ML25157A084

U.S. NRC Level 3 Probabilistic Risk Assessment Project, Volume 5: Overview of Reactor, Low-Power and Shutdown, Level 1, 2, and 3 PRAs for Internal Events (Draft for Public Review)

ML25157A084
Person / Time
Issue date:	06/06/2025
From:	NRC/RES/DRA
To:
References
Download: ML25157A084 (1)

Text

NUREG-XXXX U.S. NRC Level 3 Probabilistic Risk Assessment Project Volume 5: Overview of Reactor, Low-Power and Shutdown, Level 1, 2, and 3 PRAs for Internal Events Office of Nuclear Regulatory Research This report, though formatted as a NUREG report, is currently being released as a draft (non-NUREG) technical report.

U.S. NRC Level 3 Probabilistic Risk Assessment Project Volume 5: Overview of Reactor, Low-Power and Shutdown, Level 1, 2, and 3 PRAs for Internal Events Office of Nuclear Regulatory Research Manuscript Completed: Month 2025 Date Published: September 2025 Prepared by:

J. Wood1 A. Kuritzky1 A. Hathaway1 K. Compton1 1U.S. Nuclear Regulatory Commission A. Kuritzky, NRC Level 3 PRA Project Program Manager

iii ABSTRACT The U.S. Nuclear Regulatory Commission performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The scope of the L3PRA project encompasses all major radiological sources on the site (i.e., reactors, spent fuel pools, and dry cask storage), all internal and external hazards, and all modes of plant operation. A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources. This report, one of a series of reports documenting the models and analyses supporting the L3PRA project, provides an overview of the reactor, low-power and shutdown, Level 1, 2, and 3 PRA models for internal events. The analyses documented herein are based on information for the reference plant as it was designed and operated as of 2012 and do not reflect the plant as it is currently designed, licensed, operated, or maintained. To provide results and insights better aligned with the current design and operation of the reference plant, this report also provides the results of a parametric sensitivity analysis based on a set of new plant equipment and PRA model assumptions for all three PRA levels, primarily FLEX strategies and equipment.1 CAUTION:

The L3PRA project was developed to meet the specific objectives outlined in SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment Activities, dated July 7, 2011, using state of practice methods and data. While the study provides valuable insights and addresses its key objectives, due to limitations in time, resources, and plant information, some technical aspects of the study were subjected to simplifications or were not fully addressed. As such, inclusion of approaches in the L3PRA project documentation should not be viewed as an endorsement of these approaches for regulatory purposes.

1 FLEX refers to the U.S. nuclear power industry's proposed safety strategy, called Diverse and Flexible Coping Strategies. FLEX is intended to maintain long-term core and spent fuel cooling and containment integrity with installed plant equipment that is protected from natural hazards, as well as backup portable onsite equipment. If necessary, similar equipment can be brought from offsite.

v FOREWORD The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The staff undertook this project in response to Commission direction in the staff requirements memorandum dated September 21, 2011 (Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) resulting from SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment Activities, dated July 7, 2011 (ML11090A039).

Licensee information used in performing the Level 3 PRA project was voluntarily provided based on a licensed, operating nuclear power plant. The information provided reflects the plant as it was designed and operated as of 2012 and does not reflect the plant as it is currently designed, licensed, operated, or maintained. In addition, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models used in its regulatory decision-making. As such, the L3PRA project reports will not be the sole basis for any regulatory decisions specific to the reference plant.

Each set of L3PRA project reports covering the Level 1, 2, and 3 PRAs for a specific site radiological source, plant operating state, and hazard group is accompanied by an overview report. The overview reports summarize the results and insights from all three PRA levels. This current document is the overview report for the reactor, low-power and shutdown, Level 1, 2, and 3 PRAs for internal events.

To provide results and insights better aligned with the current design and operation of the reference plant, this report also provides the results of a parametric sensitivity analysis based on a set of new plant equipment and PRA model assumptions for all three PRA levels, primarily FLEX strategies and equipment.2 A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources (i.e., spent fuel in pools and dry storage casks).

These insights may be used to further enhance the regulatory framework and decision-making and to help focus limited agency resources on issues most directly related to the agencys mission to protect public health and safety. More specifically, potential future uses of the L3PRA project can be categorized as follows (a more detailed list is provided in SECY-12-0123, Update on Staff Plans to Apply the Full-Scope Site Level 3 PRA Project Results to the NRCs Regulatory Framework, dated September 13, 2012 [ML12202B170]):

enhancing the technical basis for the use of risk information (e.g., obtaining updated and enhanced understanding of plant risk as compared to the Commissions safety goals) 2 FLEX refers to the U.S. nuclear power industrys proposed safety strategy, called Diverse and Flexible Coping Strategies. FLEX is intended to maintain long-term core and spent fuel cooling and containment integrity with installed plant equipment that is protected from natural hazards, as well as backup portable onsite equipment. If necessary, similar equipment can be brought from off site.

vi improving the PRA state of practice (e.g., demonstrating new methods for site risk assessments, which may be particularly advantageous in addressing the risk from advanced reactor designs, a multi-unit accident, or an accident involving spent fuel; and using PRA information to inform emergency planning) identifying safety and regulatory improvements (e.g., identifying potential safety improvements that may lead to either regulatory improvements or voluntary implementation by licensees) supporting knowledge management (e.g., developing or enhancing in-house PRA technical capabilities)

In addition, the overall L3PRA project model can be exercised to provide insights regarding other issues not explicitly included in the current project scope (e.g., security-related events or the use of accident tolerant fuel). Furthermore, some future advanced light-water reactor (ALWR) and advanced non-light-water reactor (NLWR) applicants may rely heavily on the results of analyses similar to those used in the L3PRA project to establish their licensing basis and design basis by using the Licensing Modernization Project (LMP) (NEI 18-04, Rev. 1) which was endorsed via Regulatory Guide 1.233 in June 2020. Licensees who use the LMP framework are required to perform Level 3 PRA analyses. Therefore, another potential use of the methodology and insights generated from this study is to inform regulatory, policy, and technical issues pertaining to ALWRs and NLWRs.

The results and perspectives from this report, as well as all other reports prepared in support of the L3PRA project, will be incorporated into a summary report to be published after all technical work for the L3PRA project has been completed.

vii TABLE OF CONTENTS ABSTRACT................................................................................................................... iii FOREWORD................................................................................................................... v TABLE OF CONTENTS................................................................................................ vii LIST OF FIGURES......................................................................................................... ix LIST OF TABLES.......................................................................................................... xi ACKNOWLEDGMENTS.............................................................................................. xiii ABBREVIATIONS AND ACRONYMS.......................................................................... xv 1 INTRODUCTION.................................................................................................... 1-1 2 KEY MESSAGES................................................................................................... 2-1 3

SUMMARY

OF RESULTS AND INSIGHTS........................................................... 3-1 3.1 Level 1 PRA.............................................................................................................3-1 3.1.1 Results of Circa-2012 and 2020-FLEX Cases........................................3-1 3.1.2 Results of Alternative Analyses...................................................................3-2 3.1.3 Initial Insights..............................................................................................3-3 3.2 Level 2 PRA........................................................................................................... 3-10 3.2.1 Results of Circa-2012 and 2020-FLEX Cases...................................... 3-10 3.2.2 Results of Alternative Analyses................................................................. 3-12 3.2.3 Initial Insights............................................................................................ 3-18 3.3 Level 3 PRA........................................................................................................... 3-32 3.3.1 Results of Circa-2012 and 2020-FLEX Cases...................................... 3-33 3.3.2 Results of Alternative Analyses................................................................. 3-36 3.3.3 Initial Insights............................................................................................ 3-37 4 KEY ASSUMPTIONS, CONSIDERATIONS, AND UNCERTAINTIES FOR THE 2020-FLEX CASE.......................................................................................... 4-1 4.1 Level 1 PRA.............................................................................................................4-1 4.1.1 Key Assumptions........................................................................................4-3 4.1.2 Key Uncertainties........................................................................................4-5 4.2 Level 2 PRA.............................................................................................................4-5 4.2.1 Key Assumptions........................................................................................4-5 4.2.2 Additional Considerations............................................................................4-6 4.2.3 Key Uncertainties........................................................................................4-8 4.3 Level 3 PRA.............................................................................................................4-8 5 REFERENCES....................................................................................................... 5-1 APPENDIX A 2020-FLEX CASE DEVELOPMENT.................................................... A-1

ix LIST OF FIGURES Figure 3-1 Parametric Uncertainty Results for 2020-FLEX Case........................................3-6 Figure 3-2 Comparison of Release Category Frequencies for 2020-FLEX and Circa-2012 Cases........................................................................................... 3-23 Figure 3-3 Comparison of Percent Contribution to Total Release Frequency for 2020-FLEX and Circa-2012 Cases................................................................. 3-24 Figure 3-4 Individual Early Fatality Risk (0-1.8 miles) for Internal Events during Shutdown........................................................................................................ 3-40 Figure 3-5 CCDF Curves for Population-Weighted Early Fatality Risk (0-1.8 Miles) for Internal Events during Shutdown (2020-FLEX Case)................................. 3-40 Figure 3-6 Release Category Contribution to Population-Weighted Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown (Circa-2012 Case)........................................................................................... 3-41 Figure 3-7 Release Category Contribution to Population-Weighted Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown (2020-FLEX Case).......................................................................................... 3-41 Figure 3-8 Individual Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown - Alternative Analyses......................................................... 3-42 Figure 3-9 CCDF Curves for Population-Weighted Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown (2020-FLEX Case)....................... 3-42

xi LIST OF TABLES Table 2-1 Summary of Risk Metric Results.......................................................................2-1 Table 3-1 CDF by Initiating Event.....................................................................................3-7 Table 3-2 Additional Cases and Comparisons................................................................ 3-10 Table 3-3 Description of Release Categories.................................................................. 3-25 Table 3-4 Release Category Frequency Results............................................................. 3-26 Table 3-5 Level 2 PRA Surrogate Risk Metric Results.................................................... 3-27 Table 3-6 2020-FLEX Parameter Uncertainty Propagation Results by Release Category and Surrogate Risk Metric............................................................... 3-28 Table 3-7 Level 2 PRA Representative Accident Scenario Timelines.............................. 3-29 Table 3-8 Level 2 PRA Surrogate Risk Metric Results - 2020-FLEX Case..................... 3-30 Table 3-9 2020-FLEX Level 2 PRA Surrogate Risk Metric Results for Alternative Accident Recovery Assumptions..................................................................... 3-31 Table 3-10 Population-Weighted Early Fatality Risk, by Release Category, for the 0 to 1.8 mile Interval for the Circa-2012 and 2020-FLEX Cases......................... 3-43 Table 3-11 Population-Weighted Latent Cancer Fatality Risk, by Release Category, for the 0 to 10-mile Interval for the Circa-2012 and 2020-FLEX Cases............ 3-43

xiii ACKNOWLEDGMENTS The authors of this report would like to thank Virgel Furr, Latonia Enos-Sylla, and Jonathan Evans for their review of the work supporting this document. The authors would also like to thank the members of the Level 3 PRA project technical advisory group and external stakeholders who provided helpful comments on the draft report. A record of the draft report, Federal Register notice, and public comments received can be found in the NRC's Agencywide Documents Access and Management System (ADAMS) under accession number MLxxxxxxxxx.

xv ABBREVIATIONS AND ACRONYMS AC alternating current ADAMS Agencywide Documents and Management System AFW auxiliary feedwater ALWR advanced light-water reactor AOP abnormal occurrence procedure CCDF complementary cumulative distribution function CCF common-cause failure CCFP conditional containment failure probability CD core damage CDF core damage frequency CLOOP consequential loss of offsite power CST condensate storage tank DC direct current DG diesel generator EDMG extensive damage mitigation guideline ELAP extended loss of all AC power EOP emergency operating procedure EPA Environmental Protection Agency ET event tree FIP final integrated plan FLEX Diverse and Flexible Coping Strategies FSG FLEX Strategy Guideline FV Fussell-Vesely (importance measure)

GE general emergency HEP human error probability HFE human failure event HPS Health Physics Society HRA human reliability analysis ISLOCA interfacing systems loss-of-coolant accident kV kilovolt L3PRA Level 3 Pobablisitic Risk Assessment (project)

LERF large early release frequency LMP Licensing Modernization Project LNT linear no-threshold LOOP loss of offsite power LRF large release frequency LUHS loss of ultimate heat sink NLWR non-light-water reactor

xvi NRC U.S. Nuclear Regulatory Commission PAG protective action guideline POS plant operating state PRA probabilistic risk assessment QHO quantitative health objective RAT reserve auxiliary transformer RC release category RCP reactor coolant pump RCS reactor coolant system RHR residual heat removal RMWST reactor makeup water storage tank RWST refueling water storage tank SAMG severe accident management guideline SBO station blackout SG steam generator SGTR steam generator tube rupture SIG strategy implementation guide SOARCA State-of-the-Art Consequence Analyses SPAR Standardized Plant Analysis Risk (model)

TDAFW turbine-driven auxiliary feedwater V

volt

1-1 1

INTRODUCTION The U.S. Nuclear Regulatory Commission (NRC) performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The staff undertook this project in response to Commission direction in the staff requirements memorandum dated September 21, 2011 (Agencywide Documents and Management System [ADAMS] Accession No. ML112640419) resulting from SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment Activities, dated July 7, 2011 (ML11090A039).

As described in SECY-11-0089, the objectives of the L3PRA project are the following:

Develop a Level 3 PRA, generally based on current state-of-practice methods, tools, and data,1 that (1) reflects technical advances since the last NRC-sponsored Level 3 PRAs (NRC, 1990), which were completed over 30 years ago, and (2) addresses scope considerations that were not previously considered (e.g., low-power and shutdown risk, multi-unit risk, other radiological sources).

Extract new insights to enhance regulatory decision-making and to help focus limited NRC resources on issues most directly related to the agencys mission to protect public health and safety.

Enhance PRA staff capability and expertise and improve documentation practices to make PRA information more accessible, retrievable, and understandable.

Demonstrate technical feasibility and evaluate the realistic cost of developing new Level 3 PRAs.

Licensee information used in the L3PRA project was voluntarily provided based on a licensed, operating nuclear power plant. The information provided reflects the plant as it was designed and operated as of 2012 and does not reflect the plant as it is currently designed, licensed, operated, or maintained. In addition, the information provided for the reference plant was changed based on additional information, assumptions, practices, methods, and conventions used by the NRC in the development of plant-specific PRA models. As such, the L3PRA project reports will not be the sole basis for any regulatory decisions specific to the reference plant.

The series of reports for the L3PRA project are organized as follows:

Volume 1: Final summary report Volume 2: Background, site and plant description, and technical approach 1 State-of-practice methods, tools, and data refer to those that are routinely used by the NRC and industry or have acceptance in the PRA technical community. While the L3PRA project is intended to be a state-of-practice study, note that there are several technical areas within the project scope that necessitated advancements in the state of practice (e.g., modeling of multi-unit site risk, modeling of spent fuel in pools or casks, and human reliability analysis for other than internal events and internal fires).

1-2 Volume 3: Reactor, at-power, internal event and flood PRA (overview report)

Volume 3a: Level 1 PRA for internal events Volume 3b: Level 1 PRA for internal floods Volume 3c: Level 2 PRA for internal events and floods Volume 3d: Level 3 PRA for internal events and floods Volume 4: Reactor, at-power, internal fire and external event PRA (overview report)

Volume 4a: Level 1 PRA for internal fires Volume 4b: Level 1 PRA for seismic events Volume 4c: Level 1 PRA for high wind events and other hazards evaluation Volume 4d: Level 2 PRA for internal fires and seismic and wind-related events Volume 4e: Level 3 PRA for internal fires and seismic and wind-related events Volume 5: Reactor, low-power and shutdown, internal event PRA (overview report)

Volume 5a: Level 1 PRA for internal events Volume 5b: Level 2 PRA for internal events Volume 5c: Level 3 PRA for internal events Volume 6: Spent fuel pool all hazards PRA (no overview report)

Volume 6a: Level 1 and Level 2 PRA Volume 6b: Level 3 PRA Volume 7: Dry cask storage, all hazards, Level 1, Level 2, and Level 3 PRA Volume 8: Integrated site risk, all hazards, Level 1, Level 2, and Level 3 PRA The original L3PRA project models are referred to as the Circa-2012 case and a description of the plant as modeled is given in Volume 2. Volume 5a was created to document the L3PRA project Level 1 PRA model and analysis for internal events during low-power and shutdown operation for the Circa-2012 case. Additionally, Volumes 5b and 5c were created to document the corresponding Level 2 and Level 3 PRA models and analyses. As indicated in the list above, other volumes address the risk contributions from other hazards, other plant operating states, and other site radiological sources (i.e., spent fuel pools and dry storage casks).

In response to NRC Order EA-12-0049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, licensees submitted a Final Integrated Plan (FIP) that provides strategies to maintain or restore core cooling, containment, and spent fuel pool cooling capabilities. Although FIP documents focus on beyond-design-basis external events, the associated diverse and flexible coping strategies and equipment (FLEX) are applicable for internal events and internal floods.

To provide results and insights better aligned with the current design and operation of the reference plant, this report also provides the results of a parametric sensitivity analysis based on a set of new plant equipment and PRA model assumptions for all three PRA levels. This sensitivity analysis is referred to as the 2020-FLEX case (see Section 3.1.1for a summary of the

1-3 major modeling changes). The scope of the sensitivity analysis in this document is limited to internal events during low-power and shutdown operation for a single unit.

Section 2 provides key messages from the reactor, low-power and shutdown, Level 1, 2, and 3 PRAs for internal events, while Section 3 provides a summary of the results and insights from these analyses, including comparisons between the Circa-2012 and 2020-FLEX cases.

Section 4 documents key modeling assumptions, considerations, and uncertainties associated with the 2020-FLEX case.

Note, it is anticipated that the models and results of the L3PRA project are likely to evolve over time, as other parts of the project are developed, or as other technical issues are identified. As such, the final models and results of the project (which will be documented in the Volume 1 summary report after all technical work for the Level 3 PRA project has been completed) may differ in some ways from the models and results provided in the current report.

CAUTION:

The L3PRA project was developed to meet the specific objectives outlined in SECY-11-0089, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment Activities, dated July 7, 2011, using state of practice methods and data. While the study provides valuable insights and addresses its key objectives, due to limitations in time, resources, and plant information, some technical aspects of the study were subjected to simplifications or were not fully addressed. As such, inclusion of approaches in the L3PRA project documentation should not be viewed as an endorsement of these approaches for regulatory purposes.

2-1 2

KEY MESSAGES This section provides some of the key messages resulting from the reactor, low-power and shutdown, Level 1, 2, and 3 PRAs for internal events for a single unit. Table 2-1 summarizes some of the key risk metrics and surrogate risk metrics that were quantified as part of the analyses. In this table, results are provided for both the Circa-2012 case and the 2020-FLEX case for the surrogate risk metrics of core damage frequency (CDF), large early release frequency, and large release frequency, as well as for the two quantitative health objectives (QHOs) associated with the NRCs safety goal policy (NRC, 1986). Overall, the results show that the combination of this plant design and site location has substantial margin to the QHOs when considering internal events during reactor shutdown,2 though the margins are noticeably less for the surrogate risk metrics of CDF and LERF that were endorsed by the Commission when it approved the issuance of Regulatory Guide 1.174.

Table 2-1 Summary of Risk Metric Results Risk Metric (per year)

Circa-2012 Case 2020-FLEX Case Risk Metric Reduction Core damage frequency 1.3E-05 6.3E-06 49%

Large early release frequency 5.3E-07 2.1E-07 60%

Large release frequency 6.1E-06 3.2E-06 48%

Individual early fatality risk 1.4E-12 5.1E-13 64%

Individual latent cancer fatality risk 4.5E-09 2.1E-09 54%

Level 1 PRA for internal events during reactor shutdown:

The CDF from internal events during reactor shutdown is 1.3x10-5 per year (yr).

The highest contributing initiating event category to the shutdown CDF is loss of offsite power (LOOP), due primarily to the higher LOOP initiating event frequency for shutdown operation as compared to at-power operation and the modeling assumptions regarding the recovery of offsite power (similar to at-power operation).

The next largest contributor to CDF is from overdrain events when entering midloop prior to refueling. Midloop operation is generally recognized as a high-risk evolution due to the short time available until reactor coolant system (RCS) boiling occurs upon loss of cooling and the reliance on operator actions to diagnose and respond to the event in a short timeframe.

