Integrated Level 1–Level 2 decommissioning probabilistic risk assessment for boiling water reactors

1. Introduction

Probabilistic risk assessments (PRAs) are comprehensive, structured, and logical analysis methods aimed at identifying and assessing risks in complex technological systems with the purpose of improving their safety and performance, and they provide insights into the strengths and weaknesses of the design and operation of a nuclear power plant (NPP). In a PRA of an NPP, accident scenarios are typically analyzed with event trees and/or fault trees. An event tree graphically represents the various accident scenarios that can occur after an initiating event. The event tree starts with an initiating event and develops scenarios, based on whether a plant system succeeds or fails in performing its function. The event tree then considers all of the related systems that could respond to an initiating event, i.e., the so-called functional events or top events, until the sequence ends in either a safe recovery or reactor core damage [1].

PRA analysts typically estimate the risk developing the so-called Level 1, Level 2 PRA, and sometimes Level 3 PRA [1]. A typical approach is to end the analysis at the Level 2 PRA, imposing low limits on radioactive release due to a set of postulated accidents. The focus of this article is to describe a novel methodology for the estimation of fuel damage frequency (FDF) and radioactive release during the decommissioning of the plant until the release of activity.

The technical approach used to evaluate core damage accident sequences and severe accident progressions for radiological releases into the environment involved a combination of deterministic and probabilistic models [12]. A baseline or “best estimate” characterization of accident event chronology, mechanical loads on the containment, and/or reactor building (RB) and fission product release to the environment is generated using detailed, plant-specific calculations of severe accident behavior using a thermal-hydraulic code, e.g., MELCOR [2], which has been used in this analysis, MAAP [13], or any other thermal-hydraulic code. Sensitivity calculations are also needed for selected sequences using the NPP MELCOR thermal-hydraulic model to measure the effects of major modeling uncertainties in the calculated results. Furthermore, the physical effects of some phenomena are not explicitly calculated by MELCOR (e.g., hydrogen detonation) or are represented by relatively simple models. Therefore, alternative sources of information are needed to make informed decisions on an appropriate modeling approach and to supplement MELCOR calculations in areas where calculations are deficient.

A probabilistic model is used to inform the thermal-hydraulic model and assemble information from the thermal-hydraulic calculations especially weighing alternative results by probabilities. This process is a distinguishing feature of the Level 1–Level 2 PRA. The Level 1 PRA uses event trees and fault tress to estimate the FDF; the Level 2 model uses accident progression event trees (APETs), i.e., organized frameworks for delineating the various ways in which a fuel damage sequence (defined in the Level 1 PRA) could proceed in time until potential radioactive release into the environment.

Specific Level 1 event trees have been developed for the analysis of accidents during decommissioning. For each top event in the event tree, success criteria are identified based on thermal-hydraulic (i.e., MELCOR) calculations. A success criterion is a condition that must be verified to have the success of the top event in the event tree. Success criteria can be identified for systems and for operator actions. The identification of the success criteria using a set of thermal-hydraulic calculations for a PRA analysis is fundamental for the estimation of success/failure sequences. Fault trees are developed to support the estimation of the failure probability of the top event in the event tree [3].

Level 2 decommissioning event trees (APETs) are also specifically developed for the decommissioning period [9]. Similar to low-power–shutdown accidents [8], APETs developed for the decommissioning Level 2 PRA differs from APETs developed for full-power sequences in some respects. First, APETs are considerably less complicated because of the relatively simple nature of the accident sequences that can occur during decommissioning states. For example, the reactor pressure vessel (RPV) and primary containment are partially disassembled and are in thermal and mechanical equilibrium with the RB. Therefore, an assessment of thermal or mechanical challenges to the RPV and primary containment integrity is not necessary to characterize the accident progression. Rather, the dominant feature of accident progression is the response of the secondary containment (RB), which, in most cases, represents the only major barrier to fission product release to the environment.

Second, accident scenarios can be initiated either in the RPV, in the spent fuelpool (SFP), or in both. Therefore, accident progressions initiated in the RPV, SFP, or both must be combined to obtain the radiological consequences from the results of the RPV and SFP fuel damage calculations. This requires postprocessing analysis of the accident progressions because MELCOR is not able to model multiple core accident evolutions in a single calculation. Consequently, a hybrid methodology needs to be developed to examine the fuel degradation progression in the RPV and SFP separately. The results from the two calculations are combined into an integrated calculation using the thermal-hydraulic and fission product sources from the respective calculations. In this manner, the chronology of severe accident events and associated radionuclide release into the environment can be calculated for the full range of accidents identified in the Level 1 PRA.

