Text

Preliminary Draft NUREG-1935, Rev. 3, State-of-the-Art Reactor Consequence Analyses (Soarca) Project. Appendix a (Draft), Peach Bottom Integrated Analysis. Part 1 of 3
	ML11192A300
Person / Time
Site:	Peach Bottom
Issue date:	10/28/2010
From:	; Office of Nuclear Regulatory Research, Sandia
To:	;
References
	FOIA/PA-2011-0083 NUREG-1935 R3 DRFT
	Download: ML11192A300 (93)
	v • d • e

PRfDOISfý/L Revision 3 - 10/28/2010 8:18:00 AM NUREG - 1935 SAND2008P - XXXX State-of-the-Art Reactor Consequence Analyses (SOARCA) Project Appendix A (DRAFT)

Peach Bottom Integrated Analysis Manuscript Completed: XXXX Date Published: XXXX Prepared by:

Sandia National Laboratories Albuquerque, New Mexico 87185 Operated for the U.S. Department of Energy U.S. Nuclear Regulatory Commission Office of Nuclear Regulatory Research Washington, DC 20555-0001

POrACLAO L

4F Revision 3 - 10/28/2010 8:18:00 AM Sandia is a multi-program laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy's National Nuclear Security Administration under contract DE-AC04-94AL85000.

ii

00, Revision 3 - 10/28/2010 8:18:00 AM ABSTRACT New analyses of severe accident progression and consequences were performed to assess the results of past analyses and help guide public policy. This study has focused on providing a realistic evaluation of accident progression, source term, and offsite consequences for the Peach Bottom Nuclear Power Station. By using the most current emergency preparedness (EP), plant capabilities, best-available modeling and uncertainties, these analyses are more detailed, integrated, and realistic than past analyses. These analyses also consider all mitigative measures, contributing to a more realistic analysis.

Paperwork Reduction Act Statement The information collections contained in this NUREG are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Management and Budget (OMB), approval number 3150-0011.

iii

Revision 3 - 10/28/2010 8:18:00 AM This Page Intentionally Left Blank iv

PJOOOV90ý Revision 3 - 10/28/2010 8:18:00 AM ACKNOWLEDGEMENTS The contributions of the following individuals in preparing this document is gratefully acknowledged.

Jon Ake Nathan E. Bixler Jeffrey D. Brewer Terry Brock Shawn P. Bums Randall 0. Gauntt Ata Istar Joseph A. Jones Robert Prato Mark T. Leonard Jocelyn Mitchell Mark Orr Jason Schaperow F. Joseph Schelling Abdul Sheikh Richard Sherry Charles G. Tinkler Randolph Sullivan Kenneth C. Wagner Nuclear Regulatory Commission Sandia National Laboratories Sandia National Laboratories Nuclear Regulatory Commission Sandia National Laboratories Sandia National Laboratories Nuclear Regulatory Commission Sandia National Laboratories Nuclear Regulatory Commission dycoda, LLC Nuclear Regulatory Commission Nuclear Regulatory Commission Nuclear Regulatory Commission Sandia National Laboratories Nuclear Regulatory Commission Nuclear Regulatory Commission Nuclear Regulatory Commission Nuclear Regulatory Commission Sandia National Laboratories v

An-S Revision 3 - 10/28/2010 8:18:00 AM This Page Intentionally Left Blank vi

7V

/

/P1 Revision 3 -10/28/2010 8:18:00 AM TABLE OF CONTENTS A BST RA C T..................................................................................................................................

iii A C K N O W LED G EM EN TS.........................................................................................................

v TA BLE O F C O N TEN TS.......................................................................................................

vii LIST O F FIG U R ES..............................................................................................................

x LIST O F TA BLES....................................................................................................................

xiii A C R O N Y M S...............................................................................................................................

xv 1.0 IN T RO D U C TIO N.............................................................................................................

1 1.1 O utline of Report............................................................................................................

1 2.0 ACCIDENT SCENARIO DEVELOPMENT.............................................................

3 2.1 Sequences Initiated by Internal Events......................................................................

3 2.2 Sequences Initiated by External Events......................................................................

4 3.0 ACCIDENT SCENARIO DEFINITIONS..................................................................

6 3.1 Long-Term Station Blackout....................................................................................

6 3.1.1 Initiating Event........................................................................................................

6 3.1.2 System A vailabilities..............................................................................................

7 3.1.3 M itigative A ctions..................................................................................................

7 3.1.4 Scenario Boundary Conditions.............................................................................

8 3.2 Short-term Station B lackout....................................................................................

10 3.2.1 Initiating Event..........................................................................................................

11 3.2.2 System A vailabilities............................................................................................

11 3.2.3 M itigative A ctions................................................................................................

11 3.2.4 Scenario Boundary Conditions.............................................................................

12 3.3 Loss of V ital A C Bus E-12.......................................................................................

13 3.3.1 Initiating Event......................................................................................................

13 3.3.2 System A vailabilities............................................................................................

13 3.3.3 M itigative A ctions................................................................................................

14 3.3.4 Scenario Boundary Conditions.............................................................................

14 4.0 MELCOR MODEL OF THE PEACH BOTTOM PLANT...................................

17 4.1 Reactor V essel and Coolant System.........................................................................

17 4.2 Reactor Core....................................................

19 4.3 Prim ary Containm ent and Reactor Building.............................................................

23 4.4 Ex-vessel Dryw ell Floor D ebris Behavior................................................................

26 4.5 Containm ent Failure M odel.....................................................................................

28 4.6 Radionuclide Inventories and D ecay H eat................................................................

30 4.7 M odeling Uncertainties............................................................................................

31 4.7.1 Base Case A pproach on Im portant Phenom ena....................................................

32 4.7.2 Early Containm ent Failure Phenom ena...............................................................

32 5.0 Integrated Thermal Hydraulics, Accident Progression, and Radiological Release A nalysis........................................................................................................................................

35 5.1 Long-Term Station Blackout - Unm itigated Response............................................

35 vii

^!

ý

", "ýý Revision 3

- 10/28/2010 8:18:00 AM 5.1.1 Thermal Hydraulic Response................................................................................

37 5.1.2 Radionuclide Release............................................................................................

43 5.2 LTSBO-Base Case...................................................................................................

50 5.2.1 Thermal Hydraulic Response....................................................................................

50 5.2.2 Radionuclide Release............................................................................................

53 5.3 Short-Term Station Blackout - Unmitigated Response............................................

53 5.3.1 Thermal Hydraulic Response................................................................................

53 5.3.2 Radionuclide Release.............................................................................................

59 5.4 STSBO-Sensitivity Case with RCIC blackstart at 10 Minutes and without B.5.b E q u p im en t.................................................................................................................................

6 4 5.4.1 Thermal Hydraulic Response................................................................................

65 5.4.2 Radionuclide Release........................................................................

67 5.5 Loss of Vital AC Bus E Sensitivity Cases without B.5.b Equiptment.............

69 5.5.1 Thermal Hydraulic Response.................................................................................

70 5.5.2 Sensitivity Analysis..............................................................................................

73 5.6 Peer R eview...........................................................................................................

76 5.6.1 Containment leakage prior to failure....................................................................

76 5.6.2 Radionuclide Transport to the Suppression Pool due to SRV Seizure.................

78 5.6.3 Atmosphere mixing in the drywell......................................................................

86 6.0 EMERGENCY RESPONSE.....................................................................................

89 6.1 Population A ttributes...............................................................................................

.. 9 1 6.1.1 Population Distribution.......................................................................................

92 6.1.2 Evacuation Time Estimates...................................................................................

92 6.2 W inM A C C S...........................................................................................................

.. 93 6.2.1 Hotspot and Normal Relocation and Habitability.................................................

94 6.2.2 Shielding Factors................................................................................................

94 6.2.3 Potassium Iodide...................................................................................................

95 6.2.4 Adverse Weather....................................................................................................

96 6.2.5 Modeling Using Evacuation Time Estimates.....................................................

96 6.2.6 Cohort Modeling...................................................................................................

97 6.3 Accident Scenarios....................................................................................................

98 6.3.1 LTSBO Unmitigated............................................................................................

98 6.3.2 STSBO with RCIC Blackstart................................................................................

101 6.3.3 STSBO without RCIC Blackstart...........................................................................

104 6.4 S en sitivity Stud ies.......................................................................................................

106 6.4.1 Sensitivity 1 for the STSBO without RCIC Blackstart Evacuation to 16 Miles.... 108 6.4.2 Sensitivity 2 for the STSBO without RCIC Blackstart Evacuation to 20 Miles.... II1 6.4.3 Sensitivity 3 for the STSBO without RCIC Blackstart with a Delay in Implementation of Protective Actions................................................................................

113 6.5 Analysis of Earthquake Impact...................................................................................

115 6.5.1 S o ils R ev iew...........................................................................................................

1 15 6.5.2 Infrastructure Analysis............................................................................................

116 6.5.3 Electrical and Communications..............................................................................

119 6.5.4 Emergency Response..............................................................................................

120 6.5.5 Development of W inMACCS parameters..............................................................

121 6.5.6 Seismic STSBO without RCIC Blackstart..............................................................

121 viii

Revision 3 - 10/28/20108:18:00 AM 6.6 Accident Response and Mitigation of Source Terms..................

124 6.6.1 E xtern al R esources..................................................................................................

126 6.6.2 M itigation Strategies...............................................................................................

127 6.7 Emergency Preparedness Summary and Conclusions................................................

128 7.0 OFF-SITE CONSEQUENCES....................................................................................

132 7.1 In tro d u ctio n.................................................................................................................

13 2 7.2 Peach B ottom Source T erm s.......................................................................................

132 7.3 C onsequence A nalyses................................................................................................

133 7.3.1 Unmitigated Long-Term Station Blackout Scenario..............................................

134 7.3.2 Short-Term Station Blackout with RCIC Blackstart..............................................

137 7.3.3 Unmitigated Short-Term Station Blackout.............................................................

140 7.3.4 Evaluation of the Effect of the Seismic Activity on Emergency Response............ 144 7.3.5 Evaluation of SST I Source Term...........................................................................

145

8.0 REFERENCES

150 APPENDIX A.1 PEACH BOTTOM RADIONUCLIDE INVENTORY.........................

154 ix

Revision 3 - 10/28/2010 8:18:00 AM LIST OF FIGURES Figure 1 Reactor Vessel Cross-Section Detail and MELCOR Hydrodynamic Nodalization... 18 Figure 2 Spatial Nodalization of Reactor Pressure Vessel and Coolant System.................. 20 Figure 3 Spatial Nodalization of the Core and Lower Plenum............................................

21 Figure 4 Local Relative Power Fraction (RPF) and 5-Ring Radial Boundaries of Core.......... 22 Figure 5 Hydrodynamic Nodalization of the Primary Containment...................................

23 Figure 6 Hydrodynamic Nodalization of the Reactor Building (a).......................................

24 Figure 7 Hydrodynamic Nodalization of the Reactor Building (b)......................................

25 Figure 8 Drywell Floor Regions for Modeling Molten-Core/Concrete Interactions........... 27 Figure 9 Drywell Head Flange Connection Details.............................................................

29 Figure 10 Drywell Flange Leakage Model versus Containment Pressure..............................

30 Figure 11 LT SB O V essel Pressure..........................................................................................

38 Figure 12 LT SB O C oolant Level............................................................................................

38 Figure 13 LTSBO Fuel Cladding Temperatures at Core Mid-plane.....................................

40 Figure 14 LTSBO Temperature of Particulate Debris on Inner Surface of Lower Head.....

41 Figure 15 LTSBO Lower Head Temperature.........................................................................

42 Figure 16 LTSBO Containm ent Pressure................................................................................

42 Figure 17 LTSBO Environmental Source Term: Detail at Time of Containment Failure.......... 44 Figure 18 LTSBO Environmental Source Term: Long Term.................................................

45 Figure 19 LTSBO Iodine Fission Product Distribution........................................................

46 Figure 20 LTSBO Cesium Fission Product Distribution........................................................

46 Figure 21 LTSBO Tellurium Fission Product Distribution....................................................

47 Figure 22 LTSBO Cerium Fission Product Distribution.........................................................

47 Figure 23 LTSBO Ex-vessel Debris Temperatures................................................................

49 Figure 24 M itigated LTSBO Vessel Pressure.........................................................................

51 Figure 25 M itigated LTSBO Coolant Level............................................................................

51 Figure 26 M itigated LTSBO Core Temperature....................................................................

52 Figure 27 Mitigated LTSBO Containment Pressure...............................................................

52 Figure 28 STSBO Reactor Pressure.......................................................................................

55 Figure 29 STSBO Reactor Vessel W ater Level......................................................................

56 Figure 30 STSBO Fuel Cladding Temperatures at Core Mid-plane.......................................

56 Figure 31 STSBO Temperatures of Core Debris along Inner Surface of Lower Head.......... 57 Figure 32 STSBO Inner/Outer Surface Temperatures of Lower Head...................................

57 Figure 33 STSBO Containment Pressure History..................................................................

58 Figure 34 STSBO Environmental Source Term.....................................................................

60 Figure 35 STSBO Environmental Source Term: Details for Volatile Species...................... 60 Figure 36 STSBO Iodine Fission Product Distribution...........................................................

61 Figure 37 STSBO Cesium Fission Product Distribution.........................................................

62 Figure 38 STSBO Tellurium Fission Product Distribution....................................................

62 Figure 39 Reactor Vessel Pressure: STSBO with RCIC Blackstart........................................

66 Figure 40 Reactor Vessel Water Level: STSBO with RCIC Blackstart................................

67 Figure 41 STSBO with RCIC Blackstart Environmental Source Term................................

68 Figure 42 STSBO Environmental Source Term: Details for Volatile Species...................... 68 Figure 43 Loss of Vital AC Bus E-12 Reactor Vessel Pressure............................................

71 x

Revision 3 - 10/28/2010 8:18:00 AM Figure 44 Loss of Vital AC Bus E-12 Reactor Water Level...................................................

72 Figure 45 Sensitivity of Station Battery Duration: Reactor Water Level - Loss of Vital AC Bus E -12.............................................................................................................................

7 5 Figure 46 Sensitivity of Station Battery Duration: Peak Clad Temperature - Loss of Vital AC B u s E -12......................................................................................................................

7 5 Figure 47 Effect of Increased Containment Leakage on the Release of Iodine to the E n v iro n m en t...........................................................................................................

.. 7 7 Figure 48 Number of SRV Cycles as a Function of Time (LTSBO).....................................

80 Figure 49 RPV Pressure: LTSBO versus SRV Sensitivity Calculations................................

81 Figure 50 RPV Water Level: LTSBO versus SRV Sensitivity Calculations.........................

82 Figure 51 Containment Pressure: LTSBO versus SRV Sensitivity Calculations.................. 83 Figure 52 Spatial Distributions of Iodine: LTSBO versus SRV Sensitivity Calculations......... 84 Figure 53 Spatial Distribution of Cesium: LTSBO versus SRV Sensitivity Calculations......... 85 Figure 54 Iodine Release to Environment: LTSBO versus SRV Sensitivity Calculations........ 85 Figure 55 Cesium Release to Environment: LTSBO versus SRV Sensitivity Calculations...... 86 Figure 56 Drywell Atmosphere Temperatures in the Baseline LTSBO Calculation.............. 87 Figure 57 Drywell Atmosphere Temperatures with Imposed Drywell Circulation................ 88 Figure 58 Effect of Modeling Circulation Flow within the Drywell on Iodine and Cesium R elease to the Environm ent....................................................................................

88 Figure 59 Peach Bottom 10 and 20 Mile Analysis Areas.....................................................

90 Figure 60 Unmitigated LTSBO Emergency Response Timeline............................................

99 Figure 61 Duration of Protective Actions for Unmitigated LTSBO.......................................

99 Figure 62 STSBO with RCIC Blackstart Emergency Response Timeline...............................

102 Figure 63 Protective Actions for STSBO with RCIC Blackstart..............................................

102 Figure 64 STSBO without RCIC Blackstart Emergency Response Timeline..........................

104 Figure 65 Duration of Protective Actions for STSBO without RCIC Blackstart.....................

105 Figure 66 Evacuation Timeline from Peach Bottom for the 10 to 20 Mile Region.................. 108 Figure 67 Sensitivity 1 STSBO without RCIC Blackstart - Evacuation to 16 Miles................ 109 Figure 68 Duration of Protective Actions for Sensitivity 1 STSBO without RCIC Blackstart -

E vacuation to 16 M iles.............................................................................................

109 Figure 69 Sensitivity 2 STSBO without RCIC Blackstart - Evacuation to 20 Miles................ 111 Figure 70 Duration of Protective Actions for Sensitivity 2 STSBO without RCIC Blackstart -

E vacuation to 20 M iles.............................................................................................

112 Figure 71 Sensitivity 3 STSBO without RCIC Blackstart - Delay in Implementation of P ro tectiv e A ctio n s.....................................................................................................

1 14 Figure 72 Protective Action Durations for Sensitivity 3 STSBO without RCIC Blackstart -

Delay in Implementation of Protective Actions........................................................

114 Figure 73 Roadway Network Identifying Potentially Affected Roadways and Bridges.......... 117 Figure 74 Bridge along Robert Fulton Highway.......................................................................

119 Figure 75 STSBO without RCIC Blackstart Emergency Response Timeline (Seismic Analysis) 12 2 Figure 76 Protective Action Durations for STSBO without RCIC Blackstart (Seismic Analysis) 12 3 Figure 77 Conditional, i.e., assuming accident occurs, mean, latent-cancer-fatality probabilities from the Peach Bottom unmitigated LTSBO sequence for residents within a circular xi

Revision 3 - 10/28/2010 8:18:00 AM area of specified radius from the plant. The plot shows four values of dose-truncation le v e l...........................................................................................................................

13 5 Figure 78 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality probabilities from the Peach Bottom unmitigated LTSBO scenario for residents within a circular area of specified radius from the plant. The plot shows the probabilities from the emergency phase (EARLY), long-term phase (CHRONC), and the tw o phases com bined..........................................................................................

136 Figure 79 Conditional, i.e., assuming accident occurs, mean, latent-cancer-fatality probabilities from the Peach Bottom STSBO scenario with RCIC blackstart for residents within a circular area of specified radius from the plant. The plot shows four choices of dose-tru n catio n lev el..........................................................................................................

13 8 Figure 80 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality probabilities from the Peach Bottom STSBO sequence with RCIC blackstart for residents within a circular area of specified radius from the plant. The plot shows the risks from the emergency phase (EARLY), long-term phase (CHRONC), and the two p h ases com b in ed.......................................................................................................

13 9 Figure 81 Conditional, i.e., assuming accident occurs, mean, latent-cancer-fatality probabilities from the Peach Bottom unmitigated STSBO scenario for residents within a circular area of specified radius from the plant. The plot shows four choices of dose-tru n catio n lev e l..........................................................................................................

14 1 Figure 82 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality probabilities from the Peach Bottom unmitigated STSBO scenario for residents within a circular area of specified radius from the plant. The plot shows the probabilities from the emergency phase (EARLY), long-term phase (CHRONC), and the tw o phases com bined..........................................................................................

