ML18151A239

Assessment of the Potential for High Pressure MELT Ejection Resulting from a Surry Station Blackout Transient

ML18151A239
Person / Time
Site:	Surry
Issue date:	11/30/1993
From:	Dobbe C, Knudson D EG&G IDAHO, INC.
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
CON-FIN-A-6884 EGG-2689, NUREG-CR-5949, NUDOCS 9312170064
Download: ML18151A239 (176)

Text

NUREG/CR-5949 EGG-2689 Assessment of the Potential for High-Pressure Melt Ejection Resulting from a Surry Station Blackout Transient Prepared by D. L. Knudson, C. A Dobbe Idaho National Engineering Laboratory EG&G Idaho, Inc.

Prepared for U.S. Nuclear Regulatory Commission

• ~12170064 931.130 -,

\\

[

~UR ADOCK 05000280 I

P PDR

AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited In NRC pubUcatlons wlll be available from one of the following sources:

1.

The NRC PubUc Document Room, 2120 L Street, NW, Lower Level, Washington, DC 20555-0001

2.

The Superintendent of Documents, U.S. Government Printing Office, Mall Stop SSOP, Washington, DC 20402-9328

3.

The National Technical Information Service, Sprlngfleld, VA 22161 Although the Hating that follows represents the majority of documents cited In NRC publlcatlons, It Is not Intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room Include NRC correspondence and Internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, Information notices, Inspection and Investigation notices; Ucensee Event Reports; ven-dor reports and correspondence; Commission *papers; and applicant and licensee documents and corre-spondence.

The following documents.In the NUREG series are available for purchase from the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations In the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service Include NUREG series reports and technical reports prepared by other federal agencies and reports preparea by the Atomic Energy Commis-sion, forerunner -agency to the Nuclear. Regulatory Commission.

Documents available from publlc and special technical llbrarles Include all open Uterature Items, such as books, Journal and perlodlcal articles, and transactions. Federal Register notices, federal and state leglsla-tlon, and congressional reports can usually be obtained from these llbrarles.

Documents such :as theses, dissertations, foreign reports and translations, and nori-NRC conference pro-ceedings are available for purchase from the organization sponsoring the publlcatlon cited.

Slngle copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Information Resources Management, Distribution Section, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001.

Coples of Industry codes and standards used In a substantive manner In the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for refer-ence use by the publlc. Codes and standards are usually copyrighted and may be purchased from the originating organization or, If they are American National Standards, from the American National Standards Institute, 1430 Broadway, New York, NY 10018.

DISCLAIMER NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government ncir any agency thereof, or any of their employees, makes any warranty, expresed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.

I *

~

\\

Assessment of the Potential for

.High-Pressure Melt Ejection Resulting from a Surry Station Blackout 1Transient Manuscript Completed: May 1993 Date Published: November 1993 Prepared by D. L. Knudson, C. A Dobbe Idaho National Engineering Laboratory Managed by.the U.S. Department of Energy EG&G Idaho, Inc.

Idaho Falls, ID 83415 Prepared for Division of Systems Research Office of Nuclear Regulatory Res~arch U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 NRC FIN A6884 Under DOE Contract No. DE-AC07-76ID0l570 NUREG/CR-5949 EGG-2689 RK

ABSTRACT Containment integrity could be challenged by direct heating associated with a high pressure melt ejection (HPME) of core materials following reactor vessel breach during certain severe accidents. Intentional reactor coolant system (RCS) depressurization, where operators latch pressurizer relief valves open, has been proposed as an accident management strategy to reduce risks by mitigating the severity of HPME. However, de-cay heat levels, valve capacities, and other plant-specific characteristics determine wheth-er the required operator action will be effective. Without operator action, natural circulation flows could heat ex-vessel RCS pressure boundaries (surge line and hot leg piping, steam generator tubes, etc.) to the point of failure before vessel breach, providing an alternate mechanism for RCS depressurization and HPME mitigation.

This report contains an assessment of the potential for HPME during a Surry station blackout transient without operator action and without recovery. The assessment included a detailed transient analysis using the SCDAP/RELAP5/MOD3 computer code to calcu-late the plant resptjnse with and without hot leg countercurrent natural circulation, with and without reactor coolant pump seal leakage, and with variations on selected core dam-age progression parameters. RCS depressurization-related probabilities were also evaluat-ed, primarily based on the code results.

iii NUREG/CR-5949

CONTENTS ABSTRACT...................................................................... iii LIST OF FIGURES................................................................. vii LIST OF TABLES................................................................... X EXECUTIVE

SUMMARY

.......................................................... xiii ACKNOWLEDGMENTS............................................................ xix

1. INTRODUCTION................................................................ 1

2. ASSESSMENT APPROACH....................................................... 3 2.1 SCDAP/RELAP5/MOD3 Analysis............................................... 3 2.2 Probability Evaluation......................................................... 8

3. CALCULATION RESULTS....................................................... 11 3.1 Base Case.................................................................. 11 3.2 Case 2..................................................................... 15 3.3 Case 3..................................................................... 20 3.4 Case 4..................................................................... 29 3.5 Case 5..................................................................... 35 3.6 Case 6...*................................................................. 39 3.7 Uncertainties.................................. ;............................ 43 3.7.1 Thennal-Hydraulic Uncertainties............... ;..................,...... 43

3. 7.2 Core Damage Progression Uncertainties.................................... 45

4. DEPRESSURIZATION PROBABILITIES............................................ 49 4.1 Surge Line/Hot Leg Failure Issue............................................... 49 4.2 RCS Pressure at Vessel Breach Issue............................................. 51

5. CONCLUSIONS AND RECOMMENDATIONS....................................... 55

6. REFERENCES.................................................................. 59 Appendix A--SCDAP/RELAP5/MOD3 Code Description................................. *. A-1 Appendix B--SCDAP/RELAP5/MOD3 Model Description................................. B-1 I

Appendix C--Steady-State Calculations................................................ C-1 Appendix D--Calculation Statistics.................................................... D-1 Appendix E--SCDAP/RELAP5/MOD3 Model Benchmark................................. E-1 Appendix F--Selected Core Damage Results............................................ F-1 V

NUREG/CR-5949

Appendix G--Probabilistic Risk Assessment Issues....................................... G-1

• NUREG/CR-5949 vi

LIST OF FIGURES

1.

Pressurizer pressure for the Base Case...........................................

13

2.

Reactor vessel collapsed liquid level for the Base Case..............................

14

3.

Fuel rod cladding surface temperatures in the center fuel channel for the Base Case.......

14

4.

Mass flow rate in the top of a nonpressurizer loop hot leg (A) for the Base Case..........

16

• 5.

Vapor temperatures in the top and bottom of a nonpressurizer loop hot leg (A) for the Base Case.................................................................

16

6.

Volume-averaged temperatures of various structures in the pressurizer loop (C) and the reactor vessel for the Base Case... ;............................................

17

7.

Middle channel fuel rod cladding surface temperatures for Case 2.....................

19

8.

Vapor temperatures in the pressurizer and nonpressurizer loops (C and A) for Case 2......

19

9.

Volume-averaged temperatures of various structures i~ the pressurizer loop (C) and reactor vess~l for Case 2......................................................

20

10.

• RCS pressure for Case 3....... *......................,........................

23

11.

Full loop natural circulation of liquid in a nonpressurlzer loop (A) following TMLB' initiation for Case 3.................................... *......................

23

12.

Reactor vessel collapsed liquid level for Case 3. :............................... *...

24

13.

Maximum cladding surface temperature for Case 3.................................

24 I

14.

Hot leg countercurrent natural circulation in a nonpressurizer loop (A) for Case 3........

27

15.

Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) for Case 3.....

27

16.

RCS pressures for Cases 3 and 4.................. :............................

31

17.

Reactor vessel collapsed liquid levels for Cases 3 and 4.............................

31

18.

Maximum cladding surface temperatures for Cases 3 and 4..........................

32

19.

Total hydrogen generated for Cases 3 and 4.......................................

33

20.

Hot leg countercurrent natural circulation in a nonpressurizer loop (B) for Case 4.........

34

21.

Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) for Case 4.....

34

22.

Lower head debris temperatures for Cases 3 and 5.................................

37

23.

Reactor vessel collapsed liquid levels for Cases 3 and 5.............................

37

24.

RCS pressure for Case 5......................... *.............................

38

25.

Reactor vessel collapsed liquid levels in Cases 4 and 6..............................

40

26.

RCS pressures in Cases 4 and 6................................................

41

27.

Core bypass collapsed liquid levels in Cases 4 and 6................................

42

28.

Maximum cladding surface temperatures in Cases 4 and 6...........................

42

29.

Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) in Case 6.... -.

44 vii NUREG/CR-5949

B-1. Surry NPP reactor vessel nodalization with provisions for in-vessel natural circulation.....

B-2. Pressurizer coolant loop nodalization for the Surry NPP without provisions for hot leg countercurrent natural circulation...............................................

B-3. Pressurizer coolant loop nodalization for the Surry NPP with provisions for hot leg countercurrent natural circulation...............................................

B-4. A cross section of the three-channel core region...................................

B-5. A typical l~xl5 Surry NPP fuel assembly.......... :............................ *..

B-6. COUPLE mesh representing the lower reactor head.......,........................

G-1. TMLB' Base Case surge line vapor temperature histories for estimation of surge line B-5 B-6 B-7 B-10 B-11 B-14 failure probabilities.......................................................... G-10 G-2. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP................................ G-12 G-3. Configuratio~ of the hot leg nozzle and hot leg piping in the Surry NPP................ G-13 G-4. TMLB' Case 2 hot leg vapor temperature histories for estimation of hot leg failure probabilities............................................................... G-16 G-5. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences withoutRCP seal leaks in the Surry NPP................................ G-12 G-6. Probability distribution for reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.............. G-18 G-7. Lower head failure probabilities as a function of tif1'e given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP................................ G-22 I

G-8. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP......................................... G-23 G-9. Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP......................... G-23 G-10. TMLB' Case 3 surge line vapor temperature histories for estimation of surge line failure probabilities.......................................................... G-27 G-11. TMLB' Case 3 surge line pressure histories for estimation of surge line failure probabilities G-27 G-12. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal le~ of 250 gpm perRCP in the Surry NPP...................... G-31 G-13. TMLB' Case 4 surge line vapor temperature histories for estimation of surge line failure probabilities........................................................... G-33 G-14. TMLB' Case 4 surge line pressure histories for estimation of surge line failure probabilities G-33 G-15. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP...................... G-36 G-16. Probability distribution for reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.... G-37 G-17.Lower head failure probabilities as a function of time given the occurrence ofTMLB' sequences with RCP seal leaks in the Surry NPP................................... G-41 NUREG/CR-5949 viii

G-18. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP............................... G-42 G-19. Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.............. ; G-42 G-20. Surge line vapor temperature histories for estimation of surge line failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP. !............................................................... G-46 G-21. Surge line pressure histories for estimation of surge line failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.................................... *............................. G-46 G-22. Surge line volume-averaged vapor temperature histories for estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP..................................................... G-47 G-23. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.................... G-48 I

G-24. Hot leg vapor temperature histories for estimation of hot leg failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP................................................................. G-50 G-25. Hot leg volume-averaged vapor temperature histories for estimation of hot leg failure probabilities given the occurrence ofTMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP......................................'............... G-51 G-26. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.................... G-55 G-27. Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched:open PORVs in the Surry NPP............................. G-55 G-28. Probability density functions for the surge line/hot leg failure issue given the occurrence of*

TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.............. G-56

• G-29.RCS pressure for Surry TMLB' Case 3..................................... ;.... G-59 G-30. RCS pressure for Surry TMLB' Case 5.......................................... G-59 G-31.RCS pressure for Surry TMLB' Case 4.......................................... G-62 G-32.RCS pressure for Surry TMLB' Case 6.......................................... G-62 G-33.RCS pressure for intentional depressurization of the Surry NPP during a TMLB' sequence. G-64 ix NUREG/CR-5949

LIST OF TABLES ES-1. Summary of SCDAP/RELAP5/MOD3 results (in minutes)....................................................

xv ES-2. Probabilities of the surge line/hot leg failure issue given the occurrence of the specific scenarios in the Surry NPP........................................ :.............................................................. xvii ES-3. Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific scenarios withbut ex-vessel :failures in the Surry NPP............................................................. xvii

1.

Parameters for simulation of RCP seal leaks...........................................................................

6

2.

SCDAP severe core damage parameters.................................................................................

6

3.

Sequence of events for the Base Case.....................................................................................

12 4.*

Sequence of events for Case 2.................................................................................................

18

5.

Sequence of events for Case 3....................................... ~.........................................................

21

6.

Sequence of events for Case 4.................................................................................................

30

7.

Sequence of events for Case 5.................................................................................................

36

8.

Sequence of events for Case 6.................................................................................................

39

9.

Probabilities of the surge line/hot leg failure issue given the occurrence of the specific scenarios in the Surry NPP.......................................................................................................

49 52

• B-12

10.

Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific scenarios without ex-vessel failures in the Surry NPP.............................................................

B-1. Decay power curve...................................................................................................................

C-1. Comparison of steady-state results with sensitivity study values computed by Bayless..........

C-3 D-1. Calculation statistics................................................................................................................. D-3 E-1. Comparison of results from the Base Case and a previous study.............................................

E-3 F-1. Selected core damage results for the Base Case.......................................................................

F-4 F-2. Selected core damage results for Case 2...................................................................................

F-5 F-3. Selected core damage results for Case 3......................................................... ~.........................

F-6 F-4. Selected core damage results for Case 4...................................................................................

F-7 F-5. Selected core damage results for Case 5...................................................................................

F-8 F-6. Selected core damage results for Case 6...................................................................................

F-9 G-1. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences withoutRCP seal leaks in the Surry NPP................................ G-12 G-2. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP................................ G-16 G-3. Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP......................... G-18 G-4. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP................................ G-22

• NUREG/CR-59~9 X

G-5.

G-6.

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP................................... G-29 Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm perRCP in the Surry NPP...................... G-30 G-7. Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP................................... G-35 G-8. Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP............... G-37 G-9. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP................................... G-41 G-10. Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.................... G-48 G-11. Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP._................... G-54 xi NUREG/CR-5949

Executive Summary EXECUTIVE

SUMMARY

Molten core materials could be ejected by a high-pressure reactor coolant system (RCS) fol-lowing reactor vessel lower head failure during certain severe accidents. A rapid rise in contain-ment temperature and pressure, or direct contain-ment heating (OCH), could result from the high pressure melt ejection (HPME) into the contain-ment building. In a severe case, the pressuriza-tion and associated challenge to containment integrity could lead to a significant increase in ra-diological risks.

Intentional depressurization of the RCS has been proposed as an accident man~gement strate-gy to minimize the potential OCH risks (in cases where cooling water is unavailable for either pri-mary or secondary feed and bleed operations). In this strategy, plant operators latch pressurizer,

power-operated relief valves (PORVs) open to reduce the RCS pressure and mitigate the effects of an HPME. However, decay heat levels, valve capacities, and other plant-specific characteris-tics determine whether the required operator ac-tion will lead to an effective RCS depressurization. Analyses have been completed that ~ndicate intentional depressurization could be a viable method for mitigating HPME in the Surry Nuclear Power Plant (NPP). Subsequent analyses indicate that intentional depressuriza-tion could also be effective for many other pres-surized water reactors (PWRs).

Without operator actions, natural circulation flows could develop following accident initiation and reactor coolant pump (RCP) coastdown. A previous analysis of the Surry NPP identified the significance of full loop, in-vessel, and hot leg countercurrent natural circulation modes with re-spect to severe accident progression. Ex-vessel RCS pressure boundaries (surge line and hot leg piping, steam gen~rator tubes, and so on) could be heated by the natural circulation of high-temperature steam to the point of failure before failure of the lower head. Under those condi-tions, RCS depressurization through the ex-vessel pressure boundary breach could then oc-cur without operator actions. As such, uninten-xiii tional depressurization could provide an alternate way to minimize the potential OCH risks by mit-igating HPME.

TIIis report contains an assessment of the po-tential for HPME in the Surry NPP resulting from a severe reactor accident. The assessment was limited to evaluation of a station blackout scenario because it is the single largest contribu-tor to the frequency of core damage for the Surry NPP. The specific station blackout scenario con-sidered was a TMLB' sequence, which was initi-ated by the loss of all ac power and a simultaneous loss of auxiliary feedwater. The potential effects of operator actions and accident recovery were not considered. A two-part as-sessment was completed including (a) a detailed SCDAP/RELAP5/M003 analysis of the TMLB' sequence and (b) an evaluation of RCS depressurization-related probabilities.

Part one of the assessment consisted of a SCOAP/RELAP5/M003 analysis to quantify (a) the time and location of the initial RCS pressure boundary failure, (b) the associated RCS condi-tions at the time of the initial pressure boundary failure, and (c) the RCS conditions at the time of reactor vessel lower head failure. Modeling was included to allow for the development of full loop, in-vessel, and hot leg countercurrent natu-ral circulation based on previous worlc. Natural circulation flows provided a mechanism for the po'tential generation of ex-vessel failures. Code calculations from accident initiation through the time of lower head failure were performed with and without hot leg countercurrent natural circu-lation, with and without RCP seal leakage, and with variations on some of the more important core damage progression parameters. Best-estimate parameters were used as inputs where there are data or where the effects of the parame-ters are understood. For parameters with a high degree of uncertainty, values were selected to minii;nize the time to lower head failure, produc-ing a conservative evaluation of the potential for HPME. It was assumed that there was sufficient plant air and battery power to operate the PORVs NUREG/CR-5949

Executive Summary throughout the transient. Furthermore, the po-tential for PORV failures as a result of extremes in temperature was not considered. Simple struc-tural models of the ex-vessel piping were includ-ed to track the potential for creep ruptures induced by the combined effects of elevated tem-perature and pressure. Any predicted ex-vessel failure was appropriately recorded, although an associated RCS blowdown was not simulated.

Instead, the code calculations were extended to lower head failure without RCS depressurization, providing an approach for estimating the possi-ble timing difference between all events.

Part two of the assessment was completed to provide inputs for an independent analysis ad-dressing the risk impact of intentional depressur-ization of the Surry NPP. Probabilistic risk assessment (PRA) techniques will be used to de-termine the risks of intentional depressurization compared with the risks that could be expected if plant operators take no action. RCS depressur-ization probabilities were evaluated based on current calculations for use in the risk analysis.

The specific issues considered included (a) the probability that an ex-vessel failure will occur and depressurize the RCS before lower head fail-ure and (b) the probability of being at a low RCS pressure at the time of lower head failure. The probabilities were not simply derived from the calculational results. Instead, uncertainties in the results were evaluated through sensitivity calcu-lations and the application of engineering judg-ment.

Six different SCDAP/RELAP5/MOD3 cal-culations were performed in the first part of the assessment. In the Base Case, full loop, in-vessel, and hot leg countercurrent natural circula-tion flows were considered. Those flows are con-sistent with conditions that could develop following TMLB' initiation without operator ac-tions. Hot leg countercurrent natural circulation was eliminated in Case 2 to minimize the core heatup time by minimizing ex-vessel heat trans-fer. Cases 3 through 6 were designed to account for all modes of natural circulation and the po-tential effects of RCP seal leakage. A leak rate of 21 gpm per RCP was introduced at TMLB' initiation, and higher leak rates were introduced NUREG/CR-5949 xiv at the time liquid in the RCPs reached saturation in those cases. The initial leak rate represented leakage associated with the loss of seal cooling, resulting from the loss of ac power. The higher leak rates represented the potential for failures associated with high-temperature, two-phase seal instabilities In Case 3, leakage was increased from 21 gpm per RCP to the most probable leak rate of 250 gpm at RCP saturation. In Case 4, the leak rate was increased to 480 gpm per RCP, repre-senting the maximum leak rate corresponding to failure of all seal stages. Case 5 was identical to Case 3 with the exception of how heat transfer from molten materials was treated during reloca-tion. In Case 3, molten materials were relocated to the lower head without heat transfer. In Case 5, molten materials were assumed to quench dur-ing relocation (up to the limit imposed by the amount of available water). Case 6 was identical to Case 4 with the exception of the treatment of fuel cladding deformation. In Case 4, it was as-sumed that deformation was limited to 2% due to

• an oxide buildup on the outer surface of the clad-ding before the onset of ballooning. In Case 6, the limit on cladding deformation was increased to 15%. The SCDAP/RELAP5/MOD3 results listed in Table ES-1 summarize the predicted re-sponse of the Surry NPP for all calculations per-formed in this assessment SCDAP/RELAP5/MOD3 results indicate that natural circulation of steam and steam flow through the pressurizer PORVs can induce creep rupture failures in the surge line and hot leg pip-ing before failure of the lower head when the RCS js not depressurized by leaks. Without RCS leaks, the RCS pressure is maintained by pressur-izer PORV cycling. During each valve cycle, en-ergy is transferred from the core to the surge line and hot leg piping. Hot leg countercurrent natu-i:al circulation is established between PORV cy-cles, which also transfer core decay heat to the hot legs. However, the surge line is heated to a failure condition before the hot legs because it is relatively thin. In all calculations performed, steam generator tubes were assumed to be free of defects. Given that assumption, failure of the steam generator tubes would not be expected in

Executive Summary Table ES-1. Summary of SCDAP/RELAP5/MOD3 results (in mlnutes).a Case Event Base 2

3 4

5 6

Core uncovery r

176.7 177.3 189.3 167.7 189.3 167.7 First fuel clad failure 235.5 206.0 220.5 197.3 220.5 205.2 Surge line failure 237.5 215.5 337.2

>463.3 337.2

>396.7 First hot leg failure 258.3 234.3 334.8

>463.3 334.8

>396.7 First fuel melting

• 278.3 253.0 241.8 234.8 241.8 345.0 First core relocation

• 480.8 257.8 403.3 426.0 403.3 383.8 Lower head failure 482.0 260.1 405.7 433.0 479.6 389.8 RCS pressure at lower 16.0 16.0 8.56 1.36 6.48 1.37 head failure (MPa)b

a. A greater-than sign (>) indicates that the event had not occurred by the end of the calculation at the indicated time.

b. Without credit for depressurizatiort that could occur following potential ex-vessel failures.

cases without RCS leaks because the circulating steam loses a significant amount of energy before reaching the steam generators, leaving the tubes relatively cool. Although the calculation was not performed, previous studies indicate that the RCS could be effectively depressurized from the PORV set point pressure before lower head fail-ure through either a surge line or hot leg breach.

If the RCS is not depressurized by leaks, surge line and hot leg failures can be expected before failure of the lower head even if hot leg countercurrent natural circulation is not estab-lished. Hot leg countercurrent natural circulation does provide an effective mechanism for the transfer of core decay heat to the ex-vessel pip-ing. If that heat sink is eliminated, heatup of the core and in-vessel structures will accelerate, with corresponding increases in steam temperatures.

Under these conditions, however, the surge line and hot leg will also be exposed to higher tem-peratures. As a result, both surge line and hot leg creep ruptures should be induced before failure of the lower head. Without hot leg countercur-NUREG/CR-5949 xv rent natural circulation, heating of the steam gen-erator tubes is minimal.

Surge line and hot leg failures can be expect-ed before failure of the lower head if, the RCS pressure is reduced below the pressurizer PORV set point by seal leaks of 250 gpm per RCP.

Surge line heating decreases when the RCP seal

~eaks reduce the RCS pressure below the PORV set point and the PORV cycling stops. However, ex-vessel heating continues as a result of hot leg countercurrent flow. Although the hot leg is rela-tively massive, it would be heated to a failure condition before the surge line because it is ex-posed to the highest-temperature steam leaving.*

the reactor vessel and because surge line heating is minimized when PORV cycling ends. If the steam generator tubes are free of defects, failure of the tubes would not be expected in cases with leaks of 250 gpm per RCP because they remain relatively cool.

A lower head failure would be the first breach of the RCS pressure boundary if the RCP seals leak 480 gpm per pump. The progression

'l*

• .\\:,

Executive Summary of core damage is accelerated as RCP seal leak-age increases. However, higher RCP leak rates also depressurize the RCS, allowing earlier accu-mulator injection, which can delay further core degradation. The most important aspect associ-ated with RCP seal leak rates, however, is the ef-fect on ex-vessel *heating. The total core decay energy is split into the portion that is deposited in the vessel and ex-vessel structures by circulating steam and the portion that is dissipated through RCP seal leaks. The results indicate that seal leaks of 480 gpm per RCP dissipate a relatively large fraction of core decay ene~y. leaving a rel-atively small fraction for ex-vessel h~ating. In fact, the results indicate that ex-vessel failures would occur beforp lower head failure with seal leaks of 250 gpm per RCP but would not be ex-pected with leaks as high as 480 gpm per RCP.

Debris/coolant heat transfer during molten relocation to. the lower head can significantly de-lay failure of the lower head. Minimum and maximum debris/coolant heat transfer options are the only debris/coolant heat transfer options currently available in SCDAP/RELAP5/MOD3.

With the minimum option, it is assumed that the debris relocates froril the core to the lower head in a coherent stream without heat transfer, which results in a rapid lower head thermal attack.

With the maximum option, it is assumed that the debris will breakup as a result of impact with wa-ter (and structures) in the lower plenum and low-er head. The code then calculates a complete quench of the debris, up to the limit imposed by the amount of coolant available. A large RCS pressurization can result during quench; howev-er, lower head thennal attack is delayed until the debris reheats. The calculations indicate that the delay could be more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Since the ex-pected result lies between those extremes, refine-ments in relocation modeling could be useful in future analyses.

Changes in defonnation associated with bal-looning of the fuel rod cladding can significantly change core damage progression and the time to lower head failure. With a ballooning deforma-tion limit of 15%, an accumulator injection com-pletely reflooded and significantly cooled the entire core before fonnation of a molten pool.

NUREG/CR-5949 xvi The accumulators were essentially emptied dur-ing the core reflood, which eliminated the possi-bility of effective cooling during the subsequent reheating. A relatively large relocation of'ap-proximately 44370 kg of molten U02 occurred as a result. With a defonnation limit of 2%, peri-odic accumulator injection provided only partial cooling of the core hot spots. However, the par-tial cooling occurred over a prolonged period and was sufficient to delay relocation, which consist-ed of about 12940 kg of molten U02. The delay in relocation produced a corresponding delay in lower head failure of 43.2 minutes (compared to the higher defonnation case).

The SCDAP/RELAP5/MOD3 results were reviewed to identify potential uncertainties that could affect the predicted response of the Surry NPP. The review focused on uncertainties that could affect the timing of the RCS pressure boundary failures because that timing is critical in this assessment of the potential for HPME.

Uncertainties in (a) the current oxidation 1:11odels in the code, (b) the core decay power, (c) the initial steam generator liquid inventory, and (d) the nature and rate of core damage progres-sion tend to accelerate or delay both ex-vessel failures and lower head failures. For example, the current version of SCDAP/RELAP5M,OD3 only calculates oxidation of the zircaloy cladding of in-core components, which is tenninated as soon as rod-like geometry is lost As a result, the rate of core heatup could be underpredicted in the current calculations because the oxidation re-actions are exothennic. If core heatup is under-p redi c te d, core and circulating steam temperatures will be underpredicted. Therefore, the timing of both lower head and ex-vessel fail-ures could be delayed by the current treatment of oxidation in the code. A more detailed treatment of oxidation would be expected to accelerate both lower head and ex-vessel failure times with-out a significant change in the relative timing be-tween the events.

Uncertainties in (a) the treatment of in-core crust heat transfer; (b) the :fl.ow and heat transfer characteristics of a degraded core, particularly during accumulator injections; (c) natural circu-

lation flow and heat transfer; and (d) the effects of repressurization resulting from vapor pro-duced during accumulator injection and during molten relocation to the lower head tend to change the time of ex-vessel failures relative to the time of lower head failure. For example, if the heat transfer from the molten pool to the in-core crust is overpredicted, relocation and lower head failure could occur earlier than expected relative to predicted ex-vessel failures.

Sensitivity calculations were perfonned and engineering judgment was applied in an a~mpt to account for the potential effects of the uncer-Executive Summary tainties in the SCDAP/RELAP5/MOD3 calcula-tions. The results of that effort are reflected in the RCS depressurization probabilities listed in Tables ES-2 and ES-3 for (a) TMLB' sequences without RCP seal leaks (at full system pressure),

(b) TMLB' sequences with seal leaks of 250 gpm per RCP, (c) TMLB' sequences with seal leaks of 480 gpm per RCP, and (d) TMLB' sequences with stuck-open/latched-open PORVs.

There is a low probability for an HPME in the Surry NPP during TMLB' sequences without operator actions based on the results listed in the tables. In scenarios (a), (b), and (d), natural cir-Table ES-2. Probaqilities of the surge line/ hot leg failure issue given the occurrence of the specific sce-narios in the Surry NPP.

Scenario TMLB' sequences without RCP seal leaks TMLB' sequences with seal leaks of 250 gpm per RCP TMLB' sequences with seal leaks of 450 gpm per RCP

'fMLB' sequences with stuck-open/latched-open PORVs Probability 0.98 0.98 0.0 1.0 Table ES-3. Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific scenarios without ex-vessel failures in the Surry NPP.

Scenario TMLB' sequences without RCP seal leaks)

TMLB' sequences with seal leaks of 250 gpm perRCP TMLB' sequences with seal leaks of 450 gpm perRCP TMLB' sequences with stuck-open/latched-open PORVs Probability, at vessel breach, for HighRCS lntennediate Low RCS pressure RCS pressure pressure

(> 6.89 MPa)

(1.38 - 6.89 MPa)

(<1.38 MPa) 1.0 0.0 0.0 0.21 0.75 0.04 0.13 0.40 0.47 0.0 0.0 1.0 xvii NUREG/CR-5949

Executive Summapr culation* and flow through the PORVs led to surge line and/or hot leg failures before failure of the lower head without any required operator ac-tion. After accounting for uncertainties in the calculated results, it was concluded that RCS pressure reduction below 1.38 MPa would occur through the ex-vessel breach before lower head failure with a high probability._ Specifically, probabilities for a surge line or hot leg failure with RCS depressurization below 1.38 MPa be-fore lower head failure were assigned values of 0.98, 0.98, and 1.0, given the occurrence of sce-narios (a), (b), and (d), respectively.

An ex-vessel failure was not calculated be-fore lower head failure in (c). For that reason, the probability of a surge line or hot leg failure with RCS depressurization below 1.38 MPa be-fore lower head failure was assigned a value of 0.0. However, the probability of being at or be-low 1.38 MPa at the time of lower head failure (without an ex-vessel failure) was estimated to be 0.47. In addition, the probability of seal leaks as large as 480 gpm per RCP is very small. In other words, the results associated with scenario (c) would be relatively unlikely. Therefore, there is a low probability for an HP:ME during TMLB' sequences in the Surry NPP.

NUREG/CR-5949 xviii The assessment contained in this report was based on a detailed SCDAP/RELAP5/MOD3 analysis to determine the Surry NPP response during a TMLB' transient without operator ac-tions and the corresponding potential for HP:ME.

Therefore, the conclusions of this assessment are specific to the Surry NPP. Evaluation of the ap-plicability of the results to other plants was out-side the scope of this program. However, some of the factors that would have to be considered include the capacity of the pressurizer PORVs; the decay heat level; the accumulator capacity and initial pressure; the steam generator size, type, and initial liquid inventory; and the geome-tries of the hot leg, surge line, and upper plenum region of the reactor vessel. Those factors are important because they could influence core damage progression and the natural circulation of steam throughout the plant. Without operator actions, natural circulation provides the required mechanism for generating ex-vessel failures.

The timing of the ex-vessel failures relative to core damage progression determines the poten-tial for HPME. Therefore, a plant-specific un-derstanding of natural circulation and its relationship to core damage progression would be required to extend the results to other NPPs.

ACKNOWLEDGMENTS The authors would like to thank the sponsor of this work, Dr. Frank Odar of the U.S. Nuclear Regula-tory Commission, for his guidance and support through completion of the project. Tochnical review and comments offered by Dr. C. M. Allison (INEL), Mr. D. J. Hanson (INEL), Mi. E. A. Harvego (INEL), and Mr. L. J. Siefken (INEL) were also appreciated. Dr. S. E. Dingman (SNL) and Mr. D. L. Kelly (INEL) pro-vided valuable contributions to and comments on the probabilistic risk assessment aspects of this work.

And, finally, a special thank you is due Ms. N. L. Wade (INEL) for her dedication and support in comple-tion of this manuscript.

xix NUREG/CR-5949

Introduction ASSESSMENT OF THE POTENTIAL FOR HIGH-PRESSURE MELT EJECTION RESULTING FROM A SURRY STATION BLACKOUT TRANSIENT

1. INTRODUCTION Molten core materials could be ejected by a high-pressure reactor coolant system (RCS) fol-lowing reactor vessel lower head failure during certain severe accidents. A rapid rise in contain-ment temperature and pressure, or direct contain-ment heating (OCH), could result from the high pressure melt ejection (HPME) into the contain-ment building. In a sever~ case, the pressuriza-tion and associated challenge to containment integrity could lead to a significant increase in ra-diological risks.

Intentional depressurization of the RCS has been proposed as an accident management strate-gy to mitigate the severity of HPME, thereby re-ducing the risks in cases where cooling water is unavailable for either primary or secondary feed-and-bleed operations. In this strategy, plant op-erators latch pressurizer power-operated relief valves (PORVs) OP,en to reduce the RCS pressure and mitigate the effects of HPME. Risk reduc-tion is expected, since the potential for contain-ment failure as a result of OCH should be minimized if HPME can be mitigated. However, decay heat levels, valve capacities, and other plant-specific characteristics determine whether the required operator action will lead to an effec-tive RCS depressurization. Analyses have been completed that in~icate intentional depressuriza-tion could be a viable method for mitigatiny HPME in the Surry Nuclear Power Plant (NPP).

Subsequent analyses indicate that intentional de-pressurization could also be effective for many other pressurized water reactors (PWRs).2 Without operator action, natural circulation flows could develo'I, following accident initiation and reactor coolant pump (RCP) coastdown. A previous analysis of the Surry NPP identified the significance of full loop, in-vessel, and hot leg countercurrent natural circulation modes with re-1 spect to severe accident progression.3 Ex-vessel RCS pressure boundaries (surge line and hot leg piping, steam generator tubes, etc.) could be heated by the natural circulation of high-temperature steam to the point of failure before failure of the lower head. Under these condi-tions, depressurization through the ex-vessel pressure boundary breach could then occur with-out operator action. Thus, unintentional depres-surization could provide an alternate way to minimize the potential for OCH by mitigating HPME.

This report contains an assessment of the po-tential for HPME resulting from a severe reactor accident. The assessment was limited to evalua-tion of a station blackout scenario in the Surry NPP. The station blackout scenario was selected because it is the single largest contributor to the frequency of core damage for the Surry NPP.4 (HPME is of concern only in scenarios that could lead to core melt.) The Surry NPP was selected because information needed to complete the evaluation was readily available. (The selections were also influenced by the number of related and supporting studies that have been per-formed.) A two-part approach was used to com-plete this assessment, including (a) a detailed SCOAP/RELAP5/M0035 analysis 6f a station blackout scenario without operator action and without r~covery and (b) an evaluation of depres-surization~related probabilities.

The objectives of the SCOAP/RELAPS/

M003 analysis were to quantify the (a) time and location of the initial RCS pressure boundary failure, (b) associated RCS conditions at the time of initial pressure boundary failure, and (c) RCS conditions at the time of reactor vessel lower head,failure. Modeling based on previous work.3 was included to allow for the development of NUREG/CR-5949

Introduction natural circulation. Natural circulation flows provided a mechanism for the potential genera-tion of ex-vessel failures. Code calculations from accident initiation through the time of low-er head failure were performed with and without hot leg countercurrent natural circulation, with and without RCP seal leakage, and with varia-tions on some of the more important core dam-age progression parameters. Be~;t-estimate parameters were used as inputs where there were data or where the effects of the parameters were understood. For parameters with a high degree of uncertainty, values were selected to minimize the time to lower head failure, producing a con-servative evaluation of the potential for HPME.

It was assumed that there were sufficient plant air and battery power to operate the PORVs through-out the transient. Furthermore, the potential for PORV failures as a result of extremes in tempera-ture was not considered. Simple structural mod-els of the ex-vesseJ piping were included to track the potential for creep ruptures induced by the combined effects of elevated temperature and pressure. Any predicted ex-vessel failure was ap-propriately recorded, although an associated RCS blowdown was not simulated. Instead, the code calculations were extended to lower head failure without RCS depressurization, providing an approach for estimating the possible timing.

difference betwe~n all events.

The objective of the second and final part of the assessment was to provide input for an inde-pendent analysis addressing the risk impact of in-NUREG/CR-5949 2

tentional RCS depressurization of the Surry NPP.

The risk impact is being studied in support of an Accident Management Program sponsored by the U.S. Nuclear Regulatory Commission (NRC). Probabilistic risk assessment (PRA) techniques will be used to determine the impact by comparing the risks of intentional depressur-ization with the risks that could be expected if plant operators take no action. Probabilities of RCS depressurization-related issues were evalu-ated based on current calculations for use in the risk analysis. The specific depressurization is-sues considered included (a) the probability that an ex-vessel failure will occur before lower head failure and (b) the probability of being at a low RCS pressure at the time of lower head failure.

A description of the approach used to com-plete the two-part assessment is provided in Sec-tion 2. Pertinent details are provided with respect to the station blackout scenario, modeling of the Surry NPP with SCDAP/RELAP5/MOD3, and assumptions used in performing the code calculations. A description of the method and basis for evaluation of the RCS depressurization-related probabilities is also included. SCDAP/

RELAP5/MOD3 results for all calculations per-formed in the first part of the assessment are de-scribed in Section 3. Section 4 contaips resulting probabilities for the depressurizatiori-related is-sues. Co1f].clusions and recommendations based on this assessment of the potential for HPME are given in Section 5.

