Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center v NUREG/CR-6042 Rev. 2

Table of Contents

Abstract ...................................................................................................................................................... iii

Contents ...................................................................................................................................................... v

List of Figures ........................................................................................................................................... xv

List of Tables ........................................................................................................................................... xxii

Acknowledgments .................................................................................................................................. xxiv

English to Metric Conversion Factors ..................................................................................................... xxv

1.0 The Development of Safety Concepts, 1946 - 1975 ........................................................... 1.0-1

1.0.1 Introduction ........................................................................................................ 1.0-1

1.0.2 Learning Objectives for Module 1 ........................................................................ 1.0-1

References for Section 1.0 ............................................................................................... 1.0-6

1.1 1946 - 1953, Emergence of Safety Strategies ..................................................................... 1.1-1

1.1.1 The Atomic Energy Act of 1946 .......................................................................... 1.1-1

1.1.2 Remote Siting ..................................................................................................... 1.1-1

1.1.3 Containment ....................................................................................................... 1.1-1

1.1.4 Accident Prevention and Safety Systems ............................................................... 1.1-2

1.1.5 Defense in Depth ................................................................................................ 1.1-2

References for Section 1.1 ............................................................................................... 1.1-6

1.2 1954 - 1965, Early Commercial Reactors, Emphasis on Containment .................................. 1.2-1

1.2.1 Atomic Energy Act of 1954 ................................................................................. 1.2-1

1.2.2 Early Siting Precedents ........................................................................................ 1.2-2

1.2.3 Power Reactor Development Company Construction Permit Application ................ 1.2-3

1.2.4 The Price-Anderson Act and WASH-740 ............................................................. 1.2-4

1.2.5 The First Intervention .......................................................................................... 1.2-5

1.2.6 Reactor Site Criteria, 10 CFR 100 ........................................................................ 1.2-6

1.2.7 Credit for Engineered Safety Features ................................................................... 1.2-8

References for Section 1.2 ............................................................................................. 1.2-11

1.3 1966 - 1974, Emphasis on Prevention, Public Debate ........................................................ 1.3-1

1.3.1 Reactor Pressure Vessel Integrity ......................................................................... 1.3-1

1.3.2 The China Syndrome .......................................................................................... 1.3-2

1.3.3 The AEC Core Cooling Task Force (CCTF) ......................................................... 1.3-4

1.3.4 General Design Criteria ....................................................................................... 1.3-4

1.3.4.1 Criterion 1-Quality Standards and Records ............................................... 1.3-7

1.3.4.2 Criterion 2-Design Bases for Protection Against Natural Phenomena .......... 1.3-8

1.3.4.3 Criterion 3-Fire Protection ....................................................................... 1.3-8

1.3.4.4 Criterion 4-Environmental and Dynamic Effects Design Bases ................... 1.3-9

1.3.4.5 Criterion 5-Sharing of Structures, Systems, and Components ................... 1.3-10

1.3.5 The National Environmental Policy Act (NEPA) ................................................. 1.3-11

1.3.6 Emergency Core Cooling System Rulemaking .................................................... 1.3-12

1.3.7 The Energy Reorganization Act of 1974 ............................................................. 1.3-13

References for Section 1.3 ............................................................................................. 1.3-17

1.4 Design Basis Perspectives ............................................................................................... 1.4-1

1.4.1 Safety Analysis Report Requirements ................................................................... 1.4-1

1.4.2 Siting Basis Accident .......................................................................................... 1.4-2

1.4.3 Realism of Design-Basis Accident Analyses ........................................................ 1.4-3
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center vi NUREG/CR-6042 Rev. 2

Table of Contents (Continued)

1.4.4 Seismic Design

Basis..................................................................................................... 1.4-5

References for Section 1.4 ............................................................................................. 1.4-21

1.5 The Reactor Safety Study ................................................................................................ 1.5-1

1.5.1 Beyond-Design-Basis Accidents .......................................................................... 1.5-1

1.5.2 The Study .......................................................................................................... 1.5-2

1.5.3 Findings ............................................................................................................. 1.5-2

1.5.4 Impact............................................................................................................................1.5-3

References for Section 1.5 ............................................................................................... 1.5-8

1.6 Browns Ferry Fire ........................................................................................................... 1.6-1

1.6.1 Initiating Events ................................................................................................. 1.6-1

1.6.2 Cable-Spreading Room Fire ................................................................................. 1.6-2

1.6.3 Reactor-Building Fire .......................................................................................... 1.6-3

1.6.4 Fire Damage and Assessment ............................................................................... 1.6-4

1.6.5 Effect of Fire on Unit 1 ....................................................................................... 1.6-4

1.6.6 Effect of Fire on Unit 2 ....................................................................................... 1.6-6

1.6.7 Lessons Learned ......................................................................................................... 1.6-6

References for Section 1.6 ............................................................................................. 1.6-14

Appendix 1A: PRA Terms and Concepts .................................................................................... 1A-1

1A.1 Risk ................................................................................................................... 1A-1

1A.2 The PRA Process ................................................................................................ 1A-2

1A.3 Analysis of Initiating Events ................................................................................ 1A-3

1A.3.1 Internal Initiating Events ......................................................................... 1A-4

1A.3.2 External Initiating Events ........................................................................ 1A-4

1A.3.2.1 Plant Internal Fires ................................................................ 1A-5

1A.3.2.2 Seismic Events ..................................................................... 1A-5

1A.3.2.3 Weather-Related Events ........................................................ 1A-6

1A.3.2.4 Other Naturally Occurring Events .......................................... 1A-7

1A.3.2.5 Human-Caused External Initiators .......................................... 1A-7

1A.3.3 Accidents at Low Power and Shutdown .................................................... 1A-7

1A.3.4 Sabotage Not Treated in PRA .................................................................. 1A-8

1A.4 Accident Sequence Development ......................................................................... 1A-9

1A.4.1 Multiple Versus Single Failures ............................................................... 1A-9

1A.4.2 Use of Event Trees and Fault Trees ........................................................ 1A-10

1A.4.3 Failure Terminology ........................................................................ 1A-11

1A.4.3.1 Independent Versus Dependent Failures ............................... 1A-11

1A.4.3.2 Explicitly Dependent Events ................................................ 1A-12

1A.4.3.3 Common Cause Failures ...................................................... 1A-12

1A.4.3.4 Subtle Failures .................................................................... 1A-14

1A.4.4 Human Factors, Heroic Acts, Errors of Commission ................................ 1A-15

1A.4.5 External Events and Fire Analyses ......................................................... 1A-16

1A.5 Uncertainties in Risk Estimates ........................................................................ 1A-16

References for Appendix 1A .................................................................................................. 1A-36

2.0 Severe Accident Perspectives.....................................................................................................2.0-1

2.0.1 Introduction...................................................................................................................2.0-1
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center vii NUREG/CR-6042 Rev. 2

2.0.2 Learning Objectives for Chapter 2................................................................................2.0-1

Table of Contents (Continued)

2.1 The TMI-2 Accident .............................................................................................................. 2.1-1

2.1.1 Introduction .................................................................................................... 2.1-1

2.1.2 Pre-existing Problems .................................................................................................. 2.1-1

2.1.3 Loss of Feedwater 1 ............................................................................................ 2.1-2

2.1.4 Loss of Coolant, Core Cooled (13 s to 101 min.) ................................................... 2.1-2

2.1.4.1 PORV Sticks Open ................................................................................. 2.1-2

2.1.4.2 Loss of Auxiliary Feedwater .................................................................... 2.1-3

2.1.4.3 Throttling of High Pressure Injection ........................................................ 2.1-4

2.1.4.4 Release Pathways .................................................................................... 2.1-5

2.1.4.5 Auxiliary Feedwater Restored .................................................................. 2.1.6

2.1.4.6 Undiagnosed LOCA Continues ................................................................ 2.1-6

2.1.4.7 Loop B Pumps Turned Off ...................................................................... 2.1-7

2.1.5 Initial Core Damage (101 min. to 174 min.) .......................................................... 2.1-8

2.1.5.1 Loop A Pumps Turned Off, Core Uncovered ............................................ 2.1-8

2.1.5.2 Hydrogen from Zircaloy Oxidation ........................................................... 2.1-9

2.1.5.3 PORV Block Valve Closed .................................................................... 2.1-10

2.1.5.4 Initial Melting in Core Region ............................................................... 2.1-10

2.1.6 Quenching and Related Core Damage (174 min to 375 min) ................................... 2.1-11

2.1.6.1 Restart of Reactor Coolant Pump 2B ............................................................ 2.1-11

2.1.6.2 Core Region Reflooded ................................................................................ 2.1-11

2.1.6.3 Pour of Molten Core Material ...................................................................... 2.1-12

2.1.6.4 HPI On, Off, Finally Sustained ................................................................... 2.1-12

2.1.7 Recovery Attempts (5 h 15 min to 1 month) ............................................................. 2.1-13

2.1.7.1 Attempt to Collapse Vapor Bubble .............................................................. 2.1-13

2.1.7.2 Attempt to Use Core Flood Tanks ................................................................ 2.1-14

2.1.7.3 Attempt to Use Decay Heat Removal, Hydrogen Burn ................................ 2.1-15

2.1.7.4 Forced Circulation Established ..................................................................... 2.1-15

2.1.7.5 Collapsing the Bubble .................................................................................. 2.1-16

References for Section 2.1 ......................................................................................... 2.1-39

2.2 TMI-2 Implications ................................................................................................................... 2.2-1

2.2.1 Introduction ................................................................................................................. 2.2-1

2.2.2 NRC Restructuring ...................................................................................................... 2.2-2

2.2.3 Nuclear Industry Restructuring ................................................................................... 2.2-2

2.2.4 Plant Modifications ............................................................................................. 2.2-3

2.2.5 Operator Testing and Licensing ........................................................................... 2.2-4

2.2.6 Emergency Response Improvements ..................................................................... 2.2-5

2.2.7 Seabrook and Shoreham .............................................................................................. 2.2-5

2.2.8 Severe Accident Research ........................................................................................... 2.2-6

2.2.9 Severe Accident Policy ................................................................................................ 2.2-7

References for Section 2.2 ........................................................................................................ 2.2-9

2.3 The Chernobyl Accident .................................................................................................. 2.3-1

2.3.1 Chernobyl-4 Design Features ............................................................................... 2.3-1

2.3.2 The Chernobyl Experiment .................................................................................. 2.3-2

2.3.3 The Sequence of Events ...................................................................................... 2.3-2

2.3.4 Inside the Reactor ............................................................................................... 2.3-5
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center viii NUREG/CR-6042 Rev. 2

2.3.5 Implications for U.S. Plants ................................................................................. 2.3-5

References for Section 2.3 ............................................................................................... 2.3-9

Table of Contents (Continued)

2.4 Risk Influences and the Development of Safety Goals ........................................................ 2.4-1

2.4.1 Post Risk-Influenced Regulatory Practices ............................................................ 2.4-1

2.4.1.1 Anticipated Transients Without Scram ...................................................... 2.4-1

2.4.1.2 Auxiliary Feedwater Reliability ................................................................ 2.4-6

2.4.1.3 Station Blackout Rule ............................................................................. 2.4-6

2.4.1.4 Backfit Rule .................................................................................................... 2.4-8

2.4.2 Safety Goal Policy ..................................................................................................... 2.4-12

2.4.3 Safety Goal Policy and Backfitting ........................................................................... 2.4-14

References for Section 2.4 ......................................................................................... 2.4-19

2.5 Risk Assessment and Operational Perspectives ........................................................................ 2.5-1

2.5.1 Operating Plant Data ................................................................................................... 2.5-1

2.5.2 Precursor Program ....................................................................................................... 2.5-2

2.5.3 NUREG-1150 Perspectives ......................................................................................... 2.5-2

2.5.3.1 Internal Events Results ................................................................................... 2.5-3

2.5.3.1.1 NUREG-1150 Boiling Water Reactor Observations ...................... 2.5-4

2.5.3.1.2 NUREG-1150 Pressurized Water Reactor Observations ................ 2.5-6

2.5.3.2 NUREG-1150 Seismic Analysis Observations ............................................... 2.5-8

2.5.3.2.1 Surry Seismic Analysis ................................................................... 2.5-9

2.5.3.2.2 Peach Bottom Seismic Analysis ................................................ 2.5-9

2.5.3.3 NUREG-1150 Fire Analysis Observations .............................................. 2.5-10

2.5.3.3.1 Surry Fire Analysis ................................................................. 2.5-10

2.5.3.3.2 Peach Bottom Fire Analysis .................................................... 2.5-10

2.5.3.3.3 General Observations on Fire Analysis .................................... 2.5-11

2.5.4 Individual Plant Examinations .................................................................................. 2.5-11

2.5.4.1 Vulnerabilities and Plant Improvements ....................................................... 2.5-11

2.5.4.2 CDF Perspectives from the IPEs .................................................................. 2.5-12

2.5.5 Individual Plant Examinations for External Events ................................................... 2.5-13

2.5.6 Low Power and Shutdown Perspectives .................................................................... 2.5-17

2.5.6.1 Grand Gulf Low Power and Shutdown Observations ................................... 2.5-18

2.5.6.2 Surry Low Power and Shutdown Observations ............................................ 2.5-19

2.5.6.3 Industry Low Power and Shutdown Studies ................................................. 2.5-19

2.5.7 Station Blackout Sequences ...................................................................................... 2.5-20

2.5.8 Current Understanding of Risk .................................................................................. 2.5-23

References for Section 2.5 ......................................................................................... 2.5-50

2.6 Risk-Informed Regulation ............................................................................................... 2.6-1

2.6.1 PRA Policy Statement ......................................................................................... 2.6-1

2.6.2 Issues Concerning the Quantitative Use of PRA .................................................... 2.6-2

2.6.3 Reactor Oversight Process (ROP) ......................................................................... 2.6-4

2.6.3.1 The Cornerstones of Reactor Safety .......................................................... 2.6-5

2.6.3.2 Performance Indicators ................................................................................... 2.6-6

2.6.3.3 The Baseline Inspections ................................................................................ 2.6-8

2.6.3.4 The Significance Determination Process ........................................................ 2.6-9

2.6.3.5 The NRC Action Matrix ............................................................................. 2.6-10

2.6.3.6 Licensee Corrective Action Program ..................................................... 2.6-10

2.6.4 Regulatory Guide 1.174 .................................................................................... 2.6-10
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center ix NUREG/CR-6042 Rev. 2

2.6.4.1 A Four-Element Approach to Integrated Decision Making .......................... 2.6-10

2.6.5 Recent Regulatory Changes ....................................................................................... 2.6-15

Table of Contents (Continued)

2.6.5.1 Maintenance Rule (10CFR50.65) ................................................................. 2.6-15

2.6.5.2 Risk-Informed Technical Specifications ....................................................... 2.6-18

2.6.5.3 Risk-Informed In-Service Testing ........................................................... 2.6-20

2.6.6 NRC Initiatives for Regulatory Change ..................................................................... 2.6-22

References for Section 2.6 ......................................................................................... 2.6-43

Appendix 2A: Davis-Besse Loss of Feedwater ............................................................................ 2A-1

2A.1 Initiating Events ................................................................................................. 2A-1

2A.2 Reactor Trip - Turbine Trip ................................................................................. 2A-2

2A.3 Loss of Main Feedwater ...................................................................................... 2A-3

2A.4 Loss of Emergency Feedwater ............................................................................. 2A-4

2A.5 Reactor Coolant System Heatup ........................................................................... 2A-5

2A.6 Operator Actions ................................................................................................ 2A-6

2A.7 PORV Failure ..................................................................................................... 2A-8

2A.8 Steam Generator Refill ...................................................................................... 2A-10

2A.9 NRC Findings and Conclusions ......................................................................... 2A-11

Appendix 2B: Information on ATWS .......................................................................................... 2B-1

2B.1 Protection Systems Designs and Failure Analyses .................................................. 2B-1

2B.2 Plant Response to ATWS Events ......................................................................... 2B-3

2B.3 Failure of Control Rods to Fully Insert at Browns Ferry 3 ...................................... 2B-4

2B.4 ATWS Event at Salem 1 ...................................................................................... 2B-6

2B.5 10 CFR 50.62, The ATWS Rule ........................................................................ 2B-10

2B.6 Changes Considered for ATWS Rule ................................................................. 2B-11

2B.7 BWR ATWS Behavior and Mitigation Measures ................................................. 2B-12

2B.7.1 Categories of BWR ATWS .................................................................... 2B-13

2B.7.1.1 Turbine Trip With Bypass ....................................................... 2B-13

2B.7.1.2 MSIV Closure ........................................................................ 2B-13

2B.7.2 Mitigation Measures ............................................................................. 2B-14

2B.7.2.1 Recirculation Pump Trip ......................................................... 2B-14

2B.7.2.2 Standby Liquid Control System (SLCS) ................................... 2B-15

2B.7.2.3 Manual Rod Insertion ............................................................. 2B-16

2B.7.2.4 Control of Vessel Injection ...................................................... 2B-16

2B.7.3 Application of Emergency Procedure Guidelines ..................................... 2B-17

2B.7.4 Summary .............................................................................................. 2B-19

References for Appendix 2B .............................................................................. 2B-27

3.0 Accident Progression in the Reactor Vessel ............................................................................ 3.0-1

3.0.1 Introduction ....................................................................................................... 3.0-1

3.0.2 Learning Objectives ............................................................................................. 3.0-1

3.1 Introduction ................................................................................................................ 3.1-1

3.1.1 In-Vessel Accident Stages ..................................................................................... 3.1-1

3.1.2 Severe Accidents Conditions ................................................................................. 3.1-1

3.1.3 Factors Influencing Timing ................................................................................... 3.1-2

3.1.4 Review of Selected Design Features ....................................................................... 3.1-3

3.1.5 Reflooding During Accident Progression ................................................................. 3.1-3
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center x NUREG/CR-6042 Rev. 2

References for Section 3.1 ........................................................................................... 3.1-18

Table of Contents (Continued)

3.2 Core Uncovering and Heatup ......................................................................................... 3.2-1

3.2.1 Boiloff of Water in Core Region ............................................................................ 3.2-1

3.2.2 Initial Heatup of Uncovered Fuel ........................................................................... 3.2-3

References for Section 3.2 ............................................................................................ 3.2-7

3.3 Cladding Oxidation ...................................................................................................... 3.3-1

3.3.1 Reaction Kinetics ................................................................................................ 3.3-1

3.3.2 Oxidation Front .................................................................................................. 3.3-1

3.3.3 Core Damage Due to Oxidation ............................................................................. 3.3-3

3.3.4 Reflooding During Stage 3 .................................................................................... 3.3-4

3.3.5 Natural Circulation During Core Degradation. .......................................................... 3.3-4

References for Section 3.3 ........................................................................................... 3.3-14

3.4 Melting, Liquefaction, Holdup ....................................................................................... 3.4-1

3.4.1 Initial Melting ..................................................................................................... 3.4-1

3.4.2 Fuel Liquefaction ................................................................................................ 3.4-1

3.4.3 Flow Blockage Versus Streaming ........................................................................... 3.4-2

3.4.4 Reflooding at TMI-2 ............................................................................................ 3.4-3

3.4.5 Additional Reflooding Considerations ..................................................................... 3.4-4

3.4.6 Natural Circulation During Stage 4 ......................................................................... 3.4-5

References for Section 3.4 ........................................................................................... 3.4-13

3.5 Molten Pours onto the Lower Head ................................................................................. 3.5-1

3.5.1 TMI-2 Molten Pour ............................................................................................. 3.5-1

3.5.2 Alternative Melt Flow Scenarios ............................................................................ 3.5-2

3.5.3 Debris on TMI-2 Lower Head ................................................................................ 3.5-3

3.5.4 Hotspot in TMI-2 Lower Head ............................................................................... 3.5-4

3.5.5 Early Views of Lower Head Failure ........................................................................ 3.5-5

3.5.6 Lower Head Failure Modes Analyzed for TMI-2 ....................................................... 3.5-5

3.5.7 Lower Head Failure Experiments and Analyses ........................................................ 3.5-6

3.5.8 Debris Coolability ............................................................................................... 3.5-8

3.5.9 Advanced Design Concepts ................................................................................... 3.5-9

References for Section 3.5 ........................................................................................... 3.5-33

3.6 In-Vessel Fuel-Coolant Interactions ................................................................................ 3.6-1

3.6.1 Steam Explosions ................................................................................................ 3.6-1

3.6.2 Conditions Affecting Steam Explosions ................................................................... 3.6-1

3.6.3 Limitation on In-Vessel FCIs ................................................................................. 3.6-2

3.6.4 In-Vessel FCI Scenarios ....................................................................................... 3.6-3

3.6.5 Alpha Mode Containment Failure .......................................................................... 3.6-4

3.6.6 Vessel Breach by an In-Vessel Steam Explosion and Related Issues ............................. 3.6-5

3.6.7 Impact of Melt Discharge from Vessel .................................................................... 3.6-6

References for Section 3.6 ............................................................................................ 3.6-18

3.7 Special Considerations for BWR Facilities ....................................................................... 3.7-1

3.7.1 Pertinent BWR Features ....................................................................................... 3.7-1

3.7.2 Provisions for Reactor Vessel Depressurization ......................................................... 3.7-3
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xi NUREG/CR-6042 Rev. 2

3.7.2.1 Why Manual Actuation is Necessary ............................................................ 3.7-3

3.7.2.2 Rapid Depressurization for Steam Cooling .................................................... 3.7-4

Table of Contents (Continued)

3.7.2.3 Core Region Dry During Core Degradation ................................................... 3.7-5

3.7.2.4 Threat of Reactor Vessel Repressurization ..................................................... 3.7-6

3.7.2.5 Notes Concerning SRV Operation ............................................................... 3.7-7

3.7.3 Recriticality Concerns .......................................................................................... 3.7-8

3.7.4 Eutectic Formation and Relocation Sequence for BWR Core Structures ...................... 3.7-10

3.7.5 Potential Modes for Debris Movement Past the BWR Core Plate ............................... 3.7-13

3.7.5.1 Core Plate Structure ............................................................................... 3.7-13

3.7.5.2 Accident Sequence Classification for Core Plate Considerations .................... 3.7-14

3.7.5.2.1 Dry Core Plate Accident Sequences ........................................... 3.7-14

3.7.5.2.2 Wet Core Plate Accident Sequences ........................................... 3.7-15

3.7.5.3 Status of Experimental Findings ............................................................... 3.7-16

3.7.6 Severe Accident Events in the BWR Lower Plenum ................................................ 3.7-17

3.7.6.1 Debris Interactions with Lower Plenum Water ............................................. 3.7-17

3.7.6.2 Events after Lower Plenum Dryout ............................................................ 3.7-18

3.7.7 BWR Bottom Head Failure Modes ....................................................................... 3.7-19

3.7.7.1 Failure of the Bottom Head Penetrations ..................................................... 3.7-19

3.7.7.2 Gross Bottom Head Failure ...................................................................... 3.7-21

3.7.7.3 Effectiveness of External Water Cooling .................................................... 3.7-22

References for Section 3.7 .................................................................................. 3.7-54

4.0 Accident Progression in the Containment ......................................................................... 4.0-1

4.0.1 Introduction ....................................................................................................... 4.0-1

4.0.2 Learning Objectives for Chapter 4 .......................................................................... 4.0-1

4.1 Containment Characteristics and Design Bases .................................................................. 4.1-1

4.1.1 Containment Types .............................................................................................. 4.1-1

4.1.1.1 Large Dry Containments ............................................................................ 4.1-1

4.1.1.2 Subatmospheric Containments .................................................................... 4.1-1

4.1.1.3 Ice Condenser Containments ...................................................................... 4.1-2

4.1.1.4 BWR Mark I Containments ........................................................................ 4.1-2

4.1.1.5 BWR Mark II Containments ....................................................................... 4.1-3

4.1.1.6 BWR Mark III Containments ...................................................................... 4.1-3

4.1.2 Containment Design Criteria ................................................................................. 4.1-4

4.1.3 Containment Failure Modes .................................................................................. 4.1-6

References for Section 4.1 ........................................................................................... 4.1-24

4.2 Containment Response to Beyond-Design-Basis Accidents .................................................. 4.2-1

4.2.1 Containment Challenges and Timing of Events ......................................................... 4.2-1

4.2.2 Implications of Containment Failure ....................................................................... 4.2-3

4.2.3 Likelihood of Containment Failure During Severe Accidents ...................................... 4.2-4

4.2.4 Containment Venting Strategies ............................................................................. 4.2-6

References for Section 4.2 ........................................................................................... 4.2-13

4.3 Ex-Vessel Fuel-Coolant Interactions ................................................................................ 4.3-1

4.3.1 Quenching of Core Debris .................................................................................... 4.3-1

4.3.2 Non-Coolable Debris ........................................................................................... 4.3-2

4.3.3 Ex-Vessel Steam Explosions ................................................................................. 4.3-3
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xii NUREG/CR-6042 Rev. 2

4.3.4 Containment Design Considerations ........................................................................ 4.3-4

References for Section 4.3 ........................................................................................... 4.3-12

Table of Contents (Continued)

4.4 Core-Concrete Interactions ............................................................................................ 4.4-1

4.4.1 Concrete Attack .................................................................................................. 4.4-1

4.4.2 Gas Generation ................................................................................................... 4.4-2

4.4.3 Aerosol Generation .............................................................................................. 4.4-3

References for Section 4.4 ........................................................................................... 4.4-13

4.5 Direct Containment Heating (DCH)................................................................................................4.5-1

4.5.1 Ejection of Melt from the Vessel...................................................................................

4.5-1

4.5.2 Interactions in the Reactor Cavity.................................................................................. 4.5-2

4.5.3 Energy Deposition and Pressure Rise in Containment...................................................... 4.5-3

4.5.4 Containment Failure Probabilities for DCH.......................................................................... 4.5-4

References for Section 4.5.............................................................................................................4.5-13

4.6 Hydrogen Combustion ................................................................................................. 4.6-1

4.6.1 Hydrogen Combustion Reaction ............................................................................ 4.6-1

4.6.2 Conditions Necessary for Combustion .................................................................... 4.6-1

4.6.3 Deflagrations ..................................................................................................... 4.6-3

4.6.4 Detonation of Hydrogen ...................................................................................... 4.6-4

4.6.4.1 Detonation Limits .................................................................................... 4.6-4

4.6.4.2 Transition to Detonation ........................................................................... 4.6-5

4.6.4.3 Detonation Pressure and Temperatures ........................................................ 4.6-6

4.6.4.4 Local Detonation ..................................................................................... 4.6-6

4.6.4.5 Missile Generation .................................................................................. 4.6-7

4.6.5 Continuous Combustion ...................................................................................... 4.6-7

4.6.6 Combustion at TMI-2 .......................................................................................... 4.6-8

4.6.7 Hydrogen Control Requirements ........................................................................... 4.6-8

4.6.8 Risk Informed Changes to the Hydrogen Rule ....................................................... 4.6-10

References for Section 4.6 .................................................................................................. 4.6-30

4.7 BWR Mark I Liner Failure By Melt Attack ....................................................................... 4.7-1

4.7.1 Pertinent Features of the Mark I Containment Design ................................................ 4.7-1

4.7.2 Characteristics of Debris Pours From Vessel ............................................................ 4.7-2

4.7.2.1 Scenario I: Large Initial Pour of Molten Oxides ............................................ 4.7-2

4.7.2.2 Scenario II: Metallic Pour Followed by Release of Oxides .............................. 4.7-3

4.7.2.3 Accident Scenarios Not Represented ........................................................... 4.7-3

4.7.3 Debris Spreading Across The Drywell Floor ............................................................ 4.7-4

4.7.4 Thermal Loading of the Shell ............................................................................... 4.7-5

4.7.5 Mitigative Effects of Water ................................................................................. 4.7-5

4.7.6 Potential for Mark I Containment Failure ............................................................... 4.7-6

4.7.6.1 Extension to Other BWR Facilities ............................................................ 4.7-7

4.7.6.2 Drywell Flooding Capabilities .................................................................. 4.7-8

References for Section 4.7 ................................................................................. 4.7-16

Appendix 4A: Example Calculation of Hydrogen Combustion Pressures and Temperatures ............ 4A-1
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xiii NUREG/CR-6042 Rev. 2

5.0 Offsite Accident Impacts ............................................................................................... 5.0-1

5.0.1 Introduction ....................................................................................................... 5.0-1

5.0.2 Learning Objectives for Chapter 5 ................................................................................ 5.0-1

Table of Contents (Continued)

5.1 Source Terms .............................................................................................................. 5.1-1

5.1.1 Radionuclide Inventories ...................................................................................... 5.1-1

5.1.2 Source Term Characteristics .................................................................................. 5.1-1

5.1.3 Magnitude of Release Required to Cause Offsite Health Effects ................................... 5.1-2

5.1.4 Design Features That Impact Source Terms .............................................................. 5.1-3

5.1.4.1 Suppression Pools ..................................................................................... 5.1-3

5.1.4.2 Drywell-Wetwell Configuration .................................................................. 5.1-4

5.1.4.3 Containment Sprays .................................................................................. 5.1-5

5.1.4.4 Ice Condenser .......................................................................................... 5.1-5

5.1.4.5 Reactor Cavity Flooding ............................................................................ 5.1-5

5.1.4.6 Building Retention ................................................................................... 5.1-5

5.1.4.7 BWR Containment Venting ....................................................................... 5.1-6

5.1.5 Source Term Uncertainty ...................................................................................... 5.1-6

5.1.6 Revised LWR Source Term ................................................................................... 5.1-7

5.1.7 The Chernobyl Source Term ................................................................................. 5.1-8

5.1.8 On-Line Source Term Monitoring ......................................................................... 5.1-9

References for Section 5.1 ........................................................................................... 5.1-23

5.2 Offsite Dispersion and Doses ......................................................................................... 5.2-1

5.2.1 Radiation Dose and Health Effects ......................................................................... 5.2-1

5.2.1.1 Chronic (Latent) Effects ............................................................................ 5.2-1

5.2.1.2 Acute Health Effects ................................................................................. 5.2-1

5.2.2 Dose Pathways .................................................................................................... 5.2-2

5.2.3 Meteorology ....................................................................................................... 5.2-3

5.2.4 Dispersion of Effluents ......................................................................................... 5.2-4

5.2.5 Dose Versus Distance .......................................................................................... 5.2.6

5.2.6 Uncertainties in Dose Projections ........................................................................... 5.2-7

5.2.7 Dispersion of the Chernobyl Release ....................................................................... 5.2-8

5.2.8 Perspectives on Dose Projections ......................................................................... 5.2-10

References for Section 5.2 ........................................................................................... 5.2-23

5.3 Protective Actions ....................................................................................................... 5.3-1

5.3.1 Basic Concepts .................................................................................................. 5.3-1

5.3.1.1 Early, Intermediate, and Late Phases .......................................................... 5.3-1

5.3.1.2 Basic Radiation Protection Objectives ........................................................ 5.3-2

5.3.1.3 Early Protective Action Guidance .............................................................. 5.3-2

5.3.1.4 Timing of Initial Actions .......................................................................... 5.3-2

5.3.2 Evacuation ........................................................................................................ 5.3.2

5.3.2.1 Effectiveness of Evacuation ...................................................................... 5.3-3

5.3.2.2 Evacuation Risks .................................................................................... 5.3-4

5.3.2.3 Entrapment Scenarios .............................................................................. 5.3-5

5.3.3 Sheltering and Relocation from Hot Spots ............................................................... 5.3-6

5.3.4 Improvised Respiratory Protection ......................................................................... 5.3-7

5.3.5 Use of Potassium Iodide (KI) ................................................................................ 5.3-7

5.3.6 Early Protective Action Decisions During the TMI-2 Accident ................................... 5.3-8
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xiv NUREG/CR-6042 Rev. 2

5.3.7 Other Protective Actions ...................................................................................... 5.3-9

5.3.8 Protective Actions Following Chernobyl Accident .................................................. 5.3-10

5.3.8.1 Workers ............................................................................................... 5.3-10

Table of Contents (Continued)

5.3.8.2 Evacuees ............................................................................................ 5.3-11

5.3.8.3 Residents of Significantly Contaminated Areas .......................................... 5.3-12

5.3.8.4 Residents of Less Contaminated Areas ..................................................... 5.3-12

5.3.9 Long-Term Health Effects From the Chernobyl Accident ........................................ 5.3-13

References for Section 5.3 .......................................................................................... 5.3-26

5.4 Emergency Preparedness ............................................................................................... 5.4-1

5.4.1 Regulatory Basis.......................................................................................................... 5.4-1

5.4.2 Roles in an Emergency................................................................................................. 5.4-1

5.4.2.1 Role of Licensee....................................................................................................... 5.4-1

5.4.2.2 Role of State and Local Agencies.............................................................................5.4-2

5.4.2.3 Role of the NRC....................................................................................................... 5.4-2

5.4.3 Emergency Detection and Classification.............................................................................. 5.4-2

5.4.3.1 Emergency Operating Procedures......................................................................5.4-2

5.4.3.2 Emergency Action Levels........................................................................................5.4-3

5.4.3.3 Emergency Classification System........................................................................... 5.4-4

5.4.3.3.1 Unusual Event................................................................................. 5.4-4

5.4.3.3.2 Alert........................................................................................................5.4-4

5.4.3.3.3 Site Area

Emergency......................................................................... 5.4-4

5.4.3.3.4 General Emergency.......................................................................... 5.4-5

5.4.3.3.5 Class Summaries and NUMARC Recognition Categories..................... 5.4-5

5.4.3.4 Protective Action Recommendations

................................................................5.4-5

5.4.4 Emergency Response Centers ............................................................................... 5.4-6

5.4.4.1 Control Room ........................................................................................ 5.4-6

5.4.4.2 Technical Support Center ......................................................................... 5.4-6

5.4.4.3 Operations Support Center ....................................................................... 5.4-6

5.4.4.4 Emergency Operations Facility ................................................................. 5.4-6

5.4.4.5 Flow of Authority and Responsibility ......................................................... 5.4-7

5.4.5 Emergency Planning Zones .................................................................................. 5.4-7

5.4.5.1 Plume Exposure Emergency Planning Zone ................................................ 5.4-7

5.4.5.2 Ingestion Pathway Emergency Planning Zone .............................................. 5.4-8

5.4.6 Response of State and Local Organizations ............................................................. 5.4-9

5.4.6.1 Emergency Response Plans ...................................................................... 5.4-9

5.4.6.2 Public Notification .................................................................................. 5.4-9

5.4.6.3 Evacuation Time Estimates .................................................................... 5.4-10

5.4.6.4 Dose Projections and Field Monitoring ..................................................... 5.4-10

5.4.6.5 Location of Authority and Responsibility .................................................. 5.4-10

References for Section 5.4 .................................................................................. 5.4-20

Appendix 5A: Protective Action Guides ................................................................................ 5A-1

Index....................................................................................................................................................Index-1
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xv NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xvi NUREG/CR-6042 Rev. 2

List of Figures

1.0-1 Timing of major events and activities relevant to commercial power reactor safety

from 1940s to present (1 of 3) ....................................................................................... 1.0-3

1.0-1 Timing of major events and activities relevant to commercial power reactor safety

from the 1940s to present (2 of 3) ........................................................................................... 1.0-4

1.0-1 Timing of major events and activities relevant to commercial power reactor safety

from the 1940s to present (3 of 3) ........................................................................................... 1.0-5

1.1-1 Defense in depth, safety strategies ........................................................................................... 1.1-5

1.3-1 Shift of nil-ductility transition temperature ...................................................................... 1.3-15

1.3-2 Number of regulatory guides issued per year ................................................................... 1.3-16

1.4-1 Ratio of power after to power before shutdown (ps/Po) for various operation times before

shutdown ..................................................................................................................... 1.4-18

1.4-2 Effect of selected conservatisms on peak cladding temperature ......................................... 1.4-19

1.4-3 Seismic Risk Map for the contiguous United States................................................................1.4-20

1.5-1 Breakdown of nuclear power plant accidents by severity .................................................... 1.5-5

1.5-2 Frequency of man-caused events involving fatalities .......................................................... 1.5-6

1.5-3 Frequency of natural events involving fatalities ................................................................. 1.5-7

1.6-1 Vertical cross section of plant showing reactor building control room and

spreading room ............................................................................................................... 1.6-8

1.6-2 The Browns Ferry nuclear plant ....................................................................................... 1.6-9

1.6-3 Cable-tray penetration, overall simplified depiction (not to scale) ..................................... 1.6-10

1.6-4 Area where fire started .................................................................................................. 1.6-11

1.6-5 Fire-damaged area ......................................................................................................... 1.6-12

1.6-6 Equipment availability during and immediately following the March 22, 1975 fire ............ 1.6-13

1A-1 Three levels of probabilistic risk assessment ................................................................... 1A-28

1A-2 LLNL hazard curves for Peach Bottom site ..................................................................... 1A-29

1A-3 EPRI hazard curves for Peach Bottom site ...................................................................... 1A-30

1A-4 Example event tree ........................................................................................................ 1A-31

1A-5 Example fault tree ......................................................................................................... 1A-32

1A-6 Common causes of failure ............................................................................................. 1A-33

1A-7 Risk assessment procedure for external events ................................................................. 1A-34

1A-8 Internal core damage frequency ranges (5th to 95th percentile) ........................................ 1A-35

2.1-1 Arrangement of the primary reactor coolant system and related support system

for the Three Mile Island, Unit 2 (TMI-2) Reactor ............................................................... 2.1-25

2.1-2 TMI-2 scenario: initial condition- standby operation at 97% power ...................................... 2.1-26

2.1-3 Condensate and feedwater systems ......................................................................................... 2.1-27

2.1-4 TMI-2 scenario: reactor coolant pressure and pressurizer level vs. time ............................... 2.1-28

2.1-5 TMI-2 scenario: system nearly liquid solid, liquid expanding with increasing

temperature ............................................................................................................................. 2.1-29

2.1-6 TMI-2 accident radioisotope release pathways ....................................................................... 2.1-30

2.1-7 TMI-2 scenario: primary system pressure and temperatures nearly constant

following secondary steam condition, primary voids increasing ............................................ 2.1-31

2.1-8 TMI-2 scenario: loop A pumps operating, loop B stagnant after shutdown

of loop B pumps, primary voids increasing ............................................................................ 2.1-32

2.1-9 TMI-2 scenario: all pumps off, reactor core drying out and heating up,

superheated steam flowing to pressurizer and one steam generator and condensing .............. 2.1-33

2.1-10 TMI-2 scenario: core dryout and heatup continuing, hydrogen generation by

steam-zirconium reaction in hotter regions ............................................................................. 2.1-34

2.1-11 TMI-2 scenario: core partially quenched by fluid during look B pump start,

heatup resumes ....................................................................................................................... 2.1-34
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xvii NUREG/CR-6042 Rev. 2

List of Figures (Cont.)

2.1-12 TMI-2 reactor vessel refilled by manual initiation of safety injection core

temperatures decreasing ......................................................................................................... 2.1-35

2.1-13 TMI-2 scenario: system pressurized by high-pressure injection system intermittent

liquid release through top of pressurizer, heat removal by heatup of injected water,

steam generator heat transfer blocked by hydrogen ................................................................ 2.1-36

2.1-14 TMI-2 scenario: primary system depressurizing and releasing hydrogen through the

pressurizer into the containment ............................................................................................. 2.1-37

2.1-15 TMI-2 containment pressure versus time ............................................................................... 2.1-38

2.3-1 Boiling water pressure tube graphite moderated reactor ........................................................... 2.3-8

2.4-1 Average number of scrams per year ....................................................................................... 2.4-17

2.4-2 Safety goal implementation guidance ..................................................................................... 2.4-18

2.5-1 Internal core damage frequency ranges (5th to 95th percentiles) ............................................. 2.5-37

2.5-2 BWR principal contributors to internal core damage frequencies .......................................... 2.5-37

2.5-3 PWR principal contributors to internal core damage frequencies ........................................... 2.5-38

2.5-4 Surry internal and external-event core damage frequency ranges ........................................... 2.5-38

2.5-5 Peach Bottom internal-and external-event core damage frequency ranges ............................. 2.5-39

2.5-6 Surry external event core damage frequency distributions ..................................................... 2.5-39

2.5-7 Peach Bottom external event core damage frequency distributions ........................................ 2.5-40

2.5-8 Principal contributors to seismic core damage frequencies .................................................... 2.5-41

2.5-9 Principal contributors to fire core damage frequencies ........................................................... 2.5-42

2.5-10 Reported IPE CDFs for BWRs and PWRs ............................................................................. 2.5-43

2.5-11 CDF Results ........................................................................................................................... 2.5-44

2.5-12 ............................................................................................................................................... 2.5-44

2.5-13 ............................................................................................................................................... 2.5-45

2.5-14 Fire-induced CDFs Reported by Licensees ............................................................................ 2.5-46

2.5-15 Reported fire-induced CDFs for commonly identified plant fire analysis zones .................... 2.5-46

2.5-16 Grand Gulf sequence contributions for full-power and POS 5 ............................................... 2.5-47

2.5-17 Surry sequence contributions for full-power and mid-loop operation .................................... 2.5-47

2.5-18 Example PWR Boiling Risk Profile ....................................................................................... 2.5-48

2.5-19 Reduction in CDF from implementing Station Blackout Rule................................................2.5-49

2.6-1 Elements of risk-informed process ......................................................................................... 2.6-37

2.6-2 CDF acceptance guidelines .................................................................................................... 2.6-38

2.6-3 LERF acceptance guidelines .................................................................................................. 2.6-38

2.6-4 Decision tree for the categorization of structures, systems and components for the

purposes of the Maintenance Rule ......................................................................................... 2.6-39

2.6-5 Decision tree for the categorization of structures, systems and components for the

purposes of the Maintenance Rule ......................................................................................... 2.6-40

2.6-6 Integrated decision process for risk-informed regulation ........................................................ 2.6-41

2.6-7 Diagram of Categorization and Treatment...............................................................................2.6-41

2.6-8 Elements of risk-informed framework .................................................................................... 2.6-42

2.6-9 Quantitative guidelines for risk-informed framework ........................................................... .2.6-42

2A-1 Davis-Besse nuclear steam supply system .............................................................................. 2A-13

2A-2 Main steam system ................................................................................................................. 2A-14

2A-3 Main feedwater system ........................................................................................................... 2A-15

2A-4 Schematic of auxiliary feedwater system ................................................................................ 2A-16

2A-5 Makeup/HPI cooling system ................................................................................................... 2A-17

2A-6 Steam feedwater rupture control system (SFRCS) block diagram .......................................... 2A-18

2B-1 BWR operation after failure of scram in the turbine trip-initiated ATWS accident

sequence (flows in lbs/hr) ....................................................................................................... 2B-22
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xviii NUREG/CR-6042 Rev. 2

List of Figures (Cont.)

2B-2 BWR operation after failure to scram in the MSIV closure-initiated ATWS accident

sequence (flows in lbs/hr) ....................................................................................................... 2B-23

2B-3 The single SLCS injection sparger is located to the side of the control rod guide

tubes and injects horizontally into the lower plenum ............................................................. 2B-24

2B-4 Manual rod insertion involves different piping and valves and might be effective

even if scram has failed .......................................................................................................... 2B-25

2B-5 The major effect of lowering the reactor vessel water level upon core power occurs

when feedwater spargers are uncovered ................................................................................. 2B-26

3.1-1 Approximate temperature and time envelopes for in-vessel severe accident stages assuming

no coolant injection during PWR core heatup and degradation ........................................... 3.1-7

3.1-2 Melting points for metallic elements, reactor metals, and compounds .................................. 3.1-8

3.1-3 Melting and boiling points for fission products .................................................................. 3.1-8

3.1-4 Chemical interactions and formation of liquid phases in an LWR fuel rod bundle

with increasing temperature ............................................................................................. 3.1-9

3.1-5 Schematic of BWR reactor vessel internal structure ......................................................... 3.1-10

3.1-6 BWR fuel assembly ...................................................................................................... 3.1-11

3.1-7 BWR control rod .......................................................................................................... 3.1-12

3.1-8 PWR reactor coolant system arrangement (B&W) ........................................................... 3.1-13

3.1-9 PWR reactor vessel internals (Westinghouse) .................................................................. 3.1-14

3.1-10 Cutaway of typical rod cluster control assembly .............................................................. 3.1-15

3.1-11 Typical PWR arrangement for in-core instrumentation (Westinghouse) ............................. 3.1-16

3.1-12 Core damage event tree ................................................................................................. 3.1-17

3.2-1 Exponentially decreasing water level ................................................................................ 3.2-4

3.2-2 Variation of boiloff time constant with saturation pressure ................................................. 3.2-5

3.2-3 Approximate calculation of fuel temperature rise (curves) at three different times compared

with code results ............................................................................................................. 3.2-6

3.3-1 Hydrogen production per unit area from the Zr:H20 reaction ............................................... 3.3-6

3.3-2 Mass of Zr oxidized in 5 minutes exposure of 5400 square meters Zircaloy ......................... 3.3-7

3.3-3 Calculated axial cladding temperatures at three different times following start of core

uncovering for a PWR station blackout ............................................................................. 3.3-8

3.3-4 Heat balance between uncovered core and residual water ................................................... 3.3-9

3.3-5 Ratio of heat release rate via oxidation to heat transfer rate to residual saturated water ........ 3.3-10

3.3-6 Severe accident natural circulation flows ........................................................................ 3.3-11

3.3-7 Schematic diagram of a BWR with internal circulation .................................................... 3.3-12

3.3-8 Tensile strength, type 304 stainless steel ......................................................................... 3.3-13

3.4-1 Distribution of fuel rod rating (kW/m) in the TMI-2 core ................................................... 3.4-6

3.4-2 Hypothesized TMI-2 condition between 150 and 160 minutes ............................................ 3.4-7

3.4-3 Schematic representation of possible mode of initial fuel liquefaction and downward flow ... 3.4-8

3.4-4 Initial core degradation in a PWR ..................................................................................... 3.4-9

3.4-5 Hypothesized TMI-2 core at 173 minutes ........................................................................ 3.4-10

3.4-6 Hypothesized TMI-2 core configuration between 174 and 180 minutes ............................. 3.4-11

3.4-7 Hypothesized TMI-2 core configuration at 224 minutes (just prior to molten pour) ............ 3.4-12

3.5-1 Final TMI-2 debris configuration ................................................................................... 3.5-13

3.5-2 TMI-2 structures surrounding the core ............................................................................ 3.5-14

3.5-3 Fuel debris profile inside TMI-2 core barrel assembly (CBA laid flat) ............................... 3.5-15

3.5-4 TMI-2 core support assembly ......................................................................................... 3.5-16

3.5-5 Locations of solidified materials in TMI-2 core support assembly ..................................... 3.5-17

3.5-6 Location of solidified material in TMI-2 elliptical flow distributor .................................... 3.5-18

3.5-7 TMI-2 hard layer debris depths in lower head .................................................................. 3.5-19

3.5-8 TMI-2 lower-head cross section of hard debris, row 7 ...................................................... 3.5-20
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xix NUREG/CR-6042 Rev. 2

List of Figures (Cont.)

3.5-9 Visualization of the downward progress of a coherent molten mass as the below-core

structures weaken ......................................................................................................... 3.5-21

3.5-10 Cross-sectional views of TMI-2 hard layer debris sample ................................................. 3.5-22

3.5-11 Scanning electron microscope image of two phase region in TMI-2 hard layer debris

sample ......................................................................................................................... 3.5-23

3.5-12 TMI-2 nozzle damage profile ......................................................................................... 3.5-24

3.5-13 Location of lower-head steel, nozzle, and guide tube samples ........................................... 3.5-25

3.5-14 As-removed appearance of six TMI-2 nozzles ................................................................. 3.5-26

3.5-15 Schematic of sample taken from TMI-2 lower head ............................................................... 3.5-27

3.5-16 Lower head hot spot and nozzle guide tube locations ....................................................... 3.5-28

3.5-17 FailuremechanismconsideredinTMI-2analysis:(a)tuberupture,(b)weldfailure–tube

ejection, (c) global vessel failure, and (d) localized vessel failure ...................................... 3.5-29

3.5-18 Pictorial summary of the completed lower head failure tests (Figure ES-1 of

NUREG/CR-5582, SAND98-2047) ....................................................................................... 3.5-30

3.5-19 Typical debris bed dryout experiment ............................................................................. 3.5-31

3.5-20 Debris bed dryout heat flux versus particle diameter for water .......................................... 3.5-32

3.6-1 Progression of fuel-coolant mixing ................................................................................. 3.6-11

3.6-2 Energy required to vaporize 29 m3of water versus saturation pressure .............................. 3.6-12

3.6-3 Melt pour into lower plenum by failure of core plate ........................................................ 3.6-13

3.6-4 Vessel failure from steam explosion ............................................................................... 3.6-14

3.6-5 High pressure melt release from bottom of reactor vessel ................................................. 3.6-15

3.6-6 Low pressure melt release from bottom of reactor vessel .................................................. 3.6-16

3.6-7 Secondary melt release in a Zion-type reactor cavity ........................................................ 3.6-17

3.7-1 Definition of radial zones for Browns Ferry unit 1 cycle 6 core ......................................... 3.7-25

3.7-2 The progression of severe structural damage in the outer core would significantly lag

events in the central core ............................................................................................... 3.7-26

3.7-3 If the reactor vessel remains pressurized, relocating core debris falls into water above the

core plate ..................................................................................................................... 3.7-27

3.7-4 Effects of manual actuation of ADS at about one-third core height .................................... 3.7-28

3.7-5 Vessel depressurization at one-third core height provides steam cooling that temporarily

reverses core heatup ...................................................................................................... 3.7-29

3.7-6 Vessel depressurization at one-third core height delays hydrogen release ........................... 3.7-30

3.7-7 Region above the core plate would be dry during structural degradation ............................ 3.7-31

3.7-8 For the two-stage target rock SRV, control air and system pressure act in concert to position

the pilot value ............................................................................................................... 3.7-32

3.7-9 For the Crosby SRV, control air opens main valve ........................................................... 3.7-33

3.7-10 Abbreviated schematic of a typical BWR SLCS .............................................................. 3.7-34

3.7-11 The condensate storage tank is an important source of water during accident sequences

other than LBLOCA ..................................................................................................... 3.7-35

3.7-12 The condensate storage tank can be drained to the main condenser hotwells, leaving

sufficient water volume for the reactor vessel injection .................................................... 3.7-36

3.7-13 The BWR control blades are inserted into the interstitial region between fuel assemblies in

the core ........................................................................................................................ 3.7-37

3.7-14 One-half of the channel box outer surfaces do not see an intervening control blade ............ 3.7-38

3.7-15 Relocation of control blades and channel box walls leaves only UO2 pellets encased in thin

Zr02sheaths .................................................................................................................. 3.7-39

3.7-16 The BWR core plate separates the core region from the reactor vessel lower plenum but

does not support the core ............................................................................................... 3.7-40

3.7-17 Control blade tip emerging from fuel support structure near core plate edge at Peach

Bottom ......................................................................................................................... 3.7-41
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xx NUREG/CR-6042 Rev. 2

List of Figures (Cont.)

3.7-18 Material relocating from the core region would enter the reactor vessel lower plenum ........ 3.7-42

3.7-19 View of core plate with fuel support structures in place at Peach Bottom ........................... 3.7-43

3.7-20 Two-thirds of the area beneath the BWR core is blocked by the control rod guide tube ....... 3.7-44

3.7-21 Code models specific to the BWR lower plenum and bottom head currently exist .............. 3.7-45

3.7-22 The BWR control rod drive mechanism assemblies are held in place by upper stub welds;

the incore instrument tubes are supported by welds at the vessel wall ................................ 3.7-46

3.7-23 Weld holding control rod drive housing in place within stub tube at Peach Bottom ............ 3.7-47

3.7-24 Instrument guide tube weld location at inner surface of vessel wall at Peach Bottom .......... 3.7-48

3.7-25 Instrument tube failure by creep-rupture of welds and by melt overflow can be represented 3.7-49

3.7-26 Zirconium oxidation accelerates the initial debris release rate for pressurized accident

sequences ..................................................................................................................... 3.7-50

3.7-27 Atmospheric trapping within the reactor vessel support skirt could limit water contact with

the wall ........................................................................................................................ 3.7-51

3.7-28 Delayed wall creep rupture would occur in the vicinity of the gas pocket ........................... 3.7-52

3.7-29 Cooling of upper vessel wall would be necessary after internal vessel structures have

melted .......................................................................................................................... 3.7-53

4.1-1 Typical containment volumes and design pressure (psig) .................................................. 4.1-11

4.1-2 Comparison of design pressure and ultimate failure pressure ............................................ 4.1-12

4.1-3 Typical large dry containment ........................................................................................ 4.1-13

4.1-4 Typical subatmospheric containment .............................................................................. 4.1-14

4.1-5 Typical ice condenser containment ................................................................................. 4.1-15

4.1-6 Ice condenser cutaway ................................................................................................... 4.1-16

4.1-7 Typical BWR Mark I containment .................................................................................. 4.1-17

4.1-8 Typical BWR Mark II containment ................................................................................ 4.1-18

4.1-9 Typical BWR Mark III containment ............................................................................... 4.1-19

4.1-10 Peak containment pressure for one PWR ......................................................................... 4.1-20

4.1-11 Containment pressure-temperature response for 8.55 ft2pump discharge break .................. 4.1-21

4.1-12 Energy changes up to time of peak containment pressures for one PWR ............................ 4.1-22

4.1-13 Different bolting arrangements on drywell head closure flange for Browns Ferry and

Peach Bottom ............................................................................................................... 4.1-23

4.2-1 Relative probability of containment failure modes (internal events from NUREG-1150)

given core damage ........................................................................................................ 4.2-10

4.2-2 Containment failure frequency ....................................................................................... 4.2-11

4.2-3 Conditional containment failure frequency (internal events) ............................................. 4.2-12

4.3-1 Molten core quenching process ........................................................................................ 4.3-6

4.3-2 Containment pressure versus time for Zion station blackout sequence ................................. 4.3-7

4.3-3 Non-coolable debris bed .................................................................................................. 4.3-8

4.3-4 BWR Mark I containment pedestal region ......................................................................... 4.3-9

4.3-5 BWR Mark II containment pedestal region ..................................................................... 4.3-10

4.3-6 BWR Mark III containment pedestal region .................................................................... 4.3-11

4.4-1 Thermal aspects of core-concrete interactions .................................................................... 4.4-6

4.4-2 Calculations of concrete attack in a BWR Mark II containment during a station blackout

sequence ........................................................................................................................ 4.4-7

4.4-3 Combustible gas generation during CCIs .......................................................................... 4.4-8

4.4-4 Example amounts of various gases that can be generated during core-concrete interactions ... 4.4-9

4.4-5 VANESA calculations of aerosol generation rates ........................................................... 4.4-10

4.4-6 Peach Bottom station blackout, fission products released to drywell from core-concrete

interactions ................................................................................................................... 4.4-11

4.4-7 Peach Bottom station blackout, masses released to drywell from core-concrete

interactions ................................................................................................................... 4.4-12
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xxi NUREG/CR-6042 Rev. 2

List of Figures (Cont.)

4.5-1 Melt ejection process ....................................................................................................... 4.5-7

4.5-2 Distribution for fraction of core material ejected, PWR ...................................................... 4.5-8

4.5-3 Reactor cavity interactions ............................................................................................... 4.5-9

4.5-4 Estimated median particle size versus time ...................................................................... 4.5-10

4.5-5 Example distributions for pressure rise at vessel breach, Surry .......................................... 4.5-11

4.5-6 Large dry and subatmospheric containment results from DCH resolution effort ................. 4.5-12

4.6-1 Theoretical adiabatic, constant-volume combustion pressure for Hydrogen : air mixtures .... 4.6-13

4.6-2 Theoretical adiabatic, constant-volume combustion temperature for hydrogen : air

mixtures ....................................................................................................................... 4.6-14

4.6-3 Effect of initial temperature on downward propagating flammability limits in hydrogen :

air mixtures .................................................................................................................. 4-6-15

4.6-4 Flammability limits of hydrogen in air diluted with CO2 and N2........................................ 4.6-16

4.6-5 Flammability limits of hydrogen : air : steam mixtures ..................................................... 4.6-17

4.6-6 Spark ignition energies for dry hydrogen : air mixtures .................................................... 4.6-18

4.6-7 Normalized pressure rise versus hydrogen concentration .................................................. 4.6-19

4.6-8 Laminar burning velocity of hydrogen : air mixture ......................................................... 4.6-20

4.6-9 Theoretical detonation velocities for hydrogen : air mixtures ............................................ 4.6-21

4.6-10 Hydrogen detonation cells ............................................................................................. 4.6-22

4.6-11 Measurement of detonation cell size for hydrogen : air mixtures at atmospheric pressure .... 4.6-23

4.6-12 Dimensions required for detonation propagation in various geometries .............................. 4.6-24

4.6-13 Theoretical detonation pressure and normally reflected pressure ....................................... 4.6-25

4.6-14 Theoretical detonation temperature and normally reflected detonation temperature ............. 4.6-26

4.6-15 Flame structures for a range of geometries and flow rates ................................................. 4.6-27

4.6-16 Minimum spontaneous ignition temperatures .................................................................. 4.6-28

4.6-17 TMI-2 containment pressure versus time ......................................................................... 4.6-29

4.7-1 The BWR Mark I containment design employs a small primary containment with a pressure

suppression pool; secondary containment is provided by the surrounding structure ............. 4.7-10

4.7-2 The Mark I drywell floor area is small and the drywell shell is within ten feet of the pedestal

doorway ....................................................................................................................... 4.7-11

4.7-3 Core debris released from the reactor vessel would spread over the BWR Mark I drywell

floor, including the ex-pedestal region ............................................................................ 4.7-12

4.7-4 Interior of reactor pedestal at Peach Bottom with partial view of doorway ......................... 4.7-13

4.7-5 Shield over vent pipe entrance at Peach Bottom .............................................................. 4.7-14

4.7-6 Approximately 5700 m3(1.5 x 106) gallons would be required to cover the reactor vessel

bottom head at the largest (1100 MWe) BWR facilities .................................................... 4.7-15

4A-1 Theoretical adiabatic, constant-volume combustion pressure for hydrogen : air mixtures ...... 4A-5

4A-2 Theoretical adiabatic, constant-volume combustion temperature for hydrogen : air mixtures . 4A-6

4A-3 Adiabatic, constant-volume combustion pressure for various containment initial conditions .. 4A-7

4A-4 Adiabatic, constant-volume combustion temperature for various containment initial

conditions ...................................................................................................................... 4A-8

5.1-1 Examples of plume types ............................................................................................... 5.1-16

5.1-2 Putting radiation release (curies-Ci) in perspective for the public ...................................... 5.1-17

5.1-3 Event tree for severe accident consequences .................................................................... 5.1-18

5.1-4 Comparison of NUREG-1150 source terms with Reactor Safety Study (Surry) bin PWR2 .. 5.1-19

5.1-5 Comparison of NUREG-1150 source terms with Reactor Safety Study (Peach Bottom) bin

BWR4 ......................................................................................................................... 5.1-20

5.1-6 Release of Radionuclides during the active stage of the Chernobyl accident ....................... 5.1-21

5.1-7 Types of release ............................................................................................................ 5.1-22

5.2-1 Steps in projecting offsite consequences ......................................................................... 5.2-12

5.2-2 Illustration of person-rems and cancers within 50 and 500 mile radii ................................. 5.2-12
Reactor Safety Course (R-800) Reactor Safety Course

USNRC Technical Training Center xxii NUREG/CR-6042 Rev. 2

List of Figures (Cont.)

5.2-3a Putting radiation in perspective for the public (mrem) ...................................................... 5.2-13

5.2-3b Putting radiation in perspective for the public (mrem) ...................................................... 5.2-14

5.2-4 Radiation dose pathways ............................................................................................... 5.2-15

5.2-5 Examples of low-level temperature distribution in the atmosphere .................................... 5.2-15

5.2-6 Movement of a parcel of air in (a) a superadiabatic profile and (b) an inversion profile ....... 5.2-16

5.2-7 Various types of smoke plume patterns ........................................................................... 5.2-17

5.2-8 Relationship between actual plume and model projections ............................................... 5.2-18

5.2-9 The quantity ? ?/Q at ground level for effluents emitted at a height of 30 m, as a function

of distance from the source ............................................................................................ 5.2-19

5.2-10 Radiation hot spots resulting from Chernobyl nuclear power plant accident ....................... 5.2-20

5.2-11a Stomach dose by exposure time: no sheltering, stability class D, 268 m/s wind .................. 5.2-21

5.2-11b Plume centerline stomach dose by pathway: no sheltering, 24-hour exposure class D,

2.68 m/s wind ............................................................................................................... 5.2-21

5.2-11c Thyroid dose by exposure time: no sheltering, stability class D, 2.68 m/s wind .................. 5.2-21

5.2-11d Plume centerline thyroid dose by exposure pathway, no sheltering, 24-hour exposure,

class D, 2.68 m/s ........................................................................................................... 5.2-21

5.2-12 One-hour surface doses predicted by (a) Gaussian plume model, (b) puff-trajectory

model, (c) complex numerical model, and (d) doses actually observed .............................. 5.2-22

5.3-1 Early protective actions for core melt accidents ............................................................... 5.3-19

5.3-2 Protective action flow chart for severe core damage or loss of control facility .................... 5.3-20

5.3-3 Relative effectiveness of early protective actions given early containment failure ............... 5.3-21

5.3-4 Relative effectiveness of emergency response actions assuming early containment failure

with high and low source terms ...................................................................................... 5.3-22

5.3-5 Number of people within 1 and 5 miles of 111 nuclear power plants, actual or proposed

in 1979 ........................................................................................................................ 5.3-23

5.3-6 Percent of thyroid blocking afforded by 100 mg of stable iodine (130 mg of potassium

iodide) as a function of time of administration before or after a 1-?Ci intake of 131I ............ 5.3-24

5.3-7 Hourly wind vector at Three Mile Island on March 28, 1979 ............................................ 5.3-25

5.4-1 Relative locations of licensee emergency response centers ................................................ 5.4-16

5.4-2 Example of a plume emergency planning zone with boundaries and evacuation routes

determined by roads ...................................................................................................... 5.4-17

5.4-3 Example of a plume emergency planning zone ................................................................ 5.4-18

5.4-4 Flow chart showing steps from detection of a general emergency event in the control room

to public evacuation ...................................................................................................... 5.4-19
Reactor Safety course (R-800) Reactor Safety Course

USNRC Technical Training Center xxiii NUREG/CR-6042 Rev. 2

List of Tables

1.1-1 Defense in depth multilayer protection from fission products .............................................. 1.1-4

1.4-1 Chapter titles from Regulatory Guide 1.70 Revision 3 standard format and content of Safety

Analysis Reports for nuclear power plants ........................................................................ 1.4-9

1.4-2 Representative initiating events to be analyzed in Section 15.XX of the Safety Analysis

Report .......................................................................................................................... 1.4-10

1.4-3 Partial comparison of realistic assumptions with conservative assumptions for design-basis

LOCA calculations ....................................................................................................... 1.4-13

1.4-4 Conservative offsite doses from design-basis accident analyses ......................................... 1.4-15

1.4-5 Realistic offsite doses due to releases at a typical PWR ................................................... 1.4-16

1.4-6 Approximate Relationship between Modified Mercalli and Richter Seismic Classifications 1.4-17

1A-1 Consequence weighted risk ............................................................................................ 1A-19

1A-2 Transient initiating event frequencies ............................................................................. 1A-20

1A-3 Example BWR initiating event frequencies ..................................................................... 1A-22

1A-4 Initiating event frequencies for Plant Operating State 5 (cold shutdown) ........................... 1A-23

1A-5 Safety function system requirements ............................................................................... 1A-25

1A-6 Collections and summaries of actual failure events .......................................................... 1A-26

1A-7 Statistical analyses and generic data bases ....................................................................... 1A-27

2.1-1 Chronology of Major TMI-2 Accident Events ................................................................. 2.1-18

2.3-1 The most dangerous violations of operating procedures at Chernobyl-4 .............................. 2.3-7

2.4-1 Station blackout summary data ....................................................................................... 2.4-16

2.5-1 NRC Sources of reactor operational data ......................................................................... 2.5-26

2.5-2 NRC Feedback of nuclear power plant experience ........................................................... 2.5-27

2.5-3 Precursors and severe accidents ...................................................................................... 2.5-28

2.5-4 Overview of key IPE CDF observations .......................................................................... 2.5-29

2.5-5 Distributions for Core damage frequency and aggregate risk for POS 5 and full power

operation for Grand Gulf ............................................................................................... 2.5-31

2.5-6 Distributions for Core damage frequency and aggregate risk for mid-loop and full-power

operation for Surry ................................................................................................................ 2.5-31

2.5-7 Key IPE observations regarding containment performance .............................................. 2.5-32

2.5-8 Shutdown events occurring during 1998 and the early portion of 1999 .............................. 2.5-34

2.6-1 Thresholds for Performance Bands ................................................................................. 2.6-29

2.6-2 Inspectible Areas Associated with Each Cornerstone of Reactor Safety ............................. 2.6-31

2.6-3 NRC Action Matrix ...................................................................................................... 2.6-34

2.6-4 Examples Illustrating the Concept of Maintenance Preventable Functional Failures ........... 2.6-36

2B-1 The change in vapor specific volumes for a given change in pressure is much greater at

low pressure (Table entries based on values taken from steam tables) .............................. 2B-21

3.1-1 In-Vessel accident stages. ................................................................................................ 3.1-5

3.1-2 Severe Accident Conditions ............................................................................................. 3.1-6

3.5-1 Average TMI-2 Lower Head Debris Composition by Quadrant (wt%) ............................... 3.5-11

3.5-2 Summary of lower head failure experimental results ........................................................ 3.5-12

3.6-1 Fractions of core mixture that can be quenched in below-core for a typical PWR ................. 3.6-7

3.6-2 Lower plenum features of a Westinghouse PWR ............................................................... 3.6-7

3.6-3 NUREG-1150 alpha mode failure probabilities ................................................................. 3.6-8

3.6-4 Alpha-mode failure probability estimates (given a core melt accident) ................................. 3.6-9

3.6-5 Fuel coolant interaction experimental facility characteristics ............................................. 3.6-10

3.7-1 Vessel depressurization at one-third core height postpones the predicted core degradation

events for short term blackout ........................................................................................ 3.7-24

4-1-1 Number of U.S. containments of each type ....................................................................... 4.1-9

4.1-2 Examples of design leakage rates (integrated leakage) ........................................................ 4.1-9

4.1-3 10 CFR 50 Appendix J test frequency requirements ......................................................... 4.1-10
Reactor Safety course (R-800) Reactor Safety Course

USNRC Technical Training Center xxiv NUREG/CR-6042 Rev. 2

List of Tables (Cont.)

4.2-1 Containment threats according to time regime ................................................................... 4.2-9

4.4-1 Typical chemical compositions of concrete (wt%) ............................................................. 4.4-4

4.4-2 Core-concrete release for Peach Bottom station blackout sequence ..................................... 4.4-5

4.6-1 Hydrogen flammability limits in steam-saturated air at room temperature .......................... 4.6-12

4.7-1 Mark I Liner Qualitative Failure Probabilities for Various Vessel Debris Release Modes ...... 4.7-9

4A-1 Computation of adiabatic, constant-volume pressure and temperature ................................. 4A-4

5.1-1 Radioactive materials in a large [3300-MWt] light water reactor core grouped by relative

volatility ....................................................................................................................... 5.1-10

5.1-2 Typical inventories of noble gases and iodine in reactor systems ....................................... 5.1-11

5.1-3 Illustrative noble gas and halogen releases ...................................................................... 5.1-12

5.1-4 Decontamination factors associated with various design features ...................................... 5.1-13

5.1-5 NUREG-1465 BWR releases into containments ............................................................... 5.1-14

5.1-6 NUREG-1465 PWR releases into containments ............................................................... 5.1-14

5.1-7 Estimated releases from Chernobyl-4 accident ................................................................. 5.1-15

5.2-1 Relationship between Pasquill category and ??/?z and ??................................................ 5.2-11

5.2-2 Characteristic of hot spots resulting from Chernobyl Accident ........................................... 5.2-11

5.3-1 Exposure pathways, nuclear incident phases, and protective actions ................................... 5.3-15

5.3-2 Public response to nuclear-related incidents ..................................................................... 5.3-16

5.3-3 Factors by which radionuclide exposure may be reduced by sheltering for different types of

shelters and pathways of exposure .................................................................................. 5.3-17

5.3-4 Respiratory protection provided by common household and personal items against aerosols

of 1- to 5-?m particle size .............................................................................................. 5.3-18

5.4-1 Sample initiating condition and examples of accompanying Emergency Action Levels ....... 5.4-12

5.4-2 Example of timing for BWR general emergency sequences ............................................... 5.4-12

5.4-3 Emergency class descriptions ......................................................................................... 5.4-13

5.4-4 Emergency class response .............................................................................................. 5.4-14

5.4-5 Emergency Class vs. Recognition Categories ................................................................... 5.4-15

5A-1 Environmental Protection Agency recommended protective actions to reduce

whole-body and thyroid dose from exposure to a gaseous plume .......................................... 5A-2

5A-2 Environmental Protection Agency recommended protective actions to reduce external gamma

dose from plume exposure and committed dose to the thyroid from inhalation ..................... 5A-3

5A-3 Food and Drug Administration protective action guides ...................................................... 5A-3
Reactor Safety course (R-800) Reactor Safety Course

USNRC Technical Training Center xxv NUREG/CR-6042 Rev. 2

ACKNOWLEDGMENTS

This course covers an extremely wide range of topics. Developing this material required input

from numerous people at the NRC and elsewhere. In particular, we would like to thank Dr.

Denwood Ross, whose breadth and depth of knowledge concerning the history of reactor safety

was invaluable. Additional information and program guidance was provided by Mark

Cunningham and Lee Abramson of the NRC PRA branch. Other key NRC reviewers included

Ken Raglin, Len Reidinger, Larry Bell, Erick Beckjord, Warren Minners, Jocelyn Mitchell, Tom

McKenna, and Jack Lewis.

At Sandia, information and insights were provided by Dana Powers, Jeff LaChance and Donnie

Whitehead. Bob Waters and Tim Wheeler provided valuable review comments. Finally, we

wish to acknowledge the support of Rebecca Campbell, Emily Preston, Linda Flores, and Annie

Valencia in the preparation of this document.
Reactor Safety course (R-800) Reactor Safety Course

USNRC Technical Training Center xxvi NUREG/CR-6042 Rev. 2

English to Metric

Conversion Factors

English Metric

1 foot .3048 meters

1 mile 1.6093 kilometers

1 ft.2.0929 m2

1 gallon 3.785x10-3 m

3

1 ft.3.02832 m3

1 lbm .4536 kg.

1 lbf 4.44822 Newtons

1 psi 6895 pascals

1 BTU 1055 Joules

1 BTU/hr. .2931 watts

1 BTU/hr-ft23.155 watts/m2
Reactor Safety Course (R-800) 1.0 The Development of Safety Concepts, 1946 - 1975

USNRC Technical Training Center 1.0-2 NUREG/CR-6042 Rev. 2

1.0 The Development of Safety

Concepts, 1946 - 1975

1.0.1 Introduction

Of all modern technologies, the highest

potential for catastrophe in the public's mind

is probably associated with nuclear power.

The awesome destructive power of nuclear

weapons provides reason for some to fear all

things that utilize nuclear energy or emit

radiation. The accidents at Three Mile

Island (TMI) and Chernobyl strongly

reinforced intuitive public concerns about

nuclear power.

In the U.S., the potential hazards of nuclear

power were recognized very early, and some

features to prevent, contain, and otherwise

protect the public from reactor accidents

were applied from the outset. U.S. safety

strategies evolved with successive

generations of larger capacity plants, and

many additional safety features were

introduced.

It is true that U.S. plants are inherently safer

than plants like Chernobyl. It is also true

that single accidents in other industries have

killed and injured far more people than

Chernobyl. However, such arguments are

not likely to alter the public perceptions of

the hazards of nuclear power. More

importantly, no arguments can change the

actual hazard--the core inventories of

radionuclides.

Whether one's objective is to make nuclear

power plants safer or to change public

perceptions of their safety, in the long run,

the attitude recommended for the nuclear

industry by the President's Commission on

TMI-2 seems most likely to succeed:

Nuclear power is by its very nature

potentially dangerous, and ... one

must continually question whether the

safeguards already in place are

sufficient to prevent major accidents.

1

This course presents both historical and

technical information required to support

such an attitude.

Figure 1.0-1 depicts the timing of major

events and activities relevant to commercial

power reactor safety from the 1940s to the

present. To provide a framework for the

chapters that follow, a brief history of

developments significant to the U.S.

regulatory process is presented in Chapters 1

and 2. Trends and events are discussed in

roughly the chronological order in which

they became significant. Chapter 1

considers the decades preceding the accident

at Three Mile Island Unit 2 (TMI-2).

Chapter 2 discusses the TMI-2 accident and

subsequent events. Several references

provide additional information regarding the

history of nuclear regulation.2,3,4,5,6,7,8,9,10

1.0.2 Learning Objectives for Module 1

At the end of this module, the student should

be able to:

1. Describe the principal elements of the

defense-in-depth strategy.

2. Describe the legal basis of NRC's

regulatory process including the content

and impact of:

a. The Atomic Energy Acts of 1946 and

1954

b. Price-Anderson Act

c. The National Environmental Policy

Act of 1969
Reactor Safety Course (R-800) 1.0 The Development of Safety Concepts, 1946 - 1975

USNRC Technical Training Center 1.0-3 NUREG/CR-6042 Rev. 2

d. The Energy Reorganization Act of

1974

3. Describe the content of some key

elements of NRC's regulations and

regulatory process, including:

a. General Design Criteria (10 CFR 50

Appendix A)

b. Emergency Core Cooling System

Acceptance Criteria (10 CFR 50.46

and Appendix K)

c. Siting Criteria (10 CFR 100)

4. Describe three key conservatisms

inherent in traditional design-basis

accident analyses.

5. Give examples of accident initiators and

multiple failures that would result in

beyond-design-basis accidents. Explain

why some beyond-design-basis accidents

would not be severe accidents

6. Discuss the reasons why the Browns

Ferry fire burned for so long.

7. Describe the level of NRC interest in

severe accidents that resulted from the

Reactor Safety Study and the Browns

Ferry fire.
Reactor Safety Course (R-800) 1.0 The Development of Safety Concepts, 1946 - 1975

USNRC Technical Training Center 1.0-4 NUREG/CR-6042 Rev. 2

Fig

ure 1.0-1 Timin

g

of m

ajor e

v

e

nts a

n

d

a

ctivities rele

v

a

nt to

c

o

m

m

ercial

p

o

w

er re

a

ctor safety fro

m 19

4

0s to

prese

nt (1 of 3)

Licensin

g

Process

Chicago Pile

USS Nautilus

Shippingport

Yankee

Big Rock

Point

Number of Additional Operating Plants

19

4

0 19

4

5 19

5

0 19

5

5 19

6

0 19

6

5 19

7

0 19

7

5 19

8

0 19

8

5 19

9

0

2

0

0

0

O

peratio

n

al Milesto

nes

FB

R-1 E

B

W

R-1

Atomic EnergyAct of 1946A

E

C

Established

Statutory A

C

RS

Reactor SafeguardsCom

mittee

ASL

A

B Formed

10 CFR 50.10

F

9

ederal

Advisory

Com

mittee Act

1st A

C

RS

List of

Generic

Issues

A

E

C Safety

Research

Recognized

Sunshine Act

N

R

C

Established

19

4

0 19

4

5 19

5

0 19

5

5 19

6

0 19

6

5 19

7

0 19

7

5 19

8

0 19

8

5 19

9

0

2

0

0

0

Atomic EnergyAct of 1954

ASL

A

B

Formed
Reactor Safety Course (R-800) 1.0 The Development of Safety Concepts, 1946 - 1975

USNRC Technical Training Center 1.0-5 NUREG/CR-6042 Rev. 2

Fig

ure 1.0-1 Timin

g

o

f

m

ajor e

v

e

nts a

n

d

a

ctivities rele

v

a

nt to

c

o

m

m

ercial

p

o

w

er re

a

ctor sa

fety

fro

m 19

4

0s to

prese

nt (2

o

f

3)

Sitin

g

Containment

at K

A

P

L

Shippingport

Decision

Indian Point

Site Approved

10 C

F

R 100

Siting Criteria

Credit for ESFs

E

C

CS Criteria

Reg Guides

Begin

Containment

Required

for Piqua

General

Design

Criteria

10 C

F

R 50.109

Backfitting Rule

Severe Accident

P

olicy

Statement

Maintenance

R

ule (50.65)

New

Reactor

O

versig

ht

Process

1

9

4

0

1

9

4

5

1

9

5

0

1

9

5

5

1

9

6

0

1

9

6

5

1

9

7

0

1

9

7

5

1

9

8

0

1

9

8

5

1

9

9

0

2

0

0

0

Wash-3 Rule

of Thumb Case-by-Case

Site Reviews

10 C

F

R 100 Adopted

Metropolitan

Sites Considered

(‘62-’65)

Sites Approved for:

Indian Point I

Dresden I

Fermi I A

E

C

Proposes

Site Criteria

Hold on Metro SitingMalibuSeismic(‘64)

A

E

C Seismic &

Geologic Siting

Criteria

Siting Study

Meeting on

Metro Siting

ASL

A

B

Ruling Excl

Area, L

P

Z, Evac

1

9

4

0

1

9

4

5

1

9

5

0

1

9

5

5

1

9

6

0

1

9

6

5

1

9

7

0

1

9

7

5

1

9

8

0

1

9

8

5

1

9

9

0

2

0

0

0

Reg

ulatory

Decisio

n

&

Criteria

Reg

G

uide

1.17

4
Reactor Safety Course (R-800) 1.0 The Development of Safety Concepts, 1946 - 1975

USNRC Technical Training Center 1.0-6 NUREG/CR-6042 Rev. 2

Fig

ure 1.0-1 Timin

g

of m

ajor e

v

e

nts a

n

d

a

ctivities rele

v

a

nt to

c

o

m

m

ercial

p

o

w

er re

a

ctor safety fro

m 19

4

0s to

prese

nt (3

of 3)

P

r

o

b

a

bilistic

Risk

Assessm

e

nt

Wash-14

0

0 IR

E

P

In

dian

P

oint

LaSalle

T

A

P

A-45

Zio

n

R

S

S

M

A

P

N

U

R

E

G1150

P

R

A

P

olicy

Statement

19

4

0 19

4

5 19

5

0 19

5

5 19

6

0 19

6

5 19

7

0 19

7

5 19

8

0 19

8

5 19

9

0

2

0

0

0

P

ostulated

Actual

Wash-74

0

M

C

A

C

o

ncept

Win

dsscale (U

K)

R

P

V Integrity

C

hina S

y

n

dro

me

M

S

L

B

A

T

W

S

Fermi IFlo

w

Blockage

Class 9 for F

N

P

P

Black

Fox(‘77)

Bro

w

ns

FerryFire

T

MI-2

C

hern

o

b

yl

Davis

BesseL

O

F

W

19

4

0 19

4

5 19

5

0 19

5

5 19

6

0 19

6

5 19

7

0 19

7

5 19

8

0 19

8

5 19

9

0

2

0

0

0

A

c

cid

e

nts & In

cid

e

nts
Reactor Safety Course (R-800) 1.0 The Development of Safety Concepts, 1946 - 1975

USNRC Technical Training Center 1.0-7 NUREG/CR-6042 Rev. 2

1. John G. Kemeny, et al., “Reportof the

President’sCommission on the Accident

atThreeMileIsland,”October1979.

2. Richard G. Hewlett and Francis Duncan,

“AtomicShield, 1947/1952, Volume II, A

History of the United States Atomic

Energy Commission,”The Pennsylvania

State University Press, University Park,

Pennsylvania, 1960.

3. C. P. Russel, “ReactorSafeguards,”

MacMillan, New York, 1962.

4. Richard G. Hewlett and Francis Duncan,

“NuclearNavy 1946-1962", University of

Chicago Press, Chicago, Illinois, 1974.

5. George T. Mazuzan and Roger R. Trask,

“An Outline History of Nuclear

Regulation and Licensing 1946-1979,”

Historical Office, Office of the Secretary,

Nuclear Regulatory Commission, April

1979.

6. DavidOkrent,“NuclearReactorSafety:

On the HistoryoftheRegulatoryProcess,”

The University of Wisconsin Press,

Madison, Wisconsin, 1981.

7. Alice L. Buck, “AHistory of the Atomic

Energy Commission,”DOE/ES-0003/1,

U.S. Department of Energy, Assistant

S e c r e t a r y , M a n a g e m e n t a n d

Administration, Office of the Executive

Secretariat, HistoryDivision, Washington,

DC, July 1983.

8. George T. Mazuzan and Samuel Walker,

“ControllingTheAtom:TheBeginnings

of Nuclear Regulation 1946-1962,”

University of California Press, 1984.

9. J. Samuel Walker, “AShort History of

Nuclear Regulation 1946-1990,”

Historical Office, Office of the Secretary,

Nuclear Regulatory Commission,

June 1991.

10. American Nuclear Society, “Controlled

Nuclear Chain Reaction, The First 50

Years,”LaGrangePark,Illinois,1992.

References for Section 1.0
Reactor Safety Course (R-800) 1.1 1946-1953, Emergence of Safety Strategies

USNRC Technical Training Center 1.1-2 NUREG/CR-6042 Rev. 2

1.1 1946-1953, Emergence of Safety

Strategies

1.1.1 The Atomic Energy Act of 1946

Following the use of the atomic bomb to end

World War II, peaceful uses of nuclear

energy were rapidly proposed. However, a

much higher priority was to maintain control

of and advance the weapons-related aspects

of the new technology. Consequently, the

Atomic Energy Act of 1946, while providing

a statutory basis for developing peaceful

uses of nuclear energy, stressed the need for

secrecy, raw materials, and the production of

new weapons. The act did not allow for

private commercial applications of nuclear

energy; instead, it created a virtual federal

government monopoly of the new technology

and stressed the minimum regulation

necessary under this monopolistic

framework. TomanagetheNation’satomic

energy programs, the act established the

five-member Atomic Energy Commission

(AEC). The Joint Committee on Atomic

Energy (JCAE) was created by the act to

provide congressional oversight of the AEC.

1.1.2 Remote Siting

In 1947 the AEC established a Reactor

Safeguards Committee (predecessor to the

current Advisory Committee on Reactor

Safeguards, ACRS) to determine whether the

reactors being planned could be built without

endangering public safety. In the first few

years after World War II, several low-power

(less than 50 MWt) engineering test reactors

were built in the United States to develop

peaceful uses of atomic energy. For most of

these reactors, the Reactor Safeguards

Committee continued the practice established

during the Manhattan Project of siting

reactors on large government reservations far

from populated areas.

A 1950 report, WASH-3,1describes this

isolated siting practice. For each reactor, a

serious accident was postulated. The

accident involved gross overheating or

melting of the fuel, rupture of the reactor

coolant system, and an uncontrolled release

of radionuclides from the relatively

conventional building that housed the

reactor. Allowing for meteorological effects

on the transport and dispersion of

radionuclides, the Reactor Safeguards

Committee recommended that residents be

excluded within a specified distance R of the

reactor. The exclusion distance R was

related to the reactor thermal power P in

kilowatts by the following rule of thumb:

or

Outside the exclusion area, it was stipulated

that the calculated radiation exposure should

be less than 300 rem (which is roughly the

threshold for a lethal dose), or evacuation

should be possible. For a 30 MWt plant, the

rule of thumb gives an exclusion distance of

2.24 miles (3.6 km). For a 3000 MWt plant

like many currently used to produce

electricity, the rule of thumb would give an

exclusion distance of 17.3 miles (27.8 km).

1.1.3 Containment

A significant early exception to government

reservation siting was approved in 1952 for

the sodium-cooled Submarine Intermediate

Reactor Mark A, which was located at

Knolls Atomic Power Laboratory (KAPL)
Reactor Safety Course (R-800) 1.1 1946-1953, Emergence of Safety Strategies

USNRC Technical Training Center 1.1-3 NUREG/CR-6042 Rev. 2

only 19 miles (30.6 km) from Schenectady,

NY. In response to Reactor Safeguards

Committee concerns, the entire reactor

facility was enclosed in a gas-tight steel

sphere that was designed to withstand "a

disruptive core explosion from nuclear

energy release, followed by sodium-water

and air reactions" 2and to contain

radionuclides that might otherwise be

released in a reactor accident3. The AEC

accepted this containment strategy; however,

containment was not considered a perfect

substitute for isolation by distance. The

reactor was still built in a sparsely populated

area.

In December 1953 the AEC invited private

industry to submit proposals for the first

"civilian" nuclear power plant. This plant,

the Shippingport Atomic Power Station,

which was also called the pressurized water

reactor (PWR), was owned by the

government but was designed and

constructed by Westinghouse and operated

by Duquesne Light Company under the

stringent guidance of the Division of Naval

Reactors of the AEC. The PWR would not

have met the 1950 rule of thumb criterion.

The Shippingport, Pennsylvania site was

about 420 acres (1.7 km2) in area and about

20 miles (32 km) from Pittsburgh. Although

remote, the site was in a region with more

population than was characteristic of isolated

government reservation sites. Therefore a

containment building was provided for

Shippingport.

1.1.4 Accident-prevention and Safety

Systems

Nuclear-powered submarines were developed

in parallel with commercial nuclear power

plants in the early 1950s. The U.S.S.

Nautilus, the first nuclear-powered

submarine, commenced sea trials in 1955,

whereas Shippingport began to produce

electrical power in 1957. Since the

submarine crew had no avenue of escape

while the ship was at sea and major ports

were generally large population centers,

remote siting could not be relied upon to

acceptably limit the consequences of an

accident.

The submarine hull provided a containment

capability, but to protect the crew, the Navy

relied on an accident- prevention strategy.

Stringent procedures were developed for

operator training, quality control, and

system/component testing. Systems and

components were built with considerable

design margin to withstand substantially

higher than likely temperatures and

pressures. Potential equipment malfunctions

and failures were postulated anyway, and

redundant safety systems were included in

the design so that each safety function could

be performed by more than one component

or system. Prevention and safety-system

strategies analogous to those used for

submarine reactors evolved in the 1950s and

early 1960s for commercial nuclear reactors

on a case-by-case basis.

1.1.5 Defense In Depth

Figure 1.1-1 shows the key elements of an

overall safety strategy that began to emerge

in the early 1950s and has become known as

defense in depth. One key element is

accident-prevention. Quality control and

assurance are emphasized; plant systems and

structures are conservatively designed,

procured, installed, and inspected; and

operators are trained to reduce the likelihood

of initiating a serious accident. In spite of

these accident-prevention measures,

equipment failures and operator errors that
Reactor Safety Course (R-800) 1.1 1946-1953, Emergence of Safety Strategies

USNRC Technical Training Center 1.1-4 NUREG/CR-6042 Rev. 2

could result in serious accidents are

postulated, and redundant safety systems are

installed to prevent the release of

r a d i o n u c l i d e s f r o m t h e f u e l .

Notwithstanding these safety systems,

radionuclide releases from the reactor

coolant system are postulated, and a

containment building is provided to prevent

these radionuclides from escaping the plant.

Plants are required to develop accident

management programs, which further reduce

the likelihood of uncontrolled radionuclide

releases during accidents. In spite of these

actions, accidental releases are postulated.

In siting the reactor, exclusion areas and low

population zones (Section 1.2.6) are

provided so that potential leakage from the

containment can be tolerated without

endangering nearby residents. Finally,

emergency plans (Sections 2.2.6 and 5.4.5)

are developed that include provisions for

sheltering and evacuation to further reduce

potential doses to the public.

Defense in depth can also be described in

terms of the multiple barriers or layers of

protection against radionuclide releases as

indicated in Table 1.1-1.

The preceding description of defense in

depth does not address questions of what

accident initiators to postulate; what reactor

containment radionuclide releases to

postulate; how much credit should be given

for removing radionuclides using engineered

safety features, how strong the

containment should be; or what containment

leakage to postulate. Of necessity, answers

to these questions evolved and continue to

evolve as plants are licensed, safety issues

are addressed, operating experience is

obtained, accidents occur, and safety

research is conducted.

As the history discussed in the following

sections demonstrates, balance evolved in

the defense-in-depth strategy. No single

element (e.g., accident-prevention) or barrier

(e.g., containment) is emphasized to the

exclusion of others. Much of this course

describes the current balance and how it was

achieved.
Reactor Safety Course (R-800) 1.1 1946-1953, Emergence of Safety Strategies

USNRC Technical Training Center 1.1-5 NUREG/CR-6042 Rev. 2

Table 1.1-1 Defense in depth multilayer protection from fission

products

Barrier or Layer Function

1. Ceramic fuel pellets Only a fraction of the gaseous and volatile fission

products is released from the pellets.

2. Metal cladding The cladding tubes contain the fission products

released from the pellets. During the life of the

fuel, less than 0.5 percent of the tubes may

develop pinhole sized leaks through which some

fission products escape.

3. Reactor vessel and piping The 8- to 10-in. (20- to 25-cm) thick steel vessel

and 3- to 4-in. (7.6- to 10.2-cm) thick steel piping

contain the reactor cooling water. A portion of the

circulating water is continuously passed through

filters to keep the radioactivity low.

4. Containment The nuclear steam supply system is enclosed in a

containment building strong enough to withstand

the rupture of any pipe in the reactor coolant

system.

5. Exclusion area A designated area around each plant separates the

plant from the public. Entrance is restricted.

6. Low population zone,

evacuation plan

Residents in the low population zone are protected

by emergency evacuation plans.

7. Population center distance Plants are located at a distance from population

centers.
Reactor Safety Course (R-800) 1.1 1946-1953, Emergence of Safety Strategies

USNRC Technical Training Center 1.1-6 NUREG/CR-6042 Rev. 2

Figure 1.1-1 Defense in depth, safety strategies
Reactor Safety Course (R-800) 1.1 1946-1953, Emergence of Safety Strategies

USNRC Technical Training Center 1.1-7 NUREG/CR-6042 Rev. 2

1. U.S. Atomic Energy Commission,

“SummaryReportofReactorSafeguards

Committee,”WASH-3,1950.

2. C.P.Russel,“ReactorSafeguards,”p.19,

MacMillan, New York, 1962.

3. Richard G. Hewlett and Francis Duncan,

“NuclearNavy1946-1962,”p.176,

University of Chicago Press, Chicago,

Illinois, 1974

References for Section 1.1
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-2 NUREG/CR-6042 Rev. 2

1.2 1954-1965 Early Commercial

Reactors, Emphasis on Containment

1.2.1 Atomic Energy Act of 1954

In the early 1950s, there was no immediate

need for nuclear power plants in the U.S.

The impetus for developing U.S. nuclear

power plants came from the fear of falling

behind other nations, particularly the Soviet

Union. In the midst of the cold war, U.S.

government officials argued that countries in

need of electrical power would gravitate

toward the Soviet Union if it won the

nuclear power race. In addition, with the

development of the hydrogen bomb by both

the U.S. and the Soviet Union, strong desire

was expressed by the President and

congressional leaders for peaceful uses of

nuclear energy. But the development of such

peaceful uses was thwarted by the

limitations on access to technical

information imposed by the Atomic Energy

Act of 1946. After considerable debate

concerning the merits of public versus

private power, the 1946 act was amended by

the Atomic Energy Act of 1954. Much of

this act survives today under the Nuclear

Regulatory Commission.

Among other things, the 1954 act provided

for

a program to encourage widespread

participation in the development and

utilization of atomic energy for

peaceful purposes to the maximum

extent consistent with the common

defense and security and with the

health and safety of the public.

The act largely satisfied industry needs for

information, and it allowed private patents

for inventions related to non-military

applications of nuclear energy. It provided

for the federal licensing of medical, research

and development, and commercial facilities

using nuclear materials. The rights of state

or local government to license or regulate

the safety (but not economics) of such

facilities were preempted. U.S. antitrust

laws were applied to licensees.

The act gave the AEC the responsibility for

adequately protecting the public health,

safety, life, and property. Section 182(a) of

the Act requires the Commission to ensure

that

the utilization or production of

special nuclear material will ...

provide adequate protection to the

health and safety of the public.

The Congress left it to the AEC to determine

whatconstituted“adequateprotection.” In

its rules and decisions, the Commission

referstothisstandardaseitherthe“adequate

protection”standardorthe“nounduerisk”

standard. The interchangeable use of these

two terms has been accepted in legal

decisions.1

Under the 1954 Act, in addition to

continuing its nuclear weapons programs, the

AEC was given the responsibility for both

encouraging and licensing commercial

nuclear power. The Act outlined a two-step

procedure for granting licenses. If the AEC

found the safety analysis submitted by a

utility for a proposed reactor to be

acceptable, it would issue a construction

permit. After construction was completed

and the AEC determined that the facility met

the provisions of the act and the rules and

regulations of the commission, an operating

license could be issued. The act allowed a

publichearing “upon therequestofany

person whose interest may be affected by the

proceeding.”
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-3 NUREG/CR-6042 Rev. 2

The AEC's regulatory staff, created soon

after the passage of the 1954 Atomic Energy

Act, confronted the task of writing

regulations and devising licensing procedures

rigorous enough to assure safety but flexible

enough to allow for new findings and rapid

changes in nuclear technology. Within a

short time the staff drafted rules on radiation

protection, distribution and safeguarding of

fissionable materials, and the qualification of

reactor operators.

The AEC also established regulations

implementing the two-step licensing process.

Under the initial licensing regulations,

reviews of applications for construction

permits were evaluated by the regulatory

staff, which next (or concurrently) sent the

application to the Advisory Committee on

Reactor Safeguards (ACRS) for independent

review. The regulatory staff and Advisory

Committee on Reactor Safeguards reviewed

the information that applicants supplied on

the suitability of the proposed site,

construction specifications, plan of

operations, and safety features. The AEC

did not require finalized technical data on

the safety of a facility at the construction

permit stage. A construction permit could

be granted if there was reasonable assurance

that the plant could be constructed and

operated at the proposed site without undue

risk to the health and safety of the public.

Permitting construction to proceed without

first resolving all potential safety problems

was deemed acceptable in light of the

existing state of the technology and the

commitment to rapid development of nuclear

power.

The recommendations of the staff and the

Advisory Committee on Reactor Safeguards

went to the commissioners, who made the

final decision on whether to approve a

construction permit or operating license.

( La t e r, t h e Commission delega t e d

consideration of regulatory staff and

Advisory Committee on Reactor Safeguards

judgments to the Atomic Safety and

Licensing Boards while retaining final

jurisdiction in licensing cases if it chose to

review a board ruling.) The commission did

not publicly document its findings regarding

safety, nor did it make publicly available the

reports it received from the Advisory

Committee on Reactor Safeguards. Also,

public notice of commission action on an

application represented a fait accompli.

1.2.2 Early Siting Precedents

In 1955 and 1956, the AEC received and

approved applications for construction

permits for three large, privately owned

power reactors. Each was to be in the

general vicinity of a large city:

Commonwealth Edison proposed the Dresden

1 BWR about 35 miles (56 km) southwest of

Chicago, Illinois; Consolidated Edison

proposed the Indian Point 1 PWR 24 miles

(39 km) north of New York City; and Detroit

Edison proposed the Enrico Fermi fast

reactor 25 miles (40 km) south of Detroit.

Containment buildings were proposed for all

three reactors.

The advent of containment was clearly a

decisive step in moving large reactors away

from highly remote sites to populated areas.

The large exclusion distance required by the

rule of thumb criterion would have allowed

few sites in the United States to qualify for

large, uncontained nuclear power plants.

The unavailability and/or cost of large

blocks of unoccupied land near electrical

load centers made isolated siting

economically impractical. Furthermore,

containment provided a barrier to the release

of radionuclides that was highly desirable for

public safety and for public acceptance of
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-4 NUREG/CR-6042 Rev. 2

nuclear power.

In response to questions posed in 1956 by a

U.S. senator, then AEC Chairman Libby

stated:

It is expected that power reactors

such as that now under construction

at Shippingport, Pennsylvania, will

rely more upon the philosophy of

containment than isolation as a

means of protecting the public

against the consequence of an

improbable accident, but in each case

there will be a reasonable distance

between the reactor and major

centers of population.

2

In 1958, a proposal was made to build a

small (48 MWt) organic-cooled commercial

reactor without a containment near the town

of Piqua, Ohio. This proposal was rejected

and a containment building was required for

the Piqua plant.3In fact, all the commercial

nuclear power plants approved for

construction in the U.S. have had

containments.

No formal design criteria or site criteria

existed in 1955, and rather little preliminary

design information was available in 1955-

1956 when the Dresden 1, Indian Point 1,

and Enrico Fermi applications for

construction permits were reviewed.

Clearly, there was no plant operating

experience at the time. In addition there was

little consideration of alternative sites or

demographic factors. In this light, it is

interesting that the early siting decisions,

particularly approval of the 585 Mwt Indian

Point reactor, set major precedents on power

reactor siting. No large power reactor has

been built in the United States at a site

having a greater surrounding population

density than Indian Point.

1.2.3 Power Reactor Development

Company Construction Permit

Application

The January 1956 application for a

construction permit to build the Enrico

Fermi plant proved particularly contentious.

The application was filed by the Power

Reactor Development Company (PRDC), a

consortium of utilities led by Detroit Edison.

The fast breeder reactor that PRDC planned

was far more technologically advanced than

the light water reactors planned for Dresden

1 and Indian Point 1. The ACRS review of

thePRDCapplicationconcludedthat“there

is insufficient information available at this

time to give assurance that the PRDC reactor

can be operated at this site without public

hazard.”TheACRSexpresseduncertainty

that questions regarding the reactor's safety

could be resolved within PRDC's proposed

schedule for obtaining an operating license.

The ACRS urged the AEC to expand its

experimental programs on fast breeders to

seek more complete data on the issues raised

during the reviews of the PRDC application.

Public controversy regarding the PRDC

application arose as the result of

congressional testimony. In June 1956, AEC

Chairman Lewis L. Strauss testified in

support of a supplemental appropriation for

the civilian nuclear power program before a

house appropriations subcommittee. The

subcommittee chairman was a strong public

power advocate. He chided Strauss about

private industry's lack of progress in atomic

development and suggested that PRDC had

nointentionof“buildingthisreactoratany

timeinthedeterminablefuture.”4 Strauss,

eagertorefutethisassertion,replied:“They

[PRDC] have already spent eight million

dollars of their own money to date on this

project. I told you they were breaking

ground on August 8. I have been invited to
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-5 NUREG/CR-6042 Rev. 2

attendtheceremony;Iintendtodoso.”4

This reply indicated that the AEC chairman

was planning to attend the ground breaking

ceremony for a reactor whose construction

permit had not yet been granted.

During the hearings the next day, AEC

Commissioner Thomas Murray, in arguing

for additional research and development

funds, disclosed the concerns of the ACRS

regarding the PRDC application. On the

same day, Murray also went to see the

chairman of the Joint Committee on Atomic

Energy and informed him of the ACRS

safety concerns.

The Joint Committee, claiming the AEC had

failed to keep them “fullyand currently

informed”asrequiredbythe1954Atomic

Energy Act, promptly requested a copy of

the ACRS report. The AEC reluctantly

offered to provide a copy if the Joint

Committeewouldkeepit“administratively

confidential.” Thecommitteerefused to

accept the document under these conditions.

A few months later, the Commissioners

discovered that the AEC staff had provided

a copy of the document to PRDC. The

Commissioners then decided they had no

choice but to release the document publicly,

an embarrassing change of stance.

On August 2, 1956, based on more

optimistic review of the PRDC application

by the AEC staff, the commissioners decided

to issue PRDC a construction permit by a

vote of three to one (Murray was the

dissenter). The AEC decision drew an angry

response from the Joint Committee and led

to the first intervention in nuclear power

plant licensing.

1.2.4 The Price-Anderson Act and

WASH-740

Angered by the AEC decision to grant the

PRDC construction permit, Senator Clinton

P. Anderson, Chairman of the Joint

Committee on Atomic Energy, introduced

legislation which (1) established the ACRS

as a statutory body, (2) required it to review

all applications for construction permits and

operating licenses, (3) required the ACRS to

make a public report on each review, and (4)

required public hearings on all such

applications.

These measures were passed as amendments

to the Price-Anderson Act in August 1957.

The primary purpose of this act was to

establish liability limits and no-fault

provisions for insurance on nuclear reactor

accidents. Such indemnity legislation was

deemed essential by AEC, the emerging

nuclear industry, and the Joint Committee on

Atomic Energy who recognized that the

probability of a severe reactor accident could

not be reduced to zero. The original act,

which has been periodically amended, had

the government underwrite $500 million of

insurance beyond the $60 million available

from private companies. The AEC initially

opposed setting a specific upper limit, but

Andersonwantedtoavoida“blankcheck”

for industry.

4

10 CFR 140 describes the

financial protection required for licensees.5

An important technical input to establishing

t h e i n d e m n i t y p r o v i s i o n s o f t h e

Price-Anderson Act was the report WASH740 entitled, "Theoretical Possibilities and

Consequences of Major Accidents in Large

Nuclear Power Plants," which was prepared

by Brookhaven National Laboratory and

published by the AEC.6 Using what would

prove to be extremely pessimistic

assumptions including a core meltdown with
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-6 NUREG/CR-6042 Rev. 2

the release of fifty percent of the core fission

products to the atmosphere, the worst case

consequences of a 500 MWt reactor accident

were estimated to be 3,400 early fatalities,

43,000 acute injuries, and 7 billion (1957)

dollars.

There was a consensus among those involved

in the WASH-740 study that the likelihood

of a meltdown accident was low, but

quantitative probability estimates could not

be supported given the lack of operating

plant experience. Similarly, the likelihood

of containment failure (or bypass) given a

meltdown accident was not quantified (or

quantifiable, at the time). However, until

1966, the containment building was treated

as an independent barrier, which should

remain intact even if the core melted,

thereby preventing any large release of

radionuclides to the atmosphere. It was

recognized that failure of the containment

building and melting of the core could

occur--for example, as a consequence of

gross rupture of the reactor pressure

vessel--but such events were not considered

credible. Containment failure was not

expected to occur just because the core

melted.

1.2.5 The First Intervention

In the days after the AEC decision to grant

the PRDC construction permit, private

meetings were held between members of the

J oint Committee and labor union

representatives. Labor unions had opposed

many of the changes in the Atomic Energy

Act of 1954, citing fear of industry

monopolization by private utilities.

On August 31, 1956 the AEC received three

identical intervention petitions from

American Federation of Labor--Congress of

Industrial Organizations (AFL-CIO) unions.

These were the first intervention petitions

ever received by the AEC. They requested

suspension of the PRDC construction permit

while a hearing was held on the reactor's

safety, PRDC's financial qualifications, and

the legality of the AEC's conduct in issuing

the construction permit. The AEC did not

suspend the PRDC construction permit;

however, the request for hearings was

granted. The hearings began on January 8,

1957 and ran for more than two years.

On May 26, 1959 the hearings ended with an

AEC ruling that the construction permit

would stand. The unions appealed this

decision, and almost a year later the U.S.

Court of Appeals in a two to one opinion

upheld the unions by declaring the PRDC

construction permit illegal. In a particularly

controversial section, the two judge majority

took it upon themselves to review the

proposed site of the PRDC reactor.

Apparently swayed by testimony of

unmitigated nuclear accidents like that

described in WASH-740 the majority opinion

stated:

We think it clear from Congressional

concern for safety that Congress

intended no reactor should, without

compelling reasons, be located where

it will expose so large a population to

the possibility of a nuclear disaster.

7

The PRDC obtained a stay of the Court of

Appeals order while the AEC appealed to the

U.S. Supreme Court. On June 12, 1961 the

Court announced a seven-to-two vote in

favor of the government's position. The

decision supported the two-step licensing

process holding that the AEC was within its

authority to issue the construction permit

because a separate positive finding of

"adequate protection to the heath and safety

of the public" would be required before
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-7 NUREG/CR-6042 Rev. 2

granting an operating license. It was the

PRDC case that established that adequate

protection and no undue risk were

synonymous. Regarding the AEC's authority

to license reactors near a large city, the

majority decision noted that the issue had

been raised by the Court of Appeals, not by

the intervenors and concluded that "the

position is without merit."7

Although the AEC won the PRDC case, its

early bungling of the ACRS report, the

manner in which it handled the case, and the

continuance of the construction permit

during the five years of contention fostered

the image of an agency more concerned with

promoting the development of commercial

nuclear power than with regulating its safety.

1.2.6 Reactor Site Criteria, 10 CFR 100

In the late 1950s several smaller reactors, all

with containments and all at rural sites, were

approved. However, during the same period,

a few small power reactors (60 MWt) were

proposed for sites within or adjacent to

small cities. These were rejected or forced

to move to somewhat less populated sites.

To avoid wasting future efforts on reactor

proposals for sites that would be evaluated

unfavorably, the AEC commissioners

encouraged the development of written site

criteria.

On May 23, 1959 the AEC published in the

Federal Register notice of a proposed rule

making concerning site criteria.3 The notice

introduced several concepts that strongly

influenced the licensing process for

commercial reactors, particularly when site

criteria were formally issued as 10 CFR 100

in April 1962.

The maximum credible accident was a

concept introduced in the draft to strike a

balance between two extremes. If the worst

conceivable accident was postulated (e.g., an

uncontained meltdown as in WASH-740),

only sites isolated from populated areas by

hundreds of miles would offer sufficient

protection. As noted earlier, this would have

effectively precluded the commercialization

of nuclear power. On the other hand, if

engineered safety features (ESFs) to protect

against all possible accidents were included

in the facility design, then it could be argued

that every site would be satisfactory. Of

course, in the latter case no potentially

serious accidents could be overlooked and

the ESFs would have to be failproof. Such

perfection was not defensible. This led to

the idea of designing for what was

subjectively assessed to be the maximum

credible accident.

When 10 CFR 100 was issued (April 1962),

the term maximum credible accident was

dropped, but the notion was retained in

100.11 (a) and an associated footnote:

As an aid in evaluating a proposed

site, an applicant should assume a

fission product release from the

core, the expected demonstrable leak

rate from the containment and the

meteorological conditions pertinent to

his site ...*

_____________________

*The fission product release assumed for

these calculations should be based upon a

major accident, hypothesized for purposes of

s i t e a n a l y s i s o r p o s t u l a t e d f ro m

considerations of possible accidental events,

that would result in potential hazards not

exceeded by those from any accident

considered credible. Such accidents have

generally been assumed to result in

substantial meltdown of the core with

subsequent release of appreciable quantities

of fission products.
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-8 NUREG/CR-6042 Rev. 2

This maximum credible accident has, at

various times, also been referred to as the

design-basis accident (DBA) or the designbasis loss of coolant accident (LOCA). As

discussed in Section 1.4, there is not a single

design-basis accident. Plants are designed to

withstand a spectrum of postulated accidents.

The term siting-basis accident is adopted

herein to refer to a design-basis accident that

is limiting with respect to site evaluation

because it has greater predicted offsite doses

than other design-basis accidents. The

siting-basis accident is generally initiated by

a major reactor-coolant system pipe break.

R a t h e r p r e s c r i p t ive and ge n e r a l l y

conservative guidance for calculating offsite

doses evolved from 10 CFR 100. For

example, 10 CFR 100 refers to Technical

Information Document (TID) 14844, which

postulates that 100% of the noble gas fission

products, 50% of the volatile (halogen)

fission products, and 1% of the particulates

are immediately released to the containment

atmosphere following the pipe break.8,9,10

The TID-14844 release is based on a

postulated core melt accident and the 1962

understanding of fission product behavior.

(Section 5.1.6 discusses recent revisions to

guidance regarding core melt accident

releases.) Containment, which is designed to

withstand the peak pressure associated with

reactor coolant system blowdown, is

assumed to remain intact but to leak

radionuclides to the environment at the

design leakage rate (the containment leakage

rate to be incorporated in the plant technical

specifications).

Only very limited metal-water reactions and

associated hydrogen production are

accounted for in the computational

assumptions that evolved after 10 CFR 100

was issued. The reason for this is not clear.

The potential importance of metal water

reactions during core melt accidents was

recognized as early as 1957 (in WASH-740).

The fact that stainless steel, which was used

for cladding until the mid-1960s, is

considerably less reactive than Zircaloy

probably had some influence. Design-basis

accident assumptions and calculations are

discussed further in Section 1.4. The

evolution of hydrogen and the burn that

occurred at Three Mile Island Unit 2 are

discussed in Sections 2.3 and 3.4.

For purposes of site evaluation, 10 CFR 100

requires that doses at two area boundaries be

considered. The exclusion area is

that area surrounding the reactor in

which the licensee has the authority

to determine all activities, including

exclusion or removal of personnel

and property from the area.

11

The exclusion area does not have to be

owned by the licensee, merely controlled.

The low population zone is

the area immediately surrounding the

exclusion area, which contains

residents, the total number and

density of which are such that there

is a reasonable probability that

appropriate protective measures

could be taken in their behalf in the

event of a serious accident.

12

10 CFR 100 stipulates that neither an

individual located at any point on the outer

boundary of the exclusion area for two hours

immediately following onset of the

postulated fission product release nor an

individual located at any point on the outer

boundary of the low population zone for the

duration of the accident should receive a

total radiation dose in excess of 25 rem to

the whole body or 300 rem to the thyroid.13
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-9 NUREG/CR-6042 Rev. 2

Thus, the design-basis LOCA, whose

consequences were not to be exceeded by

any other credible accident, became the

focus of siting evaluations. 10 CFR 100

also stipulates that the population center

distance, which is

the distance from the reactor to the

nearest boundary of a densely

populated center containing more

than 25,000 residents, [should be] at

least one and one-third times the

distance from the reactor to the outer

boundary of the low population

zone.14

This requirement developed as a result of

various considerations. In late 1960 the

Advisory Committee on Reactor Safeguards

proposed a rather specific criterion--no lethal

doses at the population center for the worst

conceivable accident (an uncontained

meltdown as considered in WASH-740).

This philosophy was reflected in the

statement of considerations which

accompanied the interim version of the site

criteria released in March 1961:

Even if a more serious accident (not

normally considered credible) should

occur, the number of people killed

should not be catastrophic.

3

However, when the AEC published 10 CFR

100 in April 1962 the new statement of

considerations discussed the use of a

minimum acceptable distance to the nearest

population center as a way to limit the

cumulative population dose (i.e., the sum of

the individual doses received) and to provide

for protection against excessive radiation

exposure to people in large centers, where

effective protective measures might not be

feasible. Thus, 10 CFR 100 does not require

that uncontained meltdown accidents be

postulated.

1.2.7 Credit for Engineered Safety

Features

Although the 10 CFR 100 reactor site

criteria notes the

current policy of the Commission of

keeping stationary power and test

reactors away from densely populated

centers ... It should be equally

understood, however, that applicants

are free and indeed encouraged to

demonstrate to the Commission the

applicability and significance of

considerations other than those set

forth in the guides.

The nuclear industry responded to 10 CFR

100 in two ways: (1) by seeking credit for

engineered safety features (ESFs, which were

called engineered safeguards at the time) and

(2) by direct attacks on metropolitan siting

restrictions.

Credit for ESFs was sought to allow siting

of reactors at locations where, without such

features, protection of the public would not

be adequate (10 CFR 100 guidelines would

be exceeded). Applicants attempted to get

maximum credit for reductions in

containment pressure and radionuclide

concentrations by ESFs during postulated

LOCAs. The ESFs for which credit was

routinely given were containment, the

pressure suppression pool, containment

building sprays, containment heat removal

systems, and containment air-cleaning

systems.

In approving the San Onofre 1 construction

permit application in 1963, credit was even

given for emergency core cooling systems

(ECCS) so that only 6% of the core was
Reactor Safety Course (R-800) 1.2 1954-1965 Early Commercial Reactors,

Emphasis on Containment

USNRC Technical Training Center 1.2-10 NUREG/CR-6042 Rev. 2

assumed to melt, thereby reducing the

containment fission product inventory to 6%

of that which would otherwise have been

postulated for siting.

In November 1964, in response to an AEC

request, the Advisory Committee on Reactor

Safeguards documented its rationale for

accepting certain ESFs as substitutes for

distance.15 The position of the Advisory

Committee on Reactor Safeguards was that

credit was appropriate for all of the above

listed ESFs except the emergency core

cooling system. The emergency core cooling

system was deemed essential for accidentprevention, but radionuclide releases

postulated for siting were to be consistent

with emergency core cooling system failure:

Core spray and safety injection

systems ... might not function for

several reasons in the event of an

accident ... Therefore, reliance

cannot be placed on systems such as

these as the sole engineered

s a f e g u a r d s i n t h e p l a n t .

Nevertheless, prevention of core

melting after an unlikely loss of

primary coolant would greatly reduce

the exposure of the public. Thus, the

inclusion of a reactor core fission

product heat removal system as an

engineered safeguard is usually

essential.

The San Onofre 1, Connecticut Yankee,

Oyster Creek, Nine Mile Point, and Dresden

2 plants were approved for construction from

1963 to 1965 using ESFs to permit relaxing

previous requirements on the size of the

exclusion area and low population zone.

In 1962 an application was submitted for a

construction permit to build the two-unit

Ravenswood plant essentially in the heart of

New York City.

3 Double containment was

proposed for each of the Westinghouse

nuclear steam supply systems and for the

common spent fuel storage facility. Even so,

both the AEC staff and the ACRS expressed

concerns regarding the feasibility of building

containments with sufficiently small leak

rates. AEC staff calculations indicated that

even if all engineered safeguards operated,

leakage would have to be limited about 10-4

cubic feet per minute in order to meet 10

CFR 100 siting guidelines. In late 1963,

Consolidated Edison withdrew its application

for Ravenswood, claiming cheaper power

was available from Labrador, 1100 miles

away. Metropolitan siting continued to be

seriously considered as late as 1970.3
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-1 NUREG/CR-6042 Rev. 2

1.3 1966-1974 Emphasis on Prevention,

Public Debate

In 1966, two issues called into question the

assumption of containment as an independent

barrier. The first issue concerned reactor

pressure vessel integrity. The second was

the so-called China syndrome. The net

effect of these issues was to shift the focus

of regulatory actions toward a strategy of

accident prevention and away from reliance

on containment.

1.3.1 Reactor Pressure Vessel Integrity

The design and manufacture of early nuclear

reactor vessels in the United States

conformed to the basic requirements of

Section I and/or Section VII of the American

Society of Mechanical Engineers Boiler and

Pressure Vessel Code. These procedures

were also supplemented by nuclear code

cases and the Navy Code.1 Recognizing the

unique nature of nuclear reactors, the

American Society of Mechanical Engineers

established a special committee to consider

reactor pressure vessels in 1955.2In March

of 1964, American Society of Mechanical

Engineers Section III, “Rules for

Construction of Nuclear Vessels,” were

issued to specify and provide a uniform

approach to the design of nuclear pressure

vessels. The new rules placed more

emphasis on the careful analysis of design

details leading to more refined design

practices.1 Of course plants built to older

codes did not benefit from these changes.

As indicated in Figure 1.3-1, reactor vessels

are brittle when cold (below RTNDT) but, as

the temperature of reactor vessel material is

raised, the toughness increases, slowly at

first but rapidly near the reference

temperature for nil ductility transition,

RTNDT. Starting about 1950 information on

the effects of neutron radiation on the

engineering properties of structural materials

began to appear in the literature. Neutron

irradiation was found to cause structural

materials to embrittle. This can be

characterized by a shift in the reference nilductility transition temperature (RTNDT) with

irradiation that occurs over decades of plant

operation, as depicted in Figure 1.3-1.

In 1959 an American Society for Testing and

Materials task group made recommendations

on test procedures for evaluating radiation

effects on materials. This led to

recommended practices for surveillance tests

on structural materials in nuclear reactors.3

As part of their safety analysis review, the

AEC ensured that each plant conducted a

reactor vessel irradiation surveillance

program per American Society for Testing

and Materials standards to evaluate the shift

in RTNDT over the plant life, especially in the

beltline region opposite the core midplane

where the reactor vessel sees the greatest

neutron flux.

Because of the stringent design and

surveillance practices applied to reactor

pressure vessels in the U.S., failure of the

reactor pressure vessel has traditionally been

considered incredible. Containments for

U.S. nuclear power plants are not designed

to withstand the loads associated with gross

rupture of the reactor pressure vessel.

In 1964 a failure occurred near the nil

ductility transition temperature of a large

heat exchanger under test by the Foster

Wheeler Corporation. As a result of this

failure and concerns raised in 1964-1965 by

British researchers, the Advisory Committee

on Reactor Safeguards (ACRS) issued a

November 24, 1965 letter.

4 While

acknowledging the low probability of reactor

pressure vessel failure, the ACRS letter
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-2 NUREG/CR-6042 Rev. 2

expressed concern for the

increase in number, size, power level,

and proximity of nuclear power

reactors to large population centers,

and recommended 1) the development of

improved design and inspection methods for

reactor pressure vessels and 2) the

development of means "to ameliorate the

consequences of a major pressure vessel

rupture." The latter recommendation

prompted strong disagreement from both

industry and AEC representatives.

Nevertheless, more heavily populated sites

such as Indian Point and Zion were required

to design their reactor vessel cavities to

withstand a longitudinal pressure vessel

split. Ultimately, pressure on the part of

both the Advisory Committee on Reactor

Safeguards and AEC staff prompted the

development of improved industry standards

for the design, fabrication, and inspection of

pressure vessels. In addition, major research

efforts examining a variety of issues related

to reactor pressure vessel integrity were

conducted. In 1974, research conducted by

the Advisory Committee on Reactor

Safeguards concluded that the probability of

a reactor vessel failure is less than 10-6 per

vessel-year and that the most likely failures

would be within the capability of engineered

safety features.5

The issue of reactor pressure vessel integrity

has remained active since 1974. In

particular, the 1979 accident at Three Mile

Island Unit 2 (Section 2.3) was responsible

for moving the concern of pressurized

thermal shock (PTS) to a high level of

visibility. A pressurized thermal shock

event is a PWR transient that can cause

severe overcooling accompanied by vessel

pressurization to a high level. The thermal

stresses caused by rapid cooling of the

reactor vessel inside surface combine with

the pressure stresses to increase the potential

for fracture if an initiating flaw is present in

low toughness material. Additional

information on pressurized thermal shock is

presented in the references.1,6 The regulatory

approach that has evolved is aimed at

assuring that the probability of reactor

pressure vessel failure is exceedingly low.

The current rule governing pressure vessel

protection against pressurized thermal shock

is contained in 10 CFR 50.61.7

1.3.2 The China Syndrome

In preparation for a 1965 extension of PriceAnderson legislation on liability limits and

insurance for nuclear reactors, Brookhaven

National Laboratory (BNL) reexamined the

WASH-740 worst case accident scenario. A

loss of coolant accident in a 3,200 MWt

reactor was analyzed. No credit was given

for engineered safety features. BNL

estimated that, several hours following

initial primary system blowdown, decay heat

from fission products would cause the core

to melt through the bottom head of the

reactor pressure vessel and potentially

through the concrete containment basemat

and into the earth until a solid mass with

sufficient conductivity to dissipate decay

heat was formed.8It was estimated that

solidification might occur before basemat

meltthrough and would certainly occur

before the melt had penetrated more than

100 ft. (30 m) into the ground; however,

considering this potentially significant

downward penetration, the term China

syndrome was introduced.

If the molten fuel were to penetrate the

containment basemat, radionuclides could

escape through the soil to the atmosphere.

Such soil-filtered releases would probably

not cause lethal radiation doses to persons
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-3 NUREG/CR-6042 Rev. 2

outside the exclusion area. Nevertheless, the

China syndrome was significant because it

demonstrated a strong correlation between a

core meltdown and a possible loss of

containment integrity. Phenomena that were

not considered in the Brookhaven National

Laboratory study were later recognized as

potential causes of more serious above

ground containment failure modes. Such

phenomena had not been considered in

reviewing applications for commercial plants

despite the fact that the hypothetical sitingbasis accident, which was used to

demonstrate compliance with 10 CFR 100

siting criteria (Section 1.2.4), postulated

reactor containment system fission product

releases corresponding to a full-scale core

meltdown.

The concern that core meltdown could

threaten containment integrity was raised by

the Advisory Committee on Reactor

Safeguards in the summer of 1966 for the

Dresden 3 BWR and Indian Point 2 PWR

applications. Both Westinghouse and

General Electric were asked to consider the

possibility of providing ESFs that would

maintain containment integrity in the

presence of large-scale core melt.9 General

Electric argued that maintaining containment

integrity in the face of core meltdown was

not feasible for their BWR; they contended

that the emergency core cooling system was

adequate to prevent core melt in the event of

a LOCA. Westinghouse felt that a core

catcher below the reactor vessel could be

used to maintain PWR containment integrity.

Based on information provided by

Westinghouse and General Electric, the

Advisory Committee on Reactor Safeguards

concluded that it would be very difficult,

given the existing state of knowledge, to

design safeguards to assure containment

integrity given core meltdown. Instead, the

Advisory Committee on Reactor Safeguards

reports of August 16, 1966 on Dresden 3 and

Indian Point 2 recommended major

improvements in both primary system

integrity to reduce the probability of a

LOCA and emergency core cooling to reduce

the probability of meltdown given a LOCA.9

Thus, the China syndrome led to a shift in

emphasis from containment to prevention.

As time passed, accident initiators other than

the traditional large pipe break were

identified as potentially leading to core melt.

In particular, scenarios involving anticipated

transients without scram, station blackout,

other transients, and containment bypass

were eventually evaluated, and regulated to

reduce the probability of core meltdown.

Although the new emphasis on prevention

gave rise to a greatly expanded list of

accidents, until the TMI-2 accident in 1979,

the focus was on demonstrating the adequacy

of emergency core cooling for such accidents

--not on what to do if core cooling failed.

The Brookhaven reexamination of WASH740, which gave rise to the China syndrome

and to the shift in emphasis from

containment to prevention, was never

completed or published. An internal AEC

summary of the project written in 1969

stated that an important factor in the

decision not to produce a complete revision

of WASH-740 along the lines proposed by

the Brookhaven staff was the public relations

considerations. In fact, it was the failure to

release a final report of the Brookhaven

study that became a public relations concern,

because opponents of nuclear power argued

convincingly that the AEC was covering up

the real risk of reactor accidents.10

1.3.3 The AEC Core Cooling Task Force

(CCTF)

In September 1966, Advisory Committee on
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-4 NUREG/CR-6042 Rev. 2

Reactor Safeguards members expressed their

concerns regarding the China syndrome in a

meeting with the AEC commissioners. To

avoid a letter from the Advisory Committee

on Reactor Safeguards, which would have

recommended the development and

implementation of safety features to protect

against LOCAs in which emergency core

cooling system did not work, the AEC

commissioners established a task force to

study and report on questions arising from

the China syndrome.9 The eleven-man task

force, which was known as the AEC Core

Cooling Task Force (CCTF), was chaired by

William Ergen of Oak Ridge National

Laboratory and had six members from

industry and five from AEC supported

laboratories. The Core Cooling Task Force

was asked to consider

1) The degree to which core cooling

systems could be augmented to

prevent core meltdown,

2) the potential history of large

molten masses of fuel,

3) the possible interactions of molten

fuel with materials or atmospheres

in containments, and

4) the design and development

problems associated with systems

whose objective is to cope with

large molten masses of fuel.9

When faced with what little was then known

about core meltdown accidents and

associated phenomena, it was clear to the

Core Cooling Task Force that designing to

assure containment integrity after core

meltdown would require extensive,

protracted, costly research. Such research

was far beyond the scope of the Core

Cooling Task Force; consequently, the Core

Cooling Task Force focused on item 1,

preventing core meltdown.11

The Core Cooling Task Force report entitled

"Report of the Advisory Task Force on

Power Reactor Emergency Cooling," which

became available in late 1967,9concluded

that augmented emergency core cooling was

feasible and beneficial. The report was used

for policy decisions by the AEC during the

ensuing years, when the AEC emphasized

improvements in quality control and

emergency core cooling system; however, no

significant efforts to address core meltdown

accidents arose from the Core Cooling Task

Force report. The Core Cooling Task Force

correctly pointed out that small LOCAs

might have safety significance,11a fact that

would be reasserted in the 1975 Reactor

Safety Study (Section 1.5) and confirmed by

the 1979 accident at Three Mile Island Unit

2 (Section 2.1). In contrast, the task force

conclusion that current (1967) technology

was sufficient to enable prediction, with

reasonable assurance, of the key phenomena

associated with the design-basis LOCA, and

to provide quantitative understanding of the

accident would prove to be incorrect

(Section 1.3.6).

1.3.4 General Design Criteria

The AEC review of all commercial reactors

from Shippingport to Dresden 2 in 1965 was

on a case-by-case basis. The list of potential

hazards expanded as new questions were

encountered during individual plant reviews.

Tornadoes were first considered for a plant

in Arkansas, hurricanes for a plant in

Florida, and seismic events for plants in

California. Such natural phenomena were

then considered in the review of other

plants. Unusual operating experiences also

resulted in new design requirements. For

example, tornadoes once disabled all five
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-5 NUREG/CR-6042 Rev. 2

offsite power lines feeding the Dresden 1

plant, which had no on-site emergency AC

power. Subsequently, first one small onsite

diesel, then a larger diesel, then redundant

diesels to drive containment related

safeguards became the standard. In 1966,

redundant on-site power was required to

power the emergency core cooling system,

requiring still larger diesels.

Until 1965 there were no written criteria

against which the various designs could be

compared, and there was essentially no

review of the detailed design approach,

which actually determines the level of safety

achieved. As the number of new plant

applications grew, there was strong

motivation on the part of both industry and

the AEC to streamline the licensing review

process. In the spring of 1965, in response

to anticipated recommendations of an outside

review panel, the AEC staff began drafting

what would become the General Design

Criteria, Appendix A of 10 CFR 50.

On November 22, 1965 the AEC issued a

press release announcing the proposed

criteria and requesting public comment.12

During the comment period the discussions

of reactor pressure vessel failure, the China

syndrome, and the Core Cooling Task Force

were active. In this light it is interesting to

note three significant changes in the revised

draft of the general design criteria, which

was issued for comment 19 months later

(July 10, 1967).13 First, the revised draft no

longer required the containment be designed

to withstand a full meltdown as the original

draft had. The revised containment designbasis did contain the vague phrase

including considerable margin for

effects from metal-water or other

chemical reactions that could occur

as a consequence of failure of emergency

core cooling systems.

Except for these words, the revised draft

made no reference to core melt accidents.

Second, the revised draft called for

at least two emergency core cooling

systems preferably of different design

principles, each with a capability for

accomplishing abundant emergency

core cooling.

Third, requirements to design against single

failures, which had appeared in the

November 1965 version in slightly different

words, were prominent in the revised draft:

A single failure means an occurrence

which results in the loss of capability

of a component to perform its

intended safety functions. Multiple

failures resulting from a single

occurrence are considered to be a

single failure. Fluid and electrical

systems are considered to be designed

against an assumed single failure if

neither (1) a single failure of any

active component (assuming passive

components function properly) nor (2)

a single failure of a passive

c o m p o n e n t ( a s s u m i n g a c t i v e

components function properly) results

in a loss of the capability of the

system to perform its safety function.*

_____________________

*

Single failures of passive components

in electric systems should be assumed

in designing against a single failure.

The conditions under which a single

failure of a passive component in a

fluid system should be considered in

designing the system against a single

failure are under development.
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-6 NUREG/CR-6042 Rev. 2

The proposed criteria of July 10, 1967

provided interim guidance to the regulatory

staff and the nuclear industry for several

years. On February 19, 1971 the AEC

published a revised set of general design

criteria, which became Appendix A of

10 CFR 50.14 The 1971 criteria reflected the

LWR plants that had been reviewed in the

previous few years. Two emergency core

cooling systems, each capable of providing

abundant cooling, were no longer required.

The emergency core cooling system criterion

now said:

A system to provide abundant

emergency core cooling shall be

provided,

and the single failure criterion was applied

to the emergency core cooling system. None

of the criteria related to core melt accidents.

The vague phrase of the July 10, 1965

containment design criteria was modified to

require consideration of

chemical reactions that may result

from degradation, but not total

failure, of the emergency core

cooling.

The introduction to the 1971 criteria listed

several safety considerations for which

general design criteria had not yet been (and

have not yet been) developed. The list

included redundancy issues; common mode

failures; systematic, non-random failures;

and passive failures.

The general design criteria do not provide

quantitative bases for establishing the

adequacy of any particular design. The

detailed design and its acceptability were

deliberately left to the "engineering

judgment" of the designer and the regulator,

respectively. The development of more

detailed regulatory guidance began in the

1967-1968 time frame when the regulatory

staff started generating internal documents

that specified acceptable detailed design

approaches to specific problems. In 1970

the AEC began publishing such regulatory

guides. The first published regulatory guide

dealt with the concern that an emergency

core cooling system should not fail as a

result of a loss of containment integrity.

15 It

required that sources of emergency core

cooling system water be at sufficiently high

pressure (provide sufficient net positive

suction head, NPSH) to avoid pump

cavitation.

As shown in Figure 1.3-2, the number of

regulatory guides issued or revised each year

grew rapidly and remained high throughout

the 1970s. By 1978, more than 100 different

regulatory guides had been issued.9In

addition, numerous branch technical

positions and standard review plans were

issued. None of these had the force of law

like the general design criteria; however,

utilities usually found it easier to follow a

design approach prejudged as acceptable by

the regulatory staff than to defend an

alternative approach.

The actual general design criteria address 64

broad issues in six major categories:

I. Overall Requirements

II. Protection by Multiple Fission

Product Barriers

III. Protection and Reactivity

Control Systems

IV. Fluid Systems
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-7 NUREG/CR-6042 Rev. 2

V. Reactor Containment

VI. Fuel and Reactivity Control

Although all of the individual criteria cannot

be discussed here, the five criteria in

Category I are worthy of further discussion.

These criteria are particularly important and

impact many aspects of reactor safety.

1.3.4.1 Criterion 1-Quality Standards

and Records

Quality assurance is an important part of

maintaining an adequate level of safety at

nuclear power plants. A good quality

assurance program can provide confidence

that a plant is properly designed, that it is

built as designed, that proper materials are

used in construction, that the design is not

inappropriately changed at a later date, and

that appropriate maintenance and operational

practices are followed.

Criterion 1 states that:

Structures, systems, and components

important to safety shall be designed,

fabricated, erected, and tested to

quality standards commensurate with

the importance of the safety functions

being performed. ... A quality

a s s u r a n c e p rogram s h a l l b e

established and implemented in order

to provide adequate assurance that

these structures, systems, and

components will satisfactorily

perform their safety functions.

Appropriate records of design,

fabrication, erection, and testing of

structures, systems, and components

important to safety shall be

maintained by or under the control of

the nuclear power unit licensee

throughout the life of the plant.

The criterion for quality assurance was first

proposed in the July 1967 draft of Appendix

A to 10 CFR 50. The lack of AEC

requirements and criteria for quality

assurance was a key issue raised by the

Atomic Safety and Licensing Board in the

operating license hearings for the Zion plant

in 1968. The board ruled that until the

licensee presented a program to assure

quality and until the AEC developed criteria

by which to evaluate such a program, the

hearings would be halted. Following the

board's ruling and prior to the final issuance

of Appendix A, the AEC proposed a new

regulation, Appendix B to 10 CFR 50. This

new regulation more clearly spelled out

requirements for the licensees to develop

programs to assure the quality of nuclear

power plant design, construction, and

operation.

Appendix B contains 18 items that must be

part of a quality assurance program for

safety-related systems and components.

Experience from military, the National

Aeronautics and Space Administration, and

commercial nuclear projects, as well as the

AEC's own nuclear reactor experience was

used in developing the 18 items. Appendix

B clearly places the burden of responsibility

for quality assurance on the licensee.

Visible quality assurance documentation is

required for all activities affecting the

quality of safety-related systems. Appendix

B was published for comment in April 1969

and implemented in June 1970.

Following establishment of Appendices A

and B, the AEC and the industry began

issuing guidance that provided acceptable

ways of meeting the intent and requirements

of the specific regulations. In October 1971,

the American National Standards Institute

issued N45.2, "Quality Assurance Program
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-8 NUREG/CR-6042 Rev. 2

Requirements for Nuclear Power Plants."16

This standard was endorsed by the Atomic

Energy Commission in Safety Guide 28 (now

Regulatory Guide 1.28) in June 1972. Since

that time there have been numerous

additional guides and other documents on the

subject of quality assurance. The Standard

Review Plan includes guidance concerning

how the NRC staff should review and

evaluate proposed quality assurance

programs.

1.3.4.2 Criterion 2-Design Bases for

Protection Against Natural

Phenomena

Criterion 2 recognizes that not all accidents

are expected to begin as a result of failures

within the plant boundaries. Additionally,

natural phenomena may represent a threat to

plant safety. Criterion 2 states:

Structures, systems, and components

important to safety shall be designed

to withstand the effects of natural

phenomena such as earthquakes,

tornadoes, hurricanes, floods,

tsunami, and seiches without loss of

capability to perform their safety

functions. The design bases for these

structures, systems, and components

shall reflect: (1) Appropriate

consideration of the most severe of

the natural phenomena that have been

historically reported for the site and

surrounding area, with sufficient

margin for the limited accuracy,

quantity, and period of time in which

the historical data have been

a c c u mulated, (2) appropri a t e

combinations of the effects of normal

and accident conditions with the

effects of the natural phenomena and

(3) the importance of the safety

functions to be performed.

Sections 1.4 and 2.5 describe in more detail

the threats from natural phenomena and

approaches for dealing with them.