142 Figure 83 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality probabilities from the Peach Bottom unmitigated STSBO scenario for residents within a circular area of specified radius from the plant. The plot shows the dependence of probabilities on the size of the evacuation zone..............................

144 Figure 84 Conditional, i.e., assuming accident occurs, mean, LNT, latent-cancer-fatality probabilities (dimensionless) from the SSTI source term for residents within a circular area of specified radius from the Peach Bottom plant. The plot shows the probabilities from the emergency phase (EARLY), long-term phase (CHRONC), and the tw o phases com bined..........................................................................................

147 xii

osp

ý L

Revision 3 - 10/28/2010 8:18:00 AM LIST OF TABLES Table 1 Accident scenarios and their frequencies..................................................................

6 Table 2 C oncrete Com position...........................................................................................

28 Table 3 Timing of Key Events for Long-Term Station Blackout.......................................

36 Table 4 Timing of Key Events for Mitigated Long-Term Station Blackout...................... 50 Table 5 Timing of Key Events for the Unmitigated Short-term Station Blackout.............. 54 Table 6 Timing of Key Events for the Short-term Station Blackout with RCIC Blackstart.... 65 Table 7 Timing of key events for Loss of Vital AC Bus E-12............................................

70 Table 8 Sensitivities for Loss of Vital AC Bus E-12..........................................................

76 Table 9 Scenarios Assessed for Emergency Response........................................................

90 Table 10 Peach Bottom Cohort Population Values..............................................................

92 Table 11 Peach Bottom Shielding Factors...........................................................................

95 Table 12 Unm itigated LTSBO Cohort Tim ing........................................................................

101 Table 13 STSBO with RCIC Blackstart Cohort Timing..........................................................

103 Table 14 STSBO without RCIC Blackstart Cohort Timing....................................................

106 Table 15 STSBO without RCIC Blackstart, Sensitivity I.........................................................

110 Table 16 STSBO without RCIC Blackstart, Sensitivity 2.......................................................

113 Table 17 C ohort Tim ing for Sensitivity 3................................................................................

115 Table 18 Description of the Potential Evacuation Failure Locations......................................

116 Table 19 Cohort Timing STSBO without RCIC Blackstart....................................................

124 Table 20 Brief Source-Term Description for Unmitigated Peach Bottom Accident Sequences and the SSTl Source Term from the Sandia Siting Study........................................

133 Table 21 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site. Probabilities are for the Unmitigated LTSBO Scenario, which has a M ean Core Dam age Frequency of 3xl0"6/yr............................................................

134 Table 22 Unconditional, Mean, Latent-Cancer-Fatality Risks (1/reactor year) for Residents within the Specified Radii of the Peach Bottom Site. Risks Are for the unmitigated LTSBO Scenario, which has a mean core damage frequency of 3.10-6/yr............... 135 Table 23 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site. Probabilities are for the STSBO Scenario with RCIC blackstart, which has a m ean core damage frequency of 3" 10-7/yr.......................................................

137 Table 24 Unconditional, Mean, Latent-Cancer-Fatality Risks (1/reactor year) for Residents within the Specified Radii of the Peach Bottom Site. Risks are for the STSBO Scenario with RCIC blackstart, which has a mean core damage frequency of 3. 10/yr.

13 7 Table 25 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site. Probabilities are for the unmitigated STSBO Scenario, which has a mean core dam age frequency of 3" 10-7/yr..........................................................................

140 Table 26 Unconditional, Mean, Latent-Cancer-Fatality Risks (1/reactor year) for Residents within the Specified Radii of the Peach Bottom Site. Risks are for the unmitigated STSBO Scenario, which has a mean core damage frequency of 3.10-7/yr...............

140 xiii

Revision 3-10/28/2010 8:18:00 AM Table 27 Effect of Size of Evacuation Zone on Conditional, Mean, LNT, Latent-Cancer-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site. Probabilities are for the Unmitigated Short-Term Station Blackout S c e n a rio.....................................................................................................................

14 3 Table 28 Conditional, i.e., assuming accident occurs, Mean, LNT, Latent-Cancer-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site. Probabilities Are for the Unmitigated STSBO Scenario and Compare the Unmodified Emergency Response (ER) and ER Adjusted to Account for the Effect of Seismic Activity on Evacuation Routes and Human Response................................

145 Table 29 Conditional, i.e., assuming accident occurs, Mean, Latent-Cancer-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site. Probabilities are based on the SST1 Source Term from the Sandia Siting S tu d y.........................................................................................................................

14 6 Table 30 Conditional, i.e., assuming accident occurs, Mean, LNT, Latent-Cancer-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site. Probabilities Are Based on the SST1 Source Term from the Sandia Siting Study and the unmitigated STSBO scenario..................................................

146 Table 31 Conditional, i.e., assuming accident occurs, Mean, Prompt-Fatality Probabilities (dimensionless) for Residents within the Specified Radii of the Peach Bottom Site.

Probabilities are for the SST1 Source Term from the Sandia Siting Study.............. 148 xiv

ACRONYMS Revision 3 - 10/28/2010 8:18:00 AM ATWS CD CDF CRDHS CRGT CST DOE EAL EAS EOF EOP EP EPA EPDM EPZ ERO ETE GE GNF HPCI HPS IPE IPEEE LNT LOCA LPCI LPI LTSBO MCCI MSIV NRC NRCS NRF PeCo ORO PEMA PRA QHO RAMCAP RCIC RHR RPF Anticipated Transient Without Scram Core Damage Core Damage Frequency Control Rod Drive Hydraulic System Control Rod Guide Tube Condensate Storage Tank Department of Energy Emergency Action Level Emergency Alert System Emergency Operations Facility Emergency Operating Procedure Emergency Preparedness Environmental Protection Agency Ethylene Propylene Diene Methylene Emergency Planning Zone Emergency Response Organization Evacuation Time Estimate General Emergency Global Nuclear Fuel High Pressure Coolant Injection Health Physics Society Individual Plant Examination Individual Plant Examination of External Event Linear, No-Threshold Loss of Coolant Accident Low Pressure Coolant Injection Low Pressure Injection Long-Term Station Blackout Molten Corium, Concrete Interactions Main Steam Isolation Valve Nuclear Regulatory Commission Natural Resources Conservation Service National Response Framework Philadelphia Electric Company Offsite Response Official Pennsylvania Emergency Management Agency Probabilistic Risk Assessment Quantitative Health Objective Risk Analysis and Management for Critical Asset Protection Reactor Core Isolation Cooling Residual Heat Removal Relative Power Fraction xv

Revision 3 - 10/28/2010 8:18:00 AM RPV Reactor Pressure Vessel SAE Site Area Emergency SAMG Severe Accident Management Guidelines SECPOP SECtor POPulation and Economic Estimator (Version 3.12.6)

SOARCA State-of-the-Art Reactor Consequence Analysis Project SPAR Standardized Plant Analysis Risk SRV Safety/Relief Valve STCP Source Term Code Package STSBO Short-Term Station Blackout TAF Top of Active Fuel TSC Technical Support Center UE Unusual Event USGS United States Geological Service VF Vessel Failure xvi

P Revision 3-10/28/2010 8:18:00 AM

1.0 INTRODUCTION

The evaluation of accident phenomena and the offsite consequences of severe reactor accidents has been the subject of considerable research by the U.S. Nuclear Regulatory Commission (NRC) over the last several decades. As a consequence of this research focus, analyses of severe accidents at nuclear power reactors is more detailed, integrated, and realistic than at any time in the past. A desire to leverage this capability to address excessively conservative aspects of previous reactor accident analysis efforts was a major motivating factor in the genesis of the State-of-the-Art Reactor Consequence Analysis (SOARCA) project. By applying modem analysis tools and techniques, the SOARCA project seeks to provide a body of knowledge to support an informed public understanding of the likely outcomes of severe nuclear reactor accidents.

The primary objective of the SOARCA project is to provide a best-estimate evaluation of the likely consequences of important, severe accident events at reactor sites in the U.S. civilian nuclear reactor sites. To accomplish this objective, the SOARCA project has utilized integrated modeling of accident progression and off-site consequences using both state-of-the-art computational analysis tools as well as best modeling practices drawn from the collective wisdom of the severe accident analysis community. This report documents the analysis of the Peach Bottom Atomic Power Station to the risk dominant but extremely low likelihood accidents that could progress to major radiological release.

1.1 Outline of Report Section 2 of this report briefly summarizes the method used to select the specific accident scenarios subjected to detailed computational analysis. Additional details of this method can be found in Summary Report of this series of reports. Section 3 then describes the results of the mitigation measures assessment process when it was applied to Peach Bottom. Section 4 describes the key features of the MELCOR model of the Peach Bottom Atomic Power Station.

Section 5 describes for each case the results of MELCOR calculations of thermal hydraulics, and, when core damage was predicted, accident progression and radionuclide release to the environment. Section 6 describes the way in which plant-specific emergency response actions were represented in the calculations of offsite consequences, and Section 7 describes the calculations of offsite consequences for each accident scenario. Section 7 also describes analysis of offsite consequences comparing SOARCA results to consequence results from earlier studies.

References cited in this report are listed in Section 8.

I

Revision 3 - 10/28/2010 8:18:00 AM This Page Intentionally Left Blank 2

Revision 3 - 10/28/2010 8:18:00 AM 2.0 ACCIDENT SCENARIO DEVELOPMENT In the SOARCA Program, accident sequences that have an estimated frequency greater than l x 10-6 per year of reactor operation' are retained as candidate sequences for further evaluation.

Once candidate accident sequences are identified, realistic opportunities for plant personnel to respond to the observed failures of control and safety systems are evaluated. Possibilities for mitigation included the licensee's emergency operating procedures (EOPs), severe accident management guidelines (SAMGs), and mitigation measures developed specifically for response to security concerns that arose from the events of September 11, 2001. The end result of this process was a list of accident scenarios (i.e., event sequence plus options for mitigation), which were subjected to detailed analysis of radionuclide release to the environment (described in Sections 4 and 5) and offsite radiological consequence (Sections 6 and 7).

2.1 Sequences Initiated by Internal Events This scenario selection process was used to determine the scenarios for further analyses:

1.

Candidate accident sequences were identified in analyses using plant-specific, SPAR models (Version 3.31).

a. Initial Screening - Screened out initiating events with low CDFs (<10-7) and sequences with a CDF <108. This step eliminated 4% of the overall CDF.

b. Sequence Evaluation - Identified and evaluated the dominant cutsets for the remaining sequences. Determined system and equipment availabilities and accident sequence timing.

c.

Sequence Grouping - Sequences determined to have similar equipment availabilities (i.e., details of individual component or support system failures might differ, but the functional capability of key systems was similar) and result in a similar time for the onset of core damage were aggregated into a single

'sequence group.'

2. Containment systems availabilities for each sequence were assessed using system-dependency tables to delineate the support systems required for performance of the target front-line systems and from a review of existing SPAR model system fault trees.

3. Core-damage sequences from the licensee PRA model were reviewed and compared with the scenarios determined by using the SPAR models. Differences were resolved during meetings with licensee staff.

4. The screening criteria (CDF < 10-6 for most scenarios, and < 10-7 for containment bypass sequences) were applied to eliminate sequences from further analyses.

The initial pass through this process identified only one sequence at Peach Bottom that survived the frequency threshold criteria. The sequence is initiated by the failure of vital AC Bus E-12, which disables several (but not all) trains of safety equipment. The estimated frequency of this sequence was initially found be above the l X 0-6/reactor-year threshold. As a result, the I x10-7 per reactor-year for sequences involving bypass of the containment pressure boundary or a perceived possibility of a large-early release.

3

Y, ý_

Revision 3 - 10/28/2010 8:18:00 AM sequence was forwarded for an assessment of mitigative measures (see Section 2.2.1) and detailed analysis of accident progression and radiological release. However, later in time, the SPAR model was found to incorrectly represent certain features of this sequence, and its frequency was reduced below the screening criterion. Further, the MELCOR analysis performed for this sequence determined that it would not, in fact, result in core damage. In spite of both of these late conclusions on the characteristics of this sequence, the analysis results provided unique insights into the effectiveness of small-capacity, nonsafety related equipment in the plant to mitigate certain accident sequences, and it was retained in this report.

This process provides the basic characteristics of each scenario. However, it is necessary to have more detailed information about a scenario than is contained in a PRA model. To capture the additional sequence details, further analysis of system descriptions and a review of the normal and EOPs were conducted.

2.2 Sequences Initiated by External Events Seismic-initiated sequences were found to be the most restrictive in terms of the ability to successfully implement onsite mitigative measures and offsite protective actions. In addition, the seismic-initiated sequences were found to be important contributors to the external event core damage and release frequencies. As a result, representative external event sequences were assumed to be initiated by a moderate to large seismic event resulting in widespread damage to important plant support systems (primarily electric power sources).

The sequence selection process identified two sequences groups which met the CDF screening criteria for events that lead to containment failure and events that have the potential to result in significant early releases to the environment:

Long-term station blackout - lxl0-6 to 5xl0-6/reactor-year

Short-term station blackout - 1x10-7 to 5x 10-7/reactor-year 2 It was noted earlier that the initiating event for external event sequences was assumed to be a seismic event because it was judged to be limiting in terms of how much equipment would be available to mitigate as well as constrain offsite response. For these sequence groups, the seismic PRAs provided information on the initial availability of installed systems. Next, judgments were made concerning the general state of the plant to judge the availability of mitigation measures codified in 10CFR50.54(hh) and the additional time to implement mitigation measures and activate emergency response centers (e.g., Technical Support Center and Emergency Operations Facility).

2 This following scenario does not meet the SOARCA screening criterion of I x 10"6 per reactor-year; however, it was analyzed in order to assess the risk importance of a lower frequency, higher consequence scenario.

4

Revision 3-10/28/2010 8:18:00 AM The seismic events considered in SOARCA result in loss of offsite and onsite AC power and, for the more severe seismic events, loss of DC power. Under these conditions, the use of the turbine-driven RCIC system is an important mitigation measure. BWR severe accident mitigation guidelines (SAMGs) include starting of the RCIC without electricity to cope with station blackout conditions. This is known as RCIC blackstart. 10CFR50.54(hh) mitigation measures have taken this a step further and also include long-term starting of the RCIC without electricity (RCIC black run), using a portable generator to supply indications such as reactor pressure vessel level indication to allow the operator to manually adjust RCIC flow to prevent reactor pressure vessel (RPV) overfill and flooding of the RCIC turbine. For the long-term station blackout sequence, RCIC can be used to cool the core until battery exhaustion. After battery exhaustion, black run of RCIC can be used to continue to cool the core. MELCOR calculations are used to demonstrate core cooling under these conditions.

The external events PRA does not describe general plant damage and accessibility following a seismic event. The damage was assumed to be widespread and accessibility to be difficult, consistent with the unavailability of many plant systems. For the long-term station blackout, it was judged that the seismic event would fail the Condensate Storage Tank, which is the primary water reservoir for RCIC and that RCIC would initially be fed from the torus. MELCOR calculations showed that several hours would be available before torus temperature and pressure conditions precluded this. It was judged that this would be sufficient time to identify or arrange for another water reservoir for RCIC, such as the cooling tower basin (a large, low-lying reinforced concrete structure).

Mitigation measures codified in 10CFR50.54(hh) include portable equipment such as portable power supplies to supply indication, portable diesel-driven pumps, and portable air bottles to open air-operated valves, together with procedures to implement these measures under severe accident conditions. Following the site visit, the licensee purchased and tested the necessary equipment and developed procedures for using it.

5

Revision 3 - 10/28/2010 8:18:00 AM 3.0 ACCIDENT SCENARIO DEFINITIONS Only one scenario met the screening criteria. However, for reasons described in Section 2.0, three were examined with deterministic consequence calculations. Therefore, the results of these calculations are retained and presented in this report, although the scenario would not result in damage to the reactor core.

A detailed description of these scenarios is, therefore, provided in Sections 3.1 and 3.2, respectively. Both sections include a discussion of available mitigation measures. A description of the loss of AC Bus E-12 scenario is given in Section 3.3.

Table 1 Accident scenarios and their frequencies Frequency Scenario Description (per Reactor Year)

Long-Term Station Blackout 1 x 10-6 to 5x 10-"

Short-Tem Station Blackout lx10-7 to 5x10"r Loss of Vital AC Bus E-12 5x10-7 3.1 Long-Term Station Blackout The long-term station blackout is initiated by a beyond-desgin-basis earthquake (0.3-0.5 pga). It has an estimated frequency of lI x0-6 to 5x 10-6/reactor-year, which meets the SOARCA screening criterion of lx 10-6/reactor-year.

Section 3.1.1 describes the initial status of the plant following the seismic event. The key system availabilities during the course of the accident are summarized in Section 3.1.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.1.3. Section 3.1.4 describes various scenarios based on the success of the mitigative actions. In particular, mitigated scenarios are defined where the mitigative actions are successful. Unmitigated scenarios are also defined where certain key mitigation measures are not successfully implemented.

3.1.1 Initiating Event The long-term station blackout scenario is a composite of several similar sequences that differ only by their initiating event. The initiators can be a large seismic event or an internal fire or flood. The seismic event is the largest contributor to the composite frequency of this sequence, and is used as the basis for defining consequential events and conditions at the plant. Damage caused by the earthquake is assumed to result in a total loss of offsite power. In addition, onsite AC power is unavailable, with all diesel generators failing to start or run as needed. The diesel generators have a shared configuration between the two units, which causes power failure to affect both units. This analysis considers only the response of failures at one of the two units, however.

6

Revision 3 - 10/28/2010 8:18:00 AM 3.1.2 System Availabilities Immediately following the initiating event, specifically the loss of AC power, reactor scram and containment isolation would occur. The station blackout line from the hydroelectric station downstream of the plant site is also assumed to fail because of structural damage to the dam and electric station components. The station batteries are assumed to provide DC power for four hours following loss of AC power, allowing components and systems powered by DC power to operate for this four hour period. This duration of DC power assumes the batteries are at their allowable end of life and that operators successfully follow procedural actions to shed nonessential loads from the emergency DC bus. As a result, high-pressure coolant injection from RCIC and/or high pressure coolant injection (HPCI) would be available for the first four hours following the loss of AC power. Additionally, manual control of the safety/relief valves (SRV) would be available. Note that the station battery beginning-of-life rating is 8 hrs and the end-of-life rating is 2 hrs. Use of a mid-life rating together with load shedding would translate to a longer duration of DC power, on the order of 7 hrs.

3.1.3 Mitigative Actions An unmitigated MELCOR calculation was performed for the long-term station blackout scenario assuming that manual actions to mitigate the loss of vital safety systems are limited to those currently implemented in EOPs. The effects of additional mitigative actions and equipment at the plant were then examined in a separate "mitigated" calculation. Results of the unmitigated calculation are described in Section 5.1; results of the separated mitigated accident scenario are described in Section 5.2.

Two operator actions were credited in the unmitigated long-term station blackout calculation.

