Text

NUREG - 1935, State-of-the-Art Reactor Consequence Analyses (Soarca) Project, Appendix B, Surry Integrates Analysis, Working Copy Pages Only W/Handwritten Notes
	ML12124A295
Person / Time
Site:	Surry
Issue date:	02/15/2010
From:	; Office of Nuclear Regulatory Research, Sandia
To:	;
References
	FOIA/PA-2011-0083, SAND2008P - XXXX NUREG-1935
	Download: ML12124A295 (18)
	v • d • e

PVVVL Revision 1 - 2/15/2010 5:41 PM NUREG - 1935 SAND2008P - XXXX State-of-the-Art Reactor Consequence Analyses (SOARCA) Project Appendix B Surry Integrated Analysis Manuscript Completed: July 2010 Date Published: XXXX Prepared by:

Sandia National Laboratories Albuquerque, New Mexico 87185 Operated for the U.S. Department of Energy U.S. Nuclear Regulatory Commission Office of Nuclear Regulatory Research Washington, DC 20555-0001

Revision 1 - 2/15/2010 5:41 PM POb" I hour

" Use portable power supply to restore minimum instrumentation (RCS level, RCS pressure, SG level)

Manual start of EDGs and SBO diesel generator assumed to be unsuccessful due to initiating event

Offsite Emergency Operations Facility (EOF) is manned. The primary function of the EOF is review of initiating event,, plant status, and operator action to provide guidance on alternative mitigation measures. The TSC staff members are the primary users of SAMGs and mitigation measures codified in 10CFR50.54(hh). Shift supervisors and TSC supervisors are trained on these procedures.

1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

Offsite EOF reviews actions taken by operations. Recommend the following actions:

Maintain portable power supply for instrumentation

- Connect the portable, high-pressure, diesel-driven (Kerr) pump to three drain, lines Lol i~jJ 1 t5/ý-

14s-) of the rbgidi enoval pipinfnjg'or RCS makeup and use portable bottles for manual operation of SG PORVs, as needed

- Connect the portable, diesel-driven (Godwin) pump for containment spray or containment flooding 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months o Operations assesses and concurs with offsite EOF recommendations. Operations I-

,prioritizes recommendations based on plant conditions and begins implementation.

1-v 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

The TSC is manned and operational. Because of the magnitude of the seismic event, a one hour delay in reporting of TSC members was assumed. The primary function of the TSC would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigation measures.

9 Onsite EOF is manned and operational 60 minutes later.

3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months

Onsite EOF is operational.

3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

Determine the availability of the portable, diesel-driven (Godwin) pump, portable air bottles, and portable power supply (currently supplying instrumentation)

Portable air bottles ready to be connected to the steam generator PORVs for depressurizing RCS The portable diesel-driven pumps are being positioned and the connections are being assessed.

14

Revision 1 - 2/15/2010 5:41 PM

" Emergency core cooling systems are inoperable due to electrical and physical system damage

" Containment cooling systems are inoperable due to electrical and physical system damage

Recovery of offsite power is not expected during the mission time 30 minutes

Initial Operations assessment of plant status complete; Operations initiates the following action:

- Attempt manual start of EDGs and SBO diesel generator

The RCS pressure is maintained by code safety valves. The pressurizer PORVs are not currently available because loss of instrument air and backup air 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

" Use portable power supply to restore minimum instrumentation (RCS level, RCS pressure, SG level)

Manual start of EDGs and SBO diesel generator assumed to be unsuccessful due to initiating event

" The EOF is manned. The primary function of the EOF would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigation measures. The TSC staff members are the primary users of SAMGs and mitigation measures codified in 10CFR50.54(hh). Shift supervisors and TSC supervisors are trained on these procedures.

1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 0 Offsite EOF reviews actions taken by operations. Recommend the following actions:

- Maintain portable power supply for instrumentation

- Connect the portable, high-pressure, diesel-driven (Kerr) pump to three drain lines of the riduaj!, et removal pipinig and use portable bottles for manual operation of SG PORVs, as needed Connect the portable, diesel-driven (Godwin) pump for containment spray or containment flooding 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

Operations assesses and concurs with offsite EOF recommendations. Operations prioritizes recommendations based on plant conditions and begins implementation.

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

The TSC is manned and operational. Because of the magnitude of the seismic event, a one hour delay in reporting of TSC members was assumed. Theprimary function of the TSC would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigation measures.

Onsite EOF is manned and operational 60 minutes later.

3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months

Onsite EOF is operational.

