EVENT SEQUENCE ANALYSIS

1. IAEA.PNRA.05.05 Stetkar & Associates 1 EVENT SEQUENCE ANALYSIS by John W. Stetkar Presented to National Training Course on Probabilistic Safety Assessment Islamabad, Pakistan May 2 - 6, 2005 IAEA Project C7-PAK/9/028-001

2. IAEA.PNRA.05.05 Stetkar & Associates 2 LEVEL 1 PSA EVENT SEQUENCE INITIATING EVENT PLANT THERMAL / HYDRAULIC RESPONSE FUNCTIONAL SUCCESS CRITERIA MITIGATING SYSTEMS OPERATOR ACTIONS INDUCED / CONSEQUENTIAL IMPACTS CORE DAMAGE END STATES / LEVEL 2 PSA INTERFACE

3. IAEA.PNRA.05.05 Stetkar & Associates 3 SUCCESS CRITERIA

4. IAEA.PNRA.05.05 Stetkar & Associates 4 CRITICAL SAFETY FUNCTIONS CORE REACTIVITY CONTROL REACTOR COOLANT SYSTEM BOUNDARY INTEGRITY / COOLANT INVENTORY CONTROL CORE DECAY HEAT REMOVAL CONTAINMENT INTEGRITY

5. IAEA.PNRA.05.05 Stetkar & Associates 5 WHAT IS "CORE DAMAGE"? IMPORTANT TO CLEARLY DEFINE CORE DAMAGE FOR LEVEL 1 PSA THERMAL / HYDRAULIC SUCCESS CRITERIA SCENARIO TIMING INTERFACE WITH LEVEL 2 PSA MODELS TYPICAL LEVEL 1 PSA CORE DAMAGE CRITERIA SUSTAINED CORE UNCOVERY (e.g., COOLANT LEVEL BELOW CORE MID-PLANE) PEAK CLADDING TEMPERATURE > 1200 �C

6. IAEA.PNRA.05.05 Stetkar & Associates 6 WHAT IS "CORE DAMAGE"? ADDITIONAL REFINEMENTS IN LEVEL 2 PSA LOCALIZED CLADDING OXIDATION > 17% DURING OR AFTER QUENCHING CLADDING REACTION WITH WATER OR STEAM > 1% OF TOTAL ZIRCALLOY INVENTORY LOSS OF COOLABLE CORE GEOMETRY ONSET OF CORE MATERIAL RELOCATION

7. IAEA.PNRA.05.05 Stetkar & Associates 7 WHAT IS "CORE DAMAGE"? DIFFICULT TO DEFINE FOR CHANNEL-TYPE REACTORS (CANDU, RBMK, AGR, MAGNOX, ETC.) SINGLE CHANNEL MULTIPLE CHANNELS SINGLE QUADRANT HALF OF CORE ENTIRE CORE DIFFICULT TO DEFINE FOR SOME PLANT OPERATING STATES IN SHUTDOWN PSAs "PARTIAL CORE DAMAGE" MAY BE IMPORTANT FOR SOME OFFSITE RELEASE CATEGORIES

8. IAEA.PNRA.05.05 Stetkar & Associates 8 SUCCESS CRITERIA DESIGN / FSAR / LICENSING CRITERIA TYPICALLY VERY CONSERVATIVE � NOT APPROPRIATE FOR REALISTIC PSA BEST-ESTIMATE PLANT-SPECIFIC THERMAL / HYDRAULIC ANALYSES USUALLY NOT NECESSARY TO RUN DETAILED CODES FOR ALL SUCCESS CRITERIA (e.g., RETRAN, MAAP, ETC.) "FIRST PRINCIPLES" MASS AND ENERGY BALANCE MORE IMPORTANT TO EXAMINE RANGE OF SCENARIO-SPECIFIC CONDITIONS THAN TO CALCULATE PRECISE ANSWER FOR ONLY ONE CONDITION

9. IAEA.PNRA.05.05 Stetkar & Associates 9 EVENT TREES DISPLAY SEQUENCE PROGRESSION DISPLAY SEQUENCE END STATES DISPLAY SEQUENCE-SPECIFIC DEPENDENCIES FUNCTIONAL (SUCCESS CRITERIA) PHYSICAL (SYSTEMS) HUMAN IMPROVED UNDERSTANDING OF MODELS ANALYSTS / USERS PLANT PERSONNEL REVIEWERS