First, operators are assumed to open one SRV to begin a controlled depressurization of the reactor vessel approximately one hour after the initiating event. This action is prescribed in station emergency procedures to prevent excessive cycles on the SRV. The target reactor vessel pressure is at, or above, 125 psi, which would permit continued operation of RCIC (or HPCI if necessary). Second, operators are assumed to take manual control of RCIC approximately two hours after the initiating event. This involves local manipulation of the position of the (steam) throttle valve at the inlet to the RCIC turbine to reduce and control turbine speed. This action flow reduces and stabilizes coolant flow from the RCIC pump to maintain reactor vessel level at within a prescribed range.

The mitigated long-term station blackout calculation credits one additional manual action. First, a portable AC power supply is assumed to be connected (through an inverter) to the DC bus delivering power to at least one SRV and to essential control room instrumentation (primarily reactor vessel pressure and level indication.) The precise time this action is completed is not important, provided that it occurs before power from station batteries is exhausted four hours after the initiating event. If, for some reason, this action is not successful, and the RCIC pump were to trip (off), coolant makeup could be provided through low-pressure injection lines by means of a portable diesel-driven pump.

7

Ir~f Revision 3 - 10/28/2010 8:18:00 AM 3.1.4 Scenario Boundary Conditions Section 3.1.4.1 lists the sequence of events to be prescribed in the unmitigated long-term station blackout calculation. Section 3.1.4.2 summarizes the sequence of events in the mitigated long-term station blackout calculation, which credits one additional manual action.

3.1.4.1 Sensitivity Case without B.5.b Equipment The unmitigated case credits automatic system responses and manual actions that would be directed by plant emergency procedures, such as operator intervention to manually control RCIC injection flow (after its automatic actuation) to stabilize and maintain level within a target range.

The unmitigated case did not credit operator actions that are beyond the scope of emergency procedures, nor were mitigation measures called for under 10CFR50.54(hh) taken into account, such as aligning a portable diesel pump. The effects of such actions were examined in the mitigated scenario, which is described in Section 3.1.4.2. The timeline of events and operator actions that were credited in the unmitigated case are listed below.

Unmiti2ated Case Event Initiation and Initial Plant Response AC power fails (loss of offsite power, coupled with failure of all diesel generators).

" Reactor trips.

Reactor and containment isolate.

DC power (station batteries) functional.

RCIC auto-initiates when level drops to low-level setpoint (time to be predicted by MELCOR) (Water source: Torus).

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Initiate RPV depressurization by opening 1 SRV (target RCS pressure is 125 psi) 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

Operator takes manual control of RCIC.

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

Battery power exhausted.

SRV recloses.

RCIC continues to operate at a fixed (constant) flow rate until RCIC steam line floods.

3.1.4.2 Base Case The following is the time line for this sequence group. The mitigated case credits all the mitigation measures codified in 10CFR50.54(hh), including the portable pump. It also credits manual opening of a containment vent path, when containment pressure reaches unacceptably high levels. In the current analysis, a 16-in. (hard-pipe) vent path is assumed to be opened when containment pressure exceeds 24 psig. This value was selected based on the decision logic shown in plant emergency procedures. Local control of the vent line isolation valves would be accomplished by connecting portable air and electric power supplies. The timeline for these, and 8

.Revision 3 10/28/2010 8:18:00 AM other, actions are shown below in terms of their chronology after the initiating event, which is a seismic event.

Event Initiation and Initial Plant Response

" LOOP and SBO occur because of a seismic event, recovery of offsite power is not expected during the mission time.

Reactor shuts down. RCS and containment are isolated.

CRD, ECCS, SLC, Condensate, Containment Cooling and Containment Spray Systems are not available.

" Loss of all AC power because of seismic event, DC power available without chargers, EDGs do not automatically start.

" HPCI and RCIC are both available initially. HPCI is secured early in the event, and RCIC is used to maintain RCS level and can be black-started to provide continued use until steam supply is lost (75-50 psi of main steam pressure).

Control Room receives indication that plant is in a SBO condition requiring operator to enter SE-11, Station Blackout Procedure.

Without any operator action, HPCI and RCIC auto-start and operate to maintain RPV level.

" Cooling tower basin is assumed to be undamaged, contains -3 billion gallons of water.

15 minutes

" Initial Operations assessment of plant status complete.

HPCI might auto-start in response to initial transient, will be secured.

" RCIC will be operated to make up for boil-off and to maintain RPV level.

" In accordance with SE-11, Operations initiates the following mitigation measures:

Attempt to line up the Conowingo hydroelectric dam (SBO Line) as an alternative offsite power source.

Attempt manual start of EDGs.

DC load shedding initiated.

Operation of SRVs using station battery for RCS pressure control (RCIC steam line drains can be used as an alternative).

50 minutes

Emergency Operations Facility manned (the EOF is located in the Philadelphia area, far away from the plant). Therefore, the timing should not be affected by the seismic event.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

" Hydroelectric dam power supply (SBO Line) assumed to be unavailable because of initiating event.

Manual start of EDGs assumed to fail because of initiating event

DC Load shedding completed, battery life extended to an estimated 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (Batteries typically last for approximately 2 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months under normal loading conditions depending on life cycle of battery. At the beginning of its life, the battery duration is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . At the end of its life, the battery duration is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The licensee suggested that battery duration of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months would be reasonable assuming successful load shedding.)

" RPV depressurization is initiated using I SRV. The target RCS pressure is 125 psi.

9

Revision 3 - 10/28/2010 8:18:00 AM 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

The EOF is operational. The EOF reviews actions taken by Operations and determines the availability of the remotely located pump and station pumper truck stored outside of the Protected Area. Actions recommended by the EOF include the following:

Use portable power supply for operating SRVs and for RPV level indication.

Perform RCIC black-start.

Use portable diesel driven pump (250 psi, 500 gpm) to provide makeup to RCS, Hotwell, CST, and other locations. However, no water source and no hotwell for CST or RHR to connect to RCS and containment.

Use portable air supply to manually operate containment vent valves (vent into SGTS).

Use pumper truck in place of portable diesel driven pump.

1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

Operators assess and concur with EOF recommendations. Operators prioritize recommendations based on plant conditions and begin implementation.

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

Technical Support Center (TSC) manned. (Because of the magnitude of the event, loss of causeway, other potential infrastructure failures, and multiple emergency responders located on both sides of the river, a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months delay in minimum manning of TSC was assumed.)

2.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months

TSC operational.

3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

Portable DC power supply connected to continue operating SRV to depressurize RPV.

Portable air supply to manually operate containment vent valves (vent into SGTS) in place and ready for operation. Rupture disc on vent line set at -30 psi.

" RCIC black-started to limit use of site batteries and to continue providing makeup to RCS.

Before 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months

Portable diesel-driven pump available.

3.2 Short-term Station Blackout The short-term station blackout is initiated by a beyond-design-basis seismic event (0.5 - 1.0 pga). It is more severe than the long-term station blackout and has an estimated frequency of l x 10-7 to 5x 107/reactor year. Although the scenario does not meet the SOARCA screening criterion of 1 X 10-6 per reactor-year, it was retained in order to assess the risk importance of a lower frequency, higher consequence scenario.

10

Revision 3 - 10/28/2010 8:18:00 AM Section 3.2.1 describes the initial status of the plant following the seismic event. The key system availabilities during the course of the accident are summarized in Section 3.2.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.2.3. Section 3.2.4 describes various scenarios based on the success of the mitigative actions. In particular, mitigated scenarios are defined where the mitigative actions are successful. Unmitigated scenarios are also defined where certain key mitigation measures are not successfully implemented.

3.2.1 Initiating Event The short-term station blackout is initiated by the same spectrum of events that lead to the long-term station blackout. The most frequent initiators are large seismic events or internal fires or floods. The seismic event is a major contributor to the composite frequency of this sequence and is used as the basis for defining consequential events and conditions at the plant. Damage caused by the earthquake is assumed to result in a total loss of offsite power. In addition, all diesel generators fail to start or run as needed, rendering all onsite AC power unavailable.

Again, the diesel generators have a shared configuration between the two units, which causes power failure to affect both units. This analysis considers only the response of failures at one of the two units, however. Additionally, the earthquake results in failure of DC power.

3.2.2 System Availabilities Immediately following the initiating event, specifically the loss of vital AC power, reactor scram and containment isolation would occur, assuming actions to mitigate the event are not taken.

The station blackout line from the hydroelectric station downstream of the site is also assumed to fail because of structural damage to the dam and electric station components (1 g is well beyond the design basis earthquake for the hydro-station.) The major difference between this scenario and the long-term station blackout (Section 3.2) is that vital DC power from station batteries is also not available. Thus, a total loss of all onsite and offsite electrical power occurs immediately following the initiating event, rather than several hours later, thereby disabling all plant equipment that depends on control or motive power from normal or emergency electrical sources for start-up and operation. This includes steam-driven emergency coolant makeup systems (RCIC and HPCI) and remote manual control of reactor pressure relief valves, which were available for a few hours in the long-term station blackout.

An unmitigated MELCOR calculation was performed for the short-term station blackout scenario assuming actions to mitigate the event are not feasible. Results of this calculation are described in Section 5.3.

3.2.3 Mitigative Actions Reference probability is 0 of B.5.b mitigation. By procedures or equipment specifies under 10CFR50.54(hh) were modeled. Since this is a rapidly developing event, it is also worth noting that this event already falls below the screening criteria.

11

Revision 3 - 10/28/2010 8:18:00 AM 3.2.4 Scenario Boundary Conditions Two variations of the short-term station blackout scenario were considered. The first case assumes manual actions to manually actuate (black-start) the steam-driven RCIC system are not successful. This action involves local, manual opening of normally closed valves to admit steam from the main steam lines into the RCIC turbine and pump discharge valves to direct water into the reactor vessel.

In the second variation, operators successfully black-start the RCIC system 10 minutes after the initiating event and establish coolant flow to the reactor vessel. While it is possible to start RCiC at a later time and still avoid core damage the latest possible start time was not examined.

Manual actions necessary to regulate steam flow into the RCIC turbine are not credited in this scenario because electric power to instrumentation needed to monitor reactor coolant level would not be available. As a result, the system effectively operates at a constant flow rate equivalent to the rated capacity of the system. This flow rate is greater than the rate required to make up for evaporative losses, and after an initial decrease, reactor water level gradually rises above nominal and eventually overfills the reactor vessel 3. In this context, overfill means that the reactor water level rises to the elevation of the main steam line nozzles, allowing water to spill into the steam lines and causing them to flood with water. The steam extraction line for the RCIC turbine connects to the main steam line at a low elevation [adjacent to the inboard main steam isolation valves (MSIVs).] Therefore, water spilling over into the main steam lines blocks or flows toward the RCIC turbine, causing the system to cease functioning.

3.2.4.1 Sensitivity Cases without B.5.b Equipment As noted earlier, two unmitigated cases were considered.

Unmitigated Case One (no RCIC black-start)

Event Initiation and Initial Plant Response

AC power fails (loss of offsite power, coupled with failure of all diesel generators).

Reactor trips.

Reactor and containment isolate.

DC power (station batteries) fails.

Unmitigated Case Two (RCIC black-start)

Event Initiation and Initial Plant Response AC power fails (loss of offsite power, coupled with failure of all diesel generators).

Reactor trips.

" Reactor and containment isolate.

DC power (station batteries) fails.

3 If electric (control) power was available, including DC powerm or 10CFR50.54(hh) equipment, the RCIC system would cycle on/off to maintain reactor level between a minimum and maximum setpoint. Without these control signals, or an independent means of monitoring reactor water level and manually controlling coolant flow rate (i.e., turbine speed), the system is assumed to run at full capacity after it is started.

12

Revision 3 - 10/28/2010 8:18:00 AM

" Operator black-starts RCIC.

RCIC continues to operate at a fixed (constant) flow rate until RCIC steam line floods.

3.3 Loss of Vital AC Bus E-12 The scenario is initiated by the loss of vital AC Bus E-12. It was initially estimated to have a frequency above the SOARCA screening criterion of lxi 0 6/reactor-year. However, after further review of the SPAR model and comparison with the licensee's PRA, the scenario was determined to have a CDF below the screening criteria. Since the MELCOR analysis provided unique insights into the response of the plant to an internal event sequence, the MELCOR analysis was retained.

Section 3.3.1 describes the initial status of the plant following the initiating event. The key system availabilities during the course of the accident are summarized in Section 3.3.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.3.3. Section 3.3.4 describes various scenarios based on the success of the mitigative actions. In particular, mitigated scenarios are defined in which the mitigative actions are successful. Unmitigated scenarios are also defined in which certain key mitigate measures are not successfully implemented.

3.3.1 Initiating Event The initiating event for this scenario is failure of vital AC bus E-12 to provide power to associated plant equipment.

3.3.2 System Availabilities Loss of one vital AC bus disables some plant equipment, but not all. For example, power to the instrument and control air system would be lost, and the inverters that charge the station batteries would not function. However, other AC buses would direct motive power to the residual heat removal (RHR) and core spray pumps, permitting use of low-pressure coolant injection. One of the two control rod drive hydraulic pumps would also remain available.

Steam-driven injection systems (HPCI and RCIC) 4 operate as long as station batteries deliver DC power to control system components. Station batteries also facilitate manual control of SRVs.

When battery power is depleted, HPCI, RCIC, and SRV controls are assumed to be lost.

Injection flow from these sources terminates coincident with the loss of DC power, and any open SRV recloses.

The shut-down cooling mode of residual heat removal would not be available because of loss of power to valves needed to align the system for that configuration. However, the system can be aligned to operate suppression pool cooling and/or drywell sprays.

4 Although RCIC is available in all the standard plant analysis risk cut sets for this sequence, high pressure coolant injection (HPCI) is disabled due to independent failures in some of them. Availability of HPCI is not important in this sequence and is neglected.

13

P, " Ot, wl "

Revision 3 - 10/28/2010 8:18:00 AM Duration of DC power is treated as an uncertain parameter in this scenario. The licensee PRA uses a value of two hours, which is the minimum (tech spec) value and represents the worst possible condition-old batteries (maximum tolerable voltage degradation) and no load shedding.

New batteries (maximum voltage) are expected to have an eight hour lifetime without loading shedding. A reasonable estimate for the average value of battery duration (taking into account battery age and the effectiveness of actions to shed nonessential DC loads) is four hours. As described in Section 5.5.22, a precise value is not particularly important, provided that battery duration is greater than three hours.

3.3.3 Mitigative Actions This event was shown to be satisfactorily mitigated without crediting any of the security-related mitigative actions mentioned in Section 3.1.3. As such, no additional mitigative analysis was performed.

3.3.4 Scenario Boundary Conditions Section 3.3.4.1 lists the sequence of events to be prescribed in the unmitigated loss-of-vital AC Bus E-12 accident scenario. Section 3.3.4.2 summarizes the sequence of events in the mitigated case.

3.3.4.1 Unmitigated Cases A set of parametric unmitigated cases was considered. The unmitigated cases did not credit the mitigation measures of a portable pump called for under 10CFR50.54(hh). However, controlled RCIC operation until the station battery exhaustion and one pump of CRDHS injection were credited. The parametric cases varied the station battery life and other critical cooling functions.

Unmitiaated Cases Event Initiation and Initial Plant Response

Loss of all AC-powered injection except 1 CRDHS pump.

" Reactor trips.

Reactor and containment isolate.

DC power (station batteries) functional.

" RCIC auto-initiates when level drops to low-level setpoint (water source is the condensate storage tank, CST).

When level rises to operating range, operator takes manual control of RCIC to maintain RPV level.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Initiate RPV depressurization by opening 1 SRV (target RCS pressure is 125 psi).

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

Battery power exhausted.

SRV re-closes.

14

Revision 3-10/28/2010 8:18:00 AM

RCIC continues to operate at a fixed (constant) flow rate until RCIC steam line floods.

Parameters Varied in Sensitivity Calculations

Not opening SRV.

Not taking manual control of CRDHS.

" Maximize CRDHS flow by opening valve.

" Include SLC injection flow.

Battery life of 2, 3, 4, and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

3.3.4.2 Mitigated Case The following is the time line for this sequence group. The mitigated case credits all the 10CFR50.54(hh) mitigation measures, including the portable pump. The times shown below are how long after the initiating event.

Event Initiation Division IV DC power lost.

Nitrogen supply to Containment Isolation lost.

MSIVs close on loss of Instrument Air.

0 RCIC starts on low level and operates while batteries are available.

1 CRD pump operates at 110 gpm.

Control Room receives alarm that DC chargers are not available, requiring operator to enter SE-13, Loss of DC power.

Without any operator action, CRD and RCIC are operating maintaining the core covered.

Drywell spray is available, but neglected because it is not necessary.

Shutdown cooling mode of RHR is not available because the needed valve alignment could not be done because of the power failure.

SLC is available, but neglected because its cooling injection flow of 50 gpm is not necessary.

15 minutes

" Initial Operations assessment of plant status complete.

RCIC operating, maintaining RCS level.

In accordance with SE-13, DC load shed initiated.

50 minutes

TSC manned (primary function would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigative measures).

" EOF manned (primary function would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigative measures. The primary users of SAMGs and EDMGs are the TSC supervisors who are trained on SAMGs and EDMGs.)

15

Revision 3 - 10/28/2010 8:18:00 AM 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months DC load shedding complete, extending battery life to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . (Batteries typically last for approximate 2 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months under normal loading conditions depending on life cycle of battery. At the beginning of its life, the battery duration is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . At the end of its life, the battery duration is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .)

" Also available, opening CRD throttle valve to increase flow from 110 gpm to 140 gpm without depressurization. (The increased flow rate of 140 gpm is an estimate provided by the licensee.)

1.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months

TSC operational.

1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

Manual controlled depressurization using 1 SRV

TSC and/or EOF reviews actions taken by operations and determined the availability of the remotely located equipment. Recommend the following actions:

Portable power supply to ensure long-term DC to hold SRV open and provide level indication (allows management of RCIC).

RCIC blackstart.

Portable diesel driven pump (250 psi, 500 gpm) to makeup to RCS, Hotwell, CST, etc.

Portable air supply to manually operate containmeni vent valves (vent into SGTS).

Portable diesel driven pump to inject into drywell via RHR and RCS.

Portable pump to provide spray to primary or secondary containment leakage pathway.

Pumper truck can be used in place of portable diesel driven pump.

1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months Operations staff assesses and concurs with TSC and/or EOF's recommendations.

Operations staff prioritizes recommendation based on plant conditions and begin implementation.

2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months Manual operation of RCIC to sustain RCS level after battery depletion Use of a portable DC power supply to operate SRV to depressurize RPV and to allow makeup with the portable pump @ - 500 gpm.

16

Revision 3 - 10/28/2010 8:18:00 AM 4.0 MELCOR MODEL OF THE PEACH BOTTOM PLANT This section summarizes the MELCOR model of the Peach Bottom Atomic Power Station. A comprehensive description of the model is available in separate documentation [2].

The MELCOR Peach Bottom model was originally generated for code assessment applications with code version 1.8.0 at Brookhaven National Laboratories. The model was subsequently adopted by J. Carbajo, at Oak Ridge National Laboratories, to study differences in fission-product source terms predicted by MELCOR 1.8.1 and those generated for use in NUREG-1150 using the Source Term Code Package (STCP) [3]. In 2001, considerable refinements to the BWR/4 core nodalization were made by Sandia National Laboratories to support the developmental assessment and release of MELCOR 1.8.5. These refinements concentrated on the spatial nodalization of the reactor core (both in terms of fuel/structural material and hydrodynamic volumes) used to calculate in-vessel melt progression.