16

PREDECISIONAL Revision I - 2/15/2010 5:41 PM 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

Determined the availability of the remotely located portable, diesel-driven (Godwin) pump, portable air bottles, and portable power supply (currently supplying instrumentation)

Portable air bottles ready to be connected to PORVs for depressurizing RCS

The portable diesel-driven pumps are being positioned and the connections are being assessed. iA,7-, ,v, T..Zth6 / 7?,* , p,,Iz/, .9 ,, "

6.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months /*,'. 9,Iuo *F/-a . - / , ,/* _*z_ r -,/zs-

.RCS can be depressurized using portable air bottles to control the appropriate air-operated valves] The accumulators will provide make-up to the RCS once depressurized.

. However, since the RCS hot leg failure at 3.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months had alre.dy depressurized the RCS (i.e., see Section 5.1.1), this mitigation effort is not successful.

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months pp~gx Fea W -/7,'o6 ~ -O~, 4.'

The portable, diesel-driven (Godwin) pump is connected to containment spray system and injection starts. Injection continues for 1,000,000 gallons. This mitigates the release and delays containment failure. '&.*-,*,"C*P_ UJt,*-. 6o-A4- L- t-* .A'b,,*

Q ýj,,* "

Mitigated case with thermally-induced steam generator tube rupture' *, ,------

The mitigated sensitivity case has an identical sequence of events as the mitigated base case but includes a stuck open relief valve on the secondary side that leads to a thermally-induced steam generator tube rupture. I. V r P 0 1t uA a .5;'e-e &F

' A, - .--- 6 ' p ,..., Il ý ,,. .

3 h our s

The lowest-pressure safety relief valve sticks open on the steam generator with the tube rupture.

At a time to be calculated by MELCOR (which was 3 hr 33 min) e Thermally-induced steam generator tube rupture when hot leg C cumulative creep damage index exceeds 5% (i.e., a criteria to identify hot conditions in the RCS piping and ensure that the steam generator tube fails before the hot log nozzle)

The steam generator tube rupture area is the equivalent of 100% of the tube flow area 3.2 Long-Term Station Blackout The long-term station blackout is initiated by a moderately large earthquake (0.3-0.5 peak ground acceleration - pga). It has an estimated frequency of Ixl 05 to 2x 10"5/reactor-year, which meetsthe SOARCA screening criterion of lx106/reactor-year.

Section 3.2.1 describes the initial status of the plant following the seismic event. The key system availabilities normally accessible during the course of the accident are summarized in Section 3.2.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.2.3. Section 3.2.4 delineates various scenarios based on the success of 17

PS/ AL Revision 1 - 2/15/2010 5:41 PM the mitigative actions. In particular, mitigated scenarios are defined where the mitigative actions are successful. Unmitigated scenarios are also defined where certain key mitigative measures are not successfully implemented.

For station blackout scenarios, boiling in the RCP seal could cause the spring-loaded part of the seal to pop open and stay open. As such, MELCOR modeling for Surry includes seal failure when conditions in the seal approach saturation. The hole size for this failure mode is that which produces a 180 gpm/pump flow rate at normal RCS temperature and pressure. Also, it has been hypothesized that seal failure could occur as early as 13 minutes into a station blackout scenario due to the loss of seal cooling; seal cooling requires AC power. The conditional probability this early seal failure (as early as 13 minutes) has been estimated by the industry to be 0.2 [36].

Applying this 0.2 probability to the Surry long-term station blackout scenario frequency of 1 to 2xI 0"5/reactor-year results in an event frequency of 2 to 4xl 0"6/reactor-year, which meets the SOARCA screening criteria of Ixl0 6/reactor-year. While seal failure could occur as early as 13 minutes into the scenario and could include seal failures in as many as all 3 RCPs, such early and multiple seal failures would have a lower probability. However, to examine the potential range of system response, the project staff analyzed with MELCOR long-term station blackout mitigated and unmitigated sensitivity cases assuming that the seals of all 3 RCP seals failed 13 minutes into the scenario.

3.2.1 Initiating Event The seismic event results in the loss of offsite power (LOOP) and failure of onsite emergency alternating current (AC) power resulting in a station blackout (SBO) event where neither onsite nor offsite AC power are recoverable. All systems dependent on AC power are unavailable, including the containment systems (containment spray and fan coolers). The TDAFW pu*p*i'is available initially. In the long term, the loss of the TDAFW' pump may occur due to battery depletion and loss of direct current (DC) power for sensing and control. Nominal RCP leakage occurs due to the loss of pump seal cooling (21 gpm/pump). The unmitigated and mitigated base cases includes the potential for a later thermo-mechanical RCP seal failure. In addition, unmitigated and mitigated sensitivity cases are performed that include an early RCP seal failure (i.e., at 13 minutes). ,- - , z- 1v/ce,,,99.,

v v Id,-( .