2. Plant design overview

Boiling water reactors (BWRs) are types of light water nuclear reactors used for the generation of electrical power. The BWR nuclear reactor analyzed in this article is a BWR Mark I, i.e., a reactor with a drywell containment building and a wetwell made of steel torus that contains water. The SFP is located at the top of the drywell head. Fig. 1 shows an example of a BWR Mark I reactor. The production of electricity in a typical commercial BWR follows this process: The core inside the reactor vessel where the nuclear reactions occur generates heat; a steam–water mixture (two-phase flow) is produced when the reactor coolant travels upward through the core absorbing heat (upward flow is provided by jet pumps); the steam–water mixture leaves the top of the core and enters a separator where water is removed from the two-phase flow before the steam is allowed to enter the steam line; the steam line directs the steam to the main turbine which produces electricity.

For the plant to function, offsite power is necessary. If offsite power is lost, emergency diesels will power pumps that will provide cooling water to the reactor. Other safety systems are available in case of accidents, and some of them rely on offsite power or are backed up by diesel generators. Examples of BWR safety systems are reactor protection system, high-pressure coolant injection system, isolation condenser, reactor core isolation cooling system , automatic depressurization system, low-pressure core spray system, core spray, low-pressure coolant injection system, depressurization valve system, passive containment cooling system, gravity-driven cooling system, containment depressurization system, drywell flooding system, standby liquid control system, fuel pool cooling system, firewater system, torus cooling system, and service water for ultimate heat removal. Typical BWR plants may have all, additional, or a subset of these systems.

As shown in Fig. 1, in Mark I BWRs, the containment system is composed of the drywell, which surrounds the RPV and recirculation loops. The wetwell is situated underneath the drywell and is connected to the drywell by a system of vent pipes. The wetwell is a toroidal-shaped vessel (torus) which is filled to about half of its height with clean water. An interconnecting vent network exists between the drywell and the wetwell. The vents are open on one end to the drywell, and on the other end, the vents open into a header in the wetwell that has additional downcomer vents below the water level in the suppression pool.

The drywell, wetwell, and vent system form the primary containment around the RPV and recirculation loops. The function of the containment system is to contain the energy released during a postulated design-basis loss-of-coolant accident (LOCA) of any size reactor coolant pipe and to protect the reactor from external events. The primary containment is one of the three main barriers limiting release of fission products from the BWR nuclear fuel into the environment. Other barriers include the fuel rod cladding and the RPV together with its piping, which form the reactor coolant pressure boundary and the primary containment. In addition to the three fission product barriers, the secondary containment surrounds the primary containment and houses emergency core cooling systems and the SFP [10], [11].

3. Overview of decommissioning PRA

The Level 1–Level 2 decommissioning PRA is a tool to evaluate and estimate the risk associated with the reactor and SFP after the final shutdown. Fig. 2 shows an overview of the overall Level 1–Level 2 decommissioning PRA. There are three main parts of the process: Level 1 decommissioning PRA, decommissioning plant damage state (PDS) development, and Level 2 decommissioning PRA.

The Level 1 decommissioning PRA estimates the accident sequences that can lead to core damage after an initiating event either in the SFP, RPV, or in both. Each accident sequence is composed of a combination of success and failure of safety systems or operator actions after an initiating event, which can be modeled via event trees and fault trees, either in the SFP, RPV, or in both. The types of initiating events can be either internal events (i.e., LOCAs, transients, fire, and internal flooding) or external events (i.e., seismic, external flooding, wind and tornadoes, and aircraft crash). A typical approach to model the system/operator’s success or failure is made using a fault tree modeling approach that models the system logic through basic events. A fault tree solver, e.g., Computer Aided Fault Tree Analysis (CAFTA) [4] or Kvarfordt et al. [5], is used to identify the combination of basic events leading to the failure of the systems (i.e., minimal cutsets or just cutsets).

The set of cutsets makes up the accident sequences as an input to the PDSs, which are used to compress the amount of information to be processed by the Level 2 analysis. The accident sequences of the Level 1 decommissioning PRA with similar severe accident progression are grouped into the same PDS.

The PDSs contain unique sequences and are the bases for the modeling of the Level 2 decommissioning PRA that is developed with APETs supported by thermal-hydraulic calculations. In this study, the MELCOR code has been used to model the thermal-hydraulic response of the plant. For each PDS, an event tree is developed whose output could be either release of radioactive material to the environment or a safe end state. The results of the Level 2 decommissioning PRA can be characterized by release categories, large release frequency (LRF), and large early release frequency (LERF).