1.3.4.3 Criterion 3-Fire Protection

Fires are a potential hazard at most large

industrial facilities, including nuclear power

plants. Fires can occur in electrical

equipment or a variety of combustible

materials that may be present at a plant.

Small fires are fairly common occurrences,

and to assure that nuclear power plants can

adequately deal with fires, Criterion 3 was

developed. It states:

Structures, systems, and components

important to safety shall be designed

and located to minimize, consistent

with other safety requirements, the

probability and effect of fires and

explosions. ...

The criterion further specifies the need for

using noncombustible materials whenever

possible and for providing fire detection and

firefighting systems.

Despite the development of Criterion 3, fires

continued to occur at nuclear power plants.

On March 22, 1975 the Browns Ferry

Nuclear Power Plant experienced a major

fire, resulting in the loss of numerous safety

systems. The Browns Ferry fire is discussed

at length in Section 1.6. Following the fire,

the Special Review Group that investigated

the fire recommended that NRC should

develop additional specific guidance for

implementation of Criterion 3. In response

to this recommendation, the NRC developed

Branch Technical Position 9.5-1, "Guidelines

for Fire Protection for Nuclear Power

Plants."17 This information was later

published as Regulatory Guide 1.120: Fire
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-9 NUREG/CR-6042 Rev. 2

Protection Guidelines for Nuclear Power

Plants.18

In 1980 the NRC formally proposed

Appendix R to 10 CFR 50 to state the

minimum acceptable level of fire protection

for power plants operating prior to January

1, 1979. Appendix R contains four general

requirements to (1) establish a fire protection

program, (2) perform a fire hazards analysis,

(3) to incorporate fire prevention features,

and (4) to provide alternative or dedicated

shutdown capability.

19 Further, a number of

specific requirements were included, dealing

with

•water supplies for fire suppression

•isolation valves in the fire suppression

system

•manual fire suppression

•testing

•automatic fire detection

•safe shutdown capability

•fire brigade

•training

•emergency lighting

•administrative controls

•alternative shutdown capability

•fire barriers

•oil collection

Compliance with Appendix R has led to

significant improvements in fire safety at

nuclear power plants; however, fires

continue to occur and remain an important

safety issue.

1.3.4.4 Criterion 4-Environmental and

Dynamic Effects Design Bases

Reactor accidents may lead to harsh

environmental conditions that may challenge

the operation of components and systems or

threaten the integrity of structures.

Examples of environmental conditions that

can occur include:

1. high-temperature steam

2. high pressure

3. radiation

4. missiles

5. pipe whip

14. jet impingement

15. dynamic loads on components

For safety systems to function during an

accident, they must be designed to withstand

the expected environments. Therefore,

Criterion 4 states:

Structures, systems, and components

important to safety shall be designed

to accommodate the effects of and to

be compatible with the environmental

conditions associated with normal

operation, maintenance, testing, and

postulated accidents, including lossof-coolant accidents. ...

Qualification testing is normally used to

show that equipment can survive the

p o s t u l a t e d d e s i g n - b a s i s a c c i d e n t

environments. The beyond-design-basis

accidents discussed in later sections can

produce environments exceeding the

qualification limits.

In the early 1980s, the NRC began to

recognize that devices installed to protect

against the dynamic effects of large pipe

breaks can have significant safety

drawbacks. Pipe whip restraints and jet

impingement barriers make access for

inservice inspection more difficult and result

in higher operational exposures. If these

protective devices are removed for

inspection and reinstalled, piping or other

components may be damaged in the process.

If the protective devices are reinstalled

incorrectly, they may impede piping thermal
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-10 NUREG/CR-6042 Rev. 2

movement and result in overstress. In

addition, pipe snubbers can lockup and

impede piping thermal movement. As a

result, in 1984, Criterion 4 was revised to

allow dynamic effects to be excluded from

the design basis under certain conditions:

... dynamic effects associated with

postulated pipe ruptures in nuclear

power units may be excluded from the

design basis when analyses reviewed

and approved by the Commission

demonstrate that the probability of

fluid system piping rupture is

extremely low under conditions

consistent with the design basis for

the piping.

Assurance that nuclear power plants meet

Criterion 4 is an ongoing process. Testing

and documentation required by Criterion 1

are an essential part of the process.

However, in certain cases testing may not

accurately replicate the environments that

will actually be seen during an accident. A

classic case involves motor-operated valves.

In 1985 an incident at the Davis-Besse plant

involved failure of key valves in the

auxiliary feedwater system.20 The valves had

been successfully tested on numerous

occasions. However, during the actual

incident, the valves were exposed to high

differential pressures that were not present

during testing, and the torque switches were

not set to account for the differential

pressure. Continuing vigilance on the part

of inspectors and regulators to assure that

Criterion 4 is met is an important part of the

reactor safety philosophy.

1.3.4.5 Criterion 5-Sharing of Structures,

Systems, and Components

Criterion 5 is intended to address features of

a multi-unit site that could allow problems

to propagate from one unit to another. The

criterion states:

Structures, systems, and components

important to safety shall not be

shared among nuclear power units

unless it can be shown that such

sharing will not significantly impair

their ability to perform their safety

functions, including, in the event of

an accident at one unit, an orderly

shutdown and cooldown of the

remaining units.

Prior to the development of Criterion 5,

multi-unit sites frequently made use of

shared systems and structures. Service water

systems, control rooms and other features

were often shared. While each unit included

enough redundancy to respond to an accident

without consideration of the other units, it

was possible for an event at one location to

affect multiple units at the same time. After

the 1975 Browns Ferry fire damaged safety

systems at two units (see Section 1.6), new

multi-unit sites were designed with complete

separation, providing separate components

and structures for all important systems.

Although complete separation of units allows

the licensee to easily meet Criterion 5, there

are some important benefits lost in this

approach. Probabilistic risk assessment

indicate that the ability to properly cross-tie

safety systems from one unit to another can

significantly reduce the risk of certain types

of accidents. For example, cross-tieing

diesel generators can reduce the risk of

station blackout. Some plants have the

ability to cross-tie emergency cooling and

heat removal systems. The key is to make

sure that the cross-ties are properly designed

and implemented so they do not cause undue

multi-unit problems.
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-11 NUREG/CR-6042 Rev. 2

1.3.5 The National Environmental Policy

Act (NEPA)

In December 1969 Congress passed the

National Environmental Policy Act, which

was signed by President Nixon on January 1,

1970. The Act required federal agencies to

consider the environmental impact of their

activities. The Act was vague and confusing,

and it gave federal agencies broad discretion

in deciding how to carry out its mandate.

The AEC initially took a narrow view of its

responsibilities under the National

Environmental Policy Act for several

reasons. First was the conviction that the

routine operation of nuclear power plants

was not a serious threat to the environment,

and indeed, was beneficial compared to

burning fossil fuel. Second, the major

products of nuclear power generation that

affected the environment, radiation releases

and thermal discharges, were already covered

by existing legislation. Finally, the AEC did

not want to divert limited human resources

from tasks that were more central to its

mission. The regulatory staff was inundated

by a flood of reactor applications and did not

relish the idea of having to spend large

amounts of time on environmental reviews.

The AEC feared that considering a wider

range of environmental issues would cause

unwarranted additional licensing delays.

A proposed regulation issued by the AEC in

December 1970 added non-radiological

issues to the AEC's regulatory jurisdiction,

but stated AEC's intent to rely on

environmental assessments performed by

other federal and state agencies rather than

perform its own. The AEC agreed to

consider environmental issues in licensing

board hearings only if raised by a party to

the proceeding. The AEC also postponed a

review of National Environmental Policy Act

issues in licensing cases until March 1971.

Environmentalists charged that the AEC had

failed to fulfill the purposes of the National

Environmental Policy Act and took the

agency to federal court over the application

of the AEC's regulations to the Calvert

Cliffs nuclear units, which were then under

construction on the Chesapeake Bay in rural

Maryland. The July 23, 1971 ruling of the

United States Court of Appeals for the

District of Columbia was a stunning defeat

for the AEC. The court sternly rebuked the

AEC saying

We believe that the Commission's

crabbed interpretation of National

Environmental Policy Act makes a

mockery of the Act.

21

Recognizing the need to improve the public

image of the AEC, the commissioners

decided not to appeal the Calvert Cliffs court

ruling. In effect, the AEC agreed to

consider environmental impacts of proposed

projects and to develop environmental

expertise required to do so. In explaining

this decision to industrial groups, James R.

Schlesinger, newly appointed AEC

Chairman, indicated that although AEC's

policy of promoting and protecting the

industry had been justified to help nuclear

power get started, the industry was "rapidly

approaching mature growth," and "should not

expect the AEC to fight the industry's

political, social, and commercial battles."

Rather, he added, the agency's role was

"primarily to perform as a referee serving the

public interest."22

In response to requirements of the National

Environmental Protection Act (NEPA), the

AEC on December 1, 1971 published

10 CFR 51, Licensing and Environmental

Policy and Procedures for Environmental
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-12 NUREG/CR-6042 Rev. 2

Protection.23 Originally, Part 51 identified

nine classes of accidents. Events ranging

from trivial events (Class 1) to major

accidents considered in the design basis

evaluation required for the safety analysis

report (Class 8) were assigned to Classes 1

through 8. Accidents more severe than those

postulated in Class 8, which could lead to

core meltdown and radionuclide releases

ex ceeding the dose guidelines of

10 CFR Part 100, were designated Class 9.

Although this classification scheme is no

longer contained in 10 CFR, the term Class

9 is still used by some to refer to accidents

that involve substantial core damage.

1.3.6 Emergency Core Cooling System

Rulemaking

In May 1971 the AEC released unexpected

results of a Pressurized Water Reactor

(PWR) emergency core cooling system test

conducted at the Idaho National Engineering

Laboratory (INEL), which indicated the

possibility that the emergency core cooling

system could fail to provide water to the

core. The tests involved a 9-inch diameter

pressure vessel with one set of inlet and

outlet pipes. A break in an emergency core

cooling system inlet pipe was simulated, and

an attempt was made to inject water into the

pressure vessel to cool the electrically heated

rods simulating the core. The water was

unable to enter against the residual steam

pressure as steam and water were being

expelled through the break. This test result

prompted the AEC to adopt a set of Interim

Acceptance Criteria,24 that went into effect

until further research on emergency core

cooling system could be done. These criteria

required additional maintenance and

monitoring in addition to changes in the

emergency core cooling system of some

operating reactors.

At the time, generic issues such as

emergency core cooling system were being

contested at individual licensing hearings

greatly delaying the licensing process. In an

attempt to streamline the licensing process,

the AEC decided to conduct rulemaking

hearings on such generic issues. The

hearings were adjudicatory in nature,

affording the participants the opportunity to

testify and to cross-examine other witnesses.

Two rulemaking hearings were held in 1972.

The first, on radioactive plant effluents,

lasted 17 days and was rather easily resolved

based on conservative assumptions. The

second, on the Interim Acceptance Criteria

for emergency core cooling system, began in

January 1972 and took 125 days over 23

months. Scientists and engineers representing government, industry, and intervenor

organizations were heard and with their

lawyers, cross-examined one another.

Procedural matters often dominated. The

hearing record is more than 22,000 pages.

From this record and the recommendations

of the Hearing Board, the AEC issued "final

criteria" on January 4, 1974.25

In 1973, before the "final criteria" were

issued, a second series of experiments was

completed. These tests were called 11⁄2

semiscale because a loop simulating the

unbroken loops of a reactor was added to the

1⁄2 (broken) loop. This time water was

injected through the unbroken loop, as would

occur in the emergency core cooling system

of actual power reactors, which have two,

three, or four loops. The simulated core was

successfully cooled in all tests while the

steam escaped through the broken loop as

predicted by computer models.

Section 50.46 and Appendix K of 10 CFR 50

defined the final outcome of the rulemaking

by specifying that, following postulated
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-13 NUREG/CR-6042 Rev. 2

LOCAs, emergency core cooling system must

assure:

• Peak cladding temperature cannot

exceed 2200°F (1204°C),

• oxidation cannot exceed 17% of the

cladding thickness,

• hydrogen generation from hot

cladding-steam interaction cannot

exceed 1% of its potential,

• the core geometry must be retained in

a coolable condition,

• long-term cooling must be provided.

At the time the "final criteria" were

developed, computer codes had limited

capabilities for simulating the complex

phenomena associated with large LOCAs.

To ensure that calculations would be

conservative, the rule also provided

computational restraints, some of which are:

• A multiplier of 1.2 on the decay heat

rate,

• the assumption that the cladding

oxidation rate is not limited by the

predicted availability of steam,

• conservative assumptions on

emergency core cooling system

delivery to the lower plenum.

During the period from 1971 through 1974

the AEC and its successor the NRC reviewed

the emergency core cooling system designs

of every operating plant. When necessary,

retrofitting and upgrading of the emergency

core cooling systems were required or the

operating power level was reduced to assure

compliance with the final criteria. Indian

Point 1 was shut down in October 1974

because of an inadequate emergency core

cooling system. All new plants and plants

under construction were required to meet the

final criteria.

The 20 years that followed the semiscale test

brought several independent assessments of

the emergency core cooling system criteria.

NRC sponsored additional experiments to

investigate both individual phenomena and

system performance, and the development of

advanced computer codes that could provide

improved simulations of LOCAs. The

experimental and computational efforts

provided the technical basis for a revised

rule for the acceptance of emergency core

cooling systems. The rule was approved by

the NRC in September 1988.26 The revised

rule retains the acceptance criteria based on

peak cladding temperature, cladding

oxidation, and hydrogen generation;

however, it allows the use of best-estimate

computer codes for evaluating those

parameters. If best-estimate methods are

used, the revised rule requires that the

uncertainty of the calculations be quantified

and included when comparing calculated

results with the acceptance limits provided

in 10 CFR 50. This allows much more

realistic estimates of plant safety margins.

1.3.7 The Energy Reorganization Act of

1974

The AEC's efforts under Chairman

Schlesinger to narrow the divisions between

nuclear proponents and critics and to recover

the AEC's regulatory credibility produced, at

best, mixed results. The AEC suffered from

the general disillusionment with the

"establishment" that prevailed by the late

1960s largely as a result of the Vietnam war.

Major differences between the AEC and

environmentalists remained regarding
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-14 NUREG/CR-6042 Rev. 2

emergency core cooling system effectiveness,

thermal pollution, and hazards of low-level

radiation.

Another issue that undermined confidence in

the AEC in the early 1970s was its approach

to high-level radioactive waste disposal. In

1970, in response to increasing expressions

of concern about the lack of a policy for

high-level waste disposal, the AEC

announced that it would develop a

permanent repository for nuclear wastes in

an abandoned salt mine near Lyons, Kansas.

It aired its plans without conducting

t h o r o u gh ge ologic and hydrologic

investigations. The suitability of the site was

soon challenged by the state geologist of

Kansas and other scientists. The

uncertainties about the site generated a bitter

dispute between the AEC on the one side

and members of Congress and state officials

from Kansas on the other. It ended in 1972

in great embarrassment for the AEC. The

reservations of those who opposed the Lyons

location proved to be well-founded, and

numerous well holes were found to have

penetrated the salt bed.

In addition to debates over emergency core

cooling system and high-level waste

disposal, questions over reactor design and

safety, quality assurance, the probability of

a major reactor accident, and other issues

fueled the controversy over nuclear power.

The number of contested hearings for plant

licenses steadily grew. The AEC came

under increasing attacks for its dual

responsibilities for developing and regulating

the technology. The question of creating

separate agencies to promote and to regulate

the civilian uses of nuclear energy had arisen

within a short time after passage of the 1954

Atomic Energy Act, but in the early stages

of nuclear development it had seemed

premature and unwarranted. It gained

greater support in later years as both the

nuclear industry and antinuclear sentiment

grew. One of President Nixon's responses to

the Arab oil embargo and the energy crisis

of 1973-4 was to ask Congress to create a

new agency that could focus on, and

presumably speed up, the licensing of

nuclear plants. After much debate, in 1974

Congress passed the Energy Reorganization

Act, which divided the AEC into the Energy

Research and Development Administration

(ERDA), predecessor to the current

Department of Energy, and the Nuclear

Regulatory Commission.
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-15 NUREG/CR-6042 Rev. 2

Figure 1.3-1 Shift of nil-ductility transition temperature
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-16 NUREG/CR-6042 Rev. 2

Figure 1.3-2 Number of regulatory guides issued per year
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-17 NUREG/CR-6042 Rev. 2

1. TheodoreA.Meyer,“TheEvolutionof

Reactor Vessel PTS--A Catalyst to the

AdvancementofTechnology,”Mechanical

Engineering, June 1984, p. 37.

2. George T. Mazuzan and Samuel Walker,

“ControllingTheAtom:TheBeginningof

NuclearRegulation1946-1962,”University of California Press, 1984, p. 217.

3. American Society for Testing and

Materials (ASTM) Standards E-23, E-184,

E-185, and E-208, Philadelphia,

Pennsylvania.

4. Advisory Committee on Reactor

Safeguards (ACRS) letter on Reactor

Pressure Vessels (November 24, 1965),

reproducedin“NuclearReactorSafety:On

theHistoryoftheRegulatoryProcess”,by

David Okrent, 1981, pp. 88-89.

5. Advisory Committee on Reactor

Safeguards,“ReportontheIntegrityof

Reactor Vessels for Light-Water Power

Reactors,”WASH-1285,January1974.

6. U.S. Nuclear Regulatory Commission,

Statement of Considerations for Proposed

Revisionto10CFR50.61,“Fracture

Toughness Requirements for Protection

Against Pressurized Thermal Shock

Events,”May6,1991.

7. U.S. Code of Federal Regulations,

“Fracture Toughness Requirements for

Protection Against Pressurized Thermal

ShockEvents,”Title10,Part50.61.

8. Advisory Committee on Reactor

Safeguards, Minutes of June 3, 1966

Subcommittee Meeting, reproduced in

“NuclearReactorSafety:OntheHistory

oftheRegulatoryProcess,”byDavid

Okrent, 1981, pp. 99-101.

9. DavidOkrent,“NuclearReactorSafety:

OntheHistoryoftheRegulatoryProcess,”

The University of Wisconsin Press,

Madison, Wisconsin, 1981, pp. 112-121.

10. JohnMay,“TheGreenpeaceBookofthe

Nuclear Age: The Hidden History, The

HumanCost,”Greenpeace

Communications Ltd., London, 1989.

11. Eric S. Beckjord, U.S. Nuclear Regulatory

Commission Memorandum, February 28,

1992.

12. U.S. Atomic Energy Commission,

"Proposed General Design Criteria for

Construction Permits for Nuclear Power

Plants," Federal Register, November 22,

1965.

13. U.S. Atomic Energy Commission,

“ProposedGeneralDesignCriteriafor

NuclearPowerPlants,”Federal Register,

July 10, 1967.

14. U. S. Code of Federal Regulations,

“General Design Criteria for Nuclear

PowerPlants,”Title10,Part50,Appendix

A, Federal Register, February 19, 1971.

15. U.S.AtomicEnergyCommission,“Net

Positive Suction Head for Emergency Core

CoolingContainmentHeatRemoval,”

Safety Guide 1.1, November 1970.

16. American National Standards Institute,

“QualityAssuranceProgram

RequirementsforNuclearPowerPlants,”

ANSI N45.2.

References for Section 1.3
Reactor Safety Course (R-800) 1.3 1966-1974 Emphasis on Prevention, Public Debate

USNRC Technical Training Center 1.3-18 NUREG/CR-6042 Rev. 2

17. U.S. Nuclear Regulatory Commission,

“GuidelinesforFireProtectionforNuclear

PowerPlants,”AuxiliaryPower

Conversion Systems Branch Technical

Position 9.5-1, 1975.

18. U.S. Nuclear Regulatory Commission,

“FireProtectionGuidelinesforNuclear

PowerPlants,”RegulatoryGuide1.120,

draft for comment, June 1976.

19. U. S. Code of Federal Regulations, “Fire

Protection Program for Nuclear Power

Plants Operating Prior to January 1,

1979,”Title10,Part50,AppendixR.

20. U.S. Nuclear Regulatory Commission,

“Motor-OperatedValveCommonMode

Failures During Plant Transients Due to

ImproperSwitchSettings,”Inspection

Enforcement (IE) Bulletin No. 85-03,

1985.

21. Judge J. Skelly Wright, Calvert Cliffs

decision, US Court of Appeals for the

District of Columbia (July 23, 1971),

notedin“AnOutlineHistoryofNuclear

RegulationandLicensing1946-1979,”

by George T. Mazuzan and Roger R.

Trask, 1979, p. 68.

22. James R. Schlesinger, speech delivered

to industry groups in Bal Harbour,

Florida,October20,1971,citedin“A

Short History of the Regulatory Process

1946-1990,”byJ.SamuelWalker,1991,

p. 34.

23. U. S. Code of Federal Regulations,

“Licensing and Regulatory Policy and

Procedures for Environmental

Protection,”Title10,Part51.

24. George T. Mazuzan and Roger R. Trask,

“AnOutlineHistoryofNuclear

RegulationandLicensing1946-1979,”

Historical Office, Office of the

Secretary, U.S. Nuclear Regulatory

Commission, 1979, p. 71.

25. U.S. Code of Federal Regulations,

“Acceptance Criteria for Emergency

Core Cooling Systems for Light Water

CooledNuclearPowerReactors,”Title

10, Part 51.46.

26. U. S. Code of Federal Regulations,

“Emergency Core Cooling Systems;

RevisionstoAcceptanceCriteria,”Title

10, Part 50.46.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-2 NUREG/CR-6042 Rev. 2

1.4 Design Basis Perspectives

1.4.1 S a f e t y A n a l y s i s R e p o r t

Requirements

As discussed in Section 1.2.2, the initial

applications to build commercial nuclear

power plants were received and reviewed by

the AEC in 1955 and 1956. Title 10 Part

50, Domestic Licensing of Production and

Utilization Facilities, was added to the Code

of Federal Regulations in January 1956.

From the outset, the preliminary and final

safety analysis reports were the main

documents reviewed by the AEC (and later

the NRC) in deciding whether to grant

construction permits and operating licenses.

Requirements regarding the submittal and

content of safety analysis reports were first

issued as 10 CFR 50 Section 50.34 in

December of 1970.1 Additional guidance

was later provided in Regulatory Guide 1.70,

"Standard Format and Content of Safety

Analysis Reports for Nuclear Power Plants."2

Table 1.4-1, which is based on this

Regulatory Guide, indicates the major topics

treated in the safety analysis reports. The

NRC reviews safety analysis reports to

determine whether plants can be built and

operated without undue risk to the health

and safety of the public. Guidelines for the

NRC review are contained in NUREG-0800,

"Standard Review Plan for the Review of

Safety Analysis Reports for Nuclear Power

Plants."3 The NRC findings are documented

in a separate Safety Evaluation Report.

Chapter2ofanapplicant’sSafetyAnalysis

Report provides information on the geology,

seismology, hydrology, and meteorology of

the site and vicinity. It also provides

information regarding nearby industrial,

military, and transportation facilities. Based

on this information, design criteria are

established for the magnitude of external

phenomena such as floods, earthquakes,

winds, tornadoes, and tsunami, which the

plant must be capable of withstanding. The

seismic design basis is discussed further in

subsection 1.4.4.

Table 1.4-2 is a list of potential accidentinitiating events (initiators) that applicants

are requested to address in Chapter 15 of the

Safety Analysis Report. Regulatory Guide

1.70 asks that the potential causes of each of

these initiators be identified and that the

estimated frequency of occurrence of each

initiator be assigned to one of the following

categories:

a. Incidents of moderate frequency

(expected to occur several times

during the plant lifetime).

b. Infrequent events (may occur during

the lifetime of the plant).

c. Limiting faults (not expected to occur

but postulated because of the

potential for the release of significant

amounts of radioactive material).

For each of the eight initiator groups listed

in Table 1.4-2, the potential exists for the

release of radionuclides from successive

barriers (fuel, cladding, reactor coolant

pressure boundary, and containment) to the

environment. The plant must be designed to

limit such releases such that offsite doses

would not exceed the guidelines of 10 CFR

Part 100 as a result of any accident in a set

of design-basis accidents.4 Conversely, a

design-basis accident (DBA) is a postulated

set of failure events that a facility is

designed and built to withstand without

exceeding the offsite exposure guidelines of

the NRC's siting regulation (10 CFR 100).
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-3 NUREG/CR-6042 Rev. 2

The assumptions used to delineate and

analyze DBAs are based on NRC regulations

and guidelines that evolved as numerous

applications for construction permits and

operating licenses were reviewed. Some

DBAs are analyzed in detail in the Safety

Analysis Report in order to (a) bound the

offsite doses for DBAs in each of the eight

initiation categories of Table 1.4-2, and (b)

demonstrate the adequacy of key engineered

safety features, in particular, the emergency

core cooling system and containment. Each

of the analyzed DBAs invariably postulates

at least one significant failure of a

component (or operator) to perform an

intended safety function. Generally,

equipment failures beyond those consistent

with loss of electric power and single failure

criteria of 10 CFR 50, Appendix A (see

Section 1.3.4) are not postulated for DBAs.

An exception arises when anticipated

transients without scram (initiating event

group 8 in Table 1.4-2) are treated as DBAs.

Anticipated transients without scram are

discussed separately in Sections 2.4, 2.5 and

Appendix 2B.

1.4.2 Siting-Basis Accident

The siting-basis accident is the DBA that

results in the greatest calculated offsite

doses. For U.S. light water reactors the

siting-basis accident is generally a large

pipe-break LOCA. Large pipe-break LOCAs

are postulated as DBAs in spite of extensive

design, construction, testing, inspection,

operations, and maintenance measures taken

to prevent them. In design-basis LOCAs, a

coincident loss of offsite power is postulated

and the single-failure criterion is then

applied, which usually leads to the

assumption that one of the emergency diesel

generators fails to start. This implies the

loss of one out of two AC-powered trains in

various safety systems.

A spectrum of break locations and sizes is

considered, including hypothetical severance

of the largest pipe in the reactor coolant

system in such a way that reactor coolant

would discharge unimpeded from both ends

of the severed pipe. This type of break is

referred to as a "double-ended guillotine

break."

Because the reactor coolant system operates

under high pressure, a reactor coolant pipe

break would result in rapid expulsion of a

large fraction of the reactor coolant into

containment. Some of the steam resulting

from this expulsion would pressurize the

containment; the rest would be condensed on

structures or by engineered safety features.

In PWR containments, cold water sprays

and/or ice racks are provided to condense

steam blowdown. In BWR containments,

steam would be condensed in the water-filled

pressure-suppression pool. Condensing the

steam limits containment pressure, which is

the driving force for outward leakage. At

the end of the blowdown (expulsion) period,

the primary system would be filled mostly

with saturated steam at the same pressure as

that in the containment. In fact, a designbasis large-break LOCA or main steam line

break usually establishes the peak internal

pressure that the containment is designed to

accommodate.

In a large-break LOCA, the reactor would

immediately go subcritical due to the loss of

reactor coolant (neutron moderation).

Successful actuation of the reactor protection

system would keep the reactor subcritical

when reflooded with emergency coolant.

However, there would still be considerable
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-4 NUREG/CR-6042 Rev. 2

thermal energy generated in the fuel from the

decay of radioactive fission products.

Immediately after shutdown, the generation

rate of this "decay heat" is about 7% of the

thermal power during operation. For

example, a 1000 MWe nuclear plant

generates about 3100 MWt during full power

operation but still generates about 225 MWt

immediately after shutdown. The decay heat

generation rate decreases fairly rapidly as

indicated in Figure 1.4-1. However, if

emergency cooling water were not supplied

to remove heat from the core following the

pipe break, core temperatures would increase

to the point where an energetic chemical

reaction would occur between hot cladding

and residual water-steam in the reactor

pressure vessel. Given a prolonged failure

to cool the core, large quantities of hydrogen

would be generated, portions of the core

would melt, and fission products would be

released to containment and possibly to the

environment. Such severe accident

phenomena are discussed in more detail in

subsequent chapters.

The emergency core cooling system (ECCS)

is designed to limit the extent of core

damage in postulated design-basis LOCAs.

An automatic control system senses the

occurrence of a LOCA and coordinates the

operation of the different parts of the ECCS

as they are needed. The function of the

ECCS is to supply water to the core (via

spray and/or flooding systems) to cool and

limit the temperature increase of the

cladding, thus preventing significant core

damage and release of radionuclides from

the fuel rods.

In determining the acceptability of an

ECCS, the NRC reviews design-basis LOCA

calculations performed by the applicant, and

compares the results to the ECCS acceptance

criteria specified in 10 CFR 50.46 (see

Section 1.3.6).5 The quantitative ECCS

acceptance criteria (e.g., the cladding

temperature shall not exceed 2200?F) do not

represent threshold levels. That is,

exceeding a quantitative acceptance

criterion would not result in an immediate

public safety problem. What the success

criteria do represent is "a conservative

statement of conditions which, if generally

met, will provide a high degree of

confidence that public safety is protected

even if a highly unlikely LOCA occurs."6

1.4.3 Realism of Design-Basis Accident

Analyses

Table 1.4-3 compares realistic assumptions

for large-break LOCAs to corresponding

assumptions postulated in design-basis

analyses. As indicated, the assumptions

postulated in design-basis analyses are

generally conservative. To illustrate, a

typical calculation of peak cladding

temperature based on the conservative

assumptions of 10 CFR 50 Appendix K is

provided in Figure 1.4-2. As indicated in

Table 1.4-3, decay heat is conservatively

assumed to be 20% above best-estimate

values in Appendix K calculations. Figure

1.4-2 illustrates that relaxing this

conservatism alone can reduce the predicted

peak cladding temperature by several

hundred degrees.7

In September 1988, 10 CFR 50.46 was

modified to allow more realistic calculations

to be used in estimating peak cladding

temperatures. The new requirements, while

less stringent, required that uncertainties in

the calculations be considered and that the

models provide:
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-5 NUREG/CR-6042 Rev. 2

"assurance of a high level of probability

that the performance criteria of 50.46(b)

would not be exceeded."

Traditional offsite dose analyses for

design-basis LOCAs postulate releases of

radioactive fission products from the reactor

fuel to the containment (and thus available

for leakage to the environment) that are

worse than actually expected given that the

ECCS acceptance criteria must be met. NRC

Regulatory Guides 1.3 and 1.4 (for BWRs

and PWRs respectively) recommend the

assumption that 25% of the radioactive

iodine inventory developed from full-power

operation of the core be immediately

available for leakage from containment.8,9 A

release to containment of this magnitude

could only occur if the ECCS failed, thereby

permitting significant core melting.

One of the most significant barriers to

accidental releases of fission products from

a nuclear power plant is the containment.

The containment is designed to have a very

low leakage rate when subjected to the

maximum internal pressures predicted for

design-basis accidents. The internal pressure

following a pipe break inside containment

peaks and then begins to decrease rapidly

when the rate of energy addition to the

containment atmosphere by blowdown falls

below the rate of energy removal by internal

structures, containment sprays, fan coolers,

ice beds, or suppression pools. For accident

calculations, however, the containment is

conservatively (as if the pressure did not

decrease) assumed to leak at a constant rate

called the design-basis leak rate for the first

24 hours and at 50% of that rate for the

remaining duration of the accident.

DBA analyses take into account the

reduction in the amount of radioactive

material available for leakage to the

environment by engineered safety features

such as containment sprays and recirculating

filtration systems. The amount of cleanup is

evaluated for each system using conservative

assumptions for parameters such as

adsorption and filtration efficiencies.

In DBA analyses, radiation doses at the

exclusion-area and low-population-zone

boundaries are calculated assuming that the

accident occurs when meteorological

conditions are worse (from the standpoint of

calculated doses) than those that would be

expected to prevail at the site approximately

95% of the time (Regulatory Guides 1.3 and

1.4). Table 1.4-4 presents typical

conservative estimates of offsite doses for

several DBAs. Even with the very

conservative assumptions employed, the

calculated doses that a person out-of-doors

in the vicinity of the plant might receive for

the entire course of a design basis accident

are usually well below the 10 CFR Part 100

guidelines.

The radiological consequences that might

realistically result from nuclear power plant

accidents have been explored in connection

with environmental evaluations. Table 1.4-5

presents some realistic dose estimates

obtained for typical PWR events and

accidents. Note that the realistic exclusion

radius dose for a large LOCA in which

ECCS acceptance criteria are met is over

two orders of magnitude less than the

corresponding conservatively calculated

dose estimate in Table 1.4-4.6 Realistically,

meeting the ECCS acceptance criteria would

prevent the core from melting, and far less

than 25% of the radioactive iodine inventory

would escape from the fuel to the reactor

containment.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-6 NUREG/CR-6042 Rev. 2

In summary, conservative estimates of DBA

radiation doses to the public are below

10 CFR Part 100 guidelines, and realistic

estimates of DBA doses are much lower.

This is not to say that accidents resulting in

doses exceeding Part 100 guidelines are

impossible; however, such accidents would

have to involve initiating events,

phenomena, component failures, or operator

errors not postulated for DBAs in order to

cause

a. ECCS failure leading to core melting

and the release of significant

quantities of radionuclides from the

fuel to containment, and

b. breach or bypass of containment

leading to the release of

s i g n i f i c a n t q u a n t i t i e s o f

radionuclides to the environment.

To illustrate, some events and phenomena

that are not considered in design-basis

LOCA analyses include: reactor pressure

vessel rupture as an initiator or as a result of

pressurized thermal shock (Section 1.3.1);

dynamic effects (e.g., pipe whip, jet

impingement, and asymmetric loads on

reactor vessel internals) exempted with NRC

approval as permitted under GDC-4 (Section

1.3.4.2); delayed versus prompt loss of

offsite power; multiple failures leading to

total loss of AC power; failure of the

containment isolation system; and pipe

breaks resulting in containment bypass. To

assess the likelihood and consequences of

such events and phenomena both

deterministic and probabilistic analyses may

be performed (see Sections 1.5 and 2.5); but

such analyses are not required in the

licensee's Safety Analysis Report.

1.4.4 Seismic Design Basis

Design basis events are postulated in each

safety analysis report for external events

such as earthquakes, tornados, floods,

accidents at nearby industrial facilities, etc.

The approach to designing against many

potential ex-plant (external) accident

initiators can be illustrated by considering

the seismic design basis.

The severity of seismic events is usually

referenced on one of two scales. Historical

o b s e r v a t i o n s r e ga r d i n g e a r t h q u a k e

magnitudes are categorized according to the

Modified Mercalli Intensity scale, which

indicates damage done on a scale from 1

(not felt) to 12 (nearly total damage) as

indicated in Table 1.4-6. The Mercalli

categories are also referenced to the

maximum acceleration in units of standard

gravitational force (g). Measurements of

energy releases in earthquake, which

generally date from the 1930s, are based on

the logarithmic Richter scale. A rough

comparison of the two scales is provided

Table 1.4-6; however, because the amount of

damage for a given seismic energy release

depends on soil characteristics, the nature of

the underlying bedrock, and the type of

b u i l d i n g c o n s t r u c t i o n , a n e x a c t

correspondence between the Mercalli and

Richter scales does not exist.

Postulated earthquake magnitudes for a given

site are derived from knowledge of

proximity to known active faults and historic

earthquake activity. Figure 1.4-3 shows a

map of seismic activity for the contiguous

United States. The relationship of the four

zone designations to the Mercalli intensities

is indicated.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-7 NUREG/CR-6042 Rev. 2

Seismic safety considerations were largely

overlooked for the first several power

reactors, which were built east of the Rocky

Mountains. Then, in the period 1963-1965,

reactors were proposed for sites near Bodega

Bay, San Onofre, and Malibu, California.

During the AEC and ACRS review of these

sites, seismic concerns were raised.10 The

originally proposed requirements for seismic

design were made two or three times more

stringent. Even so, the Bodega Bay and

Malibu sites were rejected due to seismic

concerns.

In 1965, the AEC regulatory staff initiated

work with its consultants to develop more

specific seismic engineering criteria. In

May 1967 the AEC sent a draft document

entitled "Seismic and Geologic Siting

Criteria for Nuclear Power Plants" to the

ACRS for review and comment. Ultimately

this draft evolved into Appendix A to 10

CFR Part 100.11

The draft and subsequent revisions reflected

the traditional philosophy that nuclear power

plants should be designed against two levels

of potential seismic events. Nuclear power

plants are designed to continue to operate

given earthquakes of moderate intensity and

to safely withstand the effects of larger

earthquakes.

The operating basis earthquake (OBE)

establishes the vibratory ground motion for

which the plant is designed to continue

operating without undue risk to the health

and safety of the public. Nuclear power

plants have instruments to warn of and

measure earthquake motion. At the first

indication of an earthquake, the operator is

alerted. If the earthquake does not exceed

the magnitude of the OBE, the plant can be

kept on line to provide needed electrical

power, and no inspection or evaluation of

the plant would be required after the event.

If the earthquake exceeds the magnitude of

the OBE, the plant must be shut down and

can not be restarted until inspections and

evaluations confirmed that it would be safe

to do so.

The safe shutdown earthquake (SSE)

establishes the maximum vibratory ground

motion for which plant safety features are

designed to remain functional. At this level

other plant features might be damaged, but

the plant could be safely shut down. Plant

features (including foundations and supports)

that are designed to remain functional

following a SSE are designated Seismic

Category I.12 These features include those

that are necessary to assure:

1. The integrity of the RCS pressure

boundary,

2. the capability to shut down the

reactor and maintain it in a safe

condition, or

3. the capability to prevent or

mitigate the consequences of

accidents that could result in

potential offsite exposures

comparable to the guideline

exposures of 10 CFR Part 100.11

By a combination of structural analysis and

testing, plant structures and equipment

important to safety are built to survive the

SSE. Seismic analyses of structures,

systems, and components are discussed in

Safety Analysis Report Sections 3.7 and 3.8,

and guidance regarding such analyses is

provided in the corresponding Standard

Review Plan sections and references. In

these seismic analyses conservative
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-8 NUREG/CR-6042 Rev. 2

assumptions permit all vibratory parameters

to be determined from the peak value of the

horizontal ground acceleration caused by the

earthquake such as 0.3 g (30% of the

gravitational acceleration). Vibration tests

are conducted to confirm key analyses. Such

tests are often done on the first models of

individual components including piping, fuel

elements, pressure vessels, pumps, and

valves and on full-scale reactor structures.

Whole reactor buildings have been tested

using mechanical shakers attached to the

structure, and high explosives have been

detonated nearby to simulate strong

earthquakes.

Several items included in or omitted from

the 1967 draft seismic criteria sparked

considerable debate. One item, the proposed

minimum design basis (or floor) of 0.1 g for

the SSE, was particularly controversial. Not

until November 1971, after many major redrafts, did the AEC issue a Notice of

Proposed Rule-Making to amend the 10 CFR

Part 100 by adding Appendix A: "Seismic

and Geologic Siting Criteria for Nuclear

Power Plants."10 The criteria were adopted

in 1973 and reflected the practice which had

been followed in actual construction permit

reviews. Guidance was provided regarding

the general extent of the geologic and

seismic investigation required; however, no

clear method was provided for selecting the

SSE based on the results of such

investigations.

The limited seismic audit performed on two

reactors for the 1975 Reactor Safety Study

(see Section 1.3) identified several errors

and deviances in seismic design. In 1977

the Nuclear Regulatory Commission initiated

a major new research program in seismic

safety including the application of

probabilistic techniques (see subsection

2.2.2). In 1978 and 1979, based on new

analyses of existing seismic data, the NRC

required reevaluation of the seismic design

bases for several reactors constructed by the

Tennessee Valley Authority. In early 1979,

five operating reactors were shut down for

an extended period by the NRC in order to

permit re-analysis and possible modifications

because errors had been made in the seismic

design of important piping systems. A large

number of other reactors have since reported

errors in their seismic design, and the

adequacy of detailed seismic design has

received considerable NRC attention.

Appendix A to 10 CFR Part 100 requires

that the maximum vibratory ground motion

of the OBE be one-half that of the SSE. It

further requires suitable dynamic analyses or

qualification tests to demonstrate that

structures, systems, and components

necessary for continued safe operation are

capable of withstanding the effects of the

OBE. In some cases (e.g., piping) this has

caused the OBE requirements to have more

design significance than the SSE. The NRC

has agreed that the OBE should not control

the design of safety systems. In 1996,

Appendix S to the 10 CFR 50 requirement

was modified in the OBE by allowing the

OBE ground motion for new plant designs to

be set in either of two ways:13

a. one-third or less of the SSE

ground motion, in which case

OBE requirements can be

satisfied without an explicit

response or design analyses being

performed, or

b. a value greater than one-third of

the SSE ground motion, in which

case analysis and design are

required.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-9 NUREG/CR-6042 Rev. 2

In either case, the plant must still be shut

down for inspection if the OBE is exceeded.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-10 NUREG/CR-6042 Rev. 2

Table 1.4-1 Chapter titles from Regulatory Guide 1.70 Revision 3

standard format and content of Safety Analysis Reports

for nuclear power plants

Chapter 1 Introduction and General Description of Plant

Chapter 2 Site Characteristics

Chapter 3 Design of Structures, Components, Equipment, and Systems

Chapter 4 Reactor

Chapter 5 Reactor Coolant System and Connected Systems

Chapter 6 Engineered Safety Features

Chapter 7 Instrumentation and Controls

Chapter 8 Electric Power

Chapter 9 Auxiliary Systems

Chapter 10 Steam and Power Conversion System

Chapter 11 Radioactive Waste Management

Chapter 12 Radiation Protection

Chapter 13 Conduct of Operations

Chapter 14 Initial Test Program

Chapter 15 Accident Analysis

Chapter 16 Technical Specifications

Chapter 17 Quality Assurance
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-11 NUREG/CR-6042 Rev. 2

Table 1.4-2 Representative initiating events to be analyzed in

Section 15.X.X of the Safety Analysis Report

1. Increase in Heat Removal by the Secondary System

1.1 Feedwater system malfunctions that result in a decrease in feedwater temperature.

1.2 Feedwater system malfunctions that result in an increase in feedwater flow.

1.3 Steam pressure regulator malfunction or failure that results in increasing steam

flow.

1.4 Inadvertent opening of a steam generator relief or safety valve.

1.5 Spectrum of steam system piping failures inside and outside of containment in a

PWR.

2. Decrease in Heat Removal by the Secondary System

2.1 Steam pressures regulator malfunction or failure that results in decreasing steam

flow.

2.2 Loss of external electric load.

2.3 Turbine trip (stop valve closure).

2.4 Inadvertent closure of main steam isolation valves.

2.5 Loss of condenser vacuum.

2.6 Coincident loss of onsite and external (offsite) A.C. power to the station.

2.7 Loss of normal feedwater flow.

2.8 Feedwater piping break.

3. Decrease in Reactor Coolant System Flow Rate

3.1 Single and multiple reactor coolant pump trips.

3.2 BWR recirculation loop controller malfunctions that result in decreasing flow rate.

3.3 Reactor coolant pump shaft seizure.

3.4 Reactor coolant pump shaft break.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-12 NUREG/CR-6042 Rev. 2

Table 1.4-2 Representative initiating events to be analyzed in

Section 15.X.X of the Safety Analysis Report (Cont.)

4. Reactivity and Power Distribution Anomalies

4.1 Uncontrolled control rod assembly withdraws from a subcritical or low power

startup condition (assuming the most unfavorable reactivity conditions of the core

and reactor coolant system), including control rod or temporary control device

removal error during refueling.

4.2 Uncontrolled control rod assembly withdraws at the particular power level

(assuming the most unfavorable reactivity conditions of the core and reactor

coolant system) that yields the most severe results (low power to full power).

4.3 Control rod maloperation (system malfunction or operator error), including

maloperation of partial length control rods.

4.4 Startup of an inactive reactor coolant loop or recirculating loop at an incorrect

temperature.

4.5 A malfunction or failure of the flow controller in BWR loop that results in an

increased reactor coolant flow rate.

4.6 Chemical and volume control system malfunction that results in a decrease in the

boron concentration in the reactor coolant of a PWR.

4.7 Inadvertent loading and operation of a fuel assembly in an improper position.

4.8 Spectrum of rod ejection accidents in a PWR.

4.9 Spectrum of rod drop accidents in a BWR.

5. Increase in Reactor Coolant Inventory

5.1 Inadvertent operation of ECCS during power operation.

5.2 Chemical and volume control system malfunction (or operator error) that increases

reactor coolant inventory.

5.3. A number of BWR transients, including items 2.1 through 2.6 and item 1.2.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-13 NUREG/CR-6042 Rev. 2

Table 1.4-2 Representative initiating events to be analyzed in

Section 15.X.X of the Safety Analysis Report (Cont.)

6. Decrease in Reactor Coolant Inventory

6.1 Inadvertent opening of a pressurizer safety or relief valve in a PWR or a safety or

relief valve in a BWR.

6.2 Break in instrument line or other lines from reactor coolant pressure boundary that

penetrate containment.

6.3 Steam generator tube failure.

6.4 Spectrum of BWR steam system piping failures outside of containment.

6.5 Loss-of-coolant accidents resulting from the spectrum of postulated piping breaks

within the reactor coolant pressure boundary, including steam line breaks inside

of containment in a BWR.

6.6 A number of BWR transients, including items 2.7, 2.8, and 1.3.

7. Radioactive Release from a Subsystem or Component

7.1 Radioactive gas waste system leak or failure.

7.2 Radioactive liquid waste system leak or failure.

7.3 Postulated radioactive releases due to liquid tank failures.

7.4 Design basis fuel handling accidents in the containment and spent fuel storage

buildings.

7.5 Spent fuel cask drop accidents.

8. Anticipated Transients Without SCRAM

8.1 Inadvertent control rod withdrawal.

8.2 Loss of feedwater.

8.3 Loss of AC power.

8.4 Loss of electrical load.

8.5 Loss of condenser vacuum.

8.6 Turbine trip.

8.7 Closure of main steam line isolation valves.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-14 NUREG/CR-6042 Rev. 2

Table 1.4-3 Partial comparison of realistic assumptions with

conservative assumptions of design-basis LOCA

calculations

Realistic Assumptions Conservative Assumptions

Accident Initiation

1. Crack in large pipe, rupture of smaller

pipe, or limited break in large pipe

resulting in shutdown and repair.

1. A spectrum of pipe breaks is analyzed

including instantaneous double-ended

breaks of any reactor coolant,

feedwater, or main steam line.

System/Component Reliability

1. Off site power is available.

2. All components of emergency AC, ECCS,

and containment ESFs function properly.

1. Off-site power is lost concurrent with

initiating event.

2. The worst single active failure is

postulated for each accident analyzed.

Reactor Power

1. The plant is operated at 100% power or

less.

2. Hottest region of core has expected

peaking factor.

3. Decay heat follows best estimate

prediction.

1. The plant is operated at 102% power

continuously.

2. Hottest region of core assumed to be at

the maximum allowable peaking factor

due to abnormal condition.

3. Decay heat is conservatively above

best estimate to account for

uncertainties in prediction.

ECCS and Containment ESFs

1. Break occurs in system such that some of

water from ECCS reaching broken loop is

effective.

2. ECCS pumps deliver at higher than

design flow rate.

1. For postulated PWR cold leg breaks all

ECC water directed to the broken loop

is diverted to containment until the

end of blowdown.

2. ECCS pumps deliver at design flow

rate or less.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-15 NUREG/CR-6042 Rev. 2

Table 1.4-3 Partial comparison of realistic assumptions with

conservative assumptions of design-basis LOCA

calculations (Cont.)

Realistic Assumptions Conservative Assumptions

ECCS and Containment ESFs (Continued)

3. Reactor coolant pumps continue to run.

4. Best estimate fluid discharge and heat

transfer correlations apply.

5. Fuel rods would have a distribution of

temperature.

6. Initial containment temperature and

ultimate heat sink temperature would be

nominal.

Consequence Calculations

1. At most radionuclides in reactor coolant

and gap activities in a few fuel rods

would be released to the containment.

2. Containment leakage would be some

nominal fraction of the design leak rate

even when the containment was at its

peak pressure.

3. Best-estimate atmospheric dispersion and

transport models apply.

4. Emergency planning would be

implemented to protect the surrounding

population from any radionuclides that

might be released to the environment.

3. Reactor coolant pumps are tripped and

coasting down or assumed to have a

locked impeller.

4. Conservative fluid discharge and heat

transfer correlations are used.

5. ECCS acceptance criteria apply to the

hottest single fuel rod.

6. Initial containment temperature and

ultimate heat sink temperature would

be at upper limits.

1. 100% of the noble gasses and 25% of

the core iodine inventory is

immediately released to containment.

[Reg. Guides 1.3 and 1.4]

2. Containment leaks at the rate

incorporated as a technical

specification requirement for the first

24 hours and at half this rate for the

remaining duration of the accident.

[Reg. Guides 1.3 and 1.4]

3. Conservative atmospheric dispersion

and transport models are used.

[Reg.Guides 1.3 and 1.4]

4. Doses are calculated for a hypothetical

person standing outside in the radioactive plume, for 2 hours at the

exclusion area boundary and during

the entire period of plume passage at

the low population zone outer

boundary. [10 CFR 100 (d)]
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-16 NUREG/CR-6042 Rev. 2

Table 1.4-4 Conservative offsite doses from design-basis accident

analyses*

Two Hour

Exclusion Boundary

(3200 feet or 975 meters)

Duration of

Accident

Low Population

Zone

(4 miles or 6.4 km)

Accident

Thyroid

(Rem)

Whole Body

(Rem)

Thyroid

(Rem)

Whole Body

(Rem)

Loss of Coolant 155 3 81 3

Control Rod Ejection <1 <1 <1 <1

Fuel Handling 2 2 <1 <1

Steam Line Break 16 1 3 1

10 CFR 100 Dose

Guideline

300 25 300 25

*From WASH-1250
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-17 NUREG/CR-6042 Rev. 2

Table 1.4-5 Realistic offsite doses due to releases at a typical PWR*

Event/Accident

Individual

Dose at

Exclusion

Radius

(rem/event)

Individual

Dose at

25 miles or

40 km

(rem/event)

Dose to

Population

Within

50 miles or

80 km

(rem/event)

10 gallons per day continuous leak

rate from sources outside

containment

5 × 10-6 1 × 10-8 2 × 10-2

Gases from inadvertent discharge of

part of boric acid condensate tank 5 × 10-9 1 × 10-112 × 10-5

Loss of load 2 × 10-8 4 × 10-118 × 10-5

Fuel handling accident inside

containment (3 days after

shutdown)

6 × 10-6 1 × 10-8 2 × 10-2

Fuel handling accident outside

containment

3 × 10-4 6 × 10-7 1 × 100

Large-break LOCA 8 × 10-3 2 × 10-5 3 × 101

* From WASH-1250. Doses are whole body doses. Natural background dose is

approximately 105person-rem/yr for the assumed population within the 50 mile

or 80 km radius of the nuclear plant (i.e., 750,000 to 1,000,000 people).
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-18 NUREG/CR-6042 Rev. 2

Table 1.4-6 Approximate Relationship between Modified Mercalli and

Richter Seismic Classifications

Modified

Mercali

intensity

scale Description of effects?

Maximum

acceleration (g)Richter

magnitude

Energy

release

(ergs)

I Not felt; marginal and long-period effects of large earthquakes evident

M2

M3

M4

M5

M6

M7

M8

M9

–—

–

–

–

–

–

–

–

–

–

–—

–

–

–

–

–

–

–

–

–—

–

–

–

–

–

–

–

–

–

–—

–

–

–

–

–

–

–

–

–

–—

–

–

–

–

–

–

–

–

–

–—

–

–

–

–

–

–

–

–

–

–—

–

–

–

–

–

–

–

–

–

–—

1014

1015

1016

1017

1018

1019

1020

1021

1022

1023

1024

II Felt by persons at rest, on upper floors, or favorably placed

III Felt indoors; hanging objects swing; vibration like passing of light trucks occurs;

duration estimated; might not be recognized as an earthquake

0.003 to

0.007

IV Hanging objects swing; vibration occurs that is like passing of heavy trucks, or there is

a sensation of a jolt like a heavy ball striking the walls; standing motor cars; rock;

windows, dishes and doors rattle, glasses clink; crockery clashes, in the upper range of

IV, wooden walls and frame creak

0.007 to

0.015

V Felt outdoors; duration estimated; sleepers waken; liquids become disturbed, some spill;

small unstable objects are displaced or upset; doors swing, close, and open shutters and

pictures move; pendulum clocks stop, start, and change rate

0.015 to

0.03

VI Felt by all; many are frightened and run outdoors; persons walk unsteadily, windows,

dishes, glassware break; knickknacks, books, etc., fall off shelves; pictures fall off

walls; furniture moves or overturns; weak plaster and masonry D crack; small bells ring

(church, school); trees, bushes shake

0.03 to

0.09

VII Difficult to stand; noticed by drivers of motor cars; hanging objects quiver,; furniture

breaks; damage occurs to masonry D, including cracks; weak chimneys beak at roof

line; plaster, loose bricks, stones, tiles, cornices fall; some cracks appear in masonry C;

waves appear on ponds, water turbid with mud; small slides and caveins occur along

sand or gravel banks; large bells ring

0.07 to

0.22

VIII Steering of motor cars affected; damage occurs to masonry C, with partial collapse;

some damage occurs to masonry B, but none to masonry A; stucco and some masonry

walls fall; twisting, fall of chimneys, factory stacks, monuments, towers, and elevated

tanks occur; frame houses move on foundations if not bolted down; loose panel walls

are thrown out; changes occur in flow or temperature of springs and wells; cracks

appear in wet ground and on steep slopes

0.15 to 0.3

IX General panic, masonry D is destroyed; masonry C is heavily damaged, sometimes with

complete collapse; masonry B is seriously damaged; general damage occurs to

foundations; frame structures shift off foundations, if not bolted; frames crack; serious

damage occurs to reservoirs; underground pipes break; conspicuous cracks appear in

ground, sand and mud ejected in alluviated areas; earthquake fountains and sand craters

occur

0.3 to 0.7

X Most masonry and frame structures are destroyed, with their foundations; some wellbuilt wooden structures and bridges are destroyed; serious damage occurs to dams,

dikes, and embankments; large landslides occur; water is thrown on bank of canals,

rivers, lakes, etc.; sand and mud shift horizontally on beaches and flat land; rails are

bent slightly

0.45 to 1.5

XI Rails are bent greatly; underground pipelines are completely out of service 0.5 to 3

XII Damage nearly total; large rock masses are displaced; lines of sight and level are

distorted; objects are thrown into air

0.5 to 7

?Masonry A: A good workmanship, mortar, and design; reinforced, especially laterally, and bound together by using steel, concrete, etc; designed to

resist lateral forces; Masonry B: Good workmanship and mortar: reinforced, but not designed in detail to resist lateral forces; Masonry C: Ordinary

workmanship and mortar; no extreme weaknesses like failing to tie in at corners, but neither reinforced nor designed against horizontal forces; Masonry D:

Weak materials, such as adobe; poor mortar; low standards of workmanship; weak horizontally.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-19 NUREG/CR-6042 Rev. 2

Time After Shutdown, , sec s

10-1 100 101 102 103 104 105 106 107 108 109

1 0

s1 0 0

s

1 0 0 0

s

1 2 h

0

s = 1m 10 m 1h 1d 1w 1M 1y

10-4

10-3

10-2

10-1

P s

/P 0 D i m e n s i o n l e s s

8

s = seconds

m = minutes

d = day

w = week

M = month

y = year

Figure 1.4-1 Ratio of power after to power before shutdown

(Ps/Po) for various operation times before shutdown
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-20 NUREG/CR-6042 Rev. 2

0 2 5 5 0 7 5 1 0 0 1 2 5 1 5 0 1 7 5 2 0 0

T im e A f te r B re a k (s )

0

5 0 0

1 0 0 0

1 5 0 0

2 0 0 0

2 5 0 0

Tempratu(F)

o

0

2 0 0

4 0 0

6 0 0

8 0 0

1 0 0 0

1 2 0 0

Tempratu(C)

o

A p p e n d ix K

R e a lis tic O x id a tio n

a n d D e c a y P o w e r

R e a lis tic

O x id a tio n

Figure 1.4-2 Effect of selected conservatisms on peak cladding temperature
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-21 NUREG/CR-6042 Rev. 2

Zone0–Nodamage

Zone1–Minordamage,intensitiesVandVIoftheModifiedMercalli scale

Zone2–Moderatedamage,intensityVIIoftheModifiedMercalli scale

Zone3–Majordamage,intensityVIIandhigheroftheModifiedMercalli scale

Figure 1.4-3Seismic Risk Map for the contiguous United States
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-22 NUREG/CR-6042 Rev. 2

References for Section 1.4

1. U.S. Code of Federal Regulations,

Title 10, Part 50.34, December

23, 1999.

2. U.S. Nuclear Regulatory

Commission Regulatory Guide 1.70,

Rev.3,“Standard Format and

Content of Safety Analysis Reports

for Nuclear PowerPlants”,

November 1978.

3. U. S. Nuclear Regulatory

Commission,“Standard Review Plan

for the Review of Safety Analysis

Reports for Nuclear PowerPlants,”

NUREG-0800, Rev. 2, July 1981.

4. U. S. Code of Federal Regulations,

Title 10, Part 100.11(a), Footnote

1, September 9, 1999.

5. U. S. Code of Federal Regulations,

Title 10, Part 50.46 (b), November

3, 1997.

6. U.S. Nuclear Regulatory

Commission,“TheSafetyofNuclear

Power Reactors (Light WaterCooled) and Related Facilities,”

WASH-1250, 1973, p. 5-8.

7. R. Steiger, Extended BE/EM Study,

Idaho National Engineering

Laboratory letter STIG-177-77

(1977), cited in B. E. Boyack, et.

al.,“Quantifying Reactor Safety

Margins,”Nuclear Engineering and

Design, 1991.

8. U.S. Atomic Energy Commission

RegulatoryGuide1.3,“Assumptions

Used for Evaluating the Potential

Radiological Consequences of a

Loss of Coolant Accident for Boiling

Water Reactors,”Revision 2, June

1974.

9. U.S. Atomic Energy Commission

RegulatoryGuide1.4,“Assumptions

Used for Evaluating the Potential

Radiological Consequences of a

Loss of Coolant Accident for

Pressurized Water Reactors,”

Revision 2, June 1974.

10. David Okrent,“NuclearReactor

Safety: On the History of the

Regulatory Process,”TheUniversity

of Wisconsin Press, Madison,

Wisconsin, 1981, Chapter 17.

11. U. S. Code of Federal Regulations,

Title 10, Part 100, Appendix A,

January 1, 1990.

12. U. S. Nuclear Regulatory

Commission, Regulatory Guide

1.29,“SeismicDesign

Classification,”Rev. 3, September

1978.

13. U. S. Code of Federal Regulations,

Draft Title 10, Part 50, Appendix

S, “Earthquake Engineering

Criteria for Nuclear PowerPlants,”

December 1996.
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-1 NUREG/CR-6042 Rev. 2

1.5 The Reactor Safety Study

1.5.1 Beyond-Design-Basis Accidents

The Reactor Safety Study was prompted in

part by a request from Senator John Pastore

for a comprehensive assessment of reactor

safety. The AEC's first response to this

request was the WASH-1250 report entitled

The Reactor Safety Study of Nuclear Power

Reactors (Light Water-Cooled) and Related

Facilities, which was published in final form

in July 1973.1 WASH-1250 provided factual

information regarding the conservatisms

applied in the design of nuclear power

plants. It did not, however, address the

likelihood or potential consequences of

beyond-design-basis accidents, which

involve more serious initiating events or

more failures following initiation than the

accidents analyzed in the Safety Analysis

Report. Beyond-design-basis accidents

include those initiated by reactor pressure

vessel rupture, those initiated by seismic

events more severe than the safe shutdown

earthquake, and those involving multiple

component failures or operator errors after

initiation, that is, failures beyond those

postulated under the single failure criteria.

Figure 1.5-1 illustrates a breakdown of

nuclear power plant accidents according to

their severity. Even though they were not

specifically designed to do so, given

appropriate operator responses, plant systems

(including non-safety-grade systems) are

capable of handling many beyonddesign-basis accidents. However, there are

beyond-design-basis accidents, such as

LOCAs in which emergency core cooling

systems fail to provide adequate flow, that

would lead to core damage. For some core

damage accidents, the extent of damage

would be minor (e.g., 10 CFR 50 Appendix

K cladding temperature limit exceeded for a

brief time period).3 However, a subset of

core damage accidents (e.g. accidents

involving a prolonged failure of core cooling

systems) would result in substantial core

damage. Such accidents are called severe

accidents (or Class 9 accidents);3that is, a

severe accident is a reactor accident more

severe than design-basis accidents in which,

as a minimum, substantial damage is done to

the reactor core.

As indicated in the Section 1.4, the

radionuclide releases from fuel assumed in

conservative design-basis LOCA analyses

could only be realized if significant core

melting occurred. Consequently, for a

severe accident in which containment

remained functional, the resulting offsite

doses would be comparable to those

conservatively calculated in the Safety

Analysis Report for design-basis LOCAs.

Yet the possibility remains of severe

accidents in which containment is either

bypassed or breached as a result of severe

accident phenomena. Depending on the

mechanism, location, and timing of

containment failure, and the meteorological

conditions, offsite doses could be

substantially (100 times) worse than

conservatively calculated for the design-basis

LOCA. That is, the accidents with the

greatest potential public consequences are

uncontained severe accidents.

In this light, several questions had to be

addressed in order to respond to Senator

Pastore's request for a comprehensive

assessment of reactor safety. What accidents

could result in significant core damage and

containment breach or bypass? How likely

are these accidents? What would be their

health and economic consequences? These

are fundamental questions that WASH-1250

did not address. Such questions are

addressed in probabilistic risk assessments,

but, at the time, relevant probabilistic

estimates were quite limited in scope and/or
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-2 NUREG/CR-6042 Rev. 2

highly subjective. For example, in a policy

paper (dated November 15, 1971) to the

commissioners proposing an approach to the

preparation of environmental reports, the

regulatory staff estimated that the probability

of accidents leading to substantial core

meltdown was 10-8 per reactor-year.

4

In

retrospect, this was a highly optimistic

estimate, but it typifies the degree to which

meltdown accidents were considered "not

credible."

1.5.2 The Study

In the summer of 1972 the AEC initiated a

major probabilistic study, the Reactor Safety

Study (RSS). Professor Norman C.

Rasmussen of the Massachusetts Institute of

Technology served (half-time) as the study

director. Saul Levine of the AEC served as

full-time staff director of the AEC

employees that performed the study with the

aid of many contractors and consultants.

The team attempted to make a realistic

estimate of the potential effects of light

water reactor accidents on the public health

and safety. One BWR, Peach Bottom

Unit 2, and one PWR, Surry Unit 1, were

analyzed in detail to estimate the likelihood

and consequences of potential accidents.

The team adapted methods previously used

by the Department of Defense and NASA to

predict the effect of failures of small

components in large, complex systems. The

overall methodology, which is still utilized,

is called probabilistic risk assessment (PRA).

A tutorial on PRA methods and terminology

is included as Appendix 2A.

The team first identified events that could

potentially lead to core damage. Event trees

were then used to delineate possible

sequences of successes or failures of systems

provided to prevent core meltdown and/or

the release of radionuclides. Fault trees

were used to estimate the probabilities of

system failures from available data on the

reliability of system components. Using

these techniques, thousands of possible core

melt accident sequences were assessed for

their occurrence probabilities. The public

health and economic consequences of the

identified severe accidents were estimated

using computational models that were

developed as part of the overall effort.

A draft Reactor Safety Study report,

WASH-1400, was issued by the AEC for

comment in August 1974. The draft drew

extensive comments from government,

industry, environmental groups, nuclear

critics, and the public. The final report,

WASH-1400 (NUREG-75/014), was issued

by the NRC in October 1975.5

1.5.3 Findings

The Reactor Safety Study indicated that risks

to the public from potential U.S. nuclear

power plant accidents were small compared

to other risks encountered in a complex

technological society. Other sources of risk

that were compared in the study included

fires, explosions, toxic chemical releases,

dam failures, airplane crashes, earthquakes,

tornadoes, and hurricanes. Figures 1.5-2 and

1.5-3 show these risk comparisons. These

figures are interpreted in the following

manner:

1. Pick a point on one of the curves.

2. The ordinate represents the

f r e q u e n c y w i t h w h i c h a

consequence greater than or equal

to the corresponding abscissa

value will occur.

For example, in Figure 1.5-2, the probability

of a nuclear power plant accident involving
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-3 NUREG/CR-6042 Rev. 2

1000 or more fatalities in any given year is

approximately 10-6.

In these figures, it is assumed that there are

100 power reactors and that they all have

risks equal to the average risks for Surry and

Peach Bottom. There is no evidence to

support this assumption; however, the other

98 reactors would have to be orders of

magnitude worse than Surry and Peach

Bottom for the general conclusions to be

rendered invalid. While the risks from

nuclear power appear to be very low, the

Reactor Safety Study did indicate that core

melt accidents were more likely than

previously thought (approximately 5×10

-5 per

reactor year for Surry and Peach Bottom),

and that light water reactor risks are mainly

attributable to core melt accidents. The

Reactor Safety Study also demonstrated the

wide variety of accident sequences (initiators

and ensuing equipment failures and/or

operator errors) that have the potential to

cause core melt. In particular, the report

indicated that, for the plants analyzed,

accidents initiated by transients or small

LOCAs were more likely to cause core melt

than the traditional design-basis LOCAs.

Finally, the Reactor Safety Study

investigations into containment failure

suggested that different containment types

(e.g., Mark I BWR versus subatmospheric)

may differ in their capability to withstand

core melt accidents (for which they were not

designed).

1.5.4 Impact

The preceding findings have withstood the

test of time; however, the Reactor Safety

Study received considerable, valid criticism.

In June 1977 the NRC appointed a Risk

Assessment Review Group (the Lewis

Committee, named after Harold Lewis,

Chairman of the American Physical Society's

Study Group on Light Water Reactors) to

review WASH-1400.6 The review group's

report to the Commission in September 1978

was highly critical:

We have found a number of sources

o f b o t h c o n s e r v a t i s m a n d

nonconservatism in the probability

calculations in WASH-1400, which

are very difficult to balance. Among

the former are an inability to quantify

human adaptability during the course

of an accident, and a pervasive

regulatory influence in the choice of

uncertain parameters, while among

the latter are nagging issues about

completeness, and an inadequate

treatment of common cause failure.

We are unable to define whether the

overall probability of a core melt

given in WASH-1400 is high or low,

but we are certain that the error

bands are understated. We cannot

say by how much. Reasons for this

include an inadequate data base, a

poor statistical treatment, an

i n c o n s i s t e n t p ro p a g a t i o n o f

u n c e r t a i n t i e s t h ro u g h o u t t h e

calculation, etc.

While the Lewis Committee was critical of

the quantitative results of WASH-1400, it

provided positive encouragement for future

use of the methods. The committee report

states,

We do find that the methodology,

which was an important advance over

earlier methodologies applied to

reactor risks, is sound, and should be

developed and used more widely

under circumstances in which there is

an adequate data base or sufficient

technical expertise to insert credible

subjective probabilities into the

calculations. ... Proper application

of the methodology can therefore
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-4 NUREG/CR-6042 Rev. 2

provide a tool for the NRC to make

the licensing and regulatory process

more rational, ...

The NRC commissioners, seeming not to

understand these conclusions, issued a

January 1979 policy statement that seemed

to discredit the entire Reactor Safety Study.

The statement a) withdrew any past

endorsement of the Executive Summary of

the report, b) agreed that the peer review

process for WASH-1400 was inadequate and

c ) a c c e p t e d t h e c o n c l u s i o n t h a t

WASH-1400's absolute values of risks

should not be used uncritically, and d)

agreed that the numerical estimate of the

overall risk of reactor accidents was

unreliable.7

In spite of recommendations by the Advisory

Committee on Reactor Safeguards and others

that severe accident research and Reactor

Safety Study methods be applied to improve

the safety of reactors in operation and under

construction, it was not until after the

accident at Three Mile Island that serious

efforts to address severe accident issues were

undertaken.
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-5 NUREG/CR-6042 Rev. 2

Figure 1.5-1 Breakdown of nuclear power plant accidents by severity
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-6 NUREG/CR-6042 Rev. 2

Figure 1.5-2 Frequency of man-caused events involving fatalities
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-7 NUREG/CR-6042 Rev. 2

Figure 1.5-3 Frequency of natural events involving fatalities
Reactor Safety Course (R-800) 1.5 The Reactor Safety Study

USNRC Technical Training Center 1.5-8 NUREG/CR-6042 Rev. 2

References for Section 1.5

1. U. S. Nuclear Regulatory Commission,

“TheSafetyofNuclearPower Reactors

(Light Water-Cooled) and related

Facilities,”WASH-1250.

2. U. S. Code of Federal Regulations, Title

10, Part 50, Appendix K, January 1,

1991.

3. U. S. Nuclear Regulatory Commission,

“NRC Policy on Future Reactor

Designs, Decisions on Severe Accident

Issues in Nuclear Power Plant

Regulation,”NUREG-1070,July1985.

4. U. S. Nuclear Regulatory Commission,

Regulatory Staff to Commissioners,

November 15, 1971, Policy Paper.

5. U. S. Nuclear Regulatory Commission,

“Reactor Safety Study: An Assessment

of Accident Risks in U.S. Commercial

Nuclear PowerPlants,”WASH-1400,

October 1975.

6. H. W. Lewis,etal.,“RiskAssessment

Review Group Report to the U.S.

Nuclear Regulatory Commission,”

NUREG/CR-0400, September 1978.

7. J. Samuel Walker,“AShortHistory of

Nuclear Regulation 1946-1990,”

Historical Office, Office of the

Secretar y, Nucle a r Regulatory

Commission, June 1991, p38.
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-1 NUREG/CR-6042 Rev. 2

1.6 Browns Ferry Fire

On March 22, 1975 a major fire occurred at

the Browns Ferry nuclear power plant, which

is located near Decatur, Alabama. The

Browns Ferry plant is owned by the

Tennessee Valley Authority (TVA). At the

time, it was the largest nuclear power plant

in the world, having three units with a

maximum design power output of

approximately 3195 MWe. Units 1 and 2

were operating at a combined level of 1100

MWe. Unit 3 was still under construction.

The Browns Ferry fire was a close call that

very nearly led to core damage. In searching

for air leaks in an area containing electrical

cablesthatsuppliedpowertotheplant’s

control room and safety systems, a

technician started the fire. He used a lighted

candle to conduct the search, and the open

flame ignited the insulation around the

cables. The fire burned for over seven hours

and nearly disabled the safety equipment of

one of the two affected units.

The fire caused an estimated damage of $10

million and resulted in two operating units

being incapacitated for over a year. As a

result of the shutdown of the two units,

additional costs of about $10 million were

incurred each month for replacement power.

The accident was a blow to the public image

of nuclear power and the recently established

NRC. It focused new attention on protecting

against fires that could threaten plant safety

and on the possibility of "common-mode

failures," in which a single breakdown could

initiate a chain of events that incapacitated

even redundant safety features.

The following subsections discuss the

initiation and progression of the Browns

Ferry fire and the lessons learned. Much of

the material is drawn from an article by R.

L. Scott that appeared in Nuclear Safety in

1976.1

1.6.1 Initiating Events

The fire was initiated by a small (3 in. to 4

in. or 7 to 10 cm) lit candle that was being

used to check for air leakage of the reactor

containment building (Figure 1.6-1). The

flame ignited some polyurethane used to seal

leakage paths, and the fire burned for 7

hours before being extinguished (Figure 1.6-

2). The reactor building is maintained at a

negative pressure with respect to the exterior

of the walls in order to ensure that any

airflow is always into the reactor building.

It was this design feature that aggravated the

fire. The purpose of maintaining a negative

pressure on the reactor building is to

continuously remove the air and pass it

through filters to remove any radioactivity

that might be present. However, in order for

radioactivity to be present in the reactor

building, it would first have to escape from

the primary containment or piping. Then,

any radioactivity that managed to get into

the reactor building would be removed by

the filters, with no effect or impact on public

health and welfare. The cable-tray

penetrations through the wall of the reactor

building are sealed to minimize inleakage,

thus maintaining an adequate negative

pressure in the reactor building. The

penetrations are filled with a polyurethane

foam to form the seal, and then a

flameproofing compound is applied 3 to 6

mm (~0.1 in.) thick over the foam and over

the cables on both sides of the penetration

for a distance of 30 cm (12 in.) to form a

fire barrier (Figure 1.6-3).

The penetration where the fire originated had

been disturbed at some time after the initial

installation, because holes had been punched

through the flameproofing and sealant to
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-2 NUREG/CR-6042 Rev. 2

provide openings for additional cables

through the penetration. The result was that

the polyurethane sealant was exposed.

Leakage tests had been performed previously

on the reactor building, and the results

indicated that inleakage should be reduced.

An extensive program was therefore under

way for resealing penetrations through the

wall of the reactor building.

The method used to check the effectiveness

of the sealing operation was to hold a lit

candle near the penetration opening. If the

opening was not fully sealed, the lower

pressure in the reactor building would cause

air to be pulled through the opening, giving

a good visual indication of leakage even

where the area was poorly lit. The use of an

open flame to test for air leakage in a

condenser vacuum was then a commonplace

practice for the utility industry.

On March 22, three teams, each consisting

of an engineering aide and an electrician,

were working in the cable-spreading room

testing and sealing penetrations. Work

proceeded during the day without incident

until about 12:15 p.m., when an engineering

aide observed a hole about 50 to 100 mm (2

to 4 in.) wide in a cable-tray penetration

through the wall. The hole was

approximately 20 in. or 0.5 m back into the

penetration from the face of the concrete

wall, and the entire penetration was

congested with cable trays, making the hole

difficult to reach (Figure 1.6-4). The

engineering aide passed a lit candle by the

hole, and the flame blew horizontally into

the hole, indicating a significant leakage

path into the reactor building. The aide had

difficulty reaching into the penetration, but

he tried to stuff two pieces of sheet

polyurethane foam into the hole. (This sheet

of polyurethane was not the same type as

that used originally for the sealant; this type

is far more flammable.) He then re-lit the

candle and re-checked the penetration. The

flame was again pulled horizontally,

indicating a large airflow and leakage path,

and apparently the foam ignited at this time

–12:20p.m. Theaideobservedalow red

glow and yelled "fire." His attempt to beat

the fire out with a flashlight was

unsuccessful. He then tried to smother the

fire with rags, but this also failed. He then

discharged a CO2fire extinguisher twice, but

the CO2 was pulled right through the hole

without putting the fire out. Two more drychemical fire extinguishers were discharged

into the hole, but each gave "only one good

puff" and the fire continued. The electrician

then called for someone to notify the reactor

operations shift engineer that there was a

fire in the cable-spreading room.

Meanwhile, the fire had moved deeper into

the hole because of the airflow and was now

also on the reactor-building side of the wall;

thus there were two fires to contend with --

one in the cable-spreading room and one in

the reactor building.

1.6.2 Cable-Spreading Room Fire

About 15 min. after the fire started (at

approx. 12:35 p.m.), a siren alarm sounded

to warn personnel in the cable-spreading

room to evacuate because the permanently

installed CO2 Cardox fire-extinguishing

system was to be actuated. This system

flushes the room with enough CO2to

displace most of the oxygen required for the

survival of the personnel. After the room

was evacuated, an assistant shift engineer

attempted to actuate the Cardox system at

the Unit 1 cable-spreading room control

station but found that the power had been

shut off at the disable switch at the Unit 2

entrance to the room. This isolation

procedure was a safety measure taken while

men were leak-testing the penetration. The

engineer then turned the power on at Unit 2,

apparently without success, after which he
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-3 NUREG/CR-6042 Rev. 2

attempted to use the manual crank system.

However, he found that a metal plate had

been installed under the breakout glass to

prevent inadvertent operation of the CO2

system. The actuation at Unit 2 appeared to

be unsuccessful because there was a 3-min.

delay from the time of actuation due to

travel time from central storage, but at about

12:40 p.m. the Cardox system began

discharging CO2for the first time.

Between 12:40 p.m. and 3:00 p.m., the

Cardox system was actuated two more times

as the fire fighting continued under the

direction of an assistant shift engineer. At

about 1:45 p.m., firemen from the Athens,

Alabama, Fire Department arrived and began

to assist in the fire-fighting efforts. At

about 2:00 p.m., the Fire Chief

recommended the use of water on the fire,

but the Plant Superintendent decided against

this because of the possibility of shorting

circuits, which could further degrade

conditions such that control of the shutdown

and cooling of the reactors would be more

difficult. Furthermore, the fire was

progressing slowly (0.8 in. to 1.2 in./min. or

2 to 3 cm/min.). The use of CO2 and dry

chemicals kept the fire suppressed, but, on

several occasions when the fire was reported

to be out, it flared up again because of the

high energy content in the cables. At 3:00

p.m., a shift engineer arrived at the site,

proceeded to the cable-spreading room, and

assumed charge of the fire fighting. The fire

in that room was finally reported to be

extinguished at about 4:20 p.m.

1.6.3 Reactor-Building Fire

The fire that started on the cable-spreading

room side of the penetration spread into the

reactor building because of the inward

airflow. Two construction workers in the

cable-spreading room, on seeing that the fire

was spreading into the reactor building, went

there to fight the fire. One of the workers

notified a TVA Public Safety Officer that

there was a fire in the reactor building. The

two workers were joined by a third, and all

three, equipped with dry-chemical fire

extinguishers, proceeded to the fire in the

reactor building. The fire was burning in

cable trays that were 20 ft. or 6.1 m above

the second floor of the reactor building. A

worker climbed a ladder placed next to the

fire and discharged a dry-chemical

extinguisher on the fire, but he was then

forced to leave because he could not breathe.

This dry-chemical application suppressed the

flames but not the temperature, and the fire

flared up again.

At about 12:34 p.m. the general fire alarm

was actuated. An assistant shift engineer

arrived, climbed the ladder, and discharged

a dry-chemical extinguisher on the fire, after

which he discharged a CO2 extinguisher on

the fire. He also experienced breathing

difficulty, and by this time smoke was

becoming so dense that a breathing apparatus

was requested. Until the apparatus arrived,

CO2 was applied to the cable trays from the

floor. When the apparatus (air packs)

arrived, fire fighting continued until

visibility became so poor that the workers

could not get near the fire.

The assistant shift engineer left the area and

called the Athens Fire Dept. at 1:09 p.m.

The fire truck arrived at 1:30 p.m., and, by

1:45 p.m., seven firemen had been admitted

to the plant and were prepared to assist in

fighting the fire but in support of, and under

the direction of, Browns Ferry personnel. It

has been stated that there appears to have

been no centrally organized direction of the

fire-fighting efforts in the reactor building

between approximately 1:00 p.m. and 4:20

p.m. However, it should be noted that the

ventilation system was lost at 12:45 p.m. and

was not reestablished until 4:00 p.m. The
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-4 NUREG/CR-6042 Rev. 2

consequence was excessive smoke, making

visibility poor and necessitating air-breathing

equipment. Also, lighting was lost in the

reactor building at about 1:30 p.m. In

addition, there was a shortage of airbreathing equipment, and the available

equipment was used by workers who were

manually aligning valves in an attempt to get

the reactor into a shutdown cooling mode.

Once the plant was depressurized and a

positive source of water was going into the

reactor, attention was focused on the fire in

the reactor building. At about 4:30 p.m. the

shift engineer who had directed the activities

in the cable-spreading room until that fire

was extinguished took charge of the firefighting activities in the reactor building.

Temporary DC lighting was set up both

inside and outside the reactor building, and

a routine of sending in two or three fire

fighters at a time to use dry chemicals on the

fire was established. At about 6:00 p.m. the

Athens Fire Chief again recommended the

use of water (his first recommendation was

at 2:00 p.m.). Water had not been used

because of the electrical shock hazard, and

the Plant Superintendent had not wanted to

de-energize the circuits because he felt some

of them were needed for controlling the

shutdown of the reactors.

At approximately 7:00 p.m. the Plant

Superintendent agreed to the use of water on

the fire, contrary to the recommendation of

the TVA Public Safety Officer, because the

reactors were in a more stable condition.

Another shift engineer took the fire hose,

climbed the scaffolding to the fire, and

sprayed water on the fire, using a water fogtype nozzle. He had difficulty breathing,

and so he jammed the nozzle of the hose

into the cable tray so that it would continue

spraying water on the fire area and then

climbed down and left the building. Later,

two shift engineers returned and sprayed the

area again. At 7:45 p.m. the fire was

declared to be out.

1.6.4 Fire Damage And Assessment

The fire-damaged areas of the cablespreading room and the reactor building are

shown in Figure 1.6-5. As indicated, the

damage in the cable-spreading room

extended only about 1.5 m (5 ft.) north of

the wall penetration. Most of the damage

occurred in the reactor building, extending

up to 11.4 m (37 ft.) from the wall

penetration. A total of 117 conduits, 26

cable trays, and 1611 cables were damaged.

In all, about 9300 conductors had to be

replaced or spliced. Of the 1611 cables

damaged, 628 were safety related.

At 4:00 p.m. on Saturday March 22, the

Atlanta Regional Office of the NRC Office

of Inspection and Enforcement was notified

of the fire, in accordance with requirements.

The Atlanta office immediately initiated an

investigation that ultimately required 280

man-days of effort. The detailed report was

given to TVA and made available to the

public on July 28, 1975, along with a Notice

of Violation of NRC requirements and a list

that identified areas of concern. It should be

noted that the Notice of Violation was

corrective rather than punitive; that is, the

aim was to correct deficiencies.

1.6.5 Effect of Fire on Unit 1

Since the control room for the reactor is

common to both Units 1 and 2, activity at

one unit could be observed by the operators

of both units. About 20 min. after the fire

started, the Unit 1 operator noted anomalous

behavior of controls and instrumentation for

systems designed to provide emergency

cooling of the reactor core. For the next

several minutes, a mounting number of

events occurred, such as the automatic

starting of pumps and equipment, which the
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-5 NUREG/CR-6042 Rev. 2

operator would shut down when he

determined that they were not needed, only

to have them automatically start again.

At 12:51 p.m. the reactor was scrammed,

shutting the reactor down. This stopped the

chain reaction and eliminated nuclear fission

as a direct source of heat; however, heat

generation in the core continued as a result

of radioactive decay of fission products in

the reactor fuel. It was this aspect that was

of major concern to the nuclear reactor

operators, because continuous cooling of the

fuel to remove this decay heat must be

provided to prevent damage to the fuel.

During the first few hours after shutdown,

the decay heat level can be 2 to 3% of the

heat output at full power, decreasing to 1%

after 1 day and declining very slowly

thereafter. Therefore the most urgent need

for cooling is during the first few hours after

the reactor is shut down.

About 4 min. after the reactor was shut

down, several electrical boards that supplied

control voltages and power to many of the

systems used in cooling the reactor after

shutdown were lost. Also, many of the

instruments and indicating lights were put

out. Shortly after 1:00 p.m. the main-steamisolation valves closed automatically,

causing several problems. First, the steam

generated by the decay heat could not be

passed to the condenser, thus eliminating

this method of removing the decay heat.

Second, the valve closure resulted in the loss

of steam that was driving the feedwater

pumps, thus eliminating another method of

providing high-pressure cooling water to the

core. Fire had also disabled the High

Pressure Coolant Injection and Reactor Core

Isolation Cooling systems. Even though a

control-rod-drive (CRD) system pump was

supplying flow at around 400 liters/min.

(105 gpm), the water level over the fuel

began to decrease because of boiling caused

by the decay heat. Condensate booster

pumps were operable, but these pumps can

only inject water into the pressure vessel at

pressures of 2.4 MPa (~ 350 psi) or less.

Given these conditions, the operator chose to

depressurize the reactor, which was 7.4 MPa

(1070 psi) at this time, by remote control of

the relief valves to permit the use the lowpressure systems that were still available.

The pressure-relief valves were manually

opened from the control room, and the steam

was transferred from the pressure vessel to

the pressure-suppression pool (still within

primary containment) and condensed. By

this method the pressure in the vessel was

reduced to about 1.8 MPa (260 psi) in 20

min.; the condensate booster pumps were

then used to maintain an adequate water

level in the reactor vessel. During the

depressurization period the water level in the

core decreased but did not drop below a

point 1.2 m (4 ft.) above the top of the fuel.

Normal level is 5.08 m (200 in.), but the 1.2

m (4 ft.) level is still 0.76 m (2.5 ft.) above

the level at which the core spray and

residual-heat-removal systems would be

actuated. Once the reactor pressure was

reduced below 2.4 MPa (350 psi), one

condensate booster pump and one condensate

pump provided adequate makeup water, and

the normal water level above the fuel was

attained.

This mode of core cooling was adequate

until about 6:00 p.m., when loss of control

air prevented further manual control of the

remaining (4 out of 11) operable pressurerelief valves. The valves closed, and

pressure in the vessel started building up

again. As pressure increased above 2.4 MPa

(350 psi), the condensate booster pumps

could no longer inject water into the vessel

and thus only the control-rod-drive-system

pump was adding water.
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-6 NUREG/CR-6042 Rev. 2

After the fire was declared out at 7:45 p.m.,

the smoke began to clear, and reliance on

breathing apparatus decreased so that a more

orderly approach to obtaining shutdown

cooling could be taken. The actual valve

conditions (opened or closed) were

determined, and control power to motor

operators, pump controls, etc., was

established using temporary jumpers.

After about 3 1/2 hours (at about 9:50 p.m.)

control of the relief valves was restored, the

reactor was depressurized, and the

condensate booster pump again pumped

water into the reactor. With low-pressure

operation now secured, adequate makeup

water could be supplied by one of the

condensate pumps. In addition, two

additional condensate booster pumps and two

additional condensate pumps were available

to the operator. Another alternative would

have been to use a nonstandard system

configuration and manual valve alignment.

Two residual-heat-removal-pumps in Unit 2

could have been aligned to the Unit 1 reactor

through a crosstie pipe, and, as an additional

backup, river water could have been used

from either of two available service-water

pumps. At 4:10 the next morning, normal

shutdown cooling was established.

A chart displaying equipment and system

availability is shown in Figure 1.6-6. It

should be pointed out that, with the reactor

at high pressure, there were other

alternatives for obtaining makeup water to

the reactor. A few examples of other

alternatives are listed below:

1. The Unit 2 CRD pump and a shared

spare CRD pump could have been

used in addition to the CRD pump on

Unit 1.

2. The standby liquid-control pumps

could have been made available by

performing a manual valve alignment,

actuating two valves, and manually

restoring power to the pumps.

3. The reactor core-isolation cooling

system (RCICS) could have been

made available by installing a special

short piece of pipe that was stored

nearby.

The point is that adequate cooling-water

makeup was provided throughout the

incident, and additional alternatives could

have been used to provide makeup water

with the reactor at either high or low

pressure.

1.6.6 Effect of Fire on Unit 2

The effect of the fire on Unit 2 was less

pronounced. A few minutes after Unit 1 was

shut down, abnormal events, such as

decreasing reactor power, sounding of many

alarms, and loss of some indicating lights,

began to occur in Unit 2. The operator shut

the reactor down at 1:00 p.m. About 3 min.

later the main-steam-line isolation valves

closed automatically and high-pressure

cooling systems were successfully initiated.

After depressurization, low-pressure pumps

were used to provide cooling. By 6:30 p.m.,

stable conditions were obtained, and normal

means for cooling the core were established

by 10:45 p.m.

1.6.7 Lessons Learned

The extent of damage caused by the fire is

attributable to the length of time the fire

burned. TVA's rationale for not using water

to suppress the fire earlier in the sequence of

events was stated as follows: "The Plant

Superintendent made the conscious decision

not to use water because of the possibility of

shorting circuits and further degradation of

the plant to a condition that would have been
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-7 NUREG/CR-6042 Rev. 2

more difficult to control. Reactor safety

concerns under the circumstances took

precedence over extinguishing a localized

fire." This position reflected a fairly

widespread reluctance on the part of

licensees at the time to use water on a fire

involving electrical cables. However, the

failures caused by the fire as it continued to

burn were largely responsible for the

difficulties encountered in bringing the plant

to a safe-stable state, and the fire was

extinguished rather quickly when water was

finally applied. Hence the main lesson

learned is that, if initial attempts to

extinguish a cable fire with nonwater means

are unsuccessful, water should be used.

The damage to electrical power and control

circuits resulted in the loss of redundant

subsystems and equipment. This was

surprising in view of the independence and

separation criteria that had been applied in

the design of the plant. The two principal

reasons for the failures were found to be:

(1) failure to recognize potential sources of

failure of safety equipment (i.e., the

interconnection of safety equipment and

nonsafety circuits such as the indicator-light

circuits); and (2) contrary to what had been

considered good practice, the conduit used to

isolate cables from their redundant

counterparts did not protect the cables

adequately.

Although damage inflicted by the fire

resulted in the loss of a number of systems,

in particular the emergency core-cooling

system, alternatives were available, and

adequate cooling was provided throughout

the event. In addition, other systems were

restored both during and after the fire, and

some equipment was restored by manual

operation -- especially valves using

handwheels. Therefore, loss of the

emergency core-cooling systems made the

situation more difficult, but not impossible

because of the numerous alternatives.
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-8 NUREG/CR-6042 Rev. 2

Figure 1.6-1 Vertical cross section of plant showing reactor building

control room and spreading room
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-9 NUREG/CR-6042 Rev. 2

Fig

u

r

e

1.6-2

T

h

e

B

r

o

w

n

s

F

e

r

r

y

n

u

cle

a

r

pla

nt
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-10 NUREG/CR-6042 Rev. 2

Figure 1.6-3 Cable-tray penetration, overall simplified depiction (not to scale)
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-11 NUREG/CR-6042 Rev. 2

Figure 1.6-4 Area where fire started
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-12 NUREG/CR-6042 Rev. 2

Figure 1.6-5 Fire-damaged area
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-13 NUREG/CR-6042 Rev. 2Figure 1.6-6 Equipment availability during and immediately following the March 22, 1975 fire
Reactor Safety Course (R-800) 1.6 Browns Ferry Fire

USNRC Technical Training Center 1.6-14 NUREG/CR-6042 Rev. 2

References for Section 1.6

1. R. L. Scott, "Browns Ferry Nuclear

Power Plant Fire on March 22, 1975"

Nuclear News, Volume 17, No. 5,

September-October 1976, p. 592.
Reactor Safety Course (R-800) 1.4 Design Basis Perspectives

USNRC Technical Training Center 1.4-23 NUREG/CR-6042 Rev. 2
Reactor Safety Course 2.0 Severe Accident Perspectives

USNRC Technical Training Center 2.0-1 NUREG/CR-6042 Rev. 2

2.0 Severe Accident Perspectives

2.0.1 Introduction

The basic safety philosophy followed by

both industry and the NRC in promoting the

safety of nuclear power plants is defense in

depth. As originally conceived (see Section

1.1.5) defense in depth referred primarily to

design and siting considerations included to

prevent accidents, contain radionuclides

should an accident occur, and keep the

public away from any radionuclides that

might be released anyway. The Browns

Ferry fire demonstrated that accidents

beyond those specifically addressed during

design could occur and be very serious.

The Reactor Safety Study indicated that such

accidents dominate the risk posed by

commercial n u c l e a r power plants.

Nevertheless, only after the TMI-2 accident

occurred in 1979 was there significant

regulatory interest in so-called beyonddesign-basis accidents.

Events at TMI-2 and Chernobyl forever

altered the preexisting mindset that, because

plants are designed to be safe, severe

accidents are not credible. This chapter

discusses the TMI-2 and Chernobyl accidents

and their impact commercial reactor

regulation. The evolving development and

use of information regarding the risks

associated with severe accidents is

emphasized.

Before proceeding, it is reasonable to ask

"Why not design against all possible

accidents?" In part, the answer to this

question is the basis for defense in depth,

namely, the recognition that human beings

cannot think of everything. As indicated in

the introduction to Chapter 1,

one must continually question

whether the safeguards already in

place are sufficient to prevent major

accidents.

Hence, the regulatory approach taken by the

NRC continues to evolve to reflect

experience with operating plants and other

developments that have safety implications.

In addition, however, there is usually a

prohibitive cost associated with designing

for the exceedingly unlikely (e.g., large

meteor impact); and such expenditures may

provide at best minimal improvements to

plant safety or, in fact, make matters worse

by grossly complicating the design. In fact,

experience demonstrates that significant

safety improvements can often be achieved

with relatively simple, inexpensive changes

to existing plants. On the other hand,

advanced plants are being designed, utilizing

the lessons learned from decades of reactor

experience, both to prevent and to tolerate a

wider spectrum of potential accidents than

existing plants.

2.0.2 Learning Objectives for Module 2

At the end of this module, the student should

be able to:

1. List at least three important contributors

to the accident at TMI-2.

2. Describe the changes that occurred after

the TMI-2 accident in:

a. the NRC

b. the nuclear industry

c. nuclear power plants

d. operator training

e. emergency response

f. severe accident research.

3. Identify two features of U.S. plants not

present at Chernobyl.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-1 NUREG/CR-6042 Rev. 2

2.1 The TMI-2 Accident

2.1.1 Introduction

The Three Mile Island (TMI) Nuclear Station

is operated by the Metropolitan Edison

Company, a member of the General Public

Utilities Corporation. TMI is located near

Middletown, Pennsylvania, about 10 miles

southeast of Harrisburg, the state capitol. At

the time of the accident, the station had two

Babcock & Wilcox PWRs, Unit 1 rated at

792 MWe and Unit 2 rated at 880 MWe.

Figure 2.1-1 depicts the nuclear steam

supply system including the reactor vessel,

two once-through steam generators, four

reactor coolant pumps (two per loop), and

the pressurizer. The hot-leg piping carries

heated coolant from the reactor outlet

nozzles to an inlet at the top of each steam

generator. Two cold-leg pipes carry reactor

coolant from the bottom head of each steam

generator to the respective reactor coolant

pumps and back to the vessel through inlet

nozzles. Other features shown on Figure

2.1-1 include the core flood tank, the reactor

coolant drain tank, and the reactor building

sump. The entire nuclear steam supply

system depicted in Figure 2.1-1 is in a

cylindrical steel-lined concrete containment

called the reactor building.

The following description of the sequence of

events that occurred during the TMI-2

accident is condensed from several

sources.1,2,3,4,5,6In particular, the NRC

investigation produced a scenario that runs

over 100 pages.1

2.1.2 Pre-existing Problems

The TMI-2 reactor, the 880 MWe unit, was

operating at 97% of rated power before the

accident. Figure 2.1-2 is a simplified

drawing that depicts the pre-accident

conditions in the reactor coolant system.

Figure 2.1-2 indicates a reactor coolant

system pressure of 2150 psig (14.8 MPa),

flow of subcooled water through both reactor

coolant loops, a steam bubble in the

pressurizer, and boiling of secondary water

in both steam generators. Similar drawings

are used to indicate conditions in the reactor

coolant system as the accident progresses.

Before the accident began, there had been a

persistent leak of reactor coolant from the

pressurizer to the reactor coolant drain tank.

The leak was known by the operators to be

through either the electromagnetic PilotOperated Relief Valve (PORV) or one or

both of the pressurizer safety valves. The

safety valves and PORV are provided, as

their names imply, to relieve abnormally

high reactor coolant pressures. The safety

valves open automatically on high pressure

to prevent rupture of the reactor coolant

system. The PORV opens automatically at a

lower pressure to prevent inadvertent and

unnecessary opening of the safety valves. In

spite of the leak, the pressurizer water level

and the reactor coolant pressure were being

held at normal levels by the operators.

Consequently, they were not particularly

upset by the leak. (The NRC later concluded

that this pre-existing leak exceeded technical

specification limits.) The leak played a role

in subsequent events in at least one respect.

It created high temperature indications in the

downstream piping, and these pre-existing

indications later disguised a more serious

loss of coolant.

Figure 2.1-3 shows the condensate and

feedwater system. Steam from the steam

generators passes through the turbine and

condenses in the condenser. Water from the

condenser hotwell is pumped first by the

condensate pumps through the condensate

polishers, then by the condensate booster

pumps through the low pressure feedwater

heaters, and finally by the feedwater pumps
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-2 NUREG/CR-6042 Rev. 2

through the high pressure feedwater heaters

to the steam generators. The condensate

polishers use ion-exchange resins to purify

the feedwater. For roughly 11 hours prior to

the accident, shift foremen and auxiliary

operators had been attempting to transfer

spent resins from the condensate polishers to

a resin regeneration tank. Under normal

circumstances, compressed air is used to

"fluff" spent resins, which are then

transferred in demineralized water through a

transfer line between the tanks. But a resin

block developed in the transfer line driving

water back through the isolation valve

between the demineralizer and the

condensate pumps. As a result, water

entered an instrument air line through a

check valve that had frozen open. This

apparently caused the polisher inlet and/or

outlet isolation valves to drift toward the

closed position. The accident began when

all the isolation valves on the condensate

polishers closed. This in turn caused one of

the two operating condensate pumps and

both of the condensate booster pumps to trip

initiating the TMI-2 accident at 4:00:36 a.m.

on Wednesday, March 28, 1979.

2.1.3 Loss of Feedwater

A fairly detailed chronology of the TMI-2

accident is provided in Table 2.1-1. The

reader may find it useful to refer to this

chronology and the associated Figures

frequently. For the most part, times in the

following discussion are measure in hours

(h), minutes (min.), and seconds (s) from

turbine trip, which occurred 1 s after the

condensate pump trip. Where clock times

are specified, they are denoted with an a.m.

or p.m. suffix, as in 4:00:36 a.m.

Within the first second of the accident,

condensate pump 1A, the two condensate

booster pumps, the two feedwater pumps,

and the turbine tripped. The resulting loss

of main feedwater to the steam generators

drastically reduced the rate of heat removal

from the reactor coolant system. During the

initial seconds following the loss of main

feedwater, the reactor continued to operate,

and the reactor coolant began to heat up and

expand. This caused the rapid initial

increase in reactor coolant pressure and

pressurizer level shown in Figure 2.1-4.

About 3 s after turbine trip, the reactor

coolant pressure exceeded the PORV

setpoint of 2255 psig (15.55 MPa), causing

the PORV to open. The reactor coolant

pressure continued to rise until, at about 8 s,

the reactor automatically scrammed on high

reactor coolant pressure. As a result of the

reactor trip, the volume of the liquid reactor

coolant began to contract, and the reactor

coolant pressure began to fall as indicated in

Figure 2.1-4.

2.1.4 Loss of Coolant, Core Cooled (13 s

to 101 min.)

2.1.4.1 PORV Sticks Open

The opening of the PORV and the reactor

trip functioned as designed to prevent

overpressure in the reactor coolant system.

However, trouble developed at 13 s when the

reactor coolant pressure dropped below the

2205 psig (15.21 MPa) setpoint for PORV

closure. A mechanical failure caused the

PORV to stick open. Because the PORV

remained open, steam continued to flow,

undetected, through the stuck-open PORV,

and reactor coolant pressure continued to fall

rapidly as indicated in Figure 2.1-4. A lossof-coolant accident (LOCA) had been

initiated. It went undetected because control

room personnel did not realize that the

PORV was stuck open. A control board

indicating light signaled that the PORV was

closed. In fact, this merely indicated that

the actuating solenoid was de-energized. No
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-3 NUREG/CR-6042 Rev. 2

direct reading of actual valve position was

available.

Had they recognized the PORV was open,

the operators could have closed a block

valve manually, thereby mitigating the effect

of the stuck-open relief valve and totally

preventing subsequent damage to the reactor

core. Should the operators have known

enough to close the block valve in spite of

the erroneous indicating light? Certainly a

rapid drop in reactor coolant pressure as

depicted in Figure 2.1-4 is not a normal

response to a loss of feedwater. The

operators virtually ignored this symptom,

and (as discussed later) focused instead on

the pressurizer level behavior depicted in

Figure 2.1-4.

Another way of determining the position of

the PORV is by reading the temperature in

the pipes leading from this valve to the

reactor coolant drain tank. An abnormally

high temperature indicates the presence of

escaping reactor coolant. In fact, such

readings were made and high temperatures

were noted, but they were thought to be

caused by the same valve leakage that the

operators were aware of before the accident.

The open PORV could also have been

inferred from the reactor coolant drain tank

pressure. This pressure began increasing

when the PORV first opened 3 s after

turbine trip. At about 3 min. 12 s, the relief

valve on the reactor coolant drain began

opening intermittently. At 14 min. 48 s, the

tank's rupture disk blew, as designed, at 192

psig. The pressure in the tank then dropped

rapidly. Had an operator observed the drain

tank pressure meter before the rupture disk

blew, the fact that the PORV was open could

have been diagnosed. However, the meter

was on a panel behind the roughly 7-ft-high

reactor console on which all critical

instruments were placed. The plant's data

acquisition computer did contain a time

history of the tank pressure. However, data

printout lagged significantly during the

intense activity associated with the accident.

Clearly, there were reasons for the operators

in these early minutes of the accident to

have missed the fact that leakage was

continuing through the PORV. But there

were to be persistent signs of a serious loss

of coolant that would be ignored. In short,

the operators at Three Mile Island didn't

realize they had a loss of coolant through the

relief valve until 139 min. By then matters

had passed the point of no return.

2.1.4.2 Loss of Auxiliary Feedwater

The auxiliary feedwater system is designed

to compensate for a loss of main feedwater

and prevent the steam generators from going

dry. The three auxiliary feedwater pumps

(two electric-driven and one steam-driven)

started automatically within 1 s of the trip of

the main feedwater pumps. The automatic

auxiliary feedwater isolation valves also

opened, as designed, after two conditions

had been met: (a) the auxiliary feedwater

pumps were delivering their normal

discharge pressure (at least 875 psig); and

(b) the water level in the steam generators

was 30 inches or less. Condition (a) was

satisfied 14 s after turbine trip. Condition

(b) was satisfied at about 30 s.

There are also block valves in the auxiliary

feedwater lines to the steam generators.

These block valves are required to be open

while the plant is operating. Records

indicated that the valves had been reopened

following maintenance completed 2 days

earlier; however, they were not open at the

time of the accident. It took the operators 8

min. to discover the valves were closed, in

part, because tags on the control room panel

inadvertently covered the valve position
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-4 NUREG/CR-6042 Rev. 2

indicator lights. As a result, there was no

flow of auxiliary feedwater from the

condensate storage tank to the steam

generators until an operator opened the block

valves at 8 min. 18 s.

Babcock & Wilcox claimed that, had there

been auxiliary feedwater, the temperature of

the reactor coolant might have remained

relatively stable until the problem of the

condensate pumps was corrected and normal

feedwater was reinstated. This view has

been contested not only by the NRC but also

by the utility-sponsored Nuclear Safety

Analysis Center, an investigative arm of the

Electric Power Research Institute. Their

investigations indicate that, except for

adding another dimension to the areas of

concern within the main control room, the

early unavailability of auxiliary feedwater

did not significantly affect the progression of

the accident, which was dominated by the

uncompensated loss of reactor coolant.

2.1.4.3 Throttling of High Pressure

Injection

In a normal loss of feedwater scenario,

without the stuck open PORV, the reactor

coolant continues to contract after reactor

trip. Letdown flow is reduced or stopped,

and makeup flow is increased to maintain

the normal water level in the pressurizer.

With this in mind, at 41 s, an operator

manually started a second makeup pump

(1B) to reverse the downward trend in the

pressurizer level shown in Figure 2.1-4.

At about 1 min., the water level in the

pressurizer indeed began to increase. But

this was not solely due to increased makeup

flow. With the stuck-open PORV, the

reactor coolant pressure continued to

decrease and the NRC contends that as early

as 1 min. and continuing thereafter the

reactor coolant experienced either a general

expansion, as might occur with distributed

voids, or the formation of one or more

discrete steam vapor voids. As reactor

coolant circulating through the core became

saturated, it expanded and its pressure

increased. The force exerted by this

expanding reactor coolant through the

pressurizer surge line caused the water level

in the pressurizer to increase.

The pressurizer heaters, which would

normally be used to keep the coolant in the

RV subcooled, had tripped. Even if they had

been operational, their energy addition

capacity was far exceeded by the rate of

energy loss out the stuck open PORV.

About 2 min. after turbine trip, the reactor

coolant pressure dropped below 1600 psig as

a result of the stuck-open PORV. At this

pressure the emergency core cooling system

was automatically actuated. Makeup pump

1C started and makeup pump 1B tripped

leaving pumps 1A and 1C running as highpressure injection pumps. The makeup

valves opened to admit the full, 1000 gpm,

output of the pumps into the reactor coolant

system. The pressurizer water level was

increasing rapidly as shown in Figure 2.1-4.

In part this was due to high pressure

injection (HPI), but expansion due to vapor

formation in the reactor coolant was also

contributing to the pressurizer level increase.

The operators had been trained to avoid

filling the pressurizer and causing the

primary system to go "water solid." With

the primary system full of liquid a very

small temperature increase could cause the

pressure to rise to the point where the safety

valves would open. It is not unusual for

safety valves to leak after they lift, thereby

necessitating costly repairs. Procedures for

a turbine trip, which the operators were

attempting to follow, require the operators to

switch to manual control and reduce makeup
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-5 NUREG/CR-6042 Rev. 2

flow as soon as the pressurizer regains

normal level.

At 3 min. 13 s, after verifying that all of the

emergency core cooling systems had started

normally, the operators bypassed the high

pressure injection system. Bypassing the

system did not shut it down but merely

permitted the operators to control high

pressure injection flow manually. At 4 min.

38 s, to avoid overfilling the pressurizer, the

operators shut off makeup pump 1C,

severely throttled HPI flow from makeup

pump 1A, and initiated letdown flow in

excess of 160 gpm. After a brief pause, the

pressurizer level continued to increase due to

thermal expansion of the reactor coolant.

The coolant supplied by HPI was less than

the amount being lost through the PORV.

The stage was set for a severe accident

unless the loss of coolant was diagnosed and

corrected.

Figure 2.1-5 depicts the reactor coolant

system condition at 8 min. Reactor coolant

pressure had decreased to 1500 psig.

Saturated reactor coolant was being pumped

through both loops by all four reactor

coolant pumps. The pressurizer was full,

and the steam generators were dry.

2.1.4.4 Release Pathways

Because of the discharge of reactor coolant

through the open PORV, the pressure in the

reactor coolant drain tank increased rapidly.

While the tank was being pressurized, some

reactor coolant was forced through the vent

line into the vent gas header. This damaged

portions of the vent gas system creating

paths by which radioactive gases would

eventually leak to the auxiliary and fuel

handling buildings.

The reactor coolant drain tank relief valve

began opening intermittently at 3 min. 12 s.

Reactor coolant then began accumulating in

the reactor building sumps. At 7 min. 29 s,

a reactor building sump pump started

automatically. A second reactor building

sump pump came on at 10 min. 19 s. The

sump pumps' discharge was aligned to the

auxiliary building sump tank, which had a

blown rupture disk. Water, therefore, spilled

onto the auxiliary building floor.

The two reactor building sump pumps were

turned off at about 38 min. when an

auxiliary operator noticed that they were on

and that the reactor building sump level was

at its high limit (6 feet). Approximately

8,260 gallons of water were pumped from

the reactor building sump to the auxiliary

building before the sump pumps were turned

off.

Reactor building (containment) isolation

would have prevented the transfer of water

from the reactor building sump to the

auxiliary building. However, the rate of

coolant loss associated with the stuck open

PORV was not sufficient to cause the 4 psig

reactor building pressure required for

automatic isolation. When the reactor

coolant drain tank rupture disk blew at 14

min. 48 s, there was a 1 psig pressure spike

in the reactor building, but the 4 psig set

point for reactor building (containment)

isolation was not approached until about 60

min. (1 h).

The pathway for releases from the auxiliary

building is depicted in Figure 2.1-6. The

water initially pumped to the auxiliary

building by the reactor building sump pumps

contained low radionuclide concentrations

characteristic of reactor coolant during

normal operation. As the accident

progressed, however, fission products

escaped from a damaged core, and some

were entrained in letdown flow to the

makeup tank. The letdown line was, in fact,
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-6 NUREG/CR-6042 Rev. 2

the major path for transporting radionuclides

from the reactor building. There was some

liquid leakage from the makeup and

purification system to the auxiliary building

floor. But the main pathway for

radionuclide releases occurred during venting

of the makeup tank to the damaged vent

header. This venting began over 24 h after

accident initiation, and resulted in the

leakage of volatile radionuclides to the

auxiliary and fuel handling buildings. Gases

from these buildings are picked up by the

ventilation system, passed through filters,

and discharged through the stack. The filters

remove chemically active species like iodine,

but have no effect on inert noble gases.

2.1.4.5 Auxiliary Feedwater Restored

As discussed earlier, about 30 s after turbine

trip, the conditions required for admission of

auxiliary feedwater to the steam generators

had been met. But, because the auxiliary

feedwater block valves were closed, no water

flowed to the steam generators. It appeared

to the operators that the automatic valves

were opening at an unusually slow rate,

causing a delay in feeding the steam

generators.

About 8 min. after turbine trip, an operator

noticed steam generator level at 10 inches on

the startup range. This indicated the steam

generators were dry. The fact that the

auxiliary feedwater block valves were shut

was diagnosed, and these valves were

opened resulting in dry steam generators

being fed with relatively cool water.

Auxiliary feedwater sprayed directly onto the

hot tubes evaporated immediately. This

caused a rapid increase in steam pressure,

which had previously dropped when the

steam generators boiled dry. This positive

indication of feed flow to generators was

confirmed by a decrease in the auxiliary

feedwater pump discharge pressure and by

hammering and crackling of the vibration

and loose-parts monitor speaker, set up to

listen to the steam generator. Hot- and coldleg temperatures dropped as did the reactor

coolant pressure. Although evaporation of

auxiliary feedwater increased the steam

pressure, no water collected in the bottom

until the tubes cooled down. There was

about a 14 min. lag in recovery of steam

generator level.

2.1.4.6 Undiagnosed LOCA Continues

At the beginning of the accident, the

computer alarm printout was synchronized

with real time. The alarm printer could only

type one line every 4 s, however, and during

the accident, several alarms per second were

occurring. Within a few minutes, the alarms

being printed were for events that had

occurred several minutes earlier.

At about 15 min., reactor coolant pump

alarms started going off. This indicated

insufficient pressure at the pump inlets.

There was also a continual slow reduction in

reactor coolant pump flow, and low flow

alarms sounded at various times.

Pressure at the reactor coolant pump inlets is

required to be significantly above the

saturation pressure. This requirement is

called the net positive suction head (NPSH)

requirement. If this NPSH requirement is

not met, the formation of vapor bubbles on

the suction side causes pump cavitation.

Associated vibration could damage the pump

seals or even the attached piping.

Operators ignored the NPSH requirement and

let the reactor coolant pumps continue to

operate. As long as the reactor coolant

pumps provided forced circulation, even of

froth, the core was cooled.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-7 NUREG/CR-6042 Rev. 2

At ~20 min., the steam bubbles in the

reactor coolant caused the out-of-core

source-range neutron detector to read higher

than expected. Normally, water in the

downcomer annulus, outside the core but

inside the reactor vessel, shields these

detectors. But, because the water was now

frothy, it was not shielding the detectors as

well as usual. Not realizing that the

apparent increase in neutrons reaching the

detectors was caused by steam bubbles in the

reactor coolant, the operators feared the

possibility of a reactor restart. Although it

is now known that their fears were

unfounded, at the time they were one more

source of distraction.

About 25 min. after turbine trip, the

operators received a computer printout that

indicated the PORV outlet temperature was

high, 285°F. This indication of an open

PORV, however, was not interpreted as such

by the operators. When the PORV opened in

the initial transient, the PORV outlet

temperature would have increased even if the

PORV had closed as designed. The

operators supposed that the abnormally slow

cooling of the outlet pipe was caused by the

pre-existing PORV or safety valve leak.

Evidence of the open PORV now included:

(a) the low reactor coolant pressure; (b) the

rapid rise in reactor coolant drain tank

pressure and temperature; (c) the fact that

the rupture disk had blown; (d) the rise in

reactor building sump level (with operation

of the sump pumps); and (e) the continuing

h i g h P O RV o u t l e t t e m p e r a t u r e .

Nevertheless, the ongoing LOCA was not

diagnosed.

The reactor coolant voids and the low

reactor coolant pump flows decreased the

efficiency of primary to secondary heat

transfer in the steam generators. The rate of

boiling on the secondary side was low, and

operators found it difficult to keep the

secondary water level from creeping up.

One auxiliary feedwater pump was shut off

at 36 min.

As control room personnel struggled to

understand what was happening in the plant,

hundreds of alarms went off, signaling such

things as unusual conditions in the reactor

coolant drain tank, high temperature and

pressure in the reactor building, and low

reactor coolant pressure. Conditions were

beyond those that control room personnel

had experienced in their training or in their

operation of the plant. The symptoms

described in the emergency procedures did

not fit the situation and proved to be of little

help. The operators were well aware that

something was wrong, and, about one hour

after turbine trip, they called the on-call

operating engineer to the site.

The condition in the reactor coolant system

at 60 min. (1 h) is depicted in Figure 2.1-7.

The PORV was still open, and the reactor

coolant pressure had decreased to 1050 psig.

Unknown to the operators, the reactor

coolant was a saturated liquid-steam mixture.

A large steam bubble had probably formed in

the upper reactor vessel head. Pressurizer

level was high and was only barely being

held down. The reactor coolant pumps were

operating but with decreasing flow and

increasing vibration. Heat removal via the

steam generators was ineffective. To add to

the confusion, the condenser was no longer

available, the alarm computer lagged so

badly that it was virtually useless, radiation

alarms were beginning to come on, and the

reactor building pressure and temperature

were gradually increasing.

2.1.4.7 Loop B Pumps Turned Off

At ~74 min., the operators shut down reactor

coolant pump 1B. A few seconds later

reactor coolant pump 2B was shut down.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-8 NUREG/CR-6042 Rev. 2

(Pressurizer spray comes from the A loop.)

The action to shut down the loop B reactor

coolant pumps was taken because reactor

coolant pump performance was seriously

impaired as indicated by high vibration, low

flow (60% of normal), low amperage, and

inability to meet NPSH requirements.

Shutting down the two B loop reactor

coolant pumps reduced the flow of coolant

through the reactor core. There was still

enough mass flow in the steam-water

mixture being pumped by the two loop A

pumps to keep the core from overheating.

The open PORV was, however, still reducing

the reactor coolant inventory and pressure.

The remaining liquid reactor coolant

continued to vaporize, and, although this

vaporization removed core decay heat, it

further impeded forced circulation via the

loop-A reactor coolant pumps.

A sample of reactor coolant analyzed a few

minutes after the loop-B pumps were shut

off indicated a low boron concentration.

This finding, coupled with apparently

increasing neutron levels, increased the

operators' fears of a reactor restart. As

explained earlier, the source range neutron

detector count rate was increasing because

steam bubbles in the downcomer allowed

more neutrons to reach the detector. There

was no actual danger of re-criticality. It is

now believed the sample was diluted by

condensed steam, causing the indication of

low boron concentration.

At 80 min., an operator had the computer

print out the PORV (283°F) and pressurizer

safety valve (211°F and 219°F) outlet

temperatures. Because there had been

essentially no change in these temperatures,

the operators should have realized that the

PORV had not closed. At about the same

time, the letdown line radiation monitor

indicated a sevenfold increase. The letdown

line radiation monitor was notoriously

sensitive, but the implications of the reading

were not understood by the operators.

At 87 min. (1 h 27 min.), steam generator B

was isolated. Operators observed increases

in reactor building pressure and noted that

the secondary pressure in steam generator B

was 300 psi lower than in generator A.

They believed that secondary steam was

leaking from generator B into the reactor

building. In hindsight, the lower pressure in

generator B was caused by reduced heat

transfer in loop B after reactor coolant

pumps 1B and 2B were shut off.

Figure 2.1-8 depicts the condition in the

reactor coolant system at 90 min.. (1 h 30

min.). The reactor coolant pressure was

1050 psig. The pressurizer was nearly full.

The loop-B reactor coolant pumps were off,

the B steam generator was isolated, and the

steam and liquid phases had separated in

loop B. The reactor coolant pumps in loop

A were still on, circulating the steam-water

mixture through steam generator A.

2.1.5 Initial Core Damage (101 min. to

174 min.)

2.1.5.1 Loop A Pumps Off, Core

Uncovered

Approximately 5 to 10 min. after the loop-B

reactor coolant pumps were shut off, the

loose-parts monitor again indicated

increasing pump vibration. In fact, standing

in the control room, the operators said they

could feel the vibrations. The operators also

reported flow instability, as the loop A flow

continued to decrease. At ~101 min. (1 hr

40 min. 40 s), the loop-A reactor coolant

pumps were turned off. This action sealed

the fate of TMI-2.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-9 NUREG/CR-6042 Rev. 2

The operators asserted during interviews that

they were concerned about a inducing a

LOCA by a reactor coolant pump seal

failure, and decided to go on natural

circulation. To establish natural circulation

would have required (among other things)

subcooled reactor coolant. The operators

assumed that, because the pressurizer level

was high, the core must be covered. In

actuality, natural circulation was precluded

by the steam that had formed in the reactor

coolant system. It was the higher pressure

of steam bubbles formed in the reactor

vessel that kept the water level high in the

pressurizer. After shutting off the loop-A

pumps, the operators did not see any

indications that natural circulation had been

established.

After shutdown of the last two reactor

coolant pumps, vapor that had previously

been mixed with liquid to form a frothy

reactor coolant, separated and rose to the

higher portions of the reactor vessel and the

rest of the reactor coolant system. Water

continued to escape from the stuck-open

PORV and HPI flow remained throttled. By

103 min. (1 h 42 min. 30 s), the separation

of steam and liquid phases in the reactor

vessel had again reduced the shielding of the

source-range neutron detectors, which

indicated increasing neutron levels. The

operators increased high pressure injection

flow to avert a restart by providing

emergency boration. Reactor coolant

pressure increased, and the neutron count

rate dropped significantly.

For at least a few minutes after the loop-A

reactor coolant pumps were shut off, it

would have been possible to terminate the

accident without extensive core damage. If

full HPI flow had been initiated, the reactor

coolant system could have been refilled.

The block valve upstream of the PORV

could have been shut to repressurize the

system and collapse the vapor bubbles.

These actions would have permitted

sustained core cooling by forced (reactor

coolant pump) or natural circulation, but the

actions were not taken.

2.1.5.2 H y d ro g e n f rom Zircal o y

Oxidation

Figure 2.1-9 depicts the situation at 120 min.

(2 h). The reactor coolant pressure was

about 750 psig. The PORV was still open,

HPI flow was still throttled, and all reactor

coolant pumps were off. There was

essentially no flow through the core, and the

liquid and vapor in both loops had separated.

With this separation, the hot-leg temperature

became much higher than the cold-leg

temperature. The actual loop A hot-leg

temperature was 558°F. In retrospect, this

indicated the presence of superheated steam

in the hot leg. For superheated steam to

exist in the hot leg, a substantial portion of

the upper part of the core must be

uncovered.

It is now known that the water level in the

core region continued to fall until the top

two-thirds of the core uncovered and became

very hot. Steam generated by the boiling of

water covering the bottom portion of the

core flowed upward and oxidized the hot

Zircaloy fuel cladding releasing additional

energy and large amounts of hydrogen.

As long as the upper part of the reactor

coolant system contained only steam, the

bubble could have been condensed

(collapsed) by refilling (with full HPI) and

repressurizing (by closing the PORV block

valve) the system. However, with large

amounts of noncondensible hydrogen in the

system, the bubble could no longer be

collapsed.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-10 NUREG/CR-6042 Rev. 2

At about 120 min. (2 h), a conference phone

call began between the control-room

technical superintendent and (at their homes)

the station superintendent, the vice president

of generation, and the Babcock & Wilcox

site representative. The conference call

lasted 38 min. Conferees realized that

something was abnormal since the reactor

coolant pumps were off yet they were unable

to get a steam bubble in the pressurizer.

The blown-out rupture disk on the reactor

coolant drain tank and the water on the

reactor building floor did not seem

surprising, since this had happened before.

The condition of the block valve upstream of

the PORV was questioned. It was reported

to be shut, but it was not. The conferees

decided to restart a reactor coolant pump,

and all officials planned to report to the

control room.

At ~134 min. (2 h 14 min.), the reactor

building air sample particulate radiation

monitor went off scale. This was the first of

many radiation alarms that could definitely

be attributed to gross fuel damage.

2.1.5.3 PORV Block Valve Closed

At 139 min. (2 h 19 min.), a shift supervisor

who had just come into the control room

isolated the PORV by closing the upstream

block valve. Apparently, he did this to see

whether it would have an effect on the

anomaly of high pressurizer level and low

steam pressure. Noting that the downstream

temperature for the PORV was 35° higher

than for the safety valves, it was recognized

that a leak had been stopped. The operators

also noted an immediate drop in reactor

building temperature and pressure. With

closure of the block valve, reactor coolant

pressure began to increase from a low of 660

psig until it reached 1300 psig about 3 hours

later.

Core degradation continued after the PORV

block valve was closed because there was

still no way to cool the uncovered portion of

the core. Although steam generator A

contained 50% cold water, there was no

circulation of reactor coolant through the

steam generators. In some ways the

situation was worse than before the PORV

was closed. As the reactor coolant pressure

increased, it took less energy to evaporate

each pound of residual water covering the

bottom portion of the core.

2.1.5.4 Initial Melting In Core Region

Post-accident analyses of plant data and core

debris indicate that by 140 min. (2 h 20 m)

the core liquid level had dropped to about

midcore. The upper regions of the core had

heated sufficiently (1500°F to 1700°F) to

result in cladding failure and release of

gaseous fission products.

At about 149 min. (2 h 29 min.), the narrow

range hot-leg temperature went offscale high

(620°F). The narrow range cold-leg

temperature was already offscale low

(520°F). Wide range temperature

measurements were still available, but the

operators were in the habit of using the

narrow range temperatures, which can be

read more precisely. One meter, which

indicates the average of the hot-leg and coldleg temperatures, read 570°F (the average of

the constant readings of 620°F and 520°F).

This steady average temperature evidently

convinced the operators that the situation

was static.

Between 150 and 160 min., temperatures got

high enough to cause melting and downward

relocation of some core materials, which

refroze on colder surfaces to begin the

formation of a crust that would subsequently

act like a crucible holding molten material in

the core region.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-11 NUREG/CR-6042 Rev. 2

At 158 min. (2 h 38 min.) a letdown cooler

radiation monitor went offscale high,

reflecting the severe core damage that was

occurring.

During the period of core damage, there was

virtually no information on conditions in the

core. Incore thermocouples, which measure

reactor coolant temperature at the exit from

the core, could only show temperatures as

high as 700°F due to limits imposed by the

signal conditioning and data logging

equipment, not by the thermocouples

themselves.

Figure 2.1-10 shows the conditions in the

reactor coolant system at 158 min. (2 h 48

min.). The PORV block valve was shut, and

the reactor coolant pressure had increased to

1200 psig. Upper portions of the reactor

coolant system were filled with the steamhydrogen mixture. The Zircaloy oxidation

continued, and some melting and relocation

of core materials was indicated.

2.1.6 Quenching and Related Core

Damage (174 min. to 375 min.)

2.1.6.1 Restart of Reactor Coolant

Pump 2B

At 174 min. (2 h 54 min.) the operators

restarted reactor coolant pump 2B. Flow

was indicated for a few seconds and then

dropped to zero. The pump was shut off 19

min. later. The core was partially quenched

as liquid remaining in the cold leg was

pumped into the core. This probably caused

some collapse of rubble in the core region.

With the block valve closed, the steam

generated during the partial quench caused

the reactor coolant pressure to increase to

2200 psig.

At 176 min. (2 h 56 min.), a technician

reported that letdown sample lines had an

extremely high radiation level (600 R/hr). A

radiation level of 1 R/hr had previously

(2 h 30 min.) been reported in the makeup

tank area of the auxiliary building. The

auxiliary building was evacuated, and a site

emergency was declared. The conditions in

the reactor coolant system 180 min. (3 h)

into accident, are depicted in Figure 2.1-11.

The reactor coolant pressure was at 2050

psig. Reactor coolant pump 2B was on, but

no flow was indicated. The pressurizer level

was offscale high. Most incore

thermocouples were reading off scale. The

actual hot-leg temperatures were nearly

800°F. This indicates that at least the upper

part of the core was dry. There were many

high radiation alarms, indicating that

extensive fuel damage had occurred. Fifty to

sixty people were in the control room by this

time, attempting to resolve the crisis.

2.1.6.2 Core Region Reflooded

At 192 min. (3 h 12 min.) the PORV block

valve was reopened in an attempt to control

reactor coolant pressure. Opening the valve

resulted in an increase in the valve outlet

temperature, a limited pressure spike in the

reactor coolant drain tank (rupture disk had

previously burst at ~15 min.), an increase in

reactor building pressure, and a pathway by

which hydrogen and radionuclides from the

damaged core could reach the reactor

building.

After the PORV block valve was opened, the

reactor coolant pressure began dropping

rapidly. In response, at 200 min. (3 h 20

min.), engineered safeguards were manually

initiated. Makeup pump 1C started and the

makeup valves fully opened. Reactor

coolant temperature dropped rapidly as cold

water was injected into the reactor vessel.

The out-of-core neutron levels dropped

rapidly due to the rapid water level increase

in the downcomer. The water added was
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-12 NUREG/CR-6042 Rev. 2

sufficient to ensure that the core region was

recovered.

The sudden injection of cold water onto the

hot core materials caused additional releases

of volatile radionuclides due to thermal

shock. These radionuclides could then flow

out letdown line to the auxiliary building or

through the open PORV block valve into

reactor building. The radiation level in the

reactor building dome increased to 8 R/hr.

The vent stack alarm also went off at about

this time. Many other radiation monitors

registered alarms. The control building,

except for the control room itself, was

evacuated.

At 203 min. (3 h 23 min. 23 s, 7:24 am), a

general emergency was declared on the basis

of the many radiation alarms, and the

p o t e n t i a l f o r o ff s i t e r e l e a s e s o f

radionuclides. The utility notified State and

Federal officials when it declared the site

and general emergencies.

At ~209 min. (3 h 29 min.) a borated water

storage tank alarm was received. Water for

high pressure injection is taken from the

borated water storage tank. There were still

53 feet of water in this tank. Nevertheless,

the fact that the level was falling caused

concern that continued high pressure

injection would exhaust the borated water

storage tank inventory. Highly radioactive

water from the reactor building sump would

then have to be used for high pressure

injection. The makeup pumps and associated

pipes and valves in the auxiliary building

would then have become contaminated with

radionuclides. This could cause grave

problems if repairs became necessary. There

was, therefore, an inclination to use as little

HPI flow as possible. Emergency safeguards

were reset, and makeup pump 1C was

stopped. At the same time, the PORV block

valve was shut. Closing this valve, with

makeup pump 1A still running, caused a

rapid increase in pressurizer level.

The condition in the reactor coolant system

at 210 min. (3 h 30 min.) is depicted in

Figure 2.1-12. The opening of the block

valve for 17 min. together with the operatorinitiated increase in HPI flow had reduced

the reactor coolant pressure to 1500 psig.

The vessel had been refilled and the core

recovered. Temperatures in the reactor

coolant system were decreasing, but steam

and hydrogen gas was trapped in the hotlegs, blocking circulation of water through

the system. Most of the damage to the core

had been done, and radiation levels in the

plant were high.

2.1.6.3 Pour of Molten Core Material

At about 222 min. (3 h 42 min.) the PORV

block valve was reopened for the second

time. It remained open until 315 min. (5 h

15 min.).

At about 224 min. (3 h 44 min.), it is now

known that approximately 20 metric tonnes

(2×10

4

kg) of molten core material poured

from the core region into the reactor vessel

lower head. A rapid increase in reactor

coolant pressure between 224 and 226 min.

indicates substantial quenching of relocated

material by water in the lower head. The

phenomena associated with the formation,

holdup, and relocation of molten core

materials is discussed in Chapter 3.

2.1.6.4 HPI On, Off, Finally Sustained

At 236 min. (3 h 56 min.), engineered safety

features actuated on high (4 psig) reactor

building pressure. Makeup pump 1C started.

Both makeup pumps (1A and 1C) tripped at

258 min. (4 h 18 min.). Two unsuccessful

attempts were made to restart pump 1A. The
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-13 NUREG/CR-6042 Rev. 2

control switch was then put in the "pull-tolock" position. This completely defeated

automatic starts of the pump. The

pressurizer indicated full, and the operators

were concerned about full high pressure

injection flow coming on with an apparently

solid primary system. Actually, a very large

part of the reactor coolant system was filled

with steam and hydrogen gas, and the system

was far from being water solid. This

condition could have been recognized from

the fact that the temperatures in the hot legs

were consistent with superheated steam.

By 266 min. (4 h 26 min.) high pressure

injection was reestablished. From this time

on, high pressure injection flow was

continuously maintained at varying flow

rates after having been shut off altogether

for at least 5 min.

Between 4 h and 4 h 30 min., incore

thermocouple temperature readings were

taken off the computer. Many registered

question marks. Shortly after, at the request

of the station superintendent, an

instrumentation control engineer had several

foremen and instrument technicians go to a

room below the control room and take

readings with a millivoltmeter on the wires

from the thermocouples. The first few

readings ranged from about 200°F to 2300°F.

These were the only readings reported by the

instrumentation control engineer to the

station superintendent. Both later testified

that they discounted or did not believe the

accuracy of the high readings because they

firmly believed the low readings to be

inaccurate. In the meantime, the technicians

read the rest of the thermocouples. Their

readings, a number of which were above

2000°F, were entered in a computer book,

which was later placed on a control room

console. The technicians subsequently left

the area when nonessential personnel were

evacuated.

Only a small amount of heat could be

removed by the unisolated A steam generator

because the upper part of the primary system

was filled by a mixture of steam and

hydrogen gas. The water level on the

secondary side was rising because more

auxiliary feedwater was coming than was

leaving as steam. At 4 h 42 min., auxiliary

feedwater was shut off.

2.1.7 Recovery Attempts (5 h 15 min. to

1 month)

For the rest of the day, control room

personnel struggled to regain stability in the

plant. The principal problem was to ensure

a reliable flow of water through the core.

2.1.7.1 Attempt to Collapse Vapor

Bubble

The operators first tried to repressurize in

order to collapse what they believed to be

saturated steam bubbles in the reactor

coolant system and establish natural

circulation.

At 5 h 15 min., the PORV block valve was

closed to initiate the repressurization. Two

makeup pumps were running throughout the

repressurization so that a feed and bleed

situation existed. By 5 h 43 min., the

primary system was fully repressurized. The

pressure was maintained between 2000 and

2200 psig by cycling the PORV block valve.

Figure 2.1-13 shows the reactor coolant

system condition at 6 h. Liquid was being

released intermittently through the PORV

block valve. Two makeup pumps (HPI

pumps) were running, and core heat removal

was by heatup of the injected water. Steam

generator heat transfer was blocked by

hydrogen.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-14 NUREG/CR-6042 Rev. 2

In order to encourage natural circulation,

operators raised the water level of steam

generator A to 90%, using the condensate

pump for feed. It became clear that even

with a full steam generator and high

pressure, natural circulation was not being

established.

At 6 h 10 min., airborne radiation levels in

the Unit 2 control room required evacuation

of all but essential personnel. At 6 h 17

min., Unit 2 personnel put on masks to

protect them against possible airborne

radionuclides. At 6 h 27 min., nonessential

personnel began moving to the Unit 1

control room. At 6 h 52 min., people

leaving the Unit 2 control room failed to

close the door properly, possibly

compromising the recirculation ventilation

system.

By 7 h, communications in the Unit 2

control room were hampered by respirators.

Some personnel removed their respirators for

short periods.

The operators were reluctant to start a

reactor coolant pump for fear of vibrationinduced seal failure LOCA. They recognized

they had bubbles in both loops. They

believed the reactor core was covered and

considered the possibility of uncovering it as

each option was reviewed. The concern that

the PORV should remain closed was

reevaluated leading to a decision to use the

PORV block valve for pressure reductions.

2.1.7.2 Attempt to Use Core Flood

Tanks

With the failure of repressurization to

collapse the bubble, concern arose over

whether the core was covered and how long

the borated water storage tank inventory

would last. These uncertainties led to the

next strategy, which was to depressurize the

primary system sufficiently to inject water

from the core flood tanks. Nitrogen gas

maintained the pressure on the water in the

core flood tanks slightly above 600 psig.

Utility personnel reasoned that lower

pressure would activate the core flood tanks,

which would dump more water onto the

core, assuring that it would be covered.

Actually, if the reactor coolant pressure

drops only slightly below 600 psig (as

happened at TMI-2) only a small amount of

water is injected before the core flood tank

pressure equilibrates with that in the primary

system. An amount of water approaching

the full volume of the tanks would only be

injected into the reactor vessel if the reactor

coolant pressure dropped far below 600 psig,

as in a large break LOCA.

At 11:38 a.m. (7 h 38 min.), the PORV

block valve was opened, allowing steam and

gas once again to escape from the

pressurizer. The reactor building pressure

increased from 0.2 psig to 2.5 psig during

this reactor coolant system depressurization.

Figure 2.1-14 shows the condition in the

reactor coolant system at 8 h. The reactor

coolant pressure had been reduced to about

1000 psig. During depressurization,

hydrogen was released through the PORV

into the reactor building.

At 8 h 41 min., the reactor coolant pressure

reached 600 psig, and the core flood check

valves opened. Little water was injected

from the core flood tanks into the reactor

vessel. Some control room personnel

interpreted this to mean the core was

covered; others concluded that the core had

never been uncovered. At 9 h 10 min., plant

personnel closed the PORV block valve,

halting the depressurization.

