ML18151A239

Assessment of the Potential for High Pressure MELT Ejection Resulting from a Surry Station Blackout Transient

ML18151A239
Person / Time
Site:	Surry
Issue date:	11/30/1993
From:	Dobbe C, Knudson D EG&G IDAHO, INC.
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
CON-FIN-A-6884 EGG-2689, NUREG-CR-5949, NUDOCS 9312170064
Download: ML18151A239 (176)

Text

NUREG/CR-5949 EGG-2689 Assessment of the Potential for High-Pressure Melt Ejection Resulting from a Surry Station Blackout Transient

• Prepared by D. L. Knudson, C. A Dobbe I

Idaho National Engineering Laboratory EG&G Idaho, Inc.

Prepared for U.S. Nuclear Regulatory Commission

• ~12170064

[ ~UR ADOCK 05000280

• '---:::-_ -.--*P - .. , -* - ---- - - .

931.130 -,

PDR. ....

\

I

AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited In NRC pubUcatlons wlll be available from one of the following sources:

1. The NRC PubUc Document Room, 2120 L Street, NW, Lower Level, Washington, DC 20555-0001

2. The Superintendent of Documents, U.S. Government Printing Office, Mall Stop SSOP, Washington, DC 20402-9328

3. The National Technical Information Service, Sprlngfleld, VA 22161 Although the Hating that follows represents the majority of documents cited In NRC publlcatlons, It Is not Intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room Include NRC correspondence and Internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, Information notices, Inspection and Investigation notices; Ucensee Event Reports; ven-dor reports and correspondence; Commission *papers; and applicant and licensee documents and corre-spondence.

The following documents .In the NUREG series are available for purchase from the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations In the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service Include NUREG series reports and technical reports prepared by other federal agencies and reports preparea by the Atomic Energy Commis-sion, forerunner -agency to the Nuclear .Regulatory Commission.

Documents available from publlc and special technical llbrarles Include all open Uterature Items, such as books, Journal and perlodlcal articles, and transactions. Federal Register notices, federal and state leglsla-tlon, and congressional reports can usually be obtained from these llbrarles.

Documents such :as theses, dissertations, foreign reports and translations, and nori-NRC conference pro-ceedings are available for purchase from the organization sponsoring the publlcatlon cited.

Slngle copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Information Resources Management, Distribution Section, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001.

Coples of Industry codes and standards used In a substantive manner In the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for refer-ence use by the publlc. Codes and standards are usually copyrighted and may be purchased from the originating organization or, If they are American National Standards, from the American National Standards Institute, 1430 Broadway, New York, NY 10018.

DISCLAIMER NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government ncir any agency thereof, or any of their employees, makes any warranty, I

• ~

expresed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use \

by such third party would not infringe privately owned rights.

NUREG/CR-5949 EGG-2689 RK Assessment of the Potential for

.High-Pressure Melt Ejection Resulting from a Surry Station Blackout 1Transient Manuscript Completed: May 1993 Date Published: November 1993

• Prepared by D. L. Knudson, C. A Dobbe Idaho National Engineering Laboratory Managed by.the U.S. Department of Energy EG&G Idaho, Inc.

Idaho Falls, ID 83415 Prepared for Division of Systems Research Office of Nuclear Regulatory Res~arch U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 NRC FIN A6884 Under DOE Contract No. DE-AC07-76ID0l570

ABSTRACT Containment integrity could be challenged by direct heating associated with a high pressure melt ejection (HPME) of core materials following reactor vessel breach during certain severe accidents. Intentional reactor coolant system (RCS) depressurization, where operators latch pressurizer relief valves open, has been proposed as an accident management strategy to reduce risks by mitigating the severity of HPME. However, de-cay heat levels, valve capacities, and other plant-specific characteristics determine wheth-er the required operator action will be effective. Without operator action, natural circulation flows could heat ex-vessel RCS pressure boundaries (surge line and hot leg piping, steam generator tubes, etc.) to the point of failure before vessel breach, providing an alternate mechanism for RCS depressurization and HPME mitigation.

This report contains an assessment of the potential for HPME during a Surry station blackout transient without operator action and without recovery. The assessment included a detailed transient analysis using the SCDAP/RELAP5/MOD3 computer code to calcu-late the plant resptjnse with and without hot leg countercurrent natural circulation, with and without reactor coolant pump seal leakage, and with variations on selected core dam-age progression parameters. RCS depressurization-related probabilities were also evaluat-ed, primarily based on the code results .

• iii NUREG/CR-5949

CONTENTS ABSTRACT ...................................................................... iii LIST OF FIGURES ................................................................. vii LIST OF TABLES ................................................................... X EXECUTIVE

SUMMARY

.......................................................... xiii ACKNOWLEDGMENTS ............................................................xix

1. INTRODUCTION ................................................................ 1

2. ASSESSMENT APPROACH ....................................................... 3 2.1 SCDAP/RELAP5/MOD3 Analysis ............................................... 3 2.2 Probability Evaluation ......................................................... 8

3. CALCULATION RESULTS ....................................................... 11 3.1 Base Case .................................................................. 11 3.2 Case 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.3 Case 3 ..................................................................... 20

• 3.4 Case 4 ..................................................................... 29 3.5 Case 5 ..................................................................... 35 3.6 Case 6 ...*................................................................. 39 3.7 Uncertainties .................................. ; ............................ 43 3.7.1 Thennal-Hydraulic Uncertainties ............... ; .................. , ...... 43

3. 7 .2 Core Damage Progression Uncertainties .................................... 45

4. DEPRESSURIZATION PROBABILITIES . ........................................... 49 4.1 Surge Line/Hot Leg Failure Issue . . . . . . . . . . . . . .................................. 49 4.2 RCS Pressure at Vessel Breach Issue ............................................. 51

5. CONCLUSIONS AND RECOMMENDATIONS ....................................... 55

6. REFERENCES .................................................................. 59 Appendix A--SCDAP/RELAP5/MOD3 Code Description................................. *. A-1 Appendix B--SCDAP/RELAP5/MOD3 Model Description ................................. B-1 I .

Appendix C--Steady-State Calculations ................................................ C-1 Appendix D--Calculation Statistics .................................................... D-1

• Appendix E--SCDAP/RELAP5/MOD3 Model Benchmark ................................. E-1 Appendix F--Selected Core Damage Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F-1 V NUREG/CR-5949

Appendix G--Probabilistic Risk Assessment Issues ....................................... G-1 NUREG/CR-5949 vi

LIST OF FIGURES

1. Pressurizer pressure for the Base Case........................................... 13

2. Reactor vessel collapsed liquid level for the Base Case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3. Fuel rod cladding surface temperatures in the center fuel channel for the Base Case . . . . . . . 14

4. Mass flow rate in the top of a nonpressurizer loop hot leg (A) for the Base Case. . . . . . . . . . 16

• 5. Vapor temperatures in the top and bottom of a nonpressurizer loop hot leg (A) for the Base Case................................................................. 16

6. Volume-averaged temperatures of various structures in the pressurizer loop (C) and the reactor vessel for the Base Case ... ; . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

7. Middle channel fuel rod cladding surface temperatures for Case 2..................... 19

8. Vapor temperatures in the pressurizer and nonpressurizer loops (C and A) for Case 2. . . . . . 19

9. Volume-averaged temperatures of various structures i~ the pressurizer loop (C) and .

reactor vess~l for Case 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

10.

• RCS pressure for Case 3 ....... *...................... ,........................ 23

11. Full loop natural circulation of liquid in a nonpressurlzer loop (A) following TMLB' initiation for Case 3.................................... *. . . . . . . . . . . . . . . . . . . . . . 23

12. Reactor vessel collapsed liquid level for Case 3. : ............................... *. . . 24

• 13.

14.

15.

16.

Maximum cladding surface temperature for Case 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

I .

Hot leg countercurrent natural circulation in a nonpressurizer loop (A) for Case 3 . . . . . . . .

Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) for Case 3.....

RCS pressures for Cases 3 and 4 .................. : . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24 27 27 31

17. Reactor vessel collapsed liquid levels for Cases 3 and 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

18. Maximum cladding surface temperatures for Cases 3 and 4 . . . . . . . . . . . . . . . . . . . . . . . . . . 32

19. Total hydrogen generated for Cases 3 and 4....................................... 33

20. Hot leg countercurrent natural circulation in a nonpressurizer loop (B) for Case 4. . . . . . . . . 34

21. Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) for Case 4..... 34

22. Lower head debris temperatures for Cases 3 and 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

23. Reactor vessel collapsed liquid levels for Cases 3 and 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

24. RCS pressure for Case 5 ......................... *. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

25. Reactor vessel collapsed liquid levels in Cases 4 and 6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

26. RCS pressures in Cases 4 and 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

27. Core bypass collapsed liquid levels in Cases 4 and 6................................ 42

28. Maximum cladding surface temperatures in Cases 4 and 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

• 29. Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) in Case 6 ....-.

vii NUREG/CR-5949 44

B-1. Surry NPP reactor vessel nodalization with provisions for in-vessel natural circulation..... B-5 B-2. Pressurizer coolant loop nodalization for the Surry NPP without provisions for hot leg countercurrent natural circulation .............................................. . B-6 B-3. Pressurizer coolant loop nodalization for the Surry NPP with provisions for hot leg countercurrent natural circulation .............................................. . B-7 B-4. A cross section of the three-channel core region .................................. . B-10 B-5. A typical l~xl5 Surry NPP fuel assembly ..........: ............................ *.. B-11 B-6. COUPLE mesh representing the lower reactor head ....... , ....................... . B-14 G-1. TMLB' Base Case surge line vapor temperature histories for estimation of surge line failure probabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-10 G-2. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-12 G-3. Configuratio~ of the hot leg nozzle and hot leg piping in the Surry NPP . . . . . . . . . . . . . . . . G-13 G-4. TMLB' Case 2 hot leg vapor temperature histories for estimation of hot leg failure probabilities ............................................................... G-16 G-5. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences withoutRCP seal leaks in the Surry NPP ................................ G-12 G-6. Probability distribution for reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP . . . . . . . . . . . . . . G-18 G-7. Lower head failure probabilities as a function of tif1'e given the occurrence of TMLB' sequences without I

RCP seal leaks in the Surry NPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-22 G-8. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-23 G-9. Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP . . . . . . . . . . . . . . . . . . . . . . . . . G-23 G-10. TMLB' Case 3 surge line vapor temperature histories for estimation of surge line failure probabilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-27 G-11. TMLB' Case 3 surge line pressure histories for estimation of surge line failure probabilities G-27 G-12. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal le~ of 250 gpm perRCP in the Surry NPP ...................... G-31 G-13. TMLB' Case 4 surge line vapor temperature histories for estimation of surge line failure probabilities. . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-33 G-14. TMLB' Case 4 surge line pressure histories for estimation of surge line failure probabilities G-33 G-15. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP. . . . . . . . . . . . . . . . . . . . . . G-36 G-16. Probability distribution for reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP. . . . G-37 G-17.Lower head failure probabilities as a function of time given the occurrence ofTMLB' sequences with RCP seal leaks in the Surry NPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-41 NUREG/CR-5949 viii

G-18. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-42 G-19. Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP .............. ; G-42 G-20. Surge line vapor temperature histories for estimation of surge line failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP. ! ............................................................... G-46 G-21. Surge line pressure histories for estimation of surge line failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP .................................... *............................. G-46 G-22. Surge line volume-averaged vapor temperature histories for estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP ..................................................... G-47 G-23. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP .................... G-48 I

G-24. Hot leg vapor temperature histories for estimation of hot leg failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP ................................................................. G-50 G-25. Hot leg volume-averaged vapor temperature histories for estimation of hot leg failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP ..................................... .' ............... G-51 G-26. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP .................... G-55 G-27. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched:open PORVs in the Surry NPP ............................. G-55 G-28. Probability density functions for the surge line/hot leg failure issue given the occurrence of*

TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP .............. G-56

• G-29.RCS pressure for Surry TMLB' Case 3 ..................................... ; .... G-59 G-30. RCS pressure for Surry TMLB' Case 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-59 G-31.RCS pressure for Surry TMLB' Case 4 .......................................... G-62 G-32.RCS pressure for Surry TMLB' Case 6 .......................................... G-62 G-33.RCS pressure for intentional depressurization of the Surry NPP during a TMLB' sequence. G-64

• ix NUREG/CR-5949

LIST OF TABLES ES-1. Summary of SCDAP/RELAP5/MOD3 results (in minutes) ................................................... . xv ES-2. Probabilities of the surge line/hot leg failure issue given the occurrence of the specific scenarios in the Surry NPP ........................................ :............................................................. . xvii ES-3. Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific scenarios withbut ex-vessel :failures in the Surry NPP ............................................................ . xvii

1. Parameters for simulation of RCP seal leaks .......................................................................... . 6

2. SCDAP severe core damage parameters ................................................................................ . 6

3. Sequence of events for the Base Case. ................................................................................... . 12 4.* Sequence of events for Case 2 ................................................................................................ . 18

5. Sequence of events for Case 3....................................... ~ ........................................................ . 21

6. Sequence of events for Case 4 ............................................................................................... .. 30

7. Sequence of events for Case 5 ................................................................................................ . 36

8. Sequence of events for Case 6................................................................................................ . 39

9. Probabilities of the surge line/hot leg failure issue given the occurrence of the specific scenarios in the Surry NPP ...................................................................................................... . 49

10. Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific scenarios without ex-vessel failures in the Surry NPP ............................................................ . 52 B-1. Decay power curve .................................................................................................................. . B-12 C-1. Comparison of steady-state results with sensitivity study values computed by Bayless......... . C-3 D-1. Calculation statistics ................................................................................................................ . D-3 E-1. Comparison of results from the Base Case and a previous study ............................................ . E-3 F-1. Selected core damage results for the Base Case ...................................................................... . F-4 F-2. Selected core damage results for Case 2 .................................................................................. . F-5 F-3. Selected core damage results for Case 3 ......................................................... ~ ........................ . F-6 F-4. Selected core damage results for Case 4 .................................................................................. . F-7 F-5. Selected core damage results for Case 5 .................................................................................. . F-8 F-6. Selected core damage results for Case 6.................................................................................. . F-9 G-1. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences withoutRCP seal leaks in the Surry NPP ................................ G-12 G-2. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP ................................ G-16 G-3. Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP ......................... G-18 G-4. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-22 NUREG/CR-59~9 X

G-5. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-29 G-6. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm perRCP in the Surry NPP ...................... G-30 G-7. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-35 G-8. Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP . . . . . . . . . . . . . . . G-37 G-9. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G-41 G-10. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP .................... G-48 G-11. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP ._ ................... G-54

• xi NUREG/CR-5949

Executive Summary

• EXECUTIVE

SUMMARY

Molten core materials could be ejected by a tional depressurization could provide an alternate high-pressure reactor coolant system (RCS) fol- way to minimize the potential OCH risks by mit-lowing reactor vessel lower head failure during igating HPME.

certain severe accidents. A rapid rise in contain-ment temperature and pressure, or direct contain- TIIis report contains an assessment of the po-ment heating (OCH), could result from the high tential for HPME in the Surry NPP resulting pressure melt ejection (HPME) into the contain- from a severe reactor accident. The assessment ment building. In a severe case, the pressuriza- was limited to evaluation of a station blackout tion and associated challenge to containment scenario because it is the single largest contribu-integrity could lead to a significant increase in ra- tor to the frequency of core damage for the Surry diological risks. NPP. The specific station blackout scenario con-sidered was a TMLB' sequence, which was initi-Intentional depressurization of the RCS has ated by the loss of all ac power and a been proposed as an accident man~gement strate- simultaneous loss of auxiliary feedwater. The gy to minimize the potential OCH risks (in cases potential effects of operator actions and accident where cooling water is unavailable for either pri- recovery were not considered. A two-part as-mary or secondary feed and bleed operations). In sessment was completed including (a) a detailed this strategy, plant operators latch pressurizer , SCDAP/RELAP5/M003 analysis of the TMLB' power-operated relief valves (PORVs) open to sequence and (b) an evaluation of RCS reduce the RCS pressure and mitigate the effects depressurization-related probabilities.

of an HPME. However, decay heat levels, valve capacities, and other plant-specific characteris- Part one of the assessment consisted of a tics determine whether the required operator ac- SCOAP/RELAP5/M003 analysis to quantify (a) tion will lead to an effective RCS the time and location of the initial RCS pressure depressurization. Analyses have been completed boundary failure, (b) the associated RCS condi-that ~ndicate intentional depressurization could tions at the time of the initial pressure boundary be a viable method for mitigating HPME in the failure, and (c) the RCS conditions at the time of Surry Nuclear Power Plant (NPP). Subsequent reactor vessel lower head failure. Modeling was analyses indicate that intentional depressuriza- included to allow for the development of full tion could also be effective for many other pres- loop, in-vessel, and hot leg countercurrent natu-surized water reactors (PWRs). ral circulation based on previous worlc. Natural circulation flows provided a mechanism for the Without operator actions, natural circulation po'tential generation of ex-vessel failures. Code flows could develop following accident initiation calculations from accident initiation through the and reactor coolant pump (RCP) coastdown. A time of lower head failure were performed with previous analysis of the Surry NPP identified the and without hot leg countercurrent natural circu-significance of full loop, in-vessel, and hot leg lation, with and without RCP seal leakage, and countercurrent natural circulation modes with re- with variations on some of the more important spect to severe accident progression. Ex-vessel core damage progression parameters. Best-RCS pressure boundaries (surge line and hot leg estimate parameters were used as inputs where piping, steam gen~rator tubes, and so on) could there are data or where the effects of the parame-be heated by the natural circulation of high- ters are understood. For parameters with a high temperature steam to the point of failure before degree of uncertainty, values were selected to failure of the lower head. Under those condi- minii;nize the time to lower head failure, produc-

• tions, RCS depressurization through the ex-vessel pressure boundary breach could then oc-cur without operator actions. As such, uninten-xiii ing a conservative evaluation of the potential for HPME. It was assumed that there was sufficient plant air and battery power to operate the PORVs NUREG/CR-5949

Executive Summary throughout the transient. Furthermore, the po- at the time liquid in the RCPs reached saturation

• tential for PORV failures as a result of extremes in those cases. The initial leak rate represented in temperature was not considered. Simple struc- leakage associated with the loss of seal cooling, tural models of the ex-vessel piping were includ- resulting from the loss of ac power. The higher ed to track the potential for creep ruptures leak rates represented the potential for failures induced by the combined effects of elevated tem- associated with high-temperature, two-phase seal perature and pressure. Any predicted ex-vessel instabilities failure was appropriately recorded, although an associated RCS blowdown was not simulated. In Case 3, leakage was increased from 21 Instead, the code calculations were extended to gpm per RCP to the most probable leak rate of lower head failure without RCS depressurization, 250 gpm at RCP saturation. In Case 4, the leak providing an approach for estimating the possi- rate was increased to 480 gpm per RCP, repre-ble timing difference between all events. senting the maximum leak rate corresponding to failure of all seal stages. Case 5 was identical to Part two of the assessment was completed to Case 3 with the exception of how heat transfer provide inputs for an independent analysis ad- from molten materials was treated during reloca-dressing the risk impact of intentional depressur- tion. In Case 3, molten materials were relocated ization of the Surry NPP. Probabilistic risk to the lower head without heat transfer. In Case assessment (PRA) techniques will be used to de- 5, molten materials were assumed to quench dur-termine the risks of intentional depressurization ing relocation (up to the limit imposed by the compared with the risks that could be expected if amount of available water). Case 6 was identical plant operators take no action. RCS depressur- to Case 4 with the exception of the treatment of ization probabilities were evaluated based on fuel cladding deformation. In Case 4, it was as-current calculations for use in the risk analysis. sumed that deformation was limited to 2% due to *

• The specific issues considered included (a) the an oxide buildup on the outer surface of the clad-probability that an ex-vessel failure will occur ding before the onset of ballooning. In Case 6, and depressurize the RCS before lower head fail- the limit on cladding deformation was increased ure and (b) the probability of being at a low RCS to 15%. The SCDAP/RELAP5/MOD3 results pressure at the time of lower head failure. The listed in Table ES-1 summarize the predicted re-probabilities were not simply derived from the sponse of the Surry NPP for all calculations per-calculational results. Instead, uncertainties in the formed in this assessment results were evaluated through sensitivity calcu-lations and the application of engineering judg- SCDAP/RELAP5/MOD3 results indicate ment. that natural circulation of steam and steam flow through the pressurizer PORVs can induce creep Six different SCDAP/RELAP5/MOD3 cal- rupture failures in the surge line and hot leg pip-culations were performed in the first part of the ing before failure of the lower head when the assessment. In the Base Case, full loop, in- RCS js not depressurized by leaks. Without RCS vessel, and hot leg countercurrent natural circula- leaks, the RCS pressure is maintained by pressur-tion flows were considered. Those flows are con- izer PORV cycling. During each valve cycle, en-sistent with conditions that could develop ergy is transferred from the core to the surge line following TMLB' initiation without operator ac- and hot leg piping. Hot leg countercurrent natu-tions. Hot leg countercurrent natural circulation i:al circulation is established between PORV cy-was eliminated in Case 2 to minimize the core cles, which also transfer core decay heat to the heatup time by minimizing ex-vessel heat trans- hot legs. However, the surge line is heated to a fer. Cases 3 through 6 were designed to account failure condition before the hot legs because it is for all modes of natural circulation and the po- relatively thin. In all calculations performed, tential effects of RCP seal leakage. A leak rate steam generator tubes were assumed to be free of

• of 21 gpm per RCP was introduced at TMLB' defects. Given that assumption, failure of the initiation, and higher leak rates were introduced steam generator tubes would not be expected in NUREG/CR-5949 xiv

Executive Summary Table ES-1. Summary of SCDAP/RELAP5/MOD3 results (in mlnutes).a Case Event Base 2 3 4 5 6 r

Core uncovery 176.7 177.3 189.3 167.7 189.3 167.7 First fuel clad failure 235.5 206.0 220.5 197.3 220.5 205.2 Surge line failure 237.5 215.5 337.2 >463.3 337.2 >396.7 First hot leg failure 258.3 234.3 334.8 >463.3 334.8 >396.7 First fuel melting

• 278.3 253.0 241.8 234.8 241.8 345.0 First core relocation

• 480.8 257.8 403.3 426.0 403.3 383.8 Lower head failure 482.0 260.1 405.7 433.0 479.6 389.8 RCS pressure at lower 16.0 16.0 8.56 1.36 6.48 1.37 head failure (MPa)b

a. A greater-than sign (>) indicates that the event had not occurred by the end of the calculation at the indicated time.

'l*

• .\:,

b. Without credit for depressurizatiort that could occur following potential ex-vessel failures .

• cases without RCS leaks because the circulating steam loses a significant amount of energy before reaching the steam generators, leaving the tubes relatively cool. Although the calculation was not rent natural circulation, heating of the steam gen-erator tubes is minimal.

Surge line and hot leg failures can be expect-ed before failure of the lower head if, the RCS performed, previous studies indicate that the RCS could be effectively depressurized from the pressure is reduced below the pressurizer PORV PORV set point pressure before lower head fail- set point by seal leaks of 250 gpm per RCP.

ure through either a surge line or hot leg breach. Surge line heating decreases when the RCP seal

~eaks reduce the RCS pressure below the PORV set point and the PORV cycling stops. However, If the RCS is not depressurized by leaks, ex-vessel heating continues as a result of hot leg surge line and hot leg failures can be expected countercurrent flow. Although the hot leg is rela-before failure of the lower head even if hot leg tively massive, it would be heated to a failure countercurrent natural circulation is not estab- condition before the surge line because it is ex-lished. Hot leg countercurrent natural circulation posed to the highest-temperature steam leaving .*

does provide an effective mechanism for the the reactor vessel and because surge line heating transfer of core decay heat to the ex-vessel pip- is minimized when PORV cycling ends. If the ing. If that heat sink is eliminated, heatup of the steam generator tubes are free of defects, failure core and in-vessel structures will accelerate, with of the tubes would not be expected in cases with corresponding increases in steam temperatures. leaks of 250 gpm per RCP because they remain Under these conditions, however, the surge line relatively cool.

and hot leg will also be exposed to higher tem-

• peratures. As a result, both surge line and hot leg creep ruptures should be induced before failure of the lower head. Without hot leg countercur-NUREG/CR-5949 xv A lower head failure would be the first breach of the RCS pressure boundary if the RCP seals leak 480 gpm per pump. The progression

Executive Summary of core damage is accelerated as RCP seal leak- The accumulators were essentially emptied dur-

• age increases. However, higher RCP leak rates ing the core reflood, which eliminated the possi-also depressurize the RCS, allowing earlier accu- bility of effective cooling during the subsequent mulator injection, which can delay further core reheating. A relatively large relocation of'ap-degradation. The most important aspect associ- proximately 44370 kg of molten U02 occurred ated with RCP seal leak rates, however, is the ef- as a result. With a defonnation limit of 2%, peri-fect on ex-vessel *heating. The total core decay odic accumulator injection provided only partial energy is split into the portion that is deposited in cooling of the core hot spots. However, the par-the vessel and ex-vessel structures by circulating tial cooling occurred over a prolonged period and steam and the portion that is dissipated through was sufficient to delay relocation, which consist-RCP seal leaks. The results indicate that seal ed of about 12940 kg of molten U02. The delay leaks of 480 gpm per RCP dissipate a relatively in relocation produced a corresponding delay in large fraction of core decay ene~y. leaving a rel- lower head failure of 43.2 minutes (compared to atively small fraction for ex-vessel h~ating. In the higher defonnation case).

fact, the results indicate that ex-vessel failures would occur beforp lower head failure with seal The SCDAP/RELAP5/MOD3 results were leaks of 250 gpm per RCP but would not be ex- reviewed to identify potential uncertainties that pected with leaks as high as 480 gpm per RCP. could affect the predicted response of the Surry NPP. The review focused on uncertainties that Debris/coolant heat transfer during molten could affect the timing of the RCS pressure relocation to. the lower head can significantly de- boundary failures because that timing is critical lay failure of the lower head. Minimum and in this assessment of the potential for HPME.

maximum debris/coolant heat transfer options are the only debris/coolant heat transfer options Uncertainties in (a) the current oxidation

• currently available in SCDAP/RELAP5/MOD3. 1:11odels in the code, (b) the core decay power, (c)

With the minimum option, it is assumed that the the initial steam generator liquid inventory, and debris relocates froril the core to the lower head (d) the nature and rate of core damage progres-in a coherent stream without heat transfer, which sion tend to accelerate or delay both ex-vessel results in a rapid lower head thermal attack. failures and lower head failures. For example, With the maximum option, it is assumed that the the current version of SCDAP/RELAP5M,OD3 debris will breakup as a result of impact with wa- only calculates oxidation of the zircaloy cladding ter (and structures) in the lower plenum and low- of in-core components, which is tenninated as er head. The code then calculates a complete soon as rod-like geometry is lost As a result, the quench of the debris, up to the limit imposed by rate of core heatup could be underpredicted in the amount of coolant available. A large RCS the current calculations because the oxidation re-pressurization can result during quench; howev- actions are exothennic. If core heatup is under-er, lower head thennal attack is delayed until the p redi c te d, core and circulating steam debris reheats. The calculations indicate that the temperatures will be underpredicted. Therefore, delay could be more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Since the ex- the timing of both lower head and ex-vessel fail-pected result lies between those extremes, refine- ures could be delayed by the current treatment of ments in relocation modeling could be useful in oxidation in the code. A more detailed treatment future analyses. of oxidation would be expected to accelerate both lower head and ex-vessel failure times with-Changes in defonnation associated with bal- out a significant change in the relative timing be-looning of the fuel rod cladding can significantly tween the events.

change core damage progression and the time to lower head failure. With a ballooning deforma- Uncertainties in (a) the treatment of in-core tion limit of 15%, an accumulator injection com- crust heat transfer; (b) the :fl.ow and heat transfer

• pletely reflooded and significantly cooled the characteristics of a degraded core, particularly entire core before fonnation of a molten pool. during accumulator injections; (c) natural circu-NUREG/CR-5949 xvi

Executive Summary lation flow and heat transfer; and (d) the effects tainties in the SCDAP/RELAP5/MOD3 calcula-of repressurization resulting from vapor pro- tions. The results of that effort are reflected in duced during accumulator injection and during the RCS depressurization probabilities listed in molten relocation to the lower head tend to Tables ES-2 and ES-3 for (a) TMLB' sequences change the time of ex-vessel failures relative to without RCP seal leaks (at full system pressure),

the time of lower head failure. For example, if (b) TMLB' sequences with seal leaks of 250 gpm the heat transfer from the molten pool to the in- per RCP, (c) TMLB' sequences with seal leaks of

• 480 gpm per RCP, and (d) TMLB' sequences core crust is overpredicted, relocation and lower head failure could occur earlier than expected with stuck-open/latched-open PORVs.

relative to predicted ex-vessel failures.

There is a low probability for an HPME in Sensitivity calculations were perfonned and the Surry NPP during TMLB' sequences without engineering judgment was applied in an a~mpt operator actions based on the results listed in the to account for the potential effects of the uncer- tables. In scenarios (a), (b), and (d), natural cir-Table ES-2. Probaqilities of the surge line/ hot leg failure issue given the occurrence of the specific sce-narios in the Surry NPP.

Scenario Probability TMLB' sequences without RCP seal leaks 0.98

• TMLB' sequences with seal leaks of 250 gpm per RCP TMLB' sequences with seal leaks of 450 gpm per RCP

'fMLB' sequences with stuck-open/latched-open PORVs 0.98 0.0 1.0 Table ES-3. Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific scenarios without ex-vessel failures in the Surry NPP.

Probability, at vessel breach, for HighRCS lntennediate Low RCS Scenario pressure RCS pressure pressure

(> 6.89 MPa) (1.38 - 6.89 MPa) (<1.38 MPa)

TMLB' sequences without RCP seal leaks) 1.0 0.0 0.0 TMLB' sequences with seal leaks of 250 gpm 0.21 0.75 0.04 perRCP TMLB' sequences with seal leaks of 450 gpm 0.13 0.40 0.47 perRCP

• TMLB' sequences with stuck-open/latched-open PORVs 0.0 xvii 0.0 1.0 NUREG/CR-5949

Executive Summapr culation* and flow through the PORVs led to The assessment contained in this report was

• surge line and/or hot leg failures before failure of based on a detailed SCDAP/RELAP5/MOD3 the lower head without any required operator ac- analysis to determine the Surry NPP response tion. After accounting for uncertainties in the during a TMLB' transient without operator ac-calculated results, it was concluded that RCS tions and the corresponding potential for HP:ME.

pressure reduction below 1.38 MPa would occur Therefore, the conclusions of this assessment are through the ex-vessel breach before lower head specific to the Surry NPP. Evaluation of the ap-failure with a high probability._ Specifically, plicability of the results to other plants was out-probabilities for a surge line or hot leg failure side the scope of this program. However, some with RCS depressurization below 1.38 MPa be- of the factors that would have to be considered fore lower head failure were assigned values of include the capacity of the pressurizer PORVs; 0.98, 0.98, and 1.0, given the occurrence of sce- the decay heat level; the accumulator capacity narios (a), (b), and (d), respectively. and initial pressure; the steam generator size, type, and initial liquid inventory; and the geome-An ex-vessel failure was not calculated be- tries of the hot leg, surge line, and upper plenum fore lower head failure in (c). For that reason, region of the reactor vessel. Those factors are the probability of a surge line or hot leg failure important because they could influence core with RCS depressurization below 1.38 MPa be-damage progression and the natural circulation fore lower head failure was assigned a value of of steam throughout the plant. Without operator 0.0. However, the probability of being at or be-actions, natural circulation provides the required low 1.38 MPa at the time of lower head failure (without an ex-vessel failure) was estimated to mechanism for generating ex-vessel failures.

be 0.47. In addition, the probability of seal leaks The timing of the ex-vessel failures relative to as large as 480 gpm per RCP is very small. In core damage progression determines the poten-

• other words, the results associated with scenario tial for HPME. Therefore, a plant-specific un-(c) would be relatively unlikely. Therefore, there derstanding of natural circulation and its is a low probability for an HP:ME during TMLB' relationship to core damage progression would sequences in the Surry NPP. be required to extend the results to other NPPs .

NUREG/CR-5949 xviii

ACKNOWLEDGMENTS The authors would like to thank the sponsor of this work, Dr. Frank Odar of the U.S. Nuclear Regula-tory Commission, for his guidance and support through completion of the project. Tochnical review and comments offered by Dr. C. M. Allison (INEL), Mr. D. J. Hanson (INEL), Mi. E. A. Harvego (INEL), and Mr. L. J. Siefken (INEL) were also appreciated. Dr. S. E. Dingman (SNL) and Mr. D. L. Kelly (INEL) pro-vided valuable contributions to and comments on the probabilistic risk assessment aspects of this work.

And, finally, a special thank you is due Ms. N. L. Wade (INEL) for her dedication and support in comple-tion of this manuscript.

• xix NUREG/CR-5949

Introduction ASSESSMENT OF THE POTENTIAL FOR HIGH-

• PRESSURE MELT EJECTION RESULTING FROM A SURRY STATION BLACKOUT TRANSIENT

1. INTRODUCTION Molten core materials could be ejected by a spect to severe accident progression.3 Ex-vessel high-pressure reactor coolant system (RCS) fol- RCS pressure boundaries (surge line and hot leg lowing reactor vessel lower head failure during piping, steam generator tubes, etc.) could be certain severe accidents. A rapid rise in contain- heated by the natural circulation of high-ment temperature and pressure, or direct contain- temperature steam to the point of failure before ment heating (OCH), could result from the high failure of the lower head. Under these condi-pressure melt ejection (HPME) into the contain- tions, depressurization through the ex-vessel ment building. In a sever~ case, the pressuriza- pressure boundary breach could then occur with-tion and associated challenge to containment out operator action. Thus, unintentional depres-integrity could lead to a significant increase in ra- surization could provide an alternate way to diological risks. minimize the potential for OCH by mitigating HPME.

Intentional depressurization of the RCS has been proposed as an accident management strate- This report contains an assessment of the po-gy to mitigate the severity of HPME, thereby re- tential for HPME resulting from a severe reactor ducing the risks in cases where cooling water is accident. The assessment was limited to evalua-unavailable for either primary or secondary feed- tion of a station blackout scenario in the Surry and-bleed operations. In this strategy, plant op- NPP. The station blackout scenario was selected erators latch pressurizer power-operated relief because it is the single largest contributor to the valves (PORVs) OP,en to reduce the RCS pressure frequency of core damage for the Surry NPP. 4 and mitigate the effects of HPME. Risk reduc- (HPME is of concern only in scenarios that could tion is expected, since the potential for contain- lead to core melt.) The Surry NPP was selected ment failure as a result of OCH should be because information needed to complete the minimized if HPME can be mitigated. However, evaluation was readily available. (The selections decay heat levels, valve capacities, and other were also influenced by the number of related plant-specific characteristics determine whether and supporting studies that have been per-the required operator action will lead to an effec- formed.) A two-part approach was used to com-tive RCS depressurization. Analyses have been plete this assessment, including (a) a detailed completed that in~icate intentional depressuriza- SCOAP/RELAP5/M003 5 analysis 6f a station tion could be a viable method for mitigatiny blackout scenario without operator action and HPME in the Surry Nuclear Power Plant (NPP). without r~covery and (b) an evaluation of depres-Subsequent analyses indicate that intentional de- surization~related probabilities.

• pressurization could also be effective for many other pressurized water reactors (PWRs). 2 The objectives of the SCOAP/RELAPS/

M003 analysis were to quantify the (a) time and Without operator action, natural circulation location of the initial RCS pressure boundary flows could develo'I, following accident initiation failure, (b) associated RCS conditions at the time and reactor coolant pump (RCP) coastdown. A of initial pressure boundary failure, and (c) RCS previous analysis of the Surry NPP identified the conditions at the time of reactor vessel lower significance of full loop, in-vessel, and hot leg head ,failure. Modeling based on previous work.3 countercurrent natural circulation modes with re- was included to allow for the development of 1 NUREG/CR-5949

Introduction natural circulation. Natural circulation flows tentional RCS depressurization of the Surry NPP.

provided a mechanism for the potential genera- The risk impact is being studied in support of an tion of ex-vessel failures. Code calculations Accident Management Program sponsored by from accident initiation through the time of low- the U.S. Nuclear Regulatory Commission er head failure were performed with and without (NRC). Probabilistic risk assessment (PRA) hot leg countercurrent natural circulation, with techniques will be used to determine the impact and without RCP seal leakage, and with varia- by comparing the risks of intentional depressur-tions on some of the more important core dam- ization with the risks that could be expected if age progression parameters. Be~;t-estimate plant operators take no action. Probabilities of parameters were used as inputs where there were RCS depressurization-related issues were evalu-data or where the effects of the parameters were ated based on current calculations for use in the understood. For parameters with a high degree risk analysis. The specific depressurization is-of uncertainty, values were selected to minimize sues considered included (a) the probability that the time to lower head failure, producing a con- an ex-vessel failure will occur before lower head servative evaluation of the potential for HPME. failure and (b) the probability of being at a low It was assumed that there were sufficient plant air RCS pressure at the time of lower head failure.

and battery power to operate the PORVs through-out the transient. Furthermore, the potential for PORV failures as a result of extremes in tempera- A description of the approach used to com-ture was not considered. Simple structural mod- plete the two-part assessment is provided in Sec-els of the ex-vesseJ piping were included to track tion 2. Pertinent details are provided with the potential for creep ruptures induced by the respect to the station blackout scenario, modeling combined effects of elevated temperature and of the Surry NPP with SCDAP/RELAP5/MOD3, pressure. Any predicted ex-vessel failure was ap- and assumptions used in performing the code propriately recorded, although an associated RCS blowdown was not simulated. Instead, the code calculations were extended to lower head failure without RCS depressurization, providing an approach for estimating the possible timing.

difference betwe~n all events.

calculations. A description of the method and basis for evaluation of the RCS depressurization-related probabilities is also included. SCDAP/

RELAP5/MOD3 results for all calculations per-formed in the first part of the assessment are de-scribed in Section 3. Section 4 contaips resulting probabilities for the depressurizatiori-related is-The objective of the second and final part of sues. Co1f].clusions and recommendations based the assessment was to provide input for an inde- on this assessment of the potential for HPME are pendent analysis addressing the risk impact of in- given in Section 5.