2 To get the complete picture of plant reactor risk during a calendar year, the risk for all hazards during both reactor operation and shutdown would need to be summed together. Based on other results obtained as part of the L3PRA project, the margin to the QHOs is still relatively substantial even after summing the operating and shutdown risk for internal events and the operating risk for all other hazards (the shutdown risk for hazards other than internal events was not calculated as part of the L3PRA project).

2-2 The highest contributing plant operating states (POSs) in terms of CDF are POS 8E and POS 8L,3 which represent operation with the refueling cavity flooded. While the accident scenarios in these states progress slowly due to the large water inventory available in the refueling cavity, the unavailability of equipment for maintenance is an important factor influencing the risk in these states.

The next highest contributing POSs are POS 5A (operation with pressurizer solid),

primarily due to loss of inventory with RCS at pressure and assumptions about maintenance unavailability, and POS 6 (midloop operations prior to refueling), for the reasons discussed earlier. The CDF contribution from midloop operations can be reduced if midloop entry is delayed until later in the outage or avoiding midloop entry until fuel is removed from the reactor. However, delaying or avoiding midloop could extend the overall outage time depending on what activities are planned for the outage.

For the 2020-FLEX case, CDF for internal events during shutdown is reduced by approximately 50 percent to 6.3x10-6/yr. This significant reduction occurs because the CDF during shutdown for the reference plant is dominated by LOOP sequencesother initiating events show small or no reductions in CDF.

Level 2 PRA for internal events during reactor shutdown:

A small fraction of CDF leads to large early release (approximately 4 percent).

A relatively large fraction of CDF results in later containment failure (approximately 50 percent).

o Late, large release does not result in any prompt fatalities but can result in latent cancer fatalities and economic consequences.

For the 2020-FLEX case, large, early release frequency (LERF) is reduced by approximately 60 percent (from 5.310-7/yr to 2.110-7/yr) and large release frequency (LRF) is reduced by approximately 48 percent (from 6.110-6/yr to 3.210-6/yr).

The frequency of late, large releases is dependent on the severe accident progression modeling time.

o The L3PRA base case models severe accident progression for 7 days after accident initiation (with no credit for longer-term recovery actions, such as venting, steam-inerting, or implementing FLEX to restore electrical power).

o Reducing modeling time to approximately 2 days after accident initiation reduces LRF to less than 36 percent of CDF for the Circa-2012 case and approximately 27 percent of CDF for the 2020-FLEX case. This demonstrates the potential for risk reduction if credible mitigative actions can be successfully implemented in this timeframe.

3 See NRC (2025a) for a description of the various POSs.

2-3 The frequency of late, large releases is also dependent on credit given for operator actions during long-term accident progression.

o The human reliability analysis approach used in the Level 2 shutdown PRA limits the credit for certain station blackout conditions and for actions during long-term accident progression. A sensitivity analysis was performed considering three potential types of long-term recovery actions: actions to prevent significant combustion events in containment, actions to control containment pressure, and actions to prevent basemat melt-through.

o The sensitivity analysis demonstrates the potential benefits of long-term recovery actions (i.e., a 56 percent reduction in LRF when assuming a 0.1 failure probability for each type of action), in particular actions related to controlling containment pressure (e.g., through restoration of containment heat removal or containment venting) and preventing large combustion events in containment (e.g., venting combustible gases or igniting at lower flammability levels).

Level 3 PRA for internal events during reactor shutdown:

Early fatality risks to individuals for internal events during reactor shutdown are far below the QHO associated with the safety goals.

o The mean annual population-weighted individual early fatality risk within 1 mile of the site boundary comes almost entirely from release category SD-COPEN-RCSVENT, which involves an open containment at the time of accident initiation and moderate retention of aerosols inside the RCS.

o The changes in the 2020-FLEX case reduce population-weighted early fatality risk within 1 mile of the site boundary by 64 percent, because release category SD-COPEN-RCSVENT is dominated by LOOPs, exactly the type of accident that FLEX is designed to ameliorate.

Latent fatality risks to individuals for internal events during reactor shutdown are well below the QHO associated with the safety goals.

o The changes in the 2020-FLEX case reduce population-weighted latent cancer fatality risk within 10 miles of the site by 54 percent, because five of the six release categories that contribute the most to this risk are dominated by LOOP sequences, the target of the FLEX strategies.

o Using a shorter severe accident analysis modeling time (i.e., terminating the accident and radiological release analysis at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after entry into the severe accident management guidelines [SAMGs], as opposed to 7 days after event initiation) increases the margin to the QHO by an additional 60 percent.

o Using an alternate dose truncation model in place of the linear no-threshold (LNT) model can increase the margin to the QHO by a significant amount since the latent cancer fatality risk estimated in this study primarily results from long-

2-4 term, low-dose exposure to individuals after they are allowed to return to their homes following decontamination.

It should be remembered that these results only reflect the risk during the year for internal events when the reactor is shut down. To get the complete picture of plant reactor risk during a calendar year, the risk for all hazards during both reactor operation and shutdown would need to be summed together. Based on other results obtained as part of the L3PRA project, the margin to the QHOs is still relatively substantial even after summing the operating and shutdown risk for internal events and the operating risk for all other hazards (the shutdown risk for hazards other than internal events was not calculated as part of the L3PRA project).

3-1 3

SUMMARY

OF RESULTS AND INSIGHTS This section provides a summary of the results and insights from the Level 1, 2, and 3 PRAs for internal events during reactor shutdown. To provide results and insights that are more reflective of the current design and operation of the reference plant, throughout this section results of the Circa-2012 case are compared with the results of the 2020-FLEX case. These comparisons demonstrate how the plant risk profile associated with internal events during reactor shutdown has been influenced by several key plant changes implemented at the reference plant since 2012. The Level 1, Level 2, and Level 3 PRAs are discussed in Sections 3.1, 3.2, and 0, respectively.

3.1 Level 1 PRA This section provides a summary of the results and insights from the Level 1 PRA for internal events during reactor shutdown. Section 3.1.1 provides the high-level results for both the Circa-2012 and 2020-FLEX cases. Section 3.1.2 discusses several alternative analyses that were performed to better assess the effect of introducing FLEX into the Level 1 PRA model.

Section 3.1.3 discusses insights from the Level 1 PRA for internal events during reactor shutdown, including a discussion of the dominant contributors to CDF for both the Circa-2012 and 2020-FLEX cases.

3.1.1 Results of Circa-2012 and 2020-FLEX Cases A detailed description of the Circa-2012 Level 1 PRA model and results for internal events during reactor shutdown is provided in the respective L3PRA project report (NRC, 2025a). The 2020-FLEX case updates the Circa-2012 models to include the FLEX strategies and equipment for responding to an extended loss of alternating current (AC) power (ELAP). In addition, if FLEX is not successful, the 2020-FLEX case credits the potential for continued turbine-driven auxiliary feedwater (TDAFW) pump operation given a complete loss of all installed AC and direct current (DC) power.4 Continued TDAFW pump operation given a complete loss of all installed AC and DC power was not credited in the Circa-2012 Level 1 PRA models because, as discussed in Section 8.1.2 of NRC (2022b), there is a low likelihood of success for this action and, even if successful, the plant would not be in a stable condition (without the FLEX equipment and strategies).

The FLEX strategies, as well as continued TDAFW pump operation given a complete loss of all installed AC and DC power, are only credited in the modeling of station blackout (SBO) accident sequences. The General modeling assumptions and considerations associated with the 2020-FLEX case are addressed in Section 4.

As discussed in Appendix A, the FLEX strategies and continued TDAFW pump operation are each represented in the 2020-FLEX model by a single basic event, as opposed to combinations 4 In pre-FLEX PRA models, this was often referred to as blind feeding. For a post-FLEX PRA model, the current terminology is used, since for some FLEX failure modes (e.g., failure of the FLEX steam generator feed pump),

FLEX may still be able to provide control power for continued TDAFW pump operation. However, it is acknowledged that, in most instances, continued operation of TDAFW requires recovery of some form of installed AC power earlier than the time required to bring in offsite resources. The human error probabilities assigned to the basic events representing failure to successfully implement FLEX or continued TDAFW pump operation include the possibility of not recovering installed AC power in a timely manner.

3-2 of equipment failures and operator errors. The failure probabilities used for FLEX and continued TDAFW pump operation are discussed in Section 3.1.2 and Appendix A.

The CDF results for both the Circa-2012 and 2020-FLEX cases are provided in Table 3-1. As seen in the table, the total CDF from internal events with the reactor shut down is 1.3x10-5/yr for the Circa-2012 case. When the FLEX-related changes (including continued operation of the TDAFW pump) are included in the L3PRA model, the total shutdown CDF is reduced by 49 percent to 6.34x10-6/yr.

The impact on individual initiating events can also be seen in Table 3-1. The primary impact of the FLEX credit is seen in the LOOP initiating events. Other initiating events show small or no reductions in CDF.

The impacts of FLEX on the shutdown CDF results also depend on the POS conditions because that influences which FLEX strategies are available to respond to the event. For POSs where steam generator (SG) cooling is possible (i.e., POSs 3, 4, 5A, 12, and 13), the credit for extended TDAFW pump operation contributes to the overall effectiveness. For the remaining POSs, where SG cooling is not possible (i.e., POSs 5B through 11), only the FLEX strategies themselves are credited.

Table 3-2 presents the CDF results for each POS for the Circa-2012 case and FLEX case. CDF reductions of up to 90 percent are seen for POSs with SG cooling available. POS 6, midloop operations, shows the smallest reduction due to FLEX. This is due to significant CDF contributions in POS 6 from accident sequences unrelated to SBO (e.g., overdraining events).

Table 3-3 shows the CDF contribution from LOOP events for each POS. These results show the effectiveness of implementing FLEX for mitigating LOOP initiating events during shutdown.

A parametric uncertainty analysis for the 2020-FLEX case was performed, which addresses the uncertainties associated with all basic events in the model. The mean CDF and uncertainty distribution are estimated using a Monte Carlo sampling approach using the uncertainty distributions of the contributing basic events. Uncertainty distributions are developed for each basic event representing equipment or human failure. The basic events representing the POS and outage duration fractions are taken as point values without uncertainty. The uncertainty distributions for the FLEX failure probabilities are defined using a constrained noninformative prior distribution as described in NUREG/CR-6823 [Atwood, 2003].

The results of the parametric uncertainty analysis for the FLEX case are shown in Figure 3-1.

The range of the output distribution (95th/5th) is 11.6. The results of parametric uncertainty only provide limited insights. However, greater insights can be obtained by focusing on modeling uncertainty; in particular, as related to the values of the basic events introduced to represent the FLEX failure probabilities. Such modeling uncertainty analyses were performed and are documented in the next section, where CDF for various cases is quantified and compared.

3.1.2 Results of Alternative Analyses Section A.4 discusses the failure probabilities used for FLEX and continued TDAFW pump operation. These probabilities are treated as parameters that are varied to estimate CDF for different cases. The FLEX-related failure probabilities used to estimate the shutdown CDF for the 2020-FLEX case are provided in the table below:

3-3 Basic Event Name Probability F 1-FLEX-FAILS 0.3 T 1-AFW-SBO-NO-FLEX-FA 0.3 A parameter p is defined to represent the combined probability of FLEX failure. The parameter p is given as the product of F and T for POSs with SG cooling available, and p is equal to F for POSs where SG cooling is not available.

The failure probabilities used for FLEX and manual TDAFW pump operations are parametric values chosen by expert judgement, based on PRA experience, experience with 70 Standardized Plant Analysis Risk (SPAR) models for full-power operation, and consistent with the FLEX modeling approach for internal events and floods during power operation (NRC, 2022a). Several alternative analyses were performed to better assess the effect on plant CDF of introducing FLEX into the model. Case 1 is the Circa-2012 case with no credit for FLEX strategies. Cases 2-5 examine the effect of the FLEX failure probability on the model. Case 2 uses more pessimistic failure probabilities for the FLEX-related basic events. Case 3 corresponds to the FLEX case results that are reported in Section 3.1. Case 4 uses a more optimistic failure probability for the event representing successful implementation of FLEX. Case 5 represents the case where the FLEX implementation and extended TDAFW pump operation are assumed to have perfect reliability. The purpose of these additional cases is to demonstrate that the selected failure probabilities for FLEX and continued operation of TDAFW (Case 3) are reasonable and do not unduly influence the results. The results of these analyses are summarized in Table 3-4.

The results of the case studies indicate that, even if FLEX is assumed to always be implemented successfully, the shutdown CDF reduction is limited to 66 percent. The results also indicate that even if the failure probabilities for FLEX implementation and continued operation of the TDAFW pump (if FLEX is not successful) are each raised from 0.3 to 0.5, the percentage of CDF reduction would only drop from 49 to 37 percent.

Note, the results of the case studies indicate that for the purposes of the L3PRA project, there would be very little value in performing a more rigorous and detailed assessment of the FLEX failure probability. However, for regulatory applications, such as event assessment, a more rigorous treatment may be warranted (e.g., obtaining more realistic estimates of operator and equipment failure probabilities). Based on the results of the case studies, the FLEX case (Case 3) appears to be a reasonable choice to be further studied as part of the shutdown Level 2 and Level 3 PRA analyses.

3.1.3 Initial Insights As mentioned in the previous section, crediting FLEX and, where applicable, continued TDAFW pump operation, reduces total shutdown CDF from internal events by nearly 50 percent. Also, as shown in Table 3-4, the shutdown CDF varies by less than a factor of 2 between assuming FLEX is always implemented successfully and assuming more pessimistic failure probabilities for both FLEX implementation and continued operation of the TDAFW pump (i.e., a failure probability of 0.5 for each).

3-4 The Circa-2012 case is dominated by LOOP events (primarily, SBO and SBO-like sequences5),

which collectively contribute nearly 70 percent to total shutdown CDF from internal events. In the 2020-FLEX case, total LOOP CDF is reduced from 8.5x10-6/yr to 2.4x10-6/yr, since the back-up power capabilities of FLEX and the continued operation of TDAFW both help to mitigate SBO sequences. However, LOOP events are still the major contributor in the 2020-FLEX case, though they now contribute only 47 percent of total shutdown CDF from internal events.

FLEX implementation and continued operation of the TDAFW pump have very little impact on the remaining initiating events modeled in the reactor shutdown PRA, since those events do not involve a loss of all AC power. However, because the total shutdown CDF is reduced significantly in the 2020-FLEX case, the relative importance of these other initiators increases.

For example, the second largest contributor to shutdown CDF for both the Circa-2012 and 2020-FLEX cases is associated with the SD-ODML-EARLY event (overdrain entering midloop),

which contributes 10 percent to total shutdown CDF in the Circa-2012 case, but 19 percent to total shutdown CDF in the 2020-FLEX case. Similarly, the SD-LOINV-OP initiating event (a loss of RCS inventory due to an over-pressure condition causing relief valves to open) is the third largest contributor to shutdown CDF for both the Circa-2012 and 2020-FLEX cases, contributing 6 percent of the shutdown CDF for the Circa-2012 case, but 12 percent in the 2020-FLEX case.

Additional insights regarding the results of the Circa-2012 case are provided in Section 9 of NRC (2025a). In particular, NRC (2025a) discusses the quantification results by initiating event category (Section 9.2), POS (Section 9.3), significant accident sequences (Section 9.4), and significant cutsets (Section 9.5).

Similar detailed analysis was not performed for the 2020-FLEX case. However, in both the Circa-2012 and 2020-FLEX cases, the most significant POSs in terms of CDF contribution are the two POSs where the refuel cavity is flooded (POS 8E and POS 8L), which combine to contribute approximately 45 percent to total shutdown CDF for the Circa-2012 case and approximately 24 percent for the 2020-FLEX case. While a flooded refuel cavity affords the operators more time to respond to an initiating event, the risk significance of these two POSs is amplified by their relatively long durations and their maintenance configurations, which limit the equipment available for accident mitigation.

To gain insight into the relative risk significance of individual basic events for the Circa-2012 case, they were ranked by Fussell-Vesely (FV) importance6 (see Table 9.6-1 of Wood [2025a],

though this table specifically excludes basic events representing shutdown initiating event frequencies, as well as the plant outage type and POS duration factors). From this ranking, the most risk-significant basic events involve failures related to restoring onsite or offsite AC power in response to LOOP events. Many of the other basic events with high FV importance are also related to the modeling of LOOP events, such as the basic event representing unavailability of the alternate AC power source during LOOP events (which is assumed unavailable if the offsite grid is impacted) and equipment failures related to emergency AC power (e.g., emergency 5 SBO sequences refer to sequences that involve the complete loss of AC electric power to both safety-related and nonsafety-related switchgear buses (i.e., loss of both offsite and onsite AC power). SBO-like sequences refer to sequences where AC power is lost to all safety-related switchgear buses, though offsite AC power may remain available to nonsafety-related switchgear buses. In terms of plant response to a modeled PRA initiating event, SBO-like sequences progress very similarly to SBO sequences.

6 The FV importance measure for a particular basic event represents the relative contribution to the total end-state frequency (e.g., CDF) from accident scenarios that include that basic event.

3-5 diesel generators [DGs], reserve auxiliary transformer [RAT] supply circuit breakers, and emergency DG load sequencers).

The human failure event (HFE) with the highest FV importance is failure to establish gravity-driven feed to the RCS during a LOOP event. Several other HFEs related to response to shutdown initiating events also have a significant FV importance. The large contribution to shutdown CDF from HFEs is expected because the response to most shutdown initiating events requires operator action to mitigate the accident progression, as opposed to full-power conditions where there is a greater reliance on automatically actuated safety systems.

One interesting insight from the FV importance rankings for shutdown CDF is that several individual component failures have a higher FV importance than the corresponding common-cause failure (CCF) events. Many of the events involve failures related to the onsite emergency power system (e.g., emergency DGs, circuit breakers, and load sequencers). For some POSs (e.g., POS 5A, POS 8E, and POS 8L), only one train of emergency power is available. Under these conditions the importance of the single train failure events is heightened.

Similar detailed analysis was not performed for the 2020-FLEX case. However, a cursory review of the FV importance rankings for the 2020-FLEX case shows a similar set of important basic events. The major difference is in the magnitude of the FV importance. Since the contribution of LOOP scenarios is greatly reduced in the 2020-FLEX case, the relative importance of LOOP-related basic events is reduced (generally by around a factor of 2) and the importance of basic events not directly related to LOOP (e.g., failures associated with residual heat removal [RHR]

cooling) is increased (again, generally by a factor of 2).

In summary, incorporating credit for FLEX strategies and equipment and continued TDAFW operation under extended SBO conditions into the Level 1 PRA model reduces total shutdown CDF from internal events by nearly 50 percent. This CDF reduction is relatively insensitive to the specific failure probabilities assigned to FLEX and continued TDAFW operation. As expected, the primary impact of the FLEX credit is seen in the LOOP initiating eventsother initiating events show small or no reductions in CDF. LOOP events are still the major risk contributor to CDF for the 2020-FLEX case, though their relative contribution is much reduced.

With respect to POS, the 2020-FLEX case shows a reduction of up to 90 percent for POSs with SG cooling available. On the other end of the spectrum, POS 6 (midloop operations) shows the smallest reduction (52 percent), since this POS has a sizeable contribution from accident sequences unrelated to SBO (e.g., overdraining events).

3-6 Figure 3-1 Parametric Uncertainty Results for 2020-FLEX Case

3-7 Table 3-1 CDF Results by Initiating Event Category IE Category Circa-2012 CDF (/yr)(1) 2020-FLEX CDF (/yr)(1)

CDF Reduction 1-SD-LOOP Loss of Offsite Power 8.54E-06 2.37E-06 72.3%

1-SD-ODML-EARLY(2)

Overdrain Midloop 1.23E-06 1.22E-06 0.4%

1-SD-LOINV-OP Loss of Inventory at pressure 7.75E-07 7.74E-07 0.2%

1-SD-LORHR Loss of RHR 6.73E-07 6.64E-07 1.3%

1-SD-LONSCW Loss of Service Water 6.39E-07 6.39E-07 0.0%

1-SD-LO4160V Loss of power to 4160V AC bus 3.74E-07 3.68E-07 1.8%

1-SD-ODML-LATE(2)

Overdrain Midloop 2.28E-07 2.23E-07 2.0%

1-SD-LOINV Loss of Inventory 4.24E-08 4.24E-08 0.0%

1-SD-LOINV-DS Loss of Inventory Displacement 2.02E-08 2.00E-08 1.2%

1-SD-LOINV-SP Loss of Inventory Spray 1.77E-08 1.77E-08 0.3%

1-SD-LOINV-LG Loss of Inventory Large 1.32E-10 1.32E-10 0.0%

Total =

1.25E-05 6.34E-06 49.4%

1.

