: (1) monitor progress in the development of the Level 3 PRA and (2) provide 

Describe the 

finding, what is 

the issue, why it 

is a concern; 

explanation 

needs to clearly 

explain the 

concern and the 

basis for the 

concern. 

Describe the 

recommendation 

to resolve the 

concern; the 

explanation 

needs to be 

sufficiently 

detailed so that 

the analyst 

understands 

what needs to be 

revised in the 

PRA to resolve 

the concern. 

Analyst 

describes the 

response to the 

finding and 

recommendation, 

describing how it 

was resolved; the 

explanation 

should not be 

just an “accept,” 

but an 

explanation of 

exactly how it 

was resolved 

(e.g., how the 

PRA model was 

revised). 

The level of 

significance of 

the concern 

should be listed 

including the 

basis for level of 

significance 

assessed; see 

below for 

explanation of 

significance. 

List the applicable supporting requirement (SR) 

using the standard index number; if an SR is not 

applicable, then use the technical element 2-4 digit 

abbreviation (xxxx) and the finding numbered 

sequentially (yy) with an “P” (i.e., xxxx-yy-P). If 

criteria were developed and used, then reference 

the criterion number (see Table 18-2). 

Reactor, Spent Fuel Pool, Dry Cask Storage, Integrated Risk
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-19 

insight, advice, and guidance on the technical bases, tools, methods, models, and data for the 

project, as well as on interpretation of the study results. The ACRS Reliability and PRA 

Subcommittee will be briefed approximately twice a year to obtain their feedback on the 

technical approaches and assumptions employed in the Level 3 PRA project. The 

Communications Team Leader is responsible for summarizing the recommendations from the 

ACRS after each meeting. 

18.5 Documentation Control 

Documentation control is a key factor in any analysis to ensure and demonstrate the technical 

acceptability of the analysis. For each technical task, the method, tools, data and other 

information being used will be documented along with the basis for their acceptability (e.g., NRC 

endorsement). The documentation for each technical task is identified in Sections 4 through 17 

of this report, and the document control process for this project is described in this section. 

As mentioned above, the information to be documented includes the following: 

• Methods 

• Tools 

• Data 

• Other information - this includes the various information (other than methods, tools and 

data) used to develop the PRA model; for example: 

o plant design information reflecting the normal and emergency configurations of 

the plant 

o plant operational information with regard to plant procedures and practices 

o plant history (plant, system and component performance) 

o plant test and maintenance procedures and practices 

o engineering aspects of the plant design 

Given the large amount of information of various types required to construct and report the 

results of the Level 3 PRA project, an appropriate medium is needed to store and access this 

information. This medium has to have the ability for the project analysts to store, retrieve, edit, 

and control the information. SharePoint has been selected to be the medium, and the primary 

repository for Level 3 PRA project information will be referred to as the Level 3 PRA SharePoint 

site. 

Two Level 3 PRA project team members will primarily be responsible for document control, the 

SharePoint Manager and the Documentation Coordinator. The SharePoint Manager will be in 

charge of the various tasks needed to ensure SharePoint runs smoothly and remains organized, 

while the Documentation Coordinator will receive information from the licensee, process it, and 

ensure that the information gets to contractors and the SharePoint site in a reasonable 

timeframe, as well as ensure that vital information is routinely backed up. 

Documentation control for this project involves the following major elements, each of which is 

described in a separate section below:

• Storing and accessing project information 

• Upload of information onto the SharePoint site 

• Storage and control of licensee information 

• Documentation backup 

• Use of external media 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-20 

• Individual personal working files 

• Use of templates and forms for documentation 

• Site Visits 

• Documentation control for NRC Contractors 

• Non-disclosure agreement to allow access to proprietary information 

• Project document marking 

• Guidance for addressing potential technical issues 

• Future plant modifications 

• Organization of the various types of information on the SharePoint site 

18.5.1 Storing and Accessing Project Information 

As mentioned above, SharePoint has been selected as the medium to store and access the 

Level 3 PRA project information. SharePoint has the necessary flexibility to organize and store 

the information in a manner consistent with the needs of the project. It also allows for dynamic 

changes to the organization and site as new needs arise over the course of the project. 

Moreover, controls can be used to limit access to the information; for example, who is allowed to 

access the information and who is allowed to edit documents. These controls will help ensure 

that files are not accidentally deleted or edited without the author’s approval. SharePoint also 

has an established backup procedure that ensures data integrity. Therefore, SharePoint 

provides a mechanism to ensure that information will not be lost or corrupted. 

The information stored on the SharePoint site is only accessible by the project team members 

who have access to the NRC’s local area network. 

18.5.2 Upload of Information onto the SharePoint Site 

As the work progresses, the project team members will occasionally need to place files onto the 

Level 3 PRA Project SharePoint site. These files will include information that only the individual 

analyst will need to access, or that needs to be shared with other members of the task team or 

with the entire project team. Moreover, there may need to be restrictions, for example, on who 

has permission to edit these files. 