2.1.7.3 Attempt to Use Decay Heat

Removal, Hydrogen Burn
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-15 NUREG/CR-6042 Rev. 2

Members of the emergency command team

soon decided to depressurize again in the

hope of reaching a low enough pressure to

permit use of the decay heat removal system.

At 9 h 50 min., operators again opened the

PORV block valve. As the block valve was

opened, there was an extremely sharp

increase in reactor building pressure and

temperature. As a result of the pressure

spike, which is shown in Figure 2.1-15, the

reactor building again isolated, engineered

safeguards actuated, and the reactor building

sprays came on. Figure 2.1-15 indicates a

peak pressure of 28 psig, which is the

setpoint for the actuation of reactor building

sprays.

It is now known that the pressure spike

occurred when hydrogen, which had been

released while the PORV block valve was

open, ignited and burned with oxygen in the

reactor building atmosphere. Ignition

apparently occurred simultaneously with the

opening of the PORV block valve at 9 h 50

min. The reactor building sprays quickly

brought the pressure and temperatures down.

Six minutes after actuation, the sprays were

shut off from the control room because there

appeared to be no need for them.

Initially, the spike was dismissed as some

type of instrument malfunction. Shortly

afterward, however, at least some

supervisors concluded that for several

independent instruments to have been

affected in the same way, there must have

been a pressure pulse. It was not until late

Thursday night, however, that control room

personnel became generally aware of the

pressure spike's meaning. Its meaning

became common knowledge among the

management early Friday morning.

Figure 2.1-16 shows the condition in the

reactor coolant system at 10 h 30 min.

Reactor coolant pressure had been reduced to

about 400 psig, which was about the

minimum achieved, and the pressurizer

temperature had reached saturation. Liquid

was maintained in the reactor coolant system

during depressurization by continuous high

pressure injection and some flow from the

core flood tanks. The reactor coolant

pressure never dropped below 320 psig or

250°F, the pressure and temperature below

which the decay heat removal system would

have been allowed to operate. It is probably

fortunate that the decay heat removal system

could not be used. It was not designed to

handle highly radioactive liquids, and failure

of seals in the system could have resulted in

leakage of such liquids directly to the

auxiliary building.

At 11 h 8 min. operators ended attempts to

depressurize. Figure 2.1-17 shows the

condition at 13 h. The system pressure was

about 600 psig. Very little decay heat was

being removed except by makeup water and

by occasional opening of the PORV block

valve. Gradual heatup was causing the

reactor temperature and pressure to rise.

Pressure control was being attempted by

adjusting makeup flow and cycling the

PORV block valve. Steam generator B was

isolated. Hydrogen in the upper portions of

the system was preventing any significant

heat removal by steam generator A.

2.1.7.4 Forced Circulation Established

At 13 h 20 min., utility executives offsite

ordered the emergency command team to

repressurize the system again. The objective

was to collapse enough steam to permit the

restart of a loop A reactor coolant pump.

This would establish forced circulation

through the core and heat removal by

steaming in loop A steam generator.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-16 NUREG/CR-6042 Rev. 2

Figure 2.1-18 depicts the status of the

reactor coolant system at 15 h (7 pm). The

reactor coolant was repressurized to 2300

psig. Reactor coolant pumps are off,

although steam generator A was steaming to

the condenser providing some heat removal.

Steam generator B was isolated. Natural

circulation of reactor coolant through the

steam generator was still blocked by the

hydrogen gas at the top of the hot legs (the

so-called candy canes).

There was some concern, as to whether a

reactor coolant pump would operate under

the conditions that existed. With voids in

the reactor coolant, sustained running could

damage the pump or blow out the seals.

Therefore, the control room personnel

decided to "bump" one of the pumps (run it

for only a few seconds) and to observe

current and flow while the pump was

running.

The loss of two motor control centers (at the

time of the hydrogen burn) meant that the

AC oil lift pumps were out of service. It is

not possible to start a reactor coolant pump

unless the oil lift pump can be started.

There is a standby DC oil lift pump, but it

was necessary to send people to the auxiliary

building to start it.

At 15 h 33 min., operators started reactor

coolant pump 1A by manually bypassing

some of the inhibiting circuitry. The pump

was run for 10 s, with normal amperage and

flow. Dramatic results were seen

immediately. Reactor coolant pressure and

temperature instantly dropped, but began to

rise again as soon as the pump was stopped.

Evidently, there was an immediate transfer

of heat to the steam generator when the

coolant circulated. There was also a rapid

spike in the steam pressure and a drop in

steam generator level.

At 15 h 50 min., based on their earlier

success, the operators managed to start a

pump 1A and keep it running. This forced

water through the core region and steam

generator A. By 16 h (8 pm) relatively

stable conditions were achieved as depicted

in Figure 2.1-19. Reactor coolant

temperatures were at about 290°F.

Pressurizer level was still full-scale.

Reactor coolant pressure was about 1300

psig. Steam generator B was isolated and at

about 97% water level. Makeup was normal.

The pressurizer temperature was about

150°F, and operators were letting down in an

attempt to remove the excess hydrogen.

2.1.7.5 Collapsing the Bubble

At 17 h 25 min. (9:25 pm), the utility

believed pressure could soon be reduced to

a level at which the decay heat removal

system could be used.

Apparently, no one at this time realized that

a bubble still existed in the reactor coolant

system. Starting the reactor coolant pumps

swept the remaining gas in the upper part of

the system around with the water as discrete

bubbles. The gas bubbles would tend to

collect in the most quiescent part of the

system–theupperheadofthereactorvessel.

It is now known that the gas was largely

hydrogen. Hydrogen is slightly soluble in

water, and its solubility is greater at high

pressure. An attempt to depressurize the

system would cause some of the dissolved

hydrogen to effervesce out of the water. As

the pressure dropped, the bubble would grow

in size and interfere with circulation of the

reactor coolant.

In addition to growing in size, the bubble

and the dissolved gas made it impossible to

depressurize the reactor coolant system

completely. Ordinarily, reactor coolant
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-17 NUREG/CR-6042 Rev. 2

pressure is controlled by the size of the

steam bubble in the upper part of the

pressurizer. When this bubble contains only

steam, spraying cold water into the top the

pressurizer shrinks the bubble and reduces

the pressure. When the bubble contains a

gas like hydrogen, however, spraying does

not reduce the size of the bubble as much, so

there is less control over the pressure.

A related problem occurred in the letdown

system. As explained, hydrogen gas comes

out of solution when the pressure is reduced.

The gas from the letdown water collected in

the bleed tanks and makeup tank, increasing

the pressure and making it necessary to vent

the tanks often. The vented gas was not

pure hydrogen; it contained small amounts of

volatile radionuclides as well. There was

limited space available for holding the gas

released from the letdown flow. These two

factors made the reduction of pressure an

extremely slow process that took several

days to accomplish.

Natural circulation in the reactor coolant

system was finally established on April 27,

almost a full month after the accident began.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-18 NUREG/CR-6042 Rev. 2

Table 2.1-1 Chronology of Major TMI-2 Accident Events

Elapsed

Time

h:min:s

Event or Condition

-0:00:01 Condensate pump 1A and condensate booster pumps trip.

0:00:00 Feedwater pumps trip, turbine trips.

0:00:03 PORV opens at 2255 psig.

0:00:08 Reactor trip (control rods dropped) at 2355 psig.

0:00:13 PORV failed to reclose at 2205 psig.

0:00:15 Indicated pressurizer level peaked at 256 inches and began a rapid decrease.

0:00:14 Auxiliary feedwater pumps achieved normal discharge pressure.

0:00:15 Steam generator levels indicate 74 inches (startup range).

0:00:30 PORV and pressurizer safety valve outlet temperatures alarmed high.

0:00:38 Steam generator A water level at 23.8 inches. Auxiliary feedwater valves

open as level decreases below 30 inches and give dual indication on panel.

0:00:40 Steam generator B water level at 23.7 inches and decreasing.

0:00:41 Operator manually started one of the three makeup pumps (pump 1B).

0:00:54 Pressurizer level reached lowest level (158 inches) and started to rise.

? 0:01:00 NRC estimate of onset of steam void formation.

? 0:01:45 Steam generators A and B boiled dry.

0:02:01 High pressure injection initiated (1000 gpm) when reactor coolant pressure

fell below 1600 psig setpoint.

0:03:12 Reactor coolant drain tank relief valve began opening intermittently.

0:03:13 Operators bypassed the high pressure injection system.

0:03:28 Pressurizer high level alarm.

0:04:38 Operator throttled high pressure injection isolation valves and stopped

makeup pump 1C.

0:04:52 Second let-down cooler put in service to allow increased letdown.

0:05:00 Pressurizer level reached 377 inches and continued to rise.

0:05:15 An operator restarted condensate pump 1A.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-19 NUREG/CR-6042 Rev. 2

Table 2.1-1 Chronology of Major TMI-2 Accident Events (continued)

Elapsed

Time

h:min:s

Event or Condition

>0:05:15 Operators tried to restart condensate booster pump 2B but it tripped.

0:05:30 Saturated conditions indicated. Indicated reactor coolant temperature

(Th=582°F) and pressure (1340 psig) reached saturation.

0:06:00 Pressurizer steam bubble lost.

0:07:29 Reactor building sump pump 2A started (140 gpm).

0:08:00 Figure 2.4-5. Expansion/Saturation Due to LOFW/LOCA.

0:08:18 Operator opened auxiliary feedwater block valves.

0:10:19 Second reactor building sump pump (2A) started.

0:10:48 High (5.65 ft) reactor building sump level alarm. Sump soon overflowed

(6 ft).

0:11:43 Pressurizer level indication came back on scale and dropped rapidly

(20 inches in 1 min..) as reactor coolant loop temperatures continued to

decrease from the heat being removed by the steam generators.

0:14:48 Reactor coolant drain tank rupture disk blows.

? 0:14:50 Reactor coolant pump alarms sound.

0:18:00 Waste exhaust monitors showed a small increases in radioactive iodine.

Reactor building exhaust showed a tenfold increase in reading of

radioactive emissions.

0:22:00 Abnormal out-of-core source-range neutron flux behavior.

0:24:58 PORV outlet temperature was 285.4°F. Safety valve outlet temperature was

270°F.

0:28:00 Operators have been dispatched to the auxiliary building to confirm

pressurizer level indication and/or determine source of water that has

filled pressurizer.

>0:30:00 Emergency diesel generators shut off.

~0:36:00 Auxiliary feedwater pump 2B turned off.

0:38:10 Reactor building sump pumps turned off.

~0:40:00 Increasing count rate continued on the source range neutron detector.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-20 NUREG/CR-6042 Rev. 2

Table 2.1-1 Chronology of Major TMI-2 Accident Events (continued)

Elapsed

Time

h:min:s

Event or Condition

0:46:23 Letdown cooler monitor count rate began increasing. It would increase by

a factor of 10 within the next 40 minutes.

~0:50:00 Operators called on-call operating engineer to the site.

1:00:00 Figure 2.1-7. Reactor Coolant Voids Increasing.

1:11:00 Operators initiate reactor building cooling.

1:13:40 Loop B reactor coolant pumps turned off. Loop A pumps kept on to retain

pressurizer spray capability.

>1:14:00 Sample of reactor coolant indicates low boron concentration (700 ppm).

1:20:00 An operator had the computer print out the PORV (283°F) and pressurizer

safety valve (211°F and 219

oF) outlet temperatures.

1:27:00 Operators isolate steam generator B.

1:30:00 Figure 2.1-8. Loop-B Stagnates After Pumps Shut Off.

~1:30:00 Reactor coolant sample indicated 400-500 ppm boron and 4 ?Ci/ml.

1:40:40 Loop A reactor coolant pumps turned off.

1:42:30 Excore source-range detectors indicated increasing neutron flux levels.

Emergency boration initiated.

1:51:00 Loop A and B hotleg (Th) temperatures were increasing (eventually went

off-scale high - 620oF). Cold leg temperatures were decreasing.

2:00:00 Figure 2.1-9. Further Voiding After Loop-A Pumps Shut Off.

2:00:00 Conference call.

2:14:23 Reactor building air sample particulate radiation monitor went off scale.

2:18:00 Fifteen to twenty people in control room at this time.

2:19:00 PORV block valve closed, loss of coolant halted.

2:20:00 Vessel water level had dropped to about midcore.

2:29:00 Hotleg temperature indications passed the high end of the instrument

scale, 620oF.

2:30:00 1 R/h reported in makeup tank area of auxiliary building.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-21 NUREG/CR-6042 Rev. 2

Table 2.1-1 Chronology of Major TMI-2 Accident Events (continued)

Elapsed

Time

h:min:s

Event or Condition

2:38:23 Letdown cooler A radiation monitor went offscale high.

2:39:23 Two samples indicated the boron concentration in the reactor coolant

was 400 ppm. Emergency boration was started to avoid a reactor restart.

2:47:00 Alarm typewriter indication showed self-powered neutron detectors

responding to high temperature down to 4 foot level of the core.

90% of the core exit thermocouples >700°F.

2:48:00 Figure 2.1-10. Hydrogen Generation.

2:50:00 Start of melting, downward relocation, and crust formation.

2:54:00 Reactor coolant pump 2B was restarted and operated for 17 min.

2:56:00 Site emergency declared.

2:57:00 Fifty to sixty people are in control room; attempting to resolve the crisis.

3:00:00 Figure 2.1-11. Effects of Loop-B Pump Restart.

3:12:00 PORV block valve opened to control reactor coolant pressure.

3:20:00 Engineered safeguards actuated, makeup pump 1C started, HPI flow

increased.

3:21:00 Excore neutron instrumentation indicated a sharp decrease (reflood).

Reactor building dome radiation monitor read 8 R/h.

3:23:23 General emergency declared.

3:29:00 PORV block valve reclosed.

3:30:00 Figure 2.1-12 Vessel Refilled.

3:32:00 The makeup tank radiation level was at about 3 R/h, and the auxiliary

building basement was reported flooded with airborne radioactivity.

Spent-fuel demineralizer monitor read 250-900 mr/h. Source range monitor

count rate shows increase by a factor of three.

3:37:00 Operators tripped makeup pump 1C.

3:42:00 PORV block valve again opened.

3:44:00 Molten pour.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-22 NUREG/CR-6042 Rev. 2

Table 2.1-1 Chronology of Major TMI-2 Accident Events (continued)

Elapsed

Time

h:min:s

Event or Condition

3:55:39 Reactor building automatically isolated on high (>4 psig) pressure.

Makeup pump 1C started automatically.

>4:00:00 Over the next 90 minutes, core exit thermocouple readings were manually

obtained ranging from 217 to 2580°F.

4:18:00 Makeup pumps 1A and 1C tripped.

Operator attempted to restart pump 1A.

Switch was then placed in "Pull to Lock."

4:20:00 Reactor building dome radiation monitor records 600 R/h.

4:22:00 Makeup pump 1B was started.

4:26:00 Sustained high pressure injection after this time.

~4:30:00 Condensate system completely shut down. Problems with the condensate

system were continuing. The condenser had been steadily losing vacuum.

It was necessary to maintain steam to the main turbine seals in order

to operate the condenser at a vacuum. When main steam is not available,

seal steam is provided by the oil-fired auxiliary boiler. The auxiliary

boiler broke down, so that seal steam could not be maintained. It was,

therefore, necessary to shut down the condensate system completely.

4:40:00 Reactor building dome radiation monitor records 1000 R/h.

4:42:00 Auxiliary feedwater was turned off. Only a small amount of heat could be

removed by the steam generator because the upper part of the primary

system was filled by a mixture of steam and hydrogen gas. The water level

on the secondary side was rising because more auxiliary feedwater was

coming than was leaving as steam. At 4 hours 42 minutes, auxiliary

feedwater

was shut off.

~5:00:00 Reactor building dome radiation monitor reaches 6000 R/h.

5:15:00 Initial repressurization began, PORV block valve shut.

5:29:00 Emergency diesel fuel racks reset.

5:35:00 NRC Region 1 inspector reports no consideration of offsite evacuation,

since utility reports no significant leakage, and there has been no

significant off-site radioactivity yet.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-23 NUREG/CR-6042 Rev. 2

Table 2.1-1 Chronology of Major TMI-2 Accident Events (continued)

Elapsed

Time

h:min:s

Event or Condition

5:43:00 By cycling the PORV block valve, reactor coolant pressure was maintained

in the 1865-2150 psig range during the next 2 hours.

6:00:00 Figure 2.1-13. Repressurized, Attempting to Collapse Vapor Bubble.

6:04:00 Commenced filling steam generator A (to 97%) using condensate pumps.

6:10:00 Airborne radiation levels in Unit 2 control room require evacuation

of all but essential personnel.

6:17:00 Unit 2 personnel put on masks to protect against possible radiation.

6:27:00 Everyone, except essential personnel, started moving to Unit 1 control

room.

6:52:00 People leaving the Unit 2 control room fail to close the door properly,

possibly compromising the recirculation ventilation system.

7:00:00 Communications in the Unit 2 control room were hampered by respirators.

Communications problems led some personnel to remove respirators for

short periods.

7:00:00 A tour of the auxiliary building found 10 R/h at the radiation waste panel,

water standing on the floor in areas with floor drains, and the auxiliary

building sumps full.

7:08:00 Auxiliary feedwater pump 2A was started. Level in steam generator A

reached 100% (operating range).

7:38:54 Depressurization initiated to actuate core flood system.

7:40:00 Region 1 inspector reports that utility believes there will be no

radioactive release to the surrounding area.

8:00:00 Figure 2.1-14. Depressurizing, Releasing H2.

8:30:00 The power-operated emergency main steam dump valve was closed at the

request of corporate management.

8:41:00 Core flood tanks initiate, little flow.

9:04:00 Makeup pump 1C was shut off (concerned with borated water storage tank

inventory).

9:10:00 Initial depressurization halted.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-24 NUREG/CR-6042 Rev. 2

Table 2.1-1 Chronology of Major TMI-2 Accident Events

(continued)

Elapsed

Time

h:min:s

Event or Condition

9:50:00 Figure 2.1-15. Second Depressurization Initiated, Hydrogen Burn.

High pressure injection actuated.

Reactor building sprays actuated.

9:50:30 Makeup pump 1C was stopped.

9:57:00 Reactor building spray pumps were stopped.

10:26:15 Loop A Th<620oF. Stays on scale 10 minutes.

10:30:00 Figure 2.1-16 Reactor Coolant Pressure Near Minimum (400 psig).

11:06:00 Pressurizer level decreased to 180 inches in the next 18 minutes. Loop A

temperature was increasing.

11:08:00 Second depressurization attempt ends.

13:00:00 Figure 2.1-17. Steam Generators Blocked By Hydrogen.

? 13:00:00 About 13 hours after turbine trip, the auxiliary boiler was brought

back into operation. Steam for the turbine seals was now available

and it was possible to hold a vacuum on the condenser. Two condenser

vacuum pumps were started. It was the operator's belief that the main

condenser would soon be available.

13:20:00 Repressurization began.

14:35:00 NRC Region 1 inspector reported that there still appeared to be a bubble

in loop B.

15:00:00 Figure 2.1-18. Repressurized, Flow Blocked by Hydrogen.

15:33:00 Operator started reactor coolant pump 1A started, ran it for 10 seconds,

then tripped it.

15:45:00 The station superintendent directed operators to start a reactor coolant pump.

15:50:00 Operator started reactor coolant pump 1A and let it run continuously.

16:00:00 Figure 2.1-19. Forced Circulation Reestablished.
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-25 NUREG/CR-6042 Rev. 2

Figure 2.1-1 Arrangement of the primary reactor coolant system and related

support system for the Three Mile Island, Unit 2 (TMI-2)

Reactor (courtesy of R. Schauss and Construction Systems

Associates)
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-26 NUREG/CR-6042 Rev. 2

Fig

u

r

e

2.1-2

T

M

I-2

s

c

e

n

a

rio: initial c

o

n

ditio

n - sta

n

d

b

y

o

p

e

r

atio

n

at 9

7

%

p

o

w

e

r
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-27 NUREG/CR-6042 Rev. 2

Fig

u

r

e

2.1-3

C

o

n

d

e

n

s

ate

a

n

d

fe

e

d

w

ate

r

s

y

ste

m

s
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-28 NUREG/CR-6042 Rev. 2

Figure 2.1-4 TMI-2 scenario: reactor coolant pressure and pressurizer level

vs. time
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-29 NUREG/CR-6042 Rev. 2Figure 2.1-5 TMI-2 scenario: system nearly liquid solid, liquid expanding with increasing temperature
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-30 NUREG/CR-6042 Rev. 2

Fig

u

r

e

2.1-6

T

M

I-2

a

c

cid

e

nt r

a

diois

oto

p

e

r

ele

a

s

e

p

ath

w

a

y

s
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-31 NUREG/CR-6042 Rev. 2 Figure 2.1-7 TMI-2 scenario: primary system pressure and temperatures nearly constant following secondary steam condition, primary voids increasing
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-32 NUREG/CR-6042 Rev. 2 Figure 2.1-8 TMI-2 scenario: loop A pumps operating, loop B stagnant after shutdown of loop B pumps, primary voids increasing
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-33 NUREG/CR-6042 Rev. 2 Figure 2.1-9 TMI-2 scenario: all pumps off, reactor core drying out and heating up, superheated steam flowing to pressurizer and to one steam generator and condensing
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-34 NUREG/CR-6042 Rev. 2

t 2.8 h ou rs

P 1200 psig

M

Relief Block

Valve

Electromatic

Relief Valve (ERV )

Loop A Loop B

Pump

Off

Pump

Off

Primary Water

SecondaryWater

Steam

Steam/H ydro gen

Figure 2.1-10 TMI-2 scenar io: core dry out and heatup continuing, hy drogen g eneration by steam -

z irconium r eac tion in hotter reg ions

t 3 hours

P 2050 psig

M

Relief Block

Valve

Electromatic

Relief Valve (ERV )

Lo op A Lo op B

Pump

On

Pump

Off

Primary Water

Secon dary Water

Steam

Steam/H ydro gen

Figure 2.1- 11 TM I-2 sc enario: core partially quenched by fluid during loop B pum p start, heatup

r esumes
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-35 NUREG/CR-6042 Rev. 2

Figure 2.1-12 TMI-2 reactor vessel refilled by manual initiation of safety injection,

core temperatures decreasing
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-36 NUREG/CR-6042 Rev. 2

Figure 2.1-13 TMI-2 scenario: system pressurized by high-pressure injection system

intermittent liquid release through top of pressurizer, heat removal by

heatup of injected water, steam generator heat transfer blocked by

hydrogen
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-37 NUREG/CR-6042 Rev. 2

Figure 2.1-14 TMI-2 scenario: primary system depressurizing and releasing hydrogen

through the pressurizer into the containment
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-38 NUREG/CR-6042 Rev. 2

Figure 2.1-15 TMI-2 containment pressure versus time
Reactor Safety Course (R-800) 2.1 The TMI-2 Accident

USNRC Technical Training Center 2.1-39 NUREG/CR-6042 Rev. 2

References for Section 2.1

1. U.S. Nuclear Regulatory Commission,

"Investigation Into The March 28, 1979

Three Mile Island Accident by Office of

Inspection and Enforcement," NUREG0600, Investigative Report No. 50-

320/79-10, August 1979.

2. E. Rubinstein and J. F. Mason, "An

Analysis of Three Mile Island," IEEE

Spectrum, November 1979.

3. M. Rogovin, G. T. Frampton, et al.,

“ThreeMileIsland,A Reportto the

CommissionersandtothePublic,”U.S.

Nuclear Regulatory Commission,

NUREG/CR-1250, Volume II Part 2,

January 1980.

4. U. S. Nuclear Regulatory Commission,

“TMI-2Lessons LearnedTaskForce”

Final Report, NUREG-0585, 1980.

5. U. S. Nuclear Regulatory Commission,

“NRCActionPlanDevelopedasaResult

oftheTMI-2Accident,”NUREG-0669,

May

1980.

6. R. A. Knief, "The Accident at Three Mile

Island Unit 2," Chapter 15 of Nuclear

Energy Technology - Theory and Practice

of C o m m e rc i al Nuclear Power,

Hemisphere Publishing, 1991.
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-1 NUREG/CR-6042 Rev. 2

2.2 TMI-2 Implications

2.2.1 Introduction

The TMI-2 accident put to rest the notion

that severe nuclear power plant accidents

were not credible. Failure to diagnose and

compensate for loss of coolant from the

stuck open PORV led to substantial core

damage (oxidation and melting), which is

discussed further in Chapter 3. Yet, in spite

of the extensive core damage and the

combustion of hydrogen in containment, the

radionuclide releases to the environment

were very low. Of the 66 million curies of

radioactive iodine-131 in the reactor at the

time of the accident, only 14 or 15 curies

escaped to the environment.

Uncertainty about the causes of the accident,

confusion about how to deal with it, and

contradictory information and appraisals of

the level of danger in the days following the

accident often made utility and government

authorities appear inept, deceptive, or both.

Press accounts fed public fears and fostered

a deepening perception of a technology that

was out of control. Two days after the onset

of the accident (long after core cooling was

restored), the Governor of Pennsylvania

issued a pair of recommendations -- initially

for sheltering within 10 miles (16 km) and

later for closing schools and evacuating

pregnant women and pre-school children

within 5 miles (8 km). Despite the limited

scope of the recommended evacuation, there

was a spontaneous evacuation involving

some 144,000 persons from 50,000

households. Approximately two-thirds of the

households within 5 miles (8 km) of TMI-2

had at least one person evacuate. After one

week the decision was made to re-open the

schools, the evacuation order was lifted, and

most of the evacuees returned.

Almost immediately after the TMI-2

accident, the government and the nuclear

industry sought to identify the causes and

began taking steps to reduce the likelihood

of future accidents. Extensive corrective

actions for U.S. plants were required by the

NRC's TMI Action Plan1(see Section 2.2.4).

The first and most prominent formal

investigation of the accident was conducted

by the President's Commission on the

Accident at Three Mile Island, also known

for its chairman, John Kemeny.

2 Two

important NRC-sponsored investigations

were by the Special Inquiry Group or

Rogovin Committee, which addressed broad

accident issues, and the in-house Lessons

Learned Task Force (NUREG-0585), which

addressed concerns most germane to the

NRC's own activities.3,4In their reports, the

investigators emphasized many deficiencies

for which corrective actions were already in

progress. More significantly, the reports

strongly criticized the NRC, the utility, the

nuclear industry, and the reactor operators.

The TMI-2 nuclear steam supply system

design was found to have contributed to the

accident much less than the human factors

and attitudes involved. The investigators

also validated that the major health

consequence was

on the mental health of the people

living in the region, [including]

...immediate short-lived mental

distress produced by the accident.

A majority of the President's Commission

supported a moratorium on the licensing of

new nuclear power plants; however, such a

moratorium was not recommended in the

Commission's final report due to a lack of

consensus on guidelines for lifting the

moratorium once it was put into force. A

de facto moratorium ensued, however, as the

NRC delayed granting reactor licenses

pending resolution of relevant issues and

lessons learned from TMI-2.
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-2 NUREG/CR-6042 Rev. 2

2.2.2 NRC Restructuring

The President's Commission was highly

critical of the NRC and found that

the NRC is so preoccupied with the

licensing of (new) plants that it has

not given primary consideration to

overall safety issues.

In response to such criticisms, the NRC

reorganized to strengthen accountability and

give higher priority to plant safety. The

NRC emphasis shifted from licensing new

plants to regulating operating plants. This

was consistent with the work load resulting

from post-accident modifications to existing

plants, the de facto moratorium on licensing

new plants, and the cancellations and lack of

new orders that followed the TMI accident.

In addition, over several years, most of the

NRC's scattered headquarters offices in the

Washington, DC metropolitan area were

consolidated into a single building complex

placing individuals with safety-related

responsibilities (e.g., inspection and

enforcement, operating experience, and

research) in much closer proximity to each

other.

The need for "increased emphasis and

improved management" of NRC's inspection

and enforcement functions was addressed by

developing a strengthened enforcement

policy with substantial penalties for "failure

toreportnew ‘safety-related’information"

and for rule violations, expanding the

resident inspector program to station at least

two NRC inspectors at each plant site, and

regularly conducting team inspections. The

inspectors were now more concerned with

understanding plant operations and safety

than administrative compliance. One

comprehensive team inspection is the

Systematic Assessment of Licensee

Performance (SALP) program which rates

plants on a scale of one to three in each of

four areas (operations, maintenance,

engineering, and plant support). Systematic

assessment of licensee performance, together

with other NRC activities, were used to

enforc e h i gh e r organiz ational and

management standards for licensees.

The NRC established a new Office for

Analysis and Evaluation of Operational Data

to systematically review information from

the performance of operating plants. This

action was in response to the belated

recognition that malfunctions similar to

those at TMI had occurred at other plants,

but the information had not been assimilated

or disseminated in a way that could have

averted the TMI accident.

In addition to the organizational changes

described above, the NRC initiated major

changes affecting operator training and

licensing, operating plant configurations,

emergency response, severe accident

research, plant licensing, and regulatory

decision making. These initiatives are

discussed in later sections.

2.2.3 Nuclear Industry Restructuring

The President's Commission concluded that

the nuclear industry

must dramatically change its attitudes

towards safety and regulations [and]

...must also set and police its own

standards of excellence to ensure the

effective management and safe

operation of nuclear power plants.

The Commission charged that the industry

had a mind-set that plants were "sufficiently

safe" and emphasized that this attitude

must be changed to one that says

nuclear power is by its very nature

potentially dangerous, and ... one

must continually question whether the
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-3 NUREG/CR-6042 Rev. 2

safeguards already in place are

sufficient to prevent major accidents.2

The industry response to the accident

demonstrated a significant change in attitude.

Three key issues were singled out for prompt

attention: ineffective reactor safety

information exchange, difficult operatormachine interfaces, and inadequate operator

training. The U. S. nuclear utilities

established several organizations to deal with

these issues in the near term and with a

broader spectrum of technical and

management issues in the longer term.

The utilities established the Nuclear Safety

Analysis Center (NSAC) under the Electric

Power Research Institute (EPRI) to develop

strategies for minimizing the possibility of

future reactor accidents and to answer

generic reactor safety questions. Nuclear

Safety Analysis Center was also charted to

recommend changes in safety systems and

operator training, to act as a clearing house

for technical information, to perform

analyses of significant reactor transients, and

to participate in performing probabilistic risk

assessments.

The utilities also formed the Institute of

Nuclear Power Operations (INPO). The

Institute has served to establish industrywide qualifications, training requirements,

and testing standards first for nuclear-plant

operators and subsequently for technicians,

engineers, and managers. The INPO plant

evaluation program serves an audit and

testing function for utility staffs. INPO

provides guidance and training for those

responsible for training programs, rather than

dealing directly with individual operating

personnel. Compliance with INPO criteria is

judged by the National Nuclear Accrediting

Board, an independent organization with

expertise that encompasses training,

university education, management, and

regulation from both inside and outside the

nuclear-utility industry. Each U. S. utility

becomes a member of the INPO-chartered

National Academy of Nuclear Training when

accreditation is earned at each of its reactor

sites for ten designated training programs.

C o n t i n u i n g m e m b e r s h i p r e q u i r e s

reaccreditation every four years.

The industry later established the Nuclear

Utility Management and Resources Council

(NUMARC) to deal with personnel-related

and licensing issues, support self-initiated,

self-policed plant performance and safety

improvements.

The utilities also established a selfsponsored insurance program that provides

coverage for replacement power costs in the

event of a prolonged post-accident reactor

shutdown. This, of course, is intended to

limit the financial consequences of accidents

(e.g., in 1980 the cost for the TMI-2

recovery was estimated at $973 million,

exclusive of replacement power costs) and

provide more stability on an industry-wide

basis.

2.2.4 Plant Modifications

The TMI accident led to a number of

investigations of the adequacy of design

features, operating procedures, and personnel

of nuclear power plants to provide assurance

of no undue risk regarding severe reactor

accidents. The report "NRC Action Plan

Developed as a Result of the TMI-2

Accident" (NUREG-0660, May 1980)

describes a comprehensive and integrated

plan involving many actions that serve to

increase safety when implemented by

operating plants and plants under

construction.1 The items approved for

implementation by NRC are identified in the

report "Clarification of TMI Action Plan

Requirements" (NUREG-0737, November

1980).5 The staff issued further criteria on

auxiliary feedwater system improvements
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-4 NUREG/CR-6042 Rev. 2

( derived from NUREG-0667), a n d

instrumentation (Regulatory Guide 1.97,

Revision 2).6,7 The TMI Action Plan led to

requirements for over 6,400 separate action

items, an average of 90 action items per

plant. There were 132 different types of

action items approved. Of these, 39

involved equipment backfit items, 31

involved procedural changes, and 62

required analyses and reports.

Many of the action items addressed smallbreak and transient initiated accidents. Their

significance had previously been identified

b y WA S H - 1 4 0 0 a n d i t s r e v i e w s .

Traditionally, attention had been on the

design-basis large break LOCA. A major

shift in emphasis toward small breaks and

transients resulted from the TMI-2 accident.

Many procedural, software, and hardware

modifications were implemented to detect

and mitigate such accidents as well as to

monitor radiation-releases and other postaccident symptoms.

Considerable emphasis was placed on

improving the operator-machine interface.

Control rooms were reviewed for adequacy

of the operator-machine interface as well as

for habitability during accidents. Detailed

analysis of operator tasks supported the

development of new symptom-based

operating procedures and improvements in

control-panel hardware arrangements and

markings, alarm and annunciator priorities

and configurations, and computer-based data

collection and display systems. Safety

parameter display systems (SPDS) were

installed to aid diagnosis and decision

making. One example of a safety parameter

display system, called a "PT-plot," graphs

PWR primary and secondary system

pressures and temperatures highlighting

regions corresponding to over-cooling

transients, under-cooling transients, and

LOCAs. Emergency safety feature actuation

systems were improved to provide an

unambiguous control-room display of the

status of all safety systems.

The TMI-2 accident led to increased

emphasis on the importance of containment

survival during severe accidents. While the

changes to containments were not as

numerous as the changes to other plant

systems, additional hydrogen control

measures were implemented for some plants.

These changes are discussed in more detail

in Chapter 4.

2.2.5 Operator Training and Licensing

The TMI-2 accident highlighted the

importance of operators in responding to

evolving accident conditions. In some

countries, a "hands off" approach is taken,

where the operators do not take action for a

specified time period, so as not to make a

situation worse before they understand what

is going on. In the U.S., operators are

actively involved from the outset, and it is

important that the actions taken be positive

ones. Following the TMI-2 accident, the

NRC developed stringent new requirements

for operator training, testing, and licensing,

and for shift scheduling and overtime. In

cooperation with industry groups, NRC

promoted the increased use of reactor

simulators. Before the TMI-2 accident, it

was common for operators to train for

requalification at a "generic" simulator,

spending 90% of their simulator time on

normal operations with the remainder

emphasizing the design-basis large-break

LOCA. Now each plant is required to have

a plant-specific simulator, Simulator time is

spent primarily on covering the entire

spectrum of postulated transients and

accidents. The NRC added extensive

simulator exercises to the traditional reactoroperator (RO) and senior-reactor-operator

(SRO) exams and plant walk-throughs.

Annual requalification exams, similar to the

initial NRC exams are now administered by
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-5 NUREG/CR-6042 Rev. 2

the utility, subject to NRC approval and

validation. In addition, the NRC added

requirements for a new Shift Technical

Adviser (STA) to provide engineering

capability on each control-room shift.

2.2.6 Emergency Response Improvements

Given the confusion and uncertainty

experienced during the TMI-2 accident and

the subsequent evacuation, the NRC took

steps to upgrade emergency preparedness and

planning. New rules and guidelines were

developed. Emergency response capabilities

were expanded with improved plans,

equipment, and facilities. Emergency

response personnel from industry, the NRC,

the Federal Emergency Management Agency

(FEMA), and local organizations now

receive extensive training and are evaluated

by periodic drills. Site plans and procedures

address

• accident recognition and classification,

• declaration and initial notification,

• communication networks,

• response readiness.

The NRC now requires dedicated emergency

operations facilities (NUREG-0737, Rev. 1)

to be constructed, maintained, and tested

near each plant.8 During any future accident,

a joint information center would provide a

common location for utility, federal, state,

and local representatives to communicate

with the media. Public notification and

information channels have been established.

2.2.7 Seabrook and Shoreham

In the aftermath of the TMI-2 accident, the

NRC temporarily suspended the granting of

full power operating licenses. This de facto

moratorium ended 16 months after the

accident (August 1980) when a full-power

operating license was issued to North

Anna-2. (Granting of low power licenses

had resumed earlier, starting with Sequoyah.)

During the rest of the 1980s, the NRC

granted full-power licenses to over forty

other reactors, most of which had received

construction permits in the mid-1970s. In

1985 it authorized the undamaged Three

Mile Island Unit 1, which had been shut

down for refueling at the time of the TMI-2

accident, to resume operation.

Although many of the licensing actions

aroused little opposition, others triggered

major controversies. The two licensing

cases that precipitated what were perhaps the

most bitter, protracted, and widely

publicized debates were Seabrook in New

Hampshire and Shoreham on Long Island,

New York. The key, though hardly the sole,

issue in both cases was emergency planning.

The Three Mile Island accident had vividly

demonstrated the deficiencies in existing

procedures for coping with an off-site

nuclear emergency. The lack of effective

preparation had produced confusion,

uncertainty, and panic among members of

the public faced with the prospect of

exposure to radiation releases from the plant.

After the accident, the NRC, prodded by

Congress to improve emergency planning,

adopted a rule that required each nuclear

utility to come up with a plan for evacuating

the population within a ten mile radius of its

plant(s) in the event of a reactor accident.11

The rule applied to plants in operation and

under construction. It called for plant

owners to work with state and local police,

fire, and civil defense authorities on

emergency plans that would be tested and

evaluated by the NRC and the FEMA. The

NRC expected cooperation between federal,

state and local government officials to

upgrade emergency plans and provide better

protection for the public should a serious

nuclear accident occur.

The NRC did not, however, anticipate that

state and local governments would try to
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-6 NUREG/CR-6042 Rev. 2

prevent the operation of nuclear plants by

refusing to participate in emergency

preparations. That was precisely what the

states of New York and Massachusetts

sought to do in the cases of Shoreham and

Seabrook. In New York, Governor Mario M.

Cuomo and other state officials claimed that

it would be impossible to evacuate Long

Island if Shoreham suffered a major

accident. Therefore, the state refused to join

in emergency planning or drills. The NRC

granted Shoreham a low-power operating

license, but the state and the utility, Long

Island Lighting, eventually reached a

settlement in which the company agreed not

to operate the plant in return for concessions

from the state.

A similar issue arose at Seabrook, though

the outcome was different. The plant is

located in the state of New Hampshire, but

the ten mile emergency planning zone

extends across the state line into

Massachusetts. By the time that construction

of the plant was completed, Massachusetts

Governor Michael S. Dukakis, largely as a

result of Chernobyl, had decided that he

would not cooperate with emergency

planning efforts for Seabrook. New

Hampshire officials worked with federal

agencies to prepare an emergency plan, but

Massachusetts, arguing that crowded beaches

near the Seabrook plant could not be

evacuated in the event of an accident,

refused. As a result of the positions of New

York regarding Shoreham and Massachusetts

regarding Seabrook, in 1988 the NRC

adopted a "realism rule," which was

grounded on the premise that, in an actual

emergency, state and local governments

would make every effort to protect public

health and safety.

12 Therefore, in cases in

which state and/or local officials declined to

participate in emergency planning, the NRC

and FEMA would review and evaluate plans

developed by the utility. On that basis, the

NRC issued an operating license for the

Seabrook plant. The arguments that raged

over emergency planning and other issues at

Shoreham and Seabrook attracted a great

deal of attention, spawned heated

controversy, and raised anew an old question

of the relative authority of federal, state, and

local governments in licensing and

regulating nuclear plants.

2.2.8 Severe Accident Research

Following TMI-2, NRC research was

redirected to focus on severe accidents. This

research had several objectives, including:

1. to obtain a better understanding of the

physical phenomena of severe accidents,

2. to develop models of these phenomena in

order to predict the ways that severe

accidents might progress,

3. to develop more realistic estimates of the

radionuclide releases that could result

from severe accidents, and

4. to examine available data sources and

existing PRAs to identify the important

accident sequences for various classes of

reactors.

In order to meet these objectives, major

research programs were started at the

national laboratories and universities.

Eventually the results of these efforts were

integrated together in a major PRA for five

reference plants (NUREG-1150).13 NUREG1150 essentially replaces the Reactor Safety

Study in terms of providing current severe

accident perspectives and insights. Both the

severe accident research and NUREG-1150

are discussed in more detail in later

modules.

The Industry Degraded Core Rulemaking

(IDCOR) Program, under the sponsorship of

the Atomic Industrial Forum, was conducted
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-7 NUREG/CR-6042 Rev. 2

in parallel with the NRC research efforts.

The IDCOR group concentrated on

developing models for assessing the risks of

severe accidents. IDCOR models were used

to analyze four of the five NUREG-1150

reference plants. This facilitated the

identification and resolution of modeling

differences.

2.2.9 Severe Accident Policy

In August 1985, when the bulk of the actions

required by the TMI Action Plan had been

completed, the NRC issued a policy

statement on severe accidents.14 A policy

statement is not a regulation in the sense

that it does not impose specific

requirements, but rather provides the

Commission's rationale and motivation for

future regulatory positions. On the basis of

available information from the Severe

Accident Research Program, the Commission

concluded that existing plants pose no undue

risk to the public and that no immediate

additional regulatory changes were

recommended for these plants to address

severe accidents. Note that many changes

had already occurred, such as changes in

operator training and implementation of

hydrogen control measures for some

containment types. Even with these changes

and the stated finding of no undue risk, the

NRC recognized that there was still much

uncertainty in the phenomena associated with

severe accidents, and the Severe Accident

Policy included rationale for continuation of

the Severe Accident Research Program. If

the research uncovers further issues or

questions of undue risk, then the

Commission can act at that time.

Past research has indicated the plant-specific

nature of severe accident vulnerabilities.

Therefore, the Severe Accident Policy stated

the desirability of performing a systematic

examination of each nuclear power plant in

order to identify potential plant-specific

vulnerabilities to severe accidents. Three

years later, the NRC issued a generic letter

(88-20) and guidance (NUREG-1335), which

called for licensees to perform a systematic

Individual Plant Examination (IPE) of each

nuclear power plant operating or under

construction.15,16 The stated purpose of the

Individual Plant Examination was to have

each utility:

1. develop an appreciation of severe

accident behavior;

2. understand the most likely severe

accident sequences that could occur at its

plant;

3. gain a more quantitative understanding

of the overall probabilities of core

damage and fission product releases; and

4. if necessary, reduce the overall

probabilities of core damage and fission

product releases by modifying, where

appropriate, hardware and procedures that

would help prevent or mitigate severe

accidents.

The IPE Generic Letter makes it clear that a

major benefit from this activity is the

education of the utility staff in the area of

severe accidents. The utilities are expected

to perform much of the analysis in-house and

not rely solely on consultants for performing

the analysis.

IPE results were to be reported to the NRC

within three years according to guidance

provided in NUREG-1335. The results of

the IPE have been reviewed by the NRC.

Section 2.5 provides a discussion of these

results, which will be used, in part, to deal

with Unresolved Safety Issues and Generic

Safety Issues. The IPE submittals indicate

whether particular issues apply to the plant

and the utility's case for resolution.
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-8 NUREG/CR-6042 Rev. 2

The severe accident policy recommends that

new plants be shown to be acceptable for

severe accidents by meeting specified criteria

and procedural requirements, which include

completion of a Probabilistic Risk

Assessment (PRA) and consideration of the

severe accident vulnerabilities that the PRA

exposes.
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-9 NUREG/CR-6042 Rev. 2

References for Section 2.2

1. U. S. Nuclear Regulatory Commission,

“NRC Action Plan Developed asa

Result of the TMI-2 Accident,”

NUREG-0660, May 1980.

2. John G. Kemeny,etal.,“Reportofthe

President's Commission on the

Accident at Three Mile Island,”

October 1979.

3. M.Rogovin,etal.,“ThreeMileIsland,

A Report to the Commissioners and to

thePublic,”U.S.NuclearRegulatory

C o m m i s s i o n , N U R E G / C R - 1 2 5 0 ,

January 1980.

4. U. S. Nuclear Regulatory Commission,

“TMI-2LessonsLearnedTask Force

FinalReport,”NUREG-0585,October

1979.

5. U. S. Nuclear Regulatory Commission,

“Clarification of TMI Action Plan

Requirements,” NUREG-0737,

November 1980.

6. U. S. Nuclear Regulatory Commission,

“Transient Response of Babcock &

Wilcox-DesignedReactors,”NUREG0667.

7. U.S. Nuclear Regulatory Commission,

R e g u l a t o r y G u i d e 1 . 9 7 ,

“InstrumentationorLight-Water-Cooled

Nuclear Power Plants to Assess Plant

and Environs Conditions During and

FollowinganAccident,”Revision2,

December 1980.

8. U.S. Nuclear Regulatory Commission,

“Clarification of TMI Action Plan

Requirements,” NUREG-0737,

Supplement 1, January 1983.

9. Federal Register, Vol. 45, 55,402,

August 19, 1980.

10. J. Samuel Walker,“AShortHistoryof

Nuclear Regulation 1946-1990,”

Historical Office, Office of the

S e c r e t a r y, N u c l e a r R e g u l a t o r y

Commission, June 1991, p.38.

11. U. S. Nuclear Regulatory Commission,

“SevereAccidentRisks:AnAssessment

forFiveUS NuclearPowerPlants,”

NUREG-1150, December 1990.

12. Federal Register, Vol. 50, 32,138,

August 8, 1985.

13. U. S. Code of Federal Regulations,

“Individual Plant Examination for

Severe Accident Vulnerabilities,”Title

10, Part 50.54, (f) Generic Letter 88-

20, Nov 23, 1988.

14. U. S. Nuclear Regulatory Commission,

“Individual Plant Examination:

SubmittalGuidance,” NUREG-1335,

August 1989.
Reactor Safety Course (R-800) 2.2 TMI-2 Implications

USNRC Technical Training Center 2.2-10 NUREG/CR-6042 Rev. 2

1. NRC Action Plan Developed as a Result of the TMI-2 Accident, NUREG-0660, May

1980.

2. John G. Kemeny, et al., Report of the President's Commission on the Accident at Three

Mile Island, October 1979.

3. M. Rogovin, et al., Three Mile Island, A Report to the Commissioners and to the Public,

NUREG/CR-1250, January 1980.

4. TMI-2 Lessons Learned Task Force Final Report, NUREG-0585, October 1979.

5. Clarification of TMI Action Plan Requirements, NUREG-0737, November 1980.

6. United States Nuclear Regulatory Commission, Transient Response of Babcock & WilcoxDesigned Reactors, NUREG-0667.

7. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.97, Instrumentation for LightWater-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and

Following an Accident, Revision 2, December 1980.

8. Clarification of TMI Action Plan Requirements, NUREG-0737, U.S. Nuclear Regulatory

Commission, November 1980, Supplement 1, January 1983.
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-1 NUREG/CR-6042 Rev. 2

2.3 The Chernobyl Accident

The worst nuclear power plant accident

occurred on April 26, 1986 at unit 4 of the

nuclear power station at Chernobyl in the

Ukraine. A violent explosion destroyed the

Chernobyl-4 reactor, blew its top off, and

spewed large amounts of radioactive material

into the environment. The accident occurred

during a test in which operators had turned

off the plant's safety systems and then lost

control of the reactivity in the reactor. The

subsequent reactivity excursion led to a

massive vapor explosion, followed by

hydrogen combustion and a graphite fire that

lasted several days. The areas around the

plant were highly contaminated and 31

workers died, 28 from acute radiation

sickness.

The radioactive plume spread far into other

parts of the former Soviet Union and Europe.

Although the plume did not pose a threat to

the United States, one measure of its

intensity was that levels of iodine-131

around Three Mile Island were three times

higher after Chernobyl than they were after

the TMI-2 accident.1

In many ways, the pre-Chernobyl attitude

toward nuclear safety in the former Soviet

Union was similar to the pre-TMI attitude in

the United States. Influencedbythe“it

can’thappen”mindset,operatingpersonnel

who were impatient to conduct a test took

actions that violated procedures and began

the accident. The accident took on

catastrophic proportions as the result of

undesirable reactor design features.2 This

section provides a brief overview of the

Chernobyl reactor design, a description of

the sequence of events leading to the

accident, and a discussion of the relevance

of the accident to U.S. plants.

2.3.1 Chernobyl-4 Design Features

The Chernobyl-type reactors have undergone

many design and operation changes since the

accident at Chernobyl-4. The discussion

below portrays the design as it existed at the

time of the accident and does not reflect the

many changes that have since occurred.

The Chernobyl site in located in the Ukraine

and contains four RBMK reactors. As

shown in Figure 2.3-1, the RBMK design is

a graphite-moderated, light water cooled,

pressure tube reactor.

3 The RBMK-1000

design generates approximately 1000 MWe.

The reactor has 1661 vertical pressure tubes

that contain slightly enriched uranium

dioxide fuel elements. The fuel tubes are

made of a zirconium alloy and contain water

at a pressure of about 1000 psig (7.1 MPa).

The water acts as a coolant, but unlike U.S.

reactors, is not the primary moderator of

neutrons.

The graphite moderator is 39 ft. (12 m) in

diameter and 23 ft. (7 m) high. The fuel

tubes pass up through the moderator

assembly. Cooling water flows upward

through the core with steam collected and

driven through two turbines to generate

electricity. Eight pumps return the water to

the core. One of the most significant

problems of the Chernobyl-4 core design was

a positive void coefficient of reactivity. As

boiling in the core increased, the power level

increased. There were also problems with

the reactivity control systems. 180 control

rods are inserted from the top to control the

reactor. To further exacerbate the reactivity

problem, the control rods moved slowly and

under some situations the control rods did

not immediately introduce negative reactivity

in the early phases of insertion.
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-2 NUREG/CR-6042 Rev. 2

RBMKs do not employ a U.S. style

containment building; however, they are not

totally without containment. The graphite

moderator is enclosed in a steel container

filled with inert gases to prevent graphite

fires. The steel container is further

surrounded by a concrete structure on all

sides but the top. The Russian design

document speaks of compartmentalized

containment to limit the spread of

radionuclides in the event of a pipe rupture.

Much of the primary system piping is

contained in small concrete compartments.

Each compartment is designed to withstand

a double-ended guillotine break of the

largest pipe in the compartment. The

structure surrounding the reactor was

designed to withstand the rupture of 3

pressure tubes.

2.3.2 The Chernobyl Experiment

The Chernobyl accident began on April 25

with an experiment.1 The experiment was a

test designed to demonstrate that, in the

event of a turbogenerator disconnection and

the loss of offsite power, the inertia of the

turbine rotor could be used to help maintain

emergency power while the standby diesel

generators were started. This in turn could

relieve the diesel generators of the rapid

startup requirements and associated stresses

on the equipment. While such tests are not

unknown, the procedures for the test were

very poor, there was a desire to complete the

tests quickly, and the operators lacked a

complete understanding of the hazards

involved.

Virtually no additional safety measures were

taken during the test. The safety procedures

indicated that all switching operations were

to have the permission of the plant shift

foreman and that during an emergency the

staff members were to follow plant

instructions. (There were no specific

instructions for these conditions.) This

situation was in spite of the fact that the

experiment called for deactivation of the

Emergency Core Cooling System, so that it

would not automatically actuate as the

circulation pumps ran down.

2.3.3 The Sequence of Events

The material in this section was taken

primarily from a September 11, 1986 special

issue of Nuclear News.

3 This special issue

contains an analysis of the accident by

Valery Legasov of the Soviet Union as

presented to an International Atomic Energy

Agency conference in Vienna. Legasov

presented a candid view of the accident,

including many side comments. He noted,

for example, that there would have been

pressure on the operators to complete the

tests as they shutdown on this occasion,

because the next planned maintenance period

was more than a year away. He also said

that, in hindsight, it can be seen that

technical means could easily have been used

to prevent the operators from overriding

safety protection systems and otherwise

violating procedures. Failure to provide

adequate protection for such human error

represented "a tremendous psychological

mistake" on the part of the designers of the

RBMK reactor.

The run up to the accident started at 1:00

a.m. on April 25, with the reduction of

reactor power over the next five minutes

from 100% (3200 MWt) to half that power.

Then the unwanted turbogenerator was shut

down. The plant systems that had been

connected to this turbogenerator, including

four of the main circulation pumps and two

feedwater pumps, were switched to the grid

busbars of the turbogenerator that was still

on line.
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-3 NUREG/CR-6042 Rev. 2

At 2:00 pm, the ECCS was isolated to

prevent it from kicking in automatically.

The start of the test, however, was then

postponed at the request of the local

electricity dispatcher. As a result, the plant

was maintained in the unauthorized state

with no ECCS for the next nine hours,

although this particular violation did not in

actuality play any important part in what

followed. Still, the delay may have

aggravated operator impatience over the test,

and contributed to the "mindset" that led

plant personnel to ignore procedures and

block safety systems in their effort to get the

plant to the proper power level for the test.

At 11:10 pm, the load demand was lifted,

and preparation for the test resumed with

power reduced to the required level, 700-

1000 MWt. The automatic control system

that operates on groups of control rods in 12

zones of the core, to stabilize power density

distribution, was switched off, in keeping

with a low-power operation requirement. At

higher power levels, these zonal rods also

regulate the average power automatically.

When the local controllers are switched off,

automatic controllers working on a signal of

the average power of the whole core come

into play, but it appears that the operators

did not synchronize this automatic system

quickly enough to the required power

setpoint. There was an overshoot in the

power reduction, and the level fell below 30

MWt.

By 1:00 am on April 26, the operators were

able to stabilize the power back at 200 MWt,

but this was as high as they could get it due

to the xenon poison buildup that had started

during the excursion to lower power and was

still continuing. To drag the reactor up to

200 MWt, the operators had pulled far too

many of the manual control rods out of the

reactor, and the neutron flux distribution in

the core was such that the reactivity worth of

those rods that would be effective in the first

few centimeters of travel back into the core

was limited to the equivalent of six to eight

fully inserted rods.

According to the rules, the operating margin

of reactivity should not be allowed to go

below 30 rod equivalents without special

authorization from the chief engineer of the

power station. Legasov said that if the

margin ever falls below 15 rod equivalents,

"nobody in the whole world, not even the

Prime Minister, can authorize continued

operation of the reactor." But the operators

were so intent on getting the reactor up to an

acceptable power level for the test that they

ignored the touchy side of the reactor.

Thus, the operators at Chernobyl-4 decided

to press on, and at 1:03 and 1:07 a.m., they

started the sixth and seventh main

circulation pumps in immediate preparation

for the tests. Since the reactor power, and

consequently the hydraulic resistance of the

core and the recirculation circuit, were

substantially lower than planned, the full

eight pumps produced a massive coolant

flow through the reactor, 245,000 to 255,000

gpm (56,000 to 58,000 m3/hr). At some

individual pumps, the flow was up to 35,000

gpm (8000 m3/hr), compared with a normal

operating level of 30,000 gpm (7000 m3/hr).

This was another violation, because of the

danger that pump breakdown and vibration

could be caused by cavitation at the pumps.

But the most serious consequence of the

increased flow was the creation of the

coolant conditions very close to saturation,

with the possibility that a small temperature

increase could cause extensive flashing to

steam. The steam pressure and the water

level in the steam separation drums had also

dropped below emergency levels, but, as part

of the continuing attempt to keep the reactor

running long enough for the test to be

started, the operators also blocked the
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-4 NUREG/CR-6042 Rev. 2

resulting signals of the low levels to the

emergency protection system.

At 1:19 a.m., the feedwater supply was

increased to as much as four times its initial

value in an attempt to restore the water level

in the steam separation drums. This reduced

both the reactor coolant inlet temperature

and fuel channel steam production, with

consequent negative reactivity effects.

Within 30 seconds the automatic control

rods had fully withdrawn in response to the

negative reactivity, and the operators

attempted to withdraw the manual rods as

well. But the operators again overcompensated, and the automatic rods began

to move back in.

At 1:22 a.m., the reactor parameters were

approximately stable, and the decision was

made to start the actual turbine test. But in

case they wanted to repeat the test again

quickly, the operators blocked the emergency

protection signals from the turbine stop

valve, which they were about to close, so

that it would not trip the reactor. Also, just

before they shut off the steam to the turbine,

they sharply reduced the feedwater flow back

to the initial level required for the test

conditions. This boosted the coolant inlet

temperature, creating a transient situation

that could not be addressed because safety

systems were cut off.

At 1:22:30 a.m., the operators obtained a

printout from the fast reactivity evaluation

program, giving them the position of all the

rods and showing that the operating

reactivity margin had fallen to a level that

required immediate shutdown of the reactor.

But they delayed long enough to start the

test. There was clearly a failure to

appreciate the basic reactor physics of the

system, which had rendered the control rods

relatively worthless. The neutron flux

distribution in the core had been pulled into

such a distorted shape that the majority of

the rods would have go to well into the core

before they would encounter sufficient

neutron flux for their absorption to be

effective.

At 1:23:04 a.m., the turbine stop valve was

closed. With the isolation of the turbine,

four of the primary circulation pumps started

to run down, another transient situation for

which the automatic responses had been cut

off.

Shortly after the beginning of the test, the

reactor power began to rise sharply. The

bulk of the coolant was very close to the

saturation point at which it would flash to

steam, because the operators had earlier run

an excessive level of coolant flow with all

eight pumps on during low power reactor

operation. The RBMK reactor, with its

positive void coefficient, responds to any

such formation of steam with an increase in

reactivity and power, and further increases in

temperature and steam production resulting

in a runaway condition.

At 1:23:40 a.m., the scram button, which

would drive all control rods into the core,

was pushed. Legasov told the Vienna

meeting that there seemed to be some

ambiguity about the motivation for this

action, as unearthed during subsequent

questioning by investigators of the fatally ill

shift foreman, who had given the order. He

may have been belatedly responding to the

printout of reactivity margin; he could have

been responding to the sharp rise in reactor

power; or he may simply have believed that

the test had now run long enough to allow

him to shut down the reactor.

After a few seconds a number of shocks

were felt in the control room, and the

operator saw that the control rods had not

reached their lower stops. He therefore
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-5 NUREG/CR-6042 Rev. 2

deactivated the rods to let them fall by

gravity.

At about 1:24 a.m., observers outside the

plant reported two explosions, one after the

other; burning lumps of material and sparks

shot into the air above the reactor and some

fell onto the roof of the turbine hall and

started a fire.

In his presentation of Table 2.3-1, which

delineates the operator violations, at the

Vienna meeting, Legasov said that if any one

of the first five violations had not been

committed, the accident would not have

happened.

2.3.4 Inside the Reactor

The mechanism of the accident, particularly

in the last few seconds before the explosion

that literally blew the top off the reactor,

was the subject of intense interest for one of

the working groups at the meeting. By the

end of the week, the consensus of

international experts was that the accident

mechanism as described in the Soviet report,

a prompt critical reactivity excursion and a

steam explosion, was a wholly plausible

explanation for what happened. There is

still a need for more detailed understanding

of the mechanism, and some doubts linger

on the cause of a second explosion that was

reported to have taken three or four seconds

after the first.

The prompt critical excursion took the power

first to around 530 MWt at 1:23:40, and only

the Doppler effect of the fuel heating up to

an estimated 3000oC pulled it back down

briefly. The continuing reduction of water

flow through the fuel channels during the

power excursion led to intensive steam

production, the destruction of the fuel, a

rapid surge of coolant boiling (with the

particles of destroyed fuel entering the

boiling water), a rapid and destructive

increase of pressure in the fuel channels, and

finally the explosion that destroyed the

reactor.

At precisely the moment of fuel disruption,

which was believed to occur when the

energy density in the fuel exceeded 540

Btu/lbm (1260 J/g), there was an abrupt fall

of the coolant flow as check valves on the

main circulation pumps closed in response to

the increased pressure in the core. This loss

of flow was also recorded by the datalogging system. The flow from the pumps

would have been partially restored after the

rupture of the fuel channels, but the water

was now directed into a mass of damaged

zirconium and hot graphite. The ensuing

reaction would have produced large amounts

of hydrogen and carbon monoxide, which,

upon contact with air above the reactor,

could have caused the second explosion.

2.3.5 Implications for U.S. Plants

U.S. reactors employ very different designs

than Chernobyl-4. First, all U.S. power

reactors have negative reactivity coefficients

in virtually every situation, and control rods

in U.S. plants provide fast negative

reactivity insertion. Further, disabling of

safety systems in violation of technical

specifications is not expected to knowingly

occur. The level of safety-related training is

much higher than that attained at Chernobyl

prior to the event. In addition, as discussed

in Chapter 4, all U.S. power reactors employ

large strong containment structures. Such a

structure might not have been effective

against the enormous energy releases of

Chernobyl, but would be effective in many

postulated severe accidents at U.S. plants.

One U.S. reactor, the N Reactor at Hanford,

Washington, was shut down following

Chernobyl. The design of the N Reactor
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-6 NUREG/CR-6042 Rev. 2

included pressure tubes and graphite

moderation, but was different from

Chernobyl in many other respects. However,

the reduced need for the plutonium that it

produced coupled with adverse publicity and

safety concerns led to the ultimate shutdown

and mothballing of the N Reactor.

Supporters of nuclear power emphasized that

a Chernobyl-type accident could not occur in

commercial U.S. plants (or other nations),

which featured safety systems and

containments to prevent the release of

radionuclides. But nuclear critics pointed to

Chernobyl as the prime example of the

hazards of nuclear power. The Chernobyl

tragedy was a major setback to the hopes of

nuclear proponents to win public support for

the technology and to spur orders for new

reactors. U. S. utilities had not ordered any

new plants since 1978 and the number of

cancellations of planned units was growing.

The Chernobyl accident added a new source

of concern to long-standing controversies

over the licensing of U.S. plants.

The Chernobyl accident could not be

repeated at a U.S. nuclear power plant due to

fundamental differences in reactor design.

Nevertheless, risk assessments of U.S. plants

have identified possible severe accidents in

which containment fails and very large

releases of radionuclides occur. Most of

these releases would not be accompanied by

explosions or fires like those at Chernobyl

where the radioactive plume was lofted high

into the atmosphere and away from local

residents. As discussed in Chapter 5, a large

release from U.S. plant could, under

unfavorable meteorological conditions, result

in more early fatalities than occurred at

Chernobyl. While uncontained severe

accidents leading to such releases are not

considered likely, one should avoid the

mindset that "it can't happen here."
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-7 NUREG/CR-6042 Rev. 2

Table 2.3-1 The most dangerous violations of operating procedures at

Chernobyl-4*

Violation Motivation Consequence

1. Reducing operational Attempt to overcome Emergency protection

reactivity margin below xenon poisoning system was ineffective

permissible limit

2. Power level below that Error in switching Reactor difficult to control

specified in test program off local auto-control

3. All circulating pumps on with Meeting test requirements Coolant temperature close

some exceeding authorized to saturation

discharge

4. Blocking shutdown signal To be able to repeat tests Loss of automatic

from both turbogenerators if necessary shutdown possibility

5. Blocking water level and To perform test despite Protection system based on

steam pressure trips from unstable reactor heat parameters lost

drum-separator

6. Switching off emergency core To avoid spurious Loss of possibility to

cooling system triggering of ECCS reduce scale of accident

*From the Soviet Union summary of its report to the IAEA.
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-8 NUREG/CR-6042 Rev. 2

Figure 2.3-1 Boiling water pressure tube graphite moderated reactor
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-9 NUREG/CR-6042 Rev. 2

References for Section 2.3

1. R.A.Knief,“NuclearEngineering,

T h e o r y a n d Te c h n o l o g y o f

Commercial Nuclear Power,”Second

Edition, Hemisphere Publishing,

1992, p. 458.

2. N. A. Shteynberg etal.,“On the

Causes and Circumstances of the

Accident at Unit 4 of Chernobyl Nuclear

PowerPlanton26April1986,”Report

of USSR GPAN Commission, NRC

Translation 2932, 1991.

3. American Nuclear Society, “Special

Report,”Nuclear News, La Grange Park,

Illinois, September 11, 1986.
Reactor Safety Course (R-800) 2.3 The Chernobyl Accident

USNRC Technical Training Center 2.3-10 NUREG/CR-6042 Rev. 2

1. Knief, Ronald Allen, Nuclear Engineering, Theory and Technology of Commercial

Nuclear Power, Second Edition, Hemisphere Publishing, 1992, p. 458.

2.N.A.Shteynbergetal.,“OntheCausesandCircumstancesoftheAccidentatUnit4of

ChernobylNuclearPowerPlanton26April1986,”ReportofUSSRGPANCommission,

NRC Translation 2932 (1991).

3. Nuclear News - Special Report, American Nuclear Society, La Grange Park, Illinois,

September 11, 1986.
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-1 NUREG/CR-6042 Rev. 2

2.4 Ri s k I n f l u e n c e s and the

Development of Safety Goals

As discussed in Section 1.2.1, the Atomic

Energy Act of 1954 requires the NRC to

ensure that

the utilization or production

of special nuclear material

will ... provide adequate

protection to the health and

safety of the public.

In its rules and decisions, the Commission

refers to this standard as either the

"adequate protection" standard or the "no

undue risk" standard. The interchangeable

use of these two terms has been accepted

in legal decisions.1,2 Congress left it to the

AEC/NRC to determine what constituted

"no undue risk." Prior to the TMI-2

accident, such determinations were based

primarily on the engineering judgment of

the NRC staff, the ACRS, and the

Commissioners. Following the TMI-2

accident, the NRC began to deal with risk

in a more systematic and quantitative

manner through the use of PRA techniques.

Quantitative risk limits have not generally

been imposed in NRC regulations;

however, quantitative risk estimates do

provide supporting rationale and impetus

for regulatory decisions. As PRA has

improved over the years, the weight given

to quantitative risk estimates has increased.

The next sections describe the role that

quantitative risk estimates played in

addressing past important regulatory issues.

Then, the development of the backfit rule

and safety goals are discussed.

2.4.1 Past Risk-Influenced Regulatory

Practices

Risk considerations, both qualitative and

quantitative, have influenced a number of

existing regulations and in fact have

always been present in the minds of

decision makers. The remainder of this

section will give examples illustrating how

the consideration of risk has evolved from

an ad hoc approach to a more systematic

process.

2.4.1.1 Anticipated Transients Without

Scram

An "anticipated transient" is an event that

is expected to occur one or more times

during the life of a nuclear power plant.

There are a number of anticipated

transients, some quite trivial and others

that are more significant in terms of the

demands imposed on plant equipment.

Anticipated transients include such events

as a loss of electrical load that leads to

closing of the turbine stop valves, a load

increase such as opening of a condenser

bypass valve, a loss of feedwater flow, and

a loss of reactor coolant flow.

The reactor protection system (RPS) is

designed to monitor key plant variables to

detect off-normal plant conditions arising

f r o m a n t i c i p a t e d t r a n s i e n t s a n d

automatically initiate whatever safety

action is needed. For some anticipated

transients, to assure that no damage to the

plant occurs, the RPS is designed to

automatically "scram" the reactor, that is,

to cause the control rods to rapidly move

into the core, thereby shutting down the

nuclear reaction and reducing the heat

generation rate to that associated with

radionuclide decay (see Figure 1.4-1). An

"anticipated transient without scram" or

ATWS event would occur if the RPS failed

to scram the reactor given such a transient.

Appendix 2B provides more information

about the RPS and ATWS.

Origin of the ATWS Issue
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-2 NUREG/CR-6042 Rev. 2

The concern about ATWS originated in

discussions of the ACRS, the regulatory

staff, and reactor manufacturers about

potential interactions between reactor

control and protection systems. This

concern was based on a classic accident

that occurred at the High Temperature

Reactor Experiment (HTRE-3), an

experimental reactor in Idaho.3 Both the

control system and protection system for

this reactor took inputs from the same

neutron flux instruments. A design defect

in these instruments prevented an increase

in current when the reactor power

increased. The unchanging current caused

the reactor control system to withdraw the

control rods and simultaneously blinded

the reactor protection system to the

resulting power increase. The core was

destroyed.

ACRS member S. H. Hanauer began

raising the control/protection separation

issue in connection with specific plants

being reviewed by the ACRS in 1966 and

1967. Reactor instrument designers carried

out analyses of various kinds of failures.

After considerable discussion, and some

design changes, it was determined that

separation of control and protection

functions was being achieved to a

reasonable degree, either by physical

separation or by electrical isolation. It

became clear that failures caused by

equipment wear-out or failures occurring

on a random basis in protection systems

would not cause appreciable deterioration

of reliability because of the redundancy of

the systems. It was not so clear, however,

that these systems were sufficiently

invulnerable to common cause failures

(see Appendix 2B).

In a letter to the ACRS dated January 21,

1969, E. P. Epler, an ACRS consultant,

pointed out that common cause failures

could reduce the reliability of protection

systems in such a way that the system

might not function properly in the event of

an anticipated transient.3 Epler argued as

follows: (1) Reactor scram was needed to

prevent core meltdown and a loss of

containment integrity following a routine

operating event such as loss of electric

load, which might occur about once a year.

(2) A scram failure probability smaller

than 10-4 per demand could not be

defended because of the possibility of

common cause failures. (3) Therefore,

core melt and a major release of

radioactivity might occur with a probability

larger than 10-4 per reactor-year.

In a memorandum enclosed with his letter,

Epler noted that public figures like Alvin

Weinberg, the Director of Oak Ridge

National Laboratory (ORNL), and

Chauncey Starr, then Dean of Engineering

at the University of California, Los

Angeles, and formerly President of

Atomics International, had publicly

indicated that the probability of a serious

reactor accident was similar to that of a jet

airliner plunging into Yankee Stadium

during a World Series game, which Epler

estimated as roughly 10-7 per year.

However, because of the lack of measures

to cope with the China Syndrome, and

because of his own estimate of the

probability of scram failure, Epler felt that

the actual probability of a serious accident

might be a factor of 1,000 higher.

The ATWS issue posed by Epler sparked

heated debate and took over 15 years to

resolve. Initial efforts to resolve the issue

took two general directions. The first

involved attempts to evaluate the

likelihood of common cause or other

failures of reactor protection systems that

might lead to ATWS events. Second, in

late 1970, analyses of the consequences of

postulated ATWS events were requested of
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-3 NUREG/CR-6042 Rev. 2

reactor designers, and all the designers

performed these analyses.

WASH-1270

In September 1973 the NRC publicly

adopted a position on ATWS with the

publication of the WASH-1270 report.4

Along with providing for important plant

design changes, an important aspect of the

WASH-1270 report was that it defined an

overall safety goal, as well as a

quantitative goal for ATWS, for future

plants. Specifically, the overall safety goal

was that

... the risk to the public from

all reactor accidents should

be very small compared to

other risks of life such as

d i s e a s e o r n a t u r a l

catastrophes.

Projecting about one thousand nuclear

plants in the United States by the year

2000, it was argued that the safety

objective would require

that there be no greater than

one chance in one million

per year for an individual

plant of an accident with

p o t e n t i a l c ons e q u e n c e s

greater than the Part 100

guidelines.

WASH-1270 further proposed to allocate

only one-tenth of their objective to any one

accident type; hence, the safety objective

for ATWS was that it not lead to an

accident with serious offsite consequences

more frequently than 10-7 per reactor-year.

With the issuance of the WASH-1270

report in September 1973, the regulatory

staff had taken a position on ATWS and it

was seemingly resolved except for

implementation. The ACRS moved the

ATWS issue into the resolved column on

their list of generic issues in February

1974. In the period 1974-1975 all the

reactor vendors submitted analyses on

ATWS in general response to the

requirements set forth in the WASH-1270

report.

Unfortunately, the resolution of ATWS was

short lived. In the ensuing years a number

of positions were taken by the NRC and

the industry. In 1975 the NRC proposed

additional design changes. The industry

countered by pointing out that the Reactor

Safety Study did not show ATWS as a

major contributor to risk for LWRs. The

industry followed up with a series of

reports indicating low risk to the public.

In April 1978 the regulatory staff issued a

new report, NUREG-0460, titled

"Anticipated Transients Without Scram for

Light Water Reactors."5 This report

proposed a change in safety objective for

an unacceptable ATWS from 10-7 per

reactor-year as set forth in the WASH-1270

to 10-6 per reactor-year. This was

apparently based on the overall frequency

of core melt predicted in the Reactor

Safety Study (5×10

-5 per reactor-year). The

staff employed a mixture of deterministic

and probabilistic analyses to prescribe the

design approaches that would be needed to

meet the new safety objective for each

LWR vendor. The new staff proposals

were again opposed very strongly by the

industry, and after many meetings between

the NRC staff, the ACRS, and

representatives of the nuclear industry,

strong differences of opinion still existed.

Failure of Control Rods to Fully Insert

at Browns Ferry 3

On June 28, 1980, Browns Ferry Unit 3, a

BWR, reported that 76 of 185 control rods
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-4 NUREG/CR-6042 Rev. 2

failed to insert fully into the core when a

manual scram was initiated by the reactor

operator. Fortunately, this occurred during

a routine shutdown from about 35% power,

rather than during the kind of reactor

transient in which complete and rapid

scram of all the rods might have been

important.

The problem was determined to be

hydraulic in nature rather than electrical or

mechanical. The control rod drives

(CRDs), which insert and withdraw the

attached control rods in a General Electric

BWR, are essentially water-driven

hydraulic pistons. On a scram, a relatively

high water pressure is applied to the

bottom side of the piston by opening a

scram inlet valve. A scram outlet valve

opens to relieve water and pressure above

the piston and the rods are rapidly driven

up into the reactor core. Water discharged

from the 185 individual CRDs during

scram insertion is collected in two separate

headers called the scram discharge volumes

(SDVs). During normal operation, both

SDVs are designed to remain empty.

Tests, inspections, and analyses conducted

after the event led to the conclusion that

the east SDV was substantially full of

water at the time of the event, leaving

insufficient room for the discharge water.

Accordingly, upon scram actuation, the

CRDs rapidly drove the control rods

partially into the core but rod motion

prematurely ceased when pressure quickly

equalized on each side of the pistons.

Following each scram actuation, the scram

signal was reset by the operator, allowing

more water to drain from the SDV and

permitting the rods to insert further.

Sufficient water was finally drained from

the SDV to allow the rods to insert fully

on the fourth scram signal.

A Preliminary Notification was issued

promptly and on July 3, 1980 the NRC

issued IE Bulletin 80-17 to all BWR

licensees. Continuing NRC review of the

Browns Ferry event identified other

p r o b l e m s , w h i c h r e q u i r e d t e s t s ,

inspections, hardware changes, new

procedures, and operator training at various

BWR plants. These actions are discussed

in Appendix 2B. Browns Ferry Unit 3 was

authorized to restart on July 13, 1980,

following completion of the actions

required by IE Bulletin 80-17 and other

extensive tests.

ATWS Event at Salem 1

At 12:21 a.m. on February 25, 1983 a

low-low water level condition in one of the

four steam generators at Salem 1 initiated

a reactor trip signal in the reactor

protection system. At the time, the reactor

was at 12% rated thermal power in

preparation for power escalation after a

recently completed refueling outage. Upon

receipt of the valid reactor trip signal, both

of the redundant reactor trip breakers

failed to open (opening of either reactor

trip breaker would have caused the reactor

to trip). About 25 seconds later, operators

manually initiated a reactor trip from the

control room. The reactor trip breakers

opened as a result of the manual trip signal

and this resulted in insertion of all control

rods and shutdown of the reactor.

Following the manual trip, the plant was

stabilized in the hot standby condition. All

other systems functioned as designed.

Approximately two hours after the Salem 1

event, the cause of the failure to trip was

determined by licensee instrumentation

technicians to be failure of the UV trip

device in both reactor trip breakers to

function as designed. The plant was

placed in cold shutdown at the request of

the NRC.
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-5 NUREG/CR-6042 Rev. 2

On February 26, 1983 NRC investigators

discovered that a similar failure had

occurred on at Salem 1 on February 22,

1983. Based on a computer printout of

February 22 events, it was evident that on

that day (as on February 25) the two

reactor trip breakers failed to open upon

receipt of an automatic trip signal from the

reactor protection system. The operators

initiated a manual trip even though they

were unaware that the automatic trip had

failed.

Due to the serious nature of Salem 1

ATWS event, the NRC issued Inspection

and Enforcement Bulletin No. 83-016on

the same day (February 25, 1983) to all

PWR licensees for action and to other

nuclear power reactor facilities for

information. Subsequent initiatives on the

part of NRC and industry identified and

corrected potential deficiencies in reactor

trip breakers and related maintenance

procedures at several other plants as

described in Appendix 2B.

Because of previously identified problems

at Salem and the licensee's failure to

recognize that an ATWS event had

occurred on February 22, 1983 the NRC

did not permit the Salem plants to restart

until both technical and management

corrective actions were satisfactorily

addressed. On April 26, 1983 the NRC

agreed that the plants could be returned to

service; however, on May 5, 1983 the NRC

forwarded to the Salem licensee a Notice

of Violation and Proposed Imposition of

Civil Penalties (for $850,000).7 Violations

included operation of the reactor even

though the reactor protection system could

not be considered operable, and several

significant deficiencies which contributed

to the inoperability of the reactor trip

breakers. Region I instituted an augmented

inspection program at Salem to monitor the

licensee's progress towards completion of

longer term corrective actions, including

independent management consultants'

recommendations.

The special NRC task force prepared a

two-volume report, NUREG-1000.8 The

first volume dealt with the generic

implications of the Salem events. The

second volume documented the NRC

actions to be taken based on the work of

the task force. The results of the task

force were considered in deliberations

regarding the ATWS position and rule,

which was being developed by the NRC.

10 CFR 50.62, The ATWS Rule

On November 24, 1981, 15 months before

the Salem 1 ATWS event, the NRC invited

comments on three proposed ATWS rules.9

In July 1982 a Task Force and Steering

Group of NRC personnel from several

offices was formed to consider comments

received on the three proposals and to

develop a final rule on ATWS. Appendix

2B reproduces the final ATWS rule and

also discusses the key changes that were

considered.10

The Commission stressed that ATWS risk

reductions can also be achieved by

reducing the frequency of transients which

call for the reactor protection system to

operate. Challenges to the reactor

protection system may arise from

unreliable components, inadequate post-trip

reviews, poor testing, or tolerance of

inadequate or degraded control systems.

Operating experience in Japan indicated a

transient frequency that was substantially

less than in the United States. Utilities

had categorized transients for over ten

years but had not specifically instituted a

program to reduce them. While not

specifically required by the ATWS rule,

the Commission urged licensees to analyze

challenges to the plant safety systems,
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-6 NUREG/CR-6042 Rev. 2

particularly the reactor trip system, and

determine how improvements could be

made.11Industry response to this challenge

has been positive as indicated in Figure

2.4-1.

Interestingly, the final rule says nothing

about quantitative risk goals. In this case,

risk arguments provided the impetus for

the rule but are not present in the final

rule.

2.4.1.2 A u x i l i a r y F e e d w a t e r

Reliability

The auxiliary feedwater system (AFWS)

normally operates during startup, hot

standby, and shutdown to provide

feedwater to PWR steam generators. In

conjunction with a Seismic Category I

water source, it also functions as an

emergency system for the removal of heat

from the primary system when the main

feedwater system is not available for

emergency conditions including small

LOCAs. The AFWS operates over a time

period sufficient either to hold the plant at

hot standby for several hours or to cool

down the primary system (at a rate not to

exceed limits specified in technical

specifications) to temperature and pressure

levels at which the low pressure decay heat

removal system can operate.

The Reactor Safety Study found the AFWS

to be important in preventing certain core

damage scenarios, and the loss of auxiliary

feedwater at TMI-2 reinforced concerns

regarding the reliability of the AFWS.

Prior to the accident at TMI-2 there was

wide variance in design philosophy for

auxiliary feedwater systems. In particular

the degree of diversity and redundancy

varied widely. Some multi-plant sites had

only one auxiliary feedwater pump per

plant with interconnections between units.

Other plants had two motor driven and one

turbine-driven pump.

The NRC reviews information provided on

the AFWS in the applicant's Safety

Analysis Report following the Standard

Review Plan. In July 1981, Section 10.4.9

of the Standard Review Plan12 required

that, as part of their review, the NRC

assure that an AFWS reliability analysis be

performed in accordance with NUREG073711

using the methodology defined in

NUREG-0611

13 and NUREG-0635.14 Such

an analysis provides an estimate the AFWS

reliability and indicates major contributors

to AFWS failure for various loss of main

feedwater transients.

As set forth in Standard Review Plan

Section 10.4.9, an acceptable AFWS

should have an unreliability in the range

of 10-4 to 10 -5. Compensating factors

such as other methods of accomplishing

the safety functions of the AFWS or other

reliable methods for cooling the reactor

core during abnormal conditions may be

considered to justify a larger unavailability

of the AFWS.

In December 1986, additional regulatory

guidance regarding auxiliary feedwater

systems was set forth.15 The new guidance

called for operating plants to demonstrate

a 10-4 unreliability using plant-specific

data. This guidance is an example of the

use of quantitative risk estimates, although

they apply only to a particular system and

not to the risk of a severe accident.

2.4.1.3 Station Blackout Rule

Station blackout is the complete loss of

alternating current (AC) electrical power to

the essential and nonessential switchgear

buses in a nuclear power plant. Many

safety systems required for reactor core

cooling and containment heat removal

depend on AC power; however, because
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-7 NUREG/CR-6042 Rev. 2

station blackout requires multiple

component failures, U.S. plants were not

specifically designed (before the July 21,

1988 station blackout rule) to withstand

station blackout. In 1975 the Reactor

Safety Study showed that station blackout

could be an important contributor to the

total risk from nuclear power plant

accidents.16 As operating experience

accumulated, the concern arose that the

reliability of both the onsite and offsite

emergency AC power systems might be

less than originally anticipated. In 1979

the NRC designated station blackout as an

unresolved safety issue. A task action plan

for issue resolution (TAP A-44) was issued

in July 1980, and work was begun to

determine whether additional safety

requirements were needed.

Operating plant data and several plant

specific probabilistic studies yielded the

quantitative information presented in Table

2.4-1 and the following important findings

regarding station blackout.17

1. The variability of estimated station

blackout likelihood is potentially

large, ranging from approximately

10-5 to 10-3 per reactor-year. A

"typical" estimated frequency is on

the order of 10-4 per reactor-year.

2. The capability to restore offsite

power in a timely manner (less than

8 hours) can have a significant

effect on accident consequences.

3. The redundancy of onsite AC power

systems and the reliability of

individual power supplies have a

large influence on the likelihood of

station blackout events.

4. The capability of the decay heat

removal system to cope with long

duration blackouts (greater than 2

hours) can be a dominant factor

influencing the likelihood of core

damage or core melt for the

accident sequence.

5. The estimated frequency of station

blackout events that result in core

damage or core melt can range

from approximately 10-6 to greater

than 10-4 per reactor-year. A

"typical" core damage frequency

estimate is on the order of 10-5 per

reactor-year.

The station blackout rule 10 CFR 50.63,18

which became effective on July 21, 1988,

was promulgated to reduce the risk of

severe accidents resulting from station

blackout by:

(a) maintaining highly reliable ac electric

power systems; and (b) as additional

defense in depth, assuring that plants can

cope with a station blackout for a specified

duration selected on a plant-specific

basis.19

It should be noted that station blackout

was not deemed to constitute an undue risk

without the station blackout rule. It was

recognized that, even with the rule, station

blackout may still remain an important

contributor to residual risk. The station

blackout rule was developed to enhance

safety by accident prevention and thereby

reduce the likelihood of a core damage

accident being caused by a station

blackout. Like the ATWS rule (Section

2.4.1.1) it recognizes and addresses the

threat posed by common cause failures.

The station blackout rule identifies the

reliability of onsite emergency ac power

sources as being one of the main factors

contributing to risk of core melt resulting

from station blackout. Diesel generator

units have been widely used as the power

source for the onsite electric power
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-8 NUREG/CR-6042 Rev. 2

systems. The NRC staff developed

Regulatory Guide 1.155 entitled "Station

Blackout," which presents guidance on (1)

maintaining a high level of reliability for

emergency diesel generators, (2)

developing procedures and training to

restore offsite and onsite emergency ac

power should either one or both become

unavailable, and (3) selecting a

plant-specific acceptable station blackout

duration that the plant would be capable of

s u r v i v i n g w i t h o u t c o r e d a m a ge .

Application of the methods in this guide

would result in selection of an acceptable

station blackout duration (e.g. 2, 4, 8, or

16 hours) that depends on the specific

p l a n t d e s i g n a n d s i t e - r e l a t e d

characteristics.

The station blackout rule allows utilities

several design alternatives to ensure that

an operating plant can safely shut down in

the event that all ac power (offsite and

onsite) is lost. The NRC staff prefers

demonstrating compliance with 10 CFR

50.63 through the installation of a spare

(full capacity) alternate ac power source of

diverse design that is consistent with the

guidance in Regulatory Guide 1.155 and is

capable of powering at least one complete

set of normal safe shutdown loads.

Although an alternate AC power source is

the preferred resolution to this issue in 10

CFR 50.63, NRC imposition would exceed

current NRC regulations. For advanced

LWRs the NRC staff has recommended

that the NRC commissioners approve

imposition of an alternate ac power source.

The resolution of the station blackout

safety issue established the need for an

emergency diesel generator (EDG)

reliability program that has the capability

to achieve and maintain the emergency

diesel generator reliability levels in the

range of 0.95 per demand or better to cope

with station blackout. Explicit guidance in

the areas of diesel-generator preoperational

testing, periodic testing, and reporting

requirements have been developed for

meeting this reliability goal in a revision to

Regulatory Guide 1.9,20 which was

prepared for the resolution of Generic

Safety Issue B-56, "Diesel Reliability."

2.4.1.4 Backfit Rule

Backfitting is defined in some detail in 10

CFR 50.109, but for purposes of discussion

here it means measures which are directed

by the Commission or by NRC staff in

order to improve the safety of nuclear

power reactors, and which reflect a change

in a prior Commission or staff position on

the safety matter in question.21 The current

Backfit Rule has evolved in three stages:

1. the 1970 Backfit Rule which allowed

the NRC to take advantage of

technological advances in safety,

2. the 1985 Final Backfit Rule which

included cost impact in the

consideration of backfits, and

3. the 1988 Amended Final Backfit Rule

which dealt with legal problems

associated with cost considerations.

The NRC promulgated its first rule

c o n c e r n i n g t h e " b a c k f i t t i n g " o r

safety-enhancement of nuclear reactors in

1970. In explaining the need for such a

rule, the NRC noted that

rapid changes in technology in

the field of atomic energy result

in the continual development of

new or improved features

designed to improve the safety of

production and utilization

facilities.22
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-9 NUREG/CR-6042 Rev. 2

The rule addressed these technological

changes by setting forth a standard

governing when the NRC could require a

plant previously licensed for construction

or operation to incorporate a new safety

feature. The rule stated that

the Commission may ... require

the backfitting of a facility if it

finds that such action will

provide substantial, additional

protection which is required for

the public health and safety or

the common defense and

security.

23

The rule excepted from this standard any

backfit that was necessary to bring a

facility into compliance with its license or

a Commission order, rule, or regulation. A

backfit of this kind was apparently always

required.

By the end of the 1970s the backfit rule

had become the target of widespread

criticism. Some charged that the rule

allowed the Commission to ignore the need

for backfitting outmoded plants. For

example, the President's Commission on

the TMI-2 accident24 stated that the rule

had not forced the NRC to "systematically

consider" the "need for improvement of

older plants." Others charged that the rule

a l l o w e d t h e C o m m i s s i o n t o

indiscriminately impose backfits without

regard to their real necessity or cost. For

example, NRC's Regulatory Reform Task

Force claimed that

The staff's prior backfitting

practices which have cost

consumers billions of dollars

have made nuclear plants more

d i f ficult to op e r a t e a n d

m a i n t a i n , h a v e i n j e c t e d

uncertainty and paralyzing delay

into the administrative process

and in some instances may have

reduced rather than enhanced

public health and safety.

25

All commentors appeared to agree that the

rule had failed to systematize or rationalize

the Commission's backfitting process.

In response to criticism of the 1970 rule,

the NRC published an advance notice of

proposed rule-making on September 28,

1983. The notice invited public comment

on draft backfit rules proposed by the

Commission's Regulatory Reform Task

Force and the Atomic Industrial Forum, the

trade association of the nuclear power

industry. Fourteen months later, after

having received and reviewed numerous

comments the Commission published a

proposed version of the final rule.26

Parties commented on the rule, focusing

especially on the authority of the

Commission to consider economic costs

when deciding whether to impose backfits.

On September 20, 1985 the Commission

published its final rule, which became

effective on October 21, 1985.27 The heart

of the final backfit rule is the standard

governing the circumstances in which the

Commission will order a backfit. The

standard incorporated the 1970 rule's

requirement that the backfit substantially

increase protection to health and safety,

but added an additional requirement that

the benefits of the backfit justify its costs.

Specifically, the rule provided:

The Commission shall require

the backfitting of a facility only

when it determines ... that there

is a substantial increase in the

overall protection of the public

health and safety or the common

defense and security to be

derived from the backfit and that

the direct and indirect costs of
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-10 NUREG/CR-6042 Rev. 2

implementation for that facility

are justified in view of this

increased protection.

The rule set forth in some detail the way in

which the NRC would make the

determination of whether a proposed

backfit meets the governing standard. The

rule requires that the NRC prepare a

"systematic and documented analysis" of

each proposed backfit, considering

available information concerning nine

factors:

1. the specific objectives of the

proposed backfit;

2. the activity that would be required by

the licensee to complete the backfit;

3. the potential change in risk to the

public resulting from the backfit;

4. the potential impact of the backfit on

the radiological exposure of the

facility's employees;

5. the costs of installation and

maintenance associated with the

backfit, including the cost of facility

downtime or construction delay;

6. the potential impact on safety of the

changes in plant or operational

complexity resulting from the backfit;

7. the estimated resource burden on the

NRC associated with imposing the

backfit;

8. whether the relevancy and practicality

of the particular kind of backfit will

vary from facility to facility; and

9. whether the backfit is an interim

measure and, if so, the justification

for imposing the backfit on an interim

basis.

In addition to considering these nine

factors, the rule required the NRC to take

into account "any other-information

relevant and material to the proposed

backfit" in preparing the requisite analysis.

The rule also stated that "backfit analysis

is not required and the standard does not

apply" in three situations. The first

exception, similar to the exception in the

1970 rule, is when a backfit is necessary to

bring a facility into compliance with a

license, the rules or orders of the

Commission or written commitments of the

licensee. The second exception is when

an immediately effective

regulatory action is necessary to

ensure that the facility poses no

undue risk to the public health

and safety.

The rule provides that the imposition of a

backfit falling within this exception

shall not relieve the Commission

of performing an analysis after

the fact to document the safety

significance and appropriateness

of the action taken.

The third exception appears in a footnote

appended to the subsection containing the

second exception. This footnote states:

For those modifications which

are to ensure that the facility

poses no undue risk to the

public health and safety and

which are not deemed to require

immediately effective regulatory

action, analyses, are required;

these analyses, however, should

not involve cost considerations
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-11 NUREG/CR-6042 Rev. 2

except only insofar as cost

contributes to selecting the

s o l u t i o n a m o n g v a r i o u s

acceptable alternatives to

ensuring no undue risk to public

health and safety.

The 1985 backfit rule and a related internal

NRC Manual chapter which partially

implemented it were challenged by the

Union of Concerned Scientists. On August

4, 1987 the U.S. Court of Appeals for the

DC Circuit rendered its decision vacating

both the rule and the NRC Manual chapter

which implemented the rule.28 The Court

concluded that the rule, when considered

along with certain statements in the rule

preamble published in the Federal Register,

did not speak unambiguously in terms that

constrained the NRC from considering

economic costs in establishing standards to

ensure adequate protection of the public

health and safety as dictated by section 182

of the Atomic Energy Act. At the same

time, the Court agreed with the

Commission that once an adequate level of

safety protection had been achieved under

section 182, the Commission was fully

authorized under section 161i of the

Atomic Energy Act to consider and take

economic costs into account in ordering

further safety improvements. The Court

therefore rejected the position of the Union

of Concerned Scientists that economic

costs may never be a factor in safety

decisions under the Atomic Energy Act.

Because the Court's opinion regarding the

circumstances in which costs may be considered in making safety decisions on

nuclear power plants was completely in

accord with the Commission's own policy

views on this important subject, the Commission decided not to appeal the decision.

Instead, the Commission decided to amend

both the rule and the related NRC Manual

chapter (Chapter 0574) so that they conform unambiguously to the Court's

opinion.

The final amended backfit rule was published as 10 CFR 50.109 on June 6, 1988.25

In the rulemaking the Commission has

adhered to the following safety principle

for all of its backfitting decisions.

The Atomic Energy Act

commands the Commission to

ensure that nuclear power plant

operation provides adequate

protection to the health and

safety of the public. In defining,

redefining or enforcing this statutory standard of adequate protection, the Commission will not

consider economic costs. However, adequate protection is not

absolute protection or zero risk.

Hence safety improvements beyond the minimum needed for

adequate protection are possible. The Commission is empowered under section 161 of the

Act to impose additional safety

requirements not needed for

adequate protection and to consider economic costs in doing

so.

The 1985 revision of the backfit rule,

which was the subject of the Court's decision, required, with certain exceptions, that

backfits be imposed only upon finding that

they provided a substantial increase in the

overall protection of the public health and

safety or the common defense and security

and that the direct and indirect costs of

implementation were justified in view of

this increased protection. The final rule

restates the exceptions to this requirement

for a finding, so that the rule will clearly

be in accord with the safety principle

stated above. In response to the Court's

decision, the rule now provides that if the
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-12 NUREG/CR-6042 Rev. 2

contemplated backfit involves defining or

redefining what level of protection to the

public health and safety or common defense and security should be regarded as

adequate, neither the rule's "substantial

increase" standard nor its "costs justified"

standard (see 50.109(a)(3)) is to be applied

(see 50.109(a)(4)(iii)). Also in response to

the Court's decision, (see 824P.2d at 119)

the rule now also explicitly says that the

Commission shall always require the

backfitting of a facility if it determines

that such regulatory action is necessary to

ensure the health and safety of the public

and is in accord with the common defense

and security. On instruction from the

Commission, the NRC staff amended its

Manual Chapter on plant-specific

backfitting to ensure consistency with the

Court's opinion.

Implementation of the Backfit Rule

continues to evolve, due to ambiguity

concerning terms like “substantial

additionalprotection.”The“costjustified”

standard is changing due to revised

economic analysis. Previously, the cost

benchmark had been $1000/person-rem.

Changes that cost less than this amount

were considered cost justified. That

benchmark was changed in 1995 to

$2000/person-rem.29,30 Processes for

performing these calculations are also

evolving, as PRA technology improves.

2.4.2 Safety Goal Policy

Several TMI-2 investigators recommended

that the NRC explicitly identify a safety

goal -- a level of risk at which reactors

would be safe enough. Establishing such

a goal, advocates believed, would end the

interminable question: When is a nuclear

power plant safe enough? The NRC

e s t a b l i s h e d both qua l i t a t i v e a n d

quantitative safety goals in August 1986,

after several years of deliberations.31

The qualitative safety goals are as follows:

1. Individual members of the public

should be provided a level of

protection from the consequences of

nuclear power plant operation such

that individuals bear no significant

additional risk to life and health.

2. Societal risks to life and health from

nuclear power plant operation should

be comparable to or less than the

risks of generating electricity by

viable competing technologies and

should not be a significant addition

to other societal risks.

The corresponding quantitative safety goals

are:

1. The risk to an average individual in

the vicinity of a nuclear power plant

of prompt fatalities that might result

from reactor accidents should not

exceed one-tenth of one percent of the

sum of prompt fatality risks resulting

from other accidents to which

members of the U.S. population are

generally exposed.

2. The risk to the population near a

nuclear power plant of cancer

fatalities that might result from

nuclear power plant operation should

not exceed one tenth of one percent of

the sum of cancer fatality risks

resulting from all other causes.

The average accident fatality rate in the

U.S. is approximately 5×10

-4 per individual

per year, so the quantitative value for the

first goal is 5×10

-7 per individual per year.

The "vicinity of a nuclear power plant" is

defined to be the area within one mile (1.6

km) of the plant site boundary. The

average U.S. cancer fatality rate is

approximately 2×10

-3 per year, so the
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-13 NUREG/CR-6042 Rev. 2

quantitative value for the second goal is

2×10

-6 per average individual per year.

The population "near a nuclear power

plant" is defined as the population within

ten miles (16 km) of the plant site.

When first proposed in the early 1980s, the

second of these quantitative goals set off a

flurry of controversy. While a ten mile (16

km) radius around the plant site was

selected for evaluation, the choice of a

particular radius is arbitrary and somewhat

controversial. When considering a 0.1

percent cancer rate within a fifty mile (80

km) radius, for example, this would

amount to an average of three excess

cancer fatalities per reactor per year (these

would be excess over the expected 3000

cancer fatalities from normal causes). This

would be a total of 13,500 excess deaths

over the next thirty years in an industry

comprised of 150 reactors -- a figure

critics argued was too high. The NRC

could have responded to this criticism by

revising the second goal, perhaps by

establishing a more stringent goal for risks

to persons outside the ten mile (16 km)

radius (not addressed in the original goal),

but this would have triggered criticism

from proponents of nuclear power, who

would have argued that the goal was too

strict compared with other risks that

society accepts. Thus, both of the

preceding quantitative safety goals

remained as originally drafted.

Even when an acceptable safety goal can

be agreed on, regulators still have to

determine whether the goal actually has

been met. The NRC recognized this, and

announced that because of "the sizable

uncertainties ... and gaps in the data base,"

the quantitative safety goals would serve as

"aiming points or numerical benchmarks."

The NRC also indicated that the goals were

intended to apply to the industry as a

whole and not precisely to individual

plants. The goals were not

in and of themselves meant to

serve as a sole basis for

licensing decisions. However, if

pursuant to these guidelines,

information is developed that is

applicable to a specific licensing

decision, it may be considered

as one factor in the licensing

decision.

The safety goal policy makes it clear that

the quantitative safety goals are not hard

and fast requirements (such as a rule would

be) and are intended to apply to the

industry as a whole, rather than individual

plants. However, an actual safety goal

implementation approach is still evolving

as discussed in Section 2.6. Since 1986

t h e N R C h a s s t r u g g l e d w i t h

implementation and the possible inclusion

of "subsidiary" safety goals. For example,

one topic of particular interest and

controversy has been the large release goal

contained in the 1986 policy statement:

Consistent with the traditional

defense-in-depth approach and

t h e a c c i d e n t m i t i g a t i o n

philosophy requiring reliable

performance of containment

systems, the overall mean

frequency of a large release of

radioactive materials to the

environment from a reactor

accident should be less than 1 in

1,000,000 per year of reactor

operation.

Details concerning the large release goal

were left to the staff to develop.

Subsequently, the Commission indicated

that:
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-14 NUREG/CR-6042 Rev. 2

1. The staff may partition the large

release guideline and establish

quantitative core damage frequency

and containment perf ormance

objectives.

2. A core damage probability of less

than 1 in 10,000 per reactor year of

reactor operation appears to be a very

useful subsidiary benchmark in

making judgments about regulations

directed toward accident prevention.

This guidance has been controversial

because:

1. There is not yet an accepted

definition of a "large release,"

2. The large release and core damage

probability goals are more restrictive

(and thus subsume) the health effects

goals in most cases,

3. PRA calculations of large release

frequencies have large uncertainties,

and

4. Many plants would not be expected to

meet these subsidiary goals.

The second concern listed above relates to

the hierarchical nature of the safety goals,

starting with qualitative goals and

proceeding through the quantitative health

effects goals down to more detailed,

subsidiary quantitative goals. The ACRS

and others have raised concerns that the

proposed goals are not self-consistent and

that each successive layer in the hierarchy

tends to subsume the previous layer.

32 For

example, virtually all plants that meet the

large release goal would be expected to

meet all of the other goals. The question

then becomes, "Why have the other goals?"

The NRC recognizes this concern, but

believes that the current approach is

consistent with defense-in-depth (a 10-6

core damage frequency does not justify the

absence of containment) and that an

entirely self-consistent approach is not

possible. Current views on the subsidiary

goals are contained in Section 2.6.

The NRC has not yet attempted to apply

the safety goals to an actual plant design

during a licensing process. Thus, all the

safety goals and their objectives must be

viewed as continuing to evolve. For

example, the NRC staff has discussed

setting the core damage objective for

future reactor designs a factor of ten more

restrictive than the once per 10,000 years

proposed for currently operating reactors,

although the NRC Commissioners voted in

1988 not to make this standard a formal

policy goal. Rather, the NRC should

encourage reactor designers to strive

towards this improved core damage

frequency.

2.4.3 Safety Goal Policy and Backfitting

While risk importance began to be an

important consideration in decision making

during the 1970s and early 1980s, the

process was largely ad hoc, with no clear

guidance concerning what risk levels were

acceptable for any particular issue. A

quantitative safety goal was first

considered in conjunction with the ATWS

issue as indicated in Section 2.4.1.1.

Subsequently, as noted in Section 2.2, the

TMI-2 investigators recommended that the

NRC explicitly identify a safety goal -- a

level of risk at which reactors would be

safe enough. As discussed in the previous

sections, the NRC established both

qualitative and quantitative safety goals in

August 1986 to more clearly delineate

acceptable levels of risk.29

Despite the concerns noted in the previous

section, implementation of the Safety Goal
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-15 NUREG/CR-6042 Rev. 2

Policy began to take shape in the form of

guidance for backfitting. The evolution of

the Backfit Rule was discussed in detail in

Section 2.4.1.4. In January 1992 the NRC

staff presented the Commission with an

approach to use PRA results to achieve

consistency between the Safety Goal Policy

and the Backfit Rule.33 The approach is

based on comparison of the core damage

frequency to 10-4 per year and the

conditional containment failure probability

(as a surrogate for large release) to 10-6 per

reactor year. Figure 2.4-2 summarizes the

interim implementation guidance. A

proposed backfit would be evaluated in

terms of core damage frequency and

conditional containment failure probability.

Figure 2.4-2 would be used to determine if

the backfit warranted further analysis.

Note that this guidance only deals with

issues of enhanced protection; it is not

necessary to consider the safety goals

concerning questions of adequate

protection or regulatory compliance.

Once a consistent approach for dealing

with safety goals and backfits and other

regulatory analyses is established, the NRC

will have a means to consider backfits and

safety issues in a systematic and consistent

manner. The process for selecting backfit

options will be

clarified, and efforts can be focused on

those issues most important to risk. While

risk will not become the sole measure of

the importance of an issue, it can be used

to assure that issues are placed in their

proper perspective. If a risk-informed

approach to backfitting is to be

implemented, risk analyses must be

available to the decision-makers, and the

validity of those analyses clearly

understood. In some cases, NRCsponsored risk assessments and special

s tudies can provi d e t h e n e e d e d

information; however, another source of

information is becoming available. That

information source is the Individual Plant

Examinations (IPEs) and other plantspecific PRAs, as discussed in Section 2.5.
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-16 NUREG/CR-6042 Rev. 2

Table 2.4-1 Station blackout summary data

Operational Experience

Loss of offsite power (occurrences per year)

Average 0.1

Range 0 to 0.4

Time to restore offsite power (hours)

Median 0.6

90% restored 3.0

Emergency diesel generator reliability (per demand)

Average 0.98

Range 0.9 to 1.0

Emergency Diesel Generator Repair Time (hours)

Median 8

Analytical Results

Estimated range of unavailability of emergency 10-4 to 10-2

AC power systems (per demand)

Estimated range of frequency of station blackout 10-5 to 10-3

(per year)

Estimated range of frequency of core damage as a 10-6 to 10-4

result of station blackout (per year)
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-17 NUREG/CR-6042 Rev. 2

Fig

u

r

e

2.4-1

A

v

e

r

a

g

e

n

u

m

b

e

r

o

f

s

c

r

a

m

s

p

e

r

y

e

a

r
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-18 NUREG/CR-6042 Rev. 2

Figure 2.4-2 Safety goal implementation guidance
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-19 NUREG/CR-6042 Rev. 2

References for Section 2.4

1. Long Island Lighting Company, 18 NRC

445, 464-65 (1983).

2. Union of Concerned Scientists v. U.S.

NRC, 824 F.2d 108 (DC Cir 1987).

3. DavidOkrent,“NuclearReactorSafety:

On the History of the Regulatory

Process,”TheUniversityofWisconsin

Press, Madison, Wisconsin, 1981, p. 239.

4. U. S. Atomic Energy Commission

Regulatory Staff, "Technical Report on

Anticipated Transients Without Scram for

Water-Cooled Power Reactors," WASH1270, September 1973.

5. U. S. Nuclear Regulatory Commission

Staff Report, "Anticipated Transients

Without Scram for Light Water Reactors,

NUREG-0460, December, 1978.

6. U. S. Nuclear Regulatory Commission,

Inspection and Enforcement Bulletin No.

83-01, "Failure of Reactor Trip Breakers

(Westinghouse DB-50) to Open on

Automatic Trip Signal," February 25,

1983.

7. Letter from Richard C. DeYoung,

Director, NRC Office of Inspection and

Enforcement, to Robert Smith, Chairman

of the Board, Public Service and Gas

Company, transmitting a Notice of

Violation and Proposed Imposition of

Civil Penalties, Docket Nos. 50-272 and

50-311, May 5, 1983.

8. U. S. Nuclear Regulatory Commission,

"Generic Implications of ATWS Events

at the Salem Nuclear Power Plant,"

NUREG-1000, Vol. 1, April 1983.

9. 46FR 57521,“ProposedATWSRule,”

November 24, 1981.

10. 49 FR 26036, “Statement of

Considerations for ATWSRule,”June

26, 1984.

11. U. S. Nuclear Regulatory Commission,

"Clarification of TMI Action Plan

R e q u i r e m e n t s , " N U R E G - 0 7 3 7 ,

November 1980, Item II.E.1.1.

12. U. S. Nuclear Regulatory Commission,

“Standard Review Plan,” Office of

Nuclear Reactor Regulation, NUREG0800, Section 10.4.9, Rev. 2, July 1981.

13. U. S. Nuclear Regulatory Commission,

"Generic Evaluation of Feedwater

Transients and Small Break Loss-ofCoolant Accidents in WestinghouseDesigned Operating Plants," NUREG0611, January 1980, Appendix III and

Annex 1 of Appendix X.

14. U. S. Nuclear Regulatory Commission,

"Generic Evaluation of Feedwater

Transients and Small Break Loss-ofCoolant Accidents in Combustion

Engineering Designed Operating Plants,"

N U R E G - 0 6 3 5 , J a n u a r y 1 9 8 0 ,

Appendix III and Annex 1 of Appendix X.

15. U. S. Nuclear Regulatory Commission,

"A Prioritization of Generic Safety

Issues", NUREG-0933, December 1986.

16. “ReactorSafetyStudy: An Assessment

of Accident Risks in U.S. Commercial

NuclearPowerPlants,” WASH-1400,

October

1975.

17. U. S. Nuclear Regulatory Commission,

"Evaluation of Station Blackout

Accidents at Nuclear Power Plants,

Techni c a l Fi n d i n gs R e l ated to
Reactor Safety Course (R-800) 2.4 Risk Influences and the Development of Safety Goals

USNRC Technical Training Center 2.4-20 NUREG/CR-6042 Rev. 2

Unresolved Safety Issue A-44,”

NUREG-1032, June 1988, p. 1-1.

18. 10 CFR 50.63, "Loss of All Alternating

Current Power," July 21, 1988.

19. 53 FR 23203, “Statement of

Considerations for Final Station

BlackoutRule,”June21,1988.

20. Regulatory Guide 1.9, "Selection,

Design, Qualification, Testing, and

Reliability of Diesel Generator Units

Used as Class 1E Onsite Electric Power

Systems atNuclear Power Plants,”

Working Draft, November 28, 1989.

21. U. S. Code of Federal Regulations, Title

10, Part 50.109.

22. 35 Federal Register 5,317, March 31,

1970.

23. U. S. Code of Federal Regulations, Title

10, Part 50.109(a), 1971.

24. “President’s Commission on the

Accident at Three Mile Island,”

G o v e r n m e n t P r i n t i n g O ff i c e ,

Washington, DC, October 1979.

25. 53 Federal Register 20,603, June 6,

1988.

26. 49 Federal Register 47,034, November

30, 1984.

27. 50 Federal Register 38,097, September

20, 1985.

28. Union of Concerned Scientists versus

U.S. Nuclear Regulatory Commission,

824 F.2d 103, August 24, 1987.

29. U. S. Nuclear Regulatory Commission,

“RegulatoryAnalysisGuidelinesofthe

U.S.NuclearRegulatoryCommission,”

Final Report, Revision 2, NUREG/BR0058, November 1995.

30. U. S. Nuclear Regulatory Commission,

“ReassessmentofNRC’s DollarPer

Person-Rem Conversion Factor Policy,”

NUREG-1530, December 1995.

31. U. S. Code of Federal Regulations, Title

10,“SafetyGoalsfortheOperationsof

Nuclear Power Plants; Policy Statement,

Federal Register, August 4, 1986.

32. Letter from the Advisory Committee on

Reactor Safeguards to Lando W. Zech,

J r. , "A C R S C o m m e n t s o n a n

Implementation Plan for the Safety Goal

Policy," May 13, 1987.

33. Presentation by the Steering Group on

Regulatory Analysis to the Commission,

" I n t e r i m G u i d a n c e o n S t a f f

Implementation of the Commission's

Safety Goal Policy," January 17, 1992.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-1 NUREG/CR-6042 Rev. 2

2.5 Risk Assessment and Operational

Perspectives

Utilities are required to report plant

operating data to the NRC under certain

circumstances. The NRC uses this

information for various safety purposes,

ranging from deciding whether a plant may

continue to operate after occurrence of an

event to assessing long term trends in

equipment failures. The range of

informationthatisreportedandtheNRC’s

use of the information is described in this

section. In addition, as discussed in Section

2.4 and 2.6, estimates of core damage

frequency and other risk measures are

increasingly being used to resolve safety

issues, set policies, and make safety

decisions. Because of this, it is important to

understand the current estimates of risk for

commercial nuclear power plants. This

section provides a summary of key risk

analyses that have been performed and the

current understanding of risk based on these

analyses.

2.5.1 Operating Plant Data

Each year the NRC receives an extensive

amount of information from licensees and

other sources regarding nuclear power plant

experience. Table 2.5-1 lists some of the

sources of information and indicates those

that are required by law. Prompt phone

notifications and written Licensee Event

Reports (required by 10 CFR 50.72 and

10 CFR 50.73) are the predominant sources

of information having potential safety

implications.1,2 The NRC systematically

reviews and analyzes the information it

receives to identify instances where the

margin of safety established through

licensing has been degraded. In such cases,

the NRC then identifies and implements

corrective actions that will restore the

originally intended margin of safety. Any

proposed improvements in this margin of

safety must be separately identified and

justified as new licensing actions.

The feedback of operating data or experience

is an inherent and important aspect of NRC

a c t i v i t i e s a n d i n v o l v e s a l l N R C

organizational elements at one time or

another. The principal NRC organizations

involved are the Office of Nuclear Reactor

Regulation (NRR) and the Office for

Analysis and Evaluation of Operational Data

(AEOD). AEOD was established several

months after the TMI-2 accident to identify

and feed back significant safety lessons of

operational experience to the NRC, its

licensees, the nuclear industry as a whole,

and the public. Table 2.5-2 lists some of the

NRC-originated documents that are used to

disseminate relevant nuclear power plant

experience. Of particular interest to

licensees are Bulletins, Information Notices,

and NRR Generic Letters.

Information Notices provide information but

do not require specific actions. They are

rapid transmittals of information that may

not yet have been completely analyzed by

the NRC but that licensees should be aware

of. Licensees receiving an Information

Notice are expected to review the

information for applicability to their current

and future licensed operations. If the

information is applicable to their facility,

licensees are expected to take action

necessary to avoid repetition of the problem

described in the Information Notice.

Bulletins provide information about one or

more similar events and require that

licensees take specific actions, usually to

assure that the intent of an existing rule or

requirement is being satisfied. Prompt

response by licensees is required and failure

to respond will normally result in NRC

enforcement action. NRC Bulletins

generally require one-time action and are not

intended as substitutes for formally issued
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-2 NUREG/CR-6042 Rev. 2

regulations or for imposed license

amendments.

NRR Generic Letters can compel licensees to

provide information concerning specific

safety issues. The licensees may have to

perform analyses of the significance of

particular issues at their respective plants.

The Generic Letter may indicate a resolution

process for the issue that is acceptable to the

NRC and ask the utilities to respond, either

accepting the proposed resolution process or

presenting an alternative approach for the

NRC to consider.

2.5.2 Precursor Program

Given the years of nuclear power plant

experience accrued in the U.S., one would

expect a large number of accident sequences

that could potentially lead to core damage to

have been revealed by incidents involving

beyond-design-basis initiators and/or

sequences of events. Such incidents are

commonly referred to as precursors of severe

accidents. The NRC collects and evaluates

some data for the purpose of identifying

these severe accident precursors.

When the NRC determines that a particular

event, usually identified in a Licensee Event

Report (LER), is worth further investigation,

the Accident Sequence Precursor (ASP)

Program is used to evaluate the potential

core damage frequency importance of the

event. The ASP program uses a simplified

set of event trees and fault trees for the

analysis, in essence performing a mini-PRA.

The intent of the program is not a high

degree of accuracy, but rather, relative

insights and selection of events for further

NRC study. In the analysis of an event, the

probabilities of failure that actually occurred

are set to 1.0 and additional failures that

could have led to core damage are quantified

to determine how close the particular event

came to core damage. This results in an

estimate of the core damage frequency that

is conditional on the event, and is called the

conditional core damage probability. Table

2.5-3 shows the results of ASP analyses of

several precursor events. For example, this

table indicates that the Browns Ferry Fire

came closer to core damage than most other

precursors.

The modeling of precursor events has

changed significantly over the life of the

program, introducing variability into the

reported results that prevent meaningful

examination of trends in the conditional core

damage probabilities. However, it is

instructive to examine the mix of

contributors found to be important to

precursors over the life of the program. For

the past several years, more than half of the

precursor events have involved electric

power-related issues. Events involving the

degradation of auxiliary feedwater have

generally been found to be the second most

common.

Several studies of precursors have been

conducted.3 Regulatory actions have been

taken to reduce the threat from some of the

accidents identified in precursor studies. For

example, station blackout, loss of feedwater,

and Anticipated Transients Without Scram

(ATWS) are discussed in Section 2.4.

2.5.3 NUREG-1150 Perspectives

NUREG-1150, which was published in

December 1990, documents the results of an

extensive NRC-sponsored PRA.4 The study

examined five plants of varying designs to

give an understanding of risk for these

particular plants. Selected insights regarding

classes of plants were also obtained in the

study, and these were further developed

through the IPE program discussed in

Section 2.5.5. The improved PRA

methodology used in the NUREG-1150 study

significantly enhanced the understanding of
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-3 NUREG/CR-6042 Rev. 2

risk at nuclear power plants, and can be

considered as a replacement for the Reactor

Safety Study.

The five nuclear power plants analyzed in

NUREG-1150 are:

? Unit 1 of the Surry Power Station, a

Westinghouse-designed three-loop reactor

in a subatmospheric containment

building, located near Williamsburg,

Virginia;

? Unit 1 of the Zion Nuclear Power Plant,

a Westinghouse-designed four-loop

reactor in a large, dry containment

building, located near Chicago, Illinois;

? Unit 1 of the Sequoyah Nuclear Power

Plant, a Westinghouse-designed four-loop

reactor in an ice condenser containment

building, located near Chattanooga,

Tennessee;

? Unit 2 of the Peach Bottom Atomic

Power Station, a General Electricdesigned BWR-4 reactor in a Mark I

containment building, located near

Lancaster, Pennsylvania;

and

? Unit 1 of the Grand Gulf Nuclear Station,

a General Electric-designed BWR-6

reactor in a Mark III containment

building, located near Vicksburg,

Mississippi.

A Level 3 PRA for internal events was

performed for each of these plants. As we

proceed through the remainder of Section

2.5.3, the results and insights of NUREG1150 will be presented within the context of

current PRA methods. See Appendix 1A for

a summary of these methods.

The frequency of core damage initiated by

external events has been analyzed for two of

the plants in NUREG-1150, Surry and Peach

Bottom. The analysis examined a broad

range of external events (e.g., lightning,

aircraft impact, tornadoes, and volcanic

activity). Most of these events were

assessed to be insignificant contributors by

means of bounding analyses. However,

seismic events and fires were found to be

potentially major contributors and thus were

analyzed in detail.

The following sections provide a summary of

the key results from the NUREG-1150 study.

The internal events results are discussed

first, followed by the seismic results, and

then the fire results.

2.5.3.1 Internal Events Results

The internal-event core damage frequency

distributions from NUREG-1150 are

included as Figure 2.5-1.44 The bars in

Figure 2.5-1 show the 90% uncertainty

ranges along with the mean and median

values.

Figure 2.5-1 reflects core damage

frequencies that are relatively low. Except

for a particular sequence involving

component cooling water at Zion (plant

changes have subsequently been made to

address this), there are no serious

vulnerabilities that yield unusually high risk.

This is due in part to good design and

operating procedures. It is also due to the

fact that these plants have been studied

b e f o r e a n d p r e v i o u s l y i d e n t i f i e d

vulnerabilities have been fixed. A similar

result occurred because of the Individual

Plant Examination (IPE) program, which is

discussed in Section 2.5.5. Through PRAs

that were performed for that program, many

plant shortcomings were uncovered and then

fixed for plants that had not previously been

evaluated using PRA.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-4 NUREG/CR-6042 Rev. 2

The various accident sequences that

contribute to the core damage frequency

from internal initiators can be grouped by

common factors into categories. NUREG1150 uses the accident categories depicted in

Figures 2.5-2 and 2.5-3: station blackout,

anticipated transients without scram, other

transients, reactor coolant pump seal LOCAs,

interfacing system LOCAs, and other

LOCAs. The selection of such categories is

not unique, but merely a convenient way to

group the results.

The existence of a highly dominant accident

sequence does not of itself imply that a

safety problem exists. For example, if a

plant has an extremely low estimated core

damage frequency, the existence of a single

dominant accident sequence would have

little significance. Similarly, if a plant was

modified to eliminate the dominant accident

sequence, another accident sequence or

group of accident sequences would become

dominant. Nevertheless, the identification of

dominant accident sequences and the failures

that contribute to those sequences provide

understanding of why the core damage

frequency is high or low relative to other

plants and desired goals. This qualitative

understanding of the core damage frequency

is necessary to make practical use of the

PRA results and improve the plants, if

necessary.

The remainder of this section summarizes

the internal events results for the BWR and

PWR plants examined in NUREG-1150. A

somewhat detailed description of results is

provided here to give concrete examples of

plant-specific and generic factors that can be

important to risk. This paves the way to the

generic discussion of risk, based on the IPE

results, that is included in Section 2.5.5.

2.5.3.1.1 NUREG-1150 Boiling Water

Reactor Observations

As shown in Figure 2.5-2, the internal-event

core damage frequencies for Peach Bottom

and Grand Gulf are extremely low.

Therefore, even though dominant accident

sequences and contributing failure events can

be identified, these items should not be

considered as safety problems for the two

plants. In fact, these dominating factors

should not be overemphasized because, for

core damage frequencies below 1×10

-5, it is

possible that other events outside the scope

of these internal-event analyses are the ones

that actually dominate. In the cases of these

two plants, the real perspectives come not

from understanding why particular sequences

dominate, but rather why all types of

sequences considered in NUREG-1150 have

low frequencies for these plants.

LOCA sequences can be expected to have

low core damage frequencies at BWRs

because of the numerous systems available

to provide coolant injection. While low for

both plants, the frequency of LOCAs is

higher for Peach Bottom than for Grand

Gulf. This is primarily because Grand Gulf

is a BWR-6 design with a motor-driven

high-pressure core spray system, rather than

a steam-driven high-pressure coolant

injection system as is Peach Bottom. Motordriven systems are typically more reliable

than steam-driven systems and, more

importantly, can operate over the entire

range of pressures experienced in a LOCA

sequence.

It is evident from Figures 2.5-2 and 2.5-3

that station blackout plays a major role in

the internal-event core damage frequencies

for Peach Bottom and Grand Gulf. Each of

these plants has features that tend to reduce

the station blackout frequency, some of

which would not be present at other BWRs.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-5 NUREG/CR-6042 Rev. 2

Grand Gulf, like all BWR-6 plants, is

equipped with an extra diesel generator

dedicated to the high-pressure core spray

system. While effectively providing a third

train of redundant emergency AC power for

decay heat removal, the extra diesel also

provides diversity, based on a different

diesel design and plant location relative to

the other two diesels. This results in a low

probability of common-cause failures

affecting all three diesel generators. The net

effect is a highly reliable emergency AC

power capability. In those unlikely cases

where all three diesel generators fail, Grand

Gulf relies on a steam-driven coolant

injection system that can function until the

station batteries are depleted. At Grand Gulf

the batteries are sized to last for many hours

prior to depletion so that there is a high

probability of recovering AC power prior to

core damage. In addition, there is a dieseldriven firewater system available that can be

used to provide coolant injection in some

sequences involving the loss of AC power.

Peach Bottom is an older model BWR that

does not have a diverse diesel generator for

the high-pressure emergency core coolant

system. However, other factors contribute to

a low station blackout frequency at Peach

Bottom. Peach Bottom is a two-unit site,

with four diesel generators available. Any

one of the four diesels can provide sufficient

capacity to power both units in the event of

a loss of offsite power, given that

appropriate crossties or load swapping

between Units 2 and 3 are used. This high

level of redundancy is somewhat offset by a

less redundant service water system that

provides cooling to the diesel generators.

Subtleties in the design are such that if a

certain combination of diesel generators

fails, the service water system will fail,

causing the other diesels to fail. In addition,

station DC power is needed to start the

diesels. (Some emergency diesel generator

systems, such as those at Surry, have a

separate dedicated DC power system just for

starting purposes.) In spite of these factors,

the redundancy in the Peach Bottom

emergency AC power system is considerable.

While there is redundancy in the AC power

system design at Peach Bottom, a more

significant factor is a high-quality diesel

generator maintenance program. Plantspecific data analysis determined that the

diesel generators at Peach Bottom were an

order of magnitude more reliable than at an

average plant.

Finally, Peach Bottom, like Grand Gulf, has

station batteries that are sized to last several

hours in the event that the diesel generators

do fail. With two steam-driven systems to

provide coolant injection and several hours

to recover AC power prior to battery

depletion, the station blackout frequency is

further reduced.

Unlike most PWRs, the response of

containment is often a key in determining

the core damage frequency for BWRs. For

example, at Peach Bottom, there are a

number of ways in which containment

conditions can affect coolant injection

systems. High pressure in containment can

lead to closure of primary system relief

valves, thus failing low-pressure injection

systems, and can also lead to failure of

steam-driven high-pressure injection systems

due to high turbine exhaust backpressure.

High suppression pool temperatures can also

lead to the failure of systems that are

recirculating water from the suppression pool

to the reactor coolant system. If the

containment ultimately fails, certain systems

can fail because of the loss of net positive

suction head in the suppression pool, and

also the reactor building is subjected to a

harsh steam environment that can lead to

failure of equipment located there.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-6 NUREG/CR-6042 Rev. 2

Despite the concerns described in the

previous paragraph, the core damage

frequency for Peach Bottom is relatively

low, compared to the PWRs studied in

NUREG-1150. There are two major reasons

for this. First, Peach Bottom has the ability

to vent the wetwell through a 6-inch

diameter steel pipe, thus reducing the

containment pressure without subjecting the

reactor building to steam. While this vent

cannot be used to mitigate ATWS and

station blackout sequences, it is valuable in

reducing the frequency of many other

sequences. The second important feature at

Peach Bottom is the presence of the control

rod drive hydraulic cooling system, which

can provide sufficient coolant to the vessel

in some accident sequences, and which is not

affected by either high pressure in

containment or containment failure. Other

plants of the BWR-4 and BWR-5 designs are

potentially vulnerable to containment-related

problems. As a result, the NRC has

negotiated changes to containment venting

for BWR-4 plants. These changes are

discussed further in Module 4.

The Grand Gulf design is generally much

less susceptible to containment-related

problems than Peach Bottom. The

containment design and equipment locations

are such that containment rupture will not

result in discharge of steam into the building

containing the safety systems. Further, the

high-pressure core spray system is designed

to function with a saturated suppression pool

so that it is not affected by containment

failure. Finally, there are other systems that

can provide coolant injection using water

sources other than the suppression pool.

Thus, containment failure is relatively

benign as far as system operation is

concerned, and there is no obvious need for

containment venting.

2.5.3.1.2 NUREG-1150 Pressurized Water

Reactor Observations

The three PWRs examined in NUREG-1150

reflect much more variety in terms of

dominant accident sequences than the BWRs.

While the sequence frequencies are generally

low, it is useful to understand why the

variations among the plants occurred.

For LOCA sequences, the frequency is

significantly lower at Surry than at the other

two PWRs. A major portion of this

difference is directly tied to the additional

redundancy available in the injection

systems. In addition to the normal highpressure injection capability, Surry can

crosstie to the other unit at the site for an

additional source of high-pressure injection.

This reduces the core damage frequency due

to LOCAs and also certain groups of

transients involving stuck-open relief valves.

In addition, at Sequoyah there is a

particularly noteworthy emergency core

cooling interaction with containment

engineered safety features in LOCAs. In this

(ice condenser) containment design, the

containment sprays are automatically

actuated at a very low pressure setpoint,

which would be exceeded for virtually all

small LOCA events. This spray actuation, if

not terminated by the operator, can lead to a

rapid depletion of the refueling water storage

tank at Sequoyah. Thus, an early need to

switch to recirculation cooling may occur.

Portions of this switchover process are

manual at Sequoyah and, because of the

timing and possible stressful conditions, lead

to a significant human error probability.

Thus, LOCA-type sequences are the

dominant accident sequence type at

Sequoyah.

Station blackout-type sequences have

relatively similar frequencies at all three

PWRs. Station blackout sequences can have
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-7 NUREG/CR-6042 Rev. 2

very different characteristics at PWRs than

at BWRs. One of the most important

findings of NUREG-1150 is the importance

of reactor coolant pump seal failures for the

Westinghouse plants that were studied.

During station blackout, all cooling to the

seals is lost for these plants and there is a

significant probability that they will

ultimately fail, leading to an induced LOCA

and loss of inventory. Because the NUREG1150 PWRs do not have systems capable of

providing coolant makeup without AC

power, core damage will result if power is

not restored. The seal LOCA reduces the

time available to restore power and thus

increases the station blackout-induced core

damage frequency. New seals have been

proposed for Westinghouse PWRs and could

reduce the core damage frequency if

implemented, although they might also

increase the likelihood that any resulting

accidents would occur at high pressure,

which has implications for the accident

progression analysis.

Apart from the generic reactor coolant pump

seal question, station blackout frequencies at

PWRs are determined by the plant-specific

electric power system design and the design

of other support systems. Battery depletion

times for the three PWRs were projected to

be shorter than for the two BWRs. A unique

characteristic of the Surry plant is a gravityfed service water system with a canal that

may drain during station blackout, thus

failing containment heat removal. When

power is restored, the canal must be refilled

before containment heat removal can be

restored.

The dominant accident sequence type at Zion

is not a station blackout, but it has many

similar characteristics. Component cooling

water is needed for operation of the charging

pumps and high-pressure safety injection

pumps at Zion. Loss of component cooling

water (or loss of service water, which will

also render component cooling water

inoperable) will result in loss of these highpressure systems. This in turn leads to a

loss of reactor coolant pump seal injection.

Simultaneously, loss of component cooling

water will also result in loss of cooling to

the thermal barrier heat exchangers for the

reactor coolant pump (RCP) seals. Thus, the

reactor coolant pump seals will lose both

forms of cooling. As with station blackout,

loss of component cooling water or service

water can both cause a small LOCA (by seal

failure) and disable the systems needed to

mitigate it. The importance of this scenario

is increased further by the fact that the

component cooling water system at Zion,

although it uses redundant pumps and

valves, delivers its flow through a common

header. The licensee for the Zion plant has

made procedural changes and is also

considering both the use of new RCP seal

m a t e r i a l s a n d the installatio n o f

modifications to the cooling water systems.

ATWS frequencies are generally low at all

three of the PWRs. This is due to the

assessed reliability of the shutdown systems

and the likelihood that only slow-acting,

low-power-level events will result. While of

low frequency, it is worth noting that

interfacing-system LOCA (V) and steam

generator tube rupture (SGTR) events do

contribute significantly to risk for the PWRs.

This is because they involve a direct path for

fission products to bypass containment.

There are large uncertainties in the analyses

of these two accident types, but these events

can be important to risk even at frequencies

that may be one or two orders of magnitude

lower than other sequence types.

Most Westinghouse PWRs have developed

procedures for using feed and bleed cooling

and secondary system blowdown to cope

with loss of all feedwater. These procedures

have led to substantial reductions in the

frequencies of transient core damage
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-8 NUREG/CR-6042 Rev. 2

sequences involving the loss of main and

auxiliary feedwater. Appropriate credit for

these actions was given in these analyses.

However, there are plant-specific features

that will affect the success rate of such

actions. For example, the loss of certain

power sources (possibly only one bus) or

other support systems can fail poweroperated relief valves (PORVs) or

atmospheric dump valves or their block

valves at some plants, precluding the use of

feed and bleed or secondary system

blowdown. Plants with PORVs that tend to

leak may operate for significant periods of

time with the block valves closed, thus

making feed and bleed less reliable. On the

other hand, if certain power failures are such

that open block valves cannot be closed,

then they cannot be used to mitigate stuckopen PORVs. Thus, both the system design

and plant operating practices can be

important to the reliability assessment of

actions such as feed and bleed cooling.

2.5.3.2 NUREG-1150 Seismic Analysis

Observations

Figures 2.5-4 and 2.5-5 show the results of

the core damage frequency analysis for

seismic-initiated accidents, as well as

internally and fire-initiated accidents, for

Surry and Peach Bottom, respectively.

Examination of these figures shows that the

core damage frequency distributions of the

seismic events are comparable to those of

the internal events. It is evident that the

seismic events are significant in the total

safety profile of these plants. The key

features of the seismic results for Surry and

Peach Bottom are discussed in the following

two sections.

The analysis of the seismically induced core

damage frequency begins with the estimation

of the seismic hazard, that is, the likelihood

of exceeding different earthquake groundmotion levels at the plant site. At the time

the NUREG-1150 study was performed, there

was no agreement on a model for the seismic

hazard. NUREG-1150 used seismic hazard

curves for Peach Bottom and Surry that were

part of an NRC-funded Lawrence Livermore

National Laboratory project that resulted in

seismic hazard curves for all nuclear power

plant sites east of the Rocky Mountains.5

For purposes of completeness and

comparison, the seismically induced core

damage frequencies were also calculated

based upon a separate set of seismic hazard

curves developed by the Electric Power

Research Institute (EPRI).6 Both sets of

results are presented in this section. Since

the NUREG-1150 study was completed,

resolution on the seismic hazard curves has

been achieved.7

As can be seen in Figures 2.5-6 and 2.5-7,

the shapes of the seismically induced core

damage frequency distributions are

considerably different from those of the

internally initiated and fire-initiated events.

In particular, the 5th to 95th percentile range

is much larger for the seismic events. In

addition, as can be seen in Figures 2.5-4 and

2.5-5, the wide disparity between the mean

and the median and the location of the mean

relatively high in the distribution indicate a

wide distribution with a tail at the high end

but peaked much lower down. This is a

result of the uncertainty in the seismic

hazard curve.

The difference between the mean and median

is an important distinction. The mean is the

parameter quoted most often, but the bulk of

the distribution is well below the mean.

Thus, although the mean is the "center of

gravity" of the distribution (when viewed on

a linear rather than logarithmic scale), it is

not very representative of the distribution as

a whole. Instead, it is the lower values that

are more probable. The higher values are

estimated to have low probability, but,

because of their great distance from the bulk
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-9 NUREG/CR-6042 Rev. 2

of the distribution, the mean is "pulled up"

to a relatively high value. In a case such as

this, it is particularly evident that the entire

distribution, not just a single parameter such

as the mean or the median, must be

considered when discussing the results of the

analysis.

2.5.3.2.1 Surry Seismic Analysis

The core damage frequency probability

distributions, as calculated using the

Livermore and EPRI methods, have a large

degree of overlap. The differences between

the means and medians of the two resulting

distributions are not very meaningful

because of the large widths of the two

distributions.

As shown in Figure 2.5-8, the breakdown of

the Surry seismic analysis into principal

contributors is reasonably similar to the

results of other seismic PRAs for other

PWRs. The total core damage frequency is

dominated by loss of offsite power transients

resulting from seismically induced failures

of the ceramic insulators in the switchyard.

This dominant contribution of ceramic

insulator failures has been found in virtually

all seismic PRAs to date.

A site-specific but significant contributor to

the core damage frequency at Surry is failure

of the anchorage welds of the 4kV buses.

These buses play a vital role in providing

emergency AC electrical power since offsite

power as well as emergency onsite power

passes through these buses. Although these

welded anchorages have more than adequate

capacity at the safe shutdown earthquake

(SSE) level, they do not have sufficient

margin to withstand (with high reliability)

earthquakes in the range of four times the

SSE, which are contributing to the overall

seismic core damage frequency results.

