NUREG/CR-6859 

SAND2004-5032P

PRA Procedures and 

Uncertainty for PTS Analysis 

Office of Nuclear Regulatory Research 
NUREG/CR-6859 

SAND2004-5032P 

PRA Procedures and 

Uncertainty for PTS Analysis 

Manuscript Completed: October 2004 

Date Published: March 2010 

Prepared by 

D.W. Whitehead1 

A.M. Kolaczkowski2 

1

Sandia National Laboratories 

P.O. Box 5800 

Albuquerque, NM 87185-0744 

2 Science Applications International Corporation 

405 Urban Street 

Suite 400 

Lakewood, CO 80228 

M.T. Kirk, NRC Project Manager 

NRC Job Code Y6430 

Office of Nuclear Regulatory Research 
ABSTRACT

This report supplements NUREG-1806, “Technical Basis for Revision of the Pressurized Thermal Shock 

(PTS) Screening Limit in the PTS Rule (10CFR50.61): Summary Report,” with additional information 

regarding the Probabilistic Risk Assessment (PRA) and Human Reliability Analysis (HRA) portions of the

PTS analyses presented in that report, including the use of realistic input values and models and an 

explicit treatment of uncertainties. Best estimate equipment failure values are used throughout based on 

generic nuclear industry data, or, in cases where it's available, on plant-specific data. Parameters related 

to human performance are based on plant specific review of procedures and training, observation of plant 

personnel responding to PTS-related sequences on their simulator, and performance data from actual plant 

operations. 

Paperwork Reduction Act Statement 

The information collections contained in this NUREG are subject to the Paperwork Reduction Act of 

1995 (44 U.S.C. 3501 et seq.)., which were approved by the Office of Management and Budget, approval 

number 3150-0011. 

Public Protection Notification 

The NRC may not conduct or sponsor, and a person is not required to respond to, a request for 

information or an information collection requirement unless the requesting document displays a currently 

valid OMB control number. 

iii 
iv
FOREWORD

The reactor pressure vessel is exposed to neutron radiation during normal operation. Over time, the vessel 

steel becomes progressively more brittle in the region adjacent to the core. If a vessel had a preexisting 

flaw of critical size and certain severe system transients occurred, this flaw could propagate rapidly 

through the vessel, resulting in a through-wall crack. The severe transients of concern, known as 

pressurized thermal shock (PTS), are characterized by rapid cooling (i.e., thermal shock) of the internal 

reactor pressure vessel surface that may be combined with repressurization. The simultaneous occurrence 

of critical-size flaws, embrittled vessel, and a severe PTS transient is a very low probability event. The 

current study shows that U.S. pressurized-water reactors do not approach the levels of embrittlement to 

make them susceptible to PTS failure, even during extended operation well beyond the original 40-year 

design life. 

Advancements in our understanding and knowledge of materials behavior, our ability to realistically 

model plant systems and operational characteristics, and our ability to better evaluate PTS transients to 

estimate loads on vessel walls have shown that earlier analyses, performed some 20 years ago as part of 

the development of the PTS rule, were overly conservative, based on the tools available at the time. 

Consistent with the NRC’s Strategic Plan to use best-estimate analyses combined with uncertainty 

assessments to resolve safety-related issues, the NRC’s Office of Nuclear Regulatory Research undertook 

a project in 1999 to develop a technical basis to support a risk-informed revision of the existing PTS Rule, 

set forth in Title 10, Section 50.61, of the Code of Federal Regulations (10 CFR 50.61). 

Two central features of the current research approach were a focus on the use of realistic input values and 

models and an explicit treatment of uncertainties (using currently available uncertainty analysis tools and 

techniques). This approach improved significantly upon that employed in the past to establish the 

existing 10 CFR 50.61 embrittlement limits. The previous approach included unquantified conservatisms 

in many aspects of the analysis, and uncertainties were treated implicitly by incorporating them into the 

models. 

This report is one of a series of 21 reports that provide the technical basis that the staff will consider in a 

potential revision of 10 CFR 50.61. The risk from PTS was determined from the integrated results of the 

Fifth Version of the Reactor Excursion Leak Analysis Program (RELAP5) thermal-hydraulic analyses, 

fracture mechanics analyses, and probabilistic risk assessment. This report documents the Probabilistic 

Risk Assessment (PRA) and Human Reliability Analysis (HRA) portions of the PTS study. 

Brian W. Sheron, Director 

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

v
vi
CONTENTS

ABSTRACT .......................................................................................................... iii 

FOREWORD ........................................................................................................... v 

CONTENTS .......................................................................................................... vii 

FIGURES ............................................................................................................ viii 

TABLES ............................................................................................................. viii 

EXECUTIVE SUMMARY ......................................................................................... ix 

ABBREVIATIONS ................................................................................................. xi 

1. INTRODUCTION ................................................................................................ 1 

2. PURPOSE AND PRODUCS .................................................................................... 3 

3. PTS PRA METHODLOGICAL APPROACH ................................................................ 5 

3.1 Step 1: Collect Information ........................................................................... 6 

3.1.1 Generic Information ........................................................................ 6 

3.1.1.1 LER Review ..................................................................... 6 

3.1.1.2 Initiator Frequency and Probability Date .................................... 6 

3.1.2 Specific Information ....................................................................... 7 

 3.1.2.1 Previous PTS-PRA Analyses ................................................. 7 

 3.1.2.2 Plant-Specific Information .................................................... 7 

 3.2 Step 2: Identify the Scope and Features of the PRA Model ...................................... 8 

 3.2.1 Types of Sequences ....................................................................... 10 

 3.2.2 Initiating Events ........................................................................... 10 

 3.2.3 Functional/Equipment Considerations ................................................. 11 

 3.2.4 Human Action Considerations .......................................................... 13 

 3.3 Step 3: Construct the PRA Models ................................................................. 13 

3.3.1 PRA Modeling Differences Attributable to the Organization Constructing the 

 Model ....................................................................................... 13 

3.3.2 PRA Modeling Differences Attributable to the Order of Plant Analysis ......... 14 

 3.4 Step 4: Quantify and Bin the PRA Modeled Sequences ... ...................................... 15 

 3.5 Step 5: Revise PRA Models and Quantification .................................................. 16 

 3.6 Step 6: Perform Uncertainty Analyses ............................................................. 18 

 3.6.1 Modeling of Representative Scenarios to Characterize Aleatory Uncertainty ... 18 

 3.6.2 Quantification of Scenario Frequencies to Characterize Epistemic Uncertainty .. 18 

 3.7 Step 7: Incorporate Uncertainty and Finalize Results ............................................. 19 

4. SUMMARY ....................................................................................................... 23 

5. REFERENCES ................................................................................................... 25 

vii
viii

FIGURES

1. Integrated technical analyses comprising the PRS re-analysis project. .................................... 1 

2. Diagrammatic representation of PRA approach. .............................................................. 5 

3. Functional event tree as the basis for PRS PRA analyses. .................................................. 12 

TABLES

1. Comparison of PRA analysis used in this study with the PRA analyses that 

 supported 10CFR50.61. ........................................................................................... 9 

2. General classes of human failures considered in the PTS analyses. ........................................ 14 
EXECUTIVE SUMMARY

The NRC Office of Nuclear Regulatory Research started a study in 1999 to develop the technical basis for 

a risk-informed revision of the PTS Rule which would relax unnecessary conservatisms in the present 

PTS rule (10CFR50.61) without compromising safety. That study and its results are summarized in 

NUREG-1806. This report supplements NUREG-1806 with additional information regarding the 

Probabilistic Risk Assessment (PRA) and Human Reliability Analysis (HRA) portions of the PTS study, 

including the use of realistic input values and models and an explicit treatment of uncertainties. 

A key final product of the PTS re-analysis project was the estimation of thru-wall crack frequencies 

(TWCFs) associated with severe overcooling scenarios using the probabilistic fracture mechanics code 

FAVOR. The PRA portion of the re-analysis project had three primary purposes in the derivation of this 

final product: 

1. Define the overcooling scenarios (sequences) with the potential for being PTS challenges. 

This resulted in definition of the overcooling sequences, is in the form of the event trees 

constructed by the PRA analysts for each of the three plant PTS analyses. 