JA- , - V 1,,,

3.2.2 System Availabilities ,, (L , ,., 6', , ,, '>,/ W, The TDAFW pump is available until the emergency condensate storage tank empties. The station batteries give instrumentation until they exhaust at 8 hr. The secondary PORVs are initially available for a manual 100°F/hr system cooldown. The secondary PORVs are assumed to close following battery failure. No other systems are available.

3.2.3 Mitigative Actions The LTSBO event results in the loss of offsite and onsite AC power. Under these conditions, the TDAFW pump is an important mitigation measure. PWR emergency procedure guidelines include operation of the TDAFW pump without AC power to cope with station blackout conditions. The mitigation measures codified in 10CFR50.54(hh) have taken this a step further and also include long-term operation of TDAFW pump without DC power, methods to establish 18

E/ /

l.Revision 1 - 2/15/2010 5:41 PM instrumentations and control valves using a portable generator to supply indications such as reactor pressure and level indications. The TDAFW pump is used to cool the core until battery exhaustion. After battery exhaustion, black run of TDAFW pump is used to continue to cool the core.

The external events PRA does not describe general plant damage and accessibility following a seismic event. The damage was assumed to be widespread and accessibility to be difficult, consistent with the unavailability of many plant systems. The emergency condensate storage tank initially supplies the TDAFW pump but has finite resources (i.e., empty in -6 hours).

However, it was assessed that the operators would have sufficient time, access, and resources to make-up water for injection.

The severity of this seismic event is lower than the short-term station blackout. Consequently, the low-pressure injection and safety-related containment spray piping were also judged not likely to fail for this scenario. The integrity of this piping provided a connection point for a portable, diesel-driven pump to inject into the RCS. Licensee staff estimated that transporting the pump and connecting it to plant piping takes about two hours. Hence, the availability of the vessel injection was assessed to occur at 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , or 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after the action was recommended by the operators and support staff. Companion unmitigated analyses were also performed to quantify the response without successful mitigation by a portable pump.

In summary, the following actions are credited in the mitigated scenario calculations.

" Provide vessel injection using a portable, high-pressure, diesel-driven (Kerr) pump through three drain lines on the mgdual.at refoal-pg.ggg - A_,'. Z p /

Use portable air bottles to operate the steam generator power-operated relief valves, which allows for depressurization and cooldown of the RCS

A portable power supply is used to restore SG and RCS level indication

Manual operation of the TDAFW pump without DC power is credited

A portable, diesel-drive, low-pressure (Godwin) pump is used to Fti I the -erexency While not used in the mitigated scenario calculations, the following additional mitigative measures were identified as additional options for consideration.

" Use firewater or pumper truck for the charging pump oil cooler and use an alternative power source for high head safety injection pump RCS makeup.

" Lineup the portable, diesel-driven (Godwin) pump and firewater system for auxiliary feedwater makeup to the steam generators.

3.2.4 System Boundary Conditions Section 3.2.4.1 lists the sequence of events in the unmitigated long-term station blackout calculation. Section 3.2.4.2 summarizes the sequence of events in the mitigated long-term station blackout calculation which credits additional manual actions. Mitigated and unmitigated sensitivity cases were also performed that include an early failure of the RCP seals.

19

Revision 1 - 2/15/2010 5:41 PM The TSC and EOF review actions taken by Operations and determine the availabili the portable, diesel-driven pumps and the station pumper truck stored outside the protected area. Recommend the following actions:

- Connect the portable, high-pressure, diesel-driven (Kerr) pump to threeirainis of L* * --theresidual-heat removal piping for RCS makeup and use portable bottles for manual operation of primary PORVs, as needed.

Hook up portable power supply to power instrumentation Use the 2 firewater storage tanks (250,000 gallons per tank), the portable, low-pressure, diesel-driven (Godwin) pump, and the fire pumper truck to supply AFW suction, if necessary Setup to provide the firewater system or a portable, low-pressure, diesel-driven (Godwin) pump to the containment spray header in preparation for containment cooling 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

Operations assesses and concurs with TSC and EOF recommendations. Operations prioritizes recommendation based on plant conditions..

>1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

All mitigative actions are unsuccessful including connecting a portable, diesel-driven pump for vessel injection, refilling the water supply for the TDAFW (i.e., the emergency condensate storage tank), and maintaining instrumentation using a portable power supply 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 6 0 DC station batteries are exhausted

SG PORVs reclose

Loss of control and instrumentation for the TDAFW Unmitigated Case (without portable mitigation equipment) + early RCP seal failure Identical sequence of events as the unmitigated base case but includes an early RCP seal failure at 13 minutes.

13 minutes 0 All three RCP seals fail and leak at a nominal rate of 182 gpm per pump.