Assessment Approach

2. ASSESSMENTAPPROACH A two-part approach was followed in com-pleting this assessment. In the first part, a de-tailed SCDAP/RELAP5/MOD3 analysis of a station blackout scenario without operator ac-tions was performed. In the second part, proba-bilities associated with depressurization-related issues were evaluated. Both parts are described in the following sections.

2.1 SCDAP/RELAP5/MOD3 Analysis The SCDAP/RELAP5/MOD3 computer code was used to calculate the transient response of the Surry NPP during a station blackout sce-nario without operator actions. SCDAP/RE-LAP5/MOD3 is an integrated code package designed for reactor accident analysis. Simula-tion of thermal-hydraulics, heat transfer, severe core damage, and :fission product transport are supported. A more detailed description of the code is provided in Appendix A.

• A station blacJc_out scenario was modeled in all SCDAP/RELAP5/MOD3 calculations be-cause it is the single largest contributor to the fre-quency of core damage for the Surry NPP. The specific station blackout sequence selected for analysis is designated TMLB'. This sequence is initiated by the loss of offsite power. Onsite ac power is also unavailable because the diesel gen-erators fail to start or fail to supply power. De-cay heat removal through the steam generators cannot be maintained in the long term because there is no ac power' for the electrical pumps, and the steam driven auxiliary feedwater pumps also fail to supply water.

When the TMLB' sequence begins, power is lost to the control rod drives and pumps. A reac-tor scram follows, with coastdown of the main feedwater pumps and RCPs. Feedwater is quick-ly reduced to zero as the main feedwater valves close. The turbine stop valves close, and the pressure in the steam generators increases until the relief (or dump) valves open. Steam genera-tor pressures are maintained between the opening 3

and closing pressures of the relief valves thereaf-ter. Water in the steam generator secondaries is completely vaporized, as heat is transferred from the RCS to the steam generators. Once water in the steam generator secondaries is depleted, the steam generators no longer remove significant amounts of heat. Core decay energy then heats the RCS, resulting in system pressurization con-trolled by cycling pressurizer PORVs. The RCS pressure can also be influenced by RCP seal leaks, which could develop following the loss of seal cooling water associated with the loss of ac power. After the RCS saturates, a high-pressure boiloff begins, ultimately leading to core uncov-ery and heatup. Without recovery of power or equipment, the transient proceeds to severe core damage and melting.

The Surry NPP was selected for t111alysis be-cause the pertinent information required to com-plete this assessment was readily available. The Surry NPP is a Westinghouse-designed PWR with a rated thermal power of 2441 MW. The core consists of 157 15x15 assemblies with an active fuel height of 3.66 m. There are three pri-mary coolant loops. Each loop contains a U-tube steam generator, an RCP, and associated piping.

A single pressurizer is attached to the hot leg-pip-ing in one of the three loops. 1\\vo PORV s, with a

• combined capacity of 45.1 kg/s, can be used to relieve excess RCS pressure from the top of the pressurizer. One accumulator, with 29,100 kg of

~22-K borated water pressurized to 4.24 MPa by a nitrogen cover gas, is attached to each cold leg.

[Accumulators are the only operational part of the emergency core cooling system (ECCS) dur-ing a TMLB' sequence.] A subatmospheric con-tainment building surrounds the reactor syi,tems.

Six different SCDAP/RELAP5/MOD3 cal-culations for the Surry NPP were performed in this part of the assessment. It was assumed that there were sufficient plant air and battery power to operate the PORVs throughout all calcula-tions. The potential for other PORV failure modes was not considered. Models were includ-ed in all calculations to track the potential for NUREG/CR-5949

Assessment Approach creep ruptures in the ex-vessel piping. As previ-ously noted, all predicted ex-vessel failures were appropriately recorded, although an associated RCS blowdown was not modeled. Extending the code calculations to lower head failure without RCS depressurization provided a way to estimate the possible timing difference between all events.

In the Base Case, full loop, in-vessel, and hot leg countercurrent natural circulation flows were considered. Those flows are consistent with con-ditions that could develop following TMLB' ini-tiation without operator actions. Although hot leg countercurrent natural circulation is expect-ed, uncertainties exist with respect to :flow mag-nitude and the effectiveness of heat transfer to ex-vessel structures. Based on those uncertain-ties, hot leg countercurrent natural circulation was eliminated in Case 2. As a result, Case 2 represents a bounding calculation where ex-vessel heat transfer is minimized (which should reduce the time to reactor vessel failure). Cases 3 through 6 were designed to account for full loop, in-vessel, and hot leg countercurrent natu-ral circulation, along with the potential effects of RCP seal leakage.

Under normal operating conditions, high-pressure systems S¥PP1Y cooling water flow to the seals to offset aidesign leak rate of approxi-mately 3 gpm per RCP. However, the loss of all ac power results in a loss of seal cooling water.

Without cooling water, leak rates increase as RCP seal temperatures increase. Leak rates of21 gpm per RCP have been calculated for intact RCP seals subjected to nonnal RCS temperatures and pressures.6 Leak rates will obviously be higher if one or more of the three seal stages in a Westinghouse RCP fail. The primary factors affecting seal be-havior during a TMLB' sequence are high-temperature survivability and the potential for hydraulic instability under two-phase flow condi-tions. 7 High-temperature survivability involves the potential for 0-ring degradation and blowout.

Hydraulic instability is relate,d to evidence sug-gesting that flashing could cause one or more of the seal stages to pop open. Unfortunately, the prediction of failure of any particular seal stage (which leads to a particular leak rate) is not NUREG/CR-5949 4

straightforward. For that reason, a panel of ex-perts was assembled to make a probabilistic de-termination of RCP leak rates in Westinghouse PWRs during a station blackout. 8 [The resulting expert opinions were used in a comprehensive PRA of the Surry NPP (and four other NPPs in the United States), as documented in NUREG-1150.9] The panel concluded that the highest probability leak rate was 250 gpm per RCP, while the maximum leak rate (at a low probabili-ty) was 480 gpm per RCP. 8 (A leak rate of 480 gpm per RCP is consistent with failure of all three_ seal stages in a Westinghouse RCP. 6)

Based on results from the experts~ a leak rate of 21 gpm per RCP was introduced at TMLB' initiation in Cases 3 through 6 to represent leak-age associated with the loss of seal cooling. In Case 3, leakage was increased from 21 to 250 gpm at the time water in the RCP reached satura-tion temperature to account for potential two-phase instabilities. In Case 4, the maximum leak rate of 480 gpm per RCP was introduced at the time of RCP saturation. This case provides in-formation on the depressurization rate and its po-tential impact on HPME.

Case 5 was identical to Case 3 except for the way heat transfer from molten materials was treated during relocation. In Case 3, it was as-sumed that molten materials would remain intact during relocation from the core to the low~r parts of the reactor vessel. This approach minimizes heat,Ioss from the debris so that a relatively rapid thennal attack on the, reactor vessel can follow.

In contrast, it was assumed in Case 5 that molten materials would break up during relocation. This break-up could occur as a result of the molten material pour interacting with vessel structures and with water below the core. However, the break-up of molten materials maximizes heat transfer from the debris, which delays attack on the reactor vessel until the debris has time to re-heat Case 6 was identical to Case 4 except for the treatment of fuel cladding defonnation. In Case 4, it was assumed that defonnation was limited to 2% because of an oxide buildup on the outer sur-face of the cladding b~fore the onset of

ballooning. The oxide layer is relatively strong but less ductile than the underlying zircaloy. As a result, oxidized cladding tends to fracture at small deformations, leading to earlier oxidation of the inner cladding surfaces with the potential for earlier core heatup associated with the exo-thennic reaction. In contrast, the limit on clad-ding defonnation was increased from 2% to 15%

in Case 6. This defonnation provides a potential for larger in-core fl.ow blockage, which could af-fect core heatup by reducing convective heat transfer to the steam :flow (driven by natural cir-culation). In addition, core heatup could in-crease, because the surface area available for oxidation increases with deformation.

Appendix B contains a detailed oescription of the SCDAP/RELAP5/MOD3 model of the Surry NPP that was used to complete the six cal-culations. The rem4ining information in this sec-tion is provided to clarify the di:ff erences among the six calculations.

Trip valves were used to represent RCP seal leaks in the SCDAP/RELAP5/MOD3 model.

The relationship between transient time and trip valve :flow areas used in the subj~ct calculations is summarized in Table 1.

SCDAP input is required to define certain parameters that control severe core damage pro-gression. In general, best-estimate parameters were selected where there were data or where the effects of the parameters were understood. For parameters with a high degree of uncertainty, values were selected to minimize the time to lower head failure. This approach provides the basis for a conseivative evaluation of the poten-tial for HPME, since time is minimized for gen-

. eration of an ex-vessel failure by natural convection heating and for RCS inventory deple-tion. The resulting parameter set is listed in Ta-ble 2. The following discussion outlines the logic used to establish these values.

A temperature must be input to specify the cooling required to fragnient core components during a quenching process. The expected range is from (Tsat + 100) K to 1273 K. As indicated in Table 2, a core fragmentation temperature of 5

Assessment Approach 1273 K was used in all cases. Since less cooling is' required, this input could lead to a relatively early fragmentation of the core. As a result, core heatup, relocation of molten materials to the low-er head, and lower head failure could also occur relatively early.

• Debris formation during core degradation re-sults in a flow restriction, leading to core heatup.

As indicated in Table 2, the minimum :flow area through cohesive debris was set to 11 % of the nominal flow area in all cases. At values of 10%

and less, SCDAP/RELAP5/MOD3 sets the flow area to zero. However, a flow area of zero corre-sponds to coplanar blockage, which has not been obseived in limited test data. On that basis, 11 %

represents the maximum flow restriction consis-

.tent with current understanding. By maximizing

the flow restriction, core heatup and lower head failure should occur relatively early.

The Zr02 failure temperature controls when oxidized cladding will fail, provided that the ox-ide layer is less than the specified durable thick-ness. The failure temperature can vary between the 'melting points of Zr (2023 K) and Zr02 (2963 K). A value of 2400 K was used in all cas-es, as recommended by the SCDAP code devel-opment staff.

Durable thickness is represented by *the frac.:...

tion of oxidation necessary for the cladding to withstand attack by molten Zr. Once the durable

,thickness is reached, the oxidized cladding will remain intact until the Zr02 is heated to the spec-ified failure temperature (2400 K in this analy-sis). As a result, higher values tend to promote earlier relocation. On that basis, the Zr02 was assumed to be durable only if completely (100%)

oxidized, as indicated in Table 2.

SCDAP inputs are required to specify (a) the length of time required for a molten pool to drain from the core into the lower head, (b) the length of time required for individual rods to slump, and (c) the lengths of time over which in-core area and volume changes occur as a result of core damage. The subject calculations should not be sensitive to any of those time inteivals. Howev-er, results from scoping calculations indicated NUREG/CR-5949

Assessment Approach Table 1. Parameters for simulation ofRCP seal leaks.

Case Time RCP seal parameters 1

2 3

4 5

6 From TMLB' initia-Leak flow area = 0.0 X

X tion to lower head (Basis: no ~.CP seal leakage) failure From TMLB' initia-Leak flow area= 8.77E-6 m2 X

X X

X tion to RCP satura-(Basis: 21 gpm per RCP at 561 K, 15.5 MPaa) tion From RCP saturation Leak flow area = 1.50E-4 m2 X

X to lower head failure (Basis: 250 gpm per RCP of saturated. liquid at 16.0 MPa0)

From RCP saturation Leak flow area= 2.88E-4 m2 X

X to lower head failure (Basis: 480 gpm per RCP of saturated liquid at 16.0 MPac)

a. For intact RCP seals at operating temperatures corresponding to the loss of seal cooling at TMLB' initiation.6

b. Highest probability leak rate8 at the average pressure during PORV cycling.

c. Maximum leak rate, corresponding to failure of all three seal stages6*8 at the average pressure during PORV cycling.

Table 2. SCDAP severe core damage parameters Case SCDAP severe core damage parameter 1

2 3

4 5

Fragmentation temperature during quenching: 1273 K X

X

• x X

X Minimum cohesive debris flow area: 11 % of nominal X

X X

x.

X Zr02 failure temperature: 2400 K X

X X

X X

Zr02 durable thickness: 100%

X X

X X

X Molten pool relocation time interval: 68 s X

X X

X X

Debris to vessel thermal resistance: 0.0001 m2-K/W X

X X

X X

Cladding rupture strain: 2%

na na X

X X

Oadding rupture strain: 15%

na na Threshold strain for double-sided oxidation: 1%

na na X

X X

Intact stream of liquefied debris during relocation to lower head X

X X

X (resulting in minimum debris/coolant heat transfer)

Breakup of stream of liquefied debris during relocation to lower head X

(resulting in maximum debris/coolant heat transfer)

NUREG/CR-5949 6

6 X

X X

X X

X X

X X

that the default molten pool relocation time inter-val (10 seconds) car~ lead to code execution prob-lems, especially 1 when debris breakup is assumed. For that reason, the length of time for molten pool relocation was set to 68 seconds in all cases, as indicated in Table 2. This time value was based on an estimate that the entire core in Westinghouse NPPs could be relocated to the lower head in as little as 425 seconds.8 The esti-mate was made by accounting,for the gravity head of the molten pool and the size of passages through lower head structures. In these calcula-tions, individual channel relocation times could vary from 68 to 260 seconds based on simple scaling by the number of assemblies per channel.

The minimum relocation time interval was se-lected consistent with the effort to minimize the time to lower head failure.

, A thennal contact resistance must be input to characterize heat transfer between relocated core materials and the lower head vessel wall. Near-perfect (conduction-limited) thermal contact might be possible at the time molten core materi-als first make contact with the lower head. How-ever, considerable resistance could be postulated between solidified debris and the lower head.

Because the possible range is large, variable, and not easily quantified, the thennal contact resis-tance. between relocated materials and theJower.

head was set to 0.0001 m2-K/W in all cases, as indicated in Table 2. This value should be small enough to approximate molten contact. In addi-tion, application of the value for all other condi-tions is consistent with the effort to minimize the time to lower head failure.

Ballooning of the fuel rod cladding can occur if the internal pin pressure exceeds the external (RCS) pressure. Ballooning does not occur in the Base Case or in Case 2 because the RCS pressure is controlled throughout the transient between the opening and closing set points of the PORVs, which are well above the internal pin pressures. However, ballooning can occur in Cases 3 through 6 following RCS depressuriza-tion through RCP seal leaks. For these cases,

a. Unpublished research by J. L. Rempe on light water reactor lower head failure analysis.

7 Assessment Approach

'.SCDAP input is required to define the cladding defonnation associated with ballooning.

Cladding defonnation is a function of the ox-ide thickness relative to the onset of ball9oning.

If ballooning begins before the cladding is heated to,200 K, any oxide layer will be negligible.

According to the* S~DAP code de.velopment staff, significant ballooning can occur before rup-ture in unoxidized cladding. However, a signifi-cant oxide layer will be established if the heatup rate is slow(< 1 K/s), and ballooning does not begin before the cladding reaches 1300 K. Un-der those conditions, deformation is controlled by the oxide layer because it is stronger than the underlying zircaloy. Because the oxide layer is relatively brittle, however, rupture will occur at relatively small defonnations of 2% (orless).

Results from scoping calculations indicated that the small deformation criteria should apply for seal leak rates of 250 gpm per RCP. On that basis, a cladding rupture strain of 2% was as-sumed in Cases 3 and 5 (see Tables 1 and 2).

More significant-ballooning could be expected, based on scoping calculations, for Cases 4 and 6

.(with seal leaks of 480 gpm per RCP). However, Case 4 calculations were also perfonned with a

• • *ruprure strain of 2%. This allows a*direct com:. ***

parison with Case 3 to assess the effects associat-ed with seal leak rates only. In Case 6, a rupture strain corresponding to cladding deformation of 15% was assumed, with the understanding that extensive ballooning could occur in localized ar-eas of the core. As discussed in Appendix B, however, the total number of fuel pins in the Sur-ry NPP was divided into three groups. All fuel pins within each group are assumed to respond similarly in SCDAP/RELAP5/MOD3. Accord-ing to the SCDAP code development staff, it would be unreasonable to expect the average de-formation (over a large number of fuel pins) to exceed 15%. The selected value is assumed to be near the upper limit of the average deformation that could be expected. (As previously ex-plained, neither of these inputs apply to the Base Case or Case 2 because high RCS pressures pre-clude ballooning.)

NUREG/CR-5949

Assessment Approach If the cladding balloons and ruptures, the in-ner cladding surfaces may be oxidized (along with outer cladding surfaces) as a result of expo-sure to high-temperature steam. SCDAP re-quires input to define the threshold deformation for onset of this double-sided oxidation. As indi-cated in Table 2, double-sided oxidation is not applicable in the Base Case or in Case 2 (since high RCS pressure prevents ballooning). For Cases 3 through 6, however, double-sided oxida-tion was assumed following cladding rupture at all rod locations with defonnations of at least 1%.

Molten materials may pour from the core to the lower head in a coherent stream, or the pour may be broken up as a result of interactions with vessel structures and water below the core. In general, breakup results in quenching the debris, with a corresponding pressurization that results from associated vapor production. The quenched debris will then have to reheat before an effective lower head thermal attack can begin. On the oth-er hand, heat transfer to the coolant is minimized and thermal attack on the lower head is maxi-mized if the debris remains intact. Consistent with the effort to minimize the time to lower head failure, intact debris relocation was as-sumed in Cases 1 through 4 and Case 6, as indi-cated in Table 2. Because debris breakup is a significant possibility and because breakup pro-duces a pressurization that could affect the HPME potential, debris breakup was the as-sumed sensitivity parameter in Case 5.

2.2 Probability Evaluation Intentional depressurization of the RCS be-fore reactor vessel breach has been proposed as an accident management strategy to mitigate the severity of HPME in PWRs. The strategy, where plant operators latch pressurizer PORV s open, is expected to reduce the risks associated with PWR operation because the potential for contain-ment failure as a result of DCH should be mini-mized if HPME Cjln be mitigated. The strategy could be employed in cases where strategies in-tended to prevent core damage are not possible (i.e., where cooling water is unavailable for ei-NUREG/CR-5949 8

ther primary or secondary feed-and-bleed opera-tions).

An independent analysis is planned to deter-mine the risk impact associated with intentional depressurization of the Surry NPP. The analysis

. is needed to support an NRC Accident Manage-ment Program. PRA techniques will be used to determine the impact by comparing the risks of intentional depressurization with the risks that could be expected if plant operators take no ac-tion. Specifically, the 1isk analysis will be based on the probabilities of issues associated with both intentional and unintentional RCS depres-surization. Issue probabilities for intentional and unintentional RCS depressurization will be eval-uated in this assessment, as discussed below.

Issues that required evaluation in order to complete the risk analysis were determined through examination of the accident progression event tree (APET) developed for use in NUREG-1150. 9 Specifically, the APET was examined to compile a list of those RCS depressurization-related issues that have the largest influence on the risk results. The list included two issues that could be affected by the current SCDAP/RE-LAP5/MOD3 analysis (and other related analy-ses completed after NUREG-1150). These issues are expressed as follows

1. What is the probability that the surge line or hot leg will fail and depressurize the RCS to a low pressure before lower head failure?

2. What are the probabilities of being at a low, intermediate, and high RCS pres-sure at the time of reactor vessel breach?

(Consistent with NUREG-1150, low, intermedi-ate, and high RCS pressures were taken to be pressures below 1.38 MPa, pressures between 1.38 and 6.89 MPa, and pressures above 6.89 MPa, respectively.)

Probabilities associated with the two depres-surization issues were originally quantified by a NUREG-1150 in-vessel expert panel for Surry TMLB' sequences both with and without RCP seal leaks. (A third scenario was postulated,

consisting of a TMLB' sequence with RCP seal leaks and operational auxiliary feedwater sys-tems. However, the scenario was eliminated from consideration in NUREG-1150 based on the assumption that the availability of feedwater would reduce the probabilities for core melting and RCS depressurization through a surge line or hot leg failure.)

This part of the subject assessment was per-formed to update the probabilities associated with the identified issues based on current analy-ses. A better estimate of the risk associated with intentional depressurization is anticipated through use of the updated results. Like NUREG-1150, probabilities for both RCS de-pressurization issues will be (re)quantified for TMLB' sequences with and without RCP seal leaks. In addition, the potential for RCS depres-surization during a TMLB' sequence with a stuck-open or latched-open PORV was recog-nized. Therefore, probabilities for both issues will also be quantified for that sequence. Issue probabilities developed for the TMLB' sequence with the latched-open PORV will be used to de-termine risks associated with intentional depres-surization. Risks associated with unintentional depressurization will be based on issue probabili-ties developed for the remaining TMLB' se-quences. (Obviously, the resulting probabilities 9

Assessment Approach will be conditional on the occurrence of the vari-ous TMLB' sequences as described.)

The approach used to evaluate the issue probabilities was closely patterned after the ex-pert elicitation method followed in completion of NUREG-1150. In general, the issues were first decomposed ( or separated) into parts that were easier to evaluate; end-point probabilities were established for each part; a distribution was as-sumed between the end points; and the resulting distributions were recombined to arrive at a probability for the issue. However, establishing the end-point probabilities was the key to the whole process. The end points were not simply derived from the available calculational results.

Instead, the results were used as a basis for fur-ther evaluation. In some cases, engineering judgments were made to assess the magnitude of potential uncertainties in the results. In other cases, potential uncertainties were addressed by completing sensitivity calculations using SCDAP/RELAP5/MOD3.

In addition to evaluation of the issue proba-bilities, timing information from the current SCDAP/RELAP5/MOD3 calculations was also needed to update ac recovery probabilities in the APET. The necessary information was directly calculated during the SCDAP/RELAP5/MOD3 analysis and is documented in this report.

NUREG/CR-5949

Calculation Results

3. CALCULATION RESULTS A SCDAP/RELAP5/MOD3 analysis of Sur-ry NPP behavior during a TMLB' sequence with-out operator action and without recovery was completed. Results from that analysis, which comprised six different cases, are described in this section. Uncertainties and limitations asso-ciated with the results are also discussed.

Steady-state initialization of the complete SCDAP/RELAP5/MOD3 model was required before making any of the transient calculations described. below. Steady-state initialization in-volved bringing the model to stable conditions representing full-power operation of the Surry NPP, which provided a starting point for each case. Initialization was considered acceptable when conditions matched the steady-state results used in a previous study of the plant.3 A summa-ry of the steady-state results is given in Appendix C. Run-time statistics for all SCDAP/RELAP5/

MOD3 calculations that were performed in this analysis are compiled in Appendix D.

3.1 Base Case

• The Base Cast calculation included provi-

. sions for full loop, in-vessel, and hotleg counter-**

current natural circulation flows with initial and

• boundary conditions identical to those used in a previous study3 for a TMLB' sequence without RCP seal leaks. The Base Case differed from the previous study in the code version used (SCDAP/RELAP5/MOD3 versus SCDAP/RE-LAP5/MOD0) and in the end point of the calcu-lation (lower head failure versus initial fuel rod relocation). Completion of the Base Case was necessary because df those differences. As dis-cussed in Appendix E, Base Case results were compared to the results from the previous study to benchmark the code version and model before completing the other calculations described in

• this section. In the benchmark calculation,

• MOD3 events were found to occur somewhat (but not significantly) earlier than in MODO. The differences appear to be consistent with model improvements that have been implemented in the later code version.

11 The sequence of events from TMLB' initia-tion through creep rupture failure of the lower head for the Base Case is listed in Table 3. The table contains quantitative information that should be helpful in understanding the following description of the calculation. (Selected core damage results for this case, and all other cases considered in this analysis, are tabulated in Ap-pendix F for reference.)

Following transient initiation, decay heat was transported from the core to the steam gener-ator secondaries by full loop natural circulation in all three primary coolant loops. As the water in the steam generator secondaries boiled off, the energy removed from the RCS by the steam gen-erators *dropped below the decay energy being added in the core; and the RCS began to heat up and pressurize. The pressurizer PORVs con-trolled the RCS pressurization by cycling be-tween the opening and closing set points of 16.2 and 15.7 MPa, respectively. Boiling in the core began at 115.0 minutes. Vapor generated during the boiling collected in the top of the steam gen-erator U-tubes, terminating full loop natural cir-culation at 122.2 minutes. Venting of coolant by

• the pressurizer PO RVs reduced the RCS* liquid inventory, which uncovered the top of the core at 145.0 minutes, initiating core heatup and super-heating of RCS vapor. The core was completely uncovered by 176.7 minutes, with rapid oxida-tion of the fuel cladding commencing at 180.7 minutes. Cyclic flow through the pressurizer PORV (to control RCS pressure) and hot leg countercurrent natural circulation removed decay energy from the core, producing a heatup of the hot leg and pressurizer surge line piping. This ex-vessel heatup resulted in a predicted creep rupture failure of the pressurizer surge line at 237.5 minutes. As previously explained, howev-er, a blowdown was not modeled following surge line failure or any other RCS pressure boundary failure. Instead, the calculation was allowed to proceed without RCS depressurization to deter-mine the timing of all other events. Consistent with that approach, creep rupture failures of the hot leg nozzles were predicted between 258.3 NUREG/CR-5949

Calculation Results Table 3. Sequence of events for the Base Case.

Event TMLB' initiation Steam generator dryout (pressurizer/nonpressurizer loops)

Initial cycle of pressurizer PORV Pressurizer filled with liquid Core saturation Full loop natural circulation of liquid ends Reactor vessel liquid level drops below top of fuel rods Core exit superheat; hot leg countercurrent circulation begins Reactor vessel li'-!llid level drops below bottom of fuel rods Onset of fuel rod oxidation Core exit vapor temperature at 922 K First fuel cladding failure; cladding temperature > 2400 K Surge line creep rupture failure Hot leg creep ruptdre failures (pressurizer/nonpressurizer loops)

First appearance of an in-core molten pool Crust failure; molten core relocation to lower head Creep rupture failure of lower head End of calculation Time (min) 0 n.on8.3 78.0 95.8 115.0 122.2 145.0 149.8 176.7 180.7 185.2 235.5 237.5 258.3/260.8 278.3 480.8 482.0 483.3 and 260.8 minutes. Ceramic melting of core ma-terial at 278.3 minutes initiated the fonnation of an in-core molten pool supported by a metallic crust located at the bottom of the fuel rods.

Heating by the molten pool thinned the crust to the point of failure at 480.8 minutes. Approxi-mately 57,060 kg of molten U02 and 9930 kg of oxidized cladding were relocated to the lower head as a result. Thennal attack by the molten materials led to creep rupture failure of the lower head at 482.0 minutes.

NUREG/CR-5949 12 The RCS pressure response during the TMLB' transient is shown in Figure 1. The pres-sure initially decreased from the steady-state op-erating pressure of 15.5 MPa because the steam generators removed more energy than was being added by the core. The oscillations in the

Calculation Results 17.0 16.5

- 16.0 a,

a..

a: -

Q) 15.5

J en en Q)... 15.0 a..

14.5 14.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 1. Pressurizer pressure for the Base Case.

pressure before steam generator dryout at about 77.0 minutes reflected the cycling of the steam generator secondary relief valves. Following steam generator dryout, the pressure increased to the PORV opening pressure. The pressure then cycled between the PORV opening and closing set point for the remainder of the transient. Since RCS blowdown was not modeled in response to any pressure boundary failures, there was no RCS pressure reduction associated with the fail-ures listed in Table 3. The pressure increase above the PORV set point at about 125.0 minutes resulted from the pressurizer becoming liquid-filled and the PORV venting liquid with a lower specific energy than vapor.

The collapsed liquid level in the reactor ves-sel is shown in Figure 2. Following RCS satura-tion at 115.0 minutes, the vessel water level boiled down rapidly to the bottom of the active fuel. The flattening of the boiloff at about 130 minutes was caused by the liquid in the coolant loops draining into the vessel through the hot and cold leg nozzles. When the level dropped below 13 the core, the boiloff became more gradual be-cause heat transfer from the core to the liquid was through superheated vapor. As indicated in Figure 2, vessel dryout occurred at about 450 minutes.

Cladding surface temperatures along the height of the center fuel channel are shown in Figure 3. The heatup progressed from the top down as the liquid boiled out of the core. The upper portions of the fuel rods began oxidizing at 180.7 minutes, when the cladding temperature exceeded about 1000 K. When the temperature reached 1850 K, the oxidation kinetics changed and the heatup became more rapid. When the temperature reached 2400 K, the cladding failed; and unoxidized cladding and dissolved fuel relo-cated downward as a molten Zr-U02 eutect~c, stopping the oxidation reaction. This relocation was reflected in the rapid temperature rise in the bottom nodes of the core where the relocated ma-terial cooled and resolidified. The relocated Zr-uo2 combined with previously frozen control rod material at the bottom of the core to form a NUREG/CR-5949

Calculation Results 15.0.-----.---..---~---r------r---r--~--~-~-~

E -

ai

[> 12.0 32

.Q"

"'O Q) en a.

cu 0

0 Q) en en

~

0 0 cu Q) a:

9.0 6.0

~

\\

100.0 200.0 300.0 400.0 Time (min}

Figure 2. Reactor vessel collapsed liquid level for the Base Case.

4000.0 3000.0 q -

Q)...

°e 2000.0 Q) a.

E Q) 1-1000.0

-- 0.18 m above core inlet

- - - - - 0.91 m above core inlet B---£J 1.65 m above core inlet G- - - E) 2.38 m above core inlet ls--f:,. 3.47 m above core inlet Molten relocatio 500.0 0.0 L-_

_L_ __ ~----'---~--L-._----'----'

0.0 100.0 200.0 300.0 400.0 500.0 Time (min}

Figure 3. Fuel rod cladding surface temperatures in the center fuel channel for the Base Case.

NUREG/CR-5949 14

metallic crust. The core then melted from the crust upwards, as indicated by node temperatures in excess of 3000 K. A sustained molten pool was formed at 278.3 minutes and grew as fuel and oxidized cladding above the pool formed rubble debris, broke through the top crust, and became part of the pool. Failure of the bottom crust at 480.8 minutes allowed a molten reloca-tion into the lower head. An associated thermal attack led to creep rupture failure of the lower head at 482.0 minutes, some 244.5 minutes after the predicted failure of the surge line.

The mass flow rate in the top of one of the nonpressurizer loop hot legs is shown in Figure

4. After the hot leg countercurrent renodaliza-tion was introduced at 149.8 minutes, a natural circulation pattern was established, which de-creased steadily throughout the transient. The cycling of the PORV momentarily reversed the natural circulation flow, as vapor was drawn to-ward the pressurizer surge line. When the PORV closed, however, the natural circulation pattern in the hot leg was rapidly re-established. Vapor temperatures in the top and bottom of the hot leg nozzle for this same loop are shown in Figure 5.

A large sustained temperature gradient across the hot leg nozzle was maintained from 149.8 min-utes through the end of the transient. Vapor tem-peratures increased rapidly when the cladding oxidation rate increased at about 235 minutes.

The sustained vapor temperature increase, begin-ning at around 320 minutes, resulted from a core-

• wide blockage that was completed when a mol-ten region was established in the outer flow chan-nel.

Temperatures of the hottest structure in the upper plenum, the pressurizer surge line at the hot leg connection, the top of the pressurizer loop hot leg nozzle, and the hottest steam generator tube are shown in Figure 6. Because of its small-er thermal mass, the pressurizer surge line heated up faster and was predicted to fail earlier than the hot leg nozzle. The steam generator tubes re-mained relatively cool because most of the ener-gy in the circulating steam was transferred to the piping upstream of the generators. In fact, there were large margins before any steam generator tube failures could be expected. As indicated in 15 Calculation Results Figure 6, control rod housings should have began melting by 250 minutes; and one would expect oxidation of the stainless steel at those tempera-tures. However, the current version of SCDAP/

RELAP5/MOD3 does not account for the oxida-tion or melting failure of structures outside the core. Therefore, none of the subject calculations predicted changes in plant configuration (outside the core) as a result of melting. Total hydrogen production should increase if oxidation outside the core were considered. In addition, the mass of the in-core molten pool would increase if up-per plenum structures were allowed to slump into the pool as they melted. However, the power density would decrease because the affected structures would not contribute to the generation of decay heat Creep rupture of the surge line was the first failure of the RCS pressure boundary in this cal-culation. Failure of the reactor vessel lower head did not occur until 244.5 minutes later. As indi-cated in Table 3, hot leg creep ruptures were also well ahead of lower head failure. The RCS pres-sure was high (approximately 16.0 MPa) at the time of all failures. However, a previous calcula-tion has shown that a moderately sized surge line break can depressurize the Surry RCS from full system pressure, through a complete accumulator dump, to a pressure of 1.38 MPa within several minutes.3 Based on that calculation and the time available for depressurization, the RCS would be at a low pressure at the time of lower head fail-ure. Therefore, the potential for HPME does not exist in the Surry NPP for the conditions consid-ered in this calculation.

3.2 Case 2 This calculation was performed to evaluate the effect of hot leg countercurrent natural circu-lation on the potential for HPME through com-parison to the Base Case. In this calculation, the flow paths that could allow development of hot leg countercurrent natural circulation were elimi-nated. As indicated in Tables 1 and 2, this case was identical to the Base Case with that excep-tion. Since countercurrent natural circulation will not occur until there is core vapor superheat, the sequence of events from TMLB' initiation to NUREG/CR-J949

Calculation Results 6.0 4.0 en -

C>

2.0

.::it:. -

Q) -

ct!....

0.0

~

0 en en

-2.0 ct!

~

-4.0

-6.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 4. Mass flow rate in the top of a nonpressurizer loop hot leg (A) for the Base Case.

2500.0 2000.0 S2' -

~

J ca 1500.0 Q) a.

E Q) 1-1000.0 500.0 0.0

-- Top of hot leg A

/r---------6 Bottom of hot le A 100.0 200.0 300.0 Time (min) 400.0 500.0 Figure S. Vapor temperatures in the top and bottom of a nonpressurizer loop hot leg (A) for the Base Case.

NUREG/CR-5949 16

2500.0 2000.0

~ -

Q) cii 1500.0 Q)

a.

E Q)

I-1000.0

-- Hot leg C nozzle

- - -

• Loop C steam generator tube

-surge line B- - -o Control rod housing Stainless steel melt tern erature c!l I

I I

I I

/

I Calculation Results

-.u Surge line failure"'"'/

I I

---

Hot leg failures

,,,.,"'r--...... -

500.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 6. Volume-averaged temperatures of various structures in the pressurizer loop (C) and the reactor vessel for the Base Case.

149.8 minutes is identical to those listed in Table 3 for the Base Case. The sequence of events from 149.8 minutes through creep rupture failure of the lower head for this case is listed in Table 4.

The progression of core damage was faster in Case 2 than in the Base Case. By eliminating hot leg countercurrent flow, the only structures avail-able to absorb core decay heat were those in the upper plenum and those along the flow path from the upper plenum to the pressurizer PORV (i.e.,

the structure in the hot leg between the vessel and pressurizer surge line and the pressurizer surge line). The faster core heatup produced a more rapid increase in vapor temperatures than observed in the Base Case and resulted in creep I

rupture failures of the pressurizer surge line and the pressurizer loop hot leg nozzle 22 and 24 minutes earlier than in the Base Case, respective-ly.

There was also a major difference between the two calculations,in core damage progression.

17 In Case 2, the cladding reached 2400 Kand be-gan failing at 206.0 minutes, 29.5 minutes earlier than in the Base Case. The resultant relocating Zr-U02 cooled and solidified between 1.10 and 1.46 m above the bottom of the fuel rods instead of at the core bottom, as observed in the Base Case. The crust in Case 2 solidified at a higher elevation in the core because molten relocation occurred earlier in the transient, when the reactor vessel liq1,1id level was higher. Consequently, the initial melting of ceramic debris occurred near the core midplane, which produced a molten pool with a higher specific heat generation rate than the Base Case molten pool. Crust heatup in Case 2 was significantly faster than in the Base Case, due to the higher specific heat generation rate and the fact that the lower crust surface was ex-posed to a high-temperature core environment, as opposed to the relatively cool lower plenum. As a result, the bottom crust failed at 257.8 minutes; and 6850 kg of molten material relocated to the lower head. The relocation resulted in a creep rupture failure of the lower head at 260.1 NUREG/CR-5949

Calculation Results Table 4. Sequence of events for Case 2.

Event Core exit superheat; calculation begins Onset of fuel rod oxidation Time (min)

Reactor vessel liquid level drops below botton of fuel rods Core exit vapor temperature at 922 K 149.8 177.0 177.3 179.5 206.0 215.5 234.3 253.0 257.8 260.1 266.5 278.8 283.2 First fuel cladding failure; ruptured by melting Surge line creep rupture failure Hot leg creep rupture failure (pressurizer loop)

First appearance of an in-core molten pool Crust failure; molten core relocation to lower head Creep rupture failure of lower head Second molten core relocation (through previously failed crust)

Hot leg creep rupture failures (nonpressurizer loops)

End of calculation minutes, approximately 222 minutes earlier than in the Base Case.

The first fuel cladding failures in Case 2 oc-curred in the middle core channel. Fuel rod clad-ding surface temperatures along the height of the middle channel are shown in Figure 7. The up-per portions of the channel reached the 2400-K failure temperature for oxidized Zr, while the lower portions of the fuel remained relatively cool. As previously noted, the relocating Zr-U02 eutectic relocated and solidified to form a metallic crust in the middle channel about 1.46 m above the bottom of the fuel rods. The reduction in cooling associated with the crust :fl.ow restric-tion led to melting above the crust.