2. Direct the TH analysis as to the specific sequences to be modeled so as to obtain plant 

TH response information to be forwarded to the PFM analysts. 

3. Estimate the frequencies, including uncertainties, for those overcooling sequences 

potentially important to the PTS results and provide that information to the PFM analysts. 

These estimates were provided to the PFM analysts by the PRA analysts for those 

overcooling “case” bins potentially important to the PTS results. This information was 

provided in the form of electronic files containing a “case” bin identifier and statistical 

frequency information associated with that bin. These bin frequencies correspond to the 

“case” sequences modeled by the TH analysts and represent the combined frequencies of 

all the event tree sequences incorporated into each bin. The statistical frequency 

information along with the TH information representing each bin were then used by the 

PFM analysts to estimate the TWCFs. 

A multi-step approach was followed to produce the PRA products for the PTS re-analysis project. These 

steps included the following: 

Step 1: Collect information 

Step 2: Identify the scope and features of the PRA model 

Step 3: Construct the PRA models 

Step 4: Quantify and bin the PRA modeled sequences 

Step 5: Revise PRA models and quantification 

Step 6: Perform uncertainty analysis 

Step 7: Incorporate uncertainty and finalize results 

These steps both define the sequences of events that may lead to PTS (for input to the TH model) and 

estimate the frequencies with which these sequences are expected to occur (for combination with the PFM 

results–e.g., conditional probability of initiation (CPI) and conditional probability of failure (CPF)–to 

calculate the yearly frequency of through wall cracking). This report provides a detailed description of 

each of these seven steps. 

ix
x
ABBREVIATIONS

AC Alternating current 

ADVs Atmospheric dump valves 

AFW Auxiliary feedwater 

ATWS Anticipated transient without scram 

CPF Conditional probability of failure 

CPI Conditional probability of initiation 

DC Direct current 

EFW Emergency feedwater 

HEPs Human error probabilities 

HRA Human reliability analysis 

HZP Hot zero power 

IPTS Integrated Pressurized Thermal Shock Studies 

LER Licensee event report 

LOCA Loss of coolant accident 

MFW Main feedwater 

MSIVs Main steam isolation valves 

PFM Probabilistic fracture mechanics 

PORVs Power-operated relief valves 

PRA Probabilistic risk assessment 

PTS Pressurized thermal shock 

PWRs Pressurized water reactors 

RCPs Reactor coolant pumps 

RCS Reactor coolant system 

SG Steam generator 

SGTR Steam generator tube rupture 

SRVs Safety relief valve 

SSRVs Secondary steam relief valves 

TH Thermal-hydraulic 

TWCFs Through-wall crack frequencies 

UMD University of Maryland 

xi
xii 
1. INTRODUCTION

The NRC Office of Nuclear Regulatory Research started a study in 1999 to develop the technical basis for 

a risk-informed revision of the PTS Rule which would relax unnecessary conservatisms in the present 

PTS rule (10CFR50.61) without compromising safety. That study and its results are summarized in 

NUREG-1806, “Technical Basis for Revision of the Pressurized Thermal Shock (PTS) Screening Limit in 

the PTS Rule (10CFR50.61): Summary Report.” 

This report supplements NUREG-1806 with additional information regarding the Probabilistic Risk 

Assessment (PRA) and Human Reliability Analysis (HRA) portions of the PTS study, including the use 

of realistic input values and models and an explicit treatment of uncertainties. As depicted in Figure 1, 

the PTS re-analysis project was a closely integrated effort among three primary technical disciplines: 

1. PRA (including HRA), 

2. Thermal-hydraulic (TH) modeling, and 

3. Probabilistic fracture mechanics (PFM). 

As such, while this report focuses on the PRA and HRA (hereafter referred to as PRA unless specifically 

dealing with HRA) aspects of the re-analysis, important interfaces with the other technical disciplines are 

noted and cannot be completely separated from what was done in the PRA portion of the PTS re-analysis 

project. 

Sequence 

definitions

Pressure &

temperature 

vs. time

PRA Event 

Sequence 

Analysis

Thermal 

Hydraulic 

Analysis

PFM 

Analysis

Conditional 

probability of thru - 

wall cracking, [CPF]

Sequence 

frequencies, [ fr]

[CPF]x

[fr]

Yearly 

frequency

of thru-wall 

cracking

Figure 1. Integrated technical analyses comprising the PTS re-analysis project.

1
2
2. PURPOSE AND PRODUCTS

A key final product of the PTS re-analysis project was the estimation of thru-wall crack frequencies 

(TWCFs) associated with severe overcooling scenarios. The PRA portion of the re-analysis project had 

three primary purposes in the derivation of this final product: 

1. Define the overcooling scenarios (sequences) with the potential for being PTS challenges. 

2. Direct the TH analysis as to the specific sequences to be modeled so as to obtain plant 

TH response information to be forwarded to the PFM analysts. 

3. Estimate the frequencies, including uncertainties, for those overcooling sequences 

potentially important to the PTS results and provide that information to the PFM analysts. 

In meeting the above purposes, the process followed by the PRA analysts was iterative in nature. These 

iterations were the result of additional information becoming available from the other disciplines as the 

analyses evolved, as well as due to feedback from the licensees participating in the three plant analyses 

(Oconee Unit 1, Beaver Valley Unit 1, and Palisades Unit 1). 

For each purpose above, a specific product was produced. The first product, definition of the overcooling 

sequences, is in the form of the event trees constructed by the PRA analysts for each of the three plant 

PTS analyses. Event tree construction is a well-known and well-established PRA modeling tool that has 

been used in identifying and analyzing core damage scenarios such as in the Individual Plant Examination 

(IPE) program. In this case, the same tool was used to identify and model overcooling sequences rather 

than core damage sequences that could occur as a result of under-cooling events. The sequences depicted 

by the PTS event trees represent those combinations of initiating events that disrupt normal plant 

operation (e.g., turbine trip) and subsequent plant equipment and operator responses that are included in 

each plant model to represent overcooling sequences with the potential to be a PTS challenge. 

The second product, direction by the PRA analysts to the TH analysts as to specific sequences to be 

modeled in their phase of the overall PTS analyses, was provided in the form of written and vocal 

communications among the analysts. Each TH modeled sequence was assigned a “case” number for 

identification purposes. For a given plant analysis, each TH “case” is a scenario that broadly represents 

many possible sequences on the event trees for that plant whose characteristics are similar enough that the 

sequences can be collectively represented by a single TH sequence (case). The TH analysts modeled each 

case to derive the time histories for reactor coolant pressure, reactor vessel downcomer temperature, 

vessel wall heat transfer characteristics, and other parameters important to defining the plant TH response 

during each case. This response information was subsequently provided to the PFM analysts to determine 

the vessel wall response (i.e, crack initiation and propagation) for the TH conditions. The modeling of 

multiple event tree sequences by a smaller number of “case” sequences involved a manual binning

process that is summarized later in more detail. 

The third product, sequence frequencies including uncertainties, was provided to the PFM analysts by the 

PRA analysts for those overcooling “case” bins potentially important to the PTS results. This information 

was provided in the form of electronic files containing a “case” bin identifier and statistical frequency 

information associated with that bin. These bin frequencies correspond to the “case” sequences modeled 

by the TH analysts and represent the combined frequencies of all the event tree sequences incorporated into 

each bin. The statistical frequency information along with the TH information representing each bin were 

then used by the PFM analysts to estimate the TWCFs [Dickson]. 

3 
4 
3. PTS PRA METHODOLOGICAL APPROACH

A multi-step approach was followed to produce the PRA products for the PTS re-analysis project. 