NUREG/CR-5949 2

Assessment Approach

2. ASSESSMENTAPPROACH

• A two-part approach was followed in com-pleting this assessment. In the first part, a de-tailed SCDAP/RELAP5/MOD3 analysis of a station blackout scenario without operator ac-and closing pressures of the relief valves thereaf-ter. Water in the steam generator secondaries is completely vaporized, as heat is transferred from the RCS to the steam generators. Once water in tions was performed. In the second part, proba- the steam generator secondaries is depleted, the bilities associated with depressurization-related steam generators no longer remove significant issues were evaluated. Both parts are described amounts of heat. Core decay energy then heats in the following sections. the RCS, resulting in system pressurization con-trolled by cycling pressurizer PORVs. The RCS 2.1 SCDAP/RELAP5/MOD3 pressure can also be influenced by RCP seal Analysis leaks, which could develop following the loss of seal cooling water associated with the loss of ac The SCDAP/RELAP5/MOD3 computer power. After the RCS saturates, a high-pressure code was used to calculate the transient response boiloff begins, ultimately leading to core uncov-of the Surry NPP during a station blackout sce- ery and heatup. Without recovery of power or nario without operator actions. SCDAP/RE- equipment, the transient proceeds to severe core LAP5/MOD3 is an integrated code package damage and melting.

designed for reactor accident analysis. Simula-tion of thermal-hydraulics, heat transfer, severe The Surry NPP was selected for t111alysis be-core damage, and :fission product transport are cause the pertinent information required to com-plete this assessment was readily available. The supported. A more detailed description of the code is provided in Appendix A.

• Surry NPP is a Westinghouse-designed PWR with a rated thermal power of 2441 MW. The A station blacJc_out scenario was modeled in core consists of 157 15x15 assemblies with an all SCDAP/RELAP5/MOD3 calculations be- active fuel height of 3.66 m. There are three pri-cause it is the single largest contributor to the fre- mary coolant loops. Each loop contains a U-tube quency of core damage for the Surry NPP. The steam generator, an RCP, and associated piping.

specific station blackout sequence selected for A single pressurizer is attached to the hot leg-pip-analysis is designated TMLB'. This sequence is ing in one of the three loops. 1\vo PORVs, with a initiated by the loss of offsite power. Onsite ac

• combined capacity of 45.1 kg/s, can be used to power is also unavailable because the diesel gen- relieve excess RCS pressure from the top of the erators fail to start or fail to supply power. De- pressurizer. One accumulator, with 29,100 kg of cay heat removal through the steam generators ~22-K borated water pressurized to 4.24 MPa by cannot be maintained in the long term because a nitrogen cover gas, is attached to each cold leg.

there is no ac power' for the electrical pumps, and [Accumulators are the only operational part of the steam driven auxiliary feedwater pumps also the emergency core cooling system (ECCS) dur-fail to supply water. ing a TMLB' sequence.] A subatmospheric con-tainment building surrounds the reactor syi,tems.

When the TMLB' sequence begins, power is lost to the control rod drives and pumps. A reac- Six different SCDAP/RELAP5/MOD3 cal-tor scram follows, with coastdown of the main culations for the Surry NPP were performed in feedwater pumps and RCPs. Feedwater is quick- this part of the assessment. It was assumed that ly reduced to zero as the main feedwater valves there were sufficient plant air and battery power close. The turbine stop valves close, and the to operate the PORVs throughout all calcula-pressure in the steam generators increases until tions. The potential for other PORV failure the relief (or dump) valves open. Steam genera- modes was not considered. Models were includ-tor pressures are maintained between the opening ed in all calculations to track the potential for 3 NUREG/CR-5949

Assessment Approach creep ruptures in the ex-vessel piping. As previ- straightforward. For that reason, a panel of ex-ously noted, all predicted ex-vessel failures were appropriately recorded, although an associated RCS blowdown was not modeled. Extending the code calculations to lower head failure without RCS depressurization provided a way to estimate the possible timing difference between all events.

perts was assembled to make a probabilistic de-termination of RCP leak rates in Westinghouse PWRs during a station blackout. 8 [The resulting expert opinions were used in a comprehensive PRA of the Surry NPP (and four other NPPs in the United States), as documented in NUREG-In the Base Case, full loop, in-vessel, and hot leg 1150.9] The panel concluded that the highest countercurrent natural circulation flows were probability leak rate was 250 gpm per RCP, considered. Those flows are consistent with con- while the maximum leak rate (at a low probabili-ditions that could develop following TMLB' ini- ty) was 480 gpm per RCP. 8 (A leak rate of 480 tiation without operator actions. Although hot gpm per RCP is consistent with failure of all leg countercurrent natural circulation is expect- three_ seal stages in a Westinghouse RCP. 6) ed, uncertainties exist with respect to :flow mag-nitude and the effectiveness of heat transfer to Based on results from the experts~ a leak rate ex-vessel structures. Based on those uncertain- of 21 gpm per RCP was introduced at TMLB' ties, hot leg countercurrent natural circulation initiation in Cases 3 through 6 to represent leak-was eliminated in Case 2. As a result, Case 2 age associated with the loss of seal cooling. In represents a bounding calculation where ex- Case 3, leakage was increased from 21 to 250 vessel heat transfer is minimized (which should gpm at the time water in the RCP reached satura-reduce the time to reactor vessel failure). Cases tion temperature to account for potential two-3 through 6 were designed to account for full phase instabilities. In Case 4, the maximum leak loop, in-vessel, and hot leg countercurrent natu- rate of 480 gpm per RCP was introduced at the ral circulation, along with the potential effects of time of RCP saturation. This case provides in-RCP seal leakage.

Under normal operating conditions, high-pressure systems S¥PP1Y cooling water flow to the seals to offset aidesign leak rate of approxi-mately 3 gpm per RCP. However, the loss of all formation on the depressurization rate and its po-tential impact on HPME.

Case 5 was identical to Case 3 except for the way heat transfer from molten materials was treated during relocation. In Case 3, it was as-ac power results in a loss of seal cooling water. sumed that molten materials would remain intact Without cooling water, leak rates increase as during relocation from the core to the low~r parts RCP seal temperatures increase. Leak rates of21 of the reactor vessel. This approach minimizes gpm per RCP have been calculated for intact heat,Ioss from the debris so that a relatively rapid RCP seals subjected to nonnal RCS temperatures thennal attack on the, reactor vessel can follow.

and pressures.6 In contrast, it was assumed in Case 5 that molten materials would break up during relocation. This Leak rates will obviously be higher if one or break-up could occur as a result of the molten more of the three seal stages in a Westinghouse material pour interacting with vessel structures RCP fail. The primary factors affecting seal be- and with water below the core. However, the havior during a TMLB' sequence are high- break-up of molten materials maximizes heat temperature survivability and the potential for transfer from the debris, which delays attack on hydraulic instability under two-phase flow condi- the reactor vessel until the debris has time to re-tions. 7 High-temperature survivability involves heat the potential for 0-ring degradation and blowout.

Hydraulic instability is relate,d to evidence sug- Case 6 was identical to Case 4 except for the gesting that flashing could cause one or more of treatment of fuel cladding defonnation. In Case the seal stages to pop open. Unfortunately, the 4, it was assumed that defonnation was limited to prediction of failure of any particular seal stage 2% because of an oxide buildup on the outer sur-(which leads to a particular leak rate) is not face of the cladding b~fore the onset of NUREG/CR-5949 4

Assessment Approach ballooning. The oxide layer is relatively strong 1273 K was used in all cases. Since less cooling

• but less ductile than the underlying zircaloy. As a result, oxidized cladding tends to fracture at small deformations, leading to earlier oxidation of the inner cladding surfaces with the potential for earlier core heatup associated with the exo-thennic reaction. In contrast, the limit on clad-is' required, this input could lead to a relatively early fragmentation of the core. As a result, core heatup, relocation of molten materials to the low-er head, and lower head failure could also occur relatively early.

• ding defonnation was increased from 2% to 15% Debris formation during core degradation re-in Case 6. This defonnation provides a potential sults in a flow restriction, leading to core heatup.

for larger in-core fl.ow blockage, which could af- As indicated in Table 2, the minimum :flow area fect core heatup by reducing convective heat through cohesive debris was set to 11 % of the transfer to the steam :flow (driven by natural cir- nominal flow area in all cases. At values of 10%

culation). In addition, core heatup could in- and less, SCDAP/RELAP5/MOD3 sets the flow crease, because the surface area available for area to zero. However, a flow area of zero corre-oxidation increases with deformation. sponds to coplanar blockage, which has not been obseived in limited test data. On that basis, 11 %

Appendix B contains a detailed oescription represents the maximum flow restriction consis-of the SCDAP/RELAP5/MOD3 model of the .tent with current understanding. By maximizing Surry NPP that was used to complete the six cal- :the flow restriction, core heatup and lower head culations. The rem4ining information in this sec- failure should occur relatively early.

tion is provided to clarify the di:fferences among the six calculations. The Zr02 failure temperature controls when oxidized cladding will fail, provided that the ox-Trip valves were used to represent RCP seal ide layer is less than the specified durable thick-leaks in the SCDAP/RELAP5/MOD3 model. ness. The failure temperature can vary between The relationship between transient time and trip the 'melting points of Zr (2023 K) and Zr0 2 valve :flow areas used in the subj~ct calculations (2963 K). A value of 2400 K was used in all cas-is summarized in Table 1. es, as recommended by the SCDAP code devel-opment staff.

SCDAP input is required to define certain parameters that control severe core damage pro- Durable thickness is represented by *the frac.:. ..

gression. In general, best-estimate parameters tion of oxidation necessary for the cladding to were selected where there were data or where the withstand attack by molten Zr. Once the durable effects of the parameters were understood. For ,thickness is reached, the oxidized cladding will parameters with a high degree of uncertainty, remain intact until the Zr02 is heated to the spec-values were selected to minimize the time to ified failure temperature (2400 K in this analy-lower head failure. This approach provides the sis). As a result, higher values tend to promote basis for a conseivative evaluation of the poten- earlier relocation. On that basis, the Zr02 was tial for HPME, since time is minimized for gen- assumed to be durable only if completely (100%)

. eration of an ex-vessel failure by natural oxidized, as indicated in Table 2.

convection heating and for RCS inventory deple-tion. The resulting parameter set is listed in Ta- SCDAP inputs are required to specify (a) the ble 2. The following discussion outlines the length of time required for a molten pool to drain logic used to establish these values. from the core into the lower head, (b) the length of time required for individual rods to slump, and A temperature must be input to specify the (c) the lengths of time over which in-core area cooling required to fragnient core components and volume changes occur as a result of core during a quenching process. The expected range damage. The subject calculations should not be is from (Tsat + 100) K to 1273 K. As indicated in sensitive to any of those time inteivals. Howev-Table 2, a core fragmentation temperature of er, results from scoping calculations indicated 5 NUREG/CR-5949

Assessment Approach Table 1. Parameters for simulation ofRCP seal leaks.

Case Time RCP seal parameters 1 2 3 4 5 6 From TMLB' initia- Leak flow area = 0.0 X X tion to lower head (Basis: no ~.CP seal leakage) failure From TMLB' initia- Leak flow area= 8.77E-6 m 2 X X X X tion to RCP satura- (Basis: 21 gpm per RCP at 561 K, 15.5 MPaa) tion From RCP saturation Leak flow area = 1.50E-4 m 2 X X to lower head failure (Basis: 250 gpm per RCP of saturated. liquid at 16.0 MPa0)

From RCP saturation Leak flow area= 2.88E-4 m 2 X X to lower head failure (Basis: 480 gpm per RCP of saturated liquid at 16.0 MPac)

a. For intact RCP seals at operating temperatures corresponding to the loss of seal cooling at TMLB' initiation.6

b. Highest probability leak rate8 at the average pressure during PORV cycling.

c. Maximum leak rate, corresponding to failure of all three seal stages6*8 at the average pressure during PORV cycling.

Table 2. SCDAP severe core damage parameters Case SCDAP severe core damage parameter 1 2 3 4 5 6 Fragmentation temperature during quenching: 1273 K X X *x X X X Minimum cohesive debris flow area: 11 % of nominal X X X x. X X X X X X X X Zr02 failure temperature: 2400 K X X X X X X Zr02 durable thickness: 100%

X X X X X X Molten pool relocation time interval: 68 s Debris to vessel thermal resistance: 0.0001 m2-K/W X X X X X X Cladding rupture strain: 2% na na X X X Oadding rupture strain: 15% na na X Threshold strain for double-sided oxidation: 1% na na X X X X X X X X X Intact stream of liquefied debris during relocation to lower head (resulting in minimum debris/coolant heat transfer)

Breakup of stream of liquefied debris during relocation to lower head (resulting in maximum debris/coolant heat transfer)

NUREG/CR-5949 6 X

Assessment Approach that the default molten pool relocation time inter- '.SCDAP input is required to define the cladding val (10 seconds) car~ lead to code execution prob- defonnation associated with ballooning.

lems, especially 1 when debris breakup is assumed. For that reason, the length of time for Cladding defonnation is a function of the ox-molten pool relocation was set to 68 seconds in ide thickness relative to the onset of ball9oning.

all cases, as indicated in Table 2. This time value If ballooning begins before the cladding is heated was based on an estimate that the entire core in to ,200 K, any oxide layer will be negligible.

Westinghouse NPPs could be relocated to the According to the* S~DAP code de.velopment lower head in as little as 425 seconds. 8 The esti-staff, significant ballooning can occur before rup-mate was made by accounting ,for the gravity head of the molten pool and the size of passages ture in unoxidized cladding. However, a signifi-through lower head structures. In these calcula- cant oxide layer will be established if the heatup tions, individual channel relocation times could rate is slow(< 1 K/s), and ballooning does not vary from 68 to 260 seconds based on simple begin before the cladding reaches 1300 K. Un-scaling by the number of assemblies per channel. der those conditions, deformation is controlled The minimum relocation time interval was se- by the oxide layer because it is stronger than the lected consistent with the effort to minimize the underlying zircaloy. Because the oxide layer is time to lower head failure. relatively brittle, however, rupture will occur at relatively small defonnations of 2% (orless).

, A thennal contact resistance must be input to characterize heat transfer between relocated core Results from scoping calculations indicated materials and the lower head vessel wall. Near- that the small deformation criteria should apply perfect (conduction-limited) thermal contact for seal leak rates of 250 gpm per RCP. On that might be possible at the time molten core materi-basis, a cladding rupture strain of 2% was as-als first make contact with the lower head. How- sumed in Cases 3 and 5 (see Tables 1 and 2).

ever, considerable resistance could be postulated More significant-ballooning could be expected, between solidified debris and the lower head. based on scoping calculations, for Cases 4 and 6 Because the possible range is large, variable, and

.(with seal leaks of 480 gpm per RCP). However, not easily quantified, the thennal contact resis-Case 4 calculations were also perfonned with a tance. between relocated materials and theJower . ** *ruprure strain of 2%. This allows a*direct com:. ***

head was set to 0.0001 m2-K/W in all cases, as parison with Case 3 to assess the effects associat-indicated in Table 2. This value should be small ed with seal leak rates only. In Case 6, a rupture enough to approximate molten contact. In addi-strain corresponding to cladding deformation of tion, application of the value for all other condi-tions is consistent with the effort to minimize the 15% was assumed, with the understanding that time to lower head failure. extensive ballooning could occur in localized ar-eas of the core. As discussed in Appendix B, Ballooning of the fuel rod cladding can occur however, the total number of fuel pins in the Sur-if the internal pin pressure exceeds the external ry NPP was divided into three groups. All fuel (RCS) pressure. Ballooning does not occur in pins within each group are assumed to respond the Base Case or in Case 2 because the RCS similarly in SCDAP/RELAP5/MOD3. Accord-pressure is controlled throughout the transient ing to the SCDAP code development staff, it between the opening and closing set points of the would be unreasonable to expect the average de-PORVs, which are well above the internal pin formation (over a large number of fuel pins) to pressures. However, ballooning can occur in exceed 15%. The selected value is assumed to be Cases 3 through 6 following RCS depressuriza- near the upper limit of the average deformation tion through RCP seal leaks. For these cases, that could be expected. (As previously ex-plained, neither of these inputs apply to the Base

a. Unpublished research by J. L. Rempe on light Case or Case 2 because high RCS pressures pre-water reactor lower head failure analysis. clude ballooning.)

7 NUREG/CR-5949

Assessment Approach If the cladding balloons and ruptures, the in- ther primary or secondary feed-and-bleed opera-ner cladding surfaces may be oxidized (along with outer cladding surfaces) as a result of expo-sure to high-temperature steam. SCDAP re-quires input to define the threshold deformation for onset of this double-sided oxidation. As indi-cated in Table 2, double-sided oxidation is not tions).

An independent analysis is planned to deter-mine the risk impact associated with intentional depressurization of the Surry NPP. The analysis

.is needed to support an NRC Accident Manage-applicable in the Base Case or in Case 2 (since ment Program. PRA techniques will be used to high RCS pressure prevents ballooning). For determine the impact by comparing the risks of Cases 3 through 6, however, double-sided oxida- intentional depressurization with the risks that tion was assumed following cladding rupture at could be expected if plant operators take no ac-all rod locations with defonnations of at least tion. Specifically, the 1isk analysis will be based 1%. on the probabilities of issues associated with both intentional and unintentional RCS depres-Molten materials may pour from the core to surization. Issue probabilities for intentional and the lower head in a coherent stream, or the pour unintentional RCS depressurization will be eval-may be broken up as a result of interactions with uated in this assessment, as discussed below.

vessel structures and water below the core. In general, breakup results in quenching the debris, Issues that required evaluation in order to with a corresponding pressurization that results complete the risk analysis were determined from associated vapor production. The quenched through examination of the accident progression debris will then have to reheat before an effective event tree (APET) developed for use in NUREG-lower head thermal attack can begin. On the oth- 1150.9 Specifically, the APET was examined to compile a list of those RCS depressurization-er hand, heat transfer to the coolant is minimized and thermal attack on the lower head is maxi- related issues that have the largest influence on mized if the debris remains intact. Consistent the risk results. The list included two issues that with the effort to minimize the time to lower could be affected by the current SCDAP/RE-head failure, intact debris relocation was as- LAP5/MOD3 analysis (and other related analy-sumed in Cases 1 through 4 and Case 6, as indi- ses completed after NUREG-1150). These cated in Table 2. Because debris breakup is a issues are expressed as follows significant possibility and because breakup pro- 1. What is the probability that the surge duces a pressurization that could affect the line or hot leg will fail and depressurize HPME potential, debris breakup was the as- the RCS to a low pressure before lower sumed sensitivity parameter in Case 5. head failure?

2. What are the probabilities of being at a 2.2 Probability Evaluation low, intermediate, and high RCS pres-sure at the time of reactor vessel breach?

Intentional depressurization of the RCS be-fore reactor vessel breach has been proposed as (Consistent with NUREG-1150, low, intermedi-an accident management strategy to mitigate the ate, and high RCS pressures were taken to be severity of HPME in PWRs. The strategy, where pressures below 1.38 MPa, pressures between plant operators latch pressurizer PORV s open, is 1.38 and 6.89 MPa, and pressures above 6.89 expected to reduce the risks associated with MPa, respectively.)

PWR operation because the potential for contain-ment failure as a result of DCH should be mini- Probabilities associated with the two depres-mized if HPME Cjln be mitigated. The strategy surization issues were originally quantified by a could be employed in cases where strategies in- NUREG-1150 in-vessel expert panel for Surry

• tended to prevent core damage are not possible TMLB' sequences both with and without RCP (i.e., where cooling water is unavailable for ei- seal leaks. (A third scenario was postulated, NUREG/CR-5949 8

Assessment Approach consisting of a TMLB' sequence with RCP seal will be conditional on the occurrence of the vari-leaks and operational auxiliary feedwater sys- ous TMLB' sequences as described.)

tems. However, the scenario was eliminated from consideration in NUREG-1150 based on The approach used to evaluate the issue the assumption that the availability of feedwater probabilities was closely patterned after the ex-would reduce the probabilities for core melting pert elicitation method followed in completion of and RCS depressurization through a surge line or NUREG-1150. In general, the issues were first hot leg failure.) decomposed (or separated) into parts that were easier to evaluate; end-point probabilities were established for each part; a distribution was as-This part of the subject assessment was per-sumed between the end points; and the resulting formed to update the probabilities associated distributions were recombined to arrive at a with the identified issues based on current analy-probability for the issue. However, establishing ses. A better estimate of the risk associated with the end-point probabilities was the key to the intentional depressurization is anticipated whole process. The end points were not simply through use of the updated results. Like derived from the available calculational results.

NUREG-1150, probabilities for both RCS de- Instead, the results were used as a basis for fur-pressurization issues will be (re)quantified for ther evaluation. In some cases, engineering TMLB' sequences with and without RCP seal judgments were made to assess the magnitude of leaks. In addition, the potential for RCS depres- potential uncertainties in the results. In other surization during a TMLB' sequence with a cases, potential uncertainties were addressed by stuck-open or latched-open PORV was recog- completing sensitivity calculations using nized. Therefore, probabilities for both issues SCDAP/RELAP5/MOD3.

will also be quantified for that sequence. Issue probabilities developed for the TMLB' sequence In addition to evaluation of the issue proba-with the latched-open PORV will be used to de- bilities, timing information from the current termine risks associated with intentional depres- SCDAP/RELAP5/MOD3 calculations was also surization. Risks associated with unintentional needed to update ac recovery probabilities in the depressurization will be based on issue probabili- APET. The necessary information was directly ties developed for the remaining TMLB' se- calculated during the SCDAP/RELAP5/MOD3 quences. (Obviously, the resulting probabilities analysis and is documented in this report.

• 9 NUREG/CR-5949

Calculation Results

3. CALCULATION RESULTS A SCDAP/RELAP5/MOD3 analysis of Sur- The sequence of events from TMLB' initia-ry NPP behavior during a TMLB' sequence with- tion through creep rupture failure of the lower out operator action and without recovery was head for the Base Case is listed in Table 3. The completed. Results from that analysis, which table contains quantitative information that comprised six different cases, are described in should be helpful in understanding the following this section. Uncertainties and limitations asso- description of the calculation. (Selected core ciated with the results are also discussed. damage results for this case, and all other cases considered in this analysis, are tabulated in Ap-Steady-state initialization of the complete pendix F for reference.)

SCDAP/RELAP5/MOD3 model was required before making any of the transient calculations Following transient initiation, decay heat described. below. Steady-state initialization in- was transported from the core to the steam gener-volved bringing the model to stable conditions ator secondaries by full loop natural circulation representing full-power operation of the Surry in all three primary coolant loops. As the water NPP, which provided a starting point for each in the steam generator secondaries boiled off, the case. Initialization was considered acceptable energy removed from the RCS by the steam gen-when conditions matched the steady-state results erators *dropped below the decay energy being used in a previous study of the plant.3 A summa- added in the core; and the RCS began to heat up ry of the steady-state results is given in Appendix and pressurize. The pressurizer PORVs con-C. Run-time statistics for all SCDAP/RELAP5/ trolled the RCS pressurization by cycling be-MOD3 calculations that were performed in this tween the opening and closing set points of 16.2 analysis are compiled in Appendix D. and 15.7 MPa, respectively. Boiling in the core began at 115.0 minutes. Vapor generated during 3.1 Base Case the boiling collected in the top of the steam gen-erator U- tubes, terminating full loop natural cir-

• The Base Cast calculation included provi- culation at 122.2 minutes. Venting of coolant by

. sions for full loop, in-vessel, and hotleg counter-**

• the pressurizer PORVs reduced the RCS* liquid current natural circulation flows with initial and

• inventory, which uncovered the top of the core at boundary conditions identical to those used in a 145.0 minutes, initiating core heatup and super-previous study3 for a TMLB' sequence without heating of RCS vapor. The core was completely RCP seal leaks. The Base Case differed from the uncovered by 176.7 minutes, with rapid oxida-previous study in the code version used tion of the fuel cladding commencing at 180.7 (SCDAP/RELAP5/MOD3 versus SCDAP/RE- minutes. Cyclic flow through the pressurizer LAP5/MOD0) and in the end point of the calcu- PORV (to control RCS pressure) and hot leg lation (lower head failure versus initial fuel rod countercurrent natural circulation removed decay relocation). Completion of the Base Case was energy from the core, producing a heatup of the necessary because df those differences. As dis- hot leg and pressurizer surge line piping. This cussed in Appendix E, Base Case results were ex-vessel heatup resulted in a predicted creep compared to the results from the previous study rupture failure of the pressurizer surge line at to benchmark the code version and model before 237.5 minutes. As previously explained, howev-completing the other calculations described in er, a blowdown was not modeled following surge

• this section. In the benchmark calculation,

• line failure or any other RCS pressure boundary MOD3 events were found to occur somewhat failure. Instead, the calculation was allowed to (but not significantly) earlier than in MODO. The proceed without RCS depressurization to deter-

• differences appear to be consistent with model improvements that have been implemented in the later code version.

11 mine the timing of all other events. Consistent with that approach, creep rupture failures of the hot leg nozzles were predicted between 258.3 NUREG/CR-5949

Calculation Results Table 3. Sequence of events for the Base Case.

Time Event (min)

TMLB' initiation 0 Steam generator dryout (pressurizer/nonpressurizer loops) n.on8.3 Initial cycle of pressurizer PORV 78.0 Pressurizer filled with liquid 95.8 Core saturation 115.0 Full loop natural circulation of liquid ends 122.2 Reactor vessel liquid level drops below top of fuel rods 145.0 Core exit superheat; hot leg countercurrent circulation begins 149.8 Reactor vessel li'-!llid level drops below bottom of fuel rods 176.7 Onset of fuel rod oxidation 180.7 Core exit vapor temperature at 922 K First fuel cladding failure; cladding temperature > 2400 K Surge line creep rupture failure 185.2 235.5 237.5 Hot leg creep ruptdre failures (pressurizer/nonpressurizer loops) 258.3/260.8 First appearance of an in-core molten pool 278.3 Crust failure; molten core relocation to lower head 480.8 Creep rupture failure of lower head 482.0 End of calculation 483.3 and 260.8 minutes. Ceramic melting of core ma- materials led to creep rupture failure of the lower terial at 278.3 minutes initiated the fonnation of head at 482.0 minutes.

an in-core molten pool supported by a metallic crust located at the bottom of the fuel rods. The RCS pressure response during the Heating by the molten pool thinned the crust to TMLB' transient is shown in Figure 1. The pres-the point of failure at 480.8 minutes. Approxi- sure initially decreased from the steady-state op-mately 57,060 kg of molten U02 and 9930 kg of oxidized cladding were relocated to the lower head as a result. Thennal attack by the molten NUREG/CR-5949 12 erating pressure of 15.5 MPa because the steam generators removed more energy than was being added by the core. The oscillations in the

Calculation Results

• 17.0 16.5

-:a:

a, a..

16.0 Q)

J 15.5 en en Q) a.. 15.0 14.5 14.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 1. Pressurizer pressure for the Base Case.

pressure before steam generator dryout at about the core, the boiloff became more gradual be-77 .0 minutes reflected the cycling of the steam cause heat transfer from the core to the liquid generator secondary relief valves. Following was through superheated vapor. As indicated in steam generator dryout, the pressure increased to Figure 2, vessel dryout occurred at about 450 the PORV opening pressure. The pressure then minutes. * * **

cycled between the PORV opening and closing set point for the remainder of the transient. Since Cladding surface temperatures along the RCS blowdown was not modeled in response to height of the center fuel channel are shown in any pressure boundary failures, there was no Figure 3. The heatup progressed from the top RCS pressure reduction associated with the fail- down as the liquid boiled out of the core. The ures listed in Table 3. The pressure increase upper portions of the fuel rods began oxidizing at above the PORV set point at about 125.0 minutes 180.7 minutes, when the cladding temperature resulted from the pressurizer becoming liquid- exceeded about 1000 K. When the temperature filled and the PORV venting liquid with a lower reached 1850 K, the oxidation kinetics changed specific energy than vapor. and the heatup became more rapid. When the temperature reached 2400 K, the cladding failed; The collapsed liquid level in the reactor ves- and unoxidized cladding and dissolved fuel relo-sel is shown in Figure 2. Following RCS satura- cated downward as a molten Zr-U0 2 eutect~c, tion at 115.0 minutes, the vessel water level stopping the oxidation reaction. This relocation boiled down rapidly to the bottom of the active was reflected in the rapid temperature rise in the fuel. The flattening of the boiloff at about 130 bottom nodes of the core where the relocated ma-minutes was caused by the liquid in the coolant terial cooled and resolidified. The relocated Zr-loops draining into the vessel through the hot and uo2 combined with previously frozen control cold leg nozzles. When the level dropped below rod material at the bottom of the core to form a 13 NUREG/CR-5949

Calculation Results

-E ai 15.0 . - - - - - . - - - . . - - - ~ - - - r - - - - - - r - - - r - - ~ - - ~ - ~ - ~

[> 12.0 32 ----**-***----*-***,

~

.Q"

"'O Q) 9.0 en a.

cu 0

0 6.0

\

Q) en en

~

0 0

cu Q) a:

100.0 200.0 300.0 400.0 500.0 Time (min}

Figure 2. Reactor vessel collapsed liquid level for the Base Case.

4000.0

- - 0.18 m above core inlet

- - - - - 0.91 m above core inlet B---£J 1.65 m above core inlet G- - - E) 2.38 m above core inlet 3000.0 ls--f:,. 3.47 m above core inlet q

Q)

°e Q) 2000.0 a.

E Q) 1-1000.0 Molten relocatio 0.0 L -_ ___.__ ___,___ ___._ __ L __ _ ~----'---~--L-._----'----'

0.0 100.0 200.0 300.0 400.0 500.0 Time (min}

Figure 3. Fuel rod cladding surface temperatures in the center fuel channel for the Base Case.

NUREG/CR-5949 14

Calculation Results metallic crust. The core then melted from the Figure 6, control rod housings should have began crust upwards, as indicated by node temperatures melting by 250 minutes; and one would expect in excess of 3000 K. A sustained molten pool oxidation of the stainless steel at those tempera-was formed at 278.3 minutes and grew as fuel tures. However, the current version of SCDAP/

and oxidized cladding above the pool formed RELAP5/MOD3 does not account for the oxida-rubble debris, broke through the top crust, and tion or melting failure of structures outside the became part of the pool. Failure of the bottom core. Therefore, none of the subject calculations crust at 480.8 minutes allowed a molten reloca- predicted changes in plant configuration (outside tion into the lower head. An associated thermal the core) as a result of melting. Total hydrogen attack led to creep rupture failure of the lower production should increase if oxidation outside head at 482.0 minutes, some 244.5 minutes after the core were considered. In addition, the mass the predicted failure of the surge line. of the in-core molten pool would increase if up-per plenum structures were allowed to slump into The mass flow rate in the top of one of the the pool as they melted. However, the power nonpressurizer loop hot legs is shown in Figure density would decrease because the affected

4. After the hot leg countercurrent renodaliza- structures would not contribute to the generation tion was introduced at 149.8 minutes, a natural of decay heat circulation pattern was established, which de-creased steadily throughout the transient. The Creep rupture of the surge line was the first cycling of the PORV momentarily reversed the failure of the RCS pressure boundary in this cal-natural circulation flow, as vapor was drawn to- culation. Failure of the reactor vessel lower head ward the pressurizer surge line. When the PORV did not occur until 244.5 minutes later. As indi-closed, however, the natural circulation pattern in cated in Table 3, hot leg creep ruptures were also the hot leg was rapidly re-established. Vapor well ahead of lower head failure. The RCS pres-

• temperatures in the top and bottom of the hot leg nozzle for this same loop are shown in Figure 5.

A large sustained temperature gradient across the hot leg nozzle was maintained from 149.8 min-utes through the end of the transient. Vapor tem-peratures increased rapidly when the cladding sure was high (approximately 16.0 MPa) at the time of all failures. However, a previous calcula-tion has shown that a moderately sized surge line break can depressurize the Surry RCS from full system pressure, through a complete accumulator dump, to a pressure of 1.38 MPa within several oxidation rate increased at about 235 minutes. minutes.3 Based on that calculation and the time The sustained vapor temperature increase, begin- available for depressurization, the RCS would be ning at around 320 minutes, resulted from a core-

• at a low pressure at the time of lower head fail-wide blockage that was completed when a mol- ure. Therefore, the potential for HPME does not ten region was established in the outer flow chan- exist in the Surry NPP for the conditions consid-nel. ered in this calculation.

Temperatures of the hottest structure in the 3.2 Case 2 upper plenum, the pressurizer surge line at the hot leg connection, the top of the pressurizer loop This calculation was performed to evaluate hot leg nozzle, and the hottest steam generator the effect of hot leg countercurrent natural circu-tube are shown in Figure 6. Because of its small- lation on the potential for HPME through com-er thermal mass, the pressurizer surge line heated parison to the Base Case. In this calculation, the up faster and was predicted to fail earlier than the flow paths that could allow development of hot hot leg nozzle. The steam generator tubes re- leg countercurrent natural circulation were elimi-mained relatively cool because most of the ener- nated. As indicated in Tables 1 and 2, this case gy in the circulating steam was transferred to the was identical to the Base Case with that excep-

• piping upstream of the generators. In fact, there were large margins before any steam generator tube failures could be expected. As indicated in 15 tion. Since countercurrent natural circulation will not occur until there is core vapor superheat, the sequence of events from TMLB' initiation to NUREG/CR-J949

Calculation Results 6.0 4.0

-- en C>

.::it:.

Q) ct!

2.0 0.0

~

0 en en -2.0 ct!

~

-4.0

-6.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 4. Mass flow rate in the top of a nonpressurizer loop hot leg (A) for the Base Case.

2500.0

- - Top of hot leg A

/r---------6 Bottom of hot le A 2000.0

-S2'

~

J ca....

Q) 1500.0 a.

E Q) 1-1000.0 500.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure S. Vapor temperatures in the top and bottom of a nonpressurizer loop hot leg (A) for the Base Case.

NUREG/CR-5949 16

Calculation Results

• 2500.0 2000.0

- - Hot leg C nozzle

- - -

• Loop C steam generator tube

-surge line B- - -o Control rod housing /

.u I

I I

I

~

Stainless steel melt tern erature Q)

, I c!l I

cii

.... 1500.0 Q) Surge line failure"'"'/

a.

E Q)

I I-I

---

Hot leg failures ,,,.--

1000.0

,,,.,"'r--...... - -- -... -

500.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 6. Volume-averaged temperatures of various structures in the pressurizer loop (C) and the reactor vessel for the Base Case.

149.8 minutes is identical to those listed in Table In Case 2, the cladding reached 2400 Kand be-3 for the Base Case. The sequence of events gan failing at 206.0 minutes, 29.5 minutes earlier from 149.8 minutes through creep rupture failure than in the Base Case. The resultant relocating of the lower head for this case is listed in Table 4. Zr-U02 cooled and solidified between 1.10 and 1.46 m above the bottom of the fuel rods instead The progression of core damage was faster in of at the core bottom, as observed in the Base Case 2 than in the Base Case. By eliminating hot Case. The crust in Case 2 solidified at a higher leg countercurrent flow, the only structures avail- elevation in the core because molten relocation able to absorb core decay heat were those in the occurred earlier in the transient, when the reactor upper plenum and those along the flow path from vessel liq1,1id level was higher. Consequently, the the upper plenum to the pressurizer PORV (i.e., initial melting of ceramic debris occurred near the structure in the hot leg between the vessel the core midplane, which produced a molten pool and pressurizer surge line and the pressurizer with a higher specific heat generation rate than surge line). The faster core heatup produced a the Base Case molten pool. Crust heatup in Case more rapid increase in vapor temperatures than 2 was significantly faster than in the Base Case, observed in the Base Case and resultedI in creep due to the higher specific heat generation rate rupture failures of the pressurizer surge line and and the fact that the lower crust surface was ex-the pressurizer loop hot leg nozzle 22 and 24 posed to a high-temperature core environment, as minutes earlier than in the Base Case, respective- opposed to the relatively cool lower plenum. As ly. a result, the bottom crust failed at 257.8 minutes;

• There was also a major difference between the two calculations ,in core damage progression.

17 and 6850 kg of molten material relocated to the lower head. The relocation resulted in a creep rupture failure of the lower head at 260.1 NUREG/CR-5949

Calculation Results Table 4. Sequence of events for Case 2.