Although most team members may not edit or modify most of the files stored on the SharePoint 

site, any project team member has permission to upload files into the temporary storage 

location titled, “Inbox.” Once a file is uploaded into the Inbox, the SharePoint Manager will 

move the file from the Inbox to its proper read-only location. In order to upload files, there is a 

link on the right hand side of the front page that is titled, “Inbox: Upload documents to the 

L3PRA website.” This page can also be found by clicking: 

http://portal.nrc.gov/edo/res/dra/L3PRA/Inbox_Library/Forms/AllItems.aspx 

Once on the Inbox page, the “upload” button is clicked and the analyst chooses the files to be 

placed on the site. In uploading each file, a brief description of the file and the last edited date 

is included in the “Notes” section. The restrictions on who has access, edit capability, etc., can 

be found in Table 18-12 for the different types of information. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-21 

18.5.3 Document Control of Licensee Information

The information received from the licensee will also be stored on the SharePoint site. The 

information on the SharePoint site will be read-only, with the exception of the personal working 

files (discussed in Section 18.5.6). This administrative control will prevent inadvertent changes 

to information submitted from the licensee. All information received from the licensee will also 

be maintained on read only CD-ROMs or DVDs so that, in the event of an inadvertent change 

on SharePoint, the original data can be restored. Moreover, there is information received from 

the licensee which is proprietary and not available to the public, and therefore needs to be 

protected. When information is received from the licensee in support of this project, a 

proprietary determination is conducted for each submittal.35 Once this proprietary determination 

is conducted and approved by the Office of the General Counsel, the information is placed on 

the SharePoint site for all NRC Level 3 PRA Project Team members. The specific SharePoint 

folder that contains this information is clearly marked as “Proprietary.” If this information is 

needed by a contractor to perform their work, the information is then copied onto an external 

media device (usually a CD-ROM, marked as “Proprietary,” if applicable) and sent to the 

contractor along with a notice, if applicable, that the CD-ROM contains proprietary information 

and should be handled appropriately. 

In addition, the licensee may occasionally send updated information, or may resend the same 

information. These occurrences may cause confusion as to which version of the information is 

the most current. It is, therefore, essential that the information be administratively controlled 

such that different information is not being used in developing the model by different analysts. 

The use of SharePoint for file hosting will greatly simplify this process. The SharePoint 

Manager and Documentation Coordinator will jointly ensure that the data on the SharePoint site 

is the most current, up-to-date information that the NRC has received from the licensee, and will 

notify the entire project team when new information from the licensee is added to the 

SharePoint site. This notification will identify what information is being added and whether it 

updates any information currently existing on the site. 

18.5.4 Documentation Backup 

Using SharePoint to store and access all the information connected with the Level 3 PRA 

Project will ensure a high level of data integrity. The files on SharePoint are backed-up several 

times a week and copies are maintained both onsite and offsite. If SharePoint is corrupted, this 

process ensures that there will be minimal loss of information, and progress of the project can 

continue given an extreme event. In addition to this automatic NRC backup of the information, a 

local backup of all of the information on the Level 3 PRA SharePoint site will be copied once a 

week onto an external media device. This backup of the files will be stored onsite for rapid 

recovery of files. Information that is not able to be placed on the SharePoint site will also be 

backed up and maintained. 

18.5.5 Use of External Storage Media 

There may be types of information that are not permitted to be uploaded onto the NRC’s 

SharePoint Site. This type of information generally involves large files and executable files 

(e.g., Access Database files and files that end in “.exe”). Therefore, an external media storage 

 

35 RES Office Instruction ADM-003, Revision 1, “Procedures for Handling Request to Withhold Proprietary 

Information,” May 11, 2012, ADAMS Accession Number ML12132A139 (not publicly available). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-22 

device that has been approved for use on NRC equipment will be available, on request, for 

project team members to back up these files. This external media device will be stored and 

kept by the Document Coordinator. 

In addition, some Level 3 PRA team members will be working on portions of the project that will 

not be able to be backed up onto the personal working files section of SharePoint, described in 

Section 18.5.6. An example of this type of work is the MELCOR calculations being completed 

on high performance computers. The personnel working on these types of files will be given a 

separate external media device that will allow them to regularly back up their work. 

18.5.6 Individual Personal Working Files 

For this project, there is a tremendous amount of information that is part of the technical work 

performed (e.g., code calculations) that is essential to retain. This information is critical in being 

able to understand how the PRA model was ultimately constructed. To ensure that this 

information is not lost, each analyst will store their work on the SharePoint site. The site will 

have a section with a separate folder assigned to each analyst. These personal folders will be 

viewable by all members of the project team; however, write access will only be available to the 

individual analyst. At their request, individual analysts can request the SharePoint Manager to 

provide write access for their folder to other ream members (e.g., if multiple team members are 

collaborating on the development of a document or file). 

Each analyst of the Level 3 PRA project will store their working files and other important 

information relevant to the project in their personal folder on the SharePoint site instead of their 

personal computer or some other location. Given the back-up features in place for the Level 3 

PRA project information on the SharePoint site, this will ensure that all the necessary 

information being used in the project is properly saved and stored. 

A consistent naming scheme for the working files being stored on the SharePoint site is 

important to allow task managers (and Level 3 PRA program management) to monitor the 

progress being made. The naming convention for working files must contain at least a 

descriptive document title and the date last modified as follows: 

[Abbreviation of technical element, See Table 18-8] – [abbreviation of subject of work] – 

[date] 

An example of this is “IE – Grouping of initiators – 3.7.2013.” This example is of work 

associated with grouping of initiators as part of the Initiating Event analysis task that was 

completed (or last updated) on 3/7/2013. 