Another area of generic interest is the

contribution due to vertical flat-bottomed

storage tanks (e.g., refueling water storage

tanks and condensate storage tanks).

Because of the nature of their configuration

and field erection practices, such tanks have

often been calculated to have relatively

smaller margin over the SSE than most

components in commercial nuclear power

plants. Given that all PWRs in the United

States use the refueling water storage tank as

the primary source of emergency injection

water (and usually the sole source until the

recirculation phase of ECCS begins), failure

of the refueling water storage tank can be

expected to be a substantial contributor to

the seismically induced core damage

frequency.

2.5.3.2.2 Peach Bottom Seismic Analysis

As can be seen in Figure 2.5-8, the dominant

contributor in the seismic core damage

frequency analysis is a transient sequence

brought about by loss of offsite power. The

loss of offsite power is due to seismically

induced failures of onsite AC power. Peach

Bottom has four emergency diesel

generators, all shared between the two units,

and four station batteries per unit. Thus,

there is a high degree of redundancy.

However, all diesels require cooling

provided by the emergency service water

system, and failure to provide this cooling

will result in failure of all four diesels.

There is a variety of seismically induced

equipment failures that can fail the

emergency service water system and result in

a station blackout. These include failure of

the emergency cooling tower, failures of the

4 kV buses (in the same manner as was

found at Surry), and failures of the

emergency service water pumps or the

emergency diesel generators themselves.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-10 NUREG/CR-6042 Rev. 2

The various combinations of these failures

result in a large number of potential failure

modes and give rise to a relatively high

frequency of core damage based on station

blackout. None of these equipment failure

probabilities is substantially greater than

would be implied by the generic fragility

data available. However, the high

probability of exceedance of larger

earthquakes (as prescribed by the hazard

curves for this site) results in significant

contributions of these components to the

seismic risk.

2.5.3.3 NUREG-1150 Fire Analysis

Observations

The core damage likelihood due to a fire in

any particular area of the plant depends upon

the frequency of ignition of a fire in the

area, the amount and nature of combustible

material in that area, and the nature and

efficacy of the fire-suppression systems in

that area. In NUREG-1150, fire analyses

were performed for the Surry and Peach

Bottom plants.

Similar to the seismic results, Figure 2.5-9

shows the results of the core damage

frequency analysis for fire-initiated accidents

are comparable to those of the internal

events for Surry and Peach Bottom. It is

evident that the fire events are significant in

the total safety profile of these plants. The

key features of the fire results for Surry and

Peach Bottom are discussed below, followed

by a summary of common characteristics of

fire sequences for the two plants.

2.5.3.3.1 Surry Fire Analysis

Figure 2.5-9 shows the dominant

contributors to core damage frequency

resulting from the Surry fire analysis. The

dominant contributor is a transient resulting

in a reactor coolant pump seal LOCA, which

can lead to core damage. The scenario

consists of a fire in the emergency

switchgear room that damages control power

for the high-pressure injection and

component cooling water pumps. Cable

trays for the two redundant power trains

were run one on top of the other with

approximately 8 inches of vertical separation

in a number of plant areas, which gives rise

to the common vulnerability of these two

systems due to fire. In addition, the Halon

fire-suppression system in the emergency

switchgear room is manually actuated.

The other principal contributor is a

spuriously actuated pressurizer PORV. In

this scenario, fire-related component damage

in the control room includes control power

for a number of safety systems.

2.5.3.3.2 Peach Bottom Fire Analysis

Figure 2.5-9 shows the mechanisms by

which fire leads to core damage in the Peach

Bottom analysis. Station blackout accidents

are the dominant contributor, with

substantial contributions also coming from

fire-induced transients and losses of offsite

power.

Control room fires are of considerable

significance in the fire analysis of this plant.

The cable spreading room below the control

room is significant but not dominant in the

fire analysis. The remaining physical areas

of significance are the emergency switchgear

rooms.

2.5.3.3.3 General Observations on Fire

Analysis

Figures 2.5-8 and 2.5-9 clearly indicate that

fire-initiated core damage sequences are

significant in the total probabilistic analysis

of the two plants analyzed. These analyses

include credit for the fire protection

programs required by Appendix R to 10 CFR

Part 50.8
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-11 NUREG/CR-6042 Rev. 2

Although the two plants are of completely

different design, with completely different

fire-initiated core damage scenarios, the

possibility of fires in the emergency

switchgear areas is important in both plants.

The importance of the emergency switchgear

room at Surry is particularly high because of

the reactor coolant pump seal LOCA

scenario. Further, the importance of the

control room at Surry is comparable to that

of the control room at Peach Bottom.

This is not surprising in view of the

potential for simultaneous failure of several

systems by fires in these areas. Thus, in the

past such areas have generally received

particular attention in fire protection

programs. It should also be noted that the

significance of various areas also depends

upon the scenario that leads to core damage.

For example, the importance of the

emergency switchgear room at Surry could

be altered (if desired) not only by more fire

protection programs but also by changes in

the probability of the reactor coolant pump

seal failure.

2.5.4 Individual Plant Examinations

The NRC issued Generic Letter (GL) 88-20

in November 1988, requesting that all

licensees perform an Individual Plant

Examination (IPE) "to identify any plantspecific vulnerabilities to severe accidents

and report the results to the Commission."

The purpose and scope of the IPE effort

includes examining internal events occurring

at full-power, including those initiated by

internal flooding. In response, the staff

received 75 IPE submittals covering 108

nuclear power plant units. The staff then

examined the IPE submittals to determine

what the collective IPE results imply about

the safety of U.S. nuclear power plants and

how the IPE program has affected reactor

safety.

9 A summary of the Level 1 findings

is provided in the following sections.

Insights related to accident progression are

discussed in Module 4.

2.5.4.1 Vulnerabilities and Plant

Improvements

The primary goal of the IPE Program was for

licensees to "identify plant-specific

vulnerabilities to severe accidents that could

be fixed with low-cost improvements."

However, GL 88-20 did not specifically

define what constitutes a vulnerability;

hence, the IPEs exhibit considerable

diversity in the criteria used to define a

vulnerability. The wording used in some

submittals is such that it is not always clear

whether a licensee is identifying a finding as

a "vulnerability" or as some other issue

worthy of attention. Therefore, a problem

considered to be a vulnerability at one plant

may not have been specifically identified as

a vulnerability at another plant. In fact, only

four licensees with boiling water reactor

(BWR) plants and 15 licensees with

pressurized water reactor (PWR) plants

explicitly stated that their plants had

vulnerabilities. However, nearly all of the

licensees identified other areas warranting

investigation for potential improvements.

Over 500 proposed improvements were

identified by the licensees to address

perceived weaknesses in plant design or

operation. Most of t h e s e p l a nt

improvements are classified as procedural/

operational changes (approximately 45%),

design/hardware changes (approximately

40%), or both. Few of the improvements

involve maintenance-related changes.

Typically, the procedural or design changes

indicate revised training in order to properly

implement the actual change. Many of these

proposed improvements have already been

implemented at the plants, and others are

still under consideration.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-12 NUREG/CR-6042 Rev. 2

Some improvements are associated with

other requirements (primarily the station

blackout rule) and utility activities.

However, although these improvements were

not necessarily identified as a result of the

IPE, in some cases, the licensee is using the

IPE to prioritize the improvements and to

s u p p o r t d e c i s i o n s r e ga r d i n g t h e i r

implementation. The specific improvements

vary from plant to plant. However,

numerous improvements that had significant

impact on plant safety include changes to

AC and DC power, coolant injection

systems, decay heat removal systems,

heating, ventilating and air conditioning, and

PWR reactor coolant pump seals.

2.5.4.2 CDF Perspectives from the IPEs

The IPE results indicate that the plant core

damage frequency (CDF) is often determined

b y m a n y d i ff e r e n t s e q u e n c e s ( i n

combination), rather than being dominated

by a single sequence or failure mechanism.

The largest contributors to plant CDF and

the dominant failures contributing to those

sequences vary considerably among the

plants (e.g., some are dominated by LOCAs,

while others are dominated by station

blackout [SBO]). However, for most plants,

support systems are important to the results

because support system failures can result in

failures of multiple front-line systems.

Further, the support system designs and

dependency of front-line systems on support

systems vary considerably among the plants.

That variation explains much of the

variability observed in the IPE results.

Consistent with previous risk studies, the

CDFs reported in the IPE submittals are

lower, on average, for BWR plants than for

PWR plants, as shown in Figure 2.5-10.

Although both BWR and PWR results are

strongly affected by the support system

considerations discussed above, a few key

differences between the two types of plants

contribute to this tendency for lower BWR

CDFs and cause a difference in the relative

contributions of the accident sequences to

plant CDF. The most significant difference

is that BWRs have more injection systems

than PWRs and can depressurize more easily

to use low-pressure injection systems. This

gives BWRs a lower average contribution

from LOCAs. However, the results for

individual plants can vary from this general

trend. As shown in Figure 2.5-10, the CDFs

for many BWR plants are actually higher

than the CDFs for many PWR plants. The

variation in the CDFs is primarily driven by

a combination of the following factors,

which are further detailed in Table 2.5-4:

? plant design differences (primarily in

support systems such as cooling water,

electrical power, ventilation, and air

systems)

? variability in modeling assumptions

(including whether the models accounted

for alternative accident mitigating

systems)

? differences in data values (including

human error probabilities) used in

quantifying the models.

2.5.5 Individual Plant Examinations for

External Events

On June 28, 1991, the U.S. Nuclear

Regulatory Commission (NRC) issued

Supplement 4 to Generic Letter (GL) 88-20,

“IndividualPlantExaminationofExternal

Events (IPEEE) for Severe Accident

Vulnerabilities, 10 CFR 50.54(f).” In

particular, the external events considered in

the IPEEE program include seismic events;

internal fires; and high winds, floods, and

other (HFO) external initiating events
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-13 NUREG/CR-6042 Rev. 2

involving accidents related to transportation

and nearby facilities1.

Along with Supplement 4 to GL 88-20, the

NRCissuedNUREG-1407,“Procedureand

Submittal Guidance for the Individual Plant

Examination of External Events (IPEEE) for

Severe Accident Vulnerabilities,”in June

1991. In NUREG-1407, the NRC provided

guidelines for conducting IPEEEs.

Subsequent to the publication of NUREG1407, the NRC issued Supplement 5 to GL

88-20 on September 8, 1995, to notify

licensees of modifications to the

recommended scope of the seismic portion

of the IPEEE for certain plant sites in the

eastern United States (EUS).

The NRC received 70 IPEEE submittals

covering all operating U.S. nuclear reactors.

(Some submittals covered more than one unit

at multi-unit sites with similar or almost

identical plant designs.) The staff of the

NRC’s Office of Nuclear Regulatory

Research completed Staff Evaluation Reports

(SERs) which document the staff’soverall

conclusions for each of the IPEEE reviews.

A summary of perspectives obtained from

the IPEEEs is contained in NUREG 1742

and highlights are presented below.

Scope, Limitations, and General Comments

IPEEE studies have been limited to the

consideration of plant behavior under fullpower operating conditions. The

perspectives documented in this report are

somewhat limited for the following reasons:

(a) IPEEEs are intended to yield

predominantly qualitative perspectives,

rather than more quantitative findings; (b)

IPEEEs address several different types of

initiators of varying importance (for a given

plant) and, therefore, require the

implementation of different methods of

analyses offering varying levels of detail and

accuracy; and (c) even for a given type of

external initiator, the procedures and

methods used by the various licensees to

conduct their IPEEEs have also varied

considerably.

Additionally, the IPEEE submittals used

various sources of information, such as use

of seismic hazard curves derived from

different sources (e.g., Lawrence Livermore

National Laboratory [NUREG/CR-1488 and

NUREG/CR-5250]; Electric Power Research

Institute [EPRI, 1989]; and site-specific

studies), or applied simplified conservative

methods in some studies while others used

more realistic approaches. These differences

make it difficult to draw plant-to-plant

c o m p a r i s o n s o f a n a l ys i s r e s u l t s .

Comparisons of IPEEE results among plants

and among the various types of external

hazards are also limited because of

variations in the quality of submittals.

Seismic Events

Licensees used one of two methodologies to

conduct their seismic IPEEEs. The first was

a seismic probabilistic risk assessment

(SPRA) consisting of at least a Level 1

analysis and a qualitative containment

performance analysis. The second was a

seismic margins assessment (SMA) method,

including a qualitative containment

performance analysis.

Almost all licensees reported in their IPEEE

submittalsthatno plant“vulnerabilities”

were identified with respect to seismic risk

1On November 23, 1988, the NRC issued

GL 88-20, “Individual Plant Examination for

Severe Accident Vulnerabilities, 10 CFR

50.54(f),”to licensees of nuclear power plants.

GL 88-20 outlined the objectives and overall

logistics of the Individual Plant Examination

(IPE) program, which solely addresses internally

initiated events (including internal flooding).
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-14 NUREG/CR-6042 Rev. 2

(the use of the term vulnerability varied

widely among the IPEEE submittals).

However, most licensees did report at least

someseismic“anomalies,”“outliers,”and/or

other concerns. In the few submittals which

identified a seismic “vulnerability,” the

concerns identified were comparable to

concerns identified as outliers or anomalies

in other submittals.

For plants that performed SPRA analyses,

most plants reported seismic CDFs between

1E-5 and 1E-4 per reactor-year (ry), with the

next most common group falling between

1E-6 and 1E-5/ry, see Figure 2.5-11. Only

a small fraction of plants had CDFs higher

than 1E-4/ry or less than 1E-6/ry.

For plants that performed SMA analyses,

plant HCLPF capacities are between 0.12g

and 0.3g, see Figure 2.5-12. Fourteen

licensees reported plant HCLPFs of at least

0.3g, ten plants fell between 0.25 and 0.3g,

nine plants were between 0.2 and 0.25g, and

two plants were between 0.15 and 0.2g. One

plant reported a HCLPF value of 0.12g. With

the proposed improvements taken into

account, SMA results indicate that for all

plants the HCLPF is never below the safe

shutdown earthquake (SSE) and generally

exceeds the SSE, see Figure 2.5-13.

Dominant contributors from SPRAs for

seismic failure involve the failure of the

electrical systems, which include the failure

of offsite power (17% of all contributors);

the failure of various components of the

electrical system (17%), such as motor

control centers (MCCs), switchgear, and

relays; the failure of the emergency diesel

generator (EDG) (8%); and the failure of the

dc batteries (5%). Building and structural

failures also contribute significantly (30% of

all contributors). Other structures of which

failure could cause core damage include

block walls, pump house/pump intake

structures, dams, and stacks. Failures of

frontline and support systems (28% of all

contributors), as well as tank failures (11%)

also contribute to core damage frequency.

The weak link components identified in the

SMA analyses in general were similar to the

structures, systems, and components (SSCs)

listed as dominant contributors in the

SPRAs. Components identified as outliers

in the SMAs included many electrical

components and their anchorage, various

tanks, residual heat removal (RHR) heat

exchangers, and structures like the turbine

and auxiliary buildings. Many licensees

identified block walls located in the

proximity of safety-significant equipment as

weak link structures.

Seventy percent of the plants proposed

improvements as a result of their seismic

IPEEE analyses. In some cases these plant

improvements were only proposed in the

submittals (sometimes without a firm

commitment for implementation), while in

others the submittals indicated the

improvements were already implemented.

I m p r o v e m e n t s v a r y f r o m s i m p l e

housekeeping enhancements to more

elaborate plant design modifications and can

generally be grouped into three general

categories: hardware modifications,

improved procedures and training, and

enhanced maintenance and housekeeping.

Based on the improvements described by

licensees it is clear that the seismic IPEEE

program has had a notable impact on

improving plant safety.

Fires

For the purposes of the IPEEE fire

assessments, all licensees utilized

probabilistic analysis methods in one form or

another. By far the most commonly cited

analysis approach was the EPRI Fire-Induced

Vu l n e r a b i l i t y E v a l u a t i o n ( F I V E )

methodology [EPRI 1992]. The FIVE
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-15 NUREG/CR-6042 Rev. 2

methodology was cited as being used to

supportabout81% ofthelicensees’IPEEE

submittals. However, most of these

submittals also went beyond the FIVE

approach and applied PRA methods as a

supplement to the FIVE method.

The selected methodology did have some

impact on the final estimates of fire CDF,

but ultimately appeared to have little impact

on the overall findings of the IPEEE studies

(e.g., identification of dominant areas

contributing to fire CDF). Since FIVE is

primarily a screening method, those licensees

who stopped with FIVE screening generally

obtained higher total CDF estimates than

those who continued with more detailed fire

PRA-based quantification of unscreened

zones.

Out of all the IPEEE submittals, only two

licensees, representing three nuclear power

plant units, initially identified fire

vulnerabilities. In one case (Quad Cities),

the vulnerabilities were identified in the

licensee’soriginalIPEEE submittalanda

detailed re-analysis by the licensee showed

that fire vulnerabilities did not exist.

However, the licensee did make plant

improvements as a result of the insights

gained in the original IPEEE analysis and

credited some of those improvements in the

re-analysis. In the second case (Millstone

2), two fire vulnerabilities were identified

and addressed by the licensee. For each of

the two plants the vulnerabilities included

fire safety issues in the turbine building

which housed important safety-related cables

and equipment needed for safe shutdown.

Turbine building areas were also identified

by many other licensees as important CDF

contributors.

Despite the fact that the vast majority of

licensees identified no fire-related

vulnerabilities, the majority of licensees,

over 60%, did identify and/or implement

plant improvements to reduce fire risk. A

total of approximately 242 fire-related plant

improvements were identified by licensees.

The majority of the cited plant improvements

(about 57%) were associated with various

plant procedures including operating

procedures, maintenance procedures,

combustible controls, enhancements to

operator training, enhanced fire brigade

training, etc. The remaining improvements

(about 43%) were related to physical

plant/hardware changes. These included

general plant system design changes,

enhancements to fire protection features,

relocation of critical cables, and upgrading

of fire barriers.

The fire-induced CDFs reported by the

licensees range from approximately 4E-8 to

2E-4 per reactor-year, see Figure 2.5-14. The

IPEEE fire analyses have broadly found fire

CDF to be roughly on a par with, and in

some cases greater than, internal events

CDF. The vast majority of licensees

reported fire CDF values that equal at least

10% of the internal events CDF (or greater).

About 25% of the submittals reported fireinduced CDF values that exceeded the

corresponding plant internal events CDF (as

reported in the IPE).

In the vast majority of cases, licensees

concluded that the dominant fire CDF

contributors were those areas that held both

significant fire sources and important

equipment and cables, see Figure 2.5-14.

Hence, it appears that spatial factors (e.g.,

the location of fire source and targets), were

more significant in determining fire risk than

were plant systems design features. Areas

devoid of either fire sources or important

targets generally were screened.

Overall, the two types of fire analysis zones

found most often to be the single highest fire

CDF contributors were switchgear areas and

MCRs. The next most commonly identified
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-16 NUREG/CR-6042 Rev. 2

areas were areas of the turbine building and

cable spreading rooms for plants with only a

single cable spreading room. Other

commonly reported areas include electrical

equipment rooms, diesel generator rooms,

cable vault and tunnel areas, and

battery/charger rooms. A range of other

areas are identified as important on a plantspecific basis.

In the specific case of the main control room

(MCR), fire CDF was dominated by the

abandonment scenarios; that is, unsuppressed

fires leading to MCR abandonment. In this

case, fire CDF estimates were driven largely

by two factors, namely, the assumed

conditional probability of MCR abandonment

and the reliability of human actions

associated with plant shutdown using the

remote shutdown capability.

Fire sources considered in the fire

assessments included both fixed sources

(e.g., electrical panels, pumps, transformers,

and electrical cables) and transient

combustibles. Electrical panel fires were the

most significant fire CDF contributors in

most submittals. In a minority of submittals,

transient combustible fires were also found

to be significant.

Fire-induced transients were found to be the

most important accident sequences. These

included loss of feedwater and main steam

isolation valve (MSIV) closure transients,

loss of off-site power (LOOP) events, and

loss of support system initiators. Loss-ofcoolant accidents (LOCAs) induced by

spurious opening of pressure-operated relief

valves (PORVs) or safety relief valves

(SRVs) were generally not identified as

significant contributors to the fire-related

CDF. However, fire scenarios resulting in

reactor coolant pump (RCP) seal LOCAs

were important for many Westinghouse

pressurized water reactors (PWRs).

High Winds, Floods, and Other External

Events

The following types of events were included

in the high winds, floods and other (HFO)

external events category:

? High winds, including tornadoes, tornado

missiles, and hurricanes

? External floods, including intense rainfall

resulting in site flooding and roof

ponding; flooding from nearby bodies of

water including wave runup from rivers,

lakes and the ocean; and potential

flooding from postulated dam failures

? Accidents related to transportation or

nearby industrial facilities

? Other types of external events such as

onsite hazardous material spills,

hydrogen line breaks, effects from lowtemperature conditions such as icing and

blockage of cooling water intake lines,

blockage of drains and intakes from

debris, any other plant-unique hazard

None of the 70 IPEEE submittals identified

any HFO-related vulnerabilities; however, 34

submittals reported that they had either

made, or were considering, a total of 64

HFO-related plant improvements. Thirty-six

p l a n t s r e p o r t e d n o H F O - r e l a t e d

improvements.

All HFO evaluations reviewed have screened

out accidents involving transportation and

nearby facilities, and have also screened out

o t h e r p l a n t - u n i q u e h a z a r d s w h e n

encountered.

For those cases where the licensees

performed PRAs or CDF bounding analyses

for their HFO analysis, the estimated CDF

results have varied from plant to plant as

shown below.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-17 NUREG/CR-6042 Rev. 2

? For high winds and tornadoes, the plantspecific CDF results vary from less than

2E-7/ry to 6E-5/ry.

? For external flood events, the plantspecific CDF results vary from 2E-8/ry to

about 7E-6/ry.

? For transportation and nearby facility

accidents, all reported plant-specific CDF

results from PRA studies or bounding

analyses are below the NUREG-1407

screening criterion of 1E-6/ry.

? One submittal (Haddam Neck) reported

bounding analysis CDF results of 8E-6/ry

for lightning events and 7E-6/ry for snow

and ice.

? One submittal (South Texas) reported

CDF results of 8E-6/ry for a chemical

release from a nearby chemical facility.

? One submittal (Salem) reported a plant

improvement that resulted in an external

events CDF reduction of three orders of

magnitude from approximately 1E-4/ry to

approximately 1E-7/ry. The plant

modification cited was the improvement

of door penetration seals between the

service and auxiliary buildings to protect

against external flooding.

2.5.6 Low Power and Shutdown

Perspectives

Until recently, PRAs of severe accidents in

nuclear power plants have considered

initiating events that could occur only during

full-power operation. This focus was based

on the judgment that the level of risk

associated with accidents that could occur

during full-power operation was greater than

that for accidents during the other modes of

operation, such as low-power and shutdown.

The primary justification for this view

appeared to be that lower decay heat levels

are generally associated with these other

modes of operation, so more time is

available to recover from adverse situations

in these modes.

However, there are several factors that could

influence the risk associated with accidents

initiated during shutdown. These include:

1. The greater need for operator action to

prevent core damage (because automatic

safety systems are disabled during some

of the shutdown modes).

2. The increased unavailability of

equipment as a result of planned

maintenance. (There is a need for high

equipment availability during power

operation, which limits the amount and

length of maintenance activities that can

be performed while the plant is at

power.)

3. The breach of containment integrity

caused by the opening of penetrations

and hatches. (These openings, which are

allowed by technical specifications, in

many cases are necessary before the

activities planned for shutdown can

occur.)

In response to such concerns, the Office of

Nuclear Regulatory Research (NRR)

undertook a two-phase project to analyze the

frequencies, consequences, and risk of

accidents during modes of operation other

than full-power for two plants, and to

compare the results with those from fullpower analyses for the same plants10,11

. The

plants selected were Grand Gulf and Surry.

The analyses included a limited-scope Level

3 PRA for internal events and a Level 1

PRA for seismic and internal fire and flood

sequences. Because of the complexity of the

shutdown configurations, detailed analyses

were only performed for selected time

periods for the two plants.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-18 NUREG/CR-6042 Rev. 2

For Grand Gulf, a period called Plant

Operating State 5 (POS 5) was chosen. POS

5 covers cold shutdown operation (where the

reactor vessel is at atmospheric pressure and

the bulk water temperature is below 200 °F)

and the time in the refueling operating

condition until the vessel head is

detensioned. This period was chosen

because of its potentially large contribution

to core damage frequency (CDF) and risk.

For Surry, the evaluation was conducted for

mid-loop operation, in which the reactor

coolant system level is lowered to the midplane of the hot leg. This period was chosen

because many incidents have occurred during

mid-loop operation throughout the world,

and the apparent risk potential.

The results of the Grand Gulf and Surry

evaluations are presented below. It is

important to note that such results are highly

plant specific because of the unique

characterofeachplant’srefuelingprocess.

Grand Gulf and Surry have features that may

not be present at other plants which tend to

reduce the risk during low-power and

shutdown operations.

2.5.6.1 Grand Gulf Low Power and

Shutdown Observations

Figure 2.5-15 presents a comparison of mean

core damage frequency percentages for the

major classes of accidents from both the

NUREG-1150 full-power and the POS 5

analyses for Grand Gulf. In both analyses,

the station blackout class is important

because station blackouts cut across multiple

systems. However, during POS 5, there are

additional accidents (e.g., LOCAs) that can

cut across multiple systems. There are

differences in the accident progression

associated with station blackout accidents at

full-power versus during POS 5. These are:

(1) almost all the POS 5 station blackout

sequences lead to an interfacing system

LOCA and the full-power sequences do not;

(2) the containment is always open at the

start of POS 5 accidents whereas it is

isolated at the start of most full-power

accidents; and (3) the probability of arresting

the core damage process in the vessel is

higher for full-power accidents than for POS

5. In the full-power analysis the ATWS

class is the second most important class,

while ATWS is not possible during POS 5

since the plant is already subcritical. The

second most important class for POS 5 is

LOCAs.

Table 2.5-5 presents a comparison on a

calendar-year basis of the core damage

frequency, early fatality risk, and total latent

fatality risk for POS 5 and for full-power for

Grand Gulf. While the POS 5 mean core

damage frequency is about a factor of two

lower than the full-power value, there is

overlap between the two distributions. The

mean early fatality risk of POS 5 is only a

factor of 1.7 greater than the full-power risk

even though the containment is open during

most of the accidents in POS 5. The mean

total latent cancer fatality risk of POS 5 is

about a factor of 4 greater than the

corresponding full-power risk. One reason

for this is that in POS 5, the containment is

always open, and in full-power the

containment is always isolated at the start of

an accident. Also, some of the difference is

caused by different versions of the

consequence code being used for the two

studies. The version used for POS 5

generally results in higher estimates for the

total latent cancer fatality risk.

2.5.6.2 Surry Low Power and Shutdown

Observations

The contribution to the total core damage

frequency from internal events during midloop operation at Surry was found to be

lower by an order of magnitude than that at

full-power. This is mainly due to the much

smaller fraction of time that the plant is at
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-19 NUREG/CR-6042 Rev. 2

mid-loop. Figure 2.5-16 presents a

comparison of mean core damage frequency

percentages for the major classes of

accidents from both the NUREG-1150 fullpower and the mid-loop analyses for Surry.

Table 2.5-6 presents a comparison on a

calendar-year basis of the core damage

frequency, early fatality risk, and total latent

fatality risk for mid-loop operation and for

full-power for Surry. While the mid-loop

operation mean core damage frequency is an

order of magnitude lower than the full-power

value, there is some overlap between the two

distributions.

The offsite risk estimates for latent health

effects of accidents during mid-loop

operation were similar to the risk estimates

for full-power operation for Surry. This is

due to the lack of mitigative features for a

significant fraction of the accidents initiated

during mid-loop operation, which causes the

releases to the environment to be large. The

early health consequences are much lower

than the full-power results, despite the

unisolated containment, primarily because of

the long time after reactor trip when the

accidents occur in mid-loop operation (i.e.,

because of the natural decay of the shortlived isotopes of iodine and tellurium, which

are primarily associated with early health

effects). The uncertainties in risk for

accidents during mid-loop operations are

largely due to uncertainties associated with

isolating the containment and achieving a

pressure retaining capability.

2.5.6.3 Industry Low Power and

Shutdown Studies

During the 1990s, there was substantial

industry effort to understand and manage

low power and shutdown risks. The NRC

did not include low power and shutdown in

the IPE program; however, most licensees

have performed some type of analysis of

low power and shutdown risks. In

particular, most licensees use some form of

risk management tool to help manage

planned outages. These efforts have led to

safer plant configurations during outages,

while in some cases, resulting in shorter

outages.

For the most part, the industry outage

management activities focus on plant

configuration management, that is, assuring

that a minimum set of plant equipment is

always available to perform key safety

functions. These analyses are generally not

full scope PRAs and do not routinely

calculate risk numbers. Nevertheless, from

the studies that have been done and reported

at an NRC workshop on low power and

shutdown accidents (SAND99-1815), we can

draw important conclusions about risk;

1. Low power and shutdown risk can be

comparable to full power risk.

2. Short term risks are highly variable and

can be much larger than full power risk for

certain time periods. Figure 2.5-17 presents

the risk estimates for one PWR over a

typical outage cycle.

3. The industry is very aware of the risks

during low power and shutdown and has

taken important steps to manage risks.

Nevertheless, precursor events continue to

occur, (See Table 2.5-8) and the risks need

ongoing attention.

Section XX presents key findings from both

the NRC and industry activities. Those

findings are summarized here:

? Potentially significant operational events

occur.

? Risk from LPSD conditions can be

comparable to full power.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-20 NUREG/CR-6042 Rev. 2

? LPSD risk at boiling water and

pressurized water reactors appears to be

dominated by three classes of initiating

events (loss of shutdown cooling, loss of

coolant, and loss of offsite power).

? Dominant failures associated with LPSD

events appear to be human-related.

? The most risk dominant plant operational

states are characterized by high decay

heat and reduced inventory.

? Risk contributors appear to be very plantspecific.

? Initiating events that have been analyzed

for full power conditions must be

reexamined to ensure that all LPSD

effects are considered.

? Outages other than for refueling may be

important contributors to risk.

While much work has been done, we do not

have complete estimates of low power and

shutdown risk that can be added to full

power risk to give us a complete risk

picture. Unplanned outages are difficult to

account for, and these may be very important

to risk, as they often include outages of

safety equipment. Also, limited attention

has been given to external events during low

power and shutdown. For now, we can say

that low power and shutdown risks are

important, but a complete risk picture is not

available.

2.5.7 Station Blackout Sequences

Station blackout has consistently been found

to be an important contributor to core

damage frequency in PRAs, including the

Reactor Safety Study, NUREG-1150, and the

IPEs. It has not necessarily been the

dominant contributor for each plant in the

study, but most plants have a significant

contribution from station blackout. Because

of the general importance of station

blackout, a more detailed examination of this

particular sequence is provided in this

section. A description is first given of the

types of station blackout sequences that can

occur, followed by an assessment of the

impact of the station blackout rule (based on

IPE results).

Types of Station Blackout

Station Blackout sequences are initiated by

a loss of offsite power and the associated

reactor scram, followed by failure of the

station diesels (or gas turbines, if applicable)

to start and load. Station blackout sequences

are further discriminated into long-term and

short-term station blackouts, which are

described below for BWRs and PWRs.

For a long-term station blackout sequence in

a BWR, water is temporarily injected into

the reactor vessel by the steam turbinedriven systems. Most of the U.S. plants (25

of 37) have two independent systems (highpressure coolant injection [HPCI] plus

reactor core isolation cooling [RCIC] or

isolation condenser [IC]) that can keep the

core covered without the availability of AC

power. However, BWR-5 and BWR-6

designs have substituted an electric motordriven high pressure core spray (HPCS)

system in lieu of HPCI so that these plants

have only one turbine-driven injection

system (RCIC). Similarly, the BWR-2 and

early BWR-3 plants employ an ACdependent feedwater coolant injection system

(FWCI) instead of HPCI. Water flow is

intermittent as necessary to keep the core

covered and continues for as long as DC

(battery) power for turbine governor control

remains available from the unit batteries

(typically about 6 hours).

The short-term designation for BWRs applies

to station blackout sequences with early loss
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-21 NUREG/CR-6042 Rev. 2

of injection. Injection failure might occur in

either of two ways. First, there might be

direct failure(s) of the steam turbine

system(s) during the period in which DC

power remains available. Note that for

plants with both RCIC and HPCI, this

involves independent failures of the two

systems. Because these are high-pressure

injection systems, success of their function

does not depend upon reactor vessel

depressurization. The second (and much less

probable) way in which the early total loss

of injection initiating event for short-term

station blackout might occur is by commonmode failure of the DC battery systems. At

most BWR facilities, the diesel generators

have dedicated starting batteries, but if the

diesels are started from the unit batteries,

failure of these batteries would, upon loss of

offsite power, be a contributing cause of the

station blackout. Furthermore, without DC

power for valve and turbine governor

control, the steam turbine-driven injection

systems would not be operable. The loss of

DC power would also render the safety/relief

valves (SRVs) inoperable in the remotemanual mode; thus, the reactor vessel could

not be depressurized.

The basic characteristics of the two

dominant forms of BWR station blackout

sequences can be summarized as follows.

DC power remains available during the

period of core degradation for short-term

station blackout initiated by independent

failure of HPCI and RCIC; the decay heat

level is relatively high, and the reactor

vessel is depressurized during the period

after the core becomes uncovered and begins

to degrade. For long-term station blackout,

the core remains covered for more than 6

hours, so the decay heat level is about 50

percent less during the period of core

degradation. However, when injection

capability is lost (due to battery failure) the

ability to operate the SRVs is also lost.

Thus, the reactor vessel repressurizes and

remains pressurized during and after the

period of core degradation.

For a PWR, injection systems are lost in a

station blackout because the systems rely on

AC power. However, core cooling is

initially available in a long-term station

blackout sequence through turbine-driven

auxiliary feedwater. Turbine-driven

auxiliary feedwater can operate until the

batteries deplete, which normally leads to a

loss of control. If AC power is not

recovered soon after loss of control, core

damage will follow. Some plants might be

able to manually control feedwater after

battery depletion, but a continuous source of

feedwater is still needed to prevent core

damage.

For a short-term station blackout sequence in

a PWR, the turbine-driven auxiliary

feedwater system fails at the beginning of

the accident. The most frequent cause is

failure to start and run for the required time

period. The early loss of heat rejection

causes the inventory of the reactor coolant

systems to boil off, leading to early core

damage.

Station blackout results in loss of cooling for

reactor coolant pumps at most PWRs. This

introduces the potential for seal failure from

high temperatures, particularly for plants

using the old seal material in Westinghouse

pumps. The associated leakage from the

reactor coolant system can accelerate core

damage. This concern is most important for

long-term sequences because there is an

extended period without seal cooling before

core damage occurs. For short-term

sequences, the time to core damage is much

shorter, so seal failures are more likely to

occur after core damage.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-22 NUREG/CR-6042 Rev. 2

Station Blackout Rule

The Station Blackout Rule, discussed in

Section 2.4, requires that an analysis be

performed for each nuclear power plant to

establish a method to cope with station

blackout for a specified duration without

core damage occurring (coping method). In

some instances, licensees implemented plant

modificationstoimprovetheplant’sability

to endure a station blackout. The goal of the

Station Blackout Rule is to limit the average

station blackout contribution to CDF to

about 1×100

-5/ry. This goal should be

interpreted as an aiming point or numerical

benchmark, rather than as a hard and fast

requirement. In the IPE Insights Program,

the IPE results were used to infer the impact

of the Station Blackout Rule on the plant

CDS. For licensees that modeled the Station

Blackout Rule coping method in their IPEs,

the staff compared the average station

blackout CDF with the rule’s goal to

determine how well it was achieved. For

licensees that did not model the Station

Blackout Rule coping method, the staff

compared the average station blackout CDF

withtherule’sgoaltoprovideinsightinto

the margin for improvement in CDF by

implementing the Station Blackout Rule.

Ten licensee IPE submittals (covering 15

plant units) reported estimates of the

reduction in total CDF that resulted from

implementing the Station Blackout Rule.

These estimates are shown in Figure 2.5-18.

The average reported reduction was

~2×10

-5/ry, ranging from ~7×10-6 to ~6×10-

5

/ry. The average reported percent reduction

in total CDF was about 20%, ranging from

about 10 to 50%. Licensees that met the

Station Blackout Rule using existing

equipment were not included in the average

CDF reduction calculation.

The range of plant CDS and average CDS

for IPEs that accounted for the Station

Blackout Rule coping method in their

modeling were compared to the CDS for

those that did not account for the coping

method. Both sets of plants exhibited a wide

range of station blackout CDS relative to the

Station Blackout Rule goal. Some licensees

that modeled the Station Blackout Rule

coping method reported station blackout

CDS about two orders of magnitude lower

than the goal, while others reported station

blackout CDS about three times higher than

the goal. Similarly, some licensees reported

station blackout CDS two orders of

magnitude lower than the Station Blackout

Rule goal without modeling the Station

Blackout Rule coping method, while others

reported station blackout CDS close to an

order of magnitude higher than the goal. For

both sets of plants, the average reported

percent station blackout contribution was

about 20%, and the average station blackout

CDS for the two sets of plants were nearly

the same.

These comparisons of IPE results indicate

that the Station Blackout Rule had a

noticeable, but not enormous impact on the

plant CDS. For the limited number of plants

that directly reported the impact of the

Station Blackout Rule, the average reduction

was equal to the value anticipated during the

development of the Station Blackout Rule.

2.5.8 Current Understanding of Risk

An improved understanding of nuclear power

plant risk has been gained through analysis

of operating experience and using risk

assessment techniques. As a result of these

studies, we conclude that the current fleet of

operating plants is safe and that there is no

undue risk to the public. On the other hand,

many believe that current plants are orders

ofmagnitudesaferthantheCommission’s

Quantitative Health Objectives in the Safety

Goal Policy. We can not demonstrate that

this belief is true; in fact, it is clear that a
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-23 NUREG/CR-6042 Rev. 2

number of plants approach the QHOs when

all risks are considered. The discussions

below summarize our understanding of plant

risks.

The average internal event full power core

damage frequencies estimated for both

BWRs and PWRs are generally low, with

specific results affected strongly by plantspecific factors such as those discussed in

Section 2.5.3 for the NUREG-1150 plants.

In both the NUREG-1150 and IPE results,

station blackout, transients, and LOCAs are

usually the more important contributors for

PWRs. For BWRs, LOCAs and ATWSs are

generally less important than station

blackout and transients. Similarly, the ASP

results show a consistently high fraction of

precursors that involve electrical system

failures.

The BWRs generally (but not always) have

core damage frequencies that are lower than

those of the PWRs. The LOCA sequences,

which often dominate the PWR core damage

frequencies, are normally minor contributors

for the BWRs. This is not surprising

because BWRs have many more systems than

PWRs for injecting water into the reactor

coolant system. For many transients, the

same argument holds. BWRs have many

more systems that can provide decay heat

removal and makeup for transients that lead

to loss of water inventory due to stuck-open

relief valves or primary system leakage.

Station blackout accidents contribute a high

percentage of the core damage frequency for

many of the BWRs. However, when viewed

on an absolute scale, station blackout has a

higher frequency at the PWRs than at the

BWRs. To some extent this is due to design

differences between BWRs and PWRs. For

example, in station blackout accidents, many

PWRs are vulnerable to reactor coolant

pump seal LOCAs following loss of seal

cooling, leading to loss of inventory with no

method for providing makeup. BWRs, on

the other hand, have at least one injection

system that does not require AC power.

While such BWR and PWR design features

influence the core damage frequencies

associated with station blackout, the electric

power system design, which is largely

independent of the plant type, is probably

more important.

The NUREG-1150 and IPE analyses indicate

that for both BWRs and PWRs, other

support systems, such as service water, are

quite important. Because support systems

vary considerably among plants, caution

must be exercised when making statements

about generic classes of plants, such as

PWRs versus BWRs. Once significant plantspecific vulnerabilities are removed, supportsystem-driven sequences will probably

dominate the core damage frequencies of

both types of plants. Both types of plants

have sufficient redundancy and diversity so

as to make multiple independent failures

unlikely. Support system failures introduce

dependencies among the systems and thus

can become dominant.

The risk evaluations for external events from

NUREG-1150 and the IPEEEs indicate that

seismic and fire events can be important, but

that the results are highly plant-specific.

Seismic risk is strongly affected by electric

power failures and failures of related

components such as motor control centers.

Structural failures, such as block walls

collapsing on important equipment can also

be significant. Fire risk is dominated by

fires in areas where fire sources and

important equipment are collocated.

Switchgear rooms, control rooms, and

turbine buildings are examples of important

fire areas. Seismic and fire sequences can

be similar to internal event sequences, e.g.,

station blackout. However, a wide variety of

plant specific sequences can be observed in

the seismic and fire PRAs. Seismic and fire
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-24 NUREG/CR-6042 Rev. 2

core damage frequencies can be as high or

higher than internal event frequencies at

some plants.

Evaluations of risk during low-power and

shutdown for Grand Gulf and Surry indicate

that the risk during these modes can be

important. Industry studies confirm that the

annual risk can be of the same order as full

power risk. In fact, the short-term risk can

be significantly higher during particular

shutdown modes than during full power.

Plant configurations with reduced water

inventory, substantial decay heat, and

reduced safety system availability are

particularly important.

Section 2.4 described the safety goals that

have been set for commercial nuclear power

plants. Information is now available from

the IPEs that can be used to infer how

operating plants compare with the safety

goals. This inference was made as part of

the IPE Insights Program. When comparing

the IPE results with the safety goals, it is

important to note that the scope of the IPE

program is limited to accidents initiated by

internal events (excluding internal fires) that

occur during full-power operation.

The CDFs for all BWRs and most PWRs fall

below the 1×10

-4/ry subsidiary objective;

however, nine licensees representing 15

PWR units reported CDFs above 1×10

-4/ry.

Conditional containment failure probabilities

for bypass and early containment failure are

below the 0.1 subsidiary objective for most

of the PWRs. All of the conditional

containment failure probabilities for bypass

events in BWRs are below 0.1; however,

most of the conditional containment failure

probabilities for early containment failure

are above 0.1. This result is expected

because of the nature of BWR pressure

suppression containments.

Although offsite consequences were not

generally calculated in the IPEs, by

extrapolating the NUREG-1150 health

effects to the IPEs, an indication of how the

IPEs compare to the quantitative health

objectives can be obtained. Through this

extrapolation, the staff concluded that most

of the IPE results are likely to meet the

NRC’squantitativehealthobjectives. The

IPE results imply risk levels below the

individual latent cancer fatality health

objective. In addition the IPE results also

suggest risk levels below the individual early

fatality health objective. Seventeen plants

produced results that might approach one or

both of the QHOs. Although relatively more

plants exceeded the proposed subsidiary

objectives, only a fraction of these are found

to have the potential for individual early

fatality risk levels that could approach the

corresponding quantitative health objective.

The picture is less clear when all risks are

considered. For commercial LWRs, the

QHOs are obtained for core damage

frequencies in the range of 5E-4 and higher

per year or large early release frequencies in

the range of 3E-5 and higher. Clearly,

considering full power internal and external

events, along with low power/shutdown

events, will result in a significant number of

plants with CDFs well above 1E-4 per year.

Therefore, while it is likely that the fleet of

plant, on average, meets the Safety Goals,

large margins do not exist. This fact

becomes important when considering risk

informing the regulations to reduce

“excessive margins.”
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-25 NUREG/CR-6042 Rev. 2

Table 2.5-1 NRC Sources of reactor operational data

1. Prompt notification

Required by 10 CFR 50.72

Violations of Plant Technical Specifications

Approximately 2000 per year

2. Licensee Event Reports

Required by LER Rule, 10 CFR 50.73

Violations of Technical Specifications

Focus on Events Significant to Safety

NRC Receives Several Thousand per Year

3. Construction Deficiency Reports

Required by 10 CFR 50.55(e)

Approximately 200 in FY83

4. Component Deficiencies

Required by 10 CFR 21

Approximately 200 in 1983

5. Other Sources

Inspection findings

DOE reactor experience

Licensee reports and requests

Industry Groups

Institute of Nuclear Power Operations

Nuclear Plant Reliability Data System

Electric Power Research Institute

Nuclear Safety Analysis Center

Informal Communication

Foreign Event Information
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-26 NUREG/CR-6042 Rev. 2

Table 2.5-2 NRC Feedback of nuclear power plant experience

Operating Reactors Licensing Actions Summary (NUREG-1272) Vol. 9, No. 1

(AEOD Annual Report)

Bulletins (2 + 1 supplement in 1990) (1 + 1 supplement in 1991)

Information Notices (82 + 12 supplements in 1990) (78 + 15 supplements in 1991)

NRR Generic Letters (10 + 18 supplements in 1990) (18 + 1 supplement in 1991)*

AEOD - review licensee event reports (about 2100 per year)

AEOD - published case studies (about one per year)

AEOD - special studies (about 2 per year)

AEOD - published engineering evaluations (10 in 1990)

AEOD - published technical review reports (18 in 1990)

AEOD - published Power Reactor Events Reports (will resume in 1992)

Report to Congress on Abnormal Occurrences, NUREG-0090 (4 per year)

Miscellaneous NUREGs; case-related hearing testimonies, transcripts, etc.

Performance Indicators for Operating Commercial Nuclear Power Plants (Quarterly)

*

91-02, dated December 28, 1990 was considered to be issued in 1990.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-27 NUREG/CR-6042 Rev. 2

Table 2.5-3 Precursors and severe accidents

Date Type Event

Cond.

Core

Damage

Probability

Reference

24-Mar-71 LOSP LaCrosse loss of offsite

power

4×10

-5 NUREG/CR-2497

19-Jan-74 LOSP Haddam Neck loss of

offsite

power

2×10

-4 NUREG/CR-2497

22-Mar-75 Fire Browns Ferry Fire 1.5×10

-1 NUREG/CR-2497

31-Aug-77 LOFW Cooper loss of feedwater 1×10

-3 NUREG/CR-2497

10-Nov-77 Flooding Surry 2 valve flooding 6×10

-7 NUREG/CR-2497

20-Mar-78 Other Rancho Seco loss of

nonnuclear instrumentation

1×10

-1 NUREG/CR-2497

06-Mar-79 Service Water Brunswick loss of RHR

service water

2×10

-5 NUREG/CR-2497

02-May-79 LOFW Oyster Creek loss of

feedwater flow

2×10

-3 NUREG/CR-2497

28-Jun-80 ATWS Browns Ferry partial failure

to scram

9.8×10

-4 NUREG/CR-3591

02-Nov-81 LOCA Sequoyah loss of coolant 9×10

-4 NUREG/CR-2497

09-Jun-85 LOFW Davis Besse loss of

feedwater

1.1×10

-2 NUREG/CR-4674

20-Mar-90 Shutdown

Transient

Vogtle 1 loss of shutdown

cooling

1×10

-3 NUREG/CR-4674

13-Aug-91 Transient Nine Mile Point 2 1×10

-5 Not Published

2-Aug-95 Unavailability St. Lucie 1 multiple

failures

1.1×10

-4 NUREG/CR-4674
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-28 NUREG/CR-6042 Rev. 2

Table 2.5-4 Overview of key IPE CDF observations

Accident class Key observations

Transients

(other than station

blackouts and ATWS)

Important contributor for most plants because of reliance on support systems;

failure of such systems can defeat redundancy in front-line systems

Both plant-specific design differences and IPE modeling assumptions contribute

to variability in results:

? use of alternative systems for injection at BWRs

? variability in the probability that an operator will fail to depressurize the

vessel for LPI in BWRs

? availability of an isolation condenser in older BWRs for sequences with

loss of decay heat removal (DHR)

? susceptibility to harsh environment affecting the availability of coolant

injection capability following loss of DHR

? capability to use feed-and-bleed cooling for PWRs

? susceptibility to RCP seal LOCAs for PWRs

? ability to depressurize the reactor coolant system in PWRs affecting the

ability to use LPI

? ability to cross-tie systems to provide additional redundancy

SBOs Significant contributor for most plants, with variability driven by:

? number of redundant and diverse emergency AC power sources

? availability of alternative offsite power sources

? length of battery life

? availability of firewater as a diverse injection system for BWRs

? susceptibility to RCP seal LOCAs for PWRs

ATWS Normally a low contributor to plant CDF because of reliable scram function and

successful operator responses

BWR variability mostly driven by modeling of human errors and availability of

alternative boron injection system

PWR variability mostly driven by plant operating characteristics, IPE modeling

assumptions, and assessment of the fraction of time the plant has an unfavorable

moderator temperature coefficient

Internal floods Small contributor for most plants because of the separation of systems and

compartmentalization in the reactor building, but significant for some because of

plant-specific designs

Largest contributors involve service water breaks

LOCAs

(other than interfacing

system LOCAs

(ISLOCAs) and steam

generator tube ruptures

(SGTRs))

Significant contributors for many PWRs with manual switch over to emergency

core cooling system recirculation mode

BWRs generally have lower LOCA CDS than PWRs for the following reasons:

? BWRs have more injection systems

? BWRs can more readily depressurize to use low-pressure systems

ISLOCAs Small contributor to plant CDF for BWRs and PWRs because of the low

frequency of initiator

Higher relative contribution to early release frequency for PWRs than BWRs

because of low early failure frequency from other causes for PWRs
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-29 NUREG/CR-6042 Rev. 2

Table 2.5-4 Overview of key IPE CDF observations (continued)

Accident class Key observations

SGTR Normally a small contributor to CDF for PWRs because of opportunities for the

operator to isolate a break and terminate an accident, but important contributor to

early release frequency
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-30 NUREG/CR-6042 Rev. 2

Table 2.5-5 Distributions for Core damage frequency and aggregate

risk

for POS 5 and full-power operation for Grand Gulf

Analysis

Descriptive Statistics (All values are per calendar year)

Percentiles

5th 50th 95th Mean

Core Damage Frequency

POS 5 4.1×10

-7 1.4×10-6 5.6×10-6 2.1×10-6

Full Power 1.8×10

-7 1.1×10-6 1.4×10-5 4.1×10-6

Early Fatality Risk

POS 5 3.7×10

-11

2.8×10

-9 3.9×10-8 1.4×10-8

Full Power 2.5×10

-12 6.1×10-10 2.6×10-8 8.2×10-9

Total Latent Cancer Fatality Risk

POS 5 4.3×10

-4 1.9×10-3 1.2×10-2 3.8×10-3

Full Power 1.4×10

-5 2.4×10-4 2.3×10-3 9.5×10-4

Table 2.5-6 Distributions for Core damage frequency and aggregate

risk for mid-loop and full-power operation for Surry

Analysis

Descriptive Statistics (All values are per calendar year)

Percentiles

5th 50th 95th Mean

Core Damage Frequency

Mid Loop 3.2×10

-7 2.0×10-6 1.9×10-5 4.2×10-6

Full Power 9.8×10

-6 2.5×10-5 1.0×10-4 4.1×10-5

Early Fatality Risk

Mid Loop 1.3×10

-10 3.6×10-9 1.6×10-7 4.9×10-8

Full Power 7.6×10

-10 7.0×10-8 5.4×10-6 2.0×10-6

Total Latent Cancer Fatality Risk

Mid Loop 8.0×10

-4 5.3×10-3 5.5×10-2 1.6×10-2

Full Power 3.1×10

-4 2.2×10-3 1.9×10-2 5.2×10-3
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-31 NUREG/CR-6042 Rev. 2

Table 2.5-7 Key IPE observations regarding containment performance

Failure

mode

Key observations

Early

failure

On average, the large volume containments of PWRs are less likely to

have early structural failures than the smaller BWR pressure

suppression containments

Overpressure failures (primarily from ATWS), fuel coolant

interaction, and direct impingement of core debris on the containment

boundary are important contributors to early failure for most BWR

containments; hydrogen burns are found important in some Mark III

containments

The higher early structural failures of BWR Mark I containments

versus the later BWR containments are driven to a large extent by

drywell shell meltthrough*

In a few BWR analyses, early venting contributes to early releases

Phenomena associated with high-pressure melt ejection are the

leading causes of early failure for PWR containments*

Isolation failures are significant in a number of large, dry and

subatmospheric containments

The low early failure frequencies for ice condensers relative to the

other PWRs appear to be driven by analysis assumptions rather than

plant features

For both BWR and PWR plants, specific design features lead to a

number of unique and significant containment failure modes
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

Failure

mode

Key observations

USNRC Technical Training Center 2.5-32 NUREG/CR-6042 Rev. 2

Bypass Probability of bypass is generally higher in PWRs, in part, because of

the use of steam generators, and because the greater pressure

differential between the primary and secondary systems may increase

the likelihood of an ISLOCA in PWRs

Bypass, especially SGTR, is an important contributor to early release

for PWR containment types

Bypass is generally not important for BWRs

Late

failure

Overpressurization when containment heat removal is lost is the

primary cause of late failure in most PWR and some BWR

containments

High pressure and temperature loads caused by core-concrete

interactions are important for late failure in BWR containments

Containment venting is important for avoiding late uncontrolled

failure in some Mark I containments

The larger volumes of the Mark III containments (relative to Mark I

and Mark II containments) are partly responsible for their lower late

failure probabilities in comparison to the other BWR containments

The likelihood of late failure often depends on the mission times

assumed in the analysis

* There has been a significant change in the state-of-knowledge reporting some

severe accident phenomena in the time since the IPE analyses were carried

out.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-33 NUREG/CR-6042 Rev. 2

Table 2.5-8 Shutdown events occurring during 1998 and the early portion

of 1999.

Initiati

ng

Event

Class

Plant/

Date Event Description/Consequences

Loss of

Shutdo

wn

Cooling

Limerick

1

2/6/98

Loss of shutdown cooling and mode change. Fuse blew while

installing a jumper, causing RHR to isolate. Primary coolant

system temperature increased from 191oF to 200oF, changing modes

from cold shutdown to hot shutdown.

Clinton

2/13/98

Loss of shutdown cooling due to loss of nuclear safety Div II. An

alert was declared in order to activate the Technical Support Center

and to provide for more manpower.

Loss of

Coolant

ANO 2

2/2/99

Inadvertent entry into reduced inventory operations. Reactor vessel

level dropped 56 inches within approximately 1.5 minutes.

Quad

Cities 2

2/24/99

A draindown event occurred as a result of switching from train B of

RHR shutdown cooling to train A when operators failed to perform

tasks in the correct order. Water level was reduced from 80 inches

indicated to about 45 inches indicated (a loss of approximately

6000 to 7000 gallons).

FitzPatric

k

12/2/99

An operator-induced 100-inch (approximately 14,000 gallons)

draindown event occurred when operators attempted to maintain

indicated water level at 357 inches above the top of the active fuel

using a level instrument with a temporary addition to its reference

leg. This temporary addition was in the process of being replaced

with the original reference leg components. This replacement

activity increased the indicated level, and the operators

compensated for this apparent increase in level by increasing the

discharge rate.

Loss of

Offsite

Power

Ft.

Calhoun

5/20/98

Transformer explosion results in Loss-of-offsite power (LOOP).

Emergency diesel generators (EDGs) start and load. SD cooling

interruptedforseveralseconds.Noheatup(timetoboiling–2

hours).

McGuire

1

6/3/98

Explosion of switchyard breaker and LOOP. (1E power was

supplied through U2.)

Clinton

1/6/99

LOOP; EDGs started and loaded. Shutdown cooling via RHR lost.

Fourth of four events involving loss of shutdown cooling. B-RHR

tripped and shutdown cooling was supplied via RWCU.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

Table 2.5-8 Shutdown events occurring during 1998 and the early portion

of 1999.

Initiati

ng

Event

Class

Plant/

Date Event Description/Consequences

USNRC Technical Training Center 2.5-34 NUREG/CR-6042 Rev. 2

Loss of

Power

Clinton

6/29/98

Loss of 3 of 4 offsite power sources due to storm damage.

Shutdown cooling B-pump tripped; restarted. Spent fuel pool

cooling lost. Spent fuel cooling and one shutdown cooling bus lost.

Shutdown cooling was restated without reactor coolant system

(RCS) heatup. Spent fuel cooling restored.

D.C. Cook

1&2

8/31/98

Train A reserve power supply lost due to loss of station service

transformer. EDGs for train A, both units, auto-started. Operating

RHR pump, each unit, briefly lost with no heatup of RCS.

Catawba 2

9/6/98

Loss of 4160 V bus, auto start of one auxiliary feedwater (AFW)

pump, and lifting of one power-operated relief valve (PORV). The

plant was preparing to go water solid; therefore, little space was

available in the pressurizer to accommodate the increase in RCS

volume. When the charging pump discharge valve went full open,

the increase in flow caused the PORV to lift about 12 to 14 times.

One 1E bus lost power and was not loaded by its EDG since the

EDG was down for maintenance. The fuel was not in the core.

San

Onofre 2

2/1/99

Loss of shutdown cooling due to breaker malfunction. Inadequate

pre-job briefing, inadequate work plan, and inadequate controls of

work in progress lead to three-phase fault with normal clearing

while working on breaker and 2 oF RCS temperature rise.

Fire Fermi 2

10/8/98

Fire in EDG panel. Damage was limited to the panel. Cause not

stated.

Fermi 2

10/10/98

Fire in a motor control center in Rad Waste. Second electrical fire

in two days. This was caused by personnel error and resulted in

personnel injury.

Flood WNP 2

6/17/98

Fire header line break with subsequent flooding of ECCS pump

rooms. ECCS pumps rendered inoperable by flooding.

Other WNP 2

5/30/98

Full scram and injection of LPCS, low-pressure coolant injection

(LPCI) A start, start of Div I and III EDGs (accident signal

response). 2600 gallons of water were injected, increasing RCS

pressure and decreasing temperature. Pressure increased from 107

psig to 425 psig. Temperature decreased from 222 oF to 219 oF.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

Table 2.5-8 Shutdown events occurring during 1998 and the early portion

of 1999.

Initiati

ng

Event

Class

Plant/

Date Event Description/Consequences

USNRC Technical Training Center 2.5-35 NUREG/CR-6042 Rev. 2

WNP 2

5/31/98

Scram while shut down. Reactor pressure increased from 1034 psig

to 1064 psig. Recurring problem. Possible cause is scram

discharge volume level high.

Salem 1

2/21/98

Operator inattention resulted in start of AFW to feed steam

generator (SG). AFW ran with discharge valves closed for less

than one minute. AFW was not required to be operational in the

current mode, did not feed the steam generators because the feed

valves were closed. Level in SGs was supposed to be maintained

between 18% and 28%, but got to 9% of narrow range.

Limerick

2

6/3/98

Standby liquid control injected into the vessel. Between 300 and

350 gallons of water bearing B4C injected. Unnecessary injection

of B4C necessitated cleanup of RCS. B4C could damage carbon

steel components in RCS.

Clinton

6/10/98

Service water pump flow indications at RHR heat exchanger (HX)

off-scale high. HX bypass line inadequately sized so that high flow

would occur in the line should the HX be bypassed and inadequate

cooling to other safety-related components could occur.
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-36 NUREG/CR-6042 Rev. 2

Figure 2.5-1 Internal core damage

frequency ranges (5th to 95th

percentiles)

Figure 2.5-2 BWR principal contributors to internal core damage

frequencies
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-37 NUREG/CR-6042 Rev. 2

Figure 2.5-3 PWR principal contributors to

internal core damage frequencies

Figure 2.5-4 Surry internal and external-event core

damage frequency ranges
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-38 NUREG/CR-6042 Rev. 2

Figure 2.5-5 Peach Bottom internal- and external-event

core damage frequency ranges

1.0E-08

Core Damage Frequency

1.0E-07 1.0E-06 1.0E-05 1.0E-04 1.0E-03 1.0E-02

Siesmic, Livermore

Seismic, EPRI

Fire

Pro

bability

Density

Figure 2.5-6 Surry external event core damage frequency

distributions
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-39 NUREG/CR-6042 Rev. 2

1.0E-08

Core Damage Frequency

1.0E-07 1.0E-06 1.0E-05 1.0E-04 1.0E-03 1.0E-02

Siesmic, Livermore

Seismic, EPRI

Fire

Pro

b

a

bility

D

e

nsity

Figure 2.5-7 Peach Bottom external event core damage frequency

distributions
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-40 NUREG/CR-6042 Rev. 2

Figure 2.5-8 Principal contributors to seismic core damage

frequencies
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-41 NUREG/CR-6042 Rev. 2

Figure 2.5-9 Principal contributors to fire core damage

frequencies
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-42 NUREG/CR-6042 Rev. 2

1E-8

1E-7

1E-6

1E-5

1E-4

1E-3

Core

damage

frequency(per

reactor

year)

BWRs PWRs

Figure 2.5-10 Reported IPE CDFs for BWRs and PWRs
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-43 NUREG/CR-6042 Rev. 2

Figure 2.5-11 CDF Results

Figure 2.5-12
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-44 NUREG/CR-6042 Rev. 2

Figure 2.5-13
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-45 NUREG/CR-6042 Rev. 2

1.E-8

1.E-7

1.E-6

1.E-5

1.E-4

1.E-3

C

o

r

e

D

a

m

a

g

e

F

r

e

q

u

e

n

c

y (p

e

r

r

y)

BWR-Fire BWR-Internal

Events

PWR-Fire PWR - Internal

Events

Figure 2.5-14 Fire-induced CDFs Reported by Licensees

Key:

1 Control room

2 Cable spreading rooms

3 Cable vault/chases/tunnels

4 Switchgear rooms

5 Turbine hall/buildings

6 Diesel generator rooms

7 Battery/charger rooms

8 Electrical equipment/relay

rooms
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-46 NUREG/CR-6042 Rev. 2

Figure 2.5-15 Grand Gulf sequence contributions for full-power

and POS 5

Figure 2.5-16 Surry sequence contributions for full-power and

mid-loop operation
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-47 NUREG/CR-6042 Rev. 2

Figure 2-5.17 Example PWR Boiling Risk Profile
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-48 NUREG/CR-6042 Rev. 2

Figure 2.5-18 Reduction in CDF from implementing Station

Blackout Rule
Reactor Safety Course (R-800) 2.5 Risk Assessment and Operational Perspectives

USNRC Technical Training Center 2.5-49 NUREG/CR-6042 Rev. 2

1. U.S.Code of Federal Regulations, Title 10,

Part 50.72, January 1, 1991.

2. U.S.Code of Federal Regulations, Title 10,

Part 50.73, January 1, 1991.

3. J. W. Minarick, et al., “Precursorsto Potential

Severe Core Damage Accidents,” U.S.

Nuclear Regulatory Commission,

NUREG/CR-4674, August 1991.

4. U.S. Nuclear Regulatory Commission,

“SevereAccident Risks: An Assessment for

Five U.S. NuclearPowerPlants,”NUREG1150, December 1990.

5. G. E. Cummings, “SummaryReport on the

Seismic Safety MarginsResearchProgram,”

Lawrence Livermore National Laboratories,

NUREG/CR-4431, UCID-20549, January

1986.

6. Seismicity Owners Group and Electric Power

Research Institute, “Seismic Hazard

Methodology for the Central and Eastern

UnitedStates,”EPRINP-4726,July1986.

7. U.S. Nuclear Regulatory Commission,

“Recommendationsfor Probabilistic Seismic

Hazard Analysis: Guidance on Uncertainty

and Use of Experts,”NUREG/CR-6372 Vol.

1 & 2, April 1997.

8. U.S. Code of Federal Regulations, Title 10,

Part 50, Appendix R, January 1, 1991.

9. U.S. Nuclear Regulatory Commission,

“IndividualPlant Examination Program:

Perspectives on Reactor Safety and Plant

Performance,” NUREG-1560, Draft for

Comment, November 1996.

10. D. W. Whitehead,etal.,“Evaluationof

Potential Severe Accidents During Low

Power and Shutdown Operations at Grand

Gulf Unit 1: Analysis of Core Damage

Frequency From Internal Events for Plant

Operational State 5 During a Refueling

Outage,”Sandia National Laboratories,

NUREG/CR-6143, June, 1994.

11. T. W. Chu and W. T. Pratt, “Evaluationof

Potential Severe Accidents During Low

Power Shutdown Operations at Surry,

Unit 1,” Brookhaven National

Laboratory, NUREG/CR-6144, October

1995.

References for Section 2.5
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-1 NUREG/CR-6042 Rev. 2

2.6 Risk-Informed Regulation

2.6.1 PRA Policy Statement

Following the NUREG-1150 studies and

during the implementation of the IPE

program, the NRC debated the future use of

PRA within the agency. NUREG-14891 was

issued in March 1994 and provided a review

of staff uses of PRA at that time. In

addition, it provided information about

currently available PRA methods and their

strengths and weaknesses. At the same time,

a commission policy statement on the use of

PRA was being developed. That policy

statement was issued in August 1995 and

stated:2

the commission’s intention to

encourage the use of PRA and to

expand the scope of PRA

applications in all nuclear

regulatory matters to the extent

supported by the state-of-the-art

in terms of methods and data.

Implementation of the policy

statement will improve the

regulatory process in three areas:

Foremost, through safety decision

making enhanced by the use of

PRA insights; through more

efficient use of agency resources;

and through a reduction in

unnecessary burdens on licensees.

Therefore, the Commission adopts

the following policy statement

regarding the expanded NRC use

of PRA:

(1) The use of PRA technology

should be increased in all

regulatory matters to the extent

supported by the state-of-the-art

in PRA methods and data and in a

manner that complements the

NRC’s deterministic approach

and supports the NRC’s

traditional defense-in-depth

philosophy.

(2) PRA and associated analyses

( e . g . , s e n s i t i v i t y s t u d i e s ,

u n c e r t a i n t y a n a l y s e s , a n d

importance measures) should be

used in regulatory matters, where

practical within the bounds of the

s t a t e - o f - t h e - a r t , to reduc e

u n n e c e s s a r y c o n s e r v a t i s m

associated with current regulatory

requirements, regulatory guides,

license commitments, and staff

practices. Where appropriate,

PRA should be used to support the

proposal for additional regulatory

requirements in accordance with

10 CFR 50.109 (Backfit Rule).

Appropriate procedures for

including PRA in the process for

changing regulatory requirements

should be developed and followed.

It is, of course, understood that

the intent of this policy is that

existing rules and regulations

shall be complied with unless

these rules and regulations are

revised.

(3) PRA evaluations in support of

regulatory decisions should be as

realistic as practicable and

appropriate supporting data

should be publicly available for

review.

(4)TheCommission’ssafetygoals

for nuclear power plants and

subsidiary numerical objectives

are to be used with appropriate

consideration of uncertainties in

making regulatory judgments on

the need for proposing and
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-2 NUREG/CR-6042 Rev. 2

b a c k f i t t i n g n e w g e n e r i c

requirements on nuclear power

plant licensees.

This policy statement affirms the

Commission’s belief that PRA

methods can be used to derive

valuable insights, perspectives,

and general conclusions as a

result of an integrated and

comprehensive examination of the

design of nuclear facilities,

facility response to initiating

events, the expected interactions

among facility structures, systems,

and components and between the

facility and its operating staff.

2.6.2 I s s u e s C o n c e r n i n g t h e

Quantitative Use of PRA

Even before the issuance of the PRA Policy

Statement, the staff had begun to develop

approaches for applying PRA more

extensively in a regulatory setting. During

this process it became clear that there were

a number of key issues that needed to be

addressed. The debate of these issues has

been vigorous and still continues in some

areas. The discussion below outlines some

of the more important issues.

Do the Safety Goals provide the basis for

risk targets?

The safety goals were originally developed

toanswerthequestion“how safeissafe

enough?” Therefore,itisconsistentwith

that policy to reduce risks where appropriate

to ensure that the goals are met. However,

ifthesafetygoalsrepresent“safeenough,”

then an ALARA approach is not warranted.

On the other hand, there have been

arguments that risk targets should be set that

are more stringent that the quantitative

health objectives (QHOs) in order to account

for uncertainty and incompleteness in risk

assessments. Currently, targets are being set

based on the subsidiary safety goals (see

Sections 2.6.5 and 2.6.6), so that the targets

are tied to the QHOs, but are somewhat

conservative and also more practical to

implement.

Can the Safety Goals be applied on a plantspecific basis?

The safety goal policy clearly states that the

safety goals are to be applied to the industry

as a whole and not to individual plants.

However, when implementing a riskinformed regulatory process, such an

approach creates problems because it is

difficult to regulate toward an industry

average. For example, if we are only

interested in the average, then one good

plant could make up for one bad plant.

Conceivably, plants could actually buy and

sell risk credits to each other. Therefore,

while the Commission is still interested in

t h e c o l l e c t i v e i n d u s t r y b e h a v i o r,

implementation in a regulatory sense will be

a plant-specific process. That is, if an

individual plant proposes a change, decisions

will be influenced by the risk at that plant

and not so much by the industry average

risk.

What risks are to be considered?

Until recently, many of the PRAs performed

for plants included only internal events at

full power. However, as discussed in

Section 2.5, external events and low

power/shutdown events can contribute

significantly to risk. The safety goal policy

does not clearly describe the risks to be

included, but current thinking is that external

events and low power/shutdown risks should

be accounted for in some fashion. This is an

extremely important question because many

plants will be near or above the subsidiary
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-3 NUREG/CR-6042 Rev. 2

safety goals if these risks are included.

Thus, very little regulatory relief will be

available to those plants.

Can plants with low risk be allowed to

increase risk up to the Safety Goals?

Some plants are indicating very low risks in

their IPE submittals. Assuming that these

risk estimates are valid, plants may propose

to relax safety programs to save costs.

There has been much debate about this issue

among the staff. Given that the Commission

has indicated that the safety goals represent

astateof“safeenough,”increasesinriskup

to the safety goals would seem to be

warranted. However, current thinking is that

such increases should be minimized because

of uncertainties in PRA numbers and

skepticism about very low risk estimates.

Further, while risk decisions are likely to be

made on a plant-specific basis, if all of the

plants with risks below the safety goals

increase risk up to the goals, then the

industry average will clearly be above the

goals. Therefore, the current approach

allows for only small increases and

encourages good plants to maintain low risk

levels. The downside of this approach is

that it does not reward the good plants and

may, in fact, force them to maintain efforts

that may not be in place at the bad plants.

To what extent can regulatory decisions be

based on PRA estimates?

If PRAs were perfect, they could be used as

the basis for all regulatory decisions. That

is, the only requirement for plants would be

to keep their risk below a set level.

However, PRAs are obviously imperfect and

such an approach is not practical with

today’stechnology. Therefore, PRA will be

used to some degree to influence decisions,

rather than totally define the solutions. The

use of PRA, then, leads to tradeoffs among

risk estimates, current regulations, and

defense-in-depth principles. As an extreme

example, risk estimates might indicate that

the CDF is so low that a containment is

unnecessary to meet the safety goals;

however, defense-in-depth principles would

still lead to the need for such a structure.

As the use of PRA is debated, the degree to

which it can be used in a particular decision

will continue to be controversial.

How are uncertainties to be considered?

PRAs, by their nature, produce uncertain

results. As shown in Section 2.5, these

uncertainties can span orders of magnitude.

Further, there is debate within the PRA

community as to how uncertainty analyses

should be performed. In most cases the

Commission and staff have indicated that

mean values should be used for comparison

purposes when making decisions based on

quantitative risk estimates. The safety goal

policy indicates that uncertainties should be

accounted for, without providing much

specific guidance. Various alternatives for

treating uncertainties have been proposed,

such as setting quantitative limits for the

95th percentile of the risk distribution or

performing hypothesis testing on the

decision. At this time, such prescriptive

criteria for treating uncertainty are generally

not being proposed. Rather, it is expected

that the use of the somewhat conservative

subsidiary safety goals will partially account

for uncertainty and that uncertainty estimates

will be considered subjectively by the staff

in each particular case. The treatment of

uncertainty is clearly an area that could use

more research and additional guidance in the

future.

In considering the answers to the above

questions as wellas the Commission’s

guidance in the PRA policy statement, it

became clear that regulatory decisions
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-4 NUREG/CR-6042 Rev. 2

should not be made entirely based on

quantitative risk numbers. Other factors

needed to be considered. Therefore, the

decision was made to change the

terminologyfrom“risk-based”regulationto

“risk-informed” regulation,reflecting the

state of the art in PRA and the need to

consider other factors, such as defense-indepth. The next sections describe a number

of risk-informed activities that have been

implemented or are being considered.

2.6.3 Reactor Oversight Process (ROP)

The Nuclear Regulatory Commission grants

licenses for individual plants based on the

Final Safety Analysis Report (FSAR) for the

plant and commitments made by the licensee

that together constitute the licensing basis

for the plant. The Commission charges the

NRC staff with the responsibility of assuring

that the plant is maintained and operated in

accordance with the licensing basis and

applicable rules and regulations. The NRC

staff carries out this responsibility through

its monitoring and inspection process.

The NRC staff does not have the resources

to monitor all aspects of the operation and

maintenance of every nuclear power plant.

The staff can only hope to examine a sample

of the operations etc. and from this sample

infer compliance status of the plant. The

compliance status of individual plants can be

expected to vary, perhaps widely. The NRC

staff wants, then, to apply greater regulatory

attention to those plants have greater

difficulty maintaining compliance with their

licensing basis. There must be some process

that allows the staff to optimize the

utilization of its inspection and monitoring

resources.

The methods of quantitative risk analyses

have not advanced to the point that they can

be used to make completely objective

determinations about the utilization of the

inspection and monitoring resources that the

staff has available. Nor, is it likely that these

quantitative analysis tools will ever be

reliable for making such determinations

completely objectively. There will, then,

always be a need for a somewhat subjective

method for deploying NRC resources. In the

past, these determinations were made by

senior NRC managers in the so-called SALP

process. In the late 1990's this process was

criticized by licensees. They complained that

theprocesswasnot‘transparent’sothatthey

could readily anticipate the outcome. In

some cases, they felt the process could be

usedto‘rachet’theregulatoryrequirements

imposed on individual licensees. Perhaps of

greater importance, the licensees felt that the

combination of the SALP process and the

NRC’sinspectionprocessoveremphasized

strict regulatory requirements in a way that

did not optimize the resources available to

the licensee for safety and regulatory

activities. The risk significances of findings

and conclusions made concerning plants

were not being used in readily apparent and

predictable ways to weight actions the NRC

staff chose to undertake.

In response to these criticisms and the

growing need to better optimize the

utilization of staff resources, the Nuclear

Regulatory Commission developed a revised

Reactor Oversight Process. Key objectives of

this process are to make greater use of

quantitative risk information and, where

possible, move regulation toward a more

performance basis rather than a prescriptive,

compliance basis. The elements of the

oversight process are:

• The Cornerstones of Reactor Safety

• Performance Indicators

• Baseline Inspections

• The Significance Determination Process

• The NRC Action Matrix
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-5 NUREG/CR-6042 Rev. 2

• The Licensee’s Corrective Action

Program

Each of these elements of the oversight

process is discussed in the subsections that

follow.

2.6.3.1 The Cornerstones of Reactor

Safety

The basis of the reactor oversight process is

made of seven so-called cornerstones of

reactor safety that define categories of

interest to the NRC staff in the performance

of a licensed nuclear power plant. The

cornerstones can be considered as falling

into three broad categories - Reactor Safety,

Radiation Safety and Safeguards. These

cornerstones are:

• Reactor Safety

- The Initiating Events Cornerstone

Events that cause challenges to

safety systems at nuclear power

plants should be prevented.

- The Availability of Mitigating

Systems Cornerstone

Systems to mitigate initiating

events at nuclear power plants

should have a high availability.

- Integrity of Barriers to the Release

of Radioactivity

The multiple barriers to the

release of radioactivity designed

into plants for defense in depth

should be kept intact.

- The Emergency Preparedness

Cornerstone

The system for responding to an

event that cannot be mitigated

completely should be in a high

state of readiness.

• Radiation Safety

- Limitation of Public Radiation

Exposure

Exposure of the public to

radioactive material releases from

a plant during normal operations

should be kept acceptably low.

- Limitation of Occupational

Exposure to Radiation

Occupational exposures to

radiation should be kept as low as

reasonably achievable (ALARA).

• Safeguards

- Safeguarding Nuclear Materials

Licensees should have programs to

prevent the theft or misuse of

nuclear materials.

These cornerstones of reactor safety can

looked upon as the things that the NRC

hopes to achieve with its regulatory

requirements on licensees. They can also be

looked upon as performance objectives for

the licensees. They contrast significantly

with the categories of evaluation used in the

older SALP process which included things

like Engineering, Maintenance and

Operations.

With performance objectives defined by the

cornerstones of reactor safety, it is necessary

to have some way to determine how well

licensees are meeting these performance

objectives. In the reactor oversight process,
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-6 NUREG/CR-6042 Rev. 2

this is done with Performance Indicators and

the Baseline Inspections that are discussed in

the next two subsections.

2.6.3.2 Performance Indicators

Associated with each of the cornerstones of

reactor safety are performance indicators.

The definition of performance indicators is

not an easy task. The performance indicators

have to be objective quantities that are

measurable or easily calculated. Both the

licensee and the regulator must agree that

the indicators are indicative of the level of

performance in some continuous way. The

data used for the performance indicator must

be easily collected and in the reactor

oversight process the necessary data are to

be collected by the licensee. Finally, and

most importantly, the performance indicator

cannot be something that represents a major

safety failing. That is, the frequency of large

pipe breaks cannot be taken as a

performance indicator for barrier integrity

since such large pipe breaks failures will

produce challengesto the plant’ssafety

systems.

Performance indicators are not alien

concepts to most licensees. In fact, most

licensees maintain quite a large number of

performance indicators for their own

management purposes. In addition, INPO and

WANO demand that licensees maintain

performance data used in a variety of

indicators. The wide availability of

probabilistic risk assessments provides some

guidance on appropriate performance

indicators for some of the cornerstones such

as safety systems availability. More

subjective considerations are needed for

other cornerstones such as the cornerstone

for emergency preparedness.

The performance indicators that the NRC has

selected for each of the cornerstones are:

The Initiating Events Cornerstone

- Unplanned (automatic and manual)

scrams per 7000 hours of critical

operation

- risk-significant scrams per 3 years

- transients per 7000 hours of

critical operations

• The Availability of Mitigating

Systems Cornerstone

- Safety system unavailability:

HPCI and RCIC

HPCS

Emergency Power

RHR

AFW

HPSI

- Safety system failures

• Integrity of Barriers to the Release of

Radioactivity

- reactor coolant system specific

activity (clad integrity)

- reactor coolant system leakage

- containment leakage

• The Emergency Preparedness

Cornerstone

- Emergency Response Organization

( E R O ) d r i l l a n d e x e r c i s e

performance

- p e r c e n t a g e o f E m e rge n c y

Response Organization shift crews

that have participated in a drill or

exercise in the past 24 months

- percentage of the time the Alert

and Notification System has been

available

• Limitation of Public Radiation

Exposure
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-7 NUREG/CR-6042 Rev. 2

- number of effluent events that are

reportable per 10 CFR 20, 10 CFR

50 Appendix I, or

Technical Specifications

• Limitation of Occupational Exposure

to Radiation

- the number of non-compliance

with 10 CFR 20 requirements for

(1) high (>1 rem/hr) and (2) very

high rad i a t i o n a r e a s , and

uncontrolled personnel exposures

exceeding 10% of the stochastic

limits or 2% of the non-stochastic

limits

• Safeguarding Nuclear Materials

- security equipment availability

- Vital Area security equipment

availability

- personnel screening performance

There are three immediately apparent

features of the performance indicators. First,

the performance indicators cannot be

interpreted in a way that would indicate the

level of licensee compliance to NRC

requirements and licensee commitments.

Second, the performance indicators cannot

be used either individually or collectively as

measures of the risk posed by the continued

operation of the plant. The indicators are

truly only indicative of the need for

additional attention. Third, it is not possible

to make comparisons between indicators for

different cornerstones. That is, changes in

the availability of security equipment

availability cannot be compared to changes

in the availability of safety systems.

Since the indicators do not yield a measure

of risk and they do not yield a measure of

compliance to the regulations, it is necessary

to define a scale for response to values

found for the performance indicators for

individual licensees. To do this the NRC has

defined performance bands. These bands

indicate whether the response to the values

of the performance indicators should be by

the licensee or by the NRC and if the

response is to be by the NRC how intense

this response should be. The performance

bands are commonly referred to by color and

are:

• Green - Licensee Response Band

• White - Increased Regulatory

Response Band

• Yellow - Required Regulatory

Response Band

• Red - Unacceptable Performance

Band

The so-called ‘threshold values’forthe

performance indicators that mark the

boundaries of the performance bands are

shown in Table 2.6-1. Details of the

responses associated with each band are

discussed further in connection with the

NRC Action Matrix in a later subsection.

The threshold marking the boundary between

the Licensee Response Band and the

Increased Regulatory Response Band has

been set as the 95th percentile of the industry

performance. That is, 95% of the currently

operating plants will have performance

indicator values no worse than the green to

white threshold values. This selection for the

threshold has raised two questions. First,

why are not the thresholds set in plantspecific manners? This question arises

especially for those performance indicators

that can be assessed using methods of

quantitative risk assessment. It has been

well-established that the risk posed by a

plant is quite dependent on plant-specific

features. That is, failure of emergency power

is not of the same risk significance at all
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-8 NUREG/CR-6042 Rev. 2

plants, for example. The second question is

whether the thresholds will change as the

performance of the industry as a whole

changes. The NRC staff has indicated that

they do not plan to change the thresholds in

response to changes in the performance of

the nuclear industry.

The definitions of the thresholds for bands

other than the threshold between the

Licensee Response band and the Increased

Regulatory Attention band have been

controversial especially for the performance

indicators associated with Reactor Safety.

The NRC staff made an attempt to use risk

information to define these thresholds.

Nominally the thresholds for denote

increases in the core damage frequency of

10-5 and 10-4/reactor year associated with

just the monitored event. Of course, the

monitored event is very unlikely to produce

core damage because, by assumption, other

systems are available. Consequently, some

remarkable numbers appear. It would be

appalling if a licensee or the NRC let a plant

continue to operate that had 20 or more

automatic scrams in about a year of

operation. These thresholds are now being

reconsidered. There is also a research

activity to investigate Risk Based

Performance Indicators.

2.6.3.3 The Baseline Inspections

The second method for monitoring the

performance of licensees is the Baseline

Inspection Program. Each licensee is to be

subjected to the minimal level of inspection

defined by this program. This aspect of the

Reactor Oversight Program contrasts with

the previous SALP process in which highly

rated licensees were granted some relief

from routine inspection. The effect of this

change is that some licensees have seen their

charges for inspection hours increase after

imposition of the new Reactor Oversight

Program. There have apparently been no

complaints from licensees that sustained a

reduction in inspection as a result of the

newly defined baseline inspection program.

The Baseline Inspection Program is divided

into three component types of inspection

which are:

• “ComplementaryInspections”which

deal with areas where performance

indicators have not been established.

1. “Supplementary Inspections”

which deal with areas that

performance indicators provide

only limited indications of

performance.

• “VerificationInspections”whichdeal

with areas that are well treated by the

performance indicators and inspection

is done to verify that the performance

indicator is providing the needed

data.

The areas addressed by the Baseline

Inspection program are indicated in Table

2.6-2. Risk has been factor into the baseline

inspection program in four ways:

• inspectible areas are based on their

risk importance in measuring a

cornerstone objective,

• the inspection frequency, how many

activities to inspect, and how much

time to spend inspecting activities in

each inspectible area are based on the

risk information matrices,

• the selection of activities to inspect in

each inspectible area is based on the

use of risk information matrices

m o d i f i e d b y p l a n t - s p e c i f i c

information, and
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-9 NUREG/CR-6042 Rev. 2

• the inspectors are trained in the use

of risk information.

The inspections are carried out by the NRC

staff in the Regions. Note that in each of the

cornerstones there is an inspectible area

called “Identification and resolution of

problems”.Thisistheinspection ofthe

licensee Corrective Action Program which is

an essential element of the new Reactor

Oversight Program and is discussed

summarily in a subsection below.

2.6.3.4 The Significance Determination

Process

Inspections will inevitably lead to findings.

Furthermore, licensees themselves commonly

encounter situations where they have

inadvertently fallen out of compliance with

their licensing basis and report these

occurrences to the NRC. In the past, findings

of inspectors or licensees would be often

result in a violation of varying degrees of

severity. In the new Reactor Oversight

Program findings are subjected to a

Significance Determination Process. The

objectives of the process are:

- to characterize the significance of

an inspection finding for the NRC

licensee performance assessment

process using risk insights as

appropriate

- to provide all stakeholders an

objective and common framework

for communicating the potential

safety significance of inspection

findings, and

- to provide a basis for assessment

a n d e n f o r c e m e n t a c t i o n s

associated with an inspection

finding.

The process in all cases involves first an

initial characterization of the finding usually

by the inspector. Then the licensee

perspective on the initial characterization of

the finding significance is sought. NRC

makes a final significance determination.

The findings are labeled by a color code

similar to that used for characterizing

performance bands based on performance

indicators:

- Green Finding: A finding of very

low safety significance.

- White Finding: A finding of low

to moderate safety significance

- Yellow Finding: A finding of

substantial safety significance

- Red Finding: A finding of high

safety significance.

There is, however, clearly a distinction to be

made between a Green Finding and the green

performance band. When there is a Green

Finding there has been a performance failure

albeit one of low safety significance and the

licensee is obligated to take actions to

correct this failure.

There are four processes for the initial

characterization of a finding. The process for

characterization of a reactor inspection

finding for At-Power situations does involve

an assessment of the risk significance based

on plant-specific work sheets. These work

sheets are usually developed initially by the

NRC using risk assessment models and then

refined using risk assessment models

developed by the specific licensee. The

process for characterizing findings associated

with occupation radiation safety (primarily

issues of ALARA practices and accidental

overexposures) and public radiation safety

have quantitative elements that are based on

judgement. For these findings, the color code

does not include Red findings. The process

for characterizing findings associated with
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-10 NUREG/CR-6042 Rev. 2

fire protection is rather involved and

includes quantifications based on judgmental

inputs concerning the degradation of defense

in depth as described in the fire protection

regulations (notably 10CFR50 Appendix R).

2.6.3.5 The NRC Action Matrix

The combination of performance indicators

and inspection findings are inputs to the

NRC Action Matrix which defines escalating

responses to the inputs. This Action Matrix

is shown in Table 2.6-3. Note that a single

white input or two white inputs for different

cornerstones is still interpreted as meaning

that the licensee is fully meeting the safety

objectives defined by the cornerstones. Two

white inputs for a particular cornerstone or

a yellow input means that there is some

degradation in licensee performance, but

there has been minimal reduction in the

safety margins. A similar conclusion is

reached in the case of three white inputs to

a particular class of cornerstones - Reactor

Safety, Radiation Safety or Safeguards.

Multiple yellow inputs or any red input

implies that there has been substantial

failure to meet the safety objectives and

there have been significant reductions in the

safety margins that merit response not only

by the Regions, but also by the Agency as a

whole. When the conclusion is reached that

performance is unacceptable, the plant will

not be permitted to operate.

2.6.3.6 Licensee Corrective Action

Program

The most common response from the inputs

provide by the inspections and the

performance indicators is for additions to the

licensee’scorrectiveactionprograms.All

licensee have these programs. If nothing

else, they are mandated by the Maintenance

Rule (10CFR50.65). They take on a very

central role in the new Reactor Oversight

Program. In fact, much of the routine

inspection that was done in the past by the

NRC at nuclear power plants has been

transformed into an inspection of the

licensee’scorrectiveactionprogramandthe

ability of the licensee to identify and resolve

problems and issues that arise in the

operation of power plants.

2.6.4 Regulatory Guide 1.174

As this document is being written, regulatory

guidance for risk-informed regulation is still

being developed. However, one landmark

document that has been issued is Regulatory

Guide 1.174,“An Approach for Using

Probabilistic Risk Assessment in RiskInformed Decisions on Plant-Specific

Changesto theLicensing Basis.”3 This

document is intended for use in evaluating

plant-specific changes to the licensing basis

of an individual plant.

2.6.4.1 Maintenance Rule (10CFR50.65)

Beginning in July, 1996, nuclear power plant

licensees were required to comply with the

Maintenance Rule (10 CFR 50.65):

Each holder of a license to

operate a nuclear power plant.

. . s h a l l m o n i t o r t h e

performance or condition of

s t r u c t u re s , systems a n d

components, against licenseeestablished goals, in a manner

s u f f i c i e n t t o p r o v i d e

reasonable assurance that such

s t r u ctures, s y s t e m s a n d

components . . . are capable of

fulfilling their intended

functions. Such goals shall be

established commensurate with

safety and, where practical,

take into account industrywide operating experience.
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-11 NUREG/CR-6042 Rev. 2

When the performance or

condition of a structure,

system or component does not

m e e t established g o a l s ,

appropriate corrective action

shall be taken.

The Nuclear Regulatory Commission was

moved to impose this additional requirement

on plants because of evidence that

maintenance-related system failures were

leading to unplanned plant shutdowns or

other safety-related issues. The evidence

suggested that it was not just the

maintenance of safety-related structures,

systems, and components that was of

concern. Other systems not usually

considered safety-related within the context

of reactor regulations needed to be

addressed. Consequently, the scope of the

Maintenance Rule is large:

- safety-related structures, systems, and

components that are relied upon to

remain functional during and

following design basis events to

ensure:

• the integrity of the reactor coolant

pressure boundary

• the capability to shutdown the reactor

• the capability to maintain the reactor

in safe shutdown condition

• the capability to prevent and mitigate

the consequences of accidents

- structures, systems and components that

are not safety-related, but are:

• relied upon to mitigate accidents or

transients

• used in plant emergency operating

procedures

• capable of failing in ways that

prevent safety-related structures,

systems and components from

fulfilling their safety-related functions

• capable of failing in ways that cause

a reactor scram or actuation of a

safety-related system.

The Maintenance Rule also applies explicitly

to the safe storage of spent reactor fuel for

both operating reactors and reactors that are

being permanently shutdown.

The Maintenance Rule requires that licensees

first decide whether structures, systems and

components are within the scope of the rule.

A decision tree for this first categorization is

shown in Figure xx. Then, the licensees must

decide if the structures, systems and

components need to be monitored (so-called

a(1) SSCs) or are adequately treated by the

existing preventive maintenance program

(a(2)SSCs).A decision ‘tree’forthis

second categorization is shown in Figure

xxx.

The breadth of the concern was sufficient

that usual, generic, prescriptive regulations

concerning maintenance would easily

overwhelm both licensees and staff and

would take tremendous effort to develop and

implement. At the same time, prescriptive

regulations would not take advantage of

engineering creativity within the nuclear

industry. Consequently, the Commission

chose a more performance-based approach

that allowed the industry to define

maintenance goals based on safety. It is

noteworthy that safety rather than risk was

selected as the basis for the goals. Even in

1996, there was not the confidence in the

tools for quantitative risk assessment to

adopt quantitative measures of risk into the

regulation nor was there a willingness to

create a defacto requirement that all plants

have probabilistic risk assessments (PRAs).

Nevertheless, the requirements in the rules

that in monitoring:
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-12 NUREG/CR-6042 Rev. 2

- adjustments shall be made where

necessary to ensure that the objectives

of preventing failures of structures,

s ys t e m s , a n d c o m p o n e n t s i s

appropriately balanced against the

o b j e c t ive of minimiz i n g t h e

unavailability of structures, systems

and components due to monitoring

and preventive maintenance, and

- an assessment of the total plant

equipment that is out of service

should be taken into account to

determine the overall effect on

performance of safety functions

- created an interest in using

quantitative risk assessment methods

to implement the rule.

Even when a licensee wants to use

quantitative risk assessment methods in

connection with the Maintenance Rule, there

is a significant hurdle. Typically, a

probabilistic risk assessment will address

directly no more than about 2000

components or systems in a plant that may

have 24,000 components and systems subject

to the Maintenance Rule. The problem of

setting availability goals for the systems that

are not addressed in the probabilistic risk

assessments then arises.

To address this difficulty NUMARC and

later the Nuclear Energy Institute (NEI)

developed guidance for the industry that has

been endorsed by the NRC staff in

RegulatoryGuide1.160,“Monitoringthe

Effectiveness of Maintenance at Nuclear

PowerPlants”. Thisguidancedefinedsocalled Expert Panels that actually make the

classifications of structures, systems and

components for the purposes of the

Maintenance Rule. Where quantitative risk

information is available the Expert Panel can

use importance metrics such as ‘risk

achievement worth’ (RAW) and ‘risk

reductionworth’(RRW) for the purposes of

classification and setting availability goals

(For a discussion of risk importance

measures see Appendix A-1). Experience

and expert judgement must be used as the

basis for the classification of structures,

systems and components that are not treated

explicitly by quantitative risk analyses. Even

when quantitative risk importance measures

are available, expert judgement is required to

appreciate the limitations of these measures.

The most limiting failing of these measures

is that they do not account for the

simultaneous unavailability of multiple

systems and components.

The Maintenance Rule also specifies what

licensees are to do in the event that the

maintenance goals are not met:

When the performance or condition of

a structure system or component does

n o t m e e t e s t a b l i s h e d g o a l s ,

appropriate corrective action shall be

taken.

This requirement of the Maintenance Rule

created the licensee corrective action

programs that are crucial elements of the

revised reactor oversight process discussed

elsewhere in this document.

The NRC staff conducted an early study of

the ways licensees had implemented the

MaintenanceRule,“LessonsLearnedfrom

Early Implementation of the Maintenance

R u l e a t N i n e N u c l e a r P o w e r

Plants”(NUREG-1526,1995).Animmediate

conclusion reached in the assessment of

license implementation of the Maintenance

rule was that the requirement for assessment

of the risk significance of removing systems

from service for maintenance was being

interpreted in a limited fashion. License did

not sufficiently appreciate that the
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-13 NUREG/CR-6042 Rev. 2

Maintenance Rule applied to all modes of

operation including shutdown and low power

modes of operation. Consequently, the

Commission developed what became known

as the a(4) modification to 10CFR50.65:

Before performing maintenance

activities (including but not limited to

surveillance, post-maintenance testing

and corrective and preventive

maintenance), the licensee shall

assess and manage the increase in

risk that may result from the

proposed maintenance activities. The

scope of the assessment may be

limited to structures, systems, and

components that a risk-informed

evaluation process has shown to be

significant to public health and

safety.

This requirement of the Maintenance Rule

has contributed to the substantial increase in

attention licensee pay to the planning of

outages. Most licensees now have matrices

of combinations of equipment that are not

permitted to be simultaneously removed

from service. Many licensees have software

that allows at least a semi-quantitative

assessment of the risk impact of planned

maintenance activities.

Other conclusions reached in the early

assessment of the implementation of the

Maintenance Rule included:

• Licensees had difficulty in utilizing

i n d u s t r y e x p e r i e n c e i n s e t t i n g

maintenance goals.

• Many licensees used too limited a set of

importance measures in classifying

structures, systems and components.

• Often structures were considered

‘inherently safe’ and not treated in

accordance with the expectations from

the Maintenance Rule. Monitoring of

structures was criticized as not predictive

and not capable of giving early warning

of degradation.

• Some licensees were reluctant to

categorize structures, systems and

components as requiring the a(1)

treatment because of concern that this

might imply that their preventive

maintenance programs were ineffective.

• Licensees often could not demonstrate

performance criteria and goals were

c o m m e n s u r a t e w i t h t h e s a f e t y

significance of a structure, system or

component.

• Some licensees did not balance reliability

and availability for high safety

significant structures, systems and

components.

There can be confusion in identifying system

failures as preventable by maintenance.

Some examples of failures that are and are

not maintenance preventable are shown in

Table 2.6-4.

2.6.4.2 A Four-Element Approach to

Integrated Decision Making

Given the principles of risk-informed

decisionmaking discussed above, the staff

has identified a four-element approach to

evaluating proposed LB changes. This

approach, which is presented graphically in

Figure 2.6-2, acceptably supports the NRC's

decisionmaking process. This approach is

not sequential in nature; rather it is iterative.

Element 1: Define the Proposed Change

Element 1 involves three primary activities.

First, the licensee should identify those
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-14 NUREG/CR-6042 Rev. 2

aspects of the plant's licensing bases that

may be affected by the proposed change,

including, but not limited to, rules and

regulations, final safety analysis report

(FSAR), technical specifications, licensing

conditions, and licensing commitments.

Second, the licensee should identify all

structures, systems, and components (SSCs),

procedures, and activities that are covered by

the LB change under evaluation and consider

the original reasons for inclusion of each

program requirement. Third, the licensee

should identify available engineering studies,

methods, codes, applicable plant-specific and

industry data and operational experience,

PRA findings, and research and analysis

results relevant to the proposed LB change.

With particular regard to the plant-specific

PRA, the licensee should assess the

capability to use, refine, augment, and

update system models as needed to support

a risk assessment of the proposed LB

change.

The licensee should describe the proposed

change and how it meets the objectives of

the NRC’s PRA Policy Statement. In

addition to improvements in reactor safety,

this assessment may consider benefits from

the LB change such as reduced fiscal and

personnel resources and radiation exposure.

The licensee should affirm that the proposed

LB change meets the current regulations,

unless the proposed change is explicitly

related to a proposed exemption or rule

change.

Element 2: Perform Engineering Analysis

As part of the second element, the licensee

will evaluate the proposed LB change with

regard to the principles that adequate

defense-in-depth is maintained, that

sufficient safety margins are maintained, and

that proposed increases in core damage

frequency and risk are small and are

consistent with the intent of the

Commissions’s Safety Goal Policy

Statement.

Defense-in-Depth -- The engineering

evaluation conducted should evaluate

whether the impact of the proposed LB

change (individually and cumulatively) is

consistent with the defense-in-depth

philosophy. Defense-in-depth is maintained

if:

• A reasonable balance is preserved among

prevention of core damage, prevention of

containment failure, and consequence

mitigation.

• Over-reliance on programmatic activities

to compensate for weaknesses in plant

design is avoided.

• System redundancy, independence, and

diversity are preserved commensurate

with the ex pecte d f r e q uency,

consequences of challenges to the system,

and uncertainties (e.g., no risk outliers).

• Defenses against potential common cause

failures are preserved, and the potential

for the introduction of new common

cause failure mechanisms is assessed.

• Independence of barriers is not degraded.

• Defenses against human errors are

preserved.

• The intent of the General Design Criteria

in Appendix A to 10 CFR Part 50 is

maintained.

Safety Margins -- The engineering evaluation

conducted should assess whether the impact

of the proposed LB change is consistent with

the principle that sufficient safety margins

are maintained. Here also, the licensee is
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-15 NUREG/CR-6042 Rev. 2

expected to choose the method of

engineering analysis appropriate for

evaluating whether sufficient safety margins

would be maintained if the proposed LB

change were implemented. Sufficient safety

margins are maintained if:

• Codes and standards or their alternatives

approved for use by the NRC are met.

• Safety analysis acceptance criteria in the

LB (e.g., FSAR, supporting analyses) are

met, or proposed revisions provide

sufficient margin to account for analysis

and data uncertainty.

Evaluation of Risk Impact, Including

Treatment of Uncertainties --

The licensee's risk assessment may be used

to address the principle that proposed

increases in CDF and risk are small and are

consistent with the intent of the NRC's

Safety Goal Policy Statement. For purposes

of implementation, the licensee should assess

the expected change in CDF and LERF.

The necessary sophistication of the

evaluation, including the scope of the PRA

(e.g., internal events only, full power only),

depends on the contribution the risk

assessment makes to the integrated

decisionmaking, which depends to some

extent on the magnitude of the potential risk

impact.

There are three parts to using the PRA

results in decisiomaking:

• Assure that the quality and scope of the

PRA is adequate for the intended

application.

• Compare the CDF and LERF results to

the acceptance guidelines. The overall

baseline CDF and LERF are examined,

along with the impact of the proposed

change.

• Examine the uncertainties in the results

and assess their potential impact on the

decision.

These three items are discussed in more

detail in RG 1.174. The acceptance

guidelines were the subject of considerable

debate and are presented below.

The risk-acceptance guidelines are structured

as follows. Regions are established in the

two planes generated by a measure of the

baseline risk metric (CDF or LERF) along

the x-axis, and the change in those metrics

(CDF or LERF) along the y-axis (Figures

2.6-3 and 2.6-4), and acceptance guidelines

are established for each region as discussed

below. These guidelines are intended for

comparison with a full-scope (including

internal events, external events, full power,

low power, and shutdown) assessment of the

change in risk metric, and when necessary,

as discussed below, the baseline value of the

risk metric (CDF or LERF). However, it is

recognized that many PRAs are not full

scope and PRA information of less than full

scope may be acceptable in some cases.

There are two sets of acceptance guidelines,

one for CDF and one for LERF, and both

sets should be used.

• If the application clearly can be shown to

result in a decrease in CDF, the change

will be considered to have satisfied the

relevant principle of risk-informed

regulation with respect to CDF.

(Because Figure 2.6-3 is drawn on a log

scale, this region is not explicitly

indicated on the figure.)

• When the calculated increase in CDF is

very small, which is taken as being less

than 10-6 per reactor year, the change will

be considered regardless of whether there

is a calculation of the total CDF (Region
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-16 NUREG/CR-6042 Rev. 2

III). While there is no requirement to

calculate the total CDF, if there is an

indication that the CDF may be

considerably higher than 10-4 per reactor

year, the focus should be on finding

ways to decrease rather than increase it.

• When the calculated increase in CDF is

in the range of 10-6 per reactor year to

10-5 per reactor year, applications will be

considered only if it can be reasonably

shown that the total CDF is less than

10-4 per reactor year (Region II).

• Applications that result in increases to

CDF above 10-5 per reactor year (Region

I) would not normally be considered.

AND

• If the application clearly can be shown to

result in a decrease in LERF, the change

will be considered to have satisfied the

relevant principle of risk-informed

regulation with respect to LERF.

(Because Figure 2.6-4 is drawn with a

log scale, this region is not explicitly

indicated on the figure.)

• When the calculated increase in LERF is

very small, which is taken as being less

than 10-7 per reactor year, the change will

be considered regardless of whether there

is a calculation of the total LERF

(Region III). While there is no

requirement to calculate the total LERF,

if there is an indication that the LERF

may be considerably higher than 10-5 per

reactor year, the focus should be on

finding ways to decrease rather than

increase it.

• When the calculated increase in LERF is

in the range of 10-7 per reactor year to

10-6 per reactor year, applications will be

considered only if it can be reasonably

shown that the total LERF is less than

10-5 per reactor year (Region II).

• Applications that result in increases to

LERF above 10-6 per reactor year (Region

I) would not normally be considered.

These guidelines are intended to provide

assurance that proposed increases in CDF

and LERF are small and are consistent with

the intent of the Commission's Safety Goal

Policy Statement.

As indicated by the shading on the figures,

the change request will be subject to an NRC

technical and management review that will

become more intensive when the calculated

results are closer to the region boundaries.

The guidelines discussed above are

applicable for full power, low power, and

shutdown operations. However, during

certain shutdown operations when the

containment function is not maintained, the

LERF guideline as defined above is not

practical. In those cases, licensees may use

more stringent baseline CDF guidelines (e.g.,

10-5 per reactor year) to maintain an

equivalent risk profile or may propose an

alternative guideline to LERF that meets the

intent of Principle 4 (see Figure 2.6-1).

Integrated Decisionmaking

The results of the different elements of the

engineering analyses must be considered in

an integrated manner. None of the individual

analyses is sufficient in and of itself. In this

way, it can be seen that the decision will not

be driven solely by the numerical results of

the PRA. They are one input into the

decisionmaking and help in building an

overall picture of the implications of the

proposed change on risk. The PRA has an

important role in putting the change into its
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-17 NUREG/CR-6042 Rev. 2

proper context as it impacts the plant as a

whole.

An application will be given increased NRC

management attention when the calculated

values of the changes in the risk metrics, and

their baseline values when appropriate,

approached the guidelines. Therefore, the

issues in the submittal that are expected to

be addressed by NRC management include:

• The cumulative impact of previous

changes and the trend in CDF (the

licensee's risk management approach);

• The cumulative impact of previous

changes and the trend in LERF (the

licensee's risk management approach);

• The impact of the proposed change on

operational complexity, burden on the

operating staff, and overall safety

practices;

• Plant-specific performance and other

factors (for example, siting factors,

inspection findings, performance

indicators, and operational events), and

Level 3 PRA information, if available;

• The benefit of the change in relation to

its CDF/LERF increase;

• The practicality of accomplishing the

change with a smaller CDF/LERF impact;

and

• The practicality of reducing CDF/LERF

when there is reason to believe that the

baseline CDF/LERF are above the

guideline values (i.e., 10-4 and 10-5 per

reactor year).

Element 3: Define Implementation and

Monitoring Program

Careful consideration should be given to

implementation and performance-monitoring

strategies. The primary goal for this element

is to ensure that no adverse safety

degradation occurs because of the changes to

the LB. The staff's principal concern is the

possibility that the aggregate impact of

changes that affect a large class of SSCs

could lead to an unacceptable increase in

the number of failures from unanticipated

degradation, including possible increases in

common cause mechanisms. Therefore, an

implementation and monitoring plan should

be developed to ensure that the engineering

evaluation conducted to examine the impact

of the proposed changes continues to reflect

the actual reliability and availability of

SSCs that have been evaluated. This will

ensure that the conclusions that have been

drawn from the evaluation remain valid.

The staff expects licensees to propose

monitoring programs that include a means to

adequately track the performance of

equipment that, when degraded, can affect

the conclusions of the licensee's engineering

evaluation and integrated decisionmaking

that support the change to the LB. The

program should be capable of trending

equipment performance after a change has

been implemented to demonstrate that

performance is consistent with that assumed

in the traditional engineering and

probabilistic analyses that were conducted to

justify the change. This may include

m o n i t o r i n g a s s o c i a t e d w i t h

non-safety-related SSCs, if the analysis

determines those SSCs to be risk significant.

The program should be structured such that

(1) SSCs are monitored commensurate with

their safety importance, i.e., monitoring for

SSCs categorized as having low safety

significance may be less rigorous than that

for SSCs of high safety significance, (2)

feedback of information and corrective

actions are accomplished in a timely manner,
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-18 NUREG/CR-6042 Rev. 2

and (3) degradation in SSC performance is

detected and corrected before plant safety

can be compromised. The potential impact

of observed SSC degradation on similar

components in different systems throughout

the plant should be considered.

Element 4: Submit Proposed Change

Requestsforproposedchangetotheplant’s

LB typically take the form of requests for

license amendments (including changes to or

removal of license conditions), technical

changes, changes to or withdrawals of

orders, and changes to programs.

Licensees are free to decide whether to

submit risk information in support of their

LB change request. If the licensee’s

proposed change to the LB is consistent with

currently approved staff positions, the staff’s

determination will be based solely on

traditional engineering analysis without

recourse to risk information (although the

staff may consider any risk information

which is submitted by the licensee).

However,ifthelicensee’sproposedchange

goes beyond currently approved staff

positions, the staff will normally consider

both information based upon traditional

engineering analysis and information based

upon risk insights.

2.6.5 Recent Regulatory Changes

2.6.5.1 Maintenance Rule (10CFR50.65)

Beginning in July, 1996, nuclear power plant

licensees were required to comply with the

Maintenance Rule (10 CFR 50.65):

Each holder of a license to operate a

nuclear power plant. . . shall monitor

the performance or condition of

structures, systems and components,

against licensee-established goals, in

a manner sufficient to provide

reasonable assurance that such

structures, systems and components .

. . are capable of fulfilling their

intended functions. Such goals shall

be established commensurate with

safety and, where practical, take into

account industry-wide operating

experience. When the performance or

condition of a structure, system or

component does not meet established

goals, appropriate corrective action

shall be taken.

The Nuclear Regulatory Commission was

moved to impose this additional requirement

on plants because of evidence that

maintenance-related system failures were

leading to unplanned plant shutdowns or

other safety-related issues. The evidence

suggested that it was not just the

maintenance of safety-related structures,

systems, and components that was of

concern. Other systems not usually

considered safety-related within the context

of reactor regulations needed to be

addressed. Consequently, the scope of the

Maintenance Rule is large:

- safety-related structures, systems, and

components that are relied upon to

remain functional during and following

design basis events to ensure:

• the integrity of the reactor coolant

pressure boundary

• the capability to shutdown the reactor

• the capability to maintain the reactor

in safe shutdown condition

• the capability to prevent and mitigate

the consequences of accidents

- structures, systems and components that

are not safety-related, but are:
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-19 NUREG/CR-6042 Rev. 2

• relied upon to mitigate accidents or

transients

• used in plant emergency operating

procedures

• capable of failing in ways that

prevent safety-related structures,

systems and components from

fulfilling their safety-related functions

• capable of failing in ways that cause

a reactor scram or actuation of a

safety-related system.

The Maintenance Rule also applies explicitly

to the safe storage of spent reactor fuel for

both operating reactors and reactors that are

being permanently shutdown.

The Maintenance Rule requires that licensees

first decide whether structures, systems and

components are within the scope of the rule.

A decision tree for this first categorization is

shown in Figure 2.6-1. Then, the licensees

must decide if the structures, systems and

components need to be monitored (so-called

a(1) SSCs) or are adequately treated by the

existing preventive maintenance program

(a(2)SSCs).A decision ‘tree’forthis

second categorization is shown in Figure

2.6-2.

The breadth of the concern was sufficient

that usual, generic, prescriptive regulations

concerning maintenance would easily

overwhelm both licensees and staff and

would take tremendous effort to develop and

implement. At the same time, prescriptive

regulations would not take advantage of

engineering creativity within the nuclear

industry. Consequently, the Commission

chose a more performance-based approach

that allowed the industry to define

maintenance goals based on safety. It is

noteworthy that safety rather than risk was

selected as the basis for the goals. Even in

1996, there was not the confidence in the

tools for quantitative risk assessment to

adopt quantitative measures of risk into the

regulation nor was there a willingness to

create a defacto requirement that all plants

have probabilistic risk assessments (PRAs).

Nevertheless, the requirements in the rules

that in monitoring:

- adjustments shall be made where

necessary to ensure that the objectives of

preventing failures of structures, systems,

and components is appropriately balanced

against the objective of minimizing the

unavailability of structures, systems and

components due to monitoring and

preventive maintenance, and

- an assessment of the total plant

equipment that is out of service should

be taken into account to determine the

overall effect on performance of safety

functions

created an interest in using quantitative risk

assessment methods to implement the rule.

Even when a licensee wants to use

quantitative risk assessment methods in

connection with the Maintenance Rule, there

is a significant hurdle. Typically, a

probabilistic risk assessment will address

directly no more than about 2000

components or systems in a plant that may

have 24,000 components and systems subject

to the Maintenance Rule. The problem of

setting availability goals for the systems that

are not addressed in the probabilistic risk

assessments then arises.

To address this difficulty NUMARC and

later the Nuclear Energy Institute (NEI)

developed guidance for the industry that has

been endorsed by the NRC staff in

RegulatoryGuide1.160,“Monitoringthe

Effectiveness of Maintenance at Nuclear

PowerPlants”. Thisguidancedefinedsocalled Expert Panels that actually make the
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-20 NUREG/CR-6042 Rev. 2

classifications of structures, systems and

components for the purposes of the

Maintenance Rule. Where quantitative risk

information is available the Expert Panel can

use importance metrics such as ‘risk

achievement worth’ (RAW) and ‘risk

reductionworth’(RRW) for the purposes of

classification and setting availability goals

(For a discussion of risk importance

measures see Appendix A-1). Experience

and expert judgement must be used as the

basis for the classification of structures,

systems and components that are not treated

explicitly by quantitative risk analyses.

Even when quantitative risk importance

measures are available, expert judgement is

required to appreciate the limitations of

these measures. The most limiting failing of

these measures is that they do not account

for the simultaneous unavailability of

multiple systems and components.

The Maintenance Rule also specifies what

licensees are to do in the event that the

maintenance goals are not met:

When the performance or condition of

a structure system or component does

n o t m e e t e s t a b l i s h e d g o a l s ,

appropriate corrective action shall be

taken.

This requirement of the Maintenance Rule

created the licensee corrective action

programs that are crucial elements of the

revised reactor oversight process discussed

elsewhere in this document.

The NRC staff conducted an early study of

the ways licensees had implemented the

MaintenanceRule,“LessonsLearnedfrom

Early Implementation of the Maintenance

R u l e a t N i n e N u c l e a r P o w e r

Plants”(NUREG-1526,1995).Animmediate

conclusion reached in the assessment of

license implementation of the Maintenance

rule was that the requirement for assessment

of the risk significance of removing systems

from service for maintenance was being

interpreted in a limited fashion. License did

not sufficiently appreciate that the

Maintenance Rule applied to all modes of

operation including shutdown and low power

modes of operation. Consequently, the

Commission developed what became known

as the a(4) modification to 10CFR50.65:

Before performing maintenance

activities (including but not limited to

surveillance, post-maintenance testing

and corrective and preventive

maintenance), the licensee shall

assess and manage the increase in

risk that may result from the

proposed maintenance activities. The

scope of the assessment may be

limited to structures, systems, and

components that a risk-informed

evaluation process has shown to be

significant to public health and

safety.

This requirement of the Maintenance Rule

has contributed to the substantial increase in

attention licensee pay to the planning of

outages. Most licensees now have matrices

of combinations of equipment that are not

permitted to be simultaneously removed

from service. Many licensees have software

that allows at least a semi-quantitative

assessment of the risk impact of planned

maintenance activities.

Other conclusions reached in the early

assessment of the implementation of the

Maintenance Rule included:

• Licensees had difficulty in utilizing

i n d u s t r y e x p e r i e n c e i n s e t t i n g

maintenance goals.
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-21 NUREG/CR-6042 Rev. 2

• Many licensees used too limited a set of

importance measures in classifying

structures, systems and components.

• Often structures were considered

‘inherently safe’ and not treated in

accordance with the expectations from

the Maintenance Rule. Monitoring of

structures was criticized as not predictive

and not capable of giving early warning

of degradation.

• Some licensees were reluctant to

categorize structures, systems and

components as requiring the a(1)

treatment because of concern that this

might imply that their preventive

maintenance programs were ineffective.

• Licensees often could not demonstrate

performance criteria and goals were

c o m m e n s u r a t e w i t h t h e s a f e t y

significance of a structure, system or

component.

• Some licensees did not balance reliability

and availability for high safety

significant strictures, systems and

components.

• There can be confusion in identifying

system failures as preventable by

maintenance.

2.6.5.2 R i s k - I n f o r m e d Te c h n i c a l

Specifications

Technical specifications (TS) are key

requirements outlining the limits of

acceptable operation for nuclear power

plants. Section 182a of the Atomic Energy

Act requires that applicants for nuclear

power plant operating licenses state:

Such technical specifications,

including information of the

amount, kind, and source of

special nuclear material

required, the place of the use,

the specific characteristics of

the facility, and such other

information as the Commission

may, by rule or regulation,

deem necessary in order to

enable it to find that the

utilization ...of special nuclear

material will be in accord

with the common defense and

security and will provide

adequate protection to the

health and safety of the public.

Such technical specifications

shall be a part of any license

issued.

In Section 50.36, "Technical Specifications,"

of 10 CFR Part 50, "Domestic Licensing of

Production and Utilization Facilities," the

Commission established its regulatory

requirements related to the content of TS. In

doing this, the Commission emphasized

matters related to the prevention of

accidents and the mitigation of accident

consequences; the Commission noted that

applicants were expected to incorporate into

their TS "those items that are directly related

to maintaining the integrity of the physical

barriers designed to contain radioactivity".4

Pursuant to 10 CFR 50.36, TS are required

to contain items in the following five

specific categories: (1) safety limits, limiting

safety system settings, and limiting control

settings, (2) limiting conditions for

operation, (3) surveillance requirements, (4)

design features, and (5) administrative

controls.

For the most part, TS have played a major

role in ensuring plant safety and maintaining

safe operating conditions. However, in some

cases TS have led to unnecessary burden on

the plants and have even been counter to
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-22 NUREG/CR-6042 Rev. 2

safety. Previously, it was not uncommon for

plants to be required to shut down if a

shutdown cooling system failed a

surveillance test. Clearly, this made no

sense. Further, we are now more aware of

the risks associated with shutdown

operations and the transitions from power

operation. A risk-informed approach allows

the NRC and the licensees to consider the

risk tradeoffs from requiring a shutdown due

to a TS violation. Allowing a plant to

remain at power by extending the allowed

outage time of a component may be best for

both the licensee and the public, provided

that a careful analysis is performed.

Some aspects of TS, particularly limiting

conditions for operation and surveillance

requirements are particularly amenable to

PRA analysis. Changes to these items are

simply reflected in the unavailabilities of the

SSCs in the PRA analysis. Therefore, the

risk impact of changes can be readily

evaluated, provided that an adequate PRA is

available (this is often not the case).

Since the mid-1980s, the NRC has been

reviewing and granting improvements to TS

based, at least in part, on PRA insights.

Some of these improvements have been

proposed by the Nuclear Steam Supply

System (NSSS) owners groups to apply to an

entire class of plants. Many others have

been proposed by individual licensees.

Typically, the proposed improvements

involved a relaxation of one or more allowed

outage times (AOTs) or surveillance test

intervals (STIs) in the TS.

In its July 22, 1993, final policy statement

on TS improvements),5the Commission

stated that it:

...expects that licensees, in

preparing their Technical

S p e c i f i c a t i o n r e l a t e d

submittals, will utilize any

plant-specific PSA or risk

survey and any available

literature on risk insights and

PSAs . . . Similarly, the NRC

staff will also employ risk

i n s i g h t s a n d P S A s i n

e v a l u a t i n g Te c h n i c a l

S p e c i f i c a t i o n s r e l a t e d

submittals. Further, as a part

of the Commission's ongoing

p r o g r a m o f i m p r o v i n g

Technical Specifications, it

will continue to consider

methods to make better use of

risk and reliability information

for defining future generic

Technical Specification

requirements.

The Commission reiterated this point when

it issued the revision to 10 CFR 50.36 in

July 1995).6

Regulatory Guide 1.177 describes an

acceptable approach for making riskinformed changes to TS. The approach

follows the basic four element approach

from Regulatory Guide 1.174, described in

the previous section.

A three-tiered approach has been identified

for licensees to evaluate the risk associated

with proposed TS AOT changes (part of

Element 2, Engineering Evaluation). Tier 1

is an evaluation of the impact on plant risk

of the proposed TS change as expressed by

the change in core damage frequency(CDF),

the incremental conditional core damage

probability (ICCDP), and, when appropriate,

the change in large early release frequency

(LERF) and the incremental conditional large

early release probability (ICLERP).

Tier 2 is an identification of potentially

high-risk configurations that could exist if
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-23 NUREG/CR-6042 Rev. 2

equipment in addition to that associated with

the change were to be taken out of service

simultaneously, or other risk-significant

operational factors such as concurrent system

or equipment testing were also involved. The

objective of this part of the evaluation is to

ensure that appropriate restrictions on

dominant risk-significant configurations

associated with the change are in place.

Tier 3 is the establishment of an overall

configuration risk management program to

ensure that other potentially lower

probability, but nonetheless risk-significant,

configurations resulting from maintenance

and other operational activities are

identified and compensated for. If the Tier 2

assessment demonstrates, with reasonable

assurance, that there are no risk-significant

configurations involving the subject

equipment, the application of Tier 3 to the

proposed AOT may not be necessary.

More details concerning the guidance for

performing an acceptable PRA for TS

evaluation are contained in Regulatory Guide

1.77. Other elements of the TS analysis

follow closely the elements of Regulatory

Guide 1.74.

2.6.5.3 Risk-Informed In-Service Testing

In-service testing (IST) of important safety

equipment is required at specified intervals

in order to assure operability were the

equipment needed to respond to an accident

situation. Such equipment is typically in a

standby mode and does not operate until

demanded. IST requirements are defined in

10 CFR 50.55a(f) and in Section XI of the

ASME Boiler and Pressure Vessel Code.

***Ref9***

IST, while an essential part of ensuring

safety, can become a problem in some

situations. For example, tests can demand

licensee resources, stress the equipment

being tested, and result in increased worker

radiation exposures. Therefore, it is

appropriate to consider reducing IST

requirements when the risk impact can be

shown to be negligible.

Regulatory Guide 1.175 *** ref*** describes

an approach for risk-informed IST, primarily

to be applied to pumps and valves. As with

other risk-informed initiatives, it follows the

approach outlined in Regulatory Guide

1.174. Potential changes include changing

test intervals, testing methods and

component groupings.

The fundamental approach of Regulatory

Guide 1.175 is to group components into low

safety-significant components (LSSC) and

high safety-significant components (HSSC).

Components in the LSSC group could

receive less attention, in terms of test

intervals and rigorous testing, while

components in the HSSC group would

receive the most attention.

Components are initially categorized into

HSSC and LSSC groupings based on

threshold values for PRA importance

measures. As discussed in Regulatory Guide

1.174, while a licensee is free to choose the

threshold values of importance measures, it

will be necessary to demonstrate that the

integrated impact of the change is such that

Principle 4 is met.

PRA systematically takes credit for

non-Code components as providing support,

acting as alternatives, and acting as backups

to those components that are within the

current Code. Accordingly, to ensure that the

proposed RI-IST program will provide an

acceptable level of quality and safety, these

additional risk-important components should

be included in licensees' RI-IST proposals.
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-24 NUREG/CR-6042 Rev. 2

Although PRAs model many of the SSCs

involved in the performance of plant safety

functions, other SSCs are not modeled for

various reasons. However, this should not

imply that unmodeled components are not

important in terms of contributions to plant

risk. For example, some components are not

modeled because certain initiating events

may not be modeled (e.g., low power and

shutdown events, or some external events);

in other cases, components may not be

directly modeled because they are grouped

together with events that are modeled (e.g.,

initiating events, operator recovery events, or

within other system or function boundaries);

and in some cases, components are screened

out from the analysis because of their

assumed inherent reliability; or failure

modes are screened out because of their

insignificant contribution to risk (e.g.,

spurious closure of a valve). When feasible,

adding missing components or missing

initiators or plant operating states to the

PRA should be considered by the licensee.

When this is not feasible, information based

on traditional engineering analyses and

judgment is used to determine whether a

component should be treated as an LSSC or

HSSC. One approach to combining these

different pieces of information is to use

what has been referred to as an expert panel.

In classifying a component not modeled in

the PRA as LSSC, the expert panel should

have determined that:

• The component does not perform a safety

function, or does not perform a support

function to a safety function, or does not

complement a safety function.

• The component does not support operator

actions credited in the PRA for either

procedural or recovery actions.

• The failure of the component will not

result in the eventual occurrence of a

PRA initiating event.

• The component is not a part of a system

that acts as a barrier to fission product

release during severe accidents.

• The failure of the component will not

result in unintentional releases of

radioactive material even in the absence

of severe accident conditions.

For acceptance guidelines, when using risk

importance measures to identify components

that are low risk contributors, the potential

limitations of these measures have to be

addressed. Therefore, information to be

provided to the licensee's integrated

decisionmaking process (e.g., expert panel)

must include evaluations that demonstrate

the sensitivity of the risk importance results

to the important PRA modeling techniques,

assumptions, and data. Issues that the

licensee should consider and address when

determining low risk contributors include

truncation limit used, different risk metrics

(i.e., CDF and LERF), different component

failure modes, different maintenance states

and plant configurations, multiple component

considerations, defense in depth, and

analysis of uncertainties (including

sensitivity studies to component data

uncertainties, common- cause failures, and

recovery actions).

While the categorization process can be used

to highlight areas in which testing strategy

can be improved and areas in which

sufficient safety margins exist to the point

that testing strategy can be relaxed, it is the

determination of the change in risk from the

overall changes in the IST program that is

of concern in demonstrating that Principle 4

has been met. Therefore, no generically

applicable acceptance guidelines for the
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-25 NUREG/CR-6042 Rev. 2

threshold values of importance measures

used to categorize components as HSSC or

LSSC are given here. Instead, the licensee

should demonstrate that the overall impact of

the change on plant risk is small.

As part of the categorization process,

licensees must also address the initiating

events and plant operating modes missing

from the PRA evaluation. The licensee can

do this either by providing qualitative

arguments that the proposed change to the

IST program does not result in an increase

on risk, or by demonstrating that the

components significant to risk in these

missing contributors are maintained as

HSSC.

2.6.6 NRC Initiatives for Regulatory

Change

RG 1.174 described a process for making

plant-specific changes. The NRC is also

considering broader risk-informed changes to

10CFR50 that could be applied to groups of

plants or the industry as a whole. In SECY

98-300, (Ref.********) the staff identified

three options for addressing 10CFR50:

(1) continue with current activities, but

make no changes to the current Part 50,

(2) make changes to the overall scope of

systems, structures, and components

(SSCs) covered by those sections of

Part 50 requiring special treatment

(such as quality assurance, technical

s p e c i f i c a t i o n s , e n v i r o n m e n t a l

qualification, and 50.59 by formulating

new definitions of safety-related and

important-to-safety SSCs)(2), and

(3) make changes to specific requirements

in the body of regulations, including

general design criteria (GDCs).

The Commission directed the staff to

undertake Option 2 in the short-term and

Option 3 as a longer-term activity. Work on

both options is currently in progress.

Option 2

The information below is taken from

SECY____ Ref.) Insert Reference Here.

The purpose of this rulemaking is to develop

an alternative regulatory framework that

enables licensees, using a risk-informed

process for categorizing SSCs according to

their safety significance (i.e., a decision that

considers both traditional deterministic

insights and risk insights), to reduce

unnecessary regulatory burden for SSCs of

low safety significance by removing these

SSCs from the scope of special treatment

requirements. In the process, both the NRC

staff and industry should be able to better

focus their resources on regulatory issues of

greater safety significance. This framework

should improve regulatory effectiveness and

efficiency, and contribute to enhanced plant

safety. To accomplish this goal, it is

necessary to amend the governing

regulations. The current regulations use

terms such as "safety-related," "important to

safety," and "basic component" to identify

the groups of SSCs and associated activities

that require "special treatment." This

rulemaking will build into the regulations an

alternative that offers licensees the

flexibility of utilizing a risk-informed

process to evaluate the need for special

treatment.

This risk-informed process will ensure that

risk insights will be used in a manner that

complements the NRC's traditional

deterministic approach. The risk-informed

approach will be consistent with the

defense-in-depth philosophy, will maintain
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-26 NUREG/CR-6042 Rev. 2

sufficient safety margins, will ensure that

any increase in core damage frequency or

risk is small and consistent with the safety

goal policy statement, and will include a

performance measurement strategy. The

risk-informed framework will also be aligned

to the NRC Reactor Inspection Oversight

process by incorporating the cornerstones

from the reactor safety and radiation

protection safety areas into the SSC

categorization process.

A graphical depiction of the changes that are

expected to result from a risk-informed

re-categorization of SSCs is illustrated in

Figure 2.6-2. The figure is only intended to

provide a conceptual understanding of the

new SSC categorization process. The staff's

thinking is continuing to evolve on this

matter. The figure depicts the current

safety-related versus nonsafety-related SSC

categorization scheme with an overlay of the

new risk-informed categorization. The

risk-informed categorization would group

SSCs into one of the four boxes in Figure

2.6-5.

Box 1 of Figure 2.6-2 contains safety-related

SSCs that a risk-informed categorization

p r o c e s s c o n c l u d e s a r e s i gn i f i c a n t

contributors to plant safety. These SSCs are

termed risk-informed safety class 1 (RISC-1)

SSCs. SSCs in this box would continue to be

subject to the current special treatment

requirements. In addition, it is possible that

some of these SSCs may have additional

requirements concerning reliability and

availability, if attributes which cause an SSC

to be safety significant are not sufficiently

controlled by current special treatment

requirements. However, the staff is not

currently aware of any examples of this

situation.

Box 2 depicts the SSCs that are

nonsafety-related, and that the risk-informed

categorization concludes make a significant

contribution to plant safety. These SSCs are

termed RISC-2 SSCs. Examples of RISC-2

SSCs could include the station blackout

emergency diesel, startup feedwater pumps,

or SSCs that function for pressurized water

reactor (PWR) "feed and bleed" capability.

For RISC-2 SSCs, there will probably need

to be requirements to maintain the reliability

and availability of the SSCs consistent with

the probabilistic risk assessment (PRA). As

discussed below, it is currently envisioned

that 10 CFR 50.69 (i.e., the new rule) would

contain the regulatory treatment requirement

for RISC-1 and RISC-2 SSCs regarding the

reliability and availability of these SSCs.

Box 3 depicts the currently safety-related

SSCs that a risk-informed categorization

process determines are not significant

contributors to plant safety. These SSCs are

termed RISC-3 SSCs. The rulemaking would

revise Part 50 to contain alternative

requirements (per §50.69) such that RISC-3

SSCs would no longer be subject to the

current special treatment requirements. For

RISC-3 SSCs, it is not the intent of this

rulemaking to allow such SSCs to be

removed from the facility, or to have their

functional capability lost. Instead, the

RISC-3 SSCs will need to receive sufficient

regulatory treatment such that these SSCs are

still ex pected to meet functional

requirements, albeit at a reduced level of

assurance. The staff may determine that this

level of assurance can be provided by

licensee's commercial grade programs. As

discussed below, it is currently envisioned

that §50.69 would contain the regulatory

treatment requirements for RISC-3 SSCs.

Box 4 depicts SSCs that are non

safety-related and continue to be categorized

as not being significant contributors to plant

safety. These SSCs are out of scope of both

current special treatment and any future
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-27 NUREG/CR-6042 Rev. 2

regulatory controls of §50.69. The functional

performance of these SSCs is controlled

under the licensee's commercial grade

program (no change from the current

requirements).

Debate is ongoing about the implementation

of this approach. Most of the concern

revolves around Box 3 and the degree of

regulation needed for these SSCs.

There are literally thousands of SSCs that

may fall into Box 3 at a given plant;

therefore, the stakes are high. South Texas

has submitted an exemption request that is

similar in nature to what Option 2 would

allow. It does not follow exactly the same

process, however, and is based on a licensee

PRA that is better than the industry average.

Option 3

In SECY-98-300, the staff delineated the

following broad objectives for its work to

risk-inform 10 CFR Part 50:

• Enhance safety by focusing NRC and

licensee resources in areas commensurate

with their importance to health and

safety,

• Provide NRC with the framework to use

to risk information to take action in

reactor regulatory matters, and

• Allow use of risk information to provide

flexibility in plant operation and design,

which can result in burden reduction

without compromising safety.

SECY 00-1987describes staff progress on

more comprehensive changes to 10CFR50.

A framework for guiding these changes has

been developed and is presented below,

although it continues to evolve.

Option 3 Framework Overview

Figure 2.6-4 illustrates the key elements of

the framework. The primary goal is to

protect the public health and safety. The

framework constitutes a risk-informed,

defense-in-depth approach. It will be used

by the NRC staff to analyze the effectiveness

of existing regulations in supporting the

primary goal. When the staff determines

that the effectiveness of an existing

regulation can be improved, an alternative

risk-informed regulation, which is consistent

with the framework, is formulated and

recommended to the Commission.

As indicated in Figure 2.6-4, this approach is

consistent with cornerstones of safe nuclear

power plant operations, which were

identified in the NRC Reactor Inspection and

Oversight Program. Specific strategies and

related elements of the framework are used

to implement the cornerstones as discussed

below along with quantitative guidelines for

implementation.

Defense-in-Depth Approach

The term defense-in-depth is used to

describe applications of multiple measures to

prevent or mitigate accidents. The measures

can be embodied in SSCs or in procedures

(including emergency plans). Defense-indepth can be applied in various ways.

Redundant or diverse means may be used to

accomplish a function, the classic example

being the use of multiple barriers (fuel,

cladding, reactor coolant pressure boundary,

s p r a y o r s c r u b b i n g s ys t e m s , a n d

containment) to limit the release of core

radionuclides. Alternatively, redundant or

diverse functional lines of defense may be

used to accomplish a goal.

To illustrate, consider the primary goal of

protecting the public from nuclear power

plant accidents. As indicated in Figure
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-28 NUREG/CR-6042 Rev. 2

2.6-4, the first line of defense is to eliminate

initiators that could conceivably lead to core

damage. However, it is not possible to

eliminate all initiators. The frequency of

initiators, although significantly less than

before the accident at Three Mile Island Unit

2 (TMI-2), is about 1 per plant year. As a

second line of defense, systems such as the

Emergency Core Cooling System (ECCS) are

provided to prevent core damage should

postulated initiators occur. Although such

systems are designed for a wide spectrum of

initiators and compounding equipment

failures, no prevention system is perfect. As

a third line of defense, barriers including

containment and associated heat and fission

product removal systems are required. These

barriers would prevent large radionuclide

releases for many severe accidents, but

scenarios exist in which containment would

be breached or bypassed. A fourth line of

defense, offsite emergency preparedness, is

therefore required.

Defense-in-depth has evolved since the first

research reactors were designed in the 1940s.

The approach adopted herein requires

accident prevention and mitigation strategies

and supporting elements. Probabilistic

insights are used in implementing the

required strategies and elements. The

approach used in Option 3 is summarized in

the following working definition:

Defense-in-depth is the approach taken to

protect the public by applying the following

strategies in a risk-informed manner:

1. limit the frequency of accident initiating

events

2. limit the probability of core damage

given accident initiation

3. limit radionuclide releases during core

damage accidents

4. limit public health effects due to core

damage accident

The strategies consider the following

defense-in-depth elements:

• reasonable balance is provided among the

strategies (as shown in Figure 2.6-7).