Time Event (min)

Core exit superheat; calculation begins 149.8 Onset of fuel rod oxidation 177.0 Reactor vessel liquid level drops below botton of fuel rods 177.3 Core exit vapor temperature at 922 K 179.5 First fuel cladding failure; ruptured by melting 206.0 Surge line creep rupture failure 215.5 Hot leg creep rupture failure (pressurizer loop) 234.3 First appearance of an in-core molten pool 253.0 Crust failure; molten core relocation to lower head 257.8 Creep rupture failure of lower head 260.1 Second molten core relocation (through previously failed crust)

Hot leg creep rupture failures (nonpressurizer loops)

End of calculation 266.5 278.8 283.2 minutes, approximately 222 minutes earlier than are shown in Figure 8. Without hot leg counter-in the Base Case. current natural circulation, the vapor temperature in the pressurizer loop was always hotter than in The first fuel cladding failures in Case 2 oc- the nonpressurizer loop. The nonpressurizer curred in the middle core channel. Fuel rod clad- loop hot leg nozzle did heat up between PORV ding surface temperatures along the height of the cycles, as the RCS pressurization caused some middle channel are shown in Figure 7. The up- vapor to flow into all of the coolant loops. How-per portions of the channel reached the 2400-K ever, the dominant heat transfer mechanism was failure temperature for oxidized Zr, while the the PORV cycling, drawing superheated vapor lower portions of the fuel remained relatively into the pressurizer loop. Temperatures repre-cool. As previously noted, the relocating Zr-U02 eutectic relocated and solidified to form a senting the hottest structure in the upper plenum, metallic crust in the middle channel about 1.46 m the pressurizer surge line at the hot leg connec-above the bottom of the fuel rods. The reduction tion, the top of the pressurizer loop hot leg noz-in cooling associated with the crust :fl.ow restric- zle, and the hottest tube in the pressurizer loop tion led to melting above the crust. steain generator are shown in Figure 9. As indi-The vapor temperatures in the hot leg noz-zles of the pressurizer and nonpressurizer loops NUREG/CR-5949 18 cated, upper plenum* structures were heated to temperatures above their melting points. How-ever, steam generator tubes did not heat up be-

Calculation Results

• 4000.0 ~ - ~ - ~ - . , . . - - - . , . . - - - ~ - ~ - ~ - . - - - - - - . - - - r - - - - - - , - - - - ,

3000.0

- - 0.18 m

- - -

• 0.91 m C3----tl 1.28 m G - -o 1.65 m l!r---6 3.47 m above above above above above core core core core core inlet inlet inlet inlet inlet Molten relocatio sz Q)

l I

//

//

ff cu.... 2000.0 I

I

,.o- ,

Q) ',,....,0 I

a. I E I Q) ' ,

1- ' ,, /

1000.0 0.0 0.0 100.0 200.0 300.0*

Time (min)

Figure 7. Middle channel fuel rod cladding surface temperatures for Case 2.

2000.0

- - HotlegA G----> Hot le C

~ 1500.0 Q)

l cu....

Q) a.

E Q)

I- 1000.0 500.0 0.0 100.0 200.0 300.0 Time (min)

• Figure 8. Vapor temperatures in the pressurizer and nonpressurizer loops (C and A) for Case 2.

19 NUREG/CR-5949

Calculation Results 2500.0 . - - - - - - , c - - - - - - - , - - - - - r - - - - - , - - - - ~ - - - ~

2000.0

- - Hot leg C nozzle

- - - Loop C steam generator tube B---i:l Control rod housing 13- - -o Surge line

-52'

~

Stainless steel melt tern erature

- ..[)- - - ~ ca....

Q) 1500.0 Surge line failure a.

E Q) 1000.0 \ Hot leg failure 500.0 ' - - - - - ~ - - - - ' - - - - - - ~ - - - - - - - ' - - - - - ~ - - _ _ _ J 0.0 100.0 200.0 300.0 Time (min)

Figure 9. Volume-averaged temperatures of various structures in the pressurizer ~oop (C) and reactor ves-

• sel for Case 2.

cause of the absence of hot leg countercurrent posely I

selected to accelerate lower head failure.

flow. On that basis, there is no potential for HPME in the Surry NPP for the conditions considered in In Case 2, as in the Base Case, creep rupture this calculation. Taken together, the Base Case failures in the ex-vessel piping were predicted to and Case 2 results indicate that the potential for occur before lower head failure. However, the HPME is not affected by hot leg countercurrent 44.6-minute margin between surge line failure natural circulation with the RCS at full system and lower head failure was considerably smaller pressure.

than the Base Case margin of 244.5 minutes.

Surge line failure times were.comparable in the 3.3 Case 3 two cases, but lower head failure was significant-ly faster in Case 2. That difference resulted from the elimination of hot leg countercurrent natural This calculation was performed to evaluate circulation. Without countercurrent flow, most the effect ofRCP seal leakage (as specified in Ta-of the ex-vessel piping that can act as a sink for ble 1) on the potential for HPME. Details of this core decay heat is lost, which led to a relatively calculation are described to facilitate evaluation faster core heatup and lower head failure in Case of other RCP seal leak cases and comparison

2. Although the margin of 44.6 minutes between with the Base Case. The sequence of events surge line and lower head failures is relatively from TMLB' initiation to creep rupture failure of small compared to the Base Case, it is quite large the lower head for this calculation is listed in Tu-compared to the time required to depressurize the Surry RCS through a surge line failure. 3 In addi-tion, SCDAP/RELAP5/MOD3 input was pur-NUREG/CR-5949 20 ble 5. The table contains quantitative informa-tion that should be helpful in understanding the following description.

Calculation Results

• Table S. Sequence of events for Case 3.

Event Time (min)

TMLB' initiation 0 Steam generator dryout (pressurizer/nonpressurizer loops) 79.0/81.7 Initial cycle of pressurizer PORV 97.3 Core saturation 117.8 Pressurizer filled with liquid 118.0 RCP saturation; increased seal leaks to 250 gpm per RCP 123.5 I Full loop natural circulation of liquid ends 124.3 Reactor vessel liquid level drops below top of fuel rods 146.8 Core exit superheat; hot leg countercurrent circulation begins 149.8

• Pressurizer PORV final cycle Onset of fuel rod oxidation Reactor vessel liquid level drops below bottom of fuel rods 161.3 184.0 189.3 Core exit vapor temperature at 922 K 195.0 First fuel cladding failure; ruptured by ballooning 220.5 First relocation of molten control rod materials to lower head 233.0 First accumulator injection 238.0 First appearance of an in-core molten pool 241.8 Hot leg creep rupture failures (pressurizer/nonpressurizer loops) 334.8/335.0 Surge line cre~p rupture failure 337.2 Crust failure; molten core relocation to lower head 403.3 Creep rupture failure of lower head 405.7

• End of calculation 21 430.0 NUREG/CR-5949

Calculation Results Seal leaks of 21 gpm per RCP were intro- condensation of vapor produced in the core duced at TMLB' initiation to account for seal stopped. Thereafter, generated vapor began to heating caused by the loss of cooling water. Like collect in the top of the steam generator U-tubes, all calculations perfonned, a sharp reduction in *which tenninated full loop natural circulation of RCS pressure of alfout I MPa was predicted at liquid at 124.3 minutes, as shown in Figure 11.

the same time. That pressure reduction occurred because the reactor power dropped quickly (fol- In-core boiling and discharge through the lowing reactor scram) relative to RCP coast~ PORV and RCP seals reduced the RCS invento-down. With relatively low power and high ry, with core uncovery beginning at 146. 8 min-

' coolant flow, heat removal through the steam utes'. The corresponding reactor vessel collapsed generators produced the cooling necessary for liquid level is shown in Figure 12. A renodaliza- .

pressure reduction. As shown in Figure 10, the tion of the hot legs was incorporated at 149.8 RCS pressure then recovered to about 15.2 MPa.

• minutes to add flow paths for countercurrent nat-At that point, RCP coastdown was complete; and ural circulation. (The potential for development full loop natural circulation of subcooled liquid of that flow pattern did not exist until the hot legs was established. were voided and superheated vapor was avail-able to provide the required driving potential.)

Natural circulation of liquid provided the At 161.3 minutes, voiding of the cold legs was mechanism for transferring core* decay heat to complete, leaving the RCP seal leaks uncovered.

the steam generator secondaries, resulting in a At that time, energy dissipated by vapor dis-boiloff of the secondary inventories. At the same charge through the RCP seal leaks plus the heat time, RCS mass was also discharged through transferred to vessel and ex-vessel structures ex-RCP seal leaks. Those combined effects resulted ceeded the decay power. As a result, PORV cy-in a gradual pressure reduction to about 12 MPa cling ended and a second RCS depressurization at 80 minutes, as shown in Figure 10. At that followed, as shown in Figure 10.

point, RCS heat removal through boiloff of the secondary inventories*was complete.

Cladding oxidation began at 184.0 minutes.

However, the initial oxidation rate was moderate, At steam generator dryout, the sum of the en-with little impact on the heatup. Oxidation be-ergy removed by superheating vapor in the sec-came more vigorous as temperatures increased ondaries and the energy. dissipated through the following complete core uncovery at 189.3 min-RCP seal leaks was less than the decay heat pro-utes. At that time, the exothennic oxidation re-duced in the core. As a result, temperatures and action began to drive a core temperature pressures in the RCS began to increase. At 97.3 increase, which led to fuel rod gas pressurization minutes, the RCS pressure reached the opening and the first cladding rupture due to ballooning at set point (16.2 MPa) of the pressurizer PORV.

220.5 minutes. Double-sided oxidation follow-PORV cycling followed, which controlled the ing cladding rupture produced a very rapid in-RCS pressure between 15.7 and 16.2 MPa, as in-crease in core temperatures, as shown in Figure dicated in Figure 10. 13.a Materials from the highest temperature (highest power) regions near the center of the Boiling in the core began at 117 .8 minutes.

core began melting and slumping shortly

. *The generated vapor was condensed in the hot legs, which were still subcooled. The PORV be- a. Temperatures plotted in Figure 13 do not represent gan to discharge liquid shortly thereafter, as the any specific core location. Insltead, the maximum pressurizer filled because of continued RCS heat- cladding surface temperature calculated in the core is ing. At 123.5 minutes, saturation conditions shown as a function of time. Once fuel melting were reached at the RCPs; and the seal leaks occurs, the distinction between the cladding surface were increased to 250 gpm per RCP to simulate failures that could occur with two-phase flow through the seals. With the loops at saturation, NUREG/CR-5949

• 22 and the rest of the melt is lost At that point, Figure 13 provides an indication of the hottest temperature in the molten regions.

• Calculation Results

• 18.0 15.0 Lower head failure

'tu' 12.0 Hot leg_f~ilure \

a..

6 Q) 9.0 en en

~

a.. 6.0 team generator dryout 3.0 Molten relocation and ------

sixth accumulator injection-----

0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

• Figure 10. RCS pressure for Case 3.

250.0

~ Onset of full loop natural circulation of liquid 200.0 ___--

en en

-~

( ])

as....

150.0 100.0 3::

0

..:: End of full loop natural circulation of liquid en en 50.0

<tS

E 0.0

-50.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

• Figure 11. Full loop natural circulation of liquid in a nonpressurizer loop (A) following TMLB' initiation for Case 3.

23 NUREG/CR-5949

Calculation Results

-m

~

E 15.0 ~-~----,~-~---,--.....-----.--.....-----.----.----,

12.0 I---------..

'2

.Q'"

"C Q) 9.0 / Draining of coolant loop piping en 0.

ca To of fuel rods 0 Molten relocation and

(.) 6.0 Q) sixth accumulator injection en en Q)

> _ Bottom of fuel rods L.. 30 0

~Q) a: 0.0 ' - - - - ~ - - ' - - - - ~ - - - - ' - - ~ - ~ - - ~ - ~ - - ~ - ~

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 12. Reactor vessel collapsed liquid level for Case 3.

4000 .0 .-------r---r-------r-----,,--------.-------,.-----.----.----.-----,

First fuel melting ~

3000.0 sz

-Q)

L..

Onset of double-sided Molten relocation ro L..

Q) 2000.0 oxidation----_,_.

0.

E Q) 1-1000.0

---

Beginning of core uncovery 0.0 '--------~~------'--~----'--~-~---'--~-----'--~~~---'

0.0 100.0 200.0 . 300.0 400.0 500.0 Time (min)

Figure 13. Maximum cladding surface temperature for Case 3.

NUREG/CR-5949 24

Calculation Results thereafter. The first relocation of molten materi- steps produced the abrupt RCS pressure increase als to the lower head, which occurred at 233.0 shown in Figure 10. Other perturbations follow-minutes, consisted of about 1910 kg of control ing subsequent accumulator injections were the rod material. A metallic crust, approximately result of the same process. However, the effect 0.181 m thick, was also established as mixtures on pressure was smaller because the amount of of cladding and dissolved fuel were frozen at an liquid vaporized was smaller. The amount of liq-elevation 0.366 m above the bottom of the center uid vaporized was smaller because rubble debris channel. Meltdown in the center channel fol- had accumulated at that point in the transient, lowed, as a result of the restriction in cooling fol- thus reducing the available liquid volume.

lowing crust fonnation.

The effects of the code anomaly were only The RCS pressure was reduced to the initial observed during portions of the accumulator wa-accumulator pressure at 238.0 minutes, as a re- ter boiloff. Furthennore, these effects did not sult of continuous leakage through the RCP have any significant or adverse impact on the re-seals. Accumulator injection followed in six cy- sults of any of the calculations in this analysis cles, as clearly indicated in Figures 10 and 12. because the magnitude and duration of the pres-During each cycle, water injection began when sure spikes were small. Although the anomaly the RCS pressure dropped below the accumula- was reported to the SCDAP/RELAPS code de-tor pressure. Injection tenninated when the RCS velopers for resolution, repeating the calculations pressure increased to a point above the accumu- with the anomaly corrected was not justified.

lator pressure, as a result of vapor generation as-sociated with core cooling. (It should be noted The RCS pressure response to accumulator that accumulator pressure was reduced by each injection was directly related to the liquid level injection.) Approximately three-quarters of the in the reactor core. As indicated in Figure 12, ac-initial accumulator'liquid volume was discharged cumulator water did not reach the bottom of the into the RCS during the calculation. fuel rods until midway through the third injec-tion. Up to that point, the added water simply re-Before describing the balance of the tran- filled the lower head and plenum. Because those sient, it should be noted that RCS pressure per- vessel areas were relatively cool, only minimal turbations were observed during the accumulator vaporization Gust sufficient to tenninate furµter injection phase of the calculation. The most visi- injection) occurred, as indicated by the pressure ble evidence of this behavior appears as a pres- response shown in Figure 10. Accumulator pres-sure spike in Figure 10 at about 300 minutes. surization was more dramatic once water pene-(Smaller perturbations are also apparent during trated into the active core region where the fuel depressurization following the fifth and sixth ac- temperatures were very high.

cumulator injections.) These perturbations are the result of a SCDAP/RELAP5/MOD3 code The liquid level reached an elevation of anomaly, as discussed below. about 0.73 m above the bottom of the fuel at the end of the third accumulator injection. The asso-At about 300 minutes, the in-core liquid lev- ciated cooling was sufficient to fragment middle el was at an elevation of 0.73 m above the bot- and outer channel components in the lower levels tom of the fuel rods, which corresponded to the of the core, which left the center channel molten top of the second core volume in the model (see pool surrounded by rubble debris approximately Appendix B). For an unknown reason, heat 1 m ~eep. In addition to the complete flow transfer to the liquid phase in this volume was bloclcage associated with the molten region in the then incorrectly specified by the code over sever- center channel, middle and outer channel flow ar-al time steps. The heat that was incorrectly add- eas were automatically reduced 89% (consistent

• ed was sufficient to superheat the liquid, which led to flashing. The vapor generated by flashing all of the liquid in the volume over several time 25 with Table 2) at all fragmented locations. As in-dicated in Figure 10, the vapor produced during the cooling of the lower levels of the core drove NUREG/CR-5949

Calculation Results the RCS pressure to a peak of approximately 6.5 dation. However, RCS pressurization associated MPa. A subsequent boiloff then dropped the liq- with accumulator injection did perturb the fl.ow uid level to about 0.18 m above the bottom of the patterns. These effects can be seen in the hot leg fuel before the fourth accumulator injection. flows for a nonpressurizer loop, as shown in Fig-ure 14. (In Figure 14, flows out of the core are As indicated in Figure 12, liquid levels positive in the top half of the hot leg and negative reached during the third and fourth accumulator in the bottom half.) Up to about 250 minutes, the injections were essentially equal because the mass fl.ow returning to the vessel was noticeably lower levels of the core were cooled but not higher than the outflow, due to the difference in

. quenched by the third injection. In addition, densities between the flow streams. For each cu-some reheating took place after the water from bic meter of steam flowing into the top half of the the third injection boiled away. Although the hot leg, a cubic meter of relatively cool and rela-stored energy in the lower core levels was some- tively dense steam fl.owed out of the bottom half what reduced, vaporization was ~ufficient to ter- of the hot leg and returned to the vessel.

minate liquid penetration during the third and fourth injections at about the same elevation. Four flow spikes are clearly visible in Figure The differences in the RCS pressure response 14, corresponding to the last four accumulator in-shown in Figure 10 reflect the differences in jections. (Flow perturbations were minimal for stored energy (which is the energy available for the first two accumulator injections because the removal by the accumulator water) at the time of RCS pressure response was minimal.) Specifi-the two injections. cally, flows were accelerated out of the core as a result of the RCS pressure increase associated Core degradation was very extensive at the with vapor generation during the inj~ctions. As time of the fifth a,ccumulator injection. Specifi- shown, flows in the bottom half of the hot leg cally, the center channel was molten from the were reversed (negative values) so that all hot leg crust elevation (0.366 m above the bottom of the flow was driven toward the steam generators.

fuel) to the top of the core; and rubble debris filled most of the lower half of the middle and In some cases, RCP loop seals were cleared outer channels. Flow area reductions associated during accumulator injection. Loop seal clearing with that level of damage left relatively little vol- occurred whenever the pressure differential be-ume for injected water. Under these conditions, tween the hot leg and cold leg sides of the loop relatively small injections can result in'relatively seal was large enough to push the plug of water high liquid levels. As indicated in Figure 12, the into the cold leg piping. On subsequent injec-fifth injection penetrated about halfway into the tions, loop seals were refilled because accumula-core. A substantial RCS pressurization followed, tor water fl.owed toward the core and/or the as shown in Figure 10. The degree of core dam- empty loop seal. The process of loop seal clear-age was an important factor in that pressure re- ing ~d refilling was random, depending on the sponse. The injected liquid level reached the top fluctuating mass of liquid in the seal and the of the existing rubble debris, which provided a pressure differential. In any case, full loop natu-relatively large surface area for transferring de- ral circulation of superheated steam was estab-cay energy to the liquid and produced a rapid va- lished whenever loop seals were cleared. (Full porization, with a corresponding RCS pressure loop flow is shown in Figure 14 whenever the increase. Cooling associated wit:Ji the injection outflow is positive and the return flow is nega-fragmented the balance of the core. At that tive.) Hot leg countercurrent natural circulation point, rubble extended from the top to the bottom was quickly re-established following loop seal of the core in the middle and outer flow channels. refilling.

Core decay heat was transferred to the ex-vessel piping by hot leg countercurrent natural circulation throughout the period of core degra-NUREG/CR-5949 26 The effects of ex-vessel heating associated with countercurrent natural circulation in the pressurizer loop are shown in Figure 15.