Figure 2 depicts the steps followed both to define the sequences of events that may lead to PTS (for input 

to the TH model) and to estimate the frequencies with which these sequences are expected to occur (for 

combination with the PFM results–e.g., conditional probability of initiation (CPI) and conditional 

probability of failure (CPF)–to calculate the yearly frequency of through wall cracking). Although the 

approach is illustrated in a serial fashion, its implementation involved multiple iterative passes through the 

various steps as the analyses and the mathematical representation of each plant evolved. In the following 

sections, seven steps that together comprise the PRA analysis are described. These seven steps include: 

Step 1: Collect information (Section 3.1) 

Step 2: Identify the scope and features of the PRA model (Section 3.2) 

Step 3: Construct the PRA models (Section 3.3) 

Step 4: Quantify and bin the PRA modeled sequences (Section 3.4) 

Step 5: Revise PRA models and quantification (Section 3.5) 

Step 6: Perform uncertainty analysis (Section 3.6) 

Step 7: Incorporate uncertainty and finalize results (Section 3.7)

Step 1

Collect Information

Step 5

Revise PRA Models & 

Quantification CPI & CPF

Step 2

Identify Scope & 

Features of PRA 

Model

Step 3

Construct PRA Model

Step 4

Quantify & Bin the

Modeled Sequences

PRA

Step 6

Perform Uncertainty

Analysis

Step 7

Incorporate

Uncertainties and

Finalize Results

Result Binned 

Sequence 

Frequencies for Use 

with PFM Results

Sequence

Definitions

TH 

Model

Pressure & 

Temperature

PFM 

Model

Figure 2. Diagrammatic representation of PRA approach.

5
3. PTS PRA Methodological Approach

The reader should recognize that the PRA models described in this report consider only events internal to 

the operating plant (stuck open valves, pipe breaks, etc.) as possible PTS precursors1

. A scoping study 

aimed at assessing the frequency and the consequences of external initiating events (e.g., fires, floods, 

etc.) is detailed in a separate document [Kolaczkowski 04a]. 

3.1 Step 1: Collect Information

During the initial phase of the PTS project, significant resources were expended to collect information 

regarding PTS in general and each plant in particular. General information gathering activities included: 

• a review of the basis for the current PTS rule [10CFR50.61], and 

• a licensee event report (LER) search for the years 1980 through 2000 to gain an understanding of 

the frequency and severity of real overcooling events [INEEL 00a]. 

Plant specific information sources included the PRA analyses performed during the 1980s in support of 

the Integrated Pressurized Thermal Shock (IPTS) studies and the current PTS rule [ORNL 85a, 85b, 86], 

as well as plant-specific design and operational information. Familiarity with all of this information 

provided the bases upon which the PRA analysis of each plant was conducted. 

3.1.1 Generic Information

3.1.1.1 LER Review

A total of 128 events were identified from the LER review, demonstrating that overcooling events, or at 

least their pre-cursors, do occur from time-to-time. These events are dominated by failure to properly 

control or throttle secondary side feed, a pre-cursor that leads to relatively minor over-cooling. Still, a 

few events have been associated with actual or potential loss of portions of secondary pressure control. 

These events predominantly involve equipment failures in the main feedwater, feed and steam control, 

and main steam systems. The results of the LER review also demonstrate that both active and passive 

(i.e., latent) human errors play a role as many of the equipment failures were caused by improper 

maintenance or testing. Additionally, equipment in non-normal configurations can be an aggravating 

factor because contributing equipment faults have occurred that operators must identify and compensate 

for to prevent over-cooling. 

3.1.1.2 Initiator Frequency and Probability Date

Initiator frequency and failure probability data are needed for initiating events, systems, and components 

as input to the PRA model. Since the goal of the PTS re-analysis project was to provide a PTS risk 

perspective for the operating fleet of pressurized water reactors (PWRs), it was judged appropriate to 

apply industry-wide PWR data for initiator frequencies and equipment failure probabilities in the plantspecific analyses. Hence, while the PRA model structure and the operational considerations it represented 

were based on plant-specific information, initiator frequencies and equipment failure probability data 

were generally based on industry-wide experience. 

Generic PWR data were obtained from two main sources. The first source, NUREG/CR-5750 [INEEL

1

Internal flooding events were not considered in this analysis; however, they were examined in the external events scoping study. 

6
3. PTS PRA Methodological Approach

99], summarizes industry-wide initiator experience for the years 1987 through 1995 along with failure 

probabilities for selected components. This information was updated twice. The first update was 

performed in an unpublished (at the time) addendum to NUREG/CR-5750 [INEEL 00b] that extended the 

experience base through 1998. The second update dealt with loss-of-coolant initiators and was based on 

NRC staff input intended to account for time dependent material aging mechanisms not included in the 

experiential data [NRC LTR 02]2

. The second source, NUREG/CR-5500, [INEEL] summarizes industrywide experience for selected systems. 

3.1.2 Specific Information

3.1.2.1 Previous PTS-PRA Analyses

Review of the PRA analyses performed in support of the IPTS studies and the current PTS rule was 

another important input to the analyses. Of particular relevance were NUREG/CR-3770 [ORNL 86] and 

WCAP-15156 [Westinghouse 99] (a more recent 1999 study) since these are past analyses of two of the 

plants covered in this work, Oconee and Beaver Valley respectively. Information in NUREG/CR-4183 

[ORNL 85b] concerning H.B. Robinson and NUREG/CR-4022 [ORNL 85a] concerning Calvert Cliffs 

plant was also considered since these documents provided additional perspectives and analytical 

considerations useful to this work. 

3.1.2.2 Plant-Specific Information

At the outset of each plant-specific analysis, a letter was sent to the licensee requesting information 

pertaining to plant design, procedures, training, and other aspects of plant operation relevant to building a 

PRA model for analyzing PTS. Information provided in response to these letters was supplemented by 

information gained during plant visits and by ongoing interactions (vocal, written, and e-mail exchanges) 

with each licensee as the analyses evolved. In total, plant-specific information was derived from the 

following sources: 

• Summaries of any recent past actual overcooling events 

• Current PRA model and writeups 

• Final Safety Analysis Report sections 

• Piping and Instrument Diagrams and electrical drawings 

• Emergency and Abnormal Operating Procedures 

• Miscellaneous system design basis information and related material 

• PTS-relevant training material 

• Operational aspects associated with hot shutdown conditions

2 Generic initiator frequency information (as described in Section 3.1.1.2) was used for Oconee Unit 1 and Beaver Valley Unit 1, 

whereas the plant-specific PRA conducted by Consumers’ Energy personnel (for Palisades Unit 1) ostensibly incorporated plantspecific initiator frequency information. 

7
3. PTS PRA Methodological Approach

• Observation of multiple simulator exercises at each plant involving overcooling events that were 

set-up and run as part of a collaborative effort between each licensee and the NRC contractor 

PRA analysts 

• Periodic interactions with the licensees regarding modeling details as each analysis evolved 

• Feedback from each licensee as interim results from the analyses became available. 

3.2 Step 2: Identify the Scope and Features of the PRA Model

The format, structure, and details considered in the current analyses draw considerably from the earlier 

PRA analyses of PTS. Aside from recognition of the results and the reasons for the results from these 

past analyses, limitations and conservatism associated with the past studies were identified and, to the 

greatest extent possible, alleviated. Other improvements were adopted with the intent of increasing both 

the accuracy and comprehensiveness of the PRA representation of the plants. Table 1 summarizes the 

differences between the current PRA and that used to support the current PTS rule. These differences fall 

into the following three major categories: 

1. Greater refinement and detail in the current PRA 

2. More realistic treatment of operator actions in the current PRA 

3. Use of the latest available data on initiating event frequencies and equipment failure probabilities 

in the current PRA. 

As noted in the table, since these improvements were made with the intent of increasing both the accuracy 

and comprehensiveness of the PRA representation of the plants, they neither systematically increase nor 

reduce the estimated risk from PTS. 

In addition to identifying the areas for improvement of the PRA models that are noted in Table 1, review 

of past PRA analysis of PTS provided information in four other areas: 

1. Identifying the types of sequences that needed to be included in the PRA 

2. Identifying what types of initiating events should be included 

3. Identifying what functions and equipment status needed to be included, and 

4. Identifying what human actions needed to be considered. 

The following four sub-sections describe the general features of the PRA models in each area. These 

features were established by a team approach involving analysts skilled in both system/sequence 

considerations and HRA considerations. Thus, the process for building PRA models involved integrated 

consideration of both system/sequence and human reliability factors. 

8
3. PTS PRA Methodological Approach

Table 1. Comparison of PRA analyses used in this study with the PRA analyses that supported

10CFR50.61.

