scope:

SCOPE AND APPLICABILITY

This Standard states requirements for a Level 1 PRA of internal and external hazards while at-power for the evaluation of core damage frequency (CDF). In addition, this Standard states requirements for a limited Level 2 PRA sufficient to evaluate large early release frequency (LERF). The only hazards explicitly excluded from the scope are accidents resulting from purposeful human-induced security threats (e.g., sabotage, terrorism). These requirements are written for operating LWR power plants (i.e., plants with designs and features similar to the plants operating when this Standard was published). They may be used for LWR plants under design or construction or for advanced LWRs, but revised or additional requirements may be needed.

Treatment of Hazard Groups

This Standard states specific requirements for the following hazard groups:

(a) Internal Events (Part 2)

(b) Internal Floods (Part 3)

(c) Internal Fires (Part 4)

(d) Seismic Events (Part 5)

(e) High Winds (Part 7)

(f) External Floods (Part 8)

(g) Other Hazards (Part 9)

Many of the technical requirements in Part 2 are fundamental requirements for performing a PRA for any hazard group and are therefore relevant to Part 3, Part 4, Part 5, Part 6 (for external hazard screening), Part 7, Part 8, and Part 9 of this Standard. They are included by reference in those requirements that address the development of the plant response to the damage states created by the hazard groups addressed in Part 3, Part 4, Part 5, Part 6, Part 7, Part 8, and Part 9. Their specific allocation to Part 2 is partially a historical artifact of the way this PRA Standard was developed, with the at-power internal-events (including internal floods) requirements being developed first, and those of the remaining hazard groups being developed later. However, it is also a reflection of the fact that a fundamental understanding of the plant response to a reasonably complete set of initiating events (as defined in Section 1-2.2) provides the foundation for modeling the impact of various hazards on the plant. Thus, even though Part 2 is given a title associated with the internal-events hazard group, it is understood that the requirements in this Part are applicable to all the hazard groups within the scope of the PRA.

Hazards and Initiating Events

In using this Standard, it is necessary to understand the relationship among "hazard group," "hazard," "hazard event," and "initiating event," which are defined in Section 1-2.2.

In general, there is a range of hazard events associated with any given hazard, and, for analysis purposes, the range can be divided into bins characterized by their severity. Hazard events of different severity can result in different initiating events.

Consider the internal-events hazard group, as this group provides the fundamental understanding of plant response. As noted above, this hazard group includes several hazards, such as transients and loss of coolant accidents (LOCAs), which can be considered as generic hazards.

For transients, different transient events, such as reactor trip and loss of feedwater, can be identified in terms of the different demands they place on critical safety functions; these demands characterize the events' severity.

For LOCAs, the LOCA events applicable to the plant design might be the large LOCA, medium LOCA, small LOCA, and so forth. The small LOCA leading to plant trip on low pressure or low level is a specific binning within the range of the generic type of hazard associated with LOCAs.

Because the internal-events hazard group serves as the fundamental basis for the plant model, the terms "hazard events" and "initiating events" are synonymous, and this structure forms the primary consideration for the remaining hazard groups.

For the remaining hazard groups, the terms "hazard event" and "initiating event" are not synonymous. Rather, a hazard event is identified as the cause of an initiating event by virtue of the effect it has on the plant. The assessment of the effect on the plant defines the reason for the plant trip as well as any additional failures and provides the starting point for the analysis of the plant response. Therefore, in keeping with the definition of "initiating event," for the occurrence of a given hazard event, the initiating event (or events, as more than one outcome may be possible) is (are) a perturbation of the steady-state operation of the plant that challenges plant control and safety systems whose failure could potentially lead to core damage.

For example, consider the earthquake hazard group, which involves only one hazard, that is, earthquakes are the hazard and also the hazard group. This hazard (earthquakes) can be defined in terms of a range of seismic (hazard) events (e.g., 0.1g, 0.3g, 0.5g, >0.75g) and their associated spectral shapes and time histories. The assessment of the potential initiating events resulting from each hazard event is made based on an assessment of the impact of the seismic hazard event on the plant. So, for example, for a 0.1g seismic event, the assessment may be that the likelihood of any physical damage resulting in an automatic trip is very small; for 0.3g and 0.5g seismic events, the most likely effect may be damage to the switchyard or the transmission system, with a very small likelihood of any seismic induced failures that could result in any other initiating event; and for a >0.75g seismic event, in addition to a loss of off-site power (LOOP), there may be a high likelihood of failure of vessel or piping anchorage causing an induced LOCA. Based on such an assessment

(a) A manual scram may be the only credible initiating event for the 0.1g seismic hazard event.

(b) A LOOP would be assumed to be a hazard, whereas a grid-related LOOP would be an initiating event for the 0.3g and 0.5g seismic hazard events.

(c) In addition to a grid-related LOOP, a LOCA would be included as a hazard, whereas a small break LOCA would be an initiating event for very large (>0.75g) earthquakes.

When multiple initiating events are possible, each will have a conditional probability of occurrence which, when combined with the hazard event frequency, provides the corresponding initiating event frequency.

It is even possible that a hazard event would not result in an initiating event (i.e., there would be no perturbation of the plant operation). For example, a plant may automatically trip (initiating event), may be manually tripped (initiating event), or may continue (no initiating event) to operate through a hurricane event. These examples highlight why the distinction between "hazard event" and "initiating event" is important and must be maintained.