Table 18-8 Nomenclature for Technical Elements

Abrv. Technical Element Abrv. Technical Element 

Level 1 Internal Events

IE Initiating Event Analysis HR Human Reliability Analysis 

AS Accident Sequence Analysis DA Data Analysis

SC Success Criteria QU Quantification 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-23 

Table 18-8 Nomenclature for Technical Elements

Abrv. Technical Element Abrv. Technical Element 

SA Systems Analysis 

Internal Flood

IFPP Internal Flood Plant Partitioning IFEV Internal Flood-Induced Initiating 

Events 

IFSO Internal Flood Source Identification 

and Characterization 

IFQU Internal Flood Accident Sequences 

and Quantification 

IFSN Internal Flood Scenarios 

Internal Fire

PP Plant Boundary Definition and 

Partitioning

QNS Quantitative Screening 

ES Fire PRA Equipment Selection CF Circuit Failure Analysis 

CS Fire PRA Cable Selection HRA Post-Fire Human Reliability Analysis 

QLS Qualitative Screening FQ Fire Risk Quantification 

PRM Fire PRA Plant Response Model SF Seismic/Fire Interactions 

FSS Fire Scenario Selection and 

Analysis 

UNC Uncertainty and Sensitivity Analyses

IGN Fire Ignition Frequency

Seismic

SHA Probabilistic Seismic Hazard 

Analysis 

SPR Seismic Plant Response Analysis

SFR Seismic Fragility Analysis 

High Winds

WHA High Winds Hazard Analysis WPR High Wind Plant Response Analysis

WFR High Wind Fragility Analysis

External Flood

XFHA External Flood Hazard Analysis XFPR External Flood Plant Response Model 

and Quantification 

XFFR External Flood Fragility Analysis

Other Hazards

XHA External Hazard Analysis XPR External Hazard Plant Response 

Model/Analysis

XFR External Hazard Fragility Evaluation/

Analysis 

Level 2

L1 Level 1-2 Interface ST Radiological Source Term Analysis

CP Containment Capacity Analysis ER Evaluation and Presentation of 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-24 

Table 18-8 Nomenclature for Technical Elements

Abrv. Technical Element Abrv. Technical Element 

Results

SA Severe Accident Progression 

Analysis 

L3 Interface Between a Level 2 and 

Level 3 PRA

PT Probabilistic Treatment of Event 

Progression and Source Terms

Level 3

RE Radionuclide Release 

Characterization for Level 3

HE Health Effects

PA Protective Action Parameters and 

Other Site Data 

EC Economic Factors 

ME Meteorological Data QT Consequence Quantification and 

Reporting

AD Atmospheric Transport and 

Dispersion 

RI Risk Estimation

DO Dosimetry

Low Power and Shutdown

LPOS Plant operating State Analysis LSY Systems Analysis 

LIE Initiating Events Analysis LHR Human Reliability Analysis 

LAS Accident Sequence Analysis LDA Data Analysis

LSC Success Criteria LQU Quantification

Spent Fuel Pool

SIE Initiating event analysis SHR Human reliability analysis 

SST Structural analysis SSA Accident progression and success 

criteria

SAS Accident sequence analysis SQT Quantification

SSC Systems analysis SUNC Uncertainty analysis 

Dry Cask Storage

DIE Initiating event analysis DAS Accident sequence analysis 

DDA Data Analysis DQT Quantification

DHR Human reliability analysis DUNC Uncertainty analysis 

DSC Success Criteria: (Structural and 

Thermal Hydraulics Analysis)

Integrated Site Risk

IROS Operating State Analysis IRPT Probabilistic Treatment of Event 

Progression and Source Terms
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-25 

Table 18-8 Nomenclature for Technical Elements

Abrv. Technical Element Abrv. Technical Element 

IRIE Initiating Event Analysis IRST Radiological Source Term Analysis

IRAS Accident Sequence Analysis IRL3 Interface Between a Level 2 and 

Level 3 PRA

IRDP Dependency Analysis IRRE Radionuclide Release 

Characterization for Level 3 

IRHR Human Reliability Analysis IRQT Consequence Quantification 

IRDA Data Analysis IRRI Risk Estimation

IRQU Quantification 

18.5.7 Use of Templates and Forms for Documentation 

As the work is being performed and decisions are being made in constructing the PRA, it is 

important to document this information. To ensure the needed amount of information is 

documented and that it is documented consistently among the analysts, documentation 

templates/forms have been created. These templates and forms (or similar documentation 

formats), which will be stored on the SharePoint site, address the following information: 

 Results and resolution of reviews (i.e., TAG, self-assessment, and independent peer 

review) – see Tables 18-1, 18-3, 18-4, and 18-7 

 Criteria used for self-assessment (where no standard exists) – see Table 18-2 

 Results of meetings: TAG, internal discussions, SNC, briefings, ACRS – see Table 18-9

 Working files – see Tables 18-9 and 18-10 

 Technical issues and their resolution – see Table 18-11 

During meetings, discussions, and briefings, there can be significant decisions made with 

regard to the PRA. It is essential to document this information. Table 18-9 provides a template 

for documenting meetings and discussions. In many instances, there may be issues that are 

identified and need to be addressed. These issues will be documented via the process 

described in Section 18.5.10. 