Difference Between Current PRA Analyses and the PRA 

Analyses that Supported 10CFR50.61

Effect on

Calculated

Risk

Comments

1 Slight expansion of the types of 

sequences and initiators considered Increase

2

Slight expansion of support systems both 

as initiators and as dependencies 

affecting equipment response

Increase

3

Less gross binning of TH sequences 

because there are more "cases" into 

which to bin individual TH runs

Reduce

Current work features 50-100 

cases per plant whereas previous 

studies only considered about a 

dozen cases (e.g., small 

steamline breaks and the opening 

of 1-2 secondary valves were 

previously binned with a large 

guillotine steamline break, 

thereby treating the cooling 

effects of the smaller scenarios 

much too conservatively).

4

Refinement 

of / Detail 

Considered 

by the 

Analysis

External initiating events considered as

potential PTS pre-cursors

Increase See [Kolaczkowski 04a].

5

Credit for operator actions is based on 

detailed consideration of numerous 

contextual factors associated with the 

modeled sequences, on multiple simulator 

observations at each plant, on the latest 

procedures and relevant training, and on 

numerous discussions with operating and 

training staffs. Detrimental acts of 

commission are also considered based on 

these same inputs, including procedural 

steps that call for operator actions that 

can exacerbate overcooling in certain 

situations.

Both Increase 

and Reduce

6

Treatment of 

Operator 

Actions

A greater number of discrete operator 

action times are considered. Reduce

Previous studies considered 

success or failure of operator 

action generally at 1 time after 

the start of the event. Currently, 

we consider up to 3 discrete 

times for operator action.

7 Use of New

Data

Includes the latest industry-wide (and 

some plant-specific) data for initiating 

event frequencies, equipment failure 

probabilities, and common-cause 

considerations.

Reduce

Largest factor is the significant 

drop in the initiator frequencies 

as a result of the decrease in 

scram rates resulting from 

institutional programs executed 

in the ‘80s and ‘90s.

9
3. PTS PRA Methodological Approach

3.2.1 Types of sequences

The following list details the types of sequences included in the PRA models: 

• overcooling scenarios, 

– at full/nominal power operation 

– at hot shutdown conditions 

• loss of reactor coolant system (RCS) pressure scenarios, 

• virtually sustained RCS pressure scenarios (i.e., scenarios where RCS pressure initially decreases, 

necessitating start of high pressure injection to restore pressure), 

• late repressurization scenarios, and 

• scenarios that provide immediate overcooling as well as those that begin as loss of cooling 

scenarios (i.e., under-cooling) and subsequently become overcooling scenarios. 

Two types of scenarios commonly modeled in PRAs are not included in the current PTS analyses: 

1. anticipated transients without scram (ATWS) scenarios, and 

2. interfacing system loss-of-coolant accident (ISLOCA) scenarios. 

Sequences resulting from such scenarios were not included based on the following considerations. First, 

ATWS events generally initially begin as a severe under-cooling event (i.e., there is too much power for 

the heat removal capability) and would likely involve other failures to achieve an overcooling situation 

even if it were possible to do so. While ISLOCAs, like the loss of coolant accidents (LOCAs) modeled in 

the PTS study, could involve overcooling from the start of the event, significant ISLOCAs are often 

assumed to fail mitigating equipment in PRAs which ultimately causes an under-cooling event and core 

damage. Second, with typical ATWS and sizeable (not just small leaks) ISLOCA frequency estimates in 

the E-5/yr to E-6/yr or even lower range and with the need for other failures to occur to possibly cause a 

continuing and serious overcooling situation, sequences involving ATWS or ISLOCAs should not be 

significant contributors to PTS risk. This is because the other modeled scenarios likely to be significant 

contributors to PTS risk have initiator frequencies commonly in the 1/yr to E-3/yr range, including other 

LOCAs that are already modeled in the PTS study. 

3.2.2 Initiating Events

The following internal initiating events were included in the PRA models: 

• Small-, medium-, and large-break LOCAs; 

• Transients commonly modeled in PRA analyses, including: 

– Reactor-turbine trip, 

– Loss of main feedwater, 

– Loss of main condenser, 

– Loss of offsite power (including station blackout), 

– Loss of support systems such as AC or DC buses, 

– Loss of instrument air, and 

– Loss of various cooling water systems; 

• Steam generator tube rupture (SGTR); and 

• Small and large steamline breaks with and without subsequent isolation.

10
3. PTS PRA Methodological Approach

3.2.3 Functional/Equipment Considerations

The event trees in the PRA models that depict potential overcooling sequences are based on the status and 

interactions of four plant functions and associated plant equipment. Figure 3 presents a function-level 

event tree depicting the four functions and resultant general types of sequences treated in the PRA 

models. Each plant analysis features much more detailed event trees constructed at the initiator and 

equipment response level that incorporate the plant specific design and operational features. These four 

functions (i.e., primary integrity, secondary pressure, secondary feed, and primary flow / pressure) are 

important to treat in the PTS analyses for the following reasons: 

• Primary integrity: The status of this function influences the potential RCS pressure, which in turn 

influences the rate of cooldown (in some situations), the injection source capability, and the 

incoming and outgoing flowrates. All of these factors influence the vessel downcomer 

temperature. 

• Secondary pressure: The status of this function influences the pressure and temperature in the RCS, 

since the RCS and the secondary side of the plant are thermal-hydraulically coupled in most 

scenarios. For example, a rapid drop in secondary pressure can cause rapid cooling of the RCS, 

affecting both the downcomer temperature and, potentially, the RCS pressure (depending on 

subsequent RCS injection flow and heat removal). 

• Secondary feed: The status of this function influences the pressure and temperature in the RCS, 

since the RCS and the secondary side of the plant are thermal-hydraulically coupled in most 

scenarios. For example, overfeed can contribute to enhanced cooling of the RCS, affecting both 

the downcomer temperature and, potentially, the RCS pressure (depending on subsequent RCS 

injection flow and heat removal). 

• Primary pressure/flow: The status of this combination of conditions influences the RCS pressure 

and flow conditions (forced flow or natural circulation) during the overcooling event as well as 

the nature of the injection that can add cooling to the vessel wall. The flow characteristics either 

exacerbate or mitigate flow stagnation which can also affect the downcomer temperature. 

In the plant-specific event trees, the status of equipment relevant to each function is modeled. This means 

that for each plant, the status of equipment relevant to each function is identified and included in the 

sequence modeling. For illustrative purposes, the following list summarizes the equipment associated 

with each function in the PRA models. 

• Primary integrity: Status of pipe breaks, pressurizer power-operated relief valves (PORVs) and 

associated block valves, pressurizer safety relief valves (SRVs), and pressurizer heaters and spray 

considerations where appropriate. 

• Secondary pressure: Status of steamline breaks, main steam isolation valves (MSIVs) and 

associated non-return valves, as well as related bypass and drain valve considerations where 

appropriate, turbine throttle and governor valves, steam dump/turbine bypass valves and 

associated isolation valves (if any), atmospheric dump and associated isolation valves, and 

secondary steam relief valves (SSRVs). 

11
IN ITIATOR PRIM ARY _ INTEGRITY S ECO ND ARY_ PRESSU RE SEC O NDAR Y_FEED P RIMAR Y_IN TEG R ITY _(F&B) PR IMARY_ FLO W -PR ESSUR E 

( 1) Not consider ed a P TS concer n regardles s of pri m ary fl ow / pressure ( 2) Not analy ze d as p art of PT S a nalysi s sinc e s equ enc e l ea ds t o (p oss ib le ) cor e d amag e ( 3) CLOSE D pr im ar y i nte gri ty ( i. e., n o ope ni ng) re su lt s in

(possbl e) cor e da mage ; thu s , not ana ly ze d as p art ofPT S a nalysis.