• over-reliance on programmatic activities

to compensate for weaknesses in plant

design is avoided.

• independence of barriers is not degraded.

• safety function success probabilities

commensurate with accident frequencies,

consequences, and uncertainties are

achieved via appropriate:

- redundancy, independence, and

diversity,

- defenses against common cause failure

mechanisms,

- defenses against human errors, and

- safety margins

• the defense-in-depth objectives of the

current General Design Criteria (GDCs)

in Appendix A to 10 CFR 50 are

maintained.

The four strategies emphasizes defense

against core damage accidents, which

dominate the risk to public health and safety

posed by existing plants. Quantitative

guidelines are developed to characterize a

reasonable balance among the preventive and

mitigative strategies. For risk significant

accidents in which one or more of the four

strategies are precluded (e.g., containment

bypass accidents), the remaining strategies

may be more tightly regulated; that is,

regulations should provide a very high

confidence in the remaining strategies.

Similarly, more stringent requirements may

be imposed in the presence of large
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-29 NUREG/CR-6042 Rev. 2

uncertainties regarding the effectiveness of

one of the strategies.

Cornerstones and Strategies

The cornerstones for safe nuclear power

plant operation were discussed in Section

2.6-3. The four reactor safety cornerstones

are directly addressed in PRAs and are,

therefore, most relevant to the initial Option

3 efforts. As illustrated in Figure 2.6-4, the

four reactor safety cornerstones are reflected

in the framework by the four defense-indepth strategies. The strategies seek both to

prevent core damage accidents and to

mitigate the public impact should a core

damage accident occur. The two preventive

strategies are:

• limit the frequency of accident initiating

events (initiators), and

• limit the probability of core damage

given accident initiation.

The two mitigative strategies are:

• limit radionuclide releases during core

damage accidents, and

• limit public health effects due to core

damage accidents.

Except for the implied emphasis on core

damage accidents, Strategy 1 is identical to

Reactor Safety Cornerstone 1. Similarly, for

core damage accidents, Strategy 4 is

equivalent to Reactor Safety Cornerstone 4,

and Strategies 2 and 3 are functionally

equivalent to Reactor Safety Cornerstones 2

and 3.

The four defense-in-depth strategies are

intentionally more focused than the reactor

safety cornerstones. The cornerstones also

apply to accidents that can not lead to core

damage (for example fuel-handling, fuelstorage, and radwaste storage tank rupture

accidents). The strategy statements may in

the future be modified to address non-coredamage accidents; however, emphasis on

core damage accidents is appropriate for the

initial efforts to risk-inform existing

regulatory requirements.

In describing the cornerstones and strategies,

thewords“limit,”“prevent,”and“contain”

are relative rather than absolute. Cutting a

failure rate in half "prevents" half the

failures that would otherwise occur in a

given time period, and some fixes last for

the life of a plant. However, it is not

possible to prevent all accident initiators or

to eliminate the possibility of core damage

or containment failure for all conceivable

accidents. All four strategies are applied to

compensate for the limitations of the

individual strategies; issues related to PRA

scope, level of detail, and technical

adequacy; and uncertainty, in particular

completeness uncertainty.

Other Framework Elements

As indicated in Figure 2.6-4, other elements

are applied to support the cornerstones and

related strategies. These elements are

referred to as tactics to distinguish them

from the four defense-in-depth strategies.

Existing regulatory requirements apply a

wide variety of tactics. Some tactics such as

quality assurance are broadly applicable to

all four strategies. Safety margin is often

applied to provide a high degree of

confidence that a design or process will

provide a needed function. Other tactics

may only be applicable to specific strategies

or accident types. The primary

responsibility for implementing tactics,

whether required by regulations or not,

resides with the licensee.

Quantitative Guidelines for the Framework

Quantitative guidelines for the preventive

and mitigative defense-in-depth strategies are
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-30 NUREG/CR-6042 Rev. 2

applied by the NRC staff to assess the

effectiveness of existing regulations, to

formulate and compare risk-informed options

to existing regulatory requirements, and to

d e v e l o p r i s k - i n f o r m e d a l t e r n a t i v e

regulations. In the context of integrated

decisionmaking, the acceptance guidelines

should not be interpreted as being overly

prescriptive. The quantitative guidelines are

not proposed regulatory requirements. They

reflect a desired level of safety against

which to compare industry-averaged risk

measures; a level that is "safe enough" based

on theCommission’sSafetyGoalPolicy

Statement while providing reasonable

balance among the defense-in-depth

strategies.

The starting point for developing

quantitative guidelines is the Quantitative

Health Objectives (QHOs), which were

originally setto asa measure of“safe

enough.”

Unfortunately, the QHOs are difficult to

apply in making risk-informed changes to

the existing regulations. PRAs often do not

proceed to Level 3, that is, to the

quantification of public health risks and even

if they did, their calculation is dependent

upon many factoroutside the licensee’s

control (e.g., population density).

In addition, simply replacing existing

regulations with the QHOs would not be

risk-informed. It would not assure

reasonably balanced defense-in-depth

approach. To illustrate, consider the

following example. Even at a densely

populated U.S. site, if a plant's core damage

frequency is 10-4 per year or less, the latent

cancer QHO is generally met with no credit

taken for containment. The early fatality

QHO is more restrictive than the latent

cancerQHO.Ifaplant’slarge early release

frequency is 10-5/yr or less, the early fatality

QHO is generally met. Conceivably, both

QHOscouldbemetbyreducingaplant’s

CDF to 10-5/yr or less with no containment

and no preplanned offsite protection actions.

This would not constitute a risk-informed

approach.

What is required for a risk-informed

approach are quantitative measures and

guidelines that can be used to describe and

indicate the effectiveness of the defense-indepth strategies. The measures and

guidelines proposed for this purpose are

summarized in Figure 2.6-7.

Two methods of quantitatively assessing the

level of protection against accidents at a

given nuclear power plant are also depicted

in Figure 2.6-7:

• a prevention-mitigation assessment

considers the strategies in pairs,

• an initiator-defense assessment considers

the strategies individually.

In the context of these two assessment

methods, mean risk measures quantified in

full-scope, plant-specific PRAs would ideally

be compared to the quantitative guidelines.

Full scope PRAs address internal and

external initiating events as well as accidents

initiated in all operating modes. The

frequencies in Figure 2.6-7 are, accordingly,

stated per calender year rather than per year

of reactor operation.

Details regarding the use of Figure 2.6-7 and

the Option 3 framework are still being

worked out. 10 CFR 44 (hydrogen rule)

and10 CFR 50.46 (ECCS Rule) are currently

being evaluated by the staff for riskinformed changes. It is unlikely that

licensees will see dramatic changes in these

and other regulations as a result of the

Option 3 efforts. The treatment of defensein depth and PRA uncertainties are among

the issues leading the staff to move rather

slowly in these areas.
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-31 NUREG/CR-6042 Rev. 2

PRA quality is another issue that is being

debated. While the IPEs and IPEEs appear

to have successfully met their intended

purpose, they are very uneven in quality and

scope. It is extremely unfortunate that the

NRC did not provide better guidance to the

industry in the 1980s regarding the

preparation of the IPEs and IPEEEs so that

they would be more useful in the context of

risk-informed regulation. Over the next few

years many important decisions regarding the

implementation of risk-informed regulation

are expected and the reader should stay

tuned. In any case it is clear that regulatory

thought processes within the NRC have

profoundly changed over the last ten years.
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-32 NUREG/CR-6042 Rev. 2

Table 2.6-1 Thresholds for Performance Bands

Cornerstone Indicator Thresholds

Increased

Regulatory

Response Band

(green/white)

Required

Regulatory

Response Band

(white/yellow)

Unacceptable

Performance

Band

(yellow/red)

Initiating Events Unplanned scrams per 7000

critical hours

Risk-significant scrams per 3

years

Transients per 7000 critical

hours

>3

>4

>8

>6

>10

N/A

>25

>20

N/A

Mitigating

Systems

Safety System unavailability

HPCI and RCIC

HPCS

Emergency Power

RHR

AFW

HPSI

Safety System Failures previous

4 quarters

>0.04

>0.015

>0.025

>0.015

>0.02

>0.015

>5

>0.12

>0.04

>0.05*

>0.05

>0.06

>0.05

N/A

>0.5

>0.2

>0.1**

>0.12

N/A

Barrier Integrity Reactor Coolant System

specific activity

Reactor Coolant System

leakage

Containment Leakage

>50% TS

limit

>50% TS

limit

>100% LA

>100% TS

limit

>100% TS

limit

N/A

N/A

N/A

N/A

Emergency

Preparedness

Emergency Response

Organization drill/exercise

performance

percentage of Emergency

Response Organization shift

crews that have participated in

a drill or exercise in the past

24 months

percentage of time Alert and

Notification System available

<75% prior 6

months;

<90% prior 2

years

<80% prior 2

years:

<70% prior 3

years

<94% per

year

<55% prior 6

months;

<70% prior 2

years

<60% prior 2

years:

<70% prior 3

years

<90% per

year

N/A

N/A

N/A

*for plants with more than 2 diesel generators threshold is >0.1

**for plants with more than 2 diesel generators threshold is >0.2
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-33 NUREG/CR-6042 Rev. 2

Table 2.6-1 Thresholds for performance bands (cont.)

Cornerstone Indicator Thresholds

Public Radiation

Safety

Reportable effluent events >6 in 3 years

or >3 in one

year

>13 in 3 years

or >7 in 1 year

N/A

Occupation

Radiation Safety

number of non-compliances

with 10 CFR 20 requirements

for (1) high (>1 rem/hr) and

(2) very high radiation areas,

and uncontrolled personnel

exposures exceeding 10% of

the stochastic or 2% of the

non-stochastic limits

>5

occurrences in

3 years of >2

occurrences in

1 year

>11

occurrences in

3 years or >5

occurrences in

1 year

N/A

Safeguards availability of security

equipment

Vital Area security equipment

availability

Personnel screening process

performance

<95% per year

<95% per year

>2 reportable

events

<85% per year

<85% per year

>6 reportable

events

N/A

N/A

N/A

* for plants with more than 2 diesel generators threshold is >0.1

** for plants with more than 2 diesel generators threshold is >0.2
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-34 NUREG/CR-6042 Rev. 2

Table 2.6-2 Inspectible Areas Associated with Each Cornerstone of

Reactor Safety

Cornerstone Inspectible Areas Type

Initiating Events Adverse weather preparations

Equipment alignment

Emergent work

Fire protection

Flood protection measures

Heat sink performance

Identification and resolution of problems

In-service inspection activities

Maintenance rule implementation

Maintenance work prioritization/control

Non-routine plant evolutions

Piping system erosion and corrosion

Refueling and outage activities

complementary

supplementary

complementary

complementary

complementary

complementary

complementary

complementary

supplementary

supplementary

supplementary

complementary

complementary

Mitigating

Systems

Adverse weather preparations

Changes to license conditions and SAR

Emergent work

Equipment alignment

Fire protection

Flood protection measures

Heat sink performance

Identification and resolution of problems

In-service testing of pumps and valves

Licensed operator requalification

Maintenance rule implementation

Maintenance work prioritization/control

Non-routine plant evolutions

Operability evaluations

Operator workloads

Permanent plant modification

Post maintenance testing

Refueling and outage activities

Safety system design and performance

Surveillance testing

Temporary plant modifications

complementary

complementary

complementary

supplementary

complementary

complementary

complementary

complementary

complementary

complementary

supplementary

supplementary

supplementary

complementary

complementary

complementary

supplementary

complementary

complementary

supplementary

complementary
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-35 NUREG/CR-6042 Rev. 2

Table 2.6-2 Inspectible Areas Associated with Each Cornerstone of

Reactor Safety (Cont.)

Cornerstone Inspectible Area Type

Barrier Integrity Changes to license conditions and SAR

Equipment alignment

Fuel barrier performance

Identification and resolution of problems

In-service inspection activities

Containment leak rate and isolation valve

Licensed operator requalification

Maintenance rule implementation

Maintenance work prioritization

Non-routine plant evolutions

Permanent plant modifications

Refueling and outage activities

Surveillance testing

Temporary plant modifications

complementary

supplementary

verification

complementary

complementary

verification

complementary

supplementary

supplementary

supplementary

complementary

complementary

supplementary

complementary

Emergency

Preparedness

Alert and notification system testing

Drill and exercise inspection

Emergency action level changes

Emergency response organization testing

Training program

Identification and resolution of problems

verification

verification

complementary

complementary

verification

complementary

Public Radiation

Exposure

Gaseous and liquid effluent treatment

systems

Identification and resolution of problems

Radioactive material processing and

shipping

Environmental monitoring program

supplementary

complementary

complementary

complementary

Occupational

Radiation Exposure

Access control to radiologically

significant areas

ALARA planning and controls

Identification and resolution of problems

Radiation monitoring instrumentation

Radiation worker performance

supplementary

complementary

complementary

complementary

complementary
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-36 NUREG/CR-6042 Rev. 2

Table 2.6-2 Inspectible Areas Associated with Each Cornerstone of

Reactor Safety (cont.)

Cornerstone Inspectible Area Type

Safeguard

Access authorization

Access control

Changes to license conditions and SAR

Identification and resolution of problems

Physical protection system

Response to contingency events

supplementary

complementary

complementary

complementary

verification

complementary
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-37 NUREG/CR-6042 Rev. 2

Table 2.6-3. NRC Action Matrix

RESULTS Cornerstones fully

met; all inputs are

green

One or two inputs

white in different

cornerstones

One degraded

cornerstone

Repetitive

degraded

Cornerstones or

Multiple degraded

cornerstones

Overall

unacceptable

performance

RESPONSE Regulatory

Conference

Routine Senior

Resident Inspector

interaction

Branch Chief or

Division Director

meets with

Licensee

Division Director

or Regional

Administrator

Meet with

Licensee

EDO or

Commission Meet

with Senior

Licensee

Management

Commission

meeting with

Senior Licensee

Management

Licensee

Action

Licensee

Corrective Action

Program

Licensee

Corrective Action

Program with

NRC Oversight

Licensee Self

Assessment with

NRC Oversight

Licensee

Performance

Improvement Plan

with NRC

Oversight

NRC

Inspection

Risk Informed

Base line

Inspection

Program

Baseline and

Inspection Followup

Baseline and

inspection focused

on cause of

degradation

Baseline and

Team Inspection

focused on cause

of degradation

Regulatory

Action

none Document

response to

degrading area in

inspection report

Docket response

to degrading

condition

10CFR2.20404

DFI

10CFR 50.54(f)

letter

Confirmatory

action letter/order

Order to modify,

suspend or revoke

licensed activities
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-38 NUREG/CR-6042 Rev. 2

Table 2.6-3. NRC Action Matrix (Cont.)

COMMUNICATION Assessment

Report

Division director

reviews and signs

assessment report

with inspection

plan

Division Director

review and signs

assessment report

with inspection

plan

Regional

Administrator

reviews and signs

assessment report

with inspection

plan

Regional

Administrator

reviews and signs

assessment report

Commission

informed

Public

Assessment

Report

Senior Resident

Inspector or

Branch Chief

meets with

licensee

Branch Chief or

Division Director

meets with

licensee

Regional

Administrator

discusses

performance with

licensee

Executive Director

of Operations or

Commission

discuss

performance with

senior licensee

management

Commission

meeting with

senior licensee

management
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-39 NUREG/CR-6042 Rev. 2

Table 2.6-4 Examples Illustrating the Concept of Maintenance

Preventable Functional Failures

Maintenance Preventable Functional Failures:

• Failures due to the implementation of incorrect maintenance procedures

• Failures due to incorrect implementation of correct maintenance procedures

• Failures due to incorrect implementation of maintenance performed with procedures and considered within

the skill of the craft

• Failures of the same kind occurring at a utility that have occurred in industry that could have been precluded

by an appropriate and timely maintenance activity

• Failures that occur due to the failure to perform maintenance activities that are normal and appropriate to

the equipment function and importance such as failure to lubricate with appropriate material or the failure

to rotate equipment that is in a standby mode for long periods.

Not Maintenance Preventable Functional Failures:

• Initial failures due to original equipment manufacturer design

• Initialfailuresduetodesigninadequaciesinselectingorapplyingcommercialor‘off-the-shelf”equipment

• Initial failures due to inherent material defects

• Failures due to operational errors

• Failures due to external events

• Intentional runs to failure

• Recurrence of a failure during post maintenance testing but before returning the system to service.
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-40 NUREG/CR-6042 Rev. 2

SSCs that are

withinthescopeof

theMaintenanceRule

Systems, structures,

andcomponents not

withinscopeof the

MaintenanceRule

Continueapplicable

maintenance

programs onthese

SSCs

AreSSCs

safety

related?

Arenonsafetyrelated

SSCs in

EOPs?

DononsafetyrelatedSSCs

mitigate

accident/

transient?

DononsafetyrelatedSSCs

prevent SR

SSCfulfilling

function?

Do

nonsafety-related

SSCs scram

or actuateSRS?

Plant (SSCs)

No No No

Yes Yes Yes Yes Yes

No No

FigureX.X-XXXXXX

Figure 2.6-1 Decision tree for the categorization of structures, systems

and components for the purposes of the Maintenance

Rule.
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-41 NUREG/CR-6042 Rev. 2

Establish risk significant criteria

and risk significant performance

criteria

Establish, monitor, and

upgrade (periodically) plant

level performance criteria

SSCs in preventive

maintenance and

condition monitoring

program

Perform appropriate

maintenace on SSCs

Perform root cause

analysis, determine cause

of failure, and take

corrective action.

Perform root cause analysis,

determine cause of failure,

and take corrective action

Monitor Performance to

goal

Establish goals

Perform root cause analysis,

determine cause of failure,

and take corrective action

Are

SSCs risk

significant?

Is

SSC level goal

required?

Is

SSC level goal

required?

Is goal met?

Is

performance

acceptable?

Yes

Yes No

Yes

No

No

No

Yes

Yes

No

Is

performance

acceptable?

Is an

SSC level goal

required?

Yes

No

Yes

Figure X.X. XXXXXXXXXXXx

Figure 2.6-2. Decision tree for the categorization of structures, systems

and components for the purposes of the Maintenance Rule
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-42 NUREG/CR-6042 Rev. 2

Figure 2.6-3 Integrated decision process for risk-informed

regulation

Figure 2.6-4 Elements of risk-informed process
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-43 NUREG/CR-6042 Rev. 2

Figure 2.6-5 CDF acceptance guidelines

Figure 2.6-6 LERF acceptance guidelines
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-44 NUREG/CR-6042 Rev. 2

Insert Figure 2.6-5 here.

(now Figure 2.6-7)
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-45 NUREG/CR-6042 Rev. 2

Figure 2.6-9 Quantitative guidelines for riskinformed framework

Figure 2.6-8 Elements of risk-informed framework
Reactor Safety Course (R-800) 2.6 Risk-Informed Regulation

USNRC Technical Training Center 2.6-46 NUREG/CR-6042 Rev. 2

1. U.S. Nuclear Regulatory Commission, PRA

WorkingGroup,“AReviewofNRCStaff

Uses of Probabilistic Risk Assessment,

“NUREG-1489,March1994.

2. U.S. Nuclear Regulatory Commission,

“UseofProbabilisticRiskAssessment

Methods in Nuclear Regulatory Activities;

FinalPolicyStatement,”Federal Register,

60FR42622, August 16, 1995.

3. U.S. Nuclear Regulatory Commission,

“AnApproachforUsingProbabilistic

Risk Assessment in Risk-Informed

Decisions on Plant-Specific Changes to the

LicensingBasis,”RegulatoryGuide1.174.

4. USNRC, Statement of Considerations,

“TechnicalSpecificationsforFacility

Licensees;SafetyAnalysisReports,”

Federal Register, 33 FR 18612, December

17, 1968.

5. USNRC,“FinalPolicyStatementon

Technical Specifications Improvements

forNuclearPowerReactors,”Federal

Register, 58 FR 39132, July 22, 1993.

6. USNRC,10CFR50.36,“Technical

Specifications,”Federal Register, 60

FR 36953, July 19, 1995.

7. Letter from William D. Travers, Executive

Director for Operations, to The Commissioners, dated September 14, 2000.

References for Section 2.6
Reactor Safety Course (R-800) 3.0 Accident Progression In The Reactor Vessel

USNRC Technical Training Center 3.0-1 NUREG/CR-6042 Rev. 2

3.0 Accident Progression In The

Reactor Vessel

3.0.1 Introduction

Given an accident sequence that leads to

sustained uncovering of the core, the

progression of core damage involves

overheating of fuel; exothermic oxidation of

the cladding with accompanying production

of high temperature hydrogen gas; distortion

and breach of the fuel cladding; melting of

the cladding; fuel liquefaction; downward

relocation of core materials; interactions

between molten fuel and residual water in

the reactor vessel; and breach of the reactor

vessel accompanied by the discharge of

molten core materials to the containment.

In-vessel processes are important for a

number of reasons. The temperatures

attained by fuel, cladding, and other core

materials determine the releases of

radionuclides from the fuel. The

temperature and flow patterns of hot

radioactive gases determine the potential for

trapping and retention of radionuclides on

surfaces within the reactor coolant system.

Hydrogen gas produced in-vessel can escape

to containment, where its combustion can

pressurize and heat the containment.

In-vessel processes determine the likelihood

of arresting core degradation and

radionuclide releases from fuel upon

restoration of coolant. The melting and

relocation of core materials in the reactor

vessel, if unarrested by the restoration of

coolant, can cause failure of the reactor

vessel resulting in the discharge of hot core

debris, radionuclides, and aerosols into

containment, where they may interact with

the containment atmosphere, water, and/or

concrete. The characteristics of these

discharges strongly affect the likelihood and

timing of various containment failure modes

and the magnitudes of radionuclide releases

to the environment should containment fail.

3.0.2 Learning Objectives

At the end of this chapter, the student should

be able to:

1. List three energy sources that would be

of concern in a severe accident.

2. Identify three conditions that must be

achieved to arrest a severe accident.

3. Characterize the time intervals in which

the following events would be expected

in severe accidents involving complete

failure of cooling water flow to the core.

a. Core uncovering.

b. Onset of zirconium oxidation

c. Core relocation

d. In-vessel molten-core-coolant interaction

e. Failure of the lower head of the

reactor pressure vessel

4. Indicate, for each pair of accident types

below, the one that would proceed faster

and explain why.

a. Large LOCA versus small LOCA

b. PWR transient versus comparable

BWR transient

c. Accident initiated at power versus

one initiated at shutdown.

5. Explain what is meant by alpha-mode

containment failure and indicate the

currently perceived likelihood of such an

event.

6. List at least one concern regarding the

restoration of cooling water when molten

core material is present in-vessel.
Reactor Safety Course (R-800) 3.0 Accident Progression In The Reactor Vessel

USNRC Technical Training Center 3.0-2 NUREG/CR-6042 Rev. 2

7. Describe the possible modes of bottom

head failure and melt release to

containment.
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-1 NUREG/CR-6042 Rev. 2

3.1 Introduction

3.1.1 In-Vessel Accident Stages

This chapter discusses in-vessel processes

that strongly influence the severity and

consequences of severe accidents. For the

purpose of this discussion, in-vessel

accident progression is divided into six

successive stages, which commence with:

1. The initiating event and failures leading

to inadequate core cooling.

2. The onse t of sustained core

uncovering, which leads to core heatup.

3. The onset of exothermic oxidation of

cladding by steam, resulting in

hydrogen production, cladding failure,

and the release of gaseous fission

products from the fuel-cladding gap.

4. The onset of clad melting and fuel

liquefaction, which result in more

substantial releases of radionuclides

from the fuel.

5. Flow of molten material into the lower

plenum of the reactor vessel, which

may contain residual reactor coolant.

6. Failure of the reactor vessel lower head

with consequent discharge of hot core

debris into containment.

Each stage begins with a spec ific event

and, as indicated in Table 3.1-1, gives

rise to new processes, which can

significantly alter the progression of the

accident. The processes initiated in

previous stages generally continue, so each

stage is more complicated than its

predecessor. The processes and factors

determining their timing and impacts are

introduced below and discussed by stage

in Sections 3.2 through 3.6.

3.1.2 Severe Accidents Conditions

Over the years, computer code calculations

have been extremely useful for forming and

reinforcing engineering judgment regarding

the progression of severe accidents;

however, care must be taken in using and

interpreting severe accident cod e

calculations. It is not practical to perform

the wide variety of experiments that would

be required for complete validation of

severe accident codes. Even given the

years of severe accident research that

followed the 1979 accident at Three Mile

Island Unit 2, no computer code can

calculate all major aspec ts of the accident.

Several factors contribute to the difficulty

in modeling the in-vessel progression of

severe accidents. As indicated in Table

3.1-2, an extremely broad spectrum of

accident conditions may be encountered in

such accidents. In addition, the behavior

of a wide variety of materials at elevated

tempera tures must be modeled. Figures

3.1-2 and 3.1-3 illustrate the wide range

of melt and boiling temperatures for

elemen ts, alloys, fuel, and fission

products. Figure 3.1-4 indicates the

chemical interactions and liquid phases

that can form in LWR cores with

increasing tempera ture.1 Finally, chemical

reactions, phase changes, and movement

of both particulate and molten debris

w o uld signif i can tly change t h e

configuration of core materials during a

severe accident. As a result, modeling

uncertainties tend to increase as the

accident progresses.

Accordingly, rather than display a plethora

of code calculations, a general discussion
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-2 NUREG/CR-6042 Rev. 2

of in-vessel processes and their potential

implications is presented in this Chapter.

3.1.3 Factors Influencing Timing

In spite of uncertainties encountered in

modeling severe accidents, some factors

are known to have a strong influence on

the timing of successive stages. These

factors include a) the initiating and failure

events that lead to core uncovering, b) the

amount and timing of any coolant injection

into the core region, and c) the pressure

history within the reactor coolant system.

It should be evident from the variety of

potential core damage accidents discussed

in Chapter 2 that Stage 1, accident

initiation, has an extremely wide range of

durations. In a large-break loss-of-coolant

accident, reactor coolant blowdown and

pressure reduction occur very rapidly, and,

if emergency core cooling systems fail on

demand, Stage 1 has a very short

duration. On the other hand, in many

postulated accidents, the failure of coolant

injection may take hours. For example,

consider the BWR loss of suppression

pool cooling accident first identified in the

Reactor Safety Study. In this accident,

the core is suc ces sfully cooled for

ap pro xim ate ly a full d a y befor e

suppres sion pool h e atin g cause s

overpr essuriza ti o n and failure o f

containment, which, in turn, results in

suppression pool flashing and failure of

core cooling systems.

A longer accident initiation stage is

des irable because it provides more time

for recovery actions that cou ld prevent or

arrest core damage. A longer accident

initiation stage also results in a significant

decreases in decay heat, so that, when

core heatup begins, it occurs at a slower

rate. As indicated in Figure 1.4-1, decay

heat represents approximately 7% of

operating core power but decreases

rapidly after shutdown, reaching about 1%

of operating core power at 24 hours.

Even limited amounts of coolant can have

a significant impact on severe accident

progression. For accidents involving

boiloff (not rapid blowdown), injection

flow of only a few hundred gallo ns of

water per min ute may suffice to keep the

core of a 3300 MWt plant covered.2 In

BWRs, residual water in the reactor vessel

can be used to steam cool the core for a

brief period of time (Section 3.7.2.2).

Finally, if coolant injection capability is

recovered after the onset of core damage,

it may be possible to arrest the damage

within the reactor vessel and prevent the

discharge of molten core debris to

containment. Reflooding during a severe

accident is discussed further in Section

3.1.5.

Accidents generally proceed faster at

higher pressures because less energy is

required to evaporate a given mass of

reactor coolant. The discussions of invessel stages in Sections 3.2 through 3.6

generally focus on high-pressure PWR

accidents, but the impact of lower

pressures and the pote ntia l fo r

tempera ture-induced failures of the reactor

coolant system pressure bounda ry are

specifically considered. The discussions

generally presume that reactor shutdown

(scram) suc ces sfully terminates the fission

process, so that decay heat drives the

core-damage process. Proce sse s

discussed in the context of pressurized,

decay-heat driven PWR accidents would

also occur in depressurized, ATWS, and

BWR accidents; however, their timing and
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-3 NUREG/CR-6042 Rev. 2

impacts cou ld be significantly different.

The in-vessel progression of BWR

accidents is specifically discussed in

Section 3.7.

Table 3.1-1 and Figure 3.1-4 indicate

tempera ture inte rva ls and processes

associated with the successive in-vessel

accident stages. Ranges of the stage

durations are also indicated for PWR

accidents in which early failure of coolant

injection causes the onset of sustained

core uncovering (Stage 2) to occur within

about two hours of reactor shutdown.

The indicated stage durations provide a

baseline for the discussions of in-vessel

processes in Sections 3.2 through 3.6. If

there is partial injection of core coolant

(as there was at TMI-2) or if the core

uncovering is delayed for many hours

(allowing decay power to decrease) the

accident stages can take significantly

longer than indicated in Table 3.1-1 and

Figure 3.1-4. BWR accidents tend to

progress more slowly than corresponding

PWR accidents due to a number of factors

including lower pressure, smaller core

power density, and larger masses of water

and structural materials below the active

core region.

3.1.4 Review of Selected Design

Features

The student is presumed to be familiar

with the general design features of both

BWRs and PWRs. The purpose of this

subsection is to review, with the aid of

figures, design featu res th at can

sign ifica ntly influence the in-vessel

progression o f severe acc i dents ,

particularly features that differ markedly

between BWRs (Figures 3.1-5 to 3.1-7)

and PWRs (Figures 3.1-8 to 3.1-11).

As shown in Figure 3.1-5, BWRs have

massive steam separators and dryers

above the core region. This is not the

case for PWRs in which the reactor

coolant is subcooled during normal

operation and steam is produced in the

steam generators (Figure 3.1-8).

BWR fuel assemblies have outer Zircaloy

flow channe ls (Figure 3.1-6) that prevent

coolant flow between assemblies. PWR

fuel assemblies, on the other hand, have

no surrounding flow channels, so there is

coolant mixing between assemblies (Figure

3.1-9).

BWRs have cruciform control blades

(Figure 3.1-7) that enter from the bottom

(Figure 3.1-5). PWRs have rod cluster

control assemblies (Figure 3.1-10) that

enter from the top (Figure 3.1-8). As a

result, BWRs have a forest of control rod

drives and guide tubes in the lower

plenums of their reactor vessels, whereas

PWRs have only secondary support

assemblies (Figure 3.1-9). Westinghouse

and Babcock & Wilcox plants also have

bottom-entry in-core instruments and

guide tubes (Figure 3.1-11).

BWRs opera te at about 1000 psa whereas

PWRs opera te at about 2000 psia (13.8

MPa). BWRs have larger pressure ves sels

to accommodate their steam separators

and dryers and their lower power densities

(51-56 versus 95-105 W/liter). Finally,

BWRs cores contain roughly three times

as much Zircaloy as comparable PWR

cores, mainly because of the fuel assembly

channel box walls. Special considerations

for BWR facilities under severe accident

conditions are discussed in Section 3.7.

3.1.5 Reflooding During Accident

Progression
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-4 NUREG/CR-6042 Rev. 2

The reintroduction of coolant into a

damaged core occurred at TMI-2, and is

likely in some postulated accidents, for

example, when lost electrical power is

restored. If water is reintroduced early

enough, the configuration of the fuel rods

would differ little from the original

geometry, and the tempera tures of the fuel

and cladding would be only slightly above

operating levels. Cooling of the core

under these conditions is reasonably

assured. In Sections 3.2 through 3.6,

each in-vessel stage o f acc id en t

progression is first discussed under the

presumption that adequate cooling is not

restored. The potential for arresting core

damage during each stage is then

discussed.

Core damage can only be terminated when

three conditions are satisfied:

1. Water must be continuously ava ilable

to the core or core debris in quantities

sufficient to quench the material and

remove decay heat and heat associated

with metal-water reactions.

2. The core or core debris configuration

must be coolable.

3. Means must be available for cooling

the water or condensing the steam

produced.

Figure 3.1-12 is a functional event tree

which shows the outcomes obtained by

meeting all three termination conditions at

various stages of core damage either in

the reactor vessel or in containment.3

Water cou ld be delivered in-vessel by

normal or emergency coolant supply

systems. Water cou ld be delivered

ex-vessel by containment sprays or by

normal or emergency coolant supply

systems with coolant entering the vessel

but flowing out of the opening in the lower

head into the reactor cavity. Possible heat

sinks include steam generators, the

suppression pool and suppression pool

cooling system, residual heat removal

systems, and containment heat removal

systems (fan coolers or spray recirculation

systems).

If a dequ ate coolant in jection i s

reestablished early enough to prevent

melting, the core geometry would still be

coolable and releases would be limited to

activity in the fuel-clad gap (Outcome 1).

To reestablish coolant injection and arrest

core damage in-vessel after the onset of

melting (Outcome 2), the resulting core

debris configura tion would still have to be

coolable, perhaps with some debris in the

lower head as at TMI-2. Coolability of

core debris discharged to containment

(Outcomes 3 and 6 in Figure 3.1-12) is

discussed in Chapter 4.

If some, but not all, of the necessary

termination conditions can be met, the

accident progression can be delayed. For

example, partial coolant injection flow can

be used to delay the onset of claddin g

oxidation. Similarly, if only a limited

amount of water can be supplied to a

coolable debris configuration, the accident

progression may be delayed until the water

supply is exhausted (Outcomes 5 and 8 in

Figure 3.1-12).
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-5 NUREG/CR-6042 Rev. 2

Table 3.1-1 In-vessel accident stages

Stage Starting Condition Description

PWR

Durations,

No-Injection*

Section

1 Accident Initiator Initiation 0-90 min 3.1

2 Core uncovering

begins

Core uncovering and

heatup

5-35 min 3.2

3 Hottest cladding

reaches 1832°F

(1273 K, 1000°C)

Cladding oxidation,

melting of structural

and control materials

5-10 min 3.3

4 Hottest cladding

reaches its melt

tempera ture, 3200°F

(2033 K, 1760°C)

Clad melting, fuel

liquefaction, holdup in

core region

10-30 min 3.4

5 Core materials first

enter lower plenum

Core slumping,

quenching, reheating

0-80 min 3.5 & 3.6

6 Vessel Breach Vessel breach and

materials discharge to

containment

-- 3.5, 3.6,

4.3, 4.4,

& 4.5

*Approximate duration ranges for PWR accidents with total failure of coolant injection
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-6 NUREG/CR-6042 Rev. 2

Table 3.1-2 Severe Accident Conditions

Pressure Range 15 - 2500 psia (0.1 - 17 MPa)

Decay Power Level 0.5- 5 %

Local Heatup Rates 1.3 - 18°F/s (0.7 - 10 K/s)

Steam Flow Rates 0 - 6,600 lbm/ft2/hr (0 - 9 kg/m2/s)

Maximum Midcore Steam Superheat > 3600°F (> 2273 K, 2000°C)

Maximum Fuel Temperature > 5180°F (> 3133 K, 2860°C)
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-7 NUREG/CR-6042 Rev. 2

Figure 3.1-1 Approximate temperatureand time envelopes for in-vessel severe

accident stages assuming no coolant injection during PWR core

heatup and degradation.
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-8 NUREG/CR-6042 Rev. 2

Figure 3.1-2 Melting points for metallic elements, reactor metals, and

compounds

Figure 3.1-3 Melting and boiling points for fission products.
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-9 NUREG/CR-6042 Rev. 2

Figure 3.1-4 Chemical interactions and formation of liquid phases in an

LWR fuel rod bundle with increasing temperature
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-10 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-11 NUREG/CR-6042 Rev. 2

F

ig

u

r

e

3.

1-

5 

S

c

h

e

m

at

ic

of

B

W

R

r

e

a

ct

o

r

v

es

se

l

in

ternal structure
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-12 NUREG/CR-6042 Rev. 2

Figure 3.1-6 BWR fuel assembly
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-13 NUREG/CR-6042 Rev. 2

Figure 3.1-7 BWR control rod
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-14 NUREG/CR-6042 Rev. 2

Figure 3.1-8 PWR reactor coolant system arrangement (B&W)
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-15 NUREG/CR-6042 Rev. 2

Figure 3.1-9 PWR reactor vessel internals (Westinghouse)
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-16 NUREG/CR-6042 Rev. 2

Figure 3.1-10 Cutaway view of typical rod cluster control assembly
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-17 NUREG/CR-6042 Rev. 2

Figure 3.1-11 Typical PWR arrangement for in-core instrumentation 

 (Westinghouse)
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-18 NUREG/CR-6042 Rev. 2

Figure 3.1-12 Core damage event tree
Reactor Safety Course (R-800) 3.1 Severe Accident Stages

USNRC Technical Training Center 3.1-19 NUREG/CR-6042 Rev. 2

References for Section 3.1

1. P. Hofman, S.J.L. Hagen, G. Schanz, and

A. Skokan, "Reactor Core Materials

Interactions at Very High Temperatures,"

Nuclear Technology, 87, August 1989, 147.

2. R. M. Harrington and L. J. Ott, "The Effect

of Small-Capacity, High-Pressure Injection

Systems on TQUV Sequences at Browns

Ferry Unit One," U.S. Nuclear Regulatory

Commission, NUREG/CR-3179,

ORNL/TM-8635, September 1983.

3. F. E. Haskin, J. L. Darby, and W. B.

Murfin, "Analysis of Hypothetical Severe

Core Damage Accidents for the Zion

Pressurized Water Reactor," U.S. Nuclear

Regulatory Commission, NUREG/CR1989, SAND81-0504, October 1982.
Reactor Safety Course (R-800) 3.2 Core Uncovering and Heatup

USNRC Technical Training Center 3.2-2 NUREG/CR-6042 Rev. 2

(3.2-1)

(3.2-2)

3.2 Core Uncovering and Heatup

Core heatup begins when the water level

drops below the top of the active fuel as a

result of boiloff. Before this time fuel

temperatures are close to the system

saturation temperature because there is very

little heat transfer resistance between the

fuel and liquid reactor coolant. So long as

fuel remains submerged, it is not expected to

be damaged due to high temperature.

3.2.1 Boiloff of Water in Core Region

During the uncovering of the core, the

fraction of the core decay power that is

utilized to vaporize water is reduced as the

water level decreases. To a first

approximation, all of the decay heat

generated in the water covered region results

in evaporation, and the water level decreases

exponentially with time.1In a PWR,

sustained core uncovering begins when the

water level reaches the top of the active

core, the exponentially decreasing water

level depicted in Figure 3.2-1 follows from

the equation

where

L(t)= water level above bottom of active

core region at time t since the onset

of core uncovering,

L(0)= water level at the beginning of core

uncovering, for a PWR this is the

height of the active core region Z (12

ft),

t = time since onset of core uncovering,

and

? = time constant for boiloff in core

region, which is given by the equation

with

? = liquid density,

A = cross-sectional area of liquid in active

core region,

hfg = the energy required to evaporate a

unit mass of saturated liquid, that is,

the latent heat of vaporization, which

decreases with increasing reactor

coolant system pressure,

PD = core decay power (approximated as

constant during boiloff of water in the

core region).

Given the exponentially decreasing water

level associated with boiloff in the core

region, it takes one time constant for the

water level to decrease by a factor of e (from

12 to 4.4 ft) and another time constant for

the water level to decrease by another factor

of e (from 4.4 ft to 1.6 ft). It should be

noted that the time constant for boiloff in

the core region, ?, varies with the reactor

coolant system pressure since both the

density ? and latent heat of vaporization hfg

vary with saturation pressure. Figure 3.2-2

depicts the change in ?with pressure for the

Zion PWR at the decay power (32.5 MW)

used in the following example. The total

time duration for Stage 2, core uncovering

and heatup, is approximately 2?or, as noted

in Table 3.1-1, 5 to 35 minutes depending on

the reactor coolant system pressure.
Reactor Safety Course (R-800) 3.2 Core Uncovering and Heatup

USNRC Technical Training Center 3.2-3 NUREG/CR-6042 Rev. 2

(3.2-3)

Example 3.2-1 - Time Required for Boiloff in Core Region

In the Zion station blackout accident sequence, steam is discharged from the

primary system at the relief valve set point of 2500 psig.2 The active core height is

12 ft The area of the core occupied by water is 53.4 ft2. The core decay power

during boiloff is approximately 32.5 MW. Estimate the time required for the water

level to decrease from the top of the active core to the core midplane.

Solution:

Solving Eq. (3.2-1) for t and using Eq. (3.2-2) for ? gives

From the steam tables, for saturated water at 2515 psia,

hfg = 357.0 Btu/lbm

?= 34.83 lbm/ft3

Substituting:
Reactor Safety Course (R-800) 3.2 Core Uncovering and Heatup

USNRC Technical Training Center 3.2-4 NUREG/CR-6042 Rev. 2

A detailed treatment of the axial power

distribution, local heat transfer, two-phase

mixture dynamics, and coupling with the rest

of the reactor coolant system requires the

use of complex computer models. Figure

3.2-3 compares the predictions based on Eq.

3.2-1 with code calculations for a Zion

station blackout scenario compounded by

failure of turbine-driven auxiliary feedwater.

3

As indicated by the comparison, the

exponentially decreasing function defined by

Equations 3.2-1 and 3.2-2 is a reasonable

approximation for the water level in the core

region during this stage of the accident.

This approximation is valid for about two

time constants, which corresponds roughly to

the onset of the next stage. Beyond this

point heat transfer from the uncovered

region of the core to the residual water must

be considered.

3.2.2 Initial Heatup of Uncovered Fuel

Because of low vapor flow rates, the cooling

of fuel in the uncovered part of the core by

the flow of steam generated during PWR

boiloff is relatively ineffective. The

temperature rise in the uncovered fuel during

the boiloff and initial core heatup stage can,

therefore, be approximated as an adiabatic

absorption of fission-product decay energy.

Using this approximation, the temperature

T(z,t) at uncovered elevation z and time t is

where

Z = height of active core region (ft)

mCP = heat capacity of entire core, J/K

(Btu/°F),

PD(z) = decay power per unit axial height

at z above bottom of active core,

MW/ft

tL=Z = time at which the water level in

the core region equals z, seconds

Figure 3.2-3 compares the results of an

adiabatic heatup calculation with code

calculated core temperatures. The difference

between the fuel temperature and the

residual (saturated) water temperature is read

on the horizontal axis. The axial position in

the core is read on the vertical axis. Curves

are shown for three successive times. The

times are measured from the point when the

water level reaches the top of the active fuel

and divided by the characteristic boiloff time

constant defined in Equation 3.2-2. The

lower intercept of a curve with the vertical

axis indicates the water level at that time.

The adiabatic heatup approximation appears

reasonable based on the comparisons with

code calculations. This merely indicates that

during this stage the temperature rises in the

uncovered regions of the core are determined

almost entirely by distribution of decay heat

in the core. For a PWR at high pressure the

saturation temperature would be about

650°F, and the peak t e m p e r a t u re

(650+1080=1730°F) with t/?=1.58 would be

approaching the 1832°F (1000°C) criterion

for the onset of the next stage.

The simplifying assumptions used to develop

the analytic approximations presented above

break down near the start of the next stage,

cladding oxidation, which occurs when the

peak fuel temperature reaches about 1832°F

(1000°C or 1273 K).
Reactor Safety Course (R-800) 3.2 Core Uncovering and Heatup

USNRC Technical Training Center 3.2-5 NUREG/CR-6042 Rev. 2

Fig

u

r

e

3.2-1

E

x

p

o

n

e

ntially

d

e

c

r

e

a

sin

g

w

ate

r le

v

el
Reactor Safety Course (R-800) 3.2 Core Uncovering and Heatup

USNRC Technical Training Center 3.2-6 NUREG/CR-6042 Rev. 2

Fig

u

r

e

3.2-2

V

a

riatio

n

o

f

b

oilo

ff tim

e

c

o

n

sta

nt with

s

atu

r

atio

n

p

r

e

s

s

u

r

e
Reactor Safety Course (R-800) 3.2 Core Uncovering and Heatup

USNRC Technical Training Center 3.2-7 NUREG/CR-6042 Rev. 2 Figure 3.2-3 Approximate calculation of fuel temperature rise (curves) at three different times compared with code results
Reactor Safety Course (R-800) 3.2 Core Uncovering and Heatup

USNRC Technical Training Center 3.2-8 NUREG/CR-6042 Rev. 2

References for Section 3.2

1. J. B. Rivard and F.E.Haskin,“LWR

MeltdownAnalysesandUncertainties,”

ANS/ENS Topical Meeting on Reactor

Safety Aspects of Fuel Behavior, Sun

Valley, Idaho, August 2-6, 1981.

2. F. Eric Haskin, Walter B. Murfin, Joseph

B. Rivard, and John L. Darby,“Analysis

of a Hypothetical Core Meltdown

Accident Initiated by Loss of Offsite

Power for the Zion 1 Pressurized Water

Reactor,” U.S. Nuclear Regulatory

C o m m i s s i o n , N U R E G / C R - 1 9 8 8 ,

SAND81-0503, November 1981.

3. J.B.Rivard,etal.,“Interim Technical

AssessmentoftheMARCHCode,”U.S.

Nuclear Regulatory Commission,

NUREG/CR-2285, SAND81-1672,

February 1981.
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-1 NUREG/CR-6042 Rev. 2

(3.3-1)

(3.3-2)

3.3 Cladding Oxidation

The start of Stage 3 (Table 3.1-1) is

marked by the initiation of significant

cladding oxidation, which occurs when the

peak fuel temperature reaches about

1832°F (1000 °C).

1 The chemical reaction

is

This reaction is particularly important

because it is highly exothermic

(approximately 6.5 MJ/kg (280 Btu/lbm) of

Zr reacted), the reaction rate increases

strongly with cladding temperature, and the

noncondensible gaseous reaction product is

hydrogen.

3.3.1 Reaction Kinetics

A considerable amount of data on

oxidation-reaction kinetics exists. If

adequate steam is available, it is generally

believed that the reaction is limited by

oxygen diffusion through the ZrO2film and

the underlying metal. In this case, the

reaction rate is governed by parabolic

kinetics; that is, W2=kt where W is the

weight of metal reacted, t is the time, and

k is the rate constant, which increases

exponentially with temperature. The

following equation can be used to estimate

the mass of Zr oxidized at a particular

temperature in a steam environment as a

function of time

where,

WZr = mass of Zr oxidized per unit area

exposed to steam, kgZr/m2(lbm,Zr/ft2)

t = exposure time, s

T = temperature of surface, K, (°R)

R = universal gas constant, 8314.29

J/(kg-moleK). (1.98583 Btu/lbmole/°R)

Correlations with experimental data have

provided several alternative estimates of

the empirical constants A and B.

2,3,4 The

values obtained by Cathcart are

A = 294 kg2/(sm

4

) (12.3 lbm

2

/ft 4/s)

B = 1.672×10

8

J/kg-mole (7.195×10

4

Btu/lb-mole).

Figure 3.3-1 shows the mass of hydrogen

produced as a function of time for several

temperatures. Figure 3.3-2 shows the mass

Zr oxidized in 5 minutes at a constant

temperature as a function of temperature

for surface area of 5400 m2(58,000 ft 2),

corresponding to a PWR core.

3.3.2 Oxidation Front

The preceding isothermal example is not

realistic because the exothermic energy

associated with the oxidation reaction

would actually cause the cladding and fuel

temperatures to increase rapidly. Reaction

energy is removed from the surface by

hydrogen and by inward and axial transfer

to the metal substrate and then to the fuel.

W h e n t h e reaction z one attains

temperatures above about 2420°F (1327°C

=1600 K), the oxidation rate becomes so

large that nearly all the available steam is

reacted for typical boiloff sequences. This

condition is referred to as steam limiting

because the oxidation rate is limited by the

amount of steam available to react with the

cladding.
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-2 NUREG/CR-6042 Rev. 2

Example 3.3-1: Hydrogen Production Rate

a. What is the hydrogen production per unit surface area of Zr after 5 minutes

exposure to steam at 2192°F (1200°C)?

b. If all of the cladding (5400 m2, 26,940 lbm) in the Zion PWR were exposed to

such an environment in a severe accident, how much hydrogen (kg) would be

produced?

c. Estimate the total energy release.

Solution:

a. Substituting into Eq (3.3-2) gives

Multiplying WZr by the surface area of 5400 m2gives the mass of Zr that could be oxidized

according to the parabolic kinetics:

This is 14.2% of the 26,940 lbm Zr present.

b. By Equation (3.3-1), two moles of hydrogen are produced per mole of Zr reacted; hence, the

number of moles of hydrogen released is

The corresponding mass of hydrogen is

c. The total energy released is estimated as the mass of Zr reacted times 6.5 MJ/kg.
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-3 NUREG/CR-6042 Rev. 2

Figure 3.3-3 illustrates a calculation of the

thermal behavior of fuel during the

oxidation stage of core degradation.5 The

calculation is one dimensional, and does

not account for the natural-circulation flow

discussed later (see 3.3.5). Significant

oxidation occurs first near the location of

maximum axial power. As oxidation

continues, a sharp temperature profile

develops, reflecting a distinct oxidation

front. Oxidation increases rapidly near the

front and then decreases with elevation due

to steam depletion. The relatively short 5

minute duration in Table 3.1-1 for Stage 3

is based on calculations that indicate

average temperature rise rates in excess of

3.6°F/s (2 K/s) in regions undergoing

vigorous oxidation.5

Figures 3.3-4 and 3.3-5 illustrate the

potential contribution of the zirconium

oxidation energy to the overall energy

release rate in the core region, as a

function of oxidation temperature. Decay

heat transfer to residual saturated water

below the uncovered portion of the core

results in a steam production rate that is

proportional to the below-water portion of

the decay heat power, PDb. As indicated in

Figure 3.3-5, at sufficiently low peak

cladding temperature, the energy release

rate due to oxidation is negligible

compared to that due to decay power.

However, as the cladding temperature in

the uncovered core region increases to

about 1832°F (1000°C = 1273 K), more

and more of the vapor generated by

evaporation of residual water participates

in the zirconium oxidation reaction. At

sufficiently high cladding temperatures,

virtually all of the resulting vapor could

participate in the zirconium oxidation

reaction. In this so-called steam limited

condition, the energy hfg consumed in

evaporating a unit mass of residual water

would result in an energy release in the

oxidation reaction of hrxn (normalized to

a unit mass of steam). Therefore, the ratio

of the energy release rate by the oxidation

reaction to the decay power released below

the water level, Poxidation/PDb, would at least

equal hrxn/hfg. As indicated in Figure 3.3-

5, this ratio varies from 6.3 at atmospheric

pressure to 19 at 2500 psig. Even if PDb

were just 1/20 of the total decay heat

power, the oxidation energy could be

comparable to the decay heat power during

Stage 3.

The preceding argument ignores energy

transfer (including that associated with

movement of debris) from the hot,

uncovered core region downward to the

residual water. As indicated in Figure

3.3-4, each unit of energy that is

transferred downward to the saturated

residual water results in the production of

additional steam to fuel the oxidation

reaction. With significant feedback, for

example due to radiative heat transfer from

the hot reaction zone to the residual water,

the energy release rate from oxidation can

easily and substantially exceed that from

decay heat power. The acceleration of

energy release rates from Zircaloy

oxidation with temperature, which is

illustrated by Figure 3.3-5, has been

observed experimentally.

3.3.3 Core Damage Due to Oxidation

Clad melting is excluded during Stage 3,

which is by definition (Table 3.1-1) limited

to temperatures of 3350°F (1843°C = 1570

K) or less. Nevertheless, several types of

cladding damage can occur during Stage 3.

The cladding is simultaneously subjected

to thermal transients and, particularly if the

reactor coolant system is depressurized, to

stresses resulting from increased internal

pressure of the initial fill gases and fission

gases. At low reactor coolant system
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-4 NUREG/CR-6042 Rev. 2

pressures, ballooning of the cladding is

expected prior to rupture. The temperature

and pressure at which ballooned Zircaloy-4

cladding bursts in a steam environment has

been studied, and it has been found that,

even at low (initial) internal pressures,

cladding usually bursts at temperatures

below 2192oF (1200oC = 1473 K).6

Zirconium-burning tests result in clouds of

smoke issuing from the test chamber,

indicating that large quantities of aerosols

may be generated during the oxidation.7

Such aerosols may have a tendency to

accelerate the plateout of fission products

within the reactor coolant system.

Embrittlement and spallation of ZrO2from

the surface of the cladding as oxidation

proceeds may weaken the fuel rods, expose

more fresh zirconium metal, and/or

produce debris with the potential for

blocking coolant flow channels. Increases

in the cladding surface area exposed to

steam can increase the oxidation rate if the

reaction is not already steam starved.

Because low-melting-point silver-indiumcadmium alloys are often employed in

PWR control rods, the possibility exists for

formation of significant molten quantities

of these materials at the temperatures

attained during Stage 2. It is uncertain

when, and how coherently, such melts

might move through the core region, before

contacting residual water or core support

structures.

For BWRs, melting of the stainless steel

control blades would occur during Stage 3,

well before the onset of fuel relocation.

Special accident management guidelines

(procedures) are in place to both delay the

onset of rapid zirconium oxidation and to

limit its extent once initiated. These

special BWR measures are discussed in

Section 3.7.2.

3.3.4 Reflooding During Stage 3

During a normal boiloff, mechanisms for

transferring energy from uncovered fuel to

residual water are limited principally to

radiative heat transfer. On the other hand,

if water is reintroduced to the core zone

(reflooding) during the oxidation (Stage 3),

the core-damage processes may initially be

accelerated (and the rate of hydrogen

generation increased) due to cladding

oxidation by the additional steam generated

during the cooling of overheated fuel.

Considerable fracturing of cladding

embrittled during oxidation is expected

during reflood. This may lead to the

formation of fairly coarse rubble (fractured

cladding, fuel, and control materials) in

some regions of the core. Such rubble

formation occurred in the upper portion of

the TMI-2 core as a result of the temporary

restart of reactor coolant pump 2B (see

section 3.4.4). It is likely that the rubble

beds formed would be coolable and, given

a continuous supply of coolant injection,

the accident would be terminated during

this stage. (At TMI-2 coolant was not

permanently restored until the accident had

progressed beyond Stage 3, yet the debris

was ultimately cooled in-vessel.)

However, cooling of a reflooded core that

has undergone severe damage would have

to be maintained long-term. Additional

aspects of rubble-bed cooling are discussed

in Section 3.5.

Reflooding of a damaged core from which

a significant fraction of the control rods

have melted introduces a potential for

criticality if the injected water is

unborated. Section 3.7.3 discusses

recriticality concerns for BWRs.
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-5 NUREG/CR-6042 Rev. 2

3.3.5 Natural Circulation During Core

Degradation

In PWR accidents in which the reactor

coolant system is not depressurized as the

core heats up, gas movement in the

uncovered core and upper head regions

begins to be driven by natural convection

(buoyancy forces).8 Heat and mass transfer

from the core to the reactor coolant system

s t r u c t u r e s a r e d o m i n a t e d b y

buoyancy-driven components of the flow

field. Steam from the boiloff of residual

in-vessel water and hydrogen from

oxidation of fuel cladding rise from the hot

central core region and lose heat and

entrained fission products to relatively

colder structures above the core. As

depicted in Figure 3.3-6, the cooled gases

recirculate downward through the colder

regions of the uncovered core and are

reheated again by flowing up through the

hot central core region.

In BWRs, the fuel channels which enclose

the rods of individual fuel assemblies

impede in-core natural circulation.

However, if the residual water level falls

below the bottom of the BWR downcomer

region while fuel is still heating up in the

core region, a strong natural convection

loop can be established from the core to

the steam separators and dryers with return

to the core inlet via the downcomers. This

is depicted in Figure 3.3-7.

As indicated in Figure 3.3-8, the strength

of steel decreases rapidly above 1000°F

(538°C). For some high-pressure PWR

accidents, it has been suggested that the

natural circulation flows in PWRs could

transfer sufficient heat to the reactor

coolant system pressure boundary to result

in relatively early temperature-induced

failures of the reactor coolant system

pressure boundary.

9 The resulting

depressurization of the primary system

would alter the thermal-hydraulic

progression of the accident. In particular,

depressurization would preclude the

potentially severe ramifications associated

with high-pressure ejection of melt into the

containment (see Section 3.5). It should

be noted, however, that early temperatureinduced failure did not occur at TMI-2.

Nevertheless, codes capable of modeling

natural circulation are currently being

exercised in attempts to investigate the

l i k e l i h o o d o f s u c h e a r l y

temperature-induced failures in various

PWR severe accident scenarios.
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-6 NUREG/CR-6042 Rev. 2

Fig

u

r

e

3.3-1

H

y

d

r

o

g

e

n

p

r

o

d

u

ctio

n

p

e

r

u

nit a

r

e

a

fr

o

m th

e

Z

r : H

O2 r

e

a

ctio

n
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-7 NUREG/CR-6042 Rev. 2

0 .0 0 E + 0 0

2 .0 0 E + 0 3

4 .0 0 E + 0 3

6 .0 0 E + 0 3

8 .0 0 E + 0 3

1 .0 0 E + 0 4

1 .2 0 E + 0 4

1 .4 0 E + 0 4

0 5 0 0 1 0 0 0 1 5 0 0 2 0 0 0 2 5 0 0

T e m p e r a t u r e ( F )

Mass Zr Oxidized in 5 min (kg)

S e r i e s 1

S e r i e s 2

10 min

15 min

20 min

Legend

3000

2500

2000

1500

1000

500

0

Cla

d

Te

m

p

e

r

atu

r

e (K)

0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

Core Height, z (m)

4.0

Core Height, z (ft)

Cla

d

Te

m

p

e

r

atu

r

e (F)

0 3 6 9 12

4940

0

4040

3140

2240

1340

440

Figure 3.3-2 Mass of Zr oxidized in 5 minutes exposure of 5400 square meters

Zircaloy

Figure 3.3-3 Calculated axial cladding temperatures at three different times

following start of core uncovering for a PWR station blackout
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-8 NUREG/CR-6042 Rev. 2

Fig

u

r

e

3.3-4

H

e

at b

ala

n

c

e

b

etw

e

e

n

u

n

c

o

v

e

r

e

d

c

o

r

e

a

n

d

r

e

sid

u

al w

ate

r
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-9 NUREG/CR-6042 Rev. 2 Figure 3.3-5 Ratio of heat release rate via oxidation to heat transfer rate to residual saturated water
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-10 NUREG/CR-6042 Rev. 2

Fig

u

r

e

3.3-6

S

e

v

e

r

e

a

c

cid

e

nt n

atu

r

al cir

c

ulatio

n

flo

w

s
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-11 NUREG/CR-6042 Rev. 2

Figure 3.3-7 Schematic diagram of a BWR with internal circulation
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-12 NUREG/CR-6042 Rev. 2

Figure 3.3-8 Tensile strength, type 304 stainless steel
Reactor Safety Course (R-800) 3.3 Cladding Oxidation

USNRC Technical Training Center 3.3-13 NUREG/CR-6042 Rev. 2

References for Section 3.3

1. L. Baker, Jr., and R. O. Ivins, "Analyzing

the Effects of a Zirconium-Water

Reaction," Nucleonics, 23, 7, p. 70, 1965.

2. L. Baker, Jr. and L. C. Just, "Studies of

Metal-Wa t e r Reactions at High

TemperaturesIII,”ANL-6548,Argonne

National Laboratory, Argonne, Illinois,

1962.

3. J. V.Cathcart,etal.,“Zirconium MetalWater Oxidation Kinetics IV, Reaction

Rate Studies,”ORNL/NUREG-17,Oak

Ridge National Laboratory, Oak Ridge,

Tennessee, August 1977.

4. V. F. Urbanic and T. R. Heidrick, "High

Temperature Oxidation of Zircaloy-2 and

Zircaloy-4 in Steam," J Nucl Materials,

75(2):251-61, 1978.

5. F. Briscoe, J. B. Rivard, and M. F.

Young, "Fue l R o d Te m p e rature

Transients During LWR Degraded Core

Accidents," Proceedings, International

Meeting on Thermal Nuclear Reactor

Safety, NUREG/CP-0027, U.S. Nuclear

Regulatory Commission Conference

Proceeding, Chicago, Illinois, August 29

- September 2, 1982.

6. R. H. Chapman et al., "Zircaloy Cladding

Deformation in a Steam Environment

with Transient Heating," Zirconium in

t h e N u c l e a r I n d u s t r y ( F o u r t h

Conference), ASTM STP 681, pp. 393-

408, American Society for Testing and

Materials, Philadelphia, Pennsylvania,

1979.

7. J.B.Rivard etal.,“Identification of

Severe Accident Uncertainties,”

NUREG/CR-3440, SAND83-1689, Sandia

National Laboratories, Albuquerque, NM,

p. 3-8, September 1979.

8. V. E. Denny and B. R. Sehgal, "Analytic

P r e d i c t i o n o f C o r e H e a t u p

Liquefaction/Slumping," (Proc. Int. Mtg.

on LWR Severe Accident Evaluation,

Cambridge, Massachusetts, p. 5.4-1,

1983.

9. F. T.Harperetal.,“EvaluationofSevere

Accident Risks: Quantification of Major

Input Parameters,” NUREG/CR-4551,

SAND86-1309, Vol. 2, Rev. 1, Part 1,

Issue 1, U.S. Nuclear Regulatory

Commission, December 1990.
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-1 NUREG/CR-6042 Rev. 2

3.4 Melting, Liquefaction, Holdup

Stage 4 begins with the initial downward

relocation of molten fuel in the core region.

It extends to the time that fuel-bearing melt

enters the lower plenum of the reactor

vessel. Fuel damage during Stage 4 is

extensive. It is driven both by decay power

and by oxidation. There is a strong coupling

between fuel damage that occurs during this

stage and the release, chemistry, and

transport of fission products within the

reactor coolant system.

3.4.1 Initial Melting

As indicated in Section 3.2, the local

decay-heat generation rate determines how

rapidly a given uncovered region of the core

would heat up. The decay-heat generation

rate is proportional to the thermal power

during operation. The thermal power

distribution can therefore be used to provide

a rough idea of the core regions most

susceptible to the onset of rapid oxidation

and subsequent melting. Figure 3.4-1 shows

the power distribution in the TMI-2 core

prior to the accident.1

 Less than half of the

core by volume produces power at 25 kW/m

or greater. Heat generation rates at the

periphery of the core are markedly lower.

This suggests that melting would start near

the center of the core and might be restricted

to the central region of the core. Some of

the outermost fuel rods may not attain

temperatures resulting in severe damage

because of their low power levels and their

location adjacent to surrounding structures.

Zircaloy-4 melts at about 3200o

F (2033 K,

1760o

C); however, the onset of melting may

occur at lower temperatures. At TMI-2, a

Ni-Zr eutectic, which forms at 2192o

F

(1473 K, 1200o

C), was probably the first

melt formed as a result of interactions

between the Inconel grid spacers and

Zircaloy cladding near the center of the

core. The TMI-2 Ag-In-Cd control rod

material melts at 1472oF (1073 K, 800oC),

and the stainless steel control rod cladding

melts at approximately 2642o

F (1723 K,

1450o

C). Both of these melt points are well

below that of Zircaloy, so molten control rod

material also flowed to the liquid steam

interface relatively early. Molten silver and

iron form relatively low-temperature

eutectics with Zircaloy. Thus, the initial

molten mixture contained significant

zirconium.

The postulated condition of the TMI-2 core

shortly after the onset of melting (150 to

160 minutes into the accident) is shown in

Figure 3.4-2. 2

 Upon reaching the

steam/liquid interface the metallic mixture

froze to form a lower crust that blocked

coolant channels between fuel rods. Postaccident analyses confirm that the crust was

a Zr-Ag-In-Fe-Ni metallic mixture

surrounding standing columns of fuel pellets.

The lowest crust was near the lowest grid

spacer and corresponds to the lowest water

level in the core during the accident.

Alternative scenarios in which a blockage

does not form in the core region due to a

lower water level are discussed in Section

3.4.3.

3.4.2 Fuel Liquefaction

Early views of core melt progression

reflected in the 1975 Reactor Safety Study

held that fuel melting did not occur until the

UO2 fuel material attained its melting

temperature, 5156o

F (3123 K, 2850oC).

Research subsequent to the 1979 TMI-2

accident has shown that UO2 can be

liquefied far below its ceramic phase melting

temperature. When the local temperature of

the fuel reaches the Zircaloy melting

temperature, 3200o

F (2033 K, 1760oC), flow

of metallic cladding beneath the oxidized

layer can occur. Interactions can then occur

between molten Zircaloy and solid UO2 as
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-2 NUREG/CR-6042 Rev. 2

indicated in Figure 3.4-3. In one series of

laboratory experiments, UO2 crucibles

holding molten Zircaloy at temperatures

between 3272o

F (2073 K, 1800oC) and

3632o

F (2273 K, 2000oC) in an argon

atmosphere were rapidly destroyed by the

dissolution of solid UO2 in molten Zircaloy.3

In another experiment, electrically-heated

fuel-rod simulants in steam were massively

liquefied and relocated when the oxidationdriven 9-rod-bundle temperature exceeded

3632oF (2273 K, 2000oC). Similar behavior

has been reported in several other

experiments.4

Apparently, zirconium reduces UO2

preferentially along UO2 grain boundaries

near the UO2-Zircaloy interface. This

produces a homogeneous U-Zr-O melt at low

oxygen concentrations or a heterogeneous

U-Zr-O melt containing UO2 particles at

high oxygen concentrations. In either case,

the process is called fuel liquefaction.

In addition to destroying the UO2 matrix,

fuel liquefaction accelerates the release of

fission products from the fuel. However,

minor alloying components or impurities can

have large effects on such releases. For

instance, tin, which is a 1% component of

Zircaloy, may act as a getter for tellurium,

resulting in significant holdup or retention

of tellurium fission products.5

3.4.3 Flow Blockage Versus Streaming

The significant liquefaction of fuel that

would occur after the Zircaloy cladding

started to melt would result in downward

flow of liquid U-Zr-O. Even in the absence

of a blockage formed by the refreezing of

lower melting temperature metallic mixtures

(as occurred at TMI-2), molten U-Zr-O

could refreeze on the surfaces of fuel rods or

fuel assembly rod spacers in lower regions

of the core where temperatures were cooler.

Calculations indicate that, without additional

oxidation, the liquefied fuel would rapidly

freeze producing a significant core blockage.

This is true even if freezing requires the

transfer of the full UO2 latent heat of fusion

(270 kJ/kg). A latent heat of fusion more

appropriate for the U-Zr-O mixture would

require less heat transfer (about 50 kJ/kg)

making freezing even more likely.5

On the other hand, the high temperature of

the liquefied U-Zr-O would favor high

oxidation rates per unit area exposed, and

energy addition by oxidation as the liquid

flowed downward could preclude its

refreezing. If the water level during the

meltdown were below the bottom of the

active core, the melt could then stream into

the lower plenum if not halted by freezing

on cooler surfaces below the core region.

Quenching of melt that streamed into

residual water in the lower plenum could

provide the additional steam required to

maintain the streaming process. The

question of blockage versus streaming is

important because it affects the magnitude of

resulting fuel coolant interactions and the

timing and mode of eventual bottom head

failure (Sections 3.5 and 3.6). Most current

analyses predict the formation of a blockage

in the core region of a PWR even if the

residual water level is below the bottom of

the active fuel. BWR core melt progression

is discussed in Section 3.7.

A central blockage would redirect steam

flow outward in an open lattice (PWR) core.

This is depicted in Figure 3.4-4. The

diversion of steam flow to the outer regions

of the core could result in two possible

alternatives. If the fuel rods have not yet

attained temperatures capable of supporting

rapid oxidation, they may be cooled by the

additional flow, but if the rods are hot

enough, they may rapidly oxidize.

Figure 3.4-5 shows the core condition

postulated at TMI-2 at 173 min, just prior to
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-3 NUREG/CR-6042 Rev. 2

the brief restart of reactor coolant pump 2B.4

The damage had progressed to the point

where the blockage was nearly complete

with only the outermost fuel assemblies

undamaged. The bowl-like shape of the

lower crust or crucible may have been

caused by the flow blockage diverting steam

flow radially outward. Such flow diversion

increases steam flow rates and thus heat

transfer at the periphery of the damage zone.

This results in freezing the downward

relocating melt at elevations above the water

level as shown in Figure 3.4-5. A second

explanation for the shape of the lower crust

is that the onset of melting is primarily

controlled by decay heat, and, consequently,

the freezing isotherm increased in elevation

as core damage progressed radially outward

to regions of lower core power density.

Above the TMI-2 lower crust, a region of at

least partially molten material formed as

depicted in Figure 3.4-5. At the time

indicated (just prior to the restart of reactor

coolant pump 2B), core heatup calculations

indicate that peak temperatures within this

region of consolidated core materials may

have reached the UO2 melt temperature,

5156oF (3123 K, 2850oC). The average

temperature of the material was probably

between 4220oF (2600 K, 2327oC) and

4580o

F (2800 K, 2527oC).4

Undamaged fuel rod stubs were about 2 ft

(60 cm) long near the center of the core,

indicating that water did not drop below this

level for any significant period of time

during the accident. Water covering the

bottom of the core kept the lower supporting

crust cooled. This helped maintain the

structural stability of the crust. The ultimate

thickness of the lower crust was 10 to

15 cm.6

3.4.4 Reflooding at TMI-2

Activation of reactor coolant pump 2B at

approximately 174 min resulted in the first

significant addition of coolant to the TMI-2

reactor vessel following the shutdown of the

loop-A reactor coolant pumps at

approximately 100 min. Reactor coolant

pump 2B operated for approximately 19 min;

however, significant flow was only measured

during the first 15 s. Approximately 1000

ft3 (28 m 3) of water was pumped into the

reactor vessel from the loop B cold leg.

As discussed in Section 2.1, the reactor

coolant pressure increased rapidly when

pump 2B was turned on. This pressure

increase was caused by steam generated

when the water contacted hot surfaces in the

core region, and by hydrogen generated by

the rapid oxidation of hot Zircaloy.

The thermal-mechanical forces resulting

from partial quenching of the oxidized fuel

rod remnants in the top half of the core

fragmented the oxidized cladding and fuel

pellets to form a debris bed. The

configuration postulated for the core just

after the pump 2B restart is shown in Figure

3.4-6. As indicated in the figure, the upper

support grid was damaged. Selected areas of

the bottom of the upper core support grid

were oxidized, melted, or ablated thermally.

There was, however, no damage to structures

in the plenum above the upper core support

grid.

The upper core debris bed contained about

27,000 kg of material. Between 3 and 10%

of this debris was less than 1 mm in

diameter, and the control-rod materials (AgIn-Cd) in this debris were concentrated in

particles less than 1 mm in diameter.3

Particles of this type were found on various

horizontal surfaces in the upper plenum.

Jets of steam from the 2B pump restart are

thought to have led to this transport.
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-4 NUREG/CR-6042 Rev. 2

Apparently quantities of loose debris also

settled to the lower head of the reactor

vessel during quiescent periods or were

transported there by loop flow during the 2B

pump transient. This would explain findings

of Ag-Cd on the surfaces of several incore

instrument nozzles and in surface cracks in

the stainless steel cladding on the lower

head. The alternative that molten controlrod material flowed all the way to the

bottom head seems less plausible because of

the thick metal-rich lower crust that formed

just above the minimum water level in the

core region. Unfortunately, the manner in

which lower head debris was broken up and

removed from the vessel (Section 3.5.3)

precluded confirmation or detailed

characterization of a possible initial layer of

control-rod debris on the bottom head.

From approximately 180 min to about 200

min, the water level in the TMI-2 core

decreased as heat from the degraded core

caused reactor coolant remaining in the core

region to evaporate. At approximately

200 min the water level was at its lowest

level. The low thermal diffusivity of the

large consolidated region of primarily

ceramic core debris prevented the interior of

this region from cooling even when the

reactor vessel was subsequently refilled with

water. Calculations indicate that a pool of

molten material formed in the center of the

consolidated region and increased in size

during this period.

At 200 min. the high pressure injection

system was manually actuated and cooling

water was injected for the next 17 min.

Analyses indicate that the core region was

refilled with water by 207 min. As the

cooling water filled the reactor vessel, it

penetrated the debris bed above the

consolidated region. By about 230 min.

debris in this upper debris bed was fully

quenched.

The postulated condition of the core debris

at 224 min. is depicted in Figure 3.4-7.

Water covered the core region and

penetrated the upper debris bed, but could

not cool the consolidated region. The

material between the upper and lower crusts

was predominately molten.

Relocation of approximately 19.2 tonnes of

molten core material into the lower plenum

of the reactor vessel occurred between 224

and 226 min. As explained in Section 3.5.1,

the pour was initiated by a failure of the

crust at the periphery of the core region, but

the failure does not appear to have been

caused by the reflooding of the core region

with water.

3.4.5 Additional Reflooding

Considerations

If water is reintroduced into the core during

Stage 4, acceleration of cladding oxidation

may occur, because

• the quantity of unoxidized cladding may

be relatively large due to the slow rate of

steam evolution from boiloff prior to

reflooding,

• a large fraction of the unoxidized

cladding may be at elevated

temperatures,

• quenching of hot fuel upon reflooding

the lower part of the core would produce

copious amounts of additional steam, and

• there could be relatively uninhibited

access of steam to unoxidized cladding.

Acceleration of oxidation associated with

reintroduced coolant might, given these

assumptions, add tens of GJ of energy to the

system in a short time and evolve large

quantities of hydrogen. Because the energy

required to destroy the entire core geometry
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-5 NUREG/CR-6042 Rev. 2

at these temperatures may be as little as 6

GJ,5

 a significant redistribution of core

materials in a very short time following the

reintroduction of water is possible.5

 An

attendant possibility is one or more steam

explosions caused when hot, liquefied fuel

contacts reflooding water. (Steam explosions

are discussed in Section 3.6.) The actual

scenario is quite uncertain, and this leads to

corresponding uncertainties regarding

subsequent processes and events.

TMI-2 demonstrates, however, that the

reintroduction of sufficient water during

Stage 4 can ultimately succeed in

terminating the meltdown process within the

reactor vessel. To achieve a stable in-vessel

condition, the water supply must be

maintained and heat must be removed from

the core debris by reestablishing forced or

natural circulation through the reactor

coolant system or by local convection within

debris beds. The effectiveness of debris

cooling, especially that by local convection,

depends upon the size, shape, and

characteristics of the core debris

(Section 3.5). In the long-term, heat

transport to an ultimate heat sink may also

be required to store the energy removed

from the core debris without challenging

containment integrity (Chapter 4).

3.4.6 Natural Circulation During

Stage 4

In PWR accidents, even if the steam

generator secondary-side inventory is

depleted at the time of core damage, gaseous

natural convection between the vessel and

the primary side of U-tube steam generators

is favored. Because of potential loop seals

in the reactor coolant pump suction lines,

the convective flows would most likely be

required to traverse the hot leg piping,

displacing cooler steam/hydrogen in the

generator tubes by warmer steam-hydrogen

from the core, as depicted on the right hand

side of Figure 3.3-6. The great height of the

steam generator tubes (18 m) provides a

large driving force.

To the extent that the convection is

effective, the steam generator tubes provide

at least a temporary sink for heat and fission

products. The effectiveness of the steam

generators as a sink would decrease

significantly as the tubes heated up. It has

been estimated that halving the temperature

difference between hot gases and steam

generator tubes reduces the convective heat

flux by 40%.5

As discussed in Section 3.3.5, because the

strength of steel decreases rapidly above

1000oF (811 K, 538oC), sufficient natural

circulation of hot gases to the steam

generators would cause heated reactor

coolant system structures such as the hot

legs to weaken and fail. By depressurizing

the reactor vessel, such temperature-induced

failures could prevent large containment

pressures and temperatures that might

otherwise result from high-pressure melt

ejection due to reactor vessel bottom head

failure (Section 4.5).
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-6 NUREG/CR-6042 Rev. 2

Figure 3.4-1 Distribution of fuel rod rating (kW/m) in the TMI-2 core
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-7 NUREG/CR-6042 Rev. 2

2B inlet

B outlet

A1 inlet

Oxidized intact rods

High temperature

fuel rod remnants

Solidified crust near

liquid level

Approximate liquid level

Figure 3.4-2 Hypothesized TMI-2 condition between 150 and 160

minutes
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-8 NUREG/CR-6042 Rev. 2

Intact

Cladding

Possible

Oxidation

and / or Freezing

Liquified

(U-Zr-O)

"Breakout"

Gap Fuel Rod

Cladding

Not to Scale

Void

ZrO2

UO2

Figure 3.4-3 Schematic representation of possible mode of initial fuel

liquefaction and downward flow.
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-9 NUREG/CR-6042 Rev. 2

Figure 3.4-4 Initial core degradation in a PWR
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-10 NUREG/CR-6042 Rev. 2

2B inlet

B outlet

A1 inlet

Approximate liquid

level interface

Control, cladding, and structural

material solidified between fuel 

rods, i.e., supporting crust

Partially molten ZrO /UO 2 2

High temperature fuel rod remnants

Partially oxidized rods

Figure 3.4-5 Hypothesized TMI-2 core at 173 minutes
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-11 NUREG/CR-6042 Rev. 2

. . .

. . . . . . . .

.. . . . . ..

.

. .

.

.

. . . .

. ..

.

. .

. . . . . . . . . . . .

. . .. . . . .

. .

.. . . . . .

. . . . .

. . . .

. .

. . 

. . .

. . .

. . .. 

.

.

.

.

. .

. . . .

. . . .

. . . . .

. . .

. ..

.

. . . . . .

.

.. .

.

. . .

. . .

. . . .

.

. . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . .

.

. .

. .

. .

. . .

. .

.

. . .

. .

.. .

. .

. . . . . . . . . . . .

 . . .

. .

. .

. . . . . .. . . . . . . .

. . . . . . . . .

.

. .

. . . . .

. . .

. .

.

.

. .

. ..

.

B outlet

Approximate liquid 

level interface

Upper grid damage

Small void

Fragmented fuel rods

Possible upper crust

Patially molten ZRO /UO

between fuel rods

2 2

Control, cladding, and structural

material solidified between fuel rods

A1 inlet

Figure 3.4-6 Hypothesized TMI-2 core configuration between 174 and 180

minutes
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-12 NUREG/CR-6042 Rev. 2

Approximate

liquid level

Molten metal

and ceramic

Void

Upper debris bed

Control, structural, and

cladding material solidified

between fuel rods

Upper grid damage

A1 inlet

Upper crust

Figure 3.4-7 Hypothesized TMI-2 core configuration at 224 minutes 

 (just prior to molten pour)
Reactor Safety Course (R-800) 3.4 Melting, Liquefaction, Holdup

USNRC Technical Training Center 3.4-13 NUREG/CR-6042 Rev. 2

References for Section 3.4

1. K. H. Ardron and D. G. Cain, "Core

Temperature Transient in the Early

Phase of Core Uncovering at TMI-2,"

Progress in Nuclear Energy, 7:197-228,

1981.

2. J. M. Broughton et al., "A Scenario of

the Three Mile Island Unit 2 Accident,

Nuclear Technology, 87(1):34-53,

August 1989.

3. P. Hofmann, D. Gerwin Peck, and P.

Nikolopoulos, “Physical and Chemical

Phenomena Associated with the

Dissolution of Solid UO2 by Molten

Zircaloy-4,” PNS-NR.675/82,

Karlsruhe, Federal Republic of

Germany: Kernforschungszentrum

Karlsruhe, GmbH, 1982.

4. P. Hofmann, S. J. L. Hagen, and G.

Schanz, "Reactor Core Materials

Interactions at Very High

Temperatures," Nuclear Technology,

87(1):146-186, August 1989.

5. J. B. Rivard, et al., “Identification of

Severe Accident Uncertainties,”

NUREG/CR-3440, SAND83-1689, U.S.

Nuclear Regulatory Commission,

September 1989.

6. J. R. Wolf, D. W. Akers, and L. A.

Neimark, "Relocation of Molten

Material to the TMI-2 Lower Head,"

Nuclear Safety, 87(1):269-279, JulyDecember 1994.
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-1 NUREG/CR-6042 Rev. 2

3.5 Molten Pours onto the Lower

Head

Stage 5 begins with the movement of molten

fuel-bearing debris into the lower plenum of

the reactor vessel. It ends with failure of

the reactor pressure vessel and the discharge

of fuel debris to the containment. Reactor

pressure vessel failure could result from

weakening of the lower head or its

penetrations due to contact with hot debris.

Alternatively, vessel failure could result

from an energetic interaction of molten fuel

with residual water in the lower plenum.

This section discusses accident progression

scenarios in the absence of energetic fuelcoolant interactions. The implications of

energetic fuel-coolant interactions (steam

explosions) are discussed in Section 3.6.

3.5.1 TMI-2 Molten Pour

Relocation of approximately 19.2 metric

tonnes of molten core material into the lower

head of the reactor vessel occurred between

224 and 226 minutes. This was confirmed

by several indicators: a primary system

pressure increase of 290 psi (2 MPa),

increases in out-of-core source-range neutron

detector count rates, alarms of in-core

self-powered neutron detectors (SPNDs),

alarms of in-core thermocouples, and postaccident measurements of incore

thermocouple loop resistances.

The debris configuration that resulted from

relocation is depicted in Figure 3.5-1. The

crust failure appears to have been in the

upper half of the consolidated region near

the core periphery. Two mechanisms have

been postulated for crust failure. First,

continued heating of the molten pool could

have lead to melting of the supporting crust,

which was thinnest on the top (1 cm versus

10 to 15 cm on the bottom) where heat

transfer was greater. Second, at about 220

minutes the pressurizer block valve was

opened resulting in a decrease in the reactor

coolant pressure of 70 psi (0.5 MPa)

between 220 and 240 min.

Post-accident examinations of the eastern

half of the core region and lower vessel

internals show that the molten pour started

on the eastern side of the core. Figure 3.5-2

shows a cross section of the internal

structures surrounding the core region. The

primary path from the core region was

radially outward through a hole melted in

the R6 wall of the core former. The core

barrel appears to have experienced local

surface ablation in this region as indicated in

Figure 3.5-3.1

 

Post-accident probings found approximately

4.2 tonnes of solidified fuel debris in the

gap between the vertical core former wall

and the core barrel at depths depicted in

Figure 3.5-3. Another 5.8 tonnes are

estimated to have solidified in the core

support assembly region. About 19.2 tonnes

relocated onto the lower head of the reactor

vessel. Examinations of flow holes in the

horizontal baffle plates between the core

former and the core barrel indicate that

nearly the whole volume between plates 6

and 7 filled with molten corium that flowed

from the initial core former meltthrough

location. The majority of the molten corium

then flowed downward through flow holes in

plate 7 and ultimately into the reactor vessel

lower head. 

The lower core support assembly consists of

a number of plates and a forging as shown

in Figure 3.5-4. There were multiple flow

paths through the core support assembly to

the lower head. Figure 3.5-5 indicates

where solidified material was found in the

area between the lower grid and the flow

distributor plate, between the flow

distributor plate and the grid forging, and in

flow holes of the grid forging.2

 The

presence of solidified material indicates that
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-2 NUREG/CR-6042 Rev. 2

molten material flowed through or adjacent

to these locations. On this basis, most of

the melt flowed down to the elliptical flow

distributor on the eastern periphery in the

R6/7 and P4/5 areas. Visual examinations

indicated that some melt flowed around the

perimeter of the core support assembly

structures before moving downward.

Figure 3.5-6 indicates the locations in the

elliptical flow distributor where solidified

material was observed in or above a flow

hole.2 The flow holes indicated in Figure

3.5-6 agree well with those indicated in

Figure 3.5-5. In particular, locations H-15,

K-15, L-15 indicate flow on both figures,

and flow location C-14 in Figure 3.5-5 is

near locations D-13 and D-14 in Figure

3.5-6. The melt appears to have dropped

onto the lower head from several different

locations around the periphery of the

elliptical flow distributor.

As the melt moved downward from the core

region, heat was lost to the vertical core

former, to the core barrel, to the horizontal

baffle plates, to the lower core support

assembly, and to water that filled the lower

plenum. Minimal damage observed to the

elliptical flow distributor suggests that the

initial material reaching the lower head was

relatively cool. It is possible that the

material was mobile at temperatures below

the solidus temperature of (U,Zr) O2 owing

to the presence of phases with higher metal

content and lower melting temperatures.

Rapid steam production occurred as a result

of heat transfer from the molten core

material to water in the lower head.

Nothing in the recorded data or post

accident core conditions suggests an

energetic steam explosion (see Section 3.6)

occurred as the tons of molten core material

relocated into the lower plenum with the

reactor vessel nearly full of water.

Figures 3.5-7 and 3.5-8 depict the ultimate

hard debris layer that formed in the lower

head.2

 The layer depths were established by

mechanical probing during defueling

operations. The steep cliff-like profile

around the periphery of the hard layer

indicates rapid freezing of relatively cold

debris. A high initial temperature or

remelting would have resulted in a flatter

profile near the periphery. On the other

hand, it is now clear that high temperature

melt existed and caused some damage in the

more central regions of the lower head (see

Section 3.5.4).

3.5.2 Alternative Melt Flow Scenarios

In core melt scenarios involving the

formation of blockage in the core region,

configurations similar to that at TMI-2 are

postulated. The formation of a molten pool

contained within a crucible-like bottom crust

is envisioned with unmelted ceramic (UO2)

and metallic material either adding to the

pool from above or forming a rubble bed

above an upper crust as at TMI-2. 

The size of the molten region grew due to

continued addition of decay heat (reduced by

the loss of volatile fission products during

liquefaction). With a total loss of coolant

injection, the residual water level could drop

below the bottom of the active core and

structures supporting the mass of the crust

and melt could weaken as depicted in Figure

3.5-9. Given a failure of the core support

structures or a breakthrough of suspended

melt as occurred at TMI-2, substantial

quantities of melt could suddenly plunge

into the residual water in the lower plenum.

On the other hand, a massive, coherent pour

of molten material is not the only scenario

that can be envisioned. Local crust failure

could result in a narrow continuous pour

over a fraction of a minute to several

minutes. Alternatively, if there were little

residual water present, a strong crust might
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-3 NUREG/CR-6042 Rev. 2

not form in the core region. In this case the

discharge of molten material from the core

might occur in a narrow discontinuous

stream or streams distributed over the

duration of the core meltdown.

The rate of formation of liquefied fuel is

slow compared to all but the very slowest

discharge rates. Thus, if a large fraction of

the core is liquefied at the onset of

discharge, a larger amount might be

discharged. Conversely, if only a small

fraction is liquefied at the onset of

discharge, much smaller discharge rates

would result.

3.5.3 Debris on TMI-2 Lower Head

During the TMI-2 defueling, the solidified

layer of debris in the lower head was found

to be very hard. It had to be broken apart

by dropping a 300 lb (136 kg) hammer from

an elevation of 20 ft (6.1 m). Once the

material was broken into pieces, there was

virtually no adherence to the lower head

itself. Representative samples of the

solidified layer were obtained for

examination. Because the hard layer had to

be broken into pieces, however, information

regarding variability in debris properties

with depth could not be obtained. Results of

physical and radiochemical examinations,

which are discussed in detail elsewhere,3

 are

summarized below.

The debris was generally a dull grey ceramic

with some areas of yellow (probably

hexavalent uranium). The average density

of the samples was 8.7±0.4 g/cm3. By

comparison, the density of UO2 fuel pellets

is about 10.8 g/cm3. The average porosity

for all samples was 18±11%, reflecting a

very wide range. As indicated in Table

3.5-1, the elemental composition of the

debris was found to be very similar to that

in the original core, but with slightly more

uranium and slightly less zirconium.

Figure 3.5-10 shows cross-sectional views of

one sample with apparently connected pores

in the longitudinal sections. Such

interconnected pores were observed in many

of the samples and may have been caused by

bubbling of steam or structural material

vapors through the melt when it froze. As

indicated in Figure 3.5-11, scanning electron

microscope examinations revealed a light

uranium-rich (U,Zr)O2 phase away from the

pores. A dark, zirconium-rich (Zr,U) O2

phase was often found adjacent to the pores.

Based on the time required for such visible

phase separation to occur, the debris cooling

time was estimated to be from 3 to 72 hours.

The lack of complete phase separation

implies a cooling time toward the lower end

of this range. As discussed later, however,

tests of metal samples from the lower head

and analyses of potential vessel failure

modes imply a much shorter (~30 min.)

quenching time. This apparent discrepancy

has not yet been explained.

Dissolution techniques were used to measure

the retention fractions of several key

radionuclides in the debris. The analyses

indicated that only small fractions of volatile

radionuclides like Cs-137 were retained, but

most of the low volatility radionuclides were

retained. The decay heat generation rate in

the debris on the lower head was estimated

to be 0.13 watts per gram (w/g) of uranium

just after the molten pour.3

 This compares

to 0.18 w/g of uranium if all radionuclides

had been retained.

3.5.4 Hotspot in TMI-2 Lower Head

The condition of the TMI-2 incore

instrument nozzles following debris removal

from the lower head is depicted in Figure

3.5-12. As indicated by the section view in

Figure 3.5-8, some nozzles had been

completely buried in solidified debris but

showed absolutely no damage. Other

nozzles were partially melted, and nine
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-4 NUREG/CR-6042 Rev. 2

nozzles (E-7, E-9, F-7, F-8, G-5, G-6, G-9,

H-5, and H-8) were completely melted off.

The following explanation accounts for these

various degrees of damage.

The portion of the molten pour that initially

contacted the lower head is believed to have

been substantially cooler than material that

reached the lower head later. The initial

material lost more heat to the core baffle

and former plates, the core barrel, the lower

core support assembly, and the water that

filled the lower plenum. The lower head

itself provided an additional heat sink.

The initial cooler material fell to the lower

head from several different locations and is

believed to have rapidly frozen to form a

cup-shaped basal crust structure that

protected lower head and nozzles in these

areas. Hotter material flowed downward

across the top of this insulating crust.

Unprotected nozzles in the flow paths of the

hotter material were melted off. The height

at which a nozzle melted off indicates the

depth of the insulating crust that surrounded

the nozzle. The protective crust thickness

was negligible at location E-9, ~15 cm at

location H-5, and ~25 cm at location M-9

(see Figure 3.5-12).

In February 1990, 14 nozzles, 2 guide tubes,

and 15 lower head steel samples, were

removed from the TMI-2 vessel. Figure

3.5-13 shows the locations of these samples.

(The stubs of nozzles E-9, F-7, F-8, G-6,

and G-9 were too short to be removed.)

Figure 3.5-14 shows the as-removed

appearance of six nozzles. The 15 lower

head steel samples extended about half way

through the 5.6 inch (14.2 cm) thick vessel.

Figure 3.5-15 illustrates the prism shape of

the vessel material samples. Significant

insights regarding potential lower head

failure modes were obtained based on tests

and analyses performed on these samples. It

was determined that an elliptical hot spot

(approximately 1×0.8 m) formed where the

insulating crust thickness was negligible.

This hot spot is depicted in Figure 3.5-16.4

Within the hot spot temperatures from ~800

to 1100°C (1472 to 2012°F) persisted for

approximately 30 minutes. Cooling then

occurred rapidly (10-100°C/min.).5

 Outside

the hot spot, lower head temperatures

remained below the 727°C (1341°F)

austenitic to ferritic transition temperature;

however, some areas may have been close to

this temperature. The temperature gradient

through the lower head was 20 to 40°C/cm.

3.5.5 Early Views of Lower Head Failure

As mentioned in Sections 3.3.5 and 3.4.6

and illustrated in Figure 3.3-8, the strength

of steel decreases rapidly as its temperature

exceeds 1000°F (538°C), start

here which is far less than the steel

melting point. Early investigators focused

on global weakening accompanied by large

plastic deformations of the entire lower head

as the most likely vessel failure mode. If

large fractions of the core were postulated to

be molten in the lower head, estimates of the

time required for failure varied from 22 min.

to 40 min., depending on whether the vessel

was assumed to be pressurized or not.6

The 80 minute maximum duration with total

loss of coolant injection given in Table 3.3-1

for Stage 5 results from combining the

maximum estimated time-to-breach for the

reactor vessel (40 minutes) with a scenario

in which the molten core material flowing

into the lower head is initially quenched by

the water remaining there and must then

reheat to cause vessel failure.

In a 1981 risk assessment of the Zion plant,

an alternative mechanism for lower head

failure was identified.7

 Local meltthrough

was postulated to occur at an incore
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-5 NUREG/CR-6042 Rev. 2

instrument tube penetration. The time to

failure identified for this mode was 5 to 7

minutes, independent of relative pressure.

3.5.6 Lower Head Failure Modes

Analyzed for TMI-2

The preceding lower head failure analyses

do not apply to the TMI-2 accident where

only a limited mass (~19.2 tonnes) of molten

core debris relocated to the lower head. The

TMI-2 lower head did not fail in spite of the

hot spot that existed for about half an hour.

In 1994, analyses were performed to

investigate what modes of failure might have

occurred had the accident proceeded further

without efficient cooling of debris in the

lower head. As illustrated in Figure 3.5-17,

four temperature-related failure modes were

analyzed.

Tube Rupture - The tube rupture

mechanism shown in Figure 3.5-17a would

result from a combination of high pressure

and elevated ex-vessel tube temperatures

caused by penetration of hot debris through

the tube to ex-vessel locations. Data from

some of the TMI-2 instrument nozzles were

used to calibrate a melt-penetration model.

Model predictions indicate that molten fuel

did not penetrate through the instrument

tubes to locations below the lower head.

Ex-vessel tube rupture was therefore not a

significant threat at TMI-2.

Weld Failure, Tube Ejection - Failure of a

penetration tube weld (Figure 3.5-17b) could

result from attack and sustained heating by

debris surrounding a tube in combination

with high reactor coolant system pressure.

At TMI-2, metallurgical evidence indicates

that the Inconel penetration welds did not

melt.8

 Analysis results obtained in 1994

indicated that this failure mode would not

have occurred first at TMI-2. Results of a

subsequent lower head failure experiment

(see Section 3.5.7) show, however, that

deformation of the lower head can indeed

cause penetration welds to fail first.

Global Failure by Uniform Heating -

Based on the TMI-2 debris composition, it is

likely that the molten material reached

temperatures greater than 2600 oC (4712oF)

in the central core region before relocation.

The temperature of the debris when it

reached the lower head is not known;

however, it reached the lower head in a

molten state, and results of the debris

sample examinations suggest slow cooling.

Consequently, analysts examined the

potential for vessel failure due to prolonged

uniform heating by the debris that reached

the lower head. Heat transfer from the

debris to the lower head was modeled as

depicted in Figure 3.5-17c. With no

allowance for rapid cooling of the debris,

global failure of the lower head was

predicted to occur within 1.7 to 2.3 hours of

the molten pour.9

Local Failure by Peaked Heating -

Calculations were also performed to assess

the margin to failure due to the high

temperatures in the hot spot. The existence

of the hot spot was simulated by imposing

surrounding (background) temperatures

consistent with a lower rate of debris to

vessel heat transfer as depicted in Figure

3.5-17d. When the hot spot temperatures

were imposed with a background

temperature of only 327o

C (621oF), the

vessel was predicted to survive. When the

hot spot temperatures were imposed with a

background temperature near the 727oC

(1341o

F) ferritic to austenitic steel transition

temperature, lower head failure was

predicted to occur 1.5 hours after the molten

pour.
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-6 NUREG/CR-6042 Rev. 2

3.5.7 Lower Head Failure Experiments

and Analyses

The analyses of material samples and failure

modes described in the preceding sections do

not fully explain the known outcome of the

TMI-2 accident (the vessel did not fail).

The hypothesis that rapid cooling of debris

by water prevented lower head failure is

examined in Section 3.5.8. To assess the

validity of lower head failure models, the

NRC sponsored a series of Lower Head

Failure (LHF) experiments and analyses,10

which are discussed in this section.

The LHF experiments were performed using

1-to-4.85 linear scale models of a typical

PWR lower head. The test vessel was

basically a scaled version of the lower part

of a TMI-like reactor pressure vessel without

the vessel skirt. Linear scaling was used to

preserve the membrane stress. The

prototypic material for U.S. PWRs

(SA533B1) was used to preserve the material

behavior. The heat flux, which was applied

using internal radiant heaters, was scaled by

the linear scale factor to preserve the creep

and failure time. As a result of the heat flux

scaling, the throughwall temperature

differential decreased by the square of the

scaling factor, and the throughwall

temperature difference was typically about

10 K (18o

F). 

To be useful for model validation, the

experiments were designed with wellcharacterized initial and boundary conditions

and with sufficiently detailed measurements

of temperature, pressure, and displacement

histories. Maps of the vessel shape

(including wall thickness) were obtained

before and after each test.

A series of eight experiments was

conducted. The test conditions were

selected to examine the effects of spatial

heat flux distribution, pressure, and

construction features on lower head

deformation and failure. Three temperature

distributions were used: uniform, centerpeaked, and edge-peaked. A uniform

distribution might occur in scenarios where

the core melt gradually relocated to the

lower head. Center-peaked distributions are

representative of the hot spot that occurred

at TMI-2. Edge-peaked distributions

simulate the presence of a convecting molten

pool. All of the experiments were conducted

at a pressure of 10 MPa (1450 psig) except

LHF-7, which was conducted at 5 MPa (775

psig). A pictorial summary of all eight LHF

experiments is presented in Figure 3.5-18.

Table 3.5-2 summarizes the test conditions

and key results of all the experiments.

In all of the experiments large deformations

in the geometry of the lower head were

observed following the onset of creep. The

temperature for the onset of creep for

experiments conducted at 10 MPa was fairly

consistent, ranging from 935 K to 997 K

(1223o

F to 1335oF). The temperature at

which the lower head failed in the 10 MPa

experiments was also fairly consistent,

ranging from 1006 K to 1114 K (1351oF to

1546oF). In LHF-5, which was the only test

with penetrations installed in the lower head,

failure occurred prematurely by leakage

around circumferential welds that connected

the penetrations to the surrounding vessel.

The diameter of the penetration through

holes increased by as much as a factor of

two indicating how global head deformations

can impact the stress state in penetration

welds. 

In LHF-4, a leak developed causing the

vessel pressure to decrease to 7.7 MPa (1117

psig). The pressure was increased back to

10 MPa rapidly while the vessel temperature

was just under 1000 K (1340oF), which is

above the previously observed temperature

for the onset of creep. The vessel

deformation rate immediately increased, and
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-7 NUREG/CR-6042 Rev. 2

the vessel failed catastrophically. This

illustrates how repressurization at elevated

temperature can cause lower head failure.

LHF-7 was a replicate of LHF-1, except the

test pressure was reduced from 10 MPa to 5

MPa. The overall deformation of LHF-7

was comparable to that of LHF-1, but the

vessel failure was different. Lowering the

driving pressure elevated the temperature for

the onset of creep and the temperature for

vessel failure. While all experiments at 10

MPa had severe necking and a thickness

reduction of about a factor of 10 at the

failure location, the thickness reduction for

LHF-7 was only a factor of two.

LHF-6 was designed to investigate the

susceptibility of vessel welds, but the welds

were not challenged and LHF-6 was

essentially an exact replicate of LHF-1.

Similarly, in spite of slight difference in the

location of the edge-peaked heat flux, LHF-8

was essentially an exact replicate of LHF-3.

Generally, the tests show that failure is

attracted to regions of weakness (reduced

thickness or elevated temperature. The

uniform heat flux failures typically occurred

in regions of reduced wall thickness. For

cases where there was localized heating,

failure always occurred in regions of

maximum temperature. The difference in

load-carrying capability need not be very

large. The failure region in LHF-1 was less

than 5% thinner than the surrounding region.

The repeatability of the LHF tests and model

comparisons to the test results suggest that

with adequate information (heating rates and

patterns, pressure transients, vessel thickness

profiles, material properties, and penetration

characteristics) modeling of the mode and

timing of lower head failure may be

possible. However, the LHF experiments

constitute an incomplete data base with

respect to possible in-vessel pressures,

pressure transients, and through-wall

temperature drops. They also suggest the

need for better characterization of vessel

material properties. Consequently, although

the heating rates and patterns and the

pressure history at TMI-2 are fairly well

documented; it remains to be demonstrated

that state-of-the-art models would produce

TMI-2 predictions that are in agreement with

the intact end-state of the TMI-2 lower head.

Lower head failure predictions for

hypothetical severe accidents are even more

problematic. Details regarding plant-specific

lower head thickness and contour variations,

welds, and penetrations are seldom available

to severe accident analysts, and the ability to

model debris relocation from the core region

to the lower head, the resulting debris

configuration, the composition and

properties of the debris, and the associated

heating rates and patterns is quite limited.

Finally, as discussed in Section 3.5.8,

quenching mechanisms that could prevent

lower head failure if water is present or

reintroduced are poorly understood.

One thing is certain: if water is unavailable,

or if lower head damage proceeds too far

before water is reintroduced, lower head

failure due to creep can occur.

3.5.8 Debris Coolability

Debris cooling experiments performed before

the TMI-2 reactor pressure vessel

investigations did not focus on water cooling

of molten debris. Instead, they focused on

determining conditions under which water

covered beds of internally heated solid

particles reach dryout. Dryout occurs when

debris to coolant heat transfer rates are high

and steam flow rates out of the debris bed

prevent sufficient water from reaching the

bed interior as illustrated in Figure 3.5-19.
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-8 NUREG/CR-6042 Rev. 2

Such experiments and models developed

from them indicate some key factors

affecting the coolability of debris beds.11

These factors include the bed power, the bed

configuration, and particle sizes. The higher

the power generated in a bed, the more

difficult the bed is to cool. The bed power

at which some part of a flooded bed drys out

is called the dryout power. If flooded from

above, deeper debris beds tend to be less

coolable than shallow debris beds of the

same volume. 

Figure 3.5-20 shows the impact of particle

size on the dryout heat flux (dryout power

divided by top surface area of the bed) for

beds flooded from above.12 In beds of

smaller particles, the surface area for heat

transfer is larger, and therefore the vapor

generation rates are increased relative to

water ingress rates. Many particle sizes are

possible during a severe accident, ranging

from fractions of millimeters up to

centimeter size and larger. There is no one

exact particle size that defines a threshold

for coolability. However particle sizes of a

few millimeters and smaller, which could

result from steam explosions (see Section

3.6), are most likely to be noncoolable.

A deep bed, sufficiently small or stratified

particle sizes, and/or a small coolant fraction

could produce dryout in the bed even after it

is initially quenched.13 Forced circulation

of coolant through some possible

configurations of in-vessel debris would be

required to prevent dryout. Maintaining

forced circulation was considered to be of

paramount importance once it was reestablished at TMI-2.

Even with forced circulation, melting in the

interior of a large debris bed could occur,

and quenched or partially quenched debris

could remelt even with forced circulation.

Natural processes (such as capillary flow)

tend to cause a melting debris bed to

crumble. That is, melt flows through the

open porosity toward the debris bed

boundary where it freezes and forms a crust.

If the crust is a poor conductor (e.g., an

oxide), then very little of the energy is

transferred out of the bed. A molten pool

would form and very high temperatures

could be attained in the melt. Upward

radiative heat transfer could cause melting

of vessel upper internal structures, which

would fall and increase the metallic content

of debris in the lower head. Models have

been developed to analyze debris bed

heatup, remelting, and lower head

response.14

Cooling of lower head debris at TMI-2 may

have occurred in two ways. To explain why

temperatures surrounding the hot spot were

low enough to preclude local failure, a slow

cooling mode has been postulated in which

channels or cracks in the debris allowed for

infusion of water that cooled the debris near

the channels but left interior portions hot.

To explain the cooling rates observed in the

metallurgical samples a rapid cooling mode

has been postulated in which gaps or

channels between the lower debris crust and

the lower head allowed relatively high flow

rates of coolant to the hot spot. Water

ingress between the lower crust and the

vessel might be facilitated by deformation of

the lower head; however, there were no

observable deformations in the geometry of

the TMI-2 lower head.

A mass-energy balance on the reactor

coolant system was performed based on

plant data regarding letdown, relief valve,

and makeup flow rates following the molten

pour. The results, though not precise,

confirm that a decrease in debris internal

energy occurred in the 2 hours following the

molten pour. This supports the hypothesis

that debris cooling occurred at a rate faster

than indicated by the physical appearance of

the debris samples.8
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-9 NUREG/CR-6042 Rev. 2

Even if one accepts the unanticipated

cooling mechanisms that seem to have

occurred at TMI-2, more debris in the lower

head, hotter debris in the lower head, failure

to keep the debris covered by water, or late

introduction of water can lead to global or

local temperature-induced failure of the

lower head in hypothesized severe accidents.

3.5.9 Advanced Design Concepts

Several studies have been conducted to

examine the potential for maintaining core

and structural debris within the reactor

vessel by flooding the containment to the

extent that water covers the outer surface of

the lower portion of the reactor vessel.15,16,17

In general, experiments have shown that the

required wall cooling could be accomplished

without departure from nucleate boiling at

the outer wall surface.16,17 Nevertheless,

there are many practical difficulties from the

standpoint of providing the volume of water

that would be necessary to invoke this

strategy in an assured and timely manner

because existing plants were not designed to

provide such a flooding capability (see also

Section 3.7.7).

Advanced designs such as the Westinghouse

AP600 have implemented design features

aimed at assuring in-vessel retention of

molten debris. First steps have been taken

to allow vessel depressurization thereby

decreasing the differential pressure loads

imposed on the lower head. Second, the

lower head has been designed without

penetrations so failure mechanisms

associated with such penetrations are

precluded. Finally, the reactor cavity can be

flooded with water, so that heat transfer

through the lower head to surrounding water

can be used to prevent lower head failure

due to creep rupture.18
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-10 NUREG/CR-6042 Rev. 2

Table 3.5-1 Average TMI-2 Lower Head Debris Composition by

 Quadrant (wt%)a

Element Southeast Southwest Northeast

Original

TMI-2 Coreb

U

Zr

In

Cr

Fe

Mn

Ni

72.3

14.1

0.28

0.33

0.74

0.03

0.099

70.8

15.2c

0.52

0.93

0.28

0.81

68.2

15.2c

0.52

0.93

0.028

0.10

65.8

18.0

0.3

1.0

3.0

0.8

0.9

Totald 87.8 84.3 85.1 92.14

a Extracted from Reference 1, which cautions that because of the small number of samples

examined these data should be used with caution.

b Composition of original TMI-2 core is computed in Reference 1. c Below analytic detection limit. Elements Sn, Ag, Al, Mo, and Nb were also below their

analytic detection limits. Detection limits vary from element to element; however, a

nominal value is approximately 0.1 wt%.

d The total is for measurable constituents. Oxygen was not measured.
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-11 NUREG/CR-6042 Rev. 2

Figure 3.5-1 Final TMI-2 debris configuration
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-12 NUREG/CR-6042 Rev. 2

Figure 3.5-2 TMI-2 structures surrounding the core
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-13 NUREG/CR-6042 Rev. 2

Figure 3.5-3 Fuel deris profile inside TMI-2 core barrel

assembly (CBA laid flat)
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-14 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-15 NUREG/CR-6042 Rev. 2

Figure 3.5-4 TMI-2 core support assembly
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-16 NUREG/CR-6042 Rev. 2

Figure 3.5-5 Locations of solidified materialin TMI-2 core support

assembly
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-17 NUREG/CR-6042 Rev. 2

Figure 3.5-6 Locations of solidified material TMI-2 elliptical flow

distributor
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-18 NUREG/CR-6042 Rev. 2

Figure 3.5-7 TMI-2 hard layer debris depths in lower head
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-19 NUREG/CR-6042 Rev. 2

Figure 3.5-8 TMI-2 lower-head cross section of hard debris, row 7

 Figure 3.5-9 Visualization of the downward progress of a coherent

molten mass as the below-core structures weaken
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-20 NUREG/CR-6042 Rev. 2

Figure 3.5-10 Cross-sectional views of TMI-2 hard layer debris sample 

1-11-R

 (a) Longitudinal section

(b) Transverse section
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-21 NUREG/CR-6042 Rev. 2

Figure 3.5-11 Scanning electron microscope image of two phase region

in TMI-2 hard layer debris sample
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-22 NUREG/CR-6042 Rev. 2

Figure 3.5-12 TMI-2 nozzle damage profile

Figure 3.5-13 Location of lower-head steel, nozzle, and guide tube samples
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-23 NUREG/CR-6042 Rev. 2

Figure 3.5-14 As-removed appearance of six TMI-2 nozzles
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-24 NUREG/CR-6042 Rev. 2

Figure 3.5-15 Schematic of sample taken from TMI-2 lower head
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-25 NUREG/CR-6042 Rev. 2

Figure 3.5-16 Lower-head hot spot and nozzle guide tube locations
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-26 NUREG/CR-6042 Rev. 2

Figure 3.5-17 Failure mechanism considered in TMI-2 analyses:

(a) tube rupture

(b) weld failure–tube ejection

(c) global vessel failure, and

(d) localized vessel failure
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-27 NUREG/CR-6042 Rev. 2

Figure 3.5-18 Pictorial summary of the completed lower head failure gests

(Figure ES-1 of NUREG/CR-5582, SAND 98-2047)
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-28 NUREG/CR-6042 Rev. 2

Figure 3.5-19 Typical debris bed dryout experiment
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-29 NUREG/CR-6042 Rev. 2

Figure 3.5-20 Debris bed dryout heat flux versus particle diameter for

water
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-30 NUREG/CR-6042 Rev. 2

References for Section 3.5

1. J. R. Wolf, D. W. Akers, and L. A.

Neimark, “Relocation of Molten

Material to the TMI-2 Lower Head,”

Nuclear Safety, Vol. 35(2), 269-279,

July-December 1994.

2. V. R. Fricke, “Quick-Look Inspection

Results,” GPU Technical Report

TPO/TMI-026, Rev. 0, December 1982.

3. D. W. Akers and B. K. Schuetz,

"Physical and Radiochemical

Examinations of Debris from the TMI-2

Lower Head," Nuclear Safety, Vol. 35,

No. 2, July-December 1994.

4. G. E. Korth, "Peak Accident

Temperatures of the TMI-2 Lower

Pressure Vessel Head," Three Mile

Island Reactor Pressure Vessel

Investigation Project Achievements and

Significant Results, Organisation for

Economic Co-operation and

Development, Paris, France, October

1994.

5. D. R. Diercks and G. E. Korth, "Results

of Metallographic Examinations and

Mechanical Tests of Pressure Vessel

Samples from the TMI-2 Lower Head,"

Nuclear Safety, Vol. 35, No. 2, 301-

312, July-December 1994.

6. F. A. Kulacki, “Estimates of Failure

Time for LWR and LMFBR Vessels

Following a Core Meltdown Accident,”

Ohio State University, Department of

Mechanical Engineering, USNRC

contract AT-(49-24)-0149 Report,

February 1976.

7. Commonwealth Edison Company,

"Zion Probabilistic Safety Study,"

Chicago, IL 1981.

8. D. R. Diercks and L. A. Neimark,

“Results of Mechanical Tests and

Supplementary Microstructural

Examinations of the TMI-2 Lower

Head Samples,” NUREG/CR-6187

(ANL-94/8) [TMI V(93)AL02], June

1993.

9. J. Rempe, L. Stickler, S. Chavez, G.

Thinnes, R. Witt, and M. Corradini,

"Margin-to-Failure Calculations for

the TMI-2 Vessel," Nuclear Safety,

Vol. 35, No. 2, July-December 1994.

10. T. Y. Chu, M. M. Pilch, J. H. Bentz,

J. S. Ludwigsen, W-Y Lu, and L. L.

Humphries, "Lower Head Failure

Experiments and Analyses,"

NUREG/CR-5582, SAND98-2047.

11. R. J. Lipinski, "A Coolability Model

for Postaccident Nuclear Reactor

Debris," Nuclear Technology, 65, pp.

53-66, 1980.

12. R. Lipinski, "Debris Bed Dryout,"

Appendix 3.2-B of Thermal-Hydraulic

Process Modeling in Risk Analysis: 

An Assessment of the Relevant

Systems, Structures, and Phenomena,

NUREG/CR-3986, SAND84-1219,

August 1984.

13. K. R. Boldt et al., "SNL-LWR Severe

Core-Damage Phenomenology

Program, LWR Degraded Core

Coolability Program, Vol. 2,"

NUREG/CR-2725, SAND82-1115.
Reactor Safety Course (R-800) 3.5 Molten Pours onto the Lower Head

USNRC Technical Training Center 3.5-31 NUREG/CR-6042 Rev. 2

14. S. A. Hodge, C. R. Hyman, R. L.

Sanders "BWR Lower Plenum Debris

Bed (BH) Package Reference

Manual," MELCOR Computer Code

Manuals, NUREG/CR-6119,

SAND93-2185, Vol. 2, March 1995.

15. S. A. Hodge, J. C. Cleveland, T. S.

Kress, and M. Petek, “Identification

and Assessment of BWR In-Vessel

Strategies,” NUREG/CR-5869,

ORNL/TM-12080, October 1992.

16. R. E. Henry and H. K. Fauske,

"External Cooling of a Reactor Vessel

Under Severe Accident Conditions,"

Nuclear Engineering Design, 139, 

pp. 31-43, 1993.

17. R. E. Henry et al., "Cooling of Core

Debris Within the Reactor Vessel

Lower Head," Nuclear Technology,

101, pp.385-399, 1993.

18. T.G. Theofanous and M.L. Corradini,

“The containment of Severe Accidents

in the Advanced Passive Light Water

Reactors,” Agenzia Nazionale per la

Protezione del'Ambiente, March 1995.
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-1 NUREG/CR-6042 Rev. 2

3.6 In-Vessel Fuel-Coolant Interactions

When molten core material (fuel) comes into

contact with liquid water (coolant), a variety

of dif ferent fuel-coolant interactions (FCIs)

can occur . The FCIs can range from

quiescent boiling to explosive fragmentation

of the fuel with rapid steam generation. An

explosion caused by the rapid fragmentation

of fuel and vaporization of water due to heat

transfer from the fragmented fuel is called a

steam explosion. If the melt contains

unoxidized metals, exothermic metal-water

reactions can accompany the fuel coolant

interaction, resulting in enhanced ener gy

release and the generation of hydrogen. The

nature of the FCI determines the rates of

steam and hydrogen production and the

potential for damaging the reactor vessel or

containment building. Much theoretical and

experimental research has been devoted to

FCIs over the last three decades. This

research is summarized in several review

articles.

1,2,3,4,5

3.6.1 Steam Explosions

Steam explosions occur when heat is

transferred from the melt to water on a very

short time scale (approximately 1 msec.).

Steam explosions have occurred ever since

man began to work with molten metals. The

first known written record of such an

explosion appears in the Canterbury T ales of

the 14th century .

6 Destructive steam

explosions have occurred in aluminum, steel,

and copper foundries; arc-melting facilities;

paper mills; granulation plants; and (some

believe) Chernobyl.

7,8,9,10,11

The four major stages of a steam explosion

are:

1. Initial coarse mixing of melt and

water during which heat transfer is

generally characterized by stable

film boiling (Figure 3.6-1),

2. a triggering event that causes

local destabilization of film

boiling and local fragmentation of

melt into small drops, on the order

of 0.01 to 0.1 mm in diameter ,

3. propagation of the region of

rapid heat transfer through the

coarse mixture, and

4. explosive expansion driven by

steam at high pressure.

In the absence of a triggering event, a

nonexplosive FCI would occur . Coarse

mixing would result in some quenching of

the melt with associated steam and hydrogen

production.

3.6.2 Conditions Affecting S team

Explosions

The probability and magnitude of steam

explosions depend on various initial and

boundary conditions, including:

• mass, composition, and temp-erature of

the molten material,

• water mass, depth, and temperature,

• vessel geometry , degree of confinement,

and the presence and nature of flow

restrictions and other structures,

• fuel-coolant contact mode, in particular ,

for melts poured into water , the melt

entry velocity and pour diameter ,

• the ambient pressure,
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-2 NUREG/CR-6042 Rev. 2

• the timing and strength of any external

trigger that might be applied (e.g. in an

experiment, not a reactor accident).

Intermediate conditions that strongly

influence the probability and magnitude of

steam explosions include:

• the extent of coarse mixing (drop sizes

and surface areas),

• the rate of heat production by the

exothermic oxidation of molten metals

and partially oxidized materials by the

surrounding coolant, and

• the occurrence, timing, and strength of a

spontaneous trigger (see below).

During mixing, some of the molten drops

may spontaneously fragment into much

smaller drops, on the order of 0.01 to 0.1

mm in diameter . This local fragmentation

event is generally called a trigger . It may be

produced by natural oscillations in the vapor

film about the drop leading to fuel-coolant

contact, or it may be induced by shock

waves from falling objects, contact of the

fuel with the bottom surface, entrance of the

fuel into a region of colder water , or by

turbulence generated in part of the mixing

region. If the fragmentation is rapid enough,

local shock waves can be produced, which

can cause neighboring drops to fragment. If

such a chain reaction escalates, a steam

explosion can result.

Steam explosions can occur for a variety of

high-temperature molten materials including

uranium and its oxides. Spontaneous (no

external trigger) steam explosions have been

observed for aluminum, iron, tin, and

associated oxides in all possible contact

modes including melt pours, stratified water

over melt, and reflooding. High ambient

pressure and low water subcooling have been

shown to reduce the probability of

s p o n t a n e o u s st e am e x p l o si o n s a t

experimental scales; however , explosions can

still occur if the necessary triggers are

available.

Experimentally measured conversion ratios

(the work done divided by the thermal

ener gy available) range from zero to values

approaching the thermodynamic limit.

Explosion pressures have been measured

over the range of tens of bars to 2 kilobars.

Steam explosion computer codes have

predicted that pressures of many kilobars are

possible for strong steam explosions.

Significant rates of hydrogen production

have been observed for both explosive and

nonexplosive interactions. Much finer

fragments produced in explosive interactions

can potentially lead to more rapid production

of steam and hydrogen. The actual hydrogen

production rate, however , is a result of two

competing processes. The lar ge surface-to

volume ratio of the molten drop tends to

increase the rate of heat transfer from the

drop to water , but it also tends to increase

the rate of exothermic oxidation, which adds

ener gy to the drop and hot hydrogen gas to

the vapor film surrounding the drop. The

occurrence of a steam explosion as opposed

to a nonexplosive interaction is generally

thought to favor increased hydrogen

production, especially when the melt is

metallic as in foundries.

3.6.3 Limitations on In-V essel FCIs

A rough estimate of the potential for ener gy

release from in-vessel FCIs (excluding Zr

oxidation) can easily be computed by

calculating the ener gy that would have to be

transferred to water in order to quench the

entire core. For example, a typical PWR

core might contain 10

5

kg of UO 2 and

2×10

4

kg Zr . Assume that all of this
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-3 NUREG/CR-6042 Rev. 2

material (plus 10

4

kg Fe to allow for

structural material in the melt) is liquefied

at 4712°F (2600°C = 2873K), below the

UO2 melt temperature of 5180°F (2860°C

= 3133K). The decrease in sensible and

latent heat required to quench this melt

to 212°F (100°C = 373K), which is the

saturation temperature for water at

atmospheric pressure is approximately 170

GJ (a steam explosion of 1 to 1.5 GJ could

fail the reactor vessel lower head). A 170

GJ steam explosion would require the

evaporation of approximately 75,000 kg or

75 m

3

of saturated water at atmospheric

pressure.

In reality , the ener gy transferred from core

materials to residual water would be less

than 170 GJ for two reasons:

1. The volume of residual in-vessel

water would be limited, in the

absence of ECC restoration, and

2. lower melt temperatures and/or

higher in-vessel pressures, which

would be anticipated in most

severe accident scenarios, would

r e d u c e t h e t e m p e r a t u r e

difference between molten core

materials and residual in-vessel

water .

Figure 3.6-2 illustrates the limited capacity

for in-vessel FCI ener gy releases at

various pressures in a PWR if the residual

water is limited to 29 m

3

, which is

approximately the volume below the lower

core plate of a W estinghouse PWR.

Table 3.6-1 shows the corresponding

limitations of the mass of core material

that could be quenched.

12

In general,

BWR lower plenums are lar ger and hold

more water relative to the mass of the

core. Considerations with respect to the

potential for debris quenching in a BWR

lower plenum are discussed in Section

3.7.6.

Reactor vessel lower plenums, particularly

in BWRs, contain significant quantities of

structural materials as illustrated in Figures

3.1-5 and 3.1-9. Such structures could

restrict the volumes of melt and/or water

participating in FCIs at a given time. T able

3.6-2 provides some data on features and

geometry that characterize these flow

restrictions.

13

It should be noted that the preceding

estimates ignore the potential contribution to

FCI ener gy releases associated with

oxidizing metallic Zr contained in the melt.

As noted in Subsection 3.3, quantities of

unoxidized zirconium are likely to be

involved in the core-liquefaction processes.

Mixing of this metallic phase at high

temperatures with the water in the lower

plenum would promote rapid oxidation of

the zirconium, depending primarily upon the

degree to which fragmentation of the melt

provides lar ge increases in the interfacial

surface area. The heat of reaction for Zr

oxidation is approximately 6.5 MJ/kg of Zr

reacted. If only 1% of the Zr typically

contained in a PWR core (2×10

4

kg) were

oxidized during in-vessel FCIs, an additional

1.3 GJ would be released. Regardless of the

exact outcome, the addition of reaction

ener gy and liberation of a quantity of

hydrogen by the oxidation of zirconium

during the melt-water interaction phase

seems likely .

3.6.4 In-Vessel FCI Scenarios

In assessing the impact of in-vessel FCIs on

accident progression, three alternative

scenarios can be postulated:
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-4 NUREG/CR-6042 Rev. 2

1. No steam explosion but violent

boiling, which may partially or

totally quench the core debris,

depending on the quantity of water

available and the agglomeration of

the debris.

2. One or more relatively low-yield

s t e a m e x p l o s i o n s a n d

nonexplosive quenching until the

whole of the molten mass of fuel

has been fragmented or all of the

water evaporates.

3. A lar ge steam explosion involving

a significant fraction of the melt,

triggered either spontaneously or

by a low-yield steam explosion.

Because of the resultant disruption (and

possible dispersal) of internal structures and

residual core materials, the occurrence of

even a relatively low-yield steam explosion

could significantly alter the subsequent

progression of damage.

3.6.5 Alpha Mode Containment Failur e

Ener getically , it is possible that a lar ge

in-vessel steam explosion could cause (a)

breach of the reactor vessel,

14

or (b) breach

of the reactor vessel and generation of

containment-failing missiles.

15 Either event

would completely alter the course of the

accident by causing the immediate ejection

of fuel and fission products from the reactor

vessel. The second would result in nearly

simultaneous venting of the containment.

The possibility of these events accounts for

the nil minimum duration for S tage 5 given

in Table 3.1-1.

The Reactor Safety S tudy (RSS) first

identified the possibility that a lar ge-scale

in-vessel steam explosion could result in

containment failure. This is commonly

referred to as the alpha mode of containment

failure. The RSS took the alpha mode

failure probability to be 0.01, although the

uncertainty in this probability was

acknowledged by also providing a

pessimistic estimate of 0.1.

12

Since the RSS, there has been considerable

experimental research performed on

fuel-coolant interactions at small to

intermediate scales (50 mg to 157 kg). Early

experiments investigated steam explosion

efficiencies and various aspects of triggering

in geometries that were open to the

atmosphere. This early work is summarized

in three review papers.

2,3,4

A 1984 study showed that conversion ratios

less than 5.3% and masses of actively

participating molten core less than 5000 kg,

as suggested by several mixing models,

16,17

imply an alpha mode failure probability of

0.0001 or less. However , some ar gued that

the possibility of lar ger conversion ratios or

larger masses actively participating could not

be excluded and that the uncertainty in the

alpha-mode containment failure probability

was therefore lar ge.

18

In 1985 the first NRC-sponsored S team

Explosion Review Group (SERG-1) assessed

the probability of alpha mode failure for

NUREG-1 150.

19 The SERG-1 pessimistic

failure probability was 0.1, unchanged from

the pessimistic estimate of the RSS. The

NUREG-1 1 5 0 a l p h a mo d e f a i l u r e

probabilities are listed in T able 3.6-3.

NRC-funded FCI research after the initial

SERG-1 workshop sought to enhance the

technical basis of the alpha mode failure

estimates given by the experts, and reduce

uncertainties in the estimates. Numerous

experiments were conducted from 1985

through 1995 in both U.S. and European

facilities. A review of these experiments is
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-5 NUREG/CR-6042 Rev. 2

provided in a recent paper .

5 The

experiments demonstrate that steam voiding

around hot debris particles causes the mixing

region to be depleted of water in part as a

result of its vaporization due to rapid meltto-coolant heat transfer , and, in part due to

displacement of remaining water mass away

from the interfacial region. Depletion is

even more pronounced in the case of

adjacent simultaneous pours as occurred

through multiple holes in the elliptical flow

distributor at TMI-2.

In June 1995 the NRC convened the SERG-2

workshop to reassess the alpha mode failure

issue and to evaluate the current

understanding of other FCI issues of

potential risk significance. As illustrated in

Table 3.6-4, all but two of the 1 1 SERG-2

experts concluded that the alpha mode

failure issue is essentially resolved, meaning

that this mode of failure is of very low

probability , that it is of little or no

significance to the overall risk from nuclear

power plants, and that further research not

likely to change this conclusion.

The SERG-2 experts based their judgements

regarding the likelihood of alpha mode

failure lar g e l y o n e x p e rime n t a ll y

substantiated ar guments favoring limits to

mixing. There is a consensus among the

experts that the triggering process is poorly

understood due lar gely to its inherently

random nature. Assumptions regarding

triggering under accident conditions tend,

therefore, to be conservative. T riggering is

postulated at the worst time during

premixing, leading to trigger amplification or

shock wave propagation.

It should be emphasized, however , that in

experiments performed with prototypic

reactor melts interacting with saturated to

subcooled water at an ambient pressure of

nominally 0.1 MPa, only one or two cases

exhibited weak steam explosions either at

high melt-to-coolant volume ratios or at high

subcooling, and only when an external

trigger was used. In contrast, many more

cases using iron-alumina thermite and iron

oxide as melt simulants produced strong

steam explosions at a wide range of melt-tocoolant volume ratios, much lower

subcooling to almost saturated conditions,

with or without trigger .

3.6.6 Vessel Br each by an In-V essel

Steam Explosion and Related Issues

The steam-explosion ener gy required to fail

the bottom head of a PWR has been

estimated to be between 1 GJ and 1.5 GJ.

That is, a steam explosion need not involve

large quantities of melt or water in order to

yield such ener gies. In one study of PWR

in-vessel steam explosions, failing the

bottom head by an in-vessel steam explosion

was found to be much more likely

(probability of 0.2 versus 0.0001) than alpha

mode failure.

8 Figure 3.6-4 illustrates this

mode of vessel breach, which has the

potential for driving particulate debris from

the reactor cavity , resuspending radioactive

aerosols previously plated out within the

reactor coolant system, and forming

additional aerosols during the explosion.

Steam explosion research is currently under

way at several research facilities to address

several issues including the possibility of

lower head failure due to an in-vessel steam

explosion, the potential for significant

structural damage due to a steam explosion

in the reactor cavity (see Section 4.3),

pressure suppression ef fects on triggering,

and ef fects of melt composition and meltcoolant-confinement geometry on both

triggering and ener getics of steam

explosions. T able 3.6-5 provides summary

information on four current steam explosion

research facilities.

5
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-6 NUREG/CR-6042 Rev. 2

The current level of understanding of the

propagation phase of a steam explosion is

adequate for estimating the net ener gy

transfer to the coolant and hence, estimating

the alpha mode failure probability .

Understanding of shock loading of lower

head and reactor cavity structures requires

more rigorous treatment for which detailed

two or even three-dimensional propagation

phase models may be required.

3.6.7 Impact of Melt Discharge fr om

Vessel

Four modes of dischar ge of core materials

from the vessel can be postulated:

1. Massive failure of the vessel by

an in-vessel explosion,

2. a pressure-driven melt jet,

3. gravity-driven pour of a lar ge

molten mass,

4. continuous dripping of core

materials not involved in the

initial release.

These modes of melt dischar ge are depicted

in Figures 3.6-4 through 3.6-7.

The mode of vessel breach can strongly

influence the timing and nature of potential

loads imposed on containment. In 1984, the

NRC sponsored Containment Loads W orking

Group identified the fact that pressurized

dispersal of high-temperature melt into

containment at the time of vessel breach

(Figure 3.6-5), could result in rapid direct

heating and exothermic chemical reactions

within the containment atmosphere and pose

a severe threat to containment integrity . On

the other hand, if the vessel is depressurized,

molten material would simply flow into the

reactor cavity by gravity (Figure 3.6-6),

although if water were present in the reactor

cavity significant loads on containment could

result from ex-vessel fuel coolant

interactions or from the additional hydrogen

generated in such interactions. In general,

BWR containment drywells are relatively

small, and, hence, special procedures are

provided to assure that the reactor vessel

would be depressurized under severe

accident conditions.

The initial geometry and potential for

cooling of ex-vessel debris, as well as the

nature of interactions between core materials

and concrete, are strongly influenced by the

mode of vessel breach. The mode of melt

dischar ge into containment also has a strong

influence on the resulting concentrations of

fission products, particularly in aerosol form,

in the containment. Ex-vessel phenomena

are discussed in Module 4.

Following either a pressurized ejection or a

gravity-driven pour of melt from the vessel,

a significant fraction of core materials may

remain unmelted in the core region. W ithout

coolant, much of this material may

subsequently melt and drop out of the vessel

in small amounts over a period of hours.

This mode of dischar ge is illustrated in

Figure 3.6-7. If there is water below the

vessel, the dripping mass may prolong

ex-vessel fuel-coolant or core-concrete

interactions. If the hot leg or sur ge line had

failed earlier natural circulation could be

established with flow from the reactor cavity

up through the reactor vessel and out the

failed pipe. The ingress of air from

containment following vessel breach could

cause additional exothermic oxidation of hot

in-vessel debris. This would, in turn, lead to

additional releases of radionuclides to

containment. All such possibilities would

affect the magnitude of the radiological

release given late containment failure.
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-7 NUREG/CR-6042 Rev. 2

Table 3.6-1 Fractions of cor e mixtur e

*

that can be quenched in

below-cor e water for a typical PWR

**

Saturated W ater Pressure

Atmospheric 800 psia

(5.5 MPa)

1595 psia

(11 MPa)

2465 psi

(17 MPa)

T = 2700

oF

(1500

oC)

No Freeze

0.79 0.44 0.31 0.17

T = 3600

oF

(2000

oC)

No Freeze

0.59 0.33 0.23 0.13

T = 4500

oF

(2500

oC)

Freeze

0.37 0.21 0.14 0.08

*

10

5

kg UO 2 + 2×10

4

kg Zr + 10

4

kg steel

**

in 29 m

3

of water

Table 3.6-2 Lower plenum featur es of a W estinghouse PWR

Featur e

Appr ox.

Thickness

(mm)

Water Volume

to Next Featur e

(m3)

Energy to

Evaporate W ater

(GJ)

**

Lower Core Plate 50 6.6 4.6

Diffuser Plate 37 14.1

*

9.8

Bottom Support Plate 220 7.7

*

5.4

Reactor V essel Bottom 132 0 --

* Ratio of these two volumes approximate; sum (21.8 m3

) is volume of lower hemisphere.

** Based on a pressure of 2500 psia (17.2 MPa).
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-8 NUREG/CR-6042 Rev. 2

Table 3.6-3 NUREG-1 150 alpha mode failur e probabilities

Plant

System

Pressur e

Lower

Bound Mean

Upper

Bound

BWRs Grand Gulf High

Low

0

0

1.0×10

-3

1.0×10

-2

0.1

1.0

Peach

Bottom

High

Low

1.0×10

-8

1.0×10

-7

1.0×10

-3

1.0×10

-2

0.1

1.0

PWRs Sequoyah High

Low

0

0

8.5×10

-4

8.5×10

-3

0.1

1.0

Surry High

Low

0

0

9.1×10

-4

9.1×10

-3

0.1

1.0
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-9 NUREG/CR-6042 Rev. 2

Table 3.6-4 Alpha mode failur e pr obability estimates (given a cor e

melt accident)

Participant SERG-1

a

(1985)

SERG-2

(1995)

View on S tatus of Alpha Mode

Failur e Issue

Bankof f < 10

-4 < 10-5 Resolved from risk perspective

Berthoud -- < 10

-3 No statement on resolution

Cho < RSS

a < 10-3 Resolved from risk perspective

Corradini 10

-4

- 10

-2 < 10-4 Resolved from risk perspective

Fauske Vanishingly

small

Vanishingly

small

Resolved from risk perspective

Fletcher -- < 10

-4 Resolved from risk perspective

Henry -- Vanishingly

small

Resolved from risk perspective

Jacobs -- Probably low

likelihood

Not resolved from risk

perspective

Sehgal -- < 10

-2 Resolved from risk perspective

Theofanous < 10

-4 Physically

unreasonable

Resolved from risk perspective

Turland -- < 10

-3 Resolved from risk perspective

a Reactor Safety S tudy (RSS) best estimate 10-2

; NUREG-1 150 consensus estimate

10

-2

at low reactor coolant system pressure, 10

-3

at high reactor coolant system

pressure.
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-10 NUREG/CR-6042 Rev. 2

Table 3.6-5 Fuel coolant interaction experimental facility

characteristics

Facility FARO KROTOS WFCI ZREX

Location Joint Research Center ,

Ispra

The University of

Wisconsin

Argonne National

Laboratory

Areas of

Interest

Premixing, quenching,

propagation, ener getics,

and debris coolability

Conditions

favoring and

suppressing

ener getic FCI

Chemical

augmentation of FCI

due to metals in the

melt

Test Section

Diameter

(cm)

4.7 - 15 0.95 - 2.0 0.87 - 2.0 1.0

Melt Jet

Diameter

(cm)

1 0.3 - 0.5 0.3 0.25 - 0.5

Water Depth

(cm)

50 - 200 1000 1000 1000

Pressure

(MPa)

0.1 - 5.0 0.1 - 1.0 0.1 0.1

Melt UO2

-ZrO 2

w/ & w/o

Zr and

stainless

steel (SS)

UO2

-ZrO 2

or

Al 2O3

Sn, FeO, or

Fe 3O4

Zr

w/ or w/o

ZrO2

Melt Mass

(kg)

18 - 250 1.4 - 6.0 0.8 - 4.5 0.2 - 1.0
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-11 NUREG/CR-6042 Rev. 2

 	
 
  
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-12 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-13 NUREG/CR-6042 Rev. 2

 	
         
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-14 NUREG/CR-6042 Rev. 2

Figure 3.6-4 Vessel failure from steam explosion
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-15 NUREG/CR-6042 Rev. 2

 	
       

 
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-16 NUREG/CR-6042 Rev. 2

Figure 3.6-6 Low pressure melt release from bottom of reactor vessel
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-17 NUREG/CR-6042 Rev. 2

 	
! "#     $ 
% &

  
Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-18 NUREG/CR-6042 Rev. 2

&  " 	


	 
 
 

   	  

  !!	 "	 #$%"#&	

'&(

") 	  	 


 *  ! + , 

-  .  ) !	