The vapor temperatures in the hot leg noz-zles of the pressurizer and nonpressurizer loops NUREG/CR-5949 18 are shown in Figure 8. Without hot leg counter-current natural circulation, the vapor temperature in the pressurizer loop was always hotter than in the nonpressurizer loop. The nonpressurizer loop hot leg nozzle did heat up between PORV cycles, as the RCS pressurization caused some vapor to flow into all of the coolant loops. How-ever, the dominant heat transfer mechanism was the PORV cycling, drawing superheated vapor into the pressurizer loop. Temperatures repre-senting the hottest structure in the upper plenum, the pressurizer surge line at the hot leg connec-tion, the top of the pressurizer loop hot leg noz-zle, and the hottest tube in the pressurizer loop steain generator are shown in Figure 9. As indi-cated, upper plenum* structures were heated to temperatures above their melting points. How-ever, steam generator tubes did not heat up be-

Calculation Results 4000.0 ~-~-~-.,..---.,..---~-~-~-.------.---r------,----,

3000.0 sz -

Q)....

l cu 2000.0 Q)

a.

E Q) 1-1000.0 0.0 0.0

-- 0.18 m above core inlet

- - -

• 0.91 m above core inlet C3----tl 1.28 m above core inlet G - -o 1.65 m above core inlet l!r---6 3.47 m above core inlet 100.0 Molten relocatio Time (min)

I I

I 200.0

,.o-

',,....,0 I

/

I I

Figure 7. Middle channel fuel rod cladding surface temperatures for Case 2.

~ -

Q)

l cu Q)

a.

E Q)

I-2000.0 1500.0 1000.0 500.0 0.0

-- HotlegA G----> Hot le C 100.0 200.0 Time (min)

//

// ff 300.0*

300.0 Figure 8. Vapor temperatures in the pressurizer and nonpressurizer loops (C and A) for Case 2.

19 NUREG/CR-5949

Calculation Results 2500.0.------,c-------,-----r-----,----~---~

2000.0 52' -

~

ca 1500.0 Q) a.

E Q) 1000.0

-- Hot leg C nozzle Loop C steam generator tube B---i:l Control rod housing 13- - -o Surge line Stainless steel melt tern erature Surge line failure

-..[)- - - ~ \\

Hot leg failure 500.0 '-----~----'------~-------'-----~--___J 0.0 100.0 200.0 300.0 Time (min)

Figure 9. Volume-averaged temperatures of various structures in the pressurizer ~oop (C) and reactor ves-sel for Case 2.

cause of the absence of hot leg countercurrent flow.

In Case 2, as in the Base Case, creep rupture failures in the ex-vessel piping were predicted to occur before lower head failure. However, the 44.6-minute margin between surge line failure and lower head failure was considerably smaller than the Base Case margin of 244.5 minutes.

Surge line failure times were.comparable in the two cases, but lower head failure was significant-ly faster in Case 2. That difference resulted from the elimination of hot leg countercurrent natural circulation. Without countercurrent flow, most of the ex-vessel piping that can act as a sink for core decay heat is lost, which led to a relatively faster core heatup and lower head failure in Case

2. Although the margin of 44.6 minutes between surge line and lower head failures is relatively small compared to the Base Case, it is quite large compared to the time required to depressurize the Surry RCS through a surge line failure.3 In addi-tion, SCDAP/RELAP5/MOD3 input was pur-NUREG/CR-5949 20 posely selected to accelerate lower head failure.

I On that basis, there is no potential for HPME in the Surry NPP for the conditions considered in this calculation. Taken together, the Base Case and Case 2 results indicate that the potential for HPME is not affected by hot leg countercurrent natural circulation with the RCS at full system pressure.

3.3 Case 3 This calculation was performed to evaluate the effect ofRCP seal leakage (as specified in Ta-ble 1) on the potential for HPME. Details of this calculation are described to facilitate evaluation of other RCP seal leak cases and comparison with the Base Case. The sequence of events from TMLB' initiation to creep rupture failure of the lower head for this calculation is listed in Tu-ble 5. The table contains quantitative informa-tion that should be helpful in understanding the following description.

Table S. Sequence of events for Case 3.

Event TMLB' initiation Steam generator dryout (pressurizer/nonpressurizer loops)

Initial cycle of pressurizer PORV Core saturation Pressurizer filled with liquid RCP saturation; increased seal leaks to 250 gpm per RCP Full loop natural circulation of liquid ends Reactor vessel liquid level drops below top of fuel rods Core exit superheat; hot leg countercurrent circulation begins Pressurizer PORV final cycle Onset of fuel rod oxidation Reactor vessel liquid level drops below bottom of fuel rods Core exit vapor temperature at 922 K First fuel cladding failure; ruptured by ballooning First relocation of molten control rod materials to lower head First accumulator injection First appearance of an in-core molten pool Hot leg creep rupture failures (pressurizer/nonpressurizer loops)

Surge line cre~p rupture failure Crust failure; molten core relocation to lower head Creep rupture failure of lower head End of calculation 21 Calculation Results Time (min) 0 79.0/81.7 97.3 117.8 118.0 123.5 I 124.3 146.8 149.8 161.3 184.0 189.3 195.0 220.5 233.0 238.0 241.8 334.8/335.0 337.2 403.3 405.7 430.0 NUREG/CR-5949

Calculation Results Seal leaks of 21 gpm per RCP were intro-duced at TMLB' initiation to account for seal heating caused by the loss of cooling water. Like all calculations perfonned, a sharp reduction in RCS pressure of alfout I MPa was predicted at the same time. That pressure reduction occurred because the reactor power dropped quickly (fol-lowing reactor scram) relative to RCP coast~

down. With relatively low power and high

' coolant flow, heat removal through the steam generators produced the cooling necessary for pressure reduction. As shown in Figure 10, the RCS pressure then recovered to about 15.2 MPa.

• At that point, RCP coastdown was complete; and full loop natural circulation of subcooled liquid was established.

Natural circulation of liquid provided the mechanism for transferring core* decay heat to the steam generator secondaries, resulting in a boiloff of the secondary inventories. At the same time, RCS mass was also discharged through RCP seal leaks. Those combined effects resulted in a gradual pressure reduction to about 12 MPa at 80 minutes, as shown in Figure 10. At that point, RCS heat removal through boiloff of the secondary inventories*was complete.

At steam generator dryout, the sum of the en-ergy removed by superheating vapor in the sec-ondaries and the energy. dissipated through the RCP seal leaks was less than the decay heat pro-duced in the core. As a result, temperatures and pressures in the RCS began to increase. At 97.3 minutes, the RCS pressure reached the opening set point (16.2 MPa) of the pressurizer PORV.

PORV cycling followed, which controlled the RCS pressure between 15.7 and 16.2 MPa, as in-dicated in Figure 10.

Boiling in the core began at 117.8 minutes.

.

• The generated vapor was condensed in the hot legs, which were still subcooled. The PORV be-gan to discharge liquid shortly thereafter, as the pressurizer filled because of continued RCS heat-ing. At 123.5 minutes, saturation conditions were reached at the RCPs; and the seal leaks were increased to 250 gpm per RCP to simulate failures that could occur with two-phase flow through the seals. With the loops at saturation, NUREG/CR-5949

• 22 condensation of vapor produced in the core stopped. Thereafter, generated vapor began to collect in the top of the steam generator U-tubes,

• which tenninated full loop natural circulation of liquid at 124.3 minutes, as shown in Figure 11.

In-core boiling and discharge through the PORV and RCP seals reduced the RCS invento-ry, with core uncovery beginning at 146. 8 min-utes'. The corresponding reactor vessel collapsed liquid level is shown in Figure 12. A renodaliza-.

tion of the hot legs was incorporated at 149.8 minutes to add flow paths for countercurrent nat-ural circulation. (The potential for development of that flow pattern did not exist until the hot legs were voided and superheated vapor was avail-able to provide the required driving potential.)

At 161.3 minutes, voiding of the cold legs was complete, leaving the RCP seal leaks uncovered.

At that time, energy dissipated by vapor dis-charge through the RCP seal leaks plus the heat transferred to vessel and ex-vessel structures ex-ceeded the decay power. As a result, PORV cy-cling ended and a second RCS depressurization followed, as shown in Figure 10.

Cladding oxidation began at 184.0 minutes.

However, the initial oxidation rate was moderate, with little impact on the heatup. Oxidation be-came more vigorous as temperatures increased following complete core uncovery at 189.3 min-utes. At that time, the exothennic oxidation re-action began to drive a core temperature increase, which led to fuel rod gas pressurization and the first cladding rupture due to ballooning at 220.5 minutes. Double-sided oxidation follow-ing cladding rupture produced a very rapid in-crease in core temperatures, as shown in Figure 13.a Materials from the highest temperature (highest power) regions near the center of the core began melting and slumping shortly

a. Temperatures plotted in Figure 13 do not represent any specific core location. Insltead, the maximum cladding surface temperature calculated in the core is shown as a function of time.

Once fuel melting occurs, the distinction between the cladding surface and the rest of the melt is lost At that point, Figure 13 provides an indication of the hottest temperature in the molten regions.

18.0 15.0

'tu' 12.0 a..

6 Q) 9.0 en en

~

a..

6.0 3.0 0.0 0.0 Lower head failure Hot leg_f~ilure \\

team generator dryout Molten relocation and sixth accumulator injection-----

100.0 200.0 300.0 400.0 Time (min)

Figure 10. RCS pressure for Case 3.

en -

en

~ -

(]) as 3::

0 en en

<tS

E 250.0

~

Onset of full loop natural circulation of liquid 200.0 ___--

150.0 100.0 End of full loop natural circulation of liquid 50.0 0.0

-50.0 0.0 100.0 200.0 300.0 400.0 Time (min)

Calculation Results 500.0 500.0 Figure 11. Full loop natural circulation of liquid in a nonpressurizer loop (A) following TMLB' initiation for Case 3.

23 NUREG/CR-5949

Calculation Results 15.0 ~-~----,~-~---,--.....-----.--.....-----.----.----,

E -m

~ 12.0 I---------..

'2

.Q'"

"C Q) en

0.

ca 0

(.)

Q) en en Q) >

L..

0

~

Q) 9.0 To of fuel rods 6.0 3_0 Bottom of fuel rods

/

Draining of coolant loop piping Molten relocation and sixth accumulator injection a:

0.0 '----~--'----~----'--~-~--~-~--~-~

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 12. Reactor vessel collapsed liquid level for Case 3.

4000.0.-------r---r-------r-----,,--------.-------,.-----.----.----.-----,

3000.0 sz -

Q)

L..

ro 2000.0 L..

Q)

0.

E Q) 1-1000.0 First fuel melting ~

Onset of double-sided oxidation----_,_.

Molten relocation

---

Beginning of core uncovery 0.0 '--------~~------'--~----'--~-~---'--~-----'--~~~---'

0.0 100.0 200.0.

300.0 400.0 500.0 Time (min)

Figure 13. Maximum cladding surface temperature for Case 3.

NUREG/CR-5949 24

thereafter. The first relocation of molten materi-als to the lower head, which occurred at 233.0 minutes, consisted of about 1910 kg of control rod material. A metallic crust, approximately 0.181 m thick, was also established as mixtures of cladding and dissolved fuel were frozen at an elevation 0.366 m above the bottom of the center channel. Meltdown in the center channel fol-lowed, as a result of the restriction in cooling fol-lowing crust fonnation.

The RCS pressure was reduced to the initial accumulator pressure at 238.0 minutes, as a re-sult of continuous leakage through the RCP seals. Accumulator injection followed in six cy-cles, as clearly indicated in Figures 10 and 12.

During each cycle, water injection began when the RCS pressure dropped below the accumula-tor pressure. Injection tenninated when the RCS pressure increased to a point above the accumu-lator pressure, as a result of vapor generation as-sociated with core cooling. (It should be noted that accumulator pressure was reduced by each injection.) Approximately three-quarters of the initial accumulator'liquid volume was discharged into the RCS during the calculation.

Before describing the balance of the tran-sient, it should be noted that RCS pressure per-turbations were observed during the accumulator injection phase of the calculation. The most visi-ble evidence of this behavior appears as a pres-sure spike in Figure 10 at about 300 minutes.

(Smaller perturbations are also apparent during depressurization following the fifth and sixth ac-cumulator injections.) These perturbations are the result of a SCDAP/RELAP5/MOD3 code anomaly, as discussed below.

At about 300 minutes, the in-core liquid lev-el was at an elevation of 0.73 m above the bot-tom of the fuel rods, which corresponded to the top of the second core volume in the model (see Appendix B). For an unknown reason, heat transfer to the liquid phase in this volume was then incorrectly specified by the code over sever-al time steps. The heat that was incorrectly add-ed was sufficient to superheat the liquid, which led to flashing. The vapor generated by flashing all of the liquid in the volume over several time 25 Calculation Results steps produced the abrupt RCS pressure increase shown in Figure 10. Other perturbations follow-ing subsequent accumulator injections were the result of the same process. However, the effect on pressure was smaller because the amount of liquid vaporized was smaller. The amount of liq-uid vaporized was smaller because rubble debris had accumulated at that point in the transient, thus reducing the available liquid volume.

The effects of the code anomaly were only observed during portions of the accumulator wa-ter boiloff. Furthennore, these effects did not have any significant or adverse impact on the re-sults of any of the calculations in this analysis because the magnitude and duration of the pres-sure spikes were small. Although the anomaly was reported to the SCDAP/RELAPS code de-velopers for resolution, repeating the calculations with the anomaly corrected was not justified.

The RCS pressure response to accumulator injection was directly related to the liquid level in the reactor core. As indicated in Figure 12, ac-cumulator water did not reach the bottom of the fuel rods until midway through the third injec-tion. Up to that point, the added water simply re-filled the lower head and plenum. Because those vessel areas were relatively cool, only minimal vaporization Gust sufficient to tenninate furµter injection) occurred, as indicated by the pressure response shown in Figure 10. Accumulator pres-surization was more dramatic once water pene-trated into the active core region where the fuel temperatures were very high.

The liquid level reached an elevation of about 0.73 m above the bottom of the fuel at the end of the third accumulator injection. The asso-ciated cooling was sufficient to fragment middle and outer channel components in the lower levels of the core, which left the center channel molten pool surrounded by rubble debris approximately 1 m ~eep. In addition to the complete flow bloclcage associated with the molten region in the center channel, middle and outer channel flow ar-eas were automatically reduced 89% (consistent with Table 2) at all fragmented locations. As in-dicated in Figure 10, the vapor produced during the cooling of the lower levels of the core drove NUREG/CR-5949

Calculation Results the RCS pressure to a peak of approximately 6.5 MPa. A subsequent boiloff then dropped the liq-uid level to about 0.18 m above the bottom of the fuel before the fourth accumulator injection.

As indicated in Figure 12, liquid levels reached during the third and fourth accumulator injections were essentially equal because the lower levels of the core were cooled but not

. quenched by the third injection. In addition, some reheating took place after the water from the third injection boiled away. Although the stored energy in the lower core levels was some-what reduced, vaporization was ~ufficient to ter-minate liquid penetration during the third and fourth injections at about the same elevation.

The differences in the RCS pressure response shown in Figure 10 reflect the differences in stored energy (which is the energy available for removal by the accumulator water) at the time of the two injections.

Core degradation was very extensive at the time of the fifth a,ccumulator injection. Specifi-cally, the center channel was molten from the crust elevation (0.366 m above the bottom of the fuel) to the top of the core; and rubble debris filled most of the lower half of the middle and outer channels. Flow area reductions associated with that level of damage left relatively little vol-ume for injected water. Under these conditions, relatively small injections can result in'relatively high liquid levels. As indicated in Figure 12, the fifth injection penetrated about halfway into the core. A substantial RCS pressurization followed, as shown in Figure 10. The degree of core dam-age was an important factor in that pressure re-sponse. The injected liquid level reached the top of the existing rubble debris, which provided a relatively large surface area for transferring de-cay energy to the liquid and produced a rapid va-porization, with a corresponding RCS pressure increase. Cooling associated wit:Ji the injection fragmented the balance of the core. At that point, rubble extended from the top to the bottom of the core in the middle and outer flow channels.

Core decay heat was transferred to the ex-vessel piping by hot leg countercurrent natural circulation throughout the period of core degra-NUREG/CR-5949 26 dation. However, RCS pressurization associated with accumulator injection did perturb the fl.ow patterns. These effects can be seen in the hot leg flows for a nonpressurizer loop, as shown in Fig-ure 14. (In Figure 14, flows out of the core are positive in the top half of the hot leg and negative in the bottom half.) Up to about 250 minutes, the mass fl.ow returning to the vessel was noticeably higher than the outflow, due to the difference in densities between the flow streams. For each cu-bic meter of steam flowing into the top half of the hot leg, a cubic meter of relatively cool and rela-tively dense steam fl.owed out of the bottom half of the hot leg and returned to the vessel.

Four flow spikes are clearly visible in Figure 14, corresponding to the last four accumulator in-jections. (Flow perturbations were minimal for the first two accumulator injections because the RCS pressure response was minimal.) Specifi-cally, flows were accelerated out of the core as a result of the RCS pressure increase associated with vapor generation during the inj~ctions. As shown, flows in the bottom half of the hot leg were reversed (negative values) so that all hot leg flow was driven toward the steam generators.

In some cases, RCP loop seals were cleared during accumulator injection. Loop seal clearing occurred whenever the pressure differential be-tween the hot leg and cold leg sides of the loop seal was large enough to push the plug of water into the cold leg piping. On subsequent injec-tions, loop seals were refilled because accumula-tor water fl.owed toward the core and/or the empty loop seal. The process of loop seal clear-ing ~d refilling was random, depending on the fluctuating mass of liquid in the seal and the pressure differential. In any case, full loop natu-ral circulation of superheated steam was estab-lished whenever loop seals were cleared. (Full loop flow is shown in Figure 14 whenever the outflow is positive and the return flow is nega-tive.) Hot leg countercurrent natural circulation was quickly re-established following loop seal refilling.

The effects of ex-vessel heating associated with countercurrent natural circulation in the pressurizer loop are shown in Figure 15.

15.0 10.0

~

C) 5.0

st:. -

Q) ii 0.0 3:

0

(/)

(/)

-5.0

Full loop natural circulation of liquid ends 123.5 124.3 140.5 141.5 143.8 167.7 179.5 182.0 197.3 202.3 234.8 336.2 426.0 433.0 460.7 463.3 Pressurizer PORV final cycle Reactor vessel liquid level drops below top of fuel rods Core exit supemeat; hot leg countercurrent circulation begins Reactor vessel liquid level drops below bottom of fuel rods Onset of fuel rod oxidation Core exit vapor temperature at 922 K First fuel cladding failure; ruptured by ballooning First accumulator injection First appearance of an in-core molten pool Accumulators emptied Crust failure; first molten core relocation to lower head Creep rupture failure of lower head Crust failure; second molten core relocationto lower heat End of calculation decay power; and a corresponding pressure re-duction followed.

A comparison of the reactor vessel collapsed liquid level in Cases 3 and 4 is shown in Figure

17. Because of the differences in seal leak rates, core uncovery began earlier in Case 4 and pro-gressed at a faster rate. Specifically, uncovery began approximately 5.3 minutes earlier and was completed about 21.6 minutes earlier in Case 4.

As a result; the onset of core damage ( oxidation, ballooning, etc.) in Case 4 was also relatively early. Except for the timing difference, the initial NUREG/CR-5949 30 heatup associated with core oxid.ation was very similar in Cases 3 and 4, as shown in Figure 18.

However, a significant deviation in the Case 4 heatup occurred following accumulator injec-tions, which began at 202.3 minutes.

Accumulator injections began when the RCS pressure dropped to the accumulator pressure.

As indicated in Figure 16, differences in seal leak rates resulted in a relatively early depressuriza-tion to the accumulator pressure in Case 4. The resulting start of accumulator injections at 202.3 minutes was approximately 35. 7 minutes earlier

18.0 15.0

- 12.0 ctS a..

~ -

Q) 9.0 en en Q) 6.0 a..

3.0 0.0 0.0 100.0

\\

\\

r 1' 1\\

I

\\

I

\\

\\

I 200.0 300.0 Time (min)

Figure 16. RCS pressures for Cases 3 and 4.

15.0 E -

Q) >

Q) 12.0

!2

.Q" "O

9.0 Accumulators emptied Q) en a.

ctS To of fuel rods 0

6.0

\\

(.)

I\\

Q)

I '

en

\\

en Q)

Bottom of fuel rods 3.0 0 u I

,1 ctS First accumulator injectionL-----"

Q) er:

0.0 0.0 100.0 200.0 300.0 Time (min)

\\

\\

\\

Figure 17. Reactor vessel collapsed liquid levels for Cases 3 and 4.

31 I

I Calculation Results

\\

1-*- Case31

-- -

• Case 4

\\

\\

\\.

400.0 1-Case 3,

---* Case4 400.0 500.0 500.0 NUREG/CR-5949

Calculation Results 4000.0 First accumulator injectio 3000.0

~ -

Q)...

I I I II 11 I

I I

I*

I cu 2000.0 1

Molten relocation I

Q)

a.

E Q)

I-1000.0 1-----------LT/.

/.

~

I I

I I

I I

I I

1-- Case31

---* Case~

0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 18. Maximum cladding surface temperatures for Cases 3 and 4.

than the first injection in Case 3, as indicated in Figures 17 and 18. Injection of cold water led to a relatively early and extensive fragmentation of the heated fuel bundle in Case 4. In the current version of SCDAP/RELAP5/MOD3, howev~r.

oxidation terminates when rod-like geometry is lost. Therefore, the maximum cladding tempera-tures in Case 4 dropped as the energy associated with the exothermic oxidation reaction was lost (following fragmentation) and as accumulator water cooled the core.

lator injection is provided in Figure 19, which shows the total hydrogen generated during core oxidation for the two cases. As indicated, the to-tal hydrogen generated in Case 4 was less than half of the amount generated in Case 3. Figure 19 reflects the fact that oxidation was basically terminated by extensive core fragmentation fol-lowing the relatively early accumulator injec-tions in Case 4.

Early accumulator injection in Case 4 had another important impact on the transient pro-gression. Specifically, liquid levels in the core were relatively high before core melting, which provided some core cooling. In contrast, fuel melting had occurred in Case 3 before accumula-tor water penetrated into the core. Although the accumulators emptied in Case 4 after a sixth in-jection at 336.2 minutes, the liquid levels in Case 4 were consistently higher than those in Case 3 The differences shown in Figure 18 do not give a complete in~ication of the effects of early accumulator injection because the temperatures plotted in Figure 18 do not represent any specific core location. Instead, the maximum cladding surface temperature in the core is shown as a function of time. Comparing the maximum tem-peratures in Case 3 to the maximums in Case 4 indicates that early injection caused some tem-perature differences, but those differences were basically over by about 300 minutes. An alter-nate way to compare the effects of early accumu-up to that time, as indicated in Figure 17. Further core degradation, melting, and lower head failure were relatively late in Case 4 compared to Case 3, as a result of those differences in liquid levels.

NUREG/CR-5949 32

~ -

C 0

15....

Q)

C Q)

C>

C Q)

C>

0...

"C

c 500.0 1-Case31

---* Case 4:

400.0 300.0 200.0 100.0 I I' I

I I.

Calculation Results 0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 19. Total hydrogen generated for Cases 3 and 4.

Hot leg countercurrent natural circulation of superheated vapor developed after the hot legs drained into the reactor vessel. As in Case 3, however, this natural circulation flow pattern was interrupted by the RCS pressurization associated with core cooling following accumulator injec-tions. The effects of the last four injections in Case 4 are clearly visible as flow spikes in Figure

20. Periods of hot leg countercurrent flow, where both hot leg outflow and return flows are posi-tive, were terminated whenever the RCP loop seals were cleared. Full loop flow of superheated steam, where the hot leg outflow is positive and the return flow is negative, was terminated when-ever the loop seal was refilled during a subse-quent accumulator injection.

The effects of ex-vessel heating associated with the natural circulation of superheated steam are plotted in Figure 21. Temperatures are shown for the hot leg nozzle, the surge line, and the hottest location in the steam generator tube bundle because those components are the most vulnerable locations for creep rupture failure.

33 Furthermore, the component temperatures that were plotted represent the pipe components in the pressurizer loop because they were somewhat hotter than the corresponding components in the nonpressurizer loops. As indicated in Figure 21, the hot leg nozzle was generally hotter than the surge line and the steam generator tube. This was as expe,cted because the nozzle is exposed to the hottest steam leaving the core and because the surge line heating was not driven by PORV cycling in this case. (The steam deposits some energy in the hot leg piping before reaching the surge line and steam generator.) The flow spikes associated with accumulator injections caused large perturbations in the steam generator tube temperature and small perturbations in the more massive hot leg nozzle.

Ex-vessel heating was relatively low in Case 4 as compared to Case 3 (see Figures 15 and 21).

In fact, hot leg and surge line temperatures in Case 4 were approximately 200 K cooler. In both cases, the core decay energy was split be-tween the amount deposited in the vessel and ex-NUREG/CR-5949

Calculation Results 10.0 Hot leg counter-Hot leg counter-

+-current flow------<---Full loop flow ----,current flow----+

5.0 0.0

-5.0

-10.0 ~~~~--~--~--~~--~--~---~-~

100.0 200.0 300.0 Time (min) 400.0 500.0 Figure 20. Hot leg countercurrent natural circulation in a nonpressurizer loop (B) for Case 4.

1300.0 ~-~-~--~-~---.---~---.-----,---~---,

1100.0 Q)...

J ro 900.0 Q) a.

E Q) 1-700.0 500.0 0.0

-- Loop C hot leg nozzle G------l Loop C steam generator tube C:1----£1Surgeline 100.0 200.0 300.0 Time (min) 400.0 500.0 1 Figure 21. Volume-averaged ex-vessel piping temperatures in the pressurizer loop (C) for Case 4.

NUREG/CR-5949 34

vessel piping and the amount dissipated through RCP seal leaks. In Case 4, seal leaks of 480 gpm per RCP left a smaller fraction of the core decay energy for ex-vessel heating. In addition, the RCS depressurization rate in Case 4 led to a*rela-tively early start on accumulator injection, which provided some reduction in steam temperatures.

Therefore, the hot leg and surge line remained relatively cool. As a result, creep rupture failures were not predicted in any ex-vessel piping com-ponent in Case 4.

A boiloff following the last accumulator in-jection led to failure of an in-core crust at 426.0 minutes, about 22.7 minutes after crust failure in Case 3. The crust failure allowed approximately 12,940 kg of molten U02 at 3380 K to relocate to the lower head. Like Case 3, relocation was completed in 68 seconds without heat transfer to the lower head coolant. Thermal attack by the relocated molten fuel resulted in a creep rupture failure of the lower head at 433.0 minutes, ap-proximately 27.3 minutes after lower head fail-ure in Case 3. (As indicated in Table 6, a second crust failure and relocation was predicted at 460.7 minutes.)

All ex-vessel RCS pressure boundaries were intact at the time oflower head failure in this cal-culation. Furthermore, there were large margins before any component failures could be expected according to the results at the time of lower head failure. Therefore, it is reasonable to expect that the vessel failure as described would be the first breach of the RCS pressure boundary under the conditions considered in Case 4. The RCS pres-sure at the time of lower head failure was ap-proximately 1.36 MPa. In NUREG-1150, the potential for HPME was assumed to be low if the RCS pressure was below 1.38 MPa at vessel breach. However, the uncertainties in this calcu-

! latipn are larger than that margin. Therefore, it appears that a potential for HPME could exist in the. Surry NPP for the set of conditions consid-ered in this case.

Results from Cases 3 and 4 indicate that higher RCP leak rates can generate conditions that lead to an early onset of core damage. How-ever, higher RCP leak rates also depressurize the 35 Calculation Results RCS, allowing earlier accumulator injection, which can delay further core degradation and lower head failure. The most important differ-ence associated with RCP seal leak rates, howev-er, has to do with the effects on ex-vessel heating. Comparing results from Cases 3 and 4, seal leaks of 480 gpm per RCP were found to dissipate a relatively large fraction of core decay energy, leaving a relatively small fraction for ex-vessel heating. In fact, the results indicate that ex-vessel failures would occur with seal leaks of 250 gpm per RCP but would not be expected with leaks as high as 480 gpm per RCP. Since the potential for HPME is directly related to the potential for ex-vessel failures, it appears that in-creasing the RCP seal leak rate (within some rea-sonable bounds) increases the potential for HPME.

3.5 Case 5 This calculation was performed to evaluate the effect of debris/coolant interac\\ion during molten relocation to the lower head on the poten-tial for HPME through comparison to Case 3.

Debris/coolant interaction was varied in Case 5 by assuming maximum heat transfer between the molten core debris and the reactor coolant during relocation to the reactor vessel lower head. This calculation was identical to Case 3 w1th that ex-ception (see Tables 1 and 2). Therefore, these-quence of events from TMLB' initiation up to the first molten core relocation was identical to the list in Table 5 for Case 3. Case 5 events from the

first relocation to creep rupture failure of the lower head are summarized in Table 7.

Some heat transfer between molten core ma-terials and the reactor coolant could occur during relocation to the lower head. A number ~f fac-tors could affect this heat transfer, including the amoµnt of coolant below the core at the time of relocation, the temp~rature of the coolant, the quantity and temperature of the molten material being relocated, the relocation rate, and the influ-ence of core internal structures. The effects of those factors are not readily quantified for all possible conditions. For that reason, current ver-sions of SCDAP/RELAP5/MOD3 allow user control for modeling the two possible extremes.

NUREG/CR-5949

Calculation Results Table 7. Sequence of events for Case 5.

Event Crust failure; first molten core ~location to lower head Accumulators emptied nme *

(min) 403.3 475.0 Crust failure; second molten core relocation to lower heat*

Creep rupture failure oflower head 477.7 479.6 End of calculation In one option, molten core materials are relocat-ed to the lower he~ without any heat transfer to the reactor coolant. This option provides an up-per bound on the temperature of the debris when it reaches the lower head and a corresponding upper bound on the severity of the associated lower head thennal attack. It was used in every calculation in this analysis except Case* 5, provid-ing a conservative approach for evaluating the potential for HPME. In Case 5, the second op-tion was selected where maximum debris/coolant heat transfer is calc1,1lated. This option is imple-mented by assuming that all relocating debris is quenched, up to the obvious limit imposed by the quantity of water in the lower head.

• As a result, the option provides a lower bound on the debris temperature as it reaches the lower head and a

, corresponding lower bound on the severity of the associated lower head thennal attack.

The effect on lower head debris temperature is illustrated in Figure 22. Without heat transfer to the reactor.coolant, a step change in the maxi-mum lower head debris temperature occurred at the time of relocation in Case 3. In contrast, heat transfer during the first relocation in Case 5 cooled the molten debris to about 770 K. The lower head coolant was depleted before debris quenching could be completed, as discussed be-low.'

The collapsed liquid level was near the bot-tom of the core at the time of the first molten core relocation, as indicated in Figure 23. As dis-NUREG/CR-5949 36 496.7 cussed in Section 3.3, an accumulator injection coincided with that relocation in Case 3, result-ing in an increase in the liquid level. In Case 5, the vapor generated through debris/coolant heat transfer produced a large RCS pressure increase at the time of the first relocation, as indicated in Figure 24.

• This pressure increase prevented ac-cumulator injection in Case 5 at the time of the first relocation. Instead, the lower head coolant was sharply depleted, as shown in Figure 23.

Some of the lower head coolant was lost through vaporization associated with debris cool-ing. The remainder was forced out of the lower

• head into the cold legs by high vapor velocities and the pressure increase. Vaporization cind the pre~sure increase were terminated when the available coolant wa~ depleted. Figure 23 indi-cates a level of approximately 0.5 m at that time.

However, this value actually represents a dry condition because the level was offset by the depth of the lower head debris. When the vapor-ization terminated, water that had been forced into the cold legs drained back to the vessel, re-

~ulting in a level recovery at about 405 minutes.

The water was then boiled away by (relatively low) heat transfer from an upper crust supported by the underlying molten debris. A continuous level decline followed until the RCS pressure was reduced to the accumulator pressure. At that time, a sixth injection in Case 5 emptied the ac-cumulators and increased the level, as shown in Figure 23.

Calculation Results q

4000.0 Q)

Lower head-failure 1-- Case31

---* Cases as Q) a. 3000.0 E

Q)

I I

en I

//~~~~:

0~olten

.0 Q)

"C 2000.0 Molten relocation in i

Cases 3 and 5 Q)

~/,,/

.c.

Q)

~ 1000.0

.Q E

---

End of molten relocation and E

debris cooling

-~

0.0

E 300.0 400.0 500.0 600.0 Time (min)

' Figure 22. Lower head debris teqiperatures for Cases 3 and 5.

15.0.---~--~-~--~-~--~----.--~--...-----,

E -

Q) >

~ 12.0 1-------~

2

,.sr "O

9.0 Q)

UJ a.

<ti To of core 0 o 6.0 Q)

Cl)

Cl)

Q) >

0

~

Q) 1-- Case31

---* Cases Lower head failure Second molten relocation Sixth accumulator injection a:

0.0.__ _ ___._ __ _.__ _ ___,__ __ _.__ _ ___._ __ _.__ _ ___. __ -'--__.__ _ __,

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 23. Reactor vessel collapsed liquid levels for Cases 3 and 5.

37 NUREG/CR-5949

Calculation Results 18.0 Lower head failure 15.0

- 12.0

3.0 Bottom of fuel rods 0 -

0

'J as Q)

First accumulator injectio a:

0.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Fngure 25. Reactor vessel collapsed liquid levels in Cases 4 and 6.

This process may be easier to visualize if one views the cold legs and downcomer as one side of a U-tube manometer and the core as the other side. Accumulator water is injected into the cold legs, which are approximately 1.4 m above the top of the core. The accumulator water flows through the downcomer and into the lower head, where it encounters the bottom of the core. Wa-ter is then pushed into the core (by the pressure of the downcomer column) until it is balanced by the head required to force any generated steam through the core. In Case 4, the flow resistance in the core was relatively low. Therefore, a rela-tively small head on the downcomer side of the manometer was sufficient to raise the liquid level and force the associated steam out of the core.

Accumulator injec;tion stopped when vaporiza-tion at a given liquid level was sufficient to raise the RCS pressure above the accumulator pres-sure. In Case 6, however, the core resistance was higher because of the ballooning deformation.

To force water into the core, a corresponding lev-el increase in the downcomer side of the manom-eter was required. After accumulator injection NUREG/CR-5949 40 terminated, the excess gravity head in the down-comer continued to feed the core, resulting in a higher liquid level in Case 6. This process was even more noticeable during the third injection, which reached the mid-core elevation where the deformations and corresponding flow resistance were larger.

The differences in reactor vessel liquid levels produced a sharp contrast in the RCS pressure re-sponse in the two cases, as shown in Figure 26.

As indicated, vaporization and the corresponding RCS pressure increase were significantly higher in Case 6. The pressure increase to approximate-ly 8.0 MPa was the result of a high liquid level, which penetrated into hotter areas of the core where ballooning had generated relatively large surface areas for heat transfer. Compared to Case 4, a relatively long period was then required to vent the excess steam through RCP seal leaks in order to reduce the pressure for the fourth ac-cumulator injection. (Perturbations during the depressurization were the result of the code anomaly discussed in Section 3.3.)

as a..

~ -

Q)...

I U)

U)

Q)...

a..

18.0 15.0 12.0 9.0 6.0 3.0 0.0 Calculation Results 1-- Case41

---* Case~

Lower head failur 0.0 100.0 200.0 300.0 400.0 500.0 Figure 26. RCS pressures in Cases 4 and 6.

The third accumulator injection in Case 6 penetrated far enough into the core to cause ex-tensive fragmentation. At the time of the fourth accumulator injection, rubble debris was core-wide from an average elevation of about 0.6 m above the bottom of the fuel to the top of the core. In addition, relatively thick metallic crusts had solidified in the lower levels of all three flow channels, with corresponding flow area reduc-tions of 89% (consistent with the inputs de-scribed in Table 2). In contrast, rubble debris was confined to the central regions of the core in Case 4. Furthennore, thinner metallic crusts had solidified at significantly higher elevations. As a result, the lower levels of the core were relatively open in Case 4. Obviously, the hydraulic resis-tance during the fourth accumulator injection in Case 6 was significantly higher than the hydrau-lic resistance for either the fourth or fifth injec-tion in Case 4. Thf fourth accumulator injection in Case 6 was relatively large, as a result of those differences. In fact, the injection was sufficient to completely cover the core, as indicated in Fig-ure 25.

Time (min) 41 The core bypass was an important part of the reflood in Case 6. In fact, the bypass represented the path of least resistance for the stated debris conditions. Therefore, the liquid level in the by-pass readily followed the level in the downcom7 er. As indicated in Figure 27, the bypass filled during the fourth accumulator injection in Case

6. After filling, the excess water spilled into the top of the core. At this point, core flooding was driven from both top and bottom. As shown in Figure 27, the bypass was never filled in Case 4.

The maximum cladding surface temperatures that were calculated as a function of time *are shown in Figure 28. As indicated, the re:flood in Case 6 cooled the entire core (including the ex-isting rubble debris) to a maximum surface tem-perature of about 700 K. Only limited cooling occurred in Case 4, where accumulator injections flooded the core from the bottom. As the liquid penetrated upwards toward hot core regions, va-porization tended to force the flooding water through core crossfiow junctions toward cooler locations. If Figures 25 and 28 are compared, NUREG/CR-5949

Calculation Results E

Bypass filled and spilled into ci> >

~ 3.0

!2

J

.2" "O

Cl)

[ 2.0 c:tS 0

0 UJ

~

a. 1.0

.0 Cl) 0

()

1-Case41 Case 6 top of core_-,-,

11 I I I I I

I I

~

I I

I I

I 0.0 L__-~~-----1..~~~----'------'--L----'---'--'--'----------'-

1.___._,..._.~___,_ _

__,_~~~------'

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure 27. Core bypass collapsed liquid levels in Cases 4 and 6.