10. IAEA.PNRA.05.05 Stetkar & Associates 10 EVENT TREE STYLES "SMALL EVENT TREE / LARGE FAULT TREE" MODEL SIMPLE EVENT TREE LOGIC EVENT TREES FOCUS ON BASIC SAFETY FUNCTIONS COMPLEX FAULT TREE LOGIC SOPHISTICATED FAULT TREE MODELS REQUIRED TO ACCOUNT FOR SCENARIO-SPECIFIC DEPENDENCIES "LARGE EVENT TREE / SMALL FAULT TREE" MODEL MORE COMPLEX EVENT TREE LOGIC EVENT TREE CONTAINS FUNCTIONS, SYSTEMS, OPERATOR ACTIONS SIMPLER FAULT TREE LOGIC EVENT TREE BRANCHING CONDITIONS ACCOUNT FOR SCENARIO-SPECIFIC DEPENDENCIES

11. IAEA.PNRA.05.05 Stetkar & Associates 11 TANSTAAFL"THERE AIN'T NO SUCH THING AS A FREE LUNCH" SAME BOOLEAN LOGIC AND COMPLEXITY REQUIRED FOR REALISTIC MODEL OF ALL POTENTIAL SCENARIOS EVENT TREE / FAULT TREE LOGIC FUNCTIONALLY EQUIVALENT - COMPARATIVE STUDIES CONFIRM SAME RESULTS LARGELY A MATTER OF STYLE AND ANALYST COMFORT OFTEN EASIER TO VISUALIZE COMPLEX SCENARIO-SPECIFIC CONDITIONS IN EVENT TREE FORMAT BEST APPROACH IS USUALLY "MEDIUM EVENT TREE / MEDIUM FAULT TREE" MODEL

12. IAEA.PNRA.05.05 Stetkar & Associates 12 EVENT TREE DEVELOPMENT EVALUATE ALL REQUIRED MITIGATION FUNCTIONS SPECIALIZED EVENT TREE LOGIC FOR EACH INITIATING EVENT GROUP TOP EVENTS USUALLY ARRANGED IN APPROXIMATE TIME SEQUENCE OF NORMAL EVENT PROGRESSION EXAMPLE REACTOR TRIP TURBINE TRIP STEAM RELIEF FEEDWATER SUPPLY REACTOR COOLANT INVENTORY CONTROL LONG-TERM CORE DECAY HEAT REMOVAL COOLING

13. IAEA.PNRA.05.05 Stetkar & Associates 13 EVENT TREE DEVELOPMENT(continued) DEFINE OPERATOR ACTIONS DURING EVENT MODEL DEVELOPMENT � NOT A SEPARATE PSA TASK ACCOUNT FOR SCENARIO-SPECIFIC SUCCESS CRITERIA AND TIMING ACCOUNT FOR INDUCED / CONSEQUENTIAL FAILURES EXAMPLES INSUFFICIENT STEAM RELIEF ? LOSS OF SECONDARY HEAT REMOVAL STEAM RELIEF FAILS TO RECLOSE ? OVERCOOLING INSUFFICIENT PRIMARY PRESSURE RELIEF ? REACTOR COOLANT PIPING OR VESSEL FAILURE PRIMARY RELIEF FAILS TO RECLOSE ? LOCA

14. IAEA.PNRA.05.05 Stetkar & Associates 14 INDUCED / CONSEQUENTIAL IMPACTS

15. IAEA.PNRA.05.05 Stetkar & Associates 15 TRANSIENT-INDUCED IMPACTS LOCAs PRIMARY OVERPRESSURE STUCK-OPEN RELIEF / SAFETY VALVES REACTOR COOLANT PUMP SEAL FAILURE MAKEUP / LETDOWN OVERCOOLING SECONDARY OVERPRESSURE STUCK-OPEN RELIEF / SAFETY VALVES ATWS OPERATOR ACTIONS

16. IAEA.PNRA.05.05 Stetkar & Associates 16 TRANSIENT-INDUCED LOCAs ADD TO LOCA INITIATING EVENT FREQUENCY LOSE ACTUAL INITIATING EVENT INFORMATION LOSE DEPENDENCIES SIMPLIFIED EVENT TREES SIMPLIFIED SYSTEM MODELS ADD SEPARATE EVENT TREE TOP EVENT RETAIN DEPENDENCIES EVENT TREES MORE COMPLEX INTERFACE WITH SYSTEMS MORE COMPLEX BETTER UNDERSTANDING OF MODELS / RESULTS