Table 18-9 Documentation of Meetings and Discussions 

DATE: 

TOPIC:

SUMMARY OF MEETING/DISCUSSION: 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-26 

Table 18-9 Documentation of Meetings and Discussions 

CONCLUSIONS

Num Decision Basis for Decision 

 

 

 

 

 

 

 

ACTION ITEMS

Num Item Assignee Due Status

 

 

 

 

 

 

In performing the work to develop the PRA model, various information, assumptions, etc., are 

used at different stages (e.g., for the different technical elements). It is essential to document 

this information. Table 18-10 provides a template for documenting this information, using 

initiating event analysis as an example. 

Table 18-10 Documentation for Level 1 Internal Events Initiating Event Analysis 

Sources of Information (Inputs) 

Source Description 

 

Describe the sources of information (inputs) 

used in the technical element, the actual input 

may be attached; inputs from other tasks should 

also be included. 

List and describe each decision made during the meeting/discussions and the bases for the 

decision; include in the discussion on the decision where and how the PRA model is impacted; 

can be a high level discussion (e.g., revised Level 1 internal events success criteria). 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-27 

Table 18-10 Documentation for Level 1 Internal Events Initiating Event Analysis 

Data 

Item Value Distribution Description 

 

Assumptions 

Assumptions Basis for Assumptions 

 

Note: 

An assumption is a decision or judgment that is made in the development of the PRA model. An 

assumption is either related to a source of model uncertainty or is related to scope or level of detail. An 

assumption related to a model uncertainty is made with the knowledge that a different reasonable 

alternative assumption exists. A reasonable alternative assumption is one that has broad acceptance 

within the technical community and for which the technical basis for consideration is at least as sound as 

that of the assumption being made. An assumption related to scope or level of detail is one that is made 

for modeling convenience.

Sources of Model Uncertainty 

Source Characterization 

 

Note: 

A source of model uncertainty is one that is related to an issue for which there is no consensus approach 

or model (e.g., choice of data source, success criteria, reactor coolant pump seal loss-of-coolant accident 

model, human reliability model) and where the choice of approach or model is known to have an impact 

on the PRA results in terms of introducing new accident sequences, changing the relative importance of 

sequences, or significantly affecting the overall CDF, LERF, or LRF estimates that might have an impact 

on the use of the PRA in decision-making.

List each source of model uncertainty, describe the source, 

and describe how the PRA model would be impacted (e.g., 

new initiating event, different grouping). 

List each event that has a parameter value, 

provide its value and uncertainty interval and 

describe the basis for both; this may be an 

attachment to the table. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-28 

Table 18-10 Documentation for Level 1 Internal Events Initiating Event Analysis 

Documentation Criteria 

Criteria Documentation Description 

DOCUMENT the processes used to select, group, and screen the initiating events and to model and 

quantify the initiating event frequencies, including the inputs, methods, and results. This documentation 

includes 

the functional categories considered and the 

specific initiating events included in each 

the systematic search for plant-unique and 

plant-specific support system initiators 

the systematic search for RCS pressure 

boundary failures and interfacing system 

LOCAs 

the approach for assessing completeness and 

consistency of initiating events with plantspecific 

experience, industry experience, other 

comparable PRAs and FSAR initiating events 

the basis for screening out initiating events 

the basis for grouping and subsuming 

initiating events 

The final grouping of initiators for which 

accident sequence development will be 

performed 

the dismissal of any observed initiating 

events, including any credit for recovery 

the derivation of the initiating event 

frequencies and the recoveries used 

the approach to quantification of each 

initiating event frequency 

the frequencies quantified for initiating event 

group 

the justification for exclusion of any data 

Other Documentation Criteria 

 

 

18.5.8 Site Visits 

At various times during the course of developing the Level 3 PRA model, it will be necessary for 

cognizant staff members to visit SNC headquarters, the Vogtle plant site, or the surrounding 

Vogtle plant site area. The purpose of these visits is to (1) gather additional information not 

obtainable via documentation, and/or (2) confirm understanding of information provided. 

A site visit generally involves: 

• Discussions with various on-site personnel (e.g., engineering, operations, maintenance) 

and off-site personnel (e.g., local authorities regarding evacuation) 

• Walkdown of the site and/or the surrounding evacuation area 

List any unique documentation requirements. 

Provide a brief discussion of how the criteria 

were met; can reference another document 

that provides the evidence. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-29 

To ensure that the purpose of the visit is achieved, the team leads participating in the site visit 

will prepare a site visit plan prior to the visit. This plan will be forwarded to SNC (or other 

appropriate organization) so that the licensee (or other organization) is prepared for the visit. 