4000.0 ----~--~-~--~---.---~--,---.---

q -

~

J 1a cii 3000.0

a.

E Cl) -

Cl) 0 {g 2000.0

J UJ Id 0

E 1000.0

J E

-~

~

Molten r.elocation Core reflood ~

/ / ~

I I

,' I I

/

\\

I

\\

J I

I I

I I

I I

I I

I I

I 1-- Case41 Case 6 0.0 L__~~~-----1..~~~~~---'-~~~-____JL....._~~~---'---~-----.J 0.0

- 100.0 200.0

, 300.0 400.0 500.0 Time (min)

Figure 28. Maximum cladding surface temperatures in Cases 4 and 6.

• NUREG/CR-5949 42

one sees that maximum cladding surface temper-atures were reduced during the accumulator in-jections. However, the core basically remained hot in Case 4. In Case 6, reflood from both top and bottom significantly cooled all fuel and de-bris in the core region. Crossflow away from the hot spots was not effective because all core loca-tions were liquid-filled. (It should be noted that the erratic behavior shown in Figure 28 occurs not only during accumulator injections but also when core materials heat and slump into an exist-ing molten pool, which temporarily drops the pool temperature.)

A complete reheating of the core, including the initial formation of a molten pool at 345.0 minutes, followed the core reflood in Case 6.

There were no accumulator injections during the reheat because a substantial period of time was required to vent the excess steam generated dur-ing the fourth injection. A fifth and final accu-mulator injection did occur at 363.2 minutes.

However, the injection was small and ineffective because most of the accumulator water had been discharged by that time. Without accumulator injections, the core heatup continued, including a thermal attack on the crust supporting the in-core molten pool. As a result, crust failure occurred at 383.8 minutes, 42.2. minutes earlier than in Case

4. The crust in Case 4 remained intact longer than in Case 6 because of the differences in cool-ing associated with accumulator injection. As in-dicated in Figure 25, at approximately 360 minutes, the core liquid level resulting from the final accumulator injection was significantly higher in Case 4. Since most of the accumulator water was depleted during core reflood, the final injection in Case 6 was relatively small and inef-fective in terms of cr;ust cooling. Approximately 44,370 kg of molten U02 were relocated to the lower head following crust failure in Case 6.

Lower head failure followed at 389.8 minutes, about 43.2 minutes earlier than in Case 4.

The core reflood in Case 6 reduced the tem-perature of the steam circulating in the ex-vessel structures. As indicated in Figure 29, ex-vessel heatup was effectively terminated. As a result, ex-vessel failures were not predicted before low-er head failure in Case 6. Since all ex-vessel 43 Calculation Results RCS pressure boundaries were intact at the time of lower head failure and there was no apparent way to heat those structures to failure, it is rea-sonable to expect that the lower head failure as described will be the first breach of the RCS for the conditions assumed in this calculation.

The RCS pressure at the time of lower head failure was approximately 1.37 MPa. Consistent with NUREG-1150, the potential for HPME is assumed to be low if the RCS pressure is below *

• 1.38 MPa at vessel breach. However, the uncer-tainties in the calculation are much larger than that margin. Therefore, it appears that a potential for HPME could exist in the Surry NPP for the set of conditions considered in Case 6.

Results from Cases 4 and 6 indicate that the amount of deformation associated with balloon-ing can significantly impact the core damage pro-gression. In Case 4, accumulator injections provided only partial cooling; and the total relo-cation was limited to approximately 12,940 kg of molten U02. In Case 6, the core was reflooded and had to reheat before a molten relocation of about 443*70 kg of U02. In addition, the results indicate that the time to lower head failure de-creases as ballooning deformation increases.

However, in spite of the observed differences, the potential for HPME remained unaltered be-cause lower head failures occurred before ex-vessel failures in both cases.

3. 7 Uncertainties The SCDAP/RELAP5/MOD3 calculations were reviewed to identify uncertainties that could affect the RCS response and the timing of events during transient progression. These un-certainties, which were separated into either thermal-hydraulic or core damage progression categories, are discussed in the following sec-tions. The discussion is focused on how the un-cert&inties could affect the timing of the RCS pressure boundary failµres because those failures are critical in this assessment of the potential for HPME.

3.7.1 Thermal-Hydraulic Uncertainties.

The initial conditions used in this analysis were NUREG/CR-5949

Calculation Results 1200.0,-----,-----,----,----,---*--r-------r-----r----,

1000.0 q -

Q)

~

800.0 Q)

a.

E Q)

I-

-- Loop C hot leg nozzle e--e Loop C steam generator tube B--£J Surge line 400.0 ~--~--~-_ _,__ __

().0 100.0 200.0 Time (min) 300.0 400.0 Figure 29. Volume-averaged ex-vessel piping temperatures in*the pressurizer loop (C) in Case 6.

based on best estimates, as established in a previ-ous study. 2 It should be noted, however, that some of the initial conditions have the potential to significantly change the timing of the transient progression.

The decay power level and the steam generator secondary liquid inventory at the time of transient initiation are two of the more important parameters.

heatup and failure in the ex..:vessel piping. In other words, a higher decay power level or a low-er steam generator secondary liquid inventory would tend to accelerate both lower head and ex-vessel failures. Therefore, changes in the initial decay power level or steam generator secondary liquid inventory will change the absolute timing of transient events. Effects on the relative timing between lower head and ex-vessel failures' asso-ciated with changes in either parameter are un-known.

The hot leg countercurrent natural circula-tion model was developed to match calculated extrapolations of low-pressure, low-temperature experimental data. 2 The same model has also been shown to adequately match data from an experiment that was scaled to represent high-pressure conditions. a Although the model was developed to match the overall heatup, there is A higher decay power level at the time of transient initiation would accelerate core heatup, melting, and lower head failure. A lower steam generator secondary liquid inventory would have a similar effect. Specifically, a lower liquid in-ventory would decrease the time to steam gener-ator dryout and the start of core heatup.

Decreasing the time to core heatup is equivalent to increasing the power level because less time is allowed for decay. In additron, higher steam temperatures would be generated earlier in the transient during an accelerated core heatup asso-ciated with either a higher decay power level or a lower liquid inventory. Natural circulation of the higher-temperature steam would lead to earlier some uncertainty in the ex-vessel temperature distribution as a result of the way hot leg coun-tercurrent natural circulation was represented.

Specifically, heat and mass transfer were pre-NUREG/CR-5949 44

eluded by a physical separation of the counter-current flows. If flQw interactions were modeled, the temperature difference between the hot leg outflow and return flow could decrease, which could affect the temperature distribution in the ex-vessel piping. Results indicate that the uncer-tainty is unimportant if the RCS remains at full system pressure because ex-vessel failures oc-curred before lower head failure with and with-out hot leg countercurrent natural circulation.

The effects of the hot leg countercurrent natural circulation model in cases with RCP seal leaks were not investigatedi.

• Accumulators are passive devices that re-spond only to the RCS pressure. The RCS pres-sure, however, is strongly influenced by the vaporization that occurs as accumulator water cools the core. Based on the maturity of thermal-hydraulic portions of SCDAP/RELAP5/MOD3, it was assumed that in-core heat transfer was rea-sonably predicted for rod-like geometries. Un-certainties increase, however, with the level of core degradation. As discussed in Appendix G, an attempt was made to account for those uncer-tainties in the process of devele,>ping probabilities for RCS pressure boundary failures.

All external RCS pressure boundaries were assumed to be adiabatic in this.analysis. It is rec-ognized that some heat loss to the containment atmosphere would occur, especially as tempera-tures increase, with a possible degradation of in-sulation performance. Allowing for heat losses

. from the ex-vessel piping has been shown to re-duce piping tem~ratures and delay their failure by a few minutes.2 Although it was not investi-gated, a similar delay in the time to vessel failure would be expected if heat losses from the lower

• head were accounted for. Therefore, the adiabat-ic assumption does affect the absolute timing of all RCS pressure boundary failures but should not have a significant affect on the relative tim-ing between those failures, assuming that the

a. D. J. Pafford et al., Natural Circulation Flow in the Westinghouse High Pressure SF6 Experiments using RELAP5/MOD3, EG&G Idaho, Inc., June 1992, tech-nical report transmitted through D. J. Hanson letter to C.R. Troutman, DJH-12-92, June 11, 1992.

45 Calculation Results degradation of insulation is similar at all bound-aries.

SCDAP/RELAP5/MOD3 calculates creep rupture failures using a one-dimensional temper-ature profile at user-specified locations. The one-dimensional assumption simplifies the coding and is reasonably accurate for moderately sized pipes (i.e., the surge line, hot leg, and steam gen-erator tubes) over the range of conditions consid-e~ed in this analysis. However, the assumption is more conservative as the ratio of radius to wall thickness increases (i.e., the lower head). Scop-ing calculations, based on two-dimensional structural analyses of lower head geometries, in-dicate that the SCDAP/RELAP5/MOD3 predic-tion of the time between molten relocatio'n and lower head creep rupture in this analysis could be underpredicted by a factor of two to four. a Steam generator tubes were assumed to be defect-and degradation-free in all calculations.

Based on that assumption, creep rupture failures of the tubes were not predicted in any of the cas-es considered. A detailed structural analysis would be required to determine if any specific defect could contribute to the potential for a tube failure during a station. blackout transient. If steam generator tube failure occurred before lower head failure, the severity of HPME would be minimized by RCS pressure reduction. How;.*

ever, the obvious problem of containment bypass would be introduced in such a case.

3.7.2 Core Damage Progression Uncer-tainties. There are a number of uncertainties in the calculation of core damage progression. In most cases, these uncertainties result from the fact that there are relatively little experimental data to clearly define all processes involved.

Furthermore, the information that is available is generally limited to one-dimensional experimen-tal data, which may or may not be completely ad-equate for representation of a large PWR core.

For those reasons, this analysis was performed with core damage inputs that should produce a

a. Private communication, S. A. Chavez and J. L.

Rempe, EG&G Idaho, Inc., Idaho Falls, ID, Decem-ber 1991.

NUREG/CR-5949

Calculation Results conservative assessment of the potential for HPME. Specifically, best estimates were used if data and current understanding support such in-put. For all other parameters (with higher de-grees of uncertainty), input was selected to accelerate core damage progression and the time to lower head failure. This approach provides the basis for a conservative evaluation of the po-tential for HPME because time is minimized for generation of an ex-vessel failure by natural con-vection heating and for RCS inventory depletion.

The following uncertainties should be considered with respect to these conservative aspects of this analysis.

Oxidation of the Zr cladding of in-core com-ponents is calculated in the current version of SCDAP/RELAP5/MOD3. However, oxidation is terminated when rod-like geometry is lost, while oxidation of any component outside the core is not considered at all. As a result, hydro-gen production could be underpredicted in the current calculations. With respect to the poten-tial for HPME, however, it is more important to note that the code-calculated heatup may be slow because all of the pertinent oxidation reactions are exothennic. Therefore, if oxidation is under-predicted, core temperatures will be underpre-dicted. In that case, the calculated times for core melting, relocation, and lower head failure could be late. If the core temperatures are underpre-dicted, the calculated time of ex-vessel failures could also be late because the circulating steam temperatures that drive the ex-vessel heating would be low. In other words, the timing of both lower head and ex-vessel failures could be de-layed by the current treatment of oxidation in the code. A more detailed treatment of oxidation would be expected to accelerate both lower head and ex-vessel failure times. A significant change in the relative timing between the events would not be expected because an oxidation-driven in-crease in core heatup would be accompanied by a corresponding increase in the steam temperatures that generate ex-vessel failures.

Vessel failure can occur following relocation of molten materials from the core into the lower head. In the current version of SCDAP/RE-LAP5/MOD3, relocation typically results from a NUREG/CR-5949.

46 failure of the crust supporting an in-core molten pool. Crust failure is a function of the heat ab-sorbed from the molten pool and the heat that can be rejected from the crust surface. Uncertainty in calculating heat transfer from the molten pool arises from the fact that the pool characteristics for either laminar or turbulent free convection are not completely understood. Heat rejected from the outside surface of the crust is limited by the code to convection and radiation to the sur-rounding coolant. Direct radiation to nearby structures (i.e., the lower core support plate) is not considered, although the coolant ultimately transfers the energy to those structures by con-vection. A probabilistic assessment of the effects of these uncertainties was included in Appendix G because the timing of lower head failure is di-iectly related to crust heatup and failure.

An RCS pressure reduction can occur in the subject transient through leak paths (i.e., the RCP seals) or as a result of a temperature or pressure-induced failure of the pressure boundary. With respect to the potential for HPME, there are three modes for repressurization of the RCS: (a) the vaporization that occurs as accumulator water cools the core; (b) the vaporization that occurs as the RCS coolant absorbs heat from debris during relocation to or while in the lower head; and (c) the effects associated with an energetic fueVcool-ant interaction (i.e., a steam explosion). The ef-fects of the first two modes were considered in this analysis. The potential for a fueVcoolant in-teraction and its impact on the potential for HPME was not investigated.

As described in Appendix B, the Surry NPP core was divided into three flow channels. All of the fuel bundles in each channel were simulated by a single fuel rod component and a single con-trol rod component. When these components reached a certain temperature or damage state, that condition was assumed to apply to all fuel bundles represented by the component A sensi-tivity study was not performed to determine if any adverse effects were introduced by this no-dalization.

SCDAP/RELAP5/MOD3 has the capability to model fission product transport following fuel

cladding failures. However, this feature was not exercised in this analysis. Although it was not investigated, heating as a result of fission product deposition would not be expected to significantly alter the time to a surge line or hot leg failure.

However, fission product heating could be a more significant concern with respect to the rela-tively thin steam generator tubes, particularly if tube defects are considered.

• Fission products could be deposited in the steam generator tubes 47 Calculation ~esults as long as the surge l,ine and hot leg piping re-mained intact. (Thereafter, the steam generators would be effectively isolated from the source of

fission products by the break.) The potential for steam generator tube failure before failures in the surge line and hot leg piping could be increased by the addition of fission product heating. As in-dicated, however, fission product transport calcu-

' lations were not performed to allow assessment of this potential.

NUREG/CR-5949

Depressurization Probabilities

4. DEPRESSURIZATION PROBABILITIES Intentional depressurization of the RCS be-fore reactor vessel breach has been proposed as an accident management strategy to mitigate the severity of HPME in PWRs. An independent analysis (supporting an NRC Accident Manage-ment Program) is planned to determine the risk impact associated with implementing this strate-gy in the Surry NPP. Probabilities for the RCS depressurization issues of (a) a surge line/hot leg failure and (b) the RCS pressure at reactor vessel breach are summarized in this section for use in the risk analysis.

Probabilities for both of the stated RCS de-pressurization issues were generally based on the results from current SCDAP/RELAP5/MOD3 analyses. However, the code results were not used directly. Instead, engineering judgment and sensitivity calculations were applied to evaluate the effects of potential uncertainties. A complete description of the assumptions and methods used to develop the resulting probabilities is provided in Appendix G.

Probabilities for each RCS depressurization issue were developed for four different Surry NPP scenarios: (a) TMLB' sequences without RCP seal leaks (at full system pressure), (b)

TMLB' sequences with seal leaks of250 gpm per RCP, (c) TMLB' sequences with seal leaks of 480 gpm per RCP, and (d) TMLB' sequences with either stuck-or latched-open PORVs.

Therefore, probabilities presented in the follow-ing sections are conditional on the occurrence of the specific scenarios in the Surry NPP.

4.1 Surge Line/Hot Leg Failure Issue The surge line/hot leg failure issue relates the potential failure of ex-vessel piping and the RCS pressure response to failure of the reactor vessel lower head. Consistent with NUREG-1150, the issue can be stated as follows:

What is the probability that the surge line or hot leg will fail and depressurize the RCS to a low pressure before lower head failure?

As was done in NUREG-1150, a low pres-sure was assumed to be any pressure at or below 1.38 MPa. If the issue probability is high, the potential for HPME and the associated potential for DCH is low. Conversely, if the issue proba-bility is low, the RCS pressure at the time oflow-er head failure could result in an HPME. Under those conditions, the potential impact of DCH in the Surry NPP may require further analysis.

Probabilities for the surge line/hot leg failure is-sue, applicable to the previously identified sce-narios, are listed in Table 9.

I The RCS pressure is maintained at the PORV set point through continuous cycling of the relief valves in TMLB' sequences without RCP seal Table 9. Probabilities of the surge line/ hot leg failure issue given the occurrence of the specific scenarios in the Surry NPP.

Scenario TMLB' sequences without RCP seal leaks TMLB' sequences with seal leaks of 250 gpm per RCP TMLB' sequences with seal leaks of 450 gpm per RCP TMLB' sequences with stuck-open/latched-open PORVs 49 Probability 0.98 0.98 0.0 1.0 NUREG/CR-5949

Depressurization Probabilities leaks. Steam flow associated with the PORV cy-cling heated the surge line at high pressure. Cal-culated results indicated that creep rupture failure of the surge line would occur well ahead of lower head failure. After accounting for un-certainties in the results, it was concluded that there was a small fraction of the time where low-er head failure could occur before RCS depres-surization through the surge line. On that basis, a probability of 0.98 was assigned, as indicated in the Table 9.

Surge line heating was similar in TMLB' se-quences with either stuck-open or latched-open PORVs. In that scenario, however, flow through the surge line was continuous, which significant-ly reduced the RCS pressure. By the time high surge line temperatures were reached ( and before there was any potential for lower head failure),

the RCS pressure was near the containment pres-sure. Because creep rupture is a function of both temperature and differential pressure and be-cause the differential pressure was low, surge line failure occurred relatively late in the tran-sient. a After uncertainties were considered, it was concluded that there was only a very small fraction of the time where the lower head could fail before the surge line. The fraction was small enough to justify a probability of 1.0, as listed in Table 9. Those results clearly indicate that the potential for HPME in the Surry NPP is very low for TMLB' sequences without RCP seal leaks and for TMLB' sequences with stuck-open/

latched-open PORys.

It should be recognized that the PORVs could be latched open or could stick open at vir-tually any time during a TMLB' sequence. In this assessment, however, it was assumed that the probabilities for the surge line/hot leg failure is-sue would not be significantly altered by the PORV opening time. Furthermore, probabilities for both latched-open and stuck-open conditions

a. From a practical s$tdpoint, the time of surge line failure was unimportant because the RCS pressure was low. However, timing was important within the context of this issue. The fact that the RCS pressure was low before vessel breach was directly accounted for within the second depressurization issue.

NUREG/CR-5949 50 were assumed to be equivalent. Those assump-tions were developed as follows.

SCDAP/RELAP5/MOD3 results for imple-mentation of the late depressurization strategy in the Surry NPI>2 were used as the basis for evalua-tion of the surge line/hot leg failure issue. In the late depressurization strategy, PORV cycling controls the RCS pressure until plant operators latch the PORVs open at the time core exit tem-peratures reach 922 K. It was determined that the surge line would fail before failure of the lower head in that calculation. Results from pre-vious analyses indicated the same result with re-spect to the surge line/hot leg failure issue if the PORVs were latched open at an earlier time.

Specifically, if the PORVs are latched open at the time of steam generator dryout, surge line fail-ures are predicted to occur before lower head failure. 1 (It should be noted that there are sub-stantial differences in terms of core damage as a function of the time at which the PORVs are latched open. However, the level of core damage is of no concern in this particular issue.) Based on current understanding and the available calcu-lations, there is no reason to expect any differ-ence in results applicable to this issue if any other relatively early times were selected. In oth-er words,.the PORVs could be latched open be-fore the time core exit temperatures reach 922 K without impacting the probability given in Table

9.

If the PORVs are latched open at some time after core exit temperatures reach 922 K, RCS pressure control through PORV cycling would be extended. Results from the Base Case (docu-men~ed in this assessment) indicate that PORV cycling subjects the surge line to heating at high-pressure conditions. If the heating is allowed to continue (i.e., if it is not interrupted by latching the PORVs open), surge line failure would occur more than 240 minutes ahead of the lower head failure. If the PORVs are latched open before surge line failure (i.e., before sufficient heating at high pressure has transpired), some creep rupture damage will be accumulated. The subsequent RCS pressure reduction would result in cladding ruptures and the injection of accumulator,water.

High-temperature steam from the subsequent I

boiloff and the energy associated with oxidation of the inner surf aces of the ruptured cladding would be deposited in the surge line. Surge line failure, as a result of the heating associated with boiloff and oxidation, would be expected well ahead of lower head failure. That expectation is based on the fact that some surge line creep dam-age will have accumulated and the fact that the surge line response to the subsequent boiloff would not be sub~tantially different than the re-sponse associated with late depressurization (where the surge line failed before the lower head). Therefore, based on current understand-ing and the available calculations, the probability given in Table 9 would not be significantly al-tered by the time at which the PORVs are latched open.

Similar reasoning applies to the time at which the PORVs could stick open. In fact, there is no basis to differentiate between a latched-open condition and a stuck-open condition, given that the operators could latch the PORVs open at any given time. Therefore, the probabilities for both latched-open and stuck-open conditions are assumed to be equjvalent.

In both RCP seal leak scenarios, the total core decay energy was split between heat that was transferred to the hot leg piping by counter-current natural circulation and the energy dissi-pated through the RCP seal leaks. With seal leaks of 250 gpm per RCP, hot leg countercurrent natural circulation was sufficient to heat the hot legs to a failure condition before lower head fail-ure. After accounting for uncertainties in the cal-I culated results, 1t was concluded that there was a small fraction of the time where lpwer head fail-ure could occur before RCS depressurization through the hot leg. On that basis, a probability of 0.98 was assigned. When the seal leaks were

• increased to 480 gpm per RCP, however, hot leg heating was reduced because a larger fraction of the decay energy was lost through the RCP seal leaks. A comparison of Figures 15 and 21 pro-vides an indication of the reduction in hot leg heating that occurred. Hot leg (and surge line) temperatures were significantly cooler with a seal leak of 480 gpm per RCP. As a result, the hot legs were not heated to a failure condition be-51 Depressurization Probabilities fore lower head failure. Uncertainties in hot leg heating and the lower head failure time were not large enough to alter that result. Therefore, a probability of 0.0 was assigned to the scenario with seal leaks of 480 gpm, as indicated in Table

9.

4.2 RCS Pressure at Vessel Breach Issue Consistent with NUREG-1150, the issue of RCS pressure at vessel breach can be simply stat-ed as follows:

What are the probabilities of being at a low ( < 1.38 MPa), intermediate (1.38 to, 6.89 MPa), and high (> 6.89 MPa) RCS pressure at the time of reactor vessel breach?

There was a single caveat that is not reflected in the issue statement. Specifically, probabilities were required without taking credit for RCS de-pressurization following any potential ex-vessel piping failure. That exception was necessary be-cause the RCS pressure response associated with ex-vessel failures was addressed in the surge line/hot leg failure issue. It is important to note that the SCDAP/RELAP5/MOD3 calculations that were used to evaluate this issue were per-fonned consistent with that requirement. As pre-viously discussed, ex-vessel failures were recorded as predicted by the code; but a corre-sponding RCS blowdown was not modeled.

Probabilities for the RCS pressure at vessel breach issue are given in Table 10. The listed values are conditional on the occurrence of the previously defined scenarios in the Surry NPP given that ex-vessel failures do not occur.

For TMLB' sequences without RCP seal leaks, the RCS pressure was controlled through the time of lower head failure by continuous PORV cycling between the opening and closing set points of 16.2 and 15.7 MPa, respectively.

The RCS pressure at.vessel breach was obvious-ly in the high-pressure range, and probabilities were assigned as appropriate. Those results were reversed by the continuous flow associated with NUREG/CR-5949

Depressurization Probabilities Table 10. Probabilities of the RCS pressure at vessel breach issue given the occurrence of the specific see-narios without ex-vessel failures in the Surry NPP.

Probability, at vessel breach, for High RCS Intermediate Low RCS Scenario pressure RCS pressure pressure

(> 6.89 MPa)

(1.38 - 6.89 MPa)

(<1.38 MPa)

TMLB' sequences without RCP seal leaks TMLB' sequences with seal leaks of 250 gpm perRCP TMLB' sequences with seal leaks of 450 gpm perRCP TMLB' sequences with stuck-open/latched-open PORVs TMLB' sequences with either stuck-open or latched-open PORVs. Specifically, it was con-cluded that continuous flow through the Surry PORVs was sufficient to depressurize the RCS to 1.38 MPa (or less) well ahead of the time oflow-er head failure. Uncertainties in the failure time and the potential for repressurization (through accumulator injection and/or debris/coolant heat transfer) were conisidered before assigning a probability of 1.0 to the low-pressure range.

As discussed in Section 4.1, the PORVs could be latched open or they could stick open at virtually any time during a TMLB' sequence.

However, the time at which the PORVs are opened is of little consequence with respect to this issue, based on the following logic.

The RCS would depressurize to 1.38 MPa (or less) through the PORVs,if the valves were opened at any time before failure of the in-core crust. This was verified by SCDAP/RELAP5 calculations for the relatively early PORV open-ing times associated with implementation of both the early and late depressurization strategies in the Surry NPP. 1*2 Results from the RCP seal leak cases (documented in this assessment) indi-cate that accumulator injections can cool the in-core crust and effectively delay molten reloca-tion. Therefore, if the.PORVs were opened rela-NUREG/CR-5949 1.0 0.21 0.13 0.0 52 0.0 o.o 0.75 0.04 0.40 0.47 0.0 1.0 tively early, the RCS would be depressurized. If the P:ORVs were opened near the time of crust failure, accumulator injections would cool the in-core crust, which would delay crust failure and.

molten relocation. After the accumulator water was boiled away (and vented through the open PORVs), crust heatup and failure would occur at a low RCS pressure.

If the PORVs were opened at the time of crust failure, accumulator injections may or may not effectively cool molten materials as ~ey re-locate to the lower head. As a result, lower head failure could occur at a high RCS pressure.

However, the probabilities of the operator latch-ing the PORVs open and the PORVs sticking open within this small time window were as-sumed to be negligible. This assumption was based on the idea that if an operator were going to open the PORV s to de pressurize, that action would take place well ahead of any molten relo-cation. In other words, if the operator decided to depressurize, a reasonable amount of time would be allotted to do so. The conditions that would cause the PORVs to stick open are primarily as-sociated with operation of the valves at tempera-tures well above design conditions. The PORVs would see many cycles at elevated temperatures before the time of crust failure. If the PORVs were going to stick open as a result of the ad-

verse conditions, it would seem most likely for that failure to occur during one of the many cy-cles long before failure of the crust. Therefore, the time at which the PORVs are opened would not significantly impact the probabilities listed in Table 10 because the probability of the PORVs opening at the time of crust failure was assumed to be small.

Seal leaks of 2~0 and 480 gpm per RCP were sufficient to reduce the Surry RCS pressure well below the PORV set point to pressures that al-lowed accumulator injection. An RCS repressur-ization followed each injection, as the water was vaporized during core cooling. A period of time elapsed between the injections while the excess vapor was discharged through RCP seal leaks.

RCS repressurization could also occur during re-location to the lower head, as a result of heat transfer between the molten debris and coolant.

Those mechanisms for repressurization provided the potential for intermediate and high pressures in the seal leak scenarios.

53 Depressurization Probabilities Uncertainties in the seal leak calculations were evaluated to establish the period bver which lower head failures could have occurred. RCS pressures during the lower head failure periods were estimated based on the calculated results and the potentials for repressurization. The RCS pressure at vessel breach issue was then. quanti-fied by assuming that the probabilities were pro-portional to the fraction of each lower head failure period that corresponded to the specified pressure ranges.

F;or seal leaks of 250 gpm per RCP, lower head failures could have occurred at high, inter-mediate, and low RCS pressures 21 %, 75%, and 4% of the time, respectively. On that basis, prob-abilities of 0.21, 0.75, and 0.04 were assigned to t;he high, intermediate, and low pressure ranges, respectively, as indicated in Table 10. Probabili-ties of 0.13, 0.40, and 0.47 were estimated for high-, intermediate-, and low-pressure ranges, re-spectively, for seal leaks of 480 gpm per RCP.

NUREG/CR-5949

Conclusions.and Recommendations

5. CONCLUSIONS AND RECOMMENDATIONS A detailed SCDAP/RELAP5/MOD3 analy-sis of the Surry NPP response to a TMLB' tran-sient without operator actions has been perfonned. The analysis was designed to assess

. the potential for HPME through calculation of (a) the time and location of the initial RCS pres-sure boundary failure, (b) the associated RCS conditions at the time of the initial pressure boundary failure, and (c) the RCS conditions at the time of reactor vessel lower head failure.

These results were then used to evaluate (a) the probability that an ex-vessel failure will occur before failure of the lower head and (b) the prob-ability of being at a low RCS pressure at the time of lower head failure. Conclusions and recom-mendations pertinent to this work are presented below.

1. If the RCS is not depressurized by leaks, natural circulation of steam and steam flow through the pressurizer PORVs can be expected to induce creep rupture fail-ures in the surge line and hot leg piping before failure of the lower head.

Under these conditions, the RCS pres-sure will be maintained by pressurizer PORV cycling. During each valve cycle, energy will be transferred from the core to the surge line and hot leg piping. Hot leg countercurrent natural circulation will be established between PORV cy-cles, which will also transfer core decay heat to the hot legs. As a result, both the surge line and the hot legs would be ex-pected to fail before failure of the lower head. However, the surge line will be heated to a failure condition before the hot legs because it is relatively thin.

(The steam generator tubes were as-sumed to be free of defects in all calcula-tions perfonned. Given that assumption, failure of the steam generator tubes would not be expected because the circu-lating steam loses a significant amount of energy before reaching the steam gen-era to rs, l~aving the tubes relatively 55 cool.) Although the calculation was not performed, previous studies indicate that the RCS could be depressurized from the PORV set point pressure before lower head failure through either a surge line or hot leg bre~ch.

2. If the RCS is not depressurized by leaks, surge line and hot leg failures can be expected before failure of the lower head even if hot leg countercurrent natural circulation does not occur.

Hot leg countercurrent natural circula-tion does provide an effective mecha-nism for the transfer of core decay heat to the ex-vessel piping. If that heat transfer is eliminated, heatup of the core and in-vessel structures will accelerate, with corresponding increases in steam temperatures. Under these conditions, however, the surge line and hot leg will also be exposed to higher temperatures during each PORV cycle. As a result, both surge line and hot leg creep rup-tures should be induced before failure of the lower head. Without hot leg counter-current natural circulation, heating of the steam generator tubes is minimal.

3. Surge line and hot leg failures can be expected before failure of the lower head if the RCS pressure is reduced below the pressurizer PORV set point by seal leaks of 250 gpm per RCP.

The flow area introduced into the calcu-lations to provide an initial seal leak rate of 250 gpm per RCP is sufficient to drop the RCS pressure below the PORV set point. Surge line heating decreases when the RCS pressure drops, since PORV cycling stops. However, ex-vessel heating continues as a result of hot leg countercurrent flow. Although the hot leg is relatively massive, results from the calculations indicate that it would be heated to a failure condition NUREG/CR-5949

Conclusions and Recommendations before the surge line because it is ex-posed to the highest temperature steam leaving the reactor vessel and because surge line heating decreases without PORV cycling. Given that the steam generator tubes are free of defects, fail-ure of the tubes would not be expected because they remain relatively cool.

4. A lower head failure would be the first breach of the RCS pressure boundary if the RCP seals leak 480 gpm per pump.

The flow area introduced into the calcu-lations to provide an initial seal leak rate of 480 gpm per RCP led to relatively early core uncovery and degradation.

However, the high RCP leak rates also depressurize the RCS relatively early, al-lowing earlier accumulator injection that provides some delay in further core degradation. The most important aspect associated with RCP seal leak rates, however, has to do with the effects on ex-vessel heating. The total core decay energy is split into the portion that is (a) deposited in the vessel and ex-vessel structures by circulating steam and (b) dissipated through RCP seal leaks. The results indicate that seal leaks of 480 gpm per RCP dissipate a relatively large fraction of core decay en~rgy, leaving a relatively small fraction for ex-vessel heating. In fact, the results indicate that ex-vessel failures would occur before lower head failure with seal leaks of 250 gpm per RCP but would not be expected with leaks as high as 480 gpm per RCP.

5. Debris/coolant heat transfer during mol-ten relocation to the lower head can sig-nificantly delay failure of the lower head.

Minimum.and maximum debris/coolant heat transfer options are the only heat transfer options currently available in SCDAP/RELAP5/MOD3. With the minimum option, it is assumed that de-bris relocates from the core to the lower head in a coherent stream without heat transfer, resulting in a rapid lower head NUREG/CR-594~

56 thermal attack. With the maximum op-tion, it is assumed that th'e debris will break up as a result of impact with water in the lower head and/or interaction with lower plenum structures. The code then calculates a complete quench of the de-bris, up to the limit imposed by the amount of coolant available. A large RCS pressurization can result during the quench; however, lower head thermal at-tack is delayed until the debris reheats.

Results from the calculations indicate that the delay could be more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

Because the expected result lies between those extremes, refinements in relocation modeling could be useful in future anal-yses.

6. Changes in deformation associated with ballooning of the fuel rod cladding can significantly change core damage pro-gression and the time to lower head fail-ure.

Relatively large restrictions in core flow areas were predicted when the allowable ballooning deformation was set at 15%.

As a result, water injected from the accu-mulators did not effectively penetrate into the bottom of the core. However, a relatively large volume of accumulator water was forced through the core by-pass (between the core barrel and the former plates) because of the core flow area restrictions. The bypass flow was sufficient to reflood the core from the top down before formation of a molten pool.

The accumulators were essentially emp-tied during the core reflood, which elimi-nated the possibility of effective cooling during the subsequent reheating. A rela-tively large relocation of approximately 44,370 kg of molten U02 occurred as a result. With an allowable deformation of 2%, periodic accumulator injection pro-vided only partial cooling of the core hot spots. However, the partial cooling oc-curred over a prolonged period and was sufficient to delay relocation, which con-sisted of about 12,940 kg of molten U02.

The delay in relocation resulted in a cor-responding delay in lower head failure.

Specifically, lower head failure was cal-culated to be 43.2 minutes later than in the case with allowable cladding defor-mation of 15%.

7. There is a low probability for an HPME in the Surry NPP during a TMLB' tran-sient without operator actions.

Four separate scenarios were considered, based on current SCDAP/RELAP/

MOD3 calculations and an assessment of the potential uncertainties in the asso-ciated results. Those scenarios included (a) TMLB' sequences without RCP seal leaks (at full system pressure), (b)

TMLB' sequences with seal leaks of 250 gpm per RCP, (c) TMLB' sequences with seal leaks of 480 gpm per RCP, and (d)

TMLB' sequences with stuck-open/

latched-open PORVs.

In (a), (b), and (d), natural circulation and flow through the PORVs led to surge line and/or hot leg failures before failure of the lower head without any required operator action. After accounting for un-certainties in the calculated results, it was concluded that RCS pressure reduc-tion below 1.38 MPa would occur through the ex-vessel breach before low-er head failure with a high probability.

Specifically, probabilities for a surge line or hot leg failure with RCS depressuriza-tion below 1.38 MPa before lower head failure were assigned values of 0.98, 0.98, and 1.0 given the occurrence of scenarios (a), (b), and (d), respectively.

In (c), an ex-vessel failure was not calcu-lated before lower head failure. For that reason, the probability of a surge line or hot leg failure with RCS depressuriza-tion belo:w 1.38 MPa before lower head failure was assigned a value of 0.0.

However, the probability of being at or 57 Conclusions and Recommendations below 1.38 MPa at the time of lower head failure without an ex-vessel failure was estimated to be 0.47. In addition, the probability of seal leaks as large as 480 gpm perRCP is very small.8 In oth-er words, the results associated with sce-nario (c) would be relatively unlikely.

• Therefore, there is a low probability for an HPME in the Surry NPP based on the scenarios considered.

8. The conclusions of this assessment of the potential for HPME are specific to the SurryNPP.

This assessment was based on a detailed SCDAP/RELAP5/MOD3 analysis of the Surry NPP to detennine the response of the plant during a TMLB' transient without operator actions and the corre-sponding potential for HPME. An eval-uation of the applicability of these results to other plants was outside the scope of this program. However, some of the factors that would have to be con-sidered include pressurizer PORV capac-ity; decay heat level; accumulator capacity and initial pressure; steam gen-erator size, type, and initial liquid inven:..

tory; and hot leg, surge line, and reactor vessel geometries. These factors are considered important because they could influence the core damage progression and the natural circulation of steam throughout the plant. Without operator actions, natural circulation provides the required mechanism for generating ex-vessel failures. The timing of the ex-vessel failures relative to core damage progression detennines the potential, for HPME. Therefore, a plant-specific un-derstanding of natural circulation and its I

relationship to core damage progression would be required to extend the results to other NPPs.

NUREG/CR-5949

• 1.

2.

3.

4.

5.

6.

7.

8.

9.

References

6. REFERENCES D. J. Hanson et al., Depressurization as an Accident Management Strategy to Minimize the Conse-quences of Direct Containment Heating, NUREG/CR-5447, EGG-2574, October 1990.

D. A. Brownson, L. N. Haney, and N. D. Chien, Intentional Depressurization Accident Management Strategy for Pressurized Water Reactors, NUREG/CR-5937, EGG-2688, April 1993.

P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAP!

RELAP5, NUREG/CR-5214, EGG-2547, October 1988.

R. C. Bertucio and J. A. Julius, Analysis of Core Damage Frequency From Internal Events: Surry Unit 1, NUREG/CR-4550 (Draft), Revision 1, Volume 3, September 1988.