The core damage frequency (CDF) values in this table are reported as per year, since they already account for the fraction of the year that the plant is in a particular plant operating state (POS). As such, the total shutdown CDF can be added to the at-power internal event CDF (after adjusting for the plant availability factor) to arrive at an estimate of total internal event CDF for at-power and shutdown modes of plant operation.

2.

IE frequency for the over drain events (1-SD-ODML-EARLY and 1-SD-ODML-LATE) are the product of the frequency of entering midloop during the applicable POS per year and the conditional probability of over-draining RCS level when entering midloop:

a. POS 6: 0.59/year x 4.1E-03 = 2.4E-03/year

b. POS 10: 0.51/year x 4.1E-03 = 2.1E-03/year

3-8 Table 3-2 Shutdown CDF by Plant Operating State Shutdown POS Circa-2012 CDF (/yr) 2020-FLEX CDF (/yr)

CDF Reduction POS 3 Mode 4 cooldown 2.3E-08 2.3E-09 90.0%

POS 4 Mode 5 cooldown 1.7E-07 1.7E-08 90.1%

POS 5A Pressurizer solid 2.0E-06 1.3E-07 56.0%

POS 5B Draining RCS 7.5E-07 1.8E-07 41.9%

POS 6 Midloop (pre-refuel) 1.6E-06 1.1E-07 7.4%

POS 7 Filling refuel cavity 2.0E-07 5.6E-08 51.7%

POS 8E Refuel cavity flooded (pre-refuel) 3.3E-06 8.7E-07 57.7%

POS 8L Refuel cavity flooded (post-refuel) 2.4E-06 6.5E-07 58.6%

POS 9 Draining refuel cavity 4.7E-07 1.0E-07 39.3%

POS 10 Midloop (post-refuel) 7.2E-07 1.2E-07 27.7%

POS 11 Vacuum fill RCS 2.7E-07 8.3E-08 53.2%

POS 12 Mode 5 heat-up 4.2E-07 4.3E-08 89.7%

POS 13 Mode 4 heat-up 1.6E-07 1.6E-08 89.8%

Total Shutdown CDF 1.3E-05 6.3E-06 49.4%

3-9 Table 3-3 Shutdown LOOP CDF Contribution by Plant Operating State Shutdown POS Circa-2012 LOOP CDF

(/yr) 2020-FLEX LOOP CDF

(/yr)

CDF Reduction POS 3 Mode 4 cooldown 2.3E-08 2.3E-09 90.0%

POS 4 Mode 5 cooldown 1.7E-07 1.7E-08 90.1%

POS 5A Pressurizer solid 1.3E-06 1.3E-07 90.0%

POS 5B Draining RCS 4.9E-07 1.8E-07 63.3%

POS 6 Midloop (pre-refuel) 2.2E-07 1.1E-07 51.8%

POS 7 Filling refuel cavity 1.6E-07 5.6E-08 65.0%

POS 8E Refuel cavity flooded (pre-refuel) 2.7E-06 8.7E-07 68.4%

POS 8L Refuel cavity flooded (post-refuel) 2.1E-06 6.5E-07 68.5%

POS 9 Draining refuel cavity 2.8E-07 1.0E-07 63.3%

POS 10 Midloop (post-refuel) 3.1E-07 1.2E-07 62.1%

POS 11 Vacuum fill RCS 2.3E-07 8.3E-08 63.4%

POS 12 Mode 5 heat-up 4.2E-07 4.3E-08 89.7%

POS 13 Mode 4 heat-up 1.6E-07 1.6E-08 89.8%

Total Shutdown CDF 8.5E-06 2.4E-06 72.3%

3-10 Table 3-4 Additional Cases and Comparisons Case 1 Circa-2012 Case Case 2 Pessimistic FLEX (Note 1)

Case 3 FLEX Case Case 4 Optimistic FLEX Case 5 Perfect FLEX F FLEX basic event failure probability TRUE 0.5 0.3 0.1 FALSE T

TDAFW basic event failure probability (Note 2)

TRUE 0.5 0.3 0.3 FALSE SG cooling possible p = F x T (Note 3)

No FLEX credit 0.25 0.09 0.03 Perfect FLEX No SG cooling p = F No FLEX credit 0.5 0.3 0.1 Perfect FLEX Shutdown CDF (/yr) 1.3E-05 7.9E-06 6.3E-06 5.0E-06 4.3E-06

% CDF Reduction N/A 36.9%

49.4%

60.5%

66.0%

Notes

1. As used in the column headings for this table, FLEX refers to both FLEX strategies and continued TDAFW pump operation given a complete loss of all installed AC and DC power.

2. TDAFW failure probability refers to the failure probability for continued TDAFW pump operation given a complete loss of all installed AC and DC power.

3. The joint failure probability (p) that neither the FLEX strategies nor the continued operation of TDAFW (if FLEX is not successful) is capable of preventing core damage for SBO sequences.

3.2 Level 2 PRA This section provides a summary of the results and insights from the Level 2 PRA for internal events during reactor shutdown. Section 3.2.1 provides the release frequency results for both the Circa-2012 and 2020-FLEX cases. Section 3.2.2 discusses alternative analyses to assess the effects of modeling assumptions on the Level 2 PRA results for the 2020-FLEX case.

Section 3.2.3 discusses insights from the Level 2 PRA for internal events during reactor shutdown, including a discussion of the dominant contributors to release category frequencies for both the Circa-2012 and 2020-FLEX cases.

3.2.1 Results of Circa-2012 and 2020-FLEX Cases A detailed description of the Circa-2012 Level 2 PRA model and results for internal events during reactor shutdown is provided in the respective L3PRA project report (NRC, 2025b). The 2020-FLEX case updates the Circa-2012 models to include the FLEX strategies and equipment for responding to an ELAP. In addition, if FLEX is not successful, the 2020-FLEX case credits the potential for continued TDAFW pump operation given a complete loss of all installed AC and DC power. The FLEX strategies are intended to provide coping capability to prevent core damage; therefore, the primary effect of FLEX strategies on the PRA model is a reduction of the

3-11 CDF in the Level 1 PRA model (as discussed in Section 3.1.1). The Level 1 PRA 2020-FLEX case model changes result in reduced shutdown CDF contributions from the sequences involving SBO events. The main impact on the Level 2 PRA model for FLEX strategies is carrying forward the modified Level 1 sequences, which results in reduced frequencies for the applicable release categories.

This section provides a comparison of the 2020-FLEX case results to the Circa-2012 case. The Circa-2012 case is based on the reference plant as it was designed and operated as of 2012 and does not reflect the FLEX strategies. However, the Circa-2012 case does include severe accident mitigating strategies that can delay or arrest core damage and subsequent releases. It should also be noted that the Circa-2012 case is based on the SAMG versions from that timeframe. At that time the guidance stated that the SAMGs should not be used for accidents that are initiated during shutdown operations. Therefore, there are no SAMG-directed actions modeled in the Circa-2012 shutdown Level 2 PRA. However, there are post-core-damage actions credited based on the reference plants extensive damage mitigation guidelines (EDMGs).

Updated versions of the SAMGs for the reference plant were later obtained, but these were not provided in time to be incorporated into the Level 2 PRA modeling and analysis. The updated SAMGs are applicable to accidents initiated in all modes of operation. The updated SAMGs also list FLEX equipment, along with other installed plant equipment, as possible resources for implementing the strategies. The potential impacts of these changes to the SAMGs are considered in sensitivity studies for this analysis of the FLEX strategies in Section 3.2.2.

The Level 2 PRA accident sequences are binned into release categories, as described in the shutdown Level 2 PRA report (NRC, 2025b). A description of each release category is provided in Table 3-5. The release category frequency results for the 2020-FLEX case and the Circa-2012 case are provided in Table 3-6. Figure 3-2 shows the comparison of release category frequency results for the 2020-FLEX and Circa-2012 cases. Figure 3-3 shows the percent contribution of each release category to the total release frequency for the 2020-FLEX and Circa-2012 cases. The contributions of individual release category frequencies are discussed further in Section 3.2.3.

Level 2 PRA results are often reported in terms of one or more surrogate risk metrics. The three project-specific risk metric definitions that are used for this study (LERF, LRF, and conditional containment failure probability [CCFP]) are described in Section 2.6.1 of the Level 2 PRA report for the reactor at shutdown (NRC, 2025b). The definitions of these three risk metrics, as well as total release frequency, are provided below:

Total release frequency: the total combined release frequency from all release categories including releases where the containment is not bypassed or failed and radiological release to the environment occurs via design-basis containment leakage only

3-12 LERF (early fatalities): Release categories are defined to contribute to LERF if their representative source term has a warning time (based on Iodine release exceeding 1 percent) less than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> and the cumulative Iodine release fraction is greater than 4 percent.7 LRF: Large release frequency includes release categories that include containment bypass or containment failure, excluding those where fission product scrubbing (or other mechanisms) result in a source term comparable to, or smaller than, the remainder of the intact containment source terms.

CCFP: Conditional containment failure probability is defined as the ratio of the release category frequencies involving a failed or bypassed containment to the total release frequency.

A comparison of the surrogate risk metric results for the Circa-2012 and 2020-FLEX cases is provided in Table 3-7. The release categories contributing to each surrogate risk metric are identified in the notes at the bottom of Table 3-7. A detailed characterization of each release category and discussion of surrogate risk metric criteria are provided in Section 3.2.2 and Table 3-9. This provides the information to determine which release categories contribute to the different surrogate risk metrics.

As can be seen from Table 3-7, LERF for the 2020-FLEX case is approximately 60 percent lower than for the Circa-2012 case. Two of the three release categories contributing to LERF (1-REL-SD-COPEN-RCSINTACT and 1-REL-SD-COPEN-RCSVENT) are dominated by SBO sequences, so the FLEX model changes result in a significant reduction in LERF. Table 3-7 also shows that LRF is significantly reduced by approximately 48 percent. Five of the eight release categories that contribute to LRF are dominated by SBO sequences (1-REL-SD-CF-BEFORE-CD, 1-REL-SD-CIF, 1-REL-SD-COPEN-HEADOFF, 1-REL-SD-COPEN-RCSINTACT and 1-REL-SD-COPEN-RCSVENT).

CCFP is slightly higher in the 2020-FLEX case when compared to the Circa-2012 case. This is because, as can be seen from Table 3-6, the No containment failure release category (1-REL-SD-NOCF) is significantly reduced in the 2020 FLEX case. So, while the total frequency of severe accidents goes down significantly, the fraction of those accidents that lead to containment failure is slightly larger. However, it is important to note that the frequency of a severe accident that leads to containment failure goes down substantially in the 2020-FLEX case.

A parametric uncertainty analysis for the 2020-FLEX case was performed. A summary of the results for the release category frequencies and surrogate risk metrics is given in Table 3-8.

3.2.2 Results of Alternative Analyses Alternate analyses were performed to assess the impacts of three of the key modeling assumptions and sources of uncertainty on the 2020-FLEX case results. Specifically, alternate analyses were performed to assess the impact on the 2020-FLEX case results from 7 The reactor-at-power Level 2 PRA (NRC, 2022c) includes the same definition of LERF based on potential for early injuries and a second definition of LERF based on potential for early fatalities with a warning time criterion of less than 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The more inclusive definition based on potential for early injuries is used in the reactor-at-shutdown Level 2 PRA.

3-13 (1) alternate assumptions regarding the termination of radiological releases, (2) credit for additional post-core-damage recovery actions that could mitigate or terminate releases, and (3) actions to maintain containment integrity during Modes 5 and 6. The first two items address the possibility of actions that are not modeled in the PRA but, if successfully implemented, could prevent or mitigate releases. The possible actions could include SAMG-directed actions that were not applicable to shutdown scenarios at the time of the Circa-2012 analysis. The third item addresses a specific strategy in the reference plants FLEX plan.

Radiological Release Termination Time In both the Circa-2012 and 2020-FLEX cases, the source term analysis assumes a termination of radiological releases at 7 days (168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br />) after the event initiation. However, it is possible that releases could be terminated earlier considering possible onsite and offsite resources and recovery actions that are beyond the scope of this model. For example, actions directed by SAMGs could potentially result in release termination. However, SAMG-guided actions were not credited for the Circa-2012 analysis because the version of the reference plants SAMGs at the time of the analysis explicitly excluded actions for events initiating with the reactor shutdown.

Subsequently, the reference plants SAMGs were updated to include actions relevant to shutdown operations. This alternate evaluation considers earlier release termination times to assess the impacts of potential post-core-damage recovery actions. Alternate termination times of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> and 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after indication of core damage are applied to the release category representative accident scenarios. The indication of core damage is defined as indication of core exit temperature exceeding 1200 F. A similar evaluation of earlier accident termination times was performed for the Circa-2012 case as discussed in Section 2.6.1 and Section 2.6.3.15 of the shutdown Level 2 PRA report (NRC, 2025b).

Table 3-9 provides details of the key parameter timeline for each of the release category representative accident scenarios. This information assists in interpreting the alternate termination results. The key parameters are defined below.

General Emergency (GE) declaration - The timing of declaring a GE is based on plant-specific emergency action level determination guidance and the specific conditions of the accident scenario. There are several different criteria and plant indications that can prompt the GE declaration. The assessments of each modeled accident scenario and the estimated times of GE declaration are discussed in Section 2.5.2 and Table 2.5-3 of the shutdown Level 2 PRA report (NRC, 2025b).

Time of core damage (CD) indication - The indication of core damage marks the transition from the plant operators using the operating procedures in response to the initiating plant condition to using applicable guidance and strategies to terminate core damage and mitigate releases. The MELCOR simulated time to reach average temperature of coolant at core exit of 1200 F is used as a surrogate for the timing of imminent core damage.

Warning time - The warning time is defined as the time when the cumulative environmental iodine release fraction exceeds 1 percent (or time of noble gas release fraction exceeds 10 percent, if this occurs first) minus the time that GE declaration occurs. Warning time is an input used in the LERF definition. The warning time gives an indication of the time available for evacuating populations, which can significantly influence the occurrence of early radiological health effects.

3-14 Time to LERF threshold - The LERF definition includes criteria on the warning time and the cumulative environmental iodine release fraction exceeding 4 percent. In assessing the timing of reaching the threshold, the second criterion is the determining factor. The release categories that do not meet the LERF warning time criteria indicate N/A in this column.

Time to LRF threshold - The LRF is the summation of the frequency of all release categories that include containment bypass or containment failure, excluding those where fission product scrubbing (or other mechanisms) result in a source term comparable to, or smaller than, the remainder of the intact containment source terms.

For the purposes of assessing timing of LRF, a threshold value is designated to determine when a release is significantly greater than the reference intact containment source term. The time when the cesium environmental release fraction exceeds 10-3 is used as the criterion for a large release that is not comparable to the intact containment source term. The time to LRF threshold is provided as a reference point to consider if earlier release termination times could prevent a large release.

Time of containment failure - This refers to the timing of failure of the containment structure or timing of opening a containment bypass release pathway. A time of 0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> indicates a containment bypass is open throughout the entire duration of the scenario.

Table 3-9 shows the times to reach the LERF, LRF, and containment failure criteria. If an earlier accident termination time is assumed, then some of the scenarios may not reach the thresholds for LERF, LRF, or containment failure. Table 3-10 includes results showing the impacts of alternate assumptions regarding the termination of radiological releases. As seen in Table 3-10, the LERF result is insensitive to the accident termination time assumptions. However, the LRF and CCFP results can be significantly reduced if the releases can be terminated by 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after core damage indication. The reduction of LRF and CCFP are primarily driven by preventing containment failure due to a large combustion event associated with release category 1-REL-SD-ICF-BURN. It should also be noted that besides reducing the LRF surrogate risk metric, earlier accident termination times also reduce the magnitude of the radiological releases.

This sensitivity analysis shows that selection of a shorter scenario modeling time results in reductions of LRF and CCFP. As discussed at the beginning of this section, if there are credible reasons to model an accident scenario termination time at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after core damage indication, then both LRF and CCFP would be reduced by approximately a factor of 2. This is a significant reduction.

Additional Post-Core-Damage Recovery Actions Another set of alternate analyses was performed to assess the impacts of potential post-core-damage recovery actions that could mitigate or terminate releases. The Level 2 PRA human reliability analysis (HRA) approach, as described in (NRC, 2022c), excluded credit for operator actions following core damage during SBO and for actions in the long-term (meaning roughly 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> or more after vessel breach during all scenarios). Also, SAMG-guided actions are not credited because the reference plants SAMG guidance explicitly excluded actions for events

3-15 initiating with the reactor shutdown.8 The credited post-core-damage actions are based on the reference plants EDMGs. The reference plant has updated SAMG guidance that includes shutdown operations. The updated guidance could provide a more robust set of post-core-damage actions and make use of FLEX-related equipment. It is expected that operators would continue to take actions under SBO conditions and during the longer timeframes, including possibly making use of offsite resources. While modeling the reliability of such actions is beyond the scope of the Level 2 PRA HRA approach for the L3PRA project, the potential impacts of these actions are assessed in these alternate analyses.

The alternate analyses show how varying the reliability of possible longer-term recovery actions would affect the surrogate risk metrics LERF, LRF, and CCFP. A similar set of alternate analyses was performed for the Circa-2012 case results and is described in the discussion of model uncertainty for the Level 2 PRA (Section 2.6.3.3 of NRC [2025b]).

These alternate analyses are performed by applying a set of recovery factors to represent failure of possible recovery actions. Three categories of recovery actions are considered:

actions that prevent significant combustion events, actions that successfully control containment pressure, and actions to flood containment to prevent basemat failure. While SAMGs are not credited for shutdown accidents in the base case results, these postulated actions can provide indications of potential benefits of SAMG-guided actions.

The analyses assume that recovery actions will have an overall positive effect (i.e., the potential for actions to exacerbate the accident is not considered). A failure probability of 0.1 is assumed for each of the recovery factors. The recovery factors are applied to the release category frequencies, resulting in a reduced frequency contribution for the applicable release categories.

Successful recovery actions are accounted for by applying the success terms (i.e., 1.0-0.1=0.9),

resulting in an increased frequency for the release categories impacted by the successful actions. The rational for which release categories would be impacted by the recovery factors is outlined below.

Actions that prevent significant combustion events in the long term (RFcombust)

Examples of these actions include venting combustible gases or igniting at lower flammability levels. Because sequences with combustion-induced containment failure almost exclusively involve late containment heat removal or otherwise mitigated containment pressure, late overpressure is generally not the secondary result if combustion were to be controlled. The sequences affected by the contemplated actions would mainly be driven to releases resulting from basemat melt-through (i.e., from 1-REL-SD-ICF-BURN to 1-REL-SD-BMT).

Actions that successfully control containment pressure through restoration of containment heat removal or containment venting (RFpressure)These actions would tend to drive sequences to the intact containment end state (i.e., from 1-REL-SD-CF-BEFORE-CD and 1-REL-SD-LCF to 1-REL-SD-NOCF).

8 The reference plant provided revisions to their SAMG guidance documents that include shutdown operations within their scope. These updated SAMGs were not available, and thus not considered, at the time the analysis was performed. This is consistent with the overall L3PRA project approach, which reflects the reference plant as it was designed and operated as of 2012.

3-16 Actions that flood the cavity with timing and flow rates sufficient to arrest basemat ablation prior to basemat melt-through (RFBMT)These actions drive frequency from the 1-REL-SD-BMT release category to the 1-REL-SD-NOCF release category.

The risk surrogate results with the alternative recovery action assumptions are shown in Table 3-11. The alternatives show the possible impacts that combinations of recovery actions could have on the results assuming a human error probability of 0.1 for each of the actions. The alternative analyses in Table 3-11 consider each recovery action individually and the combined effects of multiple recovery actions. However, it should be noted that this analysis does not consider the dependencies between actions; for example, actions to control containment pressure could adversely impact the likelihood of combustion in the containment.

As seen in the table, the LERF result is unaffected by any of the recovery actions due to the timeframes involved. However, the LRF and CCFP results can be significantly reduced if recovery actions can be implemented within the necessary timeframe. Actions that prevent large combustion events, RFcombust, and actions that successfully control containment pressure through restoration of containment heat removal or containment venting, RFpressure, appear to be effective in reducing LRF. These actions or combinations of actions that can prevent large combustion events and long-term overpressure failure of the containment may be areas that provide the greatest potential risk benefit when considering post-core-damage mitigation strategies.