Calculation Results

• 15.0 10.0

~~~~ ~-~~

currenrflo*--------Full loop flOW--4Current flow - - - - +

~

C)

st:.

Q) ii 5.0 0.0 3:

0

(/)

(/)

123.5 Full loop natural circulation of liquid ends 124.3 Pressurizer PORV final cycle 140.5 Reactor vessel liquid level drops below top of fuel rods 141.5 Core exit supemeat; hot leg countercurrent circulation begins 143.8 Reactor vessel liquid level drops below bottom of fuel rods 167.7 Onset of fuel rod oxidation 179.5 Core exit vapor temperature at 922 K 182.0 First fuel cladding failure; ruptured by ballooning 197.3 First accumulator injection 202.3 First appearance of an in-core molten pool Accumulators emptied Crust failure; first molten core relocation to lower head 234.8 336.2 426.0 Creep rupture failure of lower head 433.0 Crust failure; second molten core relocationto lower heat 460.7 End of calculation 463.3 decay power; and a corresponding pressure re- heatup associated with core oxid.ation was very duction followed. similar in Cases 3 and 4, as shown in Figure 18.

However, a significant deviation in the Case 4 heatup occurred following accumulator injec-A comparison of the reactor vessel collapsed tions, which began at 202.3 minutes.

liquid level in Cases 3 and 4 is shown in Figure

17. Because of the differences in seal leak rates, core uncovery began earlier in Case 4 and pro- Accumulator injections began when the RCS gressed at a faster rate. Specifically, uncovery pressure dropped to the accumulator pressure.

began approximately 5.3 minutes earlier and was As indicated in Figure 16, differences in seal leak completed about 21.6 minutes earlier in Case 4. rates resulted in a relatively early depressuriza-As a result; the onset of core damage (oxidation, ballooning, etc.) in Case 4 was also relatively early. Except for the timing difference, the initial NUREG/CR-5949 30 tion to the accumulator pressure in Case 4. The resulting start of accumulator injections at 202.3 minutes was approximately 35. 7 minutes earlier

Calculation Results

• 18.0 15.0 1-*- Case31

-- -

• Case 4

- ctS a..

12.0 \

\

~

Q) 9.0 r 1'

en 1\

en I \

Q) I \

\

a.. 6.0 I

\

\ \

\ \

I \

3.0

' I \.

0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

• Figure 16. RCS pressures for Cases 3 and 4.

--E 15.0 1 - Case 3, Q) ---* Case4 Q) 12.0

!2

.Q" "O

Q) 9.0 Accumulators emptied en a.

ctS To of fuel rods 0(.)

6.0 \

Q) I\

I en ' \

en Q)

.... Bottom of fuel rods 3.0 0

uctS '

,1 I

Q) First accumulator injectionL-----"

er:

0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 17. Reactor vessel collapsed liquid levels for Cases 3 and 4.

31 NUREG/CR-5949

Calculation Results 4000.0 First accumulator injectio I*

-- 3000.0 I I

I

~ I I I

Q)

II 11 cu... 2000.0 1 I

I Molten relocation Q) I

a. I E

Q) I I

I I- I I

1000.0 I

/.

~

1-----------LT/.

1-- Case31

---* Case~

0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 18. Maximum cladding surface temperatures for Cases 3 and 4.

than the first injection in Case 3, as indicated in Figures 17 and 18. Injection of cold water led to a relatively early and extensive fragmentation of the heated fuel bundle in Case 4. In the current lator injection is provided in Figure 19, which shows the total hydrogen generated during core oxidation for the two cases. As indicated, the to-tal hydrogen generated in Case 4 was less than version of SCDAP/RELAP5/MOD3, howev~r. half of the amount generated in Case 3. Figure oxidation terminates when rod-like geometry is 19 reflects the fact that oxidation was basically lost. Therefore, the maximum cladding tempera- terminated by extensive core fragmentation fol-tures in Case 4 dropped as the energy associated lowing the relatively early accumulator injec-with the exothermic oxidation reaction was lost tions in Case 4.

(following fragmentation) and as accumulator water cooled the core. Early accumulator injection in Case 4 had another important impact on the transient pro-The differences shown in Figure 18 do not gression. Specifically, liquid levels in the core give a complete in~ication of the effects of early were relatively high before core melting, which accumulator injection because the temperatures provided some core cooling. In contrast, fuel plotted in Figure 18 do not represent any specific melting had occurred in Case 3 before accumula-core location. Instead, the maximum cladding tor water penetrated into the core. Although the surface temperature in the core is shown as a accumulators emptied in Case 4 after a sixth in-function of time. Comparing the maximum tem- jection at 336.2 minutes, the liquid levels in Case peratures in Case 3 to the maximums in Case 4 4 were consistently higher than those in Case 3 indicates that early injection caused some tem- up to that time, as indicated in Figure 17. Further

• perature differences, but those differences were core degradation, melting, and lower head failure basically over by about 300 minutes. An alter- were relatively late in Case 4 compared to Case nate way to compare the effects of early accumu- 3, as a result of those differences in liquid levels.

NUREG/CR-5949 32

Calculation Results

~

500.0 400.0 1- Case31

---* Case 4:

C 0

15.... 300.0 Q)

C Q)

C> ,'

C ,,

Q) 200.0 ----------------------

C>

0 "C

I I'

>- I

c 100.0 I I.

0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 19. Total hydrogen generated for Cases 3 and 4 .

Hot leg countercurrent natural circulation of Furthermore, the component temperatures that superheated vapor developed after the hot legs were plotted represent the pipe components in drained into the reactor vessel. As in Case 3, the pressurizer loop because they were somewhat however, this natural circulation flow pattern was hotter than the corresponding components in the interrupted by the RCS pressurization associated nonpressurizer loops. As indicated in Figure 21, with core cooling following accumulator injec- the hot leg nozzle was generally hotter than the tions. The effects of the last four injections in surge line and the steam generator tube. This Case 4 are clearly visible as flow spikes in Figure was as expe,cted because the nozzle is exposed to

20. Periods of hot leg countercurrent flow, where the hottest steam leaving the core and because both hot leg outflow and return flows are posi- the surge line heating was not driven by PORV tive, were terminated whenever the RCP loop cycling in this case. (The steam deposits some seals were cleared. Full loop flow of superheated energy in the hot leg piping before reaching the steam, where the hot leg outflow is positive and surge line and steam generator.) The flow spikes the return flow is negative, was terminated when- associated with accumulator injections caused ever the loop seal was refilled during a subse- large perturbations in the steam generator tube quent accumulator injection. temperature and small perturbations in the more massive hot leg nozzle.

The effects of ex-vessel heating associated with the natural circulation of superheated steam Ex-vessel heating was relatively low in Case are plotted in Figure 21. Temperatures are 4 as compared to Case 3 (see Figures 15 and 21).

shown for the hot leg nozzle, the surge line, and In fact, hot leg and surge line temperatures in the hottest location in the steam generator tube Case 4 were approximately 200 K cooler. In bundle because those components are the most both cases, the core decay energy was split be-vulnerable locations for creep rupture failure. tween the amount deposited in the vessel and ex-33 NUREG/CR-5949

Calculation Results 10.0 5.0 Hot leg counter-

+-current flow------<---Full Hot leg counter-loop flow ----,current flow----+

• 0.0

-5.0

-10.0 ~ ~ ~ ~ - - ~ - - ~ - - ~ ~ - - ~ - - ~ - - - ~ - ~

100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 20. Hot leg countercurrent natural circulation in a nonpressurizer loop (B) for Case 4.

1300.0 ~ - ~ - ~ - - ~ - ~ - - - . - - - ~ - - - . - - - - - , - - - ~ - - - ,

- - Loop C hot leg nozzle G------l Loop C steam generator tube C:1----£1Surgeline 1100.0 Q)

J ro... 900.0 Q) a.

E Q) 1-700.0 500.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min) 1 Figure 21. Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) for Case 4.

NUREG/CR-5949 34

Calculation Results vessel piping and the amount dissipated through RCS, allowing earlier accumulator injection, RCP seal leaks. In Case 4, seal leaks of 480 gpm which can delay further core degradation and per RCP left a smaller fraction of the core decay lower head failure. The most important differ-energy for ex-vessel heating. In addition, the ence associated with RCP seal leak rates, howev-RCS depressurization rate in Case 4 led to a*rela- er, has to do with the effects on ex-vessel tively early start on accumulator injection, which heating. Comparing results from Cases 3 and 4, provided some reduction in steam temperatures. seal leaks of 480 gpm per RCP were found to Therefore, the hot leg and surge line remained dissipate a relatively large fraction of core decay relatively cool. As a result, creep rupture failures energy, leaving a relatively small fraction for ex-were not predicted in any ex-vessel piping com- vessel heating. In fact, the results indicate that ponent in Case 4. ex-vessel failures would occur with seal leaks of 250 gpm per RCP but would not be expected A boiloff following the last accumulator in- with leaks as high as 480 gpm per RCP. Since jection led to failure of an in-core crust at 426.0 the potential for HPME is directly related to the minutes, about 22.7 minutes after crust failure in potential for ex-vessel failures, it appears that in-Case 3. The crust failure allowed approximately creasing the RCP seal leak rate (within some rea-12,940 kg of molten U02 at 3380 K to relocate to sonable bounds) increases the potential for the lower head. Like Case 3, relocation was HPME.

completed in 68 seconds without heat transfer to the lower head coolant. Thermal attack by the 3.5 Case 5 relocated molten fuel resulted in a creep rupture failure of the lower head at 433.0 minutes, ap- This calculation was performed to evaluate proximately 27 .3 minutes after lower head fail- the effect of debris/coolant interac\ion during ure in Case 3. (As indicated in Table 6, a second molten relocation to the lower head on the poten-crust failure and relocation was predicted at tial for HPME through comparison to Case 3.

460.7 minutes.) Debris/coolant interaction was varied in Case 5 by assuming maximum heat transfer between the All ex-vessel RCS pressure boundaries were molten core debris and the reactor coolant during intact at the time oflower head failure in this cal- relocation to the reactor vessel lower head. This culation. Furthermore, there were large margins calculation was identical to Case 3 w1th that ex-before any component failures could be expected ception (see Tables 1 and 2). Therefore, these-according to the results at the time of lower head quence of events from TMLB' initiation up to the failure. Therefore, it is reasonable to expect that first molten core relocation was identical to the the vessel failure as described would be the first list in Table 5 for Case 3. Case 5 events from the breach of the RCS pressure boundary under the :first relocation to creep rupture failure of the conditions considered in Case 4. The RCS pres- lower head are summarized in Table 7.

sure at the time of lower head failure was ap-proximately 1.36 MPa. In NUREG-1150, the Some heat transfer between molten core ma-potential for HPME was assumed to be low if the terials and the reactor coolant could occur during RCS pressure was below 1.38 MPa at vessel relocation to the lower head. A number ~f fac-breach. However, the uncertainties in this calcu- tors could affect this heat transfer, including the

! latipn are larger than that margin. Therefore, it amoµnt of coolant below the core at the time of appears that a potential for HPME could exist in relocation, the temp~rature of the coolant, the the. Surry NPP for the set of conditions consid- quantity and temperature of the molten material ered in this case. being relocated, the relocation rate, and the influ-ence of core internal structures. The effects of Results from Cases 3 and 4 indicate that those factors are not readily quantified for all

• higher RCP leak rates can generate conditions that lead to an early onset of core damage. How-ever, higher RCP leak rates also depressurize the 35 possible conditions. For that reason, current ver-sions of SCDAP/RELAP5/MOD3 allow user control for modeling the two possible extremes.

NUREG/CR-5949

Calculation Results Table 7. Sequence of events for Case 5.

nme Event (min)

Crust failure; first molten core ~location to lower head 403.3 Accumulators emptied 475.0 Crust failure; second molten core relocation to lower heat* 477.7 Creep rupture failure oflower head 479.6 End of calculation 496.7 In one option, molten core materials are relocat- cussed in Section 3.3, an accumulator injection ed to the lower he~ without any heat transfer to coincided with that relocation in Case 3, result-the reactor coolant. This option provides an up- ing in an increase in the liquid level. In Case 5, per bound on the temperature of the debris when the vapor generated through debris/coolant heat it reaches the lower head and a corresponding transfer produced a large RCS pressure increase upper bound on the severity of the associated at the time of the first relocation, as indicated in lower head thennal attack. It was used in every Figure 24. *This pressure increase prevented ac-calculation in this analysis except Case* 5, provid- cumulator injection in Case 5 at the time of the ing a conservative approach for evaluating the first relocation. Instead, the lower head coolant

• potential for HPME. In Case 5, the second op- was sharply depleted, as shown in Figure 23. .

tion was selected where maximum debris/coolant heat transfer is calc1,1lated. This option is imple-mented by assuming that all relocating debris is Some of the lower head coolant was lost quenched, up to the obvious limit imposed by the through vaporization associated with debris cool-quantity of water in the lower head.

• As a result, ing. The remainder was forced out of the lower

• the option provides a lower bound on the debris head into the cold legs by high vapor velocities temperature as it reaches the lower head and a and the pressure increase. Vaporization cind the

, corresponding lower bound on the severity of the pre~sure increase were terminated when the associated lower head thennal attack. available coolant wa~ depleted. Figure 23 indi-cates a level of approximately 0.5 m at that time.

The effect on lower head debris temperature However, this value actually represents a dry is illustrated in Figure 22. Without heat transfer condition because the level was offset by the to the reactor.coolant, a step change in the maxi- depth of the lower head debris. When the vapor-mum lower head debris temperature occurred at ization terminated, water that had been forced the time of relocation in Case 3. In contrast, heat into the cold legs drained back to the vessel, re-transfer during the first relocation in Case 5 ~ulting in a level recovery at about 405 minutes.

cooled the molten debris to about 770 K. The The water was then boiled away by (relatively lower head coolant was depleted before debris low) heat transfer from an upper crust supported quenching could be completed, as discussed be- by the underlying molten debris. A continuous low.' level decline followed until the RCS pressure was reduced to the accumulator pressure. At that The collapsed liquid level was near the bot- time, a sixth injection in Case 5 emptied the ac-

• tom of the core at the time of the first molten core cumulators and increased the level, as shown in relocation, as indicated in Figure 23. As dis- Figure 23.

NUREG/CR-5949 36

Calculation Results q

Q) as....

Q)

a. 3000.0 E

4000.0 Lower head-failure 1 - - Case31

---* Cases Q) en

.0 I

I I

Q)

"C 2000.0 Molten relocation in , / / ~ ~ ~ ~ :0~olten i Cases 3 and 5 ,,

Q)

.c.

Q)

.Q

~ 1000.0 ~/,,/

E

---

End of molten relocation and E debris cooling

-~ 0.0

E 300.0 400.0 500.0 600.0 Time (min)

' Figure 22. Lower head debris teqiperatures for Cases 3 and 5.

- 15.0 . - - - ~ - - ~ - ~ - - ~ - ~ - - ~ - - - - . - - ~ - - . . . - - - - - ,

~

E Q) 12.0 1-------~

1 - - Case31

---* Cases

2

.sr Lower head failure "O 9.0 Second molten relocation Q)

UJ Sixth accumulator injection a.

<ti To of core 0

o 6.0 Q)

Cl)

Cl)

Q)

....0>

~Q) a: 0.0 .___ ___.__ __.___ ___,___ __.___ ___.__ __.___ ___._ _-'--_ _.___ __,

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

• Figure 23. Reactor vessel collapsed liquid levels for Cases 3 and 5.

37 NUREG/CR-5949

Calculation Results 18.0 15.0 Lower head failure *

- 3.0 Bottom of fuel rods

- 0 as Q)

First accumulator injectio

' 'J a: 0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Fngure 25. Reactor vessel collapsed liquid levels in Cases 4 and 6.

This process may be easier to visualize if one terminated, the excess gravity head in the down-views the cold legs and downcomer as one side comer continued to feed the core, resulting in a of a U-tube manometer and the core as the other higher liquid level in Case 6. This process was side. Accumulator water is injected into the cold even more noticeable during the third injection, legs, which are approximately 1.4 m above the which reached the mid-core elevation where the top of the core. The accumulator water flows deformations and corresponding flow resistance through the downcomer and into the lower head, were larger.

where it encounters the bottom of the core. Wa-ter is then pushed into the core (by the pressure The differences in reactor vessel liquid levels of the downcomer column) until it is balanced by produced a sharp contrast in the RCS pressure re-the head required to force any generated steam sponse in the two cases, as shown in Figure 26.

through the core. In Case 4, the flow resistance As indicated, vaporization and the corresponding in the core was relatively low. Therefore, a rela- RCS pressure increase were significantly higher tively small head on the downcomer side of the in Case 6. The pressure increase to approximate-manometer was sufficient to raise the liquid level ly 8.0 MPa was the result of a high liquid level, and force the associated steam out of the core. which penetrated into hotter areas of the core Accumulator injec;tion stopped when vaporiza- where ballooning had generated relatively large tion at a given liquid level was sufficient to raise surface areas for heat transfer. Compared to the RCS pressure above the accumulator pres- Case 4, a relatively long period was then required sure. In Case 6, however, the core resistance was to vent the excess steam through RCP seal leaks higher because of the ballooning deformation. in order to reduce the pressure for the fourth ac-To force water into the core, a corresponding lev- cumulator injection. (Perturbations during the el increase in the downcomer side of the manom- depressurization were the result of the code eter was required. After accumulator injection anomaly discussed in Section 3.3.)

NUREG/CR-5949 40

Calculation Results

• 18.0 15.0 1 - - Case41

---* Case~

-as 12.0 a.. Lower head failur

~

Q)

I U) 9.0 U)

Q) a.. 6.0 3.0 0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

• Figure 26. RCS pressures in Cases 4 and 6.

The third accumulator injection in Case 6 The core bypass was an important part of the penetrated far enough into the core to cause ex- reflood in Case 6. In fact, the bypass represented tensive fragmentation. At the time of the fourth the path of least resistance for the stated debris accumulator injection, rubble debris was core- conditions. Therefore, the liquid level in the by-wide from an average elevation of about 0.6 m pass readily followed the level in the downcom7 above the bottom of the fuel to the top of the er. As indicated in Figure 27, the bypass filled core. In addition, relatively thick metallic crusts during the fourth accumulator injection in Case had solidified in the lower levels of all three flow 6. After filling, the excess water spilled into the channels, with corresponding flow area reduc- top of the core. At this point, core flooding was tions of 89% (consistent with the inputs de- driven from both top and bottom. As shown in scribed in Table 2). In contrast, rubble debris Figure 27, the bypass was never filled in Case 4.

was confined to the central regions of the core in Case 4. Furthennore, thinner metallic crusts had The maximum cladding surface temperatures solidified at significantly higher elevations. As a that were calculated as a function of time *are result, the lower levels of the core were relatively shown in Figure 28. As indicated, the re:flood in open in Case 4. Obviously, the hydraulic resis- Case 6 cooled the entire core (including the ex-tance during the fourth accumulator injection in isting rubble debris) to a maximum surface tem-Case 6 was significantly higher than the hydrau- perature of about 700 K. Only limited cooling lic resistance for either the fourth or fifth injec- occurred in Case 4, where accumulator injections tion in Case 4. Thf fourth accumulator injection flooded the core from the bottom. As the liquid in Case 6 was relatively large, as a result of those penetrated upwards toward hot core regions, va-differences. In fact, the injection was sufficient porization tended to force the flooding water to completely cover the core, as indicated in Fig- through core crossfiow junctions toward cooler ure 25. locations. If Figures 25 and 28 are compared, 41 NUREG/CR-5949

Calculation Results E

ci>

~ 3.0 Bypass filled and spilled into top of core_-,-,

11 I I I I I

I

!2 '

J

.2" I "O '

Cl) ~

I

[ 2.0 I c:tS 0

0 UJ

~

a. 1.0

.0

....Cl) 1 - Case41 I 0 - - - Case 6

() I I

0.0 L__-~~-----1..~~~----'------'--L----'---'--'--'----------'- 1 .___._,..._.~___,__ __,_~~~------'

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 27. Core bypass collapsed liquid levels in Cases 4 and 6.

4000.0 - - - - ~ - - ~ - ~ - - ~ - - - . - - - ~ - - , - - - . - - -

q

~

J Core reflood ~

Molten r.elocation 1a cii 3000.0 / / ~

a.

E

{g Cl)

Cl) 0 2000.0 I I

I I

I I

I

J I UJ I I

Id I I 0 I E 1000.0 'I ,' I I /

J \ I E \ J

-~ 1 - - Case41

- - - Case 6

~

0.0 L__~~~-----1..~~~~~---'-~~~-____JL....._~~~---'---~-----.J 0.0 - 100.0 200.0 , 300.0 400.0 500.0 Time (min)

Figure 28. Maximum cladding surface temperatures in Cases 4 and 6.

• NUREG/CR-5949 42

Calculation Results one sees that maximum cladding surface temper- RCS pressure boundaries were intact at the time atures were reduced during the accumulator in- of lower head failure and there was no apparent jections. However, the core basically remained way to heat those structures to failure, it is rea-hot in Case 4. In Case 6, reflood from both top sonable to expect that the lower head failure as and bottom significantly cooled all fuel and de- described will be the first breach of the RCS for bris in the core region. Crossflow away from the the conditions assumed in this calculation.

hot spots was not effective because all core loca-tions were liquid-filled. (It should be noted that The RCS pressure at the time of lower head the erratic behavior shown in Figure 28 occurs failure was approximately 1.37 MPa. Consistent not only during accumulator injections but also with NUREG-1150, the potential for HPME is when core materials heat and slump into an exist- assumed to be low if the RCS pressure is below *

• ing molten pool, which temporarily drops the 1.38 MPa at vessel breach. However, the uncer-pool temperature.) tainties in the calculation are much larger than that margin. Therefore, it appears that a potential A complete reheating of the core, including for HPME could exist in the Surry NPP for the the initial formation of a molten pool at 345.0 set of conditions considered in Case 6.

minutes, followed the core reflood in Case 6.

There were no accumulator injections during the Results from Cases 4 and 6 indicate that the reheat because a substantial period of time was amount of deformation associated with balloon-required to vent the excess steam generated dur- ing can significantly impact the core damage pro-ing the fourth injection. A fifth and final accu- gression. In Case 4, accumulator injections mulator injection did occur at 363.2 minutes. provided only partial cooling; and the total relo-However, the injection was small and ineffective cation was limited to approximately 12,940 kg of because most of the accumulator water had been molten U0 2. In Case 6, the core was reflooded discharged by that time. Without accumulator and had to reheat before a molten relocation of injections, the core heatup continued, including a about 443*70 kg of U0 2. In addition, the results thermal attack on the crust supporting the in-core indicate that the time to lower head failure de-molten pool. As a result, crust failure occurred at creases as ballooning deformation increases.

383.8 minutes, 42.2. minutes earlier than in Case However, in spite of the observed differences,

4. The crust in Case 4 remained intact longer the potential for HPME remained unaltered be-than in Case 6 because of the differences in cool- cause lower head failures occurred before ex-ing associated with accumulator injection. As in- vessel failures in both cases.

dicated in Figure 25, at approximately 360 minutes, the core liquid level resulting from the 3. 7 Uncertainties final accumulator injection was significantly higher in Case 4. Since most of the accumulator The SCDAP/RELAP5/MOD3 calculations water was depleted during core reflood, the final were reviewed to identify uncertainties that injection in Case 6 was relatively small and inef- could affect the RCS response and the timing of fective in terms of cr;ust cooling. Approximately events during transient progression. These un-44,370 kg of molten U0 2 were relocated to the certainties, which were separated into either lower head following crust failure in Case 6. thermal-hydraulic or core damage progression Lower head failure followed at 389.8 minutes, categories, are discussed in the following sec-about 43.2 minutes earlier than in Case 4. tions. The discussion is focused on how the un-cert&inties could affect the timing of the RCS The core reflood in Case 6 reduced the tem- pressure boundary failµres because those failures perature of the steam circulating in the ex-vessel are critical in this assessment of the potential for structures. As indicated in Figure 29, ex-vessel HPME.

• heatup was effectively terminated. As a result, ex-vessel failures were not predicted before low-er head failure in Case 6. Since all ex-vessel 43 3.7.1 Thermal-Hydraulic Uncertainties.

The initial conditions used in this analysis were NUREG/CR-5949

Calculation Results 1200.0 1000.0

,-----,-----,----,----,---*--r-------r-----r----,

- - Loop C hot leg nozzle e--e Loop C steam generator tube B--£J Surge line q

Q)

~ 800.0 Q) a.

E Q)

I-400.0 ~ - - ~ - - ~ -_ _,___ __,___ __,___ ___.___ ___.__ ____,

().0 100.0 200.0 300.0 400.0 Time (min)

Figure 29. Volume-averaged ex-vessel piping temperatures in*the pressurizer loop (C) in Case 6 .

based on best estimates, as established in a previ- heatup and failure in the ex..:vessel piping. In ous study.2 It should be noted, however, that other words, a higher decay power level or a low-some of the initial conditions have the potential er steam generator secondary liquid inventory to significantly change the timing of the transient would tend to accelerate both lower head and ex-progression. The decay power level and the vessel failures. Therefore, changes in the initial steam generator secondary liquid inventory at the decay power level or steam generator secondary time of transient initiation are two of the more liquid inventory will change the absolute timing important parameters. of transient events. Effects on the relative timing between lower head and ex-vessel failures' asso-A higher decay power level at the time of ciated with changes in either parameter are un-known.

transient initiation would accelerate core heatup, melting, and lower head failure. A lower steam generator secondary liquid inventory would have The hot leg countercurrent natural circula-a similar effect. Specifically, a lower liquid in- tion model was developed to match calculated ventory would decrease the time to steam gener- extrapolations of low-pressure, low-temperature ator dryout and the start of core heatup. experimental data. 2 The same model has also Decreasing the time to core heatup is equivalent been shown to adequately match data from an to increasing the power level because less time is experiment that was scaled to represent high-allowed for decay. In additron, higher steam pressure conditions. a Although the model was temperatures would be generated earlier in the developed to match the overall heatup, there is transient during an accelerated core heatup asso- some uncertainty in the ex-vessel temperature

• ciated with either a higher decay power level or a distribution as a result of the way hot leg coun-lower liquid inventory. Natural circulation of the tercurrent natural circulation was represented.

higher-temperature steam would lead to earlier Specifically, heat and mass transfer were pre-NUREG/CR-5949 44

Calculation Results eluded by a physical separation of the counter- degradation of insulation is similar at all bound-current flows. If flQw interactions were modeled, aries.

the temperature difference between the hot leg outflow and return flow could decrease, which SCDAP/RELAP5/MOD3 calculates creep could affect the temperature distribution in the rupture failures using a one-dimensional temper-ex-vessel piping. Results indicate that the uncer- ature profile at user-specified locations. The one-tainty is unimportant if the RCS remains at full dimensional assumption simplifies the coding system pressure because ex-vessel failures oc- and is reasonably accurate for moderately sized curred before lower head failure with and with- pipes (i.e., the surge line, hot leg, and steam gen-out hot leg countercurrent natural circulation. erator tubes) over the range of conditions consid-The effects of the hot leg countercurrent natural e~ed in this analysis. However, the assumption is circulation model in cases with RCP seal leaks more conservative as the ratio of radius to wall were not investigatedi. thickness increases (i.e., the lower head). Scop-ing calculations, based on two-dimensional

• Accumulators are passive devices that re- structural analyses of lower head geometries, in-spond only to the RCS pressure. The RCS pres- dicate that the SCDAP/RELAP5/MOD3 predic-sure, however, is strongly influenced by the tion of the time between molten relocatio'n and vaporization that occurs as accumulator water lower head creep rupture in this analysis could be cools the core. Based on the maturity of thermal- underpredicted by a factor of two to four. a hydraulic portions of SCDAP/RELAP5/MOD3, it was assumed that in-core heat transfer was rea- Steam generator tubes were assumed to be sonably predicted for rod-like geometries. Un- defect- and degradation-free in all calculations.

certainties increase, however, with the level of Based on that assumption, creep rupture failures core degradation. As discussed in Appendix G, of the tubes were not predicted in any of the cas-an attempt was made to account for those uncer- es considered. A detailed structural analysis tainties in the process of devele,>ping probabilities would be required to determine if any specific for RCS pressure boundary failures. defect could contribute to the potential for a tube failure during a station. blackout transient. If All external RCS pressure boundaries were steam generator tube failure occurred before assumed to be adiabatic in this.analysis. It is rec- lower head failure, the severity of HPME would ognized that some heat loss to the containment be minimized by RCS pressure reduction. How;.*

atmosphere would occur, especially as tempera- ever, the obvious problem of containment bypass tures increase, with a possible degradation of in- would be introduced in such a case.

sulation performance. Allowing for heat losses

. from the ex-vessel piping has been shown to re- 3.7.2 Core Damage Progression Uncer-duce piping tem~ratures and delay their failure tainties. There are a number of uncertainties in by a few minutes. 2 Although it was not investi- the calculation of core damage progression. In gated, a similar delay in the time to vessel failure most cases, these uncertainties result from the would be expected if heat losses from the lower

• fact that there are relatively little experimental head were accounted for. Therefore, the adiabat- data to clearly define all processes involved.

ic assumption does affect the absolute timing of Furthermore, the information that is available is all RCS pressure boundary failures but should generally limited to one-dimensional experimen-not have a significant affect on the relative tim- tal data, which may or may not be completely ad-ing between those failures, assuming that the equate for representation of a large PWR core.

For those reasons, this analysis was performed

a. D. J. Pafford et al., Natural Circulation Flow in the with core damage inputs that should produce a Westinghouse High Pressure SF6 Experiments using RELAP5/MOD3, EG&G Idaho, Inc., June 1992, tech- a. Private communication, S. A. Chavez and J. L.

nical report transmitted through D. J. Hanson letter to Rempe, EG&G Idaho, Inc., Idaho Falls, ID, Decem-C.R. Troutman, DJH-12-92, June 11, 1992. ber 1991.

45 NUREG/CR-5949

Calculation Results conservative assessment of the potential for failure of the crust supporting an in-core molten HPME. Specifically, best estimates were used if pool. Crust failure is a function of the heat ab-data and current understanding support such in- sorbed from the molten pool and the heat that can put. For all other parameters (with higher de- be rejected from the crust surface. Uncertainty in grees of uncertainty), input was selected to calculating heat transfer from the molten pool accelerate core damage progression and the time arises from the fact that the pool characteristics to lower head failure. This approach provides for either laminar or turbulent free convection the basis for a conservative evaluation of the po- are not completely understood. Heat rejected tential for HPME because time is minimized for from the outside surface of the crust is limited by generation of an ex-vessel failure by natural con- the code to convection and radiation to the sur-vection heating and for RCS inventory depletion. rounding coolant. Direct radiation to nearby The following uncertainties should be considered structures (i.e., the lower core support plate) is with respect to these conservative aspects of this not considered, although the coolant ultimately analysis. transfers the energy to those structures by con-vection. A probabilistic assessment of the effects Oxidation of the Zr cladding of in-core com- of these uncertainties was included in Appendix ponents is calculated in the current version of G because the timing of lower head failure is di-SCDAP/RELAP5/MOD3. However, oxidation iectly related to crust heatup and failure.

is terminated when rod-like geometry is lost, while oxidation of any component outside the An RCS pressure reduction can occur in the core is not considered at all. As a result, hydro- subject transient through leak paths (i.e., the RCP gen production could be underpredicted in the seals) or as a result of a temperature or pressure-current calculations. With respect to the poten- induced failure of the pressure boundary. With tial for HPME, however, it is more important to respect to the potential for HPME, there are three note that the code-calculated heatup may be slow modes for repressurization of the RCS: (a) the because all of the pertinent oxidation reactions vaporization that occurs as accumulator water are exothennic. Therefore, if oxidation is under- cools the core; (b) the vaporization that occurs as predicted, core temperatures will be underpre- the RCS coolant absorbs heat from debris during dicted. In that case, the calculated times for core relocation to or while in the lower head; and (c) melting, relocation, and lower head failure could the effects associated with an energetic fueVcool-be late. If the core temperatures are underpre- ant interaction (i.e., a steam explosion). The ef-dicted, the calculated time of ex-vessel failures fects of the first two modes were considered in could also be late because the circulating steam this analysis. The potential for a fueVcoolant in-temperatures that drive the ex-vessel heating teraction and its impact on the potential for would be low. In other words, the timing of both HPME was not investigated.

lower head and ex-vessel failures could be de-layed by the current treatment of oxidation in the As described in Appendix B, the Surry NPP code. A more detailed treatment of oxidation core was divided into three flow channels. All of would be expected to accelerate both lower head the fuel bundles in each channel were simulated and ex-vessel failure times. A significant change by a single fuel rod component and a single con-in the relative timing between the events would trol rod component. When these components not be expected because an oxidation-driven in- reached a certain temperature or damage state, crease in core heatup would be accompanied by a that condition was assumed to apply to all fuel corresponding increase in the steam temperatures bundles represented by the component A sensi-that generate ex-vessel failures. tivity study was not performed to determine if any adverse effects were introduced by this no-Vessel failure can occur following relocation dalization.

of molten materials from the core into the lower head. In the current version of SCDAP/RE- SCDAP/RELAP5/MOD3 has the capability LAP5/MOD3, relocation typically results from a to model fission product transport following fuel NUREG/CR-5949. 46

Calculation ~esults cladding failures. However, this feature was not as long as the surge l,ine and hot leg piping re-exercised in this analysis. Although it was not mained intact. (Thereafter, the steam generators investigated, heating as a result of fission product would be effectively isolated from the source of deposition would not be expected to significantly :fission products by the break.) The potential for alter the time to a surge line or hot leg failure. steam generator tube failure before failures in the However, fission product heating could be a surge line and hot leg piping could be increased more significant concern with respect to the rela- by the addition of fission product heating. As in-tively thin steam generator tubes, particularly if dicated, however, fission product transport calcu-tube defects are considered.

• Fission products '

lations were not performed to allow assessment could be deposited in the steam generator tubes of this potential.

• 47 NUREG/CR-5949

Depressurization Probabilities

4. DEPRESSURIZATION PROBABILITIES Intentional depressurization of the RCS be- ing sections are conditional on the occurrence of fore reactor vessel breach has been proposed as the specific scenarios in the Surry NPP.

an accident management strategy to mitigate the severity of HPME in PWRs. An independent 4.1 Surge Line/Hot Leg Failure analysis (supporting an NRC Accident Manage-Issue ment Program) is planned to determine the risk impact associated with implementing this strate-gy in the Surry NPP. Probabilities for the RCS The surge line/hot leg failure issue relates the depressurization issues of (a) a surge line/hot leg potential failure of ex-vessel piping and the RCS failure and (b) the RCS pressure at reactor vessel pressure response to failure of the reactor vessel breach are summarized in this section for use in lower head. Consistent with NUREG-1150, the the risk analysis. issue can be stated as follows:

What is the probability that the surge Probabilities for both of the stated RCS de- line or hot leg will fail and depressurize pressurization issues were generally based on the the RCS to a low pressure before lower results from current SCDAP/RELAP5/MOD3 head failure?

analyses. However, the code results were not used directly. Instead, engineering judgment and As was done in NUREG-1150, a low pres-sensitivity calculations were applied to evaluate sure was assumed to be any pressure at or below the effects of potential uncertainties. A complete 1.38 MPa. If the issue probability is high, the description of the assumptions and methods used potential for HPME and the associated potential to develop the resulting probabilities is provided for DCH is low. Conversely, if the issue proba-in Appendix G. bility is low, the RCS pressure at the time oflow-er head failure could result in an HPME. Under Probabilities for each RCS depressurization those conditions, the potential impact of DCH in issue were developed for four different Surry the Surry NPP may require further analysis.

NPP scenarios: (a) TMLB' sequences without Probabilities for the surge line/hot leg failure is-RCP seal leaks (at full system pressure), (b) sue, applicable to the previously identified sce-TMLB' sequences with seal leaks of250 gpm per narios, are listed in Table 9.

RCP, (c) TMLB' sequences with seal leaks of 480 gpm per RCP, and (d) TMLB' sequences I The RCS pressure is maintained at the PORV with either stuck- or latched-open PORVs. set point through continuous cycling of the relief Therefore, probabilities presented in the follow- valves in TMLB' sequences without RCP seal Table 9. Probabilities of the surge line/ hot leg failure issue given the occurrence of the specific scenarios in the Surry NPP.

Scenario Probability TMLB' sequences without RCP seal leaks 0.98 TMLB' sequences with seal leaks of 250 gpm per RCP 0.98 TMLB' sequences with seal leaks of 450 gpm per RCP 0.0 TMLB' sequences with stuck-open/latched-open PORVs 1.0 49 NUREG/CR-5949

Depressurization Probabilities leaks. Steam flow associated with the PORV cy- were assumed to be equivalent. Those assump-

• cling heated the surge line at high pressure. Cal- tions were developed as follows.

culated results indicated that creep rupture failure of the surge line would occur well ahead SCDAP/RELAP5/MOD3 results for imple-of lower head failure. After accounting for un- mentation of the late depressurization strategy in certainties in the results, it was concluded that the Surry NPI>2 were used as the basis for evalua-there was a small fraction of the time where low- tion of the surge line/hot leg failure issue. In the er head failure could occur before RCS depres- late depressurization strategy, PORV cycling surization through the surge line. On that basis, a controls the RCS pressure until plant operators probability of 0.98 was assigned, as indicated in latch the PORVs open at the time core exit tem-the Table 9. peratures reach 922 K. It was determined that the surge line would fail before failure of the Surge line heating was similar in TMLB' se- lower head in that calculation. Results from pre-quences with either stuck-open or latched-open vious analyses indicated the same result with re-PORVs. In that scenario, however, flow through spect to the surge line/hot leg failure issue if the the surge line was continuous, which significant- PORVs were latched open at an earlier time.

ly reduced the RCS pressure. By the time high Specifically, if the PORVs are latched open at the surge line temperatures were reached (and before time of steam generator dryout, surge line fail-there was any potential for lower head failure), ures are predicted to occur before lower head the RCS pressure was near the containment pres- failure. 1 (It should be noted that there are sub-sure. Because creep rupture is a function of both stantial differences in terms of core damage as a temperature and differential pressure and be- function of the time at which the PORVs are cause the differential pressure was low, surge latched open. However, the level of core damage line failure occurred relatively late in the tran- is of no concern in this particular issue.) Based sient. a After uncertainties were considered, it on current understanding and the available calcu-

• was concluded that there was only a very small lations, there is no reason to expect any differ-fraction of the time where the lower head could ence in results applicable to this issue if any fail before the surge line. The fraction was small other relatively early times were selected. In oth-enough to justify a probability of 1.0, as listed in er words,.the PORVs could be latched open be-Table 9. Those results clearly indicate that the fore the time core exit temperatures reach 922 K potential for HPME in the Surry NPP is very low without impacting the probability given in Table for TMLB' sequences without RCP seal leaks 9.

and for TMLB' sequences with stuck-open/

latched-open PORys. If the PORVs are latched open at some time after core exit temperatures reach 922 K, RCS It should be recognized that the PORVs pressure control through PORV cycling would be could be latched open or could stick open at vir- extended. Results from the Base Case (docu-tually any time during a TMLB' sequence. In men~ed in this assessment) indicate that PORV this assessment, however, it was assumed that the cycling subjects the surge line to heating at high-probabilities for the surge line/hot leg failure is- pressure conditions. If the heating is allowed to sue would not be significantly altered by the continue (i.e., if it is not interrupted by latching PORV opening time. Furthermore, probabilities the PORVs open), surge line failure would occur for both latched-open and stuck-open conditions more than 240 minutes ahead of the lower head failure. If the PORVs are latched open before

a. From a practical s$tdpoint, the time of surge line surge line failure (i.e., before sufficient heating at failure was unimportant because the RCS pressure high pressure has transpired), some creep rupture was low. However, timing was important within the damage will be accumulated. The subsequent context of this issue. The fact that the RCS pressure RCS pressure reduction would result in cladding

• was low before vessel breach was directly accounted ruptures and the injection of accumulator ,water.

for within the second depressurization issue. High-temperature steam from the subsequent I

NUREG/CR-5949 50

Depressurization Probabilities boiloff and the energy associated with oxidation fore lower head failure. Uncertainties in hot leg

• of the inner surfaces of the ruptured cladding would be deposited in the surge line. Surge line failure, as a result of the heating associated with boiloff and oxidation, would be expected well ahead of lower head failure. That expectation is based on the fact that some surge line creep dam-heating and the lower head failure time were not large enough to alter that result. Therefore, a probability of 0.0 was assigned to the scenario with seal leaks of 480 gpm, as indicated in Table 9.

age will have accumulated and the fact that the 4.2 RCS Pressure at Vessel surge line response to the subsequent boiloff Breach Issue would not be sub~tantially different than the re-sponse associated with late depressurization Consistent with NUREG-1150, the issue of (where the surge line failed before the lower RCS pressure at vessel breach can be simply stat-head). Therefore, based on current understand-ed as follows:

ing and the available calculations, the probability given in Table 9 would not be significantly al- What are the probabilities of being at a tered by the time at which the PORVs are latched low (< 1.38 MPa), intermediate (1.38 to, open. 6.89 MPa), and high (> 6.89 MPa) RCS pressure at the time of reactor vessel Similar reasoning applies to the time at breach?