C. M. Allison et al., SCDAP/RELAP5/MOD3 Code Manual, NUREG!CR-5273, EGG-2555 (Draft),

Revision 2, Volumes 14, September 1991.(available from EG&G Idaho, Inc.)

T. Boardman et al., Leak Rate Analysis of the Westinghouse Reactor Cooling Pump, NUREG/CR-4294, 85-ETEC-DRF-1714, July 1985.

C. I. Ruger et al., Technical Findings Related to Generic Issue 23: Reactor Coolant Pump Seal Fail-ure, NUREG/CR-4948, BNL-NUREG-52144, March 1989.

T. A. Wheeler et al., Analysis of Core Damage Frequency From Internal Events: Expert Judgment Elicitation, NUREG!CR-4550, SAND86-2084, Vol. 2, April 1989.

U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990.

59 NUREG/CR-5949

APPENDIX A SCDAP/RELAP5/MOD3 CODE DESCRIPTION A-1

APPENDIX A SCDAP/RELAPS/MOD3 CODE DESCRIPTION Appendix A SCDAP/RELAP5/MOD3 is a light water reactor 1LWR) transient analysis computer code tpat is currently being developed._, It can be used to simulate a wide vari~ty of system transients of interest in LWR safety, but it is specifically designed to calculate the behavior of the reactor coolant system during severe accidents.

The core, reactor coolant system, secondary system including feedwater and steam/turbine trains, and system controls can be simulated.

The code models have been designed to permit simulation of

• severe accidents up to the point of reactor vessel failure.

SCDAP/RELAP5/MOD3 was produced by incorporating models from the SCDAP,A-2 TRAP-MELT, A-3.4 and COUPLEA-5 codes into the RELAP5/MOD3A-6 code.

SCDAP models provide coding for simulation of the reactor core.

TRAP-MELT models serve as the basis for simulation of fission product transport and deposition.

COUPLE models provide coding to allow two-dimensional, finite-element heat conduction/convection calculations at user-specified locations.

(Detailed thermal simulation is typically used to represent molten regions in the core or lower head.)

And finally, RELAP5/MOD3 models allow simulation of the fluid behavior throughout the system, as well as the thermal behavior of structures outside the core.

Feedbacks between the various parts of the code were developed to provide an integral analysis capability.

For example, changes in coolant flow area associated with ballooning of fuel cladding or relocation are taken into consideration in the hydrodynamics.

SCDAP/RELAP5/MOD3 uses a one-dimensional, two-fluid,. nonequilibrium, six-equation hydrodynamic model with a simplified capability to treat multidimensional flows.

This model provides continuity, momentum, and energy equations for both the liquid and vapor phases within a control volume.

The energy equation contains source terms that couple the hydrodynamic model to the heat structure conduction model by a convective heat transfer formulation.

The code contains special process models for critical flow, abrupt area changes, branching, crossflow junctions, pumps, accumulators, valves, core neutronics, and control systems.

A flooding model can be applied at vertical junctions. A generalized creep rupture model, which accounts for the cumulative effects of pressure and temperature induced stresses, is also included for prediction of pressure boundary failures.

The creep rupture model can be applied to any RELAP5/MOD3 heat structure or to any structure represented by a finite-element COUPLE mesh.

SCDAP components simulate core disruption by modeling heatup, geometry changes, and material relocation. Detailed modeling of cylindrical and slab heat structures is allowed.

Thus, fuel rods, control rods and blades, instrument tubes, and flow shrouds can be represented.

All structures of the same type, geometry, and power in a coolant channel are grouped together; and one set of input parameters is used for each of these groupings or components.

Code input identifies the number of rods or tubes in each component and their A-3 NUREG/CR-5949

Appendix A relative positions for the purpose of radiation heat transfer calculations.

Models in SCDAP calculate fuel and cladding temperatures, zircaloy oxidation, hydrogen generation, cladding ballooning and rupture, fuel and cladding

• liquefaction, flow and fr.eezing of the liquified materials, and release of fission products.

Fragmentation of fuel rodi during reflood is calculated.

Oxidation of the inside surface of the fuel rod is calculated for ballooned and ruptured cladding.

The code does not calculate oxidation of material (zircaloy) during or following relocation.

Interactions between molten core material and the fluid below the core are explicitly mod~led.

Debris formation and behavior in the reactor vessel lower head and resultant thermal attack on the vessel lower head structure by the relocated core material are also treated.

The fission product behavior include~ aerosol agglomeration, aero$ol deposition, evaporation and condensation, and chemisorption of vapors by stainless steel. Fission products are assumed to be released equally over the entire length of the fuel rods.

The released fission products enter the coolant as aerosols, being put in the smallest size bin and allowed to agglomerate or evaporate as conditions dictate.

The number of aerosol bins used, as well as the fission product species tracked, is selected by the user.

The chemical form of the fission products is fixed.

All of the iodine is assumed to be in the form of CsI, with the remaining cesium being transported as CsOH.

Fission products do not interact with the surfaces of SCDAP components (fuel rods, control rods, control blades, and flow shrouds).

Version 7s of SCDAP/RELAP5/MOD3, with updates, was used to complete all calculations described in this report.

The updates included error corrections that have been added to subsequent versions and model changes to improve the predictive capabilities of the code.

The most significant model changes included (a) logic to direct heat transfer from an in-core crust to the coolant in the volume immediately below the crust and (b) logic to improve the representation of debris quenching during molten relocation from the core to the lower reactor vessel head.

NUREG/CR-5949.

A-4

A-1.

A-2.

A-3.

A-4.

A-5.

A-6.

Appendix A REFERENCES C. M. Allison et al., SCDAPIRELAP5/MOD3 Code Manual, NUREG/CR-5273, EGG-2555 {Dr~ft), Revision 2, Volumes 1-4, September 1991 {available from EG&G Idaho, Inc.).

G. A. Berna, C. M. Allison, and L. J. Siefken, SCDAP/MODl/VO:

A Computer Code for the Analysis of LWR Vessel Behavior During Severe Accident Transients, IS-SAAM-83-002, Revision 1, July 1984.

H. Jordon, J. A. Gieseke, and P. Baybutt, TRAP-MELT User's Manual, NUREG/CR-0632, BMl-2107, February 1979.

H. Jordan and M. R. Kuhlman, TRAP-MELT2 User's Manual, NUREG/CR-4205, BMl-2124, May 1985.

E. C. Lemmon, COUPLE/FLUID:

A Two-Dimensional Finite Element Thermal Conduction and Advection Code, EGG-ISD-SCD-80-1, February 1980.

C. M. Allison et al., RELAP5/MOD3 Code Manual, NUREG/CR-5535, EGG-2596 (Draft), Volumes 1-4, June 1990 (available from EG&G Idaho, Inc.).

A-5 NUREG/CR-5949

APPENDIX B SCDAP/RELAP5/MOD3 MODEL DESCRIPTION B-1

APPENDIX B SCDAP/RELAP5/MOD3 MODEL DESCRIPTION Appendix B SCDAP/RELAP5/MOD38"1 is an integrated computer code package designed for nuclear reactor a'ccident analysis.

Modules for simulation of thermal-hydraulics, heat transfer, severe core damage, and fission product transport are included, as discussed in Appendix A.

The code user is allowed to select those modules necessary to simulate the problem of interest.

In this.

assessment of. the Surry nuclear power plant (NPP) during a TMLB' sequence (the complete loss of all ac power and auxiliary feedwater without subsequent recovery or operator action}, an appropriate SCDAP/RELAP5/MOD3 model required use of (a) the RELAPS module for simulation of plant thermal-hydraulics and heat transfer affecting the plant structural mass; (b) the SCDAP module for simulation of core components during degradation, melt, and relocation to the lower reactor vessel head; and (c) the COUPLE module for simulation of the lower head to the time of creep rupture failure resulting from thermal attack by relocated core materials..

A SCDAP/RELAP5/MOD3 model was not developed from scratch for use in this assessment.

Instead, modifications were made to the inputs of an existing SCDAP/RELAP5/MOD0 model.

The existing model, as developed by Bayless, 0-2 has been the subject of critical internal reviews and at least one independent external review.a The existing model is believed to be a very good starting point for this assessment on that basis. All input modifications to the existing model are described separately in the following sections for RELAPS, SCDAP, and COUPLE modules.

In addition, basic information is provided as needed to under~tand the input modifications and some of the general features of the model with respect to the current assessment.

Other model details are adequately described by B~yless.

Before the input modifications are described, it should be noted that all calculations in this assessment were made using a code execution option known as MOD2.5 time smoothing.

This option invokes a numerical method designed to improve calculational stability, as implemented as a default feature in SCDAP/RELAP5/MOD2.5.

It is particularly helpful during shifts between flow regimes, heat transfer correlations, etc., where those shifts introduce functional discontinuities.

The use of MOD2.5 time smoothing was justified in this assessment since (a) it produces only minor differences in scoping results out to the onset of core heatup, (b) it reduces the magnitude of integrated mass ~rrors, and (c) it allows the code to run faster with fewer calculational problems.

\\

a.

G. M. Martinez et al., Independent Review of SCDAPIRELAP5 Natural Circulation Ca7cu7ations, SAND91-2089 (to be published).*

B-3 NUREG/CR-5949

Appendix B B-1 RELAPS INPUT The RELAPS module was used to simulate the thermal-hydraulics of the reactor vessel, the piping in all three primary coolant loops, the pressurizer, all three steam generators, and selected parts of the secondary systems.

Reactor vessel nodalization, as developed by Bayless, 6*2 is shown in Figure B-1.

As indicated, three parallel flow channels extend from the lower plenum throug~ the core to the upper reactor vessel head.

If the appropriate conditions exist, this arrangement will allow development of in-vessel natural circulation. Heat structures, which are shown as shaded areas, represent the structural mass of the reactor vessel walls, the core barrel and baffle, the thermal shield, the upper and lower core suppnrt plates, and structures in the upper and lower plena.

External surfaces of all heat structures were assumed to be adiabatic.

A junction connecting the top of the downcomer (Volume 102) to the upper plenum (Volume 172) at the hot leg elevation is shown in Figure B-1.

This junction represents a small leak path associated with clearances between the hot leg nozzles, (which are welded to the reactor vessel wall) and the internal hot leg piping (which is welded to the core barrel).

The resulting gap in the hot leg piping, which allows flow to bypass the core, is a design requirement for removal of core internals.

Nodalizations of the primary coolant loop containing the pressurizer; as developed by Bayless, are shown in Figures B-2 and B-3.

With the exception of the pressurizer and associated surge line piping, similar nodalizations were included in the model to separately represent the other two primary coolant loops in the Surry NPP.

The nodalization shown in Figure B-2 was used in conjunction with the reactor vessel nodalization from TMLB' initiation to core heatup.

(In this assessment, it was assumed that the onset of core heatup coincided with a core exit vapor superheat of 2.78 K.)

During this portion of the transient, full loop natural circulation of subcooled and saturated liquid can develop.

As the core heats the primary coolant toward saturation, however, voids begin to form and collect at the top of the steam generator U-tubes.

Once that occurs, full loop natural circulation of liquid is interrupted.

At the onset of core heatup, Figure B-2 nodalization was replaced by Figure B-3 nodalization in all calculations except those associated with Case

2.

This substitution provided the flow paths needed to represent hot leg countercurrent natural circulation.

(Figure B-3 nodalization was never used in Case 2, which was performed to evaluate conditions with minimum ex-vessel heat transfer.)

Hot leg countercurrent natural circulation became possible after saturated liquid in the hot legs drained to the vessel and/or flashed.

At that time, temperature gradients from the core to the steam generator U-tubes can drive steam flow along the top half of the hot leg (represented by components 400, 402, and 404), through a portion of the steam generator U-tubes (represented by component 408), and back to the vessel through a cooler portion of the steam generator U-tubes and the lower half of the hot leg NUREG/CR-5949 8-4

Appendix B 1042 118 3

4 113

]_

113 4

118 6

3 113

§_

113 5

118

~-

2 113

}_

113 6

118

g. -

1 113 1

108 M17 4-BDR-0293-001 Figure B-1.

Surry NPP reactor vessel nodalization with provisions for in-vessel natural circulation.

B-5 NUREG/CR-5949

z C:

0 rr, G")

n

0 I

(J'1

\\0

\\0 cc I

O'I 482 Main feed 476 47 485 MSIV Steam Generator 415 RCP Seals 489 Safeties 3

2 444PORVs 2

4 445 Safeties 441 Pressurizer Reactor vessel 172 102 449 Containment M-47811<-1291-03 Figure B-2.

Pressurizer coolant loop nodalization for the Surry NPP without provisions for hot leg countercurrent natural circulation.

l>

"C "C

CD 0..

cc

CJ I

z C

c rr,

~

n

c I u,

\\0

~

\\0 412 485 MSIV Steam Generator

<115 RCP Seals 489 Safeties 444PORYII 2

3 4

5 6

7 445 Safeties 441 Pressurizer Reactor vessel 102 449 Containment M478 dk-1291-02 Figure B-3.

Pressurizer coolant loop nodalization for the Surry NPP with provisions for hot leg countercurrent natural circulation.

)::o "C

"C CD

s Q.

X

• CJ

Appendix B (represented by components 409 and 430).

(Note that if reactor coolant pump (RCP) loop seals clear, both Figure B-2 and 8-3 nodalizations will also allow full loop natural circulation of superheated steam.)

Flow areas and loss coefficients in the split hot legs, split U-tubes, and associated components were established to match experimental countercurrent flow data as explained by Bayless.

As indicated in Figures B-2 and B-3, both fluid volumes and heat structures were included to represent the primary coolant loop piping, the pressurizer and associated surge line, and the steam generator with associated relief valves.

Without ac power, the accumulator is the only emergency core cooling system that required simulation.

The steam generator main feedwater system and associated piping were only needed to establish steady-state conditions prior to transient initiation. Auxiliary feedwater systems were not modeled, since they are not operational in a TMLB' sequence.

The external surfaces of all heat structures were assumed to be adiabatic.

A single valve was used to represent both power-operated relief valves (PORVs) connected to the pressurizer. The valve was appropriately sized to represent the flow capacity of both PORVs in the Surry NPP.

Similarly, a single valve was used to represent all three safety relief valves.

It was assumed that there was sufficient plant air and battery power to allow operation of the valves throughout all transients. Other (potential) valve failure modes were not considered.

Trip valves were added to the existing model to represent potential leakage from RCP seals.

As indicated in Figures 8-2 and 8-3, the leak was modeled at the discharge elevation of each RCP.

(SCDAP/RELAP5/MOD3 allows only one connection to a pump outlet.

However, the inlet of the connected pipe is hydraulically equivalent to the RCP outlet in SCDAP/RELAP5/MOD3.)

The relationship between transient time and valve flow areas used to model seal leakage in this assessment is described in the body of this report.

RCP seal leaks (and discharges from the pressurizer) were directed into a single volume representing the Surry NPP containment, as indicated in Figures B-2 and B-3.

However, there was no attempt to model containment in detail based on the assumption that flows from the reactor coolant system (RCS) to containment should be choked.

Containment pressure response was then monitored during all calculations to check the validity of that assumption.

In Cases 4, 5, and 6, it was found that RCP seal leak flows did come unchoked late in the transients.

For those cases, a more accurate representation of containment pressure was obtained by restarting the affected calculations with heat structures representing the containment:masses of concrete and carbon steel. The resulting heat sinks reduced containment pressure by condensing RCS flows.

Further refinement of the containment'model was unnecessary, since the pressure reduction was more than enough to produce choking of all flows from the RCS.

An interphase friction correlation for flow past rodded geometries was added to SCDAP/RELAP5/MOD3.

Based on recommendations from the code development staff, input was added to the model to use that correlation in the core and steam 1 generator secondary volumes.

As an associated input addition, NUREG/CR-5949 B-8

Appendix B the m1n1mum tube-to-tube spacing was used in place of the heated equivalent diameter for the secondary side of U-tube heat structures.

(A corresponding rod-to-rod spacing input for the core could not be made, since SCDAP components, not RELAP5 heat structures, were used to represent the fuel.)

Several other RELAP5 inputs were added and/or altered in the transition from SCDAP/RELAP5/MOD0 to SCDAP/RELAP5/MOD3 (the addition of junction hydraulic diameter input, the alteration of the heated equivalent diameter input for heat structures, and so on).* To the extent possible, all necessary input additions/alterations were implemented to retain comparability with the Bayless model.

B-2 SCDAP INPUT The three core flow channels shown in Figure B-1 were selected so that similarly powered fuel assemblies would be grouped together. A cross-section of the resulting three channel model is shown in Figure B-4.

The number of fuel assemblies in each channel and their relative power is indicated.

A typical 15xl5 fuel assembly used in the Surry NPP consists of fuel rods, control rods, and instrument tubes, as shown in Figure B-5.

Therefore, separate SCDAP' components representing fuel rods, control rods, and empty control rod guide tubes and instrument tubes were used by Bayless to model each channel. 8-2 As a result, a total of nine SCDAP components was required.

Scoping calculations were performed to determine if SCDAP components representing the control rods could be combined with SCDAP components representing the empty control rod guide tubes and instrument tubes (by channel).

In those calculations, a one-channel model was developed using the three-component approach.

In a second one-channel model, control rods, *empty control rod gµide tubes, and instrument tube~ were combined into a sirigle SCDAP control rod component.

In that case, the total number of rods plus tubes was not altered.

However, a control rod of*reduced size had to be used to conserve the masses of control rod materials and the cladding.

Calculations using both models were allowed to proceed through core degradation, melt, and relocation.

Results from the two models were found to be virtually identical.

Based on the results of.the scoping calculations, control rods were combined with ~mpty control rod guide tubes and instrument tubes in each flow channel of the SCDAP/RELAP5/MOD3 model.

Compared to the Bayless model, this simplification reduced the number of SCDAP components from nine to six.

SCDAP fuel rod components were linked to,a table to provide an appropriate decay power curve for the Surry NPP following the loss of ac power (and associated reactor scram).

The decay power curve was based on an ORIGEN2 calculation from scram to 20,000 s (333.3 min) as used in the sensitivity calculations described by Bayless., As indicated in Table B-1, however, the 8-9 NUREG/CR-5949

0:::,

I......

0 I

I I

I I

I I

I I

I I

---.J r----,

I I

I I

I I

~----*

I I

I I

I I

,---~

• ----i I

I I

I I

I

---

i I

I I

I I

I I

I I

I I

I

!.----I I

I I -----.

I I

I I

Figure B-4. A cross section of the three-channel core region.

Core barrel Core bypass Core baffle Outer channel 36 fuel assemblies relative power = 0. 76 Middle channel 96 fuel assemblies relative power = 1.05 Center channel 25 fuel assemblies relative power = 1. 17

)>

"O "O

Cl)

a.

X 0:::,

OJ I,__.

z C

o l"T"I G')

n

o I u, I.O

~

I.O Instrument tube -

r....,

\\...,,)

r.......

\\... ~

r-.....

.\\. ~

i---i.--

/

\\..,

\\....,

\\. ~

r,

\\....)

/

~

\\... ~

i.---

r,

\\....J r,

\\.

~

I/....,

~.,

Figure B-5.

A typical 15xl5 Surry NPP fuel assembly.

r r""'\\

\\... _..)

\\.

)

r "

\\... _.)

r "

\\.

)

r

'I

~

r.....,

\\..,

r """I

\\...

_ _,)

r.....,

r.....,

\\. ~

\\..,

L-Control rod guide tube Fuel rod location

)>

"'O

"'O CD

s

0.

X OJ

z l>

"C C:

"C

c Cl) l'T1 en

a.

n X

c I

cc u,

Table B-1.

Decay power curve.

U)

~

U)

Center Channel Middle Channel Outer Chancel (MW)

(MW)

(MW)

Time Fission Fission Fission (s)

Prompt Product Actinide Prompt Product Actinide Prompt Product Actinide 0.0 426.75 25.804 1.4094 1470.l 89.974 4.3161 398.42 25.198 1.0112 0.7 426.75 25.804 1.4094 1470.1 89.974 4.3161 398.42 25.198 L0112 1.0 382.11 25.804 1.4094 1316.3 89.974 4.3161 356.74 25.198 1.0112 1.5 323.73 24.634 1.4092 1115.3 85.803 4.3152 302.23 23.991 1.0112 2.0 275.83

23. 872 1.4092 950.24 83.131 4.3152 257.52 23.217 1.0112 3.0 61.178 22.820 1.4087 210.75 79.444 4.3132 57.117 22.164

1. 0109 cc 6.0 8.8713 20.987 1.4077 30.561 73.022 4.3104 8.2822 20.332 1.0102 I.....

N

11. 0 5.5405 19.328 1.4060 19.087 67.213 4.3056 5.1726 18.679 1.0087 16.0 4.1075 18.267 1.4043 14.150 63.521 4.2998 3.8347 17.641

1. 0077 21.0 3.2849

17. 491 1.4025 11.316 60.810 4.2941 3.0669 16.883 1.0062 31.0 2.3029 16.378 1.3987 7.9338 56.949 4.2826 2.1501 15.797 1.0037 51.0 1.2969 14.956 1.3919 4.4680

52. 016 4.2615 1.2108 14.428 0.9987 101.0 0.3965 13.031 1.3750 1.3660 45.365 4.2088 0.3702 12.585 0.9861 201.0 0.0679

11. 270 1.3421 0.2338 39.252 4.1072 0.0634 10.888 0.9620 501.0 0.0013 9.3085 1.2525 0.0046 32.400 3.8312 0.0012 8.9838 0.8962 1001.0 0.0 7.9034 1.1297 0.0 27.531 3.4518 0.0 7.6400 0.8057 2501.0 0.0 6.0192 0.8979 0.0 20.986

2. 7359 0.0 5.8287 0.6357 5001. O 0.0 4.7465 0.7429 0.0 16.521 2.2586 0.0 4.5747 0.5225 10001.0 0.0 3.7534 0.6738 0.0 12.966 2.0479 0.0 3.5601 0.4729 20001.0 0.0 3.2092 0.6448 0.0 11.087 1.9616 0.0 3.0214 0.4535 36000.0 0.0

2. 7197 0.5548 0.0 9.4023 1.6836 0.0 2.5731 0.3877

Appendix B decay power curve was extended to 36,000 seconds (600.0 minutes) to accommodate the anticipated duration of calculations in this assessment.

The accuracy of the extension, which was made with a least-squares fit of the last seven data points in the original table, should not adversely impact results.

, In addition, the Bayless data was scaled by a factor of 0.998 to obtain a match between MODO and MOD3 steady-state power levels.

SCDAP input is required to define certain parameters that control severe core damage progression.

In general, best-estimate parameters were selected where there were data or some basic understanding of the associated process.

For parameters with higher degrees of uncertainty, values were selected to minimize the time to lower head failure.

This approach provides the basis for a conservative evaluation of the potential for high pressure melt ejection and the associated problem of direct containment heating, since the time available for generation of an ex-vessel failure by natural convection heating is minimized and since the system pressure at the time of failure should be maximized (at least for RCP seal leak cases).

The resulting parameter set, including a full discussion of the logic used to establish each value, is described in the body of this report.

Several other SCDAP inputs were added and/or altered in the transition from SCDAP/RELAP5/MOD0 to SCDAP/RELAP5/MOD3 (the addition of fuel rod gap conductance, the alteration in the number of radial nodes required to define a control rod component, and so on).

To the extent possible, all necessary input additions/alterations were implemented to retain comparability with the Bayless model.

B-3 COUPLE INPUT SCDAP/RELAPS(MODO calculations by Bayless were terminated when fuel relocation began.

2 For that reason, detailed modeling of the lower reactor vessel head was not performed.

In this assessment, however, determining the time of lower head failure was a primary objective that required COUPLE input.

The COUPLE mesh used to represent the lower reactor vessel head is shown in Figure B-6.

The axisymetric mesh includes a total of 320 nodes with 285 elements.

Two elements were used to represent the thickness of the carbon steel portion of the lower head, with an adjoining single element representing the stainless steel liner.

(Because the liner is relatively thin, the elements representing it appear to be a heavy line in the figure.)

A layer of zero-width gap elements coincided with the inner surface of the liner. The gap elements provided a way to model contact resistance between the debris and liner.

In this assessment, a large conductance was used to simulate perfect debris/liner contact.

(This approach is consistent with the effort to minimize the time to lower head failure.)

The remaining elements are initially filled with primary coolant.

During molten relocation, the coolant can boil off and/or be displaced by debris.

B-13 NUREG/CR-5949

z

)>

C "C

~

"C rT'1 ro G)

0.

n

~

X I

2 u,

0::,

I.O

~

I.O 1.5 E --

.c:

1

.Q>

0::,

Q)

I I

~

0 0

0.5 1

1.5 2

2.5 Radius {m)

Figure B-6.

COUPLE mesh representing the lower reactor vessel head.

Appendix B Convection and radiation heat transfer were modeled at all interfaces between the coolant and debris.

In addition, convection and radiation heat transfer were modeled along the vessel wall at all nodes that are not submerged by debris (those nodes exposed to primary coolant/steam).

The external surface of the lower head was assumed to be adiabatic.

B-4 REFERENCES 8-1.

C. M. Allison et al., SCDAPIRELAP5/MOD3 Code Manual, NUREG/CR-5273, EGG-2555 (Draft), Revision 2, Volumes 1-4, September 1991 (available from EG&G Idaho, Inc.).

B-2.

P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAPIRELAP5, NUREG/CR-5214, EGG-2547, October 1988.

B-15 NUREG/CR-5949

APPENDIX C STEADY-STATE CALCULATIONS C-1

Appendix C APPENDIX C STEADY-STATE CALCULATIONS Steady-state initialization of the complete SCDAP/RELAP5/MOD3 model was required before making* transient calculations.

The initialization involved, bringing the model to stable conditions representing full power operation of the Surry nuclear power plant.

Initialization was considered acceptable when conditions matched the steady state calculated by Bayless.c-, A comparison with Bayless results is provided in Table C-1.

Table C-1.

Comparison of steady-state results with sensitivity study values computed by Bayless.~1 Parameter Core thermal power, MW Pressurizer pressure, MPa Pressurizer liquid level, m Hot leg temperature, K Cold leg temperature, K Coolant flow per loop, kg/s Steam generator pressure, MPa Liquid mass per steam generator, kg Feedwater flow per steam generator, Xenon mass, kg Krypton mass, kg Cesium mass,. kg Iodine mass, kg Tellurium mass, kg SCDAP/RELAP5fMODO SCDAP/RELAP5/MOD3 result~1 result 2443 15.5 6.62 591. 7 557.0 4230

5. 71 44000 kg/s 444.6 258.3 29.10 186.7 10.42 23.98 C-3 2443 15.5 6.62 591.8 557.0 4229 5.72 43997 442.9 258.0 29.06 149.4 10.41 23.97 NUREG/CR-5949

Appendix C As indicated in the table, the only significant deviation is in ~esium inventory.

Howeverc a separate ORIGEN2 calculation predicted an inventory of 125.5 kg of cesium._, Therefore, the value calcu.lated with SCDAP/RELAP5/MOD3 appears to be a better estimate, since it is clos~r to the ORIGEN2 calculation, which is presumed to be more accurate.

REFERENCES C-1.

P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAPIRELAP5, NUREG/CR-5214, EGG-2547, October 1988.

NUREG/CR-5949 C-4

APPENDIX D CALCULATION STATISTICS D-1

Appendix D APPENDIX D

. CALCULATION STATISTICS All calculations in this assessment were performed on a DEC (Digital Equipment Corporation) 5000/200 workstation running Version 4.2, Revision 96, of the ULTRIX operating system.

The SCDAP/RELAP5/MOD3 source was compiled and executed using ULTRIX Version 3.X of the MIPS FORTRAN77 compiler.

Other statistics for each calculation are summarized in Table D-1.

Table D-1.

Calculation statistics.a Case Steady-state Base 2

3 4

5 6

Number of RELAP5 volumes/

junctions 255/307 251/304 255/307 251/304 251/304

• 251/304 251/304 Number of RELAP5 heat Number of structures/

SCDAP mesh points components 263/1208 260/1199 263/1208 260/1199 I

263/l 206b 263/l 206b 263/1206b 6

6 6

6 6

6 6

Number of COUPLE nodes/

elements 320/285 320/285 320/285 320/285 320/285 320/285 320/285 Problem time (s) 200 29000 17000 25800 27800 29800 23800 CPU time (s) 5820 239600 135000 394400 563900 594500 408900

a.

RELAP5 inputs representing the p1p1ng and heat structures needed for simulation of hot leg countercurrent natural circulation were included in all calculations.* Trip valves were used to isolate that piping and prevent hot leg countercurrent natural circulation during Steady-state and Case 2 calculations.

However, all RELAP5 volumes and heat structures are reflected in the data given above, since even isolated components impact CPU requirements.

b.

This number includes containment heat structures added late in the calculation, as discussed in Appendix B.

D-3 NUREG/CR-5949

APPENDIX E SCDAP/RELAPS/MOD3 MODEL BENCHMARK E-1

Appendix E APPENDIX E SCDAP/RELAPS/MOD3 MODEL BENCHMARK The Base Case calculation in this analysis used initial and boundary

• conditions from a previous study.&,

However, the Base Case differed from the previous study in the code version used and in the desired endpoint of the calculation (lower head failure versus initial fuel rod relocation).

The Base Case had to be performed because of those differences and because it served as a starting point for the other calculations*in this analysis.

Base Case results were used to benchmark the code and model before completing those calculations.

Base Case results are listed in Table E-1, along with those taken from the previous study.

As indicated, event timing was consistently early in the Base Case.

The main reason for this difference appears to be in the transfer of fuel stored energy.

In the previous study, the code allowed contact between the f~el and cladding.

Removal of fuel stored energy before core uncovery was relatively effective because of the associated thermal-conductivity.

In the Base Case, a new model was used to represent a gas gap conductivity based on best-estimate values for LWR fuel.

As a result, more energy was left in the fuel following uncovery, which could have led to a faster progression of events.

The results compare well given that difference and the fact that numerous changes have.been made to the code since the previous study.

Table E-1.

Comparison of results from the Base Case and a previous study.

Event TMLB' initiation Steam generator dryout (loops C/A & B)

Initial cycle of pressurizer PORV Hot legs saturate Full loop natural circulation ends Onset of fuel rod oxidation Creep rupture failure of surge line Initial fuel/cladding relocation E-3 Base case 0

4620/4700 4680 6900 7330 10840 14250 14500 Time (s)

Previous study&,

0 5120/5420 4970 7250 7790 11120 14780 14880 NUREG/CR-5949

Appendix E REFERENCES E-1.

P. D. Bayless, Analyses of Natural Circulation During a Surry Station Blackout Using SCDAP/RELAP5, NUREG/CR-5214, EGG-2547, October 1988.

NUREG/CR-5949 E-4

APPENDIX F SELECTED CORE DAMAGE RESULTS F-1

Appendix F APPENDIX F SELECTED CORE DAMAGE RESULTS Selected core damage results for the six different SCDAP/RELAP5/MOD3 calculations performed in this assessment ~re given in the following tables.

Each table has two columns.

Each column contains a list of plant conditions and a list of debris characteristics.

Plant conditions are given at the time of the first relocation of molten fuel into the lower head and at the time of lower head failure.

Debris characteristics in the first column represent -the materials that were actually relocated at the indicated time, while debris characteristics in the second column represent all materials in the lower head at the time of lower head failure.

F-3 NUREG/CR-5949

Appendix F Table F-1.

Selected core damage results for the Base Case.

Plant conditions/

At relocation At lower head failure debris characteristics (480.8 min)

(482.0 min)

RCS pressure (MPa) 16.0 16.0 Lower plenum RCS temperature (K) 930 842 Total H2 generated (kg) 319 319 Fraction of total Zr oxidized 0.449 0.449 Containment press (MPa)a 0.193 0.194 Containment temp (K)a 416 414 Ag mass (kg) 0 0

Stainless steel mass (kg) 0 0

U02 mass (kg) 57060 57060 Zr mass (kg) 0 0

Zr02 mass (kg) 9930 9930 Maximum temperature (K)b 3450 2860 Estimated molten fraction° 1.0

< 0.01

a.

This valu~ is based on containment conditions at relocation and lower head failure, as calculated in Case 4.

b.

This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

c. This value represents the fraction of the listed debris that was molten'at the specified times.

The fraction is always 1.0 at the time of relocation since all relocating debris must be molten.

At lower head failure, the value was estimated. by the fraction of the listed lower head debris that was above 2850 Kat the time of failure.

The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr02/U02 mixtures.

NUREG/CR-5949 F-4

Appendix F Table F-2.

Selected core damage results for Case 2.

Plant conditions/

At relocation At lower head failure debris characteristics (257.8 min)

(260.1 min) 8 RCS pressure (MPa) 16.0 16.0 Lower plenum RCS temperature (K) 678 666 Total H2 generated (kg) 220 228 Fraction of total Zr oxidized 0.310 0.321 Containment press (MPa)b 0.193 0.194 Containment temp (K)b 416 414 Ag mass (kg) 0 0

Stainless steel mass (kg) 0 0

U02 mass (kg) 5800 5800 Zr mass (kg) 0 0

Zr02 mass (kg) 1050 1050 Maximum temperature (Kt 3190 2690 Estim~ted molten fractiond 1.0 0.0

a.

A second molten core relocation of 170 kg of Ag, 9090 kg of U0 2, and 2900 kg Zr at 3190 K occurred at 266.5 min, 6.4 min after lower head failure.

b.

This value,s based on containment conditions at relocation and lower head failure, as calculated in Case 4.

c. This value represents the temperature of; the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

d.

This value represents the fraction of the listed debris that was molten at the specified times.

The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten.

At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure.

The eutectic melt temperature of 2850 K was selected, sinae it is applicable to a very wide range of Zr02/U02 mixtures.

F-5 NUREG/CR-5949

Appendix F Table F-3.

Selected core damage results for Case 3.

Plant conditions/

debris characteristics RCS pressure (MPa)

Lower plenum RCS temperature (K)

Total H2 generated (kg)

Fraction of total Zr oxidized Containment press (MPa)b Containment temp (K)b Ag mass (kg)

Stainless steel mass (kg)

U0 2 mass (kg)

Zr mass (kg)

Zr02 mass (kg)

Maximum temperature (K)c Estimated molten fractiond At relocation (403.3 min) 2.08 489 415 0.585 0.164 396 0

0 10520 0

1850 3630 1.0 At lower head failure (405.7 min)a 8.56 573 415 0.585 0.164 396 1840 20 10520 50 1850 3050 0.22

a.

This includes control rod materials that began relocating at 233.0 min.

b.

This value is based on containment conditions at relocation and lower head failure as calculated in Case 5.

c. This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

d.

This value represents the fraction of the listed debris that was molten at the specified times.

The* fraction is always 1.0 at the time of relocation, since all relocating debris must be molten.

At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure.

The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr02/U02 mixtures.

NUREG/CR-5949 F-6

Appendix F Table F-4.

Selected core damage results for Case 4.

Plant conditions/

At relocation At lower head failure debris characteristics (426.0 min)

(433.0 min)8 RCS pressur~ {MPa) 1.41 1.36 Lower plenum RCS temperature (K) 468 466 Total H2 generated (kg) 188 189 Fraction of total Zr oxidized 0.265 0.266 Containment press (MPa) 0.193 0.194 Containment temp (K) 416 414 Ag mass (kg) 0 0

Stainless steel mass (kg) 0 0

U02 mass (kg) 12940 12940 Zr mass (kg) 0 0

Zr02 mass ( kg) 2180 2180 Maximum temperature (K)b 3380 3010 Estimated molten fractionc 1.0 0.15 I

a.

A second molten core relocation of 9780 kg of U02 and 1460 kg of Zr02 at 3640 K occurred at 460.7 min, 27.7 min after lower head failure.

b.

This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

c.

This value represents the fraction of the listed debris that was molten at the specified times.

The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten~

At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure.

The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr02/U02 mixtures.

F-7 NUREG/CR-5949

Appendix F Table F-5.

Selected core damage results for Case 5.

Plant conditions/

debris characteristics RCS pressure (MPa)

Lower plenum RCS temperature (K)

Total H2 generated (kg)

Fraction of total Zr oxidized Containment press (MPa)

Containment temp (K)

Ag mass (kg)

Stainless steel mass (kg)

I U0 2 mass (kg) I Zr mass (kg)

Zr02 mass (kg)

Maximum temperature (K)b Estimated molten fractionc At relocation (403.3 min) 2.08 489 415 0.585 0.164 396 0

0 10520 0

1850 3630 1.0 At lower head failure (479.6 min)8 6.48 543 419 0.590 0.164 396 2010 60 54940 130 10120 2880

< 0.01

a.

This includes debris from control rod relocation starting at a second molten core relocation at 3110 Kat 477.7 min.

233.0 min and

b.

This value ~epresents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the time of failure.

c.

This value represents the fraction of the listed debris that was molten at the specified times.

The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten.

At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure.

The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr02/U02 mixtures.

NUREG/CR-5949 F-8

Appendix F Table F-6.

Selected core damage results for Case 6.

Plant conditions/

At relocation-At lower head failure debris characteristics (480.8 min)

(482.0 min)

RCS pressure (MP-a)

1. 26

1. 37 Lower plenum RCS temperature (K) 456 461 Total H2 generiated (kg) 197 198 Fraction of total Zr oxidized

0. 277 0.279 Containment press (MPa) 0.246 0.247 Containment temp (K) 399 399 Ag mass (kg) 0 1680 Stainless steel mass (kg) 0 8

U02 mass (kg) 44370 44370 Zr mass (kg) 0 80 Zr02 mass (kg) 7980 7980 Maximum temperature (K)b 3120 2980 Estimated molten fractionc 1.0 0.06

a.

This includes control rod materials that began relocating at 357.3 min.

b.

This value represents the temperature of the melt at the time of core relocation and the maximum debris temperature in the lower head at the tirrie of failure.

c.