Containment Venting during Modes 5 and 6 This alternate analysis considers FLEX-related actions to establish or verify a containment vent flow path during Modes 5 and 6. This strategy applies to modeled POSs 4 through 12. Actions to vent containment were not identified and not modeled as part of the Circa-2012 case, which was evaluated prior to FLEX implementation. The containment venting strategy during Modes 5 and 6 also is not modeled as part of the 2020-FLEX case and the results reported in Section 3.2.1. The alternate analysis discussed just previously (Additional Post-Core-Damage Recovery Actions) considers the impact of containment venting along with other potential post-core-damage recovery actions. These are hypothetical actions that are assumed to have a positive impact on the release category end state. The alternate analysis discussed in this section takes a focused look at the FLEX-related containment venting strategy and considers its impact on the modeled pre-core-damage operator actions to isolate containment. The outcome of the analysis shows the potential beneficial and negative impacts from shifting release frequency between an intact containment and different containment failure end states.

While the containment venting strategy is identified in the reference plants FIP, no additional information on implementing this strategy (e.g., procedural guidance, cues, or timing) was available at the time of the analysis. This precluded modeling additional human actions to represent the FLEX-directed venting strategy. However, this alternate analysis provides a sensitivity case on the modeled containment isolation actions that provides insight into the potential impacts of the FLEX strategy for containment venting during Modes 5 and 6.

The alternate analysis considers the impacts of the containment venting strategy by modifying the failure probabilities related to containment isolation actions. The containment isolation failure release category, 1-REL-SD-CIF, models the impact of failure to isolate small containment penetrations. This category excludes large containment openings (e.g., the equipment hatch and the personnel airlock), which are represented by other release categories. The 1-REL-SD-

3-17 CIF release category uses a representative accident sequence that models a 2-inch diameter opening from containment to the environment at an elevation of 1 foot above the lower containment floor. The impact of this containment isolation failure is expected to be similar to the impact of establishing the containment venting strategy, though the size and location of the vent path can influence the release. Variations on the size and location of the containment isolation failure are discussed in Section 2.5.2 and Section 2.6.3.12 of the shutdown Level 2 PRA report (NRC, 2025b).

The fault tree model of containment isolation failures includes human failures to isolate small penetrations (typically 1 inch or less) that are identified in the reference plant operating procedures and containment penetration verification check list. The human failure is represented by basic event 1-CIS-XHE-XL-ISOLPEN and variations of this event that incorporate dependency with other modeled actions. These actions are described in further detail in Appendix D of NRC (2025b).

For the alternate analysis, the implementation of the FLEX containment vent strategy is assumed to have a failure probability of 0.3. This is the same failure probability assumed for implementing the FLEX portable equipment, as discussed in Section 3.1.2. The containment vent failure is implemented in the model by adjusting the containment isolation failure HFEs and equating these failures to success of the containment venting strategy. As such, the containment isolation human error probabilities (HEPs) are adjusted to a value of 0.7 (= 1-0.3).

The basic event settings for the containment venting alternate analysis are summarized in Table 3-12. The desired impacts of these changes are to represent a higher likelihood compared to the base case that operators will successfully establish a small containment vent that would have a similar release as the 1-REL-SD-CIF release category. The alternate analysis does not consider any recovery action or post-core-damage action to close the containment vent once it is established.

The impacts of this alternate analysis on the release category frequencies and surrogate risk metrics are shown in Table 3-13. The primary impact on the release category frequencies is a substantial increase in the containment isolation failure frequency (1-REL-SD-CIF), with a frequency about 7 times greater than the 2020-FLEX case frequency. The impacts of the alternate HEP values for the containment isolation HFEs, as shown in Table 3-12, lead to an overall increase in containment isolation failure, which is intended to represent the corresponding increased likelihood of implementing the FLEX containment venting strategy.

The increase in release frequency for release category 1-REL-SD-CIF corresponds to decreases in frequencies for other release categories that include successful containment isolation. The largest frequency decreases are associated with the following release categories:

1-REL-SD-CF-BEFORE-CD - This release category represents a containment overpressure failure due to evaporation and boiling of refueling cavity water during a long-duration (i.e., greater than 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br />) SBO scenario.

1-REL-SD-ICF-BURN - This release category represents a containment failure due to a global deflagration or detonation.

1-REL-SD-NOCF - This release category represents an intact containment where the radiological releases to the environment occur via normal containment leakage within the allowable design limits.

3-18 Release categories that exhibit smaller decreases in frequency due to the increase to the 1-REL-SD-CIF frequency include 1-REL-SD-BMT, 1-REL-SD-ECF, 1-REL-SD-ISLOCA,9 and 1-REL-SD-LCF. The release categories that represent failures to close the containment equipment hatch (i.e., 1-REL-SD-COPEN-HEADOFF, 1-REL-SD-COPEN-RCSINTACT, and 1-REL-SD-COPEN-RCSVENT) are not impacted by the alternate containment venting analysis.

The surrogate risk metric results for the alternate containment venting case are shown in Table 3-13. The alternate analysis has no impact on the LERF results. However, the surrogate risk metrics LRF and CCFP show a significant increase compared to the 2020-FLEX case. The reason for the change in LRF and CCFP is the shifting of frequency from the intact containment category, 1-REL-SD-NOCF, to the containment isolation failure category, 1-REL-SD-CIF.

The results of the alternate analysis show a mix of potential beneficial and negative impacts.

The shifting of frequencies from release categories associated with containment overpressure failure and combustion-induced containment failure show the potential benefit of implementing a containment venting strategy. Table 3-13 provides the release fractions of the cesium and iodine chemical classes for each release category, which provides an indication of the release magnitude. In this case, the 1-REL-SD-CIF has a smaller release magnitude than 1-REL-CF-BEFORE-CD, and is similar to, though somewhat larger than, 1-REL-SD-ICF-BURN. The release magnitude of the representative releases can be influenced by several modeling choices related to the size and location of the release pathway, and this is evaluated through sensitivity studies in the shutdown Level 2 PRA uncertainty analysis (NRC, 2025b). Given the uncertainties in the release magnitudes, the 1-REL-SD-CIF release category could be viewed as a more positive outcome compared to release categories with potentially larger containment failure sizes. Therefore, a containment venting strategy could potentially show benefit by shifting portions of the failed containment release categories to a vented containment release category with a smaller release magnitude.

The negative impacts of the containment venting strategy are shown by the shift in frequency from the intact containment category, 1-REL-SD-NOCF, to the containment isolation failure category, 1-REL-SD-CIF. The release fractions show a significantly larger release magnitude associated with 1-REL-SD-CIF compared to 1-REL-SD-NOCF. The shift in frequency from 1-REL-SD-NOCF to 1-REL-SD-CIF is also the primary contribution to the increase in risk surrogate measures LRF and CCFP. Reducing the intact containment frequency in favor of a vented containment release category is clearly a negative outcome.

3.2.3 Initial Insights As discussed previously, the primary impact on the Level 2 PRA of crediting FLEX strategies is the reduction of frequencies resulting in radionuclide releases. As shown in Section 3.2.1, the combined effects of the FLEX strategies and continued TDAFW pump operation in the 2020-FLEX case reduce total release frequency reduced by nearly 50 percent. The surrogate risk metrics of LERF and LRF are also reduced significantly in the 2020-FLEX case (by 60 percent and 48 percent, respectively). The alternative analyses described in Section 3.2.2 9 Some of the release categories, like 1-REL-SD-ISLOCA, could be expected to be unaffected by modeling of a containment venting strategy. However, the simplified approach in this alternate analysis is to modify the containment isolation failure HEPs. The interfacing systems loss-of-coolant accident (ISLOCA) release category contains cutsets with success events for containment isolation failures. As such, the alternate analysis shows small impacts on the release frequency due to modifying these events. A more rigorous modeling approach to represent the FLEX-related containment venting strategy would likely avoid these impacts.

3-19 show that two of the Level 2 risk surrogate metrics (LRF and CCFP), and the radiological release magnitudes, can be further reduced if earlier accident termination or recovery actions are successful (LERF is unaffected).

As expected, some of the largest FLEX impacts are seen for the release categories that are dominated by SBO sequences: 1-REL-SD-CF-BEFORE-CD, 1-REL-SD-CIF, 1-REL-SD-COPEN-HEADOFF, 1-REL-SD-COPEN-RCSINTACT, and 1-REL-SD-COPEN-RCSVENT.

Conversely, there is no impact on the frequency of the release category that involve a containment bypass scenario: 1-REL-SD-ISLOCA.

Release category 1-REL-SD-NOCF, which represents an intact containment, also shows a significant reduction in release category frequency. The Circa-2012 case results show that SBOs occurring during POS 8L after refueling were the dominant sequence for 1-REL-SD-NOCF (see Section 2.4.6 of NRC [2025b]). These sequences are identified as core damage sequences in the shutdown Level 1 PRA based on loss of and failure to recover all long-term cooling functions. However, accident sequence simulations performed for the shutdown Level 2 PRA identified conditions where no containment failure, and in some cases no core damage, would occur for the 7-day simulation time. As such, the Level 2 PRA includes sequences in the 1-REL-SD-NOCF release category when the event occurs after refueling, containment is successfully isolated, and RCS injection is established with adequate refueling water storage tank (RWST) inventory or the refueling cavity is flooded.10 This includes the SBOs during POS 8L sequences that dominated the 1-REL-SD-NOCF results in the Circa-2012 case. The addition of the FLEX credit significantly reduces the contributions of these sequences to the 1-REL-SD-NOCF release category.

The dominant release categories for the 2020-FLEX case in terms of frequency contributions are 1-REL-SD-NOCF, 1-REL-SD-ICF-BURN, 1-REL-SD-CF-BEFORE-CD, and 1-REL-SD-CIF.

The frequency results do not reflect the differences in the release magnitudes of the release categories and their overall contributions to risk. For example, the 1-REL-SD-NOCF release category represents an intact containment and does not contribute to LERF, LRF, or CCFP.

Both LERF and LRF surrogate risk metrics are significantly reduced in the 2020-FLEX case.

The release category contributions to the surrogate risk metrics are provided in Table 3-10.

There are many similarities in the contributions to both the 2020-FLEX case and the Circa-2012 case. For instance, both cases have significant contributions from SBO and overdraining entering mid-loop. However, for the 2020-FLEX case, while the SBO contribution is still significant in a relative sense, the absolute frequency of the contribution is much less than for the Circa-2012 case.

Similar to the Circa-2012 analysis (NRC, 2025b), a set of significant release categories for the 2020-FLEX case is defined to identify the contributions that are important to the surrogate risk metrics LERF, LRF, and overall release. The selection of significant release categories is based on the definition of significant radionuclide release category from the ASME/ANS Level 2 PRA Trial Use and Pilot Application standard (ASME, 2014). A significant radionuclide release category is defined as:

10 The shutdown Level 2 PRA report (NRC, 2025b) describes the modeling that identifies sequences that would result in no containment failure but be included in the 1-REL-SD-NOCF release category. This is addressed in the 1-L2-REC top event in the containment event tree.

3-20 One of the set of radionuclide release categories contributing to LRF/LERF or to the overall radionuclide release frequency that, when rank-ordered by decreasing frequency, sum to 95% of the LRF/LERF or overall release frequency (excluding design basis leakage RCs) or individually contribute more than 1% of LRF/LERF or 5% of the overall release frequency.

This assessment yields the following set of significant release categories:

1-REL-SD-CF-BEFORE-CD 1-REL-SD-CIF 1-REL-SD-COPEN-RCSINTACT 1-REL-SD-COPEN-RCSVENT 1-REL-SD-ICF-BURN 1-REL-SD-ISLOCA The significant release categories for the 2020-FLEX case are the same as the Circa-2012 case, except 1-REL-SD-COPEN-HEADOFF is not significant for the 2020-FLEX case. The 1-REL-SD-COPEN-HEADOFF release category, which is dominated by SBO sequences, is no longer a significant frequency contributor to LRF. Again, it should be noted that significance in this context pertains to release category frequency, not consequences. However, by including those release categories that contribute to LERF and LRF, the definition of the significant release category is intended to include release categories that are both high frequency contributors and have significant release magnitudes.

The highest frequency accident sequence for each of the release categories is described here.

1-REL-SD-BMT highest frequency accident sequence RHR cooling is lost due to overdraining when entering mid-loop during POS 6. Initial restoration of RHR cooling fails. Pumped injection is successfully initiated, but core damage occurs due to failure to restore long-term shutdown cooling. Containment penetrations are successfully isolated. Post-core-damage action to recover vessel injection fails. Core degradation continues and vessel breach occurs. Molten core-concrete interaction contributes to combustible gas generation, but global deflagration or detonation of combustible gases in containment does not occur. Containment is breached due to gradual concrete erosion in the reactor cavity.

1-REL-SD-CF-BEFORE-CD highest frequency accident sequence A loss of service water occurs during POS 8E. Actions to restore service water fail.

Containment penetrations are successfully isolated. Without containment heat removal systems available, containment gradually pressurizes due to evaporation and boiling of refueling cavity water, eventually resulting in containment overpressure failure. Core damage occurs a few hours after containment failure due to failure to restore RHR cooling.

1-REL-SD-CIF highest frequency accident sequence A LOOP occurs during POS 8E. Onsite emergency AC power fails resulting in SBO. Gravity-driven injection fails. Actions to implement FLEX strategies fail. Core damage occurs due to failure to restore power and RHR cooling. The containment equipment hatch and personnel

3-21 airlock are successfully closed, but operators fail to isolate containment penetrations. The release is not scrubbed by sprays or water pools.

1-REL-SD-COPEN-HEADOFF highest frequency accident sequence A LOOP occurs during POS 8E with the reactor vessel head removed and the refueling cavity flooded. Onsite emergency AC power fails resulting in SBO. Gravity-driven injection fails. Actions to implement FLEX strategies fail. Core damage occurs due to failure to restore power and RHR cooling. Closure of the containment equipment hatch fails. The release has a direct pathway to the environment via the open equipment hatch.

1-REL-SD-COPEN-RCSINTACT highest frequency accident sequence A LOOP occurs during POS 5A with the RCS intact. Onsite emergency AC power fails resulting in SBO. Steam generator cooling with TDAFW is initially successful. Actions to extend TDAFW operation and implement FLEX strategies fail. Core damage occurs due to failure to restore power and long-term shutdown cooling. Closure of the containment equipment hatch fails. The release has a direct pathway to the environment via the open equipment hatch.

1-REL-SD-COPEN-RCSVENT highest frequency accident sequence A LOOP occurs during POS 5B with the RCS vented via removal of three pressurizer safety valves. Onsite emergency AC power fails resulting in SBO. Gravity-driven injection fails.

Actions to implement FLEX strategies fail. Core damage occurs due to failure to restore power and RHR cooling. Closure of the containment equipment hatch fails. The release has a direct pathway to the environment via the open equipment hatch.

1-REL-SD-ECF highest frequency accident sequence RHR cooling is lost due to overdraining when entering mid-loop during POS 6. Initial restoration of RHR cooling fails. Pumped injection is successfully initiated, but core damage occurs due to failure to restore long-term shutdown cooling. Containment penetrations are successfully isolated. Post-core-damage action to recover vessel injection fails. In-vessel steam explosion occurs causing containment failure with a 4-inch equivalent diameter at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation.

1-REL-SD-ICF-BURN highest frequency accident sequence RHR cooling is lost due to overdraining when entering mid-loop during POS 6. Initial restoration of RHR cooling fails. Pumped injection is successfully initiated, but core damage occurs due to failure to restore long-term shutdown cooling. Containment penetrations are successfully isolated. Post-core-damage action to recover vessel injection fails. Post-core-damage action to establish containment spray is successful. A detonation occurs during the period after vessel breach resulting in containment failure. The representative time to reach detonable conditions in containment is 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after event initiation based on the stochastic combustion modeling.

3-22 1-REL-SD-ISLOCA highest frequency accident sequence Loss of inventory occurs during POS 5A with failure of an RHR relief valve to reclose after opening. Operators fail to diagnose and isolate the loss before RCS makeup is needed.

Pumped injection is successfully initiated, but core damage occurs due to failure to restore long-term shutdown cooling. Loss of inventory results in a containment bypass pathway to the auxiliary building through the stuck-open RHR relief valve.

1-REL-SD-LCF highest frequency accident sequence A LOOP occurs during POS 5B. Onsite emergency AC power fails resulting in SBO. Gravity-driven injection fails. Actions to implement FLEX strategies fail. Core damage occurs due to failure to restore power and RHR cooling. Containment penetrations are successfully isolated. Post-core-damage actions to recover vessel injection and containment spray fail.

Molten core-concrete interaction contributes to combustible gas generation, but an energetic combustion event that could challenge containment does not occur. Without containment heat removal systems available, containment gradually pressurizes resulting in containment overpressure failure. The release is not scrubbed by sprays or water pools.

1-REL-SD-NOCF highest frequency accident sequence RHR cooling is lost due to overdraining when entering mid-loop after refueling during POS 10. Initial restoration of RHR cooling fails. Pumped injection is successfully initiated, but core damage occurs due to failure to restore long-term shutdown cooling. Containment penetrations are successfully isolated. Containment remains intact.

To gain insight into the relative risk significance of individual basic events for the combined set of significant release categories for the 2020-FLEX case, they were ranked by FV importance.

From this ranking, the following types of events were identified as among the highest contributors:

Events representing the fraction of average annual exposure to plant outage and plant operating states. These events indicate that accident scenarios during POS 5A, POS 5B, POS 6, POS 7, POS 8E, POS 9, and POS 10 are significant contributors to the significant release categories.

Numerous events related to modeling the overall likelihood of energetic combustion events that can result in containment failure. These include the probability of a detonation occurring late in the accident progression, the likelihood of the presence of an ignition source during different phases of the accident progression, and the probability of combustion occurring during different phases of the accident progression.

Events representing shutdown initiating event frequencies, including LOOP and overdraining when entering mid-loop.

Post-core-damage HFEs representing failure to recover injection to the reactor vessel and failure to initiate containment sprays.

Events representing failures to implement FLEX strategies.

3-23 Events related to restoration of AC power during LOOP and SBO sequences. These include events representing unavailability of an alternate AC power source, failures to recover onsite emergency DGs, and failure to restore offsite power.

HFEs during the pre-core-damage sequence progression, including operator failure to established gravity-driven injection from the RWST, failure to isolate containment penetrations, and failure to restore RHR cooling after successful injection.

Events representing equipment failures from the Level 1 PRA sequences, including common-cause failure of RHR pumps, emergency DG failure to run, and RAT input breaker failure to open.

Figure 3-2 Comparison of Release Category Frequencies for 2020-FLEX and Circa-2012 Cases 1.00E-10 1.00E-09 1.00E-08 1.00E-07 1.00E-06 1.00E-05 Comparison of Release Category Frequencies Circa-2012 2020-FLEX

3-24 Figure 3-3 Comparison of Percent Contribution to Total Release Frequency for 2020-FLEX and Circa-2012 Cases 0.0%

10.0%

20.0%

30.0%

40.0%

50.0%

Comparison of Release Category Contributions Circa-2012 2020-FLEX

3-25 Table 3-5 Description of Release Categories Name Description 1-REL-SD-COPEN-HEADOFF The containment hatch and/or personnel airlock are open at the time when the accident begins, and operators fail to reclose them. The release is considered to reach the environment directly via these large openings. Furthermore, the plant is in an operating state at the time of the accident where the reactor vessel head has been removed, so in-vessel release from the core benefits from little to no retention inside the RCS.

1-REL-SD-COPEN-RCSVENT The containment hatch and/or personnel airlock are open at the time when the accident begins, and operators fail to reclose them. The release is considered to reach the environment directly via these large openings. Prior to any breach of the reactor vessel lower head by core debris, the RCS is vented or has a persistent leak not including normally cycling relief valves (e.g., pipe break or manual bleed), such that retention of aerosols inside the RCS may be intermediate in magnitude.

1-REL-SD-COPEN-RCSINTACT The containment hatch and/or personnel airlock are open at the time when the accident begins, and operators fail to reclose them. The release is considered to reach the environment directly via these large openings. Prior to any breach of the reactor vessel lower head by core debris, the RCS is intact, such that releases from the RCS to the containment can occur only by normal cycling of the pressurizer and/or RHR relief valves; therefore, significant retention of aerosols inside the RCS is possible.