( 4) For cas es w he re t he initial pr im ar y b rea ch is la rge

e nough (e .g., la rge LOCA) , t he " CL OS E D" branc h of t

he F& B to p ev en t is not applicabl e sinc e suf ficient

b lee d i s al re ady pres ent; thus , the se quen ce logic

s imp ly "pass es th rou gh" the F& B top ev ent to th ePR

OK

12

Br eak or stuc k op en valve

Increas ed pote nti al for PTS

OKDepressurizing

OKOverfeedUn derfeedNo t isol ated (i .e. , over fee d)Un derfeed

Prima ry integrity OPEN

for feed and bleed

Prima ry integr ity CLO SED . Fee d an d bleed not possi ble .OPENSec onda ry dep ressuri za ti on fu rth er lo wer s RC S te mper atu reCLOSED(4)(4)

OK /C ontrolledInjecti on over feed /RC P Injection unde rfe edOK /C ontrolledInjecti on over feed /RC P Injection unde rfe edOK /C ontrolledInjecti on over feed /RC P Injection unde rfe edOK /C ontrolledInjecti on over feed /RC P Injection unde rfe ed

FUNCTIONA L-ET - PT S F unctional Even t T ree 200

Figure 3. Functional event tree as the basis for PTS PRA analyses.
3. PTS PRA Methodological Approach

• Secondary feed: Status of main feedwater (MFW), condensate, and auxiliary/emergency 

feedwater (AFW/EFW) systems. 

• Primary pressure/flow: Status of high head safety injection, charging pumps and letdown 

considerations, accumulators/safety injection tanks, low head safety injection, reactor coolant 

pumps (RCPs). 

The status of other equipment that is relevant because of interactions with the equipment in this list is also 

modeled as appropriate. Such equipment includes the actuation and protection/isolation circuitry 

associated with the equipment in the preceding list, and support systems including cooling water, 

instrument air, and electric power and instrumentation. Heating and ventilation equipment was not 

considered in the analyses due to the slow effects of such a loss, and since the loss can often be easily 

identified and recovered. 

3.2.4 Human Action Considerations

Plant records of overcooling events that have actually occurred demonstrate that operator actions and 

inactions can significantly influence the degree of overcooling and the RCS pressure for many types of 

overcooling events. Consequently, operator action directly influences, in both beneficial and detrimental 

ways, the potential for many types of event sequences to become serious PTS challenges. For example, 

early operator action to isolate the feed to a faulted (depressurizing or already depressurized) steam 

generator (SG), directly affects the amount of overcooling that occurs and/or how long such cooling is 

sustained. Consequently, any “realistic” PTS analysis needs to consider operator actions and inactions that 

influence overcooling sequences. Therefore, consistent with the guiding principles of this project to adopt 

best-estimate models and treat uncertainties explicitly whenever practicable, a rigorous treatment of human 

actions is included in the PRA models. The process to identify, model, and probabilistically quantify 

human factors derives largely from NUREG-1624, Revision 1 [NUREG 1624R1], which uses an expert 

elicitation approach. In this study the experts included both NRC contractors and licensees. These 

individuals considered both errors of omission and acts of commission. This process identified several 

general classes of human failures (see Table 2), which have been incorporated into the PRA models. 

Table 2 also indicates which of the four primary functions (identified in Section 3.2.3 and Figure 3) these 

failures most affect. 

3.3 Step 3: Construct the PRA Models

The well-known and well-established event tree-fault tree PRA methodology was adopted as the basis for 

all plant specific analyses. However, the modeling approach varied somewhat from plant to plant because 

of the order in which the plants were analyzed (lessons learned in the Oconee analysis impacted the 

Beaver Valley and Palisades modeling approach, for example). Additionally, the availability of 

information from TH and PFM at the time PRA modeling began influenced how the PRA model evolved. 

A summary of the modeling approaches for Oconee, Beaver Valley, and Palisades is presented in the 

following two subsections. 

3.3.1 PRA Modeling Differences Attributable to the Organization Constructing the

Model

Both the Oconee and Beaver Valley PTS analyses use the same large event tree - small fault tree 

modeling format adopted by the PRAs that formed the technical basis for the current PTS rule. This 

approach makes best use of the earlier work in constructing updated PRA models. Since the desired 

13
3. PTS PRA Methodological Approach

Table 2. General classes of human failures considered in the PTS analyses.

Primary Integrity

Control

Secondary Pressure

Control

Secondary Feed

Control

Primary Pressure/Flow

Control

I. Operator fails to isolate

an isolable LOCA in a 

timely manner (e.g., 

close a block valve to a 

stuck- open PORV) 

II. Operator induces a 

LOCA (e.g., opens a 

PORV) that 

induces/enhances a 

cooldown

I. Operator fails to 

isolate a 

depressurization 

condition in a timely 

manner 

II. Operator isolates 

when not needed (may 

create a new 

depressurization 

challenge, lose heat 

sink...) 

III. Operator isolates 

wrong path/SG 

(depressurization 

continues) 

IV. Operator creates an 

excess steam demand 

such as opening 

turbine 

bypass/atmospheric 

dump valves

I. Operator fails to 

stop/throttle or 

properly align feed in 

a timely manner 

(overcooling enhanced 

or continues) 

II. Operator feeds wrong 

(affected) SG 

(overcooling 

continues) 

III. Operator 

stops/throttles feed 

when inappropriate 

(causes underfeed, 

may have to go to feed 

and bleed with its 

subsequent increase in 

potential for 

overcooling)

I. Operator does not 

properly control 

cooling and 

throttles/terminates 

injection to control 

RCS pressure 

II. Operator trips RCPs 

when not appropriate 

and/or fails to restore 

them when desirable 

III. Operator does not 

provide sufficient 

injection or fails to 

trip RCPs 

appropriately (failure 

to provide sufficient 

injection is modeled as 

leading to core 

damage; thus, such 

sequences are not 

PTS-relevant)

outputs do not require the explicit component faults for some of the systems included in the model, very 

simple system fault trees were used with corresponding system-level failure data to represent the failure 

or unavailability of these systems. 

In contrast, a plant-specific PRA model developed by the licensee was used to provide the starting point 

for the PRA model of the Palisades plant used in this project. The licensee’s PRA includes more detailed 

component-level fault trees for all the systems included in the PTS-PRA model. However, in all three 

analyses, the level of resolution in the results is sufficient for the purposes of assessing the PTS risk. 

3.3.2 PRA Modeling Differences Attributable to the Order of Plant Analysis

The PRA model of Oconee was constructed first (at a time when feedback information from the TH 

analysis and from the PFM analysis was not yet available). Consequently, it was not possible to screen 

out of the model overcooling sequences having a benign TH response or very low estimated conditional 

probabilities of through wall cracking (from the PFM analysis). Hence, the Oconee PRA model contains 

virtually all the possible overcooling sequences with virtually no a priori screening out of “low 

significance” sequences. Subsequent feedback from both TH and PFM verified that many of the 

sequences included in the Oconee model could justifiably been omitted from the PRA model. 

Work on the Beaver Valley PRA model was initiated after the Oconee model had been constructed, at a 

time when the Oconee analysis results, while still evolving, were generally well understood. Also, as the 

Beaver Valley PRA model was being constructed, some advanced TH and PFM results were already 

available for Beaver Valley sequences–identified from “lessons learned” from the Oconee analysis. 

Consideration of this Beaver Valley TH/PFM information permitted a priori screening of the following 

general categories of sequences from the Beaver Valley PRA model: 

14
3. PTS PRA Methodological Approach

• Sequences involving certain combinations of stuck-open pressurizer PORVs or SRVs were not 

modeled 

• Sequences involving certain combinations of secondary valve and simultaneous pressurizer 

PORV/SRV stuck-open events were not modeled 

• Sequences involving only secondary valve (single or multiple) stuck-open events were not 

modeled 

• Sequences involving overfeed of various SG combinations were not modeled 

• Sources of secondary depressurization downstream of the MSIVs were not explicitly modeled 

• SGTR sequences were not modeled including even those involving lack of proper feed control 

and even with RCPs shutdown (possibly inducing RCS loop stagnation) 

• Other sequences were screened from modeling on a case-by-case basis if the sequence frequency 

could be conservatively estimated as less than ~10-8/yr. This screening criterion was used 

because, when coupled with the maximum CPF calculated for any type of sequence (in the 10-3 

range) a TWCF of <10-11/yr would be generated. Such frequencies would clearly not be 

important to the overall PTS results since some other sequences were known to involve TWCFs 

in the 10-8/yr range. 

Because the Palisades model was built starting with an already established licensee component-level PRA 

model with overcooling sequences, it is the most detailed model of the three. This pre-existing Palisades 

model was augumented by the licensee, on the basis of NRC contractor review and input, to include 

possible scenarios and other factors not already in the pre-existing model. Consequently, the “lessons 

learned” from the Oconee PRA influenced the Palisades PRA model as well. In general, the Palisades 

PRA model addresses the same types of initiators and sequences as do the Oconee and Beaver Valley 

models. However, with few exceptions, the initiating event frequencies, equipment failure probability 

data, and human failure estimates are specific to Palisades. 