These developments culminated in the reassessment of radiological source terms for high burnup core designs and a comparison of their release characteristics to the regulatory prescription outlined in NUREG-1465 [6]. These calculations addressed a wide spectrum of postulated accident sequences, which required new models to represent diverse plant design features, such as:

" Modifications of modeling features needed to achieve steady-state reactor conditions (recirculation loops, jet pumps, steam separators, steam dryers, feedwater flow, CRDHS, main steam lines, turbine/hotwell, core power profile),

" New models and control logic to represent coolant injection systems (RCIC, HPCI, RP-IR, LPCS) and supporting water resources (e.g., CST with switchover), and

New models to simulate reactor vessel pressure management (safety relief valves, safety valves, ADS, and logic for manual actions to affect a controlled depressurization if torus water temperatures exceed the heat capacity temperature limit).

Subsequent work in support of other U.S. Nuclear Regulatory Commission (NRC) research programs motivated further refinement and expansion of the model in two broad areas. The first area focused on the spatial representation of primary and secondary containment. The drywell portion of primary containment has been subdivided to distinguish thermodynamic conditions internal to the pedestal from those within the drywell itself. More importantly, considerable refinements have been added to the spatial representation and flow paths within the reactor building (i.e., secondary containment). The second area has focused on bringing the model up to current "best practice" standards for MELCOR 1.8.6.

4.1 Reactor Vessel and Coolant System Excluding the core region, the reactor pressure vessel is represented by seven control volumes, nine flow paths, and 24 heat structures. Nodalization for the core region between the core top guide and the bottom of active fuel are described in detail in Section 4.2. Figure 1 provides a reactor vessel nodalization detail comparing MELCOR modeling features to actual vessel design.

17

Revision 3 - 10/28/2010 8:18:00 AM Control volumes are indicated by "CV" followed by the three-digit control volume number, and flow paths are indicated by "FL" followed by the three-digit flow path number.

Figure 1 Reactor Vessel Cross-Section Detail and MELCOR Hydrodynamic Nodalization 18

Revision 3 - 10/28/2010 8:18:00 AM Figure 1 is a schematic representation of the MELCOR control volumes and flow paths for the reactor coolant system, including:

Reactor recirculation piping,

" Main feedwater and steam lines, and

Connections to emergency coolant injection and heat removal systems.

Collectively, these ancillary systems permit the model to properly calculate steady state, as well as a wide variety of transient conditions. To optimize numerical performance of this model, some consolidation of parallel lines or trains of certain systems has been made. For example, the four main steam lines have been represented by two parallel "lines," one of which represents the single steam line containing the lead (i.e., lowest set point) SRV, and the second represents the composite geometry of the remaining three lines. Isolating the steam line with the lead SRV permits the proper geometry (internal volume, structural surface area, etc.) to be represented for fission product transport from the reactor to the suppression pool during accident sequences in which fuel damage begins while the reactor vessel is at high pressure and pressure relief is accomplished by SRV operation.

4.2 Reactor Core In MELCOR, the region tracked directly by the COR Package model includes a cylindrical space extending vertically downward along the inner surface of the core shroud, from the core top guide to the reactor vessel lower head. It also extends radially outward from the core shroud to the hemispherical lower head in the region of the lower plenum below the base of the downcomer, preserving the curvature of the lower head from this point back to the vessel centerline.

The core and lower plenum regions are divided into concentric radial rings and axial levels.

Each core cell may contain one or more core components, including fuel pellets, cladding, canister walls, supporting structures (such as the lower core plate and control rod guide tubes),

nonsupporting structures (such as control blades, the upper tie plate, and core top guide) and (once fuel damage begins) particulate and molten debris.

The spatial nodalization of the core is shown in Figure 2 and Figure 3. The entire core and lower plenum regions are divided into six radial rings. As shown in Figure 4, rings one, two, three, four, and five represent 112, 160, 200, 168, and 124 fuel assemblies, respectively. The radial distance between each of the five rings is not uniform. The radius of each ring was defined so as to preserve the radial power distribution in the Unit 2 core, based on plant operating data from four recent and consecutive operating cycles. Radial ring 6 represents the region in the lower plenum outside of the core shroud and below the downcomer. Ring 6 exists only at the lowest axial levels in the core model.

19

Turbine CV901 Buildinlg CV6 Ino m Dom FL373 L7 s

L7 V0 FL3L36 FL 7 S,

I_

(tm FL6SFLFL65FLCV&,

g~~~~L6

-FL3691 c2a ~

FL51MS, IFL70

Revision 3 - 10/28/2010 8:18:00 AM I

I CV345 Shroud Dome 9.630.r, 917 217 F3 I L I 1o J7Upper TPl 8923 Ilt l f HtI1fl f!I l

7.780

-e m : -

.* i.......

...........v,.

7 38099 7.01810 IUIc 1

6.6371-f4f~I1IIAIIAII mn 9441

-8_AFI 3___--------

5.2687 3.084 m -

2.490.0 -

1.892 m -

1.2900 --

0.0, M CVH Nodalization accompanying COR Nodalization BWR/4 Core Nodalization Figure 3 Spatial Nodalization of the Core and Lower Plenum 21

Revision 3 - 10/28/2010 8:18:00 AM radius >

0 0 153 0305 0458 0610 0763 0915 1.068 1 220 1.373 1.525 1 678 1830 1983 2135 2.288 J(m) v1 17 18 t9 20 21 4:

23 24 25 20 27 28

2.

30 0

-o 1,440 t090 1,102 0.727 0.528 0.270 0,153 1"-

I 1.2=

0.818 0.538 0272 0.305 1*71t 1.496 123 1273 0.791 0.531 0.268 0 458 18 1.288 1.403 1.188 0.756 0.510 0.257 0610 19 0763 1,485 1.098 1.110 0.704 0.484 0.241 0 763 20 1.323 1.337 1.121 0.700 0.453 0.215 0.915 21 1=5 14 150 1.378 0.95 0.980.620 0.336 0.168 1 068 22 1,417 1.145 1.255 1,139 1.014 0.724 0.450 0.246 1 220 23 1.4 123 1.245 0.954 0.945 0.720 05 0.295 1.373 2.4-1,439 12 1.489 1257 1.447 1.297 1=2 1128 0.9W42 0.7n75 0.4 0.360.172 1 525 25 18 1.089 1.417 1.231 1.394 1.067 1,320 0.91 1.007 0.718 0,497 0.3148 assemblies average 18678 20 RPF 1.830 27 1223 0.727 0.813

.754 0.701 0,695 0.6151 0.445 0.291 0.171 RING 2 I

160 1.983 28 1 313 5.2 0.532 0530 0.508 0482 0450 RING 3 200 2 135 29 1 275 2288 0

.270 0,271 0.20 214 06RING 4

168 2.288

.0 0 748 RING 5 124 (m')

j0295 714 Figure 4 Local Relative Power Fraction (RPF) and 5-Ring Radial Boundaries of Core The core and lower plenum are divided into 17 axially stacked levels. The height of a given level varies, but generally corresponds to the vertical distance between major changes in flow area, structural material(s), or other physical features of core (and below core) structures. Axial levels 1 through 5 represent the open space and structures within the lower plenum. Initially, this region has no fuel and no internal heat source, but contains a considerable mass of steel associated with the control rod guide and in-core instrument tubes. During the core degradation process, the fuel, cladding, and other core components displace the free volume within the lower plenum as they relocate downward in the form of particulate or molten debris.

Axial level 6 represents the steel associated with fuel assembly lower tie plates, fuel nose pieces, and the lower core plate and its associated support structures. Particulate debris formed by destroyed fuel, canister, and control blades above the lower core plate will be supported at this level until the lower core plate yields. Axial levels 7 through 16 represent the active fuel region.

All fuel is initially in this region and generates the fission and decay power. Axial level 17 represents the nonfuel region above the core, including the top of the canisters, the upper tie plate, and the core top guide.

22

'OýWý 10

5001ýK LL Revision 3 - 10/28/2010 8: 18:00 AM 4.3 Primary Containment and Reactor Building The primary containment of the BWR Mark I design consists of two separate regions: a drywell and wetwell. As shown in Figure 5, each region is explicitly represented in the MELCOR model with distinct hydrodynamic control volumes, flow paths, and heat structures to preserve the geometric configuration and major functional features of the Mark I design (e.g., steam pressure suppression, fission product scrubbing, and surface deposition). The drywell is further divided into four connected volumes to account for nonuniformities in the temperature and composition of the atmosphere during late phases of a severe accident.

,ead failure)

Drywell (DW)

Wetwell (WW)

FL910 (Wetwell Hard-Pipe vent to atmosphere)

FL023 Figure 5 Hydrodynamic Nodalization of the Primary Containment The internal volume, airflow flow pathways, and structures of the reactor building are modeled in considerable detail as illustrated in Figure 6 and Figure 7. The reactor building fully encloses the primary containment and participates in the release pathway of fission products to the environment released from the containment, by offering a large volume within which an airborne radionuclide concentration can be diluted by expansion into, and mixing with, the building atmosphere.

23

P44ewwe Revision 3 - 10/28/2010 8:18:00 AM I

Figure 6 Hydrodynamic Nodalization of the Reactor Building (a) 24

94E~fdy~

Revision 3 - 10/28/2010 8:18:00 AM Figure 7 Hydrodynamic Nodalization of the Reactor Building (b) 25

Revision 3 - 10/28/2010 8:18:00 AM The airborne concentration of fission product aerosols within the reactor building is attenuated by gravitational settling and other natural deposition mechanisms. The building is also equipped with a ventilation system with aerosol and charcoal filters, which would greatly aid in reducing an airborne radioactive release. However, these systems would not be available during the particular accident scenarios examined in this work, because of loss of electrical power or other equipment failures. The building is, therefore, occasionally referred to as a secondary containment, although it has a negligible capacity for internal pressure.

4.4 Ex-vessel Drywell Floor Debris Behavior The drywell floor is subdivided into three regions for the purposes of modeling molten-core/concrete interactions. The first region (which receives core debris exiting the reactor vessel) corresponds to the reactor pedestal floor and sump areas (CAV 0). Debris that accumulates in CAVO can flow out through an open doorway in the pedestal wall to a second region representing a 90' sector of the drywell floor (CAV 1). If debris accumulates in this region to a sufficient depth, it can spread further around the annular drywell floor into the third region (CAV2). This discrete representation of debris spreading is illustrated in Figure 8.

Two features of debris relocation within the three regions are modeled. The first represents bulk debris spill over or movement from one region to another. A control system monitors the debris elevation and temperature within each region, both of which must satisfy user-defined threshold values for debris to move from one region to its neighbor. More specifically, when debris in a cavity is at or above the liquidus temperature of concrete, all material that exceeds a predefined elevation above the floor/debris surface in the adjoining cavity is relocated (6 inches for CAV 0 to CAV 1 and 4 inches for CAV 1 to CAV 2). When debris in a cavity is at or below the solidus temperature of concrete, no flow is permitted. Between these two debris temperatures, restricted debris flow is permitted by increasing the required elevation difference in debris between the two cavities (more debris head required to flow).

The second control system manages debris spreading radius across the drywell floor within CAV I and 2. Debris entering CAV 1 and CAV 2 is not immediately permitted to cover the entire surface area of the cavity floor. The maximum allowable debris spreading radius is defined as a function of time. If the debris temperature is at or above the concrete liquidus temperature, then the maximum transit velocity of the debris front to the cavity wall is calculated (i.e., results in 10 minutes to transverse CAV 1 and 30 minutes to transverse CAV 2). When the debris temperature is at or below the concrete solidus, the debris front is assumed to be frozen, and lateral movement is precluded (i.e., debris velocity is 0 m/s). A linear interpolation is performed to determine the debris front velocity at temperatures between these two values.

26

V-VdN Revision 3 - 10/28/2010 8:18:00 AM S6.706 mn FLOOR EQUIV PERIMETER CAV AREA RADIUS RATIO 0

29.92 3.086 1

22.75 2.691 2

68.25 4.661 0.95 0.94 0.62 1.72 1.08 Figure 8 Drywell Floor Regions for Modeling Molten-Core/Concrete Interactions.

Full mixing of all debris into a single mixed layer is assumed in each of these debris regions.

The specific properties for concrete composition, ablation temperature, density, solidus temperature, and liquidus temperature are specified. The concrete composition represented in the MELCOR model is listed in Table 2. The drywell floor concrete includes 13.5% rebar.

Other key user-defined concrete properties are selected to match defaults for limestone common sand concrete and include:

initial temperature of 300 K

ablation temperature of 1500 K solidus temperature of 1420 K liquidus temperature of 1670 K density of 2340 kg/mi3 emissivity of 0.6 27

Revision 3 - 10/28/2010 8:18:00 AM Table 2 Concrete Composition Species Mass Fraction A120 0.0091 Fe2003,

0.0063 CaO 0.3383 MgO 0.0044 C0 2 0.2060 SiO 2 0.3645 H 2Oevap 0.0449 H2Ochem 0.0265 4.5 Containment Failure Model Peach Bottom has a Mark I containment (Figure 9) that consists of a drywell and a toroidal-shaped wetwell, which is half full of water (i.e., the pressure suppression pool.) The drywell has the shape of an inverted light bulb. The drywell head is removed during refueling operations to gain access to the reactor vessel. The drywell head flange is connected to the drywell shell with 68 bolts of 2 '/2" diameter (Figure 9). The flanged connection also has two 3/4" wide and 1/2/2" thick Ethylene Propylene Diene Methylene (EPDM) gaskets. The torque in the 2 1/2" diameter bolts range from 817 to 887 ft-lb [16][17]. An average bolt torque of 850 ft-lb was used in this study.

The 68 drywell head flange bolts (see Figure 9) are pre-tensioned during reassembly of the head.

This pre-tension also compresses the EPDM gaskets in the head flange. During an accident condition, the containment vessel may be pressurized internally. The internal pressure would counteract the pre-stress in the bolts. At a certain internal pressure, all the pre-stressing force from the bolts would be eliminated, and the EPDM gaskets would be decompressed. Further increase in the internal pressure would result in leakage at the flanged connection.

The EPDM gasket manufacturers recommend a maximum squeeze (compression) of 30 percent for a static-seal joint. The gaskets recover about 15 percent of the total thickness after the compressive load is removed from the flange. However, the licensee engineers informed the SOARCA personnel that the gaskets for the reactor vessel head flange are squeezed to 50 percent to have a metal to metal contact to ensure no leakage at design pressure of 56 psi. In addition, the gaskets are exposed to constant temperature and radiation, which contribute to early degradation. For this reason, the gaskets are replaced during each reassembly of the reactor vessel head. Based on this information and actual observations, the Peach Bottom licensee engineers recommended a gasket recovery of 0.03 inch.

28

PfEjP71e~o(lj Lb

a

'Revision 3 - 10/28/2010 8:18:00 AM 3E N

Area = Ab Figure 9 Drywell Head Flange Connection Details.

Based on the gasket recovery of 0.03 inches, the actual gap was determined at various internal pressures as:

Elongation in the bolt = ALb = ALb] - 0.03 inch where:

Lb = Length between the bolt head and nut (Figure 9)= 37.56 inches Ab = Tensile stress area of the bolt [14] = 4.0 in2 E = 28.0 x l06 psi ALb] = 0.0054 inch Leakage areas for different internal pressures are shown in Figure 10. The reactor vessel head flange does not leak until the internal accident pressure is 0.660 MPa (i.e., P/PD = 1.25 or 81 psig). Thereafter, there is a gradual increase in the leakage area.

At high temperatures (>755 K, or >9000 F), upward and radial thermal growth of the drywell would lead to binding of small and large penetrations against the biological shield wall and failure. In addition, radial growth of the containment may also cause the seismic stabilizers to punch through the upper portion of the drywell at high temperatures [15]. This observation is consistent with the results of the previous studies that show that the drywell is likely to fail at the 29

Revision 3 - 10/28/2010 8:18:00 AM low pressure range of 0-65 psig [15]. Therefore, it can be concluded that the drywell is likely to fail under any appreciable pressure load at temperatures of 900°F or greater.

Finally, the containment can fail by drywell shell melt-through containment failure (see relevant discussions in Sections 4.4 and 4.7.2).

Peach Bottom Drywall Flange Leakage Area PD

=.Ign 0.529 MPa (77 psia) 0.09 T 0.08 0.07 0.06 0.05 0.02 0.00 1.0 1.5 2.0 2.5 3.0 3.5 Pressure ratio (P/PDoeign)

Figure 10 Drywall Flange Leakage Model versus Containment Pressure 4.6 Radionuclide Inventories and Decay Heat One important input to MELCOR is the initial concentration of radionuclides in the fuel and their associated decay heat. The values are important to the timing of initial core damage and the location and concentration of the initial radioactive source. The radionuclides in a nuclear reactor come from three primary sources: (1) fission products are the result of fissions in either fissile or fissionable material in the reactor core; (2) actinides are the product of neutron capture in the initial heavy metal isotopes in the fuel; and (3) other radioisotopes are formed from the radioactive decay of these fission products and actinides. Integrated computer models such as the TRITON sequence in SCALE exist to capture all these interrelated physical processes, but they are intended primarily as reactor physics tools [13]. As such, their standard output does not provide the type of information needed for MELCOR [7]. It is important to note that changes to the TRITON sequence in SCALE were not needed for this analysis. The BLEND3 post-processing software extracts output from the TRITON sequence and combines it in a way that makes it useful for MELCOR [7].

A Global Nuclear Fuel (GNF) I10xl0 (GE-14C) fuel assembly was used as a typical fuel element for Peach Bottom analysis. Information regarding assembly dimensions, enrichments, and operating characteristics were obtained from the licensee (with permission from the fuel vendor) 30

Revision 3 - 10/28/2010 8:18:00 AM and used for a realistic evaluation. Twenty-seven different TRITON runs were performed to model three different cycles of fuel at nine specific power histories. The specific power histories ranged from 2 MW/MTU to 45 MW/MTU, which bounded all expected BWR operational conditions. For times before the cycle of interest, an average specific power of 25.5 MW/MTU was used. For example, for the second cycle fuel, the fuel was burned for its first cycle using 25.5 MW/MTU, allowed to decay for an assumed 30 day refueling outage, and then nine different TRITON calculations were performed with specific powers ranging from 2 to 45 MW/MTU. The BLEND3 code was applied to each of the fifty core nodes 5 in the MELCOR model using average specific powers derived from data for three consecutive operating cycles and appropriate nodal volume fractions. Once new libraries for each of the fifty nodes in the model were generated, the final step in the procedure was to deplete each node for 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The decay heats, masses, and specific activities as a function of time were processed and applied as input data to MELCOR to define decay heat and the radionuclide inventory.

4.7 Modeling Uncertainties The primary objective of the SOARCA project is to provide a best-estimate prediction of the likely consequences of important severe accident events at selected reactor sites in the U.S.

civilian nuclear power reactor fleet. To accomplish this objective, the SOARCA project utilizes integrated modeling of the accident progression and offsite consequences using both state-of-the-art computational analysis tools as well as best modeling practices drawn from the collective body of knowledge on severe accident behavior generated over the past 25 years of research.