which the PORVs could stick open. In fact, there is no basis to differentiate between a latched- There was a single caveat that is not reflected open condition and a stuck-open condition, given in the issue statement. Specifically, probabilities that the operators could latch the PORVs open at were required without taking credit for RCS de-any given time. Therefore, the probabilities for pressurization following any potential ex-vessel

• both latched-open and stuck-open conditions are piping failure. That exception was necessary be-assumed to be equjvalent.

• cause the RCS pressure response associated with ex-vessel failures was addressed in the surge In both RCP seal leak scenarios, the total line/hot leg failure issue. It is important to note core decay energy was split between heat that that the SCDAP/RELAP5/MOD3 calculations was transferred to the hot leg piping by counter- that were used to evaluate this issue were per-current natural circulation and the energy dissi- fonned consistent with that requirement. As pre-pated through the RCP seal leaks. With seal viously discussed, ex-vessel failures were leaks of 250 gpm per RCP, hot leg countercurrent recorded as predicted by the code; but a corre-natural circulation was sufficient to heat the hot sponding RCS blowdown was not modeled.

legs to a failure condition before lower head fail-ure. After accounting for uncertainties in the cal- Probabilities for the RCS pressure at vessel

• I culated results, 1t was concluded that there was a breach issue are given in Table 10. The listed small fraction of the time where lpwer head fail- values are conditional on the occurrence of the ure could occur before RCS depressurization previously defined scenarios in the Surry NPP through the hot leg. On that basis, a probability given that ex-vessel failures do not occur.

of 0.98 was assigned. When the seal leaks were

• increased to 480 gpm per RCP, however, hot leg For TMLB' sequences without RCP seal heating was reduced because a larger fraction of leaks, the RCS pressure was controlled through the decay energy was lost through the RCP seal the time of lower head failure by continuous leaks. A comparison of Figures 15 and 21 pro- PORV cycling between the opening and closing vides an indication of the reduction in hot leg set points of 16.2 and 15.7 MPa, respectively.

heating that occurred. Hot leg (and surge line) The RCS pressure at.vessel breach was obvious-temperatures were significantly cooler with a ly in the high-pressure range, and probabilities seal leak of 480 gpm per RCP. As a result, the were assigned as appropriate. Those results were hot legs were not heated to a failure condition be- reversed by the continuous flow associated with 51 NUREG/CR-5949

Depressurization Probabilities Table 10. Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific see-

• narios without ex-vessel failures in the Surry NPP.

Probability, at vessel breach, for High RCS Intermediate Low RCS Scenario pressure RCS pressure pressure

(> 6.89 MPa) (1.38 - 6.89 MPa) (<1.38 MPa)

TMLB' sequences without RCP seal leaks 1.0 0.0 o.o TMLB' sequences with seal leaks of 250 gpm 0.21 0.75 0.04 perRCP TMLB' sequences with seal leaks of 450 gpm 0.13 0.40 0.47 perRCP TMLB' sequences with stuck-open/latched- 0.0 0.0 1.0 open PORVs TMLB' sequences with either stuck-open or tively early, the RCS would be depressurized. If latched-open PORVs. Specifically, it was con- the P:ORVs were opened near the time of crust cluded that continuous flow through the Surry failure, accumulator injections would cool the in-PORVs was sufficient to depressurize the RCS to core crust, which would delay crust failure and .

1.38 MPa (or less) well ahead of the time oflow- molten relocation. After the accumulator water er head failure. Uncertainties in the failure time was boiled away (and vented through the open and the potential for repressurization (through PORVs), crust heatup and failure would occur at accumulator injection and/or debris/coolant heat alow RCS pressure.

transfer) were conisidered before assigning a probability of 1.0 to the low-pressure range.

If the PORVs were opened at the time of crust failure, accumulator injections may or may As discussed in Section 4.1, the PORVs not effectively cool molten materials as ~ey re-could be latched open or they could stick open at locate to the lower head. As a result, lower head virtually any time during a TMLB' sequence. failure could occur at a high RCS pressure.

However, the time at which the PORVs are However, the probabilities of the operator latch-opened is of little consequence with respect to ing the PORVs open and the PORVs sticking this issue, based on the following logic. open within this small time window were as-sumed to be negligible. This assumption was The RCS would depressurize to 1.38 MPa based on the idea that if an operator were going (or less) through the PORVs ,if the valves were to open the PORV s to de pressurize, that action opened at any time before failure of the in-core would take place well ahead of any molten relo-crust. This was verified by SCDAP/RELAP5 cation. In other words, if the operator decided to calculations for the relatively early PORV open- depressurize, a reasonable amount of time would ing times associated with implementation of both be allotted to do so. The conditions that would the early and late depressurization strategies in cause the PORVs to stick open are primarily as-the Surry NPP. 1*2 Results from the RCP seal sociated with operation of the valves at tempera-leak cases (documented in this assessment) indi- tures well above design conditions. The PORVs cate that accumulator injections can cool the in-core crust and effectively delay molten reloca-tion. Therefore, if the.PORVs were opened rela-NUREG/CR-5949 52 would see many cycles at elevated temperatures before the time of crust failure. If the PORVs were going to stick open as a result of the ad-

Depressurization Probabilities verse conditions, it would seem most likely for Uncertainties in the seal leak calculations

• that failure to occur during one of the many cy-cles long before failure of the crust. Therefore, the time at which the PORVs are opened would not significantly impact the probabilities listed in Table 10 because the probability of the PORVs opening at the time of crust failure was assumed were evaluated to establish the period bver which lower head failures could have occurred. RCS pressures during the lower head failure periods were estimated based on the calculated results and the potentials for repressurization. The RCS pressure at vessel breach issue was then. quanti-to be small. fied by assuming that the probabilities were pro-portional to the fraction of each lower head Seal leaks of 2~0 and 480 gpm per RCP were failure period that corresponded to the specified sufficient to reduce the Surry RCS pressure well pressure ranges.

below the PORV set point to pressures that al-lowed accumulator injection. An RCS repressur-ization followed each injection, as the water was F;or seal leaks of 250 gpm per RCP, lower vaporized during core cooling. A period of time head failures could have occurred at high, inter-elapsed between the injections while the excess mediate, and low RCS pressures 21 %, 75%, and vapor was discharged through RCP seal leaks. 4% of the time, respectively. On that basis, prob-RCS repressurization could also occur during re- abilities of 0.21, 0.75, and 0.04 were assigned to location to the lower head, as a result of heat t;he high, intermediate, and low pressure ranges, transfer between the molten debris and coolant. respectively, as indicated in Table 10. Probabili-Those mechanisms for repressurization provided ties of 0.13, 0.40, and 0.47 were estimated for the potential for intermediate and high pressures high-, intermediate-, and low-pressure ranges, re-in the seal leak scenarios. spectively, for seal leaks of 480 gpm per RCP.

• 53 NUREG/CR-5949

Conclusions.and Recommendations

5. CONCLUSIONS AND RECOMMENDATIONS A detailed SCDAP/RELAP5/MOD3 analy- cool.) Although the calculation was not sis of the Surry NPP response to a TMLB' tran- performed, previous studies indicate that sient without operator actions has been the RCS could be depressurized from the perfonned. The analysis was designed to assess PORV set point pressure before lower

. the potential for HPME through calculation of head failure through either a surge line (a) the time and location of the initial RCS pres- or hot leg bre~ch.

sure boundary failure, (b) the associated RCS conditions at the time of the initial pressure 2. If the RCS is not depressurized by leaks, boundary failure, and (c) the RCS conditions at surge line and hot leg failures can be the time of reactor vessel lower head failure. expected before failure of the lower head These results were then used to evaluate (a) the even if hot leg countercurrent natural probability that an ex-vessel failure will occur circulation does not occur.

before failure of the lower head and (b) the prob-ability of being at a low RCS pressure at the time Hot leg countercurrent natural circula-of lower head failure. Conclusions and recom- tion does provide an effective mecha-mendations pertinent to this work are presented nism for the transfer of core decay heat below. to the ex-vessel piping. If that heat transfer is eliminated, heatup of the core

1. If the RCS is not depressurized by leaks, and in-vessel structures will accelerate, natural circulation of steam and steam with corresponding increases in steam flow through the pressurizer PORVs can temperatures. Under these conditions, be expected to induce creep rupture fail- however, the surge line and hot leg will ures in the surge line and hot leg piping also be exposed to higher temperatures before failure of the lower head. during each PORV cycle. As a result, both surge line and hot leg creep rup-tures should be induced before failure of Under these conditions, the RCS pres- the lower head. Without hot leg counter-sure will be maintained by pressurizer current natural circulation, heating of the PORV cycling. During each valve cycle, steam generator tubes is minimal.

energy will be transferred from the core to the surge line and hot leg piping. Hot 3. Surge line and hot leg failures can be leg countercurrent natural circulation expected before failure of the lower head will be established between PORV cy- if the RCS pressure is reduced below the cles, which will also transfer core decay pressurizer PORV set point by seal leaks heat to the hot legs. As a result, both the of 250 gpm per RCP.

surge line and the hot legs would be ex-pected to fail before failure of the lower The flow area introduced into the calcu-head. However, the surge line will be lations to provide an initial seal leak rate heated to a failure condition before the of 250 gpm per RCP is sufficient to drop hot legs because it is relatively thin. the RCS pressure below the PORV set (The steam generator tubes were as- point. Surge line heating decreases sumed to be free of defects in all calcula- when the RCS pressure drops, since tions perfonned. Given that assumption, PORV cycling stops. However, ex-failure of the steam generator tubes vessel heating continues as a result of would not be expected because the circu- hot leg countercurrent flow. Although lating steam loses a significant amount the hot leg is relatively massive, results of energy before reaching the steam gen- from the calculations indicate that it era to rs, l~aving the tubes relatively would be heated to a failure condition 55 NUREG/CR-5949

Conclusions and Recommendations before the surge line because it is ex- thermal attack. With the maximum op-posed to the highest temperature steam tion, it is assumed that th'e debris will leaving the reactor vessel and because break up as a result of impact with water surge line heating decreases without in the lower head and/or interaction with PORV cycling. Given that the steam lower plenum structures. The code then generator tubes are free of defects, fail- calculates a complete quench of the de-ure of the tubes would not be expected bris, up to the limit imposed by the because they remain relatively cool. amount of coolant available. A large RCS pressurization can result during the

4. A lower head failure would be the first quench; however, lower head thermal at-breach of the RCS pressure boundary if tack is delayed until the debris reheats.

the RCP seals leak 480 gpm per pump.

Results from the calculations indicate that the delay could be more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

The flow area introduced into the calcu-Because the expected result lies between lations to provide an initial seal leak rate those extremes, refinements in relocation of 480 gpm per RCP led to relatively modeling could be useful in future anal-early core uncovery and degradation.

yses.

However, the high RCP leak rates also depressurize the RCS relatively early, al- 6. Changes in deformation associated with lowing earlier accumulator injection ballooning of the fuel rod cladding can that provides some delay in further core significantly change core damage pro-degradation. The most important aspect gression and the time to lower head fail-associated with RCP seal leak rates, ure.

however, has to do with the effects on ex-vessel heating. The total core decay Relatively large restrictions in core flow energy is split into the portion that is (a) areas were predicted when the allowable deposited in the vessel and ex-vessel ballooning deformation was set at 15%.

structures by circulating steam and (b)

As a result, water injected from the accu-dissipated through RCP seal leaks. The mulators did not effectively penetrate results indicate that seal leaks of 480 into the bottom of the core. However, a gpm per RCP dissipate a relatively large relatively large volume of accumulator fraction of core decay en~rgy, leaving a water was forced through the core by-relatively small fraction for ex-vessel pass (between the core barrel and the heating. In fact, the results indicate that former plates) because of the core flow ex-vessel failures would occur before area restrictions. The bypass flow was lower head failure with seal leaks of 250 sufficient to reflood the core from the top gpm per RCP but would not be expected down before formation of a molten pool.

with leaks as high as 480 gpm per RCP.

The accumulators were essentially emp-

5. Debris/coolant heat transfer during mol- tied during the core reflood, which elimi-ten relocation to the lower head can sig- nated the possibility of effective cooling nificantly delay failure of the lower head. during the subsequent reheating. A rela-tively large relocation of approximately Minimum .and maximum debris/coolant 44,370 kg of molten U0 2 occurred as a heat transfer options are the only heat result. With an allowable deformation of transfer options currently available in 2%, periodic accumulator injection pro-SCDAP/RELAP5/MOD3. With the vided only partial cooling of the core hot minimum option, it is assumed that de- spots. However, the partial cooling oc-bris relocates from the core to the lower head in a coherent stream without heat transfer, resulting in a rapid lower head NUREG/CR-594~ 56 curred over a prolonged period and was sufficient to delay relocation, which con-sisted of about 12,940 kg of molten U02.

Conclusions and Recommendations The delay in relocation resulted in a cor- below 1.38 MPa at the time of lower responding delay in lower head failure. head failure without an ex-vessel failure Specifically, lower head failure was cal- was estimated to be 0.47. In addition, culated to be 43.2 minutes later than in the probability of seal leaks as large as the case with allowable cladding defor- 480 gpm perRCP is very small. 8 In oth-mation of 15%. er words, the results associated with sce-

7. There is a low probability for an HPME nario (c) would be relatively unlikely.

in the Surry NPP during a TMLB' tran-

• Therefore, there is a low probability for sient without operator actions. an HPME in the Surry NPP based on the scenarios considered.

Four separate scenarios were considered, based on current SCDAP/RELAP/ 8. The conclusions of this assessment of the MOD3 calculations and an assessment potential for HPME are specific to the of the potential uncertainties in the asso- SurryNPP.

ciated results. Those scenarios included (a) TMLB' sequences without RCP seal This assessment was based on a detailed leaks (at full system pressure), (b)

SCDAP/RELAP5/MOD3 analysis of TMLB' sequences with seal leaks of 250 gpm per RCP, (c) TMLB' sequences with the Surry NPP to detennine the response seal leaks of 480 gpm per RCP, and (d) of the plant during a TMLB' transient TMLB' sequences with stuck-open/ without operator actions and the corre-latched-open PORVs. sponding potential for HPME. An eval-uation of the applicability of these In (a), (b), and (d), natural circulation results to other plants was outside the and flow through the PORVs led to surge scope of this program. However, some line and/or hot leg failures before failure of the factors that would have to be con-of the lower head without any required sidered include pressurizer PORV capac-operator action. After accounting for un- ity; decay heat level; accumulator certainties in the calculated results, it capacity and initial pressure; steam gen-was concluded that RCS pressure reduc- erator size, type, and initial liquid inven:..

tion below 1.38 MPa would occur tory; and hot leg, surge line, and reactor through the ex-vessel breach before low- vessel geometries. These factors are er head failure with a high probability. considered important because they could Specifically, probabilities for a surge line influence the core damage progression or hot leg failure with RCS depressuriza-and the natural circulation of steam tion below 1.38 MPa before lower head throughout the plant. Without operator failure were assigned values of 0.98, actions, natural circulation provides the 0.98, and 1.0 given the occurrence of scenarios (a), (b), and (d), respectively. required mechanism for generating ex-vessel failures. The timing of the ex-In (c), an ex-vessel failure was not calcu- vessel failures relative to core damage lated before lower head failure. For that progression detennines the potential, for reason, the probability of a surge line or HPME. Therefore, a plant-specific un-hot leg failure with RCS depressuriza- derstanding of natural circulation I

and its tion belo:w 1.38 MPa before lower head relationship to core damage progression failure was assigned a value of 0.0. would be required to extend the results However, the probability of being at or to other NPPs.

57 NUREG/CR-5949

References

• 6. REFERENCES

1. D. J. Hanson et al., Depressurization as an Accident Management Strategy to Minimize the Conse-quences of Direct Containment Heating, NUREG/CR-5447, EGG-2574, October 1990.

2. D. A. Brownson, L. N. Haney, and N. D. Chien, Intentional Depressurization Accident Management Strategy for Pressurized Water Reactors, NUREG/CR-5937, EGG-2688, April 1993.

3. P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAP!

RELAP5, NUREG/CR-5214, EGG-2547, October 1988.

4. R. C. Bertucio and J. A. Julius, Analysis of Core Damage Frequency From Internal Events: Surry Unit 1, NUREG/CR-4550 (Draft), Revision 1, Volume 3, September 1988.

5. C. M. Allison et al., SCDAP/RELAP5/MOD3 Code Manual, NUREG!CR-5273, EGG- 2555 (Draft),

Revision 2, Volumes 14, September 1991.(available from EG&G Idaho, Inc.)

6. T. Boardman et al., Leak Rate Analysis of the Westinghouse Reactor Cooling Pump, NUREG/CR-4294, 85-ETEC-DRF-1714, July 1985.

7. C. I. Ruger et al., Technical Findings Related to Generic Issue 23: Reactor Coolant Pump Seal Fail-ure, NUREG/CR-4948, BNL-NUREG-52144, March 1989.

8. T. A. Wheeler et al., Analysis of Core Damage Frequency From Internal Events: Expert Judgment Elicitation, NUREG!CR-4550, SAND86-2084, Vol. 2, April 1989.

9. U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five U.S. Nuclear

• Power Plants, NUREG-1150, December 1990.

• 59 NUREG/CR-5949

APPENDIX A SCDAP/RELAP5/MOD3 CODE DESCRIPTION

• A-1

Appendix A

• APPENDIX A SCDAP/RELAPS/MOD3 CODE DESCRIPTION SCDAP/RELAP5/MOD3 is a light water reactor 1LWR) transient analysis computer code tpat is currently being developed._, It can be used to simulate a wide vari~ty of system transients of interest in LWR safety, but it is specifically designed to calculate the behavior of the reactor coolant system during severe accidents. The core, reactor coolant system, secondary system including feedwater and steam/turbine trains, and system controls can be simulated. The code models have been designed to permit simulation of

• severe accidents up to the point of reactor vessel failure.

SCDAP/RELAP5/MOD3 was produced by incorporating models from the SCDAP,A- 2 TRAP-MELT, A- 3 .4 and COUPLEA- 5 codes into the RELAP5/MOD3A- 6 code. SCDAP models provide coding for simulation of the reactor core. TRAP-MELT models serve as the basis for simulation of fission product transport and deposition. COUPLE models provide coding to allow two-dimensional, finite-element heat conduction/convection calculations at user-specified locations. (Detailed thermal simulation is typically used to represent molten regions in the core or lower head.) And finally, RELAP5/MOD3 models allow simulation of the fluid behavior throughout the system, as well as the thermal behavior of structures

• outside the core. Feedbacks between the various parts of the code were developed to provide an integral analysis capability. For example, changes in coolant flow area associated with ballooning of fuel cladding or relocation are taken into consideration in the hydrodynamics.

SCDAP/RELAP5/MOD3 uses a one-dimensional, two-fluid,. nonequilibrium, six-equation hydrodynamic model with a simplified capability to treat multidimensional flows. This model provides continuity, momentum, and energy equations for both the liquid and vapor phases within a control volume. The energy equation contains source terms that couple the hydrodynamic model to the heat structure conduction model by a convective heat transfer formulation.

The code contains special process models for critical flow, abrupt area changes, branching, crossflow junctions, pumps, accumulators, valves, core neutronics, and control systems. A flooding model can be applied at vertical junctions. A generalized creep rupture model, which accounts for the cumulative effects of pressure and temperature induced stresses, is also included for prediction of pressure boundary failures. The creep rupture model can be applied to any RELAP5/MOD3 heat structure or to any structure represented by a finite-element COUPLE mesh.

SCDAP components simulate core disruption by modeling heatup, geometry changes, and material relocation. Detailed modeling of cylindrical and slab heat structures is allowed. Thus, fuel rods, control rods and blades, instrument tubes, and flow shrouds can be represented. All structures of the same type, geometry, and power in a coolant channel are grouped together; and

• one set of input parameters is used for each of these groupings or components.

Code input identifies the number of rods or tubes in each component and their A-3 NUREG/CR-5949

Appendix A relative positions for the purpose of radiation heat transfer calculations.

Models in SCDAP calculate fuel and cladding temperatures, zircaloy oxidation, hydrogen generation, cladding ballooning and rupture, fuel and cladding

• liquefaction, flow and fr.eezing of the liquified materials, and release of fission products. Fragmentation of fuel rodi during reflood is calculated.

Oxidation of the inside surface of the fuel rod is calculated for ballooned and ruptured cladding. The code does not calculate oxidation of material (zircaloy) during or following relocation. Interactions between molten core material and the fluid below the core are explicitly mod~led. Debris formation and behavior in the reactor vessel lower head and resultant thermal attack on the vessel lower head structure by the relocated core material are also treated.

The fission product behavior include~ aerosol agglomeration, aero$ol deposition, evaporation and condensation, and chemisorption of vapors by stainless steel. Fission products are assumed to be released equally over the entire length of the fuel rods. The released fission products enter the coolant as aerosols, being put in the smallest size bin and allowed to agglomerate or evaporate as conditions dictate. The number of aerosol bins used, as well as the fission product species tracked, is selected by the user.

The chemical form of the fission products is fixed. All of the iodine is assumed to be in the form of CsI, with the remaining cesium being transported as CsOH. Fission products do not interact with the surfaces of SCDAP components (fuel rods, control rods, control blades, and flow shrouds).

Version 7s of SCDAP/RELAP5/MOD3, with updates, was used to complete all calculations described in this report. The updates included error corrections that have been added to subsequent versions and model changes to improve the predictive capabilities of the code. The most significant model changes included (a) logic to direct heat transfer from an in-core crust to the coolant in the volume immediately below the crust and (b) logic to improve the representation of debris quenching during molten relocation from the core to the lower reactor vessel head.

NUREG/CR-5949. A-4

Appendix A

• A-1.

REFERENCES C. M. Allison et al., SCDAPIRELAP5/MOD3 Code Manual, NUREG/CR-5273, EGG-2555 {Dr~ft), Revision 2, Volumes 1-4, September 1991 {available from EG&G Idaho, Inc.).

A-2. G. A. Berna, C. M. Allison, and L. J. Siefken, SCDAP/MODl/VO: A Computer Code for the Analysis of LWR Vessel Behavior During Severe Accident Transients, IS-SAAM-83-002, Revision 1, July 1984.

A-3. H. Jordon, J. A. Gieseke, and P. Baybutt, TRAP-MELT User's Manual, NUREG/CR-0632, BMl-2107, February 1979.

A-4. H. Jordan and M. R. Kuhlman, TRAP-MELT2 User's Manual, NUREG/CR-4205, BMl-2124, May 1985.

A-5. E. C. Lemmon, COUPLE/FLUID: A Two-Dimensional Finite Element Thermal Conduction and Advection Code, EGG-ISD-SCD-80-1, February 1980.

A-6. C. M. Allison et al., RELAP5/MOD3 Code Manual, NUREG/CR-5535, EGG-2596 (Draft), Volumes 1-4, June 1990 (available from EG&G Idaho, Inc.) .

• A-5 NUREG/CR-5949

APPENDIX B SCDAP/RELAP5/MOD3 MODEL DESCRIPTION

• B-1

Appendix B

• APPENDIX B SCDAP/RELAP5/MOD3 MODEL DESCRIPTION SCDAP/RELAP5/MOD3 8"1 is an integrated computer code package designed for nuclear reactor a'ccident analysis. Modules for simulation of thermal-hydraulics, heat transfer, severe core damage, and fission product transport are included, as discussed in Appendix A. The code user is allowed to select those modules necessary to simulate the problem of interest. In this.

assessment of. the Surry nuclear power plant (NPP) during a TMLB' sequence (the complete loss of all ac power and auxiliary feedwater without subsequent recovery or operator action}, an appropriate SCDAP/RELAP5/MOD3 model required use of (a) the RELAPS module for simulation of plant thermal-hydraulics and heat transfer affecting the plant structural mass; (b) the SCDAP module for simulation of core components during degradation, melt, and relocation to the lower reactor vessel head; and (c) the COUPLE module for simulation of the lower head to the time of creep rupture failure resulting from thermal attack by relocated core materials ..

A SCDAP/RELAP5/MOD3 model was not developed from scratch for use in this assessment. Instead, modifications were made to the inputs of an existing SCDAP/RELAP5/MOD0 model. The existing model, as developed by Bayless, 0- 2 has

• been the subject of critical internal reviews and at least one independent external review.a The existing model is believed to be a very good starting point for this assessment on that basis. All input modifications to the existing model are described separately in the following sections for RELAPS, SCDAP, and COUPLE modules. In addition, basic information is provided as needed to under~tand the input modifications and some of the general features of the model with respect to the current assessment. Other model details are adequately described by B~yless.

Before the input modifications are described, it should be noted that all calculations in this assessment were made using a code execution option known as MOD2.5 time smoothing. This option invokes a numerical method designed to improve calculational stability, as implemented as a default feature in SCDAP/RELAP5/MOD2.5. It is particularly helpful during shifts between flow regimes, heat transfer correlations, etc., where those shifts introduce functional discontinuities. The use of MOD2.5 time smoothing was justified in this assessment since (a) it produces only minor differences in scoping results out to the onset of core heatup, (b) it reduces the magnitude of integrated mass ~rrors, and (c) it allows the code to run faster with fewer calculational problems.

\

• a. G. M. Martinez et al., Independent Review of SCDAPIRELAP5 Natural Circulation Ca7cu7ations, SAND91-2089 (to be published).*

B-3 NUREG/CR-5949

Appendix B B-1 RELAPS INPUT The RELAPS module was used to simulate the thermal-hydraulics of the reactor vessel, the piping in all three primary coolant loops, the pressurizer, all three steam generators, and selected parts of the secondary systems. Reactor vessel nodalization, as developed by Bayless, 6* 2 is shown in Figure B-1. As indicated, three parallel flow channels extend from the lower plenum throug~ the core to the upper reactor vessel head. If the appropriate conditions exist, this arrangement will allow development of in-vessel natural circulation. Heat structures, which are shown as shaded areas, represent the structural mass of the reactor vessel walls, the core barrel and baffle, the thermal shield, the upper and lower core suppnrt plates, and structures in the upper and lower plena. External surfaces of all heat structures were assumed to be adiabatic.

A junction connecting the top of the downcomer (Volume 102) to the upper plenum (Volume 172) at the hot leg elevation is shown in Figure B-1. This junction represents a small leak path associated with clearances between the hot leg nozzles, (which are welded to the reactor vessel wall) and the internal hot leg piping (which is welded to the core barrel). The resulting gap in the hot leg piping, which allows flow to bypass the core, is a design requirement for removal of core internals.

Nodalizations of the primary coolant loop containing the pressurizer; as developed by Bayless, are shown in Figures B-2 and B-3. With the exception of the pressurizer and associated surge line piping, similar nodalizations were included in the model to separately represent the other two primary coolant loops in the Surry NPP.

The nodalization shown in Figure B-2 was used in conjunction with the reactor vessel nodalization from TMLB' initiation to core heatup. (In this assessment, it was assumed that the onset of core heatup coincided with a core exit vapor superheat of 2.78 K.) During this portion of the transient, full loop natural circulation of subcooled and saturated liquid can develop. As the core heats the primary coolant toward saturation, however, voids begin to form and collect at the top of the steam generator U-tubes. Once that occurs, full loop natural circulation of liquid is interrupted.

At the onset of core heatup, Figure B-2 nodalization was replaced by Figure B-3 nodalization in all calculations except those associated with Case

2. This substitution provided the flow paths needed to represent hot leg countercurrent natural circulation. (Figure B-3 nodalization was never used in Case 2, which was performed to evaluate conditions with minimum ex-vessel heat transfer.) Hot leg countercurrent natural circulation became possible after saturated liquid in the hot legs drained to the vessel and/or flashed.

At that time, temperature gradients from the core to the steam generator U-tubes can drive steam flow along the top half of the hot leg (represented by components 400, 402, and 404), through a portion of the steam generator U-tubes (represented by component 408), and back to the vessel through a cooler portion of the steam generator U-tubes and the lower half of the hot leg NUREG/CR-5949 8-4

Appendix B 1042

• 3 4

118 4

118 3

113

]_

113 6

113

§_

113 5 118 ~-

2 113

}_

113 118 g. -

6 1 113 1

108 M174-BDR-0293-001

• Figure B-1. Surry NPP reactor vessel nodalization with provisions for in-vessel natural circulation.

B-5 NUREG/CR-5949

444PORVs l>

z "C C:

0 482 "C rr, CD G")

.......... Main 445 0..

485 489 n feed MSIV Safeties Safeties

0 ><

I (J'1 cc

\0

\0 476 2

441 Pressurizer 4

Steam 449 Generator Containment 47 cc I

O'I 3 2 Reactor vessel 172 102 415 RCP Seals M-47811<-1291-03 Figure B-2. Pressurizer coolant loop nodalization for the Surry NPP without provisions for hot leg countercurrent natural circulation .

• 412

• 444PORYII 485 489 445 MSIV Safeties Safeties 2

441 3 Pressurizer 4

Steam 449 Generator 5 Containment 6

7 CJ I

Reactor vessel 102

z <115 C RCP

c rr, Seals

)::o "C

~ M478 dk-1291-02 "C n CD

s

c I Q.

u,

\0

~

Figure B-3. Pressurizer coolant loop nodalization for the Surry NPP with provisions for hot leg X

\0 countercurrent natural circulation. *CJ

Appendix B (represented by components 409 and 430). (Note that if reactor coolant pump (RCP) loop seals clear, both Figure B-2 and 8-3 nodalizations will also allow full loop natural circulation of superheated steam.) Flow areas and loss coefficients in the split hot legs, split U-tubes, and associated components were established to match experimental countercurrent flow data as explained by Bayless.

As indicated in Figures B-2 and B-3, both fluid volumes and heat structures were included to represent the primary coolant loop piping, the pressurizer and associated surge line, and the steam generator with associated relief valves. Without ac power, the accumulator is the only emergency core cooling system that required simulation. The steam generator main feedwater system and associated piping were only needed to establish steady-state conditions prior to transient initiation. Auxiliary feedwater systems were not modeled, since they are not operational in a TMLB' sequence. The external surfaces of all heat structures were assumed to be adiabatic.

A single valve was used to represent both power-operated relief valves (PORVs) connected to the pressurizer. The valve was appropriately sized to represent the flow capacity of both PORVs in the Surry NPP. Similarly, a single valve was used to represent all three safety relief valves. It was assumed that there was sufficient plant air and battery power to allow operation of the valves throughout all transients. Other (potential) valve failure modes were not considered.

Trip valves were added to the existing model to represent potential

• leakage from RCP seals. As indicated in Figures 8-2 and 8-3, the leak was modeled at the discharge elevation of each RCP. (SCDAP/RELAP5/MOD3 allows only one connection to a pump outlet. However, the inlet of the connected pipe is hydraulically equivalent to the RCP outlet in SCDAP/RELAP5/MOD3.) The relationship between transient time and valve flow areas used to model seal leakage in this assessment is described in the body of this report.

RCP seal leaks (and discharges from the pressurizer) were directed into a single volume representing the Surry NPP containment, as indicated in Figures B-2 and B-3. However, there was no attempt to model containment in detail based on the assumption that flows from the reactor coolant system (RCS) to containment should be choked. Containment pressure response was then monitored during all calculations to check the validity of that assumption.

In Cases 4, 5, and 6, it was found that RCP seal leak flows did come unchoked late in the transients. For those cases, a more accurate representation of containment pressure was obtained by restarting the affected calculations with heat structures representing the containment:masses of concrete and carbon steel. The resulting heat sinks reduced containment pressure by condensing RCS flows. Further refinement of the containment'model was unnecessary, since the pressure reduction was more than enough to produce choking of all flows from the RCS.

An interphase friction correlation for flow past rodded geometries was added to SCDAP/RELAP5/MOD3. Based on recommendations from the code

• development staff, input was added to the model to use that correlation in the core and steam 1 generator secondary volumes. As an associated input addition, NUREG/CR-5949 B-8

Appendix B

• the m1n1mum tube-to-tube spacing was used in place of the heated equivalent diameter for the secondary side of U-tube heat structures. (A corresponding rod-to-rod spacing input for the core could not be made, since SCDAP components, not RELAP5 heat structures, were used to represent the fuel.)

Several other RELAP5 inputs were added and/or altered in the transition from SCDAP/RELAP5/MOD0 to SCDAP/RELAP5/MOD3 (the addition of junction hydraulic diameter input, the alteration of the heated equivalent diameter input for heat structures, and so on).* To the extent possible, all necessary input additions/alterations were implemented to retain comparability with the Bayless model.

B-2 SCDAP INPUT The three core flow channels shown in Figure B-1 were selected so that similarly powered fuel assemblies would be grouped together. A cross-section of the resulting three channel model is shown in Figure B-4. The number of fuel assemblies in each channel and their relative power is indicated.

A typical 15xl5 fuel assembly used in the Surry NPP consists of fuel rods, control rods, and instrument tubes, as shown in Figure B-5. Therefore, separate SCDAP' components representing fuel rods, control rods, and empty

• control rod guide tubes and instrument tubes were used by Bayless to model each channel. 8 - 2 As a result, a total of nine SCDAP components was required.

Scoping calculations were performed to determine if SCDAP components representing the control rods could be combined with SCDAP components representing the empty control rod guide tubes and instrument tubes (by channel). In those calculations, a one-channel model was developed using the three-component approach. In a second one-channel model, control rods, *empty control rod gµide tubes, and instrument tube~ were combined into a sirigle SCDAP control rod component. In that case, the total number of rods plus tubes was not altered. However, a control rod of*reduced size had to be used to conserve the masses of control rod materials and the cladding.

Calculations using both models were allowed to proceed through core degradation, melt, and relocation. Results from the two models were found to be virtually identical.

Based on the results of .the scoping calculations, control rods were combined with ~mpty control rod guide tubes and instrument tubes in each flow channel of the SCDAP/RELAP5/MOD3 model. Compared to the Bayless model, this simplification reduced the number of SCDAP components from nine to six.

SCDAP fuel rod components were linked to ,a table to provide an appropriate decay power curve for the Surry NPP following the loss of ac power (and associated reactor scram). The decay power curve was based on an ORIGEN2 calculation from scram to 20,000 s (333.3 min) as used in the sensitivity

• calculations described by Bayless., As indicated in Table B-1, however, the 8-9 NUREG/CR-5949

)>

"O "O

Cl) a.

X 0:::,

Core barrel Core bypass I

I I

I

---.JI r----,

I I Core baffle I I I I

I I

I

~----*

I I

I I I

I I

,---~

I I

• ----i I

I Outer channel I

I I

---

i I 36 fuel assemblies I

I I

I relative power = 0. 76 0:::,

I I

I I

I I

I

...... I I 0  !.----I I

I Middle channel I

I 96 fuel assemblies I

I I relative power = 1.05 Center channel 25 fuel assemblies relative power = 1. 17 Figure B-4. A cross section of the three-channel core region.

r .., ,, ....... r .., r""'\

\...,,) \. ~ \... _..) \. )

r,

\... .)

/ ~

\... ~

r "

\... _.)

r .... r " Control rod

\... ~ \. )

guide tube r-..... r

'I OJ .\. ~ "'"-"' '- ~

I

,__. i.---

Instrument

--- -- i--- i.--

/ .......

.. r.....,

tube \. .,

r, r """I -

\.

Fuel rod

\... .J r,

\... __,)

• L-location

,, ....... I/ ....,

\. ~

r....., r.....,

\... ., ~., \. ~ \. .,

z C

o l"T"I )>

G') "'O

--....... "'O n CD

o

::s I 0.

u, -'*

I.O X

~

I.O Figure B-5. A typical 15xl5 Surry NPP fuel assembly. OJ

z l>

"C C: "C

c Cl) l'T1  :::,

en a.

n X

c I

cc u,

U) Table B-1. Decay power curve.

~

U)

Center Channel Middle Channel Outer Chancel (MW) (MW) (MW)

Time Fission Fission Fission (s) Prompt Product Actinide Prompt Product Actinide Prompt Product Actinide 0.0 426.75 25.804 1.4094 1470.l 89.974 4.3161 398.42 25.198 1.0112 0.7 426.75 25.804 1.4094 1470.1 89.974 4.3161 398.42 25.198 L0112 1.0 382.11 25.804 1.4094 1316.3 89.974 4.3161 356.74 25.198 1.0112 1.5 323.73 24.634 1.4092 1115.3 85.803 4.3152 302.23 23.991 1.0112 2.0 275.83 23. 872 1.4092 950.24 83 .131 4.3152 257.52 23.217 1.0112 3.0 61.178 22.820 1.4087 210.75 79.444 4.3132 57 .117 22.164 1. 0109 cc 6.0 8.8713 20.987 1.4077 30.561 73.022 4.3104 8.2822 20.332 1.0102 N

I

11. 0 5.5405 19.328 1.4060 19.087 67.213 4.3056 5.1726 18.679 1.0087 16.0 4.1075 18.267 1.4043 14.150 63.521 4.2998 3.8347 17.641 1. 0077 21.0 3.2849 17. 491 1.4025 11.316 60.810 4.2941 3.0669 16.883 1.0062 31.0 2.3029 16.378 1.3987 7.9338 56.949 4.2826 2.1501 15.797 1.0037 51.0 1.2969 14.956 1.3919 4.4680 52. 016 4.2615 1.2108 14.428 0.9987 101.0 0.3965 13.031 1.3750 1.3660 45.365 4.2088 0.3702 12.585 0.9861 201.0 0.0679 11. 270 1.3421 0.2338 39.252 4 .1072 0.0634 10.888 0.9620 501.0 0.0013 9.3085 1.2525 0.0046 32.400 3.8312 0.0012 8.9838 0.8962 1001.0 0.0 7.9034 1.1297 0.0 27.531 3.4518 0.0 7.6400 0.8057 2501.0 0.0 6.0192 0.8979 0.0 20.986 2. 7359 0.0 5.8287 0.6357 5001. O 0.0 4.7465 0.7429 0.0 16.521 2.2586 0.0 4.5747 0.5225 10001.0 0.0 3.7534 0.6738 0.0 12.966 2.0479 0.0 3.5601 0.4729 20001.0 0.0 3.2092 0.6448 0.0 11.087 1.9616 0.0 3.0214 0.4535 36000.0 0.0 2. 7197 0.5548 0.0 9.4023 1.6836 0.0 2.5731 0.3877

Appendix B

• decay power curve was extended to 36,000 seconds (600.0 minutes) to accommodate the anticipated duration of calculations in this assessment. The accuracy of the extension, which was made with a least-squares fit of the last seven data points in the original table, should not adversely impact results.

, In addition, the Bayless data was scaled by a factor of 0.998 to obtain a match between MODO and MOD3 steady-state power levels.

SCDAP input is required to define certain parameters that control severe core damage progression. In general, best-estimate parameters were selected where there were data or some basic understanding of the associated process.

For parameters with higher degrees of uncertainty, values were selected to minimize the time to lower head failure. This approach provides the basis for a conservative evaluation of the potential for high pressure melt ejection and the associated problem of direct containment heating, since the time available for generation of an ex-vessel failure by natural convection heating is minimized and since the system pressure at the time of failure should be maximized (at least for RCP seal leak cases). The resulting parameter set, including a full discussion of the logic used to establish each value, is described in the body of this report.

Several other SCDAP inputs were added and/or altered in the transition from SCDAP/RELAP5/MOD0 to SCDAP/RELAP5/MOD3 (the addition of fuel rod gap conductance, the alteration in the number of radial nodes required to define a control rod component, and so on). To the extent possible, all necessary input additions/alterations were implemented to retain comparability with the Bayless model.

B-3 COUPLE INPUT SCDAP/RELAPS(MODO calculations by Bayless were terminated when fuel relocation began. 2 For that reason, detailed modeling of the lower reactor vessel head was not performed. In this assessment, however, determining the time of lower head failure was a primary objective that required COUPLE input.

The COUPLE mesh used to represent the lower reactor vessel head is shown in Figure B-6. The axisymetric mesh includes a total of 320 nodes with 285 elements. Two elements were used to represent the thickness of the carbon steel portion of the lower head, with an adjoining single element representing the stainless steel liner. (Because the liner is relatively thin, the elements representing it appear to be a heavy line in the figure.)

A layer of zero-width gap elements coincided with the inner surface of the liner. The gap elements provided a way to model contact resistance between the debris and liner. In this assessment, a large conductance was used to simulate perfect debris/liner contact. (This approach is consistent with the effort to minimize the time to lower head failure.) The remaining elements are initially filled with primary coolant. During molten relocation,

• the coolant can boil off and/or be displaced by debris.

B-13 NUREG/CR-5949

z )>

"C C

~ "C rT'1 ro G)  ::::,

......... 0.

n -'*

X

~

I u, 2 0::,

I.O

~

I.O 1.5

--E 0::,

I

.c:

.Q>

Q) 1

...... I

~

0 0 0.5 1 1.5 2 2.5 Radius {m)

Figure B-6. COUPLE mesh representing the lower reactor vessel head.

Appendix B

• Convection and radiation heat transfer were modeled at all interfaces between the coolant and debris. In addition, convection and radiation heat transfer were modeled along the vessel wall at all nodes that are not submerged by debris (those nodes exposed to primary coolant/steam). The external surface of the lower head was assumed to be adiabatic.

B-4 REFERENCES 8-1. C. M. Allison et al., SCDAPIRELAP5/MOD3 Code Manual, NUREG/CR-5273, EGG-2555 (Draft), Revision 2, Volumes 1-4, September 1991 (available from EG&G Idaho, Inc.).

B-2. P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAPIRELAP5, NUREG/CR-5214, EGG-2547, October 1988 .

• B-15 NUREG/CR-5949

APPENDIX C STEADY-STATE CALCULATIONS

• C-1

Appendix C

• APPENDIX C STEADY-STATE CALCULATIONS Steady-state initialization of the complete SCDAP/RELAP5/MOD3 model was required before making* transient calculations. The initialization involved, bringing the model to stable conditions representing full power operation of the Surry nuclear power plant. Initialization was considered acceptable when conditions matched the steady state calculated by Bayless.c-, A comparison with Bayless results is provided in Table C-1.

Table C-1. Comparison of steady-state results with sensitivity study values computed by Bayless.~ 1 SCDAP/RELAP5fMODO SCDAP/RELAP5/MOD3 Parameter result~ 1 result Core thermal power, MW 2443 2443 Pressurizer pressure, MPa 15.5 15.5

• Pressurizer liquid level, m Hot leg temperature, K Cold leg temperature, K 6.62 591. 7 557.0 6.62 591.8 557.0 Coolant flow per loop, kg/s 4230 4229 Steam generator pressure, MPa 5. 71 5.72 Liquid mass per steam generator, kg 44000 43997 Feedwater flow per steam generator, kg/s 444.6 442.9 Xenon mass, kg 258.3 258.0 Krypton mass, kg 29 .10 29.06 Cesium mass,. kg 186.7 149.4 Iodine mass, kg 10.42 10.41 Tellurium mass, kg 23.98 23.97

• C-3 NUREG/CR-5949

Appendix C As indicated in the table, the only significant deviation is in ~esium inventory. Howeverc a separate ORIGEN2 calculation predicted an inventory of 125.5 kg of cesium._, Therefore, the value calcu.lated with SCDAP/RELAP5/MOD3 appears to be a better estimate, since it is clos~r to the ORIGEN2 calculation, which is presumed to be more accurate.

REFERENCES C-1. P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAPIRELAP5, NUREG/CR-5214, EGG-2547, October 1988.

NUREG/CR-5949 C-4

APPENDIX D CALCULATION STATISTICS