Uncertainties of the PDS distributions are propagated to the Level 1 decommissioning PRA and are combined to Level 2 event uncertainties; the Level 2 decommissioning PRA results will include also uncertainties on LERF and LRF [6].

4. Definition of decommissioning phases

From a plant configuration point of view, the decommissioning phases and plant configurations are different than a Low Power and Shutdown (LPSD) model because in the latter, the plant is in shutdown conditions, and lots of activities are performed to take the plant back to full power within a few weeks. In addition, the systems available during decommission are different than a typical LPSD model because a few systems might be completely isolated and removed from the plant and cannot be used to mitigate a potential accident, and maintenance to components/systems in general is not performed during decommissioning; therefore, maintenance terms are not included in the decommissioning model. Furthermore, procedures used during decommissioning are different than LPSD procedures, and therefore, the typical LPSD Human Reliability Analysis (HRA) is not applicable during decommissioning. Finally, the duration of phases is different than LPSD; so, the risk profile in each phase would be different in decommissioning compared with LPSD.

Several configurations can be assumed to estimate the risk of the plant during decommissioning depending on the strategies chosen by the plant. The proposed decommissioning strategy for the reference plant is to retain the last core in the RPV for a certain period of time after final shutdown before transferring the fuel permanently to the SFP. In particular, for the first couple of months, the fuel is retained in the RPV with the RPV head and drywell closed, and in the following half a year, the RPV head and drywell are open with the SFP dam removed and the fuel pool and reactor well flooded and connected. The reactor well will remain in flooded conditions during this phase. Finally, for the next few years, all the spent fuel is transferred and remains located in the SFP.

In this article, two main phases are then proposed and analyzed: the first phase covers the permanent shutdown of the plant starting from the plant approaching Reactor Mode 4 (i.e., low RPV pressure and RPV temperature approaching 100°F) power to cold shutdown, whereas the second phase covers the actual decommissioning phase when 100% of the fuel is transferred to the SFP before the final disposal.

The analysis of the permanent shutdown state of the plant cannot be addressed as a single state due to numerous changes in plant configuration. Multiple states must be defined, with each state being modeled explicitly using a fault tree/event tree methodology to quantify the FDF. The identification of the shutdown phases is done considering two important parameters: (1) the plant modes and (2) the decommissioning characteristics. The plant modes important for the decommissioning analysis are cold shutdown, SFP movement, and actual decommissioning. In addition, within each plant mode, the plant parameters and the status of some systems can change; therefore, the characteristics within each plant mode are important to identify additional phases. The main characteristics of interest are primary system pressure, status of reactor vessel head, status of the reactor vessel well, location of fuel (RPV, SFP, or both), and availability of safety and support systems. Plant data, procedures, and working plan are good sources for the identification of the phases.

The number of phases can be large; yet, the finer the modeling, the more precise the estimation of the FDF. However, a compromise must be found between the level of detail and practicability. In this article, four phases are considered and are summarized in Table 1. For each decommissioning phase, the accident propagation will be analyzed using a linked event tree/fault tree approach.

Table 1. Characteristics of decommissioning phases.

Phase	Subphase	Description	Mode	Primary pressure	RPV head	RPV well	Fuel location	Available systems
Shutdown	P-1	From end of RPV cooling to RPV head removal	Cold SD	Low	ON	Dry	RPV	ALL
	P-2	From RPV head removal to fuel pool dam removal (drywell flooded)	Cold SD	Low	OFF	Dry to flooded	RPV	ALL
	P-3	From fuel pool dam removal to end of offload	Fuel movement	Low	OFF	Flooded	RPV/SFP	Several systems unavailable
Actual decommissioning	P-4	From end of offload to fuel removal from SFP	Decommissioning	Low	OFF	Flooded	SFP	Several systems unavailable

RPV, reactor pressure vessel; SD, shutdown; SFP, spent fuel pool.

5. Level 1 probabilistic risk assessment

5.1. Identification of phase-specific initiating events and event tree development

An initiating event (IE) is defined as a challenge to one or more plant systems necessary to maintain the plant in safe, stable conditions. During each decommissioning phase, different initiating events can potentially occur. IEs belong to different categories of initiators such as internal events (random events, fire, and floods) or external events (external floods, seismic, extreme wind and tornadoes, and aircraft crash). Therefore, each decommissioning phase is analyzed to identify any IE that could occur during that phase. In particular, the process is based on the identification of safety functions that must be accomplished to maintain a safe, stable condition. These functions are reactivity control, decay heat removal, loss of system integrity, and support system function.