This value represents the fraction of the listed debris that was molten at the specified times.

The fraction is always 1.0 at the time of relocation, since all relocating debris must be molten:

At lower head failure, the value was estimated by the fraction of the listed lower head debris that was above 2850 Kat the time of failure.

The eutectic melt temperature of 2850 K was selected, since it is applicable to a very wide range of Zr02/U02 mixtures.

F-9 NUREG/CR-5949

APPENDIX G PROBABILISTIC RISK ASSESSMENT ISSUES G-1

CONTENTS G-1.

Surge Line/Hot Leg Failure Issue G-4 G-1.1 Issue Probability for TMLB' Sequences Without RCP Seal Leaks G-1.1.1 G-1.1.2 G-1.1.3 G-1.1.4 G-1.1.5 Pl--Probability of Surge Line Failure as a Function of Time P2--Probability of Hot Leg Failure as a Function of Time P3--Probability that the RCS Pressure is Low as a Function of Time P4--Probability of Lower Head Failure as a Function of Time Recombination of Probabilities Pl through P4 G-8 G-9 G-11 G-17 G-19 G-21 G-1.2 Issue Probability for TMLB' Sequences with RCP Seal Leaks G-24 G-1.2.1 G-1.2.2 G-1.2.3 G-1.2.4 G-1.2.5 Pl--Probability of Surge Line Failure as a Function of Time P2--Probability of Hot Leg Failure as a Function of Time P3--Probability that the RCS Pressure is Low as a Function of Time P4--Probability of Lower Head Failure as a Function of Ti me Recombination of Probabilities Pl through P4 G-1.3 Issue Probability for TMLB' Sequences with Stuck-Open/

G-25 G-31 G-35 G-38 G-40 Latched-Open PORVs G-43 G-1.3.l G-1.3.2 G-1.3.3 G-1.3.4 G-1.3.5 Pl--Probability of Surge Line Failure as a Function of Time P2--Probability of Hot Leg Failure as a Function of Time P3--Probability that the RCS Pressure is Low as a Function of Time P4--Probability of Lower Head Failure as a Function of Time Recombination of Probabilities Pl through P4 G-44 G-49 G-52 G-52 G-.54 G-2.

RCS Pressure at Vessel Breach Issue G-57 G-3.

G-2.1 lssue Probabilities for TMLB' Sequences Without RCP Seal Leaks G-57 G-2.2 Issue Probabilities for TMLB' Sequences with RCP Seal Leaks G-58 G-2.3 Issue Probabilities for TMLB' Sequences with Stuck-Open/

Latched-Open PORVs I

References G-63 G-65

Appendix G It is possible to derive Equation (G-1) intuitively or through a more rigorous transformation-of-variables approach.

Both derivations follow.

I Derivation 1:

Let TLP be a random variable modeling the time of RCS depressurization following surge line/hot leg failure and TLH be a random variable modeling the time of lower head failure.

What must be calculated is the probability that TLH is greater than TLP, which will be denoted as P(TLH > TLP).

(It is assumed that TLP and TLH are statistically independent.)

Let TLH have probability density function P~. 2(t 2), and T~ have probability density function PLP, 1 (t 1). At any given value of TLP' say TLP = t 1, one can write 00 P_(TLH > TLPITLP = t,) = JPLH.2(tz)PLP.1(t,)dt2 *:

t, (G-2)

Integrating over all values oft, is necessary to find the probability that TLH > TLP*

The resulting equation, which is equivalent to Equation (G-1), is given by 00 00 P(TLH > TLP) = J JPLH,2(tz)PLP.1(t,)dt2dt, (G-3)

-oo t, I

Derivation 2:

Let Z =

T~ - T~ where P(Z > 0) is needed.

Define the transformation T as This is a one-to-one transformation with i_nverse r 1 given by 7-1: TLH = w T

= W - Z LP The absolute value of the determinant of the Jacobian of T-1 is 1.

TLP are statistically independent,, the joint density function is Integrating over W gives the marginal density of Z as G-7 (G-4)

(G-5)

If TLH and (G-6)

NUREG/CR-5949

Appendix G 00 h(z) = f h(z,w)dw = f PLH.2(w)PLP., (w - z)dw.

(G-7)

-00

-oo The probability that Z > *O is given by 00 00 p ( Z > 0) = l L p LH. 2 ( w) P LP., ( w - z) dwd z.

(G-8)

Interchanging the order of integration gives 00 00 P(Z > 0) = llPLH.2(w)PLP., (w - z)dwdz (G-9)

Using the fact that the determinant of the Jacobian of T-1 has an absolute value 1, we can rewrite this in terms of the original variables.

The resulting equation, which is equivalent to Equation (G-1), is given by 00 00 P(TLH > TLP) = s I PLH,2( ti)PLP,1 ( t, )dt2dt,

- 00 tl (G-10)

The quantification approach as described was used to evaluate probabilities of the surge line/hot leg failure issue for each of the scenarios considered.

Specifically, the probability assoc1ated with TMLB' sequences without RCP seal leaks is evaluated in Section G-1.1, the probability associated with TMLB' sequences with RCP seal leaks is evaluated in Section G-1.2, and the probability associated with TMLB' sequences with stuck-open/latched-open PORVs is evaluated in Section G-1.3.

As previously indicated, the resulting probabilities are conditional on the occurrence of the specific scenarios in the Surry NPP.

G-1.1 Issue Probability for TMLB' Sequences without RCP Seal Leaks This section contains the probability quantification for the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

As discussed in Section G-1, the surge line/hot leg failure issue was decomposed into four separate probabilities, denoted Pl through P4.

Sections G-1.1.1 through G-1.1.4 contain evaluations of the separate probabilities Pl through P4, which are also conditional on the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

The NUREG/CR-5949 G-8

Appendix G surge line/hot leg failure issue probability for this scenario was then obtained through recombination of the separate probabilities. That recombination is outlined in Section G-1.1.5.

The following quantification was primarily based on TMLB' Base Case results and TMLB' Case 2 results as calculated with SCDAP/RELAPS/MOD3 and described elsewhere in this report.

As,explained throughout this section, however, weighting fractions of Q.95 and 0.05 were applied to all interpretatiops of TMLB' Base Case and TMLB' Case 2 results, respectively.

Those weighting fractions were selected to reflect the assumption that the TMLB' Base Case conditions (i.e., hot leg countercurrent natural circulation) would be expected based on Westinghouse natural circulation experiments.

G-1.1.1 Pl--Probability of Surge Line Failure as a Function of Time.

SCDAP/RELAP5/MOD3 calculates pressure boundary failures using a Larson-Miller parameter to accumulate creep rupture damage associated with the time a specified boundary is subjected to calculated pressures and temperatures.G-3 Therefore, the calculated failure of the surge line is a function of pressure and temperature.

In this scenario, surge :line (and all other RCS) pressures are well defin~d by periodic cycling of the PORVs.

As a result, there is relatively little uncertainty in the pressure aspect of surge line creep rupture.

However, there are potential uncertainties in the calculated surge line temperatures, which could affect the timing of surge line failures. ;It was assumed that the probability of surge line failure could be inferred from the variation in failure times resulting from those temperature uncertainties.

Temperature uncertainties coald be introduced into the code calculations in a variety of ways.

For example, oxidation may be underpredicted, since only intact fuel rods are allowed to oxidize in the current version of SCDAP/RELAP5/MOD3.

If oxidation is underpredicted, the temperature of the vapor transported from the core through the surge line with each PORV cycle may be low.

On the other hand, SCDAP surfaces representing the core components radiate to each other and to the surrounding vapor.

However, radiation from SCDAP surfaces to heat structures representing the reactor vessel internals is not calculated.

Since some of those internals (particularly the lower core support.plate and other structures in the lower plenum) could be relatively cool, temperatures of the SCDAP surfaces and the surrounding vapor may be high.

These examples indicate a potential for both higher and lower surge line temperatures than were actually predicted.

A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the stainless steel surge line subjected to potential temperature variations.

The simple one-volume model had to be benchmarked before those calculations could be made.

Surge line vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 results for the TMLB' Base Case and TMLB' Case 2 as a first step in benchmarking.

A constant pressure of 15.96 Mpa (representing the midpoint between the opening and closing pressures of the cycling PORVs) and the extracted vapor temperatures were used as surge line boundary conditions.

Heat transfer coefficients from the vapor to the surge line were then adjusted until surge line failure times using the simple one-volume model matched failure times predicted in the TMLB' cases. That G-9 NUREG/CR-5949

Appendix G approach effectively simulated the pressure and temperature conditions leading to the surge line failures and provided reasonable heat transfer coefficients*

for use in subsequent calculations with the one-volume model.

The extracted temperature histories were then altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup in the TMLB' cases.

The resulting surge line vapor temperature histories for the Base Case are shown with respect to the nominal history in Figure G-1 as an example.

As indicated, surge line temperatures were varied by +/-20% relative to the temperature at the start of heatup (at about 150 min).

(Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the surge line :at those levels.)

The resulting variations represent possible heatup rates if the surge line temperatures are either under-or overpredicted.

Based on the potential uncertainties affecting surge line temperatures (including oxidation and radiation as previously discussed}, it was assumed

• that surge line vapor temperatures increased PY 20% should not be exceeded more than about 5% of the time.

It was also assumed that surge line vapor temperatures decreased by 20% should be exceeded about 95%' of the time.

Those assumptions were intended to represent the range of uncertainty associated with surge line heating.

It is not possible to more definitively establish the range of uncertainty within the scope of this project.

However, the assumptions could be easily modified at some future date if warranted.

2000.0 r----.----.---.-----,-----r-----.-----.-----,

q 1500.0 Cl) cu Cl)

C.

E Cl) t-1000.0 G------l nom temp + 20%

-- nomtemp C3----EJ nom tern - 20%

500.0.__ _ ___. __

___,.l 100.0 150.0 200.0 Time (min) 250.0 300.0 Figure G-1.

TMLB' Base Case surge line vapor temperature histories for estimation of surge line failure probabilities.

NUREG/CR-5949 G-10

Appendix G P3:

The probability that RCS pressure is low as a function of time following surge line/hot leg failure P4:

The probability of lower head failure as a function of time SCDAP/RELAP5/MOD3 was used to calculate creep rupture failures of the surge line, hot leg, and lower head for a variety of conditions, as described in this report and in related reports (which will be cited).

The RCS 1pressure at the time qf lower head failure was also calculated.

Those code re~ults, along with engineering judgment to assess potential uncertainties, were used to quantify probabilities Pl through P4.

The probability of the stated surge line/hot leg failure issue was then determined through a recombination of probabilities Pl through P4.

Recombination required that quantification be performed with respect to a common reference time.

In this evaluation, the common reference was taken to be the time of lower head fa1lure as calculated by* SCDAP/RELAP5/MOD3.

Recombination began with a simple comparison of the probability of surge line failure as a function of time (Pl) to the probability of hot leg failure as a function of time (P2).

Since RCS depressurization could occur following either ex-vessel failure, it was assumed that the potential for depressurization would be effectively controlled by the failure that had the highest probability of occurring first.

The probability associated with the controlling ex-vessel failure (either Pl or P2) was then used to establish the probability for a low RCS pressure as a function of time (P3).

The probability P3 was established through the use of available calculations and engineering judgment to determine how depressurization could proceed as a result of the controlling ex-vessel failure1 The final step in recombination involved comparison of the probability for a low RCS pressure as a function of time (P3) with the probability of lower head failure as a function of time (P4).

If probabilities P3 and P4 did not overlap, the resulting probability of the stated surge line/hot leg failure issue was determined by inspection.

In other words, if the probability for a low RCS pressure following surge line/hot leg failure (P3) reaches 1.0 before there is a probability for lower head failure (P4), the probability of the stated surge line/hot leg failure issue is clearly 1.0.

Conversely, the probability of the stated surge line/hot leg failure issue is 0.0 if the probability for lower head failure reaches 1.0 before there is a probability for RCS depressurization following the controlling ex-vessel failure.

If probabilities P3 and P4 overlap,,a statistical convolution of the probabilities was computed with (G-1) where p

the probability of the stated surge line/hot leg failure issue G-5 NUREG/CR'-5949

Appendix G the probab~lity density function (PDF); i.e., the deri~ative of the probability with respect to time, representing the probability of depressurizing the RCS following a surge line/hot leg failure integrated wi~h respect to time t 1 the PDF representing the probability of lower head failure integrated with respect to time t 2

• The integral of PLH. 2 over the range of t, to oo represents the probability that vessel failure occurs after surge line/hot leg failure at the particular time t,. The probability of the stated surge line/hot leg failure issue is then given by the integral (from -o:, to oo) of the product of PLP,, and the PLH,2 integral.

It is recognized that Equation (G-1) is strictly valid only if probabilities P3 and P4 are statistically independent.

Independence requires that an increase/decrease in the probability of one event does not increase/decrease the probability of the other.

The potential for dependency between the subject probabilities (P3 and P4) is also recognized.

However, P~

and P4 may not be strongly dependent, as discussed below.

There are numerous uncertainties in the results of current analyses that would tend to increase and decrease both probabilities. Oxidation of zircaloy during core degradation is a good example.

If oxidation,is underpredicted in current analyses, the calculation temperature of the steam circulating through the core and eventually heating the ex-vessel piping could be lower than expected.

As a result, the probability of an ex-vessel failure could be reduced (or at least delayed).

At the same time, underprediction of oxidation could also result in slower core heatup *and melting, which could reduce (or delay) the probability for relocation and lower head failure.

There are also uncertaintiesiin the current analyses that would tend to increase the probability of one event while decreasing the probability of the other.

In-core heat transfer is a good example.

If in-core heat transfer is overpredicted in current analyses, the temperature of the steam that heats the ex-vessel piping could be higher than expected, which could increase the probability of (or at least accelerate) ex-vessel failure.

At the same time, overprediction of in-core heat transfer could also result in lower core temperatures, which could reduce the probability of (or at least delay) relocation and lower head failure. Since some uncertainties could drive both probabilities in the same direction, while other uncertainties could drive them in opposite directions, it is possible that there is not a strong stat i st i cal dep,endence between probabilities P3 and P4.

I The decision to use Equation (G-1) is justified since (a) there are insufficient data to definitively establish the relationship between the subject probabilities (P3 and P4), (b) a strong statistical dependence is not supported when uncertainties in current analyses are considered, and (c) any

. compromise incurred through the u~e of the eqµation is assumed to be insignificant compared to other limitations in representing core melt progression with the current generation of computer codes.

NUREG/CR-5949 G-6

APPENDIX G PROBABILISTIC RISK ASSESSMENT ISSUES Appendix G An independent analysis is planned to determine the risk impact associated with intentional depressurization of the reactor coolant system (RCS) in the Surry nuclear power plant (NPP).

The analysis is needed to support an Accident Management Program sponsored by the Nuclear Regulatory Commission (NRC).

Probabilistic risk assessment (PRA) techniques will be used to determine the impact by comparing the risks of intentional RCS depressurization, where plant operators latch pressurizer power-operated relief valves (PORVs) open, with the risks that could be expected if plant operators take no action.

RCS depressurization issues that required evaluation in order to complete the risk analysis were identified through examination of the accident progression event tree (APET) developed for use in NUREG-1150.~1 Specifically, the APET was reviewed to compile a list of those RCS depressurization issues that have the largest influence on the risk results.

The list included two issues that could be affected by the current SCDAP/RELAP5/MOD3G-2 analysis (and other related analyses completed after NUREG-1150): (a) surge line/hot leg failure and (b) RCS pressure at reactor vessel breach.

Probabilities associated with both RCS d~pressurization issues were originally quantified by a NUREG-1150 in-vessel expert panel for Surry TMLB' (station blackout) sequences with and without reactor coolant pump (RCP) seal leaks.

It was assumed that quantification for the two scenarios would produce a reasonable estimate of the issue probabilities for all other conditi,ons.

(It should ba noted that another scenario, consisting of a TMLB' sequence with RCP seal leaks and operational auxiliary feedwater systems, was postulated.

However, that scenario was eliminated from consideration in NUREG-1150 based on the assumption that the availability of feedwater would minimize the probability for RCS depressurization through a surge line or hot leg failure.)

The evaluation contained in Appendix G represents an effort to update probabilities associated with both identified RCS depressurization issues based on current analyses.

~ike NUREG-1150, probabilities for both issues were (re)quantified for TMLB' sequences with and without RCP seal leaks.

The potential for RCS depressurization during a TMLB' sequence with a stuck-open or latched-open PORV was recognized.

Therefore, as a.step beyond NUREG-1150, probabilities for both identified depressurization issues were also quantified for that scenario.

The results will be provided for use in the independent risk analysis. A better estimate of the risk associated with intentional depressurization is anticipated through use of the updated results.

Evaluation of the surge line/hot leg failure issue is given in Section G-1, and the issue of RCS pressure at vessel, breach is evaluated in Section G-

2.

Probabilities are quantified for (a) TM~B' sequences without RCP seal G-3 NUREG/CR-5949

Appendix G leaks, (b) TMLB' sequences with RCP seal leaks, and (c) TMLB' sequences with stuck-open/latched-open PORVS in both sections.

It should be clear that all of the resulting probabilities are conditional on the occurrence of the specific TMLB' scenario in the Surry NPP.

Before the probability evaluations are presented, it should be emphasized that the analysis described in this report was developed to represent the Surry NPP.

Furthermore, related analyses completed after NUREG-1150 and cited here were also Surry-specific.

Results from those analyses form the basis for the evaluation.

Therefore, any application of information from this report, including that contained in Appendix G, should appropriately account for that limitation.

Although'the evaluation presented here is based on results from current analyses, it is also important to note that numerous assumptions and the application of engineering judgment were required to quantify the probabilities. That approach is unavoidable because of limitations in the current state of knowledge (stemming from a sparsity of experimental data) as well as limitations associated with implementing that knowledge in computer codes.

However, *every effort was made to provide a complete description of.

the approach used to allow refinement of the probabilities as the state of*

knowledge develops.

G-1 SURGE LINE/HOT LEG FA~LURE ISSUE The surge line/hot leg failure issue relates the potential failure of ex-vessel piping and the RCS pressure response to failure of the reactor vessel lower head.

Consistent with NUREG-1150, the issue can be stated as follows:

What is the probability 1that the surge line or hot leg will fail and, depressurize the RCS to a low pressure before lower head failure?

As was done in NUREG-1150, a low pressure was taken to be 1.38 MPa in this evaluation.

If the probability of the stated surge line/hot leg failure issue is high, the potential for high pressure melt ejection (HPME) and the associated potential for direct containment heating (DCH) is low.

Conversely, if the probability of the stated issue is low, the RCS pressure at the time of lower head failure could result in a HPME.

Under those conditions, the potential impact of OCH in the Surry NPP may require a detailed containment analysi~.

To facilitate quantification, the stated surge line/hot leg failure issue was decomposed into four separate probabilities. Those probabilities, which are also conditional on the occurrence of the specific TMLB' scenario in the Surry NPP, are Pl:

The probability of surge line failure as a function of time P2:

The orobability of hot leg failure as a function of time NUREG/CR-5949 G-4

Appendix G Surge line failure times were then calculated using the simple one-volume model with a fixed pressure (15.96 Mpa) and the altered vapor temperature histories as boundary conditions.

Heat transfer coefficients previously established to match TMLB' Base Case and TMLB' Case 2 predicted failures were used, as appropriate.

Since higher temperatures accelerate failure by creep rupture, surge :line failures earlier than those associated with the increased vapor temperatures were assumed to occur 5% of the time.

Conversely, sin~e lower temperatures delay failure by creep rupture, surge line failures earlier than those associated with the decreased vapor temperatures were assumed to occur 95% of the time.

Those results are summarized in Table G-1.

Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in Table

, G-1.

Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.05 ahd 0.95.

The linear assumption was made for simplicity, since there was no apparent basis' for any other distribution shape.

(Note that lower head failure times for the TMLB' cases were subtracted from the surge line failure times so that all results are expressed in terms of a common.reference.)

Results listed in Table G-1 are depicted in Figure G-2.

A combined probability distribution for surge line failure is also shown.

The combined distribution was determined by applying weighting fractions of 0.95 and 0.05 to results for the TMLB' Base Case arid TML6' Case 2, respectively.

Specifically, the distribution for the TMLB' Base Case was multiplied by 0.95, producing a peak probability of 0.95 at 234.2 minutes before lower head failure.

The combined distribution then remained flat until the distribution for TMLB' Case 2 became non-zero at 49.1 minutes before lower head failure.

At that point, the distribution for TMLB' Case 2 was multiplied by 0.05; and the resulting contribution was added to reach a probability of 1.0 at 36.4 minutes before lower head failure.

That method of combination was used in order to capture the range established by TMLB' Base Case and TMLB' Case 2 results.

The combined distribution shown in Figure G-2 indicates that surge line failures earlier than 255.5 minutes before lower head failure and surge line failures later than 36.4 minutes before lower head failure are not expected for TMLB' sequences without RCP seal leaks in the Surry NPP.

In addition, surge line fa,lures earlier than 234.2 minutes before lower head failure are expected 95% of the time.

G-1.1.2 P2--Probability of Hot Leg Failure as a Function of Time.

Hot leg creep rupture calculations with SCDAP/RELAP5/MOD3 are subject to the same uncertainties as described for the surge line creep rupture calculations (see Section G-1.1.1).

Specifically, RCS pressures affecting the hot leg are we~l defined by PORV cycling, while potential uncertainties in the calculated hot leg temperatures could exist.

Because of the similarities, the approach used to evaluate the probability of surge line failure as a function of time was used to evaluate the probability of hot leg failure.

Specifically, it was assumed that the probability of hot leg failure could be inferred from the variation in failure times resulting from temperature uncertainties.

G-11 NUREG/CR-5949

Appendix G Table G-1.

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

TMLB' case Base 2

Surge line,failure time (min)a

-255. 5b

-254.4

-235.3

-234.2b

-49.lb

-48.5

-37.0

-36. 4b; Probability 0.00 0.05 0.95 1.00 0.00 0.05 0.95 1.00

a.

Lower head failure times were subtracted from surge line failure times to produce the listed results in terms of a common reference.

(Base Case and Case 2 lower head failures were calculated to occur 482.0 and 260.1 minutes after TMLB' initiation, respectively.

Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b.

Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95.

1.0.----~--.---,rl,t---,---,---"T----r--~---.---r---,c------.----..1---.---,

0.8

~ 0.6

c

.c 0...

a. 0.4 0.2 0.0

-300.0 G- -> Base Case 13- -£J Case 2

-- Combined distribution

-200.0

-100.0

• Time prior to calculated lower head failure (min)

I I

I I

I I

I I

I I

I I

0.0 Figure G-2.

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

NUREG/CR-5949 G-12

Appendix G A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the hot leg subjected to potential temperature variations.

Compared to the simple one-volume model of the surge line, the one-volume hot leg model was refined to accommodate both carbon and stainless steel material properties. That refinement was based on the configuration of the hot leg nozzle and piping in the area of interest, depicted in Figure G-3.

As shown in Figure G-3, stainless steel hot leg piping is welded to a carbon steel hot leg nozzle in the Surry NPP.

The nozzle itself is clad with stainless steel, which was assumed to be negligible from a creep rupture perspective.

The most vulnerable areas for failure were assumed to be in the necked-down section of the carbon steel nozzle just upstream of the weld, in the areas immediately adjacent to the weld (which could be weakened as a result of the welding process}, and in the stainless hot leg just downstream of the weld.

(It should be noted that the thickened portions of the nozzle were not modeled based on the assumption that those sections would not be as vulnerable to failure as the areas described.)

Field weld Nozzle Forgin~ ?\\

/

Reactor Coolant

..____, __ (_A-508, Clas/ /

(316 S.S.)

Piping

~;::;:;::;::=========~"+~*=::::::=:=::::::.::::::::::::::::8:8:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::*;;.:

L--

s. S. Clad*

(11a" Thick)

Outlet

_L

\\ Safe-end

~5in.

Reactor Vessel Wall (A-508, Class 2 and A-533, Grade B, Class 1)

Figure G-3.

Configuration of the hot leg nozzle and hot leg piping in the Surry NPP.

G-13 NUREG/CR-5949

• Appendix G Carbon and stainless steel material properties were incor~orated into the simple one-volume model so that associ ated1 creep rupture data for both materials could be used to represent the a~eas of concern.

However, the areas immediately adjacent to the weld could not be addressed, since creep rupture data for materials adversely affected by welding are not available in SCDAP/RELAP5/MOD3.

Furthermore, gathering such data for incorporation into the code was beyond the scope of this project.

(It should be noted that stainless steel properties were used exclusively in the one-volume surge line model, since the stainless steel surge line is welded to stainless steel hot leg piping.)

The simple one-volume model had to be benchmarked before hot leg failures resulting from potential temperature variations could be calculated.

Hot leg vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 results for the TMLB' Base Case and TMLB' Case 2 as a first step in benchmarking.

A constant pressure of 15.96 Mpa (representing the midpoint between the opening and *closing pressures of the cycling PORVs) and the extracted vapor t~mperatures were used as.hot leg boundary conditions.

Heat transfer coefficients from the vapor to the hot leg were then adjusted until hot leg failure times using the simple one-volume model matched failure times predict~d in the TMLB' cases.

Stainless steel material properties were used in the benchmarking process, consistent with the modeling used in the.TMLB' cases. That approach effectively simulated the pressure and temperature conditions leading to the hot leg failures and provided reasonable heat transfei coefficients for use in subsequent calculations with the one-volume model.

The extracted temperature histories were then altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup in the TMLB' cases.

The resulting hot leg vapor temperature histories for Case 2 are shown With respect to th~ nominal history in Figure G-4 as an example.

As indicated, hot leg temperatures were varied by +/-20% relative to the temperature at the start of heatup (at about 150 min).

(Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the hot

_ leg at those levels.) The resulting variations represent possible heatup rates if the hot leg vapor temperatures are either under-or overpredicted.

Based on the potential uncertainties affecting hot leg temperatures (including ox1dation and radiation, as discussed in Section G-1.1.1), it was assumed that hot leg vapor temperatures increased by 20% should not be exceeded more than about 5% of the time.

It was also assumed that hot leg vapor temperatures decreased by 20% should be exceeded about 95% of the time.

Those assumptions were intended to represent the range of uncertainty associated with hot leg heating.

It is not possible to more definitively

- establish the range of uncertainty within the scope of this project.

However, the assumptions could be easily modified at some future date if warranted.

Hot leg failure times were then calcul~ted using the simple one-volume model with a fixed pressure (15.96 Mpa) and the altered vapor temperature histories as boundary conditions.

Heat transfer coefficients previously NUREG/CR-5949 G-14

q -

~

~

Q) a.

E Q)

I-Appendix G 2500.0.----~---.----~--~--~--~--~--~

2000.0 1500.0 1000.0 500.0 100.0

~

nom temp+ 20%

-- nomtemp

[3----£] nom temp - 20%

150.0 200.0 Time (min) 250.0 300.0 Figure G-4.

TMLB' Case 2*hot leg vapor temperature histories for estimation of hot leg failure probabili~ies.

established to match TMLB' Base Case and TMLB' Case 2 predicted failures were used as appropriate.

In an attempt to estimate the possibility of an early hot leg failure, carbon steel properties were used in conjunction with vapor temperatures that_

had-been -increased by 20%.

Since-higher temperatures accelerate-failure by creep rupture and since a given temperature will induce a carbon steel failure before a stainless steel failure, hot leg failures earlier than the corresponding failures were assumed to occur 5% of the time.

Stainless steel properties were used in conjunction with vapor temperatures that had been decreased by 20% to estimate the possibility of a late hot leg failure.

Since lower temperatures delay failure by creep rupture and since stainless steel will fail later than carbon steel at a given temperature, hot leg failures earlier than the corresponding failures were assumed to occur 95% of the time.

Those results are summarized in Table G-2.

• Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in Table G-2.

Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.05 and 0.95.

As previous~y discussed, the linear assumption was made for simplicity; since there was no apparent basis for any other distribution shape.

(Note that lower head failure times for the TMLB' cases were subtracted from the hot leg failure times so that all results are expressed in terms of a common reference.)

Results listed in Table G-2 are depicted in Figure G-5.

A combined probability distribution for hot leg fai~ure is also shown.

The combined distribution was determined by applying weighting fraciions of 0.95 and 0.05 G-15 NUREG/CR-5949

Appendix G Table G-2.

Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

TMLB' case Hot leg failure time (min)a Base

-246.?b

-244.2

-199.2

-196. 7b 2

-43.3b

-41.7

-13.3

-11. 7b Probability 0.00 0.05

0. 95, 1.00 0.00 0.05 0.95 1.00

a.

Lower head failure times ~ere subtracted from hot leg failure times to produce the listed results in terms of a common reference.

(Base Case and Case 2 lower head failures were calculated to occur 482.0 and 260.l minutes after TMLB' initiation, respectively.

Note that a negative result indicates hot leg failure before the calculated time of lower head failure.)

b.

Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95.

0.8

~ 0.6

~

.£l e a.. 0.4 0.2 0.0

-300.0; G- -E> Base Case C3- -£J Case 2

-- Combined distribution

-200.0

-100.0 Time prior to calculated lower head failure (min)

I I

I I

I I

I I

I I

I I

I 0.0 Figure G-5.

Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal, leaks in the Surry NPP.

NUREG/CR-5949 G-16

Appendix G to results for the TMLB' Base Case and TMLB' Case 2, respectively.

Specifically, the distribution for the TMLB' Base Case was multiplied by 0.95, producing a peak probability of 0.95 at 196.7 minutes before lower head failure.

The* combined distribution then remained flat until the distribution for TMLB' Case 2 became non-zero at 43.3 minutes pefore lower head failure.

At that point, the distribution for TMLB' Case 2 was multiplied by 0.05; and the resulting contribution was added to reach a probability of 1.0 at 11.7 minutes before lower head failure. That method of combination was used in order to capture the range established by TMLB' Base Case and TMLB' Case 2 results.

The combined distributiqn shown in Figure G-5 indicates that hot leg failures earlier than 246.7 minutes before lower head failure and hot leg failures later than 11.7 minutes before lower head failure are not expected for TMLB' sequences without RCP seal leaks in the Surry NPP.

In addition, hot leg failures earlier than 196.7 minutes before lower head failure are expected 95% of the time.

G-1.1.3 P3--Probability that the RCS Pressure is Low as a Function of Time.

The probability of reaching low pressure (< 1.38 MPa) in the RCS is controlled by a surge line break for TMLB' sequences without RCP seal leaks, since the probability for surge line failure is higher than the probability of hot leg failure as a function of time (see combined probability distributions shown in Figures G-2 and G-5).

Although the break size that could result from a surge line creep rupture is unknown, results from a previous calculation indicate that a break equal to 32% of the surge line flow area should depressurize the Surry NPP from full system pressure to 1.38 MPa in about 5 minutes.G* 4 Furthermore, a break as small as 5% of the surge line was estimated to be sufficient to achieve the specified pressure reduction before lower head failure in either the TMLB'-

Base Case or TMLB' Case 2.

On that basis, break size does not appear to be critical in establishing this probability di~tribution if it is assumed that a break of at least 5% would result if creep rupture of the surge line occurred.

(A 5% break is sufficient to depressurize, and larger breaks would only provide additional margin between reaching the specified pressure and lower head failure.)

Therefore, a depressurization time of 10 minutes was assumed to allDw for uncertainties in the depressurization rate without the need to directly determine and use a potential break size.

The resulting probability di*stribution for reaching a low RCS pressure is given in Tabl~ G-3 and depicted in Figure G-6.

The distribution was calculated by shifting the combined distribution in Figure G-2 by 10 minutes.

Based on Table G-3 data and the distribution shown in Figure G-6, depressurization to 1.38 MPa earlier than 245.5 minutes before lower head failure and depressurization to 1.38 MPa later than 26.4 minutes before lower head failure would not be expected if TMLB' sequences without RCP seal leaks occur in the Surry NPP.

In addition, the RCS should be depressurized 224.2 minutes before lower head failure about 95% of the time.

G-17 NUREG/CR-5949

Appendix G Table G-3.

Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

Time to reach a low RCS pressure (min)a

-245.5

-224.2

-39.1

-26.4 Probability 0.00 0.95 0.95 1.00

a.

Results are listed with respect to a common reference of zero at the calculated lower head failure time.

Note that a negative result indicates RCS depressurization before the calculated time of lower head failure.

0.8

~ 0.6

g

.c e

a. 0.4 0.2

-200.0

-100.0 0.0 Time prjor to calculated lower head failure (min)

Figure G-6.

Probability distribution for reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences without RCP s~al 1 1 eaks in_ the Surry NPP.

NUREG/CR-5949 G-18

Appendix G.

G-1.1.4 P4--Probability of Lower Head Failure as a Function of Time.

The SCDAP/RELAP5/MOD3 ca 1 cul at ion of 1 ower head creep rupture is primarily affected by (a) debris/coolant heat transfer during molten relocation to the lower head, (b) melt/lower head contact resistance, (c) uncertainties in the creep rupture analysis for large radii, and (d) in-core crust heat transfer.

Items (a) ~nd (b) are controlled by user input.

Both inputs were selected to accelerate lower head failure in the TMLB' Base Case and TMLB' Case 2.

(As discussed in the body of this report, other core damage progression inputs of lesser impact were also modeled to accelerate lower head failure.)

Items (c) and (d) are controlled by models implemented in SCDAP/RELAP5/MOD3, as discussed below.

Code creep rupture caltulations are based on one-dimensional temperature profiles through a specified wall.

The calculations are reasonably accurate for moderately sized pipes (i.e., the surge line and hot legs).

However, accuracy decreases as the radii associated with the wall increases, since the one-dimensional nature of the model does not allow for transmittal of temperature/pressure-induced stresses along the wall.

Scoping calculations based on detailed two-dimensional structural analyses of lower head geometries indicate that the SCDAP/RELAP5/MOD3 prediction of lower head creep rupture will be early.

Crusts supporting in-core molten pools are primarily cooled by radiation to the surrounding vapor.* (Radiation to intact fuel rods is calculated if the crust forms above the. bottom of the core.)

However, radiation from an in~core crust to heat structuies representing the reactor vessel internals is not calculated. Since some of those internals (particularly the lower core.

support plate and other structures in t~e lower p1enum) could be relatively cool, crust temperatures may be too high~ promoting ~arly crust failure, relocation, arid l~wer head failure.

Based on the foregoing, it should be clear that all of the primary effects treated by the code tended to accelerate relocation and lower head failure in the TMLB' Base Case and TMLB' Case 2.

From that perspective~ lower head failures earlier than those predicted by the code should have lbw probabilities.

However, relocation (in the current version of the code) cannot occur without failure of the crust supporting the *in-core molten p*ool.

There are three other potential relocation mechanisms that could lead to earlier relocations (and lower head failures), in~lOding: (a) the plunger effect, (b) radial spreading of molten materials to the core former plates, and (c) melt formation in the region adjacent to the core former plates.

Attempting to determine the earliest potential for relocation and lower head failure, either through crust failure or any alternate mechanism; provides a way to begin probability quantification, as discussed below.

A relatively stable crucible of solidified materials could retain an in-

. core molten pool.

If materials suddenly slump into the pool from above, some of the molten materials could spill over the top of the crucible and relocate to the lower head as a result of a plunger action.

After a review of TMLB' Base Case and TMLB' Case 2 results, it was concluded that relocation due to the plunger effect would not be expected before the code calculated crust failure.

Material slumping into the molten pool could occur in both cases.

G-19 NUREG/CR-5949

Appendix G However, any slumping into the pool would be expected to occur gradually, consistent with the nature of the heatup in the two cases.

Gradual slumping could result in small spills, which would tend to solidify before reaching the lower head.

In other words, relocation and lower head failure as a result of the plunger effect would not be expected before the code calculated lower head failure if TMLB' sequences without RCP seal leaks occurred in the Surry NPP.

Some amount of radial spreading could occur as core materials begin to melt.

If the molten region spreads to a point of contact with the core former plates, the former plates could also melt, resulting in relocation through the core bypass region with a potential for a subsequent lower head failure.

The time required to melt the former plates was conservatively neglected in evaluation of this potential.

It was also assumed that any relocation that resulted from radial spreading would be larg~ enough to cause a lower head failure.

In other words, the probability of lower head failure given a core bypass relocation was conservatively assumed to be 1.0.

Based on the first appearance of molten materials and a spreading rate typical of TMI-2 (estimated to be 0.06 mm/setond by the SCDAP development staff), a potential lower head failure as a result of radial spreading could have occurred 148.2 minutes earlier than the code prediction in the TMLB' Base Case and 6.8 minutes after the code prediction in TMLB' Case 2.

Melting of fuel rods on the core periphery could develop under conditions of uniform core heating.

Like the process of radial spreading, melting on the core periphery could result in a core bypass relocation with a potential for a subsequent lower head failure.

Outer channel core melting did not occur before the calculated crust failure, relocation, and lower head failure in TMLB' Case 2.

However, there was some relatively early outer channel melting in the TMLB' Base Case.

Conservatively neglecting the time required to melt the core former plates and assuming that the core bypass relocation was large enough to cause a lower head failure, lower head failure could have occurred 175.5 minutes before the time calculated by the code in the Base Case.

From the foregoing, it should be clear that the lower head could have failed 175.5 minutes before the code calculated time in the TMLB' Base Case, while the code calculation was the earliest lower head failure time for TMLB' Case 2.

It was assumed that failures earlier than either of those failures would not be expected more than 1% of the time.

That assumption was based on the conservative nature of the code calculations (which tend to produce early

.lower head failures) and the fact that alternate mechanisms were also considered to incorporate the potential for even earlier lower head failures.

Probability quantification can be completed using results from TMLB' Cases 3 and 5.