3.4 Step 4: Quantify and Bin the PRA Modeled Sequences

For each plant, two conditions were modeled: full operating power and hot zero power (HZP). As 

identified in Section 3.3.2, little information was available to screen out potential PTS sequences for 

Oconee. Thus, because of a SAPHIRE code [SAPHIRE] limitation (i.e., the inability to store more than 

100,000 sequences in a data base)3

, it became necessary to produce separate SAPHIRE models for power 

and for HZP. Once the models (i.e., the event trees and fault trees) were constructed, the SAPHIRE code 

was used to generate the sequence logic for each event tree, and to solve the resulting sequences (90,629 

sequences for each model) with no truncation due to frequency. 

Given the number of potential PTS sequences for Oconee (181,258), it was necessary to group (i.e., bin) 

sequences with like characteristics into representative TH cases for analysis using RELAP [NUREG/CR6858]4

.

3

This limitation has been removed from the current version of the software. 

4

This same binning process was used for Beaver Valley and Palisades, though the number of sequences to bin was smaller. 

15
3. PTS PRA Methodological Approach

Initial bins were constructed by developing event tree partitioning rules in SAPHIRE and then applying 

these rules to produce the TH bins. Development of the partitioning rules required the analysts to 

examine the TH information available from preliminary analyses to identify the characteristics that would 

be important to the binning process. 

Using this information, the analysts then made judgments as to whether existing TH characteristics could 

be used to represent new groups of sequences. If the analysts judged that existing characteristics were 

appropriate, either because they matched the examined sequences exactly or because the TH conditions 

from the new sequences were expected to be similar to but not be worse than the conditions from the 

existing analysis, then the uniquely-defining characteristics associated with the existing TH analyses were 

written in rule form for application in SAPHIRE. For those cases where the analysts were sufficiently 

unsure as to the appropriateness of using existing characteristics, new TH characteristics were identified. 

These new sets of characteristics were discussed with the TH analysts. If after discussion with the TH 

analysts, it was concluded that the expected TH conditions could be sufficiently different from prior TH 

analyses and that the frequency of occurrence of the conditions was such that it could not be “added” to 

some existing TH bin without being unnecessarily conservative, then a new TH calculation was 

identified. The TH characteristics associated with this new calculation were then written in rule form for 

subsequent application in SAPHIRE. 

This iterative process continued until all accident sequence cut sets were associated with a specific TH bin. 

Thus, the final application of the developed rules involved the examination of each sequence cut set to

determine which rule the cut set met, the subsequent “tagging” of the cut set, and the gathering of liketagged cut sets into initial TH bins. Once all cut sets were gathered into the initial TH bins, the bins were 

re-quantified using a truncation limit of 1E-10/yr. 

For Beaver Valley, essentially the same process was followed. The major difference between the Oconee 

and Beaver Valley analyses was in the number of sequences developed and solved (a total of 8,298 

sequences for Beaver Valley for power and HZP). As discussed in the previous subsection, knowledge 

about what was and was not important in the Oconee analysis was used with preliminary sequence 

frequency estimates and CPFs results from early Beaver Valley TH and PFM calculations to minimize the 

number of sequences actually modeled in the corresponding SAPHIRE data bases. Given the 

significantly fewer number of sequences, no truncation was performed on the initial TH bins. 

For Palisades, the process was somewhat different in that the SAPHIRE model included both power and 

HZP sequences in the same data base (only 3425 sequences total) and the sequences were solved using a 

1E-9/yr truncation value. Another difference between the Palisades and Oconee or Beaver Valley 

analyses was how the TH bins were created. In the Palisades analysis, each sequence end state was 

defined to a specific TH bin and all resulting cut sets were placed in the defined bin. (Note: use of this 

binning process rather than the one used in the Oconee or Beaver Valley analyses did not have any 

significant impact on the results which are similar across the three plants. It is simply that the binning 

process was somewhat more crude to expedite the analysis process.) 

3.5 Step 5: Revise PRA Models and Quantification

With preliminary results available, reviews by both licensee and internal project staff were conducted. 

This allowed for formal feedback from the licensee with regard to the PTS-PRA models, inputs, 

assumptions, and results, and provided an opportunity for analysts’ self-review of the PRA to date. The 

purposes of the reviews were to determine: 

• whether inaccuracies existed in the models, and whether additional potential PTS sequences

16
3. PTS PRA Methodological Approach

needed to be modeled, 

• whether additional TH bins should be created to reduce unnecessary conservatism based on new 

or updated information obtained from preliminary CPF calculations or needs identified by the 

uncertainty analysis, 

• which human actions were associated with the important TH bins, 

• which of these human actions should be reexamined to produce even more realistic (i.e., less 

conservative) human error probabilities (HEPs), and 

• what combination of the above could be accomplished within the constraints of the project. 

For Oconee, the reviews identified the need: 

• to add one more type of potential PTS sequence, 

• for additional TH bins to address uncertainty issues and to reduce conservatism (Note: 

conservatism is not reduced by having too many sequences represented by a bin that is described 

by plant conditions that are too conservative for the actual conditions of the sequences), and 

• to reexamine some human actions to produce updated HEPs to account for more specific 

conditions. 

The Beaver Valley reviews identified the need: 

• for additional TH bins to address uncertainty issues and to reduce conservatism, and 

• to reexamine a few human actions to produce updated HEPs to account for more specific 

conditions. 

Because the Palisades analysis was being performed by the utility, the results of the review described here 

dealt only with issues identified by the NRC review of the licensee’s PTS model. The review identified the 

need: 

• to add additional break sizes to the LOCA class of initiating events, 

• to modify probabilities for a few selected basic events, and 

• for additional TH bins to address uncertainty issues. 

It should be mentioned that while formal reviews were performed, such as during the second plant visit at 

both Oconee and Beaver Valley, informal periodic review was conducted via the written and vocal 

communications among the licensees and project staff on a frequent basis. Appropriately, the models 

were revised and re-quantification was performed on the basis of these licensee inputs and as a result of 

self-evaluations by the project staff. 

17
3. PTS PRA Methodological Approach

3.6 Step 6: Perform Uncertainty Analyses

The primary objective of the PRA portion of the PTS analyses was to produce estimates of the 

frequencies for each set of plant scenarios that comprise the TH bins developed in Step 4. As discussed 

previously, these scenarios involve initiating events, mitigating equipment successes and failures, and 

operator actions that result in various degrees of overcooling of the internal reactor vessel downcomer 

wall. The major areas of uncertainty associated with the PRA can be grouped into two broad categories: 

• modeling of the representative plant scenarios, and 

• estimation of the frequency of each modeled scenario. 

These areas of uncertainty and the techniques used to deal with the uncertainties are discussed in the 

following two subsections. 

3.6.1 Modeling of Representative Scenarios to Characterize Aleatory Uncertainty

Each scenario in the PRA is represented by a collection of events described by the logic of the event tree 

and relevant fault trees for each initiating event identified in the analysis. The model initially assumed 

binary logic (e.g., valve fully re-closes or sticks wide open; no in-between states) for the events. The only 

explicit modeling of event timing involved the timing of operator actions (i.e., failure to take an action is 

modeled as failure to take that action in multiple discrete times–for example, by 10 min, by 20 min–each 

with a probability). Most uncertainties with regard to the model structure (e.g., completeness, in-between 

states) are not quantified. However, where judged potentially important, a few aleatory uncertainties 

were addressed by purposely changing the model and assigning a probability to the applicability of the 

model change. Each of these changes becomes a different scenario (TH bin) with an associated frequency 

(e.g., area associated with a stuck open SRV reduced 30%, timing of reclosure of a stuck open SRV, 

actual break size of small and medium LOCAs). Since it is unknown which scenario will occur following 

an initiating event, the complete set of scenarios, as represented by the event trees, characterize a large 

part of the aleatory uncertainty associated with the occurrence of a PTS challenge. The most important of 

these uncertainties that were handled explicitly in the analyses are addressed further in the next step, Step 

7. 