The site plan will include the following: 

• Dates of visit 

• Names of NRC staff and contractors attending, including their role and responsibility in 

the Level 3 PRA project 

• SNC or other organization personnel to be interviewed 

• The locations and structures, systems, and components at the site (or surrounding area) 

to be visited 

• List of questions and issues to be discussed 

It is equally important to document the results of the site visit. This documentation will include 

the following: 

• Dates of the visit 

• Names of NRC staff and contractors on the site visit 

• Names of SNC and other organization personnel (including their position) interviewed 

• Specific questions and issues discussed along with a detailed summary of the 

discussion 

• Site areas visited with specific observations 

• General observations and conclusions made as a result of the visit 

If the intent of the visit is to access the protected area of the Vogtle site, it is preferred that the 

NRC staff have unescorted access so as to limit the burden to SNC. To obtain unescorted 

access, the following must be performed: 

• Each NRC staff member on the site visit must have completed NRC site access training 

(i.e., H-100 (NRC Site Access Training) or H-101 (NRC online Site Access Refresher 

Training), as appropriate) within the last 12 months 

• Region II must be notified. This notification will be performed by the NRC Level 3 PRA 

program manager, and will include the following information for each traveler: 

⎯ Name (as it appears on NRC badge) 

⎯ NRC badge number 

⎯ Clearance level (L, L(h), Q, or NC) 

⎯ Site access training 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-30 

 Completion date of training 

 Type of training (H-100, H-101, or non-NRC training at a specified power 

plant) 

⎯ Nuclear power plant/site to be visited 

⎯ Date(s) of visit 

• The Region will notify the security department at the Vogtle site, by letter, of the 

upcoming visit. The letter will inform plant security that the NRC staff have the 

necessary access training and to provide them with a badge allowing unescorted 

access. 

NRC contractors visiting the site will need to be escorted. It is expected that they will be 

escorted by NRC staff. However, Region II should still be notified of their participation in the 

visit, so that they are included in the letter that the Region sends to plant security. This will 

facilitate the badging process. It is also expected that all contractors will complete the NRC site 

access training so that they do not have to undergo such training at the site. The information to 

be provided to the Region for each contractor includes: 

• Name (as it appears on driver’s license) 

• Company 

• Site access training 

⎯ Completion date of training 

⎯ Type of training (H-100, H-101, or non-NRC training at a specified power plant) 

• Nuclear power plant/site to be visited 

• Date(s) of visit 

Project staff shall not collect any licensee-supplied proprietary information during onsite visits. 

All proprietary information used for this study must be submitted to the NRC in accordance with 

Section 18.5.3. Additionally, all visits to the Vogtle plant site must be coordinated with the 

NRR/DORL Project Manager and the resident inspection staff. 

18.5.9 Documentation Control for NRC Contractors 

This project will involve a substantial amount of work developed by NRC contractors. For 

example, the SPAR models and SAPHIRE program were developed and are hosted by INL for 

the NRC under previous contracts Under the Level 3 PRA contract, INL will host the models for 

this project, also. It is expected that the NRC Contractors working on this project will have their 

own internal information and document control system. It is the Contracting Officer’s 

Representative’s (COR’s) responsibility to ensure that the contractor has an adequate plan to 

store and backup their work. The COR should document this finding using the review template. 

When a document comes to the NRC from a contractor, it will be sent to the COR and technical 

lead. The technical lead will decide whether the information should be stored only on the 

SharePoint site, or also in ADAMS. In making this determination, the technical lead will need to 

consider the following factors: 

• Status of the information (e.g., draft, mark-up, final product) 

• Whether the document is a deliverable specified in the contract 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-31 

• Likelihood that the information will ultimately be contained, in whole or in part, in another 

stored document 

As general guidance, final products and other contract deliverables should be stored in ADAMS 

(as well as on the SharePoint site). Most other information will just be stored on the SharePoint 

site. Information will be stored on the SharePoint site using the procedure outlined in Section 

18.5.2. The technical analyst will make the determination whether the information should be 

stored in their personal working folder in SharePoint or in some other SharePoint location (if the 

latter, this should be coordinated with the SharePoint Manager). Generally, contractor 

information that is final and is being used as reference material should be stored in, for 

example, a SharePoint location for the associated technical element. Contractor information 

that is not final should be stored in the technical analyst’s personal working folder. 

18.5.10 Non-Disclosure Agreement to Allow Access to Proprietary Information 

To support the Level 3 PRA project, the NRC has collected a substantial amount of proprietary 

information about the Vogtle plant and its PRA. To ensure that the staff does not violate the 

conditions under which the licensee has provided this information, each project team member 

receives the following electronic message which they must acknowledge before being granted 

access to the proprietary information area of the Level 3 PRA SharePoint site: 

The proprietary information submitted by SNC for Vogtle Units 1 and 2 was 

provided to the NRC on a voluntary basis and can only be used to support the 

Level 3 PRA project. In no circumstances can this information be used to 

support a regulatory decision (including, but not limited to, inspection activities 

and license reviews). Furthermore, this information shall not be redistributed 

beyond the Level 3 PRA project team. Please acknowledge your understanding 

of this information by clicking the vote button above. 

18.5.11 Project Documentation Markings 

All documents generated as part of this project (either by staff or contractors) that contain 

licensee-provided proprietary information should have each page marked with a header and 

footer that states "Official Use Only – Proprietary Information." 

In addition, all documents (by either staff or contractors) that contain licensee-provided 

proprietary information and that are placed in ADAMS, should include the following disclaimer 

on the cover page: 

“This document contains proprietary information voluntarily supplied by Southern Nuclear 

Operating Company to support the Level 3 PRA Project. Per NRR Office Instruction LIC204, Revision 3 (January 2007), and RES Office Instruction ADM-003, Revision 1 (May 

2012), this information should not be used to support an NRC review and approval of a 

licensee application or a document, or for any other NRC decision.” 