• D-1

Appendix D

• APPENDIX D

. CALCULATION STATISTICS All calculations in this assessment were performed on a DEC (Digital Equipment Corporation) 5000/200 workstation running Version 4.2, Revision 96, of the ULTRIX operating system. The SCDAP/RELAP5/MOD3 source was compiled and executed using ULTRIX Version 3.X of the MIPS FORTRAN77 compiler. Other statistics for each calculation are summarized in Table D-1.

Table D-1. Calculation statistics.a Number of Number of Number of RELAP5 RELAP5 heat Number of COUPLE Problem CPU volumes/ structures/ SCDAP nodes/ time time Case junctions mesh points components elements (s) (s)

Steady- 255/307 263/1208 6 320/285 200 5820 state

• Base 2

3 251/304 255/307 251/304 260/1199 263/1208 260/1199 6

6 6

320/285 320/285 320/285 29000 17000 25800 239600 135000 394400 I

4 251/304 263/l 206b 6 320/285 27800 563900 5

• 251/304 263/l 206b 6 320/285 29800 594500 6 251/304 263/1206b 6 320/285 23800 408900

a. RELAP5 inputs representing the p1p1ng and heat structures needed for simulation of hot leg countercurrent natural circulation were included in all calculations.* Trip valves were used to isolate that piping and prevent hot leg countercurrent natural circulation during Steady-state and Case 2 calculations. However, all RELAP5 volumes and heat structures are reflected in the data given above, since even isolated components impact CPU requirements.

b. This number includes containment heat structures added late in the calculation, as discussed in Appendix B.

• D-3 NUREG/CR-5949

APPENDIX E SCDAP/RELAPS/MOD3 MODEL BENCHMARK

• E-1

Appendix E

• APPENDIX E SCDAP/RELAPS/MOD3 MODEL BENCHMARK The Base Case calculation in this analysis used initial and boundary

• conditions from a previous study.&, However, the Base Case differed from the previous study in the code version used and in the desired endpoint of the calculation (lower head failure versus initial fuel rod relocation). The Base Case had to be performed because of those differences and because it served as a starting point for the other calculations*in this analysis. Base Case results were used to benchmark the code and model before completing those calculations.

Base Case results are listed in Table E-1, along with those taken from the previous study. As indicated, event timing was consistently early in the Base Case. The main reason for this difference appears to be in the transfer of fuel stored energy. In the previous study, the code allowed contact between the f~el and cladding. Removal of fuel stored energy before core uncovery was relatively effective because of the associated thermal-conductivity. In the Base Case, a new model was used to represent a gas gap conductivity based on best-estimate values for LWR fuel. As a result, more energy was left in the fuel following uncovery, which could have led to a

• faster progression of events. The results compare well given that difference and the fact that numerous changes have.been made to the code since the previous study.

Table E-1. Comparison of results from the Base Case and a previous study.

Time (s)

Event Base case Previous study&,

TMLB' initiation 0 0 Steam generator dryout (loops C/A & B) 4620/4700 5120/5420 Initial cycle of pressurizer PORV 4680 4970 Hot legs saturate 6900 7250 Full loop natural circulation ends 7330 7790 Onset of fuel rod oxidation 10840 11120 Creep rupture failure of surge line 14250 14780

• Initial fuel/cladding relocation E-3 14500 14880 NUREG/CR-5949

Appendix E E-1.

REFERENCES P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAP/RELAP5, NUREG/CR-5214, EGG-2547, October 1988.

NUREG/CR-5949 E-4

APPENDIX F SELECTED CORE DAMAGE RESULTS

• F-1

Appendix F

• APPENDIX F SELECTED CORE DAMAGE RESULTS Selected core damage results for the six different SCDAP/RELAP5/MOD3 calculations performed in this assessment ~re given in the following tables.

Each table has two columns. Each column contains a list of plant conditions and a list of debris characteristics. Plant conditions are given at the time of the first relocation of molten fuel into the lower head and at the time of lower head failure. Debris characteristics in the first column represent -the materials that were actually relocated at the indicated time, while debris characteristics in the second column represent all materials in the lower head at the time of lower head failure .

• F-3 NUREG/CR-5949

Appendix F Table F-1. Selected core damage results for the Base Case.

Plant conditions/

debris characteristics At relocation (480.8 min)

At lower head failure (482.0 min)

RCS pressure (MPa) 16.0 16.0 Lower plenum RCS temperature (K) 930 842 Total H2 generated (kg) 319 319 Fraction of total Zr oxidized 0.449 0.449 Containment press (MPa)a 0 .193 0.194 Containment temp (K)a 416 414 Ag mass (kg) 0 0 Stainless steel mass (kg) 0 0 U0 2 mass (kg) 57060 57060 Zr mass (kg) 0 0 Zr0 2 mass (kg) 9930 9930 Maximum temperature (K)b 3450 2860 Estimated molten fraction° 1.0 < 0.01

a. This valu~ is based on containment conditions at relocation and lower head failure, as calculated in Case 4.

b. This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

c. This value represents the fraction of the listed debris that was molten'at the specified times. The fraction is always 1.0 at the time of relocation since all relocating debris must be molten. At lower head failure, the value was estimated. by the fraction of the listed lower head debris that was above 2850 Kat the time of failure. The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr0 2/U0 2 mixtures .

NUREG/CR-5949 F-4

Appendix F

• Table F-2. Selected core damage results for Case 2.

Plant conditions/

debris characteristics At relocation (257.8 min)

At lower head failure (260.1 min) 8 RCS pressure (MPa) 16.0 16.0 Lower plenum RCS temperature (K) 678 666 Total H2 generated (kg) 220 228 Fraction of total Zr oxidized 0.310 0.321 Containment press (MPa)b 0.193 0.194 Containment temp (K)b 416 414 Ag mass (kg) 0 0 Stainless steel mass (kg) 0 0 U0 2 mass (kg) 5800 5800 Zr mass (kg) 0 0 Zr0 2 mass (kg) 1050 1050 Maximum temperature (Kt 3190 2690 Estim~ted molten fractiond 1.0 0.0

a. A second molten core relocation of 170 kg of Ag, 9090 kg of U0 2 , and 2900 kg Zr at 3190 K occurred at 266.5 min, 6.4 min after lower head failure.

b. This value ,s based on containment conditions at relocation and lower head failure, as calculated in Case 4.

c. This value represents the temperature of; the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

d. This value represents the fraction of the listed debris that was molten at the specified times. The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten. At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure. The eutectic melt temperature of 2850 K was selected, sinae it is applicable to a very wide range of Zr0 2/U0 2 mixtures .

• F-5 NUREG/CR-5949

Appendix F Table F-3. Selected core damage results for Case 3.

Plant conditions/

debris characteristics At relocation (403.3 min)

At lower head failure (405.7 min)a RCS pressure (MPa) 2.08 8.56 Lower plenum RCS temperature (K) 489 573 Total H2 generated (kg) 415 415 Fraction of total Zr oxidized 0.585 0.585 Containment press (MPa)b 0.164 0.164 Containment temp (K)b 396 396 Ag mass (kg) 0 1840 Stainless steel mass (kg) 0 20 U0 2 mass (kg) 10520 10520 Zr mass (kg) 0 50 Zr0 2 mass (kg) 1850 1850 Maximum temperature (K)c Estimated molten fractiond a.

3630 1.0 3050 0.22 This includes control rod materials that began relocating at 233.0 min.

b. This value is based on containment conditions at relocation and lower head failure as calculated in Case 5.

c. This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

d. This value represents the fraction of the listed debris that was molten at the specified times. The* fraction is always 1.0 at the time of relocation, since all relocating debris must be molten. At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure. The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr0 2/U0 2 mixtures .

NUREG/CR-5949 F-6

Appendix F

• Table F-4. Selected core damage results for Case 4.

Plant conditions/

debris characteristics At relocation (426.0 min)

At lower head failure (433.0 min)8 RCS pressur~ {MPa) 1.41 1.36 Lower plenum RCS temperature (K) 468 466 Total H2 generated (kg) 188 189 Fraction of total Zr oxidized 0.265 0.266 Containment press (MPa) 0.193 0.194 Containment temp (K) 416 414 Ag mass (kg) 0 0 Stainless steel mass (kg) 0 0 U0 2 mass (kg) 12940 12940 Zr mass (kg) 0 0 Zr0 2 mass ( kg) 2180 2180 Maximum temperature (K)b 3380 3010 Estimated molten fractionc 1.0 0.15 I

a. A second molten core relocation of 9780 kg of U0 2 and 1460 kg of Zr0 2 at 3640 K occurred at 460.7 min, 27.7 min after lower head failure.

b. This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

c. This value represents the fraction of the listed debris that was molten at the specified times. The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten~ At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure. The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr0 2/U0 2 mixtures .

• F-7 NUREG/CR-5949

Appendix F Table F-5. Selected core damage results for Case 5.

Plant conditions/

debris characteristics At relocation (403.3 min)

At lower head failure (479.6 min)8 RCS pressure (MPa) 2.08 6.48 Lower plenum RCS temperature (K) 489 543 Total H2 generated (kg) 415 419 Fraction of total Zr oxidized 0.585 0.590 Containment press (MPa) 0.164 0.164 Containment temp (K) 396 396 Ag mass (kg) 0 2010 Stainless steel mass (kg) 0 60 I

U0 2 mass (kg) I 10520 54940 Zr mass (kg) 0 130 Zr0 2 mass (kg) 1850 10120 Maximum temperature (K)b 3630 2880 Estimated molten fractionc 1.0 < 0.01

a. This includes debris from control rod relocation starting at 233.0 min and a second molten core relocation at 3110 Kat 477.7 min.

b. This value ~epresents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

c. This value represents the fraction of the listed debris that was molten at the specified times. The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten. At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure. The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr0 2/U0 2 mixtures .

NUREG/CR-5949 F-8

• Appendix F

• Table F-6. Selected core damage results for Case 6.

Plant conditions/ At relocation- At lower head failure debris characteristics (480.8 min) (482.0 min)

RCS pressure (MP-a) 1. 26 1. 37 Lower plenum RCS temperature (K) 456 461 Total H2 generiated (kg) 197 198 Fraction of total Zr oxidized 0. 277 0.279 Containment press (MPa) 0.246 0.247 Containment temp (K) 399 399 Ag mass (kg) 0 1680 Stainless steel mass (kg) 0 8 U0 2 mass (kg) 44370 44370 Zr mass (kg) 0 80 Zr0 2 mass (kg) 7980 7980 Maximum temperature (K)b 3120 2980 Estimated molten fractionc 1.0 0.06

a. This includes control rod materials that began relocating at 357.3 min.

b. This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the tirrie of failure.

c. This value represents the fraction of the listed debris that was molten at the specified times. The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten: At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure. The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr0 2/U0 2 mixtures .

• F-9 NUREG/CR-5949

APPENDIX G PROBABILISTIC RISK ASSESSMENT ISSUES

• G-1

CONTENTS G-1. Surge Line/Hot Leg Failure Issue G-4

• G-1.1 Issue Probability for TMLB' Sequences Without RCP Seal Leaks G-8 G-1.1.1 Pl--Probability of Surge Line Failure as a Function of Time G-9 G-1.1.2 P2--Probability of Hot Leg Failure as a Function of Time G-11 G-1.1.3 P3--Probability that the RCS Pressure is Low as a Function of Time G-17 G-1.1.4 P4--Probability of Lower Head Failure as a Function of Time G-19 G-1.1.5 Recombination of Probabilities Pl through P4 G-21 G-1.2 Issue Probability for TMLB' Sequences with RCP Seal Leaks G-24 G-1.2.1 Pl--Probability of Surge Line Failure as a Function of Time G-25 G-1.2.2 P2--Probability of Hot Leg Failure as a Function of Time . G-31 G-1.2.3 P3--Probability that the RCS Pressure is Low as a Function of Time G-35 G-1.2.4 P4--Probability of Lower Head Failure as a Function of Ti me . . . . G-38 G-1.3 G-1.2.5 Recombination of Probabilities Pl through P4 Issue Probability for TMLB' Sequences with Stuck-Open/

Latched-Open PORVs G-1.3.l Pl--Probability of Surge Line Failure as a G-40 G-43

• Function of Time G-44 G-1.3.2 P2--Probability of Hot Leg Failure as a Function of Time G-49 G-1.3.3 P3--Probability that the RCS Pressure is Low as a Function of Time G-52 G-1.3.4 P4--Probability of Lower Head Failure as a Function of Time . G-52 G-1.3.5 Recombination of Probabilities Pl through P4 G-.54 G-2. RCS Pressure at Vessel Breach Issue . G-57 G-2.1 lssue Probabilities for TMLB' Sequences Without RCP Seal Leaks . G-57 G-2.2 Issue Probabilities for TMLB' Sequences with RCP Seal Leaks . . . . . . . G-58 G-2.3 Issue Probabilities for TMLB' Sequences with Stuck-Open/

Latched-Open PORVs G-63 I

G-3. References G-65

Appendix G

• It is possible to derive Equation (G-1) intuitively or through a more rigorous transformation-of-variables approach. Both derivations follow.

I Derivation 1: Let TLP be a random variable modeling the time of RCS depressurization following surge line/hot leg failure and TLH be a random variable modeling the time of lower head failure. What must be calculated is the probability that TLH is greater than TLP, which will be denoted as P(TLH > TLP). (It is assumed that TLP and TLH are statistically independent.)

Let TLH have probability density function P~. 2 (t 2 ), and T~ have probability density function PLP, 1 (t 1 ). At any given value of TLP' say TLP = t 1 , one can write 00 P_(TLH > TLPITLP = t,) = JPLH.2(tz)PLP.1(t,)dt2 *: (G-2) t, Integrating over all values oft, is necessary to find the probability that TLH > TLP* The resulting equation, which is equivalent to Equation (G-1), is given by 00 00 P(TLH > TLP) = J JPLH,2(tz)PLP.1(t,)dt2dt, (G-3)

-oo t, I

Derivation 2: Let Z = T~ - T~ where P(Z > 0) is needed. Define the transformation T as (G-4)

This is a one-to-one transformation with i_nverse r1 given by 7-1: TLH = w TLP = W- Z (G-5)

The absolute value of the determinant of the Jacobian of T- 1 is 1. If TLH and TLP are statistically independent,, the joint density function is (G-6)

Integrating over Wgives the marginal density of Z as

• G-7 NUREG/CR-5949

Appendix G h(z) = f

-00 h(z,w)dw = f 00

-oo PLH. 2(w)PLP., (w - z)dw . (G-7)

• The probability that Z > *O is given by L

00 00 p (Z > 0) = l pLH. 2 ( w) PLP., ( w - z) dwd z . (G-8)

Interchanging the order of integration gives 00 00 P(Z > 0) = llPLH. 2(w)PLP., (w - z)dwdz (G-9)

Using the fact that the determinant of the Jacobian of T- 1 has an absolute value 1, we can rewrite this in terms of the original variables. The resulting equation, which is equivalent to Equation (G-1), is given by sI 00 00 P(TLH > TLP) = PLH,2( ti)PLP,1 ( t, )dt2dt, (G-10)

- 00 tl The quantification approach as described was used to evaluate probabilities of the surge line/hot leg failure issue for each of the scenarios considered. Specifically, the probability assoc1ated with TMLB' sequences without RCP seal leaks is evaluated in Section G-1.1, the probability associated with TMLB' sequences with RCP seal leaks is evaluated in Section G-1.2, and the probability associated with TMLB' sequences with stuck-open/latched-open PORVs is evaluated in Section G-1.3. As previously indicated, the resulting probabilities are conditional on the occurrence of the specific scenarios in the Surry NPP.

G-1.1 Issue Probability for TMLB' Sequences without RCP Seal Leaks This section contains the probability quantification for the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP. As discussed in Section G-1, the surge line/hot leg failure issue was decomposed into four separate probabilities, denoted Pl through P4. Sections G-1.1.1 through G-1.1.4 contain evaluations of the separate probabilities Pl through P4, which are also conditional on the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP. The NUREG/CR-5949 G-8

Appendix G

• surge line/hot leg failure issue probability for this scenario was then obtained through recombination of the separate probabilities. That recombination is outlined in Section G-1.1.5.

The following quantification was primarily based on TMLB' Base Case results and TMLB' Case 2 results as calculated with SCDAP/RELAPS/MOD3 and described elsewhere in this report. As,explained throughout this section, however, weighting fractions of Q.95 and 0.05 were applied to all interpretatiops of TMLB' Base Case and TMLB' Case 2 results, respectively.

Those weighting fractions were selected to reflect the assumption that the TMLB' Base Case conditions (i.e., hot leg countercurrent natural circulation) would be expected based on Westinghouse natural circulation experiments.

G-1.1.1 Pl--Probability of Surge Line Failure as a Function of Time.

SCDAP/RELAP5/MOD3 calculates pressure boundary failures using a Larson-Miller parameter to accumulate creep rupture damage associated with the time a specified boundary is subjected to calculated pressures and temperatures.G- 3 Therefore, the calculated failure of the surge line is a function of pressure and temperature. In this scenario, surge :line (and all other RCS) pressures are well defin~d by periodic cycling of the PORVs. As a result, there is relatively little uncertainty in the pressure aspect of surge line creep rupture. However, there are potential uncertainties in the calculated surge line temperatures, which could affect the timing of surge line failures. ;It was assumed that the probability of surge line failure could be inferred from

• the variation in failure times resulting from those temperature uncertainties.

Temperature uncertainties coald be introduced into the code calculations in a variety of ways. For example, oxidation may be underpredicted, since only intact fuel rods are allowed to oxidize in the current version of SCDAP/RELAP5/MOD3. If oxidation is underpredicted, the temperature of the vapor transported from the core through the surge line with each PORV cycle may be low. On the other hand, SCDAP surfaces representing the core components radiate to each other and to the surrounding vapor. However, radiation from SCDAP surfaces to heat structures representing the reactor vessel internals is not calculated. Since some of those internals (particularly the lower core support.plate and other structures in the lower plenum) could be relatively cool, temperatures of the SCDAP surfaces and the surrounding vapor may be high. These examples indicate a potential for both higher and lower surge line temperatures than were actually predicted.

A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the stainless steel surge line subjected to potential temperature variations. The simple one-volume model had to be benchmarked before those calculations could be made. Surge line vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 results for the TMLB' Base Case and TMLB' Case 2 as a first step in benchmarking. A constant pressure of 15.96 Mpa (representing the midpoint between the opening and closing pressures of the cycling PORVs) and the extracted vapor temperatures were used as surge line boundary conditions. Heat transfer coefficients from the vapor to the surge line were then adjusted until surge line failure times using the simple one-volume model matched failure times predicted in the TMLB' cases. That G-9 NUREG/CR-5949

Appendix G approach effectively simulated the pressure and temperature conditions leading to the surge line failures and provided reasonable heat transfer coefficients*

for use in subsequent calculations with the one-volume model.

The extracted temperature histories were then altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup in the TMLB' cases. The resulting surge line vapor temperature histories for the Base Case are shown with respect to the nominal history in Figure G-1 as an example. As indicated, surge line temperatures were varied by +/-20% relative to the temperature at the start of heatup (at about 150 min). (Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the surge line :at those levels.) The resulting variations represent possible heatup rates if the surge line temperatures are either under- or overpredicted.

Based on the potential uncertainties affecting surge line temperatures (including oxidation and radiation as previously discussed}, it was assumed

• that surge line vapor temperatures increased PY 20% should not be exceeded more than about 5% of the time. It was also assumed that surge line vapor temperatures decreased by 20% should be exceeded about 95%' of the time. Those assumptions were intended to represent the range of uncertainty associated with surge line heating. It is not possible to more definitively establish the range of uncertainty within the scope of this project. However, the assumptions could be easily modified at some future date if warranted .

2000.0 r----.----.---.-----,-----r-----.-----.-----,

G------l nom temp + 20%

- - nomtemp C3----EJ nom tern - 20%

q Cl) 1500.0 cu....

Cl)

C.

E Cl) t- 1000.0 500.0 .___ ___._ ___.__ ___.__ __.__ ___,___ _....__ _...__ ___,.l 100.0 150.0 200.0 250.0 300.0 Time (min)

Figure G-1. TMLB' Base Case surge line vapor temperature histories for estimation of surge line failure probabilities.

NUREG/CR-5949 G-10

• Appendix G

• P3:

P4:

The probability that RCS pressure is low as a function of time following surge line/hot leg failure The probability of lower head failure as a function of time SCDAP/RELAP5/MOD3 was used to calculate creep rupture failures of the surge line, hot leg, and lower head for a variety of conditions, as described in this report and in related reports (which will be cited). The RCS pressure 1

at the time qf lower head failure was also calculated. Those code re~ults, along with engineering judgment to assess potential uncertainties, were used to quantify probabilities Pl through P4.

The probability of the stated surge line/hot leg failure issue was then determined through a recombination of probabilities Pl through P4.

Recombination required that quantification be performed with respect to a common reference time. In this evaluation, the common reference was taken to be the time of lower head fa1lure as calculated by* SCDAP/RELAP5/MOD3.

Recombination began with a simple comparison of the probability of surge line failure as a function of time (Pl) to the probability of hot leg failure as a function of time (P2). Since RCS depressurization could occur following either ex-vessel failure, it was assumed that the potential for depressurization would be effectively controlled by the failure that had the highest probability of occurring first. The probability associated with the

• controlling ex-vessel failure (either Pl or P2) was then used to establish the probability for a low RCS pressure as a function of time (P3). The probability P3 was established through the use of available calculations and engineering judgment to determine how depressurization could proceed as a result of the controlling ex-vessel failure1 The final step in recombination involved comparison of the probability for a low RCS pressure as a function of time (P3) with the probability of lower head failure as a function of time (P4). If probabilities P3 and P4 did not overlap, the resulting probability of the stated surge line/hot leg failure issue was determined by inspection. In other words, if the probability for a low RCS pressure following surge line/hot leg failure (P3) reaches 1.0 before there is a probability for lower head failure (P4), the probability of the stated surge line/hot leg failure issue is clearly 1.0.

Conversely, the probability of the stated surge line/hot leg failure issue is 0.0 if the probability for lower head failure reaches 1.0 before there is a probability for RCS depressurization following the controlling ex-vessel failure. If probabilities P3 and P4 overlap, ,a statistical convolution of the probabilities was computed with (G-1)

• where p the probability of the stated surge line/hot leg failure issue G-5 NUREG/CR'-5949

Appendix G the probab~lity density function (PDF); i.e., the deri~ative of the probability with respect to time, representing the probability of depressurizing the RCS following a surge line/hot leg failure integrated wi~h respect to time t 1 the PDF representing the probability of lower head failure integrated with respect to time t 2

• The integral of PLH. 2 over the range of t, to oo represents the probability that vessel failure occurs after surge line/hot leg failure at the particular time t,. The probability of the stated surge line/hot leg failure issue is then given by the integral (from -o:, to oo) of the product of PLP,, and the PLH, 2 integral.

It is recognized that Equation (G-1) is strictly valid only if probabilities P3 and P4 are statistically independent. Independence requires that an increase/decrease in the probability of one event does not increase/decrease the probability of the other. The potential for dependency between the subject probabilities (P3 and P4) is also recognized. However, P~

and P4 may not be strongly dependent, as discussed below.

There are numerous uncertainties in the results of current analyses that would tend to increase and decrease both probabilities. Oxidation of zircaloy during core degradation is a good example. If oxidation,is underpredicted in current analyses, the calculation temperature of the steam circulating through the core and eventually heating the ex-vessel piping could be lower than expected. As a result, the probability of an ex-vessel failure could be reduced (or at least delayed). At the same time, underprediction of oxidation could also result in slower core heatup *and melting, which could reduce (or delay) the probability for relocation and lower head failure. There are also uncertaintiesiin the current analyses that would tend to increase the probability of one event while decreasing the probability of the other. In-core heat transfer is a good example. If in-core heat transfer is overpredicted in current analyses, the temperature of the steam that heats the ex-vessel piping could be higher than expected, which could increase the probability of (or at least accelerate) ex-vessel failure. At the same time, overprediction of in-core heat transfer could also result in lower core temperatures, which could reduce the probability of (or at least delay) relocation and lower head failure. Since some uncertainties could drive both probabilities in the same direction, while other uncertainties could drive them in opposite directions, it is possible that there is not a strong stat i st i cal dep,endence between probabilities P3 and P4.

I The decision to use Equation (G-1) is justified since (a) there are insufficient data to definitively establish the relationship between the subject probabilities (P3 and P4), (b) a strong statistical dependence is not supported when uncertainties in current analyses are considered, and (c) any

. compromise incurred through the u~e of the eqµation is assumed to be insignificant compared to other limitations in representing core melt progression with the current generation of computer codes.

NUREG/CR-5949 G-6

Appendix G

• APPENDIX G PROBABILISTIC RISK ASSESSMENT ISSUES An independent analysis is planned to determine the risk impact associated with intentional depressurization of the reactor coolant system (RCS) in the Surry nuclear power plant (NPP). The analysis is needed to support an Accident Management Program sponsored by the Nuclear Regulatory Commission (NRC). Probabilistic risk assessment (PRA) techniques will be used to determine the impact by comparing the risks of intentional RCS depressurization, where plant operators latch pressurizer power-operated relief valves (PORVs) open, with the risks that could be expected if plant operators take no action.

RCS depressurization issues that required evaluation in order to complete the risk analysis were identified through examination of the accident progression event tree (APET) developed for use in NUREG-1150.~ 1 Specifically, the APET was reviewed to compile a list of those RCS depressurization issues that have the largest influence on the risk results.

The list included two issues that could be affected by the current SCDAP/RELAP5/MOD3G- 2 analysis (and other related analyses completed after NUREG-1150): (a) surge line/hot leg failure and (b) RCS pressure at reactor vessel breach.

Probabilities associated with both RCS d~pressurization issues were originally quantified by a NUREG-1150 in-vessel expert panel for Surry TMLB' (station blackout) sequences with and without reactor coolant pump (RCP) seal leaks. It was assumed that quantification for the two scenarios would produce a reasonable estimate of the issue probabilities for all other conditi,ons.

(It should ba noted that another scenario, consisting of a TMLB' sequence with RCP seal leaks and operational auxiliary feedwater systems, was postulated.

However, that scenario was eliminated from consideration in NUREG-1150 based on the assumption that the availability of feedwater would minimize the probability for RCS depressurization through a surge line or hot leg failure.)

The evaluation contained in Appendix G represents an effort to update probabilities associated with both identified RCS depressurization issues based on current analyses. ~ike NUREG-1150, probabilities for both issues were (re)quantified for TMLB' sequences with and without RCP seal leaks. The potential for RCS depressurization during a TMLB' sequence with a stuck-open or latched-open PORV was recognized. Therefore, as a.step beyond NUREG-1150, probabilities for both identified depressurization issues were also quantified for that scenario. The results will be provided for use in the independent risk analysis. A better estimate of the risk associated with intentional depressurization is anticipated through use of the updated results.

Evaluation of the surge line/hot leg failure issue is given in Section G-1, and the issue of RCS pressure at vessel, breach is evaluated in Section G-

2. Probabilities are quantified for (a) TM~B' sequences without RCP seal G-3 NUREG/CR-5949

Appendix G leaks, (b) TMLB' sequences with RCP seal leaks, and (c) TMLB' sequences with stuck-open/latched-open PORVS in both sections. It should be clear that all of the resulting probabilities are conditional on the occurrence of the specific TMLB' scenario in the Surry NPP.

Before the probability evaluations are presented, it should be emphasized that the analysis described in this report was developed to represent the Surry NPP. Furthermore, related analyses completed after NUREG-1150 and cited here were also Surry-specific. Results from those analyses form the basis for the evaluation. Therefore, any application of information from this report, including that contained in Appendix G, should appropriately account for that limitation.

Although'the evaluation presented here is based on results from current analyses, it is also important to note that numerous assumptions and the application of engineering judgment were required to quantify the probabilities. That approach is unavoidable because of limitations in the current state of knowledge (stemming from a sparsity of experimental data) as well as limitations associated with implementing that knowledge in computer codes. However, *every effort was made to provide a complete description of.

the approach used to allow refinement of the probabilities as the state of*

knowledge develops.

G-1 SURGE LINE/HOT LEG FA~LURE ISSUE The surge line/hot leg failure issue relates the potential failure of ex-vessel piping and the RCS pressure response to failure of the reactor vessel lower head. Consistent with NUREG-1150, the issue can be stated as follows:

What is the probability 1 that the surge line or hot leg will fail and, depressurize the RCS to a low pressure before lower head failure?

As was done in NUREG-1150, a low pressure was taken to be 1.38 MPa in this evaluation. If the probability of the stated surge line/hot leg failure issue is high, the potential for high pressure melt ejection (HPME) and the associated potential for direct containment heating (DCH) is low. Conversely, if the probability of the stated issue is low, the RCS pressure at the time of lower head failure could result in a HPME. Under those conditions, the potential impact of OCH in the Surry NPP may require a detailed containment analysi~.

To facilitate quantification, the stated surge line/hot leg failure issue was decomposed into four separate probabilities. Those probabilities, which are also conditional on the occurrence of the specific TMLB' scenario in the Surry NPP, are Pl: The probability of surge line failure as a function of time P2: The orobability of hot leg failure as a function of time NUREG/CR-5949 G-4

Appendix G

• Surge line failure times were then calculated using the simple one-volume model with a fixed pressure (15.96 Mpa) and the altered vapor temperature histories as boundary conditions. Heat transfer coefficients previously established to match TMLB' Base Case and TMLB' Case 2 predicted failures were used, as appropriate. Since higher temperatures accelerate failure by creep rupture, surge :line failures earlier than those associated with the increased vapor temperatures were assumed to occur 5% of the time. Conversely, sin~e lower temperatures delay failure by creep rupture, surge line failures earlier than those associated with the decreased vapor temperatures were assumed to occur 95% of the time. Those results are summarized in Table G-1. Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in Table

, G-1. Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.05 ahd 0.95. The linear assumption was made for simplicity, since there was no apparent basis' for any other distribution shape. (Note that lower head failure times for the TMLB' cases were subtracted from the surge line failure times so that all results are expressed in terms of a common.reference.)

Results listed in Table G-1 are depicted in Figure G-2. A combined probability distribution for surge line failure is also shown. The combined distribution was determined by applying weighting fractions of 0.95 and 0.05 to results for the TMLB' Base Case arid TML6' Case 2, respectively.

Specifically, the distribution for the TMLB' Base Case was multiplied by 0.95, producing a peak probability of 0.95 at 234.2 minutes before lower head failure. The combined distribution then remained flat until the distribution

• for TMLB' Case 2 became non-zero at 49.1 minutes before lower head failure.

At that point, the distribution for TMLB' Case 2 was multiplied by 0.05; and the resulting contribution was added to reach a probability of 1.0 at 36.4 minutes before lower head failure. That method of combination was used in order to capture the range established by TMLB' Base Case and TMLB' Case 2 results.

The combined distribution shown in Figure G-2 indicates that surge line failures earlier than 255.5 minutes before lower head failure and surge line failures later than 36.4 minutes before lower head failure are not expected for TMLB' sequences without RCP seal leaks in the Surry NPP. In addition, surge line fa,lures earlier than 234.2 minutes before lower head failure are expected 95% of the time.

G-1.1.2 P2--Probability of Hot Leg Failure as a Function of Time. Hot leg creep rupture calculations with SCDAP/RELAP5/MOD3 are subject to the same uncertainties as described for the surge line creep rupture calculations (see Section G-1.1.1). Specifically, RCS pressures affecting the hot leg are we~l defined by PORV cycling, while potential uncertainties in the calculated hot leg temperatures could exist. Because of the similarities, the approach used to evaluate the probability of surge line failure as a function of time was used to evaluate the probability of hot leg failure. Specifically, it was assumed that the probability of hot leg failure could be inferred from the variation in failure times resulting from temperature uncertainties .

• G-11 NUREG/CR-5949

Appendix G Table G-1. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

TMLB' case Surge line,failure time (min)a Probability Base -255. 5b 0.00

-254.4 0.05

-235.3 0.95

-234.2b 1.00 2 -49.lb 0.00

-48.5 0.05

-37.0 0.95

-36. 4b; 1.00

a. Lower head failure times were subtracted from surge line failure times to produce the listed results in terms of a common reference. (Base Case and Case 2 lower head failures were calculated to occur 482.0 and 260.1 minutes after TMLB' initiation, respectively. Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b. Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95 .

1.0 .----~--.---,rl,t---,---,---"T----r--~---.---r---,c------.----..1---.---,

I 0.8 I

I

~ 0.6 I

c I

.c I 0

a. 0.4 I I

I 0.2 G- -> Base Case I

13- -£J Case 2 I

- - Combined distribution I 0.0

-300.0 -200.0 -100.0 0.0

• Time prior to calculated lower head failure (min)

Figure G-2. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

NUREG/CR-5949 G-12

Appendix G

• A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the hot leg subjected to potential temperature variations.

Compared to the simple one-volume model of the surge line, the one-volume hot leg model was refined to accommodate both carbon and stainless steel material properties. That refinement was based on the configuration of the hot leg nozzle and piping in the area of interest, depicted in Figure G-3.

As shown in Figure G-3, stainless steel hot leg piping is welded to a carbon steel hot leg nozzle in the Surry NPP. The nozzle itself is clad with stainless steel, which was assumed to be negligible from a creep rupture perspective. The most vulnerable areas for failure were assumed to be in the necked-down section of the carbon steel nozzle just upstream of the weld, in the areas immediately adjacent to the weld (which could be weakened as a result of the welding process}, and in the stainless hot leg just downstream of the weld. (It should be noted that the thickened portions of the nozzle were not modeled based on the assumption that those sections would not be as vulnerable to failure as the areas described.)

Field weld

• Nozzle Forgin~ ?\

..____,_ _(_A-508, Clas/

/

/

- Reactor Coolant Piping (316 S.S.)

~;::;:;::;::=========~"+~*=::::::=:=::::::.::::::::::::::::8:8:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::*;;.:

L-- s. S. Clad*

(11a" Thick)

Outlet

_L

~5in.

\ Safe-end Reactor Vessel Wall (A-508, Class 2 and A-533, Grade B, Class 1)

• Figure G-3.

Surry NPP.

Configuration of the hot leg nozzle and hot leg piping in the G-13 NUREG/CR-5949

• Appendix G

_ Carbon and stainless steel material properties were incor~orated into the simple one-volume model so that associ ated 1 creep rupture data for both materials could be used to represent the a~eas of concern. However, the areas immediately adjacent to the weld could not be addressed, since creep rupture data for materials adversely affected by welding are not available in SCDAP/RELAP5/MOD3. Furthermore, gathering such data for incorporation into the code was beyond the scope of this project. (It should be noted that stainless steel properties were used exclusively in the one-volume surge line model, since the stainless steel surge line is welded to stainless steel hot leg piping.)

The simple one-volume model had to be benchmarked before hot leg failures resulting from potential temperature variations could be calculated. Hot leg vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 results for the TMLB' Base Case and TMLB' Case 2 as a first step in benchmarking. A constant pressure of 15.96 Mpa (representing the midpoint between the opening and *closing pressures of the cycling PORVs) and the extracted vapor t~mperatures were used as .hot leg boundary conditions. Heat transfer coefficients from the vapor to the hot leg were then adjusted until hot leg failure times using the simple one-volume model matched failure times predict~d in the TMLB' cases. Stainless steel material properties were used in the benchmarking process, consistent with the modeling used in the .TMLB' cases. That approach effectively simulated the pressure and temperature conditions leading to the hot leg failures and provided reasonable heat transfei coefficients for use in subsequent calculations with the one-volume model.

The extracted temperature histories were then altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup in the TMLB' cases. The resulting hot leg vapor temperature histories for Case 2 are shown With respect to th~ nominal history in Figure G-4 as an example. As indicated, hot leg temperatures were varied by +/-20% relative to the temperature at the start of heatup (at about 150 min). (Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the hot

_ leg at those levels.) The resulting variations represent possible heatup rates if the hot leg vapor temperatures are either under- or overpredicted.

Based on the potential uncertainties affecting hot leg temperatures (including ox1dation and radiation, as discussed in Section G-1.1.1), it was assumed that hot leg vapor temperatures increased by 20% should not be exceeded more than about 5% of the time. It was also assumed that hot leg vapor temperatures decreased by 20% should be exceeded about 95% of the time.

Those assumptions were intended to represent the range of uncertainty associated with hot leg heating. It is not possible to more definitively

- establish the range of uncertainty within the scope of this project. However, the assumptions could be easily modified at some future date if warranted.

Hot leg failure times were then calcul~ted using the simple one-volume model with a fixed pressure (15.96 Mpa) and the altered vapor temperature histories as boundary conditions. Heat transfer coefficients previously NUREG/CR-5949 G-14

• Appendix G 2500.0 . - - - - ~ - - - . - - - - ~ - - ~ - - ~ - - ~ - - ~ - - ~

~ nom temp+ 20%

- - nomtemp

[3----£] nom temp - 20%

2000.0

-q~

~... 1500.0 Q) a.

E Q)

I-1000.0 500.0 100.0 150.0 200.0 250.0 300.0 Time (min)

Figure G-4. TMLB' Case 2*hot leg vapor temperature histories for estimation of hot leg failure probabili~ies .

• established to match TMLB' Base Case and TMLB' Case 2 predicted failures were used as appropriate.

In an attempt to estimate the possibility of an early hot leg failure, carbon steel properties were used in conjunction with vapor temperatures that_

had- been -increased by 20%. Since-higher temperatures accelerate-failure by

• creep rupture and since a given temperature will induce a carbon steel failure before a stainless steel failure, hot leg failures earlier than the corresponding failures were assumed to occur 5% of the time. Stainless steel properties were used in conjunction with vapor temperatures that had been decreased by 20% to estimate the possibility of a late hot leg failure. Since lower temperatures delay failure by creep rupture and since stainless steel will fail later than carbon steel at a given temperature, hot leg failures earlier than the corresponding failures were assumed to occur 95% of the time.

Those results are summarized in Table G-2.

• Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in Table G-2. Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.05 and 0.95. As previous~y discussed, the linear assumption was made for simplicity; since there was no apparent basis for any other distribution shape. (Note that lower head failure times for the TMLB' cases were subtracted from the hot leg failure times so that all results are expressed in terms of a common reference.)

Results listed in Table G-2 are depicted in Figure G-5. A combined probability distribution for hot leg fai~ure is also shown. The combined distribution was determined by applying weighting fraciions of 0.95 and 0.05 G-15 NUREG/CR-5949

Appendix G Table G-2. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

TMLB' case Hot leg failure time (min)a Probability Base -246.?b 0.00

-244.2 0.05

-199.2 0. 95,

-196. 7b 1.00 2 -43.3b 0.00

-41.7 0.05

-13.3 0.95

-11. 7b 1.00

a. Lower head failure times ~ere subtracted from hot leg failure times to produce the listed results in terms of a common reference. (Base Case and Case 2 lower head failures were calculated to occur 482.0 and 260.l minutes after TMLB' initiation, respectively. Note that a negative result indicates hot leg failure before the calculated time of lower head failure.)

b. Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95.

I I

0.8 I

I I

~ 0.6 I

~

.£l I e

a.. 0.4 I I

I 0.2 G- -E> Base Case I

C3- -£J Case 2 I

- - Combined distribution I 0.0

-300.0; -200.0 -100.0 0.0 Time prior to calculated lower head failure (min)

Figure G-5. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal, leaks in the Surry NPP.

NUREG/CR-5949 G-16

Appendix G

• to results for the TMLB' Base Case and TMLB' Case 2, respectively.

Specifically, the distribution for the TMLB' Base Case was multiplied by 0.95, producing a peak probability of 0.95 at 196.7 minutes before lower head failure. The* combined distribution then remained flat until the distribution for TMLB' Case 2 became non-zero at 43.3 minutes pefore lower head failure.

At that point, the distribution for TMLB' Case 2 was multiplied by 0.05; and the resulting contribution was added to reach a probability of 1.0 at 11.7 minutes before lower head failure. That method of combination was used in order to capture the range established by TMLB' Base Case and TMLB' Case 2 results.

The combined distributiqn shown in Figure G-5 indicates that hot leg failures earlier than 246.7 minutes before lower head failure and hot leg failures later than 11.7 minutes before lower head failure are not expected for TMLB' sequences without RCP seal leaks in the Surry NPP. In addition, hot leg failures earlier than 196.7 minutes before lower head failure are expected 95% of the time.

G-1.1.3 P3--Probability that the RCS Pressure is Low as a Function of Time. The probability of reaching low pressure (< 1.38 MPa) in the RCS is controlled by a surge line break for TMLB' sequences without RCP seal leaks, since the probability for surge line failure is higher than the probability of hot leg failure as a function of time (see combined probability distributions shown in Figures G-2 and G-5) .

• Although the break size that could result from a surge line creep rupture is unknown, results from a previous calculation indicate that a break equal to 32% of the surge line flow area should depressurize the Surry NPP from full system pressure to 1.38 MPa in about 5 minutes.G* 4 Furthermore, a break as small as 5% of the surge line was estimated to be sufficient to achieve the specified pressure reduction before lower head failure in either the TMLB'-

Base Case or TMLB' Case 2. On that basis, break size does not appear to be critical in establishing this probability di~tribution if it is assumed that a break of at least 5% would result if creep rupture of the surge line occurred.

(A 5% break is sufficient to depressurize, and larger breaks would only provide additional margin between reaching the specified pressure and lower head failure.) Therefore, a depressurization time of 10 minutes was assumed to allDw for uncertainties in the depressurization rate without the need to directly determine and use a potential break size.

The resulting probability di*stribution for reaching a low RCS pressure is given in Tabl~ G-3 and depicted in Figure G-6. The distribution was calculated by shifting the combined distribution in Figure G-2 by 10 minutes.

Based on Table G-3 data and the distribution shown in Figure G-6, depressurization to 1.38 MPa earlier than 245.5 minutes before lower head failure and depressurization to 1.38 MPa later than 26.4 minutes before lower head failure would not be expected if TMLB' sequences without RCP seal leaks occur in the Surry NPP. In addition, the RCS should be depressurized 224.2 minutes before lower head failure about 95% of the time .