In addition, there is the overall general uncertainty as to the completeness issue (i.e., have all scenarios that 

potentially lead to PTS conditions been identified and modeled). This uncertainty issue was addressed 

non-quantitatively through both internal (i.e., NRC and its contractors) and external (i.e., licensee) review 

of the PRA model. As a result of this peer review process, the models are expected to produce a 

sufficiently complete set of potential PTS sequences and thus, any incompleteness in the model is expected 

to have a small effect on the results. 

3.6.2 Quantification of Scenario Frequencies to Characterize Epistemic Uncertainty

Each scenario from the set of modeled scenarios is the interaction of what are treated as random events: 

• initiating event, 

• series of mitigating equipment successes/failures (e.g., MFW trips, AFW starts, atmospheric 

dump valves (ADVs) are challenged and one sticks open...), and 

• operator actions (e.g., fails to close ADV isolation valve by 20 minutes after the ADV sticks 

open). 

18
3. PTS PRA Methodological Approach

Thus, the occurrence of each scenario is random, and the frequency of each scenario is obtained by:

 fscenario = finitiating event ⋅ Prequipment response ⋅ Properator action(s) (Eq. 1) 

where f denotes a frequency and Pr denotes a probability. 

Each of the variables used to obtain the scenario frequency has an epistemic uncertainty described by a 

distribution. The source of this information came primarily from the input data used in the analysis; i.e., 

the addendum to NUREG/CR-5750 [INEEL 00b] for Oconee and Beaver Valley, and the plant-specific 

data used in the Palisades analysis. For a few specific model inputs, other data sources were also used to 

derive these uncertainty estimates. For the HEPs, both best estimate values and uncertainty ranges and 

distributions were derived through the expert elicitation processes carried out in the human reliability 

analyses. Latin Hypercube sampling techniques were used to propagate these epistemic uncertainties to 

generate a probability distribution for each scenario frequency, which subsequently yielded the 

uncertainty in the TH bin frequency. Thus, the frequencies provided by the PRA analysts to the PFM 

analysts were described by histograms representing the resulting frequency distributions. In this way, 

these PRA uncertainty distributions were propagated through and combined with the PFM uncertainties to 

ultimately derive uncertainty distributions in the estimated TWCFs. 

3.7 Step 7: Incorporate Uncertainty and Finalize Results

This section discusses important uncertainties (largely aleatory in nature) specifically addressed in the 

PRA and describes how each was handled. As described in the previous subsection, epistemic uncertainty 

in the frequency for each of the final TH bins was estimated using Latin Hypercube sampling techniques 

and will not be described in this subsection. 

The uncertainties below were dealt with quantitatively; however, the degree of resolution associated with 

each specific uncertainty was limited. These uncertainties include: 

• size of the LOCA within a LOCA category plus other factors (e.g., initial injection water 

temperature), 

• size of the opening associated with a single or multiple stuck open SRV(s), 

• time at which a stuck open SRV recloses, and 

• time at which operators take or fail to take action. 

These uncertainties were highlighted for specific treatment in the analysis based on (a) the scenarios found 

to be most important to the PTS results, and (b) a series of uncertainty analyses performed by the 

University of Maryland (UMD) project team members on many of the inputs and parameters potentially 

affecting the PTS results to see which uncertainties would most affect those results. The specific UMD 

analyses are discussed in [Chang]. The results of that work concluded that the above uncertainties are 

sufficiently important that they needed to be treated explicitly in the PRA model. These uncertainties and 

how they were addressed are discussed in the following paragraphs. 

The actual break size of a LOCA for a specific LOCA class (i.e., small, medium, or large) can be any 

point on the spectrum of sizes defined by the two end points for that class. In addition, other factors (e.g.,

19
3. PTS PRA Methodological Approach

initial injection water temperature, break location, and injection flow rate) can contribute to the overall 

PTS model uncertainty since these factors along with the specific break size affect the rate of cooling and 

subsequent plant response. Numerical probability results from the UMD uncertainty analysis were used to 

model and estimate the importance of the various modeling uncertainties examined in the UMD analysis, 

including the different break sizes within a given class (which was assumed to be uniformly distributed). 

These numerical analyses provided a spectrum of different plant TH responses arising from uncertainties 

in these key parameters including break size. This spectrum of results was then represented by a number 

of discrete cases to cover the total spectrum of results (typically, five cases for small 

LOCAs, three for medium LOCAs, and one for large LOCAs). Each case was assigned a probability by 

the UMD analysts based on how much of the total spectrum the discrete case represented. Each discrete 

case was assigned a new TH case number with corresponding TH curves, and the frequency of each new 

case was adjusted using the UMD assigned probability for that case. This was accomplished by: 

• gathering all cut sets from all sequences generated for a specific LOCA class into one bin,

• reproducing the gathered cut sets a specified number of times corresponding to the number of 

discrete cases defined to represent the spectrum of results, and 

• modifying each set of reproduced cut sets to include the probability assigned that discrete case. 

Thus, the new modified cut sets account for the uncertainty associated with various parameters examined 

in the UMD analysis, including possible variation of break sizes within a given LOCA class.

Just as with the LOCAs, the size of the opening associated with a stuck open SRV can vary from sizes 

that are not PTS-significant to the valve fully stuck open. To deal with this issue and other relevant issues 

examined in the UMD analysis, the cut sets (and their associated frequencies) from stuck-open SRV 

sequences were modified to include a fraction that represented the uncertainty from the UMD work. In 

this case, it was assumed that the SRV opening size is uniformly distributed (any specific opening is 

equally likely) and the resulting fraction was included in the sequence frequency estimates to account for 

that fraction of possible SRV size openings that would be sufficient, from a cooling perspective, to be 

potentially important. 

The time at which a stuck-open SRV recloses is unknown and can occur at any point after the valve sticks 

open. To approximate this, the frequencies associated with stuck-open SRV sequences with subsequent 

closure of the SRV were divided equally between two specific SRV reclosure times (i.e., 3000 s and 6000 

s). These two time points were chosen after reviewing stuck-open SRV TH conditions. The 6000 s point 

was chosen to coincide with the time when the change in downcomer wall temperature had “flattened 

out.” The 3000 s point was chosen to coincide with the time when sufficient cooling had occurred to the 

downcomer wall such that PTS could become an issue. Use of these two times provides a mechanism for 

determining some measure of the uncertainty associated with reclosure of stuck open SRVs5, 6. Each case 

5

An enhancement that should be considered for any subsequent analyses entails performing multiple TH and PFM calculations 

for differing valve closure times (e.g., 1000 to 8000 seconds in increments of 1000 seconds) to determine when the CPF peaks. 

The time at which the CPF peaks can then be used as one of the modeled reclosure times (i.e. the latest reclosure time). Care 

should be taken to ensure that the selected reclosure time point does not occur after the operators are expected to have 

transitioned from responding to the initiating event to placing the plant in cold shutdown (e.g., 7200 seconds). 

6

Subsequent sensitivity analyses demonstrated that the 6000 s time is nearly the worst time from a PTS challenge point of view. 

The worst conditional probability of vessel failure typically occur if the SRV is assumed to close at 7000 s or a little beyond, 

with vessel failure probabilities within a factor of ~2 of those calculated for 6000 s. 

20
3. PTS PRA Methodological Approach

was assigned a 50% chance of occurring. 

Just as the time at which a stuck-open SRV recloses is unknown, so too are the times at which operators 

perform actions. To address this issue, the times at which selected operator actions (i.e., those believed to 

be relatively important to PTS) were performed were varied. Typically, two or three different times were 

chosen to represent the uncertainty in when the action would be performed. Once the times were defined, 

typically (1) as early as could be expected, (2) as late as possible that would still affect the outcome, and 

(3) for some actions, some intermediate time, the probability of failing to perform the action by the 

specified time was developed. Use of these operator action times provides a means of estimating the 

uncertainty associated with when the operators actually perform their actions. 

For the Oconee analysis, all issues identified above were incorporated into the analysis. For the Beaver 

Valley and Palisades analyses, results from the UMD analysis indicated that little uncertainty came from 

the sequences involving stuck-open SRVs that remained stuck open; thus, no modifications were made to 

those types of sequences in the Beaver Valley and Palisades analyses. However, all other modifications 

were made for the analyses of Beaver Valley and Palisades. 