The MELCOR 1.8.6 computer code [7] embodies much of this knowledge and was used for the accident and source-term analysis. MELCOR includes capabilities to model the two-phase thermal-hydraulics, core degradation, fission product release, transport, deposition, and the containment response. The SOARCA analyses include operator actions and equipment performance issues as prescribed by the sequence definition and mitigative actions. The MELCOR models are constructed using plant data, and the operator actions were developed based on discussions with operators during site visits. The code models and user-specified modeling practices represent the current best practices.

Uncertainties remain in our understanding of the phenomena that govern severe accident progression and radionuclide transport. Consistent with the best-estimate approach in SOARCA, all phenomena were modeled using best-estimate characterization of uncertain phenomena and events. Important severe accident phenomena and the proposed approach to modeling them in the SOARCA calculations were presented to an external expert panel during a public meeting sponsored by the NRC on August 21 and 22, 2006 in Albuquerque, New Mexico. A summary of this approach is described in Section 4.7.1. These phenomena are singled out because they are important contributors to calculated results and have uncertainty.

Section 4.7.2 briefly describes the two other topics, steam explosions, and drywell shell melt-through on a wet drywell floor have been previously included in lists of highly uncertain Five radial rings by ten axial levels 31

VAOY Revision 3 - 10/28/2010 8:18:00 AM phenomena. Section 4.7.1 briefly describes them and offers a summary of the significant research that led the SOARCA project to neglect their inclusion.

Finally, a systematic evaluation of phenomenological uncertainties for a particular sequence is a separate task and not discussed in this report. The task will evaluate the importance and impact of alternative settings or approaches for key uncertainties.

4.7.1 Base Case Approach on Important Phenomena A review of severe accident progression modeling for the SOARCA project was conducted at a public meeting in Albuquerque, New Mexico on August 21 and 22, 2006 [8]. This review focused primarily on best modeling practices for the application of the severe nuclear reactor accident analysis code MELCOR for realistic evaluation of accident progression, source term, and offsite consequences. The scope of the meeting also included consideration of potential enhancements to the MELCOR code as well as consideration of the SOARCA project in general.

The review was conducted by five panelists with demonstrated expertise in the analysis of severe accidents at commercial nuclear power plants. The panelists were drawn from private industry, the Department of Energy national laboratory complex, and a company working on behalf of German Ministries. The review was coordinated by Sandia National Laboratories and attended by Nuclear Regulatory Commission staff. A discussion of the important uncertain modeling practices and their baseline approach are further discussed in Volume II, Best Modeling Practices. A separate task in the SOARCA project is planned to address the importance of uncertainties in these modeling parameters.

4.7.2 Early Containment Failure Phenomena The objective of SOARCA is to perform best-estimate evaluations of the accident progression and consequences from the most likely severe accident sequences for specific plants. Two phenomenological issues not included in the best-estimate approach used in SOARCA include (1) alpha-mode containment failure and (2) drywell shell melt-through in the presence of water leading to containment failure. These severe phenomena leading to an early failure of the containment were included in some of NUREG-1150 to quantify the risks from nuclear reactors.

The alpha-mode event is characterized by the supposition that an in-vessel steam explosion might be initiated during core meltdown by molten core material falling into the water-filled lower plenum of the reactor vessel. The concern was that the resulting steam explosion could impart sufficient energy to separate the upper vessel head from the vessel itself and form a missile with sufficient energy to penetrate the reactor containment. This of course would produce an early failure of the containment building at a time when the largest mass of fission products is released from the reactor fuel. In the following years, significant research was focused on characterizing and quantifying this hypothesized response in order to attempt to reduce the significant uncertainty. A group of leading experts ultimately concluded in a position paper published by the Nuclear Energy Agency's Committee on the Safety of Nuclear Installations that the alpha-mode failure issue for Western-style reactor containment buildings 32

Revision 3 - 10/28/2010 8:18:00 AM can be considered resolved from a risk perspective, posing little or no significance to the overall risk from a nuclear power plant.

The issue of Mark I drywell shell (liner) melt-through at Peach Bottom was assessed by the NUREG-1 150 molten core-containment interaction panel. The results of expert panel elicitation are reported in Reference [10]. There were two schools of thought on this issue and hence the response was uncertain. Since the completion of NUREG-1 150, the NRC has sponsored analytical and experimental programs to address and resolve this so-called "Mark I Liner Attack" issue. The results of an assessment of the probability of Mark I containment failure by melt attack of the liner were published in NUREG/CR-5423 [11] and NUREG/CR-6025 [12]. It was concluded that, in the presence of water, the probability of early containment failure by melt-attack of the liner is so low as to be considered physically unreasonable.

33

~E~71 Revision 3 - 10/28/2010 8:18:00 AM This Page Intentionally Left Blank 34

Revision 3-10/28/2010 8:18:00 AM 5.0 Integrated Thermal Hydraulics, Accident Progression, and Radiological Release Analysis This section describes the MELCOR accident progression analysis for the internal and external event scenarios described in Section 3.0. Version 1.8.6 of the MELCOR severe accident analysis code was used in the accident progression and radiological release calculations.

5.1 Long-Term Station Blackout - Unmitigated Response The unmitigated scenario event progression for the LTSBO accident progression analysis assumes that the operators follow the actions dictated in Special Event Procedure SE-11 [4].

This document provides guidelines for managing the plant with degraded AC power sources.

Initial operator actions would concentrate on assessing plant status. Successful reactor scram, containment isolation, and automatic actuation of RCIC for reactor level control would be verified. These checks would take approximately fifteen minutes. Additionally, one or more SRVs would cycle to control the RPV pressure.

Special Event Procedure SE-Il requires the immediate alignment of the station blackout line from Conowingo Dam in the event of failure of offsite power combined with the failure of all diesel generators to start. When this fails to provide AC power to the plant, which is what was assumed to occur for the MELCOR analysis, the operators are directed to de-energize all unnecessary DC loads. By removing as many unnecessary loads as possible from the DC bus, the station battery lifetime is extended. This load shedding would not affect or disable control logic to the RCIC, HPCI, main control room instrumentation, or SRV control.

The load shedding is expected to begin 15 minutes into the event and take approximately 15 minutes to complete. Plant system engineers estimate the effect of load shedding would be to extend station battery duration from 2 to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

One consequence of station blackout is the loss of cooling to the RCIC and HPCI corner rooms.

Heat losses from system piping and equipment to the room atmosphere would cause these areas to overheat. In such an event, step H-5 in the Special Event Procedure SE-11 is applicable. It directs operators to block open doors to these rooms and facilitate cross ventilation, which would slow the rate of room heat up. These actions are assumed to successfully prevent system isolation from high temperature for the maximum 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months period of system operation.6 The Special Event Procedure SE-11, step H-7, directs the operators to monitor the inventory in the CST and take actions to refill the tank via gravity feed from other sources if necessary.

Long-term viability of the CST is therefore assumed in the MELCOR calculations.

The calculated timing of key events that follow from all these actions is listed in Table 3. The time at which core damage begins strongly depends on the duration of station batteries. The difference in time between loss of DC power and the onset of core damage increases as battery 6 Heat loss from RCIC (or HPCI) systems to their enclosure comer rooms is not explicitly represented in the MELCOR model.

35

P Revision 3 - 10/28/2010 8:18:00 AM lifetime increases because of reductions in decay heat levels with time. In the absence of effective manual intervention, core damage eventually proceeds to melting and relocation of core material into the reactor vessel lower head, reactor vessel lower head failure, and release of molten core debris to the drywell floor.

Table 3 Timing of Key Events for Long-Term Station Blackout Event LTSBO with (Time in hours unless noted otherwise) 4 hr DC power Station blackout - loss of all onsite and offsite AC power 0.0 Low-level 2 and RCIC actuation signal 10 minutes Operators manually open SRV to depressurize the reactor vessel 1.0 RPV pressure first drops below LPI setpoint (400 psig) 1.2 Battery depletion leads immediate SRV re-closure 4.0 RCIC steam line floods with water - RCIC flow terminates 5.2 Downcomer water level reaches top of active fuel (TAF) 9.0 First hydrogen production 9.2 First fuel-cladding gap release 10.1 First channel box failure 10.6 First core cell collapse because of time at temperature 11.0 Reactor vessel water level reaches bottom of lower core plate 11.6 SRV sticks open because of cycling at high temperatures 11.7 First core support plate localized failure in supporting debris 13.4 Lower head dries out 14.9 Ring 2 CRGT Column Collapse [failed at axial level 1]

17.5 Ring 1 CRGT Column Collapse [failed at axial level 1]

17.6 Ring 5 CRGT Column Collapse [failed at axial level 2]

17.7 Ring 3 CRGT Column Collapse [failed at axial level 1]

18.1 Ring 4 CRGT Column Collapse [failed at axial level 2]

19.0 Lower head failure 19.5 Drywell head flange leakage begins 19.5 Hydrogen burns initiated in drywell enclosure region of reactor building 19.5 Refueling bay to environment blowout panels open 19.5 Hydrogen bums initiated in reactor building refueling bay 19.7 Refueling bay roof overpressure failure 19.7 Drywell shell melt-through initiated and drywell head flange re-closure 19.7 Hydrogen burns initiated in lower reactor building 19.7 Door to environment through railroad access opens because of overpressure 19.7 Time Iodine release to environment exceeds 1% of initial core inventory 20.0 Calculation terminated 96 36

Revision 3 - 10/28/2010 8:18:00 AM The absence of water on the drywell floor in a transient scenario like station blackout 7 allows core debris ejected from the reactor vessel after lower head failure to spread laterally across the floor and contact the drywell wall. Past calculations have predicted drywell shell melt-through to occur relatively soon after vessel failure (within 30 minutes.) Fission product release from the containment to the reactor building and (with a very short delay) to the environment will begin at this point in time. Several release points to the environment are possible, depending on the response of the reactor building. Past calculations have shown that hydrogen combustion leads to near-simultaneous opening of the refueling bay blow-out panels and the railroad doorway at grade level. Blow-out panels into the turbine building and personnel access doorways out of the reactor building might also open. The dominant flow path for fission products to the environment, however, is expected to be through the refueling bay blowout panels.8 5.1.1 Thermal Hydraulic Response When plant conditions are stabilized, Special Event Procedure SE-11 calls for a controlled depressurization of the RPV to 125 psig using the instructions in the RC/P leg of Trip Procedure T-101. Depressurization would be accomplished by opening one or more SRVs or, if necessary, by manually opening other steam vent pathways, such as main steam line drains. The cooldown rate would be limited to less than 100 °F/hr. A controlled depressurization is initiated at 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months by opening a single SRV. As shown in Figure 11, this results in a stable pressure of approximately 125 psig.9 Reactor vessel pressure remains near this pressure for approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , while active DC power permits an SRV to hold in the open position. Four hours into the scenario, however, DC power from the station batteries is exhausted, and the solenoid valve regulating control air to the SRV operator closes, causing the SRV itself to reclose.' 0 SRV closure causes reactor vessel pressure to gradually increase back to its automatic (safety) lift setpoint. Reactor vessel pressure subsequently cycles about its lift setpoint for the next 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

During this same time frame (i.e., the first 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of the accident scenario), reactor vessel water level is also undergoing significant changes (refer to Figure 12.) The hydraulic transient immediately following reactor scram and isolation results in a gradual decrease in water level because of coolant evaporation and discharge through a cycling SRV to the suppression pool.

RCIC automatically starts 10 minutes after the initiating event and begins to restore reactor water level. Two hours into the scenario, operators take manual control of RCIC and maintain level within the indicated range of +5 to +35 inches (i.e., 16 ft above TAF).

7 As opposed to a loss-of-coolant accident (LOCA), where reactor coolant effluent accumulates on the drywell floor.

B A stable flow of air into the building is expected through the open railroad doorway, upward through the open equipment hatches from grade level to the refueling bay and into the environment through the open blow-out panels.

9 The target value of RPV pressure provides some margin above the RCIC isolation pressure of 75 psig.

0 Loss of control air pressure to the valve operator might take a few minutes to effect valve position, but this short time is ignored in this analysis.

37

Revision 3 - 10/28/2010 8:18:00 AM 1400 1200 1000 "a

800 600 400 200 0

0 2

4 6

8 10 12 14 16 18 20 22 24 time [hr]

Figure 11 LTSBO Vessel Pressure 800 700 600

-j 500 400 300 0.

200 I--

100 0

0 2

4 6

8 10 12 14 16 18 20 22 24 time (hr)

Figure 12 LTSBO Coolant Level 38

Revision 3 - 10/28/2010 8:18:00 AM When DC power from the station batteries expires 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months into the scenario, RCIC turbine speed is assumed to remain fixed at its last position. [Electric (DC) power is required to move the turbine inlet throttle valve (open or close), and the loss of power simply leaves the valve in its last controlled position.] As a result, RCIC continues to deliver coolant flow at approximately the same flow rate it had at the time DC power expired. However, closure of the SRV at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months means coolant losses from the reactor vessel are temporarily terminated. Therefore, the reactor vessel level begins to rise (i.e., coolant injection continues, but losses are terminated.) A continuous rise in level is evident in Figure 12, between 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and approximately 5.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

At 5.1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the water level in the reactor vessel increases above the elevation of the main steam line nozzles. Water subsequently spills over into the main steam lines causing the steam line to the RCIC turbine to flood within a few minutes. The resulting termination of RCIC operation at 5.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months causes the reactor water level to stabilize. Approximately 50 minutes later, the average water temperature in the reactor vessel increases to saturation. When that occurs (6.0 hours0 days 0 hours 0 weeks 0 months ), the reactor vessel pressure is 900 psia and increasing. Increasing reactor vessel pressure causes a slight increase in the effective level of water in because of decreasing average coolant density."1 At 6.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , reactor vessel pressure returns to the SRV lift pressure, and coolant losses through the cycling SRV resume. Without any form of coolant makeup, the reactor water level continuously decreases at a rate of 10 ft/hr. Nine hours into the scenario, the reactor water level reaches TAF. At approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the level decreases below the bottom of the lower core plate. By the time the plant has been without power for 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months , the entire inventory of water in the reactor vessel depleted (see Figure 12 and Table 3).

The thermal response of fuel in the core is illustrated in Figure 13, which shows the calculated temperature of fuel cladding across the core mid-plane. Cladding temperatures begin to rise at the top of the core when the mixture level decreases below approximately two-thirds of the core height. Within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the mixture level is approaching the bottom of the core and fuel temperatures and the extent of Zircaloy cladding oxidation are sufficiently high to cause fuel at the top of the core to fragment and relocate toward the lower core plate as rubble.

In the midst of the core damage process, the cycling SRV is discharging a mixture of steam and hydrogen (from clad oxidation) to the suppression pool. The temperature of these gases increases along with the average temperature of fuel and debris near the top of the core. By 11.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , the temperature of gases discharged through the SRV exceeds 1000 K. Thermal expansion of valve internal components above this temperature results in valve seizure. The valve is assumed to seize in the open position after 10 cycles above 1000 K. This occurs at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , and results in rapid depressurization of the RPV (see Figure 11) and a sharp decrease in mixture level (see Figure 12.)

The density of saturated water decreases by 4-5% as pressure increases from 900 psia to 1150 psia. This causes the entire body of water within the core shroud to expand slightly, resulting in an increase in effective (swollen) water level.

39

epoeL Revision 3 - 10/28/2010 8:18:00 AM 3000 2500 2000 1500 E

1000 500 0

Cladding Temperatures at Core Mid-plane Ring 1

-Ring 2

Ring 3 Ring 4 Ring 5 0

Indicates intact fuel no longer present at this location

/

0 0

0 2

4 6

8 10 12 14 time [hr]

16 18 20 22 24 Figure 13 LTSBO Fuel Cladding Temperatures at Core Mid-plane Particulate and molten debris accumulate near the bottom of the core until 13.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , when the lower core plate yields, releasing core debris into the reactor vessel lower head. The interaction between hot debris and residual water in the lower head increases the rate of coolant evaporation, as indicated in Figure 12 by the increase in (negative) slope of the "in-shroud" water level. It also causes the temperature of debris submerged below the lower plenum mixture level to decrease to near-equilibrium conditions. This is evident in Figure 14, which shows the calculated temperature of debris along the inner surface of the lower head. When residual water in the lower plenum is completely evaporated at 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months , debris temperatures begin to increase.

Heat transfer from debris to the inner surface of the lower head causes the lower head temperature to increase as well. This is illustrated in Figure 15, which depicts the calculated temperature on the inner and outer surfaces of the lower head across all five rings of the MELCOR model. Because reactor vessel pressure is relatively low during this heat up, the failure of the lower head is more strongly influenced by thermal rather than mechanical stresses. 12 Failure of the lower head (at 19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ) results in the rapid ejection of over 100 metric tons of core debris onto the floor of the reactor pedestal in the drywell. The composition of this debris (at the time of head failure) is a mixture of molten stainless steel (-30% by mass), unoxidized zirconium (-11%) and particulate debris containing U0 2 and metallic oxides (remainder).

12The inner surface temperature of the nadir of the lower head (MELCOR rings 1-3) is above the melting point of steel at the time failure occurs.

40

-i-K Revision 3 - 10/28/2010 8:18:00 AM 2500 2000 1500 E 1000 500 0

0 5

10 15 20 25 30 time [hr]

Figure 14 LTSBO Temperature of Particulate Debris on Inner Surface of Lower Head Before the reactor vessel lower head fails, thermodynamic conditions in the containment are governed by the gradual release of hydrogen through the SRV to the torus. The large quantity of hydrogen (over 1300 kg between 10 and 19 hours2.199074e-4 days 0.00528 hours 3.141534e-5 weeks 7.2295e-6 months ), combined with the small free volume of the containment, results in significant increases in pressure. The containment pressure history is shown in Figure 16. Thirteen hours after the initiating event (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after the loss of all coolant injection), the containment pressure increases above the design pressure of 56 psig. Immediately prior to lower head failure (19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ), containment pressure exceeds 76 psig.

Containment atmosphere temperatures remain modest throughout the early increases in pressure because of cooling of the steam/hydrogen mixture as it bubbles through the suppression pool.

However, immediately following vessel breach, containment atmosphere pressure and temperature increase dramatically from the accumulation of molten core debris on the reactor pedestal and drywell floors. The atmosphere temperature in the pedestal increases to over 1500 K and the atmosphere at the top of the drywell (close to the closure flange) increases to a stable temperature of approx. 440 K (330F). The combination of elevated pressure and temperature near the top of the drywell eventually results in leakage through the head flange.

The leak area and discharge rate are assumed to be proportional to the differential pressure across the flange.'13 Drywell head flange leakage begins almost 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months after the initial loss of offsite power. The initial leak rate is relatively small and is quickly overwhelmed by a separate containment failure mode.

13 The flange leak area, which is based on a structural analysis based on the containment internal pressure, is described in Section 4.5.