It should be further noted that the proprietary information submitted by SNC for Vogtle Units 1 

and 2 was provided to the NRC on a voluntary basis and can only be used to support the 

Level 3 PRA project. In no circumstances will this information be used to support a regulatory 

decision (including, but not limited to, inspection activities and license reviews). Aside from 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-32 

submitting documents into ADAMS with the disclaimer above, documents containing SNC 

proprietary information should not be distributed beyond the Level 3 PRA project team. 

18.5.12 Guidance for Addressing Potential Technical Issues 

In developing the Level 3 PRA model, technical issues will arise that may impact the PRA 

results or insights. These issues can include: 

• potential issues that may call into question the technical rigor or adequacy of the 

Southern Nuclear Operating Company (SNC) Vogtle PRA36 (e.g., potential model errors 

or deficiencies that may require changes to the model) or related quality control activities 

(e.g., self-assessment or peer review) 

• issues that require a decision by the Level 3 Project Management Team or discussion 

with the Level 3 PRA Technical Advisory Group (TAG) or other experts (e.g., selection of 

significant assumptions or a choice between different analytical methods, models, or 

approaches); further technical analysis beyond that described in the TAAP; and/or 

coordination across technical areas. 

An important consideration is that these issues are likely to involve proprietary PRA and plant 

information submitted by SNC that must be protected from public disclosure or misuse. SNC 

has voluntarily submitted substantial amounts of proprietary PRA and plant information to the 

NRC in support of the Level 3 PRA project and, for the reasons detailed below, this information 

is not to be used to support regulatory decisionmaking: 

• Under the requirements specified in 10 CFR 2.390, “Public inspections, exemptions, 

requests for withholding,” proprietary information submitted will be withheld from public 

disclosure if it is of a type normally held in confidence by SNC. All proprietary information 

submitted by SNC is reviewed and controlled as described in Section 18.5.3. Nonproprietary versions of these documents, which would normally be submitted to support a 

license amendment or regulatory use, will not be developed to support this research project. 

• Information submitted by SNC for this project does not support any regulatory decision and 

is not required to be done under oath and affirmation or docketed, as would normally be 

done for a licensing submittal (e.g., see 10 CFR 50.30). 

• This information is not being submitted either to support a licensing application or by the 

Commission's regulations, orders, or license conditions, and consequently the requirements 

of 10 CFR 50.9, “Completeness and accuracy of information,” do not apply. 

Consequently, it is important to have a process for addressing potential issues that also ensures 

that appropriate separation between the Level 3 PRA project and regulatory decisionmaking is 

maintained. For this project, a process has been developed for resolving technical issues, 

communicating technical concerns to SNC staff, and turning issue follow-up over to the 

appropriate regulatory process when appropriate. 

 

36 The Level 3 PRA Project is associated with only Units 1 and 2 at the Vogtle site. Units 3 and 4 

(currently under construction) are outside of the scope of this project. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-33 

For the purposes of this process, the following terms are used: 

• Level 3 PRA Project Management Team – In this context, refers to the Level 3 PRA project 

Program Manager, Principle Technical Advisor, and RES/DRA/PRAB Branch Chief. 

• Cognizant staff – project team members that include, at a minimum, the technical lead, but 

may also include other technical analysts on the project team that are involved with 

identification or resolution of the issue. 

The following process is used to ensure that issues identified in the performance of the Level 3 

PRA project that have the potential to impact regulatory decisionmaking are handled in an 

appropriate manner. 

1. When a Level 3 PRA project staff member or contractor identifies an issue (or potential 

issue), the cognizant staff will assess what impact the issue could have on the PRA (i.e., the 

significance of the issue) and whether the issue could call into question the technical rigor or 

adequacy of the SNC Vogtle PRA or related quality control activities. The cognizant staff 

will then summarize the issue and its potential impact on the PRA in a document (see 

Table 18-11). This documentation shall be forwarded to the Level 3 PRA Project 

Management Team as soon as practical after the issue is identified, at which point the issue 

will be added to the Level 3 PRA project issue tracking spreadsheet. 

General guidance for determining whether an issue should be documented and tracked 

includes: 

• Issue may call into question the technical rigor or adequacy of the SNC Vogtle PRA 

• Issue involves a choice between different analytical methods, models, or approaches 

• Issue requires additional work beyond that described in the TAAP 

• Issue requires coordination across technical areas (e.g., an unresolved technical issue 

that has the potential to materially impact modeling decisions made in two or more 

technical areas) 

• Issue warrants communication to the entire Level 3 Project team for awareness 

• Any other issue a project team member determines should be included or would be of 

interest to the Level 3 PRA Project Management Team 

2. For those issues that potentially question the technical adequacy of the SNC Vogtle PRA, 

the Program Manager will coordinate a meeting or discussion with SNC to address the 

identified issue. The meeting or discussion will include SNC staff (as identified by SNC), the 

Level 3 PRA Project Management Team, and the cognizant staff. The results of the 

meeting or discussion will be documented in accordance with project procedures (see 

Table 18-9 for documenting discussions/meetings). To facilitate the discussion, the 

Program Manager may forward the summary description of the issue (in its entirety or in 

part) to SNC prior to the meeting or discussion. In accordance with project communication 

protocols, the meeting/discussion will be coordinated with the NRR/DORL Project Manager 

and the SNC Licensing Director. 

a. Following the discussion with SNC (and after reviewing any additional information 

identified by SNC), the Level 3 PRA management team and cognizant project staff may 

determine that the issue is adequately resolved because, for example: 

i. SNC provided additional information or clarification to resolve the issue. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-34 

ii. SNC and the NRC used different methods or approaches, both of which are 

acceptable. 

iii. The issue was determined to not have a significant impact on the PRA results or 

insights. 