1-REL-SD-ISLOCA (also referred to as LOI-OC)

The accident consists of a pipe break to a location outside of the containment (i.e., into the auxiliary building). Releases reach the auxiliary building via this break from the RCS, and from there to the environment. The release category does not distinguish between cases where the auxiliary building remains intact and leaks relatively slowly to the environment, from cases where the auxiliary building fails due to steam overpressure or energetic event. Also, whether the release may be scrubbed by a water pool overlying the break is left unspecified.

1-REL-SD-ISGTR One or more steam generator tubes fail after the start of core damage due to temperature-induced creep rupture. The release to the environment occurs via the break created in the damaged steam generator, and from there to the environment via atmospheric relief valves or secondary-side leaks. The release category does not distinguish between cases where relief valves cycle normally in response to steam line pressure versus cases where the valves have failed in the open position or been forced open by previous operator action.

This release category is represented in the model logic, but it does not contribute any release frequency above the truncation value of 10-12 per year.

Therefore, 1-REL-SD-ISGTR is not included in the release category frequency results tables.

1-REL-SD-CF-BEFORE-CD The containment fails due to steam overpressure sometime in between the start of the accident and the start of core damage. This release may or may not benefit from any aerosol scrubbing.

1-REL-SD-ECF The containment fails some time in between the start of core damage and the time frame at and around vessel breach due to an energetic event. This release may or may not benefit from any aerosol scrubbing.

Table 3-5 Description of Release Categories (cont.)

3-26 Name Description 1-REL-SD-CIF Release from the containment to the environment occurs via a containment penetration that fails to be isolated by the containment isolation system or by manual action, or a pre-existing leakage path (not including open containment hatch or personnel airlock). This release may or may not benefit from any aerosol scrubbing. Also, depending on the type and location of the isolation failure, the release may benefit from some retention inside the auxiliary building.

1-REL-SD-ICF-BURN The containment fails some hours after vessel breach due to a global deflagration or detonation. This release may or may not benefit from any aerosol scrubbing.

1-REL-SD-LCF The containment fails at some time between tens of hours after the time of vessel breach, up to as late as 7 days after the start of the accident, due to long-term quasi-static overpressure. Releases to the environment are not mitigated significantly by sprays or water pools.

1-REL-SD-BMT The containment eventually fails due to basemat ablation from sustained core-concrete interaction, at some point within 7 days of the start of the accident.

Only the airborne component of release to the environment (which stems from normal design-basis containment leakage while the containment is pressurized) is modeled here.

1-REL-SD-NOCF Containment is not open, unisolated, bypassed, or failed, and radiological release to the environment occurs via design-basis containment leakage only.

This release may or may not benefit from any aerosol scrubbing.

3-27 Table 3-6 Release Category Frequency Results Release Category Name Circa-2012 Release Category Frequency

(/yr) (a)

Circa-2012 %

of Total Release 2020-FLEX Release Category Frequency

(/yr) (b) 2020-FLEX % of Total Release 2020-FLEX Impact (a-b)/a %

Total 1.24E-05 6.26E-06 49.4%

1-REL-SD-BMT 1.23E-07 1.0%

5.64E-08 0.9%

54.2%

1-REL-SD-CF-BEFORE-CD 2.07E-06 16.7%

1.02E-06 16.3%

50.7%

1-REL-SD-CIF 1.70E-06 13.8%

4.46E-07 7.1%

73.8%

1-REL-SD-COPEN-HEADOFF 7.75E-08 0.6%

2.32E-08 0.4%

70.1%

1-REL-SD-COPEN-RCSINTACT 2.68E-07 2.2%

3.22E-08 0.5%

88.0%

1-REL-SD-COPEN-RCSVENT 1.31E-07 1.1%

4.88E-08 0.8%

62.6%

1-REL-SD-ECF 5.07E-10 0.0%

3.46E-10 0.0%

31.8%

1-REL-SD-ICF-BURN 1.70E-06 13.8%

1.49E-06 23.8%

12.7%

1-REL-SD-ISLOCA 1.33E-07 1.1%

1.33E-07 2.1%

0.0%

1-REL-SD-LCF 5.48E-08 0.4%

1.67E-08 0.3%

69.5%

1-REL-SD-NOCF 6.11E-06 49.4%

2.99E-06 47.8%

51.0%

Table 3-7 Level 2 PRA Surrogate Risk Metric Results Level 2 PRA Surrogate Risk Metric Circa-2012 Case 2020-FLEX Case Risk Metric Reduction Total Release Frequency (/yr) 1.2E-05 6.3E-06 49%

LERF1 (/yr) 5.3E-07 2.1E-07 60%

LRF2 (/yr) 6.1E-06 3.2E-06 48%

CCFP3 0.51 0.52

1. The release categories contributing to LERF are: 1-REL-SD-COPEN-RCSINTACT, 1-REL-SD-COPEN-RCSVENT, and 1-REL-SD-ISLOCA.

2. The release categories contributing to LRF are: 1-REL-SD-CF-BEFORE-CD, 1-REL-SD-CIF, 1-REL-SD-COPEN-HEADOFF, 1-REL-SD-COPEN-RCSINTACT, 1-REL-SD-COPEN-RCSVENT, 1-REL-SD-ECF, 1-REL-SD-ICF-BURN, and 1-REL-SD-ISLOCA.

3. The release categories contributing to CCFP include all release categories resulting in containment failure or bypass: 1-REL-SD-BMT, 1-REL-SD-CF-BEFORE-CD, 1-REL-SD-CIF, 1-REL-SD-COPEN-HEADOFF, 1-REL-SD-COPEN-RCSINTACT, 1-REL-SD-COPEN-RCSVENT, 1-REL-SD-ECF, 1-REL-SD-ICF-BURN, 1-REL-SD-ISLOCA, and 1-REL-SD-LCF.

3-28 Table 3-8 2020-FLEX Parameter Uncertainty Propagation Results by Release Category and Surrogate Risk Metric Release Category or Surrogate Risk Metric Point Estimate

(/yr)

Mean (/yr) 5th Percentile

(/yr)

Median

(/yr) 95th Percentile

(/yr) 95th/5th Ratio 1-REL-SD-BMT 5.64E-08 5.36E-08 4.52E-10 1.35E-08 2.20E-07 488 1-REL-SD-CF-BEFORE-CD 1.02E-06 9.84E-07 1.61E-07 6.41E-07 2.94E-06 18 1-REL-SD-CIF 4.46E-07 3.90E-07 1.49E-08 1.66E-07 1.48E-06 99 1-REL-SD-COPEN-HEADOFF 2.32E-08 2.05E-08 1.33E-11 3.35E-09 8.71E-08 6540 1-REL-SD-COPEN-RCSINTACT 3.22E-08 2.83E-08 8.52E-11 3.87E-09 1.25E-07 1465 1-REL-SD-COPEN-RCSVENT 4.88E-08 4.28E-08 2.66E-09 1.65E-08 1.55E-07 58 1-REL-SD-ECF 3.46E-10 2.74E-10 3.25E-13 1.42E-11 8.23E-10 2531 1-REL-SD-ICF-BURN 1.49E-06 1.49E-06 4.14E-09 9.02E-07 4.59E-06 1108 1-REL-SD-ISLOCA 1.33E-07 1.34E-07 1.91E-09 1.90E-08 4.93E-07 258 1-REL-SD-LCF 1.67E-08 1.36E-08 7.51E-11 2.52E-09 5.41E-08 721 1-REL-SD-NOCF 2.99E-06 2.92E-06 6.12E-07 1.99E-06 7.86E-06 13 LERF 2.14E-07 1.88E-07 9.91E-09 6.73E-08 6.85E-07 69 LRF 3.19E-06 3.12E-06 4.96E-07 2.09E-06 8.95E-06 18

3-29 Table 3-9 Level 2 PRA Representative Accident Scenario Timelines Release Category MELCOR Represent.

Case GE1 (hr)

Time of CD Indication2 (hr)

Warning Time3 (hr)

Time to LERF Thresh.4 (hr)

Time to LRF Thresh.5 (hr)

Time of Cont.

Failure (hr) 36 hr after CD Indication (hr) 60 hr after CD Indication (hr) 1-REL-SD-BMT SD08.2 (POS 3)

~28 27

>140 N/A Never 165 63 87 1-REL-SD-CF-BEFORE-CD SD09 (POS 8E)

~24 126 103 N/A 126 118 162

>168 1-REL-SD-CIF SD03 (POS 8E)

~33 125 95 N/A

~127 0

(cont. unisol.)

161

>168 1-REL-SD-COPEN-HEADOFF SD05 (POS 8E)

~48 100 52 N/A 100 0

(cont. hatch open) 136 160 1-REL-SD-COPEN-RCSINTACT SD07 (POS 5A)

~15 16 2

17 16 0

(cont. hatch open) 52 76 1-REL-SD-COPEN-RCSVENT SD13 (POS 5B)

~5

~5 2

8 7

0 (cont. hatch open) 41 65 1-REL-SD-ECF SD01.2 (POS 6) 11.5 15

~64 N/A

~65 24 51 75 1-REL-SD-ICF-BURN SD01.8 (POS 6) 11.5 15

~85 N/A 69 60 51 75 1-REL-SD-ISLOCA SD11.1 (POS 5A) 18 22 7

50

~25 0

(cont. bypass) 58 82 1-REL-SD-LCF SD01 (POS 6) 11.5 15

>156 N/A Never 168 51 75 1-REL-SD-NOCF SD12 (POS 10) 30 24

>138 N/A Never Never 60 84 1 The timing of general emergency (GE) declaration depends on the scenario-specific conditions and is indicated in Table 2.5-3 of (NRC, 2025b).

2 Core damage (CD) is indicated when core exit temperature exceeds 1200 F. Thirty minutes are added to the time indicated in the MELCOR simulation to account for time to assess plant conditions.

3 Warning time is determined by the time at which cumulative environmental iodine release fraction exceeds 1 percent minus the time that GE is declared.

4 The LERF criteria are met when the warning time is less than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />, and the cumulative environmental iodine release fraction exceeds 4 percent.

5 The time when cumulative environmental release fractions of either iodine or cesium exceed 0.001 is used to indicate a large release, which is considered to be larger than (not comparable to) releases from an intact containment (i.e., releases associated with release category 1-REL-SD-NOCF).

3-30 Table 3-10 Level 2 PRA Surrogate Risk Metric Results - 2020-FLEX Case Release Category Time at Which Airborne Radiological Releases are Terminated Total Release 36 Hr after CD Indication 60 Hr after CD Indication 7 Days after Event Occurs Frequency

(/yr)

% of Total LERF

(/yr)

LRF

(/yr)

CCFP LERF

(/yr)

LRF

(/yr)

CCFP LERF

(/yr)

LRF

(/yr)

CCFP 1-REL-SD-BMT 5.6E-08 0.9%

0.9%

1-REL-SD-CF-BEFORE-CD 1.0E-06 16.3%

1.0E-06 16.3%

1.0E-06 16.3%

1.0E-06 16.3%

1-REL-SD-CIF 4.5E-07 7.1%

4.5E-07 7.1%

4.5E-07 7.1%

4.5E-07 7.1%

1-REL-SD-COPEN-HEADOFF 2.3E-08 0.4%

2.3E-08 0.4%

2.3E-08 0.4%

2.3E-08 0.4%

1-REL-SD-COPEN-RCSINTACT 3.2E-08 0.5%

3.2E-08 3.2E-08 0.5%

3.2E-08 3.2E-08 0.5%

3.2E-08 3.2E-08 0.5%

1-REL-SD-COPEN-RCSVENT 4.9E-08 0.8%

4.9E-08 4.9E-08 0.8%

4.9E-08 4.9E-08 0.8%

4.9E-08 4.9E-08 0.8%

1-REL-SD-ECF 3.5E-10

<0.1%

<0.1%

3.5E-10

<0.1%

3.5E-10

<0.1%

1-REL-SD-ICF-BURN 1.5E-06 23.8%

1.5E-06 23.8%

1.5E-06 23.8%

1-REL-SD-ISLOCA 1.3E-07 2.1%

1.3E-07 1.3E-07 2.1%

1.3E-07 1.3E-07 2.1%

1.3E-07 1.3E-07 2.1%

1-REL-SD-LCF 1.7E-08 0.3%

0.3%

1-REL-SD-NOCF 3.0E-06 47.8%

Total 6.3E-06 100.0%

2.1E-07 1.7E-06 27.2%

2.1E-07 3.2E-06 51.0%

2.1E-07 3.2E-06 52.2%

3-31 Table 3-11 2020-FLEX Level 2 PRA Surrogate Risk Metric Results for Alternative Accident Recovery Assumptions Postulated Recovery Factors Resulting Risk Surrogates RFcombust RFpressure RFBMT LERF (/yr)

LRF (/yr)

CCFP 1

1 1

2.1E-07 3.2E-06 0.522 1

1 0.1 2.1E-07 1.9E-06 0.522 1

0.1 1

2.1E-07 2.3E-06 0.373 0.1 1

1 2.1E-07 3.2E-06 0.514 1

0.1 0.1 2.1E-07 9.3E-07 0.373 0.1 1

0.1 2.1E-07 1.9E-06 0.324 0.1 0.1 1

2.1E-07 2.3E-06 0.364 0.1 0.1 0.1 2.1E-07 9.3E-07 0.173 Table 3-12 Containment Isolation Failure Human Error Probabilities for Containment Venting Alternate Analysis Containment Isolation Human Failure Event Name 2020-FLEX Case HEP Value Alternate Analysis Containment Isolation HEP Value (i.e.,

Probability of Successful Containment Venting) 1-CIS-XHE-XL-ISOLPEN Failure to isolate small containment penetrations 3.0E-03 7.0E-01 1-CIS-XHE-XL-ISOLPEN-LD Failure to isolate small containment penetrations (low dependency) 5.3E-02 7.0E-01 1-CIS-XHE-XL-ISOLPEN-HD Failure to isolate small containment penetrations (high dependency) 5.0E-01 7.0E-01

3-32 Table 3-13 Release Category Frequency and Surrogate Risk Metric Results for Containment Venting Alternate Analysis 2020-FLEX Case Containment Venting Alternate Case Release Fractions for Cs, I Release Category Frequency (per year)

% of Total Frequency (per year)1

% of Total 1-REL-SD-BMT 5.6E-08 0.9%

1.8E-08 0.3%

1.7E-06, 2.6E-06 1-REL-SD-CF-BEFORE-CD 1.0E-06 16.3%

4.1E-07 6.7%

1.5E-01, 1.4E-01 1-REL-SD-CIF 4.5E-07 7.1%

3.1E-06 51.9%

6.7E-02, 5.9E-02 1-REL-SD-COPEN-HEADOFF 2.3E-08 0.4%

2.3E-08 0.4%

8.7E-01, 8.8E-01 1-REL-SD-COPEN-RCSINTACT 3.2E-08 0.5%

3.2E-08 0.5%

2.5E-01, 3.8E-01 1-REL-SD-COPEN-RCSVENT 4.9E-08 0.8%

4.9E-08 0.8%

7.9E-01, 8.2E-01 1-REL-SD-ECF 3.5E-10 0.0%

1.1E-10 0.0%

1.1E-02, 3.0E-02 1-REL-SD-ICF-BURN 1.5E-06 23.8%

4.6E-07 7.7%

5.7E-03, 2.7E-02 1-REL-SD-ISLOCA 1.3E-07 2.1%

1.3E-07 2.2%

2.8E-02, 4.5E-02 1-REL-SD-LCF 1.7E-08 0.3%

5.2E-09 0.1%

1.8E-05, 1.7E-05 1-REL-SD-NOCF 3.0E-06 47.8%

1.8E-06 29.4%

1.8E-05, 1.9E-05 Surrogate Metrics LERF 2.1E-07 3.4%

2.1E-07 3.5%

--2 LRF 3.2E-06 51.0%

4.2E-06 70.2%

--2 CCFP 52.2%

70.6%

--2 Note 1: The cutsets of each release category were re-quantified with the HEP values shown in Table 3-12. The sum of the release frequencies does not exactly match the total 2020-FLEX case frequency due to quantification inaccuracies associated with large failure probabilities, success terms, and truncation. The difference in the total release frequency is less than 4 percent.

Note 2: The surrogate risk metrics include contributions from combinations of release categories (see Table 3-10 for release category contributions to surrogate risk measures). The surrogate risk metric results are not characterized in terms of any one single release.

3.3 Level 3 PRA This section provides a summary of the results and insights from the Level 3 PRA for internal events during reactor shutdown. Results are provided for the following two risk metrics:

Population-weighted early fatality risk (0-1.8 miles) measures the average annual risk to individuals within 1 mile of the site boundary of incurring a fatality within 1 year from acute exposures to radiation due to modeled accidental releases of radiological materials from the reference nuclear power plant site. Results for this metric can be compared to the average individual early fatality risk QHO to obtain insights related to the NRCs safety goal policy (NRC, 1986).

3-33 Population-weighted latent cancer fatality risk (0-10 miles) measures the average annual risk to individuals within 10 miles of the site of incurring a fatality from cancers caused by doses arising from modeled accidental releases of radiological materials from the reference nuclear power plant site. This result, by weighting health effects cases across the entire 10-mile population, reflects the occurrence of exposures relative to the distribution of population around the site. Results for this metric can be compared to the average individual latent cancer fatality risk QHO to obtain insights related to the NRCs safety goal policy (NRC, 1986).

Note that while this report focuses only on the two risk metrics associated with the QHOs, Volume 5c (NRC, 2025c) addresses a more complete set of risk metrics, including those associated with land contamination, population relocation, and economic costs.

Section 3.3.1 provides the results for these two risk metrics for the 2020-FLEX case and a comparison to the results for the Circa-2012 case. Section 3.3.2 discusses alternative analyses to assess the effects of modeling assumptions on the Level 3 PRA results. Section 3.3.3 discusses insights from the Level 3 PRA portion of the 2020-FLEX case, including a discussion of the significant risk contributors.

3.3.1 Results of Circa-2012 and 2020-FLEX Cases The 2020-FLEX case updates the Circa-2012 models to include the FLEX strategies and equipment for responding to an ELAP and continued TDAFW pump operation given a complete loss of all installed AC and DC power. The FLEX strategies are intended to provide coping capability to prevent core damage. Therefore, the primary effect of FLEX strategies on the PRA model is a reduction of the CDF in the Level 1 PRA model (as discussed in Section 3.1.1). The Level 1 PRA 2020-FLEX case model changes result in reduced CDF contributions from the sequences involving SBO events. The main impact on the Level 2 PRA model for FLEX strategies is carrying forward the modified Level 1 PRA sequences, which results in reduced frequencies for the applicable release categories. The 2020-FLEX case does not consider the impact of FLEX strategies on severe accident timing; therefore, the conditional consequences do not change and the only impact on the Level 3 PRA model derives from the change in release category frequencies.

This report provides a comparison of the 2020-FLEX case results to the Circa-2012 case. The description of the Circa-2012 Level 3 PRA model and results for internal events during reactor shutdown are provided in the associated L3PRA project report (NRC, 2025c). Table 3-14 compares mean annual population-weighted early fatality risk within 1 mile of the site boundary for the Circa-2012 and 2020-FLEX cases.11 Only the release categories that appreciably contribute to early fatality risk are included in the table.12 As seen in Table 3-14, essentially all the mean annual population-weighted individual early fatality risk within 1 mile of the site boundary comes from release category SD-COPEN-RCSVENT, which involves an open containment at the time of accident initiation and moderate retention of aerosols inside the RCS. As seen in Table 4-2 in NRC (2025c), this release 11 These values were obtained by weighting the mean (over all weather trials) consequence values for individual release categories by the point estimate of the individual release category frequencies.

12 For a description of the different release categories, see Table 3-5.

3-34 category drives early fatality risk because it has large radiological release fractions combined with a short warning time.

Also as seen in Table 3-14, the changes in the 2020-FLEX case reduce population-weighted early fatality risk within 1 mile of the site boundary by 64 percent. The reduction is substantial because release category SD-COPEN-RCSVENT is dominated by LOOPs, exactly the type of accident that FLEX is designed to ameliorate.

Figure 3-4 compares the population-weighted early fatality risk within 1 mile of the site boundary for both the Circa-2012 and 2020-FLEX cases to the associated QHO. While it can be seen from this figure that there is substantial margin to the QHO in both cases, it should be remembered that the figure only reflects the risk during the year when the reactor is shutdown.