6 The Surry DC station batteries are required to last for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Initially, the licensee estimated a best-estimate life of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Following completion of the analysis, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months was thought to be more realistic. However, the ECST ran out of water at 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and stopped the TDAFW pump. Consequent, the most significant benefit of the station batteries failed at 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , which was less than the best-estimate battery life.

21

P D/L Revision 1 - 2/15/2010 5:41 PM 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months

" The offsite EOF is manned. The primary function of the EOF would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigation measures. The TSC staff members are the primary users of SAMGs and mitigation measures codified in 10CFR50.54(hh). Shift supervisors and TSC supervisors are trained on these procedures.

Operations initiate a controlled depressurization of the SGs to approximately 120 psi to achieve an RCS cooldown of < 100'F per hour by manually opening the SG PORVs.

" TSC and EOF review actions taken by Operations and determine the availability of the portable, diesel-driven pumps and the station pumper truck stored outside the protected area. Recommend the following actions:

- Connect the portable, high-pressure, diesel-driven (Kerr) pump to three drain lines of t e54tthe glat piping for RCS makeup and use portable bottles for manual operation of primary PORVs, as needed.

- Hook up portable power supply to power instrumentation

- Use the 2 firewater storage tanks (250,000 gallons per tank), the portable, low-pressure, diesel-driven (Godwin) pump, and the fire pumper truck to supply AFW suction, if necessary

- Setup to provide the firewater system or a portable, low-pressure, diesel-driven (Godwin) pump to the containment spray header in preparation for containment cooling 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

Operations assesses and concurs with TSC and EOF recommendations. Operations prioritizes recommendation based on plant conditions and begins implementation.

P(V?@ 900 S#

3.5 ho r111e 7 ~

The Kerr pump provides emergenc4* pm makeup flow to the RCS -- " 5 A portable power supply provides to power to the instrumentation TDAFW pump maintaining S/G level Pre-staging and lineups are ongoing for other mitigation measures:

- Setup to provide the firewater system or the a portable, low-pressure, diesel-driven (Godwin) pump to the containment spray header in preparation for containment cooling

- Use the 2 firewater storage tanks with the portable, low-pressure, diesel-driven (Godwin) pump or the fire pumper truck to supply AFW Mitigated Case (using portable mitigation equipment) + early RCP seal failure Identical sequence of events as the unmitigated base case but includes an early RCP seal failure at 13 minutes.

13 minutes

All three RCP seals fail and leak at a nominal rate of 182 gpm per pump.

23

Revision 1 - 2115/2010 5:41 PM by which the operators would respond to the event. These time estimates included consideration of indications that the operators woul~d have of the bypass accident, operator training onplant procedures for dealing with bypass accidents and related drills, and assistance from the TSC and EOF, which were estimated to be manned and operational by 1 to 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months into the event.

Operator actions in this scenario are essentially those expected per training and procedure.

Specifically, the operators are trained to perform the following actions to mitigate to sequence:

Secure AFW delivery to the steam generator with the broken tube (the faulted steam generator)

Secure I of the 3 total high head safety injection (HHSI) pumps

Isolate the faulted steam generator, i.e., close the MSIVs serving the faulted steam generator

Secure the remaining HHSI pumps once the faulted generator is isolated, which will end the RCS leakage

Perform a 100°F/hr cool-down of the RCS

" Establish long-term cooling with residual heat removal The following other mitigation measures were identified but not used.

0 Use the pressurizer PORVs to depressurize the RCS to get an accumulator injection at low pressure

&P*, Cross-connect to the unaffected unit's RWST Use firewater makeup to RWST from the firewater header at -300 gpm from the two i 09,ipft/gallons firewater storage tanks, then the James River

" ;The portable, low-pressure, diesel-driven (Godwin) pump is available to makeup to the RWST and the CST at -2000 gpm at 120 psi

",', *-190,000 gallonsavailable from the SFP for rapid RWST makeup

Procedures exist to align firewater to the suction of the AFW pump via installed piping tanks and James River and valves from firewater storage

Two portable, high-pressure, diesel-driven (Kerr) pumps are available to inject into RCS

~fr using fi~ewatte-at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (assumes guidance from TSC and EOF at 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and an hour to implement --- 1" r- . t -r 't, q 'f 9 External sprays are available to knockdown releases CIP-Z) 3.3.4 Boundary Conditions Section 3.3.4.1 lists the sequence of events to be prescribed in the mitigated spontaneous steam generator tube rupture where the operator successfully performs the actions described in Section 3.3.3. Section 3.2.4.2 summarizes the sequence of events in two unmitigated scenarios where the operator does not successfully perform the actions described in Section 3.3.3. The second unmitigated scenario uses the same failed operator actions but also includes the failure of the steam generator secondary relief valve to create a sustained containment bypass pathway for fission products.