Specifically, those results indicate that debris/coolant heat transfer, which amounts to debris quenching limited only by the availability of water in the lower head, can extend lower head survival by 73.9 minutes.

Assuming that debris quenching is not strongly dependent on RCS pressure and assuming that debris/coolant heat transfer accounts for about half of the conservatism in the code calculations of lower head failure as previously discussed, lower head failure could be as late as (2 x 73.9 minutes, or) 147.8 minutes after the code-calculated times.

therefore, it was assumed that lower NUREG/CR-5949 G-20

Appendix G head failures earlier than the code calculation plus 147.8 minutes would occur about 99% of the time in the TMLB' Base Case and TMLB' Case 2.

Results of the quantification for the probability of lower head failure are summarized in Table G-4.

Failure times at the endpoint probabilities of 0.0 and 1.0 are also included.

Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.01 and 0.99.

As previously discussed, the linear assumpti~n was made for simplicity, since there was no apparent basis for any other distribution shape.

(Note that results are listed with respect to a common reference of zero at the calculated lower head failure time.)

Results listed in Table G-4 are depicted in Figure G-7.

A combined probability distribution for lower head failure is also shown.

The combined distribution was determined by applying weighting fractions of 0.95 and 0.05 to results for the TMLB' Base Case and TMLB' Case 2, respectively.

Specifically, the distribution for the TMLB' Base Case was multiplied by 0.95 over the domairn from -178.8 to 151.1 minutes; and the distribution for TMLB' Case 2 was multiplied by 0.05 over the domain from -1.5 to 149.3 minutes.

The weighted distributions were then summed in order to capture the range established by TMLB' Base Case and TMLB' Case 2 results.

The weighting fractions were selected to reflect the assumption that the TMLB' Base Case conditions (i.e., hot leg countercurrent natural circulation) are most likely based on Westinghouse natural circulation experiments.

The combined distribution shown in Figure G-7 indicates that lower head failures earlier than 178.8 minutes before the calculated failure time and lower head failures later than 151.1 minutes after the calculated failure time would not be expected if TMLB' sequences without RCP seal leaks occur in the Surry NPP.

G-1.1.5 Recombination of Probabilities Pl through P4.

The combined distribution shown in Figure G-6 represents the probability of having a surge line failure that will depressurize the RCS to a low pressure given the occurrence of TMLB' sequences without RCP sea1 leaks in the Surry NPP.

The probability of a lower head failure is represented by the combined distribution shown in Figure G-7.

Those distributions overlap, as shown in Figure G-8.

Therefore, derivatives of the distributions with respect to time were calculated to give the corresponding PDFs shown in Figure G-9.

Equation (G-1) was applied to the PDFs, as explained in Section G-1.

Specifically, the integration limits in Equation (G-1) were reset consistent with non-zero values of PLP. 1 and PLH. 2 and evaluated to give J

-26.4J 151.1 p = -245.5 t, p LP.1 p LH.2dt 2dt 1 = 0

• 98 (G-11) where G-21 NUREG/CR-5949

Appendix G Table G-4.

Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

TMLB' case Base 2

Lower head failure time (min)a

-178.8b

-175.5 147.8 151.lb

-1. 5b 0.0 147.8 149.3b Probability 0.00 0.01 0.99 1.00 0.00 0.01 0.99 1.00

a.

Results are listed with respect to a common reference of zero at the calculated lower head failure time.

(Base Case and Case 2 lower head failures were calculated to occur 482.0 and 260.1 minutes after TMLB' initiation, respectively.

Note that a negative result indicates lower head failure before the calculated failure time.)

b.

Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution.between probabilities of 0.01 and 0.99.

1.0.----r----.------,-----,-----,-----,----,lldj-----,

0.8

~ 0.6

c ctl

.0 0

~

D... 0.4 0.2 G- -El Base Case G- -£J Case 2

-- Combined distribution I

I I

I I

I I

I I

I I

I I

I I

0.0 '---.ep..~.1.--~~......... ~~_.__~___,l!!I'--~~.....__~~-'--~~-'--~~--'

-200.0

-100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-7.

Lower head failure probabilities as a function of time given the occurrence of'TMLB' sequences without RCP seal leaks in the Surry NPP.

NUREG/CR-5949 G-22

Appendix G 1.0 ~-~-------------------/---

0.8

-~ 0.6

~

.c e a.. 0.4 0.2

/

/

-- RCS depressu rization

/

Lower head failure

/

/

/

/

/

/

/

/

/

/,

/

/

/

/

/

/

0.0.___........ __

.__L..-......._ _ __. __

J....__...J

-300.0

-200.0

-100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-8.

Probability qf the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP sea1 leaks in the Surry NPP.

0.050 ------------------------

0.040

• en

~ 0.030

'C

~

j 0.020 0....

a..

0.010

-- RCS depressurization Lower head failure

-245.5

-26.4

-f78.8 -

151.1 0.000...._ _ __....__...__......._.......___._ __

.___....r....,,_.____._ __

_.,.c _

-300.0

-200.0

-100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-9.

Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

G-23 NUREG/CR-5949

Appendix G I

P *

= the probability of the surge line/hot leg failure issue given

~~,

=

the occurrence of'TMLB' sequences without RCP seal leaks in the Surry NPP the PDF representing the probability of depressurizing the RCS following a surge line failure given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP integrated with respect to time t, P~.2 the PDF representing the probability of lower head failure given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP integrated with respect to time t 2

• Therefore, the 'probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences witrout RCP seal leaks in the Surry NPP is 0.98.

G-1.2 Issue Probability for TMLB' Sequences with RCP Seal Leaks This section contains the probability quantification for the surge line/hot leg failure issue given the occurren~e of TMLB' sequences with RCP seal leaks in the Surry NPP.

As discussed in Section G-1, 1 the surge line/hot leg failure issue was decomposed into four separate probabilities denoted Pl through P4.

Sections G-1.2.l through G-1.2.4 contain evaluations of the separate probabilities Pl through P4, which are also conditional on the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP.

The surge line/hot leg failure issue probability for this scenario was then' obtained through recombination of the separate probabilities. That recombination is outlined in Section G-1.2.5.

Quantification was primarily based o~ SCDAP/RELAP5/MOD3 results for TMLB' Cases 3 through 6, as described in the body of this report.

Weighting factors applicable to the results from each case were needed to complete the quantification.

The basis for selection of those weighting factors is explained below.

Seal leak rate probabilities were established for Westinghouse RCPs by a panel of expertsG*

5 for use in NUREG-1150.

The leak rate probabilities covered RCPs with the new a-ring seal materials as well as the RCPs with the old materials, as is the case for the Surry NPP.

Discrete seal leaks ranging from 21 to 480 gpm per RCP were considered.

For the old a-ring materials, the highest probabilities were assigned to a leak rate of 250 gpm per RCP, moderate probabilities were assigned to a leak rate of 21 gpm per RCP, and very low probabilities were assigned to the potential for leaking 480 gpm per RCP.

Two simplifying assumptions were made regarding the NUREG-1150 probabilities, since the subject calculations were only performed at leak,

rates of 250 and 480 gpm per RCP.

First, it was assumed that a leak rate of 21 gpm per RCP is small enough to be eliminated from consideration in this scenario. A combined leak rate of 63 gpm (21 gpm per RCP) represents less than 1% of the capacity of the Surry PORVs.

It is believed that such a leak NUREG/CR-5949 G-24

Appendix G would be too small to reduce RCS pressure below the PORV setpoint before lower head failure.

As a result, the RCS would remain at high pressure controlled by PORV cycling.

(However, the PORV cycles would be somewhat shorter than those calculated in the TMLB' cases without RCP seal leakage.)

The probability quantification given in Section G-1.1 should cover those conditions.

And second, it was assumed that seal leak rates of 250 and 480 gpm per RCP should be quantified separately. That assumption was based ori the large differences between the leak rate probabilities according to NUREG-1150 and the knowledge that the ex-vessel response is also significantly different.

Since the probability of the surge line/hot leg failure issue was quantified separately for seal leaks of 250 and 480 gpm per RCP, weighting factors were also developed separately, as outlined below.

I A seal leak rate of 250 gpm per RCP was assumed in TMLB' Cases 3 and 5.

The only difference between those cases was i~ debris/coolant heat transfer during molten relocation to the lower head.

Debris/coolant heat transfer was not modeled in Case 3, while complete quenching (limited only by the availability of water in the lower head) was modeled in Case 5.

As such, the cases represent upper and lower bounds on initial debris temperatures driving lower head thermal attack.

It was assumed that results from Cases 3 and 5 should be given equal weight, since the actual debris temperature will fall between those bounds.

Therefore, probability quantification of the surge line/hot leg failure issue for a seal leak of 250 gpm per RCP was developed based on an equal weighting of the probabilities Pl through P4 as derived from Case 3 and Case 5 results.

A seal leak rate of 480 gpm per RCP was assumed in TMLB' Cases 4 and 6.

The only difference between those cases was in the user inputs defining the extent of ballooning (deformation) allowed in the fuel cladding.

In Case 4, deformation was limited to 2%, while rupture deformations up to 15% were used in Case 6~

Those values were selected to cover the expected range based on experimental data.

On that basis, it was assumed that results from Cases 4 and 6 should be given equal weight.

Therefore, probability quantification of the surge line/hot leg failure issue for a seal leak of 480 gpm per RCP was developed based on an equal weighting of the probabilities Pl through P4 as derived from Case 4 and Case 6 results.

G-1.2.1 Pl--Probability of Surge Line Failure as a Function of Time.

Surge line creep rupture calculations for TMLB' Cases 3 through 6 are subject to potential pressure uncertainties in addition to the temperature uncertainties previously described (see Section G-1.1.1).

It was assumed that the probability of surge line failure could be inferred from the variations in failure times resulting from both temperature and pressure uncertainties.

The potential pressure uncertainties are primarily associated with vaporization during core degradation.

Water addition through accumulator injection and debris/coolant heat transfer during molten relocation are the fundamental contributors to vapor production.

Accumulator water is injected into each cold leg of the Surry NPP whenever the RCS pressure drops below the accumulator pressure.

Vaporization begins as injected water flows from the downcomer and into the core.

The pressure increases as a result of the vaporization until the RCS pressure G-25 NUREG/CR-5949

Appendix G exceeds the accumulator pressure and accumulator injection stops.

The excess vapor must then be discharged through RCP seal leaks to reduce RCS pressure before accumulator injection can be repeat~d.

RCS pressurization could be either high or 1low, depending on the SCDAP/RELAP5/MOD3 prediction of heat transfer between the accumulator water and the reactor core.

Based on the maturity of the thermal-hydraulics portion of the code, the uncertainty in heat transfer for an intact core should be relatively low.

However, some uncertainty in the calculations could develop as flow paths and heat transfer surface areas are altered as a result of ballooning, oxidation, and general core degradation.

SCDAP/RELAP5/MOD3 provides an on/off option with rc~pect to debris/coolant heat transfer during molten relocation to the lower head.

With the option turned on, vaporization is allowed to proceed until all relocating molten debris is quenched or until the water in the lower reactor vessel head is depleted.

The amount of molten material relocated and the water inventory in the lower head could be either high or low.

On that basis, the RCS pressure resulting from the associated vapor production could also be either high or low.

The approach previously used to bound' potential temperature uncertainties for TMLB' sequences without RCP seal leaks was used to address potential temperature and pressure uncertainties in this scenario.

Specifically, a simple one-volume SCDAP/RELAPS/MOD3 model was developed to calculate the response of the stainless steel surge line subjected to potential temperature and pressure variations.

The simple one-volume model had to be benchmarked before those calculations could be made.

Surge line vapor temperature and pressure histories were extracted from the SCDAP/RELAPS/MOD3 results for TMLB' Cases 3 through 6 as a first step in benchmarking.

The extracted vapor temperatures and pressures were used as surge line boundary conditions.

Heat transfer coefficients from the vapor to the surge line were then adjusted until surge line response using the simple one-volume model matched the response predicted in the TMLB' cases.

That approach effectively simulated the surge line temperature and pressure conditions and provided reasonable heat transfer coefficients for use in subsequent calculations with the one-volume model.

The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties.

The extracted temperature histories were altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup in the TMLB' cases (consistent with the approach described in Section G-1.1.lJ.

The resulting surge line vapor temperature histories for Case 3 are shown with respect to the nominal history in Figure G-10 as an example.

As indicated, surge line temperatures were varied by +/-20% relative to the temperature at the start of heatup (at about 150 minutes).

(Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the surge line at those levels.)

Potential pressure uncertainties were addressed by varying accumulator injection and debris quenching pressure peaks by +/-20%.

Minimum pressures in the extracted histories were not altered, since they are based on accumulator pressures that are predicted with relatively little uncertainty.

The resulting surge line NUREG/CR-5949 G-26

sz -

Q)

~

Q) a.

E

~

Appendix G 2500.0,---------,------.-----.------,-----,.---~--~-~

2000.0 1500.0 1000.0 500.0 100.0 200.0 300.0 Time (min) fs:-----f:,. nom temp + 20%

-- nomtemp G---£J nom tern - 20%

400.0 500.0 Figure G-10.

TMLB' Case 3 surge line vapor temperature histories for estimation of surge line failure probabilities.

pressure histories for Case 3 are shown with respect to the nominal history in Figure G-11 as an example.

The variations shown in Figures G-10 and G-11 represent possible conditions that could occur if the surge line temperatures/pressures are either under-or overpredicted.

It was assumed that the combined conditions represented by surge line temperatures and pressures that were increased by 20% should not be exceeded more than about 5% of the time.

It was also assumed that the combined conditions represented by surge line temperatures and pressures that Jere decreased by ~0% should be exceeded about 95% of the time.

Those assumptions were based on the potential uncertainties affecting surge line temperatures (including oxidation and radiation as discussed in Section G-1.1.1) and the potential uncertainties affecting surge line pressures (including the effects of accumulator injection pnd debris/coolant heat transfer as previously discussed).

The assumptions were intended to represent the range of uncertainty associated with surge line temperatures and pressures.

It is not possible to more definitively establish the range of uncertainty within the scope of this project.

However, the assumptions could be easily modified at some future date if warranted.

Surge line failure times were then calculated using the simple one-volume model with the altered vapor temperature and pressure histories as boundary conditions.

Heat transfer coefficients previously established to match the surge line response in TMLB' Cases 3 through 6 were used as appropriate.

Since higher temperatures and pressures accelerate failure by creep rupture, G-27 NUREG/CR-5949 I

J

Appendix G 18.0 15.0 cu 12.0 a..

E -

~

9.0

~

~

a..

6.0 3.0

~

nom press+ 20%

-- nom press G---1 nom ress - 20% ~

0.0......_~_.__~....._~.......__~_._~......... ~---'-~--'-~~~~'--~....._~.........__~

100.0 150.0 200.0 250.0 300.0 350.0 400.0 Time (min}

Figure G-11.

TMLB' Case 3 surge line pressure histories for estimation of surge line failure probabilities.

surge line failures earlier than the failures associated with the combined conditions of increased temperature and pressure were assumed to occur 5% of the time.

Conversely, since lower temperatures and pressures delay failure by creep rupture, surge line failures earlier than the failures associated with the combined 'conditions of decreased temperature and pressure were assumed to occur 95% of the time.

Those results are summarized in Table G-5.

As indicated in Table G-5, creep rupture failures of the surge line were not calculated (for the temperature/pressure variations that were considered}

before molten relocation and lower head failure in Cases 4 and 6.

Therefore, the probability of surge line failure in those cases was taken to be 0.0.

With respect to Cases 3,and 5, however, a 20% increase in surge line temperature/pressure histories was sufficient to induce creep rupture failures.

As indicated in Table G-5, the corresponding failure times were assigned a probability of 0.05 consistent with the previously discussed assumptions.

Unfortunately, creep rupture failures were not calculated for a 20% decrease in the temperature/pressure histories. Obviously, a probability distribution cannot be established on the basis of a single point (at a probability of 0.05).

However, nominal temperature/pressure histories for Cases 3 and 5 did result in calculated failures (at adjusted times of -68.6 minutes and -142.5 minutes, respectively).

Probabilities were established for the nominal failure times (to allow generation of probability distributions) as described below.

NUREG/CR-5949 G-28

Appendix G Table G-5.

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP.

TMLB' case 3

4 5

6 Surge line failure time (min)a

-104.8

-178.7 Probability 0.05 0.05

a.

Lower head failure times were subtracted from surge line failure times to produce the listed results in terms of a common reference.

(Lower head failures were calculated to occur 405.7, 432.9, 479.6, and 389.8 minutes after TMLB' initiation in TMLB' Cases 3 through 6, respectively.

Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b.

NC means that creep rupture failure was not calculated before molten relocation and lower head failure.

Nominal temperature histories. (with a fixed pressure of 15.96 MPa) resulted in surge line failures at adjusted times of -244.5 and -44.6 minutes in the TMLB' Base Case and TMLB' Case 2, respectively.

Based on TMLB' Base Case and TMLB' Case 2 surge line failure distributions given in Table G-1, those failure times correspond to probabilities of 0.52 and 0.34, respectively.

Given the TMLB' Base Case weighting fraction of 0.95 and the TMLB' Case 2 weighting fraction of 0.05, surge line failures based on nominal temperature/pressure histories have a probability of approximately 0.5 (0.95*0.52 + 0.05*0.34) given the occurrence of TMLB' sequences without RCP seal leaks in the Surry NPP.

Therefore, surge line failure times associated with nominal temperature/pressure conditions in TMLB' Cases 3 and 5 were assumed to have probabilities of 0.5.

TMLB' Case 3 and 5 failure times at endpoint probabilities of 0.0 were extrapolated by assuming a linear distribution of failure times between the probabilities of 0.05 and 0.5.

The linear assumption was made for simplicity, since there was no apparent basis for any other distribution shape.

Failure times for probabilities greater than 0.5 were not determined.

However, it is known that surge line failure probabilities do not reach unity before lower head failure.

Therefore, the linear probability distributions for Cases 3 and 5 were assumed to be capped at a maximum probability of 0.5.

The corresponding results are summarized in Table G-6.

(Note that lower head failure times for the TMLB' cases were subtracted from the surge line failure times so that all results are expressed in ierms of a common reference.)

G-29 NUREG/CR-5949

Appendix G Table G-6.

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

TMLB' case 3

5 Surge line failure time (min)a

-108.Bb

-104.8

-68.6c

-182.7b

-178.7

-142.5c Probability 0.00 0.05 0.50 0.00 0.05 0.50

a.

Lower head failure times were subtracted from surge line failure times to produce the listed results in terms of a common reference.

(Lower head failures were calculated to occur 405.7 and 479.6 minutes after TMLB' initiation in TMLB' Cases 3 and 5, respectively.

Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b.

Failure times at the endpoint probability of 0.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.50.

c.

Failure times at a probability of 0.50 were estimated based on surge line failure times at nominal pressure/temperature conditions and surge line results associated with TMLB', sequences without RCP seal leaks in the Surry NPP.

Although it was not investigated, it is believed that the probability cap of 0.5 could be higher.

Surge line failures in TMLB' Cases 3 and 5 are predicted for nominal temperature/pressure conditions, while failures are not predicted if nominal temperature/pressure conditions are decreased by 20%.

Therefore, there must be a point between nominal temperature/pressure conditions and the decreased temperature/pressure conditions where surge line failures would still occur.

For example, surge line failures in TMLB' Cases 3 and 5 could reasonably be expected if nominal temperatures/pressures were only decreased by 1%.

Based on the assumptions given to establish the probability cap at 0.5 and the assumption of a linear probability distribution, failures at nominal temperatures/pressures decreased py 1% should be given a probability somewhat greater than 0.5.

Therefore, without further investigation, one can conclude that the probability cap of 0.5 is conservative from an HPME standpoint.

Investigation to remove conservatism is not justified, since (a) hot leg failures occur before surge line failures in this scenario and (b) the issue decomposition requires failure in only one of the two ex-vessel components in order to mitigate the potential consequences of a HPME.

NUREG/CR-594:

G-30

Appendix G Results listed in Table G-6 are depicted in Figure G-12.

The combined probability distribution (as shown) was determined by applying equal weight to the results in Table G-6.

Specifically, the distribution for TMLB' Case 3 was multiplied by 0.5 over the domain from -108.8 to -68.6 minutes; and the distribution for TMLB' Case 5 was multiplied by 0.5 over the domain from

-182.7 to -142.5 minutes.

The weighted distributions were then summed in order to capture the range established by the separate results.

Based on the table data and the combined distribution, surge line failures earlier than 182.7 minutes before lower head failure are not expected for TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

In addition, a maximum probability for surge line failure of 0.5 is expected 68.6 minutes before lower head failure.

G-1.2.2 P2--Probability of Hot Leg Failure as a Function of Time.

Hot leg creep rupture calculations in TMLB' Cases 3 through 6 are subject,to the same temperature and pressure uncertainties previously described for the surge line creep rupture calculations (see Section G-1.2.1).

Because of the similarities, the approach used to evaluate the probability of surge line failure as function of time was used to evaluate the probability of hot leg failure.

Specifically, it was assumed that the probability of hot leg failure could be inferred from the variations in failure times resulting from temperature and pressure uncertainties.

1.00 ~---~---~---~---~---~---~

0.80

-~ 0.60

~

.0 e a.. 0.40 0.20 0.00

-200.0 G--> Case 3 C3- -J Case 5

-- Combined distribution

/

ri

/

/

/

/

fl

/

/

-150.0

/

I cl

-100.0

,/

/

/

/

/

Time prior to calculated lower head failure (min)

-50.0 Figure G-12~

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

G-31 NUREG/CR-5949

Appendix G A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the hot leg subjected to potential temperature and pressure variations.

As discussed in Section G-1.1.2, carbon and stainless steel material properties were incorporated into the model so that the areas most vulnerable to creep rupture could be analyzed.

The simple one-volume model had to be benchmarked before hot leg failures resulting from potential temperature/pressure variations could be calculated.

Hot leg vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 results for TMLB' Cases 3 through 6 as a first step in benchmarking.

The extracted vapor temperatures and pressures were used as hot leg boundary conditions.

Heat transfer coefficients from the vapor to the hot leg were then adjusted until the hot leg response using the simple one-volume model matched the response predicted in the TMLB' cases.

Stainless steel material properties were used in the benchmarking process, consistent with the modeling used in the TMLB' cases. This approach effectively simulated the hot leg pressure and temperature conditions and provided reasonable heat transfer coefficients for use in subsequent calculations with the one-volume model.

The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties.

The extracted temperature histories were altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup in the TMLB' cases consistent with the approach described in Section G-1.1.2.

The resulting hot leg vapor temperature histories for Case 4 are shown with respect to the nominal history in Figure G-13 as an example.

As indicated, hot leg temperatures were varied by +/-20% relative to the temperature at the start of heatup (at about 140 minutes).

(Vapor temperatures prior to heatup were of no interest, since they remain near the saturation temperature and do not contribute to the cumulative creep damage of the hot leg at those levels.) Potential pressure uncertainties were addres~ed by varying accumulator injection and debris quenching pressure peaks by +/-20% consistent with the approach described in Section G-1.2.1.

Minimum pressures in the extracted histories were not altered, since they are based on accumulator: pressures that are predicted with relatively little uncertainty.

The resulting hot leg pressure histories for Case 4 are shown with respect to the nominal history in Figure G-14 as an example.

The variations shown in Figures G-13 and G-14 represent possible conditions that could occur if the hot leg temperatures/pressures are either under-or overpredicted.

It was assumed that the combined conditions represented by hot leg temperatures and pressures that were increased by 20% should not be exceeded more than about 5% of the time.

It was also assumed that the combined conditions rep~esented by hot leg temperatures and pressures that were decreased by 20% should be exceeded about 95% of the time.

Those assumptions were based on the potential uncertainties affecting hot leg temperatures (including oxidation and radiation as discussed in Section G-1.1.1) and the potential uncertainties affecting hot leg pressures (including the effects of accumulator injection and debris/coolant heat transfer as discussed in Section G-1.2.1).

The assumptions were intended to represent the range of uncertainty associated with hot leg temperatures and pressures.

It is not possible to more definitively establish the range of uncertainty within the scope of this NUREG/CR-5949 G-32

S2' -

Appendix G 2500.0.-----.-----.----~----,.--~--~--~---

2000.0 1500.0 1000.0 e-----l nom temp + 20%

-- nomtemp t3------EJ nom tern - 20%

500.0.__ ___....__ __

100.0 200.0 300.0 Time (min) 400.0 500.0 Figure G-13.

TMLB' Case 4 hot leg vapor temperature histories for estimation of hot leg failure probabilities.

cu a..

E -

Q)

Cl)

Cl)

Q) a..

18.0 ---~---.----~--~---r-----.----r-----,

15.0 12.0 9.0 6.0 3.0 0.0 100.0 200.0 300.0 Time (min)

G---E> nom press + 20%

-- nom press 13--£1 nom ress - 20%

400.0 500.0 Figure G-14.

TMLB' Case 4 hot leg pressure histories for estimation of hot leg failure probabilities.

G-33 NUREG/CR-5949

Appendix G project. However, the asiumptions could be easily modified at some future date if warranted.

Hot leg failure times were then calculated using the simple one-volume model with the altered vapor temperature and pressure histories as boundary conditions.

Heat transfer coefficients previously *established to match the hot leg response in TMLB' Cas'es 3 through 6 were used as appropriate.

In an attempt to estimate the possibility of an early hot leg failure, cafbon steel properties were used in conjunction with vapor temperatures and pressures that had been increased by 20%.

Since higher temperatures and pressures accelerate failure by creep rupture and since a given temperature and pressure will induce a carbon steel failure before a stainless steel failure, hot leg failures earlier than the failures corresponding to carbon steel subjected to the combined conditions of increased temperature and pressure were assumed to occur 5% of the time.

Stainless steel properties were used in conjunction with vapor temperatures and pressures that had been decreased by 20% to estimate the possibility of a late hot leg failure.

Since lower temperatures and pressures delay failure by creep rupture and since stainless steel will fail later than carbon steel at a given temperature and pressure, hot leg failures earlier than the ~orresponding failures were assumed to occur 95% of the time.

Those results are summarized in Table G-7.

As indicated, creep rupture failures of the hot leg were not calculated (for the temperature/pressure variations that were considered) before molten relocation and lower head failure in Cases 4 and 6.

Therefore, the probability of hot leg failure in those cases was taken to be 0.0.

With respect to Cases 3 and 5, however, failure times were calculated for probabilities of 0.05 and 0.95 as indicated.

In addition, failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution of failure tim~s between probabilities of 0.05 and 0.95.

As previously discussed, the linear assumption was made for simplicity, since there was no apparent basis for any other distribution shape.

(Note that lower head failure times for the TMLB' cases were subtracted from the hot leg failure times so that all results are expressed in terms of a common reference.)

Results listed in Table G-7 are depicted in Figure G-15.

The combined probability distribution (as shown) was determined by applying equal weight to the results in Table G-7.

Specifically, the distribution for TMLB' Case 3 was multiplied by 0.5 over the domain from -110.8 to 24.3 minutes; and the distribution fo~ TMLB' Case 5 was multiplied by 0.5 over the domain from

-184.7 to -49.7 minutes.

The weighted distributions were then summed in order to capture the range established by the separate results.

The combined distribution indicates that hot leg failures earlier than 184.7 minutes before lower head failure and hot leg failures later than 24.3 minutes after lower head failure are not expected for TMLB' sequences with 250 gpm RCP seal le~ks

• in the Surry NPP.

NUREG/CR-5949 G-34

Appendix G Table G-7.

Hot leg failure probabilities as a function of time given the occurrence of TMLB' sequences* with RCP seal leaks in the Surry NPP.

TMLB' case 3

4 5

6 Hot leg failure time (min)a

-110.8

-104.0 17.5 24.3b NCC

-184. 7b

-177.9

-56.4

-49.7b Probability 0.00 0.05 0.95 1.00 0.00 0.05 0.95 1.00

a.

Lower head failure times were subtracted from hot leg failure times to produce the listed results in terms of a common reference.

(Lower head failures were calculated to occur 405.7, 432.9, 479.6, and 389.8 minutes after TMLB' initiation in TMLB' Cases 3 through 6, respectively.

Note that a negative result indicates hot leg failure before the calculated time of lower head failure.)*

b.

Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95.

c.

NC means that creep rupture failure was not calculated before molten relocation and lower head failure.

G-1.2.3 P3--Probability that the RCS :Pressure is Low as a Function of Time.

SCDAP/RE~AP5/MOD3 results for TMLB' Cases 3 through 6 indicate that the RCP seal leaks considered are sufficient to reduce the RCS pressure well below the setpoint of the PORVs.

However, the RCP seal leaks may or may not depressurize the RCS below 1.38 MPa before lower head failure because of the potential for repressurization associated with accumulator injections and debris/coolant heat transfer.

In other words, failure of the surge line

• and/or hot leg, which should adequately relieve any repressurization in most circumstances, may still be required to avoid 'an HPME.

The probability of depressurizing through a surge line or hot leg break (given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP) is discussed below.

As described in Sections G-1.2.1 and G-1.2.2, creep rupture failures were not calculated for either the surge line or the hot leg before molten relocation and lower head failure in TMLB' Cases 4 and 6.

Obviously, those results indicate that there is no potential for RCS depressurization through a G-35 NUREG/CR-5949

Appendix G 1.0 r------.---,------,v------.---B----r------,

0.8

~ 0.6 i

.0 e

a. 0.4 0.2 I

I I

I I

I I

I I

I I

I I

I I

I I

I I

I I

I

/

I I

I I

I I

e--0Case 3 13-EJ Case 5 Combined distribution Time prior to calculated lower head failure (min) 100.0 Figure G-15.

Hot leg failure probabilities as.a function of time given the occurrence TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

surge line or hot leg failure before lower head failure.

Therefore, this probability was taken to be 0.0 given the ~ccurrence of TMLB' sequences with seal leaks of 480 gpm per RCP in the Surry NPP.

I With respect to seal leaks of 250 gpm per RCP, both surge line and hot leg failures were predicted.

However, the probability of reaching low pressure in the RCS is controlled by a hot leg break for TMLB' sequences with seal leaks of 250 gpm per RCP, since the probability for hot leg failure is higher than the probability of surge line failure as a function of time (see combined probability distributions shown in Fi~ures G-12 and G-15).

Although the break size resulting from hot leg creep rupture is unknown, one would expect a hot leg rupture to be larger than a surge line rupture.

It was established in Section G-1.1.3 that a surge line creep rupture could depressurize the RCS from operating pressure to 1.38 MPa in 10 minutes.

With a larger rupture size expected and with the RCS pressure reduced by RCP seal leaks, it is quite conservative to assume RCS depressurization to 1.38 MPa within 10 minutes of hot leg creep rupture.

Probability distributions for reaching a low RCS pressure are given in Table G-8 on that basis. Specifically, the distributions were calculated by shifting the results for TMLB' Cases 3 and 5 given in Table G-7 by 10 minutes.

(Obviously, there was no reason to carry results for Cases 4 and 6 forward to Table G-8, since hot leg failures were not calculated.) Results listed in Table G-8 are depicted in Figure G-16.

The combined probability distribution NUREG/CR-5949 G-36

Appendix G Table G-8.

Probability of reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

TMLB' case 3

5 Time to reach a low RCS pressure (min)a

-100.8b

-94.0 27.5

34. 3b

-174.7b

-167.9

-46.4

-39. 7b Probability 0.00 0.05 0.95 1.00 0.00 0.05 0.95 1.00

a.

Lower head failure times were subtracted from the times required to reach a low RCS pressure to produce the listed results in terms of a common reference.

(Lower head failures were calculated to occur 405.7 and 479.6 minutes after TMLB' initiation in TMLB' Cases 3 and 5, respectively.

Note that a negative result indicates RCS depressurization before the calculated time of lower head failure.)

b.

Failure times at endpoint probabilities of 0.0 and 1.0 were extrapola~ed by assuming a linear distribution between probabilities of 0.05 and 0.95.

0.8

~ 0.6

0

('(I

.D 0

0:: 0.4 0.2 0.0 ~~~~~~~~~~~---'-~~~___,_~~~--'-~~~--'

-200.0

-100.0 0.0 100.0 Time prior to calculated lower head failure (min)

Figure G-16.

Probability distribution for reaching a low RCS pressure as a function of time given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

G-37 NUREG/CR-5949

Appendix G for reaching a low RCS pressure (as shown) was determined by applying equal weight to the results of Table G-8.

Specifically, the distribution for TMLB' Case 3 was multiplied by 0.5 over the domain from -100.8 to 34.3 minutes; and the distributipn for TMLB' Case 5 was multiplied by 0.5 over the domain from

-174.7 to -39.7 minutes.

The weighted distributions were then summed in order to capture the range established by the separate results.

Based on the table data and the combined distribution, RCS depressOrization to 1.38 MPa earlier than 174.7 minutes before lower head failure and RCS depressurization to 1.38 MPa later than 34~3 minutes after lower head failure would not be expected, given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

G-1.2.4 P4--Probability of Lower Head Failure as a Function of Time.

As discussed in Section G-1.1.4, the SCDAP/RELAP5/MOD3 calculation of lower head creep rupture is primarily affected by (a) 'debris/coolant heat transfer during molten relocation to the lower head, (b) melt/lower head contact resistance, (c) uncertainties in the creep rupture analysis for large radii, and (d) in-core crust heat transfer. Although, TMLB' Case 5 was used to investigate the effects of debris/coolant heat transfer, TMLB' Cases 3, 4, and 6 are similar to the TMLB' Base Case and TMLB' Case 2 in that all of those items tended to accelerate relocation and lower head failure.

From that perspective, lower head failures earlier than those predicted by'the code should have low probabilities.

However, the potential for earlier relocations (that are not currently considered by the code) should be evaluated, as discussed below.

A relatively stable crucible of solidified materials could retain an in-core molten pool.

If materials suddenly slump into the pool from above, some of the molten materials could spill over the top of the crucible and relocate to.the lower head as a result of a plunger action. After reviewing results from the subject cases, it was concluded that relocations due to the plunger effect would not be expected before the code calculated crust failures.

Material slumping into the molten pools could have occurred; however, any slumping into the pool would be expected to occur gradually, consistent with the nature of the predicted heatup in the subject cases.

Gradual slumping could result in small spills, which would tend to solidify before reaching the lower head.

In other words, relocation and lower head failure as a result of the plunger effect would not be expected before the code calculated lower head failure in the subject cases.

Some amount of radial spreading could occur as core materials begin to melt.

If the molten region spreads to a point of contact with the core former plates, the former plates could also melt, resulting in relocation through the core bypass region with a potential for a subsequent lower head failure.

The time required to melt the former plates was conservatively neglected in evaluation of this potential.

It was also assumed that any relocation that resulted from radial spreading would be large enough to cause a lower head failure.

In other words, the probability of lower head failure given a core bypass relocation was conservatively assumed to be 1.0.

Based on the first appearance of molten materials and a spreading rate typical of TMI-2 (estimated to.be 0.06 mm/second by the SCDAP development staff}, potential lower head failures as a result of radial spreading could have occurred in a NUREG/CR-5949 G-38

Appendix G range from 98.5 minutes after to 28.3 minutes after the code predictions in the subject cases.

Melting of fuel rods on the core periphery could develop under conditions of uniform core heating.

Like the process of radial spreading, melting on the core periphery could result in a core bypass relocation with a potential for a subsequent lower head failure.

With the exception of TMLB' Case 4, outer channel core melting did not occur before the calculated crust failure, relocation, and lower head failure in the subject cases.

A decision was made to disregard th~ relatively early outer channel melting in TMLB' Case 4, since that result appeared to be an unreasonable anomaly in the calculation.

Therefore, early relocation and lower head failures as a result of melting on the core periphery would not be expected before the code calculated lower head failures in the subject cases.

From the foregoing, it should be clear t~at the code-calculated failures appear to represent the earliest lower head failures times.that could be expected in TMLB' Cases 3, 4, and 6.

(TMLB' Case 5 will be handled separately, since debris/coolant heat transfer resulted in a delayed lower head failure.)

It was assumed that failures earlier than those calculated would not be expected more than 1% of the time.

That assumption was based on the conservative nature of the code calculations (which tend to produce early lower head failures) and the fact that alternate mechanisms were.also considered to incorporate the potential for even earlier lower head failures.

Probability quantification can be com~leted using results from TMLB' Cases 3 and 5.

Specifically, comparing results from those cases indicates that debris/coolant heat transfer, which amounts to debris quenching limited only by the availability of water in the lower head, can extend lower head survival by 73.9 minutes.

Assuming that debris/coolant heat transfer accounts for about half of the conservatism in the code calculations of lower head failure as previously discussed, lower head failure could be as late as. 147.8 minutes (2 x 73.9 minutes) after the code-calculated times.

Therefore, it was assumed that lower head fatlures earlier than the code calculation plus 147.8 minutes would occur about 99% of the time.

The calculated lower head failure time from TMLB' Case 3 (with an assumed probability of 0.01) and the calculated lower head failure time from TMLB' Case 3 plus 147.8 minutes (with an assumed probability of 0.99) effectively provides a range of lower head failure uncertainty for TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

That is because results from both (250 gpm RCP seal leak) Cases 3 and 5 were used to establish the distribution.

The calculated lower head failure times from TMLB' Cases 4 and 6 (with an assumed probability of 0.01) and the application of a late failure uncertainty of 147.8 minutes to the calculated lower head failure times (with an assumed probability of 0.99) provides separate distributions for those cases.

However, the distributions are equivalent when referenced to the time of calculated lower head failures (since TMLB' Case 4 and 6 results did not support failures earlier than calculated and since the Tate failure adjustment was the same in both cases).

The combined distribution for TMLB' sequences with seal leaks of 480 gpm per RCP is equal to the distributions for TMLB' Cases 4 and 6, since the separate distributions are equal.