During decommissioning, reactivity control is performed using control blades in the reactor and borated panels or other control mechanisms in the SFP. The reactivity design–basis evaluations are reviewed to assess a very low likelihood of occurrence of accidents with fission power relative to accidents with only decay heat power. The decay heat removal is typically due to loss of offsite power, loss of service water, transients in the primary loop or shutdown cooling loop, failure of a component or system that is supporting the decay heat removal function, or operator errors. Loss of system integrity is due to a pipe break in the primary system or shutdown cooling loop. Therefore, two types of IEs are generally considered: loss-of-decay heat removal accidents (LODHRs) and LOCAs. Each category of initiators can cause a loss of heat removal or a LOCA. Along with LODHR and LOCA initiating events, structured hazard-initiating events are also considered. Finally, cask drop events are also considered. During plant decommissioning, it is expected that there will be movements of spent fuel storage casks over the SFP. These casks are heavy enough that if dropped can cause catastrophic damage to the fuel pool. Cask drop accidents that lead to catastrophic failure of the SFP include accidents in which the load is dropped either on the pool floor or near the pool wall. For purposes of consequence assessment, all cask drop accidents are assumed to result in a rapid pool drain down leading to fuel uncovery followed by a zirconium fire. Therefore, cask drop scenarios will be assumed to lead directly to fuel damage. Other equipment such as fuel handling machine and polar crane are located over the SFP, but they are robust structures and will not affect the integrity of the SFP unless there is an external event such as a seismic that can cause damage: these hazards are addressed in the seismic analysis. The frequency of cask drop events has been calculated as the fraction of time the crane is moving equipment over the total time of the decommissioning phase. Each shutdown phase is addressed separately, and the IEs associated with each phase are identified. The IE frequencies for each phase are estimated using plant-specific data (if available or existing) or generic data. The IE frequencies represent the likelihood of failure occurring during the duration of the phase. In particular, LOCAs can be due to random piping failure or seismic-induced initiators whereas loss of heat removal initiators can be due to any type of event.

For the shutdown phases P-1 through P-3, for each type of initiating event, i.e., internal events (random events, fire, and floods) and external events (external floods, seismic, extreme wind and tornadoes, and aircraft crash), a specific event tree is developed. For each successful event tree branch, shutdown-specific success criteria are identified based on thermal-hydraulic calculations. A specific thermal-hydraulic model is developed for both RPV and SFP response based on MELCOR calculations.

The number of event trees developed for phases P-1 through P-3 can be large (∼40 ETs). As an example, a seismic initiating event tree for phase P-1 is provided in Fig. 3.

For the actual decommission phase (phase P-4), a smaller number of event trees are developed because of the simpler plant configuration, i.e., fuel is located just in the SFP, and only a few systems are available. The event trees identified during phase P-4 are

•
Loss of SFP cooling
•
Seismic events
•
Nonseismic external hazards, and
•
Internal hazards

5.2. Level 1 results

LOCA and LODHR event trees developed for the internal model can be used for any other category of initiator, except seismic. Specific seismic event trees are developed, and transfers to seismically induced hazards are modeled in the Level 1 PRA. Then, to obtain an overall contribution to the FDF, each single event tree model (internal events, internal floods, external floods, and fire along with seismic) is integrated into a single fault tree model and quantified to obtain cutsets that will be considered in each PDS. Table 2 provides an overview of the Level 1 results.

Table 2. Level 1 decommissioning PRA results.

IE group	% FDF contribution
LODHR	4%
LOCA	4%
Fire	25%
Internal floods	2%
Earthquake	42%
Winds	1%
External flood	14%
Aircraft crash	1%
Cask drop	7%

FDF, fuel damage frequency; IE, initiating event; LOCA, loss-of-coolant accident, LODHR, loss-of-decay heat removal; PRA, probabilistic risk assessment.

The seismic, fire, and external flood event groups are the highest contributors to the Level 1 FDF. The fourth contributor is a cask drop event due to equipment handling during the decommissioning phase of the plant.

For the Level 2 analysis, each IE category is broken down to the sequence contributor to the FDF. Each sequence in each IE category will be assigned to a specific PDS that will be the basis of the Level 2 analysis.