25

O(*Dri / AL Revision 1 - 2115/2010 5:41 PM Section 3.4.2. The pertinent mitigative measures available to address the accident progression are described in Section 3.4.3. Section 3.4.4 delineates various scenarios based on the success of the mitigative actions. In particular, a mitigated scenario is defined where the mitigative actions are successful. An unmitigated scenario is defined where certain key mitigate measures are not successfully implemented.

3.4.1 Initiating Event The interfacing systems loss-of-coolant accident (ISLOCA) initiates with a common mode failure of both of the inboard isolation check valve disks resulting in over-pressurization and failure of low-head safety injection (LHSI) piping outside of containment in safeguards building.

The resulting double-ended guillotine pipe break permits back-flow of the high-pressure RCS water into the safeguards building. Water will also spill into safeguards building via forward

,. flow through the LHSI pumps to the pipe break. The broken 6" LHSI line has a 2.57" venturi

-VaIr- between the RCS and the break that will limit the backward break flow. Although LHSI pumps are initially available until motor floods, they are ineffective because all their flow goes out the pipe break.

3.4.2 System Availabilities The full complement of systems is considered functional in this scenario including all systems associated with engineered safeguards and instrumentation and control as well as all auxiliary and emergency systems. However, the high-pressure recirculation and low-pressure recirculation ECCS are not available once the RWST drains because there is no water in reactor sump.

3.4.3 Mitigative Actions The ISLOCA results in core damage because of ineffective operator responses. In particular, the operators fail to refill the RWST or cross-connect to the unaffected unit's RWST. The SPAR model and the licensee's PRA concluded that the ISLOCA proceeds to core damage because of the above errors. However, the PRA models do not appear to have credited the significant time available for the operators to respond adequately. The PRA model also does not appear to credit technical assistance from the TSC and EOF. The realistic analysis of thermal hydraulics in Section 5.5 subsequently estimated 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months until the RWST is empty and 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months until the fission product releases begin, providing considerable time for the operators to respond. The ISLOCA time estimates are based on a double-ended pipe rupture, which drains the RWST at the maximum rate.

Based on detailed discussions of the scenario with the plant operators during the site visit and subsequent phone calls, the following operator and mitigative actions and their associated timeltines-we-re-use d.

Per procedure, only two HHSI pumps are required. All three will start and one is secured within 15 minutes.

The operators will take control of the AFW pumps to maintain normal level in the steam generators after 15 minutes.

29

A D/A L , Revision I - 211512010 5:41 PM

" To minimize backflow leakage to the safeguards building, the operators will shift HHSI injection from the cold leg to the hot leg at 45 minutes. Additional HI-SI pumps can be secured if an adequate water vessel can be maintained to minimize the spill rate into the safeguard building. The second and third HHSI pumps were secured at 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 9 hour1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , respectively.

" The operators will start a 100F/hr RCS cooldown at 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and continue depressurizing the steam generators to atmospheric pressure to minimize the break flow.

" The unaffected unit's HI-ISI pumps and RWST are aligned to the affected unit through a series of operator actions.

The following other mitigation measures were identified but not used in the calculations.

a The RWST can be refilled using firewater makeup from the firewater header at -300 gpm from two 250,000-gallon firewater storage tanks, then from the James River.

The portable, low-pressure, diesel-driven (Godwin) pump is available to makeup to the RWST and the CST at -1200 gpmat 120 psi

-190,000 gallons available from the spent fuel pool for rapid RWST makeup 0 The two portable, high-pressure, diesel-driven (Kerr) pumps are available to inject into RCS using-firewaW at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (assumes guidance from TSC and EOF at 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and an hour to implemeni)-,--- ;2. 1 5 7--e 7" - (;-', /,4 Z-)

External sprays are available to knockdown releases 3.4.4 Boundary Conditions Section 3.4.4.1 lists the sequence of events to be prescribed in the unmitigated interfacing systems loss-of-coolant accident calculation. Section 3.4.4.2 summarizes the sequence of events in the mitigated interfacing systems loss-of-coolant accident, which credits additional operator actions.

3.4.4.1 Unmitigated Interfacing Systems LOCA Event Initiation

The LHSI inboard isolation check valves fail causing a pipe break in the low pressure piping in the Safeguards Building

The reactor trips on low pressure

Containment Phase 1 isolation auto-initiates.

All 3 high pressure injection (HHSI) pumps auto-initiate on the ECCS injection signal.