If the issue has not been resolved, it will be evaluated by the Level 3 PRA Project 

Management Team to determine if a technical inadequacy (i.e., error) of the SNC Vogtle 

PRA actually exists. It will be assumed that any technical inadequacy issue that is not 

resolved by the cognizant staff will be considered to be an error in the SNC Vogtle PRA 

unless the Level 3 PRA Project Management Team determines that the issue has been 

resolved. 

b. Once an error of the SNC Vogtle PRA has been identified, appropriate SNC staff will be 

contacted (in accordance with project communication protocols and in coordination with 

the NRR/DORL Project Manager) and informed of the details of the error, including the 

potential for the error to impact PRA results and/or insights or call into question the 

adequacy of quality control activities. SNC will be requested to conduct a review of the 

error and inform the NRR/DORL Project Manager of the result of this review. This 

review will include consideration of any licensing and/or regulatory applications of the 

PRA. The Level 3 PRA cognizant staff will prepare a written summary of the notification 

of SNC staff of the error which the RES/DRA/PRAB Branch Chief will forward to the 

NRR/DORL Vogtle Project Manager and appropriate NRR/DORL Branch Chief (either by 

formal memo or email notification). 

Once the error has been communicated to SNC and the NRR/DORL Project Manager, 

the Level 3 PRA project team is not responsible for any further follow-up on the potential 

regulatory implications of the error. 

c. Once the error has been turned over to NRR/DORL, it is recognized that the Level 3 

PRA project team may proceed with an appropriate technical resolution consistent with 

the overall project objectives. The error will continue to be documented and tracked 

using Table 18-11 as the error is resolved within the context of the Level 3 PRA project. 

3. For those issues that require a decision, further technical analysis, and/or discussion 

beyond the cognizant staff, the cognizant staff member who has the lead for the issue will 

set up a project team meeting to discuss the issue. This meeting should include all 

cognizant staff and the Level 3 PRA project management team. For those issues requiring 

further technical analysis, the cognizant staff, in consultation with the Level 3 PRA project 

management team, will determine what technical analysis will be performed to resolve the 

issue. In determining what analysis to perform, consideration will be given to the potential 

impact that the issue may have on the PRA results or insights, the resources required for 

the additional analysis, and the availability of requisite staff. 

The results of the meeting or discussion will be documented in accordance with project 

procedures (see Table 18-9 for documenting discussions/meetings). If the cognizant staff 

and Level 3 PRA project management team cannot resolve the issue during the meeting, 

then one or more of the following actions will be taken: 

a. The cognizant staff member who has the lead for the issue will organize a meeting with 

other knowledgeable staff or contractors. 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-35 

b. The Level 3 PRA Program Manager will communicate to the TAG coordinator that the 

project team wishes to discuss the issue with the TAG. 

c. The Level 3 PRA Program Manager will coordinate a meeting or discussion with SNC to 

get more information related to the issue, as needed. The meeting or discussion will 

include SNC staff (as identified by SNC), the Level 3 PRA Project Management Team, 

and the cognizant staff. To facilitate the discussion, the Program Manager may forward 

the summary description of the issue (in its entirety or in part) to SNC prior to the 

meeting or discussion. In accordance with project communication protocols, the 

meeting/discussion will be coordinated with the NRR/DORL Project Manager and the 

SNC Licensing Director. 

For all of the above actions, the results of any meetings or discussions will be documented 

in accordance with project procedures (see Table 18-9 for documenting 

discussions/meetings), and the issue tracking spreadsheet will be updated accordingly. 

Also, as part of the resolution of the issue, it is possible that a potential error or deficiency 

may be identified in the SNC Vogtle PRA or related quality control activities. If so, this issue 

will be addressed as discussed in Step 2, above. 

4. The different types of issues discussed above are to be tracked using Table 18-11. This 

process involves the following: 

• Once the cognizant staff has entered the issue into Table 18-11, the table is forwarded 

to the Documentation Coordinator. 

• When there is any new information related to the issue, that information is forwarded to 

the Documentation Coordinator. 

• The Documentation Coordinator will update and maintain the master list of all the issues, 

which will reside on the Level 3 PRA project SharePoint site. 

 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-36 

Table 18-11 Issue Documentation Template 

Technical Analyst ___________________ 

Status 

 

● High Significance -- An issue needing resolution to ensure the technical adequacy of the PRA, the capability of the PRA, or the robustness of the PRA 

update process. 

● Medium Significance -- An issue whose resolution is needed to maintain maximum flexibility in PRA applications and consistency with Industry practices 

(as endorsed by the NRC) or simply to enhance the PRA’s technical capability as time and resources permit. It is unlikely that the technical adequacy of the PRA is impacted. 

● Low Significance -- An issue that does not impact the technical adequacy of the PRA. 