21
22 
4. SUMMARY

This report summarizes the overall process used to develop and quantify the Oconee, Beaver Valley, and 

Palisades PTS PRA models used to support the PTS re-analysis project. Similarities and differences 

among the development of the models are discussed. 

For more details on the individual analyses see [Kolaczkowski 04b] for Oconee, [Whitehead 04a] for 

Beaver Valley, and [Whitehead 04b] for Palisades.

23
24 
5. REFERENCES

10CFR50.61 Code of Federal Regulation 10CFR50.61, “Fracture Toughness Requirements for 

Protection Against Pressurized Thermal Shock Events,” promulgated 06/26/84. 

Chang Chang, Y.H., Almenas, K., Mosleh, A., and Pour-Gol Mohammad, M., ThermalHydraulic Uncertainty Analysis in Pressurized Thermal Shock Risk Assessment - 

Methodology and Implementation on Oconee, Beaver Valley, Palisades, and Calvert 

Cliffs Nuclear Power Plants, University of Maryland, ADAMS ML043550271, with 

supplementary information regarding the report’s use at ML043510336. 

Dickson T. L. Dickson and S. Yin, “Electronic Archival of the Results of Pressurized Thermal 

Shock Analyses for Beaver Valley, Oconee, and Palisades Reactor Pressure Vessels 

Generated with the 04.1 Version of FAVOR,” ORNL/NRC/LTR-04/18, ADAMS 

ML042960465. 

INEEL Idaho National Engineering and Environmental Laboratory, Reliability Study: 

(various volumes), NUREG/CR-5500 (various volumes). 

INEEL 99 Idaho National Engineering and Environmental Laboratory, “Rates of Initiating 

Events at U.S. Nuclear Power Plants: 1987 – 1995,” NUREG/CR-5750, 

INEEL/EXT-98-00401, February 1999. 

INEEL 00a INEEL staff review of LERs for the Oconee PTS analysis conducted during MarchApril, 2000 based on keywords “overcooling,” “thermal shock,” and “excessive 

cooling.” This includes a draft letter report, “Human Performance Insights for 

Overcooling Events in Support of PTS,” D. Gertman and M. Parrish, INEEL, March 

7, 2000. 

INEEL 00b Idaho National Engineering and Environmental Laboratory, “Rates of Initiating 

Events at U.S. Nuclear Power Plants: 1987 – 1998,” Draft, NUREG/CR-5750, 

INEEL/EXT-2000-00153, March 2000. 

Kolaczkowski 04a Kolaczkowski, A. M., Kelly, D, and Whitehead, D. W., “Estimate of External Events 

Contribution to Pressurized Thermal Shock (PTS) Risk,” Sandia National 

Laboratories, Letter Report, October 2004, ADAMS ML042880476. 

Kolaczkowski 04b Kolaczkowski, A. M. et al., “Oconee Pressurized Thermal Shock (PTS) Probabilistic

Risk Assessment (PRA),” Sandia National Laboratories, Letter Report, September 

2004, ADAMS ML042880452. 

NRC LTR 02 Memorandum from Thadani to Collins on “Transmittal of Technical Work to Support

Possible Rulemaking on a Risk-Informed Alternative to 10 CFR50.46/GDC 35,” 

dated July 31, 2002 (Accession number ML022120660). 

NUREG 1624R1 U.S. Nuclear Regulatory Agency, “Technical Basis and Implementation Guidelines 

for A Technique for Human Event Analysis (ATHEANA),” NUREG-1624, Rev. 1, 

May 2000. 

NUREG/CR-6858 Arcieri, W. C., R. M. Beaton, C. D. Fletcher, and D. E. Bessette, “RELAP5 Thermal 

Hydraulic Analysis to Support PTS Evaluation for the Oconee-1, Beaver Valley-1, 

and Palisades Nuclear Power Plants,” NUREG/CR-6858. 

25
ORNL 85a Oak Ridge National Laboratory, “Pressurized Thermal Shock Evaluation of the Calvert Cliffs Unit 1 

Nuclear Power Plant,” NUREG/CR-4022, ORNL/TM-9408, for the U.S. Nuclear Regulatory 

Commission, September 1985. 

ORNL 85b Oak Ridge National Laboratory, “Pressurized Thermal Shock Evaluation of the H.B. 

Robinson Unit 2 Nuclear Power Plant,” NUREG/CR-4183, ORNL/TM-9567, for the 

U.S. Nuclear Regulatory Commission, September 1985. 

ORNL 86 Oak Ridge National Laboratory, “Preliminary Development of an Integrated Approach to the 

Evaluation of Pressurized Thermal Shock as Applied to the Oconee Unit 1 Nuclear Power Plant,” 

NUREG/CR-3770, ORNL/TM-9176, for the U.S. Nuclear Regulatory Commission, May 1986. 

SAPHIRE Systems Analysis Programs for Hands-on Integrated Reliability Evaluations 

(SAPHIRE) Version 7, Idaho National Engineering and Environmental Laboratory. 

Westinghouse 99 Westinghouse Electric Company LLC, Nuclear Services Division, WOG Pilot-Plant Application of the 

EPRI Alternative Method for Reactor Vessel PTS, WCAP-15156, June 1999. 

Whitehead 04a Whitehead, D. W. et al., “Beaver Valley Pressurized Thermal Shock (PTS) Probabilistic Risk 

Assessment (PRA),” Sandia National Laboratories, Letter Report, September, ADAMS 

ML042880454. 

Whitehead 04b Whitehead, D. W. et al., Palisades Pressurized Thermal Shock (PTS) Probabilistic Risk Assessment 

(PRA), Sandia National Laboratories, Letter Report, October 2004, ADAMS ML042880473. 

26
1. REPORT NUMBER 

(Assigned by NRC, Add Vol., Supp., Rev., 

and Addendum Numbers, if any.)

NUREG-CR-6859

3. DATE REPORT PUBLISHED

MONTH YEAR 

2. TITLE AND SUBTITLE 

PRA Procedures and Uncertainty for PTS Analysis

4. FIN OR GRANT NUMBER

6. TYPE OF REPORT 

 Technical 

5. AUTHOR(S) 

D.M. Whitehead1 and A.M. Kolaczkowski2

7. PERIOD COVERED (Inclusive Dates)

1-2005 to 2-2007

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address; if contractor, 

provide name and mailing address.)

1

Sandia National Laboratories, P.O. Box 5800, Albuquerque, NM 87185-0744

2

Science Application International Corporation, 405 Urban St., Suite 400, Lakewood, CO 80228 

NRC FORM 335

(9-2004) 

NRCMD 3.7

U.S. NUCLEAR REGULATORY COMMISSION

BIBLIOGRAPHIC DATA SHEET

(See instructions on the reverse)

March 2010

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (If NRC, type "Same as above"; if contractor, provide NRC Division, Office or Region, U.S. Nuclear Regulatory Commission, 

and mailing address.)

Division of Fuel, Engineering, and Radiological Research, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, 

Washington, DC 20555-0001 

10. SUPPLEMENTARY NOTES

 M.T. Kirk, NRC Project Manager 

11. ABSTRACT (200 words or less)

This report supplements NUREG-1806, “Technical Basis for Revision of the Pressurized Thermal Shock (PTS) Screening 

Limit in the PTS Rule (10CFR50.61): Summary Report,” with additional information regarding the Probabilistic Risk 

Assessment (PRA) and Human Reliability Analysis (HRA) portions of the PTS analyses presented in that report, including the 

use of realistic input values and models and an explicit treatment of uncertainties. Best estimate equipment failure values are

used throughout based on generic nuclear industry data, or, in cases where it's available, on plant-specific data. Parameters 

related to human performance are based on plant specific review of procedures and training, observation of plant personnel 

responding to PTS-related sequences on their simulator, and performance data from actual plant operations. 

12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers in locating the report.)

Pressurized thermal shock, reactor pressure vessel, probabilistic fracture mechanics 

13. AVAILABILITY STATEMENT 

unlimited 

14. SECURITY CLASSIFICATION 

(This Page)

unclassified 

(This Report)

unclassified 

15. NUMBER OF PAGES 

16. PRICE

NRC FORM 335 (9-2004) PRINTED ON RECYCLED PAPER