To get the complete picture of plant reactor risk during a calendar year, the risk for all hazards during both reactor operation and shutdown would need to be summed together. Note, however, that based on the values provided in Table 3-22 of the overview report for the reactor, at-power, Level 1, 2, and 3 PRAs for internal fires, seismic events, and high winds (NRC, 2024) and Table 3-14 of this report, the margin to the QHO is still substantial (i.e., several orders of magnitude for both the Circa-2012 case and the 2020-FLEX case) even after summing the operating and shutdown risk for internal events and the operating risk for all other hazards (note, the shutdown risk for hazards other than internal events was not calculated as part of the L3PRA project).

As discussed in Section 3.2.1, a parameter uncertainty analysis considering the uncertainty in the Level 2 PRA release category frequencies was performed for the 2020-FLEX case for internal events during reactor shutdown. Table 3-15 presents the mean, median, 5th-percentile, and 95th-percentile 0-1.8-mile population-weighted early fatality risk considering the uncertainty in the Level 2 PRA release category frequency estimates for these hazards (for comparison, Table 3-15 also includes the respective values for all hazards during power operation, obtained from NRC [2022a] and NRC [2024]). Figure 3-5 presents complementary cumulative distribution function (CCDF) curves that illustrate the frequencies of exceeding specified levels of population-weighted early fatality risk in the 0-1.8-mile range (i.e., within 1 mile of the site boundary) for internal events during shutdown. These curves include the contributions from the full spectrum of accident scenarios modeled in the reactor, at-shutdown PRA for internal events.

The red curve reflects the mean CCDF curve, the green curve reflects the median CCDF curve, and the blue curves represent the 5th-percentile and 95th-percentile CCDF curves.

Table 3-16 compares mean population-weighted individual latent cancer fatality risk within 10 miles of the site for the Circa-2012 and 2020-FLEX cases for internal events during shutdown.13 This information is displayed graphically in Figure 3-6 and Figure 3-7.

As seen in Table 3-16, in the Circa-2012 case for internal events during shutdown, the two release categories that make the largest contribution to mean annual population-weighted individual latent cancer fatality risk within 10 miles are: (1) a release category in which the containment fails due to overpressure by steam sometime in between the start of the accident and the start of core damage (SD-CF-Before-CD) and (2) a release category in which the 13 These values were obtained by weighting the mean (over all weather trials) consequence values for individual release categories by the point estimate of the individual release category frequencies. Also, the percentages included in the table are based on calculations using three significant figures, so the reported percentages may not appear intuitively obvious.

3-35 release to the environment occurs via a containment penetration that fails to be isolated by manual action or via a pre-existing leakage path (not including open containment hatch or personnel airlock) (SD-CIF). These two radiological release categories collectively contribute around 70 percent of the mean annual population-weighted individual latent cancer fatality risk within 10 miles. The release category in which the containment fails hours after vessel breach due to a global deflagration or detonation (SD-ICF-BURN) contributes an additional 18 percent of the mean annual population-weighted individual latent cancer fatality risk within 10 miles.

Taken together, the three release categories that involve an open containment hatch and/or personnel airlock, with operator failure to reclose them (SD-COPEN-HEADOFF, SD-COPEN-RCSINTACT, SD COPEN-RCSVENT), collectively make up the bulk of the remaining contribution (12 percent).

As can also be seen from Table 3-16, the changes in the 2020-FLEX case reduce population-weighted latent cancer fatality risk within 10 miles of the site by 54 percent for internal events during shutdown. This substantial reduction occurs because five of the six release categories discussed above are dominated by LOOP sequences, the target of the FLEX strategies. The relative contribution of the SD-ICF-BURN release category rises to 33 percent in the 2020-FLEX case, since a spectrum of accident sequences contribute to this release category and, therefore, it is only modestly reduced by the FLEX strategies.

Figure 3-8 compares the population-weighted latent cancer fatality risk within 10 miles of the site for both the Circa-2012 and 2020-FLEX cases to the associated QHO (note, the alternative cases shown in the figure involving accident termination time and dose truncation are discussed later in Section 3.3.2). While it can be seen from this figure that there is substantial margin to the QHO in both cases, it should be remembered that the figure only reflects the risk during the year for internal events when the reactor is shutdown. To get the complete picture of plant reactor risk during a calendar year, the risk for all hazards during both reactor operation and shutdown would need to be summed together. Note, however, that based on the values provided in Table 3-28 of the overview report for the reactor, at-power, Level 1, 2, and 3 PRAs for internal fires, seismic events, and high winds (NRC, 2024) and Table 3-16 of this report, the margin to the QHO is still relatively substantial (i.e., approximately a factor of 30 for the Circa-2012 case and nearly a factor of 50 for the 2020-FLEX case) even after summing the operating and shutdown risk for internal events and the operating risk for all other hazards (note, the shutdown risk for hazards other than internal events was not calculated as part of the L3PRA project).

As mentioned previously for early fatality risk, a parameter uncertainty analysis considering the uncertainty in the Level 2 PRA release category frequencies was performed for the 2020-FLEX case for internal events during reactor shutdown. Table 3-17 presents the mean, median, 5th-percentile, and 95th-percentile 0-10-mile population-weighted latent cancer fatality risk considering the uncertainty in the Level 2 PRA release category frequency estimates (for comparison, Table 3-17 also includes the respective values for all hazards during power operation, obtained from NRC [2022a] and NRC [2024]). Figure 3-9 presents CCDF curves that illustrate the frequencies of exceeding specified levels of population-weighted latent cancer fatality risk in the 0-10-mile range for internal events during shutdown. These curves include the contributions from the full spectrum of accident scenarios modeled in the reactor, at-shutdown PRA for internal events. The red curve reflects the mean CCDF curve, the green curve reflects the median CCDF curve, and the blue curves represent the 5th-percentile and 95th-percentile CCDF curves.

3-36 As shown in Figure 3-9, the slopes of the CCDF curves appear to increase (i.e., become more negative) at about 5x10-4. This indicates the likelihood of exceeding population-weighted latent cancer fatality risk levels beyond these values becomes increasingly less likely as the risk level increases.

3.3.2 Results of Alternative Analyses Several alternative analyses were performed to assess the impacts of modeling assumptions and sources of uncertainty on the Level 3 PRA results. The two alternative analyses discussed here involve the accident termination time (as previously discussed in Section 3.2.2 for the Level 2 PRA) and the dose truncation model for evaluating radiological health effects.

As discussed in Section 3.2.2, the L3PRA project does not explicitly model the role of long-term onsite, or offsite, resources in terminating accidents after core damage has occurred. The issue of the timing of accident termination and termination of radiological release is treated as a global modeling uncertainty, as described in Appendix D of the Level 2 reactor at-power internal event and flood PRA report (NRC, 2022c). In both the Circa-2012 and 2020-FLEX cases, the accident and release termination time for many accident sequences is 7 days after event initiation. To gain insight into the range of consequence/risk results from different accident termination times, consequence calculations were performed terminating radiological releases from all the representative accident sequences 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after indication of core damage.

For releases that can lead to early fatalities, most of the release occurs within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after indication of core damage; therefore, this alternative termination time has no appreciable impact on early fatality risk. However, the alternative termination time does have a significant impact on latent cancer fatality risk, as can be seen in Figure 3-8.

For the alternative analysis, the largest reduction in latent cancer fatality risk comes from the SD-ICF-BURN release category (accounting for over 90 percent of the risk reduction). Release category SD-ICF-BURN contributes approximately 33 percent to latent cancer fatality risk for the 2020-FLEX case but has virtually no risk contribution for the case with the alternative termination time. This is because the alternative termination time is 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br /> after event initiation for the representative MELCOR sequence for this release category (SD01.8), while the containment does not fail in this sequence until 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> after event initiation (see Table 2.3-2 of NRC [2025b]).

As discussed in the Level 3 PRA report (NRC, 2025c), it is unclear what health consequences, if any, are attributable to very low radiation exposure. The NRC currently relies on the hypothesis that a linear no-threshold (LNT) dose-response relationship is the appropriate approach to use in making its regulatory decisions. The LNT approach is based on scientific evidence supported by many in the technical community. However, there is also the belief by many in the technical community that estimating latent cancer fatalities based on very small doses to large populations is inappropriate, though there is no consensus on what dose threshold is appropriate.

Consistent with the State-of-the-Art Reactor Consequence Analyses (SOARCA) (NRC, 2012) and current NRC policy for regulatory applications, the LNT model is used as the base-case dose-response model for both the Circa-2012 and 2020-FLEX cases for evaluating radiological health effects. Because the cancer risk estimation is more uncertain in the low-dose range, an alternative dose truncation model was also considered to allow examination of the cancer risks

3-37 arising only from lifetime doses above the low-dose range. The alternate dose truncation model is based on the model documented in a Health Physics Society (HPS) position paper on radiation risk (HPS 2010), which estimates cancer risk based only on annual individual doses greater than 0.05 Sv (5 rem), or lifetime individual doses greater than 0.1 Sv (10 rem).14 The impact of the alternative dose truncation model on the 2020-FLEX case (while retaining the 7-day accident and release termination time) is shown in Figure 3-8. As can be seen from the figure, use of the alternative dose truncation model reduces latent cancer fatality risk significantly. This is to be expected since the latent cancer fatality risk estimated in this study primarily results from long-term, low-dose exposure to individuals after they are allowed to return to their homes following decontamination.15 3.3.3 Initial Insights To gain insight into the relative risk significance of individual basic events to selected offsite public risk metrics, composite FV importance measures were calculated for each event. The composite FV importance measure for a particular basic event is used to approximate the relative contribution to the total mean annual risk for each selected offsite public risk metric from accident scenarios that include that basic event. In practice, this composite FV importance measure is calculated as a weighted sum of the standard FV importance measure for the basic event with respect to each radiological release category frequency, weighted by the relative contribution of each radiological release category to the mean annual risk for each selected offsite public risk metric. For more information on the composite FV importance measure, see Section 5.2.5.1 of the reactor, at-power, Level 3 PRA report for internal events and internal floods (NRC, 2022d).

For both the Circa-2012 and 2020-FLEX cases, composite FV importances were calculated for (1) mean annual population-weighted individual early fatality risk within 1 mile of the site boundary and (2) mean annual population-weighted individual latent cancer fatality risk within 10 miles.

As stated in NRC (2025c), for the Circa-2012 case, LOOP is the initiating event contributing by far the most to early fatality risk (approximately 90 percent). Loss of inventory initiating events collectively contribute an additional 8 percent. Also, approximately 93 percent of early fatality risk occurs in just two POSs, draining the RCS to mid-loop prior to refueling (56 percent) or after refueling (37 percent).

Aside from the boundary condition events (i.e., related to plant operating type and state) and initiating events, the top two contributors according to NRC (2025c) are (1) operator failure to establish low pressure gravity feed given a LOOP (approximately 83 percent) and (2) operator failure to close the equipment hatch with lowered RCS inventory and no AC power 14 It is noted that the HPS position statement on radiation risk was updated in February 2019 to state simply that The Health Physics Society advises against estimating health risks to people from exposures to ionizing radiation that are near or less than natural background levels because statistical uncertainties at these low levels are great (HPS, 2019). However, the numerical values corresponding to the 2010 position statement were used in this analysis for consistency with recent NRC analyses using the MACCS dose truncation model.

15 The dose criterion for the required decontamination after a severe accident is uncertain. The current state of practice is to model decontamination to the level of meeting the habitability criteria as defined by the Environmental Protection Agency (EPA) intermediate-phase protective action guidelines (PAGs). The use of the EPA intermediate-phase PAGs (2 rem in the year of the accident and 500 mrem in subsequent years) is assumed as a surrogate for decisions on cleanup and reoccupation.

3-38 (approximately 81 percent). As is evident by their contribution percentages, these two operator errors usually occur together in the same cutsets.

NRC (2025c) identifies equipment failures or operator errors that lead to a station blackout as other significant contributors to early fatality risk. Included in this set of basic events are CCFs of the RAT input breakers (contributing 33 percent) and the emergency DG load sequencers (contributing 20 percent), as well as random failures of these components and the emergency DGs, and operator failure to recover offsite power.

While the absolute risk is significantly reduced in the 2020-FLEX case for internal events during shutdown, the relative contributions of the different events are similar. LOOP is still the initiating event contributing by far the most to early fatality risk, though its contribution drops to 73 percent, since FLEX is targeted at extended LOOP scenarios. As a result, the contribution from loss of inventory initiating events collectively rises to around 19 percent. Also, the same two POSs, draining the RCS to mid-loop prior to refueling (56 percent) or after refueling (31 percent), dominate the early fatality risk, as do the two dominant operator errors identified for the Circa-2012 caseoperator failure to establish low pressure gravity feed given a LOOP (66 percent) and operator failure to close the equipment hatch with lowered RCS inventory and no AC power (65 percent).

As stated in NRC (2025c), for the Circa-2012 case, LOOP is the initiating event contributing by far the most to mean annual population-weighted individual latent cancer fatality risk within 10 miles (approximately 73 percent). The next largest contributing initiating event is an overdraining event with the reactor in mid-loop operation (8 percent). Other initiating event contributors with the reactor at-shutdown (all in the 4-5 percent range) include (1) loss of nuclear service cooling water, (2) loss of RHR, (3) loss of inventory with RCS at pressure, and (4) loss of a 4,160 V AC bus. Also, approximately 77 percent of mean annual population-weighted individual latent cancer fatality risk within 10 miles occurs in just two POSs, refueling operation (60 percent) and when the pressurizer is water solid for hydrogen degassing prior to refueling (17 percent).

Aside from the boundary condition events (i.e., related to plant operating type and state) and initiating events, most of the highest contributing basic events (as reported in NRC [2025c])

involve various human errors (e.g., failures to restore electric power, failure to establish low-pressure gravity feed given LOOP, or failure to isolate small containment penetrations [with high dependency on a previous operator failure]). Other high contributing events include failures leading to a station blackout (e.g., failures of emergency DGs, RAT input breakers, or emergency DG load sequencers) and events associated with combustion (detonations or deflagrations) within containment. Note, some combustion events result in direct failure of the containment, while others occur early in the accident progression before there is sufficient combustible gas to result in containment failure. In these latter cases, the early combustible events can reduce the amount of combustible gas in containment, thereby reducing the likelihood of a larger combustible event later in the accident progression. However, the most important factor influencing late combustion-induced containment failure is the success of late containment heat removal resulting in reduced steam concentrations. This action influences the likelihood of combustion events in the late timeframe to a greater extent than whether there were earlier combustion events.

While the absolute risk is significantly reduced in the 2020-FLEX case for internal events during shutdown, the relative contributions of the different events are similar. LOOP is still the initiating

3-39 event contributing by far the most to latent cancer fatality risk, though its contribution drops to 42 percent, since FLEX is targeted at extended LOOP scenarios. As a result, the contribution from the overdraining event with the reactor in mid-loop operation rises to 17 percent and the contribution from the other initiating event contributors identified above for the Circa-2012 case increase from the 4-5 percent range to the 8-11 percent range. Also, the collective contribution from the two dominant POSs for the Circa-2012 case identified above is reduced to approximately 67 percent and the contribution for the POS for draining the RCS to mid-loop prior to refueling increases from 8 percent to 17 percent. The other highest contributing basic events for the Circa-2012 case (i.e., those aside from the boundary condition events and initiating events) are still major contributors in the 2020-FLEX case, though the relative contribution of those events leading to station blackout is reduced since FLEX is targeted at extended LOOP scenarios.

3-40 Figure 3-4 Individual Early Fatality Risk (0-1.8 miles) for Internal Events during Shutdown Figure 3-5 CCDF Curves for Population-Weighted Early Fatality Risk (0-1.8 Miles) for Internal Events during Shutdown (2020-FLEX Case)

3-41 Figure 3-6 Release Category Contribution to Population-Weighted Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown (Circa-2012 Case)

Figure 3-7 Release Category Contribution to Population-Weighted Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown (2020-FLEX Case)

3-42 Figure 3-8 Individual Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown - Alternative Analyses Figure 3-9 CCDF Curves for Population-Weighted Latent Cancer Fatality Risk (0-10 Miles) for Internal Events during Shutdown (2020-FLEX Case)

3-43 Table 3-14 Population-Weighted Early Fatality Risk (0-1.8 Miles), by Release Category, for the Circa-2012 and 2020-FLEX Cases for Internal Events during Shutdown Circa-2012 Case 2020-FLEX Case 2020-FLEX Impact Release Category Name Early Fatality Risk (/yr) (a)

% of Total Early Fatality Risk (/yr) (b)

% of Total (a-b)/a %

Total 1.4E-12 100%

5.1E-13 100%

64%

SD-COPEN-RCSVENT 1.4E-12 100%

5.1E-13 100%

64%

SD-COPEN-HEADOFF 1.1E-15

<1%

3.3E-16

<1%

70%

Table 3-15 Statistical Analysis of the Population-Weighted Early Fatality Risk (0-1.8 Miles) for the 2020-FLEX Case for Internal Events during Shutdown and Individual Hazards during Power Operation Point Estimate1

(/yr)

Mean

(/yr)

Median

(/yr) 5th-Percentile

(/yr) 95th-Percentile

(/yr)

Internal events during shutdown2 5.1E-13 4.5E-13 1.7E-13 2.8E-14 1.6E-12 Internal events and floods during power operation3,4 3.2E-13 3.9E-13 2.8E-13 8.0E-14 1.0E-12 Internal fires during power operation4 3.8E-14 3.7E-14 2.3E-14 5.7E-15 1.1E-13 Seismic events during power operation4 2.6E-13 2.4E-13 1.3E-13 3.3E-14 7.7E-13 High winds during power operation4 4.0E-14 1.2E-13 4.8E-14 6.2E-15 4.2E-13 1 The reported point estimate value is the frequency-weighted sum of all release categories using the release category frequency point estimate values convolved with the conditional consequence mean values over all weather trials for each release category.

2 Reactor shutdown results are based on calendar years and reflect the fraction of the calendar year that the reactor is shutdown (i.e., 0.07). Note, the resulting reactor shutdown calendar-year risk does not include the risk associated with reactor at-power operations during the calendar year.

3 Risk results for internal events and internal floods for the reactor at power are calculated as a single group. Since the contribution from internal floods is very small relative to the contribution from internal events, these values can be meaningfully compared to the reactor shutdown results for internal events.

4 Reactor at-power results are based on reactor-critical-years. To convert the risk metric of the reactor at-power from per reactor-critical-year to per calendar-year, multiply the result by the plant availability factor of 0.93. Note, the resulting reactor, at-power, calendar-year risk does not include the risk associated with reactor shutdown operations during the calendar year.

3-44 Table 3-16 Population-Weighted Latent Cancer Fatality Risk (0-10 Miles), by Release Category, for the Circa-2012 and 2020-FLEX Cases for Internal Events during Shutdown Circa-2012 Case 2020-FLEX Case 2020-FLEX Impact Release Category Name Latent Cancer Fatality Risk

(/yr) (a)

% of Total Latent Cancer Fatality Risk

(/yr) (b)

% of Total (a-b)/a %

Total 4.5E-09 100%

2.1E-09 100%

54%

SD-CF-Before-CD 1.8E-09 40%

8.8E-10 42%

51%

SD-CIF 1.3E-09 30%

3.5E-10 17%

74%

SD-ICF-BURN 8.0E-10 18%

7.0E-10 33%

12%

SD-COPEN-RCSINTACT 3.0E-10 7%

3.6E-11 2%

88%

SD-COPEN-RCSVENT 1.2E-10 3%

4.7E-11 2%

62%

SD-COPEN-HEADOFF 7.8E-11 2%

2.3E-11 1%

70%

SD-ISLOCA 6.8E-11 1%

6.8E-11 3%

SD-NOCF 1.4E-11

<1%

6.8E-12

<1%

52%

SD-LCF 4.4E-13

<1%

1.3E-13

<1%

70%

SD-ECF 3.3E-13

<1%

2.2E-13

<1%

32%

SD-BMT 2.6E-14

<1%

1.2E-14

<1%

53%

3-45 Table 3-17 Statistical Analysis of the Population-Weighted Latent Cancer Fatality Risk (0-10 Miles) for the 2020-FLEX Case for Internal Events during Shutdown and Individual Hazards during Power Operation Point Estimate1

(/yr)

Mean

(/yr)

Median (/yr) 5th-Percentile

(/yr) 95th-Percentile

(/yr)

Internal events during shutdown2 2.1E-09 2.0E-09 1.6E-09 5.8E-10 4.8E-09 Internal events and floods during power operation3,4 9.8E-09 9.9E-09 8.1E-09 3.3E-09 2.2E-08 Internal fires during power operation4 2.2E-08 2.1E-08 1.9E-08 8.8E-09 4.0E-08 Seismic events during power operation4 6.2E-09 5.6E-09 4.6E-09 1.9E-09 1.2E-08 High winds during power operation4 2.4E-09 7.5E-09 5.8E-09 1.9E-09 1.8E-08 1 The reported point estimate value is the frequency-weighted sum of all release categories using the release category frequency point estimate values convolved with the conditional consequence mean values over all weather trials for each release category.