41

OP490)ON/L Revision 3 - 10/28/2010 8:18:00 AM 2200 2000 1800 1600

= 1400

& 1200 E

I-1000 800 600 400 Lower head failure Lower Head Temperatures ----

-Ring 1 - Inner Surface Ring 1 -Outer Surface

-Ring 2 - Inner Surface Ring 2 -Outer Surface

-Ring 3 - Inner Surface

-Ring 3 -Outer Surface Ring 4 - Inner Surface Ring 4 - Outer Surface

-Ring 5-Inner Surface Ring 5 - Outer Surface Lower head dryout 0

5 10 15 time [hr]

20 25 30 Figure 15 LTSBO Lower Head Temperature 120 100 (U

4) 1..

(U (Ua)

L.

0.

80 60 40 20 0

0 10 20 30 40 50 time [hr]

Figure 16 LTSBO Containment Pressure 42

Revision 3 - 10/28/2010 8:18:00 AM Soon after debris is released onto the reactor pedestal floor, it flows laterally out of the cavity through the open personnel access doorway and spreads out across the main drywell floor.

Lateral movement and spreading of debris across the drywell floor allows debris to reach the steel shell at the outer perimeter of the drywell within 10 minutes. Five minutes later, thermal attack of the molten debris against the steel shell results in shell penetration and opening of a release pathway for fission products into the basement (torus room) of the reactor building. The combined leakage through the drywell head flange and the ruptured drywell shell results in a rapid depressurization of the containment to approximately 25 psig, and then a gradual long-term depressurization, primarily through the opening in the drywell shell.14 Before drywell shell melt-through occurs, hydrogen leaks through the drywell head flange and accumulates in the reactor building refueling bay.15 Within a few minutes, a flammable mixture develops and is assumed to ignite. The resulting increase in pressure within the building causes the blow-out panels in the side walls of the refueling bay to open, creating a release pathway to the environment.

Following drywell shell melt-through (several minutes later), hydrogen is released from the drywell into the basement of the building (i.e., torus room) and is transported upward through open floor gratings into the ground level of the reactor building. Flammable mixtures quickly develop in these regions, which are assumed to ignite. The pressure rise within the building at this lower location causes several doorways within the building to open, including the large equipment access doorway. This large opening at grade level, coupled with the open blow-out panels in the refueling bay (at the top of the building), creates an efficient transport pathway for material released from containment to the environment. That is, a vertical column of airflow is created within the building whereby fresh air from outside the building enters through the open equipment doors at grade level, rises upward through the open equipment hatches at every intermediate floor within the building, and exits through the blow-out panels at the top of the building. As will be shown in the next section, this chimney effect reduces the effectiveness of the reactor building as an area for fission product retention.

5.1.2 Radionuclide Release The release of radionuclides that immediately accompanies containment failure as shown in Figure 17 (see Appendix A. 1 for a detailed radionuclide core inventory). This release occurs in two steps because of sequential breaches in the containment boundary by two distinct failure modes. The first appearance of significant release to the environment begins at 19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , when leakage through the drywell head flange begins. The leak area associated with this failure mode is relatively small. Therefore, the leak rate is low, and the initial radionuclide release to the environment is relatively slow. Within 15 minutes, however, a larger leak area develops as a result of melt-through of the drywell shell. A sharp increase in the release rate is shown in Figure 17 (at 19.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ), when this second failure mode occurs.

"4 Reduction in drywell internal pressure cause the drywell head flange leak pathway to reclose.

15 The precise leak pathway includes intermediate transport through the drywell head flange to the drywell head enclosure. Leakage from the enclosure into the refueling bay occurs through gaps in the concrete shield blocks on the refueling bay floor. This complex leak pathway is explicitly represented in the MELCOR model.

43

mp$4d9e Revision 3 - 10/28/2010 8:18:00 AM The long-term release of radionuclides to the environment is shown in Figure 18. Following the puff release that accompanies containment failure, a steady and gradual increase in the total quantity of radionuclides released to the environment is observed. The gradual, long-term increase in release is caused by two processes. First, molten corium-concrete interactions (MCCI) on the drywell floor drive the residual quantity of volatile fission products from fuel debris, and release a relatively small fraction of all nonvolatile species. Second, the combination of high drywell atmosphere temperatures generated as a byproduct of MCCI and heating of reactor vessel internal structures because of decay heating of deposited radionuclides results in a late revaporization release of volatile species from within the containment and reactor coolant system. The latter is described in greater detail below.

0 0

0 I.-0 0

0

.t" ELL U-1.E+00 1.E-01 1.E-02 1.E-03 1.E-04 1.E-05 1.E-06 19 19.25 19.5 19.75 20 20.25 20.5 20.75 21 time [hr]

Figure 17 LTSBO Environmental Source Term: Detail at Time of Containment Failure 44

5WXPKL0000, Revision 3 - 10/28/2010 8:18:00 AM 0

06 0

0 1.E+00 1.E-01 1.E-02 1.E-03 1.E-04 1.E-05 1.E-06 0

5 10 15 20 25 30 35 40 45 50 time [hr]

Figure 18 LTSBO Environmental Source Term: Long Term Figure 19 depicts the fraction of the initial iodine inventory that is captured in the suppression pool, deposited or airborne within the RPV in the drywell, and is released to the environment as a function of time. Similar information is shown in Figure 20 for cesium, in Figure 21 for tellurium, and in Figure 22 for non-volatile cerium.

Collectively, these figures provide useful information about the mobility of different radionuclide species and temporal changes in their spatial distribution. For example, next to noble gases, iodine is the most volatile radionuclide group. In the SOARCA calculations, iodine is assumed to be transported in the form of CsI, which vaporizes at relatively modest temperatures for a severe accident. As a result, CsI is released from fuel during the early phases of in-vessel core damage progression and a significant fraction remains airborne because of relatively high temperatures of structures within the reactor vessel. Airborne iodine is efficiently transported to the wetwell through the operating SRV. In particular (see Figure 19),

approximately 60% of the initial core inventory of iodine is discharged to the suppression pool during the blowdown of the reactor vessel that accompanies SRV seizure at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . During the succeeding eight hours, the majority of CsI that remains deposited on reactor vessel internal structures after RPV blowdown evaporates from their surfaces as a result of decay heating, and is also carried into the suppression pool.

45

f~b tfOy~L Revision 3 - 10/28/2010 8:18:00 AM 0.9 0.8 0E0.7 0o.6 0

o 0.5 S0.4 S0.3 0.2 LL 0.1 0

0 10 20 30 40 time [hr]

LTSBO Iodine Fission Product Distribution 50 Figure 19 0.9 0.8 o 0.7 0.6 0 0.5 0.4

- 0.3 0

.! 0.2 U-0.1 0

0 10 20 30 40 50 time [hr]

Figure 20 LTSBO Cesium Fission Product Distribution 46

0*)ýIfOýL Revision 3 - 10/28/2010 8:18:00 AM 0.9 0.8 0

0.7 0.6 O

-E0 0.5

°m" 0.4 C

o 0.3 C

.m0.2 L_I..

0.1 0

0 10 20 30 40 time [hr]

50 Figure 21 0.0014 LTSBO Tellurium Fission Product Distribution Cerium Distribution

, 0.0012 0

C0>

0.001 C

EI-o 0.0008 0*

o 0.0006 0

LL 0.0002 0

Release to

\\

environment (0.1%)

Drywell Deposited/Airborne Captured in Iwithin RPV

/

Suppression Pool 0

10 20 30 40 50 time [hr]

Figure 22 LTSBO Cerium Fission Product Distribution 47

Revision 3 - 10/28/2010 8:18:00 AM A small fraction (few percent) of iodine enters the drywell atmosphere at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months (i.e., during RPV blowdown) because of incomplete scrubbing in the suppression pool. The high flow rate, combined with the high noncondensable (hydrogen) fraction of carrier gas, reduces scrubbing efficiency during this brief period of iodine transport to containment. This iodine initially deposits on drywell surfaces, but revaporizes when corium-concrete interactions begin after lower head failure. Late revaporization of the small amount of iodine in the drywell is the primary source of iodine to the environment.

Temporal changes in the spatial distribution of cesium (Figure 20) differ from those observed for iodine. First, a much larger fraction of the cesium inventory remains deposited on in-vessel structures during the early phase of in-vessel damage progression than is observed for iodine.

When reactor vessel blowdown occurs at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , a significant, but smaller, fraction of cesium is airborne in the vessel atmosphere. Therefore, a smaller quantity is promptly swept into the wetwell following SRV seizure. In contrast to iodine, for which nearly 60% of the initial core inventory is swept into the suppression pool during RPV blowdown, less than 20% of the cesium inventory is transported to the torus at the same time. Revolatilization and transport of deposited cesium to the suppression pool prior to vessel breach are also less than that observed for iodine. Approximately 33% of the cesium is transported to the pool prior to lower head failure, whereas nearly 90% is observed for iodine.

These differences in iodine and cesium behavior can be attributed to differences in the physical properties of their dominant chemical forms. As mentioned earlier, iodine is transported as Csl.

The cesium contribution to CsI represents only 6% of the total cesium inventory. The vast majority (approx. 90%)16 of the cesium inventory is transported in the form of cesium molybdate (Cs 2MoO 4). Cesium molybdate is less volatile than the iodide and remains deposited on in-vessel structures at significantly higher temperatures. The in-vessel temperature history calculated for the long-term station blackout creates a thermal environment that promotes the evaporation of CsI relative to that of Cs 2MoO 4. Therefore, iodine is preferentially transported to the torus, but cesium remains deposited on in-vessel structures.

The suppressed mobility of cesium compared to iodine also affects the ultimate quantity transported to environment. Because the amount of cesium swept into the suppression pool during reactor vessel blowdown at 11.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months is a small fraction of the total core inventory, carry-over into the drywell atmosphere (because of inefficient pool scrubbing) is negligible.

Therefore, the amount of cesium in the drywell atmosphere at the time of containment failure (19.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ) is also very small. In contrast to the iodine release, which is dominated by an early

'puff release immediately accompanying containment failure, the cesium release is characterized by a small, protracted release that begins after containment failure. The primary mechanism for this long-term release is the slow revolatilization of cesium deposited on RPV internal surfaces.

The behavior of tellurium (Figure 21) is similar to that described above for iodine, and is not described in further detail here. Release of the heavy non-volatile species (e.g., cerium) differs substantially from the trends described above for volatile species. As indicated in Figure 22, the 16 The remaining fraction is cesium located in the fuel-cladding gap.

48

Ponpav, 5ý dL Revision 3 - 10/28/2010 8:18:00 AM release of these radio-elements does not begin until after vessel breach, when MCCI occurs on the drywell floor. Release of cerium and other non-volatile species (e.g., La and Ru) from fuel debris begins soon after vessel breach when MCCI is most aggressive. As indicated in Figure 23, the temperature of ex-vessel debris decreases significantly as it spreads across the drywell floor from its initial point of arrival in the reactor pedestal. This greatly reduces the rate at which the non-volatile species are released.

3000 2500 72000 1500 0.

E I-1000 500 0

Ex-vessel Debris Temperatures

-CAVO:

In-pedestal CAVI: Quarter-floor outside doorway

-CAV2:

Remainder of DW floor

£ 0

10 20 30 40 time [hr]

Figure 23 LTSBO Ex-vessel Debris Temperatures 50 49

75pepleL Revision 3 - 10/28/2010 8:18:00 AM 5.2 LTSBO-Base Case The key events for LTSBO with mitigative actions (discussed in Section 3.1.3) are listed in Table 4.

Table 4 Timing of Key Events for Mitigated Long-Term Station Blackout Mitigated LTSBO Event with 4 hr (Time in hours unless noted otherwise)

DC power Station blackout - loss of all onsite and offsite AC power.

0.0 Automatic reactor scram and containment isolation 0.0+

Low-level 2 and RCIC actuation signal 10 minutes Operators manually open SRV to depressurize the reactor vessel 1.0 RPV pressure first drops below LPI setpoint (400 psig) 1.2 Operators take manual control of RCIC; flow throttled to maintain level 2.0 within range (+5 to +35 in)

Portable electric generated positioned, started and connected to remote panel 1.0 to 4.0 Station batteries depleted 4.0 Operators position, align, and start portable pump to replace RCIC as injection 4.0 to 10.0 source High suppression pool temperature isolation signal for RCIC 10.0 Calculation terminated 24 5.2.1 Thermal Hydraulic Response As in the unmitigated case, the operator manually opens a safety relief valve (SRV) to reduce pressure in RPV. When the station batteries are exhausted, a portable power supply is engaged to sustain the open SRV in the mitigated case. This maintains the RPV at a stable pressure at or above 125 psig as directed in the Special Event Procedure SE-11. This is shown in Figure 24.

The coolant level history for the mitigated long-term station blackout is plotted in Figure 25.

The core temperature history for the mitigated long-term station blackout is shown in Figure 26.

No plot was included for the long-term station blackout lower head temperature history because the mitigated case does not result in core damage. The curve would be a flat line at nominal shutdown conditions. The containment pressure history for the mitigated long-term station blackout is shown in Figure 27. The operator actions are labeled in the plot.

50

op

0410, Revision 3 - 10/28/2010 8:18:00 AM 1400 1200 1000 U) fA 800 600 400 200 0

0 2

4 6

8 10 12 14 16 time [hr]

18 20 22 24 Figure 24 Mitigated LTSBO Vessel Pressure 700 600 500

..J 400 300 200 0

100 Operator manually opens 1 SRV I.........

L Op erator takes manual control of RCIC

-Automatic RCIC actuation Reactor Water Level

-In-Shroud Downcomer

- TAF

- BAF

- - - Steam Line Nozzle j High Supp. Pool Temp RCIC Isolation 0

0 2

4 6

8 10 12 14 time (hr) 16 18 20 22 24 Figure 25 Mitigated LTSBO Coolant Level 51

Revision 3 - 10/28/2010 8:18:00 AM 1000 900 800 700 E

600 500 400 Maximum Cladding Temperature in Core 0

2 4

6 8

10 12 14 16 18 20 22 24 time (hr)

Figure 26 Mitigated LTSBO Core Temperature 30 25

'* 20 0.

2 15 (L 10 5

0 0

2 4

6 8

10 12 14 16 18 20 22 24 time [hr]

Figure 27 Mitigated LTSBO Containment Pressure 52

PeC Revision 3 - 10/28/2010 8:18:00 AM 5.2.2 Radionuclide Release No plots were included for the iodine fission product distribution history, cesium fission product distribution history, barium fission product distribution history, cerium fission product distribution history, or environmental release history of all fission products resulting from mitigated long-term station blackout because the mitigated case does not result in core damage. All the curves would be flat lines at nominal shutdown conditions.

5.3 Short-Term Station Blackout - Unmitigated Response The general response of plant equipment and operating personnel to the STSBO closely resembles the unmitigated LTSBO scenario. Therefore, the reader is referred to Section 5.1 for a description of the actions that plant personnel would take in response to this type of event. A key difference, however, is the early failure of DC power, which significantly reduces the time available for intervention and accelerates the time line of damage progression.

The accelerated event chronology is evident in Table 5, which indicates the onset of core damage (measured as the first time at which fuel cladding fails) occurs approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the initiating event in the short-term scenario, whereas the same condition occurs 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months later in the long-term scenario where station batteries (DC power) ensure coolant makeup for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .17 Late phases of in-vessel damage progression also proceed at a relatively rapid pace because of the higher levels of decay power retained in the core. For example, reactor vessel dryout occurs approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after core debris relocates into the lower plenum in the short-term scenario, whereas it takes nearly 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months in the long-term scenario. As noted later, these differences have a relatively minor impact on the quantity of activity released to the environment; but they do impact the time at which a release begins, and therefore may impact the assessment of offsite health consequences.

5.3.1 Thermal Hydraulic Response The initiating event causes a prompt failure of all AC and DC power supplies to plant equipment and instrumentation. Reactor control blades, MSIVs, and containment isolation valves would all move to their fail-safe positions (inserted and closed). Isolation of the reactor coolant system causes reactor pressure to rise to the set point of the SRVs, which open and direct coolant to the pressure suppression pool. As shown in Figure 28, reactor pressure is maintained at approximately 1120 psia, as the SRV with the lowest set point cycles open/close for approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .' 8 Actions taken by plant operations personnel to manually reduce reactor pressure and prevent frequent cycling of the SRVs are assumed to not be successful. This is because control power to necessary equipment (e.g., SRV solenoid control valves) would not be available and manual actions to open alternative steam relief paths are assumed to be inhibited by obstacles preventing access to plant equipment (a result of the severity of the initiating event.)

17 The delayed time to the onset of core damage in the long-term station blackout is not proportional to the duration of DC power or coolant makeup due to the nonlinear change in core decay heat with time.

18 A second SRV periodically opens during the first 45 minutes of the transient, when decay heat levels remain high. However, after this point in time, only one valve is cycling.

53

qOEtAC4PIOIVL Revision 3 - 10/28/2010 8:18:00 AM Table 5 Timing of Key Events for the Unmitigated Short-term Station Blackout Time Event (hr)

Station blackout - loss of all onsite and offsite AC power 0.0 Low-level 2 and RCIC actuation signal 10 minutes Downcomer water level reaches top of active fuel 0.5 First hydrogen production 1.0 First fuel-cladding gap release

._1.0 First channel box failure 1.2 Reactor vessel water level reaches bottom of lower core plate 2.0 SRV sticks open due to excessive cycling 2.0 RPV pressure decreases below LPI set point (400 psi) 2.3 First core support plate localized failure in supporting debris 2.6 Lower head dries out 3.5 Ring 5 CRGT Column Collapse [failed at axial level 2]

5.5 Ring 3 CRGT Column Collapse [failed at axial level 2]

5.8 Ring 1 CRGT Column Collapse [failed at axial level 1]

5.9 Ring 4 CRGT Column Collapse [failed at axial level 1]

6.1 Ring 2 CRGT Column Collapse [failed at axial level 1]

6.1 Lower head failure (yield from creep rupture) 7.9 Drywell shell melt-through (leakage into torus room of reactor building) 8.2 Refueling bay to environment blowout panels open 8.2 Hydrogen burns initiated in torus room (basement) of reactor building 8.2 Door to environment through railroad access opens from overpressure 8.2 Blowout panels from RB steam tunnel to turbine building open 8.2 Steel roof of reactor building fails due to over-pressure 8.4 Reactor Pedestal through-wall erosion 11.1 Time Iodine release to environment exceeds 1%

8.5 Total In-vessel H2 production (kg) 1142.

Calculation terminated 48.0 Two hours after the initiating event, the (single) cycling SRV sticks in the open position, causing a rapid depressurization of the reactor coolant system.'

The continuous discharge of steam through the open SRV accelerates the rate at which the coolant inventory is depleted from the The time (or cycle) at which an SRV would fail to reclose is determined by calculating the cumulative probability of failure, based on the total number of cycles and the probability of failure on demand. The latter is taken from the Individual Plant Examination (IPE) for Peach Bottom, which reports a value of 3.7E-3 per demand. This value is larger than the industry average value of 8E-4/demand reported in NUREG/CR-6928, and is assumed to be representative of plant-specific performance. In the MELCOR model, the valve sticks in the open position when the cumulative probability of failure exceeds 0.9 (i.e.,

90% confidence of failure.)