17. IAEA.PNRA.05.05 Stetkar & Associates 17 OVERCOOLING SCENARIOS PRESSURIZED THERMAL SHOCK (PTS) MAY BE SIGNIFICANT PLANT-SPECIFIC PROBLEM TYPICALLY MORE IMPORTANT FOR OLDER PLANTS VESSEL WELD MATERIAL DOCUMENTATION AND INSPECTIONS AUTOMATIC SIGNALS SECONDARY ISOLATION (STEAM AND/OR FEED) SAFEGUARDS ACTUATION AFFECT SEQUENCE PROGRESSION AFFECT AVAILABLE SYSTEMS

18. IAEA.PNRA.05.05 Stetkar & Associates 18 ATWS SCENARIOS REACTOR SHUTDOWN SUCCESS CRITERIA SIGNAL FAILURES (REACTOR PROTECTION SYSTEM) MECHANICAL FAILURES (CONTROL RODS) ALTERNATE SHUTDOWN OPTIONS TIME WINDOW SUCCESS CRITERIA AVAILABLE SYSTEMS OPERATOR ACTIONS

19. IAEA.PNRA.05.05 Stetkar & Associates 19 ATWS MODELS CORE NUCLEAR POWER PRIMARY / SECONDARY ENERGY BALANCE FEEDWATER SUCCESS CRITERIA PRIMARY PRESSURE RESPONSE ENERGY RELEASE INTO CONTAINMENT

20. IAEA.PNRA.05.05 Stetkar & Associates 20 OPERATOR ACTIONS

21. IAEA.PNRA.05.05 Stetkar & Associates 21 OPERATOR ACTIONSAFTER INITIATING EVENT ACTIONS REQUIRED BY EMERGENCY OPERATING PROCEDURES USE OF ALTERNATE EQUIPMENT REALIGNMENT OF SYSTEMS MANUAL BACKUP TO AUTOMATIC SIGNALS REPAIR / RECOVERY OF FAILED EQUIPMENT NO FUNDAMENTAL DIFFERENCE BETWEEN "PROCEDURE-DIRECTED" ACTIONS AND "RECOVERY" ACTIONS

22. IAEA.PNRA.05.05 Stetkar & Associates 22 ELEMENTS OF A HUMAN ACTION IDENTIFICATION DIAGNOSIS COGNITIVE DECISION RESPONSE IMPLEMENTATION

23. IAEA.PNRA.05.05 Stetkar & Associates 23 HUMAN BEINGS ARE NOT HARDWARE HUMAN RELIABILITY CANNOT BE EVALUATED OUT OF CONTEXT HUMAN PERFORMANCE DEPENDS ON THE ENTIRE HISTORY OF ACCUMULATED KNOWLEDGE, EXPERIENCE, TRAINING, GUIDANCE, AND INFORMATION UNTIL THE TIME OF RESPONSE HUMANS INTERPRET THE INFORMATION THAT THEY RECEIVE, EVALUATE ITS RELEVANCE AND MEANING, FORM A CONCLUSION, AND RESPOND INFORMATION, INTERPRETATION, AND DECISION DEPEND ON THE SCENARIO CONTEXT

24. IAEA.PNRA.05.05 Stetkar & Associates 24 SCENARIO-BASED PERSPECTIVE PSA MODELS CONTAIN VERY LARGE NUMBERS OF INDIVIDUAL SCENARIOS ("SEQUENCES", "CUTSETS", ETC.) IDENTIFY IMPORTANT DIFFERENCES THAT AFFECT HUMAN RESPONSE GROUP SCENARIOS AND DEFINE PSA ACTIONS BASED ON SUCCESS CRITERIA AND BOUNDARY CONDITIONS FOR HUMAN PERFORMANCE MANUAL START OF STANDBY EQUIPMENT IS A SCENARIO-BASED COGNITIVE ACTION

25. IAEA.PNRA.05.05 Stetkar & Associates 25 SCENARIO-BASED CONSIDERATIONS INITIATING EVENT AVAILABLE TIME WINDOW AVAILABLE EQUIPMENT CUES, INDICATIONS, AND ALARMS PROCEDURES, TRAINING, AND EXPERIENCE COMPETING PRIORITIES PREVIOUS OPERATOR ACTIONS (SUCCESSES AND FAILURES)