• G-17 NUREG/CR-5949

Appendix G Table G-3. Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

• Time to reach a low RCS pressure (min)a Probability

-245.5 0.00

-224.2 0.95

-39.1 0.95

-26.4 1.00

a. Results are listed with respect to a common reference of zero at the calculated lower head failure time. Note that a negative result indicates RCS depressurization before the calculated time of lower head failure.

0.8 *

~ 0.6

g

.c e

a. 0.4 0.2

-200.0 -100.0 0.0 Time prjor to calculated lower head failure (min)

Figure G-6. Probability distribution for reaching a low RCS pressure as a 1

function of time given the occurrence of TMLB' sequences without RCP s~al 1eaks in_ the Surry NPP.

NUREG/CR-5949 G-18

Appendix G.

• G-1.1.4 P4--Probability of Lower Head Failure as a Function of Time.

The SCDAP/RELAP5/MOD3 ca 1cul at ion of 1ower head creep rupture is primarily affected by (a) debris/coolant heat transfer during molten relocation to the lower head, (b) melt/lower head contact resistance, (c) uncertainties in the creep rupture analysis for large radii, and (d) in-core crust heat transfer.

Items (a) ~nd (b) are controlled by user input. Both inputs were selected to accelerate lower head failure in the TMLB' Base Case and TMLB' Case 2. (As discussed in the body of this report, other core damage progression inputs of lesser impact were also modeled to accelerate lower head failure.) Items (c) and (d) are controlled by models implemented in SCDAP/RELAP5/MOD3, as discussed below.

Code creep rupture caltulations are based on one-dimensional temperature profiles through a specified wall. The calculations are reasonably accurate for moderately sized pipes (i.e., the surge line and hot legs). However, accuracy decreases as the radii associated with the wall increases, since the one-dimensional nature of the model does not allow for transmittal of temperature/pressure-induced stresses along the wall. Scoping calculations based on detailed two-dimensional structural analyses of lower head geometries indicate that the SCDAP/RELAP5/MOD3 prediction of lower head creep rupture will be early.

• Crusts supporting in-core molten pools are primarily cooled by radiation to the surrounding vapor.* (Radiation to intact fuel rods is calculated if the crust forms above the. bottom of the core.) However, radiation from an in~core crust to heat structuies representing the reactor vessel internals is not calculated. Since some of those internals (particularly the lower core.

support plate and other structures in t~e lower p1enum) could be relatively cool, crust temperatures may be too high~ promoting ~arly crust failure, relocation, arid l~wer head failure.

Based on the foregoing, it should be clear that all of the primary effects treated by the code tended to accelerate relocation and lower head failure in the TMLB' Base Case and TMLB' Case 2. From that perspective~ lower head failures earlier than those predicted by the code should have lbw probabilities. However, relocation (in the current version of the code) cannot occur without failure of the crust supporting the *in-core molten p*ool.

There are three other potential relocation mechanisms that could lead to earlier relocations (and lower head failures), in~lOding: (a) the plunger effect, (b) radial spreading of molten materials to the core former plates, and (c) melt formation in the region adjacent to the core former plates.

Attempting to determine the earliest potential for relocation and lower head failure, either through crust failure or any alternate mechanism; provides a way to begin probability quantification, as discussed below.

A relatively stable crucible of solidified materials could retain an in-

. core molten pool. If materials suddenly slump into the pool from above, some of the molten materials could spill over the top of the crucible and relocate to the lower head as a result of a plunger action. After a review of TMLB' Base Case and TMLB' Case 2 results, it was concluded that relocation due to the plunger effect would not be expected before the code calculated crust failure. Material slumping into the molten pool could occur in both cases.

G-19 NUREG/CR-5949

Appendix G However, any slumping into the pool would be expected to occur gradually, consistent with the nature of the heatup in the two cases. Gradual slumping could result in small spills, which would tend to solidify before reaching the lower head. In other words, relocation and lower head failure as a result of the plunger effect would not be expected before the code calculated lower head failure if TMLB' sequences without RCP seal leaks occurred in the Surry NPP.

Some amount of radial spreading could occur as core materials begin to melt. If the molten region spreads to a point of contact with the core former plates, the former plates could also melt, resulting in relocation through the core bypass region with a potential for a subsequent lower head failure. The time required to melt the former plates was conservatively neglected in evaluation of this potential. It was also assumed that any relocation that resulted from radial spreading would be larg~ enough to cause a lower head failure. In other words, the probability of lower head failure given a core bypass relocation was conservatively assumed to be 1.0. Based on the first appearance of molten materials and a spreading rate typical of TMI-2 (estimated to be 0.06 mm/setond by the SCDAP development staff), a potential lower head failure as a result of radial spreading could have occurred 148.2 minutes earlier than the code prediction in the TMLB' Base Case and 6.8 minutes after the code prediction in TMLB' Case 2.

Melting of fuel rods on the core periphery could develop under conditions of uniform core heating. Like the process of radial spreading, melting on the core periphery could result in a core bypass relocation with a potential for a subsequent lower head failure. Outer channel core melting did not occur before the calculated crust failure, relocation, and lower head failure in TMLB' Case 2. However, there was some relatively early outer channel melting in the TMLB' Base Case. Conservatively neglecting the time required to melt the core former plates and assuming that the core bypass relocation was large enough to cause a lower head failure, lower head failure could have occurred 175.5 minutes before the time calculated by the code in the Base Case.

From the foregoing, it should be clear that the lower head could have failed 175.5 minutes before the code calculated time in the TMLB' Base Case, while the code calculation was the earliest lower head failure time for TMLB' Case 2. It was assumed that failures earlier than either of those failures would not be expected more than 1% of the time. That assumption was based on the conservative nature of the code calculations (which tend to produce early

.lower head failures) and the fact that alternate mechanisms were also considered to incorporate the potential for even earlier lower head failures.

Probability quantification can be completed using results from TMLB' Cases 3 and 5. Specifically, those results indicate that debris/coolant heat transfer, which amounts to debris quenching limited only by the availability of water in the lower head, can extend lower head survival by 73.9 minutes.

Assuming that debris quenching is not strongly dependent on RCS pressure and assuming that debris/coolant heat transfer accounts for about half of the conservatism in the code calculations of lower head failure as previously discussed, lower head failure could be as late as (2 x 73.9 minutes, or) 147.8

• minutes after the code-calculated times. therefore, it was assumed that lower NUREG/CR-5949 G-20

Appendix G

• head failures earlier than the code calculation plus 147.8 minutes would occur about 99% of the time in the TMLB' Base Case and TMLB' Case 2.

Results of the quantification for the probability of lower head failure are summarized in Table G-4. Failure times at the endpoint probabilities of 0.0 and 1.0 are also included. Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.01 and 0.99.

As previously discussed, the linear assumpti~n was made for simplicity, since there was no apparent basis for any other distribution shape. (Note that results are listed with respect to a common reference of zero at the calculated lower head failure time.)

Results listed in Table G-4 are depicted in Figure G-7. A combined probability distribution for lower head failure is also shown. The combined distribution was determined by applying weighting fractions of 0.95 and 0.05 to results for the TMLB' Base Case and TMLB' Case 2, respectively.

• Specifically, the distribution for the TMLB' Base Case was multiplied by 0.95 over the domairn from -178.8 to 151.1 minutes; and the distribution for TMLB' Case 2 was multiplied by 0.05 over the domain from -1.5 to 149.3 minutes. The weighted distributions were then summed in order to capture the range established by TMLB' Base Case and TMLB' Case 2 results. The weighting fractions were selected to reflect the assumption that the TMLB' Base Case conditions (i.e., hot leg countercurrent natural circulation) are most likely based on Westinghouse natural circulation experiments .

• The combined distribution shown in Figure G-7 indicates that lower head failures earlier than 178.8 minutes before the calculated failure time and lower head failures later than 151.1 minutes after the calculated failure time would not be expected if TMLB' sequences without RCP seal leaks occur in the Surry NPP.

G-1.1.5 Recombination of Probabilities Pl through P4. The combined distribution shown in Figure G-6 represents the probability of having a surge line failure that will depressurize the RCS to a low pressure given the

• occurrence of TMLB' sequences without RCP sea1 leaks in the Surry NPP. The probability of a lower head failure is represented by the combined distribution shown in Figure G-7. Those distributions overlap, as shown in Figure G-8. Therefore, derivatives of the distributions with respect to time were calculated to give the corresponding PDFs shown in Figure G-9. Equation (G-1) was applied to the PDFs, as explained in Section G-1. Specifically, the integration limits in Equation (G-1) were reset consistent with non-zero values of PLP. 1 and PLH. 2 and evaluated to give p =

-26.4J 151.1

= 0

• 98 (G-11)

J-245.5 t, pLP.1 pLH.2dt 2dt 1 where G-21 NUREG/CR-5949

Appendix G Table G-4. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

TMLB' case Lower head failure time (min)a Probability Base -178.8b 0.00

-175.5 0.01 147.8 0.99 151.lb 1.00 2 -1. 5b 0.00 0.0 0.01 147.8 0.99 149.3b 1.00

a. Results are listed with respect to a common reference of zero at the calculated lower head failure time. (Base Case and Case 2 lower head failures were calculated to occur 482.0 and 260.1 minutes after TMLB' initiation, respectively. Note that a negative result indicates lower head failure before the calculated failure time.)

b. Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution .between probabilities of 0.01 and 0.99.

1.0 .----r----.------,-----,-----,-----,----,lldj-----,

G- -El Base Case I G- -£J Case 2 I 0.8 - - Combined distribution I

I I

~ 0.6 I

c I ctl

.0 I 0

~

D... 0.4 I

I I

I 0.2 I I

I 0.0 '---.ep..~.1.--~~.........~~_.__~___,l!!I'--~~.....__~~-'--~~-'--~~--'

-200.0 -100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-7. Lower head failure probabilities as a function of time given the occurrence of'TMLB' sequences without RCP seal leaks in the Surry NPP.

NUREG/CR-5949 G-22

Appendix G

• 1.0 ~ - ~ - - - - - - - - - - - - - - - - - - - / - - -

0.8

- - RCS depressu rization

- - Lower head failure

/

/

/

/

/

/

/

-~ 0.6 /

~

.c /

/

e /,

a.. 0.4 /

/

/

/

0.2 /

/

/

/

0.0 .___........_ _.__L..-.......__ __._ _....___ ___.__ __.___ ___.__ _J....__...J

-300.0 -200.0 -100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-8. Probability qf the surge line/hot leg failure issue given the

• occurrence of TMLB' sequences without RCP sea1 leaks in the Surry NPP.

0.050 - - - - - - - - - - - - - - - - - - - - - - - -

- - RCS depressurization

- - Lower head failure 0.040

• en

~ 0.030

'C

~

j....

0 0.020 a..

0.010

-245.5 -26.4

-f78.8 - - - - 151.1 0.000 ....__ __....__...__......._.......___.__ _.___....r....,,_.____.__ _..__._ __.___ _.,.c_ ___.

-300.0 -200.0 -100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-9. Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

G-23 NUREG/CR-5949

Appendix G P *

~~,

I

=

= the probability of the surge line/hot leg failure issue given the occurrence of'TMLB' sequences without RCP seal leaks in the Surry NPP the PDF representing the probability of depressurizing the RCS following a surge line failure given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP integrated with respect to time t, P~. 2 the PDF representing the probability of lower head failure given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP integrated with respect to time t 2

• Therefore, the 'probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences witrout RCP seal leaks in the Surry NPP is 0.98.

G-1.2 Issue Probability for TMLB' Sequences with RCP Seal Leaks This section contains the probability quantification for the surge line/hot leg failure issue given the occurren~e of TMLB' sequences with RCP seal leaks in the Surry NPP. As discussed in Section G-1, 1 the surge line/hot leg failure issue was decomposed into four separate probabilities denoted Pl through P4. Sections G-1.2.l through G-1.2.4 contain evaluations of the separate probabilities Pl through P4, which are also conditional on the

• occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP. The surge line/hot leg failure issue probability for this scenario was then' obtained through recombination of the separate probabilities. That recombination is outlined in Section G-1.2.5.

Quantification was primarily based o~ SCDAP/RELAP5/MOD3 results for TMLB' Cases 3 through 6, as described in the body of this report. Weighting factors applicable to the results from each case were needed to complete the quantification. The basis for selection of those weighting factors is explained below.

Seal leak rate probabilities were established for Westinghouse RCPs by a panel of expertsG* 5 for use in NUREG-1150. The leak rate probabilities covered RCPs with the new a-ring seal materials as well as the RCPs with the old materials, as is the case for the Surry NPP. Discrete seal leaks ranging from 21 to 480 gpm per RCP were considered. For the old a-ring materials, the highest probabilities were assigned to a leak rate of 250 gpm per RCP, moderate probabilities were assigned to a leak rate of 21 gpm per RCP, and very low probabilities were assigned to the potential for leaking 480 gpm per RCP.

Two simplifying assumptions were made regarding the NUREG-1150 probabilities, since the subject calculations were only performed at leak ,

rates of 250 and 480 gpm per RCP. First, it was assumed that a leak rate of 21 gpm per RCP is small enough to be eliminated from consideration in this scenario. A combined leak rate of 63 gpm (21 gpm per RCP) represents less than 1% of the capacity of the Surry PORVs. It is believed that such a leak NUREG/CR-5949

. G-24

Appendix G

• would be too small to reduce RCS pressure below the PORV setpoint before lower head failure. As a result, the RCS would remain at high pressure controlled by PORV cycling. (However, the PORV cycles would be somewhat shorter than those calculated in the TMLB' cases without RCP seal leakage.) The probability quantification given in Section G-1.1 should cover those conditions. And second, it was assumed that seal leak rates of 250 and 480 gpm per RCP should be quantified separately. That assumption was based ori the large differences between the leak rate probabilities according to NUREG-1150 and the knowledge that the ex-vessel response is also significantly different.

Since the probability of the surge line/hot leg failure issue was quantified separately for seal leaks of 250 and 480 gpm per RCP, weighting factors were also developed separately, as outlined below.

I A seal leak rate of 250 gpm per RCP was assumed in TMLB' Cases 3 and 5.

The only difference between those cases was i~ debris/coolant heat transfer during molten relocation to the lower head. Debris/coolant heat transfer was not modeled in Case 3, while complete quenching (limited only by the availability of water in the lower head) was modeled in Case 5. As such, the cases represent upper and lower bounds on initial debris temperatures driving lower head thermal attack. It was assumed that results from Cases 3 and 5 should be given equal weight, since the actual debris temperature will fall between those bounds. Therefore, probability quantification of the surge line/hot leg failure issue for a seal leak of 250 gpm per RCP was developed based on an equal weighting of the probabilities Pl through P4 as derived from Case 3 and Case 5 results .

A seal leak rate of 480 gpm per RCP was assumed in TMLB' Cases 4 and 6.

The only difference between those cases was in the user inputs defining the extent of ballooning (deformation) allowed in the fuel cladding. In Case 4, deformation was limited to 2%, while rupture deformations up to 15% were used in Case 6~ Those values were selected to cover the expected range based on experimental data. On that basis, it was assumed that results from Cases 4 and 6 should be given equal weight. Therefore, probability quantification of the surge line/hot leg failure issue for a seal leak of 480 gpm per RCP was developed based on an equal weighting of the probabilities Pl through P4 as derived from Case 4 and Case 6 results.

G-1.2.1 Pl--Probability of Surge Line Failure as a Function of Time.

Surge line creep rupture calculations for TMLB' Cases 3 through 6 are subject to potential pressure uncertainties in addition to the temperature uncertainties previously described (see Section G-1.1.1). It was assumed that the probability of surge line failure could be inferred from the variations in failure times resulting from both temperature and pressure uncertainties. The potential pressure uncertainties are primarily associated with vaporization during core degradation. Water addition through accumulator injection and debris/coolant heat transfer during molten relocation are the fundamental contributors to vapor production.

Accumulator water is injected into each cold leg of the Surry NPP whenever the RCS pressure drops below the accumulator pressure. Vaporization begins as injected water flows from the downcomer and into the core. The pressure increases as a result of the vaporization until the RCS pressure G-25 NUREG/CR-5949

Appendix G exceeds the accumulator pressure and accumulator injection stops. The excess vapor must then be discharged through RCP seal leaks to reduce RCS pressure before accumulator injection can be repeat~d. RCS pressurization could be either high or 1low, depending on the SCDAP/RELAP5/MOD3 prediction of heat transfer between the accumulator water and the reactor core. Based on the maturity of the thermal-hydraulics portion of the code, the uncertainty in heat transfer for an intact core should be relatively low. However, some uncertainty in the calculations could develop as flow paths and heat transfer surface areas are altered as a result of ballooning, oxidation, and general core degradation.

SCDAP/RELAP5/MOD3 provides an on/off option with rc~pect to debris/coolant heat transfer during molten relocation to the lower head. With the option turned on, vaporization is allowed to proceed until all relocating molten debris is quenched or until the water in the lower reactor vessel head is depleted. The amount of molten material relocated and the water inventory in the lower head could be either high or low. On that basis, the RCS pressure resulting from the associated vapor production could also be either high or low.

The approach previously used to bound' potential temperature uncertainties for TMLB' sequences without RCP seal leaks was used to address potential temperature and pressure uncertainties in this scenario. Specifically, a simple one-volume SCDAP/RELAPS/MOD3 model was developed to calculate the response of the stainless steel surge line subjected to potential temperature and pressure variations. The simple one-volume model had to be benchmarked before those calculations could be made. Surge line vapor temperature and pressure histories were extracted from the SCDAP/RELAPS/MOD3 results for TMLB' Cases 3 through 6 as a first step in benchmarking. The extracted vapor temperatures and pressures were used as surge line boundary conditions. Heat transfer coefficients from the vapor to the surge line were then adjusted until surge line response using the simple one-volume model matched the response predicted in the TMLB' cases. That approach effectively simulated the surge line temperature and pressure conditions and provided reasonable heat transfer coefficients for use in subsequent calculations with the one-volume model.

The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties. The extracted temperature histories were altered by +/-20% with respect to the calculated vapor ,

temperatures at the beginning of RCS heatup in the TMLB' cases (consistent with the approach described in Section G-1.1.lJ. The resulting surge line vapor temperature histories for Case 3 are shown with respect to the nominal history in Figure G-10 as an example. As indicated, surge line temperatures were varied by +/-20% relative to the temperature at the start of heatup (at about 150 minutes). (Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the surge line at those levels.) Potential pressure uncertainties were addressed by varying accumulator injection and debris quenching pressure peaks by +/-20%. Minimum pressures in the extracted histories were not altered, since they are based on accumulator pressures that are predicted with relatively little uncertainty. The resulting surge line NUREG/CR-5949 G-26

Appendix G

• 2500.0 ,---------,------.-----.------,-----,.---~--~-~

2000.0 fs:-----f:,.

- - nomtemp nom temp + 20%

G---£J nom tern - 20%

-sz Q)

~....

Q) 1500.0 a.

E

~

1000.0 500.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-10. TMLB' Case 3 surge line vapor temperature histories for estimation of surge line failure probabilities .

pressure histories for Case 3 are shown with respect to the nominal history in Figure G-11 as an example. The variations shown in Figures G-10 and G-11 represent possible conditions that could occur if the surge line temperatures/pressures are either under- or overpredicted.

It was assumed that the combined conditions represented by surge line temperatures and pressures that were increased by 20% should not be exceeded more than about 5% of the time. It was also assumed that the combined conditions represented by surge line temperatures and pressures that Jere decreased by ~0% should be exceeded about 95% of the time. Those assumptions were based on the potential uncertainties affecting surge line temperatures (including oxidation and radiation as discussed in Section G-1.1.1) and the potential uncertainties affecting surge line pressures (including the effects of accumulator injection pnd debris/coolant heat transfer as previously discussed). The assumptions were intended to represent the range of uncertainty associated with surge line temperatures and pressures. It is not possible to more definitively establish the range of uncertainty within the scope of this project. However, the assumptions could be easily modified at some future date if warranted.

Surge line failure times were then calculated using the simple one-volume model with the altered vapor temperature and pressure histories as boundary conditions. Heat transfer coefficients previously established to match the surge line response in TMLB' Cases 3 through 6 were used as appropriate.

Since higher temperatures and pressures accelerate failure by creep rupture, G-27 NUREG/CR-5949 I

Appendix G 18.0 15.0

~ nom press+ 20%

- - nom press G---1 nom ress - 20% ~

cu 12.0 -

a..

E

~

9.0 -

~

~

a.. 6.0 -

3.0 -

0.0 ......_~_.__~....._~.......__~_._~.........~---'-~--'-~~~~'--~....._~.........__~

100.0 150.0 200.0 250.0 300.0 350.0 400.0 Time (min}

Figure G-11. TMLB' Case 3 surge line pressure histories for estimation of surge line failure probabilities.

surge line failures earlier than the failures associated with the combined conditions of increased temperature and pressure were assumed to occur 5% of the time. Conversely, since lower temperatures and pressures delay failure by creep rupture, surge line failures earlier than the failures associated with the combined 'conditions of decreased temperature and pressure were assumed to occur 95% of the time. Those results are summarized in Table G-5.

As indicated in Table G-5, creep rupture failures of the surge line were not calculated (for the temperature/pressure variations that were considered}

before molten relocation and lower head failure in Cases 4 and 6. Therefore, the probability of surge line failure in those cases was taken to be 0.0.

With respect to Cases 3 ,and 5, however, a 20% increase in surge line temperature/pressure histories was sufficient to induce creep rupture failures. As indicated in Table G-5, the corresponding failure times were assigned a probability of 0.05 consistent with the previously discussed assumptions. Unfortunately, creep rupture failures were not calculated for a 20% decrease in the temperature/pressure histories. Obviously, a probability distribution cannot be established on the basis of a single point (at a probability of 0.05). However, nominal temperature/pressure histories for Cases 3 and 5 did result in calculated failures (at adjusted times of -68.6 minutes and -142.5 minutes, respectively). Probabilities were established for the nominal failure times (to allow generation of probability distributions)

• as described below.

NUREG/CR-5949 G-28

Appendix G

• Table G-5. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP.

TMLB' case Surge line failure time (min)a Probability 3 -104.8 0.05 4

5 -178.7 0.05 6

a. Lower head failure times were subtracted from surge line failure times to produce the listed results in terms of a common reference. (Lower head failures were calculated to occur 405.7, 432.9, 479.6, and 389.8 minutes after TMLB' initiation in TMLB' Cases 3 through 6, respectively. Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b. NC means that creep rupture failure was not calculated before molten

• relocation and lower head failure.

Nominal temperature histories. (with a fixed pressure of 15.96 MPa) resulted in surge line failures at adjusted times of -244.5 and -44.6 minutes in the TMLB' Base Case and TMLB' Case 2, respectively. Based on TMLB' Base Case and TMLB' Case 2 surge line failure distributions given in Table G-1, those failure times correspond to probabilities of 0.52 and 0.34, respectively. Given the TMLB' Base Case weighting fraction of 0.95 and the TMLB' Case 2 weighting fraction of 0.05, surge line failures based on nominal temperature/pressure histories have a probability of approximately 0.5 (0.95*0.52 + 0.05*0.34) given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP. Therefore, surge line failure times associated with nominal temperature/pressure conditions in TMLB' Cases 3 and 5 were assumed to have probabilities of 0.5.

TMLB' Case 3 and 5 failure times at endpoint probabilities of 0.0 were extrapolated by assuming a linear distribution of failure times between the probabilities of 0.05 and 0.5. The linear assumption was made for simplicity, since there was no apparent basis for any other distribution shape. Failure times for probabilities greater than 0.5 were not determined. However, it is known that surge line failure probabilities do not reach unity before lower head failure. Therefore, the linear probability distributions for Cases 3 and 5 were assumed to be capped at a maximum probability of 0.5. The corresponding results are summarized in Table G-6. (Note that lower head failure times for the TMLB' cases were subtracted from the surge line failure times so that all results are expressed in ierms of a common reference.)

G-29 NUREG/CR-5949

Appendix G Table G-6. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

TMLB' case Surge line failure time (min)a Probability 3 -108.Bb 0.00

-104.8 0.05

-68.6c 0.50 5 -182.7b 0.00

-178.7 0.05

-142.5c 0.50

a. Lower head failure times were subtracted from surge line failure times to produce the listed results in terms of a common reference. (Lower head

• failures were calculated to occur 405.7 and 479.6 minutes after TMLB' initiation in TMLB' Cases 3 and 5, respectively. Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b. Failure times at the endpoint probability of 0.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.50.

c. Failure times at a probability of 0.50 were estimated based on surge line failure times at nominal pressure/temperature conditions and surge line results associated with TMLB', sequences without RCP seal leaks in the Surry NPP.

Although it was not investigated, it is believed that the probability cap of 0.5 could be higher. Surge line failures in TMLB' Cases 3 and 5 are predicted for nominal temperature/pressure conditions, while failures are not predicted if nominal temperature/pressure conditions are decreased by 20%.

Therefore, there must be a point between nominal temperature/pressure conditions and the decreased temperature/pressure conditions where surge line failures would still occur. For example, surge line failures in TMLB' Cases 3 and 5 could reasonably be expected if nominal temperatures/pressures were only decreased by 1%. Based on the assumptions given to establish the probability cap at 0.5 and the assumption of a linear probability distribution, failures at nominal temperatures/pressures decreased py 1% should be given a probability somewhat greater than 0.5. Therefore, without further investigation, one can conclude that the probability cap of 0.5 is conservative from an HPME standpoint. Investigation to remove conservatism is not justified, since (a) hot leg failures occur before surge line failures in this scenario and (b) the issue decomposition requires failure in only one of the two ex-vessel components in order to mitigate the potential consequences of a HPME.

NUREG/CR-594: G-30

Appendix G

• Results listed in Table G-6 are depicted in Figure G-12. The combined probability distribution (as shown) was determined by applying equal weight to the results in Table G-6. Specifically, the distribution for TMLB' Case 3 was multiplied by 0.5 over the domain from -108.8 to -68.6 minutes; and the distribution for TMLB' Case 5 was multiplied by 0.5 over the domain from

-182.7 to -142.5 minutes. The weighted distributions were then summed in order to capture the range established by the separate results. Based on the table data and the combined distribution, surge line failures earlier than 182.7 minutes before lower head failure are not expected for TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP. In addition, a maximum probability for surge line failure of 0.5 is expected 68.6 minutes before lower head failure.

G-1.2.2 P2--Probability of Hot Leg Failure as a Function of Time. Hot leg creep rupture calculations in TMLB' Cases 3 through 6 are subject ,to the same temperature and pressure uncertainties previously described for the surge line creep rupture calculations (see Section G-1.2.1). Because of the similarities, the approach used to evaluate the probability of surge line failure as function of time was used to evaluate the probability of hot leg failure. Specifically, it was assumed that the probability of hot leg failure could be inferred from the variations in failure times resulting from temperature and pressure uncertainties .

• 1.00 ~ - - - ~ - - - ~ - - - ~ - - - ~ - - - ~ - - - ~

0.80 G--> Case 3 C3- -J Case 5

- - Combined distribution

-~ 0.60

~

.0 fl e

a.. 0.40

/ /

/ /

/ /

/ ,/

/ /

0.20 /

/

/ I ri cl 0.00

-200.0 -150.0 -100.0 -50.0 Time prior to calculated lower head failure (min)

Figure G-12~ Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

G-31 NUREG/CR-5949

Appendix G A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate

• the response of the hot leg subjected to potential temperature and pressure variations. As discussed in Section G-1.1.2, carbon and stainless steel material properties were incorporated into the model so that the areas most vulnerable to creep rupture could be analyzed. The simple one-volume model had to be benchmarked before hot leg failures resulting from potential temperature/pressure variations could be calculated. Hot leg vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 results for TMLB' Cases 3 through 6 as a first step in benchmarking. The extracted vapor temperatures and pressures were used as hot leg boundary conditions. Heat transfer coefficients from the vapor to the hot leg were then adjusted until the hot leg response using the simple one-volume model matched the response predicted in the TMLB' cases. Stainless steel material properties were used in the benchmarking process, consistent with the modeling used in the TMLB' cases. This approach effectively simulated the hot leg pressure and temperature conditions and provided reasonable heat transfer coefficients for use in subsequent calculations with the one-volume model.

The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties. The extracted temperature histories were altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup in the TMLB' cases consistent with the approach described in Section G-1.1.2. The resulting hot leg vapor temperature histories for Case 4 are shown with respect to the nominal history in Figure G-13 as an example. As indicated, hot leg temperatures were varied

• by +/-20% relative to the temperature at the start of heatup (at about 140 minutes). (Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the hot leg at those levels.) Potential pressure uncertainties were addres~ed by varying accumulator injection and debris quenching pressure peaks by +/-20% consistent with the approach described in Section G-1.2.1. Minimum pressures in the extracted histories were not altered, since they are based on accumulator: pressures that are predicted with relatively little uncertainty. The resulting hot leg pressure histories for Case 4 are shown with respect to the nominal history in Figure G-14 as an example. The variations shown in Figures G-13 and G-14 represent possible conditions that could occur if the hot leg temperatures/pressures are either under- or overpredicted.

It was assumed that the combined conditions represented by hot leg temperatures and pressures that were increased by 20% should not be exceeded more than about 5% of the time. It was also assumed that the combined conditions rep~esented by hot leg temperatures and pressures that were decreased by 20% should be exceeded about 95% of the time. Those assumptions were based on the potential uncertainties affecting hot leg temperatures (including oxidation and radiation as discussed in Section G-1.1.1) and the potential uncertainties affecting hot leg pressures (including the effects of accumulator injection and debris/coolant heat transfer as discussed in Section G-1.2.1). The assumptions were intended to represent the range of uncertainty associated with hot leg temperatures and pressures. It is not possible to

• more definitively establish the range of uncertainty within the scope of this NUREG/CR-5949 G-32

Appendix G

• 2500.0 . - - - - - . - - - - - . - - - - ~ - - - - , . - - ~ - - ~ - - ~ - - -

2000.0 e-----l nom temp

- - nomtemp

+ 20%

t3------EJ nom tern - 20%

S2' 1500.0 1000.0 500.0 ._____....___ _....___ __,_ _____._ ___.__ __..__ ___.__ ___.

100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-13. TMLB' Case 4 hot leg vapor temperature histories for estimation

• of hot leg failure probabilities.

18.0 ---~---.----~--~---r-----.----r-----,

G---E> nom press + 20%

- - nom press 15.0 13--£1 nom ress - 20%

-cu 12.0 a..

E

....Q::::,)

Cl) 9.0 Cl)

....Q) a.. 6.0 3.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

• Figure G-14. TMLB' Case 4 hot leg pressure histories for estimation of hot leg failure probabilities.

G-33 NUREG/CR-5949

Appendix G project. However, the asiumptions could be easily modified at some future date if warranted.

Hot leg failure times were then calculated using the simple one-volume model with the altered vapor temperature and pressure histories as boundary conditions. Heat transfer coefficients previously *established to match the hot leg response in TMLB' Cas'es 3 through 6 were used as appropriate.

In an attempt to estimate the possibility of an early hot leg failure, cafbon steel properties were used in conjunction with vapor temperatures and pressures that had been increased by 20%. Since higher temperatures and pressures accelerate failure by creep rupture and since a given temperature and pressure will induce a carbon steel failure before a stainless steel failure, hot leg failures earlier than the failures corresponding to carbon steel subjected to the combined conditions of increased temperature and pressure were assumed to occur 5% of the time. Stainless steel properties were used in conjunction with vapor temperatures and pressures that had been decreased by 20% to estimate the possibility of a late hot leg failure. Since lower temperatures and pressures delay failure by creep rupture and since stainless steel will fail later than carbon steel at a given temperature and pressure, hot leg failures earlier than the ~orresponding failures were assumed to occur 95% of the time. Those results are summarized in Table G-7.

As indicated, creep rupture failures of the hot leg were not calculated (for the temperature/pressure variations that were considered) before molten relocation and lower head failure in Cases 4 and 6. Therefore, the probability of hot leg failure in those cases was taken to be 0.0. With respect to Cases 3 and 5, however, failure times were calculated for probabilities of 0.05 and 0.95 as indicated. In addition, failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution of failure tim~s between probabilities of 0.05 and 0.95. As previously discussed, the linear assumption was made for simplicity, since there was no apparent basis for any other distribution shape. (Note that lower head failure times for the TMLB' cases were subtracted from the hot leg failure times so that all results are expressed in terms of a common reference.)

Results listed in Table G-7 are depicted in Figure G-15. The combined probability distribution (as shown) was determined by applying equal weight to the results in Table G-7. Specifically, the distribution for TMLB' Case 3 was multiplied by 0.5 over the domain from -110.8 to 24.3 minutes; and the distribution fo~ TMLB' Case 5 was multiplied by 0.5 over the domain from

-184.7 to -49.7 minutes. The weighted distributions were then summed in order to capture the range established by the separate results. The combined distribution indicates that hot leg failures earlier than 184.7 minutes before lower head failure and hot leg failures later than 24.3 minutes after lower head failure are not expected for TMLB' sequences with 250 gpm RCP seal le~ks

• in the Surry NPP.

NUREG/CR-5949 G-34

Appendix G

• Table G-7. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences* with RCP seal leaks in the Surry NPP.

TMLB' case Hot leg failure time (min)a Probability 3 -110.8 0.00

-104.0 0.05 17.5 0.95 24.3b 1.00 4 NCC 5 -184. 7b 0.00

-177.9 0.05

-56.4 0.95

-49.7b 1.00 6

a. Lower head failure times were subtracted from hot leg failure times to produce the listed results in terms of a common reference. (Lower head failures were calculated to occur 405.7, 432.9, 479.6, and 389.8 minutes after TMLB' initiation in TMLB' Cases 3 through 6, respectively. Note that a negative result indicates hot leg failure before the calculated time of lower head failure.)*

b. Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95.

c. NC means that creep rupture failure was not calculated before molten relocation and lower head failure.

G-1.2.3 P3--Probability that the RCS :Pressure is Low as a Function of Time. SCDAP/RE~AP5/MOD3 results for TMLB' Cases 3 through 6 indicate that the RCP seal leaks considered are sufficient to reduce the RCS pressure well below the setpoint of the PORVs. However, the RCP seal leaks may or may not depressurize the RCS below 1.38 MPa before lower head failure because of the potential for repressurization associated with accumulator injections and debris/coolant heat transfer. In other words, failure of the surge line

• and/or hot leg, which should adequately relieve any repressurization in most circumstances, may still be required to avoid 'an HPME. The probability of depressurizing through a surge line or hot leg break (given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP) is discussed below.

As described in Sections G-1.2.1 and G-1.2.2, creep rupture failures were not calculated for either the surge line or the hot leg before molten relocation and lower head failure in TMLB' Cases 4 and 6. Obviously, those results indicate that there is no potential for RCS depressurization through a G-35 NUREG/CR-5949

Appendix G 1.0 r------.---,------,v------.---B----r------,

0.8 I

I I

I I

I I I I I

~ 0.6 I I i

.0 I I e I / I

a. 0.4 I I I I I I I I e--0Case 3 0.2 I I 13-EJ Case 5

- Combined distribution I I 100.0 Time prior to calculated lower head failure (min)

Figure G-15. Hot leg failure probabilities as.a function of time given the occurrence TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

surge line or hot leg failure before lower head failure. Therefore, this probability was taken to be 0.0 given the ~ccurrence of TMLB' sequences with seal leaks of 480 gpm per RCP in the Surry NPP.

I With respect to seal leaks of 250 gpm per RCP, both surge line and hot leg failures were predicted. However, the probability of reaching low pressure in the RCS is controlled by a hot leg break for TMLB' sequences with seal leaks of 250 gpm per RCP, since the probability for hot leg failure is higher than the probability of surge line failure as a function of time (see combined probability distributions shown in Fi~ures G-12 and G-15). Although the break size resulting from hot leg creep rupture is unknown, one would expect a hot leg rupture to be larger than a surge line rupture. It was established in Section G-1.1.3 that a surge line creep rupture could depressurize the RCS from operating pressure to 1.38 MPa in 10 minutes. With a larger rupture size expected and with the RCS pressure reduced by RCP seal leaks, it is quite conservative to assume RCS depressurization to 1.38 MPa within 10 minutes of hot leg creep rupture.

Probability distributions for reaching a low RCS pressure are given in Table G-8 on that basis. Specifically, the distributions were calculated by shifting the results for TMLB' Cases 3 and 5 given in Table G-7 by 10 minutes.

(Obviously, there was no reason to carry results for Cases 4 and 6 forward to

• Table G-8, since hot leg failures were not calculated.) Results listed in Table G-8 are depicted in Figure G-16. The combined probability distribution NUREG/CR-5949 G-36

Appendix G

• Table G-8. Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

TMLB' case Time to reach a low RCS pressure (min)a Probability 3 -100.8b 0.00

-94.0 0.05 27.5 0.95

34. 3b 1.00 5 -174.7b 0.00

-167.9 0.05

-46.4 0.95

-39. 7b 1.00

a. Lower head failure times were subtracted from the times required to reach a low RCS pressure to produce the listed results in terms of a common reference. (Lower head failures were calculated to occur 405.7 and 479.6 minutes after TMLB' initiation in TMLB' Cases 3 and 5, respectively. Note that a negative result indicates RCS depressurization before the calculated time of lower head failure.)

• b. Failure times at endpoint probabilities of 0.0 and 1.0 were extrapola~ed by assuming a linear distribution between probabilities of 0.05 and 0.95.

0.8

~ 0.6

0

('(I

.D 0

0:: 0.4 0.2 0.0 ~~~~~~~~~~~---'-~~~___,_~~~--'-~~~--'

-200.0 -100.0 0.0 100.0 Time prior to calculated lower head failure (min)

Figure G-16. Probability distribution for reaching a low RCS pressure as a

• function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

G-37 NUREG/CR-5949

Appendix G for reaching a low RCS pressure (as shown) was determined by applying equal weight to the results of Table G-8. Specifically, the distribution for TMLB' Case 3 was multiplied by 0.5 over the domain from -100.8 to 34.3 minutes; and the distributipn for TMLB' Case 5 was multiplied by 0.5 over the domain from

-174.7 to -39.7 minutes. The weighted distributions were then summed in order to capture the range established by the separate results. Based on the table data and the combined distribution, RCS depressOrization to 1.38 MPa earlier than 174.7 minutes before lower head failure and RCS depressurization to 1.38 MPa later than 34~3 minutes after lower head failure would not be expected, given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

G-1.2.4 P4--Probability of Lower Head Failure as a Function of Time. As discussed in Section G-1.1.4, the SCDAP/RELAP5/MOD3 calculation of lower head creep rupture is primarily affected by (a) 'debris/coolant heat transfer during molten relocation to the lower head, (b) melt/lower head contact resistance, (c) uncertainties in the creep rupture analysis for large radii, and (d) in-core crust heat transfer. Although, TMLB' Case 5 was used to investigate the effects of debris/coolant heat transfer, TMLB' Cases 3, 4, and 6 are similar to the TMLB' Base Case and TMLB' Case 2 in that all of those items tended to accelerate relocation and lower head failure. From that perspective, lower head failures earlier than those predicted by'the code should have low probabilities. However, the potential for earlier relocations (that are not currently considered by the code) should be evaluated, as discussed below .

A relatively stable crucible of solidified materials could retain an in-core molten pool. If materials suddenly slump into the pool from above, some of the molten materials could spill over the top of the crucible and relocate to .the lower head as a result of a plunger action. After reviewing results from the subject cases, it was concluded that relocations due to the plunger effect would not be expected before the code calculated crust failures.

Material slumping into the molten pools could have occurred; however, any slumping into the pool would be expected to occur gradually, consistent with the nature of the predicted heatup in the subject cases. Gradual slumping could result in small spills, which would tend to solidify before reaching the lower head. In other words, relocation and lower head failure as a result of the plunger effect would not be expected before the code calculated lower head failure in the subject cases.

Some amount of radial spreading could occur as core materials begin to melt. If the molten region spreads to a point of contact with the core former plates, the former plates could also melt, resulting in relocation through the core bypass region with a potential for a subsequent lower head failure. The time required to melt the former plates was conservatively neglected in evaluation of this potential. It was also assumed that any relocation that resulted from radial spreading would be large enough to cause a lower head failure. In other words, the probability of lower head failure given a core bypass relocation was conservatively assumed to be 1.0. Based on the first appearance of molten materials and a spreading rate typical of TMI-2 (estimated to .be 0.06 mm/second by the SCDAP development staff}, potential lower head failures as a result of radial spreading could have occurred in a NUREG/CR-5949 G-38