54

P179CIAI$

Revision 3 - 10/28/2010 8:18:00 AM RPV. Figure 29 shows the two-phase reactor mixture level in the downcomer and within the core shroud. Both levels show a sharp decrease at 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , corresponding to the time of reactor blowdown through the open SRV. The steam flow produced by the flashing of residual water into steam temporarily cools over-heated fuel and in-core debris (Figure 30), but also reduces the in-core mixture level well below the elevation of the lower core plate. Within an hour (i.e., less than 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months after the initiating event), the lower core plate yields, and debris begins to relocate into the lower plenum.

Debris that pours into the body of water in the lower head is cooled because of fragmentation as it travels through water and is then cooled via bulk boiling on surfaces of the resulting debris bed. This effect is shown in Figure 31, which shows the calculated temperature of debris along the inner surface of the lower head. When residual water is completely evaporated, debris temperatures begin to rise, exceeding the melting temperature of stainless steel (1700 K) in approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . Rising debris temperatures also cause the temperature of the lower head to increase, as indicated in Figure 32. Because reactor vessel pressure is relatively low during this heat up, failure of the lower head is from creep rupture at high temperature.20 1400 0.

0)

U)

(I)

I-.

1200 1000 800 600 400 200 0

0 2

4 6

8 10 12 14 16 18 20 22 24 time [hr]

Figure 28 STSBO Reactor Pressure 20 The inner surface temperature of the central region of the lower head (MELCOR rings 1-4) is above the melting point of steel at the time failure occurs.

55

PApe~oN/L Revision 3 - 10/28/2010 8:18:00 AM 600

,-, 500 400

_J 300 0*= 200 0.

0 I-100 L

RPV Water Level In-Shroud Downcomer

- TAF

- BAF S/RV sticks in open position Elevation of top of jet pumps

"- Elevation of downcomer baffle plate Initial debris relocation into lower head 0

0 2

4 6

8 10 12 14 time (hr) 16 18 20 22 24 Figure 29 STSBO Reactor Vessel Water Level 3000 2500 2000 1500 0

E 0

1000 500 0

Cladding Temperatures at Core Mid-plane

-Ring 1I 0

-Ring 2

.0

-Ring 3

Ring 4 Ring 5 0 Indicates failure of intact fuel at this location 0

1 2

3 4

5 6

7 8

9 10 time [hr]

Figure 30 STSBO Fuel Cladding Temperatures at Core Mid-plane 56

PA/i~6/

Revision 3 - 10/28/2010 8:18:00 AM 2500 2000 a 1500 0.

E 1000 I,-

500 0

0 1

2 3

4 5

6 7

8 9

10 time [hr]

Figure 31 STSBO Temperatures of Core Debris along Inner Surface of Lower Head 2200 Lower head failure 2000 Lower Head Temperatures 1800 Ring 1 - Inner Surface

- Ring 1 - Outer Surface

-Ring 2 - Inner Surface 1600 Ring2-Outer Surface

-Ring 3 - Inner Surface

-)

-Ring 3 - Outer Surface 1400

-Ring

- Inner Surface Ring 4 - Outer Surface 4

1200

-Ring 5 - Inner Surface E

Ring 5 - Outer Surface I-1000 800 Lower head dryout -,

6 0 0 i

400 0

1 2

3 4

5 6

7 8

9 10 time [hr]

Figure 32 STSBO Inner/Outer Surface Temperatures of Lower Head 57

1.,

.~..

P10445#e Revision 3 - 10/28/2010 8:18:00 AM Failure of the lower head (at 7.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months ) results in the rapid ejection of over 100 metric tons of core debris onto the floor of the reactor pedestal in the drywell. The composition of this debris (at the time of head failure) is a mixture of molten stainless steel (-1/3 by mass), unoxidized zirconium (- 12%), and particulate debris containing U02 and metallic oxides (remainder).

Before the reactor vessel lower head fails, thermodynamic conditions in the containment are governed by the release of hydrogen through the open SRV to the torus. The large quantity of hydrogen (over 1100 kg within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ), combined with the small free volume of the containment, results in a significant increase in pressure. The containment pressure history is shown in Figure 33. Immediately prior to lower head failure, containment pressure is approximately 41 psig. The energy accompanying the discharge of molten core debris after lower head failure causes this pressure to increase to 67 psig before containment failure occurs because of thermal failure of the drywell shell (discussed below).

In contrast to the long-term station blackout (refer to Section 5.1.1), containment pressure immediately following reactor vessel failure is well below the threshold for induced leakage through the drywell head flange (80 psig). Therefore, leakage from containment does not occur by this mechanism. The lower pressure in the short-term scenario is a result of a reduced period of reactor steaming to the suppression pool (prior to the onset of core damage). Torus water temperature remains subcooled (relative to atmospheric conditions) throughout the entire period of in-vessel core damage progression. Therefore, steam contributions to containment pressure are negligible.

80 70 60

050 2 40 230 0.

20 10 0

0 5

10 15 20 25 time [hr]

Figure 33 STSBO Containment Pressure History 58

X iKI

ý l

Revision 3 - 10/28/2010 8:18:00 AM Containment conditions change dramatically, when,.debris is released onto the reactor pedestal floor following lower head failure. The abse'ice of water on the drywell floor allows debris to flow laterally out of the cavity through the open personnel access doorway and spread out across the main drywell floor. Lateral movement and spreading of debris across the drywell floor allow debris to reach the steel shell at the outer perimeter of the drywell within 10 minutes.

Five minutes later, thermal attack of the molten debris against the steel shell results in shell penetration and opening of a release pathway for fission products into the basement (torus room) of the reactor building. This results in a rapid depressurization of the containment to atmospheric conditions in a short time (less than one hour).

Immediately following drywell shell melt-through, hydrogen is released from the drywell into the basement of the building (i.e., torus room) and is transported upward through open floor gratings into the ground level of the reactor building. Flammable mixtures quickly develop in these regions, which are assumed to ignite from high flammable gas concentration and high gas effluent temperatures (exceeding 1500 K near the floor of the drywell.) The resulting pressure rise within the building causes several doorways within the building to open, including the large equipment access doorway at grade level and the blow-out panels in the side walls of the refueling bay near the top of the building. This combination of two large openings in the reactor building creates an efficient transport pathway for material released from containment to the environment. That is, a vertical column of airflow is created within the building, whereby fresh air from outside the building enters through the open equipment doors at grade level, rises upward through the open equipment hatches at every intermediate floor within the building, and exits through the blowout panels at the top of the building. As will be shown in the next section, retention of fission products in the reactor building is small for most species because of the chimney effect that is created by this flow pattern.

5.3.2 Radionuclide Release The release of radionuclides immediately accompanying containment failure (i.e., the puff release) is the dominant contributor to the early release of activity to the environment. This differs from the release calculated for the LTSBO scenario, which began with enhanced leakage through the drywell head flange and then increased a few minutes later when drywell shell melt-through occurred (refer to Section 5.1.2). As noted above, the early, enhanced leakage through the drywell head flange is not predicted in the STSBO scenario due to relatively lower pressure within containment up to, and soon after, the time of lower head failure. Rather, releases from the containment result exclusively from containment depressurization accompanying drywell shell melt-through. The fractional release to the environment for all radioactive species is shown in Figure 34. An expanded view of the release fractions for volatile species is shown in Figure 35.

59

PleVOCL Revision 3 - 10/28/2010 8:18:00 AM 0

C 2

0 0

0 1.E+00 1.E-01 1.E-02 1.E-03 1.E-04 1.E-05 1.E-06 0

5 10 15 20 25 30 35 40 45 50 time [hr]

Figure 34 STSBO Environmental Source Term 1.E+00 0

C C

0 U

0 C0

.2 4-(_

i-1.E-01 1.E-02

_i_

0 5

10 15 20 25 30 35 40 45 50 time [hr]

Figure 35 STSBO Environmental Source Term: Details for Volatile Species 60

P/

09 tXpeA L

Revision 3 - 10/28/2010 8:18:00 AM Figure 36 summarizes the spatial distribution of the total iodine inventory as a function of time.

Similar information is shown in Figure 20 for cesium and Figure 21 for tellurium. Collectively, these figures provide useful information about the mobility of different radionuclide species and temporal changes in their location. For example, next to noble gases, iodine is the most volatile radionuclide group. In the SOARCA calculations, all iodine is assumed to be transported in the form of CsI, which vaporizes at relatively modest temperatures for a severe accident. As a result, CsI is released from fuel during the early phases of in-vessel core damage progression, and a significant fraction remains airborne because of relatively high temperatures of structures within the reactor vessel. Airborne iodine is efficiently transported to the wetwell through the operating SRV. Approximately 60% of the initial core inventory of iodine is discharged to the suppression pool during the blowdown of the reactor vessel that accompanies SRV seizure at 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . During the succeeding 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , most CsI initially deposited on reactor vessel internal structures after RPV blowdown evaporates from the surfaces because of decay heating, and is swept into the suppression pool.

0.9 0.8 0

C, 0.7 0

0.6 0.

0'U 0.5 0.4 o 0.3

0.2 LI..

0.1 0

0 10 20 30 40 time [hr]

Figure 36 STSBO Iodine Fission Product Distribution 50 61

/irvty

)L Revision 3 - 10/28/2010 8:18:00 AM 0.9 0.8 0

c0.7 0.6 0

0.5 0.4 f*-o 0.3 0

~0.2 U.

0.1 0

0 10 20 30 40 time [hr]

Figure 37 STSBO Cesium Fission Product Distribution 50 0.9 0.8 0

0.7 0.6 0t.

0.5 0.4 o 0.3 C

0 0.2 0.1 0

0 10 20 30 40 time [hr]

50 Figure 38 STSBO Tellurium Fission Product Distribution 62

V V

A NRevision 3-10/28/2010 8:18:00 AM A very small fraction (<1% percent) of iodine is carried into the drywell atmosphere at 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (i.e., during RPV blowdown) as a result of incomplete scrubbing in the suppression pool. The high gas flow rate, combined with the high non-condensable (hydrogen) fraction of carrier gas, reduces scrubbing efficiency during this brief period of iodine transport to containment. This small quantity of iodine initially deposits on drywell surfaces, but revaporizes when drywell atmosphere temperatures increase after lower head failure resulting from corium-concrete interactions. Late revaporization of this small amount of iodine in the drywell represents approximately one-half of the iodine source term to the environment within the first few hours of containment failure. The balance comes from a slow evaporation of iodine from surfaces of the main steam lines and other reactor coolant system structures.

Retention of iodine in the reactor building is shown in Figure 366 to be small, but not negligible.

Approximately 15% of the total activity released from containment is captured on surfaces within the building. Similar amounts are observed for other species, except of course noble gases.

Temporal changes in the spatial distribution of cesium (Figure 37) differ from those observed for iodine. First, a much larger fraction of the cesium inventory remains deposited on in-vessel structures during the early phase of in-vessel damage progression than is observed for iodine.

When reactor vessel blowdown occurs at 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , a significant, but smaller, fraction of cesium is airborne in the vessel atmosphere. Therefore, a smaller quantity is promptly swept into the wetwell after SRV seizure. In contrast to iodine, for which 60-70% of the initial core inventory is swept into the suppression pool during RPV blowdown, approximately 25% of the cesium inventory is transported to the torus at the same time. Revolatilization and transport of deposited cesium to the suppression pool prior to vessel breach are also less than that observed for iodine.

Approximately 42% of the cesium is transported to the pool prior to lower head failure, whereas twice this fraction is observed for iodine. The reader is referred to Section 5.1.2 for a discussion of the reasons for the differences in iodine and cesium behavior (i.e., differences in their dominant chemical forms).

In the long-term (beyond 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ), a second phase of release to the environment is observed for the more volatile fission product species (iodine and tellurium in particular). The source of this release is re-vaporization of material deposited on surfaces of the reactor pressure vessel and appended piping when fission products were first released from damaged fuel. The principal location of this late-evolving material is reactor recirculation loop piping, which is attached to the downcomer portion of the reactor pressure vessel (refer to Figure 11) The vast majority of water in the recirculation loops remains trapped in low elevations of the system long after the RPV itself has dried out, and debris has relocated onto the drywell floor. Approximately 8% of the iodine inventory and 12% of the tellurium inventory are carried into recirculation loop suction piping during the late stages of in-vessel core damage where it deposits (mostly on the surface of water the piping.) After core debris leaves the reactor vessel following lower head failure, residual water in recirculation loop piping continues to slowly evaporate because of decay heating from retained fission products and (more importantly) from external heating by the very high drywell atmosphere temperatures generated by corium-concrete interactions.

Approximately 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months after lower head failure (28 hours3.240741e-4 days 0.00778 hours 4.62963e-5 weeks 1.0654e-5 months into the scenario), recirculation loop piping dries out, and captured fission products are left resting on the inner surface of dry piping.

63

P16epqAor Revision 3 - 10/28/2010 8:18:00 AM Continued heating causes the volatile species to evaporate and be released through the open reactor pressure and drywell, and into the environment. As indicated in Figure 36 and Figure 38, this late release results in a two-to four-fold increase in the total fractional release of iodine and tellurium to the environment. This same phenomenon is not observed in the LTSBO scenario within the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months window of the analysis.

5.4 STSBO-Sensitivity Case with RCIC blackstart at 10 Minutes and without B.5.b Equpiment.

The chronology of events in this scenario lies between those reflected in the unmitigated LTSBO (Section 5.1) and the unmitigated STSBO (Section 5.3) scenarios. High pressure injection via operation of the RCIC system is available for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months in the LTSBO scenario but is assumed unavailable in the unmitigated STSBO scenario. The situation examined in this section is an intermediate possibility that assumes RCIC does not automatically start (in response to a decrease in reactor water level) because of the unavailability of AC and DC power supplies,21 but operators are assumed to start the system by following the "blackstart" procedure. This procedure provides specific instructions for manually opening steam supply valves to the RCIC turbine and coolant discharge valves between the pump to the reactor pressure vessel. Once RCIC is started through this procedure, it is assumed to run a full capacity.2 The calculated chronology of key events for this scenario is summarized in Table 6.

2 1 This is the situation discussed in Section 5.3.

22 Reactor level instrumentation and associated RCIC control signals to regulate turbine speed, which adjusts the injection flow rate would not be available, so the system is assumed to run without interruption.

64

C AL Revision 3 - 10/28/2010 8:18:00 AM Table 6 Timing of Key Events for the Short-term Station Blackout with RCIC Blackstart Time Event (hr)

Station blackout - loss of all onsite and offsite AC power 0.0 Low-level 2 and RCIC actuation signal (RCIC black start time) 10 minutes Reactor vessel over-fill, RCIC steam line floods, RCIC flow terminates 1.7 Downcomer water level reaches TAF 4.1 First hydrogen production 5.0 First fuel-cladding gap release 5.0 First channel box failure 5.3 Reactor vessel water level reaches bottom of lower core plate 6.3 SRV sticks open due to excessive cycling [P(fail) > 0.9]

6.3 RPV pressure decreases below LPI setpoint (400 psi) 6.5 First core support plate localized failure in supporting debris 7.0 Lower head dries out 8.0 Rings 1-3 CRGT Column Collapse [failed at axial level 1]

11.1 - 11.3 Ring 4 CRGT Column Collapse [failed at axial level 2]

12.6 Ring 5 CRGT Column Collapse [failed at axial level 2]

12.9 Lower head failure (yield from creep rupture) 13.2 Start of drywell head flange leakage (leakage into DW head enclosure) 13.2 Deflagration within DW head enclosure (auto-ignition assumed) 13.2 Refueling bay to environment blowout panels open 13.3 Drywell shell melt-through (leakage into torus room of reactor building) 13.4 Hydrogen bums initiated in torus room (basement) of reactor building 13.4 Door to environment through railroad access opens due to overpressure 13.4 Blowout panels from RB steam tunnel to turbine building open 13.4 Hydrogen burns propagate upward in reactor building from basement 13.4+

Steel roof of reactor building fails due to over-pressure 13:7 Reactor Pedestal through-wall erosion 18.1 Time Iodine release to environment exceeds 1%

13.5 Total In-vessel H2 production (kg) 1356.

Calculation terminated 48.0 5.4.1 Thermal Hydraulic Response Early manual actuation of RCIC has a significant impact on the thermal-hydraulic signature for the STBO scenario. As illustrated in Figure 39 and Figure 40, operation of RCIC reduces reactor vessel pressure23 and restores reactor water level. Once this is started, operators are 23 RCIC operation influences reactor pressure by providing a mechanism for steam relief.

65

ýRýOE9610)&L Revision 3 - 10/28/2010 8:18:00 AM assumed to set RCIC turbine speed at its nominal, full-flow position (i.e., the absence of reactor level indication 24 precludes an informed judgment of the required RCIC flow rate and adjusting RCIC flow is not credited in this analysis.) Nominal RCIC flow is greater than the coolant evaporation rate and the reactor water increases steadily for approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . At 1.7 hrs, the reactor water level reaches the elevation of main steam line nozzles. The steam lines subsequently flood with water, causing the RCIC turbine steam extraction line to flood, thereby terminating RCIC operation.

The large volume of water discharged into the reactor vessel prior to the permanent loss of all forms of coolant injection extends the chronology of subsequent events in comparison to the STSBO scenario described in Section 5.3. Comparing the times of key events in Table 6 to those in Table 5 (for the unmitigated STSBO), core uncovery and the onset of fuel damage are delayed by nearly 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . As described below, this delay extends to 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months by the time containment failure and the beginning of radiological releases to the environment occurs. Details of the in-vessel fuel damage progression are not repeated here because they are quantitatively similar to the unmitigated STSBO, with a 4 to 5 hour5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months delay.

20 0~

1400 1200 1000 800 600 400 200 0

0 2

4 6

8 10 12 14 16 18 20 22 24 time [hr]

Figure 39 Reactor Vessel Pressure: STSBO with RCIC Blackstart 24 Failure of reactor vessel level instrumentation precludes effective throttling of RCIC flow to maintain level within range 66

P,4d64<//A Revision 3 - 10/28/2010 8:18:00 AM 700 600

4) 500 CD 400 300 C. 200 0

1-100 RCIC steam line floods--

termination of injection RPV Water Level In-Shroud Downcomer

- TAF

- BAF

- - - Main Steam Nozzle SRV sticks open, initiating RPV blowdown

...................... Elevation of top of jet pumps T :- ----

Y* Initial debris relocation.

into lower head I

I I

I 0

0 2

4 6

8 10 12 14 16 18 20 22 24 time (hr)

Figure 40 Reactor Vessel Water Level: STSBO with RCIC Blackstart 5.4.2 Radionuclide Release As in the unmitigated STSBO, the release of radionuclides immediately accompanying containment failure is the dominant contributor to the release of activity to the environment.

Releases from the containment result initially (and mostly) from containment depressurization accompanying drywell shell melt-through. A later increase in the release of iodine begins 43 hours4.976852e-4 days 0.0119 hours 7.109788e-5 weeks 1.63615e-5 months into the sequence as a result of revaporization of CsI and, to a lesser extent, tellurium initially deposited on surfaces within the reactor coolant system. The fractional release to the environment for all radioactive species is shown in Figure 41. An expanded view of the release fractions for volatile species is shown in Figure 42.