26. IAEA.PNRA.05.05 Stetkar & Associates 26 IDENTIFY / DISPLAY HUMAN DEPENDENCIES PSA MODELS SHOULD: DISPLAY OPERATOR ACTIONS IN SCENARIO CONTEXT IDENTIFY ALL CONDITIONS WHERE OPERATOR ACTIONS ARE COMBINED THROUGH "AND" LOGIC DIFFICULT TO IDENTIFY SCENARIO CONTEXT AND COMBINED ACTIONS IN FAULT TREE FORMAT USUALLY REQUIRES MODEL SOLUTION NUMERICAL VALUES MAY SUPPRESS CUTSETS "SCREENING VALUES" MAY BE OPTIMISTIC EVENT TREE FORMAT GENERALLY BETTER DEFINES SCENARIO CONTEXT IDENTIFIES COMBINED ACTIONS

27. IAEA.PNRA.05.05 Stetkar & Associates 27 OPERATOR ACTIONS IN FAULT TREES ADVANTAGES SIMPLER EVENT TREES DISADVANTAGES MORE COMPLEX FAULT TREES MORE DIFFICULT FOR ANALYSTS TO IDENTIFY SCENARIO-SPECIFIC DEPENDENCIES HOUSE EVENTS OR SPECIAL LOGIC TO DEFINE CONDITIONS FOR CORRECT ACTIONS GENERAL EXPERIENCE FROM REVIEWS POOR TREATMENT OF OPERATOR ACTIONS OPTIMISTIC QUANTIFICATION OF COMBINED ERRORS

28. IAEA.PNRA.05.05 Stetkar & Associates 28 OPERATOR ACTIONS IN EVENT TREES ADVANTAGES SIMPLER FAULT TREES EASIER FOR ANALYSTS TO IDENTIFY SCENARIO-SPECIFIC DEPENDENCIES DISADVANTAGES MORE COMPLEX EVENT TREES BRANCH POINT CONDITIONS TO DEFINE CORRECT ACTIONS GENERAL EXPERIENCE FROM REVIEWS IMPROVED TREATMENT OF OPERATOR ACTIONS REALISTIC QUANTIFICATION OF COMBINED ERRORS

29. IAEA.PNRA.05.05 Stetkar & Associates 29 PLANT DAMAGE STATES

30. IAEA.PNRA.05.05 Stetkar & Associates 30 PLANT DAMAGE STATES (PDS) DEFINE INTERFACE BETWEEN PLANT ANALYSIS (LEVEL 1 PSA) AND CONTAINMENT ANALYSIS (LEVEL 2 PSA) PLANT DAMAGE STATES ARE "INITIATING EVENTS" FOR LEVEL 2 PSA COLLECT LEVEL 1 EVENT SEQUENCES WITH SIMILAR CONTAINMENT RESPONSE "LEVEL 1+" PSA EXTENDS MODELS TO INCLUDE CORE DAMAGE SEQUENCES AND CORRESPONDING PLANT DAMAGE STATES (INTERNATIONAL PSA TERMINOLOGY)

31. IAEA.PNRA.05.05 Stetkar & Associates 31 PLANT DAMAGE STATE PARAMETERS REACTOR COOLANT SYSTEM PRESSURE STEAM GENERATOR HEAT REMOVAL WATER INJECTION CORE DEBRIS COOLING / CONTAINMENT HEAT REMOVAL FISSION PRODUCT REMOVAL CONTAINMENT ISOLATION

32. IAEA.PNRA.05.05 Stetkar & Associates 32 TIMING CONSIDERATIONS SOME PSAs DISTINGUISH BETWEEN CONDITIONS AT TIME OF CORE DAMAGE AND AT TIME OF VESSEL FAILURE SOME PSAs DISTINGUISH BETWEEN "EARLY" AND "LATE" CORE DAMAGE SCENARIOS "EARLY" OFTEN ASSOCIATED WITH LOSS OF SECONDARY COOLING OR LOCAs WITH INJECTION FAILURE "LATE" OFTEN ASSOCIATED WITH LOSS OF RHR COOLING OR RECIRCULATION FAILURE "LARGE EARLY RELEASE FREQUENCY" (LERF) IMPORTANT FOR SOME RISK-INFORMED APPLICATIONS MANY PSAs DO NOT INCLUDE TIME AS A PLANT DAMAGE STATE PARAMETER