G-39 NUREG/CR-5949

Appendix G Results of the quantification for the probability of lower head failure are summarized in Table G-9 on that basis.

As indicated, combined distributions are given for seal leaks of 250 gpm per RCP and for seal leaks of 480 gpm per RCP.

Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in the table.

Those values were extrapolated by assuming a linear distribution of failure times between probabilities of 0.01 and 0.99.

As previously discussed, the linear assumption was made for simplicity, since there was no apparent basis for any other distribution shape.

Results listed in Table G-9 are depicted; in Figure G-17.

The combined distribution for seal leaks of 250 gpm per RCP is equivale~t to the combined distribution for seal leaks of 480 gpm per RCP.

Therefore, lower head failures earlier than 1.5 minutes before the calculated failure time and lower head failures later than 149.3 minutes after those calculated would not be expected if TMLB' sequences with RCP seal leaks occur in the Surry NPP.

G-1.2.5 Recombination of Probabilities Pl through P4.

The combined distribution shown in Figure G-16 represents the probability of having a hot leg failure that will depressurize the RCS to a low pressure given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

The probability of a lower head failure is represented by the combined distribution shown in Figure G-17.

Those distributions overlap, as shown in Figure G-18.

Therefore, derivatives of the distributions with respect to time were calculated to give the corresponding PDFs shown in Figure G-19.

Equation (G-1) was applied to the PDFs, as explained in Section G-1.

Specifically, the integration limits in Equation (G-1) were reset consistent with non-zero values of PLP.i and PLH. 2 and evaluated to give

. I 34.3 I 149.3 p =

-174.7 t, PLP,,PLH,2dt2dt, = 0. 98 (G-12) where P

the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP PLPl

=

• the PDF representing the probability of depressurizing the RCS following a hot leg failure given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP integrated with respect to time t 1 the PDF representing the probability of lower head failure given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP integrated with respect to time t2.

NUREG/CR-5949 G-40

Appendix G Table G-9.

Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP.

TMLB' Sequence With seal leaks of 250 gpm per RCP With seal leaks of 480 gpm per RCP Lower head failure time (min)a I

-1. 5b 0.0 147.8 149.3b

-1. 5b 0.0 147.8 149.3b Probability 0.00 0.01 0.99 1.00 0.00 0.01 0.99 1.00

a.

Results are listed with respect to a common reference of zero at the calculated lower head failure times.

Note that a negative result indicates lower head failure before the calculated failure time.

b.

Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.01 and 0.99.

1.0 0.8

~ 0.6

0

<<s

.D 0

0:: 0.4 0.2 0.0 '--~....__~_.__~...__~..__~.....___~.....___~.....___~.....__~_.._~_.__~.....,__~_.

-100.0

-50.0 0.0 50.0 100.0 150.0 200.0 Time prior to calculated lower head failure (min)

Figure G-17.

Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with RCP seal leaks in the Surry NPP.

G-41 NUREG/CR-5949

Appendix G 1.0 ~-~--~--~--~-~~--~---/....------,

-- RCS depressurization Lower head failure 0.8

~ 0.6

~

.c e o... 0.4 I

0.2 I

I I

I I

I I

I I

I I

I I

I 0.0 ~~-~--~--~--......_ __

-200.0

-100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-18.

Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

~

• u5 C

Q)

"t:J

0 ca

.c 0...

0...

0.010 0.008 -

0.006 -

0.004 -

0.002

~

0.000

-200.0

-174.7 I

I I

, -- RCS depressurization I Lower head failure

,--------1 I

I I

I I

I I

I I

I I

I I

I I

I I

-1.5 11 34.3 l149.3 I

I

-100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-19.

Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP.

NUREG/CR-5949 G-42

Appendix G Therefore, the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 250 gpm per RCP in the Surry NPP is 0.98.

The probability of having a surge line or hot leg failure was 0.0 for TMLB' Cases 4 and 6 with seal leaks of 480 gpm per RCP (see Sections G-1.2.1 and G-1.2.2).

Obviously, there is no possibility for an associated RCS depressurization in those cases.

Therefore, the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with seal leaks of 480 gpm per RCP in the Surry NPP is 0.0.

G-1.3 Issue Probability for TMLB' Sequences with Stuck-Open/Latched-Open PORVs This section contains the probability quantification for the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

As discussed in Section G-1, the surge line/hot leg failure issue was decomposed into four separate probabilities, denoted Pl through P4.

Sections G-1.3.1 through G-1.3.4 contain evaluations of the separate probabilities Pl through P4, which are also conditional on the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

The surge line/hot leg failure issue probability for this scenario was then obtained through recombination of the separate probabilities.

That recombination is outlined in Section G-1.3.5.

Quantification was primarily based on SCDAP/RELAP5/MOD3 results for an intentional depressurization of the Surry NPP.G-6 A late depressurization strategy was considered.in that analysis, where it was assumed that plant operators would latch the PORVs open at the time core exit temperatures reached 922 K.

It should be recognized that the PORVs could be latched open or they could stick open at virtually any time during a TMLB' sequence.

In this evaluation, however, it was assumed that the probabilities for the su~ge line/hot leg failure issue would not be significantly altered by the* PORV opening time.

Furthermore, probabilities for both latched-open and stuck-open conditions were assumed to be equivalent.

Those assumptions were developed as follows.

It was determined that the surge line would fail before failure of the lower head if the late depressurization strategy were implemented in the Surry NPP.G-5 Results from previous analyses indicate the same result with respect to surge line failure if the PORVs are latched open at an earlier time.

Specifically, if the PORVs are latched open at the time of steam generator dryout, surge line failures are also predicted to occur before lower head failure.G*

7 (It should be noted that there are substantial differences in terms of core damage as a function of the time that the PORVs are latched open.

However, the level of core damage is of no concern in this particular issue.)

Based on current understanding and the available calculations, there is no reason to expect any difference in results applicable to this issue if any other relatively early PORV opening times were selected.

G-43 NUREG/CR-5949

Appendix G If the PORVs are latched open at some: time after core exit temperatures reach 922 K, RCS pressure control through PORV cycling would be extended.

Results from the TMLB' Base Case (described in the body of this report) indicate that PORV cycling subjects the surge line to heating at high pressure conditions.

If allowed to continue (i.e., if it is not interrupted by latching the PORVs open), surge line failure would occur more than 240 minutes ahead of lower head failure.

If the PORVs are latched open before surge line failure (i.e., before sufficient heating at high pressure has transpired), the ensuing RCS pressure reduction would result in cladding ruptures and the injection of accumulator water.

High-temperature steam from the subsequent boiloff and the some of the energy associated with oxidation of the inner surfaces of the ruptured cladding would be deposited in the surge line.

Surge line failure, as a result of the heating associated with boiloff and oxidation, would be expected ahead of lower head failure.

Based on current understanding and the available calculations, there is no reason to expect any difference in results applicable to this issue if relatively late PORV opening times are selected.

Therefore, the probability of the surge line/hot leg failure issue should not be significantly altered by the time that the PORVs are latched open.

A similar set of reasoning applies to the time that the PORVs could stick open.

In fact, there is no basis to differentiate between a latched-open condition and a stuck-open condition, given that the operators could latch the PORVs open or the PORVs could stick open at any given time.

Therefore, the probabilities for both latched-open and stuck-open conditions were assumed to be equivalent.

G-1.3.1 Pl--Probability of Surge Line Failure as a Function of Time.

Surge line creep rupture calculations during TMLB' sequences with stu~k-open/latched-open PORVs are subject to the temperature and pressure uncertainties previously described for TMLB' sequences with RCP seal leaks (see Section G-1.2.1).

Therefore, the quantification approach used in Section G-1.2.1 was used in this evaluation.

Specifically, it was assumed that the probability of surge line failure could be inferred from the variations in failure times resulting from both temperature and pressure uncertainties.

A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the stainless steel surge line subjected to potential temperature and pressure variations.

The simple one-volume model had to be benchmarked before those calculations could be made.

Surge line vapor temperature and pressure histories were extracted from the SCDAP/RELAP5/MOD3 intentional depressurization results as a first step in benchmarking.

The extracted vapor temperatures and pressures were used as surge line boundary conditions.

Heat transfer coefficients from the vapor to the surge line were then adjusted until the surge line response using the simple one-volume model matched the response predicted during the intentional depressurization calculation.

That approach effectively simulated the surge line temperature and pressure conditions and provided reasonable heat transfer coefficients for use in subsequent calculations with the one-volume model.

NUREG/CR-5949 G-44

Appendix G The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties.

The extracted temperature histories were altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup, consistent with the approach described in Section G-1.1.1.

Potential pressure uncertainties were addressed by varying accumulator injection and debris quenching pressure peaks by +/-20%,

consistent with the approach described in Section G-1.2.1.

The resulting surge line vapor temperature and pressure histories are shown with respect to the nominal histories in Figures G-20 and G-21, respectively.

The variations shown in Figures G-20 and G-21 represent possible conditions that could occur if the surge line temperatures/pressures are either under-or overpredicted.

It was assumed that the combined conditions represented by surge line temperatures and pressures that were increased by 20% should not be exceeded more than about 5% of the time.

It was also assumed that the combined conditions represented by surge line temperatures and pressures that were decreased by 20% should be exceeded about 95% of the time.

Those assumptions were based on the potential uncertainties affecting surge line temperatures (including oxidation and radiation, as discussed in Section G-1.1.1) and the potential uncertainties affecting surge line pressures (including the effects of accumulator injection and debris/coolant heat transfer, as discussed in Section G-1.2.1).

The assumptions were intended to represent the range of uncertainty associated with surge line temperatures and pressures.

It is not possible to more definitively establish the range of uncertainty within the' scope of this project.

However, the assumptions could be easily modified at some future date if warranted.

The surge line response was then calculated using the simple one-volume model with the altered vapor temperature and pres'sure histories as boundary conditions.

Heat transfer coefficients previously established to match the surge line response were used as appropriate.

Surge line failures were not calculated prior to relocation and lower head failure within the range of uncertainties considered.

On that basis, one might conclude that the probability of surge line failure is 0.0.

However, such a conclusion would be premature without some understanding of the code creep rupture calculation relative to intentional depressurization of the, Surry NPP, as discussed below.

SCDAP/RELAP5/MOD3 calculates creep rupture failures based on the time a specified component remains at a given temperature and pressure (which induces a stress).

The code calculation then relies on experimental data of failures that were recorded for a variety of materials subjected to a range of temperatures and stress levels.

However, e0trapolation is required, especially for low-stress conditions, since the experimental temperature and stress range was limited.

In contrast with TMLB' sequences with and without RCP seal leaks, surge line stresses are very low in the intentional depressurization calculation because the PORV effectively reduces the RCS pressure.

As a result, the extrapolated time to creep rupture failure is well beyond the time of relocation.

Therefore, creep rupture failures of the surge line were not predicted.*

Uncertainties in extrapolation of experimental creep rupture data to low-stress conditions prompted further evaluation.

Specifically, the calcul~ted G-45 NUREG/CR-5949

Appendix G 2500.0.-----,.--------.-----.----,---~------,-------,-----,

2000.0 S2' -

~

~ 1500.0 Q)

0.

E

~

1000.0 e---e nom temp + 20%

-- nomtemp 13--£1 nom temp - 20%

500.0..__ _ __... __

100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-20.

Surge line vapor temperature histories for estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the.Surry NPP.

18.0 15.0

- 12.0 CCI 0...

~ -

Q) 9.0 en en Q) 0...

6.0 3.0 0.0 I

100.0 200.0 300.0 Time (min)

<3-----e nom press+ 20%

.-- nom press C3-----J nom ress - 20%

400.0 500.0 Figure G-21.

Surge line pressure histories fQr estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

NUREG/CR-5949 G-46

Appendix G surge line stress levels were compared to the ultimate strength of stainless steel.

It was concluded that the ultimate strength of the surge line would be exceeded by the calculated stresses during intentional depressurization once the surge line reached approximately 1530 K. 8-6 Stresses that exceed the ultimate strength of the stainless steel should be sufficient to result in a surge line breach.

On that basis, it was assumed that failure could be expected by the time the surge line reached 1530 K.

Volume-averaged temperature histories of the surge line pipe, with variations predicted through use of the simple one-volume model to account for potential uncertainties during ex-vessel heatup, are depicted in Figure G-22.

A line was also drawn at the assumed failure temperature as a visualization aid.

Surge line failures at 371.4 and 483.5 minutes are indicated for heatup variations of +/-20%, respectively.

Surge line failure at -371.4 minutes was assigned a probability of 0.05 by assuming that a 20% increase in heatup should not be exceeded more than about 5% of the time.

A probability of 0.95 was assigned to the surge line failure at 483.5 minutes by assuming that a 20%

decrease in surge line heating should be exceeded about 95% of the time.

Those results are summarized in Table G-10.

Failure times at the endpoint probabilities of 0.0 and 1.0 are also included iri the table.

Those values were extrapolated by assuming a linear distribution of failure times between the probabilities of 0.05 and 0.95.

Note that the lower head failure time of 489.1 minutes was subtracted from the surge line failure times so that results are expressed in terms of a common reference.

Results listed in Table. G-10 are depicted in Figure G-23.

Based on the table data and the distribution shown in the figure, surge line failures Q) ct!

Q)

Q_

E

~

"C Q)

Ol ct!

Q) 2000.0 ~--~-~~-~--~------------

1500.0 G------0 nom temp + 20%

-- nomtemp C3----J nom temp - 20%

1530 K

~

1000.0 I

Q)

E 0 >

500.0 1----L----L-----J'------'-----'-----'-----'-----'

1 oo_o 200.0.

300.0 400.0 500.0 Time (min)

Figure G-22.

Surge line volume-averaged temperature histories for estimation of surge line failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

G-47 NUREG/CR-5949

Appendix G Table G-10.

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

Surge line failure time (min)a

-123.9b

-117.7

-5.6 0.6b Probability 0.00 0.05 0.95

1. 00

a.

Lower head failure time was subtracted from surge line failure time to produce the results in terms of a common reference.

(Lower head failure was calculated to occur 489.l minutes after TMLB' initiation during the intentional depressurization calculation.

Note that a negative result indicates surge line failure before the calculated time of lower head failure.)

b.

Failure times at endpoint probabilities of 0.0 and 1.0 were extrapolated by assuming a linear distribution between probabilities of 0.05 and 0.95.

0.8

~ 0.6

.a ro

..c 0...

a. 0.4 0.2 0.0 '--~~.u...-~~.....__~~--'-~~--'-~~--'-~~~'---~~..__~_____.

-150.0

-100.0

-50.0 0.0 50.0 I

Time prior to calculated lower head failure (min)

Figure G-23.

Surge line failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/l~tched-open PORVs in the Sorry NPP.

NUREG/CR-5949 G-48

Appendix G earlier than 123.9 minutes before lower head failure and surge line failures later than 0.6 minutes after lower head failure are not expected given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

In addition, surge line failures earlier than 5.6 minutes before lower head failure are expected 95% of the time.

G-1.3.2 P2--Probability of Hot Leg Failure as a Function of Time.

Hot leg creep rupture calculations during TMLB' sequences with stuck-open/latched-open PORVs are subject to the temperature and pressure uncertainties previously described for TMLB' sequences with RCP seal leaks (see Section G-1.2.2).

Therefore, the quantification approach used in Section G-1.2.2 was used in this evaluation.

Specifically, it was assumed that the probability of hot leg failure could be inferred from the variations in failure times resulting from both temperature and pressure uncertainties.

A simple one-volume SCDAP/RELAP5/MOD3 model was developed to calculate the response of the hot leg subjected to potential temperature and pressure variations.

As discussed in Section G-1.1.2, carbon and stainless steel material properties were incorporated into t'he model so that the areas most vulnerable to creep rupture could be analyzed.

The simple one-volume model had to be benchmarked before hot leg failures resulting from potential temperature/pressure variations could be calculated.

Hot leg vapor temperature histories were extracted from the SCDAP/RELAP5/MOD3 intentional depressurization results as a first step in benchmarking.

The extracted vapor temperatures and pressures were used as hot leg boundary conditions.

Heat transfer coefficients from the vapor to the hot leg were then adjusted until the hot leg response using the simple one-volume model matched the response predicted in the intentional depressurization calculation.

Stainless steel material properties were used in the benchmarking process, consistent with the modeling used in the calculation.

That approach effectively simulated the hot leg pressure and temperature conditions and provided a reasonable heat transfer coefficient for use in subsequent calculations with the one-volume model.

The extracted temperature and pressure histories were then altered in an attempt to account for potential uncertainties.

The extracted temperature histories were altered by +/-20% with respect to the calculated vapor temperatures at the beginning of RCS heatup, consistent with the approach described in Se~tion G-1.1.2.

Potential pressure uncertainties were addressed by varying accumulator injection and debris quenching pressure peaks by +/-20%,

consistent with the approach described in Section G-1.2.2.

The resulting hot leg vapor temperature histories are shown with respect to the nominal history in Figure G-24.

The altered hot leg pressure histories are not shown, since they are essentially equal to the surge line histories depicted in Figure'G-

21.

The resulting variations represent possible conditions that could occur if the hot leg temperatures/pressures are either under-or overpredicted.

It was assumed that the combined conditions represented by hot leg temperatures and pressures that were increased by 20% should not be exceeded more than about 5% of the time.

It was also assumed that the combined conditions represented by hot leg temperatures and pressures that were decreased by 20% should be exceeded about 95% of the time.

Those assumptions G-49 NUREG/CR-5949

Appendix G 3000.0 G-----e nom temp+ 20%

2500.0

-- nomtemp 13----EJ nom temp - 20%

S2' 2000.0 Cl)

~

ca 1500.0

~

Cl) a.

E Cl) 1000.0 I-

.500.0 0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-24.

Hot leg vapor temperature histories for estimation of hot leg failure probabilities given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

were based on the potential uncertainties affecting hot leg temperatures (including oxidation and radiation, as discussed in Section G-1.1.1) and the.

potential uncertainties affecting hot leg pressures (including the effects of accumulator injection and debris/coolant heat transfer, as discussed in Section G-1.2.1).

The assumptions were intended to represent the range of uncertainty associated with hot leg temperatures and pressures.

It is not possible to more definitively establish the range of uncertainty within the scope of this project.

However, the assumptions could be easily modified at some future date if warranted.

The hot leg response was then calculated.using the simple one-volume model with the altered vapor temperature and pressure histories as boundary conditions.

The heat transfer coefficient previously established to match the hot leg response was used as appropriate.

In an attempt to estimate the possibility of an early hot leg failure, carbon steel properties were used in conjunction with vapor temperatures and pressures that had been increased by 20%.

Since higher temperatures and pressures accelerate failure by creep rupture and since a given temperature and pressure will induce a carbon steel failure before a stainless steel failure, hot leg failures earlier than the failures corresponding to carbon steel subjected to the combined conditions of increased temperature and pressure were as~umed to occur 5% of the time.

Stainless steel properties were used in conjunction with vapor temperatures and pressures that had been decreased by 20% to estimate the possibility of a late hot leg failure.

Since lower temperatures and pressures delay failure by NUREG/CR-5949 G-50

Appendix G creep rupture and since stainless steel will fail later than carbon steel at a given temperature and pressure, hot leg failures earlier than the corresponding failures were assumed to occur 95% of the time.

However, hot leg failures were not calculated prior to relocation and lower head failure within the range of uncertainties considered.

The calculated hot leg stresses were very low because the Rq was depressuri:zed through the open PORVs.

As a result, creep ruptures were not predicted.

As discussed in Section G-1.3.1, an evaluation was needed to address uncertainties in the extrapolation of experimental creep rupture data to low-stress conditions.

As a first step, volume-averaged hot leg piping temperature histories for all three primary coolant loops were extracted from the intentional depressurization results, and depicted in Figure G-25.

As indicated, the highest hot leg piping temperatures occurred in the loop containing the pressurizer and PO'RVs.

{The primary coolant loops, including the pressurizei loop with component numbers in the 400's, were described in Appendix B of this report.) That result was expected, since a majority of the core decay energy is transferred through that hot leg and the surge line before being discharged through the PORVs.

However, the highest hot leg temperatures (reaching approximately 1300 K) are relatively cool compared to the surge line temperatures (see Figure G-22).

Furthermore, the calculated stresses during intentional depressurization are well below the ultimate strength of the hot leg, even at 1300 K.

If the highest hot leg temperature history was increased by 20% (with respect to temperatures at the beginning of heatup) to account for potential uncertainties, a margin of approximately 100 K would still exist between the point where the calculated stress approached the ultimate strength of the hot leg.

1400.0 ~-~-~--,----r-----r--,----r-----r---r----,

S2' 1200.0 e?

G--> Loop A hot leg

-- Loop 8 hot leg 13------fJ Loo C hot le cu Q)

0.

E

~

"C Q) g>

I Q)

E 0 >

1000.0 800.0 600.0 r---e---""'

400.0.._ _ _.__ _ _... __

_.__ _ _.__~--~--

0.0 100.0 200.0 300.0 400.0 500.0 Time (min)

Figure G-25.

Hot leg volume-averaged temperature histories for all three primary coolant loops during the intentional depressurization of the Surry NPP.

G-51 NUREG/CR-5949

• ",i

• , i

Appendix G Based on the foregoing creep rupture analysis and the temperature-related stress/strength evaluation, hot leg failures would not be expected before relocation and lower head failure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs -in the Surry NPP.

Therefore, the probability of hot leg failure was taken to be 0.0.

G-1.3.3 P3--Probability that the RCS Pressure is Low as a Function-of Time.

SCDAP/RELAPS/MOD3 results indicate that the RCS pressure drops well below 1.38 Mpa before lower head failure as a result of flow through the latched-open PORVs during the intentional depressurization of the Surry NPP.

However, probability P3 was structured to relate RCS depressurization to an ex-vessel failure.

Specifically, it is necessary to quantify the probability that the RCS pressure is low as a function of time following surge line/hot leg failure.

The following describes quantification of the probability consistent with that structure.

The probability is controlled by a surge line break for TMLB' sequences with stuck-open/latched-open PORVs, since hot leg failures were not calculated (see Sections G-1.3.1 and G-1.3.2).

Depressurization following the surge line break is unnecessary, since the RCS is depressurized below the target level by the latched-open PORVs.

Therefore, there is no need to add a delay time to allow for depressurization following the (controlling) surge line break.

On that basis, the probability distribution for reaching a low RCS pressure following a surge line/hot leg failure is equal to the distribution for surge line failure as given in Table G-10.

A graphical representation of the that distribution is shown in Figure G-23.

G-1.3.4 P4--Probability of Lower Head Failure as a Function of Time.

As discussed in Section G-1.1.4, the SCDAP/RELAPS/MOD3 calculation of lower head creep rupture is primarily affected by (a) debris/coolant heat transfer during molten relocation to the lower head, (b) melt/lower head contact resistance, (c) uncertainties in the creep rupture analysis for large radii, and (d) in-core crust heat transfer.

Debris/coolant heat transfer was included in the referenced intentional depressurization calculation.

However, the debris was not effectively cooled because the amount of relocated debris was large relative to the amount of lower head coolant available for quenching.

As a result, lower head creep rupture proceeded without delay as if debris/coolant heat transfer were not modeled.

In addition, the remaining items were modeled to accelerate lower head failure.

Since the primary effects treated within the calculation tended to accelerate lower head failure, lower head failures earlier than those predicted would be expected to have low probabilities.

Before quantification can be completed, however, the potential for earlier relocations and associated lower head failures (through mechanisms not currently considered by the code) should be evaluated, as discussed below.

The potential for molten relocations that could result from a plunger effect were described in Section G-1.1.4.

After reviewing results from the intentional depressurization calculation, it was concluded that relocations due to the plunger effect would not be expected before the code calculated crust failures.

Material slumping into the molten pool could have occurred; however, any slumping into the pool would be expected to occur gradually, consistent with the nature of the predicted heatup.

Gradual slumping could NUREG/CR-5949 G-52

Appendix G result in small spills, which would tend to solidify before reaching the lower head.

In other w9rds, relocation and lower head failure as a result of the plunger effect would not-be expec~ed before the code calculated lower head failure.

The potential for relocations that could result from the radial spreading of molten materials to the core former plates was also described in Section G-1.1.4.

The time required to melt the former. plates was conservatively neglected in evaluation of this potential.

The probability of lower head failure given a core bypass relocation was also conservatively assumed to be 1.0.

Based on the first appearance of molten materials and a spreading rate typical of TMI-2 (estimated to be 0.06 mm/second by the SCDAP development staff), potential lower head failures as a result of radial spreading could have occurred 29.3 minutes after the code prediction.

Melting of'fuel rods on the core periphery could develop under conditions of uniform core heating.

Like the process of radial spreading, melting on the core periphery could result in a core bypass relocation with a potential for a subsequent lower head failure.

However, outer channel core melting did not occur before the calculated crust failure, relocation, and lower head fail,ure in the referenced intentional depressurizatio~ calculation.

I From the foregoing, it should be clear that the code-qalculated failure appears to represent the earliest lower head failure time that could be expected.

It was assumed that failures earlier than the prediction would not be expected more than 1% of the time.

That assumption was based on the conservative nature of the code calculation (which tended to produce an early lower head failure) and the fact that alternate mechanisms were also considered to incorporate the potential for an even earlier lower head failure.

Probability quantification can be completed using results from TMLB' Cases 3 and 5.

Specifically, comparing results from those cases indicates that debris/coolant heat transfer, which amounts to debris quenching limited only by the availability of water in the lower head, can extend lower head survival by 73.9 minutes.

Although lower head survival was not extended in the subject calculation, such a result could have occurred if the amount of material relocated was lower and/or if the amount of lower head coolant was higher.

It could be argued that the necessary differences in the debris/coolant interaction are within the uncertainties associated with the current understanding of core damage progression.

Assuming that the necessary differences were calculated and assuming that debris/coolant heat transfer accounts for about half of the conservatism in the code calculations of lower head failure as previously discussed, lower head failure could be as late as 147.8 minutes (2 x 73.9 minutes) after the code-calculated time.

Therefore, it was assumed that lower head failures earlier than the code calculation plus 147.8 minutes would occur about 99% of the time.

Results of the quantification for the probability of lower head failure are summarized in Table G-11 on that basis.

Failure times at the endpoint probabilities of 0.0 and 1.0 are also included in the table.

Those values G-53 NUREG/CR-5949

Appendix G Table G-11.

Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

Lower head failure time (min)a

-1. 5b 0.0 147.8 149.3b Probability 0.00 0.01 0.99

1. 00

a.

Results are listed with respect fo a common reference of 'zero' at the calculated lower head failure time.

Note that a negative result indicatei lower head failure before*the calculated time.;

b.

Failure times at endpoint probabilities of 0.0 and 1.0 'were extrapolated by assuming a linear distribution between probabilities of 0.01 and 0.99.

were extrapolated by assuming a linear distribution of failure times between probabilities of 0.01 and 0.99.

As previously discussed, the linear assumption was made for simplicity,since there was no apparent basis for any other distribution shape.

Results listed in Table G-11 are depicted in Figure G-26.

As indicated, lower head failures earlier than 1.5 minutes before the calculated failure time and lower head failures later than 149.3 minutes after the calculated time would not be expected given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

G-1.3.5 Recombination of Probabilities Pl through P4.

The distribution shown in Figure G-23 represents the probability of having a surge line failure that will depressurize the RCS to a low pressure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

(As discussed in Section G-1.3.3, there was no need to shift the distribution shown in Figure G-23 to allow time for depressurization, since the pressure was effectively reduced through the open PORVs.)

The probability of a lower head failure is represented by the distribution shown in Figure G-26.

There is a slight overlap of the distributions, as shown in Figure G-27.

Therefore, derivatives of the distributions with respect to time were calculated to give the corresponding PDFs shown in Figure G-28.

Equation (G-1) was applied to the PDFs as explained in Section G-1.

Specifically, the integration limits in Equation (G-1) were reset consistent with non-zero values of PLP., and PLH. 2 and evaluated to give NUREG/CR-5949 G-54

0.8

-~ 0.6

g

.£l 0...

a.. 0.4 0.2 Appendix G 0.0......... _.......................................... _ ___. _ ___. _ ___.. _ __._ ________________ __._ _ __.

-100.0

-50.0 0.0 50.0 100.0 150.0 200.0 Time prior to calculated lower head failure (min)

Figure G-26.

Lower head failure probabilities as a function of time given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

1.0 ~--.------~--~----.-----.----I~---,

0.8

~ 0.6

0 ctl

.£l 0...

a.. 0.4 0.2 I

I I

I I

I I

I I

I I

I 1

1 -- RCS depressu rization I

Lower head failure 0.0......... _ __.......... __.___, __ ___. __

._..L __

-200.0

-100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-27.

Probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

G-55 NUREG/CR-5949 J\\

Appendix G

~

• u; C

Q)

"C

~

~

.Q 0...

a..

0.010 0.008....

0.006 -

0.004 I-0.002....

0.000

-200.0 I

I I

1-- RCS depressurization I Lower head failure I

I I

I I

I I

I I

I.

I I

I I

I

-123.9

-1.s I 0.6 I

1149.3 I

I

-100.0 0.0 100.0 200.0 Time prior to calculated lower head failure (min)

Figure G-28.

Probability density functions for the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP.

I 0.6 f 149.3 p =

-123.9 t, PLP,,PLH,2dt2dt, > 0.99:::::: 1.0 (G-13) where P

= the probability of the surge line/hot leg failure issue given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP PLPl

=

the PDF representing the probability of depressurizing the RCS following a surge line failure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP integrated with respect to time t, PLH. 2 =

the PDF representing the probability of lower head failure given the occurrence of TMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP integrated with respect to time t 2

• Therefore, the probability of the surge line/hot leg failure issue given the occurrence of tMLB' sequences with stuck-open/latched-open PORVs in the Surry NPP is 1.0.

NUREG/CR-5949 G-56

Appendix G G-2 RCS PRESSURE AT VESSEL BREACH ISSUE This issue provides a structure for defining the RCS pressure at the time of vessel breach given that ex-vessel failures do not occur.

The issue is an important aspect of the planned risk assessment in that issue results are needed for cases where surge line/hot leg failures do not depressurize the RCS before lower head failure.

Consistent with NUREG-1150, the issue was separated into high-, intermediate-, and low-pressure components to better characterize the RCS conditions at vessel breach.

Those components are P~:

The probability that the RCS pressure is greater than 6.89 MPa at the time of vessel breach given that ex-vessel failures do not occur P~t:

The probability that the RCS pressure is greater than 1.38 MPa but less than 6.89 MPa at the time of vessel breach given that ex-vessel failures do not occur P~:

The probability that the RCS pressure is less than 1.38 MPa at the time of vessel breach given that ex-vessel failures do not occur.

The following sections contain evaluations of the three probability components for each of the scenarios considered.

Specifically, Section G-2.1 contains the evaluation of the three components for TMLB' sequences without RCP seal leaks, Section G-2.2 contains the evaluation of the three components for TMLB' sequences with RCP seal leaks, and Section G-2.3 contains the evaluation of the three components for TMLB' sequences with stuck-open/latched-open PORVs.

It is important to not~ that the resulting probabilities are conditional on occurrence of the specific scenarios.

It is also important to note that the SCDAP/RELAP5/MOD3 calculations that were, used as a basis for evaluation were performed without accounting for the effects of potential ex-vessel piping failures.

Ex-vessel failures were recorded as predicted during the code calculations, but a corresponding RCS blowdown was not modeled.

In other words, the calculations that were used in the following evaluation were performed consistent with the structure of the issue.

G-2.1 Issue Probabilities for TMLB' Sequences without RCP Seal Leaks Probability quantification of the RCS pressure at vessel breach issue for this scenario was based on TMLB' Base Case and TMLB' Case 2 results, as described in the body of this report.

There were no RCS leaks in either calculation.

Therefore, the pressurizer PORVs were the only means for pressure control during the RCS boil off that was driven by core decay energy.

The PORVs controlled the RCS pressure by cycling between the opening and closing set points of 16.2* and 15.7 Mpa, respectively.

The results clearly indicate that the RCS pressures will remain high through the time of lower,

G-57 NUREG/CR-5949

Appendix G head failure.

Furthermore, uncertainties tn the calculated lower head failure time are unimportant, since PORV cycling is continuous.

Neglecting potential depressurization effects associated with the predicted ex-vessel failures (consistent with the probability definitions given in Section G-2), the probabilities for this scenario are G-2.2 Issue Probabilities for TMLB' Sequences with RCP Seal Leaks Probability quantification of* the RCS pressure at vessel breach issue for this scenario was based SCDAP/RELAP5/MOD3 results for TMLB' Cases 3 through 6, as described in the body of this report. All of those cases included RCP seal leaks that reduce the RCS pressure below the PORV setpoint before lower head failure.

However, quantification of probabilities for this issue must account for uncertainties in the lower head failure time and the RCS pressure response.

Those uncertainties and their effect on issue probabilities were evaluated separately for seal leaks of 250 and 480 gpm per RCP, as discussed below.

(The basis for separate evaluation was described in Section G-1.2.)

Seal leaks of 250 gpm per RCP were included in TMLB' Cases 3 and 5.

Uncertainties in the lower head failure times for those cases were evaluated in Section G-1.2.4.

As di.scussed in that section, lower head failures in TMLB' Cases 3 and 5 could occur at any time during a 150.8-minute window.

Specifically, it was determined that lower head failure could occur at any time within a window extending 1.5 minutes earlier to 149.3 minutes later than the calculated failure time in TMLB' Case 3.

It was also determined that lower head failure could occur at any time within a window extending 75.4 minutes earlier to 75.4 minutes later that the calculated failure time in TMLB' Case 5.

Based on the uncertainty evaluation, a failure window extending from 404.2 to 555.0 minutes is applicable to both cases, given the Case 3 and 5 calculated failure times of 405.7 and 479.6 minutes, respectively.

Vertical lines marking the failure windows are shown with respect to the RCS pressures for Cases 3 and 5 in Figures G-29 and G-30, respectively.

Horizontal lines are also drawn on the figures to mark the boundaries between high, intermediate, and low pressure ranges as an aid in quantification.

The probability of lower head failure is uniformly distributed across the 150.8-minute window, since the failure distributions were assumed to be linear (see Section G-1.2.4).

Therefore, it was assumed that the issue probabilities (defined in Section G-2) are proportional to the fractions of the failure windows that correspond to high, intermediate, and low RCS pressures.

Since the calculations were terminated shortly after calculated lower head failures (before 555.0 minutes), it was necessary to estimate the possible RCS pressure response within the failure windows so that the appropriate fractions could be measured.

Accumulator injection and debris/coolant heat transfer during relocation to the lower head are the primary mechanisms that could NUREG/CR-5949 G-58

18.0 15.0

- 12.0

<<I

a.

~ -

Q) 9.0 18 Q)...

a.

6.0 3.0 0.0 0.0 100.0 200.0 300.0 Time (min)

\\

400.0

\\

\\

\\

Appendix G 555.0

\\

1,

\\

I \\

\\

I

\\

\\

I

\\

\\

I

\\

\\ I

\\

'I

\\

500.0 J.38 600.0 Figure G-29.

RCS pressure for Surry TMLB' Case 3.

<> Divieion, Office or Region, U.S. NUCMM Regulatory ~.

and muing --:, if conttllCID,; pravo.

n.,,,. and maJing *dd-J EG&G Idaho, Inc.

Idaho Falls, ID 83415

9. SPONSORING ORGANIZATION -

NAME AND ADDRESS (if NRC, type *5.,,_ --**: t t:Otltrat:tor, prrNid9 NRC Division, Olfit>> or Reg101J, U.S. NueJNr Regulll.toty ~.

"1'~*Systems Research Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 -0001

. SUPPLEMENTARY NOTES

13. ABSTRACT (200 words or less)

Containment integrity could be challenged by direct heating associated with a high pressure melt ejection (HPME) of core materials following reactor vessel breach during certain severe accidents. Intentional reactor coolant system (RCS) depressurization, where operators latch pressurizer relief valves open, has been proposed as an accident man-agement strategy to reduce risks by mitigating the severity of HPME. However, decay heat levels, valve capacities, and other plant-specific characteristics determine whether the required operator action will be effective. Without oper-ator action, natural circulation flows could heat ex-vessel RCS pressure boundaries (surge line and hot leg piping, steam generator tubes, etc.) to the point of failure before vessel breach, providing an alternate mechanism for RCS de-pressurization and HPME mitigation.

This report contains an assessment of the potential for HPME during a Surry station blackout transient without operator action and without recovery. The assessment included a detailed transient analysis using the SCDAP/RELAP5/MOD3 computer code to calculate the plant response with and without hot leg countercurrent natural circulation, with and without reactor coolant pump seal leakage, and with variations on selected core damage progression parameters. RCS depressurization-related probabilities were also evaluated, primarily based on the code results.

12. KEY WORDS/DESCRIPTORS (List words or phrases lhst wiH assist rssearch9rs in locating the report.)

Surry, high pressure melt ejection direct containment heating NRC FORM 335 (2*89)

13. AVAILABILITY STATEMENT Unlimited

14. SECURITY CLASSIFICATION rn,;,,.,.,

Unclassified (llWaa_.,

Unclassified

15. NUMBER OF PAGES

16. PRICE

Printed on recycled paper Federal Recycling Program

.iTED STATES NUCLEA~ULA TORY.COMMISSION WASHINGTON, D.C. 20555-0001 OFFICIAL BUSINESS PENALTY FOR PRIVATE.USE, $300 1 1 AN 1 R K

---f? !155 51 3 g ~ :, ~

U~. ~,Rr-OA',M CATIOI\\IS SVCS

• -;,*Pl!RLI n1v FnIA.'*

TPS-PDR-NUREG P-211 DC 20555 l~ASHINGTON SPECIAL FOU SS RATE POSTAGE A, _,

USNRC PERMIT NO_, G-67