67

Revision 3 - 10/28/2010 8:18:00 AM 1.E+'00 I.E-Ol NG Te Cs 0

04 0

0 0

BBa

~

1.E-02 +

1.E-03 1.E-04 I.E-05 1.E-06 Fission Products in Environment

-Containment failure Ce SnMo La Ru 4 -

P -

0 5

10 15 20 25 time [hr]

30 35 40 45 50 Figure 41 STSBO with RCIC Blackstart Environmental Source Term 1.E+00 0

0) 01.E-0 0

1.0 0 0

5 10 15 20 25 time [hr]

30 35 40 45 50 Figure 42 STSBO Environmental Source Term: Details for Volatile Species 68

X 9 Revision 3

- 10/28/2010 8:18:00 AM 5.5 Loss of Vital AC Bus E Sensitivity Cases without B.5.b Equiptment The scenario event progression (Table 7) assumes operators follow the actions directed in Trip Procedure T-101 [5] (reactor pressure vessel control). The estimates of the time at which actions would be taken are based on a table-top exercise with plant operations personnel during a site visit in June 2007. The plant operations personnel would take approximately 15 minutes to assess the situation before taking action. During this time, RCIC would actuate and cycle as needed to maintain level. Additionally, one or more SRVs would cycle to control RPV pressure.

These systems are assumed to operate automatically based on nominal actuation and termination/closure set points; manual intervention is assumed unnecessary and is not credited within this initial time period.

The loss of vital electric power (i.e., the initiating event) results in reactor scram, closure of the main steam isolation valve (MSIV), and containment isolation. In response to this scenario, the operator would be directed, in part, by the Trip Procedure T-101. This procedure provides instructions for managing reactor power, water level, and pressure.

Within Trip Procedure T-101, step RC/L-3 directs the operators to restore and maintain level between +5 and +35 in. (+177 to +206 in. above TAF) using, in order of priority:

" Feedwater

" Control Rod Drive Hydraulic System (CRDHS)

Reactor Core Isolation Cooling

" High Pressure Coolant Injection

Condensate

Core Spray

" Low Pressure Coolant Injection Feedwater is not available in this scenario. However, CRDHS continues to operate at its nominal (post-scram) flow rate without operator intervention.25 RCIC is also available and would start automatically upon receipt of a low-level 2-signal (level less than +66 inches).

Long-term operation of these two systems alone provides sufficient makeup to maintain level.

However, RCIC flow terminates in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months when power from station batteries depletes.

Parametric MELCOR calculations described in Section 5.5.2 indicate battery durations (i.e.,

RCIC operation) greater than 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months is sufficient for long-term operation of CRDHS alone to prevent core damage in the long term. Therefore, best-estimate MELCOR analysis concludes this scenario would not lead to core damage as (conservatively) identified in the NRC SPAR model. Additional details of the calculation are provided below.

25 The procedure directs operators to maximize the control rod drive hydraulic system flow using procedure T-246, but the second pump is not available in this scenario. The only action that can be taken to increase flow is to open the pump discharge throttle valve, which is assumed to occur 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the initiating event. The licensee estimates this would increase maximum flow (at full pressure) from 110 gpm to 140 gpin.

69

PEe)P~L Revision 3 - 10/28/2010 8:18:00 AM Table 7 Timing of key events for Loss of Vital AC Bus E-12 Time Event Description (hr)

Loss of Vital DC Bus E-12 0.0 MSIV Closure, Reactor Scram and Containment Isolation 0.0+

RCIC Automatically Starts because of Low Rx Water Level 0.2 Operators Begin Manual Depressurization (open 1 SRV) 1.5 Operators Take Manual Control of RCIC to Maintain Level within Range 2.0 Station Battery Supply Exhausted, SRV Recloses and RCIC operation terminates*

4.0 Operators Secure the Single CRDHS Pumpto Prevent Reactor Overfill 4.3 Reactor Pressure Back to SRV Relief Setpoint (SRV Automatically Cycles) 6.0 Operator Restarts Single Control Rod Drive Hydraulic System Pump to Restore 7.0 Level Cycling SRV Fails to Reclose After Several Hundred Cycles; Reactor 13.5 Depressurizes Reactor Water Level Briefly Decreases Below Top of Active Fuel 13.8 Level Restored Above Top of Active Fuel 16.0 Level Fully Recovered to Nominal (Sequence Terminated) 21.0 As noted in the text, termination of RCIC operation following a loss of DC power is a conservative assumption. An equally valid possibility is that the system would continue operating at a fixed speed until the system is manually secured.

5.5.1 Thermal Hydraulic Response Step RC/P-5 of the Trip Procedure T-101 directs operators to take manual control of the SRV if they are cycling (i.e., opening automatically at their lift setpoint.) Step RC/P-6 further directs them to open the SRV until the reactor pressure vessel pressure decreases below 950 psig. A quantitative target for the reactor pressure vessel pressure is not prescribed in the procedure, particularly if reduced pressure would not challenge the viability of coolant injection.26 Preliminary MELCOR calculations indicated that lead SRV would cycle approximately fifty times prior to automatic actuation of RCIC at approximately 20 minutes into the event. Cycling.

would temporarily cease (and the reactor pressure vessel would briefly depressurize) while the RCIC operates because of the steam flow to RCIC turbine. RCIC operation temporarily terminates at 45 minutes when reactor water level is restored to the high-level setpoint.

Subsequently, RPV pressure increases and SRV cycling resumes.

Based on this information, operators are assumed to initiate manual depressurization of the reactor vessel 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months into the event to prevent further cycling of the SRVs. As shown in Figure 43, reactor vessel pressure decreases below 200 psig in approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Reactor vessel pressure stabilizes near 150 psig until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , when DC power is lost (station batteries exhaust), and the open SRV recloses. Reactor vessel pressure increases back to the minimum 26 It is important to note that manual safety/relief valve control requires DC power. Therefore, manual opening of a safety/relief valve is viable only while station batteries remain active or with B.5.b portable power supply.

70

Revision 3 - 10/28/2010 8:18:00 AM SRV setpoint in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . For the next 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , reactor vessel pressure is maintained at approximately 1100 psig by continuous cycling of the lowest setpoint SRV.

1200 1000 Start controlled Cycling S/RV

......sticks open depressurization 8.0 600 U)U) 0.400 station batteries exhaust 200

.. (loss of DC power; S/RV recloses) 0 0

2 4

6 8

10 12 14 16 18 20 22 24 time [hr]

Figure 43 Loss of Vital AC Bus E-12 Reactor Vessel Pressure At 13.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , after several hundred cycles, the SRV fails to reclose and the reactor vessel again depressurizes. This event represents a random failure of the SRV to reclose, which is calculated by MELCOR based on the number of valve cycles, a failure rate of 3.7E-3 per demand, and a 90% confidence level for failure.

Figure 44 shows the calculated reactor water level during the entire 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months calculation. Level initially decreases in response to reactor isolation and termination of reactor feedwater.

Twelve minutes later, RCIC automatically starts and begins to refill the reactor vessel. RCIC flow is automatically terminated at 48 minutes when level reaches the high-level setpoint. Level subsequently decreases slowly because of evaporation resulting from decay heat in the core.

At 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , when operators open an SRV to depressurize the reactor, the increased coolant discharge rate through the open SRV accelerates the rate at which reactor water level decreases.

RCIC automatically starts a second time, briefly stabilizing water level near the low-level setpoint. Two hours into the event, operators take manual control of RCIC turbine speed to reduce injection flow as needed to maintain level within range. When the depressurization transient is completed at approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , coolant effluent rate through the open SRV is reduced, and reactor water level increases back to the target range. Operators take manual control of RCIC flow during this transient and subsequently maintain the level within range for approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

71

Revision 3 - 10/28/2010 8:18:00 AM 800 Operator takes manual control of RCIC 700

/

& opens CRDHS throttle valve 70F0 6,

,Main Steam Line Nozzles 600

~CRDHS off 500 L

termination of dc power S(S/RV recloses) 0 40 TAF-300 Stat cStart controlled depressurization 200 termination of dc power BAF (S/RV recloses)

SRV sticks open 100 0,

I I

I 0

2 4

6 8

10 12 14 16 18 20 22 24 time (hr)

Figure 44 Loss of Vital AC Bus E-12 Reactor Water Level Four hours into the sequence, DC power from station batteries is exhausted. As noted earlier, this causes the open SRV to reclose, but also is assumed to cause RCIC operation to terminate.

Loss of DC power, by itself, would not necessarily cause the system to stop functioning. Steam inlet valves and coolant discharge valves, turbine speed controller, and other system components could remain fixed in the position held at the time control power expired. Mechanical trip and isolation of the RCIC system immediately following the loss of DC power is conservatively assumed in this analysis.

Between 4 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , the reactor vessel pressure slowly increases as shown in Figure 43.

During this period, coolant losses cease, but CRDHS flow continues. This causes the reactor vessel water level to increase above the upper limit of the target range specified in emergency procedures. Observing this trend, operations personnel are assumed (based on training) to manually secure the CRDHS pump to slow or terminate the increase in reactor water level with the objective of preventing water from spilling over into the main steam lines. As indicated in Figure 44, the MELCOR calculation indicates this objective would not be met because of expansion of the reactor coolant system volume as energy is gradually absorbed by the isolated reactor coolant system inventory. The steam lines begin to flood with water approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after DC power terminates and the open SRV recloses.

Approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after steam line flooding begins, reactor vessel pressure reaches the relief set point of the SRVs, and cycling with its associated discharge of reactor coolant begins anew.

The discharge of coolant through the cycling SRV and the absence of any form of active coolant injection (CRDHS remains inactive), causes the reactor vessel water level to decrease, eventually 72

P/E/

/

1XL Revision 3 - 10/28/2010 8:18:00 AM reducing below the elevation of the main steam lines and approaching the nominal range. When the level reaches the upper end of the target range (7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ), the single available CRDHS pump is restarted to compensate for coolant inventory lost through the cycling SRV.

From this point forward in the scenario, CRDHS operates continuously as the only resource of coolant makeup to the reactor vessel. The coolant delivery rate is approximately 140 gpm (maximum system flow) while the reactor vessel remains at full pressure. However, following reactor vessel depressurization at 13.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (because of SRV failure to reclose), the coolant flow rate increases to over 180 gpm, thereby allowing the reactor water level to increase back to the desired range.

The minimum water level observed in the core is well above the minimum steam cooling water level and fuel heat up, and damage is averted.27 Radionuclide Release Because core damage is averted in this scenario, a release of radionuclides from fuel does not occur and no environmental source term is generated.

5.5.2 Sensitivity Analysis Several sensitivity calculations were performed to examine the effects of alternative assumptions regarding key features of system performance. Several sensitivity calculations were performed to confirm the conclusion that adequate core cooling would be maintained in this scenario if alternative credible assumptions were made regarding key features of system performance.

Results of these calculations are described below in Section 5.5.22.

In particular, the following uncertainties were studied:

Duration of station batteries (DC power): As noted in Section 3.3.2, the actual duration of DC power from station batteries depends on several factors, including battery age and the effectiveness of actions taken by plant personnel to shed nonessential loads from the DC bus. The minimum duration required by plant technical specifications is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

However, durations longer than the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months estimate are also possible. Therefore, sensitivity calculations were performed to evaluate the minimum battery duration needed to ensure adequate core cooling in this scenario.

CRDHS coolant delivery rate: The baseline calculation described in Section 5.5.1 assumes that operators increase the flow rate from the single available CRDHS pump to its maximum capacity. This involves manual actions to open a locked throttle valve in the pump discharge line. Sensitivity calculations were performed to evaluate plant response if this action is not taken.

" Manual depressurization: Plant emergency procedures call for manual depressurization of the reactor vessel, which is assumed to occur 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the initiating event in the baseline calculation. This action has two competing effects on hydraulic behavior in the reactor pressure vessel. Reducing reactor vessel pressure increases the coolant delivery 27 The reason this sequence was identified in the SPAR model as a "core damage" sequence, but the results computed here conclude otherwise, is that the CRDHS system is not credited in the SPAR model. Operation of this system has a significant impact on plant response to the initiating event and a realistic examination of reactor hydraulic behavior leads to a conclusion of"no core damage."

73

Revision 3 - 10/28/2010 8:18:00 AM rate from the CRDHS pump, but it also increases the rate at which coolant is discharged from the vessel during the blowdown period. The importance of this action is examined in a single bounding (worst case) sensitivity calculation, which assumes that manual depressurization does not occur and operators fail to open the CRDHS throttle valve to permit maximum flow.

The results of the sensitivity calculations examining alternative values of station battery duration are summarized in Figure 45 and Figure 46. The calculations considered four distinct values of assumed station battery duration: 2, 3, 4, and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . These calculations differ slightly from the baseline analysis in two ways. First, RCIC is assumed to operate entirely as an automatic system; operator actions to take control of the system to maintain level within range are not credited. Second, manual actions to maximize CRDHS flow are not credited. The single available CRDHS pump is assumed to operate according to nominal system flow rates.

The calculated reactor water level for these sensitivity cases is shown in Figure 45and the calculated peak cladding temperature in the core is shown in Figure 46. The minimum reactor water level is shown to dip below core mid-plane in the case with 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months battery duration, and gradually higher values for longer durations. The bounding thermal response of fuel in the core (maximum cladding temperature) is also improved with increasing battery duration. Fuel cladding failure (and accompanying release of the gap inventory of radionuclides) occurs in cases with 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months battery duration or less. Peak temperatures in cases with battery duration greater than 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months are below values at which clad failure would be anticipated (approximately 1200 K).

Results of sensitivity calculations for the other parameters noted above are listed in Table 8.

Neglecting the beneficial effects of operator actions to control CRDHS flow rate (maximize flow or secure system at high reactor water levels) does not alter the conclusion of no core damage.

The effects of manual depressurization, on the other hand, are potentially important. If operators fail to maximize CRDHS flow and fail to reduce reactor vessel pressure, core damage would not be avoided even if station batteries sustain RCIC flow for as much as 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

74

P111O)iL Revision 3 - 10/28/2010 8:18:00 AM 800 700

_ 600

-l 500 400 300 6 200 100 0

/---

Main Steam Line Nozzles -

6-hr 3-hr 4-hr 2-hr dc TAF

" RCIC operates via automatic cycling (no manual intervention)

" Variations in station battery duration 0

2 4

6 8

10 12 14 16 18 20 22 24 time (hr)

Figure 45 Sensitivity of Station Battery Duration: Reactor Water Level - Loss of Vital AC Bus E-12 2500 2000 0

C

0. 1500 E

I--

1000 E

E x

500 M

2-hr dc

RCIC operates via automatic cycling (no manual intervention)

Variations in station battery duration 3-hr I

4-hr 6-hr V

0 0

2 4

6 8

10 12 14 16 18 20 22 24 time (hr)

Figure 46 Sensitivity of Station Battery Duration: Peak Clad Temperature - Loss of Vital AC Bus E-12 75

PAQWO/tL Revision 3 - 10/28/2010 8:18:00 AM Table 8 Sensitivities for Loss of Vital AC Bus E-12 Maximize CRDHS CRDHS Off Flow to Prevent Re-Pressuriz RCIC (Mitigative RPV Depressurize e (SRV Sensitivity Duration Action)

Overfill (Open SRV)

Closes)

Results Base Case CRD Flow CRD Flow Battery Life 4 hrs 4 hrs 4 hrs 2-6 hrs I hr 4.3 - 7 hrs.

1.5 hrs 4 hrs No Core Damage (CD)

No Don -

.3 15 r Not Doe NtDn NotDoerNt on Not ~ ~

~

Doe

,hrson otDn 4 hrs No CD 4 hrs No CD 2-6 hrs

_> 3 hr life averts CD Depressurize 2-6 hrs Where, CD = core damage, N/A CD, no VF VF = vessel failure 5.6 Peer Review During the independent peer review of the MELCOR calculations, several modeling details were identified which merited further investigation. These issues were identified by the peer review committee because there was a sense that there is some inherent uncertainty in these modeling areas and because there is potential influence on the accident progression and/or the environmental source term. Each of the sensitivity calculations described below represents an alternative representation of the LTSBO accident scenario. The issues selected for study of the LTSBO scenario are not necessarily important to other postulated BWR scenarios.

Three broad issues were examined in the sensitivity calculations 28:

1. Containment leakage prior to failure,

2. Radionuclide transport to the suppression pool due to SRV seizure, and

3. Atmosphere mixing in the drywell.

The following sections summarize the assessment of each issue.

5.6.1 Containment leakage prior to failure The initiating event for the station blackout accident scenarios (both long-and short-term) is assumed to be a large (beyond design-basis) seismic event. The baseline calculations assume containment leakage is limited to the maximum allowable by plant-specific Technical Specifications (Tech Spec). This assumption represents more leakage than would be anticipated during normal operation because routine testing of containment leak tightness strives to control leakage well below the Tech Spec limit. However, it does not directly account for the possibility that leakage greater than the Tech Spec limit could be caused by a large seismic event.

28 The order in which these issues are discussed is solely a matter of convenience and should not be interpreted as an indication of relative importance.

76

Plpecxl Revision 3 - 10/28/2010 8:18:00 AM Two sensitivity calculations were performed to examine the impact of seismically induced increased leakage on radiological release to the environment. One case assumed a leak area three (3) times larger than the Tech Spec limit29; a second case assumed an area ten (10) times the Tech Spec limit. Increased levels of containment leakage have a very small impact on the final environmental source term as shown in Figure 47. Prior to the time of containment failure (i.e., 0 to 19.5 hrs in the LTSBO scenario), increased leakage has a small, but noticeable impact on the release of volatile iodine and cesium to the environment. However, the magnitude of release during this period of leakage is negligibly small in comparison to releases that occur shortly after containment failure.

Increased levels of containment leakage do not affect the long term release of iodine or cesium because the vast majority of volatile species are swept to the suppression pool through the open SRV. (The next section discusses this topic in more detail.) Increases in containment leakage also have a negligible effect on the long-term release of iodine and cesium to the environment.

1.E+00.

S 102 r-0 "E

Lt.

0 LL 1.E-01 1.E-02 1.E-03 1.E-04 1.E-05 1.E-06 1.E-07 1.E-08 1.E-09 1.E-10 0

.,=

0La U.

1.E-01 1.E-02 1.E-03 t 1.E-04 1.E-05 1.E-06 1.E-07 1.E-08 1.E-09 1.E-10 Cesium in Environment DW-Leakag 13X DW Leakage

-Base Case 0

12 24 36 48 0

12 24 36 48 time [hr]

time [hr]

Figure 47 Effect of Increased Containment Leakage on the Release of Iodine to the Environment 29 Containment leakage is modeled as a constant area opening in the containment pressure boundary. The actual leak rate, therefore, varies with internal pressure. Leakage corresponding to the Tech Spec limit is based on the area that would produce a leak rate of 0.5% of the containment free volume per day at an internal pressure of 56 psig. All this leakage is assumed to be located in the drywell, where the largest number of penetrations through containment pressure boundary is located.

77

ML11192A300

Text

8.0 REFERENCES

1.0 INTRODUCTION

Navigation menu

Search