LHSI initiates on the ECCS injection signal, which pumps water into the Safeguards Building through the pipe break until the LHSI pumps become submerged

The MSIVs close

,R 0he~O du4oýavitation ~ ~ ~ ~ ~ ~

The one turbine-driven (TD) and two motor-driven (MD) auxiliary feedwater pumps.

automatically start on a low-level actuation signal. The initial water source is the emergency condensate storage tank (ECST) (110,000 gallons) but can be refilled from the CST, which has 300,000 gallons.

30

P// I/AL Revision 1 - 2/15/2010 5:41 PM 2 minutes

" LHSI motors fail when they are flooded in the Safeguards Building (approximately 2 minutes into the event)

LHSI outboard isolation valve submerged and inaccessible.

After the LHSI motor failures, the RWST continues to gravity drain through the pipe break in the safeguards building.

15 minutes

Initial Operations assessment of plant status complete, LOCA identified

RCS level being maintained with two HHSI pumps, one HI-1SI pump secured per procedure

SG level being maintained by AFW 30 minutes r'jtS ~ ~-I~s' a Auxiliary-Buildi&gsumppumpaim sounds andtheý q,Auxiliary Building sump 1,"1, ,.,Jr-,

pumps auto-initiate, pumping water from the auxiliary building basement at a rate of ,

-100 gpm (50 gpm per pump). The sump pumps will continue to operate as long as auxiliary basement does not flood more that 2' above the basement floor flooding the sump pump motors.

45 minutes

Operations transfers HHSI to RCS hot legs.

50 minutes

The TSC is manned. Primary function would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigation measures.

" The EOF is manned. Primary function would be to review initiating event, plant status, and operator action to provide guidance on alternative mitigation measures. The TSC staff are the primary users of SAMGs and EDMGs. Shift supervisors and TSC supervisors are trained on SAMGs and EDMGs.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Operators begin 100°F/hr cooldown 1.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months

The TSC is operational.

1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months 0 The EOF is operational.

a The TSC and EOF review and concur with actions taken by operations. Recommends shifting to the unaffected unit's RWST while in operation to prevent running out of inventory.

31

PD Revision I -2115/2010 5:41 PM 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

Secure second HHSI pump and throttle remaining pump flow to maintain water level above the core

>1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

Operations does not successfully implement actions to shift to unaffected unit's HHSI pumps and RWST. HHSI will terminate when the RWST empties.

3.4.4.2 Mitigated Interfacing Systems LOCA The mitigated case has an identical sequence of events until 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months , the time assessed to implement the TSC and EOF recommendations. The operator successfully initiates the following actions, starting at 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months .

1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months

Operations assesses TSC and EOF recommendation to lineup the unaffected unit's RWST to the blender to makeup to the RWST at - 150 gpm while continuing to provide RCS makeup with the same RWST.

Operations swaps HHSI flow to unaffected unit's RWST. This action also uses the unaffected unit's HHSI pumps.

The affected unit's RWST is isolated, securing drain down of RWST into the Safeguards Building. However, water continues to flow from the RCS into the Safeguards Building and is controlled by the RCS pressure and hydrostatic water head in the Safeguards Building.

Note: The HHSI pumps could trip off line if auxiliary building is allowed to flood to approximately 5 feet above of auxiliary building basement floor without

,,% -Av-- A-, mitigation measures. The volume of the Auxiliary Building basement that will "r4a,--5 result in flooding of the HHSI pumps is 530,000 gallons. Another mitigation

-is, option is to use portable submersible pumps to pump out the Auxiliary Building basement to preclude flooding of the HHSI pumps. This option is recognized by the licensee but is not included in plant procedures.

Event Termination (Started at 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in the calculation)

Establish long-term cooling using the residual heat removal system (closed-circuit cooling system) 32

P"I/L Revision 1 - 2/15(2010 5:41 PM Fission Product Release to the Environment LTSBO - Not mitigated with portable equipment I

0.1 0.01 0.001 U.

0.0001 0.00001 0.000001 0 S2 3. 4 Time (days)

Figure 73 Unmitigated LTSBO environmental release history of all fission products.

5.3.2 Mitigated Long-Term Station Blackout Table 7 summarizes the timing of the key events in the mitigated LTSBO. As described in Section 3.4.1, the accident scenario initiates with a complete loss of all onsite and offsite power.

The reactor successfully trips and the containment isolates but all powered safety systems are unavailable. The timings of the key events are discussed further in Section 5.3.2.1. Unlike the unmitigated LTSBO described in Section 5.3.1, the mitigated LTSBO credits the successful connection of the portable, diesel-driven (Kerr) pump to three drain lih s 4esidual ' --#p, 25 hdetT6nfdb iping -to the RCS. The Kerr pump is a high-head pump with a design capacity of 100 gpm at 6.2 MPa (900 psi) and 500 gpm at 3.5 MPa (500 psi). The Kerr pump takes suction from the refueling water storage tank, which has a135O;000;gal capacity. The refueling water storage tank could be refilled as necessary. The sequenc ,Rf events is identical to the unmitigated LTSBO until 3 hr 30 min when the Kerr pump tarts operating. The Kerr pump operation starts prior to any core degradation (see). The em gency Kerr pump is effective at maintaining the vessel water level above the top of the fuel fir the duration of the sequence. In fact, the pump was throttled to a small fraction of its rated floSb 25 The utility has a 3-way connection from the Kerr pump to the three drain lines and all connecting equipment near the residual heat removal piping.