Appendix G

• range from 98.5 minutes after to 28.3 minutes after the code predictions in the subject cases.

Melting of fuel rods on the core periphery could develop under conditions of uniform core heating. Like the process of radial spreading, melting on the core periphery could result in a core bypass relocation with a potential for a subsequent lower head failure. With the exception of TMLB' Case 4, outer channel core melting did not occur before the calculated crust failure, relocation, and lower head failure in the subject cases. A decision was made to disregard th~ relatively early outer channel melting in TMLB' Case 4, since that result appeared to be an unreasonable anomaly in the calculation.

Therefore, early relocation and lower head failures as a result of melting on the core periphery would not be expected before the code calculated lower head failures in the subject cases.

From the foregoing, it should be clear t~at the code-calculated failures appear to represent the earliest lower head failures times.that could be expected in TMLB' Cases 3, 4, and 6. (TMLB' Case 5 will be handled separately, since debris/coolant heat transfer resulted in a delayed lower head failure.) It was assumed that failures earlier than those calculated would not be expected more than 1% of the time. That assumption was based on the conservative nature of the code calculations (which tend to produce early lower head failures) and the fact that alternate mechanisms were.also considered to incorporate the potential for even earlier lower head failures.

Probability quantification can be com~leted using results from TMLB' Cases 3 and 5. Specifically, comparing results from those cases indicates that debris/coolant heat transfer, which amounts to debris quenching limited only by the availability of water in the lower head, can extend lower head survival by 73.9 minutes. Assuming that debris/coolant heat transfer accounts for about half of the conservatism in the code calculations of lower head failure as previously discussed, lower head failure could be as late as. 147.8 minutes (2 x 73.9 minutes) after the code-calculated times. Therefore, it was assumed that lower head fatlures earlier than the code calculation plus 147.8 minutes would occur about 99% of the time.

The calculated lower head failure time from TMLB' Case 3 (with an assumed probability of 0.01) and the calculated lower head failure time from TMLB' Case 3 plus 147.8 minutes (with an assumed probability of 0.99) effectively provides a range of lower head failure uncertainty for TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP. That is because results from both (250 gpm RCP seal leak) Cases 3 and 5 were used to establish the distribution. The calculated lower head failure times from TMLB' Cases 4 and 6 (with an assumed probability of 0.01) and the application of a late failure uncertainty of 147.8 minutes to the calculated lower head failure times (with an assumed probability of 0.99) provides separate distributions for those cases. However, the distributions are equivalent when referenced to the time of calculated lower head failures (since TMLB' Case 4 and 6 results did not support failures earlier than calculated and since the Tate failure adjustment was the same in both cases). The combined distribution for TMLB' sequences with seal leaks of 480 gpm per RCP is equal to the distributions for TMLB' Cases 4 and 6, since the separate distributions are equal.

G-39 NUREG/CR-5949

Appendix G Results of the quantification for the probability of lower head failure are summarized in Table G-9 on that basis. As indicated, combined distributions are given for seal leaks of 250 gpm per RCP and for seal leaks of 480 gpm per RCP. Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in the table. Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.01 and 0.99. As previously discussed, the linear assumption was made for simplicity, since there was no apparent basis for any other distribution shape.

Results listed in Table G-9 are depicted; in Figure G-17. The combined distribution for seal leaks of 250 gpm per RCP is equivale~t to the combined distribution for seal leaks of 480 gpm per RCP. Therefore, lower head failures earlier than 1.5 minutes before the calculated failure time and lower head failures later than 149.3 minutes after those calculated would not be expected if TMLB' sequences with RCP seal leaks occur in the Surry NPP.

G-1.2.5 Recombination of Probabilities Pl through P4. The combined distribution shown in Figure G-16 represents the probability of having a hot leg failure that will depressurize the RCS to a low pressure given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP. The probability of a lower head failure is represented by the combined distribution shown in Figure G-17. Those distributions overlap, as shown in Figure G-18. Therefore, derivatives of the distributions with respect to time

• were calculated to give the corresponding PDFs shown in Figure G-19. Equation (G-1) was applied to the PDFs, as explained in Section G-1. Specifically, the integration limits in Equation (G-1) were reset consistent with non-zero values of PLP.i and PLH. 2 and evaluated to give p

.I I

=

34.3

-174.7 t, 149.3 PLP,,PLH,2dt2dt, = 0. 98 (G-12) where P the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP PLPl =

• the PDF representing the probability of depressurizing the RCS following a hot leg failure given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP integrated with respect to time t 1 the PDF representing the probability of lower head failure given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP integrated with respect to time t2.

NUREG/CR-5949 G-40

Appendix G

• Table G-9. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP.

TMLB' Sequence Lower head failure time (min)a I

Probability With seal leaks of -1. 5b 0.00 250 gpm per RCP 0.0 0.01 147.8 0.99 149.3b 1.00 With seal leaks of -1. 5b 0.00 480 gpm per RCP 0.0 0.01 147.8 0.99 149.3b 1.00

a. Results are listed with respect to a common reference of zero at the calculated lower head failure times. Note that a negative result indicates lower head failure before the calculated failure time.

b. Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.01 and 0.99 .

• 1.0 0.8

~ 0.6

0

<<s

.D 0

0:: 0.4 0.2 0.0 '--~....__~_.__~...__~..__~.....___~.....___~.....___~.....__~_.._~_.__~.....,__~_.

-100.0 -50.0 0.0 50.0 100.0 150.0 200.0 Time prior to calculated lower head failure (min)

• Figure G-17. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP.

G-41 NUREG/CR-5949

Appendix G 1.0 ~ - ~ - - ~ - - ~ - - ~ - ~ ~ - - ~ - - - / . . . . - - - - - - ,

0.8

- - RCS depressurization

- - Lower head failure I

I I

• I I

~ 0.6 I I

~

.c I e

o... 0.4 I

I I

I 0.2 I I

I 0.0 ~ ~ - ~ - - ~ - - ~ - - . . . . . . __ _......__ _.......__ _........__ ____.

-200.0 -100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-18. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

0.010 0.008 -

I I

, - - RCS depressurization

- - Lower head failure I

I

~

• u5 ,--------1 C

0.006 - -

Q)

"t:J I I

.'!: I I

0 I ca

.c 0.004 - I -

0 0...

I I I I I 0.002 ~

I I -

I I

-174.7 I I

-1.5 11 34.3 l149.3 I I 0.000

-200.0 -100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-19. Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

NUREG/CR-5949 G-42

Appendix G

• Therefore, the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP is 0.98.

The probability of having a surge line or hot leg failure was 0.0 for TMLB' Cases 4 and 6 with seal leaks of 480 gpm per RCP (see Sections G-1.2.1 and G-1.2.2). Obviously, there is no possibility for an associated RCS depressurization in those cases. Therefore, the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 480 gpm per RCP in the Surry NPP is 0.0.

G-1.3 Issue Probability for TMLB' Sequences with Stuck-Open/Latched-Open PORVs This section contains the probability quantification for the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP. As discussed in Section G-1, the surge line/hot leg failure issue was decomposed into four separate probabilities, denoted Pl through P4. Sections G-1.3.1 through G-1.3.4 contain evaluations of the separate probabilities Pl through P4, which are also conditional on the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP. The surge line/hot leg failure issue probability for this scenario was then obtained through recombination of the separate probabilities. That recombination is outlined in Section G-1.3.5 .

• Quantification was primarily based on SCDAP/RELAP5/MOD3 results for an intentional depressurization of the Surry NPP.G- 6 A late depressurization strategy was considered .in that analysis, where it was assumed that plant operators would latch the PORVs open at the time core exit temperatures reached 922 K. It should be recognized that the PORVs could be latched open or they could stick open at virtually any time during a TMLB' sequence. In this evaluation, however, it was assumed that the probabilities for the su~ge line/hot leg failure issue would not be significantly altered by the* PORV opening time. Furthermore, probabilities for both latched-open and stuck-open conditions were assumed to be equivalent. Those assumptions were developed as follows.

It was determined that the surge line would fail before failure of the lower head if the late depressurization strategy were implemented in the Surry NPP.G- 5 Results from previous analyses indicate the same result with respect to surge line failure if the PORVs are latched open at an earlier time.

Specifically, if the PORVs are latched open at the time of steam generator dryout, surge line failures are also predicted to occur before lower head failure.G* 7 (It should be noted that there are substantial differences in terms of core damage as a function of the time that the PORVs are latched open. However, the level of core damage is of no concern in this particular issue.) Based on current understanding and the available calculations, there is no reason to expect any difference in results applicable to this issue if any other relatively early PORV opening times were selected .

• G-43 NUREG/CR-5949

Appendix G If the PORVs are latched open at some: time after core exit temperatures reach 922 K, RCS pressure control through PORV cycling would be extended.

Results from the TMLB' Base Case (described in the body of this report) indicate that PORV cycling subjects the surge line to heating at high pressure conditions. If allowed to continue (i.e., if it is not interrupted by latching the PORVs open), surge line failure would occur more than 240 minutes ahead of lower head failure. If the PORVs are latched open before surge line failure (i.e., before sufficient heating at high pressure has transpired), the ensuing RCS pressure reduction would result in cladding ruptures and the injection of accumulator water. High-temperature steam from the subsequent boiloff and the some of the energy associated with oxidation of the inner surfaces of the ruptured cladding would be deposited in the surge line. Surge line failure, as a result of the heating associated with boiloff and oxidation, would be expected ahead of lower head failure. Based on current understanding and the available calculations, there is no reason to expect any difference in results applicable to this issue if relatively late PORV opening times are selected. Therefore, the probability of the surge line/hot leg failure issue should not be significantly altered by the time that the PORVs are latched open.

A similar set of reasoning applies to the time that the PORVs could stick open. In fact, there is no basis to differentiate between a latched-open condition and a stuck-open condition, given that the operators could latch the PORVs open or the PORVs could stick open at any given time. Therefore, the probabilities for both latched-open and stuck-open conditions were assumed to be equivalent.

G-1.3.1 Pl--Probability of Surge Line Failure as a Function of Time.

Surge line creep rupture calculations during TMLB' sequences with stu~k-open/latched-open PORVs are subject to the temperature and pressure uncertainties previously described for TMLB' sequences with RCP seal leaks (see Section G-1.2.1). Therefore, the quantification approach used in Section G-1.2.1 was used in this evaluation. Specifically, it was assumed that the probability of surge line failure could be inferred from the variations in failure times resulting from both temperature and pressure uncertainties.

A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the stainless steel surge line subjected to potential temperature and pressure variations. The simple one-volume model had to be benchmarked before those calculations could be made. Surge line vapor temperature and pressure histories were extracted from the SCDAP/RELAP5/MOD3 intentional depressurization results as a first step in benchmarking. The extracted vapor temperatures and pressures were used as surge line boundary conditions. Heat transfer coefficients from the vapor to the surge line were then adjusted until the surge line response using the simple one-volume model matched the response predicted during the intentional depressurization calculation. That approach effectively simulated the surge line temperature and pressure conditions and provided reasonable heat transfer coefficients for use in subsequent calculations with the one-volume model.

NUREG/CR-5949 G-44

Appendix G

• The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties. The extracted temperature histories were altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup, consistent with the approach described in Section G-1.1.1. Potential pressure uncertainties were addressed by varying accumulator injection and debris quenching pressure peaks by +/-20%,

consistent with the approach described in Section G-1.2.1. The resulting surge line vapor temperature and pressure histories are shown with respect to the nominal histories in Figures G-20 and G-21, respectively. The variations shown in Figures G-20 and G-21 represent possible conditions that could occur if the surge line temperatures/pressures are either under- or overpredicted.

It was assumed that the combined conditions represented by surge line temperatures and pressures that were increased by 20% should not be exceeded more than about 5% of the time. It was also assumed that the combined conditions represented by surge line temperatures and pressures that were decreased by 20% should be exceeded about 95% of the time. Those assumptions were based on the potential uncertainties affecting surge line temperatures (including oxidation and radiation, as discussed in Section G-1.1.1) and the potential uncertainties affecting surge line pressures (including the effects of accumulator injection and debris/coolant heat transfer, as discussed in Section G-1.2.1). The assumptions were intended to represent the range of uncertainty associated with surge line temperatures and pressures. It is not possible to more definitively establish the range of uncertainty within the'

• scope of this project. However, the assumptions could be easily modified at some future date if warranted.

The surge line response was then calculated using the simple one-volume model with the altered vapor temperature and pres'sure histories as boundary conditions. Heat transfer coefficients previously established to match the surge line response were used as appropriate. Surge line failures were not calculated prior to relocation and lower head failure within the range of uncertainties considered. On that basis, one might conclude that the probability of surge line failure is 0.0. However, such a conclusion would be premature without some understanding of the code creep rupture calculation relative to intentional depressurization of the, Surry NPP, as discussed below.

SCDAP/RELAP5/MOD3 calculates creep rupture failures based on the time a specified component remains at a given temperature and pressure (which induces a stress). The code calculation then relies on experimental data of failures that were recorded for a variety of materials subjected to a range of temperatures and stress levels. However, e0trapolation is required, especially for low-stress conditions, since the experimental temperature and stress range was limited. In contrast with TMLB' sequences with and without RCP seal leaks, surge line stresses are very low in the intentional depressurization calculation because the PORV effectively reduces the RCS pressure. As a result, the extrapolated time to creep rupture failure is well beyond the time of relocation. Therefore, creep rupture failures of the surge line were not predicted.*

• Uncertainties in extrapolation of experimental creep rupture data to low-stress conditions prompted further evaluation. Specifically, the calcul~ted G-45 NUREG/CR-5949

Appendix G 2500.0 .-----,.--------.-----.----,---~------,-------,-----,

2000.0 e---e nom temp + 20%

- - nomtemp 13--£1 nom temp - 20%

S2'

~

~ 1500.0 Q) 0.

E

~

1000.0 500.0 ..___ __..._ _............_ ___.__ ___.__ _.....__ _......__ _......___ __,

100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-20. Surge line vapor temperature histories for estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the.Surry NPP.

18.0

<3-----e nom press+ 20%

. - - nom press 15.0 C3-----J nom ress - 20%

CCI 0...

12.0

~

....Q::,)

en 9.0 en

....Q) 0... 6.0 3.0 0.0 I 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-21. Surge line pressure histories fQr estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

NUREG/CR-5949 G-46

Appendix G

• surge line stress levels were compared to the ultimate strength of stainless steel. It was concluded that the ultimate strength of the surge line would be exceeded by the calculated stresses during intentional the surge line reached approximately 1530 K. 8 -6 Stresses that exceed the ultimate strength of the stainless steel should be sufficient to result in a depressurization once surge line breach. On that basis, it was assumed that failure could be expected by the time the surge line reached 1530 K.

Volume-averaged temperature histories of the surge line pipe, with variations predicted through use of the simple one-volume model to account for potential uncertainties during ex-vessel heatup, are depicted in Figure G-22.

A line was also drawn at the assumed failure temperature as a visualization aid. Surge line failures at 371.4 and 483.5 minutes are indicated for heatup variations of +/-20%, respectively. Surge line failure at -371.4 minutes was assigned a probability of 0.05 by assuming that a 20% increase in heatup

• should not be exceeded more than about 5% of the time. A probability of 0.95 was assigned to the surge line failure at 483.5 minutes by assuming that a 20%

decrease in surge line heating should be exceeded about 95% of the time.

Those results are summarized in Table G-10. Failure times at the endpoint probabilities of 0.0 and 1.0 are also included iri the table. Those values were extrapolated by assuming a linear distribution of failure times between the probabilities of 0.05 and 0.95. Note that the lower head failure time of 489.1 minutes was subtracted from the surge line failure times so that results are expressed in terms of a common reference .

• Results listed in Table. G-10 are depicted in Figure G-23. Based on the table data and the distribution shown in the figure, surge line failures 2000.0 ~ - - ~ - ~ ~ - ~ - - ~ - - - - - - - - - - - -

G------0 nom temp + 20%

- - nomtemp C3----J nom temp - 20%

Q)

....ct!:, 1530 K Q) 1500.0 Q_

E

~

"C Q)

Ol ct!

Q)

~I 1000.0 Q)

E 0

500.0 1 - - - - L - - - - L - - - - - J ' - - - - - - ' - - - - - ' - - - - - ' - - - - - ' - - - - - '

1oo_o 200.0. 300.0 400.0 500.0 Time (min)

Figure G-22. Surge line volume-averaged temperature histories for estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

G-47 NUREG/CR-5949

Appendix G Table G-10. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

Surge line failure time (min)a Probability

-123.9b 0.00

-117.7 0.05

-5.6 0.95 0.6b 1. 00

a. Lower head failure time was subtracted from surge line failure time to produce the results in terms of a common reference. (Lower head failure was calculated to occur 489.l minutes after TMLB' initiation during the intentional depressurization calculation. Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b. Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95 .

0.8

~ 0.6

.aro

..c 0

a. 0.4 0.2 0.0 '--~~.u...-~~.....__~~--'-~~--'-~~--'-~~~'---~~..__~_____.

-150.0 -100.0 -50.0 0.0 50.0 I

Time prior to calculated lower head failure (min)

Figure G-23. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/l~tched-open PORVs in the Sorry

• NPP.

NUREG/CR-5949 G-48

Appendix G

• earlier than 123.9 minutes before lower head failure and surge line failures later than 0.6 minutes after lower head failure are not expected given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP. In addition, surge line failures earlier than 5.6 minutes before lower head failure are expected 95% of the time.

G-1.3.2 P2--Probability of Hot Leg Failure as a Function of Time. Hot leg creep rupture calculations during TMLB' sequences with stuck-open/latched-open PORVs are subject to the temperature and pressure uncertainties previously described for TMLB' sequences with RCP seal leaks (see Section G-1.2.2). Therefore, the quantification approach used in Section G-1.2.2 was used in this evaluation. Specifically, it was assumed that the probability of hot leg failure could be inferred from the variations in failure times resulting from both temperature and pressure uncertainties.

A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the hot leg subjected to potential temperature and pressure variations. As discussed in Section G-1.1.2, carbon and stainless steel material properties were incorporated into t'he model so that the areas most vulnerable to creep rupture could be analyzed. The simple one-volume model had to be benchmarked before hot leg failures resulting from potential temperature/pressure variations could be calculated. Hot leg vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 intentional depressurization results as a first step in benchmarking. The extracted vapor

• temperatures and pressures were used as hot leg boundary conditions. Heat transfer coefficients from the vapor to the hot leg were then adjusted until the hot leg response using the simple one-volume model matched the response predicted in the intentional depressurization calculation. Stainless steel material properties were used in the benchmarking process, consistent with the modeling used in the calculation. That approach effectively simulated the hot leg pressure and temperature conditions and provided a reasonable heat transfer coefficient for use in subsequent calculations with the one-volume model.

The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties. The extracted temperature histories were altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup, consistent with the approach described in Se~tion G-1.1.2. Potential pressure uncertainties were addressed by varying accumulator injection and debris quenching pressure peaks by +/-20%,

consistent with the approach described in Section G-1.2.2. The resulting hot leg vapor temperature histories are shown with respect to the nominal history in Figure G-24. The altered hot leg pressure histories are not shown, since they are essentially equal to the surge line histories depicted in Figure'G-

21. The resulting variations represent possible conditions that could occur if the hot leg temperatures/pressures are either under- or overpredicted.

It was assumed that the combined conditions represented by hot leg temperatures and pressures that were increased by 20% should not be exceeded

• more than about 5% of the time. It was also assumed that the combined conditions represented by hot leg temperatures and pressures that were decreased by 20% should be exceeded about 95% of the time. Those assumptions G-49 NUREG/CR-5949

Appendix G 3000.0 2500.0 G-----e nom temp+ 20%

- - nomtemp 13----EJ nom temp - 20%

S2' 2000.0 Cl)

~

ca

~ 1500.0 Cl) a.

E Cl)

I- 1000.0

.500.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-24. Hot leg vapor temperature histories for estimation of hot leg failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

were based on the potential uncertainties affecting hot leg temperatures (including oxidation and radiation, as discussed in Section G-1.1.1) and the.

potential uncertainties affecting hot leg pressures (including the effects of accumulator injection and debris/coolant heat transfer, as discussed in Section G-1.2.1). The assumptions were intended to represent the range of uncertainty associated with hot leg temperatures and pressures. It is not possible to more definitively establish the range of uncertainty within the scope of this project. However, the assumptions could be easily modified at some future date if warranted.

The hot leg response was then calculated.using the simple one-volume model with the altered vapor temperature and pressure histories as boundary conditions. The heat transfer coefficient previously established to match the hot leg response was used as appropriate. In an attempt to estimate the possibility of an early hot leg failure, carbon steel properties were used in conjunction with vapor temperatures and pressures that had been increased by 20%. Since higher temperatures and pressures accelerate failure by creep rupture and since a given temperature and pressure will induce a carbon steel failure before a stainless steel failure, hot leg failures earlier than the failures corresponding to carbon steel subjected to the combined conditions of increased temperature and pressure were as~umed to occur 5% of the time.

Stainless steel properties were used in conjunction with vapor temperatures

• and pressures that had been decreased by 20% to estimate the possibility of a late hot leg failure. Since lower temperatures and pressures delay failure by NUREG/CR-5949 G-50

Appendix G creep rupture and since stainless steel will fail later than carbon steel at a given temperature and pressure, hot leg failures earlier than the corresponding failures were assumed to occur 95% of the time. However, hot leg failures were not calculated prior to relocation and lower head failure within the range of uncertainties considered. The calculated hot leg stresses were very low because the Rq was depressuri:zed through the open PORVs. As a result, creep ruptures were not predicted.

As discussed in Section G-1.3.1, an evaluation was needed to address uncertainties in the extrapolation of experimental creep rupture data to low-stress conditions. As a first step, volume-averaged hot leg piping temperature histories for all three primary coolant loops were extracted from the intentional depressurization results, and depicted in Figure G-25. As indicated, the highest hot leg piping temperatures occurred in the loop containing the pressurizer and PO'RVs. {The primary coolant loops, including the pressurizei loop with component numbers in the 400's, were described in Appendix B of this report.) That result was expected, since a majority of the core decay energy is transferred through that hot leg and the surge line before being discharged through the PORVs. However, the highest hot leg temperatures (reaching approximately 1300 K) are relatively cool compared to the surge line temperatures (see Figure G-22). Furthermore, the calculated stresses during intentional depressurization are well below the ultimate strength of the hot leg, even at 1300 K. If the highest hot leg temperature history was increased by 20% (with respect to temperatures at the beginning of

• heatup) to account for potential uncertainties, a margin of approximately 100 K would still exist between the point where the calculated stress approached the ultimate strength of the hot leg.

1400.0 ~-~-~--,----r-----r--,----r-----r---r----,

G--> Loop A hot leg I

.. I

• ",i

• , i S2' - - Loop 8 hot leg

.._.. 1200.0 13------fJ Loo C hot le e?

cu Q) 0.

E 1000.0

~

"C Q) g>

800.0

!I Q)

E 0 600.0 r---e---""'

400.0 ..__ _.___ _..._ _.,___ _.__ _..._ __.___ _ . _ _ ~ - - ~ - -

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

• Figure G-25. Hot leg volume-averaged temperature histories for all three primary coolant loops during the intentional depressurization of the Surry NPP.

G-51 NUREG/CR-5949

Appendix G Based on the foregoing creep rupture analysis and the temperature-related stress/strength evaluation, hot leg failures would not be expected before relocation and lower head failure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs -in the Surry NPP. Therefore, the probability of hot leg failure was taken to be 0.0.

G-1.3.3 P3--Probability that the RCS Pressure is Low as a Function-of Time. SCDAP/RELAPS/MOD3 results indicate that the RCS pressure drops well below 1.38 Mpa before lower head failure as a result of flow through the latched-open PORVs during the intentional depressurization of the Surry NPP.

However, probability P3 was structured to relate RCS depressurization to an ex-vessel failure. Specifically, it is necessary to quantify the probability that the RCS pressure is low as a function of time following surge line/hot leg failure. The following describes quantification of the probability consistent with that structure.

The probability is controlled by a surge line break for TMLB' sequences with stuck-open/latched-open PORVs, since hot leg failures were not calculated (see Sections G-1.3.1 and G-1.3.2). Depressurization following the surge line break is unnecessary, since the RCS is depressurized below the target level by the latched-open PORVs. Therefore, there is no need to add a delay time to allow for depressurization following the (controlling) surge line break. On that basis, the probability distribution for reaching a low RCS pressure following a surge line/hot leg failure is equal to the distribution for surge line failure as given in Table G-10. A graphical representation of the that

• distribution is shown in Figure G-23.

G-1.3.4 P4--Probability of Lower Head Failure as a Function of Time. As discussed in Section G-1.1.4, the SCDAP/RELAPS/MOD3 calculation of lower head creep rupture is primarily affected by (a) debris/coolant heat transfer during molten relocation to the lower head, (b) melt/lower head contact resistance, (c) uncertainties in the creep rupture analysis for large radii, and (d) in-core crust heat transfer. Debris/coolant heat transfer was included in the referenced intentional depressurization calculation. However, the debris was not effectively cooled because the amount of relocated debris was large relative to the amount of lower head coolant available for quenching. As a result, lower head creep rupture proceeded without delay as if debris/coolant heat transfer were not modeled. In addition, the remaining items were modeled to accelerate lower head failure. Since the primary effects treated within the calculation tended to accelerate lower head failure, lower head failures earlier than those predicted would be expected to have low probabilities.

Before quantification can be completed, however, the potential for earlier relocations and associated lower head failures (through mechanisms not currently considered by the code) should be evaluated, as discussed below.

The potential for molten relocations that could result from a plunger effect were described in Section G-1.1.4. After reviewing results from the intentional depressurization calculation, it was concluded that relocations due to the plunger effect would not be expected before the code calculated crust failures. Material slumping into the molten pool could have occurred; however, any slumping into the pool would be expected to occur gradually, consistent with the nature of the predicted heatup. Gradual slumping could NUREG/CR-5949 G-52

Appendix G

• result in small spills, which would tend to solidify before reaching the lower head. In other w9rds, relocation and lower head failure as a result of the plunger effect would not- be expec~ed before the code calculated lower head failure.

The potential for relocations that could result from the radial spreading of molten materials to the core former plates was also described in Section G-1.1.4. The time required to melt the former. plates was conservatively neglected in evaluation of this potential. The probability of lower head failure given a core bypass relocation was also conservatively assumed to be 1.0. Based on the first appearance of molten materials and a spreading rate typical of TMI-2 (estimated to be 0.06 mm/second by the SCDAP development staff), potential lower head failures as a result of radial spreading could have occurred 29.3 minutes after the code prediction.

Melting of'fuel rods on the core periphery could develop under conditions of uniform core heating. Like the process of radial spreading, melting on the core periphery could result in a core bypass relocation with a potential for a subsequent lower head failure. However, outer channel core melting did not occur before the calculated crust failure, relocation, and lower head fail,ure in the referenced intentional depressurizatio~ calculation.

I From the foregoing, it should be clear that the code-qalculated failure appears to represent the earliest lower head failure time that could be

• expected. It was assumed that failures earlier than the prediction would not be expected more than 1% of the time. That assumption was based on the conservative nature of the code calculation (which tended to produce an early lower head failure) and the fact that alternate mechanisms were also considered to incorporate the potential for an even earlier lower head failure.

Probability quantification can be completed using results from TMLB' Cases 3 and 5. Specifically, comparing results from those cases indicates that debris/coolant heat transfer, which amounts to debris quenching limited only by the availability of water in the lower head, can extend lower head survival by 73.9 minutes. Although lower head survival was not extended in the subject calculation, such a result could have occurred if the amount of material relocated was lower and/or if the amount of lower head coolant was higher. It could be argued that the necessary differences in the debris/coolant interaction are within the uncertainties associated with the current understanding of core damage progression. Assuming that the necessary differences were calculated and assuming that debris/coolant heat transfer accounts for about half of the conservatism in the code calculations of lower head failure as previously discussed, lower head failure could be as late as 147.8 minutes (2 x 73.9 minutes) after the code-calculated time. Therefore, it was assumed that lower head failures earlier than the code calculation plus 147.8 minutes would occur about 99% of the time.

Results of the quantification for the probability of lower head failure

• are summarized in Table G-11 on that basis. Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in the table. Those values G-53 NUREG/CR-5949

Appendix G Table G-11. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

Lower head failure time (min)a Probability

-1. 5b 0.00 0.0 0.01 147.8 0.99 149.3b 1. 00

a. Results are listed with respect fo a common reference of 'zero' at the calculated lower head failure time. Note that a negative result indicatei lower head failure before*the calculated time.;

b. Failure times at endpoint probabilities of 0.0 and 1.0 'were extrapolated by assuming a linear distribution between probabilities of 0.01 and 0.99.

were extrapolated by assuming a linear distribution of failure times between probabilities of 0.01 and 0.99. As previously discussed, the linear assumption was made for simplicity,since there was no apparent basis for any other distribution shape.

Results listed in Table G-11 are depicted in Figure G-26. As indicated, lower head failures earlier than 1.5 minutes before the calculated failure time and lower head failures later than 149.3 minutes after the calculated time would not be expected given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

G-1.3.5 Recombination of Probabilities Pl through P4. The distribution shown in Figure G-23 represents the probability of having a surge line failure that will depressurize the RCS to a low pressure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP. (As discussed in Section G-1.3.3, there was no need to shift the distribution shown in Figure G-23 to allow time for depressurization, since the pressure was effectively reduced through the open PORVs.) The probability of a lower head failure is represented by the distribution shown in Figure G-26. There is a slight overlap of the distributions, as shown in Figure G-27. Therefore, derivatives of the distributions with respect to time were calculated to give the corresponding PDFs shown in Figure G-28. Equation (G-1) was applied to the PDFs as explained in Section G-1. Specifically, the integration limits in Equation (G-1) were reset consistent with non-zero values of PLP., and PLH. 2 and evaluated to give NUREG/CR-5949 G-54

Appendix G

• 0.8

-~ 0.6

g

.£l 0

a.. 0.4 0.2 0.0 ........._ .........................................._ ___._ ___._ ___.._ __.___________________.__ __.

-100.0 -50.0 0.0 50.0 100.0 150.0 200.0 Time prior to calculated lower head failure (min)

Figure G-26. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry

• NPP.

1.0 ~--.------~--~----.-----.----I~---,

I I

0.8 I I J\

I

~ 0.6 I

0 I ctl

.£l I 0

a.. 0.4 I

I I

I 0.2 1 1 -- RCS depressu rization I - - Lower head failure 0.0 ........._ __..........__.___,_ ____._ _ ._..L_ __ _ . __ __ _ . __ __ _ . __ __ _ .

-200.0 -100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-27. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

G-55 NUREG/CR-5949

Appendix G 0.010 0.008 ....

I 1--

I RCS depressurization

- Lower head failure I

I I

~

• u; ,--------,

C Q)

"C 0.006 - I I -

~ I I

~ 0.004

.Q I-I I 0 I I a.. I I.

0.002 .... I I -

I I

-123.9 -1.s I0.6 I 1149.3 I I 0.000

-200.0 -100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-28. Probability density functions for the surge line/hot leg failure

• issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

0.6 f 149.3 p =

I -123.9 t, PLP,,PLH,2dt2dt, > 0.99:::::: 1.0 (G-13) where P = the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP PLPl = the PDF representing the probability of depressurizing the RCS following a surge line failure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP integrated with respect to time t, PLH. 2 = the PDF representing the probability of lower head failure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP integrated with respect to time t 2

• Therefore, the probability of the surge line/hot leg failure issue given the occurrence of tMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP is 1.0.

NUREG/CR-5949 G-56

Appendix G

• G-2 RCS PRESSURE AT VESSEL BREACH ISSUE This issue provides a structure for defining the RCS pressure at the time of vessel breach given that ex-vessel failures do not occur. The issue is an important aspect of the planned risk assessment in that issue results are needed for cases where surge line/hot leg failures do not depressurize the RCS before lower head failure. Consistent with NUREG-1150, the issue was separated into high-, intermediate-, and low-pressure components to better characterize the RCS conditions at vessel breach. Those components are P~: The probability that the RCS pressure is greater than 6.89 MPa at the time of vessel breach given that ex-vessel failures do not occur P~t: The probability that the RCS pressure is greater than 1.38 MPa but less than 6.89 MPa at the time of vessel breach given that ex-vessel failures do not occur P~: The probability that the RCS pressure is less than 1.38 MPa at the time of vessel breach given that ex-vessel failures do not occur.

The following sections contain evaluations of the three probability

• components for each of the scenarios considered. Specifically, Section G-2.1 contains the evaluation of the three components for TMLB' sequences without RCP seal leaks, Section G-2.2 contains the evaluation of the three components for TMLB' sequences with RCP seal leaks, and Section G-2.3 contains the evaluation of the three components for TMLB' sequences with stuck-open/latched-open PORVs. It is important to not~ that the resulting probabilities are conditional on occurrence of the specific scenarios.

It is also important to note that the SCDAP/RELAP5/MOD3 calculations that were, used as a basis for evaluation were performed without accounting for the effects of potential ex-vessel piping failures. Ex-vessel failures were recorded as predicted during the code calculations, but a corresponding RCS blowdown was not modeled. In other words, the calculations that were used in the following evaluation were performed consistent with the structure of the issue.

G-2.1 Issue Probabilities for TMLB' Sequences without RCP Seal Leaks Probability quantification of the RCS pressure at vessel breach issue for this scenario was based on TMLB' Base Case and TMLB' Case 2 results, as described in the body of this report. There were no RCS leaks in either calculation. Therefore, the pressurizer PORVs were the only means for pressure control during the RCS boil off that was driven by core decay energy.

The PORVs controlled the RCS pressure by cycling between the opening and closing set points of 16.2* and 15.7 Mpa, respectively. The results clearly indicate that the RCS pressures will remain high through the time of lower ,

G-57 NUREG/CR-5949

Appendix G head failure. Furthermore, uncertainties tn the calculated lower head failure time are unimportant, since PORV cycling is continuous. Neglecting potential depressurization effects associated with the predicted ex-vessel failures (consistent with the probability definitions given in Section G-2), the probabilities for this scenario are G-2.2 Issue Probabilities for TMLB' Sequences with RCP Seal Leaks Probability quantification of* the RCS pressure at vessel breach issue for this scenario was based SCDAP/RELAP5/MOD3 results for TMLB' Cases 3 through 6, as described in the body of this report. All of those cases included RCP seal leaks that reduce the RCS pressure below the PORV setpoint before lower head failure. However, quantification of probabilities for this issue must account for uncertainties in the lower head failure time and the RCS pressure response. Those uncertainties and their effect on issue probabilities were evaluated separately for seal leaks of 250 and 480 gpm per RCP, as discussed below. (The basis for separate evaluation was described in Section G-1.2.)

Seal leaks of 250 gpm per RCP were included in TMLB' Cases 3 and 5.

Uncertainties in the lower head failure times for those cases were evaluated in Section G-1.2.4. As di.scussed in that section, lower head failures in TMLB' Cases 3 and 5 could occur at any time during a 150.8-minute window.

Specifically, it was determined that lower head failure could occur at any time within a window extending 1.5 minutes earlier to 149.3 minutes later than the calculated failure time in TMLB' Case 3. It was also determined that lower head failure could occur at any time within a window extending 75.4 minutes earlier to 75.4 minutes later that the calculated failure time in TMLB' Case 5. Based on the uncertainty evaluation, a failure window extending from 404.2 to 555.0 minutes is applicable to both cases, given the Case 3 and 5 calculated failure times of 405.7 and 479.6 minutes, respectively. Vertical lines marking the failure windows are shown with respect to the RCS pressures for Cases 3 and 5 in Figures G-29 and G-30, respectively. Horizontal lines are also drawn on the figures to mark the boundaries between high, intermediate, and low pressure ranges as an aid in quantification.

The probability of lower head failure is uniformly distributed across the 150.8-minute window, since the failure distributions were assumed to be linear (see Section G-1.2.4). Therefore, it was assumed that the issue probabilities (defined in Section G-2) are proportional to the fractions of the failure windows that correspond to high, intermediate, and low RCS pressures. Since the calculations were terminated shortly after calculated lower head failures (before 555.0 minutes), it was necessary to estimate the possible RCS pressure response within the failure windows so that the appropriate fractions could be measured. Accumulator injection and debris/coolant heat transfer during relocation to the lower head are the primary mechanisms that could NUREG/CR-5949 G-58

Appendix G 18.0 15.0 a.

<<I 12.0

~

Q) 9.0 \

\

555.0

...a.18

\

Q)

\

6.0 \ 1,

\ I \

\ I \

\ I \

\ I \

3.0 \ I \

'I \

J.38 0.0 0.0 100.0 200.0 300.0 400.0 500.0 600.0 Time (min)

Figure G-29. RCS pressure for Surry TMLB' Case 3 .

• 18.0 .-----r---r---.---~---.-~-~---------~

15.0

-<> Divieion, Office or Region, U.S. NUCMM Regulatory ~ . and muing - - : , if conttllCID,; pravo.

n.,,,. and maJing *dd-J EG&G Idaho, Inc.

Idaho Falls, ID 83415

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (if NRC, type *5.,,_ - - * * : t t:Otltrat:tor, prrNid9 NRC Division, Olfit>> or Reg101J, U.S. NueJNr Regulll.toty ~ .

"1'~*Systems Research Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 -0001

. SUPPLEMENTARY NOTES

13. ABSTRACT (200 words or less)

Containment integrity could be challenged by direct heating associated with a high pressure melt ejection (HPME) of core materials following reactor vessel breach during certain severe accidents. Intentional reactor coolant system (RCS) depressurization, where operators latch pressurizer relief valves open, has been proposed as an accident man-agement strategy to reduce risks by mitigating the severity of HPME. However, decay heat levels, valve capacities, and other plant-specific characteristics determine whether the required operator action will be effective. Without oper-ator action, natural circulation flows could heat ex-vessel RCS pressure boundaries (surge line and hot leg piping, steam generator tubes, etc.) to the point of failure before vessel breach, providing an alternate mechanism for RCS de-pressurization and HPME mitigation.

This report contains an assessment of the potential for HPME during a Surry station blackout transient without operator action and without recovery. The assessment included a detailed transient analysis using the SCDAP/RELAP5/MOD3 computer code to calculate the plant response with and without hot leg countercurrent natural circulation, with and without reactor coolant pump seal leakage, and with variations on selected core damage progression parameters. RCS depressurization-related probabilities were also evaluated, primarily based on the code results.

13. AVAILABILITY STATEMENT

12. KEY WORDS/DESCRIPTORS (List words or phrases lhst wiH assist rssearch9rs in locating the report.)

Unlimited

14. SECURITY CLASSIFICATION Surry, high pressure melt ejection rn,;,,.,.,

direct containment heating Unclassified (llWaa_.,

Unclassified

15. NUMBER OF PAGES

16. PRICE NRC FORM 335 (2*89)

Printed on recycled paper Federal Recycling Program *

.iTED STATES

__ - - -* 1 1 AN 1 R K SPECIAL FOU SS RATE NUCLEA~ULATORY .COMMISSION ---f? !155 51 3 g ~ :, ~ POSTAGE A, _ ,

WASHINGTON, D.C. 20555-0001 U ~.

.:, ~,Rr-OA',M

"***-* *-;,*Pl!RLI CATIOI\IS' SVCS USNRC n1v FnIA .'* *** PERMIT NO_, G-67 TPS-PDR-NUREG P-211 DC 20555 OFFICIAL BUSINESS l~ASHINGTON PENALTY FOR PRIVATE.USE, $300

---