Implemented 

Resolution 

 

Recommended 

Resolution 

 

Level of 

Significance 

 

Issue 

 

Num 

 Describe the concern, what is the issue, why it is a concern; explanation needs to clearly explain the concern and the basis for the concern. If the issue is associated with a specific SR, then note Describe the recommendation to resolve the concern; the explanation needs to be sufficiently detailed so that the analyst understands what needs to be revised in the PRA to resolve the concern, and the basis for the recommended resolution. Describe the response to the issue and recommendation, describing how it was resolved; the explanation should not be just an “accept,” but an explanation of exactly how it was resolved (e.g., how the PRA model was revised), and the basis for the implemented resolution. The level of significance of the concern should be listed including the basis for level of significance assessed; see below for explanation of significance. Use the technical element 2-4 digit abbreviation (xxxx) and the issue numbered sequentially (yy) followed by an “I” (i.e., xxxx-yy-I). Note, for issues that may cut across multiple technical elements, use the 4 digit abbreviation “CCCC.” Describe the status, what has been accomplished, what still needs to be done, and the date of the status (i.e., the status will continually be updated, each time it is updated, the date needs to be changed accordingly). Once the issue has been resolved (i.e., the PRA model has incorporated the resolution), the status should state complete and the date completed. Part of the status is whether the issue has been reviewed by the TAG (the review by the TAG is documented elsewhere).
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-37 

18.5.13 Future Plant Modifications 

One objective of the Level 3 PRA project model is to ensure it reflects the as-built, as-operated 

plant. However, the Level 3 PRA project will take several years to complete, and the plant 

design and operation are likely to change over time. Therefore, the potential exists that the 

Level 3 PRA project model may not reflect the as-built, as-operated plant at the time of project 

completion. Consequently, criteria are needed to determine which future modifications under 

consideration by SNC are incorporated into the model. 

The following criteria are used to determine which, if any, future Vogtle plant modifications will 

be included in the NRC Level 3 PRA model: 

• The potential modification is risk significant, 

• There is a regulatory commitment that the proposed plant change will be completed by the 

time the Level 3 PRA model is completed, 

• If procedures and training are required, they meet the guidelines of RIS 2008-15 and they 

are implemented in a timeframe that does not impede the overall Level 3 PRA schedule, 

• The effect of the modification has already been evaluated by the NRC (e.g., safety 

evaluation report issued) and accepted, and

• There is sufficient information for the Level 3 PRA project to understand the proposed 

change. 

All of the above criteria must be met for the plant modification to be included in the Level 3 PRA 

model. If one of the criteria is not met, then the plant modification will not be included. 

However, sensitivities may be performed to determine its impact on the PRA. The basis for 

including and not including a plant modification will be documented using Table 18-10. 

18.5.14 Organization of the Various Types of Information on the SharePoint 

Site 

The Level 3 PRA project has numerous different types of information that need to be stored and 

accessed. The various types of information are summarized in Table 18-12. Also provided in 

Table 18-12 are the access control settings for the different types of information. 

Table 18-12 Summary of Level 3 PRA Project Information on SharePoint Site 

 Brief Description of Folder 

Contents 

Access Control* 

General L3PRA 

Project 

Documents 

• General documents relating to 

the work performed in support of 

this project (e.g., briefings, 

TAAP documents) 

Read/Write Access: 

SharePoint Manager 

Read-Only Access: 

All Level 3 PRA Project Team Members 

No Access: 

All other NRC staff 
Level 3 PRA Technical Analysis Approach Plan, Rev. 0b

18-38 

Reference 

Documents 

(Including Vogtle 

Site Information) 

• Plant specific information 

previously available at the NRC 

(e.g., FSAR, IPE, IPEEE) 

• General non-plant specific 

information (e.g., dry cask 

storage information) 

• Proprietary plant specific 

information sent by Vogtle in 

support of this project (e.g., 

PRA models and 

documentation, plant 

procedures, system diagrams) 

Read/Write Access: 

SharePoint Manager 

Read-Only Access: 

All Level 3 PRA Project Team Members* 

No Access: 

All other NRC staff 

Task Group 

Technical 

Documents 

(Includes 

Personal Working 

Files) 

• Personal working files Read/Write Access: 

SharePoint Manager 

Each team member will have read/write 

access to their own working files.** 

Read-Only Access: 

All Level 3 PRA Project Team Members 

No Access: 

All other NRC staff 

Technical 

Advisory Group 

Documents 

• TAG information (e.g., meeting 

minutes) 

Read/Write Access: 

SharePoint Manager 

TAG Coordinator 

Read-Only Access: 

 All Level 3 PRA Project Team Members 

No Access: 

 All other NRC staff 

Inbox: Upload 

Documents to the 

L3PRA Website 

• Miscellaneous documents 

uploaded to the site that have 

not yet been filed 

Read/Write Access: 

SharePoint Manager 

Read-Only Access: 

All Level 3 PRA Project Team Members 

No Access: 

All other NRC staff 

*To access the proprietary information area of this folder, project team members need to acknowledge 

the non-disclosure statement (as discussed in Section 18.5.9). 

**Write access may be shared with other project team members as the request of the owning individual.

18.6 Quality Assurance Program Implementation Audits 

Periodic audits of the implementation of the Level 3 PRA project QA plan will be performed at a 

frequency of not less than once per year. These audits will cover a representative sampling of 

project activities in order to verify compliance with QA plan requirements. The Level 3 PRA 

Project Management team will determine the scheduling of these audits and how they are to be 

carried out.