!  / !.	 ""01	

%2	 '&&

() 	 
 *, 

-  *   

.	 / 3.	 ("0(1	 

((2%(4"	 ''

56 77	 
 -  

8 9    !!!

3!   3 *	 /

3.	 ($01	 (4%$2	 ''5

$3:  
3	 
 -

 %  07 91

  /	 
!  

"( +  3. 9 

) !	 "	 &2%"#	 ; 8

"(%"$	 ''$

4< 	 
 = > =

	  8. 	 <  .


8!  .	 9	 < 

.	 /->?	 '(5

2) : 	 
 .  

7%6 .  ) !  -%



!! *	 +? 

   
 ) %+

9  	 3  / 

 8	 8  	 / -

) *	 @. "'	 '&&

&) :   	 
8., +

6  + <  7 A	 6 

3 * 8.	


!   %8.%

  	 /  
8	

) < -%A	 /- >?	 /- >?	

3 8 "'%; 8 2	 '&4

'+3-	 
8.	 + .

A	 !. -	 

5(%$"	 @.	 '&'

#7	 
8. % 

9! B / /-	

6  8 '&2

+ 8!	 


6     C!

 ! )  7%

9	 / 3.	 ""0(1	

('%((2	 ) .%@ '&#

"@:  	 
9 

3  C 	

/C < D%(55#	 3/6 &(%4&'	

3 8 '&5

(@:	 
-  9%

) - ) 	 /C  < D%

5'(	 3/6 &#%#5$$	 @. '&#

5@A<   	 

+ 6 !

  .	 / 6 %%4#031	

C  E!   !.

.	 3!	 CE	 '&"

$C 3 /     ! .

  	 
 3. 3.

%      ?

 C3   / 
-


	 +3A %5##	 / C  < %

2$D#5	 ; 8 '2$Reactor Safety Course (R-800) 3.6 In-Vessel Fuel Coolant Interactions

USNRC Technical Training Center 3.6-19 NUREG/CR-6042 Rev. 2

4<   ) 3	


      '

0%) 1   
+

6  .     3.   	 

/ !! 6 !	 

(#%(("	 '&

2)   < ) 	


 6 .  )   7%

) *!	 
!  

9) !  + 3

 	  8!	

) 	 !'&(

&) : 	 
) % 

9 
! 	 
!

  " +  3.

 9  ) !	 '&5

'C 3 /     ! .

  	 
 -  

  C !  


    7

!  9% 3

 *	 /C < %4	 '&$

"#) : 	 6 3-	  

@+?	 
 C. 3.

 
+ 3 *	

/C < D%((4'	 3/6 &(%5(&	

) . '&5Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-1 NUREG/CR-6042 Rev. 2 

3.7 Special Considerations for BWR

Facilities

Boiling water reactors have unique features

that would cause their behavior under severe

accident conditions to differ significantly

from that expected for the pressurized water

reactor design.1,2 This section addresses

several special considerations affecting BWR

severe accident progression and mitigation.

In this endeavor, many implications of the

phenomena described in Sections 3.1 through

3.6 (such as zirconium oxidation) will be

demonstrated by example. First, however, it

is necessary to review some of the BWR

features pertinent to severe accident

considerations.

3.7.1 Pertinent BWR Features

An important distinction of the BWR design

is that provisions are made for direct

operator control of reactor vessel water level

and pressure. Reactor vessel pressure

control is normally accomplished rather

simply by manually induced actuation of the

vessel safety/relief valves (SRVs) or by

operation of the reactor core isolation

cooling (RCIC) system turbine or, for plants

so equipped, the isolation condenser or highpressure coolant injection system (HPCI)

turbine. Each of these methods relies to

some extent, however, upon the availability

of DC power or control air, which may not

be available under accident conditions. SRV

considerations will be described in Section

3.7.2.5.

All BWR plant designs except Oyster Creek,

Nine Mile Point 1, and Millstone 1

incorporate either the RCIC or HPCI steam

turbine-driven reactor vessel injection

system; the later BWR-3 and all BWR-4

plants have both. These systems can be

used for reactor vessel pressure control when

run continuously in the recirculation mode,

pumping water from the condensate storage

tank back to the condensate storage tank and

periodically diverting a small portion of the

flow into the reactor vessel as necessary to

maintain the desired water level. The steam

taken from the reactor vessel by the turbine

is passed to the pressure suppression pool as

turbine exhaust, which provides a slower

rate of pool temperature increase than if the

vessel pressure control were obtained by

direct passage of steam from the vessel to

the pool via the SRVs. Plants having both

HPCI and RCIC systems can employ the

HPCI turbine exclusively for pressure

control while the RCIC system is used to

maintain the reactor vessel water level. The

HPCI turbine is larger than the RCIC turbine

and, therefore, is more effective for pressure

control. These systems require DC power for

valve and turbine governor control, but have

no requirement for control air.

All BWR-5 and -6 plants are equipped with

an electric-motor-driven high-pressure core

spray (HPCS) system rather than a turbinedriven HPCI system. The HPCS pump takes

suction from the condensate storage tank and

delivers flow into a sparger mounted within

the core shroud. Spray nozzles mounted on

the spargers are directed at the fuel bundles.

As in the case of HPCI, the pressure

suppression pool is an alternate source of

water for the HPCS.

All BWR facilities employ the low-pressure

coolant injection (LPCI) mode of the

residual heat removal (RHR) system as the

dominant operating mode and normal valve

lineup configuration; the RHR system will

automatically align to the LPCI mode

whenever ECCS initiation signals such as

low reactor vessel water level or high

drywell pressure are sensed. LPCI flow is

intended to restore and maintain the reactor

vessel coolant inventory during a LOCA

after the reactor vessel is depressurized,
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-2 NUREG/CR-6042 Rev. 2 

either by the leak itself or by opening of the

SRVs.

All BWR facilities also employ a lowpressure core spray (LPCS) system, which

takes suction on the pressure suppression

pool and sprays water directly onto the

upper ends of the fuel assemblies through

nozzles mounted in sparger rings located

within the shroud just above the reactor

core. With the reactor vessel depressurized,

the automatically-initiated LPCI and LPCS

flows, which begin when the reactor vessel

pressure-to-suppression pool pressure

differential falls below about 2.00 MPa (290

psig), are large. As an example, for a 1065-

MWe BWR-4 facility such as Browns Ferry

or Peach Bottom, the combined flows would

be more than 3.16 m3

/s (50,000 gal/min),

which is sufficient to completely fill an

intact reactor vessel in less than four

minutes. It should be recalled that the

amount of vessel injection necessary to

remove decay heat (by boiling) is only about

0.013 m3/s (200 gal/min).

Eight BWR design features have important

implications with respect to differences

(from PWR behavior) in the expected

response of a BWR core under severe

accident conditions. These are:

1. There is much more zirconium

metal in a BWR core, which

under similar conditions would

increase the amount of energy

released by oxidation and the

production of hydrogen.

Compared with a PWR of the

same design power, a BWR

typically contains about one and

one-half times the mass of UO2

and three times the mass of

zirconium metal (counting both

fuel rod cladding and channel

box walls).

2. The BWR reactor vessel would

be isolated under most severe

accident conditions, due to

closure of the main steam

isolation valves (MSIVs). This

tends to make the BWR severe

accident sequence thermal

hydraulic calculation simpler to

perform, since natural circulation

pathways through external loops

such as hot legs and steam

generators need not be

considered.

3. Because of the marked reduction

in the average radial power factor

in the outer regions of the BWR

core, degradation events would

occur in the central core region

long before similar events would

take place in the peripheral

regions.

4. SRV actuations would cause

important pressure and water

level fluctuations within the

reactor vessel. Operator actions

(mandated by emergency

procedure guidelines) to

depressurize the reactor vessel

would lead to early (and total)

uncovering of the BWR core.

5. Diversity of core structures

(control blades, channel boxes,

fuel rods) would lead to

progressive downward relocation

of different materials from the

upper core region to the core

plate.

6. With early material accumulation

upon its upper surface, the fate of

the BWR core plate determines

whether the initial debris bed

would form within the lower
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-3 NUREG/CR-6042 Rev. 2 

portion of the core or in the

vessel lower plenum.

7. Because there are many more

steel structures in the BWR lower

plenum, BWR debris would have

a much greater steel content.

8. There is a much larger volume of

water (relative to the core

structural volume) within the

lower plenum beneath a BWR

core. If conditions are favorable,

debris relocating from the core

region can be completely

quenched - with sufficient water

remaining to remove decay heat

(by boiling) for several hours

without makeup.

The importance of each of these items will

be elucidated in the discussions of Sections

3.7.2 through 3.7.7. Item 3, however,

deserves special amplification here. Figure

3.7-1 illustrates a typical division of a BWR

core into radial zones for code computation

purposes. This example is based upon the

Browns Ferry Unit 1 core, which comprises

764 fuel assemblies. Since a symmetric core

loading is maintained, the drawing shows

just one-fourth (191 assemblies) of the core.

What should be noted from Figure 3.7-1 is

that the outer 25.1% of the core (sum of

volume fractions for zones 9 and 10) is

characterized by average radial peaking

factors of just 0.670 and 0.354. This

dramatic falloff is illustrated by Figure 3.7-

2, which also indicates the volume-averaged

central region power factor (1.199)

associated with a four-radial-zone code

representation of the core. Because of the

associated reductions in decay heating

beyond the central region of the core,

predicted severe accident events in the

central region lead those in the peripheral

regions by considerable periods of time. For

example, formation and downward

relocations of large amounts of debris are

calculated for the central region before

structural degradation is predicted to begin

in the outermost core region. 

3.7.2 Provisions for Reactor Vessel

Depressurization

The BWR Owners Group Emergency

Procedure Guidelines (EPGs)3

 require

unequivocally that the operators act to

manually depressurize the reactor vessel

should the core become partially uncovered

under conditions (such as station blackout )

characterized by loss of injection capability.

The operators would meet this requirement

by use of the Automatic Depressurization

System (ADS). The following discussions

address why manual actuation of an

“automatic” system is necessary, what is

expected to be achieved by the rapid

depressurization, the status of the core

during the subsequent periods of structural

degradation (if the accident is not

terminated), and the importance of keeping

the reactor vessel depressurized during the

latter stages of the accident.

3.7.2.1 Why Manual Actuation is

Necessary

The most direct means of BWR reactor

vessel pressure control is by use of the

SRVs, which require no outside energy

source for operation as a safety valve but do

require both control air and DC power when

used as a remotely operated relief valve.

This dependence upon the availability of

control air and DC power pertains both to

remote-manual opening of the valves by the

control room operators and to the valveopening logic of the ADS.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-4 NUREG/CR-6042 Rev. 2 

The purpose of the ADS is to rapidly

depressurize the reactor vessel so that the

low-pressure emergency core cooling

systems (ECCS) can inject water to mitigate

the consequences of a small or intermediate

loss-of-coolant accident should the highpressure systems prove inadequate. The

number of ADS-associated SRVs is plantspecific; these valves are signaled to open

automatically if required to provide reactor

vessel depressurization in response to low

reactor vessel water level caused by

transients or small breaks. ADS initiation is

by coincidence of low reactor vessel water

level and high drywell pressure, provided

that at least one of the low-pressure pumps

is running. Recently, a bypass timer

(typically 265 seconds) has been backfitted

to the ADS logic to ensure automatic

actuation of ADS on sustained low water

level even if the high drywell pressure signal

is not present.

There is, however, no timer bypass for the

requirement that at least one of the lowpressure ECCS pumps (RHR or Core Spray)

be running. (The actual signal is derived by

sensing the pump discharge pressure.) This

is reasonable, since a great deal of water is

lost from the reactor vessel when the ADS is

actuated and therefore it is prudent to

require that a replacement water source be

available. As explained in the next Section,

however, it is desirable to actuate the ADS

under certain severe accident situations even

though there is no operating pump. Without

the discharge pressure signal, the ADS must

be actuated manually (operator pushbuttons).

(NOTE: Typically, the ADS timer is

initiated when the reactor vessel water level

is between two and three feet above the top

of the core. Current EPGs direct that the

operators prevent automatic actuation of the

ADS and instead manually initiate this

system when the water level reaches the top

of active fuel. This intentional delay of

ADS for cases when the low pressure pumps

are running is a matter of controversy, and

not all BWR facilities invoke this provision.)

3.7.2.2 Rapid Depressurization for

Steam Cooling

For BWR accident sequences involving

partial uncovering of the core, the EPGs

provide that the operators must take action

to initiate “steam cooling” which, for plants

without isolation condensers, is

accomplished by manually initiating the

ADS. The purpose is to delay fuel heatup

by cooling the uncovered upper regions of

the core by a rapid flow of steam. Because

the source of steam is the remaining

inventory of water in the reactor vessel, the

steam cooling maneuver can provide only a

temporary respite.

In order to illustrate the effects of steam

cooling, let us first consider a case in which

this maneuver is not used. Figure 3.7-3

shows the calculated reactor vessel water

level for a postulated loss of injection

(caused by station blackout and failure of

RCIC) at Grand Gulf. It should be noted

that after falling below the top of active fuel

(TAF), the calculated curve follows the

exponentially decreasing water level

predicted by Figure 3.2-1 until a downward

deviation becomes apparent, near the bottom

of active fuel (BAF). This deviation occurs

because debris relocating from the upper,

uncovered, region of the core is relocating

downward into the water remaining in the

lower portion of the core, accelerating its

boiloff.

Let us now consider the same accident

sequence, but with implementation of the

steam cooling maneuver. Figure 3.7-4

shows the calculated reactor vessel pressure

and water level when the ADS is actuated at
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-5 NUREG/CR-6042 Rev. 2 

about one-third core height (75 minutes after

scram). At this time, there has been no

degradation of the upper core. At Grand

Gulf, 8 SRVs (of 20 total) are associated

with the ADS. The vessel depressurizes

quickly and the accompanying water loss

due to flashing causes the water level to fall

into the lower plenum, well below the BAF

and the core plate. Subsequently, the

flashing ceases, and the remaining water is

significant for debris quenching.

The maximum fuel rod temperature in the

central region of the core is plotted versus

time in Figure 3.7-5, for both cases. The

temperature escalations that occur after time

80 minutes for the case without ADS are

caused by the energy releases associated

with zirconium oxidation. (The dotted lines

on this figure indicate the time at which the

temperature increases above 1832°F

[1273°K]). For the case with ADS

actuation, the temperature decreases

immediately after the valves are opened due

to the effects of steam cooling.

Subsequently, the temperature again

increases, but the time at which the runaway

zirconium oxidation temperature is reached

has been delayed by about 15 minutes. The

differences in hydrogen generation between

the two cases during the period plotted are

substantial, as can be appreciated by a

comparison of the two subplots of Figure

3.7-6.

Table 3.7-1 displays the times associated

with the major events of the accident

sequence for both cases. When the ADS is

actuated, core plate dryout follows

immediately thereafter, and debris begins

relocating from the upper core region at

about time 110 minutes. Without ADS

actuation, debris relocation begins about 23

minutes earlier and before core plate dryout,

which is delayed until time 102.5 minutes.

It is instructive to consider why the first

local core plate failure occurs earlier for the

case with ADS actuation. Recall that the

core plate is dry when debris relocation

begins in this case, so that the hot debris

falls directly on the plate surface. When the

ADS is not actuated, the initial debris

relocations fall into water overlying the core

plate. This initial debris is quenched and

forms a protective layer over the plate.

Later, when water no longer remains over

the plate, failure is delayed until the newly

relocating debris has heated both the plate

and the previously quenched debris.

It is important that the ADS be manually

initiated at the proper time. Too soon means

that reactor vessel water inventory will be

lost without the compensatory benefits

afforded by effective steam cooling. Too

late means that a steam-rich atmosphere will

exist during the onset of runaway metalwater reactions. By procedure, steam

cooling is to be placed into effect when the

“Minimum Zero-Injection RPV Water Level”

is reached. In Revision 4 of the EPGs, this

is defined as the lowest vessel level at which

the average steam generation rate within the

covered portion of the core is sufficient to

prevent the maximum clad temperature in

the uncovered region of the core from

exceeding 1800°F (1255 K). This level is

plant-specific; the basis for its determination

and procedures for its calculation are

described in Appendices to the EPGs.

3.7.2.3 Core Region Dry During Core

Degradation

As explained in the previous section, the

delay in the onset of core damage gained by

use of the steam cooling maneuver is

temporary. Nevertheless, staving off the

onset of core degradation, which otherwise

would begin at about 78 minutes, for an

additional 15 minutes can be significant
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-6 NUREG/CR-6042 Rev. 2 

when trying to regain electrical power or

implement other means of restoring reactor

vessel injection capability. Even if such

efforts are unsuccessful so that the accident

sequence proceeds into core degradation, the

steam cooling maneuver provides the benefit

of assuring that the core region will be

steam-starved when runaway metal-water

reaction temperatures are reached.

When considering severe accident

progression for BWRs, it is extremely

important to recognize that when the

specified procedures are followed, the core

region would be dry during the period of

core degradation. As illustrated in the water

level plot included with Figure 3.7-4,

execution of the steam cooling maneuver

causes the water level to fall below the core

plate. This plot represents the results

calculated when the ADS valves are opened

with the water level at about one-third core

height, but the final level will fall below the

core plate even if this maneuver is initiated

with the water level near the top of the core

(although the achieved fuel temperature

decrease will be much less).

Figure 3.7-7 shows the water level relative

to the core plate immediately after execution

of the ADS maneuver. It should be noted

that some water is trapped in the downcomer

region surrounding the jet pumps. This

occurs because the initial temperature of the

water in the jet pump region is less than the

temperature of the water in the core region.

Hence, a lower proportion of the water in

the downcomer region is flashed during the

rapid vessel depressurization

3.7.2.4 Threat of Reactor Vessel

Repressurization

The motivation for keeping the reactor

vessel depressurized under severe accident

conditions is, first, that the capacity for

quenching of the debris relocating from the

core region into the lower plenum is

enhanced and, second, that relocation of

molten debris into the relatively small BWR

drywell would then be, should bottom head

penetration failures occur, by gravityinduced flow and not by rapid vessel

blowdown. For the less probable case that

penetration failures do not occur, so that the

vessel bottom head ultimately undergoes

gross failure by creep rupture, the time of

failure would be delayed by several hours.

Keeping the reactor vessel depressurized

eliminates direct heating concerns and

greatly reduces the initial challenge to the

integrity of the primary containment.

The chief threats that the reactor vessel may

be pressurized at the time of bottom head

failure arise from two considerations, one

derived from the potential for equipment

failure and the other derived from the

possibility of operator error. The question

of equipment failure is chiefly associated

with the long-term station blackout accident

sequence, for which injection capability is

maintained until the unit batteries are lost.

With loss of the batteries, the ability to

operate the SRVs manually is also lost. 

Because multiple SRVs are installed and

operation of any one valve is sufficient for

depressurization under severe accident

conditions, improved reliability of SRV

operation can be attained simply by ensuring

that the small amount of DC power and

control air necessary for opening will be

available (to at least one valve) when

required. Several BWR utilities have taken

steps toward this end such as provision of a

dedicated small DC diesel generator and

backup compressed nitrogen supply bottles.

The impact of operator error upon vessel

depressurization as typically represented in

probabilistic risk assessments is direct. It is

postulated that the operators fail to take the
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-7 NUREG/CR-6042 Rev. 2 

required action to manually depressurize the

reactor vessel. Although the assumed

probability for such failure, say 0.001, may

seem low, typical core melt frequencies are

much lower – on the order of 10-5.

Accordingly, it is important to recognize that

such assumptions concerning operator error,

while seeming reasonable and conservative,

may lead to the unrealistic conclusions that

BWR core melt, should it happen, would

always occur in a pressurized vessel and that

there is no point in providing equipment

upgrades such as a dedicated DC generator

since the operators would not use them

anyway.

3.7.2.5 N o t e s C o n c e r ni ng SRV

Operation

Any serious attempt to study and

comprehend the probable course of an

unmitigated severe accident sequence at a

BWR facility must include development of a

thorough understanding of the operation of

the installed SRVs under abnormal

conditions of reactor vessel and containment

pressure. The pertinent characteristics of the

more common SRV designs are described in

the following paragraphs. The reader should

particularly note that control air pressure

sufficient for valve operation under normal

conditions may not be adequate if the

reactor vessel is depressurized and the

containment pressure is elevated.

All SRVs are located between the reactor

vessel and the inboard main steam isolation

valves (MSIVs) on horizontal runs of the

main steam lines within the drywell. The

discharge from each valve is piped to the

pressure suppression pool, with the line

terminating well below the pool surface, so

that the steam is subject to condensation in

the pool. The number of SRVs varies from

plant to plant (e.g., 11 at Limerick; 24 at

Nine Mile Point 2), as do the rated relief

valve flows.

Some operating BWRs are equipped with

three-stage Target Rock valves, which have

exhibited a greater tendency to stick open in

the past than have other types of valves.

Many BWR utilities, however, have replaced

the original three-stage valves with the

newer two-stage Target Rock valves (Figure

3.7-8). Some operating BWRs are equipped

with Dresser electromatic relief valves.

BWR-5 and BWR-6 plants are equipped with

Crosby and Dikkers dual function SRVs

(Figure 3.7-9).

The differences in SRV operation in the

automatic and remote-manual or ADS modes

can be demonstrated with reference to the

two-stage Target Rock design shown in

Figure 3.7-8. During normal reactor

operation, a small piston orifice serves to

equalize the steam pressure above and below

the main valve piston, and the main valve

disk remains seated. The reactor vessel

pressure (valve inlet pressure) is ported via

the pilot sensing port to tend to push the

pilot valve to the right. When the reactor

vessel pressure exceeds the setpoint

established by the setpoint adjustment

spring, the pilot valve is moved to the right,

the stabilizer disk is seated, and the volume

above the main valve piston is vented to the

valve outlet via the main valve piston vent.

The sudden pressure differential causes the

main valve piston to lift, opening the valve.

For the remote-manual or ADS modes, the

SRV opening is initiated by control air,

which is admitted via a DC solenoidoperated valve (not shown) to the air inlet at

the right of the setpoint adjustment spring.

The control air moves the valve actuator to

the right (against drywell pressure), which

compresses the setpoint adjustment spring

and pulls the pilot valve open, seating the
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-8 NUREG/CR-6042 Rev. 2 

stabilizer disk and venting the space above

the main valve piston. Because the control

air pressure and the reactor vessel pressure

work in tandem to move the pilot valve to

the right, the amount of control air pressure

required to open the SRV will depend upon

the reactor vessel-to-drywell pressure

differential. Also, because the control air

acts to move the air actuator against drywell

pressure, the required control air pressure

will increase with drywell pressure.

(It should be noted that the three-stage

Target Rock valves behave differently with

respect to the effect of the reactor vessel-todrywell pressure differential. A good

description of the operation of this older

valve design is available in Reference 4.)

The spring-loaded direct-acting SRV shown

in Figure 3.7-9 is opened in the spring mode

of operation by direct action of the reactor

vessel pressure against the disk, which will

pop open when the valve inlet pressure

exceeds the setpoint value. In the poweractuated mode, a pneumatic piston within

the air cylinder moves a mechanical linkage

to compress the spring and open the valve.

As in the case of the two-stage Target Rock

valve, the control air is provided via DC

solenoid-operated valves, and the air

pressure required for valve opening

decreases with reactor vessel pressure and

increases with drywell pressure.

All SRVs associated with the ADS are fitted

with pneumatic accumulators (located within

the drywell) to ensure that these valves can

be opened and held open for some (plantspecific) period following failure of the

drywell control air system. For severe

accident considerations, it is important to

recall that remote operation of the SRVs is

possible only as long as DC power remains

available and the pneumatic supply pressure

exceeds the containment pressure by some

minimum amount.

3.7.3 Recriticality Concerns

The progression of damage and structural

relocation of the various components

(control blades, channel boxes, fuel rods) of

a BWR core during an unmitigated severe

accident sequence will be discussed in detail

in Section 3.7.4. There it will be shown that

the first structures to melt and relocate

downward are the control blades. Here we

pause to consider severe accident sequences

that have the potential for early termination,

i.e., accident sequences for which the core

structure sustains significant damage but

reactor vessel injection capability is restored

while the major portion of the fuel remains

above the core plate.

If significant control blade melting and

relocation were to occur during a period of

temporary core uncovering, then criticality

would follow restoration of reactor vessel

injection capability if the core were rapidly

recovered with cold unborated water using

the high-capacity low-pressure injection

systems.5

 Obviously, a neutron poison

should be introduced into the reactor vessel

for reactivity control under these

circumstances, but question arises as to how

best to do this. The normal means of adding

boron to the reactor vessel is by injection

with the standby liquid control system

(SLCS). Although this system is designed to

inject sufficient neutron-absorbing sodium

pentaborate solution into the reactor vessel

to shut down the reactor from full power

(independent of any control rod motion) and

to maintain the reactor subcritical during

cooldown to ambient conditions, the SLCS is

not intended to provide a backup for the

rapid shutdown normally achieved by scram.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-9 NUREG/CR-6042 Rev. 2 

As indicated in Figure 3.7-10, the basic

SLCS comprises a heated storage tank, two

100% capacity positive displacement pumps,

and, as the only barrier to injection into the

reactor vessel, two explosive squib valves.

In most of the current BWR facilities, the

sodium pentaborate solution enters the

reactor vessel via a single vertical sparger

located at one side of the lower plenum just

below the core plate. However, so as to

improve the mixing and diffusion of the

injected solution (which has a specific

gravity of about 1.3) throughout the core

region, some BWR facilities have been

modified to provide a third displacement

pump and to permit the injected solution to

enter the reactor vessel via the core spray

line and sparger.

For the purpose of reducing the time

required for reactor shutdown for the ATWS

accident sequence, the NRC has issued a

Final Rule6

 requiring that the SLCS injection

be at a rate equivalent to 86 gal/min (0.0054

m3/s) of 13 wt.% sodium pentaborate

solution, the boron being in its natural state

with 19.8 at.% of the boron-10 isotope.

With this increased injection rate, sufficient

boron for hot shutdown can be pumped into

the reactor vessel in about 20 minutes, and

for cold shutdown in about 48 minutes. It

requires approximately an hour to inject the

entire contents of the tank.

The operators would have no direct means of

knowing whether significant control blade

relocation had occurred. Thus, there is a

strong potential for surprise should, for

example, a station blackout accident

sequence suddenly be converted into an

uncontrolled criticality upon restoration of

electrical power and reactor vessel injection

capability. If the SLCS is used to inject

sodium pentaborate at a relatively slow rate

while the core is rapidly recovered with

unborated water using the high-capacity,

low-pressure injection systems, then

criticality would occur and the core would

remain critical until sufficient boron for

shutdown (at the prevailing temperature)

reached the core region. To avoid the

possibility of temporary criticality, it would

be desirable to inject effective quantities of

boron along with the ECCS flow being used

to recover the core. A strategy to

accomplish this using only existing plant

equipment but employing a different chemical

form for the boron poison has been proposed.7

The only currently available information

concerning the poison concentration required

is derived from a recent Pacific Northwest

Laboratory (PNL) study,5

 which indicates

that much more boron would have to be

injected than is available (as a solution of

sodium pentaborate) in the SLCS.

Furthermore, the dominant loss-of-injection

accident sequence is station blackout, and

without means for mechanical stirring or

heating of the injection source, the ability to

form the poison solution under accident

conditions becomes of prime importance.

Hence the need for the alternate chemical

form.

The PNL study5 provides the estimate that a

boron-10 concentration of between 700 and

1000 ppm would be required within the

vessel to preclude criticality once control

blade melting had occurred. This is much

greater than the concentration (about 225

ppm) attainable by injection of the entire

contents of the SLCS tank.

At this point, it should be noted that the

conclusions of the PNL study with respect to

the boron concentrations required to

preclude criticality are acknowledged by the

authors of that study to be very

conservative. Stated another way, in the

many instances where it was necessary to

make assumptions during the study, the
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-10 NUREG/CR-6042 Rev. 2 

assumed quantities were selected in a

manner that tends to increase reactivity

(promote criticality). As an example, debris

particles are assumed to exist in the form of

spheres. As discussed in the following

paragraphs, the resulting high boron

concentration requirement makes

development of a practical coping strategy

difficult.

One means to achieve such a high boron

concentration would be to mix the powder

directly with the water in the condensate

storage tank during the blackout period and

then, once electrical power is restored, to

refill the reactor vessel by pumping the

solution in a controlled manner using one of

the low-pressure injection system pumps.

The condensate storage tank is an important

source of water to the reactor vessel

injection systems for each BWR unit. As

indicated in Figure 3.7-11 (based upon the

Browns Ferry arrangement), it is the normal

suction source for the steam turbine-driven

HPCI and RCIC systems and the alternate

source for the electric motor-driven RHR

and core spray pumps. 

During normal reactor operation, the

condensate storage tank provides makeup

flow to the main condenser hotwells via an

internal tank standpipe, as indicated on

Figure 3.7-12. The purpose of the standpipe

is to guarantee a reserve supply of water for

the reactor vessel injection systems that take

suction from the bottom of the tank. Any

practical strategy for direct poisoning of the

tank contents must include provision for

partial draining to reduce the initial water

volume, especially if boron-10

concentrations on the order of 700 ppm are

to be established. The condensate storage

tank can be gravity-drained through the

standpipe to the main condenser hotwells

under station blackout conditions.

Additional information concerning this

example of a candidate accident management

strategy and the characteristics of the

alternate boron poison chemical form is

available in Reference 7. It seems desirable

that the very conservative estimates of the

PNL study should now be replaced by more

realistic estimates, which certainly would be

expected to lower the target boron

concentration from its present value of 700

ppm and thereby improve the practicality of

such a strategy. (For example, Reference 8,

which incorporates an assumption that threefourths of the control blade B4C remains in

the core region, suggests that reflood water

boron-10 concentrations as low as 200 ppm

might be sufficient.) In the meantime, many

of the BWR facilities have implemented

accident management measures, on a

voluntary basis, to provide backup capability

for the SLCS. These backup strategies

invoke such methods as modification of the

HPCI or RCIC pump suction piping to

permit connection to the SLCS tank, or

poisoning of the condensate storage tank. 

3.7.4 Eutectic Formation and Relocation

Sequence for BWR Core Structures

This section addresses the progression of

damage and structural relocation of BWR

core components that would be expected to

occur during an unmitigated severe accident

sequence, i.e., an accident sequence for

which reactor vessel injection capability is

not restored. The BWR core is basically an

assembly of unit cells, one of which is

shown in the center drawing of Figure 3.7-

13. As indicated, each unit cell comprises

four fuel assemblies, each located in one of

the four quadrants of a central control blade.

Additional details concerning the fuel

assembly and control blade internal

compositions are shown in Figures 3.1-6 and

3.1-7, respectively.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-11 NUREG/CR-6042 Rev. 2 

As may be confirmed by an inspection of

Figure 3.7-14, one-half of the channel box

outer surfaces do not see an intervening

control blade. This arrangement affects the

local core heatup rates calculated for

conditions in which a shutdown core (all

control blades inserted) is postulated to be

uncovered. Where the control blades exist,

they serve as heat sinks for radiation from

the adjacent channel box walls. Where there

are no blades, the channel box walls radiate

to each other.

Experiments to investigate the phenomena of

core melt progression in prototypical BWR

core geometries have been carried out in the

Annular Core Research Reactor (ACRR) at

Sandia National Laboratories (one BWR

test) and at the CORA out-of-pile facility9

 at

the Kernforschungszentrum Karlsruhe (KfK)

in the former Federal Republic of Germany

(six BWR tests). The first of these was the

DF-4 experiment,10 conducted within the

ACRR in November 1986. The test

apparatus, placed within the cylindrical

region surrounded by the ACRR annulus,

included a control blade arm, channel box

walls, and 14 fresh fuel rods. The apparatus

was dry, but the 20-inch (50-cm) long test

section was supplied from below with a

steam flow representative of BWR boiloff

conditions.

When the DF-4 fuel rod cladding was heated

beyond the runaway zirconium oxidation

temperature, the energy release associated

with oxidation accelerated the temperature

escalation. Much of the clad melted at

2125 K (3365°F) and relocated downward;

the remainder was converted to and

remained in place as ZrO2, which has a

much higher melting point ([4900°F]2978

K).

The control blade in the DF-4 experiment

melted earlier than expected and

progressively and rapidly relocated

downward. Subsequently, the reactor was

shutdown to terminate power generation

within the test assembly fuel rods before

fuel melting could begin. In a post-test

cross-section, the relocated control blade

material was found in the form of an ingot at

the very bottom of the test section, which

was below the bottom of active fuel. Both

the control blade and the channel box wall

portions of the DF-4 test section were more

than 90% destroyed due to melting and

relocation during the experiment, but the

fuel pellet stacks were predominantly still

standing. Relocated cladding blocked the

base of the fuel rod regions of the

experiment.

Figure 3.7-15 illustrates the results of the

DF-4 experiment, extrapolated to the same

portion of the core that is represented in

Figure 3.7-14. (Here the water rods, which

were not included in the DF-4 experiment,

have been assumed to relocate in the same

time frame as the channel box walls.) The

ramifications of these standing fuel pellet

stacks in the absence of control blades with

respect to the potential for criticality if

water were to be introduced at this point in

an actual accident sequence should be

obvious.

The early control blade relocation observed

in the DF-4 test was later determined to

have been caused by a eutectic interaction

between the control blade neutron absorber

(B4C powder) and the surrounding stainless

steel of the blade structure. This occurred at

a temperature well below the stainless steel

melting point ([2600°F] 1700 K). This early

B4C-SS eutectic formation was also observed

in the subsequent CORA BWR tests. The

reaction proceeds rapidly when the local

temperature increases above (2240°F)

1500 K, and sudden and complete

liquefaction has been observed in CORA
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-12 NUREG/CR-6042 Rev. 2 

special-effects tests at (2372°F) 1573 K.11

Post-test analyses12 of the CORA BWR core

melt experiments have found that a

liquefaction temperature of (2250°F) 1505 K

for the B4C/SS combination best fits the

observed structural failures and melt

relocations.

The CORA experiments also demonstrated

the formation of zirconium-based eutectics

when the mixture formed from the

destruction of the control blades at one axial

level flows downward and comes into

contact with the adjacent channel box wall

at a lower axial level. Typically, this

downward relocation of stainless steel and

B4C occurs in a series of rapidly repeated

temporary freeze-remelt steps. Whenever the

path of the downward-flowing liquid

encounters a temporary blockage, some of

the flow is diverted horizontally toward the

blade tip and from there into the unbladed

portion of the unit cell. In this manner, the

liquid steel-B4C mixture is spread through

much of the lower portion of the unit cell.

When the gap between the control blade and

the outer surface of the channel box wall

becomes bridged by a semi-permanent

blockage (low in the core), the continuously

accumulating SS-B4C liquid attacks the local

channel box wall aggressively. The

resulting zirconium-based eutectics are

formed at the prevailing temperature of

about 1523 K (2282°F). Thus, channel box

wall failures follow soon (within minutes)

after the onset of control blade failures.

To recap, based on the experimental record,

structural damage within an uncovered BWR

core is expected to be initiated when the

temperature of the control blades in the

upper regions of the core reaches about

(2250°F) 1505 K. This is about (350°F)

195 K below the melting temperature of

stainless steel. Within a few minutes

thereafter, channel box wall damage would

be initiated in the lower regions of the core,

at local wall temperatures of about (2282°F)

1523 K. This is some (1080°F) 600 K

below the melting temperature of zirconium.

(It should be noted, however, that the

destruction of the channel wall is not by

melting, but rather by the process of

dissolution by the liquid steel.) All of this

structural damage occurs at temperatures far

below the melting temperature [5400°F]

(3011 K ) of the UO2 fuel.

As mentioned previously, it is important to

note that the fuel rod pellet stacks, encased

in thin ZrO2 sheaths, continued to stand at

the end of the DF-4 experiment. (CORA

results are not germane to this question

because these experiments were driven by

electrically heated fuel rod simulators.)

With the internal fission power heating,

melting of the DF-4 cladding was initiated at

the inner clad surface. This liquid

zirconium then interacted with the outer

surfaces of the UO2 pellets to form a paste

that, upon subsequent cooling, solidified in

a manner that tends to glue the pellets

together.

It is a valid question as to whether or not

the fuel pellet stacks would continue to

stand in an actual reactor accident. The

DF-4 experiment employed fresh fuel, which

had neither the local cracking nor the

internal fission product inventory that would

be present in actual fuel after long periods

of power operation. Fission product release

experiments with high-burnup fuel have

demonstrated extensive fuel swelling and

foaming.13,14

Finally, there remains the question as to the

response of the hot fuel pellet stacks, should

they remain standing, to the introduction of

water. It is well known that hot cladding

will shatter when thermally shocked, but the
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-13 NUREG/CR-6042 Rev. 2 

case of standing fuel has not been addressed

for BWRs. Fuel collapse did occur in the

upper portion of the TMI core when RCP 2B

was temporarily restarted.

3.7.5 Potential Modes for Debris

Movement Past the BWR Core

Plate

The BWR core plate is located at the base of

the core region within the lower portion of

the core shroud, as shown in Figure 3.7-16.

Although the core plate does not support the

core, it separates the core region from the

reactor vessel lower plenum and thus would

serve as an impediment to the movement of

core and structural debris into the lower

plenum under severe accident conditions. In

fact, the fate of the core plate is pivotal to

the progression of a BWR severe accident;

whether the core plate remains in place or

fails and relocates will determine whether

the debris bed comprising the materials

accumulating below the active core forms

over the plate surface or within the lower

plenum.

3.7.5.1 Core Plate Structure

The core plate is basically a circular

stainless steel plate strengthened by an

underlying support structure. Figure 3.7-16

indicates the relative arrangement of the fuel

assemblies, fuel support piece, control rod

guide tube, control rod drive housing, and

stub tube for one core unit cell. The

primary functions of the BWR core plate are

to laterally align the upper portions of the

control rod guide tubes and to provide the

partition that under normal operating

conditions prevents flow from the lower

plenum from entering directly into the core

region. Instead, the flow enters holes (one

for each fuel assembly) in the upper portion

of each control rod guide tube and passes

through the fuel support pieces into the fuel

assemblies; one of these entrance holes is

labeled “flow inlet into fuel bundle” on

Figure 3.7-16.

To provide an illustrative example of the

dimensions of the core plate, the following

discussion is based upon the 251-in. ID

BWR-4 reactor vessel installed at 1065-

MWe facilities such as Peach Bottom or

Browns Ferry. Each of the 185 control rod

guide tubes supports four fuel assemblies via

an orificed fuel support piece such as the

one shown in Figure 3.7-17. The support

piece rests within the upper portion of the

control rod guide tube while the core plate

provides an alignment pin to ensure proper

placement of both the guide tube and

support piece. The upper surface of the core

plate is located about 23 cm (9 in.) below

the bottom of active fuel within the fuel

assemblies.

The core plate, which is 5 cm (2 in.) thick

and weighs 9300 kg (20,500 lb), provides

vertical support to only the 24 outermost

fuel assemblies (of the 764 assemblies that

make up the core). The support arrangement

for one of these 24 peripheral assemblies is

shown at the extreme right of Figure 3.7-17.

In contrast to the four-lobed fuel support

pieces used for the majority of the fuel

assemblies, each peripheral fuel support

carries only a single fuel assembly and is

firmly seated within the core plate itself.

The stainless steel core plate surface

resembles a perforated drum membrane,

being penetrated by 185 large holes (28 cm

[11 in.] ID) to accommodate the passage of

the control rod guide tubes and 55 smaller

holes (5 cm [2 in.] ID) for the in-core

instrument guide tubes. The core plate is

supported around its outer periphery, which

is bolted to a ledge on the core shroud as

indicated on Figure 3.7-18. Central support
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-14 NUREG/CR-6042 Rev. 2 

is limited to that provided by the stiffener

plates and stiffener rods labeled “core plate

support structure” on Figure 3.7-16.

An appreciation for the extent of the core

plate, which has a diameter of about 4.9 m

(16 ft.), can be gained from Figure 3.7-19.

Under the conditions that would be imposed

by a severe accident, the peripherally

supported core plate is in position to assume

the role of providing vertical support for

the relocating core and structural debris that

would accumulate over its upper surface.

This would at least delay any major

movement of debris into the lower plenum

until local plate structural failures had

opened the necessary pathways. Local plate

structural failure (creep rupture) would be

caused by the combined effects of an

increasing weight of debris to be supported

and a local loss of structural strength due to

elevated plate temperature.

3.7.5.2 Accident Sequence Classification

for Core Plate Considerations

The characteristics and rates of debris

relocations from the active core region down

onto the upper surface of the BWR core

plate under severe accident conditions are

accident-sequence dependent. The decay

heat level at the onset of debris relocation,

for example, depends upon the time at which

the core becomes uncovered, which can vary

from about 40 minutes (short-term station

blackout) to more than 35 hours (loss of

decay heat removal) after scram. The time

required to boil away the water over the core

is plant-specific, and depends strongly upon

the decay heat level. Thus, it is necessary to

determine how much this time is shortened

and adjust procedures accordingly when

power uprates are introduced.

From the standpoint of core plate response,

BWR severe accident sequences can be

broadly divided into two distinct sets: those

sequences for which the core plate would be

dry when debris relocation begins, and those

for which the plate would be covered with

water.

3.7.5.2.1 Dry Core Plate Accident

Sequences

As explained in Section 3.7.2.3, almost all

BWR severe accident sequences invoke

procedural steps for manual actuation of the

ADS when the core becomes partially

uncovered. The attendant flashing of steam

and high rate of flow through the open SRVs

would cause rapid loss of reactor vessel

water inventory and almost immediate core

plate dryout. Heatup of the totally

uncovered core would then lead to structural

relocation of molten control blade (stainless

steel/B4C) and channel box (zirconium)

materials. With the core plate dry, plate

heatup and the potential for local

temperatures conducive to creep rupture

would begin immediately after the relocating

metallic liquids reached the plate.

As local plate failures occur, overlying

debris would fall into the lower plenum,

contributing to the establishment of a debris

bed there. (See Section 3.7.6.) On the other

hand, for regions where the core plate

remains intact, the debris bed would form in

the region above the plate surface, with the

oxides (UO2 fuel pellets and ZrO2 from the

oxidized portion of the cladding) generally

above the metals. This buildup of a debris

bed above the plate surface is more likely

for the case of the wet core plate, as will be

described below.

Before leaving this discussion of the dry

case, it is worthwhile to note that the core

plate was not designed to constitute an

impermeable partition. Leakage through the

plate during reactor operation is intended to

provide some cooling flow to the core
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-15 NUREG/CR-6042 Rev. 2 

interstitial region, to supplement the control

rod drive hydraulic system flow. Because of

the numerous original leakage pathways, it

would not be necessary to have actual core

plate failures in order for much of the

metallic liquid reaching the plate surface to

flow through, particularly in the vicinity of

the incore instrument guide tube

penetrations. (These hollow stainless steel

tubes would be susceptible to melting long

before the core plate itself.)

3.7.5.2.2 Wet Core Plate Accident

Sequences

The intent of the BWR Owners Group

Emergency Procedure Guidelines (EPGs)3

regarding rapid reactor vessel

depressurization when the core has been

partially uncovered cannot be carried out in

some BWR severe accident sequences

because either control air or DC power, or

both are not available at the time that it

becomes necessary to open the SRVs. This

is true, for example, for the long-term

station blackout accident sequence, which is

estimated by the NUREG-1150 study to

constitute about 42% of the overall core

damage risk (internal events) at Peach

Bottom. For these accident sequences and in

sequences involving failure to depressurize

due to operator error, molten materials

relocating downward from the uncovered

upper portion of the core would freeze upon

entering the two-phase (steam/water) region

above the plate. The associated steam

generation would cause a higher degree of

metal-water reaction in the upper portion of

the core and an accelerated core degradation

rate in that vicinity.

For the wet case, much of the relocating

metallic liquid would not reach the core

plate, but rather would freeze at some

elevation above the plate. Subsequent debris

bed formation and melting above the plate

surface would lead to a period within the

accident sequence more like the Three Mile

Island (PWR) experience. In other words,

retention and buildup of a debris bed above

the core plate is more likely for the wet case

where core plate dryout, heatup, and

structural failure are delayed because the

plate is submerged in water during initial

material melting and relocation.

Would the presence of water in the BWR

core region during the initial stages of debris

relocation from the upper core lead to

formation of a bowl - like crucible containing oxidic melt as occurred at Three Mile

Island? No experiment has directly

addressed this possibility, but it seems very

unlikely because of the open spaces between

the fuel assemblies in the BWR core

configuration and the different frothing

heights among adjoining fuel bundles. The

difference in frothing heights (due to

different power densities) between adjacent

bundles in the central region of a typical

BWR core would exceed 0.30 m 1ft.);

consequently, any metallic blockages would

be discontinuous in the radial direction.

(Contrary to first expectations, the freezing

level for downward-flowing metallic liquids

would be higher in the higher-power fuel

assemblies.)

Core plate dryout would, of course,

eventually occur for the case without vessel

depressurization, when sufficient debris had

been quenched to boil away all of the water

initially above the plate. By this time,

however, the core plate would be covered

with a layer of previously quenched metallic

material. Subsequent relocation of oxides

onto the surface of this mostly metallic layer

would induce heating of the plate and the

accumulated overlying debris. The

temperature increase of the plate would,

however, be much slower than for the dry
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-16 NUREG/CR-6042 Rev. 2 

case, where molten metals interact directly

with the plate surface.

3.7.5.3 Status of Experimental

Findings

The current experimental foundation for

understanding downward relocation of core

debris under BWR severe accident

conditions consists of the DF-4 experiment

and the CORA BWR tests. Each of these

experiments represents an uncovered length

(control blade, channel box, and fuel rods)

in the upper BWR core with steam flows

(from below) typical of a wet core plate

accident sequence. However, in each case,

the steam flows were fed into the test

apparatus from outside and there was no

representation of water in the lower portion

of the test section or of a core plate. These

experiments all demonstrate rapid relocation

of metals (control blade and channel box

materials) to below the fueled region of the

test assembly. These results confirm that

relocation of metallic metals would occur

first, so that debris initially reaching the

core plate surface would consist entirely of

metals, but provide no information

concerning the core plate response.

Results of an experimental program15 to

establish the necessary information

concerning the severe accident response of

the BWR core plate were published in 1997.

The XR2 test at Sandia National

Laboratories examined the behavior of

downward relocating molten metallic

materials in the lower portion of a dry BWR

core. The material composition and

geometry of the XR2 test section was

prototypic in both the axial and local radial

directions. The simulated portion of the

lower core included one-half meter of the

fuel assembly, the nose piece, the core plate,

the control blade and velocity limiter, and

the fuel support structure with the coolant

inlet nozzles. The imposed test conditions

were calculated beforehand by the NRCsponsored SCDAP/RELAP code, which itself

includes models16 based upon the results of

the previous BWR DF-4 and CORA

experiments. Specifically, these calculations

provided the bases for the initial thermal

state of the test assembly and for the timing

and associated rates for the introduction of

molten metals onto the test assembly from

above.

To simulate downward draining control

blade liquids reaching the lower core,

control blade material was fed into the upper

end of the test section over a period of 1000

seconds. Employing a specially designed

wire guide and melter system, this feed

material was delivered in a prescribed

pattern over the test assembly control blade

at a controlled, constant rate. Subsequently,

molten Zircaloy was introduced as

appropriate to represent the calculated

degradation of the upper fuel rod cladding

and channel box walls.

As reported in Reference 15, the fuel

assemblies were severely degraded during

the test. The channel box walls were

destroyed by the aggressive eutectic-forming

action of the molten control blade material,

and the fuel rods were stripped of cladding.

The x-ray imaging system showed the

forming of temporary blockages and pools

early during the test, but the liquids were

able to break free so that large masses of

molten materials would drain suddenly to the

lower reaches of the test assembly.

Thermocouple responses also indicated the

effects of large-scale and sudden melt

relocations to regions beneath the core plate.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-17 NUREG/CR-6042 Rev. 2 

Subsequent to the test, more that half of the

feed material and material that melted in the

upper portion of the test assembly was found

below the core plate elevation. Some of this

was located in the inlet nozzle, some had

come to rest on the control blade velocity

limiter, but most was found in the lower

catch basin (which simulates the vessel

lower plenum). Thus, the results of the XR-2

experiment demonstrate that the downward

flowing metallic liquids do not freeze to

form permanent blockages above the core

plate, but rather continue to the plate surface

and beyond to the lower plenum through

existing pathways in the lower core

structures and core plate. 

It is important to recognize that the XR2

experiment was not intended to address core

plate failure directly, but rather to provide

the temperature response of the core plate

for use in separate creep rupture

calculations. The experiment did not

represent the true radial extent of the core

plate or the magnitude of the imposed load

that would exist at the time that creep

rupture would be expected to occur in the

actual case. In actuality, the core plate is a

perforated disk (with underbracing) that is

4.9 m (16 ft.) in diameter and is supported

around the edge. Ultimately (after the

period of initial metals pour addressed by

the experiment), the central portion of this

disk would be loaded by some 200,000 kg of

fuel debris from the upper central core. This

is when gross core plate failure would be

expected to occur, and with the plate

temperatures (in excess of [1700 o

F] 1200 K)

demonstrated in this experiment, such failure

seems likely.

3.7.6 Severe Accident Events in the BWR

Lower Plenum

As explained in the previous section, it is

expected that metallic liquids relocating

downward through a dry BWR core would to

a large extent pass through existing core

plate pathways into the reactor vessel lower

plenum. Subsequently, following collapse of

the central fuel pellet stacks and local

failures of the core plate boundary, oxidic

debris would enter and begin to accumulate

within the lower plenum. While much of

this entering oxide would be in the solid

phase as UO2 fuel pellet fragments, code

predictions indicate that a significant portion

would be in the liquid phase in the form of

a UO2-ZrO2 eutectic mixture. At this point,

it is important to consider the extent to

which the falling debris would interact with

the lower plenum water.

3.7.6.1 Debris Interactions With Lower

Plenum Water

Fortunately, several experiments17,18 have

been conducted to examine the behavior of

corium streams falling through water. In

general, these have been special effects tests

employing the actual materials of interest at

the temperatures of interest. For example,

Reference 17 reports the results of six tests

in which a corium composition (by mass) of

60% UO2, 16% ZrO2, and 24% stainless

steel (SS) at an initial temperature of

(5072°F) 3073 K was poured at atmospheric

pressure into water pools of depth about one

meter. No steam explosions occurred, and

the fraction of the pour quenched during the

fall varied from 55-72% for subcooled

pools to 33-45% for initially saturated pools.

Very little (about 1%) of the steel dropped

into the subcooled pools was oxidized during

the fall, but for the saturated pools, up to

35% of the available steel was oxidized.

The corium not quenched during the fall was

subsequently quenched while resting at the

bottom of the pool, where a debris bed of

solidified particles was formed. There was

no ablation of the pool floor.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-18 NUREG/CR-6042 Rev. 2 

When contemplating the corium pours that

might be generated in hypothetical BWR

accidents, it is necessary to consider the

effects associated with the presence of

zirconium metal as a constituent. In spite of

the difficulties associated with the handling

of liquid zirconium, the experiments

conducted to date in the corium pour test

series reported in Reference 18 have

included one UO2-ZrO2-Zr pour, the results

of which may be compared with the results

of three similar tests carried out in the same

apparatus with UO2-ZrO2 pours. No steam

explosions occurred in these tests, which

were carried out at 5.0 MPa (725 psia) with

saturated water pools varying in depth from

1-2 meters. All of these pours were subject

to significant breakup and quenching during

the melt fall through the water.

For the Reference 18 tests with UO2-ZrO2, a

portion (from 1/6 to 1/3) of the corium mass

did not break up during the fall, but rather

reached the pool floor while still molten

(and subsequently quenched there). For the

test with UO2-ZrO2-Zr, however, full

oxidation of the zirconium and complete

breakup of the melt occurred during the fall.

Apparently, the energy release associated

with the metal oxidation during the fall had

the effect of promoting spreading (and

quenching) of the accompanying oxide

portion of the pour.

Future corium-water interaction tests are

expected to provide additional insights. In

the meantime, the available evidence from

the special effects experiments17,18 supports

a contention that in the actual case, the

relocating debris would quench in the lower

plenum water.

For BWRs, the argument that the falling

masses of hot debris would be quenched in

the reactor vessel lower plenum is buttressed

by the extent of the stainless steel structures

located there and the large surrounding

volume of water. For the Browns

Ferry/Peach Bottom example, there are 185

control rod guide tubes of (11 in.) 28 cm

outer diameter on a (12 in.) 30.5 cm pitch in

the vessel lower plenum; within each unit

cell, any free-falling debris must pass

through a (50 in.2

) 316 cm2 opening (see

Figure 3.7-20) that is (12 ft.) 3.7 m in length

(see Figure 3.7-21). Thus, any rapid passage

of large, coherent, molten masses through

the lower plenum water is precluded, and a

large amount of energy would be transferred

from the debris to the relatively cold steel

with which it came into contact. These

considerations, plus the initial presence of

sufficient water in the lower plenum to

completely quench more than one entire

core, leads to the conclusion that the

relocating debris would be quenched. The

associated steam generation would be

relieved via the SRVs, so that vessel

integrity would not be threatened.

3.7.6.2 Events After Lower Plenum

Dryout

In accordance with the BWR core material

damage and relocation sequence described in

Section 3.7.5, it is expected that the

composition of the quenched debris bed that

accumulates in the lower plenum would vary

with height. Lowermost in the bed would be

the debris first relocated into the lower

plenum. This normally would comprise

mostly metallic debris (control blades,

channel boxes, candled clad and dissolved

fuel) that had either passed through the

intact core plate, had accumulated on the

plate surface before local plate failure, or

had subsequently relocated downward within

the same local region before fuel pellet stack

collapse.

Higher, within the middle region of the bed

would be the collapsed fuel and ZrO2 from
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-19 NUREG/CR-6042 Rev. 2 

the central region of the core. The initial

leakages of metallic liquids through the core

plate and the subsequent plate structural

failures would cause temporary bursts of

steaming as the relocating metallic debris

was quenched; however, with the collapse of

the central core fuel pellet stacks, a constant

heat source (the decay heat associated with

the pellets) would be introduced to the lower

plenum reservoir, initiating a continuous

boiloff of the remaining water.

After lower plenum dryout, the debris bed

temperature would increase, causing thermal

attack and failure of the control rod guide

tube and instrument tube structures, which

the debris would completely surround to a

depth of about (10 ft.) 3 m. Since the

control rod drive mechanism assemblies and

the control rod guide tubes support the core,

the remaining standing outer radial regions

of the core would be expected to collapse

into the lower plenum when these support

columns fail. Thus, the uppermost portion

of the completed lower plenum debris bed

should primarily consist of the collapsed

metallic and fuel materials from the

relatively undamaged outer regions of the

core. The stainless steel of the control rod

guide tubes and mechanism assemblies, the

instrument tubes, and other lower plenum

structures would be subsumed into the

surrounding debris as it became molten.

3.7.7 BWR Bottom Head Failure Modes

Given that the lower portion of the debris

bed would be comprised almost entirely of

metallic materials while UO2 pellets

constituted more than half of the central bed,

then the central region would heat up much

more rapidly after lower plenum dryout, and

heat transfer within the bed would be toward

the vessel wall. As the temperature of the

bed increased, materials in the central region

would begin to melt, migrate to cooler

regions within the bed, freeze, and

subsequently melt again. Eventually,

temperatures near the wall would be

sufficient to threaten its integrity. Failure of

the vessel bottom head wall as a pressure

boundary might occur as a result of

penetration failures, or by creep-rupture

failure of the wall itself. Both of these

potential failure modes are discussed below.

3.7.7.1 Failure of the Bottom Head

Penetrations

There are more than 200 bottom head

penetrations in a BWR reactor vessel of the

size employed at Browns Ferry or Peach

Bottom, where there are 185 control rod

drive (CRD) mechanism assembly

penetrations, 55 instrument guide tube

penetrations, and a (2 in.) 5.1 cm drain line

penetration near the low point of the bottom

head. The inner surface of the bottom head

is clad with Inconel (thickness [0.125 in.]

0.32 cm), while the penetrations are stainless

steel. Cross-sections of the CRD mechanism

assembly and instrument tube penetrations

and their weldments are illustrated in Figure

3.7-22. Each CRD mechanism assembly is

held in place by an Inconel-to-stainless steel

weld located at the upper end of the Inconel

stub tube, as shown in Figure 3.7-23.

(These are the welds that support the weight

of the BWR core.) The location of one of

the instrument guide tube welds at the inner

surface of the bottom head wall is shown in

Figure 3.7-24.

It is important to note that the CRD

mechanism assembly welds are located about

(4 in.) 10 cm above the vessel wall and thus

would lie within the confines of the lower

plenum debris bed. As a consequence, these

welds would be expected to reach elevated

temperatures before the instrument tube

welds at the vessel wall. Failure, if it

occurred, would be by creep rupture, which
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-20 NUREG/CR-6042 Rev. 2 

would be promoted at much lower

temperatures if the reactor vessel were

pressurized.

Although bottom head pressure boundary

failures should occur first at the upper stub

tube welds, this type of penetration failure is

less important from the standpoint of

potential for debris release from the reactor

vessel than are instrument tube failures.

This is true because BWRs are required to

have an auxiliary support structure beneath

the vessel bottom head that would limit the

downward movement of any control rod

mechanism assembly to about 3 cm (1 in.) in

the event of failure of its stub tube weld.

(This requirement does not derive from

severe accident considerations, but rather

from a need to guard against the sudden

expulsion of a control blade from the core

during critical operation at very low power.)

Since the thickness of the vessel bottom

head in the region of the penetrations is 21.4

cm (8 7/16 in.), this limited downward

movement could not open a significant

pathway through the vessel wall even if the

CRD mechanism assembly were melted

within the debris bed. This is not true for

the instrument guide tubes, for which there

is no provision to limit their downward

movement.

For an unmitigated accident sequence,

temperatures at the inner surface of the

bottom head wall would eventually become

sufficiently high to cause failures of the

welds that hold the instrument tubes in

place. However, it is probable that a

different mode of failure for the instrument

guide tubes would occur first. As illustrated

in Figure 3.7-25, this potential early failure

mode for the instrument guide tubes involves

melting of the portions of these guide tubes

within the central region of the debris bed.

Then, when the sequence of melting,

downward movement, and freezing processes

for the metals had progressed to the point

that molten debris liquids were standing in

the central region of the bed, these liquids

could spill into the failed instrument tubes

and pour through the vessel wall. In order

to complete the pathway to the containment,

however, it is necessary that the entry of

molten debris liquids into the interior of

these tubes induce tube wall failures

external to the bottom head wall.

Would movement of molten debris liquids

through an instrument tube result in tube

failure outside the vessel wall? This

question has been extensively studied.7,19

An important measure of the vulnerability of

the tube wall is the ratio of the volume

within the tube available for occupation by

melt to the volume of the adjacent wall. For

BWR instrument guide tubes, this ratio is

1.40, whereas for PWR guide tubes, this

ratio varies from 0.06 to 0.52. Thus, BWRs

are more susceptible to debris release by

penetration failures than are PWRs.

Analyses19 indicate, however, that the BWR

instrument guide tube vulnerability is limited

to cases where the vessel pressure is greater

than (290 psia) 2 MPa, and molten oxidic

(ceramic) melt enters the tube. (Metallic

liquids entering the tube and passing through

the vessel wall would be expected to freeze

while the tube wall remains intact.) If the

reactor vessel is depressurized, then

calculations indicate that the only possible

penetration failure involves the entrance of

ceramic liquids into the vessel drain.

Given the presence of internal debris liquids,

then the BWR vessel drain offers the highest

potential for the opening of an escape route

through the vessel wall, as evidenced by its

melt volume-to-wall volume ratio of 1.57,

which is the largest value of this ratio for

any type of penetration. However, it is

important to recognize that the pathway by

which molten debris would enter the vessel
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-21 NUREG/CR-6042 Rev. 2 

drain is different than that for the instrument

guide tubes. The vessel drain is located at

the bottom of the lower plenum, offset

slightly (about [6 in.] 15 cm) from the point

of vessel zero. Therefore, metallic particles

quenched while falling through the lower

plenum water during the initial stages of

debris movement through the core plate

would collect in the drain. After lower

plenum dryout, metallic liquids forming

within the debris bed and moving downward

would enter the remaining voids within the

vessel drain. On the other hand, molten

material would flow laterally within the bed

to enter the failure location of an instrument

tube only after the voids in the lower

portions of the bed had been filled with

liquid, to the level of the failure location.

The upshot is that the vessel drain would

probably be filled earlier by a lowermelting-temperature metallic mixture; the

instrument guide tubes would probably be

filled later by a higher-melting-temperature

oxidic mixture.

To summarize, BWR penetration failures by

internal flow are unlikely, but the possibility

cannot be excluded. If not previously filled

by frozen metals, the instrument tubes would

be expected to fail ex-vessel if attacked from

within by ceramic melt at a pressure of at

least 2 MPa (290 psia). While the presence

of ceramic melt within the vessel drain could

cause failure of the wall with zero pressure

differential, it is very probable that the drain

would be filled by metallic debris long

before molten ceramics became available in

the vicinity. Since there are 55 instrument

guide tubes and just one drain, it seems that

between the two possibilities, opening of an

instrument tube pathway is more probable.

The experimental evidence with respect to

bottom head failure as discussed in Section

3.5.7 indicates that the presence of

penetrations does accelerate bottom head

failure, not by internal sneak pathways

through the vessel wall, but rather external

to the penetrations. These failures are

characterized by cracking of and leakage

through the circumferential welds that

originally held the penetrations within the

surrounding vessel wall. Once initiated, this

leakage rapidly increases as the diameter of

the vessel wall through-holes provided for

the penetrations increases by as much as a

factor of two.

If penetration failures did occur, then a leak

path from the vessel to the containment

atmosphere would be created. Subsequently,

the vessel gaseous content would blow down

if the reactor vessel were at pressure or, if

the vessel were depressurized, would slowly

leak out as the gas temperature in the vessel

increased and the water in the vessel

downcomer region boiled away. The leak

path for the steam generated from the water

surrounding the jet pumps would be up

through the downcomer region, down

through the core region, and out through the

debris bed. Steam passing through the

debris would react with any unoxidized

metals in its path, greatly augmenting the

local bed heatup rate and promoting local

melting. The liquids would flow from the

vessel as they are created by melting within

the bed. Stated another way, the rate of

release of debris liquids from the vessel

would be controlled by the rate of debris

melting.

3.7.7.2 Gross Bottom Head Failure

If penetration failures do occur, the

downward flow of molten liquids around the

instrument tube and control rod guide tube

locations would induce ablation of the

surrounding solid debris (in lower portions

of the bed) and the vessel wall. Wall

ablation can significantly increase the size

of the effective flow pathways through the
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-22 NUREG/CR-6042 Rev. 2 

wall; however, as discussed in the previous

Section, the rate at which liquids are

released from the vessel after the initial

penetration failures and blowdown would be

controlled by the rate at which the solid

debris is melting. Eventually, wall ablation

would lead to gross failure of the wall, such

that all remaining debris (comprised

primarily of solids) would be released from

the vessel.

For cases in which penetration failures did

not occur, heat transfer from the central

portion of the bed after lower plenum dryout

would eventually increase the temperature of

the bottom head wall to the point of failure

by creep rupture. (This has been observed

experimentally for vessel bottom heads

without penetrations as discussed in Section

3.5.7.) However, about 95% of the vessel

wall stress under normal operating

conditions is due to the internal vessel

pressure, and, as described in Section 3.7.2,

emergency procedures direct the control

room operators to manually depressurize the

reactor vessel at an early phase of any

severe accident sequence (when the core is

partially uncovered). The wall stress after

lower plenum dryout with the reactor vessel

depressurized and taking into account the

weights of both the debris resting on the

bottom head and the bottom head itself

would be less than 3% of the normal

operating value.7

 At this low stress level,

failure by creep rupture would occur only at

wall temperatures approaching the melting

temperature of the carbon steel.

Calculations based on short term station

blackout without penetration failures

typically predict that wall temperatures of

this magnitude would be reached about six

hours after lower plenum dryout.

3.7.7.3 Effectiveness of External Water

Cooling

It is important to note that containment

flooding to above the level of the core is

currently incorporated within the BWR

Owners Group EPGs3

 as an alternative

method for providing a water source into the

reactor vessel in the event of LOCA (the

water would flow into the vessel from the

containment through the break). Here we

will discuss whether or not containment

flooding, if successfully carried out, might

be effective in preventing the release of

molten materials from the reactor vessel for

the risk-dominant non-LOCA accident

sequences such as station blackout. The

practical difficulties associated with

attempting to inject large amounts of water

into containment under severe accident

conditions will be addressed in Section 4.7.

Heat transfer from the instrument guide tube

and vessel drain outer surfaces would be

greatly enhanced by the presence of water

because the heat transfer mode would be

shifted from natural convection of air to

nucleate or film boiling of water.

HEATING code calculations 7

 have

demonstrated that the effectiveness of the

water cooling is such that the submerged

instrument guide tubes or vessel drain would

be expected to survive filling with any

possible category of molten debris, even if

the vessel remains pressurized.

If the containment were flooded with water,

a portion of the drywell atmosphere would

be trapped within the reactor vessel support

skirt, as illustrated in Figure 3.7-26. The

fraction of the bottom head surface area

beneath the skirt that would be submerged in

water could be increased by providing a vent

pathway such as by drilling several small

holes in the vessel skirt, just below the

vessel attachment weld. However, from the

standpoint of regulatory requirements, the

NUREG-1150 core melt frequency estimates,

cost-benefit analysis, and the desire to

minimize radiation exposure to personnel,
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-23 NUREG/CR-6042 Rev. 2 

this is clearly not a practical proposal for

existing BWR facilities.

Analyses7

 have shown that the existence of

a trapped gas pocket beneath the vessel skirt

attachment would ultimately prove fatal to

the integrity of the bottom head wall.

Figure 3.7-27 illustrates the expected

condition of the debris at the time of wall

failure. The central portion of the bed is a

liquid slurry while a crust (thicker at the

bottom) adheres to the wall. Calculations

indicate that the presence of water as shown

in Figures 3.7-26 and -27 would serve to

delay bottom head creep rupture from about

10 hours after scram if the bottom head is

dry to about 13 hours after scram.

It is instructive to briefly consider a case in

which the bottom head is completely

submerged as shown in Figure 3.7-28. Here

none of the local bottom head temperatures

would ever become high enough to threaten

failure by creep rupture. However, upward

radiative heat transfer within the vessel from

the debris surface would eventually melt all

of the upper internal structures; the ensuing

stainless steel liquid would be added to the

central debris pool. After exhaustion of the

stainless steel, the only remaining internal

heat sink above the debris surface would be

the carbon steel of the vessel wall. All

portions of the wall cooled by water on their

outer surfaces would remain intact, but

unless the water height within the drywell

extended well above the surface of the

debris pool, upper portions of the vessel

wall with exteriors exposed to the drywell

atmosphere would ultimately reach failure

temperatures. Figure 3.7-28 indicates the

minimum water height required to prevent

melting of the wall inner surface as

determined by an actual calculation7

 based

upon the Peach Bottom or Browns Ferry

configuration. 
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-24 NUREG/CR-6042 Rev. 2 

Table 3.7-1 Vessel depressurization at one-third core height

postpones the predicted core degradation events for

short term blackout
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-25 NUREG/CR-6042 Rev. 2 

Figure 3.7-1 Definition of radial zones for Browns Ferry unit 1

cycle 6 core
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-26 NUREG/CR-6042 Rev. 2 

Figure 3.7-2 The progression of severe structural damage in the

outer core would significantly lag events in the

central core
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-27 NUREG/CR-6042 Rev. 2 

Figure 3.7-3 If the reactor vessel remains pressurized, relocating core

debris falls into water above the core plate
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-28 NUREG/CR-6042 Rev. 2 

Figure 3.7-4 Effects of manual actuation of ADS at about one-third core

height
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-29 NUREG/CR-6042 Rev. 2 

Figure 3.7-5 Vessel depressurization at one-third core height provides

steam cooling that temporarily reverses core heatup
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-30 NUREG/CR-6042 Rev. 2 

Figure 3.7-6 Vessel depressurization at one-third core height delays

hydrogen release
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-31 NUREG/CR-6042 Rev. 2 

Figure 3.7-7 Regional above core plate would be dry during structural

degradation
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-32 NUREG/CR-6042 Rev. 2 

Figure 3.7-8 For the two-stage target rock SRV, control air and system

pressure act in concert to position the pilot valve.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-33 NUREG/CR-6042 Rev. 2 

Figure 3.7-9 For the Crosby SRV, control air opens the main valve
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-34 NUREG/CR-6042 Rev. 2 

Figure 3.7-10 Abbreviated schematic of a typical BWR SLCS
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-35 NUREG/CR-6042 Rev. 2 

Figure 3.7-11 The condensate storage tank is an important source of

water during accident sequences other than LBLOCA
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-36 NUREG/CR-6042 Rev. 2 

Figure 3.7-12 The condensate storage tank can be drained to the main

condenser hotwells, leaving sufficient water volume for the

reactor vessel injection
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-37 NUREG/CR-6042 Rev. 2 

Figure 3.7-13 The BWR control blades are inserted into the

interstitial region between fuel assemblies in

the core.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-38 NUREG/CR-6042 Rev. 2 

Figure 3.7-14 One-half of the channel box outer surfaces do not see

an intervening control blade
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-39 NUREG/CR-6042 Rev. 2 

Figure 3.7-15 Relocation of control blades and channel box walls

leaves on UO2 pellets encased in thin Zr02 sheaths
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-40 NUREG/CR-6042 Rev. 2 

Figure 3.7-16 The BWR core plate separates the core region from the

reactor vessel lower plenum but does not support the

core
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-41 NUREG/CR-6042 Rev. 2 

Figure 3.7-17 Control blade tip emerging from fuel support structure

near core plate edge at Peach Bottom
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-42 NUREG/CR-6042 Rev. 2 

Figure 3.7-18 Material relocating from the core region would enter the

reactor vessel lower plenum
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-43 NUREG/CR-6042 Rev. 2 

Figure 3.7-19 View of core plate with fuel support structures in place

at Peach Bottom
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-44 NUREG/CR-6042 Rev. 2 

Figure 3.7-20 Two-thirds of the area beneath the BWR core is

blocked by the control rod guide tube
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-45 NUREG/CR-6042 Rev. 2 

Hemisphere

Stainless

steel internal

structures

Bottom

Head Penetrations

Support

Skirt

Figure 3.7-21 Code models specific to the BWR lower plenum and

bottom currently exist
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-46 NUREG/CR-6042 Rev. 2 

STUB TUBE WELD

SB 166

INCONEL

CLADDING

15.240 diam

VESSEL BORE

304 SST

WELD AT

VESSEL WALL

CLADDING

5.080 diam

VESSEL BORE

3.810 diam

5.042 diam

(ALL DIMENSIONS IN cm)

Figure 3.7-22 The BWR control rod drive mechanism assemblies are held

in place by upper stub welds; the incore instrument tubes

are supported by welds at the vessel wall.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-47 NUREG/CR-6042 Rev. 2 

Figure 3.7-23 Weld holding control rod drive housing in place within

stub tube at Peach Bottom
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-48 NUREG/CR-6042 Rev. 2 

Figure 3.7-24 Instrument guide tube weld location at inner

surface of vessel wall at Peach Bottom
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-49 NUREG/CR-6042 Rev. 2 

Figure 3.7-25 Instrument tube failure by creep-rupture of welds and

by melt overflow can be represented
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-50 NUREG/CR-6042 Rev. 2 

Figure 3.7-26 Zirconium oxidation accelerates the initial debris release

rate for pressurized accident sequences
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-51 NUREG/CR-6042 Rev. 2 

Figure 3.7-27 Atmosphere trapping within the reactor vessel support

skirt could limit water contact with the wall
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-52 NUREG/CR-6042 Rev. 2 

Figure 3.7-28 Delayed wall creep rupture would occur in the vicinity

of the gas pocket
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-53 NUREG/CR-6042 Rev. 2 

Figure 3.7-29 Cooling of upper vessel wall would be necessary after

internal vessel structures have melted
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-54 NUREG/CR-6042 Rev. 2 

References for Section 3.7

1. S. R. Greene, “Realistic Simulation of

Severe Accidents in BWRs - Computer

Modeling Requirements,” NUREG/CR2940, ORNL/TM-8517, Oak Ridge

National Laboratory, April 1984.

2. L. J. Ott, “Advanced Severe Accident

Models for BWR Applications,”

Nuclear Engineering Design, 115, pp.

289-303, 1989.

3. General Electric Company, “BWR

Owner’s Group Emergency Procedure

Guidelines,” Revision 4, NEDO-31331,

March 1987.

4. Tennessee Valley Authority, “Browns

Ferry Final Safety Analysis Report,”

Volume 2, Section 4.4.5.

5. W. B. Scott, et al., “Recriticality in a

BWR Following a Core Damage

Event,” NUREG/CR-5653, PNL-7476,

Pacific Northwest Laboratory,

December 1990.

6. U.S. Nuclear Regulatory Commission,

“Reduction of Risk from Anticipated

Transients Without Scram (ATWS)

Events for Light-Water-Cooled Nuclear

Power Plants, Final Rule,” July 1984.

7. S. A. Hodge, J. C. Cleveland, T. S.

Kress, and M. Petek, “Identification

and Assessment of BWR In-Vessel

Strategies,” NUREG/CR-5869,

ORNL/TM-12080, Oak Ridge National

Laboratory, October 1992.

8. B. I. Shamoun and R. J. Witt,

“Parametric Study of Recriticality in a

Boiling Water Reactor Severe

Accident,” Nuclear Technology, 107,

pp. 227-235, August 1994.

9. S. Hagen and K. Hain, “Out-of-Pile

Bundle Experiments on Severe Fuel

Damage,” CORA Program, KfK 3677,

Forschungszentrum Karlsruhe (FZK),

(formerly Kernforschungszentrum

Karlsruhe [KfK]), 1986.

10. R. O. Gauntt, R. D. Gasser, and L. J.

Ott, “The DF-4 BWR Control

Blade/Channel Box Fuel Damage

Experiment,” NUREG/CR-4671,

SAND86-1443, Sandia National

Laboratories, November 1989.

11. P. Hofmann, M.Markiewicz, and J.

Spino, “Reaction Behaviour of B4C

Absorber Material with Stainless Steel

and Zircaloy in Severe LWR Accidents,” KfK 4598, Forschungszentrum

Karlsruhe (FZK), (formerly

Kernforschungszentrum Karlsruhe

[KfK]), July 1989.

12. L. J. Ott, “Posttest Analysis of the

CORA-28 Preoxidized BWR

Experiment,” ORNL/NRC/LTR/-93/26,

Letter Report, Oak Ridge National

Laboratory, September 1993.

13. M. D. Allen, H. W. Stockman, K. O.

Reil, and J. W. Fisk, “Fission Product

Release and Fuel Behavior of Irradiated

Light Water Reactor Fuel Under Severe

Accident Conditions - The ACRR ST-1

Experiment,” NUREG/CR-5345,

SAND89-0308, Sandia National

Laboratories, November 1991.

14. A. J. Grimley, “A Thermodynamic

Model of Fuel Disruption in ST-1,”

NUREG/CR-5312, SAND-3324, Sandia

National Laboratories, February 1991.
Reactor Safety Course (R-800) 3.7 Special Consideration for BWR Facilities

USNRC Technical Training Center 3.7-55 NUREG/CR-6042 Rev. 2 

15. R. O. Gauntt and L. L. Humphries,

“Final Results of the XR2-1 BWR

Metallic Melt Relocation Experiment,”

NUREG/CR-6527, SAND97-1039,

Sandia National Laboratories, 1997.

16. F. P. Griffin, “BWR Control

Blade/Channel Box Interaction and

Melt Relocation Models for SCDAP,”

Revision 3, ORNL/NRC/LTR-92/12/R3,

Letter Report, Oak Ridge National

Laboratory, March 1995. 

17. B. W. Spencer, et al., “Fragmentation

and Quench Behavior of Corium Melt

Streams in Water,” NUREG/CR-6133,

ANL-93/32, Argonne National

Laboratory, February 1994.

18. D. Magallon, et al., “Status of

theFARO/KROTOS Melt-Coolant

Interactions Tests,” Proceedings of the

Twenty-Third Water Reactor Safety

Information Meeting, NUREG/CP-0149,

Vol 2, pp. 157-185, European

Commission, Joint Research Centre,

Safety Technology Institute, 1995.

19. J. L. Rempe, et al., “Light Water

Reactor Lower Head Failure Analysis,”

NUREG/CR-5642, EGG-2618, Idaho

National Engineering Laboratory,

October 1993.
Reactor Safety Course (R-800) 4.0 Accident Progression in the Containment

USNRC Technical Training Center 4.0-1 NUREG/CR-6042 Rev. 2

4.0 Accident Progression In The

Containment

4.0.1 Introduction

As discussed in Module 1, containments

began to evolve when designers realized that

remote siting would not be practical in all

cases. The first containments were provided

for the Knolls Atomic Power Laboratory and

Shippingport experimental reactors in order

to allow them to be sited in more populated

areas. Containments for large power

reactors evolved during the 1960s,

representing a key element of the defense-indepth strategy. In the event of a designbasis accident, containments are designed to

minimize leakage and keep offsite doses well

below the 10 CFR 100 limits.

Two basic strategies are used in U.S.

containments. The passive pressure

suppression approach, used in all General

Electric Boiling Water Reactors (BWRs) and

Westinghouse Pressurized Water Reactor

(PWR) Ice Condenser Containments,

involves the use of an energy absorbing

medium to absorb most of the energy

released during a design-basis loss-ofcoolant accident (LOCA). For BWRs the

medium is water contained in a suppression

pool, and for ice condenser containments,

the medium consists of numerous columns of

ice. The second approach, used in most

PWRs, is simply to design a large, strong

volume to receive the energy. All

containments also contain active cooling

systems, such as sprays and fan coolers, to

provide additional cooling and pressure

suppression during a design-basis accident.

These active systems do not act quickly

enough to affect the initial blowdown during

a large-break LOCA, but limit further

pressure increases and are also beneficial

during slower developing accidents.

Containments are designed to cope with the

accidents specified in Chapter 15 of the

Safety Analysis Report, as discussed in

Section 2.1. Design-basis accidents resulting

to the greatest predicted containment loads

are generally initiated by large reactor

coolant or main steam pipe breaks. As

described in Section 4.1, containments are

designed to survive such accidents with

considerable margin.

The China Syndrome and the Reactor Safety

Study began to cast doubt on the ability of

containments to survive all possible

accidents, and it became clear that risk to

the public is usually dominated by those

accidents in which the containment fails or

is bypassed. In a severe accident, there are

sources of energy and phenomena that can

cause a greater threat to containment than

the design-basis LOCA. The hydrogen burn

at Three Mile Island highlighted the

potential threats from severe accident

phenomena, even though the containment

survived that particular event. The

remainder of this module describes different

containment designs and the potential threats

to those designs.

4.0.2 Learning Objectives for Chapter 4

At the end of this chapter, the student should

be able to:

1. Describe the six basic containment

types and associated engineered

safety features.

2. Identify which containment types

are less susceptible to isolation

failures.

3. Contrast the potential failure

mechanisms for steel and concrete

containments.
Reactor Safety Course (R-800) 4.0 Accident Progression in the Containment

USNRC Technical Training Center 4.0-2 NUREG/CR-6042 Rev. 2

4. Describe the following causes of

containment failure. For each

cause, indicate when failure could

occur.

a. direct containment heating

b. fuel-coolant interactions

c. liner meltthrough

d. combustion

e. long-term overpressure

5. Describe a BWR accident scenario

in which venting of a Mark I or

Mark II containment might be

appropriate.

6. List at least one concern regarding

the containment if AC power is

restored late in a station blackout

accident.

7. Explain the different hydrogen

control measures used in BWR

Mark I, II, and III and PWR ice

condenser containment designs.

8. Characterize the usefulness of

hydrogen recombiners during

severe accidents.
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-1 NUREG/CR-6042 Rev. 2

4.1 Containment Characteristics and

Design Bases

4.1.1 Containment Types

There are six basic containment types used

for U.S. Light Water Reactors (LWRs).

Four of those designs primarily use the

passive pressure suppression concept, and

two rely primarily on large, strong volumes.

All of these containments are constructed of

either steel or concrete with a steel liner for

leak tightness. Except for Big Rock Point,

BWR designs, which have evolved from the

Mark I to the Mark III design, all use a

pressure suppression pool. A few

Westinghouse PWRs have ice-condenser

(pressure suppression) containments, but

most PWRs have large dry containments or

a subatmospheric variation of the large dry

containment. Table 4.1-1 lists the number of

containments of each type.1

 Figure 4.1-1

shows a comparison of the containment

volumes and design pressures for typical

containments.2 The design pressures for

containments are based on a very

conservative design process. If all isolation

features work properly, it is likely that

containments will not fail until the design

pressures have been greatly exceeded.

Figure 4.1-2 compares the design pressures

with realistic estimates of ultimate failure

pressures for six typical containments.3,4

The next six subsections describe the six

containment types in more detail. It is

important to note that there are plantspecific variations within each containment

type, and these discussions do not delineate

all of these design differences.

4.1.1.1 Large Dry Containments

A typical large dry containment is shown in

Figure 4.1-3. A large dry containment is

designed to contain the blowdown mass and

energy from a large break LOCA, assuming

any single active failure in the containment

heat removal systems. These systems may

include containment sprays and/or fan

coolers, depending on the particular design.

Large dry containments can be of either

concrete or steel construction. Concrete

containments have steel liners to assure leak

tightness. Large dry (and all other)

containments have a large, thick basemat

that provides seismic capability, supports the

structures, and may serve to contain molten

material during a severe accident.

During an accident, most of the water

introduced into containment through a pipe

break or relief valves collects in the sump.

The water can include the initial reactor

coolant inventory plus additional sources

injected into the reactor coolant system.

Water may enter containment as vapor,

liquid, or a two phase mixture. The liquid

portion drains quickly into the sump and the

vapor portion may condense (on structures

or containment spray drops or coolers) and

then drain into the sump. Once water

storage tanks have been depleted, water in

the sump is recirculated to the vessel and/or

the containment sprays using recirculation

systems to provide long-term heat removal.

It is important that the sumps be kept clear

of debris that could inhibit this recirculation.

Large dry containments are not as

susceptible to hydrogen combustion as other,

smaller containments. No systems are

provided for short term hydrogen control

during a severe accident (see Section 4.6).

However, hydrogen recombiners are

provided to allow long-term hydrogen

control.

4.1.1.2 Subatmospheric Containments

Subatmospheric containments are very

similar to large dry containments, as shown

in Figure 4.1-4. The major difference is that

the containment is maintained at a negative

pressure (~5 psi or 35 kPa) with respect to
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-2 NUREG/CR-6042 Rev. 2

the outside atmosphere. This negative

pressure means that leakage during normal

operation is into the containment rather than

to the atmosphere. Further, this negative

pressure provides some additional margin for

response to design basis accidents, and

therefore the design pressure and/or volume

can be reduced accordingly. Keeping the

containment at a subatmospheric pressure

also means that any significant containment

leaks will be readily detected, when

maintaining the negative pressure becomes

more difficult.

4.1.1.3 Ice Condenser Containments

Figure 4.1-5 shows the layout of an ice

condenser containment and Figure 4.1-6

shows the ice condenser in more detail. Ice

condenser containments are constructed of

either concrete or steel. Ice condenser

containments are the only PWR

containments that rely primarily on passive

pressure suppression. The containment

consists of an upper and a lower

compartment connected through an ice bed.

In the event of a design-basis LOCA, steam

flows from the break, into the lower

compartment, and up into the ice beds where

most of the steam is condensed. Return air

fans maintain a forced circulation from the

upper to lower compartments, enhancing

flow through the ice beds. One-way doors

are present at the entrance and exit of the

ice bed region. These doors open upon

slight pressure from the lower compartment,

but close if air flow occurs in the reverse

direction.

The ice beds are more than adequate to limit

the peak pressure from a design-basis

LOCA. However, in a long-term accident,

the ice will eventually melt and containment

heat removal will be required. Thus,

containment sprays are provided in the upper

compartment of the containment. Water

from the sprays drains through sump drain

lines down into the lower compartment

sump, where it can be recirculated for longterm heat removal. It is noteworthy that,

because of the melting ice, there will be

more water in the lower compartment during

many accidents than would be present in a

large dry containment. The effect of this

additional water upon severe accident

phenomena will be discussed in later

sections.

Because of their smaller volume, ice

condenser containments are more susceptible

to combustion events than large dry

containments. In fact, a combustion event

involving the same quantity of hydrogen that

was burned at TMI-2 might have led to

containment failure in an ice condenser

containment. Therefore, specific hydrogen

control requirements have been placed on ice

condenser containments. These requirements

are examined in Section 4.6.

4.1.1.4 BWR Mark I Containments

Mark I containments are provided for most

of the older BWR plants, 24 in number. The

Mark I is a pressure suppression

containment, which allows the containment

to be smaller in volume. The basic design is

shown in Figure 4.1-7. The containment is

divided into the drywell containing the

reactor vessel and the wetwell (torus)

containing the suppression pool. The

containment may be constructed of either

concrete or steel. The water in the

suppression pool acts as an energy absorbing

medium in the event of an accident. If a

LOCA occurs, steam flows from the drywell

through a set of vent lines and downcomers

into the suppression pool, where the steam

is condensed. Steam can also be released

from the reactor vessel through the safety

relief valves and associated piping directly

into the suppression pool. In the event that

the pressure in the wetwell exceeds the
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-3 NUREG/CR-6042 Rev. 2

pressure in the drywell, vacuum breakers are

provided that equalize the pressure.

The water in the suppression pool can be

recycled through the core cooling systems,

much the same as sump water is recycled in

a PWR. Long-term containment heat

removal can be provided by sprays or

suppression pool cooling systems either of

which can be aligned with appropriate heat

exchangers. In addition, Mark I

containments are equipped with lines

connected to the wetwell that can be used to

vent the containment if the pressure becomes

too high. As will be discussed later, the

particular venting strategy chosen can

significantly impact the course of an

accident.

Because of the small volume of the Mark I

containment, hydrogen control measures are

required. In this case, the drywell is inerted

with nitrogen during most of the operating

cycle to preclude the possibility of

combustion. More details on hydrogen

concerns for Mark I BWRs are contained in

Section 4.6.

4.1.1.5 BWR Mark II Containments

Mark II containments are similar in concept

to Mark I containments. Figure 4.1-8 shows

a Mark II containment. The suppression

pool design is simplified, and the entire

containment structure is more unified.

Instead of the complicated torus design

included in the Mark I containment, the

suppression pool simply sits in the wetwell

region below the drywell. Containment heat

removal systems (sprays and suppression

pool cooling) and nitrogen inerting strategies

are the same as for the Mark I containments.

Containment venting can also be performed

in a similar fashion to the Mark I

containments.

4.1.1.6 BWR Mark III Containments

While the Mark II design represented an

evolution of the Mark I design, the Mark III

design introduced major changes. A typical

Mark III containment is shown in Figure

4.1-9. Mark III containments can be freestanding steel or steel-lined concrete. These

containments have a drywell that functions

much as the older designs, but have a larger

surrounding containment that includes the

wetwell. In the Mark III design, the

suppression pool is located in an annular

region outside the drywell.

The suppression pool function is essentially

the same as in the older designs. In this

case, if there is a LOCA in the drywell, then

steam will flow through horizontal vents to

the suppression pool where the steam will be

condensed. It is possible for the blowdown

to cause the suppression pool to slosh over

the weir wall and partially fill the drywell.

In order to assure that adequate water is

available in the suppression pool, allowing

for recirculation, evaporation, and sloshing,

water can be added to the suppression pool

from the upper pool above the drywell.

If the pressure in the outer containment

exceeds the pressure in the drywell, then

vacuum breakers open to equalize the

pressure. Long-term containment heat

removal can be accomplished with

suppression pool cooling or by containment

sprays (with appropriate circulation of the

water through heat exchangers) in the outer

containment.

An important asset of the Mark III design is

construction of the outer containment around

the drywell, effectively providing a double

layer of protection. If containment failure

were to occur, in many cases the outer

containment would fail first, leaving the

drywell and suppression pool intact. Any

subsequent fission product releases would

still be scrubbed as they passed through the

suppression pool, greatly reducing the source
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-4 NUREG/CR-6042 Rev. 2

term. Thus, the only accidents (other than

bypass sequences) likely to produce large

source terms must involve failure of the

outer containment plus either loss of the

suppression pool or failure of the drywell.

Further, the containment sprays can be used

to remove fission products and reduce the

source term.

The Mark III design is an intermediate-sized

containment, much like the ice condenser

containment. It is large enough that inerting

is not required for hydrogen control, but still

small enough that some hydrogen control

measures are needed. Those measures are

discussed in later sections.

4.1.2 Containment Design Criteria

Section 2.1 provided a discussion of designbasis accidents, as included in Chapter 15 of

the Safety Analysis Report (SAR). For

containments, the design must preclude

exceeding of the 10 CFR 100 dose

guidelines, given the most limiting accident

evaluated in Chapter 15. Specifically, the

requirements of 10 CFR 50, Appendix A,

General Design Criterion 50 state:

The reactor containment structure,

including access openings,

penetrations, and the containment

heat removal system shall be

designed so that the containment

structure and its internal

compartments can accommodate,

without exceeding the design leakage

rate and with sufficient margin, the

calculated pressure and temperature

conditions resulting from any lossoff-coolant accident.5

It is interesting to note that, while the

criterion indicates any loss-of-coolant

accident, only those LOCAs considered in

Chapter 15 of the SAR are actually

considered. For example, the containments

are not specifically designed for Reactor

Vessel Rupture or Steam Generator Rupture.

Generally, one of the most limiting Chapter

15 accidents is the large break LOCA. The

large break LOCA tends to produce both

higher pressures and more fission products

in containment than the other Chapter 15

accidents. Main Steam Line Breaks tend to

produce the highest temperatures in

containment and determine the temperature

design limits.

Section 2.1 discusses the calculations

involved in analyzing a Chapter 15 accident,

including the significant conservatisms.

Figures 4.1-10, 4.1-11, and 4.1-12 depict

containment pressure, temperature and

energy balance results for PWR design-basis

LOCAs in a large dry containment. Figure

4.1-10 shows the calculated containment

pressures resulting from a spectrum of

postulated reactor coolant system pipe

breaks. For this set of calculations the

maximum containment pressure of 50.21

psig (346 kPa) occurs for an 8 ft2

 (0.74 m2)

reactor coolant pump discharge line break.

Figures 4.1-11 and 4.1-12 provide more

detail for this particular accident. In this

accident, the blowdown takes approximately

25 sec. Despite the fact that the blowdown

occurs with no containment cooling systems

operating, the peak pressure does not occur

during this period. The reflooding of the

core, which includes core flood tank

injection at 15.3 sec. and emergency core

cooling at 26 sec., generates additional

steam which continues to pressurize

containment until about 918 sec., when the

peak pressure is reached. In this calculation,

which can vary for other plants, a

containment cooler is started at 43 sec. and

the sprays are started at 67 sec., providing

some positive reduction in the peak pressure.

After 918 sec., the pressure declines, and

recirculation cooling from the sump is

established at 3500 sec.
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-5 NUREG/CR-6042 Rev. 2

While the large break LOCA presents the

most significant design-basis accident

pressure challenge for containment

designers, there are other types of loads that

must be considered in the design.6

 These

loads include:

1. temperature transients and gradients

2. safe shutdown earthquake loads

3. internal and external missiles

4. mechanical loads from pipe rupture

5. external pressures

6. winds and tornadoes.

Section 2.1.4 described the design basis for

seismic and other external events. Thermal

transients and gradients could conceivably

lead to stresses and cracks or tears in the

containment. Missiles can come from many

sources, including control rod ejection,

shrapnel from a failed pipe, or aircraft

impact. When a pipe ruptures, the resulting

forces on the piping could cause failure at

the point where the piping penetrates the

containment. External pressures (and

buoyant forces) can result due to external

increases in barometric pressure or internal

drops in pressure resulting from internal

cooling or inadvertent spray operation.

In practice, it is impossible to design and

construct a perfect containment, that is, one

that has zero leakage over the range of

postulated accident conditions. Therefore,

nonzero design leakage rates are established

that are intended to be as low as can be

reasonably achieved and that will keep the

offsite exposures below the dose guidelines

established in 10 CFR 100.7

 These design

leakage rates can be site- and plant-specific

because the offsite doses are affected by the

site geometry and the local meteorology, as

well as the reactor type. However, some

plants simply use standard technical

specifications that are more stringent than a

site-specific analysis would allow.

Leakage from a containment structure can

occur due to failure of the containment

structure, failure of penetrations through the

structure, and failure of isolation valves.

Penetrations through the containment

structures include piping penetrations,

electrical penetrations, hatches and airlocks.

Isolation valves are provided on all pipes

and ducts that penetrate the containment.

Normally, two isolation valves are provided

for each line, with the isolation valves

consisting of locked closed or automatic

isolation valves. Requirements for these

isolation valves are contained in 10 CFR 50,

Appendix A, General Design Criteria 54

through 57.8

Containment leakage rates are determined in

the SAR and Technical Specifications.

Criteria for testing containment leakage are

set forth in 10 CFR 50, Appendix J.9 This

appendix became effective in 1973. Its

purpose is to implement, in part, 10 CFR 50,

Appendix A, General Design Criteria 16

which mandates “an essentially leak-tight

barrier against the uncontrolled release of

radioactivity to the environment ...” for

postulated accidents. Until 1995 this

appendix specified prescriptive containment

leakage-testing requirements, including the

types of tests required, how they should be

conducted, and the reporting requirements.

Effective October 26, 1995, an amendment

to Appendix J was issued which added an

alternative method, based on performance

and risk, for meeting the containment

leakage rate test requirements.10 This

method is designated as Option B; the

original Appendix J method is referred to as

Option A. Guidance for the implementation

of Option B is provided in NRC Regulatory

Guide 1.163.11 With either option, three

types of tests are generally performed to

assure leakage remains within design limits:

1. Type A tests - tests of the overall

integrated leakage rate,
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-6 NUREG/CR-6042 Rev. 2

2. Type B tests - tests to detect local leaks

around containment penetrations, and

3. Type C tests - tests to measure

containment isolation valve leakage rates.

Table 4.1-2 provides examples of design

leakage rates that correspond to Option A of

Appendix J. The higher allowed leakage

rates for the pressure suppression

containments is a result of their smaller

volumes. Although the criteria are

somewhat different, the allowable leakage

permitted under Option B of Appendix J is

1.0 wt.%/day. This reflects the NRC

conclusion that a small additional leakage

would have no significant impact on safety.

Assuring that the design leakage rates are

met is a complex process involving a variety

of tests, some of which are difficult to

perform. Based on an analysis of past

containment tests, Option B of Appendix J

was developed to simplify the testing

process, primarily by allowing the testing

frequency to be reduced if the results of past

tests demonstrate high containment

performance and therefore low risk of

significant leakage. Table 4.1-3 provides a

comparison of the test frequency

requirements for the two Appendix J

options. This table illustrates the advantage

that Option B provides if the containment

leakage requirements are consistently met.

However, in recognition of the costs and

effort required to implement a new testing

process, licensees can continue to test under

Option A; conversion to Option B is

voluntary.

The amount of leakage from a containment

is a function of the length of time that the

containment remains pressurized. Further,

there are some postulated accidents in which

energy may be added to containment for

many hours of even days. Therefore, the

NRC has established requirements for

containment heat removal. These

requirements are contained in 10 CFR 50,

Appendix A, Criterion 38.12 Containment

heat removal systems may involve sprays,

fan coolers, suppression pool cooling, or

emergency core cooling recirculation cooling

and must meet the single failure criterion.

4.1.3 Containment Failure Modes

In the event that a containment does fail, the

manner in which it fails can have a

significant impact on offsite releases. If a

containment leaks slowly, then large

fractions of the radionuclides may still be

retained inside the containment or

surrounding buildings, depending on where

the leak occurs. Retention can result from

gravitational settling of radioactive aerosols

inside the containment or surrounding

buildings or from sprays or other systems

removing the radionuclides from the

containment atmosphere. The effectiveness

of these processes depends upon the

residence time of the radionuclides in

containment. Conversely, a large rupture of

the containment can lead to rapid transport

of radionuclides to the environment with

minimal retention.

The containment failure mode that occurs

depends upon the containment design and

the particular phenomena that cause the

failure. Particular severe accident

phenomena (including those beyond the

design-basis) will be discussed in later

sections; however, the challenges that they

produce include:

1. overpressure

2. dynamic pressures (shock waves)

3. internal missiles

4. external missiles

5. meltthrough

6. bypass.
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-7 NUREG/CR-6042 Rev. 2

Overpressure can theoretically lead to either

leakage or large rupture in any type of

containment. Overpressure can result from

several different causes, as discussed in later

sections. However, it is important to

recognize that pressure transients following

reactor vessel blowdown under severe

accident conditions can be more severe than

those normally considered in the analyses of

design-basis accidents. This is true because

of the initial containment pressure increases

caused by hydrogen generation and

containment heating during the early phases

(prior to reactor vessel failure) of a severe

accident. As a containment is pressurized,

it begins to deform. High temperatures

exacerbate the problem. These deformities

can lead to leakage around penetrations in

the containment or to tearing of the steel

liner (in concrete containments). Based on

recent studies, leakage is considered the

more likely outcome for concrete

containments.13 The concrete structure is

unlikely to rupture as a result of pressure

challenges (even if the steel liner tears), but

rather is more likely to crack. Steel

containments are susceptible to rupture in

the event that the penetrations do not leak

and the containment continues to pressurize.

Given sufficient pressure, a crack in a steel

containment can propagate catastrophically.

Generally, assuming that early penetration

leakage does not occur, steel containments

have a larger margin between the design and

ultimate failure pressures than concrete

containments.

Shock waves and missiles can potentially

cause large holes in the containment.

However, the containments are designed for

the most credible external missiles, such as

tornado-driven missiles, and some types of

internal missiles, such as control rod

ejections. Missiles or shock waves resulting

from hydrogen detonations or steam

explosions are a possible threat that will be

discussed in more detail later.

There are two basic types of meltthrough to

consider. First is the possibility of basemat

meltthrough (the China Syndrome). In this

case, following vessel failure the molten

material melts through the basemat over a

period of hours or days and vents the

containment through the surrounding soil

and can release substantial amounts of

contaminated water. This failure mode is

not generally catastrophic, because of the

long time available for emergency response

actions and the possibility of some retention

in the soil. The second type of meltthrough

is most applicable to Mark I BWR

containments. In this case, molten material

can exit the area beneath the reactor and

flow across the floor, directly contacting the

steel liner and causing it to fail. This type

of failure, which is addressed in more detail

in Section 4.7, can happen much more

quickly than basemat meltthrough and can

lead to more serious consequences. A

similar scenario may be possible for PWR

ice condenser containments, if debris is

blown out of the reactor cavity near the seal

table.

There are two other types of containment

failure that can lead to severe consequences:

(1) containment bypass and (2) isolation

failure. Containment bypass involves failure

of the reactor coolant system boundary in

such a manner that a path is created to the

outside without going through containment.

Bypass involves failures in the reactor

coolant pressure boundary separating high

pressure and low pressure systems.

Normally, this involves the failure of at least

two valves. For example, the valves

separating the primary system from the

Residual Heat Removal (RHR) system may

fail, thus putting high pressure into the RHR

system. Because the RHR system is

normally constructed with low pressure

piping and components, it may fail outside

containment, providing a direct path from
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-8 NUREG/CR-6042 Rev. 2

the core to the outside. Such sequences are

usually referred to as interfacing systems

LOCAs. In PWRs, steam generator tube

ruptures provide an additional possibility of

containment bypass. Primary system

pressure will lift the relief valves on the

secondary side, with the potential for stuckopen valves to provide the path to the

atmosphere.

Containment isolation failure involves

failure of the containment isolation function

as a result of containment isolation valve

failures or other openings in the containment

boundary external to the reactor coolant

system. These failures may be the result of

preexisting leaks or the failure of isolation

valves to close upon demand. The failures

are more related to system and procedural

malfunctions, rather than severe accident

phenomena. In this case, the containment

has no chance to function and fission

products have a direct path outside to the

atmosphere. Isolation failures are less

likely in Mark I and II BWRs because of

their inerted containments that make large

leaks easily detected. Similarly, isolation

failures are unlikely in PWR subatmospheric

containments. 

It should be recognized that plant-specific

containment design differences abound,

many with important ramifications with

respect to plant response under severe

accident conditions. This is true even for

supposedly “sister” plants such as the

Browns Ferry and Peach Bottom plants with

Mark I containments. A good example is

provided by Figure 4.1-13, which affords a

subjective comparison of the bolting

arrangements used at these two plants for

the respective drywell head closure flanges.

In this case, the Browns Ferry arrangement

is

less prone to flange separation by bolt

elongation at elevated temperatures. This

difference may be important for severe

accident sequences involving high drywell

temperatures (see Section 4.2), since the

integrity of the silicon seals has been

demonstrated14 to degrade significantly at

temperatures in excess of about 600 K

(620 oF). The point here is that the failure

pressure can vary with temperature and can

be affected by seemingly unimportant design

differences.
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-9 NUREG/CR-6042 Rev. 2

Table 4.1-1 Number of U.S. containments of each type

Containment Type Number

PWR Large Dry 59*

PWR Subatmospheric 7

PWR Ice Condenser 9

BWR Mark I 24

BWR Mark II 8

BWR Mark III 4

*Includes Big Rock Point, which is a BWR I.

Table 4.1-2 Examples of design leakage rates (integrated leakage)*

Plant Containment

Type

Peak DesignBasis Accident

Pressure

psig (kPa)

Maximum

Allowable

Leakage 

(wt.%/day)

Peach Bottom BWR Mark I 49.1 (339) 0.5

LaSalle BWR Mark II 39.6 (273) 0.635

Grand Gulf BWR Mark III 11.5 (79) 0.437

Sequoyah PWR Ice

Condenser

12 (83) 0.25

Surry Subatmospheric 45 (310) 0.1

Zion Large Dry 47 (324) 0.1

*data taken from the following reports:

Integrated Leak Rate Test Report for Peach Bottom Unit 3, March 18, 1992.

Integrated Leak Rate Test Report for LaSalle Unit 1, March 12, 1992.

Integrated Leak Rate Test Report for Grand Gulf Unit 1, August 4, 1989.

Integrated Leak Rate Test Report for Sequoyah Unit 2, February 19, 1985.

Integrated Leak Rate Test Report for Surry Unit 2, September 3, 1991.

Integrated Leak Rate Test Report for Zion Unit 1, July 5, 1988.
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-10 NUREG/CR-6042 Rev. 2

Table 4.1-3 10 CFR 50 Appendix J test frequency requirements

Test

Type

Option A Option B

A 1. Preoperational leakage rate test.

2. Three tests during each 10 year service

period, at approximately equal intervals.

3. If any periodic test fails, the schedule for

subsequent tests will be reviewed and

approved by the Commission. A summary

report must be provided to the NRC.

4. If two consecutive tests fail, a test is

required at each refueling or every 18

months, whichever comes first. 2. Applies

after two consecutive successful tests.

1. Preoperational leakage rate test.

2. Test within 48 months and then at

periodic interval (maximum of 10 years)

based on past leakage performance of

containment.

3. If test fails, successful test required

within 48 months before returning to

extended test interval.

4. Visual inspection of containment interior

and exterior required prior to each test. 

Perform two additional inspections at

refueling outages prior to the next test if

the interval has been extended to 10

years.

5. Test results which exceed performance

criteria may require reporting to NRC

(e.g., License Event Report [LER]).

B 1. Except for airlocks:

(a) Tests required during shutdown for

refueling, or other convenient

interval, but at least every 2 years.

(b) Frequency of tests reduced for

penetrations employing a

continuous leakage monitoring

system.

2. Airlocks: Tests required prior to initial fuel

loading and at six-month intervals

thereafter.

3. If any periodic test fails, a summary report

must be provided to the NRC.

1. Test prior to initial criticality.

2. Test within 30 months and then at

periodic interval based on safety

significance and past performance of

each non-airlock boundary.

3. If test fails, successful test required

within 30 months before returning to

extended test interval.

4. Tests required at least every 10 years. 

The maximum interval for airlocks is 30

months.

5. Test results which exceed performance

criteria may require reporting to NRC

(e.g., LER).

C 1. Tests required during shutdown for

refueling, but at least every 2 years.

2. If any periodic test fails, a summary report

must be provided to the NRC.

1. Test prior to initial criticality

2. Test within 30 months and then at

periodic interval based on safety

significance and past performance of

each isolation valve.

3. If test fails, successful test required

within 30 months before returning to

extended test interval.

4. Tests required at least every 60 months. 

The maximum interval for certain valves

(e.g., main steam valve in BWRs) is 30

months.

5. Test results which exceed performance

criteria may require reporting to NRC

(e.g., LER).
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-11 NUREG/CR-6042 Rev. 2

Figure 4.1-1 Typical containment volumes and design pressure (psig)
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-12 NUREG/CR-6042 Rev. 2Figure 4.1-2 Comparison of design pressure and ultimate failure pressure 
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-13 NUREG/CR-6042 Rev. 2

Figure 4.1-3 Typical large dry containment
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-14 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-15 NUREG/CR-6042 Rev. 2

Figure 4.1-5 Typical ice condenser containment
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-16 NUREG/CR-6042 Rev. 2

Figure 4.1-6 Ice condenser cutaway
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-17 NUREG/CR-6042 Rev. 2

Figure 4.1-7 Typical BWR Mark I containment
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-18 NUREG/CR-6042 Rev. 2

Figure 4.1-8 Typical BWR Mark II containment
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-19 NUREG/CR-6042 Rev. 2

Figure 4.1-9 Typical BWR Mark III containment
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-20 NUREG/CR-6042 Rev. 2 Figure 4.1-10 Peak containment pressure for one PWR
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-21 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-22 NUREG/CR-6042 Rev. 2Figure 4.1-12 Energy changes up to time of peak containment pressures for one PWR
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-23 NUREG/CR-6042 Rev. 2

Figure 4.1-13 Different bolting arrangements on drywell head

closure flange for Browns Ferry and Peach Bottom
Reactor Safety Course (R-800) 4.1 Containment Characteristics and Design Bases

USNRC Technical Training Center 4.1-24 NUREG/CR-6042 Rev. 2

References for Section 4.1

1. U.S. Nuclear Regulatory Commission,

World Wide Web Site,

http://www.nrc.gov, May 10, 1996.

2. A. L. Camp, et al., “Light Water

Reactor Hydrogen Manual,”

NUREG/CR-2726, SAND82-1137,

Sandia National Laboratories, August

1983.

3. U. S. Nuclear Regulatory Commission,

“Severe Accident Risks: An Assessment for Five U.S. Nuclear Power

Plants,” NUREG-1150, December 1990.

4. T. D. Brown, et al., “Integrated Risk

Assessment for the LaSalle Unit 2

Nuclear Power Plant: Phenomenology

and Risk Uncertainty Evaluation

Program (PRUEP),” NUREG/CR-5305,

SAND90-2765, Sandia National

Laboratories, 1992.

5. U.S.Code of Federal Regulations, Title

10, Part 50, Appendix A, General

Design Criterion 50, U.S. Government

Printing Office, January 1, 1991.

6. Kenneth C. Lish, “Nuclear Power Plant

Systems and Equipment,” Industrial

Press Inc., 200 Madison Avenue, New

York, New York, 1972.

7. U.S. Code of Federal Regulations, Title

10, Part 100, U.S. Government Printing

Office, January 1, 1991.

8. U.S. Code of Federal Regulations, Title

10, Part 50, Appendix A, U.S.

Government Printing Office, January 1,

1991.

9. U.S. Code of Federal Regulations, Title

10, Part 50, Appendix J, U.S.

Government Printing Office, January 1,

1991.

10. U.S. Code of Federal Regulations, Title

10, Part 50, Appendix A, General

Design Criterion 38, U.S. Government

Printing Office, January 1, 1991.

11. U.S. Nuclear Regulatory Commission,

“Performance-Based Containment LeakTest Program,” NRC Regulatory Guide

1.163, September 1995.

12. U.S. Code of Federal Regulations, Title

10, Part 50, Appendix A, General

Design Criterion 38, U.S. Government

Printing Office, January 1, 1991.

13. R. J. Breeding, et al., “Evaluation of

Severe Accident Risks: Quantification

of Major Input Parameters,”

NUREG/CR-4551, Vol. 2, December

1986.

14. D. A. Brinson and G. H. Graves,

“Evaluation of Seals for Mechanical

Penetrations of Containment

Buildings,” NUREG/CR-5096,

SAND88-7016, Sandia National

Laboratories, August 1988.
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-1 NUREG/CR-6042 Rev. 2

4.2 Containment Response to BeyondDesign-Basis Accidents

As discussed in Section 4.1, containments

are not likely to fail from the loads resulting

from design-basis accidents. In fact, there

are very large margins between the pressures

resulting from design-basis accidents and

predicted ultimate failure pressures.

However, the China Syndrome and the

Reactor Safety Study made it clear that more

severe challenges to containment were

possible.1,2 In fact, it appeared that public

risk was probably dominated by accidents in

which substantial core damage occurred and

the containment failed or was bypassed. The

TMI-2 accident further emphasized the

importance of phenomena, such as hydrogen

combustion, that could accompany severe

accidents. This section provides some

general perspectives on the vulnerabilities of

containments to severe accident phenomena.

Later sections will describe key severe

accident phenomena in more detail.

4.2.1 Containment Challenges and

Timing of Events

Challenges to containments can occur during

four time regimes:

1. at the start of the accident,

2. prior to reactor vessel failure,

3. at or soon after reactor vessel failure, or

4. long after reactor vessel failure.

Table 4.2-1 summarizes the time regimes

and their associated containment challenges.

Isolation failures and bypass occurring at the

start of the accident were addressed in

Section 4.1. The three other time regimes

are discussed below.

Prior to vessel failure, there are three types

of containment pressure loads that can occur.

The first type of load includes the pressure

loads that result from the initial reactor

coolant system blowdown and subsequent

steam and hydrogen releases due to

reflooding. For design-basis accidents, these

loads are not a threat; however,

containments are not designed to withstand

the loads that may occur during some severe

accidents resulting from the rupture of a

reactor vessel or steam generator. As of

early 1996, there have been no definitive

studies concerning the likelihood of

containment failure from such events;

fortunately, the frequency of such events is

estimated to be very small.

As a related matter, it should be noted that

the occurrence of high containment pressure

signals does not necessarily mean that a

LOCA has occurred. Loss of drywell

coolers and the concomitant increase in

drywell temperature will cause the drywell

pressure in the relatively small Mark I and

Mark II containments to exceed the alarm

setpoints (about 1.7 psig or 12 kPa) within

a few minutes. Although this temperatureinduced pressure increase has no

implications with respect to the integrity of

the drywell boundary, its effect in generating

one of the LOCA accident signatures

illustrates a potential for operator confusion

under conditions such as those

accompanying Station Blackout.

A second type of load that can occur prior to

vessel breach involves the failure of

containment heat removal systems to cope

with the ongoing mass and energy additions

to the containment even though core cooling

is successful. This problem can occur in

many ATWS sequences or in LOCAs or

transients in which containment heat

removal systems fail. In the latter cases, the

design pressure may be exceeded early, but

the ultimate failure pressure would not be

reached for many hours or even days. In

fact, some containments may not fail at all,

if the heat losses through the structure can

eventually match the decreasing decay heat
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-2 NUREG/CR-6042 Rev. 2

load. If the containment does fail, then

there is the potential for the loss of core

cooling as a result of several phenomena,

including:

1. loss of net positive suction head (NPSH)

to pumps that are recirculating water

from a heated sump or suppression pool,

2. failure of piping as a result of the

containment failure, or

3. failure of core cooling system

components located in the reactor

building of a Mark I or Mark II BWR

when steam enters the surrounding

reactor building following containment

failure.

If core damage results from one of these

phenomena, then the accident will proceed

in a containment that is already failed.

The third phenomena that can cause failure

prior to vessel breach is hydrogen

combustion. Hydrogen will be generated

during the core heatup and meltdown phase

due to zirconium-steam reactions. If a

significant amount of this hydrogen is

released through relief valves (as at TMI-2)

or through a pipe break, then combustion

prior to vessel breach can threaten the

containment. Hydrogen combustion is

discussed in more detail later in this module.

The second time phase of interest, and the

one that is often most threatening to

containment, is the phase that occurs at or

soon after vessel breach. When vessel

breach occurs, there are several phenomena

that can ensue, sometimes acting

simultaneously. Those phenomena include:

1. steam spike,

2. steam explosion,

3. direct containment heating,

4. hydrogen combustion,

5. containment shell meltthrough,

6. downcomer failure (Mark II BWR).

Steam spikes or explosions can occur if

there is water in the reactor cavity or

pedestal region below the reactor vessel. Invessel steam explosions and alpha mode

failures were addressed in Module 3. Water

may be present below the vessel as a result

of leakage from the reactor coolant system,

the operation of containment sprays, or

melted ice in an ice condenser containment.

By themselves, steam spikes are unlikely to

threaten containment, unless the containment

is already substantially pressurized. The

amount of mass and energy added to the

containment atmosphere is determined by the

amount of water converted to steam as the

melt is quenched in the water. If a steam

explosion occurs, then shock waves may

cause damage to the containment structure or

the vessel supports. If the vessel supports

fail and the vessel moves significantly, then

containment failure may result around the

piping penetrations. In some BWRs, steam

explosions could lead to suppression pool

bypass, possibly resulting in eventual

overpressurization of the containment.

Steam explosions are discussed more in

Section 4.3.

Direct Containment Heating (DCH) involves

the ejection of the melt from the vessel at

high pressure, thus spraying the molten

material into containment. With the melt

broken up into small particles, rapid heat

transfer to the containment atmosphere can

occur, most likely accompanied by the

chemical energy associated with oxidation of

metals in the melt. This "direct heating" has

the potential to transfer more energy to the

containment atmosphere than a steam spike

and provides a more significant threat to

containment. DCH is discussed more in

Section 4.5.
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-3 NUREG/CR-6042 Rev. 2

When the reactor vessel fails, any hydrogen

contained in the reactor coolant system will

be released to containment, and additional

hydrogen may be generated as a result of

chemical reactions accompanying steam

spikes, steam explosions, or direct

containment heating. This hydrogen may

burn immediately if sufficient oxygen is

present, particularly if the molten material

provides an ignition source or the hydrogen

is already at very high temperatures.

Hydrogen combustion at vessel breach may

directly threaten containment or may

threaten containment in combination with

one or more of the other phenomena that can

occur.

A phenomenon of importance primarily for

Mark I BWRs is shell (liner) meltthrough.

At vessel breach, the molten material may

flow out of the pedestal region, across the

drywell floor and then directly contact the

steel liner, causing failure. The likelihood

of this event and potential means for its

mitigation are discussed in more detail in

Section 4.7.

A phenomenon of importance for Mark II

BWRs is downcomer failure. While Mark II

designs vary significantly, there is often the

potential for molten material to flow across

the floor and into the downcomers. This

molten material may directly fail the

downcomer or, possibly, lead to a steam

explosion that fails the downcomer.

Downcomer failure does not lead to

immediate containment failure; however, the

suppression pool is bypassed, thus negating

its heat removal and fission product

scrubbing capabilities.

The third time phase of interest is the late

phase, hours or more after vessel failure.

The late phase threats consist primarily of

high temperature, overpressure, basemat

meltthrough, and hydrogen burns. High

temperature and long term overpressure can

result if containment heat removal systems

are inoperative. In a BWR, high drywell

temperatures can result even if the

suppression pool cooling systems are

working. With most of the core materials

now present in the containment, the decay

heat must be removed somehow to prevent

temperature and pressure buildup. High

temperatures can result in weakened

structures that may leak more than expected

or fail at pressures lower than the expected

ultimate failure pressure. The problem is

exacerbated by noncondensible gases that

can be generated by core-concrete

interactions. These noncondensible gases

contribute to the overall pressure.

Basemat meltthrough is a long term result of

core-concrete interactions. These interactions

can generate hydrogen and other noncondensible gases, generate copious amounts

of radioactive and nonradioactive aerosols,

and eventually fail the basemat. Coreconcrete interactions will be discussed in

more detail in Section 4.4.

Hydrogen burns can also occur during the

late phase. In some cases this may involve

hydrogen that was present previously, but

did not burn due to the lack of an ignition

source or an excess of steam in the

atmosphere. If steam is removed late in an

accident, for example, due to recovery of

sprays, a gaseous mixture that was inert may

become flammable. Another factor affecting

hydrogen burns is the amount of flammable

gases (hydrogen and carbon monoxide) being

generated from core-concrete interactions.

These additional gases can lead to burning

late in an accident.

Section 4.2.1 has summarized the time

phases of an accident and the phenomena

that occur during those phases. Section

4.2.2 will now discuss estimates of

containment failure probabilities as a result

of those particular phenomena.
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-4 NUREG/CR-6042 Rev. 2

4.2.2 Implications of Containment Failure

The significance of containment failure

depends upon the particular accident

sequence, the mode of containment failure

and the timing of radioactive releases.

Module 5 addresses the importance of the

timing of releases relative to warning times

and evacuation speeds. The importance of

accident sequence type and containment

failure mechanisms are discussed briefly

below.

Containment failure can only represent a

significant concern if radionuclides are

released from the fuel and the reactor

coolant system. If fuel melting does not

occur and only the activity in the reactor

coolant and the radioactive gases in the fuel

pins (gap release) are released, then the

consequences will be minimal even if

containment failure occurs.

If fuel melting does occur and a significant

amount of radionuclides is released to

containment, then the timing and mode of

containment failure are critical factors in

determining the offsite consequences.

Generally, the most severe failure modes are

ones that occur early in time (before or

during reactor vessel failure) so that there is

little settling or other retention of

radionuclides in the containment.

Radionuclides can be retained in

containment in a number of ways:

1. scrubbing in suppression pools,

2. scrubbing by containment sprays,

3. retention in an ice condenser,

4. gravitational settling and other natural

processes,

5. trapping along tortuous release paths.

Most of these retention mechanisms are

affected by the time available for the

mechanism to work. Small containment

leaks allow more time for settling and

scrubbing by sprays. Therefore, ruptures are

more likely to lead to severe consequences

than leaks. If the radionuclides can be

mostly retained until after evacuation occurs,

then many of the health effects can be

substantially reduced. Also, failures that

lead into surrounding buildings allow further

opportunities for retention.

Module 5 will discuss the offsite

consequences of particular accident types in

more detail. However, the importance of

containment failure can be summarized by

stating that the worst failures are failures (or

bypasses) that occur early and allow rapid,

unscrubbed transit of radionuclides out of

the containment.

4.2.3 Likelihood of Containment Failure

During Severe Accidents

The most comprehensive study of

containment failure probabilities is contained

in the NUREG-1150 documents.3

 In

addition, the industry has performed

individual plant examinations (IPEs)

assessing the performance of containments in

severe accidents. Seventy-five IPE

submittals covering 108 units are included in

the discussions below.4

 Despite the fact that

severe accidents provide challenges beyond

the design-basis, NUREG-1150 (and the IPE

studies) show that containments have the

capacity to withstand many of these

accidents. This capability is a result of the

very conservative design process that

provides substantial margin with respect to

less severe design-basis accidents.

The likelihood of actual containment failure

is usually considered according to one of

two measures: conditional containment

failure probability (CCFP) and containment
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-5 NUREG/CR-6042 Rev. 2

failure frequency (CFF). Both of these

measures depend upon several factors,

including the particular containment design

and accident sequence. The conditional

containment failure probability is the

probability of containment failure given an

accident. The containment failure frequency

is the frequency per reactor year of accidents

involving containment failure. These

quantities are determined from: 

where

CCFP is the conditional containment

failure probability,

CFF is the containment failure frequency,

CDF is the total core damage frequency,

Si

 is the frequency of accident sequence

i,

Ci

 is the conditional probability of

containment failure given accident

sequence i,

and

n is the total number of accident

sequences.

Because Si

 and Ci depend on the particular

accident sequences (which vary considerably

among the plants), both CCFP and CFF can

be significantly different for two plants with

identical containments.

Most of the time, values for CCFP and CFF

are calculated for early failures and bypass

events. Failures happening many hours after

core damage normally contribute much less

to public risk. Figure 4.2-1 shows the

relative probability of different containment

failure modes (CCFP), given a core damage

accident, for the five plants evaluated in

NUREG-1150. In this figure, early failures

include failures that occur before, at, or soon

after vessel breach. Note that many of the

outcomes at Grand Gulf, which has a Mark

III containment, involve failure of the outer

containment with the drywell and

suppression pool remaining intact.

Therefore, the containment failures for

Grand Gulf do not all lead to significant

radiological releases.

With the caveat noted above for Grand Gulf,

the failures that most impact public risk are

the early failures and the bypass events.

Figure 4.2-2 shows the CFFs of such events

for the five NUREG-1150 plants and the

IPEs. Figure 4.2-3 shows the CCFP for the

same plants. These figures, which consider

only internally initiated accidents (the IPEs

include internal flooding), account for the

variation in accident frequency and type. As

noted in Module 2, Grand Gulf has a

substantially lower core damage frequency

than Sequoyah, and this is reflected in a

lower containment failure frequency, even

though Grand Gulf has a higher probability

of early failure given an accident (CCFP).

Because of the risk importance of early

releases, the phenomena, mechanism, and

accident scenarios that can lead to such

releases are of particular interest. These

involve early structural failure of the

containment, containment bypass,

containment isolation failures and, for some
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-6 NUREG/CR-6042 Rev. 2

BWR plants, deliberate venting of the

containment.

As a group, the large dry PWR containments

analyzed in NUREG-1150 and the IPEs have

significantly smaller conditional

probabilities of early structural failure

(given core melt) than the BWR pressure

suppression containments analyzed.

Nonetheless, containment bypass and

isolation failures are generally more

significant for the PWR containments. As

seen in Figure 4.2-2, however, these general

trends are often not true for individual IPEs

because of the considerable range in the

results. For instance, conditional

probabilities for both early and late

containment failure for a number of large

dry PWR containments were higher than

those reported for some of the BWR

pressure suppression containments.

The results for BWRs, grouped by

containment type, follow expected trends

and indicate that, in general, Mark I

containments are more likely to fail during

a severe accident than the later Mark II and

Mark III designs. However, the ranges of

predicted failure probabilities are quite high

for all BWR containment designs and there

is significant overlap of the results, given

core damage. A large variability also exists

in the contributions of the different failure

modes for each BWR containment group.

However, plants in all three BWR

containment groups found a significant

probability of early or late structural failure,

given core damage.

The Commission has previously considered

a subsidiary safety goal involving the

frequency of containment failures that are

accompanied by large releases of

radioactivity. The goal was tentatively set

at 10-6 per reactor year. However, the

commission abandoned this goal due to

difficulties in achieving consensus on an

appropriate definition of a large release. An

alternate subsidiary safety goal of an

average CCFP of 0.1 is still being

considered. It is not clear whether the

CCFP goal should include all containment

failures or only early failures and bypass.

Figure 4.2-3 shows that few plants meet this

goal if all failures are considered, and most

of the BWRs do not meet the goal even for

early failures and bypass. No new specific

actions to deal with BWR containments,

based on IPE findings, were being planned

as of mid 1997. Low core-damage

frequencies for BWRs provide partial

justification for a lack of action.

More recently, the staff has been considering

a return to a large release goal. As

discussed in Section 2.6, a large early

release frequency of 10-5 per year has been

proposed as part of the risk-informed

regulation initiative. Note that, if this

approach is implemented, there will not be a

direct measure of containment performance

as part of the decision criteria. That is, a

plant could meet the numerical goal with a

low core-damage frequency and a poor

containment. However, qualitative consideration of defense-in-depth is intended to

assure that containment performance is not

neglected entirely.

4.2.4 Containment Venting Strategies

Containments are somewhat unusual in that

they are pressure vessels without safety

relief valves. Thus, if containment heat

removal is lost, there is no designed-in

feature to prevent structural failure. Most

containments have penetrations that could

conceivably be used to vent the containment

and relieve pressure. These penetrations

include the lines used for leak rate testing,

among others. However, most plants do not

have procedures for venting during an

accident. There are several reasons for this,

including the belief that it is unnecessary,
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-7 NUREG/CR-6042 Rev. 2

the requirements for AC power for valves,

the desire to avoid guaranteed release of

radioactive materials, and the potential

hazards to personnel involved in the venting

process.

Recently, utilities with BWR Mark I and II

containments have included venting in their

emergency procedures. Venting can be

particularly valuable for accident sequences

involving the long-term loss of containment

heat removal in Mark I and II BWRs. In

these sequences, often referred to as TW

sequences, core cooling is initially

successful. However, the loss of

containment heat removal leads ultimately to

containment failure. After containment

failure, the core cooling systems may fail as

a result of the loss of net positive suction

head or from the harsh environments due to

steam in the reactor building. In some

cases, core cooling may fail even before the

containment fails. For some BWR plants,

high containment pressure can cause the

Automatic Depressurization System (ADS)

valves to close, leading to the loss of low

pressure injection systems. In others, the

reactor core isolation cooling system will

fail due to high turbine exhaust

backpressure. Venting can prevent these

problems.

The particular venting procedures vary

widely from plant to plant, but include use

of leak rate testing lines and lines to the

standby gas treatment systems. These plants

generally have several possible lines that can

be used, ranging in size from two inches to

two feet in diameter. Generally, the venting

is effective only for long-term loss of

containment heat removal sequences.

Venting can not occur fast enough to relieve

pressure rises from energetic events, such as

steam explosions or hydrogen burns.

Venting is generally not possible during

station blackout, due to the requirements for

AC power to open the vents and is not

adequate to handle the steaming rate from an

Anticipated Transients Without Scram

(ATWS) event.

As discussed in Section 4.1, vent lines from

the containment are available in Mark I and

II BWRs. Venting is possible from either

the wetwell or drywell; however, venting

from the wetwell is advantageous, because

any radionuclide releases can still be

scrubbed through the suppression pool.

Thus, such venting is more attractive for

BWRs than for other designs. A possible

negative effect is that venting may lead to a

saturated suppression pool, causing loss of

net positive suction head to some pumps. At

some plants, the procedures call for cycling

the vent valves to prevent this loss of net

positive suction head.

At some plants venting occurs through

strong piping. However, in others the

venting may involve ductwork and relatively

weak gas flow paths. If venting occurs at

high containment pressure, this ductwork

will fail, releasing steam and possibly

hydrogen and noble gases into the reactor

building. These gases may lead to failure of

safety equipment in the reactor building and

exacerbate the accident. As a result of these

concerns, the NRC has reached agreement

with owners of Mark I containments to

develop procedures for venting only through

hardened piping to alleviate this concern.5

A final note concerns venting as it relates to

emergency response. Current procedures for

venting do not attempt to coordinate venting

strategies with orders to evacuate. Venting

at the wrong time, particularly from the

drywell, could conceivably lead to

significant releases at the time when the

public is moving out onto the roads and is

most vulnerable. However, when

appropriately used, venting can be an

effective measure to release gases from
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-8 NUREG/CR-6042 Rev. 2

containment via the most desirable pathway

if releases are inevitable. Stated another

way, early releases of steam, hydrogen, and

heated atmosphere and perhaps fission

product noble gases may very well preclude

a later uncontrolled and high pressure-driven

release of atmosphere charged with

radioactive aerosols.

The remaining sections in Module 4 discuss

some of the specific phenomena that can

challenge containments during a severe

accident.
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-9 NUREG/CR-6042 Rev. 2

Table 4.2-1 Containment threats according to time regime

Time Regime Challenge

Start of the Accident

Pre-existing Leak

Containment Isolation Failure

Containment Bypass

Prior to Vessel Breach

Reactor Coolant System Blowdown

 Insufficient Containment Heat

Removal

Hydrogen Combustion

Delayed Bypass

At or Soon After Vessel Breach

Steam Spike

Steam Explosion

Combustion

Direct Containment Heating

Debris Contact with Containment

Late (> 2 Hours After Vessel Breach)

Failure of Containment Heat Removal

Combustion

Non-condensible gas generation

Basemat Meltthrough
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-10 NUREG/CR-6042 Rev. 2 Figure 4.2-1 Relative probability of containment failure modes (internal events from NUREG-1150) given core damage
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-11 NUREG/CR-6042 Rev. 2 Figure 4.2-2 Containment failure frequency
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-12 NUREG/CR-6042 Rev. 2 1.00 0.90 0.80 0.70 0.60 0.50 0.40 0.30 0.20 0.10 0.00 Surry Zion Sequoyah IPEs PWRs IPEs BWRs Grand Gulf Peach Bottom

Conditional Containment Failure Probability Early Failure and Bypass All Failures NUREG-1150 Point estimates for early and bypass failure Point estimates for all failures IPEs

Figure 4.2-3 Conditional containment failure probability (internal events)
Reactor Safety Course (R-800) 4.2 Containment Response to Beyond-Design-Basis Accidents

USNRC Technical Training Center 4.2-13 NUREG/CR-6042 Rev. 2

References for Section 4.2

1. David Okrent, “Nuclear Reactor Safety:

On the History of the Regulatory

Process,” The University of Wisconsin

Press, Madison, Wisconsin, pp. 99-101,

1981.

2. U.S. Nuclear Regulatory Commission,

“Reactor Safety Study: An Assessment

of Accident Risks in U.S. Commercial

Nuclear Power Plants,” WASH-1400,

October 1975.

3. U.S. Nuclear Regulatory Commission,

“Severe Accident Risks: An Assessment

for Five U.S. Nuclear Power Plants,”

NUREG-1150, December 1990.

4. U.S. Nuclear Regulatory Commission,

“Individual Plant Examination Program:

Perspectives on Reactor Safety and Plant

Performance,” NUREG-1560, Part 1,

Volume 1, Draft for Comment, December

1997.

5. Generic letter 89-16, Installation of a

Hardened Wetwell Vent, September 1,

1989.
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-1 NUREG/CR-6042 Rev. 2

4.3 Ex-Vessel Fuel-Coolant Interactions

For some plants and particular accident

situations, water will be present underneath

the reactor vessel when the molten material

exits the vessel at the time of failure. In

other cases, water may be added on top of

the molten material subsequent to vessel

failure. It is generally considered axiomatic

that water addition is always a good thing in

a reactor accident. While current guidance

to operators is always to add water, it is

important to note that there are several

different possible outcomes when molten

core debris contacts water, and only some of

these outcomes are desirable:

1. The water may act to cool and quench

(refreeze) the molten core debris, and

may limit the spread of molten core

across the containment floor.

2. The debris may form a molten pool under

the water, probably with an overlying

crust layer, and remain molten.

3. An energetic fuel-coolant interaction may

occur.

Each of these possibilities is discussed in

more detail below.

4.3.1 Quenching of Core Debris

Quenching and continued cooling of the core

debris is generally the most desirable

outcome. When the debris is solidified, the

release of radioactive materials from the

debris is effectively terminated. The most

significant detrimental effect of quenching is

the generation of large quantities of steam,

which causes a pressure spike in the

containment atmosphere. For the most part,

a steam spike will not directly be a threat to

the containment unless other phenomena

occur simultaneously or the containment is

already pressurized significantly prior to the

steam spike.

Figure 4.3-1 depicts the quenching process

for a PWR. The process involves energy

transfer from the molten core debris to

liquid water. The molten debris gives up

latent heat of fusion plus sensible heat in

cooling down to a near-equilibrium

temperature. Oxidation energy will be

involved if there are unoxidized metals

present in the melt. The energy transferred

to the water will heat the water to saturation

and produce boiling sufficient to the

available energy. The steam generated will

then enter the containment atmosphere,

causing a pressure increase. The speed of

the quenching process depends upon how

well the molten core mixes with water, the

debris particle sizes, and the geometry of the

mixture. The quenching process may be

very rapid or take many minutes, depending

upon these factors.