6. PDS definition and input to decommissioning level 2 PRA

The decommissioning Level 1 PRA identifies the combinations of system failures and/or human errors that can lead to damage of the irradiated fuel in the RPV and/or the SFP. Each fuel damage sequence is assigned to a unique PDS based on the status of key plant systems (available or unavailable). The PDS development process integrates results of the Level 1 PRA for all contributions to the total decommissioning FDF including sequences initiated by internal events and external events. The attributes used to combine individual accident sequences from the Level 1 PRA to PDSs in this study are

•
Sequence category, i.e., direct fuel damage, fuel pool LOCA, isolable LOCA, unisolable LOCA, transient, seismic LOCA, or seismic transient,
•
Accident phase, i.e., phases P-1 through P-4,
•
RPV pressure, i.e., high or low,
•
Available or unavailable systems,
•
AC Power,
•
Crane status,
•
Initial fuel status,
•
SFP status,
•
RB status,
•
SFP dam status,
•
Leakage rate,
•
Leakage elevation, and
•
Sequence type, i.e., internal events, fire, flooding, or external events. This is not really an attribute, but the information could be used in the Level 2 decommissioning PRA as needed.

Based on the Level 1 PRA decommissioning results, systems and AC power may be or may not be available in the Level 2 analysis. The crane status attribute asks whether the crane fails damaging the pool. The initial fuel status attribute accounts for the fact that the fuel can or cannot be mechanically damaged at the beginning of the accident progression. The SFP status, RB status, and the SFP dam status attributes ask for the integrity of the SFP, RB, and SFP dam, respectively, at the beginning of the accident progression. Each of these structures can either be intact or damaged (mostly due to seismic events). The SFP leakage rate and leakage elevation attributes account for any loss of coolant in the SFP: the amount of the leakage (large, medium, or small) and the location of the leakage (bottom of the pool or any other locations within the pool). The characteristics of the severe accident progression are specified by these attributes and are described in the following sections.

Based on the Level 1 PRA decommissioning accident sequence results and PDS attributes, 26 PDSs have been identified for phase P-1; 13 PDSs for phase P-2; 17 PDs for phase P-3; and 6 PDSs for phase P-4. As an example, Table 3 summarizes the PDSs for P-4, and Table 4 provides details of the PDS attributes for each PDS in P-4. Sequences mapped to specific PDSs are identified by analyzing cutsets and using flags to identify what systems are available and not available. The specific attributes assigned to each PDS are used to develop Level 2 APETs and MELCOR accident progression inputs.

Table 3. PDSs for decommissioning phase P-4.

ID	Description
PDS-1	Boil-off scenarios
PDS-2	Dam failure scenarios
PDS-3	SFP failure scenarios
PDS-4	Crane failure scenarios
PDS-5	RB failure scenarios
PDS-6	Nonseismic leakage scenarios

PDS, plant damage state; RB, reactor building; SFP, spent fuel pool.

Table 4. Details of PDS characteristics in phase P-4.

Phase, plant damage state	Sequence categories	RPV pressure	Available systems	Unavailable systems	AC power	Crane status	Initial fuel status	SFP status	RB status	SFP dam status	Leakage rate	Leakage elevation
P-4, PDS-01	IE, IH, EXT, SEIS	Low	NONE	ALL	NONE	OK	OK	OK	OK	OK	N/A	N/A
P-4, PDS-02	SEIS	Low	NONE	ALL	NONE	OK	OK	OK	OK	FAILED	Large through dam, then boil-off	Only dam failure
P-4, PDS-03	SEIS	Low	NONE	ALL	NONE	OK	OK	DAMAGED	OK	OK	Medium	Bottom of pool
P-4, PDS-04	SEIS, CASK DROP	Low	NONE	ALL	NONE	FAILED	DAMAGED	DAMAGED	OK	OK	Small and medium	Bottom of the pool to 1/4 of active fuel
P-4, PDS-05	EXT, SEIS	Low	NONE	ALL	NONE	OK	DAMAGED	DAMAGED	FAILED	OK	Large	Bottom of pool
P-4, PDS-06	IE, IH, EXT, SEIS	Low	NONE	ALL	NONE	OK	OK	OK	OK	OK	Small	Bottom of pool

IE, initiating event; IH, internal hazard; EXT, eternal; PDS, plant damage state; RB, reactor building; RPV, reactor pressure vessel; SEIS, seismic.