115

P 0=

D I AL Revision 1 - 2/1512010 5:41 PM Table 7 The timing of key events for mitigated long-term station blackout.

Time Event Description (hh:mm)

Initiating event 00:00 Station blackout - loss of all onsite and offsite AC power MSIVs close Reactor trip 00:00 RCP seals initially leak at 21 gpm/pump TD-AFW auto initiates at full flow 00:01 Operators control TD-AFW to maintain level 00:15 Vessel water level drains into upper plenum 00:30 Operators initiate controlled cooldown of secondary at 01:30

-100 0F/hr Vessel water level drains into upper plenum 01:57 Minimum vessel water level 02:30 Accumulators begin injecting 02:25 igpm emergency high-head diesel injection to IRCS 03:30 SG cooldown stopped at 120 psig to maintain TD-AFW flow 03:35 Pressurizer starts to refill 05:38 2 DC station batteries fail but operator actions continue to control the secondary pressure at 120 psi and maintain TD-AFW flow Normal pressurizer level restored 24:00 5.3.2.1 Thermal-Hydraulic Response The progression of events in the mitigated LTSBO is identical to the unmitigated LTSBO as described in Section 4.3.1 through the first 3 hr 30 min. In particular, the operators take actions to throttle the TD-AFW to maintain a normal level in the steam generators and perform a cool down of the RCS using the steam generator relief valves. Similar to the unmitigated case, the accumulators begin injecting at 2 hr 25 min in response to the decrease in the primary system pressure. It is estimated that the operators could begin RCS injection using the portable, diesel-driven Kerr pump by 3 hr 30 min.

At the time the emergency pump is ready for injection, the primary system pressure is 2.0 MPa (278 psig) or well within the pressure head capacity of the Kerr pump (see Figure 74). Similar to the unmitigated LTSBO,.the secondary system is depressurized to 120 psi, or.the lower limit of operability for the TD-AFW. Due to the RCP seal leakage and liquid volume shrinkage from the cool down,\the vessel level initially deceased but started to recover after 2 hr 25 min following the start of the accumulator injection (see Figure 75). The peak fuel cladding temperature and vessel lower head followed the primary system liquid temperature, which was steadily cooled down by the steam generators (see Figure 76 and Figure 77, respectively).

116

IAL Revision 1 - 2/1512010 5:41 PM Safeguards Building 2.57" flow LHSI 6" orifice Motor Check valves 46'- Spill to Aux bldg.

Cold Leg, CL EL

/

ISLOCA in low pressure piping Containment Containment I Sump I / LHS LHSI supply initially aligned from RWST Figure 108: Schematic of the unmitigated ISLOCA piping layout.

152

Revision 1 - 2/15/2010 5:41 PM 5.5.1.1 Thermal-hydraulic Response The responses of the primary and secondary pressure systems are shown in Figure 109. At the start of the accident sequence, the reactor pressure quickly falls following the pipe break in one of the low-head safety injection (LHSI) lines. The pipe break is a double-ended guillotine break of the LHSI line in the safeguards building at -1 m below the eventual flooded water level. 10i Approximately 20 seconds after the pipe break, the reactor successfully trips due to .the rapidly ,

decreasing reactor coolant system pressure and pressurizer level. T pi.bipv 'I (TCVsMlYos6§6ihthe reactot"tip a 'liii I*d"PY"ump riih-response to the b ?V closu&iibfthe TCVs. However, the two motor-driven and one turbine-driven auxiliary feedwater pumps automatically start following the loss of the main feedwater flow. An emergency core cooling system (ECCS) safety injection signal is also generated due to the decreasing pressurizer pressure. The ECCS signal starts the three high-head and two low-head safety injection (HHSI and LHSI) pumps.

The secondary pressure initially rises in response to the TCV closure but cools down after the cold AFW starts to refill the steam generators. Once the primary system depressurizes to the steam generator pressure, the primary and secondary system pressures remain coupled for the first 20 min. However, the energy and inventory loss out the break eventually exceeds the thermal coupling through the steam generator and the primary system depressurizes more quickly than the secondary. After 15 min, the operator takes control of the AFW and shuts down one of the three HHSI pumps. At 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the operators begin a controlled 1000F/hr cooldown to reduce the primary system pressure and therefore reduce the magnitude of the break flow.