A calculation was performed for a station

blackout sequence in the Zion large dry

containment, considering the complete and

rapid quenching of an entire molten core,

along with 30% oxidation of the available

metals.1

 This quenching process would yield

approximately 268 Million Btu (283,000 MJ)

of energy, and would produce a pressure

spike of about 35 psig (240 kPa). Figure

4.3-2 shows the pressure in the Zion

containment that could result from this

accident sequence, assuming that the entire

core is dropped into a reactor cavity full of

water at about 14,000 seconds. The total

containment pressure approaches 90 psig

(620 kPa) as a result of the combined effects

of prepressurization prior to vessel breach,

vessel blowdown at vessel breach, and the

35 psi (241 kPa) pressure rise resulting from

the quenching in the reactor cavity. Two

different quenching times are shown in

Figure 4.3-2, corresponding to one minute

and one hour. Without operating
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-2 NUREG/CR-6042 Rev. 2

containment heat removal systems, the two

different times produce similar containment

pressure rises. The longer time available for

heat transfer to structures is somewhat offset

by the continued addition of decay heat.

In reality, quenching the debris will usually

result in pressures much less than those

indicated in Figure 4.3-2. First, it is

extremely unlikely that all of the core debris

will be involved in one large steam spike.

Most models of accident progression

indicate that a significant fraction of the

core will remain in the vessel and be

released slowly over a long time period.

Second, there must be sufficient water

available to participate in the quenching

process. In the example shown, there was a

completely full reactor cavity. Even if

sufficient water is initially present, some of

the water may be blown out of the reactor

cavity before it can contact the core debris,

possibly resulting in debris that is not

quenched.

Subatmospheric containments will respond to

steam spikes in much the same manner as

large dry containments. There is general

agreement that other containment types are

even less susceptible to steam spikes due to

their pressure suppression design.1

 While

not designed specifically for steam spikes at

vessel breach, suppression pools and ice

condensers can readily handle such loads,

provided that the water or ice has not been

depleted prior to the event. Note that, after

the debris quenches, a continuing water

supply and long-term heat removal are still

necessary in most cases to remove the decay

heat that can gradually pressurize the

containment.

4.3.2 Non-Coolable Debris

There are some cases in which core debris

may not quench or, if quenched, may

subsequently form a rubble bed that is noncoolable. Cooling of core debris requires

that the debris remain in contact with water,

to allow boiling heat transfer to carry away

the decay heat. Two mechanisms that can

prevent this contact are debris bed dryout

and crust formation. As discussed in

Module 3, the vapor that flows up out of the

debris bed can provide resistance to

overlying and surrounding water that is

needed to permeate the debris bed. If the

resistance to water is sufficient, parts of the

bed may dry out, leading to continued

melting and possible core-concrete attack.

Figure 4.3-3 depicts the mechanisms

contributing to debris bed dryout.

As discussed in Module 3, the key factors

affecting debris bed dryout are the particle

sizes and the geometry (porosity) of the

debris bed. Mixed particle sizes,

particularly with smaller particles and deeper

debris beds, tend to be less coolable than

shallow debris beds composed of large

particles. With smaller particles, the surface

area for heat transfer is larger, and therefore,

the vapor generation rates are increased

relative to water ingress rates. Many

particle sizes are possible during a severe

accident, ranging from 0.01 inches (0.025

cm) or less up to inch size and larger.

There is no one exact particle size that

provides a threshold for coolability.

However, particle sizes of a tenth of an inch

(0.25 cm) and smaller are the ones most

likely to be non-coolable. Such small

particles can form during energetic melt

ejection from the vessel or as a result of

energetic fuel-coolant interactions (discussed

in the next subsection).

In addition to debris bed dryout, there is a

second possibility for non-coolable core

debris. If a molten pool is contacted by an

overlying water pool, a crust may form,

preventing the further contact of water with

the melt. In this case, core-concrete attack
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-3 NUREG/CR-6042 Rev. 2

may continue unabated, as discussed in

Section 4.4.

With non-coolable core debris, any boiling

that does occur will not rapidly affect the

containment pressure, and can generally be

neglected, unless a sequence involves loss of

all containment heat removal for many hours

or even days. Because some of the decay

heat goes into the core-concrete attack as

opposed to the containment atmosphere, this

case actually produces less of a long-term

overpressure threat from steaming than the

case where the debris is quenched. The

threats from core-concrete attack and

combustible (and other non-condensible) gas

generation may more than offset the benefits

of reduced steaming and are discussed in

more detail in later sections.

4.3.3 Ex-Vessel Steam Explosions

The largest threat to containment resulting

from the ex-vessel interaction of molten core

debris and water is an energetic ex-vessel

fuel-coolant interaction (steam explosion).

An ex-vessel steam explosion is simply an

extreme case of a steam spike where the

quenching occurs explosively and produces

dynamic as well as static pressures. An exvessel steam explosion can threaten the

containment in several different ways,

including:

1. generation of dynamic pressure loads

(shock waves) that can fail the

containment structure,

2. generation of pressures and shock waves

that can fail vessel support structures,

leading to movement of the vessel and

failure of containment piping

penetrations,

3. generation of energetic missiles that can

be thrown into the containment, or

4. generation of pressures and shock waves

that can fail the drywell floor of a BWR

Mark II containment or the drywell wall

of a Mark III containment.

Generally, the second and fourth threats

above are the ones of most concern, and

generally more so for BWRs (and a few

PWRs) because of the confined pedestal

region and the impact of pedestal failure on

the containment. Section 4.3.4 discusses the

design-specific aspects of ex-vessel steam

explosions in more detail. As with in-vessel

steam explosions, there are many factors that

contribute to the magnitude of any ex-vessel

steam explosion. These include:

1. the amount of water available to

participate,

2. the composition of the melt, including

the amount of unoxidized metals that

may react during the explosion,

3. cavity or pedestal region geometry,

insofar as it may lead to confinement of

the explosion or focusing of shock

waves,

4. transmission of shock waves through a

water pool,

5. pouring rate and contact mode, i.e., water

on corium, corium on water, or jet

ejection into water, and

6. fraction of the core participating.

The physical processes involved in steam

explosions were described in Module 3.

Those processes are similar for ex-vessel

steam explosions, except that some of the

initial conditions are different. The exvessel case will always be at low pressure,

no higher than the containment failure

pressure. Steam explosions tend to be more

likely at low pressure. Second, the
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-4 NUREG/CR-6042 Rev. 2

geometry is different, involving varying

degrees of confinement. Third, there are

three contact modes to consider. The corium

may pour from the vessel into a water pool

or water may be added on top of corium, not

unlike some in-vessel scenarios, or the

corium may be ejected from the vessel as a

high pressure jet into a water pool.

The latter case is unique to ex-vessel

conditions and results when the vessel fails

at high pressure. Experiments indicate that

some steam explosions are likely under these

conditions, but the magnitude is largely

unknown. If the initial mass exiting the

vessel reacts, it may blow the water out of

the cavity or pedestal region, resulting in

less reaction of the later material. Because

the jet is not all released instantaneously, it

is likely that a fairly small fraction of the

core will participate. However, significant

challenges to containment and vessel

supports are still possible, particularly if

oxidation accompanies the explosion.

One potential benefit of an ex-vessel steam

explosion is that the core debris may be

dispersed in the containment, reducing the

concerns of core-concrete attack, and

possibly making the debris more coolable.

On the other hand, the benefit of such an

event depends on exactly where the debris

ends up and the continuing availability of

long-term containment heat removal, and the

impact on fission product releases.

As noted in Module 3, rapid quenching of

core debris, explosively or otherwise, can

result in significant oxidation of any metals

contained in the core debris. Hydrogen

generated as a result of this oxidation can

present a significant threat that will be

discussed in later sections.

4.3.4 Containment Design Considerations

As noted above, there are many features that

can impact the importance of ex-vessel fuelcoolant interactions. First and foremost, the

presence of water is necessary for a fuelcoolant interaction to occur. In some

scenarios, particularly for large dry PWR

containments, the reactor cavity will be dry

or nearly so. Generally, for large quantities

of water to be present in the reactor cavity,

the containment sprays must have operated

or large quantities of water have been

pumped out through a break in the reactor

coolant system. Then, if the sump and floor

design allows, some of this water will

overflow into the reactor cavity. Ice

condenser containments are more likely to

contain water in the reactor cavity due to the

melting of ice combined with other sources.

In fact, ice condenser containments can be

deeply flooded in the lower compartment,

mitigating fission product releases, but also

providing a transmission medium for shock

waves.

In BWR containments, water is likely to be

present under the vessel for most LOCAs.

Transient sequences may have a relatively

dry pedestal region if the drywell sprays

have not been used, and there has not been

significant prior leakage. Mark III

containments are the most likely to have

large amounts of water under the vessel as a

result of water spilling over the weir wall

from the suppression pool. However, all

three BWR containment types are

susceptible to failure of the vessel supports,

with relatively small amounts of water

present. Figures 4.3-4, 4.3-5, and 4.3-6

depict typical pedestal regions for BWRs

and point out some of the important

vulnerabilities. As noted earlier, the Mark

II containments are also susceptible to

failure of the floor separating the drywell

from the wetwell. Another factor for Mark

II containments, resulting from the

considerable design variation among the

Mark II containments, is the possibility of
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-5 NUREG/CR-6042 Rev. 2

corium flowing down the downcomers into

the suppression pool, failing the downcomers

with a steam explosion or as a result of

meltthrough, thus leading to suppression

pool bypass. One Mark II containment has

downcomers located directly below the

vessel, guaranteeing some flow into the

downcomers. 

For both BWRs and PWRs, if water is not

present prior to vessel failure, then water

may be pumped into the reactor coolant

system at a later time and flow through the

failed vessel onto the melt.

The relative containment failure probabilities

from ex-vessel fuel-coolant interactions were

assessed for the six containment types in the

NUREG-1150 and LaSalle studies.2,3 These

studies indicate that containment failure is

very unlikely for the three PWRs examined.

For the three BWRs, drywell failures from

steam explosions contribute noticeably to the

overall containment failure probabilities,

particularly for the Mark I and Mark II

designs. In contrast, most of the individual

plant examinations (IPEs) performed by the

utilities found ex-vessel fuel-coolant

interactions to be unimportant contributors

to the likelihood of containment failure. A

few of the IPEs used NUREG-1150 as the

basis for their analysis and produced similar

results.
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-6 NUREG/CR-6042 Rev. 2

Figure 4.3-1 Molten core quenching process
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-7 NUREG/CR-6042 Rev. 2

Figure 4.3-2 Containment pressure versus time for Zion station

blackout sequence
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-8 NUREG/CR-6042 Rev. 2 Figure 4.3-3 Non-coolable debris bed
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-9 NUREG/CR-6042 Rev. 2

Figure 4.3-4 BWR Mark I containment pedestal region
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-10 NUREG/CR-6042 Rev. 2 Figure 4.3-5 BWR Mark II containment pedestal region
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-11 NUREG/CR-6042 Rev. 2 Figure 4.3-6 BWR Mark III pedestal region
Reactor Safety Course (R-800) 4.3 Ex-Vessel Fuel-Coolant Interactions

USNRC Technical Training Center 4.3-12 NUREG/CR-6042 Rev. 2

References for Section 4.3

1. U.S. Nuclear Regulatory Commission,

“Estimates of Early Containment Loads

from Core Melt Accidents,” NUREG1079, Draft Report for Comment,

December 1985.

2. U.S. Nuclear Regulatory Commission,

“Severe Accident Risks: An Assessment

for Five U.S. Nuclear Power Plants,”

NUREG-1150, December 1990.

3. T. D. Brown, et al., “Integrated Risk

Assessment for the LaSalle Unit 2

Nuclear Power Plant: Phenomenology

and Risk Uncertainty Evaluation Program

(PRUEP),” NUREG/CR-5305, SAND90-

2765, Sandia National Laboratories,

1992.
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-1 NUREG/CR-6042 Rev. 2

4.4 Core-Concrete Interactions

If molten core material falls into the reactor

cavity or pedestal region and is not blown

out due to high pressure melt ejection or exvessel steam explosions, then Core-Concrete

Interactions (CCIs) are possible. The

possibility of CCIs leading to basemat

meltthrough and containment failure was

proposed by Brookhaven National

Laboratory in reference to the China

Syndrome. 1

 Numerous studies and

experimental programs have since verified

that basemat meltthrough is possible,

although there are still significant

uncertainties. Research has indicated that

CCIs can also have other important effects

in accidents, even when the basemat remains

intact. In particular, combustible gas

generation can occur and large quantities of

aerosols can be generated, thus affecting the

source term if the containment fails. In the

subsections below, these topics are discussed

in more detail.2

4.4.1 Concrete Attack

The most obvious concern about CCIs is the

compromising of the containment structure.

In addition to basemat meltthrough, CCIs

can lead to failure of vessel supports and

other local structures that can indirectly lead

to containment failure. The ensuing

discussions of concrete attack are intended

to include all of these possibilities.

Most concrete used in reactor applications is

either limestone, basaltic or a combination

of limestone and common sand. Table 4.4-1

gives typical compositions for these three

types of concrete.3 As shown in Figure 4.4-

1, the attack of concrete by corium is driven

largely by thermal processes. Decay heat

and some heat from chemical reactions

(which may dominate for short periods of

time) are generated in the molten pool and

may be transferred to the top surface of the

pool or to the surrounding concrete. Under

most circumstances, the heat flux to the

concrete is sufficient to decompose it,

releasing gases and melting the residual

materials which are primarily oxides and

metal reinforcing bars. The melted materials

are added to the molten pool, thus diluting

it, increasing its surface area, and reducing

the volumetric heat generation rate. In time,

heat transfer out the top of the molten pool

and through the surrounding concrete may be

sufficient to remove the generated heat and

the temperature will decline to the point at

which the CCI is terminated. Typical CCIs

can penetrate concrete at the rate of several

inches (tens of cm) per hour. Whether or

not the CCI is terminated prior to basemat

meltthrough is determined by many factors,

including:

1. type of concrete and aggregate used in

the structure,

2. basemat thickness,

3. cavity size and geometry,

4. melt mass in the cavity,

5. melt composition, and

6. presence of overlying water.

As noted in Section 4.3, the presence of an

overlying water pool does not guarantee that

the debris will be coolable. A crust may

form over the melt, and heat transfer may be

insufficient to remove all the decay heat

from the melt. A number of experiments

have shown minimal effect of water on

concrete ablation rates.4

 However, an

overlying water can reduce fission product

releases even if it does not cool the debris.
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-2 NUREG/CR-6042 Rev. 2

As its temperature increases, concrete begins

to fail (lose its structural integrity) even

before gross melting of its constituents

occurs. The loss of structural integrity

accompanies the release of water and carbon

dioxide from the concrete in three phases:5

1. release of molecular and physically

entrapped water between 86 and 446 o

F

(30 and 230 oC),

2. release of water chemically constituted as

hydroxides between 662 and 932 oF (350

and 500 oC), and

3. release of carbon dioxide from the

aggregate and the cementitious phases

between 1112 and 1832 o

F (600 and 1000 o

C).

The point at which concrete loses its

integrity varies with the type of concrete,

but generally occurs as hydraulic bonds are

eliminated and well before the carbon

dioxide is released. Typical concrete

contains about 4 to 9 wt.% water and 0 to 45

wt.% carbon dioxide. Loss of structural

integrity is particularly important when

considering the possible impact of CCIs

upon vessel supports in BWRs.

Figure 4.4-2 is an example calculation of

concrete attack in the LaSalle BWR Mark II

containment.6

 The concrete at LaSalle is a

mixture of limestone and common sand. In

general, limestone concrete will ablate more

rapidly than basaltic concrete. An important

aspect of containment failure due to concrete

attack is that, even if it occurs, one would

expect that many hours would be available

to initiate emergency response plans,

including evacuation and sheltering, so that

offsite health effects can be minimized.

4.4.2 Gas Generation

CCIs result in the generation of large

amounts of gases, some of which are

combustible. Combustible gases are

generated indirectly in a CCI. As shown in

Figure 4.4-3, water and carbon dioxide are

released from the concrete. When these

gases rise through the melt they can react

with unoxidized metals to produce metal

oxides and the combustible gases hydrogen

and carbon monoxide. As a result of

complex reactions within the melt, the actual

concentrations of hydrogen and carbon

monoxide in the gases exiting the melt can

vary significantly. It is likely that the flow

of gases up through the melt will be

nonuniform and that the melt itself will

consist of layers of varying metallic content.

The total amount of combustible gas that can

be formed as a result of CCIs is limited

primarily by the amount of metallic

constituents present in the melt, although

some other reactions are possible that can

slightly increase this quantity. The molten

pool in the reactor cavity may contain large

amounts of steel from the reactor vessel,

below vessel structures, containment liner

plate, concrete reinforcing bars, and other

structures. As a result, the total quantity of

combustible gas released from core concrete

interactions can exceed that produced by

100% oxidation of all available zirconium,

which is normally the limit for in-vessel

hydrogen production.

Figure 4.4-4 shows examples of amounts of

various gases that can be generated during

core-concrete interactions4

. Note that much

more gas (primarily CO and CO2) is

produced by limestone concrete than basaltic

concrete. In any case, it is not

inconceivable that a few thousand pounds

(or kilograms) of combustible gases could be

generated from CCIs.5
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-3 NUREG/CR-6042 Rev. 2

As the combustible gas exits the top of the

melt, there are several possibilities. First, if

there is an overlying water pool, the gases

will cool before they pass into the

containment atmosphere. Second, if there is

no overlying water pool, the gases may

spontaneously ignite above the molten

corium. This spontaneous ignition requires

high temperatures (supplied by the molten

pool) and the presence of oxygen. Oxygen

in the cavity will be rapidly depleted unless

flow paths exist to circulate oxygen from the

rest of containment. Spontaneous ignition

can not occur in Mark I and II BWRs, which

have inert containments. Combustion effects

will be discussed in more detail in Section

4.6.

For Mark I and II containments, despite their

inerted condition, gases from CCIs can still

represent a concern. Because these gases

are noncondensible, they can lead to

significant pressure buildup that can not be

removed using sprays or suppression pool

cooling. This is why venting may ultimately

be required to prevent long-term

overpressure from these gases.

4.4.3 Aerosol Generation

In the absence of an overlying water layer,

Core-Concrete Interactions produce dense

clouds of aerosols. Two processes produce

such aerosols. First, volatile and semivolatile chemicals species including many

fission products can be present in hot gases

that bubble up through the melt. As these

species emerge into and mix with the cooler

atmosphere above the melt, they condense

and become aerosol particles. Second, when

gas bubbles emerge and burst at the surface

of the melt, aerosols containing less volatile

species are formed and entrained in the

flowing gases. An overlying water pool can

effectively remove most of the aerosols

generated in CCIs, particularly the less

volatile species. 

In a severe accident, the radioactive and

nonradioactive aerosols released from CCIs

can significantly impact the concentrations

of radionuclides in the containment

atmosphere and, given containment failure,

the quantities of radionuclides released to

the environment. In general, generation of

radioactive aerosols will increase the

releases to the environment. In fact, the

largest release fractions postulated in risk

assessments are generally for accident

scenarios involving Core-Concrete

Interactions with no overlying water pool in

the reactor cavity. However, the generation

of large quantities of non-radioactive

aerosols can accelerate the agglomeration

and gravitational settling of radioactive

aerosols in the containment. Thus, if

containment failure is delayed long enough,

aerosol generation can actually reduce

releases to the environment. Large

quantities of aerosols, radioactive or not,

have the potential to plug air filters that are

not designed for such loadings.

Figure 4.4-5 shows example VANESA

calculations of aerosol generation rates as a

result of CCIs at three plants and for three

different accident scenarios.7

 The wide

variations result from differences in melt

composition and concrete type. These

calculations do not account for any

overlying water pools. This figure indicates

the tremendous mass of material that can be

suspended in the containment in the form of

aerosols. Table 4.4-2 and Figures 4.4-6 and

4.4-7 indicate the types of materials that can

be contained in the aerosols. Most of the

mass is made up of concrete materials, such

as CaO and SiO2. However, Table 4.4-2 and

Figure 4.4-6 also show that significant

fractions of fission products are released

during CCIs.
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-4 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-5 NUREG/CR-6042 Rev. 2

Table 4.4-1 Typical chemical compositions of concrete (wt.%)

Oxide

Basaltic

Concrete

Limestone

Concrete

Limestone/

Common Sand

Concrete

SiO2 54.73 3.60 35.70

CaO 8.80 45.40 31.20

A12O3 8.30 1.60 3.60

MgO 6.20 5.67 0.48

Fe2O3 6.25 1.20 1.44

K2O 5.38 0.68 1.22

TiO2 1.05 0.12 0.18

Na2O 1.80 0.08 0.82

MnO - 0.01 0.03

Cr2O3 - 0.004 0.014

H2O 5.00 4.10 4.80

CO2 1.50 35.70 22.00
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-6 NUREG/CR-6042 Rev. 2

Table 4.4-2 Core-concrete release for Peach Bottom station

blackout sequence

 

Species Released Mass (kg) Release Fraction(1)

 (1 kg = 2.2lb.) 

 

Fission Products

I+Br 1.8 1.0

Cs+Rb 27 1.0

Te+Sb 14 0.64

Sr 53 0.84

Mo 5.0×10-4 2.0×10-6

Ru(2) 3.0×10-4 9.0×10-7

La(3) 33 3.9×10-2

Nb 4.3 1.0(4)

Ce+Np+Pu 90 9.0×10-2

Ba 64 0.62

Steel

Fe(5) 1234 1.3×10-2(6)

Cr 6.6×10-2 8.10-6

Ni 29 6.2×10-3

Mn 89 0.50

Zircaloy

Zr(7) 0.55 8.0×10-6

Sn 46 5.0×10-2

Control Material

Gd 17 5.8×10-2

Fuel

U 23 2.0×10-4

Concrete (6)

Ca0 1988 2.9×10-2

A1203 339 0.14

Na20 82 0.74

K20 656 0.64

Si02 1124 0.21

 

(1) Based on melt inventory at start of core-concrete interaction.

(2) Includes Tc, Rh, and Pd.

(3) Includes Y, Zr(fp), Pr, Nd, Pm, Eu, and Sm.

(4) Quantitative release is calculated because of the assumed oxide chemical form, which is under review.

(5) Includes Fe from concrete and reinforcing bars.

(6) Release fraction based on the amount of concrete and reinforcing bars incorporated into the molten pool.

(7) Structural Zr only.
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-7 NUREG/CR-6042 Rev. 2

Figure 4.4-1 Thermal aspects of core-concrete interactions
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-8 NUREG/CR-6042 Rev. 2

Figure 4.4-2 Calculations of concrete attack in a

BWR Mark II containment during a

station blackout sequence
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-9 NUREG/CR-6042 Rev. 2

Figure 4.4-3 Combustible gas generation during CCIs
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-10 NUREG/CR-6042 Rev. 2

Figure 4.4-4 Example amounts of various gases that can be

generated during core-concrete interactions
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-11 NUREG/CR-6042 Rev. 2 Figure 4.4-5 VANESA calculations of aerosol generation rates
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-12 NUREG/CR-6042 Rev. 2

Figure 4.4-6 Peach Bottom station blackout, fission products released to

drywell from core-concrete interactions
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-13 NUREG/CR-6042 Rev. 2

Figure 4.4-7 Peach Bottom station blackout, masses released to drywell from

core-concrete interactions
Reactor Safety Course (R-800) 4.4 Core-Concrete Interactions

USNRC Technical Training Center 4.4-14 NUREG/CR-6042 Rev. 2

References for Section 4.4

1. ACRS Subcommittee Meeting Minutes,

June 3, 1966, reproduced in Okrent,

pp. 99-101.

2. R. K. Cole, Jr., D. P. Kelly, and M. A.

Ellis, “CORCON-Mod2: A Computer

Program for Analysis of Molten-Core

Concrete Interactions,” NUREG/CR3920, SAND84-1246, Sandia National

Laboratories, Albuquerque, NM,

August 1984.

3. E. R. Copus and D. R. Bradley,

“Interaction of Hot Solid Core Debris

with Concrete,” NUREG/CR-4558,

SAND85-1739, Sandia National

Laboratories, June 1986.

4. Reactor Safety Research Semiannual

Report, July-December 1986, Volume

36, NUREG/CR-4805, SAND86-2752,

Sandia National Laboratories,

November 1987. (Note: an error was

found on the first graph of the original

figure. The labels for the CO and

Cos plots were reversed.)

5. A. L. Camp, et al., “Light Water

Reactor Hydrogen Manual,”

NUREG/CR-2726, SAND82-1137,

Sandia National Laboratories,

Albuquerque, New Mexico, August

1983.

6. C. J. Shaffer, L. A. Miller, and A. C.

Payne, Jr. “Integrated Risk Assessment

for the LaSalle Unit 2 Nuclear Power

Plant: Phenomenology and risk

Uncertainty Evaluation Program

(PRUEP),” Volume 3: MELCOR Code

Calculations, NUREG/CR-5305, 3 of

3, SAND90-2765, Sandia National

Laboratories, Albuquerque, New

Mexico, July 1992.

7. M. Silberberg, et al., “Reassessment of

the Technical Bases for Estimating

Source Terms,” NUREG-0956, July

1986.
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-1 NUREG/CR-6042 Rev. 2

4.5 Direct Containment Heating

A severe accident may progress with either

high or low pressure in the reactor coolant

system up to the point of vessel breach.

Modules 2 and 3 discussed some of the

accident scenarios that could involve high

pressure at the time of vessel breach. When

vessel failure occurs at a pressure of a few

hundred psi (several hundred kPa) or more,

the melt will be ejected as a jet into the

reactor cavity. What happens next depends

upon the reactor vessel pressure, the cavity

and containment design, the presence of

water in the cavity, the amount of melt

ejected and other factors. One possibility,

discussed earlier, is that a steam explosion

will result in the reactor cavity, if sufficient

water is available and the melt can mix with

the water. Another possibility is that some

of the melt will be fragmented by jet

breakup and swept out of the cavity into the

containment where it will heat the

atmosphere (direct containment heating

[DCH]). The latter process can lead to very

rapid and efficient heat transfer to the

atmosphere, possibly accompanied by

oxidation reactions and hydrogen burning

that further enhance the energy transfer.

Energy transfer to the containment

atmosphere, of course, leads to containment

pressurization. The important phenomena

are discussed in more detail below.

4.5.1 Ejection of Melt from the Vessel

The melt ejection process is depicted in

Figure 4.5-1. When the vessel first fails,

molten material will be ejected as a liquid

stream (melt ejection phase). As the liquid

corium level in the vessel drops, gas

blowthrough will begin to occur, resulting in

a two-phase mixture blowing down from the

vessel. The noncoherence of the steam

blowdown and melt ejection is predicted to

have a large impact on the DCH loads, as

discussed in Section 4.5.3. The high

velocity expanding gas flow provides the

motive force for entraining corium and

ejecting it from the reactor cavity (gas

blowdown phase).

Vessel failure may occur at a small opening,

such as an instrument tube, or as a result of

a larger rupture. The particular failure mode

does not have a large impact during the melt

ejection phase, but can be important for exvessel steam explosions or for the gas

blowdown phase interactions discussed in

Sections 4.5.2 and 4.5.3. The amount of

material participating in an ex-vessel steam

explosion and the nature of the explosion

will be affected by the ejection rate (which

depends on the opening size). Small

amounts of molten material may result in

small explosions that force water out of the

cavity and preclude larger explosions. For

Westinghouse PWR vessels, it has been

estimated that the initial hole size could be

approximately 1.3 ft. (0.4 m) in diameter for

a thermally-induced rupture or about an inch

(0.03 m) for ejection of an incore instrument

tube.1

 However, for the latter case the hole

is expected to rapidly ablate to about the

size of a thermally-induced rupture, so that

the overall effect of the small initial opening

size is minimal.

Along with the hole size, the amount and

composition of molten material in the lower

plenum of the vessel is an important factor.

In some scenarios, vessel failure may occur

early, when only part of the core is molten.

Core material that has not relocated to the

lower plenum will not contribute

significantly to the direct heating process.

Figure 4.5-2 shows an example estimate of

the amount of material that may be ejected

for given core melt scenarios in PWRs.2

The melt composition is also important.

Melts rich in metal will tend to result in

higher DCH loads because of the energy

released when the metal is oxidized, and
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-2 NUREG/CR-6042 Rev. 2

because of the energy released by

combustion of any hydrogen produced by the

reaction of steam with the metal.

As part of the DCH resolution program, best

estimate SCDAP/RELAP5 calculations were

performed for representative reactors of all

nuclear steam supply systems (PWRs) in the

United States:3,4* Zion (Westinghouse 4-

loop), Surry (Westinghouse 3-loop), Calvert

Cliffs (Combustion Engineering), ANO-2

(Combustion Engineering), Oconee (Babcock

& Wilcox lowered loop) and Davis-Besse

(Babcock & Wilcox raised loop). In all of

these calculations, the melt composition was

predicted to be predominantly oxidic at the

time of vessel breach. This is consistent

with observations from the TMI accident. It

may not be consistent with accidents that

have less water available. Indeed, recent

tests in the PHEBUS-FP tests raise questions

about the accuracy of computer code

calculations of the metallic fraction of the

core melt at the time core debris relocates

from the core region.

4.5.2 Interactions in the Reactor Cavity

When molten material is ejected into the

reactor cavity at high pressure, there are a

number of phenomena that are important to

consider. The possibility of an ex-vessel

steam explosion has already been mentioned.

Additional phenomena that lead to

fragmented debris that can be dispersed from

the cavity are also important. These

phenomena, depicted in Figure 4.5-3, include

molten jet breakup, gas evolution and

chemical reactions, and trapping of a portion

of the jet before it can escape the cavity.

The presence of water in the reactor cavity

could result in some quenched debris, thus

partially mitigating the DCH threat. 

Experimental evidence indicates that the

presence of water in the reactor cavity can

be detrimental. A jet of molten material

entering a pool of water will often lead to a

steam explosion.** With small levels of

water, the experiments show that the initial

contact with molten debris produces a steam

explosion that blows the remaining water out

of the cavity, ending immediate debris-water

interactions. Experiments with high

temperature melt injection into model reactor

cavities filled completely with water have

produced dramatic steam explosions of

sufficient magnitude to threaten structural

damage. In addition to potential steam

explosions, water can also provide an

additional source of hydrogen by chemically

reacting with unoxidized metals in the

molten debris. As the jet encounters water or

steam (either from the blowthrough or as a

result of water in the cavity), oxidation of

any metals can occur, leading to rapid

hydrogen production. Some experiments

indicate that the gases exiting the reactor

cavity can contain as much as 50% hydrogen

during some phases of the blowdown.**

The sizes of particles produced by breakup

of a jet of molten material can affect the

heat transfer and chemical reaction rates (by

determining the available surface area), as

well as particle transport within

containment. At high RCS pressures, the

dispersed melt is highly fragmented (~1mm)

with a broad distribution of particle sizes.

Extensive (thermal and chemical)

interactions (near equilibrium) of melt with

blowdown steam can be expected during

dispersal. Figure 4.5-4 shows some

*

Resolution of the Direct Containment Heating

Issue for all Combustion Engineering Plants and

Babcock & Wilcox Plants, NUREG/CR-6475, In

Preparation.

**Memo from Richard Griffith to R. G. Gido,

Sandia National Laboratories, May 11, 1992.
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-3 NUREG/CR-6042 Rev. 2

estimated mean particle sizes that can result

for given conditions.

Evolution of gases dissolved in the melt can

result in changes in the jet breakup, and can

also significantly affect fission product

releases. The melt breakup process is likely

to release most of the volatile materials and

also allow formation of numerous

radioactive aerosols, although these

processes are not well understood. 

As the high-temperature jet passes through

the cavity, melt is entrained and swept out

into the containment. The debris dispersal is

noncoherent with the RCS blowdown; i.e.,

the melt is fully dispersed from the vessel

and cavity long before blowdown is

complete. Gases exiting the reactor cavity

may have velocities of several hundred feet

per second (hundreds of m/s) according to

some estimates.3

 As the melt is swept along,

some of it impinges upon the cavity floor or

walls. Significant erosion of concrete is not

expected to occur because the melt will

mostly splash off. Additional metal may

enter the DCH process through two

processes: incore instrument tubes, which

pass through many cavities, may be ablated

and dispersed from the cavity with the melt;

and RPV insulation in the annulus around

the RPV may be ablated and dispersed with

the melt.

As the jet passes through the cavity, corium

will bounce off of the walls, perhaps

multiple times, as it is carried along by the

gases. Ultimately, depending on the driving

pressure, some fraction of the melt will be

retained in the cavity and not enter the main

containment. Particles may be trapped under

a seal table or any other obstruction in the

path of the jet, as long as the jet does not

cut through the obstruction. Locations

where the flow sharply changes direction

may also collect debris. However, for all

PWR reactor cavities examined to date,

experiments have shown nearly complete

dispersal of the debris at RCS pressures of

interest. At low pressures, some cavity

designs retain debris, but with the low RCS

pressures, the availability of steam is more

limiting to DCH loads1

. Note that any

trapped material may result in subsequent

core debris-concrete interactions within the

reactor cavity.

Most reactor cavities can withstand the loads

accompanying high pressure melt ejection

(HPME). However, weaker cavities might

be vulnerable to overpressure damage

resulting from initial melt/water interactions

(explosive or nonexplosive) or from high

cavity pressures resulting from the dispersal

process itself.

4.5.3 Energy Deposition and Pressure

Rise in Containment

As core debris is swept out of the reactor

cavity, it is transported throughout the

containment. The degree to which the debris

can be transported to the top of the

containment affects the resulting pressure

rise. In the lower regions of most PWR

containments, the containment is highly

subcompartmentalized. It is expected that

significant quantities of the core debris will

be trapped in these subcompartments before

it can reach the upper regions of

containment. This trapping may

significantly reduce the predicted

containment pressure rise. The reduction

comes about because debris within

subcompartments can thermally saturate the

subcompartment atmosphere and consume

any available oxidant without completely

cooling or completely reacting before it is

trapped.

Some containments have a fairly open path

around the reactor vessel to the upper

containment. Melt can be dispersed upwards

from the cavity through the annulus around
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-4 NUREG/CR-6042 Rev. 2

the RPV into the refueling canal and upper

dome. Debris passing up around This is the

dominant dispersal path in some Combustion

Engineering plants. These containments will

not benefit as much from the effects of

subcompartments.

Suspended debris particles can rapidly

transfer their energy to the containment

atmosphere. Because of the small particle

sizes, the total surface area for heat transfer

is quite large. The amount of thermal

energy available in a molten core was

discussed previously in Module 3. This

thermal energy can be transferred to the

containment atmosphere through radiative

and convective heat transfer. This heat

transfer will be very rapid, with much of it

occurring in a matter of seconds if particles

remain airborne and continue to encounter

cool atmospheric gases. As the atmosphere

heats, of course, the rates of heat transfer in

the absence of exothermic reaction decrease

substantially.

In addition to heat transfer, energy may be

imparted to the containment atmosphere as a

result of exothermic oxidation reactions

involving metallic constituents in the core

debris and either air or steam. The

noncoherence of the steam blowdown and

melt ejection limits the extent of these

reactions, thereby reducing containment

loads. The metal-steam reactions will result

in the production of additional hydrogen.

Hydrogen from these reactions plus

hydrogen previously injected into

containment may then burn, resulting in

additional pressurization. The hot debris

particles and the high temperatures of the

exiting gases may lead to some hydrogen

combustion even for mixtures outside the

normal flammability limits (see Section 4.6).

Figure 4.5-5 shows examples from the

NUREG-1150 study of the range of

pressures considered possible for a DCH

event in the Surry subatmospheric

containment.3

 In that study, now believed

to be conservative, the important factors

were considered to be the vessel pressure,

the presence of water in the cavity, the

vessel hole size, the core fraction ejected,

the amount of zirconium oxidation, and the

operation of containment sprays.

In Figure 4.5-5, the dry cavity case (Case 1)

results in higher pressures than the

equivalent wet cavity case (Case 2). In

these estimates, steam explosions resulting

in dynamic pressures damaging the cavity or

other parts of the containment were not

considered. Without steam explosion

damage, water was predicted to be

beneficial, with the heat absorption

outweighing any detrimental effects of

hydrogen production.

4.5.4 Containment Failure Probabilities

for DCH

It is clear that in extreme cases high

pressure melt ejection and direct

containment heating can produce pressures

that threaten structural integrity of the

containments. The issue becomes one, then,

of the probability that such extreme loads

will actually occur in an accident. Nearly all

pressurized water reactor licensees have

instituted measures in their emergency

operating procedures to depressurize the

reactor coolant systems to eliminate the

driving force for high pressure melt ejection.

Despite this, accidents can still be envisaged

in which there is a failure to depressurize or

there is incomplete depressurization. These

accidents are not unlike those pressurized

accidents found to be possible in boiling

water reactors despite the availability of an

automatic depressurization system. A variety

of analyses have appeared that indicate

natural processes during core degradation

will lead to depressurization of the reactor

coolant system. Typically these analyses
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-5 NUREG/CR-6042 Rev. 2

show that the natural circulation of gases

and vapors heat portions of the reactor

coolant system such as the surge line or the

nozzles for pipes attached to the reactor

vessel that they fail by creep rupture before

core debris can penetrate the reactor vessel.

Comforting as these analyses may seem, the

fact remains that no evidence of such

heating of the reactor coolant system was

encountered during the accident at Three

Mile Island. It is difficult, then, to find a

firm basis for discounting direct containment

heating bases solely on the low probability

of it occurring.

Research sponsored by the NRC has focused

on the probability of containment loads

produced by high pressure melt ejection

exceeding the structural capabilities of the

containment. Three computer models of the

phenomena associated with high pressure

melt ejection have been developed - CLCH

(Convection Limited Containment Heating),

TCE (Two-cell Equilibrium), and the

CONTAIN code that is a systems level

model of containment response during severe

reactor accidents. Experiments involving

high pressure melt ejection into scaled

models of reactor cavities have been used to

develop and validate these models which can

usually be run to give very similar results.

Extrapolation of the model predictions to the

scale of reactor accidents has shown that the

uncertain quantities that most influence the

pressurization of containment following high

pressure melt ejection are:

• melt mass expelled

• metal fraction in the expelled melt

• mass of water ejected 

• coherence of melt and water dispersal

from the reactor cavity

Investigators have used the SCDAP/RELAP5

model to analyze a variety of accidents

particularly for the Zion reactor, which has

a large, dry containment, and the Surry

reactor, which has a subatmospheric

containment to determine the ranges of

values of the first three of these influential

quantities. Uncertainty distributions have

been developed for each of these based on

the analyses. SCDAP/RELAP5 is NRC’s best

estimate code for analysis of core

degradation. It must, however, be noted that

recent tests conducted in the PHEBUS-FP

program have called into question the

accuracy with which SCDAP/RELAP5

predict both the relocation of molten core

debris from the core region and the amounts

of zirconium metal in this relocated core

debris. 

The coherence with which steam and molten

core debris is dispersed from a reactor cavity

has been derived from experiments using

scale model reactor cavities. The derivation

of the coherence ratio from these

experiments that will be applicable at the

full scale has not been without controversy.

A model of the coherence ratio satisfactory

to a panel of thermal hydraulic experts has

been devised.

The uncertainty distributions for the melt

mass and metal fraction in the melt have

been used in the models to develop

uncertainty distributions for the loads

expected on containments during various

accident scenarios involving various amounts

of co-dispersed water. These uncertainty

distributions for the loads have been

compared to the uncertainty distributions for

the structural capabilities of the

containments at Zion and Surry. An

example of such a comparison is shown in

Figure 4.5-7. From these comparisons, it

has been found that the conditional

probability that direct containment heating

will fail the Zion containment is less than

0.01. 4

 Similarly low conditional

containment failure probabilities have been

found for Surry.5
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-6 NUREG/CR-6042 Rev. 2

The methodology developed for the Zion

reactor and tested for the Surry reactor has

been extrapolated to all Westinghouse

reactor with large dry containments and

subatmospheric containments.6

 It has been

found for all these reactors that the

conditional containment failure probability

as a result of direct containment heating is

less than 0.01.

The methodology has been extended to

Combustion Engineering and Babcock and

Wilcox reactors.7 Combustion engineering

plants are of particular concern because they

typically have rather large annular gaps

around the reactor vessel. Core debris

expelled from the reactor vessel could

disperse up through these gaps into the large

volume of the reactor containment where

heat transfer from the debris to the

atmosphere could be most complete.

Nevertheless, it was found from the analyses

that conditional containment failure

probabilities as a result of direct

containment heating for all Combustion

Engineering and Babcock and Wilcox plants

were less than 0.1 and in most cases less

than 0.01.

Though they have automatic depressurization

systems, boiling water reactors could be

susceptible to high pressure melt ejection in

some accidents. Hydrogen combustion in the

drywells of inerted boiling water reactor

containments will not be especially

important, but pressurization as a result of

heat transfer to the drywell atmosphere

might be significant in these containments

that are typically much smaller than

pressurized water reactor containments. To

date there has been no experimental

investigations of high pressure melt ejection

in boiling water reactors and only the most

limited analytic studies.
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-7 NUREG/CR-6042 Rev. 2 Figure 4.5-1 Melt ejection process
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-8 NUREG/CR-6042 Rev. 2Figure 4.5-2 Distribution for fraction of core material ejected, PWR
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-9 NUREG/CR-6042 Rev. 2Figure 4.5-3 Reactor cavity interactions
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-10 NUREG/CR-6042 Rev. 2Figure 4.5-4 Estimated median particle size versus time 
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-11 NUREG/CR-6042 Rev. 2

Figure 4.5-5 Example distributions for pressure rise at vessel breach, Surry
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-12 NUREG/CR-6042 Rev. 2 Figure 4.5-6 Surry containment pressure estimates from DCH resolution effort
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-13 NUREG/CR-6042 Rev. 2

Figure 4.5-7 Large dry and subatmospheric containment results from DCH

resolution effort
Reactor Safety Course (R-800) 4.5 Direct Containment Heating

USNRC Technical Training Center 4.5-14 NUREG/CR-6042 Rev. 2

1.

References for Section 4.5

1. M. M. Pilch, Michael D. Allen, and

David C. Williams, “Heat Transfer

During Direct Containment Heating,”

Academic Press, 1996.

2. F. T. Harper, et al., “Evaluation of

Severe Accident Risks: Quantification of

Major Input Parameters,” NUREG/CR4551, SAND86-1309, Vol. 2, Rev. 1, Part

1, Sandia National Laboratories,

December 1990.

3. F. T. Harper, et al., Evaluation of Severe

Accident Risks: Quantification of Major

Input Parameters,” NUREG\CR-4551,

SAND86-1309, Vol. 2, Rev. 1, Part 2,

Sandia National Laboratories, April

1991.

4. M.M. Pilch, et al., “The Probability of

Containment Failure by Direct

Containment Heating in Zion”,

NUREG/CR, SAND93-1535, Sandia

National Laboratories, Albuquerque, NM,

December, 1994

5. M.M. Pilch, et al., “The Probability of

Containment Failure by Direct

Containment Heating in Surry”,

NUREG/CR-6109, SAND93-2078, Sandia

National Laboratories, Albuquerque, NM,

May 1995

6. M. M. Pilch, et al., “Resolution of the

Direct Containment Heating Issue for all

Westinghouse Plants with Large Dry

Containments or Subatmospheric

Containments,” NUREG/CR-6338,

SAND95-2381, Sandia National

Laboratories, February 1996.

7. M.M. Pilch, et al., “Resolution of the

Direct Containment Heating Issue for

Combustion Engineering Plants and

Babcock and Wilcox Plants”

NUREG/CR-6475, SAND97-0667, Sandia

National Laboratories, Albuquerque, NM,

November 1998.
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-1 NUREG/CR-6042 Rev. 

4.6 Hydrogen Combustion

During the TMI-2 accident, hydrogen

generated from in-vessel zirconium oxidation

was released to the containment through the

pressurizer relief valve. This hydrogen

eventually ignited, resulting in a 28 psig

(193 kPa) peak pressure in the containment.

While this particular event did not threaten

the TMI-2 containment, it raised awareness

of the potential threats that might arise for

other scenarios and for other containment

types. The main concern over hydrogen

combustion in nuclear reactor containments

is that the high pressure generated might

cause a breach of containment and a release

of radioactivity. A second concern is that

the resultant high temperature or pressure

might damage important safety-related

equipment. This section describes the

physical mechanisms important to hydrogen

combustion events, discusses the TMI-2

event in more detail, and describes the

subsequent regulatory activities that have

been taken to reduce the potential

combustion threats. Much of the material in

this section is excerpted from the Light

Water Reactor Hydrogen Manual.

1

4.6.1 Hydrogen Combustion Reaction

Combustion of hydrogen according to the

reaction:

2H2 + O2

--> 2H 2O + energy (heat)

results in the release of about 5.2×10

4

Btu/lb-mol of hydrogen burned (57.8

kcal/gm-mole). Combustion waves are

usually classified either as deflagrations or

detonations. The term "explosion" usually

refers to a detonation, but is somewhat

ambiguous and should be avoided.

Deflagrations are combustion waves in

which unburned gases are heated by thermal

conduction to temperatures high enough for

chemical reaction to occur. Deflagrations

normally travel subsonically and result in

quasi-static (nearly steady state) loads on

containment. Detonations are combustion

waves in which heating of the unburned

gases is due to compression from shock

wave s. De t o n a tion wave s tr ave l

supersonically and produce dynamic or

impulsive loads on containment in addition

to quasi-static loads. The pressure and

temperature obtained from the complete

combustion of hydrogen in air, adiabatically

(without heat loss) and at constant volume,

are shown in Figures 4.6-1 and 4.6-2. These

figures show the ratio of initial to final

pressures and final temperatures that could

be expected for gas mixtures with low steam

concentrations. Appendix A shows examples

of pressure and temperature calculations for

the types of air-steam-hydrogen mixtures that

might occur in a reactor containment. In the

following sections, the conditions necessary

for combustion and the different combustion

modes are discussed in detail.

4.6.2 Conditions Necessary for

Combustion

Normally, for substantial combustion of

hydrogen to take place, the gaseous mixture

must be flammable, and an ignition source

must be present. The special case of high

temperature combustion is discussed later.

For a flammable gas mixture, the

flammability limits are defined as the

limiting concentrations of fuel, at a given

temperature and pressure, in which a flame

can be propagated indefinitely. Limits for

upward propagation of flames are wider than

those for downward propagation. Limits for

horizontal propagation are between those for

upward and downward propagation.

The lower flammability limit is the minimum

concentration of hydrogen required to

propagate a flame, while the upper limit is

the maximum concentration. At the lower

limit, the hydrogen is in short supply and the
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-2 NUREG/CR-6042 Rev. 

oxygen is present in excess. At the upper

limit of flammability for hydrogen in air, the

oxygen is in short supply, about 5% oxygen

by volume. The behavior of the upper limit

of flammability of hydrogen with various

mixtures such as air:steam is more easily

understood if one considers it as the lower

flammability limit of oxygen.

In large PWR containments we are usually

interested in the lower limit of flammability,

there being large amounts of oxygen present.

In the much smaller BWR containments,

particularly the inerted containments, we

may be interested in the upper flammability

limit.

For hydrogen:air mixtures, the flammability

limits of Coward and Jones are still

accepted.

2 Values for hydrogen flammability

in air saturated with water vapor at room

temperature and pressure are given in Table

4.6-1. These limits may vary slightly during

accident conditions. There may be scale

effects due to the large size of reactor

containments as well as variations in

flammability due to the ignition source

strength.

In reactor accidents the conditions inside

containment prior to hydrogen combustion

may include elevated temperature, elevated

pressure, and the presence of steam. The

flammability limits widen with increasing

temperature. For example, at 212

oF (100oC)

the lower limit for downward propagation is

approximately 8.8% (see Figure 4.6-3).

If the containment atmosphere is altered by

the addition of carbon dioxide, steam,

nitrogen, or other diluent, the lower

flammability limit will increase slowly with

additional diluent, while the upper

flammability limit will drop more rapidly.

With continued increase in diluent concentration, the two limits approach one

another until they meet and the atmosphere

is inerted. A flame cannot be propagated a

significant distance for any fuel:air ratio in

an inerted atmosphere. The addition of

diluents has been proposed as a hydrogen

mitigation strategy. Figure 4.6-4 shows the

flammability limits with the addition of

excess nitrogen or carbon dioxide. Note that

for 75% additional nitrogen, the atmosphere

is inert.

3,4 This corresponds to 5% oxygen at

the limit of the flammable region, a value

very close to that of the upper limit for

hydrogen:air combustion. For carbon

dioxide, the atmosphere is inerted when the

carbon dioxide concentration is 60% or

above, corresponding to 8% oxygen or less.

The larger specific heat of carbon dioxide

reduces the flame temperature and flame

velocity; hence carbon dioxide suppresses

flammability more than nitrogen. It requires

about 60% steam to inert hydrogen:air:steam

mixtures. The triangular diagram of Shapiro

and Moffett e indicates regions of

fl ammability of hydrogen: a ir:st e am

mixtures.

4

It has been widely reproduced

and appears as Figure 4.6-5.

Ignition of dry hydrogen:air mixtures,

particularly when the mixtures are well

within the flammability limits, can occur

with a very small input of energy.

4 Common

sources of ignition are sparks from electrical

equipment and from the discharge of small

static electric charges. The minimum energy

required from a spark for ignition of a

quiescent hydrogen:air mixture is of the

order of 10

-7 Btu (10-4

J) (a very weak spark).

The ignition energy required as a function of

hydrogen concentration is shown in Figure

4.6-6.

5 For a flammable mixture, the

required ignition energy increases as the

hydrogen concentration approaches the

flammability limits. The addition of a

diluent, such as steam, will increase the
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-3 NUREG/CR-6042 Rev. 

required ignition energy substantially. As

mentioned previously, high energy ignition

sources can cause mixtures outside the

flammability limits to burn for some

distance.

4.6.3 Deflagrations

Deflagrations are flames that generally travel

at subsonic speeds relative to the unburned

gas. Deflagrations propagate mainly by

thermal conduction from the hot burned gas

into the unburned gas, raising its temperature

high enough for a rapid exothermic chemical

reaction to take place. The propagation of a

deflagration can be understood by examining

the flammability limits discussed in the

previous section. Consider a quiescent

mixture of hydrogen:air. For hydrogen

concentrations below about 4.1% there will

be no significant propagation away from an

ignition source. For hydrogen concentrations

between 4.1 and 6.0%, there will be upward

propagation from the ignition source.

Hydrogen concentrations between 6.0 and

9.0% will produce both upward and

horizontal propagation, and hydrogen

concentrations above 9.0% will produce

propagation in all directions, although the

upward propagation may be faster than the

downward propagation. Exact values for

propagation limits will, of course, vary with

temperature, pressure, and the presence of

diluents. The degree of turbulence is also

very important with turbulence tending to

enhance combustion as long as the

turbulence is not violent enough to "blow

out" the flame.

It has been found in laboratory experiments

that when hydrogen:air mixtures with

hydrogen concentrations in the range 4-8%

were ignited with a spark, some of the

hydrogen was not burned.

6,7,8,9,10 The

resultant pressure rise was below that

predicted for complete combustion, as shown

in Figure 4.6-7. Experimental results with a

spark ignition source indicate that the

completeness of combustion in quiescent

mixtures increases with increasing hydrogen

concentration, and is nearly complete at

about 8-10% hydrogen. The range of

incomplete combustion corresponds to the

range in which the mixture is above the

flammability limit for upward propagation,

but below the flammability limit for

downward propagation. As shown in Figure

4.6-7 for the "fans on" cases, turbulence and

mixing of the gases can significantly

increase the completeness of combustion.

The additional variations in Figure 4.6-7 for

mixtures below 8% tend to result from

variations in the geometry and scale of the

experiments.

Another important parameter when studying

deflagrations is the flame speed. The flame

speed determines how much time is available

for heat transfer during a burn. Heat transfer

results in pressures and temperatures below

those predicted in Figures 4.6-1 and 4.6-2.

The dominant heat transfer mechanisms are

evaporation of containment sprays, radiation,

and convection. Some plants also contain

fan coolers. Normally, if the sprays are on,

they will dominate the heat transfer process.

Radiation heat transfer can also be important

due to the high gas temperatures expected

during a hydrogen burn. Convection may be

less significant over the short time of a burn.

One note is that the presence of sprays may

significantly increase the flame speed due to

the increased turbulence induced by the

sprays. Typically, pressure rises above 80%

of the adiabatic pressure rises are predicted

for reasonable values of the flame speed,

assuming complete combustion.

As shown in Figure 4.6-8, laminar burning

velocities are quite slow. The laminar

burning velocity (in a Lagrangian sense)

denotes the speed of gases at a steady
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-4 NUREG/CR-6042 Rev. 

burner. Propagating laminar flames have

flame speeds (in an Eulerian sense) which

are 5-7 times faster due to volumetric

expansion of the burned gases. The

maximum laminar burning velocity of

hydrogen:air mixtures is about 9.8 fps (3

m/s) near a concentration of about 42%

hydrogen. The burning velocity becomes

much smaller as the flammability limits are

approached.

In a reactor containment, it is likely that a

laminar deflagration will become turbulent.

Turbulent flames can have average burning

velocities 2 to 5 times the laminar burning

velocity. Therefore, a hydrogen combustion

event can occur in a containment in a matter

of seconds, as opposed to the long times

predicted by the laminar burning velocities.

If the turbulent flame speed (laboratory

system) becomes greater than about onetenth the speed of sound (the speed of sound

is approximately 1150 fps (350 m/s) in

containment air), shock waves will be

formed ahead of the flame front. In that

case dynamic loads, in addition to static

loads, will be imposed on the containment

structure. The mechanisms leading to flame

acceleration and detonation will be discussed

in the next section.

4.6.4 Detonation of Hydrogen

A detonation is a combustion wave that

travels at supersonic speeds relative to the

unburned gas in front of it. For near

stoichiometric hydrogen air mixtures this

speed is about 6600 fps (2000 m/s) (see

Figure 4.6-9). The compression of the

unburned gas by shock waves in the

detonation raises the gas temperature high

enough to initiate rapid combustion.

We will attempt to answer as well as

possible the following three questions:

1. Under what conditions is a hydrogen:air

or hydrogen:air:steam detonation possible

in containment?

2. If a detonation is possible, what is the

likelihood that it will occur?

3. What pressure loads could a detonation

cause?

We can answer the first question fairly well

(at least with regard to hydrogen:air

mixtures) and also the third question. The

second question concerns the transition from

deflagration to detonation and is still not

completely understood after more than 50

years of investigation. We can say that, in

most postulated reactor accident scenarios,

deflagrations are much more likely than

detonations.

4.6.4.1 Detonation Limits

Hydrogen:air mixtures near stoichiometric

(about 29% hydrogen, two parts H2

to one

part O2

) are known to be detonable.

Mixtures departing from stoichiometric,

either in the hydrogen-lean or hydrogen-rich

direction are increasingly more difficult to

detonate. It has been observed that

"detonation limits" are functions of geometry

and scale, and not universal values at given

mixture concentrations, temperatures and

pressures.

11,12,13

Our understanding of the possibility of

sustaining a detonation in hydrogen:air

mixtures, as well as other gas mixtures, has

greatly increased within the last fifteen

years. It has been found that a detonation

wave is composed of unsteady oblique shock

waves moving in an everchanging cellular

structure (characterized by its transverse

dimension), a "foamy" detonation front.

Figure 4.6-10 shows the effect when a

detonation passes by a smoked foil. The
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-5 NUREG/CR-6042 Rev. 

interacting shock waves form roughly

diamond shape detonation “cells.”

The farther a mixture is from stoichiometric,

and hence the less energetic the chemical

reaction, the larger is the detonation cell

size, . The cell width for hydrogen:air has

been accurately measured over an extensive

range of hydrogen:air ratios (see Figure 4.6-

11).

13

The knowledge of hydrogen:air cell size is

valuable for evaluating detonation concerns

in particular geometries. It is known that if

a detonation is to propagate in a given

geometry, there is a minimum size for

which the detonation will propagate, related

to the cell size. For smaller geometries, the

detonation will fail. Figure 4.6-12 shows the

relationship between various geometries and

cell size. For example, at 16% hydrogen,

the cell size is about 9.6 in. (24.5 cm).

This means that a 16% hydrogen mixture

detonation should be able to propagate down

a tube 3.2 in. (8.2 cm) in diameter. The

larger the tube diameter, the wider is the

range of detonable hydrogen concentrations.

The detonability of a mixture is increased

(cell size is decreased) with increasing

temperature. For example, in a 17 in. (43

cm) tube at 68

oF (20oC), a detonation can

be propagated in a mixture with 11.7%

hydrogen. At 212

oF (100oC), the detonability limit changes to 9.5% hydrogen.

14

The information provided above helps to

answer the first question, "Under what

conditions is a hydrogen:air detonation

possible in containment?" The detonation

limits are not fixed, but depend on the

geometry and are wider for larger sizes and

higher temperatures. The curve of cell size

versus hydrogen fraction rises steeply on the

hydrogen-lean side (see Figure 4.6-11). For

the large geometrical scales in containments,

detonations may propagate in leaner mixtures

than has been demonstrated in small and

medium scale experiments.

4.6.4.2 Transition to Detonation

A detonable mixture may only deflagrate

(burn) and not detonate. Detonations can

start directly by the use of a vigorous shock

wave coming from a high explosive, strong

spark, or laser. Approximately 0.035 oz. (1

gm) of tetryl explosive will initiate a

spherical detonation of a stoichiometric

hydrogen:air mixture. The increase in

explosive charge required as the mixture

departs from stoichiometric is roughly

proportional to the increase in detonation

cell size. Detonations can also start from

deflagrations that accelerate to high speeds

pushing shock waves ahead of the burn front

until at some point shock heating is

sufficient to initiate the detonation. Sources

of such highly accelerated flames are high

speed jets coming from semiconfined regions

and flames passing through fields of

obstacles.

Many obstacles that might potentially cause

flame acceleration, such as pipes and

pressure vessels, are present in the lower

sections of most containments. Very fast

burns may also occur due to the presence of

a very intense ignition source, such as a jet

of hot combustion products formed

subsequent to ignition in some adjoining

semi-confined volume.

Deflagration-to-detonation transition is

probably the least understood aspect of

d e t o n a t i o n t h e o r y a t t h is t i m e .

Measurements have been made of the

distance required to have transition to

detonation in smooth tubes. Distances many

times the tube diameter have been required.

If obstacles are inserted into the tube, the

required distance to detonation is greatly

reduced. The motion of the expanding gases

around the obstacles leads to greatly
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-6 NUREG/CR-6042 Rev. 

increased flame front area, rapid flame

acceleration and rapid transition to

detonation. Confinement greatly promotes

transition, but one cannot rule out transition

to detonation in a containment if a detonable

mixture of sufficient size is present. The

second question, "If a detonation is possible,

what is the likelihood that it will occur?"

therefore cannot be answered with certainty

at present.

4.6.4.3 Detonation Pressures and

Temperatures

For the purpose of studying the pressures

and temperatures caused by a detonation, it

is sufficient to ignore the detonation wave

structure and consider it as a thin surface, a

discontinuity. Chapman and Jouguet

assumed that the detonation traveled at a

speed that was sonic relative to the unburned

gas. With this assumption one can compute

a unique detonation speed for each

hydrogen:air mixture, and find the

corresponding temperature and pressure

behind the detonation wave. The results are

shown in Figures 4.6-13 and 4.6-14. It is an

experimental fact that the measured speeds

of detonations are approximately equal to the

calculated Chapman-Jouguet values.

The burned gases behind a detonation are

moving in the direction of the detonation.

When a detonation hits a rigid wall, the

gases must be brought to rest. This is

accomplished by a reflected shock wave.

We will consider only the case of a

detonation wave striking a wall at normal

incidence. The reflected shock wave further

compresses the burned gas, increasing the

detonation pressure by a factor of about 2.3.

The pressures and temperatures predicted

behind the normally reflected shock wave are

also shown in Figures 4.6-13 and 4.6-14. In

a containment one expects wave reflections

from walls and obstacles to give rise to

complex shock wave patterns. Wave

interactions may lead to dissipation or,

possibly, to wave focusing which can give

rise to very high local peak pressures.

4.6.4.4 Local Detonations

In all the previous sections on detonations it

has been assumed that the detonation is

taking place in a homogeneous combustible

mixture. Such detonations are global,

traveling throughout the containment. With

the exception of the strongest containments,

containments will probably not be able to

withstand the quasi-static pressure (adiabatic

isochoric pressures) generated after the

detonation, even without the additional

dynamic loads due to detonation. It is

therefore more appropriate to consider the

effect of detonations when only a local

portion of the containment atmosphere is

detonable.

Consider a detonable cloud of hydrogen:air

surrounded by air. As the detonation wave

leaves the cloud, it will change into an

expanding decaying shock wave. The shock

wave intensity drops fairly rapidly if the

shock wave expands spherically. Within a

distance equal to 3 cloud radii, the shock

wave pressure will drop to a value low

enough to no longer threaten the containment

structure. However, it has been found in

detailed computer calculations that, because

of the containment geometry, the shock

waves may be focused in local regions, such

as the top center of the containment dome,

giving rise to large local peak pressures and

impulses.

15,16 Local detonations may be

dangerous in and near the detonable cloud,

and may be dangerous at locations farther

away if shock focusing effects are

significant.

There are several locations to consider where

high hydrogen concentrations are possible.

These include:
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-7 NUREG/CR-6042 Rev. 

1. near the hydrogen release point,

2. under ceilings or in the dome due to the

rise and stratification of a low density

plume, or

3. near steam removal locations such as ice

condensers, suppression pools, and fan

coolers.

A detonable mixture requires adequate

hydrogen and oxygen, but not too much

steam. Regions of stratification tend to be

difficult to establish and maintain in a

turbulent containment environment. Steam

removal locations are generally a more

significant concern for local detonations.

4.6.4.5 Missile Generation

Missiles may be generated when combustion

(deflagration or detonation) occurs in a

confined region or when a propagating

combustion front produces dynamic pressure

loads on equipment. Such missiles may pose

a threat to the containment structure itself,

as well as representing a potential threat to

safety and control equipment. For instance,

electrical cables may not be expected to

withstand the impact of a door or metal box.

The actual risk to plant safety posed by

missil e s gene r a t ed fr om h yd rogen

combustion depends upon a number of

independent factors and is very difficult to

predict.

4.6.5 Continuous Combustion

The preceding discussions have dealt with

the discrete combustion events associated

with hydrogen:air:steam mixtures in

containment. There are also mechanisms for

continuous combustion that are possible in

some containments and for certain accident

scenarios. Hydrogen may enter the

containment as part of a turbulent jet from a

pipe break or relief valve or may enter as

part of a buoyant plume from the top of a

suppression pool or from core-concrete

interactions. The hydrogen may be

accompanied by large quantities of steam or,

in the case of core-concrete interactions,

carbon monoxide which is also flammable.

The primary threat to nuclear power plants

from continuous combustion is the

temperature rise and the possible effect on

equipment and structures. Pressure increases

from continuous combustion will not

generally threaten the containment.

Hydrogen that enters the containment may

start to burn as a turbulent diffusion flame.

A diffusion flame is one in which the

burning rate is controlled by the rate of

mixing of oxygen and fuel. The nature of

the flame is determined by the Froude

Number, which is the ratio of the momentum

forces to the buoyant forces in the jet or

plume. Figure 4.6-15 shows the types of

flames that can occur for different source

diameters and flow rates. For the hydrogen

to burn, it is necessary that at some location

the hydrogen:air:steam mixture be within

flammability limits.

Combustion can begin either because of an

outside ignition source, or because the

mixture t emperatur e is above the

spontaneous ignition temperature. Shapiro

and Moffette in 1952 presented experimental

results on the spontaneous ignition

temperature of hydrogen:air:steam mixtures

(see Figure 4.6-16).

17 The spontaneous

ignition temperature is in the range of 959-

1076

oF (515-580oC). Above this temperature, combustion can occur without external

ignition sources such as electrical sparks.

For example, continuous combustion may

occur in a reactor cavity above CCI in a dry

cavity. In this case, the combustion will be

limited by the availability of oxygen.

However, if any oxygen is present, hydrogen

and carbon monoxide can react even if the
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-8 NUREG/CR-6042 Rev. 

mixture is not within normal flammability

limits.

Turbulent jets, such as from a pipe break,

tend to autoignite at higher temperatures

than buoyant plumes. Experiments have

shown that such jets can autoignite at

temperatures above 1166 to 1346

oF (630-

730

oC).18 A stable flame will occur at a

distance from the orifice such that the

turbulent burning velocity is equal to the gas

flow velocity. There is evidence to suggest

that for a particular set of conditions

(temperature, pressure, and composition),

there is a minimum orifice diameter for

flame stability.

19 This minimum diameter is

typically on the order of a few hundredths of

an inch (millimeters) or less, and therefore,

all practical sized orifices will support a

stable hydrogen flame. Turbulent jets of

hydrogen can also accompany direct

containment heating. Hydrogen may already

be present in containment, with additional

hydrogen coming from in-vessel and from

oxidation reactions during the melt ejection

process. The hot particles and high

temperature gases will serve to ignite the

hydrogen, resulting in an additional energy

contribution to the direct containment

heating process. As noted in Section 4.5,

very rich mixtures of hydrogen may be found

at the exit of a reactor cavity, raising the

possibility of a detonation. However, in this

latter case the mixture may be steam rich

and oxygen starved near the release point.

4.6.6 Combustion at TMI-2

The TMI-2 accident was discussed at some

length in Module 2. During the core heatup

and degradation process, hydrogen was

generated and released to containment

through the pressurizer relief valve and the

quench tank. Estimates of the total amount

of hydrogen generated range from 594 to 814

lbm (270 - 370 kg).

20 This amount of

hydrogen corresponds to oxidation of about

40% of the zirconium in the core.

Approximately 9 hours and 50 min. into the

accident, a hydrogen deflagration occurred,

resulting in a 28 psig peak pressure in

containment (see Figure 4.6-17). The

ignition source is not known, but could have

been an electrical spark from a variety of

sources.

The pressure rise observed at TMI-2 is

consistent with the estimates of the

generation and rel atively complete

combustion of between 7 and 8.2%

hydrogen. The TMI-2 containment has a

volume in excess of 2×10

6

ft

3

(5.7×10

4 m3

)

and a failure pressure far in excess of 28

psig (193 kPa). However, BWR containments and PWR ice condenser containments

are much smaller than TMI-2, and the same

quantity of hydrogen could have resulted in

a detonable mixture in those containments.

The realization that hydrogen combustion

could cause containment failure in smaller

containments led to regulatory actions, as

discussed in the following section.

4.6.7 Hydrogen Control Requirements

In general, there are very few regulations

and guidelines dealing with beyond-designbasis accident phenomena in reactor

containments. For example, there are no

specific rules dealing with CCIs, ex-vessel

steam explosions, or direct containment

heating. Hydrogen control has been an

exception to this approach, with significant

regulations passed following the TMI-2

accident.

Limited hydrogen control was provided prior

to TMI-2 in the form of hydrogen

recombiners that could remove the small

amounts of hydrogen that might be generated

during a design-basis LOCA. However,

these recombiners have virtually no value for

the large quantities of hydrogen that could

be generated during a severe accident.
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-9 NUREG/CR-6042 Rev. 

Therefore, the NRC took additional steps to

protect the reactors considered most

vulnerable to hydrogen combustion.

The hydrogen rule is contained in 10 CFR

50.44.

21

In 1981, the NRC ordered that all

BWRs with Mark I and Mark II

containments be inerted during normal

operation to preclude the possibility of

combustion. These containments are small

enough that relatively low levels of

zirconium oxidation could produce detonable

mixtures in containment. Although inerting

will prevent combustion within the

containment, hydrogen can enter the

surrounding reactor building of a Mark I or

II containment if the containment fails or is

vented through structurally inadequate flow

paths. This hydrogen can burn, presenting a

thermal hazard for safety equipment located

in those buildings.

BWR Mark III containments and PWR ice

condenser containments were the object of

long and controversial examination and are

still being examined today. A variety of

hydrogen control measures were considered

by both the industry and the NRC. These

measures included inerting, partial inerting,

water fogs and foams, and deliberate ignition

systems. Because of the need to enter

containment for various operational activities

and risks to personnel, the utilities opposed

inerting approaches. Some other approaches,

such as water fogs and foams, were not

successfully demonstrated as practical prior

to the decisions that were reached.

Ultimately, the industry and NRC agreed on

the deliberate ignition approach, even though

other options are allowed under 10 CFR

50.44. The deliberate ignition approach is

discussed in more detail below.

The acceptance of deliberate ignition as a

viable strategy is based in part on a couple

of controversial assumptions in the hydrogen

rule. The TMI-2 accident did not result in

vessel breach, and only about half of the

avail abl e z ir conium wa s oxidi z ed.

Therefore, the hydrogen rule was set up to

address only degraded core accidents and not

full scale melting and vessel breach.

Consistent with the assumption that vessel

breach does not occur, the limit of zirconium

oxidation was set to 75% of the fuel

cladding, not including channel boxes in

BWRs. Greater amounts of hydrogen were

not expected to be consistent with an

accident in which most of the core did not

melt or the vessel was not breached.

Further, because the vessel is not breached,

the release of hydrogen to containment was

expected to occur over time periods of at

least many minutes, if not longer. The large

puff release that might accompany vessel

breach, hot-leg rupture or ex-vessel steam

explosions does not need to be considered in

meeting the hydrogen rule. It is also

interesting to note that, while the fuel

damage is assumed to be arrested at some

point, the reflooding process is assumed to

not produce oxidation in excess of 75% and

to not result in a large burst of hydrogen.

Therefore, only a select subset of beyonddesign-basis accidents is actually addressed.

Deliberate ignition is based on the premise

that hydrogen can be burned off in small

quantities as it enters the containment.

Either numerous small deflagrations or

continuous combustion may occur, resulting

in minimal pressure rise in containment,

although the temperature effects must be

considered. If the containment is not steaminerted, then lean mixtures will be

combusted until either the hydrogen or

oxygen is depleted. As shown in Figures

4.1-5 and 4.1-9, igniters are located throughout containment to assure that locally high

concentrations of hydrogen are avoided.

These igniters are typically glow plugs,

requiring AC power to function.
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-10 NUREG/CR-6042 Rev. 

There are some limitations and concerns

associated with igniters. First, they require

AC power and will not function during

station blackout. Further, if the containment

is filled with hydrogen and power is later

restored, they could provide a distributed

ignition source if the operators do not think

to keep them turned off.

Second, there are two regions where higher

than average hydrogen concentrations are

possible. One is within an ice condenser

and the other is above a Mark III

suppression pool. In both cases, a steamrich mixture may enter the condensing

region, and the gas may emerge very

hydrogen-rich. This is particularly true for

rapid releases of hydrogen. A third concern

relates to accidents more severe than

degraded core accidents and to reflooding.

Very rapid releases of hydrogen, such as

associated with vessel breach or late

reflooding, may overwhelm the igniters so

that the effect is the same as for a large

deflagration. A fourth possibility concerns

sequences in which the containment sprays

do not function and the containment

becomes steam inert. If the hydrogen

accumulates in the inert atmosphere, and the

sprays are later recovered, combustion may

occur when the containment deinerts. If the

combustion occurs early in the deinerting

process, while significant steam is still

present, a fairly weak burn is expected.

Despite the concerns raised above, hydrogen

igniters are expected to have a positive

benefit in many accidents. However,

persons responsible for managing accidents

need to be aware of the possibilities and use

the igniters appropriately.

No additional hydrogen controls have been

required for large dry or subatmospheric

containments. These containments are large

enough and strong enough that deflagrations

are not expected to threaten them, except in

conjunction with other phenomena. Local

detonations are possible, but not considered

likely for many accidents.

22 Detonable

mixtures involving most of the containment

can not be achieved without complete

oxidation of all zirconium, plus additional

hydrogen generation from steel oxidation or

core-concrete interactions. A large

detonation would require all of this hydrogen

to be generated, that none of it burn

previously, and that the burn undergoes a

transition to a detonation. This combination

of events is considered unlikely.

4.6.8 Risk-Informed Changes to the

Hydrogen Rule

As PRAs were performed throughout the

1980s and early 1990s, it became clear that

hydrogen combustion was not a major threat

to most large, dry and subatmospheric

containments. Further, it was clear that

hydrogen recombiners contributed very little

to public safety, due to their limited capacity

to mitigate large hydrogen releases from the

reactor coolant system. In 1998, San Onofre

requested an exemption to the requirement

for hydrogen recombiners. This exemption

was granted, thereby relieving the plant of

the operational and tech spec burdens

associated with their operation.

As the NRC moved forward with riskinforming the regulations, 10CFR50.44

became one of the first regulations

addressed, due in part to industry requests.

It is desirable to issue a rule change as

opposed to granting individual exemption for

many plants. Rulemaking is not yet

complete for the new rule; however, the rule

is likely to allow the elimination of

hydrogen recombiners for large, dry and

subatmospheric containments. For BWR

Mark I and II containments, no major

changes are anticipated.
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-11 NUREG/CR-6042 Rev. 

Risk-informing the hydrogen rule for ice

condenser and BWR Mark III containments

is more complex. As noted earlier, these

intermediate-sized containments have acpowered igniter systems for hydrogen

control. PRAs indicate that the risk from

station blackout and similar accidents can be

important. Therefore, it is possible that the

risk-informed hydrogen rule could add

additional requirements for these two

containment types. For example, DC backup

power or other backup power sources for the

igniters could be needed. Given that

implementation of the risk-informed rule is

voluntary, it is unlikely that any substantive

changes will be made at these plants.
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-12 NUREG/CR-6042 Rev. 

Table 4.6-1 Hydrogen flammability limits in steam-saturated air

at room temperature

Lower Limit

Vol. % of

Hydrogen

Upper Limit

Vol. % of

Hydrogen

Upward Propagation 4.1 74

Horizontal Propagation 6.0 74

Downward Propagation 9.0 74
R

eactorSafetyCourse(R-800)4.6HydrogenCombustion

USNRCTechnicalTrainingCenter

4.6-13NUREG/CR-6042Rev.

Figure 4.6-1 Theoretical adiabatic, constant-volume combustion pressure for

hydrogen : air mixtures
R

eactorSafetyCourse(R-800)4.6HydrogenCombustion

USNRCTechnicalTrainingCenter

4.6-14NUREG/CR-6042Rev.

Figure 4.6-2 Theoretical adiabatic, constant-volume combustion temperature

for hydrogen : air mixtures
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-15 NUREG/CR-6042 Rev. 

Figure 4.6-3 Effect of initial temperature on downward propagating

flammability limits in hydrogen : air mixtures
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-16 NUREG/CR-6042 Rev. 









	
	











 
 















 












 






Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-17 NUREG/CR-6042 Rev. 

Figure 4.6-5 Flammability limits of hydrogen : air : steam mixtures
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-18 NUREG/CR-6042 Rev. 

Figure 4.6-6 Spark ignition energies for dry hydrogen :

air mixtures
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-19 NUREG/CR-6042 Rev. 

Figure 4.6-7 Normalized pressure rise versus hydrogen

concentration
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-20 NUREG/CR-6042 Rev. 

Fig

u

r

e

4.6-8

L

a

min

a

r

b

u

r

nin

g

v

elo

city

o

f

h

y

d

r

o

g

e

n : air

mixtu

r

e
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-21 NUREG/CR-6042 Rev. 

Fig

u

r

e

4.6-9

T

h

e

o

r

etic

al d

eto

n

atio

n

v

elo

citie

s

fo

r

h

y

d

r

o

g

e

n : air

mixtu

r

e
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-22 NUREG/CR-6042 Rev. 

Fig

u

r

e

4.6-1

0

H

y

d

r

o

g

e

n

d

eto

n

atio

n

c

ells
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-23 NUREG/CR-6042 Rev. 

Figure 4.6-11 Measurement of detonation cell size

for hydrogen : air mixtures at

atmospheric pressure
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-24 NUREG/CR-6042 Rev. 

Figure 4.6-12 Dimensions required for detonation

propagation in various geometries
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-25 NUREG/CR-6042 Rev. 

Fig

u

r

e

4.6-1

3

T

h

e

o

r

etic

al d

eto

n

atio

n

p

r

e

s

s

u

r

e

a

n

d

n

o

r

m

ally

r

e

fle

cte

d

p

r

e

s

s

u

r

e
R

eactorSafetyCourse(R-800)4.6HydrogenCombustion

USNRCTechnicalTrainingCenter

4.6-26NUREG/CR-6042Rev.

Figure 4.6-14 Theoretical detonation temperature and normally reflected detonation

temperature
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-27 NUREG/CR-6042 Rev. 

Figure 4.6-15 Flame structures for a range of geometries

and flow rates
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-28 NUREG/CR-6042 Rev. 

Figure 4.6-16 Minimum spontaneous ignition temperatures
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-29 NUREG/CR-6042 Rev. 

Fig

u

r

e

4.6-1

7

T

M

I-2

c

o

ntain

m

e

nt p

r

e

s

s

u

r

e

v

e

r

s

u

s tim

e
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-30 NUREG/CR-6042 Rev. 

References for Section 4.6

1. A. L. Camp, et al., “Light Water Reactor

Hydrogen Manual,” NUREG/CR-2726,

SAND82-1137, Sandi a Na tiona l

Laboratories, August 1983.

2. E. P. Coward and G. W. Jones, “Limits

of Flammability of Gases and Vapors,”

Bulletin 503, Bureau of Mines, U. S.

Department of Interior, 1952.

3. B. Bregeon, et al., “Near-Limit

Downward Propagation of Hydrogen and

Methane Flames in Oxygen-Nitrogen

Mixtures,” Combustion & Flame, 33:33-

45, 1978.

4. Z. M. Shapiro and T. R. Moffette,

“Hydrogen Flammability Data and

Application to PWR Loss-of-Coolant

Accident,” WAPD-SC-545, Bettis Plant,

September 1957.

5. I. L. Drell and F. E. Belles, “Survey of

Hydrogen Combustion Properties,”

NACA R 1383, National Advisory

Committee for Aeronautics, 1958.

6. A. L. Furno, E. B. Cook, J. M. Kuchta

and D. S. Burgess, "Some Observations

on Near-Limit Flames," 13 Symposium

on Combustion, Pittsburgh Combustion

Institute, 593-599, 1971.

7. B. C. Slifer and T. G. Peterson,

“Hydrogen Flammability and Burning

Characteristic in BWR Containments,”

NEDO-10812, 73NED49, General

Electric, April 1973.

8. M. P. Paulson and J. O. Bradfute,

"Pressure and Temperature Transients

Resulting from Postulated Hydrogen

Fires in Mark III Containments," EI 75-

4, Energy Inc., 1981.

9. M. Berman, “Light Water Reactor Safety

Research Program Quarterly Report,”

January-March, 1981, NUREG/CR2163,1 of 4, SAND81-1216,1 of 4,

S a n d i a N a t i o n a l La b o r a t o ri e s,

Albuquerque, New Mexico, July 1981.

10. W. E. Lowry, et al., “Final Results of

the Hydrogen Igniter Experimental

Program,” NUREG/CR-2486, UCRL53036, Lawrence Livermore National

Laboratory, February 1982.

11. M. Berman, “Light Water Reactor Safety

Research Program Semiannual Report,”

April-September 1981, NUREG/CR2481, SAND82-0006, Sandia National

Laboratories, Albuquerque, New

Mexico, February 1982.

12. Yu. M. Annushkin and E. D. Sverdlov,

“Stability of Submerged Diffusion

Flames in Subsonic and Underexpanded

Su p e rs o n i c Ga s-Fu e l Str e ams, ”

Translation, Combustion, Explosions,

and Shock Waves, 14, 5, 1978.

13. C. M. Guirao, R. Knystautas, J. H. Lee,

W. Benedick, and M. Berman,

"Hydrogen-Air Detonations," presented

at the 1982 Combustion (International)

Symposium, Haifa, Israel, 1982.

14. D. W. Stamps and M. Berman, “A

Critical Review of High-Temperature

Hydrogen Combustion in Reactor Safety

Ap p l i c a t i o n s, ” S A N D8 8 - 0 6 8 0C,

International Conference on Thermal

Reactor Safety, Avignon, France,

October 1988.
Reactor Safety Course (R-800) 4.6 Hydrogen Combustion

USNRC Technical Training Center 4.6-31 NUREG/CR-6042 Rev. 

15. R. K. Byers, “CSQ Calculations of H2

Detonations in the Zion and Sequoyah

Nuclear Plants,” NUREG/CR-2385,

SAND81-2216, Sandi a Nationa l

Laboratories, Albuquerque, New

Mexico, July 1982.

16. M. A. Delichatsios, M. B. Genadry, and

M. N. Fardis, “Calculations of Hydrogen

Detonations in Nuclear Containments by

the Random Choice Method,” M.I.T.,

R81-30, December 1981.

17. Z. M. Shapiro and T. R. Moffette,

“Hydrogen Flammability Data and

Application to PWR Loss-of-Coolant

Accident,” September 1957.

18. J. E. Shepherd, “Hydrogen-Steam JetFlame Facility and Experiments,”

NUREG/CR-3638, SAND84-0060,

Sandia National Laboratories, February

1985.

19. M. Berman, Light Water Reactor Safety

Research Program Semiannual Report,

April-September 1981, February 1982.

20. “Technical Aspects of Hydrogen Control

and Combustion in Severe Light-Water

Reactor Accidents,” National Academy

Press, Washington, D.C., 1987.

21. Title 10, Code of Federal Regulations,

Part 50.44, U.S. Government Printing

Office, January 1, 1991.

22. M. P. Sherman and M. Berman, “The

Possibility of Local Detonations During

Degraded-Core Accidents in the

Bellefonte Nuclear Power Plant,”

NUREG/CR-4803, SAND86-1180,

Sandia National Laboratories, January

1987.
USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-1

Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

4.7 BWR Mark I Liner Failure By Melt

Attack

Because of its relatively small enclosed volume

and drywell floor area, the BWR Mark I

containment structural boundary is particularly

vulnerable to failure by overpressure or by

direct contact attack should molten core and

structural debris leave the reactor vessel.

Numerous analyses of the potential for early

failure of the containment pressure boundary

due to direct interaction with corium have been

published, beginning with Reference 1.

According to NUREG-1150 (Section 12.4,

Perspectives), “At Peach Bottom, drywell

meltthrough is the most important mode of

containment failure.”

In 1988, the NRC Office of Research began a

dedicated major effort toward resolution of the

Mark I liner failure issue. The approach

involved an initial decomposition of the overall

issue into considerations of melt release from

the reactor vessel, melt spreading over the

containment floor, and thermal loading of the

drywell shell. The results of this effort, which

is purported to be a “mechanistic treatment of

the sequence of physical phenomena that lead to

liner contact by corium debris, and their

coupling through a probabilistic framework that

allows representation of uncertainties,”2

 are

documented in References 2 and 3.

The following subsections address the prospects

for spreading of debris liquids to the steel

drywell shell in a manner that would induce

failure of that boundary, and the mitigative

measures that might be taken. Following a

description of the specific features of the Mark

I containment that are relevant to this issue, the

decomposition categories of melt release, melt

spreading, and thermal attack are each

discussed. Finally, an assessment of the

mitigative effects of water and a summary of

the current status of this issue are provided in

Subsections 4.7.5 and 4.7.6, respectively.

4.7.1 Pertinent Features of the Mark I

Containment Design

The typical BWR Mark I primary and

secondary containment configuration is shown

in Figure 4.7-1. With the sole exception of the

two Brunswick units, which employ steel-lined

reinforced concrete structures, all Mark I

primary containments incorporate free standing

steel structures. Thus, while “liner failure” is

correct for identification of the direct corium

attack issue with respect to the Brunswick

units, it is a misnomer for the other 22 Mark I

units, where “shell failure” would be more

appropriate. Nevertheless, by historical

repetition, “liner failure” has become the

general appellation for this issue at all BWR

facilities.

It should be recognized that plant-specific

containment design differences abound, many

with important ramifications with respect to

plant response under severe accident

conditions. This is true even for supposedly

“sister” plants such as Browns Ferry and Peach

Bottom.

With respect to the potential for emergent

corium to come into contact with the carbon

steel drywell shell at the level of the floor, it is

important to first note that here also, any

detailed analysis must take plant-specific

differences into consideration. This discussion is based on the Peach Bottom/Browns

Ferry configuration. Figure 4.7-2 provides a

plan view of the intersection of the base of the

reactor pedestal with the concrete floor. As

indicated, there is a single doorway to direct

any flow from the inpedestal region toward the
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-2

opposite portion of the drywell wall. The

distance from the point directly underneath the

reactor vessel centerline to the closest point of

the drywall wall is only about 7 m (22.85 ft.).

Figure 4.7-3 shows the placement of all reactor

pedestal penetrations at Browns Ferry, and

confirms that the doorway provides the only

opening extending to the level of the floor. The

location of the drywell sumps within the

pedestal region is also shown in this figure.

The pedestal doorway and door at Peach Bottom

are shown at the left side of Figure 4.7-4. This

photograph also shows a portion of the carbon

steel sump cover, which occupies a central

rectangular section of the pedestal region floor.

The existence of the sumps is a factor with

respect to the potential for debris spreading

since erosion of the thin sump cover would

permit a significant fraction of the emergent

debris to be retained in the sumps. The sump

volume is about 5.7 m3

 (200 ft.3) at both Browns

Ferry and Peach Bottom.

Another pertinent plant-specific difference

involves the entrances to the vent pipes, which

lead to the pressure suppression pool as

illustrated in Figure 4.7-1. As shown in Figure

4.7-5, the lower lip of the vent pipe shielded

opening is located on the sloping drywell wall a

short distance (about 0.61 m [2 ft.]) above the

floor. At Peach Bottom, one of these vent pipes

lies directly opposite the pedestal doorway.

This is not the case at Browns Ferry, where this

doorway faces a portion of the drywell wall

midway between two of the vent pipe entrances.

4.7.2 Characteristics of Debris Pours From

Vessel

Before undertaking to address debris flow

through the pedestal doorway and spreading in

the expedestal region, it is necessary to first

select appropriate representative debris

releases (rates, quantities, compositions, and

temperatures) from the reactor vessel. Since

the ultimate purpose of this selection process is

for use in exploring means for mitigation, it is

reasonable to exclude accident scenarios

involving high-pressure melt ejection, for

which failure of the shell integrity is virtually

certain by means of DCH, liner melt, or

overpressurization. (It is of course a goal of

BWR accident management that high pressure

severe accident sequences not occur. These

have not been analyzed; see discussion in

Section 3.7.2.)

The Mark I liner failure study2,3 recognizes the

existence of major uncertainties in the

calculation of in-vessel core melt progression

and therefore considers two debris pours, each

associated with the predictions of a different

severe accident code. It is important to

recognize that this study is focused upon lowpressure accident sequences and the potential

for “early” containment failure, that is, failure

in conjunction with the initial release from the

reactor vessel, before the aerosols have had

time to settle. The two selected pours, which

are described below, are intended to bound the

spectrum of debris compositions that might

reasonably be expected to be encountered

within the realm of interest.

4.7.2.1 Scenario I: Large Initial Pour 

of Molten Oxides
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-3

The pour that Reference 2 analyzes as Scenario

I derives from calculations performed by the

industry-sponsored MAAP code6

. In-vessel

melt progression resembles the TMI event and

is characterized by holdup of debris in the core

region in the form of a large pool of molten

oxides mixed with superheated metallic

zirconium within a crucible-shaped metallic

supporting crust. Eventually, a large portion of

the molten pool breaks through the metallic

crust, and enters the lower plenum while

pushing the water away. There is little

interaction between the flowing oxides and the

water, or with the lower plenum stainless steel

structures, except to cause immediate

penetration failures. The liquid zirconiumoxide mixture then drains into the containment

over a period of about five minutes.

The Mark I liner failure study2

 employs

probability density functions for the pour

characteristics, but it is appropriate to think of

Scenario I as an initial rapid release of 12.5 m3

(441 ft.3) of 20% zirconium metal in a UO2-

ZrO2 ceramic mixture with negligible (50 K

[90o

F]) superheat. All water then drains from

the vessel, and the subsequent debris release is

relatively very slow, corresponding to the rate at

which the debris remaining within the vessel

melts. Specifically, the study considers an

additional 7.5 m3 (265 ft. 3) of the same debris

composition to be released into the containment

over the next 150 minutes.

4.7.2.2 Scenario II: Metallic Pour

Followed by Release of Oxides

The Scenario II pour considered in Reference 2

derives from predictions of the BWRSAR

code7

, which was sponsored at the time by the

NRC. (Subsequently, many of the BWRSAR

models have been made operational

within MELCOR.) Here the core melt

progression is that described in Sections 3.7.5

and 3.7.6 for the dry case. Basically, debris

relocating into the lower plenum is quenched

by the water there. The remaining water is

boiled away under the impetus of decay

heating and the lower plenum steel structures

are subsumed into the surrounding debris.

Penetration failures occur at a time when only

liquid metals are present as the debris

temperature increases after lower plenum

dryout. Oxide melting (and release) follows

the initial release of metals.

As noted in Section 3.7, detailed analyses15

have indicated that bottom head release

pathways initiated by debris flows internal to

the penetration tubes are much less likely than

previously thought. Instead, the experimental

evidence (See Section 3.5.7) is that vessels

equipped with bottom head penetrations would

fail by flows external to the tubes and within

the expanding vessel through-holes provided

for and surrounding the penetrations. From the

standpoint of debris pour characterization,

however, there is little difference associated

with the details of penetration failure. Thus,

the Scenario II pour remains an appropriate

representation of the debris releases associated

with penetration failure.

For the Mark I liner failure study,2 the Scenario

II probability density functions are such that

the initial pour can be approximated as 14 m3

(494 ft.3) of a mixture of stainless steel with

30% zirconium metal at 100 K (180oF)

superheat. This initial pour, which occurs over

a period of 20 minutes, is followed by a

relatively slow release of 15 m3 (530 ft.3) of

oxides (mixed with 15% zirconium metal) over

a period of 100 minutes.

4.7.2.3 Accident Scenarios Not

Represented
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-4

As mentioned previously, the Mark I liner

failure study does not consider high-pressure

accident sequences. Neither does it directly

address accident sequences in which penetration

failures are assumed not to occur. Debris pours

are based upon decay heat rates prior to any

increases due to power uprates.

Completion of the Mark I liner failure study

involved a process by which a preliminary

analysis was performed and subjected to

extensive peer review. This first step is

documented in Reference 2. Additional

analyses were then performed to address the

concerns identified by the peer review. This

second round of analyses and the final

conclusions of the study are documented in

Reference 3.

One of the concerns addressed in the second

round of analyses has to do with the amount of

metals that might be mixed with the oxides in

the Scenario I release. This is an important

question because the magnitude of the material

superheat that is carried with the spreading

debris is paramount to the fate of the wall after

contact. (Debris liquids have a higher effective

conductivity for heat transfer into the wall

surface.) Specifically, it was proposed that

upward radiation from the molten pool held in

the core region might induce melting of the

upper reactor vessel internal structures so that

the molten liquids, when released into the lower

plenum, would include a large quantity of

stainless steel. Dedicated calculations with the

APRIL code,8

 however, subsequently showed

that the composition of the Scenario I melt as

originally conceived was indeed bounding for

that scenario.

Although less probable, the accident sequence

without penetration failure would produce a

much larger included metals superheat than is

represented by the Scenario I release. With the

reactor vessel depressurized, creep rupture of

the vessel wall would not occur until the wall

was heated to near the carbon steel melting

temperature. At this time, much of the central

region of the lower plenum debris bed would

be occupied by a slurry of solid oxides and

superheated metals. But, if penetration failures

did not occur and the bottom head failed by

creep rupture, how would the contents of the

lower plenum be released to the drywell?

It is, of course, unknown how the separation of

the portion of the bottom head below the

support skirt from the remainder of the vessel

would progress. Would there be a complete

break, or would one side of the bottom head

sag? The available experimental evidence as

obtained for the PWR bottom head

configuration is discussed in Section 3.5.7, but

BWR structure has important differences.

BWR vessels have a support skirt and, as

shown in the lower part of Figure 3.7-7, there

is a control rod drive housing support structure

about 1 m (3 ft.) beneath the vessel that might

interrupt the downward movement of the

dislocated portion of the vessel bottom head.

It is pointed out in Reference 2 that much of

the lower plenum content could still be

contained within the bottom head after its

initial rupture, and that “Pending quantification

of the merits of this new type of scenario,

quantification of it is left for future study.” 

4.7.3 Debris Spreading Across The Drywell

Floor

As described in the previous section,

distinction between the two considered

scenarios is that Scenario I involves a mostly

oxidic melt with a high initial release rate

whereas Scenario II involves an initially
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-5

metallic melt with a relatively low release rate.

The total release quantity for Scenario II is

about twice that for Scenario I.

As considered in Reference 2, debris falling

from the reactor vessel would first fill the

drywell sumps, then would spill over the

pedestal region floor. As sufficient height is

accumulated over the floor, flow would begin

through the pedestal doorway. Initial spreading

as the flow enters the expedestal region would

be slight, but after contact with the drywell wall,

the flow would separate into two branches, each

flowing along the wall in a nearly onedimensional fashion. These two branches then

meet at a position diametrically opposite to the

doorway.

During the spreading process, the flowing

debris radiates to the overlying atmosphere (or

water) and transfers heat to and ablates the

underlying concrete. Gases released from the

concrete promote oxidation of the metals carried

with the debris, and the associated energy

release serves to increase the debris

temperature. The purpose of the spreading

calculations described in Reference 2 is to

determine the parameters important to the

question of survivability of the drywell wall.

These are the depth of the debris immediately

adjacent to the wall, the initial superheat of this

debris, and the length of time that superheat is

maintained.

For the second round of analysis, the peer

review process recommended that the adequacy

of the approach employed in the preparation of

Reference 2 be checked by the application of

other available analytical tools, specifically the

MELTSPREAD9

 and CORCON10 codes. The

MELTSPREAD code provides a mechanistic

treatment of the basic processes involved in the

spreading of debris over a steel or concrete

substrate, including gravity-driven flow, melt

freezing, immobilization and heatup, concrete

decomposition and gas release, chemical

oxidation of melt metallic constituents,

enhancement of heat transfer by any overlying

water, and spreading of new melt release over

previously spread material. The CORCON

code, which provides detailed modeling of

core-concrete interaction phenomena, was

invoked specifically to confirm the duration of

superheat in the debris. 

As described in Reference 3, the results of the

independent MELTSPREAD and CORCON

analyses support the contention that for the

pours considered in Reference 2, the depth of

debris at the wall, the initial superheat, and the

duration of superheat employed for the shell

failure analysis are appropriately conservative.

In other words, the values used in

considerations of heat transfer to the shell

(discussed in the next section) are higher than

those that would be produced in a best-estimate

analysis.

4.7.4 Thermal Loading of the Shell

For the initial phase of the Mark I liner failure

study, as documented in Reference 2, it was

assumed that wall failure would occur if the

local temperature reached 1773 K (2732 o

F),

which is tantamount to failure by melting.

During the subsequent peer review, it was

recognized that the drywell shell as installed at

Peach Bottom and most other BWR Mark I

facilities is susceptible to failure by creep

rupture, which would occur at a much lower

temperature .

The Peach Bottom drywell shell is encased in

concrete below the level of the drywell floor.

Above the floor, there is a 5.1 cm (2 in.) air

gap between the outer surface of the shell and
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-6

the surrounding concrete. Between these two

regions, there is a sand-filled transition zone,

which is intended to transmit any seismic loads

from the primary containment evenly into the

supporting concrete foundation. The

arrangement of the shell, surrounding concrete,

and sand-filled transition zone at the level of the

floor is plant specific. At Peach Bottom, the

shell is 3.2 cm (1.250 in.) thick and the top of

the sand transition zone is at the level of the

floor. (At Browns Ferry, the shell thickness is

2.9 cm [1.125 in.], and the sand-filled transition

zone extends more than 10 cm [4 in.] above the

floor level.)

The surface of the transition zone constrains the

portion of the spherical shell just above it from

moving radially outward against the

surrounding concrete. Thus, the shell is subject

to temperature-induced creep rupture at the

locations where it would be heated by adjoining

debris. 

In response to the concern identified by the peer

review in regard to the assumed shell failure

criteria, the ANATECH Research Corporation

was assigned to carry out a three-dimensional,

finite element, structural analysis of the Mark I

shell in localized contact with debris, the results

of which are documented in Part V of Reference

3. The debris, which is of composition (oxidic)

and depth (20 cm [8 in.]) corresponding to

Scenario I, was assumed to be covered with

water. Containment pressure was represented

as remaining constant at 0.2 MPa (29 psia).

Creep rupture was predicted to fail the shell at

1533 K (2300 o

F), which is about 240 K (430 o

F) lower than the carbon steel melting

temperature. This temperature of 1533 K (2300

o

F) was then adopted by the Mark I failure study

for use as the best-estimate failure temperature

for the drywell shell. 

4.7.5 Mitigative Effects of Water

As described in Section 4.7.3, the most

important parameters determining the amount

of energy that would be transferred to the shell

from the adjacent debris are the debris depth,

the initial debris superheat, and the time

duration that the debris remained superheated.

If a significant quantity of water overlies the

drywell floor at the time of initial debris

release, then all three of these parameters

would be affected favorably, from the

standpoint of promoting the survival of the

shell. 

The depth of debris adjacent to the wall would

be reduced, because more of the debris would

freeze within the pedestal region, and less

would reach the shell.

The largest beneficial effect would be in

reducing the amount of superheat carried to the

wall. Although the effectiveness of overlying

water in cooling crusted debris is not well

understood, insulating crusts would develop

only after the superheat is lost. Since heat loss

mechanisms to water from a superheated

corium melt are straightforward and the

associated heat transfer is large, it is pointed

out in Reference 3 that the effectiveness of

water in reducing superheat is not a matter of

controversy.

With respect to the duration of superheat in the

debris at the wall, the overlying water would

play an important role by removing heat from

the wetted shell just above the debris. In

effect, the portion of the shell that is in contact

with water above the debris acts as an efficient

cooling fin. A cooling pathway is established

from the debris into the shell and up through

the fin to the overlying water. This accelerates

the elimination of the debris superheat.
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-7

One cannot selectively consider only the

benefits of the presence of water, however.

Before recommending that provision be made to

supply water to the Mark I drywell floor under

severe accident conditions, it is first necessary

to consider the potential for and effects of steam

explosions. For the Mark I liner failure study,

this consideration is given in Appendix A “The

Occurrence and Role of Steam Explosions in a

Mark-I Containment” to Part I of Reference 3.

There it is argued that integrity-threatening

steam explosions over the surface or at the

leading edge of the spreading debris can be

ruled out, and that in fact, small-scale steam

explosions (fuel-coolant interactions) at these

locations would be beneficial from the

standpoint of promoting quenching. On the

other hand, it is noted that there is a concern

with respect to the potential for energetic steam

explosions induced by the debris pouring within

the pedestal region.

Appendix A to Reference 3 Part I also notes that

the occurrence of an energetic steam explosion

within the pedestal region would offer much

more of a threat to the reactor pedestal than to

the drywell shell. However, the argument is

made that with a limited depth of water (about

30 cm [1 ft.]), an impulse to the pedestal of the

magnitude necessary to cause failure cannot be

delivered. (Note that the actual depth can vary

from plant to plant.)

It is not yet possible to make definitive

resolution as to whether or not it is worth

risking the destructive potential of steam

explosions in order to reap the beneficial

aspects of water on the drywell floor.

Phenomena associated with the introduction of

corium into water have been studied in the

series of experiments discussed in Section

3.7.6.1. At the very least, it can be concluded

that energetic explosions with the oxidic

components of core debris are very hard to

generate.

4.7.6 Potential for Mark I Containment

Failure

The Mark I liner failure study has considered

the case of debris release via penetration

failures from a depressurized Peach Bottom

reactor vessel. The study concludes that there

is a “virtual certainty” of shell failure if the

containment floor is dry at the time of initial

release, but that early shell failure is

“physically unreasonable” if the drywell is

flooded with water to the lower lip of the vent

pipe openings, a depth of about 61 cm (2 ft.).

For its consideration of this issue, the Advisory

Committee on Reactor Safeguards (ACRS) has

stated that “Results of the severe accident

research have shown that there is no threat of

prompt containment failure posed by ... Mark

I liner meltthrough. Research should continue

to: ... determine the impact of ex-vessel steam

explosions on the BWR containments.”11 

Apparently this statement is intended to

include only cases with water overlying the

drywell floor. What about the high-pressure

case? The ACRS goes on to state “Additional

assessment of DCH is needed for ... BWRs.”

Thus, it seems that the concern with respect to

shell failure that might be caused by highpressure melt ejection is effectively subsumed

into the larger direct containment heating issue.

The reason that the presence of water to the

level of the vent openings is considered to

reliably preclude only “early” or “prompt”

failure of the shell has to do with the formation

of solid-base islands of quenched metallic

debris in conjunction with the initial release.

These could then serve as underwater
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-8

causeways for transport of subsequent molten

releases from the reactor vessel toward the

drywell shell. If debris liquids can reach the

shell at locations above the water surface, then

the situation reverts to the dry case, for which

shell failure is probable.

The current situation with respect to the Mark I

liner failure analyses based on the Peach

Bottom facility is summarized in Table 4.7-1.

As indicated, high pressure cases and accident

sequences involving creep rupture of the reactor

vessel bottom head have not been analyzed. For

the cases that have been studied, extension of

the existing results to other Mark I facilities is

discussed in the remainder of this section.

4.7.6.1 Extension to Other BWR Facilities

As is the case for all other aspects of severe

accident research, plant-specific design features

play an important role and must be taken into

consideration when considering extrapolation of

the Mark I study results, based on Peach

Bottom, to other BWR facilities. To provide a

feel for the extent of the design variations, there

are seven different sizes of reactor vessels in

U.S. Mark I containments, ranging from Duane

Arnold (183 in. ID) to Peach Bottom (251 in.

ID). At Duane Arnold, the radius to the shell at

the level of the drywell floor is 6.34 m (20.8 ft.),

as compared to 6.96 m (22.85 ft.) at Peach

Bottom. On the other hand, the potential debris

source is smaller at Duane Arnold, where the

core comprises just 368 fuel assemblies, as

opposed to the 764 assemblies at Peach Bottom.

One of the most important geometric parameters

with respect to the shell failure issue is the

height of the vent line entrance above the

drywell floor. This height determines the

maximum depth of water over the floor and,

should debris enter a vent pipe, local failure

would be virtually certain. As discussed in

Part I of Reference 3, the location of the vent

line openings is plant specific, but in general

the shorter heights are associated with the

facilities that have the smaller cores and hence

the smaller potential debris pours.

Review by the NRC and its contractors12,13 of

the Individual Plant Examinations (IPEs)

submitted by the various BWR facilities has

confirmed the importance of the Mark I shell

failure issue as previously identified in

NUREG-1150. In fact, “Liner meltthrough

was found to be the most important contributor

to early containment failure for Mark I

containments.”12 The IPEs also reveal,

however, that in some Mark I containments,

the sump and floor configuration is such as to

automatically preclude shell failure.

Specifically, the sumps at Monticello are large

enough to contain all of the debris release from

the vessel. At Oyster Creek, a concrete curb

serves to prevent the debris from reaching the

drywell shell.12

4.7.6.2 Drywell Flooding Capabilities

If the drywell floor is to be reliably flooded

under severe accident conditions, then the

necessary water would have to be capable of

delivery into the containment in case of station

blackout. The general concept is to vent the

containment to permit use of low-pressure

pumps and to inject the water via the existing

drywell spray headers. To address station

blackout concerns, it would be necessary to

invoke new or upgraded independently

powered pumping systems.

Going one step further, relatively minor

modifications beyond the need for an

independently powered dedicated pumping

system might be employed to permit rapid
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-9

filling of the wetwell, flooding of the vent pipes,

and increase of the water level within the

drywell to a height sufficient to cover the

reactor vessel bottom head. If drywell flooding

to this level could be achieved quickly enough,

then the water in the drywell could provide two

lines of defense against containment failure:

first by serving to keep the debris within the

reactor vessel as described in Section 3.7.7.3,

and second by extending upward the protection

of the drywell shell.

Provision of the necessary volume of water

would require the availability of an independent

containment flooding system of sufficient

capacity to cover the reactor vessel bottom head

before lower plenum dryout and the associated

threat of penetration failures. This would in

general require equipment modifications to

existing plants, but similar modifications are

required for flooding to protect the shell. In

both cases, the drywell would have to be vented

during the flooding process and beyond. The

only additional requirement for the

independently powered pumping systems

necessary to deal with station blackout would be

to increase their capacity. For two feet of water,

86 m3

 (22,800 gal.) would be required. Making

allowance for the trapping of a portion of the

containment atmosphere in the upper wetwell as

indicated in Figure 4.7-6, about 5700 m3

(1,500,000 gal.) would have to be added to the

Peach Bottom containment in order to submerge

the reactor vessel bottom head.

Detailed information concerning the prospects

for a containment flooding strategy intended to

maintaining the core debris within the reactor

vessel is available in Reference 14. The BWR

severe accident sequence leading most rapidly

to the formation of a reactor vessel lower

plenum debris bed is short-term station

blackout, for which the vessel bottom head

would have to be submerged in no more than

150 min. (2.5 hours) after the onset of core

degradation. For Peach Bottom, this is

equivalent to a required pumping capacity of

0.63 m3

/s (10,000 gal./min.). 
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-10

Table 4.7-1 Mark I Liner Qualitative Failure Probabilities for

Various Vessel Debris Release Modes
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-11

Figure 4.7-1 The BWR Mark I containment design employs a small

primary containment with a pressure suppression pool;

secondary containment is provided by the surrounding

structure
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-12

Figure 4.7-2 The Mark I drywell floor area is small and the drywell shell is

within ten feet of the pedestal doorway
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-13

Figure 4.7-3 Core debris released from the reactor vessel would spread

over the BWR Mark I drywell floor, including the ex-pedestal

region.
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-14

Figure 4.7-4 Interior of reactor pedestal at Peach Bottom with partial view

of doorway.
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-15

Figure 4.7-5 Shield over vent pipe entrance at Peach Bottom
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-16

Figure 4.7-6 Approximately 5700 m3 (1.5x106) gallons would be required to

cover the reactor vessel bottom head at the largest (1100MWe)

BWR facilities
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-17

References for Section 4.7

1. G. A. Greene, K. R. Perkins, and S. A.

Hodge, “Mark I Containment Drywell,

Impact of Core/Concrete Interactions on

Containment Integrity and Failure of the

Drywell Liner,” Source Term

Evaluation for Accident Conditions,

paper IAEA, Vienna, Austria, October

1985.

2. T. G. Theofanous et al., “The

Probability of Liner Failure in a Mark-I

Containment,’ NUREG/CR-5423,

Center for Risk Studies and Safety,

University of California, August 1991.

3. T. G. Theofanous, et al., “The

Probability of Mark-I Containment

Failure by Melt-Attack of the Liner,”

NUREG/CR-6025, University of

California, Rensselaer Polytechnic

Institute, Sandia National Laboratories,

Argonne National Laboratory,

ANATECH, Inc., November 1993.

4. D. A. Brinson and G. H. Graves,

“Evaluation of Seals for Mechanical

Penetrations of Containment Buildings,”

NUREG/CR-5096, SAND88-7016,

Sandia National Laboratories, August

1988.

5. General Electric Company, “BWR

Owner’s Group Emergency Procedure

Guidelines,” Revision 4, NEDO-31331,

March 1987.

6. R. E. Henry, et al., “Experiments

Relating to Drywell Shell-Core Debris

Interactions,” Proceedings of the

Sixteenth Water Reactor Safety

Information Meeting, NUREG/CP-0097,

Vol. 5, pp. 317-339, Fauske and

Associates, October 1988.

7. S. A. Hodge and L. J. Ott, “BWRSAR

Calculations of Reactor Vessel Debris

Pours for Peach Bottom Short-Term

Station Blackout,” Proceedings of the

Sixteenth Water Reactor Safety

Information Meeting, NUREG/CP-0097,

Vol. 5, pp. 377-401, Oak Ridge National

Laboratory, October 1988.

8. S. H. Kim, et al., “The Development of

APRIL.MOD2 - A Computer Code for

Core Meltdown Accident Analysis of

Boiling Water Nuclear Reactors,”

NUREG/CR-5157, Rensselaer

Polytechnic Institute, 1988.

9. M. T. Farmer, J. J. Sienicki, and B. W.

Spencer, “The MELTSPREAD-1

Computer Code for the Analysis of

Transient Spreading in Containments,”

Sixth Proceedings of Nuclear Thermal

Hydraulics, 1990 ANS Winter Meeting,

November, 1990, p. 21, Argonne

National Laboratory, 1990.

10. J. F. Muir et al., “CORCON-MOD 1:

An Improved Model for MoltenCore/Concrete Interactions,”

NUREG/CR-2142, SAND80-2415,

Sandia National Laboratories, July

1981.

11. Letter from the Advisory Committee on

Reactor Safeguards to The Honorable

Shirley Ann Jackson, Chairman, U. S.

Nuclear Regulatory Commission,
Reactor Safety Course (R-800) 4.7 BWR Mark I Liner Failure By Melt

USNRC Technical Training Center NUREG/CR-6042 Rev. 2 4.7-18

“Severe Accident Research,” June

28, 1996.

12. C. C. Lin, J. R. Lehner, W. T. Pratt, and

M. Drouin, “Severe Accident

Progression Perspectives for Mark I

Containments Based on the IPE

Results,” Proceedings of the TwentyThird Water Reactor Safety Information

Meeting, NUREG/CP-0149, Vol. 2, pp.

463-472, Brookhaven National

Laboratory and U.S. Nuclear Regulatory

Commission, October 1995.

13. W. T. Pratt, John Lehner, A. Camp, and

E. Chow, “IPE Results as Compared

with NUREG-1150,” Proceedings of the

Twenty-Third Water Reactor Safety

Information Meeting, NUREG/CP-0149,

Vol. 2, pp. 485-504, Brookhaven

National Laboratory, Sandia National

Laboratories, and U.S. Nuclear

Regulatory Commission, October 1995.

14. S. A. Hodge, J. C. Cleveland, T. S.

Kress, and M. Petek, “Identification and

Assessment of BWR In-Vessel

Strategies,” NUREG/CR-5869,

ORNL/TM-12080, Oak Ridge National

Laboratory, October 1992.

15. J. L. Rempe et al., “Light Water Reactor

Lower Head Failure Analysis.”

NUREG/CR-5642, EGG-2618, Idaho

National Engineering Laboratory,

October 1993.
Reactor Safety Course (R-800) 5 Offsite Accident Impacts

USNRC Technical Training Center 5.0-1 NUREG/CR-6042 Rev. 2

5.0 Offsite Accident Impacts

5.0.1 Introduction

Modules 1 through 4 emphasize the

importance of the defense-in-depth

philosophy for preventing severe accidents

or containing radionuclide releases given

such accidents. This module carries the

defense-in-depth philosophy one step further.

It discusses radionuclide releases that,

however unlikely, could occur; the radiation

doses and associated health effects that

could result; actions that can be taken to

protect the public; and the U.S. emergency

planning process for implementing such

protective actions.

5.0.2 Learning Objectives for Module 5

After completing this module, the student

should be able to:

1. Describe the location in the plant of

radioactive material that could

potentially cause offsite injuries or

fatalities and the extent of plant damage

required for its release.

2. Describe the characteristics of the

radioactive source term that have an

important effect on offsite doses and the

plant design features that could have a

major impact on such characteristics.

3. Explain the impact of wind speed,

stability class, radioactive decay,

ground deposition, and rainfall on the

rate of decrease in offsite dose versus

distance.

4. Characterize our current ability to

accurately project source term

characteristics and offsite doses that

could result from a severe core-damage

accident.

5. Describe the roles and efficacy of

evacuation, sheltering, ad hoc

respiratory protection, and

administration of stable iodine in

protecting the public from potential

nuclear power plant releases of

radioactive materials.

6. Describe the Chernobyl source term and

the actions taken to protect the public

from this source term. Compare these

with the current LWR source terms and

NRC guidance on protective actions.

7. Indicate the primary responsibilities of

the licensee, state and local agencies,

and the NRC during a nuclear power

plant emergency.

8. Describe plume exposure Emergency

Planning Zone and the ingestion

pathway Emergency Planning Zone.

9. Explain what Emergency Action Levels

(EALs) are.

10. List the four classes of emergencies in

order of increasing severity and indicate

which require official notification and

which require offsite protective actions.

11. Describe the functions of the Technical

Support Center (TSC) and the

Emergency Operations Facility (EOF)

during a nuclear power plant

emergency.
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-1 NUREG/CR-6042 Rev. 2

5.1 Source Terms

As indicated in Modules 3 and 4, if the

energy contained in the core of a nuclear

power plant is not controlled, considerable

damage can be done to the fuel, cladding,

reactor vessel, and even the containment--the

plant barriers that normally contain the core

radionuclides. Even if the reactor is shut

down, the substantial energy generated by

the decay of fission products (decay heat)

can lead to damage to these barriers. If

sufficient quantities of radionuclides are

released to the environment as a result of

such damage, offsite health effects may

result. This subsection discusses the

quantities and characteristics of radionuclide

releases to the environment (source terms).

Transport of the released radionuclides in

the environment and associated offsite doses

and health effects are discussed in Section

5.2.

5.1.1 Radionuclide Inventories

The conventional unit that is used to

quantify the radioactivity of a material is the

curie (Ci). One curie of material undergoes

radioactive decay at the rate of 3.7x10

10

nuclear disintegrations per second, which is

the radioactivity of one gram of pure radium.

The corresponding Standard International

(SI) unit of radioactivity is the becquerel

(Bq). One becquerel is one nuclear

disintegration per second, so 1 Ci = 3.7x10

10

Bq.

Table 5.1-1 shows the principal components

of the 5 billion or so curies of radioactive

materials in the core of a 3300 MWt light

water reactor 30 min after shutdown

according to their relative volatilities.

1,2 Of

the groups listed, radionuclides of the noble

gases krypton (Kr) and xenon (Xe) are the

most volatile and, consequently, the most

likely to be released from the plant to the

environment during an accident. Up to

100% of the noble gases could be released in

severe accidents involving containment

failure or bypass. Radioactive iodine and

cesium, which rank second in volatility,

could also be released in substantial

quantities. Radioiodine can concentrate in

the thyroid. As a result, small quantities of

radioiodine can cause damage to the thyroid

gland. Long-lived radioactive cesium is a

potential source of long-term offsite dose

(e.g. from Chernobyl).

Table 5.1-2 shows radionuclide inventories

of the volatile noble gases and iodine in

various plant systems.

2 Note that the vast

majority of this volatile radioactive material

is contained in the core. All other reactor

systems contain less than one-half of 1% of

the xenon, krypton, and iodine activity in the

core. Because radioactive cesium is longlived, the spent fuel pool can contain more

than the core; however, the driving force

(decay heat) for release is much larger in the

core.

5.1.2 Source Term Characteristics

Radionuclides would be released to the

environment as gases such as krypton(Kr),

xenon (Xe), and iodine (I2

); aerosol particles

of water soluble substances such as cesium

iodide (CsI), cesium hydroxide (CsOH), and

strontium hydroxide (Sr(OH)2); or slightly

soluble oxides of tellurium (Te), ruthenium

(Ru), and lanthanum (La). Generally, a

major release (source term) from a nuclear

power plant can be viewed as a cloud (called

the plume) of radioactive gases, aerosol

particles, and water vapor (mist). As

indicated in Figure 5.1-1, the plume could be

released continuously over a long time

period, or it could be released as a very

short puff. It could be released at ground

level or higher.

Source terms are characterized by the

fractions of the core inventory of
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-2 NUREG/CR-6042 Rev. 2

radionuclides that are released to the

environment and other attributes that can

have an important effect on offsite doses and

the numbers and types of offsite health

effects. Such attributes include the start

time and duration of the release, the size

distribution of the aerosols released, the

elevation of the release, and the energy

released with the radioactive material. For

example, if the plume is hot, rise due to

buoyancy may loft the plume over people

living near the plant thereby limiting the

doses they receive. Also, if the release is

slow (takes a long time), shifts in wind

direction may cause more people to be

exposed but may also cause the exposure to

any stationary group to be reduced. Such

effects are discussed further in Section 5.2.

The isotopic composition of a source term is

important because it determines decay rates

and thus radiation exposure rates. Rapidly

decaying (halflives under a minute) nuclides

deliver most of their dose quickly at short

distances from their release point.

Conversely, slowly decaying nuclides may

deliver dose over many years out to great

distances from their release point. The

chemical and physical form of the released

radioactive materials also influences offsite

doses. For example, if only noble gases are

released, deposition on the ground and

incorporation into the food chain does not

take place thereby eliminating several

important long-term exposure pathways.

Conversely, if the released radioactive

material is all in the form of water insoluble

particles too large to be respirable, lung

exposure due to inhalation does not occur.

5.1.3 Magnitude of Release Required to

Cause Offsite Health Effects

It is not obvious from examining the values

of a source term's characteristics what the

potential health impact would be to the

public. It is, however, easy to demonstrate

that the release of only a relatively small

fraction of the core inventory to the

environment could be significant. Table 5.1-

3 shows that, under certain meteorological

conditions, a prompt release of only 10

6 Ci

of noble gases or 600 Ci of halogens could,

based on current federal guidelines

(discussed in Appendix 5A), result in doses

sufficient to warrant taking actions to protect

persons within a mile of the plant. Doses at

least ten times higher than federal protective

action guides would be required to induce

early injuries or fatalities. For example,

under the same poor meteorological

conditions assumed above, Table 5.1-3

indicates that a release of 10

7 Ci of noble

gases or 2.4x10

4 Ci of halogens could result

in doses exceeding the thresholds for acute,

radiation-induced injuries.

As indicated in Section 5.1.1, only the core,

the spent-fuel storage pool, and the reactor

coolant contain more than 10

6 Ci of noble

gases or 6x10

2 Ci of halogens. Accidents

not involving one of these three regions

(e.g., gas-decay tank rupture) would not,

therefore, result in doses requiring offsite

protective actions. It should be emphasized,

however, that one cannot project offsite

doses and health effects based solely on the

Curies of radionuclides released. For

example, as indicated in Table 5.1-3, the

average annual release of noble gases for a

LWR is 1000 Ci, but this release occurs

gradually during all kinds of weather

conditions. It therefore results in very low

offsite doses.

Figure 5.1-2 compares the average annual

releases of noble gases and iodine from U.S.

plants to the estimated releases that occurred

as a result of the TMI-2 and Chernobyl

accidents. Clearly the uncontained

Chernobyl release, which is discussed in

Section 5.1.7, was large by any measure.

The TMI-2 release, much of which occurred

during controlled venting of the containment,
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-3 NUREG/CR-6042 Rev. 2

wa s v e r y mo d e st i n comp a ris o n .

Nevertheless, as discussed in Sections 5.3.7

and 5.4, current guidelines would call for a

precautionary evacuation for an accident like

that at TMI-2.

Only the reactor core contains sufficient

radioactive material and energy (e.g., decay

heat) to result in source terms capable of

causing offsite injuries and/or fatalities. In

addition to core damage, an accident

resulting in offsite injuries and/or fatalities

would require a direct pathway to the

atmosphere and a driving force (e.g., steam).

The radioactive material released from the

core would have to move through the reactor

coolant system and containment without

being significantly filtered or removed by

other methods such as containment sprays,

ice condensers, fan coolers, or suppression

pools. Even if such engineered safety

features failed, over time natural removal

processes (e.g., gravitational settling) would

remove most particulate fission products

from the atmosphere of an intact

containment. Therefore, if the containment

holds for several hours and the containment

sprays or other removal systems work, early

injuries or fatalities would be unlikely.

Figure 5.1-3 uses an event tree to display the

potential public health consequences due to

core-damage accidents. Moving from left to

right in the figure, yes/no answers to

questions at the top result in a series of

branches, possibly to offsite consequences.

For example, if only the radioactive material

contained in the fuel pins (gaps) is released

with late containment failure, the offsite

consequences would be small (branch 7). If

all answers are yes, extremely severe offsite

consequences are possible (branch 1). As

Figure 5.1-3 indicates, offsite health effects

are likely only if core melting and

containment failure (or bypass) occur. The

implications of this observation in deciding

when to initiate offsite protective actions are

discussed in Section 5.3.7 and 5.4.

5.1.4 Design Features That Impact

Source Terms

In Module 4, performance of the

containment was described with respect to

the timing of containment failure and the

magnitude of resulting leakage to the

environment. Environmental source terms

are, however, affected by more than just the

mode and timing of containment failure.

The following paragraphs describe the effect

of different safety systems and plant features

on the magnitude of source terms. A

common measure of the capability of a

system or feature to remove radioactive

aerosols or vapors in the decontamination

factor (DF), which is the ratio of the inlet

concentration to the outlet concentrations.

Table 5.1-4 provides a summary of the more

significant DFs associated with the features

that are discussed.

5.1.4.1 Suppression Pools

BWR suppression pools can be very

e ff e c tive in s c rubbing (r emov i n g)

radionuclides that accompany steam and

noncondensible gases bubbling up through

the pool. The pool water retains soluble

vapors and aerosols but provides little

attenuation of noble gas fission products.

Although Regulatory Guide 1.3 suggests not

allowing credit for fission product scrubbing

by BWR suppression pools,

3 Standard

Review Plan Section 6.5.5 was revised to

allow such credit.

4 The Reactor Safety

Study assumed a DF of 100 for sub-cooled

pools and 1.0 for saturated pools.

5 NUREG1150 cal cul a tions ba s ed on mor e

s o p h i s t i c a t e d m o d e l s i n d i c a t e

decontamination factors ranging from 1.2 to

4000 with a median value of about 80.

6
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-4 NUREG/CR-6042 Rev. 2

Some of the most important radionuclides,

such as isotopes of iodine and cesium, and

tellurium, are primarily released from fuel

while it is still in the reactor vessel.

Risk-dominant accident sequences in BWRs

are typically initiated by transients rather

than pipe breaks. In transients, the in-vessel

release is directed to the suppression pool

rather than being released to the drywell. As

a result, the in-vessel release is subjected to

scrubbing in the suppression pool, even if

containment failure has already occurred.

Because the early health effects are often

caused by early releases of volatile

radioactive materials, the suppression pool is

one of the reasons the likelihood of early

fatalities is low for the BWR designs

analyzed in NUREG-1150.

If not bypassed, the suppression pools can

also be effective in scrubbing ex-vessel

releases. Suppression pool bypass places an

upper limit on the suppression pool

decontamination factor. For example, if as

little as 1% of the flow bypasses the

suppression pool, the effective DF factor

must be less than 100.

Experiments have shown that solution pH is

a major factor in determining the amount of

molecular iodine (I2

) and organic iodine

found in solution. Unless chemical additives

are introduced to control it, the pH tends to

be reduced by long-term radiolysis. This

favors the recombination of I

-

ions to form

I2. Increasing pool temperatures and

especially pool boiling can, in turn, cause I2

to move from the liquid to the vapor phase.

7

Hence, it is possible that suppression pools

would scrub substantial amounts of iodine in

the early phases of an accident, only to

re-evolve it later as I2

. In NUREG-1150,

such re-evolution of iodine was judged to be

important in accident sequences where the

containment failed and the suppression pool

eventually boiled.

There is presently no requirement for pH

control in BWR suppression pools. It may

well be that additional materials likely to be

in the suppression pool as a result of a

severe accident (such as cesium borate,

cesium hydroxide, and core-concrete

decomposition products) would counteract

any reduction in pH from radiolysis and

would ensure that the pH level remained

sufficiently high to preclude re-evolution of

iodine. If credit is to be given for long-term

retention of iodine in the suppression pool,

maintenance of the pH at or above a level of

7 must be demonstrated.

8

5.1.4.2 Drywell-Wetwell Configuration

Depending on the timing and location of

containment failure, the suppression pool

may also be effective in scrubbing the

release occurring during core-concrete attack

or re-evolved from the reactor coolant

system after vessel failure. In the NUREG1150 analyses for Peach Bottom (Mark I

containment), containment failure was found

likely to occur in the drywell early in the

accident. Thus, in many scenarios the

suppression pool was not effective in

mitigating the delayed release of radioactive

material.

The Mark III design has the advantage,

relative to the Mark I and Mark II designs,

that the wetwell boundary completely

encloses the drywell, in effect providing a

double barrier to radioactive material

release. As long as the drywell remains

intact, any release of radioactive material

from the fuel is subject to decontamination

by the suppression pool. With the Mark III

drywell intact, the environmental source

terms is reduced to a level at which early

fatalities would not be expected to occur,

even for early failure of the outer

containment. However, for Grand Gulf

(Mark III containment), drywell failure

accompanies approximately one-half of the
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-5 NUREG/CR-6042 Rev. 2

early containment failures in NUREG-1150,

and the suppression pool is ineffective in

mitigating ex-vessel releases for such

scenarios.

5.1.4.3 Containment Sprays

Containment sprays can be effective in

reducing airborne concentrations of

radioactive aerosols and vapors. In the

Surry (subatmospheric) and Zion (large dry)

designs, approximately 20% of the NUREG1150 core meltdown sequences were

predicted to eventually result in delayed

containment failure or basemat meltthrough.

The effect of sprays, in those scenarios in

which they are operational for an extended

time, is to reduce the concentration of

radioactive aerosols airborne in the

containment to negligible levels in

comparison with non-aerosol radionuclides

(e.g., noble gases). Qualified sprays can

reduce airborne aerosol activities by an order

of magnitude in 15 to 20 minutes. For

shorter periods of operation, sprays would be

less effective but could still have a

substantial mitigative effect on the release.

Without sprays, an order of magnitude

reduction in airborne aerosol activities would

typically take about 10 hours.

The Sequoyah (ice condenser) design has

containment sprays for the purpose of

condensing steam that might bypass the ice

bed, as well as for use after the ice has

melted. The effects of the sprays and ice

beds in removing radioactive material are

not completely independent since they both

tend to preferentially remove larger aerosols.

5.1.4.4 Ice Condenser

The ice beds in an ice condenser

containment remove radioactive material

from the air by processes that are very

similar to those in the BWR pressuresuppression pools. The decontamination

factor is very sensitive to the volume

fraction of steam in the flowing gas, which

in turn depends on whether the air-return

fans are operational. For a typical case

when the air-return fans are on, the

magnitude of the decontamination factors

was assessed to be in the range from 1.2 to

20, with a median value of 3. Thus, the

effectiveness of the ice bed in mitigating the

release of radioactive material is likely to be

substantially less than for a BWR

suppression pool.

5.1.4.5 Reactor Cavity Flooding

The configuration of a PWR reactor cavity

or BWR pedestal region affects the

likelihood of water accumulation and water

depth below the reactor vessel. In some

PWRs, water reaching the containment floor

does not flow into the reactor cavity, and

unless the spray system is operating, the

cavity will be dry at vessel failure. In the

Peach Bottom (Mark I) design, there is a

maximum water depth of approximately 2

feet on the pedestal and drywell floor before

water would overflow into the suppression

pool via the downcomer. Other designs

investigated such as Sequoyah and Zion have

substantially greater potential for water

accumulation in the pedestal or cavity

region. In the Sequoyah design, the water

depth could be as much as 40 feet.

If a coolable debris bed is formed in the

cavity or pedestal, and makeup water is

continuously supplied, core-concrete release

of radioactive material would be avoided.

Even if molten core-concrete interaction

occurs, a continuous overlaying pool of

water can substantially reduce the release of

radioactive material to the containment in

the same way suppression pools mitigate

releases.
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-6 NUREG/CR-6042 Rev. 2

5.1.4.6 Building Retention

In NUREG-1150, radionuclide retention was

evaluated for the Peach Bottom reactor

building. (An evaluation was not made for

the portion of the reactor building that

surrounds the Grand Gulf containment,

which was assessed to have little potential

for retention.) The range of aerosol

decontamination factors for the Peach

Bottom reactor building subsequent to

drywell rupture was 1.1 to 80, with a median

value of 2.6. The location of drywell failure

affects the potential for reactor building

decontamination. Leakage past the drywell

head to the refueling building was assumed

to result in very little decontamination.

Failure of the drywell by meltthrough

resulted in a release that was subjected to a

decontamination factor of 1.3 to 90 with a

median value of 4.

In the NUREG-1150 analyses of PWR

interfacing LOCA sequences, some retention

of radionuclides was assumed in the

auxiliary building (in addition to water pool

decontamination for submerged releases). In

the Sequoyah analyses, retention was

enhanced by the actuation of the fire spray

system.

5.1.4.7 BWR Containment Venting

In the Peach Bottom and Grand Gulf

designs, procedures have been implemented

to intentionally vent the containment to

avoid overpressure failure. By venting from

the wetwell air space (in Peach Bottom) and

from the containment (in Grand Gulf)

assurance is provided that, subsequent to

core damage, the release of radionuclides

through the vent line will have been

subjected to decontamination by the

suppression pool.

As discussed in Module 4, containment

venting to the outside can substantially

improve the likelihood of recovery from a

loss of decay heat removal and, as a result,

reduce the frequency of severe accidents.

The results of NUREG-1150 indicate,

however, only limit ed benefits in

consequence mitigation for the existing

v e n ti n g p r oc edur e s and ha rdwa r e .

Uncertainties regarding the decontamination

factor for the suppression pool and the

re-evolution of iodine from the suppression

pool are quite broad. As a result, the

consequences of a vented release are not

necessarily minor. Furthermore, the

effectiveness of venting may, for some

plants, be limited by the high likelihood of

early containment failure mechanisms that

would bypass the vent.

5.1.5 Source Term Uncertainty

Clearly, the magnitude of the source term

varies depending on whether or not

containment fails, when it fails, where and

how it fails, and the effectiveness of

engineered safety features in mitigating the

release. However, even if details regarding

the nature of containment failure and

engineered safety feature performance are

known, the uncertainty in predicting severe

accident phenomena is still large.

A major shortcoming of the 1975 Reactor

Safety Study was its limited treatment of the

uncertainties in severe accident source terms.

In the intervening years, particularly

subsequent to the Three Mile Island

accident, major experimental and code

development efforts have broadly explored

severe accident behavior. In the

comprehensive NUREG-1150 study, which

was published in 1989, care was taken to

assess and display the uncertainties

associated with the analysis of accident

source terms. Many of the severe accident

issues that are now recognized as the

greatest sources of uncertainty were
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-7 NUREG/CR-6042 Rev. 2

completely unknown to the earlier Reactor

Safety Study analysts.

In the 1975 Reactor Safety Study, source

terms were developed for nine release

categories ("PWR1" to "PWR9") for the

Surry plant and five release categories for

the Peach Bottom plant ("BWR1" to

"BWR5"). In NUREG-1150, source terms

were developed for a much larger number of

accident progression bins. For each accident

progression bin, an estimate of the

uncertainty in the release fractions for each

of the elemental groups was obtained.

Figure 5.1-4 provides a comparison of an

important large release category (PWR2)

from the Reactor Safety Study with a

comparable aggregation of accident

progression bins (early containment failure,

high reactor coolant system pressure) from

the NUREG-1150. The Reactor Safety Study

results in this case are clearly conservative

when compared to the NUREG-1150 results.

Figure 5.1-5 compares results for an

isolation failure in the wetwell region from

the Reactor Safety Study, release category

BWR4, with the venting accident progression

bin from NUREG-1150. The Reactor Safety

Study results are very similar to the mean

release terms for the venting bin, with the

exception of the iodine group, which is

higher because of the late release

mechanisms (re-evolution from the

suppression pool and the reactor vessel)

considered in the NUREG-1150 study.

Overall, the comparisons indicate that the

source terms in the Reactor Safety Study are

in some instances higher and in other

instances lower than those in NUREG-1150.

However, for the early containment failure

scenarios that have the greatest impact on

risk, the Reactor Safety Study source terms

are larger than the mean values of the

NUREG-1150 study and are typically at the

upper bound of the uncertainty range.

5.1.6 Revised LWR Source Term

In 1962, (see Sections 1.2.6 and 2.1.2) the

Atomic Energy Commission issued Technical

information document TID-14844,

9 which

postulated a release of fission products from

the reactor vessel into containment to be

used for calculating offsite doses in

accordance with the reactor siting criteria of

10 CFR Part 100. The TID-14844 release

was based on a postulated core melt accident

and the 1962 understanding of fission

product behavior. In addition to evaluations

of site suitability and plant mitigation

features such as containment sprays and

filtration systems, the TID-14844 release has

i n fl u e n c e d p o st- a c c i d e n t r a d i a ti o n

environments for which safety-related

components are qualified, post-accident

habitability requirements for the control

room, post-accident sampling systems, and

post-accident accessibility considerations.

For currently licensed pl ants, the

characteristics of the fission product release

from the core into the containment were

derived from TID-14844 as set forth in

Regulatory Guides 1.3 and 1.4.

3,10 The

release consists of 100% of the core

inventory of noble gases and 50% of the

iodines (half of which are assumed to

deposit on interior surfaces very rapidly).

These values were based largely on

experiments performed in the late 1950s

involving heated irradiated UO2 pellets. The

TID-14844 release also includes 1% of the

remaining solid fission products, but these

were dropped from consideration in

Regulatory Guides 1.3 and 1.4. A 1%

release of solid fission products is

considered in certain areas such as

equipment qualification.

In Regulatory Guides 1.3 and 1.4, the release

to containment is assumed to occur

instantaneously (with the initial blowdown of

the reactor vessel in a LOCA). Further, the
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-8 NUREG/CR-6042 Rev. 2

iodine chemical form is assumed to be 91%

elemental (I2), 5% particulate, and 4%

organic. Organic iodine is not readily

removed by containment sprays or filter

systems. These assumptions have

significantly affected the design of

engineering safety features, particularly

containment isolation valve closure times

Recently, the NRC developed revised

accident source terms based on careful

evaluation of NUREG-1150 accident

scenarios and associated source term

estimates. This evaluation is documented in

NUREG/CR-5747,

11

and the resulting revised

source terms are published in NUREG-1465.