2 Reactor shutdown results are based on calendar years and reflect the fraction of the calendar year that the reactor is shutdown (i.e., 0.07). Note, the resulting reactor shutdown calendar-year risk does not include the risk associated with reactor at-power operations during the calendar year.

3 Risk results for internal events and internal floods for the reactor at power are calculated as a single group. Since the contribution from internal floods is very small relative to the contribution from internal events, these values can be meaningfully compared to the reactor shutdown results for internal events.

4 Reactor at-power results are based on reactor-critical-years. To convert the risk metric of the reactor at-power from per reactor-critical-year to per calendar-year, multiply the result by the plant availability factor of 0.93. Note, the resulting reactor, at-power, calendar-year risk does not include the risk associated with reactor shutdown operations during the calendar year.

4-1 4

KEY ASSUMPTIONS, CONSIDERATIONS, AND UNCERTAINTIES FOR THE 2020-FLEX CASE This section documents key modeling assumptions, additional considerations (if any), and uncertainties associated with the 2020-FLEX case. This information is provided separately for the Level 1 PRA, Level 2 PRA, and Level 3 PRA in Sections 4.1, 4.2, and 4.3, respectively.

4.1 Level 1 PRA This section contains a summary of the 2020-FLEX case model for the Level 1 PRA during reactor shutdown. The model revision is developed in a manner to be consistent with the approach for representing FLEX strategies for at-power conditions for internal events and floods (NRC, 2022a). While the shutdown plant operating states (POSs) employ some of the same and some different FLEX strategies compared to the at-power conditions, a similar parametric FLEX modeling approach is used. Descriptions below use information taken from the reference plants Final Integration Plan (FIP) to summarize the reference plants FLEX strategy approach.

The objective of the FLEX strategies is to establish coping capabilities to prevent damage to the fuel in the reactor and spent fuel pools and to maintain the containment function using installed equipment, on-site portable equipment, and off-site resources. This coping capability addresses an extended loss of AC power (ELAP), namely loss of off-site power, emergency diesel generators (DGs), and any alternate non-FLEX AC sources.

The plants coping capability is attained through the implementation of pre-determined FLEX strategies that are focused on maintaining or restoring key plant safety functions. The FLEX strategies are not tied to any specific damage state or mechanistic assessment of external hazards. Rather, the strategies are developed to maintain the key plant safety functions based on the evaluation of plant response to the coincident ELAP or loss of ultimate heat sink (LUHS) event. A safety function-based approach provides consistency and coordination with existing plant emergency operating procedures (EOPs) and abnormal occurrence procedures (AOPs).

FLEX strategies are implemented using FLEX support guidelines (FSGs) and strategy implementation guides (SIGs). SIGs were developed to have operator actions in the field included in a separate procedure format.

Procedural interfaces have been incorporated into the AOPs for Modes 5 and 6 to include appropriate reference to FSGs. Additionally, procedure interfaces have been incorporated into ECA-0.0, "Loss of All AC Power, which is applicable to shutdown operations during Mode 4.

The strategies for coping with the plant conditions that result from an ELAP/LUHS event involve a three-phase approach:

Phase 1 - Initially cope by relying on installed plant equipment and on-site resources.

Phase 2 - Transition from installed plant equipment to on-site FLEX equipment.

Phase 3 - Obtain additional capability and redundancy from off-site equipment and resources until power, water, and coolant injection systems are restored or commissioned.

4-2 In the modeling used for this report:

Only FLEX Phases 1 and 2 are considered (i.e., use of off-site equipment is not included).

The plants FLEX implementation approach provides different strategies depending on the POS at the time of the initiating event. The modeled FLEX mitigating strategies include:

o core cooling and heat removal with steam generators available and reactor coolant system (RCS) inventory and reactivity control using safety injection accumulators or boron injection FLEX pump (applies during POSs 3, 4, 5A, 12, and 13) o RCS inventory and reactivity control without steam generators available using gravity-driven injection and/or RCS makeup FLEX pump (applies during POSs 4 through 11)

The containment cooling function is not included as part of the plants FLEX strategies.

However, a containment venting strategy is applicable during shutdown Modes 5 and 6 and is addressed as part of the 2020-FLEX case model for the Level 2 PRA.

The results of the original shutdown CDF analysis documented in NRC (2025a) are referred to as the Circa-2012 case. The three key items that are considered for modeling in the 2020-FLEX case are:

1. incorporation of FLEX strategies and equipment into station blackout (SBO) events as directed by the EOPs and AOPs, including gravity-driven injection during shutdown

states,

2. modeling of continued operation of the turbine-driven auxiliary feedwater (TDAFW) pump, including for SBO sequences where the FLEX strategies and associated portable equipment have not been fully implemented16

3. modeling of passive shutdown reactor coolant pump (RCP) seals for loss of RCP seal cooling events, including SBO The modeling of passive shutdown RCP seals is not included in the scope of the modeled shutdown states that are currently included in the CDF model, but this plant modification is expected to have only minimal impact on shutdown operation. As shown in NRC (2025a) the shutdown CDF results show the majority of the CDF is associated with POSs where no RCPs are operating (i.e., POS 5B through POS 11). The remaining modeled shutdown POSs (POSs 3, 4, 5A, 12, and 13) include partial operation of the RCPs (less than four RCPs operating for portions of the POS). However, the lower operating temperatures (RCS temperatures are less 16 This report uses a simplified approach to represent sensitivity studies on the impacts of the FLEX strategies. The approach does not include detailed modeling of combinations of FLEX equipment failures and operator errors.

Rather, the model includes two event tree nodes with developed events. The first event tree node represents FLEX failure, which broadly encompasses the Phase 2 FLEX strategies and associated equipment and actions.

The second event tree node represents continued TDAFW operation and is a viable success path even if the first FLEX node fails. Refer to Appendix A for more information on the modeling approach to represent the FLEX strategies.

4-3 than 350°F for all modeled POSs) and pressures (less than 365 psig for all modeled POSs) are expected to reduce the likelihood of RCP seal failures,17 and the impacts of seal failures would be less severe because not all four RCPs would experience seal failure leakage. The shutdown CDF model (NRC, 2025a) does not include modeling of RCP seal failures. While this is a limitation of the model that underestimates the total shutdown CDF, the relative contributions are expected to be small. Given this model limitation, the shutdown CDF FLEX case addresses the inclusion of the first two items listed above but does not include the passive shutdown RCP seals. Still, the inclusion of the first two items will make the FLEX case and associated shutdown CDF more representative of the plant as currently built and operated.

These modeling revisions are represented by aggregated failure probabilities (one for each of the first two items listed above). This allows a parametric assessment of the effect of FLEX changes on the CDF, without justifying individual failure probabilities for equipment and operator actions. This approach is deemed to be suitable for assessing the sensitivity of shutdown CDF to the impacts of FLEX strategies, especially considering the uncertainties in the equipment reliabilities and human error probabilities at the time of this calculation.

Section 4.1.1 describes the key modeling assumptions for the 2020-FLEX case and Section summarizes the key uncertainties and their impact on the results. A description of the changes incorporated into the Circa-2012 Level 1 PRA model to develop the 2020-FLEX model is provided in 5APPENDIX A.

4.1.1 Key Assumptions Major assumptions for the Level 1 PRA portion of the 2020-FLEX case model are summarized below. This list includes the desired characteristics of a FLEX model as already used in the NRCs SPAR models. It should be noted, however, that not all these modeling points are necessarily used explicitly in the parametric sensitivity analysis documented in this report. Some of these points are only included here to elaborate on the context and scope of the FLEX model basic events used in this sensitivity analysis.

FLEX is considered for accident sequences modeled in the SBO event tree (ET). The SBO ET is entered when the Total Loss of All AC Power procedure is implemented.

The Circa-2012 case model was revised to account for FLEX if ELAP is declared, since FSGs are only activated after ELAP is declared according to the applicable plant procedures.

Although FLEX strategies and equipment were stated in the reference plant FIP to be in response to beyond-design-basis external events, there is no explicit limitation in the plant FLEX documents and procedures to prevent taking credit for FLEX for internal events during shutdown if SBO conditions exist and ELAP is declared.

17 Much analysis has been done to evaluate the likelihood of RCP seal failures at nominal operating temperatures and pressures, e.g., WCAP-15603 (Sancaktar, 2002). The analyses indicate that exposure to high RCS temperatures and differential pressures are contributing factors in evaluating seal failures. While the analyses have not been extended to fully evaluate shutdown conditions, the analyses and supporting data suggest RCP seal failures after plant cooldown are highly unlikely. In the NRC staffs safety evaluation of WCAP-15603 (NRC, 2003), the staff accepted using a zero probability of failure for RCP seal O-ring failures if it can be justified that the plants cooldown will result in an RCS pressure of less than 1710 psi within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the loss of all seal cooling.

4-4 ELAP may be declared as early as within the first hour following a total loss of AC power, and as late as within the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following a total loss of AC power.

The FLEX case addresses shutdown initiating events that occur during Modes 4, 5, and 6.18 Operators are directed to the FSGs from ECA-0.0, Loss of All AC Power, for accidents initiated during Mode 4. For accidents initiated during Modes 5 and 6, the abnormal operating procedures, 18019-C, Loss of Residual Heat Removal and 18031-C, Loss of Class 1E Electrical Systems, direct operators to the FSGs.

The mission time is assumed to be 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. However, this has no effect on this sensitivity analysis since a fault-tree based model to represent FLEX equipment and human failures is not used. A simple parametric representation of FLEX success or failure is used to assess the model sensitivity to inclusion of the FLEX strategies. This model assumption is included here to retain consistency with other FLEX models NRC uses for its risk assessments. (Assignment of a 72-hour mission time for FLEX success in PRA models is prudent and necessary from a safety assessment perspective, considering that the FLEX includes a three-phase response after ELAP declaration and relies mainly on non-safety equipment).

For POSs where steam generator cooling is available, it is assumed that if the TDAFW pump is available, operators will use it as long as possible to cope with the sequence, until AC power is restored. That is, operators will not voluntarily switch strategies to low pressure steam generator injection, if the TDAFW pump is still operational and can remove decay heat.

Gravity feed (i.e., gravity-driven RCS injection from the RWST) is credited as the FLEX Phase 1 strategy for POSs with RCS vented or reactor vessel head removed and sufficient time to establish gravity feed before RCS boiling. However, successful gravity feed does not meet the end state success criteria for the FLEX sequence mission time.

Gravity feed may not maintain the required flow rate for the duration of the mission time.

It is still credited to extend the response time for implementing Phase 2 strategies.

The Phase 2 FLEX strategies for POSs without steam generator cooling available involve using the FLEX pumps and injection inventory sources identified in (SNC, 2016) to maintain RCS inventory and temperature. The L3PRA FLEX parametric sensitivity study assumes that if the Phase 2 FLEX strategy is successfully implemented, then the strategy will be successful for the duration of the mission time. However, the capacities of the equipment and inventory sources were not independently verified for this analysis.

It is possible that actions may be necessary to align multiple inventory sources throughout the mission time, as well as actions for fueling diesel generators and diesel-driven pumps, but any such actions are not explicitly modeled in the FLEX sensitivity analysis.

AC power recovery is assumed to be required to achieve a safe/stable end state with successful FLEX or TDAFW pump operation (i.e., successful FLEX implementation includes maintaining successful FLEX strategy operation for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and successful AC 18 The FLEX case model scope is consistent with the Circa-2012 shutdown CDF model (NRC, 2025a), which includes POSs during Modes 4, 5, and 6 during a refueling outage. CDF contributions from low power and hot standby POSs (during Modes 1, 2, and 3) are estimated in sensitivity studies (see Section 10.3.2 in NRC [2025a]).

The FLEX case does not include contributions from low power and hot standby POSs.

4-5 power recovery within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />).19 It should be noted that at this time there may not be a consensus about FLEX accident sequence success criteria. However, this has no effect on this model quantification since a detailed FLEX model is not used here.

4.1.2 Key Uncertainties The most important modeling uncertainties introduced in the 2020-FLEX case are associated with the probabilities assigned to the two new ET nodes characterizing the two FLEX-related failures, as discussed below.

The FLEX-related revisions to the CDF model consist of adding two new ET nodes to the existing SBO sequences to expand the number of possible success paths. These nodes address (1) whether ELAP is declared, and FLEX strategies are successfully implemented, and (2) if FLEX is unsuccessful, whether extended TDAFW pump operation is successful under extended SBO conditions.

As discussed in Section 3.1.2, sensitivity analyses (referred to as alternative cases) were performed to assure that the failure probabilities assumed for these ET nodes are reasonable; namely, they do not significantly sway the results and insights in either a conservative or nonconservative direction.

There are other modeling uncertainties inherited from the Circa-2012 model, upon which the FLEX scenarios are superimposed. These modeling uncertainties are already discussed for the Circa-2012 model in the reactor, low-power and shutdown, Level 1 PRA report for internal events (NRC, 2025a).

4.2 Level 2 PRA This section contains a summary of the key model assumptions, additional considerations, and sources of uncertainty for the Level 2 PRA portion of the 2020-FLEX case. The Level 2 PRA model is influenced by the Level 1 PRA FLEX-related modeling changes that result in a reduction of the CDF. Section 4.2.1 describes the key modeling assumptions. Section 4.2.2 discusses other modeling considerations. Section 4.2.3 summarizes the key uncertainties and their impact on the results.

4.2.1 Key Assumptions The key assumptions for the Level 2 PRA for the 2020-FLEX case model are summarized below.

The Level 2 PRA for the Circa-2012 case considers extended manual operation of the TDAFW pump during certain slow-developing SBO sequences. For the 2020-FLEX case, the credit for extended TDAFW pump operation is removed because it duplicates model changes that are made to the Level 1 portion of the model. The continued 19 The success criteria for a safe/stable end-state given ELAP are defined to include AC power recovery either directly or through long-term assets (DGs, etc.) provided from offsite sources (SAFER [Strategic Alliance for FLEX Emergency Response] response center). This is consistent with the three-phase FLEX strategy going as far as 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> as defined in FIP documents.

4-6 TDAFW pump operation is addressed in the Level 1 PRA portion of the 2020-FLEX case.

The 2020-FLEX case release categories use the same representative source terms as the Circa-2012 case. The primary impact on the model with the inclusion of FLEX strategies and continued TDAFW operation is the reduction of release category frequencies, but the model changes also influence the accident progression sequences and related modeling assumptions. Each release category includes a mix of different accident sequences that have similar attributes but are not identical. The representative source term scenarios cannot exactly represent all the contributing elements. The representative source term should consider the balance of timing and magnitude to select a source term that conservatively bounds the range of outcomes for that release category. The considerations related to within release category variability are discussed in Section 2.5 of the Level 2 PRA report (NRC, 2025b). Those considerations generally apply to the 2020-FLEX case release category results. Although the FLEX changes have significantly reduced the frequency results, the contributing sequences remain consistent with the representative source term selections.

The reference plants containment design does not require cooling or venting during the Phase 1 or Phase 2 FLEX implementation. Therefore, the inclusion of FLEX has no impact on the ability to control containment pressure or containment heat removal. The Level 2 PRA does consider longer-term actions directed by EDMGs for containment pressure control and containment heat removal. These actions are considered to be unaffected by the FLEX model changes.

The modeled EDMG-directed actions are developed based on versions of the guidelines provided by the reference plant circa 2012. At that time, versions of the reference plants SAMGs were not applicable to accidents that are initiated during shutdown operations.

Updated versions of the SAMGs for the reference plant were later obtained, but these were not provided in time to be incorporated into the current analysis. In the updated SAMGs, FLEX equipment is listed as an option along with other installed plant equipment as possible ways to implement the strategies. Since the EDMGs and SAMGs are not prescriptive, but focus on accomplishing a function (e.g., control containment pressure) and provide options to accomplish it, the Level 2 PRA modeling of post-core damage actions is primarily driven by human reliability analysis (HRA) and plant conditions due to earlier failures, not by availability of equipment. Availability of FLEX equipment provides another layer of defense-in-depth but is not expected to have significant impact on the post-core damage modeling.

4.2.2 Additional Considerations The inclusion of FLEX strategies significantly reduces the release frequencies, but the representative release source terms are not changed. As discussed in the key assumptions above, the modeled release categories each include a range of accident sequences, which are collectively represented by a single representative source term. A significant contribution to the variation within release categories is the timing of equipment failures that can delay core damage and containment failure, which can reduce the resulting source terms. As part of the reactor, shutdown, Level 2 PRA for internal events, a range of accident scenario simulations and sensitivity studies have been performed to account for this variation. The boundary

4-7 conditions of the cases that were simulated to generate potential source terms are described in Section 2.3.3 of the reactor, shutdown, Level 2 PRA report for internal events (NRC, 2025b).

The representative source term scenarios cannot exactly represent all the contributing accident sequences. Selecting the representative source term should consider the balance of timing and magnitude so that the selected source term conservatively bounds the range of outcomes for that release category. The selection compares the candidate representative accident scenarios with the attributes of the release category sequences in terms of the following factors:

type of initiating event POS conditions availability of containment systems (e.g., containment cooling units, containment sprays) containment failure mechanism timing of core damage, reactor vessel breach, and containment failure release magnitude frequency contribution of different sequences within a release category While the release category frequency results have changed in the 2020-FLEX case, the attributes of the contributing sequences to the release categories have not changed significantly. Therefore, the changes introduced by the 2020-FLEX case were deemed to not be significant enough to warrant generating new representative source terms. For both the Circa-2012 case and the 2020-FLEX case, there is not always an exact match between the dominant release category sequence and the representative accident scenarios.

While no changes were made to the representative accident scenarios and source terms, the potential changes introduced by the 2020-FLEX case changes were assessed qualitatively. The impacts of the FLEX changes include reducing the frequency contributions from SBO sequences and potential influences on the accident progression timing for SBO sequences. The accident progression timing can be impacted by the FLEX strategies by delaying the onset of core damage. For example, a FLEX core cooling strategy could be implemented to provided RCS makeup with a FLEX makeup pump, but ultimately the pump fails before the mission time is achieved. This would provide some benefit in delaying core damage compared to the case where FLEX strategies are not credited. However, the simplified FLEX modeling approach used in the shutdown Level 1 PRA does not provide insights on when and how the FLEX failures occur. Not having a basis for specific changes to the sequence timing helped to support the decision to maintain the representative accident scenarios for the 2020-FLEX case.

The FLEX impacts on sequence timing could also influence the warning times for evacuating the population and preventing early radiological consequences. The selection of warning times for each release category are based on the timing of the representative accident scenarios.

Most of the shutdown release categories are assessed to have long warning times (i.e., greater than 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />). The variations introduced by the FLEX modeling are not expected to have any notable impacts on the warning time determinations for these release categories.

However, shutdown release categories with short warning times and significant frequency contributions from SBO sequences could potentially have impacts on the accident progression timing with the addition of FLEX. These conditions apply to two shutdown release categories, 1-REL-SD-COPEN-RCSINTACT and 1-REL-SD-COPEN-RCSVENT, which were both determined to have warning times of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In the representative scenarios for these release categories, the GE declaration is based on having no decay heat removal and no injection to the reactor

4-8 vessel while the containment is open. The timing of FLEX-related failures could influence the timing of the GE declaration.

With the implementation of FLEX strategies, it may be more likely that core cooling can be successfully extended and delay the onset of core damage. By delaying core damage, the eventual environmental releases are lessened. However, the same representative source terms for the Circa-2012 case are applied to the 2020-FLEX case. The reasoning for using those representative cases is that the Level 1 PRA SBO sequences that are passed to the Level 2 PRA include failures to implement FLEX and extend TDAFW operation. If those actions fail, then decay heat removal is assumed to be lost early in the event progression, similar to the assumptions in the Circa-2012 cases. If those actions are successful, then core damage is avoided, and the sequences would not be addressed in the Level 2 PRA. Realistically, there could be a range of intermediate outcomes with different combinations of human and equipment failures that influence the timing of event progression, which would tend to reduce the environmental releases.