V.-

The ECCS flow is shown in Figure 110. The three HHSI and two LHSI pumps started in response to the EECS signal. Due to the double-end guillotine break in the LHSI line and the interconnectivity of the supply lines, all the LHSI flow went out the break into the safeguards building. By 1 min 39 sec, the two LHSI pumps flooded the safeguards building. Since the LHSI motors were in the safeguards building, they failed when they were flooded.

Subsequently, the refueling water storage tank, which supplies water to the LHSI and HHSI pumps, started to gravity drain through the broken pipe at -1200 gpm. As the RWST continued to drain, the gravity-driven flow decreased until the tank emptied at 3.3 hr (see Figure 111). Due to the connectivity through the ECCS piping, about one-third of the total HHSI back-flowed into the safeguards building through the broken LHSI line before entering the RCS.

Figure 112 shows the two-phase level response in the vessel. The vessel water level drops quickly following the pipe break but starts to recover after 16 min in response to the decreased break flow at lower pressure, the accumulator injection, and the ECCS flow. However, following the shift to hot leg ECCS injection at 45 min, the reactor pressure drops quickly in response to sudden condensation of steam in the hot leg. The sudden drop in primary system presse-imedi a u seharge**fator-water;--After-the-condensaniorrtransie 1 t, the primary system pressure stabilizes but the two-phase level in the vessel temporarily dropped below the top of the core. Just after 2 hr, the level begins to recover as the primary system pressure begins to decrease with the secondary pressure. The accumulators inject from 2 to 3 hr as the primary system pressure continues to decreases. The ECCS injection continues to maintain the level until 3.3 hr when the RWST is empty. Subsequently, the water level 153

P e .Revision 1 - 2/1512010 5:41 PM Time Event Description (hh:mm)

Break flow "stops" 9:12 HHSI throttled to maintain level (remains off) 10:00 Second Unit's RWST refilled 28:24 Calculation terminated 36:00 5.5.2.1 Thermal-Hydraulic Response The responses of the primary and secondary pressure systems are shown in Figure 121. At the start of the accident sequence, the reactor pressure quickly falls following the pipe break in one of the low-head safety injection (LHSI) lines (see Figure 121). There is a double-ended guillotine break of the LHSI piping in the auxiliary building. Approximately 20 seconds after the pipe break, the reactor successfully trips due to the rapidly decreasing reactor coolant system pressure and pressurizer level. The turbine control valves (TCVs) close with the reactor trip signal. Meh 6iAnf*ewaterpumps fiip in response to the TCVscl6osure. However, the two motor-driven and one turbine-driven auxiliary feedwater pumps automatically start following the loss of the main feedwater flow. An emergency core cooling system (ECCS) safety injection signal is also generated due to the decreasing pressurizer pressure. The ECCS signal starts the three high-head and two low-head safety injection (HHSI and LHSI) pumps.

The secondary pressure initially rises following the TSV closure but cools down once the cold AFW starts to refill the steam generators. Once the primary system depressurizes to the steam generator pressure, the primary and secondary system pressures remain coupled for the first 20 min. However, the energy loss out the break eventually exceeds the thermal coupling through the steam generator, which allows the primary system to depressurize more quickly than the secondary. The operator takes control of the AFW after 15 min and shuts down one of the three HHSI pumps. At 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the operators begin a controlled 100°F/hr cooldown to reduce the primary system pressure and therefore reduce the magnitude of the break flow. At 1 hr 45 min, the HHSI injection from the unaffected reactor is aligned to the affected reactor, which extends the available injection. However, the accident is not mitigated until the primary system pressure is low enough to terminate the break flow and the residual heat removal (RHR) system is operating (i.e., starting at 6 hr).

Figure 122 shows the two-phase level response. in the vessel. The vessel water level drops quickly following the pipe break but starts to recover after 16 min in response to the decreased break flow at lower pressure, the accumulator injection, and the ECCS flow. However, following the shift to hot leg ECCS injection at 45 min, the reactor pressure drops quickly in response to sudden condensation of steam in the hot leg. The sudden drop in primary system pressure immediately causes a discharge of accumulator water. After the condensation transient, the primary system pressure stabilizes but the two-phase level temporarily drops below the top of the core. Just after 2 hr, the level begins to recover as the primary system pressure begins to decrease with the secondary pressure. The accumulators steadily inject from 2 to 3 hr as the primary system pressure decreases. After 2.7 hr, the water level remained near or above the top of the core. Then at 6 hr, the RHR system was initiated, which caused an immediate increase 163

ML12124A295

Text

Navigation menu

Search