7. Level 2 PRA decommissioning APET approach

Severe accident progression and fission product source term calculations are performed for each PDS. The calculations generate information needed to characterize the chronology of key events and the magnitude of timing of radiological releases for each of the PDSs identified in the Level 1 PRA. These results are integrated within the APET framework that delineates various ways in which a fuel damage sequence (defined in the Level 1 PRA) could proceed in time (see Fig. 4). For a given accident sequence, plausible variations in severe accident progression arise from a combination of the systemic (or random) probabilities that available accident mitigation systems could fail to adequately perform their function and from limitations in our ability to confidently predict the evolution of severe accident phenomena with contemporary computer models. As a result, a single accident sequence identified in the Level 1 assessment of FDF results in several plausible severe accident progressions in the Level 2 PRA. The relative probability of each of these accident progressions is evaluated in the APET.

The definition of the APET end-state source terms are developed directly from the deterministic MELCOR results. Specific integrated RPV and SFP MELCOR source term calculations are performed to characterize the sequence source term. Consequently, each APET sequence is assigned to a specific integrated MELCOR calculation. The results used from the MELCOR calculations include (a) the timing of the start of radioactive release into the environment, (b) the total Cs-137 activity released in the environment, (c) the total activity released to the environment, and (d) an indication whether the I-131 activity released to the environment exceeded the large early release (LER) criteria. Alternate consequence measures could be evaluated although these measures are often used to assess early (i.e., evacuation phase) and late (i.e., long-term) health effects [15]. Consequently, unlike other PRA methodologies that calculate the source term based on the accident progression characteristics using algorithms derived from deterministic calculations, the present approach directly uses the results from the deterministic calculations with the APET. The current approach does not allow for complex variations in attributes that may affect the source term. However, each result in the sequence source terms can be directly tied to a mechanistic evaluation of the accident progression. All complex interactions affecting the source term are calculated using the physics models within MELCOR.

7.1. Deterministic evaluation of decommissioning sequences

The technical foundation of the Level 2 decommissioning PRA will be developed from results of plant-specific calculations of severe accident progression using the MELCOR computer code. The MELCOR model has the ability to evaluate accident progression and fission product release from fuel located either in the RPV or in the SFP, but not from both locations in a single calculation (i.e., a typical limitation in most severe accident codes). Consequently, a hybrid methodology is used to examine the fuel degradation progression in the RPV and the SFP separately. The results from the two calculations are combined into an integrated calculation using the thermal-hydraulic and fission product sources from the respective calculations. In this manner, the chronology of severe accident events and associated radionuclide release into the environment can be calculated for the full range of accidents identified in the Level 1 PRA.

7.1.1. RPV accident progression model

The MELCOR calculations performed in support of the Level 2 decommissioning PRA are chosen to provide detailed information on accident progression and fission product source terms for the PDSs identified in the Level 1 PRA. MELCOR calculations for each and every PDS are impractical to be performed. Therefore, only calculations for a group of PDSs that could successfully represent the range of conditions associated with the accident initiator, expected severe accident progressions, and the scope of fission product source terms across all PDSs can be performed. Criteria used to select representative PDSs included the following: (1) PDSs with significant frequency (in general, the PDSs that comprise at least the top 99% of the total), (2) PDSs expected to lead to large fission product source terms (e.g., sequences initiated with failure of the RB), (3) PDSs from each phase of the decommissioning phase (i.e., phases P-1 through P-4), (4) PDSs expected to rapidly progress to fuel damage (e.g., unisolable LOCA initiators), and (5) PDSs that characterize the response with fuel in various states of offload.

After applying these selection criteria, a series of representative PDSs are identified for baseline MELCOR calculations. The RPV accident progression calculations in phase P-1 occur at the start of the permanent shutdown. The phase P-1 reactor state is assumed to begin as the plant approaches Reactor Mode 4 (i.e., low RPV pressure and RPV temperature approaching 100°F), which signifies the start of the cold shutdown. The decay power has decreased to less than 0.6% of full power. Because the decay heat and the system fluid temperature and pressure are lower than full-power sequences, the response of the reactor system to accidents is slower than full-power accidents from high system pressure.

RPV calculations in phases P-2 and P-3 are complicated by the status of the hydraulic connections to the reactor well during the shutdown operations. In phase P-2, the SFP is usually isolated from the reactor well by a dam. Unless the SFP dam fails due to a seismic event, the accident in the RPV occurs independently compared with an accident in the SFP. The reactor model in these phases includes a configuration where the reactor and the drywell heads are removed. The thermal-hydraulic response of the SFP includes the appropriate decay heat load.