4.2.3 Key Uncertainties As described in Section 3.2.2, alternative assumptions regarding accident termination and post-core damage recovery actions can significantly reduce the surrogate risk metric results for LERF, LRF, and CCFP. If there are credible reasons to model an accident scenario termination time at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after core damage indication (as opposed to 7 days after event initiation), then both LRF and CCDP would be reduced significantly.

A comprehensive review of modeling uncertainties that can affect the source term development and other aspects of the Level 2 PRA modeling is presented in Section 2.6.3 of the shutdown Level 2 PRA report (NRC, 2025b). In general, the same model uncertainties apply to the 2020-FLEX case for shutdown. For example, the model uncertainties related to radiological release pathway modeling can have potentially large impacts on release magnitudes, and these same uncertainties are applicable to the 2020-FLEX case.

The FLEX-related revisions to the model could also increase the uncertainties associated with accident progression timing and selection of representative source terms. These issues are discussed above under key assumptions (Section 4.2.1) and additional considerations (Section 4.2.2).

4.3 Level 3 PRA As discussed previously, FLEX strategies are intended to provide coping capability to prevent core damage. Therefore, the primary effect of FLEX strategies on the PRA model is a reduction of the CDF from sequences involving SBO events or RCP seal failures. The main impact on the Level 2 and Level 3 models for FLEX strategies is carrying forward the modified Level 1 sequences, which results in reduced frequencies for the applicable release categories.

As discussed in Section 4.2, the implementation of FLEX strategies may affect accident progression modeling impacting the timing and magnitude of releases. However, while the release category frequency results have changed in the 2020-FLEX case, the representative source terms are still consistent with the Level 2 PRA logic model assumptions that were used in defining the release categories. Therefore, the 2020-FLEX case for shutdown uses the same representative source terms as the Circa-2012 case.

4-9 To the extent that the implementation of FLEX strategies alters accident progression timelines, the warning time (i.e., the time between the declaration of a GE and the onset of a major release) could either increase or decrease. An increase in the warning time would not have a significant effect on the results because the warning time is already sufficiently long for most release categories to significantly reduce early phase exposures. In principle, a decrease in the warning time could result in increased early phase exposures; the significance of this hypothetical situation would need to be balanced against the long warning times in the base case model, the reduction of CDF associated with the 2020-FLEX case, and likelihood of lower release magnitudes associated with the more delayed accident progression.

The potential influences of the FLEX modeling changes on the scenario assumptions and timing are discussed in more detail in Section 4.2, but ultimately no changes were made to the representative accident scenarios or source terms. It is also not expected that there would be changes to other aspects of the Level 3 PRA modeling (e.g., meteorology, atmospheric transport and diffusion, emergency response, economic factors, dosimetry, or health effects).

As indicated above, the 2020-FLEX case does not include any changes specific to the consequence analysis portion of the analysis; therefore, no specific assumptions, considerations, or uncertainties are identified here. However, it should be noted that the key assumptions, considerations, and uncertainties from the Circa-2012 case, as discussed in the Level 3 PRA report for shutdown (NRC, 2025c), also apply to the 2020-FLEX case for shutdown.

5-1 5

REFERENCES HPS, 2010 Health Physics Society, Radiation Risk in Perspective: Position Statement of the Health Physics Society (PS010-2), adopted January 1996, revised July 2010, McLean, Va.

HPS, 2019 Health Physics Society, Radiation Risk in Perspective: Position Statement of the Health Physics Society (PS010-4), adopted January 1996, revised February 2019, McLean, Va.

NRC, 1986 U.S. Nuclear Regulatory Commission, Safety Goals for the Operations of Nuclear Power Plants, Policy Statement, Republication (51 FR 30028), Federal Register, 1986.

NRC, 2003 U.S. Nuclear Regulatory Commission, Safety Evaluation Report for the Westinghouse Owners Group (WOG) Topical Report WCAP-15603, Revision 1, WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs, April 2003

[ML030980126].

NRC, 2012 U.S. Nuclear Regulatory Commission, State-of-the-Art Reactor Consequence Analyses (SOARCA) Report, NUREG-1935, November 2012 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12332A057).

NRC, 2022a U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 3x: Overview of Reactor, At-Power, Level 1, 2, and 3 PRAs for Internal Events and Internal Floods, April 2022 [Draft for Comment] (ADAMS Accession No. ML22067A210).

NRC, 2022b U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 3a, Part 1: Reactor, At-Power, Level 1 PRA for Internal Events, Part 1 - Main Report, April 2022 [Draft] (ADAMS Accession No. ML22067A211).

NRC, 2022c U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 3c: Reactor, At-Power, Level 2 PRA for Internal Events and Floods, April 2022 [Draft] (ADAMS Accession No. ML22067A214).

NRC, 2022d U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 3d: Reactor, At-Power, Level 3 PRA for Internal Events and Floods, April 2022 [Draft] (ADAMS Accession No. ML22067A215).

NRC, 2024 U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 4: Overview of Reactor, At-Power, Level 1, 2, and 3 PRAs for Internal Fires, Seismic Events, and High Winds, August 2023 [Draft for Comment] (ADAMS Accession No. ML23194A015).

NRC, 2025a U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 5a: Reactor, Low-Power and Shutdown, Level 1 PRA for Internal Events, September 2025 [Draft] (ADAMS Accession No. ML25157A085).

5-2 NRC, 2025b U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 5b: Reactor, Low-Power and Shutdown, Level 2 PRA for Internal Events, September 2025 [Draft] (ADAMS Accession No. ML25157A086).

NRC, 2025c U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project, Volume 5c: Reactor, Low-Power and Shutdown, Level 3 PRA for Internal Events, September 2025 [Draft] (ADAMS Accession No. ML25157A087).

Sancaktar, 2002 Sancaktar, S., WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs, WCAP-15603, Revision 1, Westinghouse Electric Company, May 2002 [ML021500485].

A-1 APPENDIX A 2020-FLEX CASE DEVELOPMENT The 2020-FLEX case model for the reactor, low-power and shutdown, Level 1 PRA was developed by incorporating a set of changes into the Circa-2012 Level 1 PRA model (NRC, 2025a) to credit implementation of FLEX strategies and equipment for responding to an extended loss of AC power (ELAP) or loss of ultimate heat sink (LUHS) event. In addition, if FLEX is not successful, the 2020-FLEX case credits the potential for continued turbine-driven auxiliary feedwater (TDAFW) pump operation given a complete loss of all installed AC and direct current (DC) power.

The FLEX strategies for coping with the plant conditions that result from an ELAP/LUHS event involve a three-phase approach:

Phase 1 - Initially cope by relying on installed plant equipment and on-site resources.

Phase 2 - Transition from installed plant equipment to on-site FLEX equipment.

Phase 3 - Obtain additional capability and redundancy from off-site equipment and resources until power, water, and coolant injection systems are restored or commissioned.

In the modeling used for the 2020-FLEX case for low-power and shutdown:

Only FLEX Phases 1 and 2 are considered (i.e., use of off-site equipment is not included).

The plants FLEX implementation approach provides different strategies depending on the plant operating state (POS)20 at the time of the initiating event. The modeled FLEX mitigating strategies include:

o core cooling and heat removal with steam generators (SGs) available and reactor coolant system (RCS) inventory and reactivity control using safety injection accumulators or boron injection FLEX pump (applies during POSs 3, 4, 5A, 12, and 13) o RCS inventory and reactivity control without SGs available using gravity-driven injection and/or RCS makeup FLEX pump (applies during POSs 4 through 11)

The containment cooling function is not included as part of the plants FLEX strategies.

However, a containment venting strategy is applicable during shutdown Modes 5 and 6 and is addressed as part of the 2020-FLEX case model for the Level 2 PRA.

The changes incorporated into the 2020-FLEX case model consist of adding two new event tree (ET) nodes to the existing station blackout (SBO) ET to expand the number of possible success paths. The new ET nodes are described in Section A.1 and the new ET sequences obtained by the introduction of these nodes are described in Section A.2. The success criteria for the two new ET nodes are discussed in Section A.3 and the basic event probabilities used to quantify 20 See NRC (2025a) for a description of the various POSs.

A-2 the new nodes are discussed in Section A.4. Finally, Section A.5 provides some additional revisions that were made to the model to get a more accurate estimation of core damage frequency (CDF) for the reactor, low-power and shutdown, 2020-FLEX case.

A.1 Event Tree Node Descriptions Descriptions of the two ET nodes added to the 2020-FLEX case model are provided below.

1-FLEX (ELAP Declared and FLEX Successful)

This ET node represents declaration of ELAP and implementation of Phase 2 FLEX strategies.

The FLEX strategies differ depending on the POS, but the same ET node is used to represent implementation of the strategies across all shutdown POSs. For all FLEX strategies, the portable FLEX equipment needs to be locally staged, connected, started, and operated (including refueling) for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. During this time, restoration of AC power is required to declare a safe and stable end state. The key POS attribute to determine the FLEX strategy is the availability of SGs for RCS heat removal.

For POSs with SGs available to provide RCS heat removal (i.e., POSs 3, 4, 5A, 12, and 13),

this node includes declaration of ELAP, successful DC load shedding, success of one 480V FLEX diesel generator (DG) supplying battery charging, success of the SG FLEX pump (if the TDAFW pump is unavailable or has failed), and boron addition and RCS makeup by the makeup FLEX pump.

For POSs where SGs are not available for RCS heat removal (i.e., POSs 5B through 11), this node includes declaration of ELAP and successful RCS inventory and reactivity control with a makeup FLEX pump powered by a 480V FLEX DG with suction from RWST. During Mode 6 inventory control can be established using the SG FLEX pump to make up demineralized water from any available source (i.e., condensate storage tank [CST] or reactor makeup water storage tank [RMWST]).

1-AFW-SBO-NO-FLEX (Continued TDAFW Pump Operation in SBO)

This node is used only for POSs with SGs available to provide RCS heat removal (i.e., POSs 3, 4, 5A, 12, and 13). This node appears in the shutdown SBO ETs immediately after the new 1-FLEX node. Use of the TDAFW pump for SG cooling is queried in the SBO ETs before the FLEX node, but long-term cooling with the TDAFW pump requires recovery of the onsite emergency DGs or offsite power. The addition of this node allows crediting manual operation of the TDAFW pump in FLEX Phase 1 and continued in Phase 2 until the SG pressure drops below the TDAFW pump operation limit. The success branch of this node indicates successful implementation of FLEX strategies to continue manual operation of the TDAFW pump and leads to a safe, stable end state (denoted as OK in the ET). The TDAFW pump may be controlled locally. It also may be controlled from the main control room in cases where the FLEX 480V DG is successful in supplying battery charging. TDAFW may not last for the 72-hour mission time prescribed with manual (and possibly local) control, and possible equipment failures. Therefore, AC power must be recovered before the SG pressure drops below its operation limit. The expected duration of TDAFW operation (the time window) before SG pressure is no longer adequate is not discussed in the references available. The length of this time window will affect when the FLEX SG pump must be ready to take over the function or AC power must be

A-3 recovered. However, this has no effect on this model quantification since a detailed FLEX model is not used here.

A.2 Event Tree Sequences If the 1-FLEX and 1-AFW-SBO-NO-FLEX nodes are not credited, then the CDF results of the shutdown SBO sequences are the same as for the Circa-2012 case. However, the ET changes modify the sequence numbering. If the 1-FLEX and 1-AFW-SBO-NO-FLEX nodes are credited and one of these new nodes are successful, then the following new ET success paths are introduced:

If 1-FLEX node is successful, then the sequence is assigned the OK end state.

For POSs where SG cooling is possible, if 1-FLEX node fails, but 1-AFW-SBO-NO-FLEX node is successful, then the sequence is assigned the OK end state.

For POSs where SG cooling is not possible, the Phase 1 FLEX strategy for gravity feed is credited. Though, in this case, the credit for gravity feed did not introduce a new ET node because the Circa-2012 case model already included gravity feed modeling. Successful gravity feed does not result in an OK end state, but the success branch impacts the time available for late recovery of AC power and residual heat removal (RHR) cooling.

The last ET node, which represents late recovery of RHR cooling for a safe and stable end state, is not queried if either 1-FLEX or 1-AFW-SBO-NO-FLEX is successfulrecovery of AC power to reach a safe and stable end state is subsumed in the success criteria for these two new ET nodes.

A.3 ET Node Success Criteria The success criteria for the two new 1-SBO ET nodes are described in this section.

1-FLEX FLEX success criteria are:

declaration of ELAP success of load shedding success of 480V FLEX DG success of SG FLEX pump for feeding steam generators for POSs with SG cooling success of SG FLEX pump for Mode 6 (i.e., POSs 7, 8E, and 8L) for makeup to refueling cavity success of boron addition and RCS makeup by the makeup FLEX pump restoration of AC power within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />

A-4 portable FLEX equipment needs to be locally staged, connected, started, and operated for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and refueled The success criteria for FLEX implementation during shutdown are similar to those used for modeling the FLEX strategies for full power operation (NRC, 2022a). While the specific strategy varies depending on the POS conditions (e.g., feeding SGs or makeup to refueling cavity), the same portable FLEX equipment is used, and the strategies are implemented in a similar timeframe. For these reasons, the same FLEX failure probability as used in the full power model is used in the shutdown model. The FLEX failure probabilities are discussed further in Section A.4, and sensitivity cases with alternative FLEX failure probabilities are described in Section 3.1.2.

1-AFW-SBO-NO-FLEX Continued TDAFW pump operation success criteria include:

operation from the main control room or manual local operation restoration of AC power before the SG steam pressure falls below 120 psig.21 Note, in cases where the FLEX DG is operating but other FLEX functions fail, DC power can be maintained throughout the event, which ensures control power will be available for the TDAFW pump. DC power is initially provided by the safety-related station batteries and subsequently by the battery chargers, once the onsite 480V FLEX DG is operating.

The success criteria for continued TDAFW pump operation are the same as those used for modeling the FLEX strategies for full power operation (NRC, 2022a). The reference plants FLEX plan indicates that the same FLEX strategy applies during Modes 1-4 and Mode 5 with SGs available. Consequently, the same TDAFW pump operation failure probability as used in the full-power model is used in the shutdown model for POSs where SG cooling is applicable.

The FLEX failure probabilities are discussed further in Section A.4, and sensitivity cases with alternative FLEX failure probabilities are described in Section 3.1.2.

A.4 New Basic Event Probabilities Each of the two new SBO ET nodes is represented by a single basic event, as opposed to combinations of basic events representing different equipment and operator action failures. This simplified approach is appropriate for this sensitivity analysis because of the uncertainties in modeling deployment actions and is valid when the new nodes are deemed to be independent from the other ET nodes.

It is deemed that the current state of knowledge would limit the validity of human error probabilities (HEPs) assignable to individual FLEX actions.22 For this sensitivity analysis no 21 Restoration of AC power before the SG steam pressure falls below 120 psig, and the subsequent need for an alternative ultimate heat removal source to be made operable, are not explicitly considered as part of this analysis; rather, they are implicitly considered as part of the all-encompassing basic event for this node.

22 At the time of the initial low-power and shutdown Level 1 PRA model development, there was limited experience with applying human reliability analysis (HRA) methods to FLEX actions. Concurrent with the development of the L3PRA project, NRC staff, with participation from nuclear industry groups, developed Research Information Letter 2020-13 (the associated letter reports are available in ADAMS at accession numbers ML20345A318 and ML21032A119 for Volume 1 and Volume 2, respectively) to exercise the IDHEAS-ECA method to estimate HEPs

A-5 attempt is made to separately model equipment failure and human error events. The probabilities assigned to the failures, as shown below, are meant to include equipment failures and operator errors and failure to recover AC power within 72 hrs. These probabilities are treated as parameters that are varied to estimate CDF for different cases. The FLEX-related failure probabilities used to estimate the shutdown CDF for the 2020-FLEX case are provided in the table below:

Basic Event Name Probability F 1-FLEX-FAILS 0.3 T 1-AFW-SBO-NO-FLEX-FA 0.3 The shutdown CDF analysis using these parameters is identified as the 2020-FLEX case. A parameter p is defined to represent the combined probability of FLEX failure. The parameter p is given as the product of F and T for POSs with SG cooling available, and p is equal to F for POSs where SG cooling is not available.

The failure probabilities used for FLEX and manual TDAFW pump operations are parametric values chosen by expert judgement, based on PRA experience, experience with 70 SPAR models for full-power operation, and consistent with the FLEX modeling approach for internal events and floods during power operation (NRC, 2022a). The cases studied with different parameter values are used to show the range of the effectiveness of the FLEX strategies with varying assumptions about the reliability of implementing FLEX. The case results are provided in Section 3.1.2 and Table 3-4.

As discussed in Section A.2, the Phase 1 FLEX strategy for gravity feed is also modeled.

However, the modeling associated with gravity feed was included in the Circa-2012 case and the failure probabilities are unchanged in the FLEX case model. The gravity feed failure probability is dominated by the human failure events (HFEs) associated with the action. HFEs are developed for a variety of POS conditions as documented in (NRC, 2025a). The HEP values for failure to establish gravity feed range from 8.0x10-3 to 5.5x10-1.

A.5 Additional Revisions to the Model The FLEX model described in this report affects the SBO sequences resulting in core damage.

Other sequences which also involve a loss of total AC power due to consequential losses of offsite power (CLOOPs) were examined to assess if FLEX strategies could be implemented.

These sequences do not query the added FLEX ET nodes, 1-FLEX and 1-AFW-SBO-NO-FLEX, so the FLEX modeling does not directly impact the sequence CDF.

To address the potential for FLEX to impact these sequences, an ET post-processing rule was applied to credit FLEX recovery for certain consequential and random LOOP cutsets that result in SBO due to common-cause failure of reserve auxiliary transformer breakers or emergency DG load sequencers (which collectively dominate the CDF contribution from consequential and random LOOPs). The rule only credits the FLEX strategies and equipment associated with the for FLEX actions. While the IDHEAS-ECA approach was not used in developing the FLEX case for the L3PRA project, this work provides a basis for applying HRA methods to FLEX actions for future applications.

A-6 1-FLEX ET node. This rule does not credit extended TDAFW operation because for most of the cutsets SG cooling is not possible.

It is recognized that there may be a small number of additional CDF cutsets that can also benefit from FLEX, but no further model revisions were developed to ensure all cutsets were addressed. These additional cutsets involve failure of a 4.16 kV AC bus or other failures leading to a CLOOP, or other failures that could result in loss of emergency power in response to a CLOOP. Crediting FLEX for these additional cutsets is not expected to make a substantial further reduction in CDF.

NUREG-XXXX Jeff Wood, Alan Kuritzky, Alfred (Trey) Hathaway, Keith Compton Division of Risk Analysis Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Alan Kuritzky, NRC Level 3 PRA Project Program Manager Same as above The U.S. Nuclear Regulatory Commission performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The scope of the L3PRA project encompasses all major radiological sources on the site (i.e., reactors, spent fuel pools, and dry cask storage), all internal and external hazards, and all modes of plant operation. A full-scope site Level 3 PRA for a nuclear power plant site can provide valuable insights into the importance of various risk contributors by assessing accidents involving one or more reactor cores as well as other site radiological sources. This report, one of a series of reports documenting the models and analyses supporting the L3PRA project, provides an overview of the reactor, low-power and shutdown, Level 1, 2, and 3 PRA models for internal events. The analyses documented herein are based information for the reference plant as it was designed and operated as of 2012 and do not reflect the plant as it is currently designed, licensed, operated, or maintained. To provide results and insights better aligned with the current design and operation of the reference plant, this report also provides the results of a parametric sensitivity analysis based on a set of new plant equipment and PRA model assumptions for all three PRA levels. The sensitivity analysis reflects the current reactor coolant pump shutdown seal design at the reference plant, as well as the potential impact of FLEX strategies, both of which reduce the risk to the public.

PRA Level 1 PRA Internal events Level 2 PRA Low-Power and Shutdown Level 3 PRA Risk Plant damage states Core damage Release categories CDF Source terms Level 3 PRA project Consequence analysis L3PRA project LERF September 2025 Technical U.S. NRC Level 3 Probabilistic Risk Assessment Project Volume 5: Overview of Reactor, Low-Power and Shutdown, Level 1, 2, and 3 PRAs for Internal Events

NUREG-XXXX U.S. NRC LEVEL 3 PROBABILISTIC RISK ASSESSMENT (PRA) PROJECT September 2025