8

NUREG-1465 source terms were developed

for regulatory application to future LWRs

but may also be used to evaluate changes to

regulatory requirements for existing plants.

Tables 5.1-5 and 5.1-6 present the NUREG1465 release fractions, which are intended to

be representative or typical (rather than

conservative or bounding) values, except for

the initial appearance of fission products

from the failed fuel. This so-called gap

release is set by the design basis initiator

that leads to earliest cladding failure.

In contrast to the instantaneous releases

postulated in Regulatory Guides 1.3 and 1.4,

the NUREG-1465 releases are distributed in

time to reflect the degree of fuel melting and

relocation, reactor pressure vessel integrity,

and, as applicable, attack upon concrete

below the reactor cavity by molten core

materials. The timing aspects are typical of

a low pressure core-melt scenario, except

that the onset of the release of gap activity is

based upon the earliest calculated time of

fuel rod failure under accident conditions.

NUREG-1465 also considers the chemical

form of iodine in the containment and

concludes that no more than 3% of the

airborne iodine would be converted to

organic form. When pH is controlled at

values of 7 or greater within the

containment, elemental iodine is assumed to

comprise no more than 5% of the total

iodine released to containment, and organic

iodine no more than 0.15 percent (3 percent

of 5 percent).

5.1.7 The Chernobyl Source Term

The initial release of radioactive materials

from Chernobyl 4 reactor resulted from the

explosions that destroyed the reactor core on

April 26, 1986. Releases continued over a

relatively long period of time and occurred

in several stages, each of which differed in

radionuclide composition and intensity.

Figure 5.1-6 shows the estimated timedependance of the release for the first 10

days following the accident when a stream of

hot air carried particulates, noble gases and

volatile radionuclides from the destroyed

reactor up to the atmosphere

12

.

From April 26 until May 1 the release rate

decreased, perhaps under the influence of

the measures undertaken to extinguish the

burning graphite and cover the core,

although there is no consensus on this point.

During this stage the release consisted of

finely dispersed fuel particles entrained by

the escaping hot air and graphite combustion

products. The radionuclide composition

during this stage was similar to that of the

fuel.

From May 1 through May 5, there was a

rapid increase in the release rate, at first

dominated by volatile radionuclides

(especially iodine isotopes), after which the

composition again became similar to that of

the fuel. The release during this stage was

attributed to heating of the fuel to over

2000

oC from the residual heat. The released

radionuclides were associated with aerosols

of fuel and graphite combustion products.
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-9 NUREG/CR-6042 Rev. 2

On May 6, there was an abrupt decrease in

the release rate perhaps due to chemical

interactions of the radionuclides with the

materials introduced into the core. A

complete explanation of the sudden decrease

is not available. Measurable releases of

activity continued during the remainder of

May. For example, there was a significant

peak 20 to 21 days after the beginning of the

accident, and a less pronounced peak in the

25- to 30-day period.

13

Table 5.1-7 summarizes the quantitative

estimates of the magnitude of the releases

from the Chernobyl-4 reactor. Based on

various data, including measurements of

Cs-137 in fuel masses inside the reactor

sarcophagus and in the global fallout, the

total core cesium released to the

environment is estimated to be 33%±10%, or

2.3±0.7 MCi.

14 The relative constancy of the

ratio of I-131 and Cs-137 activities in fallout

observed in the majority of European

countries indicates that 50% to 60% of the

initial I-131 inventory or 40 to 50 MCi of

I-131 was released. Accounting for

radioactive decay in the reactor in the period

of the release, this corresponds to a total

activity of 30 to 35 MCi released into the

atmosphere. The ratio of Iodine-131

released as gases to that released as aerosols

was approximately 3:7 over the first two

weeks after the accident, but, by the third

week, the ratio changed to approximately

10:1.

13

Comparing the Chernobyl release fractions in

Table 5.1-7 with the revised LWR source

terms in Tables 5.1-5 and 5.1-6 shows the

volatile release fractions (noble gases,

iodine, and cesium) are similar in magnitude.

On the other hand, releases of nonvolatile

species at Chernobyl resulted from the initial

explosions and the ensuing fires. The

amount of fuel released is estimated to be

3.5%±0.5% of the fuel inventory in the

core.

12,14 This far exceeds the NUREG-1465

release fractions for nonvolatile species. It

should also be emphasized that the NUREG1465 releases are to the containment, not

directly to the atmosphere as occurred at

Chernobyl.

5.1.8 On-Line Source Term Monitoring

As indicated in Section 5.1.5, it is not

possible to predict with certainty the source

term that would result from a given plant

damage state. What, then, is the feasibility

of on-line monitoring to measure source term

characteristics during an accident?

For accidents where the total release is

through a monitored pathway (e.g., the

stack), it may be possible to adequately

characterize the release. As part of the

upgrades that followed the TMI-2 accident,

on-line radiation monitors capable of

measuring the noble gases released through

plant vents were installed. Noble gases are

not considered as great a threat to the public

as the halogens and other chemical groups

listed in Table 5.1-1. The presence of

halogens and other chemical groups must, in

general, be determined through analysis of

s ampl es t aken during the releas e.

Unfortunately, this can require several hours.

Nevertheless, at a minimum, the magnitude

of a stack release can generally be estimated

if the monitors stay on scale.

By their very nature, however, releases

resulting in offsite dose high enough to

cause early health effects most likely could

not be characterized by existing effluent

monitors. A release resulting in early offsite

health effects (death and injuries) would

have to be fast, direct, and unfiltered. Most

important are potential releases due to major

containment failure. As illustrated in Figure

5.1-7, such a release would be through an

unmonitored path to the atmosphere.

Effluent-monitoring systems located in

routinely monitored release paths (e.g.,
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-10 NUREG/CR-6042 Rev. 2

stacks) would not be able to assess the

extent and the characteristics of such a

release.
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-11 NUREG/CR-6042 Rev. 2

Table 5.1-1 Radioactive materials in a large [3300-MWt]

light water reactor core grouped by relative

volatility

Group Isotope Half-life Core Inventory (Ci) Group Total (Ci)

Kr-85 10.72 y 6.69E+05

Noble Gases Kr-85m 4.48 h 3.13E+07 3.84E+08

Kr-87 1.27 h 5.72E+07

Kr-88 2.54 h 7.74E+07

Xe-133 5.245 d 1.83E+08

Xe-135 9.09 h 3.44E+07

I-131 8.04 d 8.66E+07

Halogens I-132 2.30 h 1.28E+08 7.71E+08

I-133 20.8 h 1.83E+08

I-134 52.6 m 2.01E+08

I-135 6.61 h 1.73E+08

Cs-134 2.062 y 1.17E+07

Alkali Metals Cs-136 13.16 d 3.56E+06 2.18E+07

Cs-137 30.17 y 6.53E+06

Rb-86 18.66 d 5.10E+04

Sb-127 3.85 d 7.53E+06

Tellerium Group Sb-129 4.40 h 2.67E+07 2.13E+08

Te-127 9.35 h 7.28E+06

Te-127m 109 d 9.63E+05

Te-129 1.16 h 2.50E+07

Te-129m 33.6 d 6.60E+06

Te-131m 30 h 1.26E+07

Te-132 3.26 d 1.26E+08

Ba-139 1.396 h 1.70E+08

Barium, Strontium Ba-140 12.746 d 1.68E+08 6.95E+08

Sr-89 50.52 d 9.70E+07

Sr-90 29.1 y 5.24E+06

Sr-91 9.5 h 1.25E+08

Sr-92 2.71 h 1.30E+08

Co-58 70.88 d 8.71E+05

Noble Metals Co-60 5.271 d 6.66E+05 5.94E+08

Mo-99 2.7476 d 1.65E+08

Rh-105 35.4 h 5.53E+07

Ru-103 39.27 d 1.23E+08

Ru-105 4.44 h 7.98E+07

Ru-106 1.02 y 2.79E+07

Tc-99m 6.01 h 1.42E+08

Am-241 432.7 y 3.13E+03

Lanthanides Cm-242 162.8 d 1.20E+06 1.54E+09

Cm-244 18.1 y 7.02E+04

La-140 1.678 d 1.72E+08

La-141 3.90 h 1.57E+08

La-142 1.54 h 1.52E+08

Nb-95 34.97 d 1.41E+08

Nd-147 10.98 d 6.52E+07

Pr-143 13.57 d 1.46E+08

Y-90 2.67 d 5.62E+06

Y-91 58.5 d 1.18E+08

Y-92 3.54 d 1.30E+08

Y-93 10.2 h 1.47E+08

Zr-95 64.02 d 1.49E+08

Zr-97 16.8 h 1.56E+08

Ce-141 32.50 d 1.53E+08

Cerium Group Ce-143 1.38 d 1.48E+08 2.15E+09

Ce-144 284.6 d 9.20E+07

Np-239 2.355 d 1.75E+09

Pu-238 87.7 y 9.90E+04

Pu-239 24100 y 2.23E+04

Pu-240 6560 y 2.82E+04

Pu-241 14.4 y 4.74E+06
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-12 NUREG/CR-6042 Rev. 2

Table 5.1-2 Typical inventories of noble gases and iodine in reactor

systems

Location

Inventory (Ci)

Noble gases (Xe,

Kr)

Iodine (I)

Reactor core total 4.0E+8 7.5E+8

Reactor core gap

a

3.0E+7 1.4E+7

Spent fuel storage pool 1.0E+6 5.0E+5

b

Primary coolant

c

1.0E+4 6.0E+2

c

Pressurized Water Reactor--other

systems

Waste gas storage tank 1.0E+5 1

Boiling Water Reactor--other systems

Steam line

Waste gas treatment system

1.0E+4

d

5.0E+3

25

d

0.25

Shipping cask 1.0E+4 1

aGap between UO2

fuel and Zircaloy cladding.

bOne-third of the core is 30 days old; the rest is 1 year old.

cNominal value, iodine levels can much higher or lower (factor of 10) depending on fuel

leakage.

dCi/hr (circulating).
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-13 NUREG/CR-6042 Rev. 2

Table 5.1-3 Illustrative noble gas and halogen releases

Activity

Released

(Ci)

Fraction of

3000 MWt Core

Inventory

a

Noble Gases (Krypton and Xenon)

Average annual release for a LWR

b

1x10

3

3x10

-6

Prompt release resulting in 5 rem

committed stomach dose equivalent

c

to

unprotected individual one mile

downwind under poor meteorological

conditions

d

1x10

6

3x10

-2

Prompt release resulting in 50 rem

acute stomach dose

e

to unprotected

individual one mile downwind under

poor meteorological conditions.

d

1x10

7

3x10

-2

Halogens (Iodine)

Average annual release for a LWR

b

0.13 1x10

-10

Prompt release resulting in 5 rem acute

thyroid dose

c

to unprotected infant one

mile downwind under poor

meteorological conditions

d

6x10

2

1x10

-6

Prompt release resulting in 200 rem

thyroid dose

f

to unprotected infant one

mile downwind under poor

meteorological conditions

d

2.4x10

4

3x10

-5

aSee Table 5.1-1

bPredominately I-131

cThe smallest dose for which evacuation would be considered based of Environmental Protection Agency protective

action guides discussed in Appendix 5A

dGround level, non-buoyant release, stability class F, 1 m/s wind speed, calculations using USNRC MACCS 1.5.11.1

computer code

eThreshold for radiation-induced prodromal vomiting

fThreshold for radiation-induced thyroiditis
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-14 NUREG/CR-6042 Rev. 2

Table 5.1-4 Decontamination factors associated with various design

features

Design Feature Decontamination Factor

Containment Sprays 10 for aerosols in 10-20 minutes versus

10 for aerosols in 10 hours without

sprays

Ice Condensers 1.2 to 20 while ice is present

Reactor building surrounding a BWR

Mark I containment

1.1 to 80

Suppression pools and overlying water

layers

2 to 4000 before re-evolution
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-15 NUREG/CR-6042 Rev. 2

Table 5.1-5 NUREG-1465 BWR releases into containments

*

Gap

** Early InVessel

Ex-Vessel Late InVessel

Duration (Hours) 0.5 1.5 3.0 10.0

Noble Gases: Xe, Kr 0.05 0.95 0 0

Halogens: I, Br 0.05 0.25 0.30 0.01

Alkali Metals: Cs, Rb 0.05 0.20 0.35 0.01

Tellurium group: Te, Sb, Se 0 0.05 0.25 0.005

Barium, strontium: Ba, Sr 0 0.02 0.1 0

Noble Metals:

Ru, Rh, Pd, Mo, Tc, Co

0 0.0025 0.0025 0

Lanthanides: La, Zr, Nd, Eu,N

b, Pm, Pr, Sm, Y, Cm, Am

0 0.0002 0.005 0

Cerium Group: Ce, Pu, Np 0 0.0005 0.005 0

* Values shown are fractions of core inventory.

** Gap release is 3 percent if long-term fuel cooling is maintained.

Table 5.1-6 NUREG-1465 PWR releases into containments

*

Gap

** Early InVessel

Ex-Vessel Late InVessel

Duration (Hours) 0.5 1.3 2.0 10.0

Noble Gases: Xe, Kr 0.05 0.95 0 0

Halogens: I, Br 0.05 0.35 0.25 0.01

Alkali Metals: Cs, Rb 0.05 0.25 0.35 0.01

Tellurium group: Te, Sb, Se 0 0.05 0.25 0.005

Barium, strontium: Ba, Sr 0 0.02 0.1 0

Noble Metals:

Ru, Rh, Pd, Mo, Tc, Co

0 0.0025 0.0025 0

Lanthanides: La, Zr, Nd, Eu,N

b, Pm, Pr, Sm, Y, Cm, Am

0 0.0002 0.005 0

Cerium Group: Ce, Pu, Np 0 0.0005 0.005 0

* Values shown are fractions of core inventory.

** Gap release is 3 percent if long-term fuel cooling is maintained.
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-16 NUREG/CR-6042 Rev. 2

Table 5.1-7 Estimated releases from Chernobyl-4 accident

14

Noble Gases 100% 190±20 MCi

131

I 55±5% 45±5 MCi

137Cs 33%±10% 2.3±0.7 MCi

90Sr,90Y 4% 2.8±0.8 MCi

Fuel 3.5±0.5%
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-17 NUREG/CR-6042 Rev. 2

Figure 5.1-1 Examples of plume types
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-18 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-19 NUREG/CR-6042 Rev. 2

Figure 5.1-3 Event tree for severe accident consequences
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-20 NUREG/CR-6042 Rev. 2

Figure 5.1-4 Comparison of NUREG-1150 source terms with Reactor

Safety

Study (Surry) bin PWR2
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-21 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-22 NUREG/CR-6042 Rev. 2

Figure 5.1-6 Release of radionuclides during the active stage of the

Chernobyl accident

1
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-23 NUREG/CR-6042 Rev. 2
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-24 NUREG/CR-6042 Rev. 2

References for Section 5.1

1. D. J. Alpert, et al., “Relative Importance

of Individual Elements to Reactor

Accident Consequences Assuming Equal

Release Fractions,” NUREG/CR-4467,

SAND85-2575, March 1986.

2. T. J. McKenna, et al., “Pilot Program:

NRC Severe Reactor Accident Incident

Response Training Manual, Vol. 2,

Severe Reactor Accident Overview,”

NUREG-1210, February 1987.

3. U.S. Nuclear Regulatory Commission,

“Assumptions Used for Evaluating the

Potential Radiological Consequences of

a Loss of Coolant Accident for Boiling

Water Reactors,” Regulatory Guide 1.3,

Revision 2, June 1974.

4. U.S. Nuclear Regulatory Commission,

“Pressure Suppression Pool as a Fission

Product Cleanup System,” Standard

Review Plan, Section 6.5.5, NUREG0800, December 1988.

5. U.S. Nuclear Regulatory Commission,

“Reactor Safety Study: An Assessment

of Accident Risks in U.S. Commercial

Nuclear Power Plants,” WASH-1400,

NUREG-75/014, December 1975.

6. U.S. Nuclear Regulatory Commission,

“Severe Accident Risks: An Assessment

for Five U.S. Nuclear Power Plants,”

NUREG-1150, December 1990.

7. E.C. Beahm, C.F. Weber, and T.S.

Kress, “Iodine Chemical Forms in LWR

Severe Accidents,” NUREG/CR-5732,

ORNL/TM-11861, prepared for NRC by

Oak Ridge National Laboratory, April

1992.

8. L. Soffer, S. B. Burson, C. M. Ferrell,

R. Y. Lee, and J. N. Ridgely,

“Ac c i d e n t S o u r c e Te rms f o r

Light-Water Nuclear Power Plants,”

NUREG-1465, February 1995.

9. J. J. DiNunno, et al., "Calculation of

Distance Factors for Power and Test

Reactor Sites," Technical Information

Document (TID)-14844, U.S. Atomic

Energy Commission, 1962.

10. U.S Nuclear Regulatory Commission,

"Assumptions Used for Evaluating the

Potential Radiological Consequences

of a Loss of Coolant Accident for

P r e ss u ri z e d Wa t e r Re a c t o rs, "

Regulatory Guide 1.4, Revision 2,

June 1974.

11. H. P. Nourbakhsh, "Estimates of

Radionuclide Release Characteristics

into Containment Under Severe

Accidents," NUREG/CR-5747 (BNLNUREG-52289, Brookhaven National

Laboratory, November 1993.

12. USSR State Committee on the

Utilization of Atomic Energy. The

accident at Chernobyl and its

consequences. Summary report on the

post-accident review meeting on the

Chernobyl a c c ident. Vi enna:

International Atomic Energy Agency,

IAEA Safety Series N 75-INSAG-1;

1986.

13. Yu. P. Buzulukov and Yu. L.

Dobrynin, "Release of Radionuclides

During the Chernobyl Accident," in

The Chernobyl Papers, Volume I,

Doses to the Soviet Population and

Early Health Effects Studies, Steven
Reactor Safety Course (R-800) 5.1 Source Terms

USNRC Technical Training Center 5.1-25 NUREG/CR-6042 Rev. 2

E. Merwin and Michail I. Balonav

editors, Re s e a r c h Ent e rpris e s,

Richland, Washington, 1993.

14. S. T. Belyaev, A. A. Borovoy, and V.

F. Demin, et al., “The Chernobyl

Source Term, In: Proceedings of a

seminar on comparative assessment of

the en v ironmental impac t of

radionuclides released during three

major nuclear accidents, Kyshtym,

Windscale, Chernobyl. Luxembourg:

EUR; Report EUR 13574; 1991: 71-

91.
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-1 NUREG/CR-6042 Rev. 2

5.2 Offsite Dispersion and Doses

In order to assess the consequences of a

severe accident, one must (1) estimate the

source term, (2) characterize the transport of

radionuclides in the environment, and (3)

estimate the resulting doses to the public

(accounting for protective actions that may

be taken). This process is depicted in Figure

5.2-1. Source term estimates are treated in

Section 5.1. This section discusses the

transport of radionuclides in the environment

and the doses that could potentially result

from such transport. Offsite protective

actions that could be taken to reduce doses

to the public are discussed in section 5.3.

5.2.1 Radiation Dose and Health Effects

Radiation exposures can affect the health of

exposed individuals. The type of effect, its

severity, and the length of time until the

effect appears are determined by the total

dose received, the rate of exposure, the

exposed organs, and the degree of medical

treatment received.

Although the curie is an appropriate unit for

quantifying amounts of radioactive materials

(e.g., curies in the core), it is not an

appropriate unit for quantifying the potential

health effects that may result from the

release of radioactive materials to the

environment. The number of curies required

to induce various health effects can vary

considerably, depending on the types of

radiation emitted by the decaying nuclei and

how the radiation enters the body (i.e., the

pathway). The term dose refers to radiation

absorbed by a human body. A unit of dose

is the rad. One rad corresponds to 100 ergs

of energy deposited in a gram of material.

The corresponding SI unit is the Grey (Gy),

and 1 Gy = 100 rads (1 J/kg). A closely

related unit, the rem, is a measure of dose

equivalent in humans. The corresponding SI

unit is the Sievert (Sv), and 1 Sv = 100

rems. The dose to the whole body or to a

particular organ is a measure of potential

biological damage induced by exposure of

the body or organ to radiation.

5.2.1.1 Chronic (Latent) Effects

Small doses or moderately large doses

received at low dose rates (e.g., long term

exposure to low levels of ground

contamination) can cause health effects such

as cancer, which appear later in time and are

not directly observable following the

exposure. Such effects are called chronic

effects.

Traditionally, the risk of cancer has been

assumed to be proportional to dose, no

matter how small. That is, computer models

assume that a collective dose of about 2,000

person-rem (1 rem to 2,000 people, 0.1 rem

to 20,000 people, etc.) will result in one

radiation-induced cancer in the affected

population.

1 This linear, no-threshold

hypothesis is the subject of considerable

debate, with some contending it is too

conservative. Under this hypothesis, because

the release is spread over a larger area and

therefore over a larger population the farther

it moves from the plant, a sizable fraction of

the predicted radiation-induced cancers can

result from very small exposures beyond 50

miles from the plant. This is illustrated in

Figure 5.2-2.

2

5.2.1.2 Acute Health Effects

Large doses received over short time periods

threaten both the short- and long-term health

of exposed individuals. If exposures are

sufficiently intense, exposed organs are

damaged causing radiation sickness or death

within days or months. As a class, such

early health effects are called acute.

Radiation sickness includes vomiting,

diarrhea, loss of hair, nausea, hemorrhaging,

fever, loss of appetite, and general malaise.
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-2 NUREG/CR-6042 Rev. 2

Deaths can be caused by failures of the

lungs, small intestine, or blood-forming bone

marrow. Barring death or complications,

recovery from radiation sickness occurs in a

few weeks to a year depending on the dose

received. Exposed individuals who survive

radiation sickness are still subject to

increased risk of latent effects such as

cancers.

Because damage sufficient to impair organ

functioning does not occur if exposures are

small, short-term health effects usually have

dose thresholds. That is, the effect does not

appear until the dose received is greater than

the threshold dose (Dth). Once the threshold

dose has been exceeded, the fraction of the

exposed population in which the health

effect occurs (the health effect's incidence)

rises rapidly with increasing dose until the

effect appears in all of the exposed

individuals. The dose at which a health

effect is induced in half of the exposed

population is called the D50 dose (LD50

if the

dose is lethal).

Figure 5.2-3 depicts the average dose

equivalents in millirems received from

natural background, common medical

procedures, and frequent human activities.

3

As indicated in the figure, early injuries

generally would appear at doses above 50 to

100 rem to the whole body, and early deaths

would be expected at much higher doses

(e.g., 250 to 600 rem). It has been estimated

that, with only minimal medical treatment,

about 50% of the people who receive a

whole-body dose (LD50

) of 300 rem would

die within 60 days. LD50 has been estimated

to increase to 450 rem with supportive

medical treatment.

4

5.2.2 Dose Pathways

As indicated in Figure 5.2-4, a person can

receive a radiation dose from a plume in

several ways, usually called pathways. First,

dose can be received externally from the

radiation given off by the passing plume or

the ground contamination. Such doses are

called cloud shine and ground shine,

respectively. The dose due to radioactive

particles that settle directly onto the skin or

clothing of persons immersed in the cloud is

called the skin dose. Dose can also be

received by inhaling the radioactive material

in the plume; this is called inhalation dose.

Some of the inhaled material may

concentrate in particular organs such as the

lungs or thyroid and thus become a special

threat to those organs. Cloud shine, ground

shine, and inhalation are collectively

considered parts of the plume exposure

pathway.

Dose can also be received from the ingestion

pathway, that is, from eating or drinking

contaminated food or water. As in the case

of inhaled material, ingested material can

concentrate in various organs. Ingestion of

milk receives special attention because

radioiodine from a plume can contaminate

grass eaten by dairy herds. This radioiodine,

which can be greatly concentrated in the

milk, can then concentrate in the drinker's

thyroid gland.

The actual doses received by individuals

offsite as a result of an accidental release

would depend primarily on three factors:

1. The release (source term) characteristics,

2. the weather during and after

the release, which would

determine the concentrations

of airborne radionuclides and

ground contamination offsite,

and

3. the protective actions taken by

individuals located offsite.
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-3 NUREG/CR-6042 Rev. 2

Source terms are discussed in Section 5.1.

The impact of weather on offsite

consequences is discussed in the following

subsections. The impact of protective

actions on offsite-site health effects is

discussed in Section 5.3. In considering

offsite protective actions against releases

from nuclear power plant accidents, both

acute dose to the bone marrow and thyroid

doses are important. Dose to the bone

marrow (mostly from shine) is a dominant

cause of early deaths for reactor accidents.

Thyroid dose is important because inhalation

or ingestion of small amounts of radioiodine

can result in damage or destruction of the

thyroid. However, unlike bone marrow dose,

dose to the thyroid will not be fatal in the

short term in most cases. There would, of

course, be increased risk of death due to

thyroid cancer.

5.2.3 Meteorology

In the absence of significant heat transfer

with the ground or between adjacent layers

of air, the temperature in a well-mixed

atmosphere decreases linearly with altitude

at a rate of about 5.4

F/1000 ft (1C/100 m).

This is called the adiabatic lapse rate (or

adiabatic temperature distribution) because it

is derived by treating the expansion of air

with altitude as an adiabatic expansion.

5 As

indicated in Figure 5.2-5, other temperature

d istri b u t i o n s s u c h a s is o t h e rma l,

superadiabatic, and inversions may exist

over particular ranges of altitudes. The

actual temperature profile at any time is

determined by a number of factors including

heating and cooling of the earth's surface,

the movements of large air masses (highs

and lows), the existence of cloud cover, and

the presence of large topographical

obstacles. For example, on clear days with

light winds, superadiabatic conditions may

exist in the first few hundred meters of the

atmosphere due to the heat transferred to the

air from the hot surface of the earth.

Conversely, on a cloudless night, when the

earth radiates energy most easily, the earth's

surface may cool down faster than the air

immediately above it, and the result is a

radiation inversion.

The degree to which pollutants are dispersed

in the atmosphere depends to a large extent

on the atmospheric temperature profile.

Consider the case of dispersion in a

superadiabatic atmosphere. If a small parcel

of polluted air is released at some altitude h

and the same temperature T as the

atmosphere, as indicated in Figure 5.2-6a,

the parcel will remain in equilibrium at that

point if not disturbed. Suppose, however,

that a fluctuation in the atmosphere moves

the parcel upward. The parcel will cool

adiabatically as it rises; that is, the

temperature of the parcel will follow the

adiabatic curve shown by the dashed lines in

Figure 5.2-6a. Because the surrounding

superadiabatic atmosphere cools more

rapidly, the parcel becomes increasingly

hotter than the atmosphere. This means the

parcel becomes increasingly buoyant, causing

it to move more rapidly upward. On the

other hand, if the parcel is pushed

downward, its temperature will fall more

rapidly and it will become increasingly more

dense than the surrounding superadiabatic

air. This will accelerate the downward

motion at the parcel. Clearly, the

superadiabatic atmospheric conditions are

inherently unstable and are highly favorable

for dispersing pollutants.

In contrast, if the parcel is released into an

isothermal or inversion profile, as indicated

in Figure 5.2-6b, a fluctuation upward will

make it cooler and hence more dense than

the surrounding atmosphere, tending to

return the parcel to its original position.

Similarly, a downward fluctuation will make

the parcel hotter and more buoyant than the

surrounding air. This will also tend to

return the parcel to its equilibrium point.
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-4 NUREG/CR-6042 Rev. 2

Atmospheres characterized by isothermal or

inversion profiles are therefore said to be

stable. This is undesirable for pollutant

dispersal.

Frequently, the parcel is hotter than its

surroundings when released, and it will

initially rise due to its greater buoyancy.

Various types of dispersal patterns can be

observed depending on the conditions in the

surrounding atmosphere, as illustrated in

Figure 5.2-7. Plumes emitted into an

inversion layer (stable atmosphere) disperse

horizontally much more rapidly than they

disperse vertically (vertical dispersion is

inhibited in an inversion layer). Therefore,

the plume spreads out horizontally but not

vertically, which produces a fan shape when

viewed from below (fanning). If a hot

plume is emitted into an unstable atmosphere

that is capped by an inversion layer, the

plume rises to the inversion layer and then

spreads rapidly downward, fumigating the

ground below (fumigation). Plumes emitted

into an uncapped unstable atmosphere tend

to breakup because vertical displacements of

plume parcels are enhanced (looping).

Plumes emitted into a neutral atmosphere

(lapse rate equal to the adiabatic lapse rate)

are dispersed smoothly both vertically and

horizontally, and therefore have a conical

profile in the crosswind direction (coning).

Plumes emitted into a neutral layer that

overlies an inversion layer can spread

upward but not downward (lofting).

It is possible to estimate the stability

conditions in the lower atmosphere by

simply measuring the temperature at two or

more heights on a meteorological tower.

The slope of the temperature profile can then

be compared by dividing the temperature

difference T by the difference in height z

of the measurements. Alternatively, stability

can be estimated by monitoring fluctuations

(standard deviation 

) in the angle of a

wind vane. Based on experimental data on

atmospheric dispersion, stability regions are

often divided into the seven stability classes

listed in Table 5.2-1

6

depending on the

indicated ranges of T/z or 

.

Other meteorological conditions that can

have a strong impact on atmospheric

dispersion or ground contamination include

wind speed, precipitation and humidity.

Data on these factors are also measured on

the meteorological tower. The significance

of such factors is discussed in the following

section.

5.2.4 Dispersion of Effluents

Plumes disperse as they are transported

downwind, which means that concentrations

of released radionuclides would decrease

with plume travel distance. Because

dispersion causes plume materials (droplets,

particles, gas molecules) to move away from

the plume centerline in a random series of

steps, plume concentrations tend to assume

normal (Gaussian) distributions in both the

vertical and horizontal directions. The rate

of spreading depends on atmospheric

stability and is usually not the same in the

vertical and horizontal directions.

Models of atmospheric dispersion range in

complexity from simple to sophisticated.

Perhaps the simplest model is the straightline Gaussian plume model. As illustrated

in Figure 5.2-8, this model assumes a

constant wind direction and a Gaussianshaped spreading of the plume with distance.

It also assumes a constant wind speed, and it

does not account for the effects of local

topography. According to this model, the

released plume (or puff for a short duration

release) moves downwind at the wind speed

u. The plume spreads in all directions due

to turbulent diffusions as it moves. This

spreading is characterized by empirically

determined standard deviations in vertical

and cross wind pollutant concentrations.
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-5 NUREG/CR-6042 Rev. 2

These standard deviations increase with

downwind distance and atmospheric

instability.

The inhalation and immersion doses that

would be received by an individual standing

in the path of the plume increase with the

magnitude of T, the time-integrated

concentration at the point in question.

According to the straight-line Gaussian

plume model

where

T = i n t e gr a t e d r a d ionuc lide

concentration at point in

question (Ci•s/m

3

)

Q = quantity of radionuclide

released (Ci)

u = wind speed (m/s)

 = Gaussian shape function,

which depends on the

location, the stability class,

and the release height (m

-2

)

Figure 5.2-9 shows the quantity T/Q along

the plume centerline for effluent released at

a height of 100 ft under Pasquill stability

classes B, C, and D for a 6 mile/hr wind.

T/Q is also shown for a 2 mile/hr wind

speed for stability class D. It will be

observed that, at reasonable distances from

the plant, T/Q decreases more or less

exponentially. With the more unstable

conditions (B), the maximum of T

/Q occurs

nearer the release point (within a few

hundred meters), then drops rapidly to very

low values. On the other hand, under more

stable conditions (D), the peak of T

/Q is

located much further from the source.

Concentrations in populated offsite locations

are therefore usually greater under stable

than under unstable conditions and stable

conditions are often assumed in calculations

of the atmospheric dispersion of releases

from nuclear power plants.

The preceding discussion ignored the effects

of radioactive decay and ground deposition

on plume concentrations. Radioactive decay

and deposition, both wet and dry, are each

first order processes (i.e., their rates are

proportional to the local concentration).

Both proc e ss e s c aus e a tmosphe ri c

concentrations to decrease more rapidly with

distance.

Changes in wind speed and atmospheric

stability cause    	



		 	 	 

	    	  
	

    

     	

	   	      

		   	

	     

  	  	

	  
 
  

  	   


 	 
	   
  

    	 	

   	 
 
 

	
 		   	

 	   
  

	  		

	!	  	 



		  	 	

      	

    	   

		 " 
# distributed in

very complex patterns as seen at Chernobyl

(Figure 5.2-10).

7

Wind stagnation causes cloudshine,

inhalation, and skin doses at the stagnation

distance to increase because the exposure

times for these doses all increase. In

addition, prolonged stagnation can produce
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-6 NUREG/CR-6042 Rev. 2

a hot spot on the ground at the stagnation

distance because of the greatly increased

time period during which deposition occurs

at that distance.

5.2.5 Dose Versus Distance

As indicated in Section 5.1.3, releases to the

atmosphere from a very severe reactor

accident involving both core melting and

containment failure could result in offsitesite injuries or fatalities. This section

presents dose versus distance calculations

based on the straight-line Gaussian plume

model for such a release, one resulting from

a Surry (PWR) accident scenario in which

containment fails early (2.5 hours after

scram). The release duration is taken to be

0.5 hour. The release fractions are set at the

median values depicted within the NUREG1150 uncertainty ranges of Figure 5.1-4.

Two radiation-induced injuries with

relatively low thresholds are prodromal

vomiting (threshold stomach dose of ~50

rem) and hypothyroidism (threshold thyroid

dose of ~200 rem). Figure 5.2-11 provides

information regarding the stomach and

thyroid doses versus distance for the

p o st u l a t e d r e l e a s e u n d e r t yp i c a l

meteorological conditions (stability class D,

6 m/s wind speed).

It is evident from Figure 5.1-4 that the

postulated release fractions are neither

optimistic nor pessimistic. Nor are the

postulated meteorological conditions

particularly extreme. Doses resulting from

an actual accident involving both core

melting and containment failure could

therefore be much higher or much lower

depending on the actual source term

characteristics and the weather at the time of

the release.

In calculating the doses presented in Figure

5.2-11, evacuation, sheltering, and other

possible offsite-site protective actions are

not considered, and dose reduction factors

representative of normal indoor activities are

not applied. That is, the doses shown are

for hypothetical persons on the plume

centerline who remain outside during plume

passage for the indicated time intervals

measured from plume arrival.

The top left plot in Figure 5.2-11 shows the

integrated stomach dose at 4 hours,

24-hours, and 7 days following initial

exposure. It is evident that the stomach dose

continues to increase after plume passage.

This is due to continued exposure to

radionuclides deposited on the ground and

f r o m i n h a l a t i o n o f r e s u s p e n d e d

radionuclides. The top right plot shows the

relative contribution of various pathways to

the 24-hour stomach dose as a function of

distance. The cloudshine and groundshine

pathways contribute roughly equally,

whereas the inhalation pathway is

insignificant. The 4-hour stomach dose

exceeds the ~50 rem threshold for

radiation-induced injury to a distance of ~2.5

miles.

From the bottom figures, it can be seen that

projected thyroid doses are dominated by

inhalation doses. The ground and cloud

shine contributions increase the thyroid dose

only marginally within 24 hr. The 4-hr

thyroid dose exceeds the ~200 rem threshold

for radiation-induced hypothyroidism within

about 5.25 miles.

The dose versus distance results clearly

indicate that people close to the plant would

have to take protective actions before or

shortly after the start of the release to avoid

injuries and fatalities. Actions taken after

plume passage would be effective only in

reducing additional dose from ground

contamination. Beyond a certain radius, the

direct dose from the plume (cloudshine and

inhalation) is not sufficient to result in early
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-7 NUREG/CR-6042 Rev. 2

injuries; but if people remain on

contaminated ground, their dose can clearly

increase to the point where injuries or

fatalities become likely. Obviously, after a

major release, areas of substantial ground

contamination must be identified, and the

population must be relocated.

For most LWR release scenarios, the greatest

effluent concentrations occur within the first

2 to 3 miles. Therefore, independent of the

size of the release, the greatest need for

protective actions most likely will be within

2 to 3 miles of the plant. For large releases,

these actions are taken to prevent early

injuries and fatalities. For lesser releases,

they are taken to keep doses below

Environmental Protection Agency protective

action guides, which are discussed in

Appendix 5A.

Another point to be made from Figure 5.2-11

involves the plume exposure emergency

planning zone, which is normally within a 10

mile radius of the plant (see Section 5.4.5.1).

Many think that the public risk stops at the

boundary of the emergency planning zone.

But, it is clear that the postulated release

could result in doses in excess of the

Environmental Protection Agency whole

body (1 to 5 rem) and thyroid (5 to 25 rem)

protective action guides beyond 10 miles.

At these levels, protective actions could be

appropriate beyond the plume emergency

planning zone.

5.2.6 Uncertainties in Dose Projections

In a 1981 study conducted at the Idaho

National Engineering Laboratory, a

nonradioactive tracer (SF6

) was released and

the resulting air concentrations were

compared with predictions made by various

models to evaluate their potential use in

emergency response situations. Figure 5.2-

12 shows the actual air concentration

(plume) pattern observed for one of the tests

and the plume pattern predicted by three of

the models tested under this program: (a) a

simple, straight-line Gaussian plume model

of the type used by many emergency

response organizations, (b) a Gaussian-puff

trajectory model, which accounts for wind

shifts, and (c) a more sophisticated wind

field and topographic model used in the

DOE's Atmospheric Release Advisory

Capability (ARAC) program. Even the most

complicated ARAC model could not

reproduce what actually occurred.

This result points out two concerns. First,

only one meteorological tower is typically in

the site vicinity. The initial transport of

radioactive material from a site after it is

released to the atmosphere will be dominated

by local conditions (e.g., hills, valleys, lakes,

and precipitation). This single source of

weather and wind information cannot give a

definitive indication of winds away from the

plant. Nuclear power plants are typically

located in very complex areas (e.g., in river

valleys or on the coast), where wind

direction and flows can vary considerably

within a short distance of the plant. As an

example, a 180



difference in wind direction

could result from sea breeze effects at a

coastal site. This is the basis for taking

protective actions in all directions near

(within 2 or 3 miles) of the plant. The

events that occurred early in the TMI-2

incident (as discussed in Section 5.3.7),

further illustrate the problems inherent in

taking protective actions only in the

downwind direction.

Second, differences should be expected in

the estimates produced by various analysts.

Various response organizations may be

performing analyses based on different

assumptions. For example, the NRC may be

concentrating on dose projections based on

possible additional plant failures, while the

state is making dose projections based on

estimates of actual releases. As Figure 5.2-
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-8 NUREG/CR-6042 Rev. 2

12 indicates, even if the same input

conditions (e.g., source terms and

meteorology) are used, dose estimates may

differ.

Unanticipated catastrophic containment

failure is an example of a case where source

term could be underestimated by a factor of

100,000. For lesser accidents (non-core

damage) where the total release is through a

monitored pathway and consists mostly of

noble gases, the source term uncertainty can

be reduced. However, the transport and dose

uncertainties would remain. Overall, the

best that should be expected in the early

time frame is that projected dose estimates

may be within a factor of 10 of the true dose

value; more likely, they will be even less

accurate.

It is clear that one should not expect close

agreement when comparing various dose

projections with each other or with early

field monitoring data. Dose projections

should be viewed only as rough estimates.

What may be more important than relying on

a dose model in estimating plume movement

is a knowledge of local meteorological

conditions and trends (e.g., the winds shift

every morning at about 9:00 a.m.).

The basic point here is that the analyst needs

to understand the problem, the models, and

the results. Indiscriminate use of technical

aids such as dose projection models without

access to staff who understand the

unpredictability of local conditions can

provide misleading input to protective action

decision making.

5.2.7 Dispersion of the Chernobyl Release

As shown in Figure 5.2-10, the Chernobyl

nuclear power plant is located between 51

and 52 north latitudes in the Ukraine in the

Kiev region and is only 15 km from the

south border of the Gomel region of Belarus.

The western part of the Bryansk region of

Russia is 150 km from the plant. The region

is relatively flat, and elevations do not

exceed 200 m. The climate is moderate,

with warm summers, mild winters, and an

average precipitation of 20 to 24 inches (500

to 650 mm).

From the time the accident began on April

26, 1986, a stream of hot air carried

radioactive materials from the destroyed

reactor into the atmosphere. Volatile iodine

and cesium radioisotopes were discovered at

heights up to 6 to 9 km. The exposure rate

in the stream at a distance of 5 to 10 km and

a height of 200 m was approximately 1 rad/h

on April 27 and 0.5 rad/h on April 28.

8

When the plume of radioactive material first

rose on April 26, the winds carried it

northwest into Latvia and across the Baltic

Sea into Scandinavia, Lithuania, and

Northern Poland. On the second day, the

winds changed, blowing to the west and

southwest and passing over Southern Poland,

Switzerland, Italy, Austria, Southern

Germany, and France. On the fifth day the

wind changed back to the northwest and the

cloud moved into Central Germany, the

Netherlands, and Great Britain. Eventually,

the winds blew northeast spreading the

fallout into Central Russia. Some

radioactive material road the jet-stream over

the United States and other countries. Trace

levels of I-131 were measured in Japan and

the United States by May 5.

9

In all, more than 20 countries received

fallout from Chernobyl, exposing nearly 400

million people. Deposition patterns were

complex and diverse. They depended on

both particle densities and the weather. The

largest particles, which were primarily fuel

particles, were deposited within 100 km of

the reactor. Both in this near zone and

across the former Soviet Union and Europe,
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-9 NUREG/CR-6042 Rev. 2

levels of contamination depended on whether

it was raining when the cloud passed over.

Outside the former Soviet Union, the Lap

people of northern Sweden were perhaps

hardest hit. Their reindeer herds were so

contaminated they were unfit for human

consumption.

Ukraine, Belarus, and Russia were subjected

t o t h e mo st i n t e n s e r a d i o a c t i v e

contamination (see Figure 5.2-10).

10,11 The

three main regions of contamination have

been designated the Central, Bryansk-Belarus

and Kaluga-Tula-Orel hot spots. The

following information regarding these hot

spots and other contamination is taken from

Reference 12 and summarized in Table

5.2-2.

The central hot spot was formed during the

initial active stage of the release,

predominantly to the west and northwest.

Cs-137 soil surface activities in excess of

1.0 Ci/m

2

covered large areas of the

territory of the Kiev, Zhitomir, Cherrnigov,

Rovno, and Lutsk regions of the Ukraine; as

well as the Gomel and Brest regions of

Belarus. The most highly contaminated area

was the 30-km radius surrounding the

reactor, where Cs-137 surface activities

generally exceeded 40 Ci/m

2

. Outside the

30-km zone, such areas were also present to

the west and northwest of the reactor in the

Gomel, Kiev, and Zhitomir regions. The

initial gamma dose rate (1 m above the

ground) from deposited radionuclides ranged

from 1 to 200 mrad/h. By 1991, these dose

rates had decreased to 0.005 to 1 mrad/h.

The Bryansk-Belarus hot spot, centered 200

km to the north-northeast of Chernobyl, was

formed on April 28-29, 1986 as a result of

rainfall at the interface of the Bryansk region

of Russia and the Gomel and Mogilev

regions of Belarus. The soil surface

activities of Cs-137 in the most highly

contaminated areas in this hot spot were

comparable to the levels in the central hot

spot and exceeded 130 Ci/m

2

in some

villages of the Mogilev region and 110

Ci/m

2

in the village Zaborye of the Bryansk

region. The initial dose rates in air ranged

form 0.3 mrad/hr to 30 mrad/hr. By 1991,

these dose rates had fallen to 0.005 to 0.5

mrad/hr. The Bryansk-Belarus spot was

called a "cesium hot spot" because of the

predominance of long-lived Cs-137.

The Kaluga-Tula-Orel spot in Russia,

centered approximately 500 km northeast of

the reactor, was also a "cesium hot spot." It

was formed from the same radioactive cloud

that produced the Bryansk-Belarus spot, as a

result of rainfall on April 28-29. However,

Cs-137 contamination levels were lower, less

than 0.16 Ci/m

2

. The initial dose rates

over this hot spot ranged from 0.3 to 3.0

mrad/hr. By 1991 these dose rates had

fallen to 0.005 to 0.05 mrem/hr.

Outside the three main hot spots in the

greater part of the European territory of the

former Soviet Union, there were many areas

of radioactive contamination with Cs-137

levels mainly in the range 1 to 5 Ci/m

2

.

Overall, the contaminated land areas of the

former Soviet Union included approximately

3,100 km

2 with >40 Ci/m2 Cs-137,

7,200 km

2 with 16 to 40 Ci/m2 Cs-137,

17,600 km

2 with 5 to 16 Ci/m2 Cs-137,

103,000 km

2 with 1 to 5 Ci/m2 Cs-137.11

The total Cs-137 activity in areas where

Cs-137 levels exceeded 1 Ci/m

2

is

estimated to be approximately 1.0 MCi,

including 0.3 MCi within a radius of 40 km

around the reactor.

10,11 Accounting for the

large area with Cs-137 contamination levels

less than 1.0 Ci/m

2

, the total Cs-137

deposition in the former Soviet Union is

estimated to be 1.3 MCi, 95% of which was

deposited in the European part and 5%

outside this part (east of the Ural mountain

range).
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-10 NUREG/CR-6042 Rev. 2

Most of the Sr-90 released was deposited in

the near zone of the accident. In fact, areas

with Sr-90 surface activity levels on the soil

exceeding 3.0 Ci/m

2 were almost entirely

within the 30-km zone. Areas with Sr-90

levels exceeding 1.0 Ci/m

2 were almost

entirely within the 100-km zone. Only a few

separate sites with Sr-90 levels in the range

1.0 to 3.0 Ci/m

2 were found in the

Bryansk-Belarus hot spot.

Information on areas contaminated with

plutonium isotopes is not extensive because

of the difficulty in detecting these isotopes.

The only hot spot with plutonium (Pu-239

and Pu-240) surface activity on the soil

exceeding 0.1 Ci/m

2 was located

completely within the 30-km zone. In the

regions of the Bryansk-Belarus and KalugaTula-Orel hot spots, plutonium activity

levels ranged from 0.002 to 0.02 Ci/m

2

and

0.002 to 0.008 Ci/m

2

, respectively.

Although Cs-137 and Sr-90 levels were well

correlated in these regions, there was no

apparent correlation between plutonium and

Cs-137 or Sr-90 levels.

5.2.8 Perspective on Dose Projections

In the past, considerable attention has been

given to the use of real-time dose projections

as the primary basis for initiating offsite

protective actions. Section 5.1 highlights

the difficulty of predicting the source term

with sufficient accuracy to justify this use of

real-time dose projections during a severe

accident. This section explains why

significant uncertainties would still be

associated with projecting offsite doses, even

if one could accurately predict the timing,

energetics, composition, and amount of

radioactive material that may be or is being

released from a plant during a severe

accident. As a result, decisions regarding

early protective actions should be based on

plant conditions, which demonstrate the

potential for a large release, not on dose

projections for some assumed source term

and weather. Nevertheless, both precalculated and real-time dose projections in

conjunction with early field monitoring

would play a useful role in responding to a

severe accident.

Precalculated dose projections may be useful

in comparing the consequences of various

plant response options (e.g., venting the

cont a inment ve rsus a llowing l a t e r

containment failure). During the initial

phase of a severe core damage accident,

precalculated and real-time dose projections

would be helpful in establishing priorities

for the use of limited resources in the

implementation of offsite actions such as

deployment of field-monitoring teams. In an

actual uncontrolled release of radioactive

material to the environment, it would be

imperative to obtain offsite monitoring team

data as quickly as possible.

After implementation of protective actions

near the plant (based on an assessment of

plant conditions), dose projections may

assist in determining whether these actions

should be extended. The model projections

may indicate the maximum distance from the

plant where further actions are required.

Another role of dose projections is to

provide feedback regarding the magnitude

and composition of a release based on the

analysis of offsite samples and field

monitoring results.
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-11 NUREG/CR-6042 Rev. 2

Table 5.2-1 Relationship between Pasquill category and T/z and 

*

Pasquill category T/z (

C/100 m) 

(degrees)

A - Extremely unstable T/z -1.9   22.5

B - Moderately

unstable

-1.9 < T/z -1.7 22.5 >   17.5

C - Slightly unstable -1.7 < T/z -1.5 17.5 >   12.5

D - neutral -1.5 < T/z -0.5 12.5 >   7.5

E - Slightly stable -0.5 < T/z 1.5 7.5 >   3.8

F - Moderately stable 1.5 < T/z 4.0 3.8 >   2.1

G - Extremely stable 4.0 < T/z 2.1 > 

$

%
  &  '()*+,	  -

'./0

Table 5.2-2 Characteristic of hot spots r esulting fr om Chernobyl

accident

*

 +
 1 	

-2')3 +

+	 4	

"-5


(

#



1  

"
5#

'..' "6 #

1  

"
5#

- 2,  7 80 '  (00 0006  '

929 -

: (00 
 ,2

,;

7 ')0 0)  )0 00006 

06

<2=2

> 

-

: 600 
 ,;

? 0'@ 0)  ) 00006 

006

$

%
 	 '(
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-12 NUREG/CR-6042 Rev. 2

Figure 5.2-1 Steps in projecting offsite

consequences

500 Mile Radius

800,000 Square Miles

20,000,000 Person Rems

10,000 Cancers

50 Mile Radius

8,000 Square Miles

3,000,000 Person Rems

1500 Cancers
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-13 NUREG/CR-6042 Rev. 2

 	

 

       

    
 Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-14 NUREG/CR-6042 Rev. 2

Figur e 5.2-3a Putting radiation in perspective for the public (mr em)
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-15 NUREG/CR-6042 Rev. 2

Figure 5.2-3b Putting radiation in perspective for the public (mrem)
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-16 NUREG/CR-6042 Rev. 2

Figure 5.2-4 Radiation dose pathways

Superadiabatic

Inversions

Isothermal

Adiabatic

Earth's surface

Altitu

d

e

Temperature

Fig

ure 5.2-5 Examples of low-level temperatur e distribution in the

atmospher e
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-17 NUREG/CR-6042 Rev. 2

Figure 5.2-6 Movement of a parcel of air in (a) a superadiabatic profile and

(b) an inversion profile
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-18 NUREG/CR-6042 Rev. 2

Figure 5.2-7 Various types of smoke plume patterns
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-19 NUREG/CR-6042 Rev. 2

Figure 5.2-8 Relationship between actual plume and model projections
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-20 NUREG/CR-6042 Rev. 2

Figure 5.2-9 The quantity T/Q at ground level for effluents emmitted at a

height of 30 m, as a function of distance from the source
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-21 NUREG/CR-6042 Rev. 2

Figure 5.2-10 Radiation hot spots resulting from Chernobyl nuclear power

plant accident
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-22 NUREG/CR-6042 Rev. 2

Figure 5.2-11c Thyroid dose by exposure time: no sheltering, stability

class D, 2.68 m/s wind

0.1

1

10

100

1000

10000

1 10 100 1000

Distance (miles)

Dose (rem)

4-hour

24-hour

7-day

Figure 5.2-11d Plume centerline thyroid dose by exposure pathway,

no sheltering, 24-hour exposure, class D, 2.68 m/s

0.1

1

10

100

1000

10000

1 10 100 1000

Distance (miles)

Dose (rem)

Cloudshine

Groundshine

Inhalation

Figure 5.2-11a Stomach dose by exposure time: no sheltering,

stability class D, 2.68 m/s wind

0.01

0.1

1

10

100

1000

1 10 100 1000

Distance (miles)

Dose (rem)

4-hour

24-hour

7-day

Figure5.2-11b Plumecenterlinestomachdosebypathway: no

sheltering, 24-hour exposure, classD, 2.68m/swind

0.01

0.1

1

10

100

1000

1 10 100 1000

Distance(miles)

Dose (rem)

Cloudshine

Groundshine

Inhalation
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-23 NUREG/CR-6042 Rev. 2

Figure 5.2-12 One-hour surface doses predicted by (a) Gaussian plume

model, (b) puff-trajectory model, (c) complex numerical

model, and (d) doses actually observed
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-24 NUREG/CR-6042 Rev. 2

Refer ences for Section 5.2

1. S. Abrahamson, B.B. Boecker, E.S.

Gilbert, and B.R. Scott, “Health

Effects Models for Nuclear Power

Plant Accident Consequence Analysis,

Modifications of Models Resulting

from Recent Reports on Health Effects

of Ionizing Radiation, Low LET

Radiation, Part II: Scientific Bases for

Health Effects Models,” NUREG/CR4214, Rev. 1, Part II Addendum 1,

LMF-132, August 1991.

2. NUREG-1150, Table 11.7, Plant 3,

exceedance frequency 10

-6

yr

-1

, mean

complementary cumulative distribution

function (CCDF), adjusted to one

cancer per 2000 person-rem, June

1989.

3. U.S. Nuclear Regulatory Commission,

“RTM-96 Response Technical

Manual,” Vol. 1, Rev. 4, March 1996,

pp. O-6 to O-9.

4. S. Abrahamson, et al, “Health Effects

Models for Nuclear Power Plant

Accident Consequence Analysis, Low

LET Radiation, Part II: Scientific

Bases for Health Effects Models,”

NUREG/CR-4214, SAND85-7185, Rev.

1, Part II, May 1989, Tables 2.7 and

2.8.

5. D. H. Slade, Editor, “Meteorology and

Atomic Energy--1968,” Washington,

DC, U.S. Atomic Energy Commission,

1968.

6. U.S. Nuclear Regulatory Commission

Regulatory Guide 1.23, 1980.

7. “The Chernobyl Papers, Volume I,

Doses to the Soviet Population and

Early Health Effects Studies,” Steven

E. Merwin and Michail I. Balonav

editors, Research Enterprises,

Richland, Washington, 1993.

8. YU.A. Izrael, S.M. Vakulovskii, V.N.

Vetrov, F.Ya. Rovinskii, and YeD.

Stukin, “Chernobyl: Radioactive

contamination of the environment.

Leningrad: Gidrometeoizdat;” 1990 (in

Russian).

9. Jaworowski, and L. Kownacka,

“Tropospheric and stratospheric

distributions of radioactive iodine and

cesium after the Chernobyl event,” J.

Environ. Radioact. 6:145-150; 1988.

10. YU.A. Izrael, S.M. Vakulovskii, V.N.

Vetrov, F.Ya. Rovinskii, and Ye.D.

Stukin, “Chernobyl: Radioactive

contamination of the environment.

Leningrad: Gidrometeoizdat;” 1990 (in

Russian).

11. USSR State Committee on

Hydrometeorology. Radiation maps in

the territory of the European part of

the USSR as of December 1990.

Densities of area contamination by

cesium-137, strontium-90, and

plutonium-239, 240. Minsk: SCH;

1991.
5.3 Protective Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

5.3.1 Basic Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

5.3.1.1 Early, Intermediate, and Late Phases . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

5.3.1.2 Basic Radiation Protection Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . 2

5.3.1.3 Early Protective Action Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

5.3.1.4 Timing of Initial Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

5.3.2 Evacuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

5.3.2.1 Effectiveness of Evacuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

5.3.2.2 Evacuation Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

5.3.2.3 Entrapment Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

5.3.3 Sheltering and Relocation from Hot Spots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

5.3.4 Improvised Respiratory Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

5.3.5 Use of Potassium Iodide (KI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

5.3.6 Early Protective Action Decisions During the TMI-2 Accident . . . . . . . . . . . . . . 8

5.3.7 Other Protective Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

5.3.8 Protective Actions Following The Chernobyl Accident . . . . . . . . . . . . . . . . . . . . 9

5.3.8.1 Workers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

5.3.8.2 Evacuees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

5.3.8.3 Residents of Significantly Contaminated Areas . . . . . . . . . . . . . . . . . 12

5.3.8.4 Residents of Less Contaminated Areas . . . . . . . . . . . . . . . . . . . . . . . . . 12

5.3.9 Long-Term Health Effects From The Chernobyl Accident . . . . . . . . . . . . . . . . . 13

References for Section 5.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
 	
 
  

	  !  " #$%&'( (

5.3 Protective Actions

The public can usually be protected from an

uncontrolled release of radiological material

only by some form of intervention (e.g.

evacuation) that disrupts normal living.

Such intervention is termed protective

action. This section presents information

regarding the appropriate timing and

potential effectiveness of various protective

actions. Emergency preparedness, that is,

the process of preparing to take effective

actions to protect the public in the case of a

U.S. reactor accident, is the subject of

Section 5.4.

5.3.1 Basic Concepts

5.3.1.1 Early, Intermediate, and Late

Phases

In discussing protective actions, it is

convenient to identify three time phases:

early, intermediate, and late. Although the

time intervals associated with these phases

may overlap, different considerations apply

within each phase.

The early phase (also referred to as the

emergency phase) is the period at the

beginning of a reactor accident when

immediate decisions for the effective use of

protective actions are required. This phase

may last from hours to days.

The intermediate phase is the period

beginning after the radiological releases have

been brought under control and reliable

environmental measurements are available to

provide a basis for decisions on additional

protective actions. It extends until these

additional protective actions are terminated.

This phase may overlap the early and late

phases and last from weeks to many months.

The late phase (also referred to as the

recovery phase) begins with recovery actions

designed to reduce radiation levels in the

environment and ends when all recovery

actions have been completed. This period

may extend from months to years.

The protective actions available to avoid or

reduce radiation dose can be categorized as

a function of exposure pathway and incident

phase, as shown in Table 5.3-1. Evacuation

and sheltering are the principal protective

actions available to protect the public from

exposure during the early phase. It may also

be appropriate to take actions to protect

against contamination of milk (primarily by

radioactive iodine) or to issue stable iodine

to reduce thyroid doses. The use of simple,

ad hoc respiratory protection may also be

appropriate.

It is necessary to distinguish between

evacuation and relocation with regard to

incident phases. Evacuation is the urgent

removal of people from an area to avoid or

reduce high-level, short-term exposure,

usually from the plume or deposited activity.

Relocation, on the other hand, is the removal

or continued exclusion of peopl e

(households) from contaminated areas to

a v o i d c h r o n i c r adi a tion ex posur e .

Conditions may develop in which some

groups who have been evacuated in an

emergency may be allowed to return, while

others may be converted to relocation status.

Relocation and decontamination are key

protective actions for the intermediate and

late phases. Decisions would be made

during the intermediate phase concerning

whether areas from which the public has

been relocated should be decontaminated and

reoccupied, or condemned and the occupants

permanently relocated. Another protective

action for the intermediate and late phases is

the imposition of restrictions on the use of

contaminated food and water.
 	
 
  

	  !  ( #$%&'( (

5.3.1.2 Basic Radiation Protection

Objectives

Protective actions taken in response to a

severe accident at a nuclear power plant

have the following objectives:

1. To avoid (prevent) doses

sufficient to cause early health

effects (injuries or deaths) that

would be seen at specific organ

(e.g., bone marrow or thyroid)

doses above 50 rem;

2. to reduce early off-site doses that

would otherwise exceed federal

protective action guidelines (see

Appendix 5A); and

3. to reduce the risk of long-term

health effects (e.g., cancers).

These objectives are listed in decreasing

order of importance. Initial protective

actions should be directed toward meeting

the first objective by keeping the acute doses

from the passing plume (cloud shine, ground

shine, and inhalation doses) below levels

that could result in early injuries or deaths.

Federal protective action guides (PAG) dose

levels are well below the levels that would

cause early health effects (see Appendix

5A).

5.3.1.3 Ea r l y Pro t e c ti v e Ac ti o n

Guidance

Guidance regarding early protective actions

has evolved from numerous severe accident

studies. This guidance has been incorporated

into response procedures and training

manuals for the NRC staff, the latest

edition of which is Response

Technical Manual (RTM)-96.

1 Figures 5.3-1

and 5.3-2 depict the current strategy. In

short, the early protective action guidance

says, given a severe core damage accident,

people should immediately evacuate areas

near the plant (within a 2- to 3-mile radius)

and remain in shelter elsewhere for the

immediate future. Let us now examine the

rational for this guidance.

5.3.1.4 Timing of Initial Actions

First, consider the need for the immediate

implementation. As discussed in Section

5.1, core damage and containment failure are

both required for a large release. Control

room indicators of core damage should be

numerous. On the other hand, it would be

virtually impossible to predict the occurrence

or time of containment failure in most severe

accidents. A major release would be very

intense with most of the radioactive material

being released within 0.5 to 2.0 hr of

containment failure. Relying on predictions

of containment failure or waiting for

indications of containment failure could

delay an evacuation during the period when

it would be the most effective action for

avoiding offsite health effects.

The best way to ensure that protective

actions are started before a major release is

to initiate the actions as soon as core

damage is detected. If the decision to take

action awaits dose projections or field

monitoring results, the population close to

the plant could be exposed to the large

radioactive plume. This is one of the

primary reasons for establishing emergency

action levels that tie the declaration of a

General Emergency (see Section 5.4) to clear

indications of core damage.

5.3.2 Evacuation

Early evacuation of the area near the plant

has several benefits in terms of public

safety:

1. Cloud shine dose from all or at

least part of the plume can be
 	
 
  

	  !   #$%&'( (

avoided (if the evacuation begins

before or shortly after the release).

2. Dose from contaminated ground

and other surfaces can be avoided.

3. Inhalation of contaminated air can

be avoided.

4. The highest-risk areas would be

cleared early, thereby permitting

emergency response teams to

focus on other areas.

Immediate evacuation of people near the

plant could well prove to be precautionary

because most severe accidents (like the

Three Mile Island accident) would not be

expected to lead to a major release. On the

other hand, core damage accidents are

expected to be extremely rare; so that

precautionary evacuations would also be

rare, and the results of not taking immediate

protective actions could be tragic. As

illustrated in Section 5.3.2.2, for a severe

accident resulting in a large release,

evacuation near the plant (within 2 to 3

miles) may be the only action that can

prevent early health effects.

5.3.2.1 Effectiveness of Evacuation

A concern is sometimes raised that, once a

release from a severe reactor accident starts,

an evacuation should not be recommended

because the evacuees may run into or be

overtaken by the plume. However, as

illustrated in Section 5.2.4, plume

concentrations decrease exponentially with

distance from the source.

As a result, large reductions in doses to

individuals may be achieved by evacuation.

Evacuation also precludes the possibility of

long term exposure to hot spots. In contrast,

sheltering in a typical farm house reduces a

person's dose by no more than a factor of 2,

and does not preclude long term exposure to

hot spots. Consequently, public officials

must continue to be concerned about people

in shelters.

Studies consistently indicate that evacuation

during plume passage does not increase risk

over sheltering in a typical residential home.

Conversely, delaying evacuation can

considerably increase risk. These finding

are, for example, consistent with NUREG1150 results that compare the following six

protective action scenarios:

1. Normal activity, which assumes

that no protective actions are

taken during the release but that

people are relocated within 6

hours of plume arrival.

2. Home sheltering, which assumes

(a) shielding typical of masonry

houses or basements of wood

frame houses, (b) inhalation

protection consistent with such

homes, and ©) relocation within 6

hours of plume arrival;

3. Large building shelter, which

assumes sheltering in a large

building such as an office

building, hospital, apartment

building, or school, indoor

protection for inhalation of

radionuclides, and relocation

within 6 hours of plume arrival;

4. Radial evacuation at 2.5 miles/hr

starting 1 hour before release;

5. Radial evacuation at 2.5 miles/hr

starting at the time of release;

6. Radial evacuation at 2.5 miles/hr

starting 1 hour after the start of

release.
 	
 
  

	  !  ' #$%&'( (

Figures 5.3-3 and 5.3-4 show the conditional

probabilities of exceeding 50-rem and 200-

rem red bone marrow doses for the six

scenarios assuming an early containment

failure at Zion with source term magnitudes

varying from low to high.

2 These figures

indicate a large probability of doses

exceeding 200 rems (and the associated risk

of fatalities) within 1 to 2 miles of the plant.

With no protective actions, the probability of

doses exceeding 50 rems (and the associated

risk of radiation-induced injuries) is

significant even 10 miles away. Sheltering

in a typical house does not significantly

lower these probabilities.

As indicated, evacuation before release

(scenario 4) provides the greatest risk

reduction. Evacuation at time of release

(scenario 5) evacuation 1 hour after release

(scenario 6) both result in exceedance

probabilities that are lower than or, at large

distances, comparable to those for basement

sheltering. Therefore, if a large release can

occur, it is prudent to consider prompt

evacuation.

At 3 miles and beyond, it is possible to

avoid doses exceeding 200 rems by

sheltering in large buildings even in the case

of a large release. People in large buildings

such as hospitals would therefore not

necessarily have to be immediately

evacuated, but could shelter instead. Of

course, further reductions in dose are

possible by prompt evacuation.

At 10 miles, no protective actions except

relocation would be necessary to avoid 200-

rem doses. Sheltering in large buildings or

evacuation prior to release would keep doses

below 50 rem.

Calculations also indicate the importance of

monitoring ground contamination following

plume passage and quickly relocating

sheltered individuals away from hot spots.

In calculations like those performed for

NUREG-1150, people are typically assumed

to relocate if the ground contamination is 1

rem/h (about 100,000 times the normal

background dose rate).

Few people live close to most nuclear power

reactors. Figure 5.3-5 illustrates the number

of people within 1 and 5 miles of 111

nuclear power plant sites (actual or proposed

in 1979).

3 Well below 10,000 people live

within a 1 to 5 mile radius. In fact, at most

sites, fewer than 300 people live within 2

miles of the site. Indeed, the area within a

2- to 3-mile radius encompasses the

low-population zone around most reactor

sites. There would normally be few

impediments to immediate evacuation of the

population within a 2- to 3-mile radius.

The basic conclusion is that, even for a large

release, large numbers of early fatalities can

be prevented if (a) areas near the plant (2 to

3 miles) are evacuated before or shortly after

the release and (b) prompt monitoring is

conducted to locate ground contamination

that would result in expeditious relocation of

people sheltered outside the evacuation zone.

5.3.2.2 Evacuation Risks

Objections have been raised to evacuation

because of fears of panic or injuries during

the evacuation. Evacuations of up to a few

thousand people from areas up to about

several square miles are not uncommon.

Evacuations of significant size occur about

every week to ten days in the United States.

(Keep a mental note every time you hear of

an evacuation.)

The historical fatality risk is about 1/500,000

per person during evacuations. This

evacuation risk is considerably less than

PRA estimates of a 1/10 to 1/100 risk of

fatality given a core melt accident with no

evacuation. Although the comparison says
 	
 
  

	  !   #$%&'( (

nothing definitive about the risk for any

particular core melt accident, it does indicate

strongly that, on the average, it would be far

less risky for a person to evacuate than to

remain within 2 to 3 miles of a nuclear

power plant experiencing a severe core

damage accident. Conversely, on a

predetermined basis, an evacuation should

not be recommended unless a core melt

accident sequence is actually under way.

The practice of basing emergency plans for

nuclear facility accidents on information

regarding public behavior during nonnuclear

emergencies has been questioned. Although

the dat a bas e is limited, several

nuclear-related incidents involving public

response have occurred and can be compared

to the nonnuclear experience. Some of these

incidents (excluding weapons-related

incidents) are presented in Table 5.3-2. The

Environmental Protection Agency found no

reason to expect that people would react

differently to a nuclear accident than they

would to a flood, fire, or similar emergency.

4

The accident that appears to be of the

greatest relevance is the one at Three Mile

Island Unit 2 (TMI-2), which occurred at

4:00 a.m. on March 28, 1979. By 8:00 a.m.,

the national television networks were

broadcasting the news. A small percentage

of the local population left the area during

the first two days. On the third day

(Friday), the governor of Pennsylvania

recommended the evacuation of children and

pregnant women. By the end of the

weekend, about half of the population within

20 miles had left the area. Throughout this

time, the people were subjected to intense

stress and (to them) conflicting opinions and

advice. Despite these conditions, the

evacuations that occurred were orderly.

Some observers have stated that the

evacuations represented panic. Conversely,

it could be argued that the public's behavior

was perfectly understandable considering the

intense pressures to which they were

subjected (e.g., various authorities expressed

diametrically opposed positions, and some

authorities even reversed their own positions

during the course of the accident). In fact,

if the current protective action guidance had

been in place at the time of the accident,

evacuation of the area near the plant would

have been recommended.

5.3.2.3 Entrapment Scenarios

Scenarios can be hypothesized in which

evacuation may not be practical. For

example, if an ice storm is in progress, if

major transportation arteries are blocked, or

if a major population center is involved,

ordering an evacuation may result in

entrapment of persons outside, where they

may be more vulnerable than in their

original locations (a car is not as good a

shelter as a house). If early evacuation is

simply not possible, local officials must use

common sense in providing the best shelter

and/or evacuation possible. Emergency

personnel should monitor for ground

contamination following a release, and

motivate people to leave any highly

contaminated areas (i.e., hot spots). It

would, most likely, not be necessary for

people to move very far from such heavily

contaminated areas to significantly reduce

their exposures. Expedient shelter of some

sort is almost always available.

Entrapment problems are expected to be rare

at most reactor sites in the United States,

especially rare in conjunction with a severe

accident. Fewer than 300 people live within

2 to 3 miles of most nuclear power plants in

the United States. Within this distance there

are few facilities such as hospitals that

would require special attention in the event

of an evacuation. At a few reactor sites

where these conditions are not met, the

emergency planner (and responder) must
 	
 
  

	  !  & #$%&'( (

recognize that evacuation would be more

difficult. Emergency plans must be prepared

and decisions made accordingly.

5.3.3 Sheltering and Relocation from Hot

Spots

Early sheltering is an appropriate protective

action measure

1. for areas where the risk of

exceeding the doses required for

early health effects is relatively

low,

2. for lesser events (e.g., Site Area

Emergencies) where a major

release is not expected,

3. if outside entrapment problems are

likely to occur should an

evacuation be attempted.

Table 5.3-3 provides factors that can be used

to indicate the relative amount by which

exposures may be reduced for various

pathways as a result of sheltering. These

sheltering factors should be used for

comparison purposes only, not for predictive

purposes. They can be used to determine the

type of structure to recommend if a choice of

structures is available. For cloudshine and

groundshine, small farmhouses provide very

little protection; but, if a farmhouse has a

basement, protection can be improved.

Large concrete structures can provide a great

deal of protection.

Enclosed structures can offer protection from

the inhalation pathway. The degree of

inhalation protection provided depends on

the "openness" or ventilation rate of the

shelter and on how long the plume remains

outside. Small dwellings with closed

windows and doors ventilate at a rate of

about one air turnover per hour. Based on

risk assessments, life-threatening releases

from U.S. plants would be expected to last

less than two hours. Less-severe (in

quantity) releases could last much longer.

For a one-hour release, a protection factor of

about three (two-thirds reduction in dose

commitment) can be achieved in such a

dwelling. For longer releases, the inhalation

protection factor would be lower (assuming

that the wind does not shift).

Numerous studies indicate that beyond some

distance (typically 2 to 3 miles from the

plant) sheltering followed by post-release

monitoring and relocation from "hot spots"

would be as effective as evacuation for many

severe accident scenarios. This might not be

the case under certain meteorological

conditions, in particular, if the radioactive

plume passes through rainfall or if severe

inversion conditions trap and confine the

plume near the ground. Such conditions

cannot be predicted with any useful degree

of accuracy, and offsite radiological

monitoring after the release must be relied

upon to determine when evacuation at

greater distances is warranted.

Doses from ground contamination may

become very important within a few hours of

a major release. Therefore, after

implementing initial protective actions near

the plant, dose projections and field

monitoring should be performed. Dose

projections would be used to estimate

whether protective actions should be

expanded according to the Environmental

Protection Agency Protective Action Guides.

As discussed in Section 5.2, large

uncertainties are associated with dose

projections. Therefore, as soon as possible

after a release, field monitoring data should

be the preferred basis for expanding initial

protective actions.

In the event of an actual major release,

anyone sheltered in an area of high

ground-level contamination (e.g., >1 R/hr)
 	
 
  

	  !  ) #$%&'( (

would be asked to leave, whether or not an

emergency plan calls for it. The

predetermined level of 1 R/hr conforms to

the Environmental Protection Agency

Protective Action Guide of 1 to 5 rems

projected whole-body dose. As noted

earlier, evacuation at lower dose rates could

be recommended on an ad hoc basis, but for

a very severe accident, the 1 R/hr level may

be suitable as an initial predetermined "trip"

level.

5.3.4 Improvised Respiratory Protection

Improvised respiratory protection, such as

placing a towel over the mouth and nose,

reduces only the dose associated with

inhalation of fine aerosols (less than about

10 microns in diameter). It does not impact

the dose received from cloud shine or

contaminated ground and other surfaces. As

a result, improvised respiratory protection is

a secondary protective action (i.e., it may be

recommended in conjunction with evacuation

or sheltering). Implementation of

improvised respiratory protection should

never delay implementation of other

protective actions such as sheltering or

evacuation.

Table 5.3-4 shows the results of experiments

conducted using different types of

improvised respiratory protection.

5 Military

personnel used various household items for

protection and measured their efficiency in

removing particles. Some results are

remarkable. Use of a tight-fitting heavy

towel over the nose and mouth can reduce

the inhalation exposure from small

particulates by a factor of 10. A

loose-fitting towel can be used to reduce

particulate inhalation by a factor of 2 to 5.

Similar reduction factors would apply to

babies lightly wrapped in blankets, such as

they are for protection from wind and cold.

Note, however, that exposure received

through inhalation of radioactive gases is not

reduced by these techniques. Basically,

improvised respiratory protection is a

secondary protective action that can be used

to provide a nontrivial level of additional

protection.

5.3.5 Use of Potassium Iodide (KI)

The Food and Drug Administration has

recommended that potassium iodide tablets

be administered for projected thyroid doses

greater than 25 rem.

5

Ingestion of potassium

iodide (KI) tablets reduces the dose to the

thyroid caused by the intake of radioiodine.

It must be understood, however, that use of

the thyroid-blocking agent potassium iodide

(KI) is not an adequate substitute for prompt

evacuation or sheltering by the general

population near a plant in response to a

severe accident. The immediate risk to the

population from a severe reactor accident is

bone marrow dose, not the dose to the

thyroid from radioiodine.

To be effective, potassium iodide must be

taken just before or shortly after exposure to

radioiodine (within 1 to 2 hr). Thus, to be

potentially effective, it must be readily

available.

6 Taking the recommended dosage

of KI (130 mg) just before or at the time of

exposure could block more than 90% of

radioactive iodine uptake by the thyroid as

indicated in Figure 5.3-6. If taken

approximately 3 to 4 hr after acute exposure,

only about 20% blocking would occur in

some persons. Note that a small percentage

of people could react adversely to KI, but

the risk of a severe reaction is very small.

The NRC and the Federal Emergency

Management Agency (FEMA) recommend

predistribution of KI to predesignated

emergency workers, site personnel, and

institutionalized individuals who might find

it difficult to evacuate during an emergency.

FEMA has stated the position that

predistribution of KI to the general public
 	
 
  

	  !   #$%&'( (

should not be required for a state or local

emergency plan to be acceptable.

7 NRC

emergency preparedness regulations (10 CFR

50.47(b)(10)), however, require that States

with population within the 10-mile

emergency planning zone of commercial

nuclear power plants consider including KI

as a protective measure for the general

public to supplement sheltering and

evacuation. The NRC will provide funding

for a supply of potassium

5.3.6 Early Protective Action Decisions

During the TMI-2 Accident

To highlight some of the points discussed in

this section, certain aspects of the

assessments of the TMI-2 accident merit

discussion. Figure 5.3-7 presents the hourly

wind vector as measured by the site

meteorological system during the first day of

the accident. Actually, these measurements

were not available to the NRC until three

days later because the plant computer

crashed early in the accident. It is evident

that wind direction at the site varied

dramatically throughout the 12-hr period.

A Site Emergency was declared at 6:56 a.m.,

followed by a General Emergency at 7:24

a.m. Between 7:30 and 8:00 a.m., the State

of Pennsylvania did issue warnings of

imminent evacuation to the west of the site.

At 8:15 a.m., the evacuation alert was called

off when the results of onsite and offsite

radiation monitoring showed that there had

been no major radiological release.

Coincident with this decision, molten

material existed in the reactor vessel and

containment radiation levels were very high

(see Table 2.1-1 and Section 3.5).

If an evacuation to the west of the site had

been initiated around 8:00 a.m., local wind

conditions would have shifted the potentially

affected area to the north by 9:00 a.m., and

then to the east by 11:00 a.m. Thus, the

wrong people would have been told to

evacuate. As the NRC Special Inquiry

Group noted later, based on in-plant

observations as set forth in the emergency

plans and as emphasized in NRC emergency

planning guidance in place even at the time

(R.G. 1.101), omnidirectional evacuation of

the total low-population zone (2.5-mileradius area surrounding the site) would have

been warranted no later than 7:30 a.m.

Although not diagnosed, by 9:00 a.m.

indications of severe core damage were

indisput abl e . Some of the cor e

thermocouple showed temperatures over

2000°F (800°F beyond that required for

cladding failures, and the containment dome

monitor increased from 600 to 6000 R/hr

between 8:20 and 9:00 a.m. However, as

indicated, the decision not to take action was

made based on field-monitoring results. The

NRC Special Inquiry Group found that the

state offices should have been advised at

9:00 a.m. that

the core has been badly damaged and

has released a substantial amount of

radioactivity. The plant is in a

condition not previously analyzed for

cooling system performance.

The Inquiry Group went on to state:

The difficult question in this situation

is whether to advise precautionary

evacuation of the nearby population or

to advise only an alert for possible

evacuation. The recommendation to

evacuate is consistent with what we

think would then be the case, a prudent

doubt that the core-cooling passages

were still sufficient for cooldown. In

addition, the containment building was

now filling with intensely radioactive

gas and vapors, leaving the nearby

public protected by only one remaining

barrier, the containment, a barrier
 	
 
  

	  !  * #$%&'( (

with a known leak rate that needed

only internal pressure to drive the

leakage.

Finally, the Inquiry Group stated:

Pres ent emergency plans are

inadequate because they do not provide

a clear requirement to evaluate the

need for protective actions based on

deterioration of plant conditions.

This example illustrates the importance (for

core melt accidents) of implementing

protective actions in the nearby areas as

soon as core damage is detected and without

regard for wind direction or detection of

actual major releases. These are two of the

foundations of current NRC staff emergency

planning guidance. Early precautionary

evacuation of the immediat e area

(approximately 2-mile radius) should not be

recommended in only "downwind" directions

because of the inability to determine where

downwind will be when the protective

actions are actually implemented or when a

significant release occurs. In addition, when

core damage is detected, the early

recommendation to evacuate should not be

based on early real-time dose projections but

on the status of the core. Indeed, the

predetermined, early, initial evacuation for a

severe core damage accident is called

"precautionary" because a major release may

never actually occur, as was the case at TMI2. On the other hand, no immediate, early

evacuation would be warranted for sequences

less serious than core-melt accidents.

5.3.7 Other Protective Actions

Othe r pr o t e c ti v e a c ti o ns such a s

decont amination of evacuees, milk

contamination control, and reservoir (water)

protection may also be part of the emergency

r e s p o n s e ; h o w e v e r, v e r y e a r l y

implementation of these actions (within 0 to

4 hr of the release) would not be crucial to

their effectiveness. They would, however,

be important in reducing the number of

latent health effects.

For radiation protection purposes, it is

assumed that, no matter how low the dose,

some percentage of the population will

eventually suffer from cancer because of the

radiation exposure. As indicated in Section

5.2, consequence models predict that many

of the radiation-induced cancers would occur

due to doses received by people tens to

hundreds of miles from the plant. This is

the result of a great number of people

receiving a very low dose. Thus, as a

practical matter, emergency-phase protective

actions available to reduce these effects are

very few. In the early time frame of a

response, sheltering to long distances might

be advised--much as for an air pollution

alert.

If a severe reactor accident occurred during

the growing season, crops and pasture within

the 50-mile ingestion-pathway emergency

planning zone (EPZ) might need to be

decontaminated or temporarily quarantined

to allow radioactivity to decay. This means

that very soon after the accident, surveys of

pastures, milk, fruits, and leafy vegetables

would need to be conducted, dairy and meat

animals would have to moved from

contaminated to uncontaminated pastures or

fed from uncontaminated stored forage.

Contaminated crops would have be prevented

from reaching market (entering the food

distribution system), and residents of the 50

mile EPZ would have to be carefully warned

not to eat contaminated food they had

privately grown.

5.3.8 Protective Actions Following The

Chernobyl Accident
 	
 
  

	  !  " #$%&'( (

After the Chernobyl accident, plant workers

and individuals who helped mitigate the

accident were exposed to beta and gamma

radiation from the reactor ruins, the core

fragments expelled by the explosion, the

plume, and the radionuclides deposited on

the ground. The majority of acute radiation

injuries occurred from the doses received

during the night of the accident (April 26,

1986), when the reactor staff (not knowing

the degree of destruction) tried to restore the

reactor to operational mode. Shortly

thereafter, firemen responding to the

emergency were unprotected from the

radiation. The dosimeters they wore were

either damaged or incapable of measuring

the extremely high dose rates they

encountered (up to thousands of rads per

hour). Clinical treatment for acute radiation

sickness was delivered to 134 individuals; 37

of these cases were life threatening. Of

these 37, 28 died within days or weeks.

Thermal- and beta-induced skin burns

affected more than 50% of the total body

surface area of 26 of the 28 patients who

died. Two more persons died at the site as

a result of the initial explosions, and one

person died of cardiac infarction. Thus, a

total of 31 people died during the first three

months.

8

After the initial exposures, protective actions

were implemented to reduce doses to the

remaining Chernobyl workers, persons who

helped mitigate the accident, and inhabitants

of contaminated regions. No additional

cases of acute radiation sickness were

observed. In part, this is due to the

protective actions including evacuations that

are discussed in the following subsections.

It is, however, also a result of the energetic

lofting of the release and the winds and rains

that existed during the release. These

factors resulted in deposition patterns that

were not as bad as they might otherwise

have been in major population centers like

the city of Kiev.

The information regarding protective actions

and their effectiveness, which is presented in

the following sections, is drawn from an

overview which appears in a 1993 book

entitled The Chernobyl Papers.

9

5.3.8.1 Workers

Approximately 600,000 individuals took part

in mitigation activities at the reactor and

within the 30-km zone surrounding the

reactor. These workers were all adults, most

of whom were males between the ages of 20

and 45. About half were servicemen who

were brought in from all territories of the

former Soviet Union.

The effective dose equivalent limit

established for individuals working in the

30-km zone was 25 rem in accordance with

the Soviet standards of radiation safety.

Upon reaching this limit, a worker was

suspended from work in the 30-km zone and

was required to undergo a medical

evaluation. In 1987 this limit was reduced

to 10 rem, and in 1988 to 5 rem per year.

As time progressed, especially while a

protective shell (the "sarcophagus") was built

around the destroyed reactor, workers

continued to receive doses up to 25 rem and

even higher in a few cases from exposure to

external beta and gamma radiation. The

composition of radionuclides contributing to

these exposures varied continuously due to

decay. Inhalation of radionuclides also

occurred. These included volatile forms of

I-131 in May 1986 and resuspended fuel

particles in the hot, dry summer of 1986.

Doses from ingestion were negligible

because uncontaminated food products were

made available to the workers.

To decrease beta and gamma radiation levels

in the 30-km zone, activities included

decontamination of buildings and roads

using water and special decontamination
 	
 
  

	  !  "" #$%&'( (

solutions, removal of radioactive soil, and

covering contaminated sites with up to 1.5 m

of crushed rock and/or concrete. These

activities were performed using heavy

equipment with highly shielded cabins and

remotely operated tools. Additional

countermeasures included decontamination

of roofs of buildings at the Chernobyl site

using robotic machinery and the application

of water and a fixing polymer to the ground

to suppress dust.

Additional worker protection was provided

through the use of special clothing and

footwear, and both filter and supplied-air

respirators. External gamma radiation doses

were limited by restricting stay times in high

exposure-rate areas and through the use of

remotely operated tools. Also, stable iodine

was administered to workers through June

1986.

5.3.8.2 Evacuees

To avoid acute radiation sickness, 49,000

inhabitants of the town of Pripyat, located 3

km from the Chernobyl nuclear power plant,

were evacuated on April 27, 1986.

Additionally, 11,000 inhabitants of 15

villages in the 10-km zone around the plant

were evacuated on May 2 and 3, and 42,000

additional inhabitants of 83 villages in the

30-km zone were evacuated between May 4

and May 7. During June through September

1986, after data on the areas contaminated

by long-lived radionuclides were refined, the

inhabitants of 57 villages in Belarus, 1

village in the Ukraine, and 4 villages in the

Bryansk region of Russia were resettled. No

cases of acute radiation sickness were

observed in any of the 116,000 evacuated

individuals.

Although rumors were rampant, the

population of Pripyat was not officially

notified of the accident until approximately

noon on April 27, at which time they were

ordered to prepare to evacuate. Evacuation

took place by buses mainly between 1 p.m.

and 5 p.m. on April 27. The remainder of

the population of the 30-km zone learned

about the accident from television on the

evening of April 28. Stable iodine was

administered to approximately 60% of the

population of Pripyat on April 26 and 27,

but 65% of the population did not undertake

any other countermeasures prior to

evacuation. Rural residents of the 30-km

zone did not significantly change routines,

nor did they apply any personal

countermeasures prior to evacuation.

The evacuees were subjected to external

radiation from the plume and to beta and

gamma radiation from radionuclides

deposited on the ground before evacuation

was completed. Ingestion of radionuclides

occurred in a number of Belarus villages (in

the southern portion of the Gomel region)

because notifications of the accident were

late and therefore ineffective in preventing

consumption of contaminated foods.

Consequently, thyroid doses to children in

these villages exceeded a thousand rems.

External exposures and the intake of

radionuclides essentially ceased after

evacuation. The average and maximum

effective dose equivalents from external

gamma radiation to inhabitants of Pripyat

were 1 rem and 10 rem, respectively. The

values for the rural population of the 30-km

zone were approximately 2 rem and 40 rem,

respectively. The average thyroid dose to

Pripyat inhabitants was approximately 20 rad

for both children and adults. Administration

of stable iodine is estimated to have

decreased thyroid doses in Pypriat evacuees

by a factor of 10.
 	
 
  

	  !  "( #$%&'( (

5.3.8.3 Re sidents of Signifi cantly

Contaminated Areas

About 4 million people were, and many

continue to be, subjected to external and

internal exposures in the 131,000-km

2

area,

with Cs-137 surface activity levels exceeding

1 μCi/m

2

. Approximately 270,000 of these

individuals resided in the controlled area,

which consisted of 10,300 km

2 with Cs-137

surface activity levels exceeding 16 Ci/m

2

.

For these individuals, external exposures

from the plume were insignificant compared

to the external exposures from deposited

radionuclides. According to available data,

less than 10% of the external doses received

during the first year were attributed to the

plume. Inhalation doses from the plume and

from resuspended radionuclides were also

insignificant for these individuals compared

to the ingestion of I, Cs, and Sr isotopes.

Dose limits were developed for the

protection of people who continued to reside

in significantly contaminated areas. The

adopted limits were 10 rem for the first year

after the Chernobyl accident, then 3 rem in

the second year and 2.5 rem in each year of

1988 and 1989. Overall, through January 1,

1990 the maximum effective dose equivalent

allowed was 13 rem per inhabitant. In 1991

a new criterion for relocation of residents to

uncontaminated areas was set: for annual

effective dose equivalents greater than 0.5

rem, relocation was required. To ensure that

the effective dose equivalent limitations

were met and to limit internal doses to

critical organs, temporary permissible levels

of radionuclide activities in food products

and drinking water were instituted. Along

with the standards for food products, many

other standards were introduced including

standards for contamination of various

surfaces.

In the early and intermediate phase,

protective actions taken for inhabitants of

significantly contaminated areas included

administration of stable iodine, temporary

relocation, delivery of uncontaminated meat

and dairy products, decontamination of

villages, and measures to decrease

radionuclide content in agricultural products.

The inhabitants of villages with the highest

levels of radioactive contamination were

gradually resettled to uncontaminated areas.

The most effective protective actions for

reducing person-rems were temporary and

permanent relocation and the supply of

u n c o n t a m i n a t e d f o o d p r o d u c t s .

Administration of stable iodine was only

effective in Pripyat, where short-term (1.5

day) radioiodine intakes were very high and

stable iodine was administered in a timely

manner. There were no observations of

cases of acute radiation sickness in the

population of the controlled areas, although

radiation-related thyroid cancers may be

observed.

In many towns and villages, numerous

countermeasures for protection of the

population were performed simultaneously.

Temporary resettling of children, monitoring

of milk contamination and administration of

stable iodine together decreased the

collective thyroid dose to the 3 million

inhabitants of Kiev by an estimated 11

million person-rem, or approximately 40%.

5.3.8.4 Residents of Less Contaminated

Areas

The remainder of the population of the

former Soviet Union numbered approximately 280 million in 1991. These

individuals resided in territories with Cs-137

surface activity levels below 0.04 MBq/m

2

and were subjected to relatively insignificant

exposures from local contamination. An

important factor was the distribution

throughout the country of meat and dairy

products produced in the contaminated area.

Although concentrations of radionuclides in
 	
 
  

	  !  " #$%&'( (

these products were within permissible

levels, the content of Cs radionuclides in the

bodies of inhabitants of the former Soviet

Union increased compared to the preaccident levels as a result of the

consumption of the products. In many

regions both individual and collective

population doses from these products were

higher than those received from the local

deposition of radioactive material.

Outside the former Soviet Union, protective

actions in countries that received fallout

from Chernobyl varied. In many countries,

contamination levels in milk and other food

products were monitored and sale of

contaminated produce was banned. In some

countries KI was distributed to children to

protect against thyroid cancer.

5.3.9 Long-Term Health Effects From

The Chernobyl Accident

In April of 1996, almost ten years after the

Chernobyl accident, an international

conference was held in Vienna to discuss the

r a d i o l o g i c a l , e n v i r o n m e n t a l , a n d

psychosocial consequences of the Chernobyl

accident.

8 One major conclusion of the

conference was that the psychological impact

of the accident has been extensive and

long-lasting. The mental stress caused by

what is and is not known about the accident

is real. The population is inclined to

mistrust official statements and attribute an

increase in any kind of illness to radiation.

Yet, at the time of the conference, clear

evidence regarding the impact of Chernobyl

on the incidence rates of various illnesses

was sparse.

There is one notable exception. A large

number of child thyroid tumors are clearly

attributable to the consumption of milk

contaminated with radioiodine. At the time

of the conference, over 550 cases of thyroid

cancer had been diagnosed in children below

the age of 15--about 330 in Belarus, 200 in

Ukraine, and 25 in Russia. In Belarus, the

number of cases diagnosed between 1990

and 1995 was about 50 times greater than in

the United Kingdom. This incidence rate is

almost an order-of-magnitude greater than

would have been predicted based on preexisting models, and the reason for the

discrepancy is not clearly understood.

Children may be much more sensitive to

radioactive iodine than anticipated, or iodine

deficiency may have been a factor, or some

genetic predisposition to the disease may

have existed in the region. If detected

sufficiently early, thyroid cancer can be

treated with surgery, iodine-131 therapy, and

thyroid hormone replacement. Some 10 to

15% of those treated develop complications

that could result in death at a later date.

Data regarding other health effects is less

clear. Studies of the overall incidence of

cancer among cleanup workers and residents

of contaminated areas were undertaken in

Ukraine, Belarus, and Russia. Some of these

studies indicated no increase in comparison

with the general population whereas others

reported increases as large a 11% for

cleanup workers and 3% for inhabitants of

contaminated areas. No consistent increase

has been validated for leukemia in any of the

three countries. After 10 years, an increase

in the incidence of leukemia among the

cleanup workers was anticipated based on

studies of atomic bomb survivors. It may be

that atomic bomb survivor studies are not

directly applicable to Chernobyl because the

doses to cleanup workers and residents in

contaminated areas were delivered over

comparatively long time periods.

Because additional thyroid cancers are

anticipated, information regarding leukemia

incidence rates is inconclusive, and the

latency period for many other forms of

cancer (in particular solid tumors) exceeds

10 years, it is important that studies of the
 	
 
  

	  !  "' #$%&'( (

d is e a s e i n c i d e n c e r a t e s c o n ti n u e .

Unfortunately, key pieces of information are

often missing, such as data on the amount

and type of radiation to which individuals

were exposed. Also, records of the

incidence of disease and causes of death for

people in the affected areas before and after

the accident often are often deficient. As a

result, the long-term health effects of the

Chernobyl accident may never be known

with great accuracy. But major strides have

been made in the treatment of children with

thyroid cancer, the quality of cancer

registries, health studies and research infrastructures, and training of epidemiologists

and medical personnel.
 	
 
  

	  !  " #$%&'( (

Table 5.3-1 Exposure pathways, nuclear incident phases, and protective

actions

Potential Exposure

Pathways Incident Phases

Potential Protective

Actions

1. External radiation

from facility

Sheltering

Evacuation

Control of access

2. External radiation

from plume

Sheltering

Evacuation

Control of access

3. Inhalation of activity

in plume

Sheltering

Use of potassium iodide

Evacuation

Ad hoc respiratory

protection

Control of access

Early

4. Contamination of skin

and clothes

Sheltering

Evacuation

Decontamination of

persons

5. External radiation

from ground

deposition

Evacuation

Relocation

Decontamination of land

and property

Intermediate

6. Ingestion of

contaminated food and

water

Food and water controls

Late

7. Inhalation of

resuspended activity

Relocation

Decontamination of land

and property

Note: The use of stored animal feed and uncontaminated water to limit the uptake of

radionuclides by domestic animals in the food chain can be applicable in any of the

phases.
 	
 
  

	  !  "& #$%&'( (

Table 5.3-2 Public response to nuclear-related incidents

Date Location Incident Public reaction

1957 Windscale,

England

Accident at a graphite reactor

caused the release of 20,000 Ci of

radioiodine

Typical, no panic

1977 Ft. St.

Vrain,

Colo.

Erroneous reports of a release of

20 Ci/sec from a nuclear power

reactor

Normal, no panic despite

blizzard conditions

1978 Rocky

Flats, Colo.

Major fire at a plutonium plant Normal, no panic or

widespread flight

1980 Crystal

River, Fla.

20,000 gal of primary water was

spilled into the containment

Normal, no panic or

widespread flight

1979 Three Mile

Island, Pa

Nuclear power plant accident Half of population within 20

miles evacuated within 5

days

1982 Rochester,

N.Y.

Primary coolant released to the

atmosphere from R.E. Ginna

nuclear power plant

Normal, no panic or

widespread flight

1981 Indian

Point, N.Y.

Power transformer exploded when

lightning struck a nuclear power

station

Small-scale evacuation
 	
 
  

	  !  ") #$%&'( (

Table 5.3-3. Factors by which radionuclide exposure may be reduced

by sheltering for different types of shelters and pathways of exposure

Type of shelter Cloud shine Ground shine Inhalation

Small, frame building

Without basement 1 2 2

a

With basement 3 5-10 3

a

Multiple-story concrete structure 5 10 5

aPuff release only.
 	
 
  

	  !  " #$%&'( (

Table 5.3-4. Respiratory protection provided by common household

and personal items against aerosols of 1- to 5-m particle

size

Item Number of

thicknesses

Geometric mean

efficiency (%)

Toilet paper 3 91

Handkerchief, man's cotton Crumpled 88

Bath towel, Turkish 2 85

Bath towel, Turkish 1 74

Bed sheet, muslin 1 72

Handkerchief, man's cotton 1 27
 	
 
  

	  !  "* #$%&'( (

Figure 5.3-1 Early protective actions for core melt accidents
 	
 
  

	  !  ( #$%&'( (

Evacuate a 2 mile radius and 5 mile downwind unless conditions make

evacuation dangerous and advise remainder of plume EPZ to go

indoors and to monitor EBS broadcast

Actual or projected severe core damage

a

or loss of control of facility

Continue assessment based on all available

plant and field monitoring information

Modify protective actions as necessary. Locate and evacuate

hot spots. Do not relax protective actions until the source of

the threat is clearly under control

NO

YES

(See notes b, c, d, e)

a Severe core damage is indicated by (1) loss of critical functions required for core protection (e.g., loss

of injection combined with loss of cooling accident); (2) high core temperatures (PWR) or partially

uncovered core (BWR); or (3) very high radiation levels in area or process monitors.

b Distances are approximate - actual distances will be determine by the size of the preplanned sub-areas,

which are based on geopolitical boundaries.

c

If there are very dangerous travel conditions, initially shelter rather than evacuate the population until

condition improve.

d Transit-dependent persons should be advised to remain indoors until transportation resources arrive, if

possible.

e Shelter may be the appropriate action for controlled releases of radioactive material from the containment

if there is assurance that the release is short term (puff release) and the area near the plant cannot

evacuated before plume arrives.

Figure 5.3-2 Protective action flow chart for severe core damage or loss

of control facility
 	
 
  

	  !  (" #$%&'( (

+!
  
   , !  

-  
 
	
.#$""/+!
"
 	
 
  

	  !  (( #$%&'( (

+!
'  
 - ! , 
- !

 

-  
 
0 ! 1 0 
- 
 	
 
  

	  !  ( #$%&'( (

+!
 
- 2 
 ,, 0 " 1  -   
 """ 
  ,0

, /


  ,,1  "*)*
 	
 
  

	  !  (' #$%&'( (

+!
&  
 1 2 3! 

11 2 " - ! 
 2 1

" - ! 
 ,
- 11   

 
 - 
 1- 

2 
  "3


""

4
 	
 
  

	  !  ( #$%&'( (

+!
) 5
  01   6  4 1  6  (/

"*)*
 	
 
  

	  !  (& #$%&'( (

References for Section 5.3

1. T. McKenna, et al., “RTM-96 Response

Technical Manual,” NUREG/BR-0150,

Vol. 1, Rev. 4, March 1996, Figure G-1.

2. U.S. Nuclear Regulatory Commission,

“Severe Accident Risks: An Assessment

for Five U.S. Nuclear Power Plants,”

NUREG-1150, p. 13-12, December 1990.

3. U.S Nuclear Regulatory Commission,

“Demographic Statistics Pertaining to

Nuclear Power Reactor Sites,” NUREG0348, October 1979.

4. J. M. Hans, Jr. and T. C. Sell,

“Evacuation Risks--An Evaluation,”

Environmental Protection Agency report

EPA-520/6-74-002, Office of Radiation

Research, National Environmental

Research Center, Las Vegas, Nevada,

June 1974.

5. J. A. Martin, Jr., et al., "Pilot Program:

NRC Severe Reactor Accident Incident

Response Training Manual, Public

Protective Actions -- Predetermined

Criteria and Initial Actions," NUREG1210, Volume 4, 1987.

6. J. A. Martin, "Potassium Iodide:

Predistribution or Not? The Real

Emergency Preparedness Issue," Health

Physics, 49(2):287-289, August 1985.

7. U.S. Food and Drug Administration,

"Radioactive Contamination of Human

and Animal Feeds and Potassium Iodide

as a Blocking Agent in a Radiation

Emergency,” Federal Register, 43:242,

Part VII, December 15, 1978.

8. A. Kaul, H. Landfermann, and M.

Thieme, “One Decade After Chernobyl:

Summing Up the Consequences,” Health

Physics, Vol. 71, No. 5 (November

1996) 634-640.

9. M. I. Balonov, "Overview of Doses to

the Soviet Population from the

Chernobyl Accident and the Protective

Actions Applied," in The Chernobyl

Papers, Vol. I, Doses to the Soviet

Population and Early Health Effects

Studies, Steven E. Merwin and Michail

I. Balonov editors, Research Enterprises

Publishing Segment, Richland, WA,

1993.
Reactor Safety Course (R-800) 5.2 Offsite Dispersion and Doses

USNRC Technical Training Center 5.2-25 NUREG/CR-6042 Rev. 2

12. Balonov , M.I., "Overview of Doses to

the Soviet Population from the

Chernobyl Accident and the Protective

Actions Applied," in The Chernobyl

Papers, V olume I, Doses to the Soviet

Population and Early Health Ef fects

Studies, S teven E. Merwin and Michail

I. Balonav editors, Research

Enterprises, Richland, W ashington,

1993.
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-1 NUREG/CR-6042 Rev. 2

5.4 Emergency Preparedness

Preparations for potential nuclear power

plant emergencies are extensive. The

discussion in this section is limited to those

aspects of preparedness that affect the NRC's

role of monitoring protective actions. This

includes organizational responsibilities,

emergency detection and classification,

Emergency Planning Zones, licensee

response centers, and the response of state

and local organizations.

5.4.1 Regulatory Basis

Licensees have developed plans and procedures

for emergency response in accordance with the

requirements and guidelines presented in the

following documents:

1. Title 10, Code of Federal

Regulations (CFR) Pt. 50.47 and

Appendix E, which contain the

basic requirements for emergency

preparedness.

2. NUREG-0654 [Regulatory Guide

(R.G.) 1.101, rev. 2],

1 which

contains the criteria to be used in

developing and assessing an

emergency plan.

3. NUREG-0396,

2 NUREG-1131,3

and Information Notice 83-28,

4

which discuss the foundation for

t h e c u r r e n t e m e r g e n c y

preparedness concepts.

4. NUREG-0737, Supplement 1,

5

which clarifies the requirements

for the emergency organization

and emergency centers.

5. NUREG-1210 and RTM-96,

6,7

which update the guidance in

NUREG-0654 and Information

Notice 83-28 based on results of

s evere accident res earch and

experience gained in emergency

preparedness exercises.

The licensee emergency plans and

procedures are available at NRC Headquarters (HQ) and at the regional offices for

each operating reactor.

5.4.2 Roles in an Emergency

5.4.2.1 Role of Licensee

In the event of an emergency, the primary

responsibilities of the licensee are to protect

the core, to prevent or limit offsite

consequences, and to notify predesignated

state and local officials promptly (within 15

minutes) of the emergency declaration.

The licensee's first priority is to protect the

core by maintaining the following critical

safety functions:

1. making the core subcritical and

keeping it there,

2. keeping the water flowing

through the core,

3. keeping the core covered with

water,

4. providing makeup for water

boiled off, and

5. removing decay heat from the

core to an outside heat sink.

The licensee must also take action to prevent

or limit offsite consequences by

1. maintaining reactor containment and the Engineered

Safety Feature (ESF) systems,
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-2 NUREG/CR-6042 Rev. 2

2. controlling radionuclide

releases,

3. recommending appropriate protective actions to offsite

officials.

Licensees have developed Emergency

Operating Procedures for use by the control

room staff in responding to emergency

conditions. These Emergency Operating

Procedures are discussed in Section 5.4.3.1.

In parallel with attempts to correct the

problem, the licensee must notify offsite

officials of an emergency declaration

promptly (within 15 min). The licensee

recommends initial protective actions to

offsite officials because the licensee has the

best early understanding of core and

containment conditions. Furthermore, if an

actual offsite radionuclide release occurs, the

licensee is responsible for monitoring that

release to ensure that actions recommended

off site are appropriate (i.e., that initial

protective action recommendations/decisions

continue to be valid based on current, actual

monitoring data). Section 5.3 discusses role

and efficacy of specific protective actions.

5.4.2.2 Role of State and Local Agencies

State and local agencies are charged with

protecting the public from the offsite

consequences that might result from a power

plant accident. These organizations have the

ultimate responsibility for notifying the

public to take protective actions in the event

of a severe accident. State and local

officials base their decisions on the

recommendations of the licensee. The

licensee cannot order an evacuation of areas

surrounding the plant; the licensee can only

make such a recommendation to the

appropriate offsite officials. Those officials

must make the decision to notify the public

to implement any protective actions. The

response of state and local organizations is

discussed in Section 5.4.6.

5.4.2.3 Role of the NRC

The NRC role should be one of monitoring

the licensee's actions and providing

assistance to the licensee. It is important

that the NRC response personnel understand

that extensive preplanning has been

completed to assist in early decision making.

When prompt protective action is dictated by

plant conditions in a serious accident, it is

not appropriate for the licensee or the

responsible state or local agency to seek

NRC concurrence prior to initiating the

action. The NRC should intervene only if

there is a serious lack of appropriate action.

5.4.3 E m e r g e n c y D e t e c ti o n a n d

Classification

5.4.3.1 E m e r g e n c y O p e r a t i n g

Procedures

Prior to the accident at Three Mile Island,

plant emergency operating procedures were

"event-oriented." They described the steps

which the operator should take given the

oc curr enc e of c e rt a in pr e s e l e c t ed,

pre-analyzed events. These procedures were

typically limited to transient events or

loss-of-coolant events followed by successful

operation of all safety systems designed to

respond to these events.

Since the Three Mile Island accident,

considerable effort has been devoted to the

development of "symptom-based" procedures

to replace (or at least significantly augment)

the event-specific procedures. The basic

premise underlying these symptom-based

procedures is that there is a limited set of

critical safety functions (CSFs), which, if

successfully performed by either automatic

plant response or manual action, result in a

"safe" condition for the plant. The basic
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-3 NUREG/CR-6042 Rev. 2

goal of the plant safety systems and the

ultimate goal of operator actions is to ensure

the performance of these critical safety

functions. Symptom-based operating

procedures relate critical safety function

performance to specific plant/control room

instruments.

The attractiveness of the "critical safety

functions" concept evolves from the

implication that the operator need only

monitor a relatively few pieces of

information to ascertain the safety of the

plant. While there are a limited number of

critical functions (or parameters) which

indicate the performance of these functions,

there are virtually an unlimited number of

events (with a wide variety of symptoms)

that can affect the performance of these

functions. The operator can carry out his

duties by focusing on these critical functions

without regard to the specific events that

have occurred.

It is important to note that, in general, the

Emergency Operating Procedures address

actions that lead up to but do not include

actions to be taken after core damage.

Therefore, the operators may not have

procedures to help them once the core has

been damaged. However, as a result of

shortcomings identified in the Three Mile

Island accident, licensees have installed

additional instrumentation to detect

inadequate core cooling, developed core

condition assessment procedures, and

conducted training on core condition

assessment. These assessments are based on

the relationship of various plant instruments

(e.g., containment radiation monitor, reactor

water level indicator, core thermocouples,

etc.). These relationships must be used with

caution, but they do provide gross indicators

of the extent of core damage.

5.4.3.2 Emergency Action Levels

Licensees have established Emergency

Action Levels based on control room

instrument readings (e.g., 1000 R/h

containment monitor reading or 2000

F

thermocouple) that indicate the scope of an

emergency. NRC guidance requires that

Emergency Action Levels be established for

a full range of events from situations that

indicate just a potential problem to actual

core damage (General Emergency).

Emergency Action Levels are extremely

important. They are trigger levels for the

declaration of emergencies and the initiation

of predetermined activities that lead to

immediate, early actions (e.g., activation of

organization, notifications, and protective

actions).

Each licensee's emergency action plan

contains a list of Emergency Action Levels

which are used by the operators in assessing

the level of response needed. Most licensees

originally established their Emergency

Action Levels for each of the 60 example

initiating conditions provided in NUREG0654. In many cases, this results in a very

long list of diagnostic control room

parameters, as can be seen from the sample

shown in Table 5.4-1. Some licensees have

streamlined this approach by using flow

charts and other visual aids. A newer

symptomatic EAL classification scheme has

been developed by NUMARC and adopted

many licensees. In the NUMARC

methodology, generic recognition categories

replace individual analyses of multiple

NUREG-0654 initiating conditions.

Table 5.4-2 shows several examples of the

timing of boiling water reactor (BWR) core

damage accidents. These examples illustrate

that core damage could occur within a few

minutes or many hours. These are only

examples to show what might be typical of

the timing during an event and to

demonstrate how the ability to take early
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-4 NUREG/CR-6042 Rev. 2

action based on the exceeding of Emergency

Action Levels could provide sufficient time

to implement protective actions.

5.4.3.3 Emergency Classification System

Four classes of emergencies (Unusual Event,

Alert, Site Area Emergency, and General

Emergency) have been established by NRC

regulations. The class of emergency that is

declared is based on conditions that trigger

the Emergency Action Levels (EALs).

Typically, licensees have established for

each emergency class specific Emergency

Plan Implementation Procedures (EPIPs) that

are to be implemented by the control room

staff. The importance of correct

classification cannot be overemphasized.

The event classification initiates all

appropriate actions for that class. Both

over- and under-reaction could have serious

adverse consequences. The classification

procedures (i.e., Emergency Action Levels)

for specific nuclear power plants are

included in the emergency plans, which are

located in the Region Incident Response

Centers (IRCs) and the Headquarters

Operations Center.

Each class requires specific initial actions.

The classes and the appropriate initial

actions are discussed in more detail in the

following subsections.

5.4.3.3.1 Unusual Event

The rationale for establishing notification of

an "Unusual Event" as an emergency class is

to provide early and prompt notification of

minor events that could possibly lead to

more serious conditions. The purpose of

offsite notification is to

1. ensure that the first step in any

response later found to be

necessary has been carried out,

2. bring the operating staff to a state

of readiness,

3. provide systematic handling of

unusual events information and

decision making, and

4. control rumors.

5.4.3.3.2 Alert

An alert is declared if events are in progress

or have occurred that involve an actual (or

potential) substantial degradation of the level

of safety at the plant. Any radiological

releases are expected to be limited, so that

resulting exposures would be small fractions

of the U.S. Environmental Protection Agency

(EPA) Protective Action Guides.

The purpose of an alert is to

1. ensure that the onsite Technical

Support Center is activated so that

licensee emergency personnel are

readily available to respond,

2. provide offsite authorities with

information on the current status

of the event, and

3. provide assistance to the control

room staff.

5.4.3.3.3 Site Area Emergency

A site area emergency is declared if events

are in progress or have occurred that involve

actual or likely major failures of plant

functions needed for protection of the public.

Radiological releases, if any, are not

expected to result in doses exceeding

Environmental Protection Agency Protective

Action Guide levels, except possibly near the

site boundary.
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-5 NUREG/CR-6042 Rev. 2

The purpose of the Site Area Emergency

declaration is to

1. ensure that all emergency response

centers are manned,

2. e n s u r e t h a t r a d i o l o g i c a l

monitoring teams are dispatched,

3. ensure that personnel required to

aid in the evacuation of near-site

areas are at duty stations should

the situation become more serious,

4. provide consultation with offsite

authorities,

5. provide updates for the public

through offsite authorities, and

6. ensure that nonessential personnel

are evacuated.

5.4.3.3.4 General Emergency

A general emergency is declared if events

are in progress or have occurred that involve

actual or imminent substantial core

degradation or melting. Risks of exceeding

Environmental Protection Agency Protection

Action Guide exposure levels in more than

the immediate area are considerably

elevated. This is a very special case. A

General Emergency indicates that plant

conditions are well beyond design and early

protective actions are warranted.

The purpose of the General Emergency

declaration is to:

1. initiate predetermined protective

action notification to the public,

and

2. bring the full available resources

of government and industry to

bear on the situation.

5.4.3.3.5 Class Summaries and NUMARC

Recognition Categories

Summary descriptions of the four emergency

classes are provided in Table 5.4-3. A

summary of emergency classification actions

for the three major classes is presented in

Table 5.4-4. The number of emergencies

typically reported to the NRC in a year is

200 unusual events, 10 alerts, and 1 or 2 site

area emergencies. No general emergencies

have been declared since TMI-2.

Table 5.4-5 displays the relationship between

the four emergency classes and the

NUMARC recognition classes. By matching

the observed plant condition with the

recognition category descriptions on the left,

the applicable emergency class can be

determined. If the recognition category is

“Fission Product Barriers Failure or

Challenge,” plant-specific measurable values

indicating loss or potential loss of the

cladding, reactor coolant system, and

containment barriers are developed by the

licensee.

5.4.3.4 P r o t e c t i v e A c t i o n

Recommendations

As discussed earlier, within 15 min of

identifying a situation requiring urgent

action (General Emergency), the licensee

must recommend protective actions to offsite

officials. For situations requiring urgent

actions, recommended protective actions

should have been predetermined based on

discussions between the licensee and offsite

officials considering plant and local

conditions.

It is important to note that applications of

protective actions are site-specific. For

example, one plan may call for initial

evacuation out to 5 miles, while another

calls for initial evacuation out to 3 miles,
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-6 NUREG/CR-6042 Rev. 2

but the basic concept of prompt evacuation

of the area near the plant for a severe core

damage accident is met.

No predetermined actions are established for

site area emergencies and lesser events. The

specific actions for these lesser events would

be based on projected plant conditions,

offsite dose projections, and monitoring

conducted at the time.

5.4.4 Emergency Response Centers

5.4.4.1 Control Room

Authority to take action in the event of an

emergency must reside in the plant control

room until the Technical Support Center (see

Section 5.4.4.2) or the Emergency

Operations Facility (see Section 5.4.4.4) is

activated. This includes the authority to

declare emergencies, to notify offsite

officials within 15 minutes of general

emergency declaration, and to provide any

a p p r o p r i a t e p r o t e c t i v e a c t i o n

recommendations. The NRC must be

notified after the appropriate state and local

officials are notified and no later than one

hour after declaring the emergency.

Upon declaration of an emergency, most

sites designate an onsite Emergency

Director, who is in charge of the plant's total

response. During night and weekend hours,

this typically is the Shift Supervisor. Once

the appropriate augmentation staff arrive

following declaration of an emergency, this

responsibility (and title) normally transfers

to the Technical Support Center and then to

the Emergency Operations Facility.

5.4.4.2 Technical Support Center

There were indications from the events at

Three Mile Island that numerous personnel

in the control room acted to congest and

confuse the reactor operators' control room

activities. Review of this accident also

shows that there existed a lack of reliable

technical data and other records on which to

base accident recovery decisions. As a

result, today licensees are required to

establish Technical Support Centers whose

staff have access to plant technical

information and who are responsible for

engineering support of reactor operations

during an accident. Personnel in the

Technical Support Center must be able both

to assist the control room when needed and

to diagnose and mitigate an event. Until the

Emergency Operations Facility is activated,

the Technical Support Center will also

perform the functions of the Emergency

Operations Facility. The Technical Support

Center is located close to the control room

inside a protected and shielded area to allow

fast access for face-to-face discussions with

control room personnel.

5.4.4.3 Operations Support Center

The establishment of an Operations Support

Center was introduced to help relieve the

influx of shift/operational support personnel

in the control room. The function of the

Operations Support Center is to provide a

place to which shift personnel report to

receive further instructions from the

operations staff. The Operations Support

Center can be a locker room with capability

for reliable communications with supervisory

and decision-making personnel.

5.4.4.4 Emergency Operations Facility

Personnel with primary responsibility for the

licensee's response to a severe accident

situation are located in the Emergency

Operations Facility once it is activated. The

Emergency Operations Facility is an offsite

facility, which is usually near the site, with

hardening/shielding or a backup facility if

necessary. Figure 5.4-1 depicts the relative
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-7 NUREG/CR-6042 Rev. 2

locations of the licensee emergency response

centers.

The Emergency Operations Facility is

ge ne r a lly whe r e p r o t e c ti v e a c ti o n

recommendations would be formulated and

where the Emergency Director would be

located. Space is also provided for state and

local agencies. The Emergency Operations

Facility enables effective coordination of

onsite actions with those off site, and

provides a central location from which to

direct all offsite actions by the licensee (e.g.,

monitoring, sampling, and dose assessment).

5.4.4.5 Flow o f Autho r it y and

Responsibility

The responsibility and authority for licensee

actions during a severe nuclear power plant

accident start in the control room and then

flow out as people arrive to man the

Technical Support Center and the Emergency

Operations Facility. The licensee will

typically start transferring functions/

responsibilities/authorities out of the control

room as soon as possible so that control

room personnel can concentrate on bringing

the situation under control. Staffing the

Technical Support Center would typically

require about 30 minutes. About one hour

would be required to staff the Emergency

Operations Facility. NRC staff initially

attempting to contact licensee personnel

must be aware of how long the accident has

been under way to determine where their

contacts should be made. The Emergency

Network System (ENS) and Health Physics

Network (HPN) lines can be used to

determine where the appropriate licensee

representative is located.

5.4.5 Emergency Planning Zones

Plume and ingestion Emergency Planning

Zones have been established around each

nuclear reactor plant site. These Emergency

Planning Zones were established so that the

public can be notified to implement

appropriate protective actions in an efficient

and a timely manner in the event of a real

emergency.

5.4.5.1 Plume Exposure Emergency

Planning Zone

The plume exposure Emergency Planning

Zone is that area requiring possible

immediate action to reduce risk to the public

in the event of an accident. It is an area

approximately 10 miles in radius around the

power plant. This size is based primarily on

the following considerations:

1. Projected doses from the

tr ad iti o n a l de sign ba sis

accidents would not exceed

Environment al Protection

Agency Protective Action

Guide (PAG) levels outside the

zone.

2. Projected doses from most

core melt sequences would not

exceed Protective Action

Guide upper levels outside the

zone.

3. For the worst-case core-melt

sequences, immediate lifethreatening dos es would

generally not occur outside the

zone. (For most hypothesized

s e v e r e a c c i d e n ts, l if e -

threatening doses are not

predicted beyond 2 to 3 miles

from the plant.)

4. Detailed planning within 10

miles provides a substantial

base for expansion of response

efforts in the event that this

proves necessary.
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-8 NUREG/CR-6042 Rev. 2

It is unlikely that any immediate protective

actions would be required beyond the plume

exposure pathway Emergency Planning Zone.

The zone is sufficiently large that protective

actions within it provide for substantial

reduction in early health effects (injuries or

deaths) in the event of a worst-case core

melt accident.

The boundaries of the plume Emergency

Planning Zone take into account local

features such as roads, rivers, lakes,

peninsula, etc. that may extend the zone

beyond 10 miles. The boundaries are

selected to assure the existence of adequate

evacuation routes as illustrated in Figures

5.4-2 and 5.4-3.

Extensive provisions are made for action

within the Emergency Planning Zone. These

include:

1. provisions for prompt decision

making on protective actions for

the public by all responsible

parties,

2. development of evacuation plans,

3. provisions for informing the

public of emergency plans and

proc edur e s (i. e ., a publi c

education program),

4. provisions for promptly (within 15

min of the time that state and

local officials are notified)

alerting and informing the public

of the actions to be taken (e.g.,

siren system and radio messages),

5. provisions for maintaining 24-hr

communication between the

licensee and state and local

officials,

6. provisions for radiological

monitoring in the event of an

offsite radioactivity release, and

7. provisions for activating and

maintaining emergency operations

centers.

5.4.5.2 Ingestion Pathway Emergency

Planning Zone

The ingestion pathway Emergency Planning

Zone is the area in which plans exist for

protecting the public from the consumption

of food contaminated with radioactive

material and for which there is considerable

time (hours to days) for action to reduce

risks. Thus, the level of preparation is much

less in this Emergency Planning Zone than it

is in the plume exposure pathway Emergency

Planning Zone. Also, the preparations that

are made for this Emergency Planning Zone

are typically effected at the state level rather

than at the local level.

In this Emergency Planning Zone, the

concern is for the interdiction of foodstuffs

rather than the avoidance of exposure to the

plume itself. Protective actions within this

zone would generally include the restriction

of grazing animals to stored feed and

restrictions on crop consumption and water

usage. The area of this Emergency Planning

Zone generally encompasses a 50-mile radius

around the plant site. The size of the

ingestion exposure Emergency Planning

Zone (about 50 miles in radius, which also

includes the 10-mile radius plume exposure

Emergency Planning Zone) was selected for

the following reasons:

1. The downwind range within

which contamination will

generally not exceed the

Protective Action Guides is

limited to about 50 miles from

a power plant because of wind
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-9 NUREG/CR-6042 Rev. 2

shifts during the release and

travel periods.

2. There may be conversion of

atmospheric iodine (i.e., iodine

suspended in the atmosphere

for long time periods) to

chemical forms that do not

readily enter the ingestion

pathway.

3. Much of any particulate

material in a radioactive plume

would be deposited on the

ground within about 50 miles

of the facility.

4. The likelihood of exceeding

ingestion pathway Protective

Action Guide levels at 50

miles is comparable to the

likelihood of exceeding plume

exposure pathway Protective

Action Guide levels at 10

miles.

Except for the most severe accidents,

immediate action is not critical for food and

agricultural produce because of the

additional time involved when compared to

the time frame associated with the plume

exposure Emergency Planning Zone.

Preplanned actions for the ingestion pathway

Emergency Planning Zone ordinarily will be

implemented by local agencies at the

direction of state agencies.

5.4.6 Response of State and Local

Organizations

5.4.6.1 Emergency Response Plans

States and local agencies have formulated

written emergency response plans in

response to NRC and Federal Emergency

Management Agency (FEMA) requirements.

These documents (1) describe the procedures

that state and local officials will follow in

the event of a nuclear power plant

emergency and (2) list the responsibilities of

each state and local agency involved. In

most states, the authority to recommend

protective actions to the public resides with

local not state authorities.

5.4.6.2 Public Notification

The licensee must notify offsite state and

local organi z ations responsible for

implementing protective actions within 15

minutes of the declaration of an emergency.

This permits offsite officials to make prompt

protective action decisions, to provide an

alerting signal (e.g., a siren), and to follow

the signal by a message via the local radio

station as to what actions the public should

take. State and local officials have

predetermined the criteria that they will use

to make protective action decisions. These

criteria should have been coordinated with

the recommendations made to local agencies

by the licensee.

In most cases, the specific protective action

criteria for severe core damage accidents

have been developed after consideration of

plant and local conditions. For example, the

areas planned to be evacuated may be

confined to a valley around the site, or the

specific evacuation sector boundaries may be

determined by local roads. This delineation

is done so that the local population can

understand the evacuation instructions.

As discussed in Sections 5.2.6 and 5.4.3,

current NRC guidance calls for prompt

offsite protective actions on detection of

actual or imminent core damage (before dose

assessment). Earlier guidance caused many

state and local agencies to rely primarily on

projected dose assessments. The currently

envisioned role for dose assessment during

an emergency is discussed in Section 5.2.8.
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-10 NUREG/CR-6042 Rev. 2

A flow chart showing the typical steps from

detection of an event in the power plant

control room (CR) to notification of the

public is shown in Figure 5.4-4. Note that

the offsite officials generally make decisions

based on licensee recommendations, which

are, in turn, based on criteria discussed and

agreed to in advance. However, conditions

that exist off-site (e.g., ice storm, blocked

highway, bridge out, etc.) might alter

implementation of the licensee's recommendation.

5.4.6.3 Evacuation Time Estimates

Licensees are required to develop evacuation

time estimates for the plume-exposure

Emergency Planning Zone (10-mile radius).

These estimates are based on various models

and must be used with caution. These

models have not been validated against

evacuations and are subject to large

uncertainties.

Often, the evacuation time estimates are

dominated by assumptions of how long it

will take to notify people and for them to get

ready to leave. Sometimes it is assumed that

it will take an hour or more for preevacuation preparation. Actual experience

has shown, however, that, if people are told

and motivated to "go now," most will follow

instructions and most will evacuate very

rapidly. Except for special cases where

there is a large population near the site (i.e.,

Zion and Indian Point) or where there is

some special population (e.g., hospital

patients), it should be possible to evacuate

the area near the site in 1 hour or less.

Because of the NRC's siting criteria, there is

a limited population (<300 people) within 2

miles of most sites. In these cases, the

capacity of the local roads will be great

enough so as not to delay an evacuation.

5.4.6.4 Dose Projections and Field

Monitoring

Dose projection models used by offsite

officials are generally similar to those used

by the licensee and have the same limitations

as other dose models. The only source of

release estimates is from the licensee.

Therefore, while offsite officials can confirm

(check) licensee transport calculations, they

must rely on the licensee's release estimates.

Because of the complex processes involved

in a core melt scenario, the source term

(release) estimate would be highly uncertain

early in an event. Offsite monitoring

capabilities vary markedly, from excellent to

marginal depending on the state's emphasis

on developing an independent capability. In

some situations, offsite officials rely on the

licensee or the responding federal agencies

(e.g., DOE, EPA, and NRC) for monitoring

information.

5.4.6.5 Location of Authority and

Responsibility

During the initial phase of the event, the

specific location of the local offsite officials

with the authority and responsibility to take

action varies. The communications system

between the licensee and offsite officials

should accommodate this need. This is very

site- and/or state-specific. In some cases,

there are duty officers and 24-hr manned

centers, and in others there are local police

stations. Once the local emergency

organization has been activated, it will

establish a local Operations Center. It

should be noted that at some sites there are

several (2 to 20) local governments within

the plume Emergency Planning Zone and

that each might have a center.

At the state level, there are typically two

levels of activity of interest: (1) an organization that is responsible for conducting

technical assessments (e.g., dose assessment)

of the situation and (2) decision makers

(e.g., governor). These functions may be

performed at two separate locations
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-11 NUREG/CR-6042 Rev. 2

(centers). The NRC must coordinate its

contact with offsite officials to avoid

considerable confusion resulting from

carrying out discussions with both groups.

The licensee or state emergency plans should

be consulted to determine the specific

emergency organization's locations.
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-12 NUREG/CR-6042 Rev. 2

Table 5.4-1 Sample initiating condition and examples of

accompanying Emergency Action Levels

Initiating condition No. 1 Emergency Action Levels

Known loss of coolant

accident (LOCA) greater

than makeup pump

capacity

Low reactor water level (-134 in.) on level/pressure

recorder 1B21-R623B panel 1H12-P601

or

High drywell pressure (+1.8 lb) on pressure indicators

CM010 and/or CM021, panel 1PM06J

with

Water level below (and failure to return to) top of active

fuel as indicated on fuel zone level indicator 1B21-

R6210, panel 1H13-P601 (-150in. +50 in. range with "0"

corresponding to top of active fuel), following a time

delay of 3 min

Table 5.4-2 Example of timing for BWR general emergency

sequences

Timing of event (hr)

TWa TQUV

b AEc S2

J

d

Unusual event 0.017

Alert 0.33 0.17

Site Area Emergency 1 0.5

General Emergency (protective actions

recommended)

1 to 3 0.17 0.17 3+

Core damage 18 1 0.17 29

Containment failure

e

Leak 16 3 0.25

Major 21 5 3 20

aReactor shutdown followed by loss of decay heat removal.

bReactor shutdown followed by loss of ability to provide coolant water.

cLarge loss of coolant and failure of system to replace water.

dSmall loss of coolant and loss of long-term heat removal.

eAssuming isolation.
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-13 NUREG/CR-6042 Rev. 2

Table 5.4-3 Emergency class descriptions

Class

a Core status Radiation

Unusual Event No threat to irradiated fuel No release above technical

specification (or annual limits)

Alert Actual (or potential for)

substantial degradation of

safety

Release is small fraction of

EPA Protection Action

Guidelines (PAGs) beyond the

site boundary

Site Area

Emergency

Major failures of functions

needed for public protection

Release is less than EPA PAGs

beyond the site boundary

General

Emergency

Actual or imminent core

degradation

Dose may exceed EPA PAGs

beyond the site boundary

aClassifications are based on plant instrument levels (i.e., Emergency Action Levels).
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-14 NUREG/CR-6042 Rev. 2

Table 5.4-4 Emergency class response

Class

a Plant action Local and state agency action

Unusual

event

Provide notification Be aware

Alert Mobilize plant resources; man

centers (help for control room)

Stand by

a

Activate Technical Support Center

(TSC)

Site Area

Emergency

Full mobilization; nonessential site

personnel evacuate

Mobilize; Man emergency

centers and dispatch Monitoring

Team

Activate TSC, Operations Support

Center, and Emergency Operations

Facility

Inform public, activate warning

system

Dispatch monitoring team

Provide dose assessments

Take protective actions in

accordance with PAGs or on an

ad hoc basis

General

Emergency

Full mobilization; recommend

predetermined protective actions

(within 15 min) after declaring

emergency

Recommend predetermined

protective actions to the public

based on plant conditions

Precautionary evacuation

(2 to 5 miles)

aThe NRC will typically begin staffing its response centers at the Alert level and may be expected

to go to "stand by" or "initial activation."
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-15 NUREG/CR-6042 Rev. 2

Table 5.4-5 Emergency Class vs. Recognition Categories

Recognition Categories

Emergency

Class

 




  


    


 





  



 
  !

"#$ 
 


 %
& 

 !  


%&
  

'  !  
 ( %



)* 
$)%(++,

) * *!
 -  

./ 



 


0 12

3%  0 4+ /

*
5!

 6



 
 


 



&   


 


) 7 8 





  
 




/


  
 // ) 

 $9 9:  / 8 

/





 35  /

-  8 

  %


 !/ 
 %
&


;$


8 
 %
  !/ 

/

 
  

8 
 & 8 /

  
 ; 


 
  0 9:

/

6&  

 

.<

%$8 ; 3$% /

*!
  %
&

%&/   0

9: /


  8 
/


% 
=
/

*!
  

 !&/

*!
  
/

8  ;/ 8   %$8

 


/


 Unplanned Gas or

Liq. Release to

Environment > 200 X

TS for > 15 min.

Major Damage to

Irradiated Fuel. Loss

of Water Level

Uncovers Fuel

Outside RV.

Increase in Plt Rad or

Airborne Levels

Impedes Sys. Ops or

Ability to Maintain

cold S/D.

Any Loss or Potential

Loss of Either Fuel

Clad or RCS.

Natural & Destructive

Phenomena in Plt. Vital

Areas.

Safety Sys. Req’d. For Safe

S/D Affected By Fire or

Explosion. Release of

Toxic/Flammable Gas

Jeopardizes Sys. Op. Safe

S/D. Security Event in P.A.

Control Room Evac Initiated.

Other Conditions Warrant

Declaration by ED.

Loss of All On/Offsite AC

to Essential Busses, Cold

S/D, Refueling. Failure

RPS to Scram & Manual

Scram Successful.

Inability to Maintain Cold

S/D. Unplanned Loss of

All Safety Sys. Annun.,

Transient in Progress. AC

Pwr. Loss, Only One Source

Feed Essen. Busses, > 15

min.

SAE Site Boundary Dose

(actual or projected)

Exceeds 100 mRem

W.B. or 500 mRem

Child Thryoid.

Loss of Fuel Clad and

RCS. Potential Loss of

Fuel Clad and RCS.

Potential Loss of Fuel

Clad or RCS + Loss of

Any Additional Barrier.

Security Event, Plt. Vital

Area. CR Evac. Initiated, Plt.

Control Cannot be

Established. Other

Conditions Warrant

Declaration By ED.

Loss of All AC Pwr.

Failure EPS to Scram &

Manual Scram

Unsuccessful. Loss of all

Vital DC Pwr. Loss of

functions Req’d to maintain

Hot S/D. Loss of RV Water

Level Req’d to Cover Fuel.

Inability to Monitor

Significant Transient in

Progress.

GE Site Boundary Dose

(actual or imminent)

Exceeds 1 Rem.W.B

or 5 Rem Child

Thyroid for

Actual/Proj. Duration

Release, Actual

Meteorology.

Loss of Any Two

Barriers and Potential

Loss of Third Barrier.

Any core melt

sequence.

Security Event, Cannot

Reach/Maintain Cold S/D.

Other Conditions Warrant

Declaration by ED.

Prolonged Loss of AC Pwr.

Failure RPS to Scram &

Manual Scram Unsuccessful

& Extreme Challenge to

Core Cooling.
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-16 NUREG/CR-6042 Rev. 2

Figure 5.4-1 Relative locations of licensee emergency response centers
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-17 NUREG/CR-6042 Rev. 2

Figure 5.4-2 Example of a plume emergency planning zone with boundaries

and evacuation routes determined by roads
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-18 NUREG/CR-6042 Rev. 2

Figure 5.4-3 Example of a plume emergency planning zone (boundaries are

determined by natural features)
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-19 NUREG/CR-6042 Rev. 2

Figure 5.4-4 Flowchart showing steps from detection of a general emergency

event in the control room to public evacuation
Reactor Safety Course (R-800) 5.4 Emergency Preparedness

USNRC Technical Training Center 5.4-20 NUREG/CR-6042 Rev. 2

1. U.S. Nuclear Regulatory Commission and

Federal Emergency Management Agency,

“Criteria for Preparation and Evaluation of

Radiological Emergency Response Plans and

Preparedness in Support of Nuclear Power

Plants,” NUREG-0654, FEMA-REP-1, Rev.

1, November 1980.

2. H. E. Collins, B. K. Grimes, and F. Galpin,

“Planning Basis for the Development of State

and Local Government Radiological

Emergency Response Plans in Support of

Light Water Nuclear Power Plants,” NUREG0396/EPA 520/1-78-016, 1978.

3. D. C. Aldrich, P. McGrath, and N. C.

Rasmussen, “Examination of Offsite

Radiological Emergency Protective Measures

for NuclearReactor AccidentsInvolvingCore

Melt,” NUREG/CR-1131, SAND78-0454,

1978.

4. U.S. Nuclear Regulatory Commission

Information Notice (IN) 83-28, “Criteria for

Protective Action Recommendations for

General Emergencies,” May 1983.

5. U.S. Nuclear Regulatory Commission,

“Clarification of TMI Action Plan

Requirements: Requirements for Emergency

Response Capability,” NUREG-0737, Supp.

1, No. 1, Washington, D.C., January 1983.

6. T. J. McKenna, et al., “Pilot Program: NRC

Severe Reactor Accident Incident Response

TrainingManual,”NUREG-1210, Volumes 1-

5, December, 1990.

7. U.S. NuclearRegulatoryCommission, “RTM96, Response Technical Manual,”

NUREG/BR-0150, Revision 4, March 1996.

References for Section 5.4